joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463d80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x5a2660], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push edi
jne 0x463da8
push 2
push 1
call fcn.004b6706
add esp, 8
mov esi, eax
jmp 0x463df5
push 0
push 0
push 0xffffffffffffffff
push 0x5a2660
push 0
push 0xfde9
call ebx
mov edi, eax
cmp edi, 1
jle 0x463df3
push 2
push edi
call fcn.004b6706
mov esi, eax
add esp, 8
test esi, esi
je 0x463df3
push edi
push esi
push 0xffffffffffffffff
push 0x5a2660
push 0
push 0xfde9
call ebx
cmp eax, edi
je 0x463df5
push esi
call fcn.004d1211
add esp, 4
xor esi, esi
cmp byte [0x52b2c8], 0
jne 0x463e0e
push 2
push 1
call fcn.004b6706
add esp, 8
mov edi, eax
jmp 0x463e5f
push 0
push 0
push 0xffffffffffffffff
push 0x52b2c8
push 0
push 0xfde9
call ebx
mov dword [ebp - 4], eax
cmp eax, 1
jle 0x463e5d
push 2
push eax
call fcn.004b6706
mov edi, eax
add esp, 8
test edi, edi
je 0x463e5d
push dword [ebp - 4]
push edi
push 0xffffffffffffffff
push 0x52b2c8
push 0
push 0xfde9
call ebx
cmp eax, dword [ebp - 4]
je 0x463e5f
push edi
call fcn.004d1211
add esp, 4
xor edi, edi
cmp dword [ebp + 0xc], 0
jne 0x463e69
xor ebx, ebx
jmp 0x463e7a
push 2
push 0x104
call fcn.004b6706
add esp, 8
mov ebx, eax
push ebx
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 4], 0
mov dword [ebp - 8], eax
je 0x463ec3
push 0
push 0
push 0x104
push dword [ebp + 0xc]
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
test eax, eax
jne 0x463ec3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
test ebx, ebx
je 0x463ed0
push ebx
call fcn.004d1211
add esp, 4
test edi, edi
je 0x463edd
push edi
call fcn.004d1211
add esp, 4
test esi, esi
je 0x463eea
push esi
call fcn.004d1211
add esp, 4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463fe0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
test edi, edi
jne 0x463ff9
xor esi, esi
jmp 0x46405d
cmp byte [edi], 0
jne 0x46400e
push 2
push 1
call fcn.004b6706
add esp, 8
mov esi, eax
jmp 0x464058
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call eax
mov ebx, eax
cmp ebx, 1
jle 0x464056
push 2
push ebx
call fcn.004b6706
mov esi, eax
add esp, 8
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test esi, esi
je 0x46405d
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call eax
cmp eax, ebx
je 0x464058
push esi
call fcn.004d1211
add esp, 4
xor esi, esi
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, dword [ebp - 4]
test edi, edi
jne 0x464075
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
jmp 0x46412e
cmp byte [edi], 0
jne 0x4640a1
push 2
push 1
call fcn.004b6706
add esp, 8
mov ebx, eax
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
test ebx, ebx
je 0x46412e
jmp 0x464125
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call eax
mov dword [ebp - 4], eax
cmp eax, 1
jg 0x4640c8
push 1
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
jmp 0x46412e
push 2
push eax
call fcn.004b6706
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4640e7
push 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
jmp 0x46412e
push dword [ebp - 4]
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call eax
cmp eax, dword [ebp - 4]
je 0x464119
push ebx
call fcn.004d1211
add esp, 4
push 1
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
jmp 0x46412e
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
push ebx
call fcn.004d1211
add esp, 4
test esi, esi
je 0x46413b
push esi
call fcn.004d1211
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d570
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 0x1c]
mov dword [ebp - 8], edx
mov ebx, ecx
push dword [ebp + 0x18]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004a9490
mov edi, edx
mov esi, eax
test edi, edi
jne 0x46d676
cmp esi, 0xffffffff
ja 0x46d676
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
push dword [ebp + 0xc]
imul eax, ecx
push ecx
mov dword [ebp - 4], eax
call fcn.004a9490
push edi
push edi
push edx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x46d5f5
call fcn.0044b6b0
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push str.read_sectors:_Could_not_access_sector_0x_08llx____s_n
call fcn.0044b0b0
or eax, 0xffffffff
add esp, 0x10
or edx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46d619
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp eax, esi
jne 0x46d619
cmp ecx, edi
je 0x46d66d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x46d62a
call fcn.0044b6b0
jmp 0x46d62f
mov eax, 0x52ad5a
push eax
push str.read_sectors:_Read_error__s_n
call fcn.0044b0b0
push edi
push esi
push dword [ebp - 4]
push str.__Read:__d__Expected:__llu_n
call fcn.0044b0b0
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x10]
push eax
push str.__StartSector:_0x_08llx__nSectors:_0x_llx__SectorSize:_0x_llx_n
call fcn.0044b0b0
mov eax, dword [ebp - 4]
add esp, 0x34
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.read_sectors:_nSectors_x_SectorSize_is_too_big_n
call fcn.0044b0b0
add esp, 4
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4714f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c4
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x18], 0x4e204f4e
mov ecx, 0xe5
mov dword [ebp - 0x14], 0x20454d41
mov esi, str.FAT32___1
mov word [ebp - 0x10], 0x2020
lea edi, [ebp - 0x5c0]
mov byte [ebp - 0xe], 0x20
rep movsd dword es:[edi], dword [esi]
push 0
push 0xb
mov ecx, 0x80
mov dword [ebp - 0xc], 0x4d9058eb
movsw word es:[edi], word [esi]
lea edx, [ebp - 0xc]
mov esi, 0x549b00
mov dword [ebp - 8], 0x4e495753
lea edi, [ebp - 0x228]
mov word [ebp - 4], 0x2e34
rep movsd dword es:[edi], dword [esi]
push 0
push 0
mov ecx, ebx
mov byte [ebp - 2], 0x31
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xaa550000
call fcn.0046d880
add esp, 0x10
test eax, eax
je 0x47160f
push 0
push 0xb
push 0
push 0x47
lea edx, [ebp - 0x18]
mov ecx, ebx
call fcn.0046d880
add esp, 0x10
test eax, eax
je 0x47160f
push 0
push 0x396
push 0
push 0x52
lea edx, [ebp - 0x5c0]
mov ecx, ebx
call fcn.0046d880
add esp, 0x10
test eax, eax
je 0x47160f
push 0
push 0x10
push 0
push 0x3f0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.0046d880
add esp, 0x10
test eax, eax
je 0x47160f
push 0
push 0x200
push 0
push 0x1c00
lea edx, [ebp - 0x228]
mov ecx, ebx
call fcn.0046d880
add esp, 0x10
test eax, eax
je 0x47160f
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push 0
push 0x10b
push 0
push 0
lea edx, [ebp - 0x110]
mov dword [ebp - 0x110], 0xc031fcfa
mov esi, ecx
mov dword [ebp - 0x10c], 0xd88ed08e
mov dword [ebp - 0x108], 0x8d7c00bd
mov dword [ebp - 0x104], 0xb8fbe066
mov dword [ebp - 0x100], 0xc08e1fe0
mov dword [ebp - 0xfc], 0xef89ee89
mov dword [ebp - 0xf8], 0xf30100b9
mov dword [ebp - 0xf4], 0x7c22eaa5
mov dword [ebp - 0xf0], 0xd88e1fe0
mov dword [ebp - 0xec], 0xc031d08e
mov dword [ebp - 0xe8], 0xbe8dc08e
mov dword [ebp - 0xe4], 0x5f601be
mov dword [ebp - 0xe0], 0x836d7580
mov dword [ebp - 0xdc], 0xff8110c7
mov dword [ebp - 0xd8], 0xf2727dfe
mov dword [ebp - 0xd4], 0x6e00c4e8
mov dword [ebp - 0xd0], 0x6361206f
mov dword [ebp - 0xcc], 0x65766974
mov dword [ebp - 0xc8], 0x72617020
mov dword [ebp - 0xc4], 0x69746974
mov dword [ebp - 0xc0], 0x66206e6f
mov dword [ebp - 0xbc], 0x646e756f
mov dword [ebp - 0xb8], 0xe8feeb00
mov dword [ebp - 0xb4], 0x657200a5
mov dword [ebp - 0xb0], 0x65206461
mov dword [ebp - 0xac], 0x726f7272
mov dword [ebp - 0xa8], 0x69687720
mov dword [ebp - 0xa4], 0x7220656c
mov dword [ebp - 0xa0], 0x69646165
mov dword [ebp - 0x9c], 0x6420676e
mov dword [ebp - 0x98], 0x65766972
mov dword [ebp - 0x94], 0xe8daeb00
mov dword [ebp - 0x90], 0x61700081
mov dword [ebp - 0x8c], 0x74697472
mov dword [ebp - 0x88], 0x206e6f69
mov dword [ebp - 0x84], 0x6e676973
mov dword [ebp - 0x80], 0x72757461
mov dword [ebp - 0x7c], 0x3d212065
mov dword [ebp - 0x78], 0x41353520
mov dword [ebp - 0x74], 0xb9eb0041
mov dword [ebp - 0x70], 0x720010e8
mov dword [ebp - 0x6c], 0x3e8126b6
mov dword [ebp - 0x68], 0xaa557dfe
mov dword [ebp - 0x64], 0xead175
mov dword [ebp - 0x60], 0xbb00007c
mov dword [ebp - 0x5c], 0x41b455aa
mov dword [ebp - 0x58], 0x327213cd
mov dword [ebp - 0x54], 0xaa55fb81
mov dword [ebp - 0x50], 0xc1f62c75
mov dword [ebp - 0x4c], 0xeb277401
mov dword [ebp - 0x48], 0x4001010
mov dword [ebp - 0x44], 0x7c0000
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x8458b00
mov dword [ebp - 0x34], 0x8b7cd1a3
mov dword [ebp - 0x30], 0xd3a30a45
mov dword [ebp - 0x2c], 0x4200b87c
mov dword [ebp - 0x28], 0xcd7cc9be
mov dword [ebp - 0x24], 0x4b8c313
mov dword [ebp - 0x20], 0x7c00bb02
mov dword [ebp - 0x1c], 0x8a024d8b
mov dword [ebp - 0x18], 0x13cd0175
mov dword [ebp - 0x14], 0xb4db31c3
mov dword [ebp - 0x10], 0x5e10cd0e
mov dword [ebp - 0xc], 0x3c56ac
mov word [ebp - 8], 0xf375
mov byte [ebp - 6], 0xc3
call fcn.0046d880
add esp, 0x10
test eax, eax
je 0x476db2
mov ecx, esi
call fcn.00475e30
test eax, eax
je 0x476db2
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x484070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
or edx, 0xffffffff
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [ebx + 0x10]
cmp edi, 4
ja 0x484091
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
sub edi, 4
push esi
mov dword [ebp + 0x10], edi
mov esi, 0
je 0x4841ef
mov ebx, dword [ebp + 0xc]
mov cl, byte [esi + ebx]
and cl, 0xfe
cmp cl, 0xe8
jne 0x4841e3
mov ecx, esi
sub ecx, edx
cmp ecx, 3
jbe 0x4840e5
xor eax, eax
mov dword [ebp - 4], eax
lea ecx, [ebx + 4]
mov edx, esi
add ecx, esi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], ecx
mov cl, byte [ecx]
test cl, cl
je 0x48411d
cmp cl, 0xff
je 0x48411d
add eax, eax
or eax, 1
jmp 0x4841e3
dec ecx
shl eax, cl
and eax, 7
mov dword [ebp - 4], eax
je 0x4840c3
movzx ecx, byte [eax + 0x518970]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x518968], 0
mov cl, byte [edx + ebx + 4]
je 0x484111
test cl, cl
je 0x484111
cmp cl, 0xff
jne 0x4840c3
add eax, eax
mov edx, esi
or eax, 1
jmp 0x4841e3
lea edi, [ebx + 3]
add edi, esi
mov dword [ebp - 0xc], edi
lea edi, [ebx + 2]
inc ebx
add edi, esi
add ebx, esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], ebx
movzx ebx, cl
mov ecx, dword [ebp - 0xc]
shl ebx, 8
movzx ecx, byte [ecx]
or ebx, ecx
movzx ecx, byte [edi]
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp - 8]
shl ebx, 8
movzx ecx, byte [ecx]
or ebx, ecx
mov ecx, dword [ebp + 8]
sub ebx, dword [ecx + 0xc]
sub ebx, esi
sub ebx, 5
test eax, eax
je 0x4841a7
movzx edi, byte [eax + 0x518970]
mov eax, 0x18
shl edi, 3
sub eax, edi
mov edx, ebx
mov ecx, eax
shr edx, cl
test dl, dl
je 0x484183
cmp dl, 0xff
jne 0x4841a1
mov ecx, 0x20
mov edx, 1
sub ecx, edi
shl edx, cl
mov ecx, dword [ebp + 8]
dec edx
xor ebx, edx
sub ebx, dword [ecx + 0xc]
sub ebx, esi
sub ebx, 5
jmp 0x484174
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
and ebx, 0x1ffffff
mov ecx, ebx
and ecx, 0x1000000
neg ecx
or ebx, ecx
mov ecx, dword [ebp - 8]
mov byte [ecx], bl
mov ecx, ebx
shr ecx, 8
mov byte [edi], cl
mov ecx, ebx
mov edi, dword [ebp - 0xc]
shr ecx, 0x10
shr ebx, 0x18
add esi, 4
mov byte [edi], cl
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp + 0x10]
mov byte [ecx], bl
mov ebx, dword [ebp + 0xc]
inc esi
cmp esi, edi
jb 0x4840a6
mov ebx, dword [ebp + 8]
mov ecx, esi
sub ecx, edx
cmp ecx, 3
jbe 0x484206
xor eax, eax
mov dword [ebx + 0x10], eax
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov dword [ebx + 0x10], eax
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x486e90
Capabilities:
Encode data using xor
Hash data using crc32b
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x486eb8
push 4
push 0x100
call fcn.004b6706
mov esi, eax
add esp, 8
mov dword [ebp + 8], esi
test esi, esi
je 0x486f6e
cmp dword [ebp + 0xc], 0
push ebx
push edi
mov edi, 1
je 0x486f0b
mov ebx, 0x80000000
nop word [eax + eax]
mov ecx, ebx
xor eax, eax
sar ecx, 0x1f
add ebx, ebx
and ecx, 0x4c11db7
xor ebx, ecx
test edi, edi
je 0x486ef8
lea edx, [esi + edi*4]
mov ecx, dword [esi + eax*4]
lea edx, [edx + 4]
xor ecx, ebx
inc eax
mov dword [edx - 4], ecx
cmp eax, edi
jb 0x486ee8
add edi, edi
cmp edi, 0x100
jb 0x486ed0
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x80
mov dword [esi], 0
mov dword [ebp - 4], edx
nop dword [eax]
mov eax, edi
lea ebx, [edx + edx]
and al, 1
lea edx, [esi + edx*4]
movzx eax, al
neg eax
sbb eax, eax
shr edi, 1
and eax, 0xedb88320
xor edi, eax
xor ecx, ecx
nop dword [eax]
mov eax, dword [esi + ecx*4]
add ecx, ebx
mov esi, dword [ebp - 4]
xor eax, edi
mov dword [edx], eax
lea eax, [esi*8]
mov esi, dword [ebp + 8]
add edx, eax
cmp ecx, 0x100
jb 0x486f40
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jne 0x486f20
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x486f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test edx, edx
je 0x486fad
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [edi + ecx*4]
sub edx, 1
jne 0x486f95
pop edi
pop esi
pop ebp
ret
Function at 0x48e7e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [0x5512ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push edi
mov edi, dword [ebp + 0x10]
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x39]
mov dword [ebp - 0x30], edi
push ecx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x40], 0
push ecx
lea ecx, [ebp - 0x58]
movlpd qword [ebp - 0x38], xmm0
push ecx
lea ecx, [ebp - 0x48]
push ecx
push 1
push eax
call fcn.0048e1e0
add esp, 0x1c
test al, al
jne 0x48e841
mov eax, dword [ebp - 0x40]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x38]
or eax, dword [ebp - 0x34]
push esi
jne 0x48e948
mov esi, dword [0x558ec4]
xorps xmm0, xmm0
mov edi, dword [ebp - 0x48]
movlpd qword [ebp - 0x38], xmm0
test esi, esi
jne 0x48e88c
push str.NtDeviceIoControlFile
push str.NtDll
call fcn.0048ddb0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x558ec4], esi
test esi, esi
je 0x48e945
push 0x90
lea eax, [ebp - 0xe8]
push 0
push eax
call fcn.004ab0f0
add esp, 0xc
lea eax, [ebp - 0xe8]
push 0x90
push eax
push 0x90
push eax
push 0x70048
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0
push edi
call esi
test eax, eax
js 0x48e8d8
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd4]
jmp 0x48e93f
cmp eax, 0xc0000010
jne 0x48e923
push 0x28
lea eax, [ebp - 0x2c]
xorps xmm0, xmm0
push eax
push 0x28
push eax
push 0x700a0
lea eax, [ebp - 0x50]
movq qword [ebp - 0xc], xmm0
push eax
push 0
push 0
push 0
push edi
movups xmmword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x1c], xmm0
call dword [0x558ec4]
mov edi, dword [ebp - 0x30]
test eax, eax
js 0x48e948
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
jmp 0x48e948
cmp eax, 0xc000000d
jne 0x48e945
lea eax, [ebp - 0x44]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x48e945
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
mov edi, dword [ebp - 0x30]
mov eax, dword [0x558ed0]
mov esi, dword [ebp - 0x48]
test eax, eax
jne 0x48e976
push str.NtClose
push str.Ntdll
call fcn.0048ddb0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x558ed0], eax
test eax, eax
je 0x48e979
push esi
call eax
mov eax, dword [ebp + 0xc]
cdq
push edx
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.004a9380
mov ecx, dword [ebp - 4]
mov dword [edi], eax
xor ecx, ebp
pop esi
mov dword [edi + 4], edx
xor eax, eax
pop edi
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
Function at 0x49bef0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x14]
push ebx
call fcn.004d122c
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
test esi, esi
jne 0x49bf1d
pop edi
pop esi
mov eax, 0x7f2bb746
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0
push esi
call fcn.004ab0f0
mov eax, dword [edi + 0x10]
mov edx, 0xff01
mov ecx, dword [eax + 0x64]
and ecx, 0x400
mov dword [ebp - 0x14], ecx
neg ecx
sbb ebx, ebx
mov ecx, dword [eax + 0x60]
mov eax, dword [ebp + 0xc]
and ecx, 2
mov dword [esi], eax
and ebx, 0xc
mov ax, word [esi + 6]
and ax, dx
shl ecx, 8
or ax, 1
movzx edx, cx
mov ecx, dword [ebp + 0x14]
movzx eax, al
or eax, edx
mov byte [esi + 8], 0x2e
mov word [esi + 6], ax
or edx, 2
mov eax, dword [edi + 0x14]
sub eax, ebx
mov dword [ebp - 0x10], ebx
sub eax, 0xc
mov ebx, 0x18
mov dword [ebp - 4], eax
mov eax, 0xc
mov word [esi + 4], ax
mov word [esi + 0x10], ax
mov eax, dword [ecx]
mov dword [esi + 0xc], eax
mov word [esi + 0x12], dx
lea edx, [esi + 0x18]
mov word [esi + 0x14], 0x2e2e
mov esi, dword [ebp + 0x18]
mov dword [ebp - 8], edx
lea eax, [esi - 4]
push eax
lea eax, [ecx + 4]
push eax
push edx
call fcn.004aab70
lea eax, [esi + 0x14]
add esp, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
push ecx
push eax
push edi
call fcn.0049dbc0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x49c0e0
mov ecx, dword [ebp - 4]
add ebx, ecx
mov eax, dword [ebp + 8]
add eax, ebx
cmp ebx, dword [ebp - 0xc]
jl 0x49bfc2
mov eax, dword [edi + 0x14]
sub eax, dword [ebp - 0x10]
push dword [ebp - 8]
sub eax, ebx
add ecx, eax
push ecx
push edi
mov dword [ebp - 4], ecx
call fcn.0049df70
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x49c0e0
cmp dword [ebp - 0x14], eax
je 0x49c02c
mov eax, dword [edi + 0x14]
mov ebx, dword [ebp + 8]
add eax, 0xfffffff4
add eax, ebx
push eax
push edi
call fcn.00494760
add esp, 8
jmp 0x49c037
test esi, esi
jne 0x49c0e0
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
push edi
call fcn.00496930
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x49c0e0
push dword [ebp + 0xc]
push eax
push ebx
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edi
call fcn.0049d2f0
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x49c0e0
mov eax, dword [edi + 0x10]
mov ebx, dword [ebp + 0x10]
test byte [eax + 0x60], 0x40
je 0x49c081
or dword [ebx + 0x20], 0x80000
and dword [ebx + 0x20], 0xefffffff
push 0
push 1
push ebx
push edi
call fcn.0049ad40
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x49c0e0
mov eax, dword [edi + 0x14]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
push 2
push esi
push ebx
push dword [ebp + 0xc]
push edi
call fcn.0049b310
mov esi, eax
add esp, 0x24
test esi, esi
jne 0x49c0e0
push ebx
push dword [ebp + 0xc]
push edi
call fcn.004915c0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x49c0e0
push 1
push dword [ebp - 0x1c]
push edi
call fcn.0048b460
add esp, 0xc
push dword [ebp + 8]
call fcn.004d1211
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a0620
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x5512ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x8c], ecx
movlpd qword [ebp - 0xd4], xmm0
mov dword [ebp - 0xcc], 0xf3bcc908
mov dword [ebp - 0xc8], 0x6a09e667
mov dword [ebp - 0xc4], 0x84caa73b
mov dword [ebp - 0xc0], 0xbb67ae85
mov dword [ebp - 0xbc], 0xfe94f82b
mov dword [ebp - 0xb8], 0x3c6ef372
mov dword [ebp - 0xb4], 0x5f1d36f1
mov dword [ebp - 0xb0], 0xa54ff53a
mov dword [ebp - 0xac], 0xade682d1
mov dword [ebp - 0xa8], 0x510e527f
mov dword [ebp - 0xa4], 0x2b3e6c1f
mov dword [ebp - 0xa0], 0x9b05688c
mov dword [ebp - 0x9c], 0xfb41bd6b
mov dword [ebp - 0x98], 0x1f83d9ab
mov dword [ebp - 0x94], 0x137e2179
mov dword [ebp - 0x90], 0x5be0cd19
test esi, esi
je 0x4a07b4
push edi
test ecx, ecx
jne 0x4a073b
cmp esi, 0x80
jb 0x4a073b
lea eax, [ebp - 0xd4]
push ebx
push eax
call fcn.004a07e0
mov ecx, dword [ebp - 0x8c]
add esp, 8
add dword [ebp - 0xd4], 0x400
adc dword [ebp - 0xd0], 0
sub ebx, 0xffffff80
add esi, 0xffffff80
jmp 0x4a07a5
mov eax, 0x80
mov edi, esi
sub eax, ecx
cmp esi, eax
cmovae edi, eax
lea eax, [ebp - 0x88]
push edi
add eax, ecx
push ebx
push eax
call fcn.004aab70
mov ecx, dword [ebp - 0x8c]
add esp, 0xc
add ecx, edi
add ebx, edi
sub esi, edi
mov dword [ebp - 0x8c], ecx
cmp ecx, 0x80
jne 0x4a07a5
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.004a07e0
add esp, 8
add dword [ebp - 0xd4], 0x400
adc dword [ebp - 0xd0], 0
xor ecx, ecx
mov dword [ebp - 0x8c], ecx
test esi, esi
jne 0x4a0700
mov eax, dword [ebp - 0xd8]
pop edi
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.004a1900
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop esi
pop ebx
call fcn.004a8b60
mov esp, ebp
pop ebp
ret