joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x5e0f00]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x808], ecx
push edi
xor edi, edi
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x459495
sub esi, edx
cmp esi, 0x7fffffff
ja 0x4594fb
xor edi, edi
push edi
push edi
push esi
push ecx
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x4594fb
cmp eax, 0x400
ja 0x4594fb
push eax
lea eax, [ebp - 0x804]
push eax
push esi
push dword [ebp - 0x808]
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x4594fb
cmp eax, 0x400
ja 0x4594fb
mov edi, eax
cmp edi, 0x400
jb 0x4594fb
xor eax, eax
mov word [ebp - 6], ax
jmp 0x459509
xor eax, eax
mov word [ebp + edi*2 - 0x804], ax
test edi, edi
je 0x459531
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x459531
shr eax, 4
pop edi
and eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3b35
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004d3b35
mov esp, ebp
pop ebp
ret
Function at 0x472650
Capabilities:
Check mutex on windows

Disassembly:
push esi
xor ecx, ecx
mov esi, 0x6073c8
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x472680
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edx, eax
xor eax, eax
mov ecx, edx
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x472680
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [0x6073c8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x6073d0]
test eax, eax
je 0x4726ea
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFree]
nop
cmp dword [eax + 4], 0
mov esi, dword [eax + 8]
jne 0x4726e3
mov ecx, dword [eax + 0x10]
cmp dword [ecx + eax], 1
jne 0x4726e3
sub dword [0x6073d8], ecx
mov ecx, esi
test esi, esi
je 0x4726c7
mov ecx, dword [eax + 0xc]
mov dword [esi + 0xc], ecx
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4726d3
mov dword [edx + 8], ecx
jmp 0x4726d9
mov dword [0x6073d0], ecx
push 0x8000
push 0
push eax
call edi
mov eax, esi
test esi, esi
jne 0x4726a0
pop edi
push dword [0x6073c8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop esi
ret
Function at 0x4728d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5e0f00]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push esi
push edi
test edx, edx
je 0x472a4c
test ecx, ecx
je 0x472a4c
cmp ecx, 0xffffdfff
ja 0x472a4c
cmp edx, ecx
mov edi, ecx
cmovbe edi, edx
add ecx, 0x1fff
add edi, 0x1fff
and ecx, 0xffffe000
and edi, 0xffffe000
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
test eax, eax
jne 0x47293f
push 0x10
call fcn.004e0093
add esp, 4
jmp 0x47294b
push dword [eax + 8]
mov eax, dword [eax]
push 0x10
call eax
add esp, 8
mov esi, eax
test esi, esi
je 0x472a4c
mov eax, dword [ebp - 0x2c]
push ebx
test eax, eax
jne 0x47296f
mov dword [esi], 0x401260
mov dword [esi + 4], 0x4012e0
mov dword [esi + 8], eax
jmp 0x47297d
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
cmp edi, dword [ebp - 0x30]
ja 0x4729e3
cmp edi, 1
jb 0x4729e3
push dword [esi + 8]
mov eax, dword [esi]
push 0x10
call eax
mov edi, eax
add esp, 8
test edi, edi
je 0x4729e3
mov eax, dword [0x6073cc]
test eax, eax
jne 0x4729b5
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x24]
dec eax
mov dword [0x6073cc], eax
mov ecx, dword [ebp - 0x30]
add ecx, eax
not eax
push 4
and ecx, eax
push 0x2000
push ecx
push 0
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
test ecx, ecx
jne 0x472a09
push dword [esi + 8]
mov eax, dword [esi + 4]
push edi
call eax
add esp, 8
push dword [esi + 8]
mov eax, dword [esi + 4]
push esi
mov dword [esi + 0xc], 0
call eax
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3b35
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2c]
add eax, ecx
mov dword [edi + 0xc], ecx
mov dword [edi + 4], eax
mov dword [edi + 8], eax
sub eax, dword [ebp - 0x34]
push eax
push edi
call fcn.0047b800
add esp, 8
test eax, eax
jne 0x472a31
push esi
push edi
call fcn.0047b2e0
jmp 0x4729e0
mov eax, dword [edi + 4]
mov dword [edi], eax
mov eax, esi
pop ebx
mov dword [esi + 0xc], edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3b35
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004d3b35
mov esp, ebp
pop ebp
ret
Function at 0x47b1a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor ecx, ecx
mov esi, 0x6073c8
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x47b1d3
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edx, eax
xor eax, eax
mov ecx, edx
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x47b1d3
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [0x6073c8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [ebp + 8]
mov edx, dword [esi - 8]
lea eax, [esi - 8]
sub dword [0x6073d4], edx
mov ecx, eax
sub ecx, dword [eax + 4]
cmp dword [ecx], 0
jne 0x47b206
add dword [ecx + 0x10], edx
mov eax, dword [ecx + 0x10]
mov dword [eax + ecx + 4], eax
jmp 0x47b22c
mov dword [eax + 0x10], edx
mov ecx, eax
mov edx, dword [0x6073d0]
mov dword [eax], 0
mov dword [esi], edx
mov dword [eax + 0xc], 0
test edx, edx
je 0x47b227
mov dword [edx + 0xc], eax
mov dword [0x6073d0], eax
mov esi, dword [ecx + 0x10]
cmp dword [esi + ecx], 0
lea edx, [esi + ecx]
jne 0x47b26d
mov eax, dword [edx + 0x10]
add eax, esi
push edi
mov dword [ecx + 0x10], eax
mov edi, dword [edx + 8]
test edi, edi
je 0x47b24e
mov eax, dword [edx + 0xc]
mov dword [edi + 0xc], eax
mov esi, dword [edx + 0xc]
mov eax, dword [edx + 8]
pop edi
test esi, esi
je 0x47b25e
mov dword [esi + 8], eax
jmp 0x47b263
mov dword [0x6073d0], eax
mov eax, dword [ecx + 0x10]
mov dword [eax + ecx + 4], eax
lea edx, [eax + ecx]
cmp dword [ecx + 4], 0
pop esi
jne 0x47b2c5
cmp dword [edx], 1
jne 0x47b2c5
mov eax, dword [0x6073d4]
mov edx, dword [0x6073d8]
sub edx, dword [ecx + 0x10]
lea eax, [eax + eax*2]
shr eax, 1
cmp edx, eax
jbe 0x47b2c5
mov dword [0x6073d8], edx
mov edx, dword [ecx + 8]
test edx, edx
je 0x47b2a3
mov eax, dword [ecx + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ecx + 0xc]
mov eax, dword [ecx + 8]
test edx, edx
je 0x47b2b2
mov dword [edx + 8], eax
jmp 0x47b2b7
mov dword [0x6073d0], eax
push 0x8000
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [0x6073c8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop ebp
ret
Function at 0x47b680
Capabilities:
Allocate or change rwx memory
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
push edi
mov edi, 0x6073c8
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x47b6b7
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edx, eax
xor eax, eax
mov ecx, edx
lock cmpxchg dword [edi], ecx
test eax, eax
je 0x47b6b7
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [0x6073c8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, 0x38
cmp esi, edi
cmovae edi, esi
mov esi, dword [0x6073d0]
add edi, 0xf
and edi, 0xfffffff8
test esi, esi
je 0x47b6ee
nop
mov ecx, dword [esi + 0x10]
cmp ecx, edi
jae 0x47b724
mov esi, dword [esi + 8]
test esi, esi
jne 0x47b6e0
push ebx
push 0x40
lea esi, [edi + 0x10007]
push 0x3000
and esi, 0xffff0000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x47b779
push dword [0x6073c8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
lea eax, [edi + 0x40]
cmp ecx, eax
jbe 0x47b73b
sub ecx, edi
mov dword [esi + 0x10], ecx
add esi, ecx
mov dword [esi + 4], ecx
mov dword [esi + edi + 4], edi
jmp 0x47b75e
mov edx, dword [esi + 8]
test edx, edx
je 0x47b748
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
test edx, edx
je 0x47b757
mov dword [edx + 8], eax
jmp 0x47b75c
mov dword [0x6073d0], eax
mov edi, ecx
add dword [0x6073d4], edi
mov dword [esi], edi
push dword [0x6073c8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
lea eax, [esi + 8]
pop esi
pop ebp
ret
sub esi, 8
mov dword [ebx + 4], 0
add dword [0x6073d8], esi
lea eax, [edi + 0x40]
cmp esi, eax
jbe 0x47b7c9
mov ecx, dword [0x6073d0]
lea eax, [ebx + edi]
add dword [0x6073d4], edi
sub esi, edi
mov dword [ebx], edi
mov dword [eax + 4], edi
mov dword [eax], 0
mov dword [eax + 0x10], esi
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 0
test ecx, ecx
je 0x47b7c0
mov dword [ecx + 0xc], eax
mov dword [0x6073d0], eax
add eax, esi
jmp 0x47b7d4
add dword [0x6073d4], esi
lea eax, [ebx + esi]
mov dword [ebx], esi
mov dword [eax], 1
mov dword [eax + 4], esi
push dword [0x6073c8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebx + 8]
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x47b800
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5e0f00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp esi, dword [edi + 0xc]
jb 0x47b888
cmp esi, dword [edi + 4]
jae 0x47b888
mov eax, dword [0x6073cc]
test eax, eax
jne 0x47b83e
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x24]
dec eax
mov dword [0x6073cc], eax
not eax
mov ecx, eax
and eax, dword [edi + 8]
and ecx, esi
cmp ecx, eax
je 0x47b873
jae 0x47b860
push 4
push 0x1000
sub eax, ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x47b86f
push 0x4000
sub ecx, eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x47b888
mov dword [edi + 8], esi
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3b35
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004d3b35
mov esp, ebp
pop ebp
ret

Function at 0x47ccc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.0047c950
xor ecx, ecx
pop edi
pop esi
cmp dword [eax + 4], ecx
setne cl
mov eax, ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x48cb70
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x10
push ebx
push esi
xor bl, bl
xor esi, esi
push edi
cmp eax, 1
jne 0x48cb8a
lea esi, [eax + 0xc]
jmp 0x48cb94
mov ecx, 2
cmp eax, ecx
cmove esi, ecx
mov eax, dword [ebp + 0xc]
and eax, 0xfffffffe
mov dword [ebp - 4], eax
add eax, 2
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x48cc97
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x48cc97
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.004d6030
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov ecx, dword [ebp - 4]
xor edx, edx
push edi
mov word [ecx + eax], dx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x48cc5e
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push esi
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x48cc16
mov bl, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5b6bac
mov dword [ebp - 0x10], str.S:KBT_third_partykbtkbt_platform_win32.cpp
mov dword [ebp - 0xc], str.CopyToClipboard
call dword [sym.imp.KERNEL32.dll_GetLastError]
movq xmm0, qword [ebp - 0x10]
push eax
push 3
sub esp, 0xc
mov ecx, esp
movq qword [ecx], xmm0
mov dword [ecx + 8], 0x7bb
call fcn.004a4b70
add esp, 0x18
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5b6bd0
mov dword [ebp - 0x10], str.S:KBT_third_partykbtkbt_platform_win32.cpp
mov dword [ebp - 0xc], str.CopyToClipboard
call dword [sym.imp.KERNEL32.dll_GetLastError]
movq xmm0, qword [ebp - 0x10]
push eax
push 3
sub esp, 0xc
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0x7c2
call fcn.004a4b70
add esp, 0x18
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x491df0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501a0e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x5e0f00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push eax
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x491ed6
push eax
push esi
call fcn.00424d00
add esp, 8
test al, al
mov eax, esi
je 0x491f1f
cmp dword [esi + 0x14], 8
jb 0x491e7c
mov eax, dword [esi]
push eax
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x491ea3
mov ecx, dword [esi + 0x10]
mov edx, esi
dec ecx
mov dword [esi + 0x10], ecx
cmp dword [esi + 0x14], 8
jb 0x491e9b
mov edx, dword [esi]
xor eax, eax
mov word [edx + ecx*2], ax
jmp 0x491f1d
push 0x5b696c
mov dword [ebp - 0x20], str.S:KBT_third_partykbtkbt_platform_win32.cpp
mov dword [ebp - 0x1c], str.GetCWD
call dword [sym.imp.KERNEL32.dll_GetLastError]
movq xmm0, qword [ebp - 0x20]
push eax
push 3
sub esp, 0xc
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0x3f9
jmp 0x491f07
push 0x5b696c
mov dword [ebp - 0x20], str.S:KBT_third_partykbtkbt_platform_win32.cpp
mov dword [ebp - 0x1c], str.GetCWD
call dword [sym.imp.KERNEL32.dll_GetLastError]
movq xmm0, qword [ebp - 0x20]
push eax
push 3
sub esp, 0xc
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0x400
call fcn.004a4b70
add esp, 0x18
mov ecx, esi
push 0
push 0x539b60
call fcn.00431340
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d3b35
mov esp, ebp
pop ebp
ret
Function at 0x492e70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5e0f00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc8]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0xd0]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x5965c0]
sub esi, 1
jne 0x492ea3
mov eax, dword [0x60752c]
not ebx
cmp dword [eax + 0x3e70], ebx
jne 0x492ed9
push esi
push edi
push 4
push ebx
call fcn.0048de10
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3b35
mov esp, ebp
pop ebp
ret 4

Function at 0x492ef0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5e0f00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc8]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0xd0]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x5965c0]
sub esi, 1
jne 0x492f23
mov eax, dword [0x60752c]
not ebx
cmp dword [eax + 0x3e70], ebx
jne 0x492f59
push esi
push edi
push 0xc
push ebx
call fcn.0048de10
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3b35
mov esp, ebp
pop ebp
ret 4
Function at 0x494b20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x494b32
mov dword [edi], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00494c50
mov esi, eax
add esp, 8
test esi, esi
jne 0x494b4a
pop edi
pop esi
pop ebp
ret
push ebx
push esi
call fcn.004e2f9c
add esp, 4
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
je 0x494c3c
push 2
push 0
push esi
call fcn.004e293d
add esp, 0xc
test eax, eax
jne 0x494c3c
push esi
call fcn.004e2f9c
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x494c3c
push 0
push dword [ebp + 0x10]
push esi
call fcn.004e293d
add esp, 0xc
test eax, eax
jne 0x494c3c
mov eax, dword [0x60752c]
test eax, eax
je 0x494bae
inc dword [eax + 0xcc]
push dword [0x6075ac]
mov eax, dword [ebp + 0x14]
add eax, ebx
push eax
call dword [0x5e0e28]
add esp, 8
mov dword [ebp + 0x10], eax
test eax, eax
je 0x494c3c
push esi
push ebx
push 1
push eax
call fcn.004e259a
add esp, 0x10
cmp eax, ebx
je 0x494c0d
push esi
call fcn.004e1bdd
mov eax, dword [0x60752c]
add esp, 4
test eax, eax
je 0x494bf3
dec dword [eax + 0xcc]
push dword [0x6075ac]
mov eax, dword [ebp + 0x10]
push eax
call dword [0x5e0e2c]
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x494c25
push eax
mov eax, dword [ebp + 0x10]
add eax, ebx
push 0
push eax
call fcn.004d65b0
add esp, 0xc
push esi
call fcn.004e1bdd
add esp, 4
test edi, edi
je 0x494c34
mov dword [edi], ebx
mov eax, dword [ebp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call fcn.004e1bdd
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x49e590
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x49e5f3
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x49e5d6
cmp edi, 2
jb 0x49e5d6
cmp byte [esi], cl
jne 0x49e5d6
cmp byte [esi + 1], cl
jne 0x49e5d6
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x5965c0]
jmp 0x49e5a7
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x5965c0]
test edi, edi
jne 0x49e5a7
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x49e628
nop word [eax + eax]
cmp cl, 0x23
jne 0x49e60f
cmp byte [esi], cl
jne 0x49e60f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x5965c0]
test cl, cl
jne 0x49e600
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x49e840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14
xor edx, edx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
test esi, esi
je 0x49e860
cmp eax, esi
jae 0x49e9bb
mov cl, byte [eax]
mov byte [ebp - 3], cl
test cl, cl
je 0x49e9bb
movzx ecx, cl
xor ebx, ebx
shr ecx, 3
mov edx, esi
movsx ecx, byte [ecx + 0x5b289c]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x49e892
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp - 3]
mov byte [ebp - 4], cl
cmp esi, edx
jae 0x49e8a7
mov bh, byte [esi]
jmp 0x49e8a9
xor bh, bh
lea esi, [eax + 2]
mov byte [ebp - 3], bh
cmp esi, edx
jae 0x49e8b7
mov ch, byte [esi]
jmp 0x49e8b9
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 2], ch
cmp esi, edx
jae 0x49e8c7
mov bl, byte [esi]
jmp 0x49e8c9
xor bl, bl
movzx edx, ch
movzx esi, bh
movzx edi, bl
movzx ecx, cl
mov byte [ebp - 1], bl
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx*4 + 0x5b28bc]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], ebx
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov ebx, dword [ebp - 8]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x5b28e4]
shr ebx, cl
mov edx, ebx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0xc]
cmp edx, dword [ebx*4 + 0x5b28d0]
sbb ecx, ecx
and ecx, 0x40
or edi, ecx
mov ecx, 0x10ffff
cmp ecx, edx
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x5b28f8]
mov ebx, dword [ebp - 0x14]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x49e9a2
xor edx, edx
cmp byte [ebp - 4], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 1], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
mov edx, dword [ebp - 0x10]
inc edx
jmp 0x49e84e
add eax, ebx
test edx, edx
je 0x49e9b1
mov edx, dword [ebp - 0x10]
inc edx
jmp 0x49e84e
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49ea40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
dec eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x10], ecx
lea eax, [ebx + eax*4]
mov dword [ebp - 0x18], eax
cmp ebx, eax
mov eax, dword [ebp + 0x10]
jae 0x49ebe3
push esi
mov esi, dword [ebp + 0x14]
push edi
nop dword [eax]
test esi, esi
je 0x49ea7c
cmp eax, esi
jae 0x49ebde
mov bl, byte [eax]
mov byte [ebp + 0xf], bl
test bl, bl
je 0x49ebde
movzx ecx, bl
mov edx, esi
shr ecx, 3
xor ebx, ebx
movsx ecx, byte [ecx + 0x5b289c]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x49eaae
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp + 0xf]
mov byte [ebp - 3], cl
cmp esi, edx
jae 0x49eac3
mov bh, byte [esi]
jmp 0x49eac5
xor bh, bh
lea esi, [eax + 2]
mov byte [ebp - 2], bh
cmp esi, edx
jae 0x49ead3
mov ch, byte [esi]
jmp 0x49ead5
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 1], ch
cmp esi, edx
jae 0x49eae3
mov bl, byte [esi]
jmp 0x49eae5
xor bl, bl
movzx edx, ch
movzx esi, bh
movzx edi, bl
movzx ecx, cl
mov byte [ebp + 0xf], bl
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx*4 + 0x5b28bc]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], ebx
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov ebx, dword [ebp - 8]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
mov edx, dword [ebp - 0xc]
shr edi, 2
or edi, esi
mov ecx, dword [ecx*4 + 0x5b28e4]
shr ebx, cl
shr edi, 2
mov esi, ebx
cmp esi, dword [edx*4 + 0x5b28d0]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x14]
sbb ecx, ecx
and ecx, 0x40
or edi, ecx
mov ecx, 0x10ffff
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [edx*4 + 0x5b28f8]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x49ebbc
xor edx, edx
mov esi, 0xfffd
cmp byte [ebp + 0xf], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 1], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
jmp 0x49ebc2
add eax, ebx
test esi, esi
je 0x49ebdb
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
add ecx, 4
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
cmp ecx, dword [ebp - 0x18]
jb 0x49ea70
jmp 0x49ebde
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
pop edi
pop esi
mov edx, dword [ebp + 0x18]
mov dword [ecx], 0
test edx, edx
je 0x49ebf2
mov dword [edx], eax
sub ecx, ebx
sar ecx, 2
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret