joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5690b0
Capabilities:
Authenticate hmac

Disassembly:
inc ebx
mov edx, dword [esp + 0xe8]
mov eax, dword [esp + 0xec]
mov dword [edx], edi
pop edi
pop esi
pop ebp
mov dword [eax], 0x30
xor eax, eax
pop ebx
add esp, 0xcc
ret
push edx
mov dword [esp + 0x74], edi
mov edi, dword [esp + 0xf4]
lea eax, [esp + 0x18]
push edi
push eax
mov eax, dword [esi + 0x34]
call fcn.00565020
add esp, 0x10
cmp dword [edi], 0
jne 0x5688b6
xor ebp, ebp
cmp eax, ebp
jge 0x56729c
mov ecx, eax
neg ecx
cmp ecx, 0x1a
jne 0x569132
mov edi, dword [esp + 0x10]
cmp byte [edi + 1], 0x5c
jne 0x569113
cmp byte [edi + 2], 0x45
jne 0x569113
mov esi, dword [esp + 0xb8]
mov ecx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x24]
add edi, 2
inc edi
xor edx, edx
jmp 0x56710a
mov esi, dword [esp + 0xb8]
mov ecx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x24]
inc edi
mov dword [esp + 0x50], 1
xor edx, edx
invalid
fcomp st(7)
Function at 0x56ff30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x13c
mov ecx, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, eax
or eax, 0xffffffff
mov dword [esp + 0x14], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
test dword [ebp + 0x18], 0xe20f5a6f
lea esi, [eax + ecx]
xor al, 8
Function at 0x570dff
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x540]
call fcn.0057148e
lea eax, [ebp - 0x13c]
push 0x104
push eax
push 0
call dword [0x48d290]
lea eax, [ebp - 0x13c]
push 0x49c010
push eax
call fcn.005757c6
pop ecx
mov dword [esi], eax
test eax, eax
pop ecx
jne 0x570e4d
push 1
pop eax
jmp 0x570fdd
xor eax, eax
mov cl, byte [eax + 0x49c008]
mov byte [ebp + eax - 0x24], cl
mov cl, byte [eax + 0x49c000]
mov byte [ebp + eax - 0x1c], cl
inc eax
cmp eax, 8
jl 0x570e4f
mov edi, dword [ebp + 0xc]
push edi
call fcn.00576750
and dword [esi + 0x110], 0
pop ecx
lea ecx, [esi + 0x110]
xor edx, edx
test eax, eax
jle 0x570e91
movsx ebx, byte [edx + edi]
add dword [ecx], ebx
inc edx
cmp edx, eax
jl 0x570e86
push 2
push 0xfffffffffffffff8
push dword [esi]
call fcn.005766c8
push dword [esi]
lea edi, [esi + 4]
push 1
pop ebx
push ebx
push 4
push edi
call fcn.00576621
push dword [esi]
call fcn.00576372
push dword [esi]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push ebx
push 4
push eax
call fcn.00576621
push 0
push 0
push dword [esi]
call fcn.005766c8
and dword [ebp + 0xc], 0
add esp, 0x3c
cmp dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
jle 0x570f10
mov ecx, dword [esi]
test byte [ecx + 0xc], 0x10
jne 0x570f10
push ecx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00576621
add esp, 0x10
lea ecx, [ebp - 0x540]
push dword [ebp - 0x14]
call fcn.005714cd
inc dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 8]
jl 0x570ee0
xor eax, 0xaaaaaaaa
cmp dword [ebp - 0x10], eax
jne 0x570f51
push 0
push dword [edi]
push dword [esi]
call fcn.005766c8
push dword [esi]
lea eax, [ebp - 0x34]
push ebx
push 0x10
push eax
call fcn.00576621
add esp, 0x1c
test eax, eax
je 0x570f51
xor eax, eax
mov cl, byte [ebp + eax - 0x34]
cmp cl, byte [ebp + eax - 0x24]
jne 0x570f4c
inc eax
cmp eax, 0x10
jl 0x570f3c
cmp eax, 0x10
je 0x570f55
push 3
jmp 0x570f6d
push dword [esi]
lea eax, [ebp - 1]
push ebx
push ebx
push eax
call fcn.00576621
add esp, 0x10
cmp byte [ebp - 1], 3
je 0x570f7a
push 4
pop edi
push dword [esi]
call fcn.00575a1b
pop ecx
mov eax, edi
jmp 0x570fdd
push dword [esi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.00576621
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0xfac1
lea ebx, [esi + 0xc]
push edi
push 1
push ebx
call fcn.00576621
add esp, 0x20
lea eax, [edi + 0xc3d2]
mov ecx, esi
push eax
push edi
push ebx
call fcn.00570ff2
and byte [edi + esi + 0xc], 0
lea eax, [esi + 0x110]
xor ecx, ecx
cmp edi, ecx
mov dword [eax], ecx
jle 0x570fd0
movsx edx, byte [ebx + ecx]
add dword [eax], edx
inc ecx
cmp ecx, edi
jl 0x570fc5
push dword [esi]
call fcn.00576372
mov dword [esi + 8], eax
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x570ff2
Capabilities:
Encode data using xor

Disassembly:
push edi
push dword [esp + 0x10]
call fcn.0050cb10
xor edi, edi
pop ecx
cmp dword [esp + 0xc], edi
jbe 0x57101c
push esi
mov eax, dword [esp + 0xc]
lea esi, [edi + eax]
call fcn.0050cc80
xor byte [esi], al
inc edi
cmp edi, dword [esp + 0x10]
jb 0x571006
pop esi
pop edi
ret 0xc
Function at 0x571020
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x290]
call fcn.005714f6
push 0
push dword [esi + 8]
push dword [esi]
call fcn.005766c8
add esp, 0xc
lea eax, [ebp - 0x398]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.00571302
test eax, eax
je 0x571064
push 6
jmp 0x5710f3
push dword [esi]
lea eax, [ebp - 1]
push 1
pop ebx
push ebx
push ebx
push eax
call fcn.00576621
push dword [esi]
lea eax, [ebp - 8]
push ebx
push 4
push eax
call fcn.00576621
push dword [esi]
mov edi, dword [ebp - 8]
lea eax, [ebp - 8]
xor edi, 0x45aa
push ebx
push 4
push eax
call fcn.00576621
mov eax, dword [ebp - 8]
push dword [esi]
xor eax, 0x45aa
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.00576621
add esp, 0x40
lea eax, [ebp - 0x18]
push dword [esi]
push ebx
push 4
push eax
call fcn.00576621
push dword [esi]
lea eax, [ebp - 0x1c]
push ebx
push 4
push eax
call fcn.00576621
push dword [esi]
lea eax, [ebp - 0x20]
push ebx
push 4
push eax
call fcn.00576621
push dword [ebp - 0xc]
call fcn.005721e3
add esp, 0x34
mov dword [ebp + 8], eax
test eax, eax
jne 0x5710f9
push 8
pop eax
jmp 0x5711d0
push edi
call fcn.005721e3
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
jne 0x57110f
push 8
pop esi
jmp 0x5711c5
push dword [esi]
push ebx
push edi
push eax
call fcn.00576621
mov eax, dword [esi + 0x110]
add esp, 0x10
add eax, 0x22af
mov ecx, esi
push eax
push edi
mov edi, dword [ebp - 0x10]
push edi
call fcn.00570ff2
cmp byte [ebp - 1], bl
jne 0x571173
lea ecx, [ebp - 0x290]
call fcn.005714f6
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x290], eax
call fcn.00571522
push edi
call fcn.005739bf
pop ecx
jmp 0x57117f
push dword [ebp + 8]
call fcn.005739bf
pop ecx
mov dword [ebp + 8], edi
push 0x49c014
push dword [ebp + 0xc]
call fcn.005757c6
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x57119b
push 7
jmp 0x571109
push edi
push ebx
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.00575934
push edi
call fcn.00575a1b
add esp, 0x14
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.0057144e
xor esi, esi
push dword [ebp + 8]
call fcn.005739bf
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x5711d7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x380
push esi
mov esi, ecx
lea ecx, [ebp - 0x278]
call fcn.005714f6
push 0
push dword [esi + 8]
push dword [esi]
call fcn.005766c8
add esp, 0xc
lea eax, [ebp - 0x380]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.00571302
test eax, eax
je 0x57121a
push 6
pop eax
jmp 0x5712fd
push ebx
push edi
push dword [esi]
lea eax, [ebp - 1]
push 1
pop ebx
push ebx
push ebx
push eax
call fcn.00576621
push dword [esi]
lea eax, [ebp - 8]
push ebx
push 4
push eax
call fcn.00576621
push dword [esi]
mov edi, dword [ebp - 8]
lea eax, [ebp - 8]
xor edi, 0x45aa
push ebx
push 4
push eax
call fcn.00576621
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
xor eax, 0x45aa
push ebx
push 0x10
mov dword [ecx], eax
push dword [esi]
call fcn.005766c8
mov eax, dword [ebp + 0x10]
push dword [eax]
call fcn.005721e3
add esp, 0x40
mov dword [ebp + 0x10], eax
push edi
call fcn.005721e3
push dword [esi]
mov dword [ebp + 8], eax
push ebx
push edi
push eax
call fcn.00576621
mov eax, dword [esi + 0x110]
add esp, 0x14
add eax, 0x22af
mov ecx, esi
push eax
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00570ff2
cmp byte [ebp - 1], bl
jne 0x5712e5
lea ecx, [ebp - 0x278]
call fcn.005714f6
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x278], eax
call fcn.00571522
push edi
call fcn.005739bf
pop ecx
jmp 0x5712f1
push dword [ebp + 0x10]
call fcn.005739bf
pop ecx
mov dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
pop edi
pop ebx
mov dword [eax], ecx
xor eax, eax
pop esi
leave
ret 0xc
Function at 0x571302
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 1
pop ebx
mov esi, ecx
mov byte [ebp - 1], bl
push dword [esi]
lea eax, [ebp - 0x14]
push 4
push ebx
push eax
call fcn.00576621
add esp, 0x10
lea eax, [ebp - 0x14]
mov ecx, esi
push 0x16fa
push 4
push eax
call fcn.00570ff2
and byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push 0x49c018
push eax
call fcn.005767e0
pop ecx
test eax, eax
pop ecx
jne 0x571433
push dword [esi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.00576621
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29bc
lea eax, [ebp - 0x11c]
push edi
push ebx
push eax
call fcn.00576621
add esp, 0x20
lea eax, [edi + 0xa25e]
mov ecx, esi
push eax
lea eax, [ebp - 0x11c]
push edi
push eax
call fcn.00570ff2
push dword [esi]
and byte [ebp + edi - 0x11c], 0
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.00576621
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29ac
push edi
push ebx
push dword [ebp + 0xc]
call fcn.00576621
add esp, 0x20
lea eax, [edi + 0xf25e]
mov ecx, esi
push eax
push edi
push dword [ebp + 0xc]
call fcn.00570ff2
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
and byte [edi + eax], 0
lea eax, [ebp - 0x11c]
push eax
call fcn.005767e0
pop ecx
test eax, eax
pop ecx
je 0x57144a
push ebx
push ebx
push dword [esi]
call fcn.005766c8
push dword [esi]
lea eax, [ebp - 8]
push ebx
push 4
push eax
call fcn.00576621
xor dword [ebp - 8], 0x45aa
push ebx
push 4
push dword [esi]
call fcn.005766c8
push ebx
push 0x10
push dword [esi]
call fcn.005766c8
push ebx
push dword [ebp - 8]
push dword [esi]
call fcn.005766c8
add esp, 0x40
jmp 0x571437
and byte [ebp - 1], 0
cmp byte [ebp - 1], bl
je 0x571316
push 6
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x571443

Function at 0x57148e
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, ecx
push esi
push edi
mov edi, eax
or dword [eax + 0x400], 0xffffffff
xor esi, esi
mov edx, esi
push 8
shl edx, 0x18
pop ecx
test edx, 0x80000000
je 0x5714b7
add edx, edx
xor edx, 0x4c11db7
jmp 0x5714b9
shl edx, 1
dec ecx
jne 0x5714a5
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x57149d
pop edi
pop esi
ret

Function at 0x571641
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x571666
mov eax, dword [esi + 0xc]
push 8
add eax, dword [esi + 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00576870
add esp, 0xc
jmp 0x571679
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.00576621
add esp, 0x10
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 3]
shl eax, 8
or eax, ecx
add dword [esi + 0xc], 8
movzx ecx, byte [ebp - 2]
shl eax, 8
or eax, ecx
and byte [ebp - 4], 0
movzx ecx, byte [ebp - 1]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp + 8]
push 0x49c020
mov dword [ecx], eax
lea eax, [ebp - 8]
push eax
call fcn.005767e0
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
pop esi
leave
ret 4
Function at 0x5bead0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x2f00
call fcn.0063f880
mov al, byte [0x4a14e1]
or al, byte [0x4a14e0]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x2c], al
jne 0x5beb06
push 0
push 0
call fcn.005bf630
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2f00
ret
mov ebp, dword [0x4a14d8]
xor esi, esi
cmp ebp, esi
jne 0x5bec77
push 0x12000
call fcn.0062f159
add esp, 4
mov dword [0x4a14d8], eax
cmp eax, esi
je 0x5bec67
push 0x24000
call fcn.0062f159
add esp, 4
mov dword [0x4a14dc], eax
cmp eax, esi
je 0x5bec67
push 0x20000
call fcn.0062f159
add esp, 4
mov dword [0x4a14cc], eax
cmp eax, esi
je 0x5bec67
push 0x40000
call fcn.0062f159
add esp, 4
mov dword [0x4a14d0], eax
cmp eax, esi
je 0x5bec67
push 0x7d0
call fcn.0062f159
add esp, 4
mov dword [0x4a14d4], eax
cmp eax, esi
je 0x5bec67
mov ebp, dword [0x4a14d8]
push 0x12000
push esi
push ebp
call fcn.006386e0
mov ebx, dword [0x4a14dc]
add esp, 0xc
push 0x24000
push esi
push ebx
call fcn.006386e0
mov byte [ebp + 0x1324], 3
mov byte [ebp + 0xb644], 1
add byte [eax], al
add esi, eax
test dword [edi + esi*4], esp
add byte [edx], al
call fcn.005bfd00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2f00
ret
mov ebx, dword [0x4a14dc]
Function at 0x5c8b10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x49f988], eax
mov edx, 1
mov eax, 0x49f988
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x4a0344
jl 0x5c8b24
mov dword [0x49d318], 1
mov dword [0x4a2504], 1
pop edi
ret

Function at 0x5c8b60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4a2504], 0
push esi
mov esi, 0x49f988
jne 0x5c8b7e
call dword [fcn.0048d2e4]
push eax
call fcn.005c8b10
add esp, 4
mov dword [0x49d318], 0x270
mov dword [0x49f984], esi
mov ecx, 0xe3
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi + 0x634]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x5c8b93
mov ecx, 0x18c
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi - 0x38c]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x5c8bc8
mov ecx, dword [esi]
mov eax, dword [0x49f988]
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, dword [esi]
and al, 1
movzx edx, al
shr ecx, 1
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor ecx, edx
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
ret

Function at 0x5c8c80
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x49d318]
jne 0x5c8c8d
call fcn.005c8b60
mov eax, dword [0x49f984]
mov ecx, dword [eax]
add eax, 4
mov dword [0x49f984], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret
Function at 0x5d1a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov al, byte [0x49d350]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov byte [esp + 0xc], 0x20
mov byte [esp + 0xd], al
mov dword [esp + 0xe], 0x3e3c0928
mov dword [esp + 0x12], 0x2d2b3d3a
mov dword [esp + 0x16], 0x7e212f2a
mov dword [esp + 0x1a], 0x5b5e7c26
mov word [esp + 0x1e], 0x3f2e
mov byte [esp + 0x20], 0
mov edi, ebp
test ebp, ebp
je 0x5d1aab
mov dl, byte [ebp]
test dl, dl
je 0x5d1aab
lea ecx, [esp + 0xc]
mov al, 0x20
cmp dl, al
je 0x5d1afe
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x5d1a97
mov dl, byte [edi + 1]
inc edi
test dl, dl
jne 0x5d1a91
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5d1ab0
sub eax, edx
lea edi, [eax + ebp - 1]
cmp edi, ebp
jbe 0x5d1ad0
mov al, byte [edi]
cmp al, 0x20
je 0x5d1acb
cmp al, 9
jne 0x5d1ad0
dec edi
cmp edi, ebp
ja 0x5d1ac1
mov esi, edi
sub esi, ebp
inc esi
cmp esi, 0xfd
jbe 0x5d1b05
cmp byte [esp + 0x30], 0
je 0x5d1af3
mov ecx, dword [esp + 0x28]
push ebp
push 0x492298
call fcn.005e0d00
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x18
ret 0xc
cmp edi, ebp
jbe 0x5d1ad0
dec edi
jmp 0x5d1abd
push esi
push ebp
push ebx
call fcn.00631ce0
add esp, 0xc
mov eax, edi
pop edi
mov byte [esi + ebx], 0
pop esi
pop ebp
add esp, 0x18
ret 0xc
Function at 0x607df0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1fc
mov eax, dword [0x49d3c8]
mov ecx, dword [eax + 0x4c]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
lea edx, [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp + 8]
push edx
lea eax, [esp + 0x28]
call fcn.00607130
mov dword [esp + 0x18], eax
test eax, eax
je 0x608c36
mov eax, dword [esp + 0x24]
cmp eax, 0x62
ja 0x608c36
mov ebx, dword [eax*4 + 0x4a11b8]
mov dword [esp + 0x20], ebx
test ebx, ebx
je 0x608c36
mov eax, dword [ebp + 0xc]
call fcn.006101d0
push 1
push 0
mov dword [esp + 0x2c], eax
push 0xffffffffffffffff
cmp eax, dword [ebx + 0xc]
jae 0x608c3c
mov ecx, dword [ebx + 0x14]
lea eax, [eax + eax*4]
lea edi, [ecx + eax*4]
mov ecx, dword [0x4a13a4]
push 0x4900b0
mov dword [esp + 0x24], edi
call fcn.0061dcb0
mov eax, dword [0x4a2b54]
mov edx, dword [0x4a2b50]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x48], eax
xor eax, eax
mov dword [0x4a2b50], eax
mov dword [0x4a2b54], eax
mov byte [esp + 0x13], al
lea eax, [ecx - 1]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x2c], 1
cmp eax, 0xc
ja 0x608348
jmp dword [eax*4 + 0x451858]
mov bl, byte [edi + 6]
mov ecx, dword [esp + 0x20]
call fcn.00612a00
test eax, eax
je 0x608399
mov edx, dword [edi]
push edx
call dword [fcn.0048d558]
test eax, eax
je 0x608399
mov ecx, dword [edi]
lea eax, [esp + 0x30]
push eax
push ecx
call dword [fcn.0048d454]
mov esi, dword [esp + 0x20]
mov eax, dword [esi]
push 2
lea edx, [esp + 0x34]
push edx
push eax
push 0
call dword [fcn.0048d3e4]
mov edx, dword [esi]
push 1
lea ecx, [esp + 0x34]
push ecx
push edx
call dword [fcn.0048d5a8]
mov esi, dword [esp + 0x4c]
test esi, esi
je 0x6083d4
mov eax, dword [0x4a2b50]
test eax, eax
je 0x6083c5
push eax
call fcn.0062f9bf
add esp, 4
cmp dword [0x4a2b54], 0x400000
jbe 0x6083c5
dec dword [0x4a2b58]
mov eax, dword [esp + 0x48]
mov dword [0x4a2b50], esi
mov dword [0x4a2b54], eax
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 1
push 0
push 0xffffffffffffffff
mov ecx, dword [0x4a13a4]
push 0x4916f4
call fcn.0061dcb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x62cdff
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x540]
call fcn.0062d48e
lea eax, [ebp - 0x13c]
push 0x104
push eax
push 0
call dword [0x48d290]
lea eax, [ebp - 0x13c]
push 0x49c010
push eax
call fcn.006317c6
pop ecx
mov dword [esi], eax
test eax, eax
pop ecx
jne 0x62ce4d
push 1
pop eax
jmp 0x62cfdd
xor eax, eax
mov cl, byte [eax + 0x49c008]
mov byte [ebp + eax - 0x24], cl
mov cl, byte [eax + 0x49c000]
mov byte [ebp + eax - 0x1c], cl
inc eax
cmp eax, 8
jl 0x62ce4f
mov edi, dword [ebp + 0xc]
push edi
call fcn.00632750
and dword [esi + 0x110], 0
pop ecx
lea ecx, [esi + 0x110]
xor edx, edx
test eax, eax
jle 0x62ce91
movsx ebx, byte [edx + edi]
add dword [ecx], ebx
inc edx
cmp edx, eax
jl 0x62ce86
push 2
push 0xfffffffffffffff8
push dword [esi]
call fcn.006326c8
push dword [esi]
lea edi, [esi + 4]
push 1
pop ebx
push ebx
push 4
push edi
call fcn.00632621
push dword [esi]
call fcn.00632372
push dword [esi]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push ebx
push 4
push eax
call fcn.00632621
push 0
push 0
push dword [esi]
call fcn.006326c8
and dword [ebp + 0xc], 0
add esp, 0x3c
cmp dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
jle 0x62cf10
mov ecx, dword [esi]
test byte [ecx + 0xc], 0x10
jne 0x62cf10
push ecx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00632621
add esp, 0x10
lea ecx, [ebp - 0x540]
push dword [ebp - 0x14]
call fcn.0062d4cd
inc dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 8]
jl 0x62cee0
xor eax, 0xaaaaaaaa
cmp dword [ebp - 0x10], eax
jne 0x62cf51
push 0
push dword [edi]
push dword [esi]
call fcn.006326c8
push dword [esi]
lea eax, [ebp - 0x34]
push ebx
push 0x10
push eax
call fcn.00632621
add esp, 0x1c
test eax, eax
je 0x62cf51
xor eax, eax
mov cl, byte [ebp + eax - 0x34]
cmp cl, byte [ebp + eax - 0x24]
jne 0x62cf4c
inc eax
cmp eax, 0x10
jl 0x62cf3c
cmp eax, 0x10
je 0x62cf55
push 3
jmp 0x62cf6d
push dword [esi]
lea eax, [ebp - 1]
push ebx
push ebx
push eax
call fcn.00632621
add esp, 0x10
cmp byte [ebp - 1], 3
je 0x62cf7a
push 4
pop edi
push dword [esi]
call fcn.00631a1b
pop ecx
mov eax, edi
jmp 0x62cfdd
push dword [esi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.00632621
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0xfac1
lea ebx, [esi + 0xc]
push edi
push 1
push ebx
call fcn.00632621
add esp, 0x20
lea eax, [edi + 0xc3d2]
mov ecx, esi
push eax
push edi
push ebx
call fcn.0062cff2
and byte [edi + esi + 0xc], 0
lea eax, [esi + 0x110]
xor ecx, ecx
cmp edi, ecx
mov dword [eax], ecx
jle 0x62cfd0
movsx edx, byte [ebx + ecx]
add dword [eax], edx
inc ecx
cmp ecx, edi
jl 0x62cfc5
push dword [esi]
call fcn.00632372
mov dword [esi + 8], eax
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x62cff2
Capabilities:
Encode data using xor

Disassembly:
push edi
push dword [esp + 0x10]
call fcn.005c8b10
xor edi, edi
pop ecx
cmp dword [esp + 0xc], edi
jbe 0x62d01c
push esi
mov eax, dword [esp + 0xc]
lea esi, [edi + eax]
call fcn.005c8c80
xor byte [esi], al
inc edi
cmp edi, dword [esp + 0x10]
jb 0x62d006
pop esi
pop edi
ret 0xc
Function at 0x62d020
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x290]
call fcn.0062d4f6
push 0
push dword [esi + 8]
push dword [esi]
call fcn.006326c8
add esp, 0xc
lea eax, [ebp - 0x398]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.0062d302
test eax, eax
je 0x62d064
push 6
jmp 0x62d0f3
push dword [esi]
lea eax, [ebp - 1]
push 1
pop ebx
push ebx
push ebx
push eax
call fcn.00632621
push dword [esi]
lea eax, [ebp - 8]
push ebx
push 4
push eax
call fcn.00632621
push dword [esi]
mov edi, dword [ebp - 8]
lea eax, [ebp - 8]
xor edi, 0x45aa
push ebx
push 4
push eax
call fcn.00632621
mov eax, dword [ebp - 8]
push dword [esi]
xor eax, 0x45aa
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.00632621
add esp, 0x40
lea eax, [ebp - 0x18]
push dword [esi]
push ebx
push 4
push eax
call fcn.00632621
push dword [esi]
lea eax, [ebp - 0x1c]
push ebx
push 4
push eax
call fcn.00632621
push dword [esi]
lea eax, [ebp - 0x20]
push ebx
push 4
push eax
call fcn.00632621
push dword [ebp - 0xc]
call fcn.0062e1e3
add esp, 0x34
mov dword [ebp + 8], eax
test eax, eax
jne 0x62d0f9
push 8
pop eax
jmp 0x62d1d0
push edi
call fcn.0062e1e3
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
jne 0x62d10f
push 8
pop esi
jmp 0x62d1c5
push dword [esi]
push ebx
push edi
push eax
call fcn.00632621
mov eax, dword [esi + 0x110]
add esp, 0x10
add eax, 0x22af
mov ecx, esi
push eax
push edi
mov edi, dword [ebp - 0x10]
push edi
call fcn.0062cff2
cmp byte [ebp - 1], bl
jne 0x62d173
lea ecx, [ebp - 0x290]
call fcn.0062d4f6
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x290], eax
call fcn.0062d522
push edi
call fcn.0062f9bf
pop ecx
jmp 0x62d17f
push dword [ebp + 8]
call fcn.0062f9bf
pop ecx
mov dword [ebp + 8], edi
push 0x49c014
push dword [ebp + 0xc]
call fcn.006317c6
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x62d19b
push 7
jmp 0x62d109
push edi
push ebx
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.00631934
push edi
call fcn.00631a1b
add esp, 0x14
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.0062d44e
xor esi, esi
push dword [ebp + 8]
call fcn.0062f9bf
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8