joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4654f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x214
mov eax, dword [0x887490]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
push edi
xor edi, edi
test esi, esi
je 0x465625
call fcn.00452bb0
cmp dword [0x8b7d80], edi
jne 0x465563
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x465546
push str.GetFinalPathNameByHandleW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x8b7d80], eax
jmp 0x46554b
mov eax, dword [0x8b7d80]
test eax, eax
jne 0x465563
push 1
call fcn.00461530
add esp, 4
call fcn.00452bb0
jmp 0x46562f
push esi
call fcn.00457d80
add esp, 4
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x465585
test al, 0x10
je 0x465585
mov ecx, 1
jmp 0x465587
xor ecx, ecx
push 0
test ecx, ecx
mov edx, 0x2000010
mov eax, 0x80
cmovne eax, edx
push eax
push 3
push 0
push 1
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
cmp eax, 0xffffffff
jne 0x4655be
push 0
call fcn.00461550
add esp, 8
jmp 0x465611
push 0x108
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [0x8b7d80]
cmp eax, 0x108
jae 0x465607
test eax, eax
je 0x4655f9
add eax, eax
cmp eax, 0x210
jae 0x465648
xor ecx, ecx
mov word [esp + eax + 8], cx
lea eax, [esp + 8]
push eax
call fcn.0047b490
add esp, 4
mov edi, eax
push 0
push 1
call fcn.00461550
add esp, 8
jmp 0x465611
push 9
call fcn.00461530
add esp, 4
test esi, esi
je 0x46561e
push esi
call fcn.0048bed0
add esp, 4
call fcn.00452bb0
jmp 0x46562f
push 2
call fcn.00461530
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.005091ef
add esp, 0x214
ret
call fcn.0050956a
int3

Function at 0x465650
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
test esi, esi
je 0x465725
mov edi, dword [esp + 0x10]
test edi, edi
je 0x465725
call fcn.00452bb0
cmp dword [0x8b7d7c], 0
jne 0x4656b9
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x46569a
push str.CreateSymbolicLinkW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x8b7d7c], eax
jmp 0x46569f
mov eax, dword [0x8b7d7c]
test eax, eax
jne 0x4656b9
push 1
call fcn.00461530
add esp, 4
xor esi, esi
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
ret
push ebx
push edi
call fcn.00457d80
push esi
mov ebx, eax
call fcn.00457d80
add esp, 8
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4656e4
test al, 0x10
je 0x4656e4
mov eax, 1
jmp 0x4656e6
xor eax, eax
push eax
push edi
push ebx
call dword [0x8b7d7c]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.00461550
add esp, 8
test ebx, ebx
je 0x46570d
push ebx
call fcn.0048bed0
add esp, 4
pop ebx
test edi, edi
je 0x46571b
push edi
call fcn.0048bed0
add esp, 4
call fcn.00452bb0
pop edi
mov eax, esi
pop esi
ret
push 2
call fcn.00461530
add esp, 4
xor eax, eax
pop edi
pop esi
ret
Function at 0x48bf60
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x24
mov eax, dword [0x887490]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
cmp eax, 0x3e9
jg 0x48c07a
je 0x48c063
cmp eax, 0x69
ja case.0x48c084.1006
movzx eax, byte [eax + 0x48c128]
jmp dword [eax*4 + 0x48c108]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0xc]
shr ecx, 0xa
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005091ef
add esp, 0x24
ret
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
or ecx, 0xffffffff
cmp dword [esp + 0xc], 0xffffffff
cmovb ecx, dword [esp + 0xc]
shr ecx, 0xa
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005091ef
add esp, 0x24
ret
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x1c]
shr ecx, 0xa
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005091ef
add esp, 0x24
ret
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 8]
shr ecx, 0xa
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005091ef
add esp, 0x24
ret
mov ecx, 1
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005091ef
add esp, 0x24
ret
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x14]
shr ecx, 0xa
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005091ef
add esp, 0x24
ret
mov ecx, dword [0x8b83c0]
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005091ef
add esp, 0x24
ret
add eax, 0xfffffc16
cmp eax, 7
ja case.0x48c084.1006
jmp dword [eax*4 + 0x48c194]
mov ecx, dword [0x8b83c4]
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005091ef
add esp, 0x24
ret
mov ecx, dword [0x8b7fe8]
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005091ef
add esp, 0x24
ret
mov eax, dword [0x8b7fe8]
lea ecx, [eax + eax*2]
shl ecx, 3
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005091ef
add esp, 0x24
ret
mov ecx, dword [0x8b7fc0]
sub ecx, dword [0x8b7fc8]
sar ecx, 2
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005091ef
add esp, 0x24
ret
xor ecx, ecx
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005091ef
add esp, 0x24
ret

Function at 0x48ddc0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
cmp dword [0x8b81f8], 0
jne 0x48de36
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x1c]
lea eax, [edx - 1]
test edx, eax
jne 0x48de3f
mov ecx, dword [esp + 4]
lea eax, [ecx - 1]
test ecx, eax
jne 0x48de3f
mov dword [0x8b8200], edx
mov dword [0x8b81fc], ecx
mov dword [0x8b8204], 0x40000
mov dword [0x8b8208], 0x200000
mov dword [0x8b820c], 5
mov dword [0x8b83cc], 5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, 0x55555550
and eax, 0xfffffff8
or eax, 8
mov dword [0x8b81f8], eax
mov eax, 1
add esp, 0x24
ret
call fcn.00515d98
int3
Function at 0x4e2650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 0xffffffffffffffff
push dword [esp + 0x18]
push ebx
call fcn.004ea6b0
mov esi, eax
add esp, 0xc
mov ecx, dword [esi + 0x7c]
or byte [esi + 0x1b], 0x80
mov edi, dword [ecx + 0xc]
mov eax, dword [edi + 0x88]
test eax, eax
je 0x4e26b1
test byte [eax + 0x24], 8
jne 0x4e26b1
cmp dword [edi + 0x170], 0
jne 0x4e26b1
cmp dword [edi + 0x168], 0
jne 0x4e26b1
push eax
call fcn.00453d40
add esp, 4
mov dword [edi + 0x168], eax
test eax, eax
jne 0x4e26b1
mov dword [edi + 0x170], 1
mov dword [esi + 0xc], 0
mov eax, 0x38e38e39
mov dword [esi + 0x10], 0
mov dword [esi + 0x38], 1
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x14], 0xa0043
mov byte [esi + 0x1a], 0x20
movzx ecx, word [ebx + 0x2e]
sub ecx, 0xc
mov dword [esi + 0x44], 1
imul ecx
push 0
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push esi
mov word [esi + 0x78], ax
call fcn.004e8ac0
add esp, 8
mov dword [ebx + 0x14], esi
pop edi
pop esi
pop ebx
ret
Function at 0x4e2750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push 0xffffffffffffffff
push dword [esp + 0x1c]
push ebp
call fcn.004ea6b0
add esp, 0xc
mov esi, eax
cmp dword [esp + 0x10], 0
je 0x4e2773
or byte [esi + 0x1b], 0x80
mov bl, byte [esp + 0x24]
cmp bl, 0x43
jne 0x4e27c3
mov eax, dword [esi + 0x7c]
push edi
mov edi, dword [eax + 0xc]
mov eax, dword [edi + 0x88]
test eax, eax
je 0x4e27c2
test byte [eax + 0x24], 8
jne 0x4e27c2
cmp dword [edi + 0x170], 0
jne 0x4e27c2
cmp dword [edi + 0x168], 0
jne 0x4e27c2
push eax
call fcn.00453d40
add esp, 4
mov dword [edi + 0x168], eax
test eax, eax
jne 0x4e27c2
mov dword [edi + 0x170], 1
pop edi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4e27e7
push eax
call fcn.004f5700
mov dword [esi + 4], eax
push eax
mov eax, dword [esi + 0x7c]
push dword [eax + 0xc]
call fcn.004b8120
add esp, 0xc
mov word [esi + 0x18], ax
mov eax, dword [esp + 0x20]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4e2802
push eax
call fcn.004f5700
add esp, 4
mov dword [esi + 8], eax
cmp dword [esp + 0x3c], 0
mov eax, dword [esp + 0x30]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 0x38], eax
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x20], eax
mov dword [esi + 0x3c], 0
je 0x4e2834
cmp bl, 0x43
jne 0x4e2834
mov eax, 1
jmp 0x4e2836
xor eax, eax
mov cx, word [esp + 0x28]
cmp bl, 0x43
mov dword [esi + 0x40], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], eax
movzx eax, bl
mov word [esi + 0x14], ax
setne al
dec al
mov word [esi + 0x16], cx
and al, 0x20
mov dword [esi + 0x34], 0
mov byte [esi + 0x1a], al
mov dword [esi + 0x30], 0
movzx eax, word [ebp + 0x2e]
sub eax, 0xc
movzx ecx, cx
add ecx, 8
cdq
idiv ecx
push dword [esp + 0x44]
mov word [esi + 0x78], ax
push esi
mov dword [esi + 0x44], 1
call fcn.004e8ac0
add esp, 8
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x4e2b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4e2b99
push eax
call fcn.004ea850
mov eax, dword [edi + 0x14]
add esp, 4
cmp dword [eax + 0x44], 0
je 0x4e2b99
push eax
call fcn.004e9a40
add esp, 4
mov esi, dword [edi + 0x18]
test esi, esi
je 0x4e2bc2
push esi
call fcn.004ea850
add esp, 4
cmp dword [esi + 0x44], 0
je 0x4e2bb8
push esi
call fcn.004e9a40
add esp, 4
mov esi, dword [esi + 0x80]
test esi, esi
jne 0x4e2ba0
cmp dword [edi + 0x20], 0
mov esi, dword [edi + 0x3c]
je 0x4e2be1
push 0
push 0
push str.hb_cdxIndexFlushAvailPage_on_readonly_database.
push 0x238d
call fcn.00458c70
add esp, 0x10
cmp dword [edi + 0x1c], 0
je 0x4e2c03
cmp dword [edi + 0x40], 0
jne 0x4e2c03
push 0
push 0
push str.hb_cdxIndexFlushAvailPage_on_not_locked_index_file.
push 0x238e
call fcn.00458c70
add esp, 0x10
lea eax, [edi + 0x48]
push eax
push dword [edi + 8]
push dword [edi + 0xc]
call fcn.004c5b00
add esp, 0xc
test eax, eax
jne 0x4e2c2d
push eax
push eax
push str.hb_cdxIndexLockFlush:_flush_lock_failed.
push 0x2395
call fcn.00458c70
add esp, 0x10
mov ebp, dword [edi + 0x38]
test esi, esi
je 0x4e2cd3
cmp dword [esi + 4], 0
je 0x4e2cd3
movzx eax, word [edi + 0x2e]
push ebx
push eax
push 0
push eax
call fcn.0048bf00
add esp, 4
push eax
call fcn.0050abb0
add esp, 0xc
mov ebx, eax
nop
mov eax, dword [esi]
mov dword [ebx], eax
cmp dword [edi + 0x28], 0
je 0x4e2c70
movzx ecx, word [edi + 0x30]
jmp 0x4e2c72
xor ecx, ecx
mov eax, ebp
xor edx, edx
call fcn.00509a70
push edx
push eax
movzx eax, word [edi + 0x2e]
push eax
push ebx
push dword [edi + 8]
call fcn.004614a0
movzx ecx, word [edi + 0x2e]
add esp, 0x14
cmp eax, ecx
je 0x4e2cac
push 0
push 0
push str.Write_in_index_page_failed.
push 0x3f3
call fcn.00458c70
add esp, 0x10
mov dword [edi + 0x78], 1
mov ebp, dword [esi]
mov dword [esi + 4], 0
mov esi, dword [esi + 8]
test esi, esi
je 0x4e2cc9
cmp dword [esi + 4], 0
jne 0x4e2c60
push ebx
call fcn.0048bed0
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4e3060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
cmp dword [esi + 0x20], 0
mov ebx, dword [esi + 8]
mov dword [esp + 0x10], ebx
je 0x4e308e
push 0
push 0
push str.hb_cdxIndexGetAvailPage_on_readonly_database.
push 0x238d
call fcn.00458c70
add esp, 0x10
cmp dword [esi + 0x1c], 0
je 0x4e30b0
cmp dword [esi + 0x40], 0
jne 0x4e30b0
push 0
push 0
push str.hb_cdxIndexGetAvailPage_on_not_locked_index_file.
push 0x238e
call fcn.00458c70
add esp, 0x10
mov edi, dword [esi + 0x38]
test edi, edi
je 0x4e314a
cmp edi, 0xffffffff
je 0x4e314a
mov ebp, dword [esp + 0x20]
test ebp, ebp
jne 0x4e3152
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4e30f5
mov ecx, dword [eax]
mov dword [esi + 0x38], ecx
mov ecx, dword [eax + 8]
push eax
mov dword [esi + 0x3c], ecx
call fcn.0048bed0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp dword [esi + 0x28], 0
je 0x4e3101
movzx ecx, word [esi + 0x30]
jmp 0x4e3103
xor ecx, ecx
mov eax, edi
xor edx, edx
call fcn.00509a70
push edx
push eax
push 4
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00461000
add esp, 0x14
cmp eax, 4
je 0x4e3139
push 0
push 0
push str.hb_cdxIndexGetAvailPage:_Read_index_page_failed.
push 0x3f2
call fcn.00458c70
add esp, 0x10
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x38], eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x4e3158
movzx eax, word [esi + 0x2c]
jmp 0x4e315c
movzx eax, word [esi + 0x2e]
mov edi, dword [esi + 0x34]
xor ebx, ebx
movzx eax, ax
mov edx, edi
mov dword [esp + 0x14], eax
cmp edi, 0xffffffff
jne 0x4e3196
cmp dword [esi + 0x28], ebx
je 0x4e317a
movzx edi, word [esi + 0x30]
jmp 0x4e317c
xor edi, edi
push dword [esp + 0x10]
call fcn.004610d0
add esp, 4
mov ecx, edi
call fcn.00509a90
mov edi, eax
mov edx, eax
mov dword [esi + 0x34], edi
movzx eax, word [esi + 0x2e]
mov dword [esp + 0x1c], eax
nop
cmp dword [esi + 0x28], 0
je 0x4e31aa
xor ecx, ecx
jmp 0x4e31ae
movzx ecx, word [esi + 0x30]
mov eax, 1
shl eax, cl
mov ecx, dword [esp + 0x14]
add edx, eax
mov eax, dword [esp + 0x1c]
add ebx, eax
cmp ebx, ecx
jb 0x4e31a0
mov dword [esi + 0x34], edx
test ebp, ebp
je 0x4e326c
cmp ecx, eax
cmovae eax, ecx
push eax
push 0
push eax
mov dword [esp + 0x28], eax
call fcn.0048bf00
add esp, 4
push eax
call fcn.0050abb0
lea ecx, [esi + 0x48]
mov ebp, eax
push ecx
push dword [esi + 8]
push dword [esi + 0xc]
call fcn.004c5b00
add esp, 0x18
test eax, eax
jne 0x4e3217
push eax
push eax
push str.hb_cdxIndexLockFlush:_flush_lock_failed.
push 0x2395
call fcn.00458c70
add esp, 0x10
cmp dword [esi + 0x28], 0
je 0x4e3223
movzx ecx, word [esi + 0x30]
jmp 0x4e3225
xor ecx, ecx
mov eax, edi
xor edx, edx
call fcn.00509a70
mov ebx, dword [esp + 0x1c]
push edx
push eax
push ebx
push ebp
push dword [esp + 0x20]
call fcn.004614a0
add esp, 0x14
cmp eax, ebx
je 0x4e325c
push 0
push 0
push str.Write_in_index_page_failed.
push 0x3f3
call fcn.00458c70
add esp, 0x10
push ebp
mov dword [esi + 0x78], 1
call fcn.0048bed0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4e6960
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
test byte [esi + 0x20], 2
mov eax, dword [esi + 0x40]
mov ebx, dword [esi + 0x10]
movzx eax, word [eax + 0x16]
mov dword [esp + 0x1c], eax
lea ebp, [eax + 8]
jne 0x4e6998
push 0
push 0
push str.hb_cdxPageLeafDelKey:_page_is_not_a_leaf.
push 0x23f1
call fcn.00458c70
add esp, 0x10
test ebx, ebx
js 0x4e69a1
cmp ebx, dword [esi + 0xc]
jl 0x4e69b7
push 0
push 0
push str.hb_cdxPageLeafDelKey:_wrong_iKey_index.
push 0x23f1
call fcn.00458c70
add esp, 0x10
mov edi, dword [esi + 0x34]
test edi, edi
jne 0x4e69d9
mov eax, dword [esi + 0xc]
imul eax, ebp
push eax
call fcn.0048bf00
mov edi, eax
push edi
push esi
call fcn.004e67c0
add esp, 0xc
mov dword [esi + 0x34], edi
lea ecx, [ebx + 1]
imul ecx, ebp
mov dword [esp + 0x18], ecx
movzx eax, word [ecx + edi - 4]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x40]
movzx edx, word [eax + 0x16]
movzx eax, word [ecx + edi - 2]
movzx ecx, byte [esi + 0x1f]
sub ecx, eax
mov eax, dword [esi + 0xc]
sub ecx, dword [esp + 0x14]
dec eax
add ecx, edx
mov dword [esp + 0x10], ecx
cmp ebx, eax
jge 0x4e6aa6
lea eax, [ebx + 2]
xor ecx, ecx
imul eax, ebp
sub eax, 4
mov dword [esp + 0x28], eax
movzx eax, word [edi + eax]
sub dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
test ebx, ebx
jle 0x4e6a93
mov esi, dword [esp + 0x18]
lea eax, [ebx - 1]
mov ecx, dword [esp + 0x14]
imul eax, ebp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
add eax, edi
movzx eax, word [eax + esi + 6]
mov esi, dword [esp + 0x30]
sub edx, eax
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov dword [esp + 0x1c], edx
cmovb ecx, eax
cmp ecx, edx
jle 0x4e6a6b
mov ecx, edx
jmp 0x4e6a93
jge 0x4e6a93
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
lea edx, [edi + esi]
mov edi, dword [esp + 0x1c]
add edx, ecx
sub eax, esi
mov esi, eax
mov al, byte [edx]
cmp al, byte [esi + edx]
jne 0x4e6a8f
inc ecx
inc edx
cmp ecx, edi
jl 0x4e6a82
mov esi, dword [esp + 0x30]
mov eax, dword [esi + 0x34]
mov edx, dword [esp + 0x28]
add dword [esp + 0x10], ecx
mov word [edx + eax], cx
mov ecx, dword [esp + 0x10]
mov edi, dword [esi + 0xc]
add word [esi + 0x32], cx
dec edi
movzx eax, word [esi + 0x32]
mov dword [esi + 0xc], edi
cmp edi, ebx
jle 0x4e6add
mov eax, dword [esp + 0x18]
sub edi, ebx
add eax, dword [esi + 0x34]
imul edi, ebp
imul ebp, ebx
push edi
add ebp, dword [esi + 0x34]
push eax
push ebp
call fcn.0050a630
mov edi, dword [esi + 0xc]
add esp, 0xc
movzx eax, word [esi + 0x32]
xor edx, edx
movzx ebp, ax
cmp ebx, edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 1
setge dl
test edi, edi
jne 0x4e6afe
or edx, 4
jmp 0x4e6b06
test bp, bp
jns 0x4e6b06
or edx, 2
movzx ecx, byte [esi + 0x1f]
mov eax, edx
pop edi
or eax, 8
cmp bp, cx
pop esi
pop ebp
cmovl eax, edx
pop ebx
add esp, 0x1c
ret
Function at 0x4f4950
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
inc eax
push eax
call fcn.0048bf00
push dword [edi]
mov esi, eax
push dword [esp + 0x18]
push esi
call fcn.0050a630
mov ecx, dword [edi]
add esp, 0x10
cmp dword [esp + 0xc], 1
mov byte [esi + ecx], 0
jne 0x4f498c
xor eax, eax
cmp dword [edi], eax
jbe 0x4f498c
xor byte [eax + esi], 0xf3
inc eax
cmp eax, dword [edi]
jb 0x4f4983
pop edi
mov eax, esi
pop esi
ret

Function at 0x4f5c40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4f5c80
push esi
push edi
push eax
call fcn.00457d80
add esp, 4
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4f5c6c
test al, 0x10
je 0x4f5c6c
mov esi, 1
jmp 0x4f5c6e
xor esi, esi
test edi, edi
je 0x4f5c7b
push edi
call fcn.0048bed0
add esp, 4
pop edi
mov eax, esi
pop esi
ret
xor eax, eax
ret

Function at 0x4f5f00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4f5f40
push esi
push edi
push eax
call fcn.00457d80
add esp, 4
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4f5f2c
test al, 0x50
jne 0x4f5f2c
mov esi, 1
jmp 0x4f5f2e
xor esi, esi
test edi, edi
je 0x4f5f3b
push edi
call fcn.0048bed0
add esp, 4
pop edi
mov eax, esi
pop esi
ret
xor eax, eax
ret
Function at 0x4f8860
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
push edi
push dword [esp + 0x10]
xor ebx, ebx
call fcn.0047b570
add esp, 4
mov edi, eax
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
test ebp, ebp
je 0x4f88b0
lea eax, [ebp*2]
push esi
push eax
call fcn.0048bf00
add esp, 4
mov esi, eax
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
call fcn.0047b490
push esi
mov ebx, eax
call fcn.0048bed0
add esp, 8
pop esi
push edi
call fcn.0048bed0
add esp, 4
mov eax, ebx
pop edi
pop ebp
pop ebx
ret

Function at 0x508e70
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, dword [esp + 0x10]
mov esi, eax
test esi, esi
je 0x508ed1
test edi, edi
je 0x508e9d
xor ecx, ecx
cmp word [edi], cx
je 0x508e9a
inc ecx
cmp word [edi + ecx*2], 0
jne 0x508e92
inc esi
add esi, ecx
lea eax, [esi + esi]
push eax
call fcn.0048bf00
add esp, 4
mov ebx, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test edi, edi
je 0x508efa
dec esi
push esi
push 0x7a38d4
push ebx
call fcn.00508f20
push esi
push edi
push ebx
call fcn.00508f20
add esp, 0x18
jmp 0x508efa
xor esi, esi
cmp word [edi], si
je 0x508ee0
inc esi
cmp word [edi + esi*2], 0
jne 0x508ed8
lea esi, [esi*2 + 2]
push esi
call fcn.0048bf00
push esi
mov ebx, eax
push edi
push ebx
call fcn.0050a630
add esp, 0x10
push 8
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push ebx
mov esi, eax
call fcn.0048bed0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x50a2ce
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x50a30d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x50a30d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x50a30d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x50a30d
cmp dword [ecx + 0x74], 0xe
jbe 0x50a30d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x515324
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00509650
mov eax, dword [0x887490]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0051a011
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x515366
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x5154c2
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00509860
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x8b9228]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0051daf8
mov ecx, dword [esi*4 + 0x8b9228]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x5154bb
cmp eax, dword [ecx + edi + 0x24]
jne 0x5154bb
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5154bb
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0051daf8
add esp, 0x14
test edx, edx
jl 0x5154bb
jg 0x515431
test eax, eax
jb 0x5154bb
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x5154bb
jl 0x51544b
cmp dword [ebp - 0x1008], eax
ja 0x5154bb
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x515469
test ebx, ebx
je 0x5154a2
cmp ecx, edi
jae 0x5154a2
mov al, byte [ecx]
cmp al, 0xd
jne 0x515483
lea eax, [edi - 1]
cmp ecx, eax
jae 0x51548f
cmp byte [ecx + 1], 0xa
jne 0x51548f
inc ecx
jmp 0x51548f
movzx eax, al
movsx eax, byte [eax + 0x8876b0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x515469
cmp edx, ebx
jne 0x515469
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x5154c0
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005091ef
leave
ret

Function at 0x51ad7e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x7a61a8
push 0x7a61a0
push str.FlsAlloc
push 0x1f
call fcn.0051ac9a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x51adb2
push dword [ebp + 8]
mov ecx, esi
call dword [0x571b6c]
call esi
jmp 0x51adb8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x51adfc
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x7a61b8
push 0x7a61b0
push str.FlsGetValue
push 0x21
call fcn.0051ac9a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x51ae33
push dword [ebp + 8]
mov ecx, esi
call dword [0x571b6c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]