joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1c00
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movsx eax, al
push esi
mov ecx, dword [edx]
mov esi, 0xff
xor eax, ecx
shr ecx, 8
and eax, esi
mov eax, dword [eax*4 + 0x528c38]
xor eax, ecx
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edx + 8]
inc ecx
mov dword [edx + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, esi
pop esi
xor eax, dword [ecx*4 + 0x528c38]
mov dword [edx + 8], eax
pop ebp
ret

Function at 0x4b3ead
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x4b3ee1
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4b3edc
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4b3f08
mov edx, dword [edi + 0x1c]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x18]
jbe 0x4b3ef1
mov esi, dword [edi + 0x18]
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.004d22d0
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x4b401f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4b402d
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x4b40e8
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x528c38]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x528c38]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x528c38]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x528c38]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x528c38]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x528c38]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x528c38]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x528c38]
dec edi
jne 0x4b404b
pop edi
test esi, esi
je 0x4b4101
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x528c38]
inc edx
dec esi
jne 0x4b40ec
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
Function at 0x4b6313
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x5520a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x4b6356
mov eax, 0x200
jmp 0x4b64ca
mov eax, dword [ebp - 0x38]
xor ecx, ecx
push esi
inc ecx
mov edx, eax
and edx, ecx
push 0
pop esi
cmovne esi, ecx
test al, 2
je 0x4b636e
or esi, 2
test al, 4
je 0x4b6375
or esi, 4
mov ecx, eax
and ecx, 0x10
je 0x4b637f
or esi, 0x10
test al, 0x20
je 0x4b6386
or esi, 0x20
test ecx, ecx
je 0x4b6392
or esi, 0x40000000
jmp 0x4b6398
or esi, 0x80000000
or esi, 0x1000000
test edx, edx
jne 0x4b63a8
or esi, 0x800000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x3c], eax
cmp eax, 0x28
jbe 0x4b6459
xor eax, eax
push eax
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x44]
push eax
push 2
lea eax, [ebp - 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push 0x24
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x44]
push eax
push 4
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x54ad
cmp word [ebp - 0x40], ax
jne 0x4b6456
mov ecx, dword [ebp - 0x58]
lea eax, [ecx + 0x34]
cmp dword [ebp - 0x3c], eax
jbe 0x4b6456
push 0
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x44]
push eax
push 4
lea eax, [ebp - 0x48]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x48]
cmp eax, 0x5a4d
je 0x4b6450
cmp eax, 0x454e
je 0x4b6450
cmp eax, 0x454c
je 0x4b6450
cmp eax, 0x4550
jne 0x4b6456
or esi, 0x400000
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x54]
test ecx, ecx
je 0x4b6462
mov dword [ecx], esi
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x4b646b
mov dword [ecx], eax
test ebx, ebx
je 0x4b649b
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.004b77d9
push dword [ebp - 0x20]
mov dword [ebx], eax
push dword [ebp - 0x24]
call fcn.004b77d9
push dword [ebp - 0x30]
mov dword [ebx + 4], eax
push dword [ebp - 0x34]
call fcn.004b77d9
add esp, 0x18
mov dword [ebx + 8], eax
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4b64c7
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.004b7766
movzx ecx, word [ebp - 0x40]
add esp, 0x10
movzx eax, word [ebp - 0x3c]
shl ecx, 0x10
or ecx, eax
mov dword [esi], ecx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004d11b3
mov esp, ebp
pop ebp
ret
Function at 0x4b6d72
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4b6d80
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x4b6e3b
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52afa8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52afa8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52afa8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52afa8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52afa8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52afa8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52afa8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52afa8]
dec edi
jne 0x4b6d9e
pop edi
test esi, esi
je 0x4b6e54
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52afa8]
inc edx
dec esi
jne 0x4b6e3f
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
Function at 0x4b7529
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov ecx, edi
mov ebx, edi
mov dword [ebp - 4], ecx
mov dword [esi + 0x6af80], 2
jmp 0x4b772c
cmp dword [esi + 0x6af90], 3
jb 0x4b75a6
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4b75e3
mov eax, dword [esi + 0x6af84]
sub eax, ecx
cmp eax, 0x7efa
ja 0x4b75e3
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x4b75cd
mov dword [esi + 0x6afa0], eax
push ecx
push esi
call fcn.004b80af
pop ecx
pop ecx
mov ecx, dword [esi + 0x6af90]
mov ebx, eax
cmp ebx, ecx
cmova ebx, ecx
cmp ebx, 3
jb 0x4b76b7
lea eax, [ebx - 3]
push eax
mov eax, dword [esi + 0x6af84]
sub eax, dword [esi + 0x6af88]
push eax
push esi
call fcn.004b708b
sub dword [esi + 0x6af90], ebx
add esp, 0xc
mov dword [ebp + 8], eax
cmp ebx, dword [esi + 0x6af98]
ja 0x4b767e
cmp dword [esi + 0x6af90], 3
jb 0x4b767e
dec ebx
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [esi + edx + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
dec ebx
jne 0x4b7621
mov eax, dword [ebp + 8]
jmp 0x4b76d6
add dword [esi + 0x6af84], ebx
mov ebx, edi
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp + 8]
jmp 0x4b76dc
mov eax, dword [esi + 0x6af84]
movzx eax, byte [eax + esi + 0x1af70]
push eax
push edi
push esi
call fcn.004b708b
add esp, 0xc
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x4b7716
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x4b76f4
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x4b76f6
mov edx, edi
mov eax, dword [esi + 0x6af84]
push edi
sub eax, ecx
push eax
push edx
push esi
call fcn.004b793b
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x4b7729
push esi
call fcn.004b77fd
pop ecx
mov ecx, dword [ebp - 4]
cmp dword [esi + 0x6af90], edi
jne 0x4b754b
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x4b774a
lea edi, [esi + 0x1af70]
add edi, ecx
mov eax, dword [esi + 0x6af84]
push 1
sub eax, ecx
push eax
push edi
push esi
call fcn.004b793b
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b7f83
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebx - 1]
cmp eax, 7
jbe 0x4b7fa1
mov dword [esi + 0x6afa4], str.bad_pack_level
xor edi, edi
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x4b7fc5
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
mov dword [esi + 0x6af6c], edi
push edi
push eax
call fcn.004d11d0
movzx eax, word [ebx*8 + 0x52af5a]
add esp, 0xc
mov dword [esi + 0x6af98], eax
movzx eax, word [ebx*8 + 0x52af58]
mov dword [esi + 0x6af9c], eax
movzx eax, word [ebx*8 + 0x52af5c]
push 2
mov dword [esi + 0x6afa0], eax
movzx eax, word [ebx*8 + 0x52af5e]
pop ecx
mov dword [esi + 0x6af94], eax
cmp ebx, ecx
jg 0x4b8028
mov eax, dword [ebp + 0x10]
or word [eax], 4
jmp 0x4b8033
cmp ebx, 8
jl 0x4b8033
mov eax, dword [ebp + 0x10]
or word [eax], cx
push 0x10000
lea ebx, [esi + 0x1af70]
mov dword [esi + 0x6af84], edi
push ebx
push esi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
test eax, eax
je 0x4b809a
cmp eax, 0xffffffff
je 0x4b809a
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x4b8075
push esi
call fcn.004b77fd
pop ecx
mov dword [esi + 0x6af7c], edi
mov ecx, edi
movzx eax, byte [ebx + edi]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc edi
mov dword [esi + 0x6af7c], ecx
cmp edi, 2
jb 0x4b807d
jmp 0x4b80aa
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4b8dcc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x78]
test ecx, ecx
je 0x4b8e1c
mov eax, dword [edi + 0x80]
mov esi, dword [edi + 0x7c]
cmp eax, esi
jae 0x4b8e59
sub esi, eax
cmp esi, dword [ebp + 0xc]
cmova esi, dword [ebp + 0xc]
add eax, ecx
push esi
push eax
push dword [ebp + 8]
call fcn.004d22d0
add dword [edi + 0x80], esi
add dword [edi + 0x68], esi
push esi
push dword [ebp + 8]
push dword [edi + 0x6c]
call fcn.004b6d72
add esp, 0x18
mov dword [edi + 0x6c], eax
mov eax, esi
jmp 0x4b8e5b
cmp dword [edi + 0x70], 0
je 0x4b8e52
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x70]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b8e59
mov esi, dword [ebp - 4]
add dword [edi + 0x68], esi
push esi
push dword [ebp + 8]
push dword [edi + 0x6c]
call fcn.004b6d72
add esp, 0xc
jmp 0x4b8e15
mov dword [edi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4b92ae
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movsx eax, al
push esi
mov ecx, dword [edx]
mov esi, 0xff
xor eax, ecx
shr ecx, 8
and eax, esi
mov eax, dword [eax*4 + 0x52afa8]
xor eax, ecx
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edx + 8]
inc ecx
mov dword [edx + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, esi
pop esi
xor eax, dword [ecx*4 + 0x52afa8]
mov dword [edx + 8], eax
pop ebp
ret

Function at 0x4b92fe
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp byte [esi + 0x2d], 0
je 0x4b9377
cmp dword [esi + 0x3c], 0
je 0x4b9330
cmp dword [esi + 0x40], edi
jae 0x4b932a
push dword [esi + 0x3c]
call fcn.004d0550
and dword [esi + 0x3c], 0
pop ecx
cmp dword [esi + 0x3c], 0
jne 0x4b9340
lea eax, [edi + edi]
push eax
call fcn.004d1376
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push ebx
push dword [esi + 0x3c]
call fcn.004d22d0
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x4b9374
lea ecx, [esi + 0x30]
mov eax, dword [esi + 0x3c]
movzx eax, byte [ebx + eax]
push eax
push ecx
call fcn.004b93d1
pop ecx
pop ecx
mov ecx, dword [esi + 0x3c]
mov byte [ebx + ecx], al
inc ebx
lea ecx, [esi + 0x30]
cmp ebx, edi
jb 0x4b9356
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4b93a6
mov edx, dword [esi + 0x24]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x28]
jb 0x4b9392
mov dword [esi + 0x14], 0x30000
jmp 0x4b93c8
push edi
add ecx, edx
push ebx
push ecx
call fcn.004d22d0
add esp, 0xc
mov eax, edi
add dword [esi + 0x24], edi
jmp 0x4b93ca
mov eax, dword [esi + 4]
test eax, eax
je 0x4b93c1
push 0
lea ecx, [ebp + 8]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x4b93ca
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4b9abc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b9ad6
test al, 0x10
jne 0x4b9ad6
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4b9c4c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8c
mov eax, dword [0x5520a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
and dword [ebp - 0xe84], 0
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x24c
mov dword [ebp - 0xe88], eax
lea eax, [ebp - 0xe80]
push 0
push eax
call fcn.004d11d0
xor eax, eax
mov ebx, 0x40e
push ebx
push eax
mov word [ebp - 0x824], ax
lea eax, [ebp - 0x822]
push eax
call fcn.004d11d0
xor eax, eax
push ebx
push eax
mov word [ebp - 0xc34], ax
lea eax, [ebp - 0xc32]
push eax
call fcn.004d11d0
xor eax, eax
push ebx
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.004d11d0
push edi
call fcn.004b9abc
add esp, 0x34
test eax, eax
je 0x4b9cf9
test esi, esi
je 0x4b9e57
lea eax, [ebp - 0xe84]
push eax
push edi
call esi
jmp 0x4b9e57
push edi
lea eax, [ebp - 0xc34]
push 0x52b8b8
push eax
call fcn.004d4466
add esp, 0xc
lea eax, [ebp - 0xe84]
push eax
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [ebp - 0xe8c], ebx
cmp ebx, 0xffffffff
je 0x4b9e57
test byte [ebp - 0xe84], 0x10
lea eax, [ebp - 0xe58]
je 0x4b9e04
push 0x528690
push eax
call fcn.004d081c
pop ecx
pop ecx
test eax, eax
je 0x4b9e32
lea eax, [ebp - 0xe58]
push 0x52867c
push eax
call fcn.004d081c
pop ecx
pop ecx
test eax, eax
je 0x4b9e32
lea eax, [ebp - 0xe58]
push eax
push edi
lea eax, [ebp - 0x414]
push 0x52b8c4
push eax
call fcn.004d4466
mov eax, dword [ebp - 0xe88]
add esp, 0x10
test eax, eax
je 0x4b9dea
lea ecx, [ebp - 0xe84]
push ecx
lea ecx, [ebp - 0x414]
push ecx
call eax
test eax, eax
jne 0x4b9de4
lea eax, [ebp - 0x414]
push 0x5c
push eax
call fcn.004d0892
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4b9e4a
push ebx
call fcn.004d085a
add eax, eax
push eax
push 0
push ebx
call fcn.004d11d0
mov ebx, dword [ebp - 0xe8c]
add esp, 0x10
mov eax, dword [ebp - 0xe88]
push eax
push esi
lea eax, [ebp - 0xe84]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004b9c4c
add esp, 0x10
jmp 0x4b9e32
push eax
push edi
lea eax, [ebp - 0x824]
push 0x52b8c4
push eax
call fcn.004d4466
add esp, 0x10
test esi, esi
je 0x4b9e32
lea eax, [ebp - 0xe84]
push eax
lea eax, [ebp - 0x824]
push eax
call esi
test eax, eax
je 0x4b9e50
lea eax, [ebp - 0xe84]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4b9d33
jmp 0x4b9e50
mov ebx, dword [ebp - 0xe8c]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d11b3
mov esp, ebp
pop ebp
ret
Function at 0x4ba15b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4ba169
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
not ecx
mov ebx, 0xff
cmp esi, 8
jl 0x4ba226
push edi
mov edi, esi
shr edi, 3
imul eax, edi, 0xfffffff8
add esi, eax
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52b8d8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52b8d8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52b8d8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52b8d8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52b8d8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52b8d8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52b8d8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52b8d8]
dec edi
jne 0x4ba18c
pop edi
test esi, esi
je 0x4ba23f
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x52b8d8]
inc edx
dec esi
jne 0x4ba22a
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
Function at 0x4bb993
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5520a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], esi
push edi
mov edi, ecx
test esi, esi
jne 0x4bb9c5
xor ebx, ebx
push ebx
push ebx
push ebx
push 2
call fcn.004be224
xor al, al
jmp 0x4bbaff
call fcn.004bb0f5
or dword [edi + 8], 0xffffffff
xor ebx, ebx
or dword [edi + 4], 0xffffffff
push 2
push ebx
push esi
call fcn.004d4fce
push esi
call fcn.004d53e1
push ebx
push ebx
push esi
mov dword [ebp - 0x24], eax
call fcn.004d4fce
mov esi, dword [ebp - 0x24]
add esp, 0x1c
test esi, esi
jne 0x4bba01
push ebx
push ebx
push ebx
push 0xd
mov ecx, edi
jmp 0x4bb9b9
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], ebx
mov byte [ebp - 0x1c], bl
call fcn.0040eab0
lea eax, [esi + 1]
push eax
call fcn.004d0695
push dword [ebp - 0x2c]
mov esi, eax
push 1
push dword [ebp - 0x24]
mov dword [ebp - 0x28], esi
push esi
mov byte [esi], bl
call fcn.004d4e93
add esp, 0x14
cmp eax, 1
je 0x4bba55
push esi
call fcn.004d069e
pop ecx
push ebx
push ebx
push ebx
push 2
mov ecx, edi
call fcn.004be224
jmp 0x4bbae8
mov edx, dword [ebp - 0x24]
mov ecx, esi
mov eax, ecx
mov byte [eax + edx], bl
cmp byte [eax], bl
je 0x4bbab5
mov al, byte [esi]
cmp al, 0xa
jne 0x4bba7b
mov eax, esi
sub eax, ecx
inc eax
push eax
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00404ee0
inc esi
jmp 0x4bbaac
cmp al, 0xd
jne 0x4bbab0
mov eax, esi
sub eax, ecx
test eax, eax
jle 0x4bba91
push eax
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00404ee0
push 0xa
push 1
lea ecx, [ebp - 0x1c]
call fcn.00404fd0
lea eax, [esi + 1]
cmp byte [eax], 0xa
jne 0x4bbaaa
add esi, 2
jmp 0x4bbaac
mov esi, eax
mov ecx, esi
jmp 0x4bbab1
inc esi
cmp byte [esi], bl
jne 0x4bba63
sub esi, ecx
je 0x4bbac3
push esi
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00404ee0
push dword [ebp - 0x28]
call fcn.004d069e
cmp dword [ebp - 8], 0x10
mov eax, dword [edi]
pop ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
cmovae ecx, dword [ebp - 0x1c]
push ebx
push ecx
mov ecx, edi
call dword [eax + 8]
cmp byte [edi + 0x40], bl
je 0x4bbaed
mov byte [ebp - 0x1d], bl
jmp 0x4bbaf1
mov byte [ebp - 0x1d], 1
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.00405220
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d11b3
mov esp, ebp
pop ebp
ret 8
Function at 0x4bfb58
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
call fcn.004a94f6
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4bfc05
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0x200000
ja 0x4bfc04
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 1]
push eax
mov dword [ebp - 4], ebx
mov dword [ebp + 8], edi
call fcn.004a99aa
mov edx, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov eax, edi
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4bfc04
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4bfc04
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
sub eax, ecx
add edx, ecx
mov dword [ebp + 8], eax
mov dword [ebp - 8], edx
test eax, eax
jne 0x4bfbb9
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
mov byte [eax + edi], bl
call fcn.004bf81d
test esi, esi
je 0x4bfc01
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8