joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x651ea8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4605a0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00552c0c
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4605dc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4605dc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00552c0c
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4606ab
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x460604
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x460637
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.005a3e5c
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00552c0c
mov esp, ebp
pop ebp
ret 4
mov al, bl
mov byte [ebp - 0x25], al
mov edx, dword [ecx]
cmp edx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x4606c1
lea ecx, [ebp - 0x25]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
push dword [esi + 0x4c]
movsx eax, al
push eax
call fcn.005a3e5c
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00552c0c
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x46069b
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0059888c
add esp, 0x10
cmp edi, eax
jne 0x4606ab
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x4605c7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00552c0c
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x4606ab
cmp eax, 1
jle 0x46067e
cmp eax, 3
jne 0x4606ab
mov al, byte [ebp - 0x25]
jmp 0x460652
Function at 0x460d60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x651ea8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x460df7
cmp byte [esi + 0x3d], 0
je 0x460df7
push 0xffffffffffffffff
call fcn.00460570
cmp eax, 0xffffffff
je 0x460db0
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx]
cmp edx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x460e09
lea edi, [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x28], edi
sub eax, 0
je 0x460dc2
sub eax, 1
je 0x460dc6
sub eax, 2
je 0x460df7
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00552c0c
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
lea eax, [ebp - 0x24]
sub edi, eax
je 0x460de0
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0059888c
add esp, 0x10
cmp edi, eax
jne 0x460db0
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00552c0c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00552c0c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
mov edi, dword [ebp - 0x28]
jmp 0x460da1

Function at 0x469390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x58edadb9
xor ecx, ecx
cmp byte [ebp - 4], cl
jbe 0x4693cb
mov eax, dword [ebp - 4]
xor eax, 0x80164043
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub eax, 0x29e08a43
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ecx*4 + 0x6da5a0], eax
inc ecx
movzx eax, byte [ebp - 4]
cmp ecx, eax
jb 0x4693a2
movups xmm0, xmmword [0x6da63d]
push esi
xor esi, esi
movups xmmword [0x6d7f30], xmm0
nop dword [eax]
call fcn.004a6820
mov dword [esi + 0x6d7f30], eax
add esi, 4
cmp esi, 0x10
jb 0x4693e0
push 0x10
push 0x6da5c5
push 0x6d7f30
push 0x6d7f14
call fcn.004a6cb0
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x488190
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
push 0x61ce5c
push str.interface.cfg
mov edi, ecx
call fcn.00598656
mov esi, eax
add esp, 8
test esi, esi
jne 0x4881b1
pop edi
xor al, al
pop esi
ret
push esi
push 0xc8
lea eax, [edi + 0x2630]
push 1
push eax
call fcn.00599550
push esi
call fcn.00598966
add esp, 0x14
mov al, 1
pop edi
pop esi
ret

Function at 0x4881e0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x262c], 0
je 0x48824f
push edi
push 0x61cb78
call dword [sym.imp.python27.dll_Py_BuildValue]
push eax
push str.OnSaveInterfaceStatus
push dword [esi + 0x262c]
call fcn.00546e10
push 0x61ce2c
push str.interface.cfg
call fcn.00598656
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x488231
push str.Cannot_open_interface.cfg
call fcn.004a4c60
add esp, 4
pop edi
pop esi
ret
push edi
push 0xc8
lea eax, [esi + 0x2630]
push 1
push eax
call fcn.0059888c
push edi
call fcn.00598966
add esp, 0x14
pop edi
pop esi
ret

Function at 0x48d730
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e5684
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x651ea8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [0x6da204], edi
mov dword [ebp - 4], 0
lea esi, [edi + 4]
mov dword [edi], vtable.CPythonTextTail.0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040f8e0
mov dword [esi], eax
lea esi, [edi + 0xc]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040f8e0
mov dword [esi], eax
lea esi, [edi + 0x14]
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040f8e0
mov dword [esi], eax
lea esi, [edi + 0x1c]
mov byte [ebp - 4], 3
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00429220
mov dword [esi], eax
lea esi, [edi + 0x24]
mov byte [ebp - 4], 4
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00429220
mov dword [esi], eax
mov ecx, edi
mov dword [edi + 0x2c], vtable.CDynamicPool_struct_CPythonTextTail::STextTail_.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
call fcn.0048d660
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48f100
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e1f28
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x651ea8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [str.UserDict.pyc]
xor edi, edi
cmp byte [eax], 0xa
je 0x48f1fb
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, 0x61cd20
push 4
push str.lib_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00406cf0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push dword [esi]
call fcn.00407aa0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.005a2e1d
add esp, 8
test eax, eax
jne 0x48f219
cmp dword [ebp - 0x14], 0x10
lea esi, [ebp - 0x28]
lea ecx, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push esi
push ecx
call ebx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x48f1e3
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x48f1d9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48f24d
push edx
push ecx
call fcn.00552c1d
add esp, 8
inc edi
mov eax, dword [edi*4 + 0x61cd20]
lea esi, [edi*4 + 0x61cd20]
cmp byte [eax], 0xa
jne 0x48f146
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00552c0c
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x48f249
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x48f23f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48f24d
push edx
push ecx
call fcn.00552c1d
add esp, 8
xor al, al
jmp 0x48f1fd
call fcn.0059841a
int3
Function at 0x48f270
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x651ea8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x104]
mov dword [ebp - 0x408], ecx
push eax
push 0x100
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x104]
cmp byte [eax + ecx - 1], 0x5c
je 0x48f2d3
mov edi, ecx
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x48f2c0
mov ax, word [0x62da8c]
mov word [edi], ax
lea ecx, [ebp - 0x104]
dec ecx
nop word [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x48f2e0
mov eax, dword [str.metin2client.dat]
mov dword [ecx], eax
mov eax, dword [0x62daa4]
mov dword [ecx + 4], eax
mov eax, dword [0x62daa8]
mov dword [ecx + 8], eax
mov eax, dword [0x62daac]
mov dword [ecx + 0xc], eax
mov al, byte [0x62dab0]
push ebx
mov byte [ecx + 0x10], al
call fcn.00418020
mov ebx, eax
lea edi, [ebp - 0x404]
mov edx, ebx
sub edi, ebx
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [edi + edx - 1], cl
test cl, cl
jne 0x48f323
push 7
lea eax, [ebp - 0x404]
push str.locale_
push eax
call fcn.005a11da
add esp, 0xc
test eax, eax
jne 0x48f362
lea ecx, [ebx + 7]
lea edx, [ebp - 0x404]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x48f355
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x104]
push eax
push 0x1ff
lea eax, [ebp - 0x304]
push eax
push 0
push esi
lea eax, [ebp - 0x404]
push eax
call edi
cmp byte [ebp - 0x304], 0
pop ebx
jne 0x48f3f3
push 0x1ff
lea eax, [ebp - 0x304]
push eax
push dword [ebp - 0x408]
push dword [0x6da1bc]
call dword [sym.imp.USER32.dll_LoadStringA]
cmp byte [ebp - 0x304], 0
jne 0x48f3f3
lea eax, [ebp - 0x104]
push eax
push 0x1ff
lea eax, [ebp - 0x304]
push eax
push 0
push esi
push 0x62dabc
call edi
cmp byte [ebp - 0x304], 0
jne 0x48f3f3
lea ecx, [ebp - 0x304]
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x48f3e6
lea eax, [ebp - 0x408]
mov ecx, 0x6da1c0
push eax
call fcn.0043f9f0
lea ecx, [ebp - 0x304]
mov esi, eax
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x48f410
sub ecx, edx
lea eax, [ebp - 0x304]
push ecx
push eax
mov ecx, esi
call fcn.00406cf0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00552c0c
mov esp, ebp
pop ebp
ret
Function at 0x48fe40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa8
mov eax, dword [0x651ea8]
xor eax, esp
mov dword [esp + 0xa4], eax
movups xmm0, xmmword [str.LoadingWindowClass]
mov eax, dword [0x62db98]
mov dword [esp + 0x88], eax
mov ax, word [0x62db9c]
movups xmmword [esp + 0x68], xmm0
mov word [esp + 0x8c], ax
lea eax, [esp + 0x68]
movups xmm0, xmmword [0x62db88]
push esi
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x28]
push edi
movups xmmword [esp + 0x80], xmm0
mov dword [esp + 0x28], ecx
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
push eax
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
mov dword [esp + 0x34], 0x48fcd0
mov dword [esp + 0x40], ecx
call dword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
jne 0x48fefe
push 0
push str.Hiba
push 0x62dbd8
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.00552c0c
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], vtable.Gdiplus::Image.0
push eax
push 0x62db58
mov dword [esp + 0x24], 0
call dword [sym.imp.gdiplus.dll_GdipLoadImageFromFile]
mov dword [esp + 0x20], 0
test eax, eax
je 0x48ff43
push 0
push str.Hiba
push 0x62dc54
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x490053
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push dword [esp + 0x20]
call dword [sym.imp.gdiplus.dll_GdipGetImageWidth]
mov ecx, dword [esp + 0x20]
test eax, eax
mov dword [esp + 0x10], 0
cmovne ecx, eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x20]
mov dword [esp + 0x28], ecx
call dword [sym.imp.gdiplus.dll_GdipGetImageHeight]
mov ecx, dword [esp + 0x20]
test eax, eax
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
cmovne ecx, eax
push 0
mov dword [esp + 0x24], ecx
call esi
push 1
mov edi, eax
call esi
mov ecx, dword [esp + 0x10]
sub eax, ecx
push 0
push dword [esp + 0x2c]
cdq
push 0
push 0
push ecx
mov ecx, dword [esp + 0x28]
sub eax, edx
sar eax, 1
sub edi, ecx
push ecx
push eax
mov eax, edi
cdq
sub eax, edx
sar eax, 1
push eax
push closesocket
push 0x62dc3c
lea eax, [esp + 0x98]
push eax
push 8
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x6d7f44], eax
test eax, eax
jne 0x48fff8
push eax
push str.Hiba
push str.Nem_siker
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x490053
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x6d7f44]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
lea eax, [esp + 0x54]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x490053
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
nop word [eax + eax]
lea eax, [esp + 0x54]
push eax
call edi
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea eax, [esp + 0x60]
push eax
call esi
test eax, eax
jne 0x490030
push dword [esp + 0x1c]
mov dword [esp + 0x1c], vtable.Gdiplus::Image.0
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
mov ecx, dword [esp + 0xac]
pop edi
pop esi
xor ecx, esp
call fcn.00552c0c
mov esp, ebp
pop ebp
ret
Function at 0x491960
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x662ab8]
test eax, eax
je 0x4919a4
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x662ab8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x49198e
push dword [0x662ab8]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [0x662abc]
mov dword [0x662ab8], 0
call dword [sym.imp.USER32.dll_SetFocus]
ret
Function at 0x4a52f0
Capabilities:
Get system information on windows
Print debug messages
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x24
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x134], eax
test ecx, ecx
jne 0x4a530f
mov ecx, dword [esi + 0x114]
add eax, ecx
mov dword [esi + 0x138], ecx
cmp eax, dword [esi + 0x114]
jbe 0x4a5328
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [esi + 0x134]
xor edx, edx
mov ecx, dword [ebp - 8]
mov eax, edi
div ecx
mov eax, dword [esi + 0x138]
mov ebx, edi
push 0
mov dword [ebp + 0x10], eax
sub ebx, edx
add eax, edi
mov dword [ebp + 0xc], ecx
push eax
push 0
push 2
push 0
push dword [esi + 0x110]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov dword [esi + 0x130], ecx
test ecx, ecx
jne 0x4a538c
push str.CMappedFile::Map__m_hFM_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
xor edx, edx
mov eax, edi
div dword [ebp + 0xc]
add edx, dword [ebp + 0x10]
push edx
push ebx
push 0
push 4
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x13c], eax
test eax, eax
jne 0x4a53cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CMappedFile::Map__m_lpMapData__lu
call fcn.004a4c60
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
sub eax, ebx
push 0
lea ecx, [eax + edi]
mov eax, dword [ebp + 8]
mov dword [esi + 0x140], ecx
mov dword [eax], ecx
mov ecx, esi
push dword [esi + 0x140]
mov dword [esi + 0x12c], 0
push dword [esi + 0x138]
call fcn.004a52d0
mov eax, dword [esi + 0x138]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4a6890
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x20
mov edx, edi
mov ecx, edi
shl ecx, 4
dec ebx
shr edx, 5
xor edx, ecx
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 0x10]
mov ecx, eax
and ecx, 3
add edx, edi
mov ecx, dword [ebx + ecx*4]
add ecx, eax
sub eax, 0x61c88647
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
shr ecx, 0xb
add edx, esi
and ecx, 3
mov ecx, dword [ebx + ecx*4]
mov ebx, dword [ebp + 0xc]
add ecx, eax
xor edx, ecx
add edi, edx
test ebx, ebx
jne 0x4a68a3
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov dword [eax + 4], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4a6980
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, 0xc6ef3720
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x20
mov edx, esi
mov ecx, esi
shl ecx, 4
dec ebx
shr edx, 5
xor edx, ecx
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 0x10]
mov ecx, eax
shr ecx, 0xb
add edx, esi
and ecx, 3
mov ecx, dword [ebx + ecx*4]
add ecx, eax
add eax, 0x61c88647
xor edx, ecx
sub edi, edx
mov edx, edi
mov ecx, edi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
and ecx, 3
add edx, edi
mov ecx, dword [ebx + ecx*4]
mov ebx, dword [ebp + 0xc]
add ecx, eax
xor edx, ecx
sub esi, edx
test ebx, ebx
jne 0x4a6996
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov dword [eax + 4], edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a7200
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4a72a9
cmp byte [esi], 0
je 0x4a72a9
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a7220
sub ecx, edx
cmp ecx, 3
jb 0x4a7237
cmp byte [esi + 1], 0x3a
jne 0x4a7237
add esi, 3
mov ecx, esi
mov dword [ebp + 8], esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a7240
sub ecx, edx
push edi
lea eax, [ecx + 1]
push eax
mov dword [ebp - 4], eax
call fcn.00552c2b
mov cl, byte [esi]
add esp, 4
mov edi, eax
test cl, cl
je 0x4a729f
push ebx
xor ebx, ebx
mov eax, esi
cmp cl, 0x2f
je 0x4a7270
cmp cl, 0x5c
jne 0x4a7292
push dword [ebp - 4]
push 0
push edi
call fcn.0058ff00
push ebx
push esi
push edi
call fcn.00598470
add esp, 0x18
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 1]
inc eax
inc ebx
mov dword [ebp + 8], eax
test cl, cl
jne 0x4a7266
pop ebx
push edi
call fcn.00552c34
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a7850
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
or eax, 0xffffffff
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 0x10
jb 0x4a78e2
mov ecx, edi
shr ecx, 4
push ebx
mov dword [ebp + 0xc], ecx
push esi
lea esi, [edx + 1]
mov ebx, 4
nop dword [eax + eax]
movsx ecx, byte [esi - 1]
lea esi, [esi + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6502c0]
movsx ecx, byte [esi - 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6502c0]
movsx ecx, byte [esi - 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6502c0]
movsx ecx, byte [esi - 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6502c0]
sub ebx, 1
jne 0x4a7880
add edx, 0x10
sub edi, 0x10
sub dword [ebp + 0xc], 1
jne 0x4a7870
pop esi
pop ebx
test edi, edi
je 0x4a7900
movsx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6502c0]
sub edi, 1
jne 0x4a78e6
not eax
pop edi
pop ebp
ret
Function at 0x4a7bd0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4a7bfb
xor eax, eax
pop edi
pop ebp
ret
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x4a7c20
Capabilities:
Get file size
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
push ebx
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x4a7c8e
push ebx
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
push ebx
push esi
call fcn.004a7850
add esp, 8
mov ebx, eax
test esi, esi
je 0x4a7c7e
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret