joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465180
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.004916c0
mov eax, dword [0x4ccc64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4651b8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4651b8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x4652a4
mov ecx, ebx
mov edx, ebx
movzx eax, ax
jmp 0x4651d0
cmp ax, 0x2f
je 0x4651dc
cmp ax, 0x5c
jne 0x4651de
mov ecx, edx
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x4651d0
push edi
cmp ecx, ebx
je 0x46521f
sub ecx, ebx
sar ecx, 1
add ecx, ecx
mov edi, ecx
push edi
lea eax, [ebp - 0x4004]
push ebx
push eax
call fcn.0048cf70
lea edx, [ebp - 0x4004]
push edx
xor ecx, ecx
push esi
mov word [ebp + edi - 0x4004], cx
call fcn.00465180
add esp, 0x14
xor eax, eax
mov word [ebp - 0x2004], ax
test esi, esi
je 0x465245
lea edx, [ebp - 0x2004]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x465236
mov eax, ebx
mov edx, ebx
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x465250
lea edi, [ebp - 0x2004]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x465266
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2004]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x4652a4
push 0
lea edx, [ebp - 0x2004]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0048b97b
mov esp, ebp
pop ebp
ret
Function at 0x466460
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov eax, 0x400000
cmp edi, ebx
ja 0x466486
jb 0x46647e
cmp dword [ebp + 0xc], eax
jae 0x466486
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edi
jmp 0x466489
mov dword [ebp - 4], ebx
push eax
mov eax, dword [ebp + 8]
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
cmp ecx, ebx
jne 0x4664a7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x5a4d
cmp word [ecx], dx
jne 0x4664e8
mov esi, dword [ecx + 0x3c]
mov eax, esi
cdq
cmp edx, edi
ja 0x4664e8
jb 0x4664c2
cmp eax, dword [ebp + 0xc]
jae 0x4664e8
cmp dword [esi + ecx], 0x4550
jne 0x4664e8
mov edx, dword [esi + ecx + 0x54]
add edx, dword [esi + ecx + 0x24]
mov eax, dword [ebp + 0x14]
add edx, dword [esi + ecx + 0x20]
add edx, dword [esi + ecx + 0x1c]
mov dword [eax + 4], ebx
mov dword [eax], edx
mov ebx, 1
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466800
Capabilities:
Get file size
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [edi + 0x84]
cmp dword [edi + 0x80], ebx
push esi
lea esi, [edi + 0x74]
jbe 0x46681e
call fcn.0048c1a2
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ecx
cmp ecx, dword [esi + 0x10]
jbe 0x466836
call fcn.0048c1a2
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi]
push ebx
push edx
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00468990
xor ebx, ebx
cmp dword [edi + 0x18], ebx
je 0x466859
mov ecx, dword [edi]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [edi + 0x18]
mov eax, dword [edi]
push ebx
push ebx
neg edx
push 3
sbb edx, edx
push ebx
and edx, 0x40000000
push 3
add edx, 0x80000000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
je 0x466900
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x4668a7
or ecx, eax
or eax, eax
jmp 0x4668ab
mov ecx, eax
xor eax, eax
push ebx
mov edx, ecx
push edx
push eax
mov dword [edi + 0x14], eax
xor eax, eax
cmp dword [edi + 0x18], ebx
mov dword [edi + 0x10], ecx
mov ecx, dword [edi + 4]
setne al
lea eax, [eax + eax + 2]
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [edi + 8], eax
cmp eax, ebx
jne 0x4668e2
mov eax, 9
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [edi + 0x20]
cmp dword [ebp + 8], ebx
je 0x46690d
mov edx, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
push esi
push edx
push ecx
push eax
call fcn.00466460
add esp, 0x10
test eax, eax
jne 0x466912
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov edx, dword [edi + 0x14]
cmp edx, dword [esi + 4]
jb 0x466941
ja 0x466923
mov eax, dword [edi + 0x10]
cmp eax, dword [esi]
jbe 0x466941
mov ecx, edi
call fcn.00466f70
test eax, eax
jne 0x466941
cmp dword [edi + 0x18], ebx
je 0x466941
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push ecx
push edx
mov esi, edi
call fcn.00466750
pop esi
mov dword [edi + 0x8c], 1
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x468550
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0xc0000000
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4685ac
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4685a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
push ecx
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x4685c6
or eax, eax
or ecx, 0xffffffff
jmp 0x4685c8
xor ecx, ecx
push ebx
push eax
push ecx
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
cmp edi, ebx
jne 0x4685e2
mov ebx, 8
jmp 0x468659
lea edx, [ebp - 4]
push edx
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x4685fc
or eax, eax
or ecx, 0xffffffff
jmp 0x4685fe
xor ecx, ecx
lea edx, [ebp - 0x10]
push edx
push ecx
push eax
push edi
call fcn.00466460
add esp, 0x10
test eax, eax
je 0x46864d
mov ebx, dword [ebp - 0x10]
mov eax, ebx
or eax, dword [ebp - 0xc]
je 0x46864d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
push 0
lea edx, [ebp - 8]
push edx
push ebx
push esi
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x468642
mov ebx, 0xc
jmp 0x468659
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ebx, ebx
jmp 0x468659
push edi
mov ebx, 8
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46867f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e2a0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
push str.ntdll.dll
call esi
mov edi, eax
test edi, edi
je 0x46e339
push str.GetFinalPathNameByHandleW
push str.Kernel32.dll
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.NtQueryObject
push edi
mov dword [0x4d1780], eax
call esi
push str.NtOpenSymbolicLinkObject
push edi
mov dword [0x4d17b0], eax
call esi
push str.NtQuerySymbolicLinkObject
push edi
mov dword [0x4d17b4], eax
call esi
push str.ZwClose
push edi
mov dword [0x4d17b8], eax
call esi
push 0x68
push 0xff
push 0x4d1aa8
mov dword [0x4d17ac], eax
call fcn.0048cb00
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 0xc
push 0x4d1a90
call esi
push 0x4d1a74
call esi
mov dword [0x4d177c], 1
pop edi
pop esi
ret
Function at 0x4720c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
mov dword [ebp - 4], 0
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x4722df
lea ebx, [ebx]
cmp dword [esi + 0x6af90], 3
jb 0x472147
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af84]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af70], ecx
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x472187
mov edx, dword [esi + 0x6af84]
sub edx, ecx
cmp edx, 0x7efa
ja 0x472187
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x472172
mov dword [esi + 0x6afa0], eax
mov eax, ecx
call fcn.00471dd0
mov ebx, eax
mov eax, dword [esi + 0x6af90]
cmp ebx, eax
jbe 0x472187
mov ebx, eax
mov eax, dword [esi + 0x6af84]
mov ecx, esi
cmp ebx, 3
jb 0x47226c
sub eax, dword [esi + 0x6af88]
lea edx, [ebx - 3]
call fcn.004715c0
sub dword [esi + 0x6af90], ebx
mov ecx, dword [esi + 0x6af90]
mov dword [ebp - 8], eax
cmp ebx, dword [esi + 0x6af98]
ja 0x472234
cmp ecx, 3
jb 0x472234
mov edi, 1
sub ebx, edi
lea esp, [esp]
add dword [esi + 0x6af84], edi
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ecx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
sub ebx, edi
mov dword [esi + edx*4 + 0x2af70], ecx
mov edx, dword [esi + 0x6af84]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x6af7c]
mov dword [esi + ecx*4 + 0x4af70], edx
jne 0x4721d0
add dword [esi + 0x6af84], edi
mov eax, dword [ebp - 8]
jmp 0x472287
add dword [esi + 0x6af84], ebx
mov ecx, dword [esi + 0x6af84]
lea edx, [ecx + esi]
movzx ecx, byte [edx + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx edx, byte [edx + 0x1af71]
shl ecx, 5
xor edx, ecx
xor ebx, ebx
and edx, 0x7fff
mov dword [esi + 0x6af7c], edx
jmp 0x472287
movzx edx, byte [eax + esi + 0x1af70]
xor eax, eax
call fcn.004715c0
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x4722c1
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
jl 0x47229e
lea edx, [ecx + esi + 0x1af70]
jmp 0x4722a0
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
push edx
xor edi, edi
mov ecx, esi
call fcn.00471420
mov ecx, dword [esi + 0x6af84]
add esp, 4
mov dword [esi + 0x6af74], ecx
cmp dword [esi + 0x6af90], 0x106
jae 0x4722d2
call fcn.00471f70
cmp dword [esi + 0x6af90], 0
jne 0x4720f0
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
jl 0x4722f2
lea edx, [ecx + esi + 0x1af70]
jmp 0x4722f4
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
push edx
mov edi, 1
mov ecx, esi
call fcn.00471420
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472fa0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x472fa7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x473084
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4bac80]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x4bac80]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x4bac80]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4bac80]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4bac80]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4bac80]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4bac80]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4bac80]
inc ecx
sub edx, 8
sub esi, 1
jne 0x472fc0
pop edi
test edx, edx
je 0x4730ab
jmp 0x473090
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4bac80]
inc ecx
sub edx, 1
jne 0x473090
not eax
pop esi
ret

Function at 0x4730b0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4bac80]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x4bac80]
mov dword [edx + 8], ecx
ret
Function at 0x473240
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, eax
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x473266
mov eax, 0x200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x4c]
mov edx, eax
xor edi, edi
and edx, 1
je 0x47327c
mov dword [ebp - 8], 1
mov edi, dword [ebp - 8]
test al, 2
je 0x473283
or edi, 2
test al, 4
je 0x47328a
or edi, 4
mov ecx, eax
and ecx, 0x10
je 0x473294
or edi, 0x10
test al, 0x20
je 0x47329b
or edi, 0x20
test ecx, ecx
je 0x4732a7
or edi, 0x40000000
jmp 0x4732ad
or edi, 0x80000000
or edi, 0x1000000
mov dword [ebp - 8], edi
test edx, edx
jne 0x4732c3
or edi, 0x800000
mov dword [ebp - 8], edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp eax, 0x28
jbe 0x47336a
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [ebp - 0xc]
push ecx
push 2
lea edx, [ebp - 4]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea ecx, [ebp - 0x14]
push ecx
push esi
call ebx
mov edx, 0x54ad
cmp word [ebp - 4], dx
jne 0x473367
mov eax, dword [ebp - 0x14]
lea ecx, [eax + 0x34]
cmp dword [ebp - 0x10], ecx
jbe 0x473367
push 0
push 0
push eax
push esi
call edi
push 0
lea edx, [ebp - 0xc]
push edx
push 4
lea eax, [ebp - 0x18]
push eax
push esi
call ebx
mov eax, dword [ebp - 0x18]
cmp eax, 0x5a4d
je 0x473360
cmp eax, 0x454e
je 0x473360
cmp eax, 0x454c
je 0x473360
cmp eax, 0x4550
jne 0x473367
or dword [ebp - 8], 0x400000
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 8]
test eax, eax
je 0x473373
mov dword [eax], edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x47337f
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x38]
test esi, esi
je 0x4733f9
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
push 0
sub edx, 0xd53e8000
push 0x989680
sbb eax, 0x19db1de
push eax
push edx
call fcn.004915f0
mov dword [esi + 4], edx
push 0
mov ecx, ebx
sub ecx, 0xd53e8000
mov edx, edi
push 0x989680
sbb edx, 0x19db1de
push edx
push ecx
mov dword [esi], eax
call fcn.004915f0
mov ecx, dword [ebp - 0x44]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x48]
push 0
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
mov dword [esi + 0xc], edx
call fcn.004915f0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x473421
push edi
push ebx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
call fcn.004731e0
movzx ecx, word [ebp - 4]
movzx edx, word [ebp - 8]
shl ecx, 0x10
add esp, 0x10
or ecx, edx
mov dword [esi], ecx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4734d0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
je 0x4735bb
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x473507
cmp dword [esi + 0x40], edi
jae 0x473507
push eax
call fcn.0047d5e9
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x47351f
lea eax, [edi + edi]
push eax
call fcn.0047d5f4
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.0048cf70
add esp, 0xc
xor ebx, ebx
test edi, edi
jbe 0x4735b8
mov edx, dword [esi + 0x3c]
mov cl, byte [ebx + edx]
mov edi, dword [esi + 0x30]
mov byte [ebp + 8], cl
movsx ecx, cl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4bac80]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0x38]
shr edi, 8
xor dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4bac80]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, byte [ebp + 8]
inc ebx
mov byte [ebx + ecx - 1], al
cmp ebx, dword [ebp + 0xc]
jb 0x473537
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x20]
test edx, edx
je 0x4735fa
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x4735df
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.0048cf70
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x47361c
push 0
lea edx, [ebp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x473a70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [esi + 0x84]
push edi
test ecx, ecx
je 0x473ac3
mov eax, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
cmp eax, edi
jae 0x473b00
sub edi, eax
cmp edi, edx
jbe 0x473a97
mov edi, edx
push edi
add eax, ecx
push eax
push ebx
call fcn.0048cf70
mov eax, dword [esi + 0x78]
add dword [esi + 0x8c], edi
add dword [esi + 0x74], edi
add esp, 0xc
mov edx, edi
mov ecx, ebx
call fcn.00472fa0
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x473af9
push 0
lea ecx, [ebp - 4]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x473b00
mov edi, dword [ebp - 4]
mov eax, dword [esi + 0x78]
add dword [esi + 0x74], edi
mov edx, edi
mov ecx, ebx
call fcn.00472fa0
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x476170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5eda
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ccc64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push 0x4be890
xor esi, esi
push eax
mov dword [ebp - 0x18], esi
call fcn.0048fd5a
mov ebx, eax
add esp, 8
cmp ebx, esi
jne 0x4761d8
mov ecx, dword [0x4d1b78]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
cmp ecx, esi
je 0x4761c6
inc dword [ecx + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push esi
push ebx
call fcn.004902fa
add esp, 0xc
push ebx
call fcn.004901cb
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], esi
cmp edi, esi
jne 0x476229
push ebx
call fcn.004903f6
mov edx, dword [0x4d1b78]
mov eax, dword [ebp + 8]
mov ecx, edx
add esp, 4
mov dword [eax], edx
cmp ecx, esi
je 0x476349
inc dword [ecx + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push esi
push ebx
call fcn.004902fa
lea eax, [edi + 4]
add esp, 0xc
push eax
call fcn.0048c2b0
add esp, 4
push ebx
push edi
mov esi, eax
push 1
push esi
call fcn.00490011
push ebx
mov edi, eax
call fcn.004903f6
add esp, 0x14
push 0
push edi
push esi
mov byte [esi + edi], 0
mov byte [esi + edi + 1], 0
mov byte [esi + edi + 2], 0
mov byte [esi + edi + 3], 0
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test al, al
jne 0x4762bb
cmp byte [esi], 0xef
mov eax, 2
jne 0x476296
cmp byte [esi + 1], 0xbb
jne 0x476296
cmp byte [esi + 2], 0xbf
jne 0x476296
lea ecx, [eax + 1]
lea eax, [ecx - 2]
jmp 0x476299
mov ecx, dword [ebp - 0x10]
push eax
lea ebx, [esi + ecx]
call fcn.00474900
add esp, 4
push esi
mov edi, eax
call fcn.0048c1d3
add esp, 4
mov esi, edi
mov dword [ebp - 0x10], 0
jmp 0x4762df
mov al, byte [esi]
cmp al, 0xef
jne 0x4762ce
cmp byte [esi + 1], 0xff
jne 0x4762ce
mov dword [ebp - 0x10], 2
cmp al, 0xff
jne 0x4762df
cmp byte [esi + 1], 0xfe
jne 0x4762df
mov dword [ebp - 0x10], 2
test esi, esi
jne 0x476307
mov ecx, dword [0x4d1b78]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test ecx, ecx
je 0x476349
inc dword [ecx + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 0
lea ecx, [esi + edx]
push eax
call fcn.00475f90
push esi
call fcn.0048c1d3
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
add esp, 0xc
mov dword [esi], eax
test eax, eax
je 0x476330
inc dword [eax + 0x30]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
mov dword [ebp - 0x18], 1
call fcn.004769e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret