joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4189d1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x77c]
add eax, 1
mov dword [ebp - 0x77c], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x77c]
cmp edx, dword [ecx + 0x18]
jae 0x418aaa
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a4]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x780], edx
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a8]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19ac]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19b0], ecx
mov dword [ebp - 0x1a0], 0
jmp 0x41890e
mov edx, dword [ebp - 0x1a0]
add edx, 1
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4189c0
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
idiv edi
inc dword [ebp - 0x7a7bf040]
add byte [eax], al
invalid
idiv edi
inc dword [ebp - 0x7a7bf040]
add byte [eax], al
add byte [ecx + 0x51], dl
push ecx
push ecx
add esp, 4
call 0x41894e
add byte [eax + 0x4f], dl
xor edi, dword ss:[ebx]
aaa
dec ebp
inc eax
add esp, 4
pop ecx
push esi
jmp 0x41895b
or esi, 0x17f1e
or esi, 0x16269
jmp 0x41896c
pop esi
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
cmp edx, ecx
je 0x4189b2
mov edx, dword [ebp - 0x780]
add edx, dword [ebp - 0x1a0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1a0]
movsx edx, byte [ebp + ecx - 0x8a4]
cmp eax, edx
jne 0x4189b9
jmp 0x4188ff
jmp 0x4189c0
push ebx
call 0x4189d1
add byte [edi + 0x44], al
cmp byte [eax + 0x3b], cl
inc esp
xor cl, byte ds:[eax + 0x42]
add esp, 4
or ebx, 0x165f
pop ebx
push ecx
call 0x4189e8
add byte [ecx], bh
dec esi
xor bh, byte [ebx + esi]
add esp, 4
sub ecx, 0x38ff
pop ecx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
cmp ecx, eax
jne 0x418a1f
mov dword [ebp - 0xcd4], 0
jmp 0x418a8e
push ecx
add ecx, 0x184e0
pop ecx
push edi
push edx
add esp, 4
jmp 0x418a33
sub edi, 0x40d3
call 0x418a47
add byte [ebp + 0x3c], cl
inc ebx
inc edx
aaa
cmp dword [edi], esi
xor eax, 0x8104c483
out 0xca, eax
sub eax, 0x8b5f0000
lea eax, [eax + 0x3fffff8]
lea esp, [eax - 2]
invalid
cmp dword [ebp - 0xcd4], 0
jne 0x418aa5
mov edx, dword [ebp - 0x19b0]
mov dword [ebp - 0x3f8], edx
jmp 0x418ab6
jmp 0x41888f
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0
je 0x418b91
push ebx
push edx
add esp, 4
or ebx, 0x4412
pop ebx
push edi
xor edi, 0xe54f
and edi, 0x222d
and edi, 0x3815
call 0x418af1
add byte [edi + 0x45], al
aas
cmp eax, 0x3743404c
Function at 0x4189e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x77c]
add eax, 1
mov dword [ebp - 0x77c], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x77c]
cmp edx, dword [ecx + 0x18]
jae 0x418aaa
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a4]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x780], edx
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a8]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19ac]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19b0], ecx
mov dword [ebp - 0x1a0], 0
jmp 0x41890e
mov edx, dword [ebp - 0x1a0]
add edx, 1
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4189c0
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
idiv edi
inc dword [ebp - 0x7a7bf040]
add byte [eax], al
invalid
idiv edi
inc dword [ebp - 0x7a7bf040]
add byte [eax], al
add byte [ecx + 0x51], dl
push ecx
push ecx
add esp, 4
call 0x41894e
add byte [eax + 0x4f], dl
xor edi, dword ss:[ebx]
aaa
dec ebp
inc eax
add esp, 4
pop ecx
push esi
jmp 0x41895b
or esi, 0x17f1e
or esi, 0x16269
jmp 0x41896c
pop esi
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
cmp edx, ecx
je 0x4189b2
mov edx, dword [ebp - 0x780]
add edx, dword [ebp - 0x1a0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1a0]
movsx edx, byte [ebp + ecx - 0x8a4]
cmp eax, edx
jne 0x4189b9
jmp 0x4188ff
jmp 0x4189c0
push ebx
call 0x4189d1
add byte [edi + 0x44], al
cmp byte [eax + 0x3b], cl
inc esp
xor cl, byte ds:[eax + 0x42]
add esp, 4
or ebx, 0x165f
pop ebx
push ecx
call 0x4189e8
add byte [ecx], bh
dec esi
xor bh, byte [ebx + esi]
add esp, 4
sub ecx, 0x38ff
pop ecx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
cmp ecx, eax
jne 0x418a1f
mov dword [ebp - 0xcd4], 0
jmp 0x418a8e
push ecx
add ecx, 0x184e0
pop ecx
push edi
push edx
add esp, 4
jmp 0x418a33
sub edi, 0x40d3
call 0x418a47
add byte [ebp + 0x3c], cl
inc ebx
inc edx
aaa
cmp dword [edi], esi
xor eax, 0x8104c483
out 0xca, eax
sub eax, 0x8b5f0000
lea eax, [eax + 0x3fffff8]
lea esp, [eax - 2]
invalid
cmp dword [ebp - 0xcd4], 0
jne 0x418aa5
mov edx, dword [ebp - 0x19b0]
mov dword [ebp - 0x3f8], edx
jmp 0x418ab6
jmp 0x41888f
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0
je 0x418b91
push ebx
push edx
add esp, 4
or ebx, 0x4412
pop ebx
push edi
xor edi, 0xe54f
and edi, 0x222d
and edi, 0x3815
call 0x418af1
add byte [edi + 0x45], al
aas
cmp eax, 0x3743404c
Function at 0x418a47
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x77c]
add eax, 1
mov dword [ebp - 0x77c], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x77c]
cmp edx, dword [ecx + 0x18]
jae 0x418aaa
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a4]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x780], edx
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a8]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19ac]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19b0], ecx
mov dword [ebp - 0x1a0], 0
jmp 0x41890e
mov edx, dword [ebp - 0x1a0]
add edx, 1
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4189c0
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
idiv edi
inc dword [ebp - 0x7a7bf040]
add byte [eax], al
invalid
idiv edi
inc dword [ebp - 0x7a7bf040]
add byte [eax], al
add byte [ecx + 0x51], dl
push ecx
push ecx
add esp, 4
call 0x41894e
add byte [eax + 0x4f], dl
xor edi, dword ss:[ebx]
aaa
dec ebp
inc eax
add esp, 4
pop ecx
push esi
jmp 0x41895b
or esi, 0x17f1e
or esi, 0x16269
jmp 0x41896c
pop esi
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
cmp edx, ecx
je 0x4189b2
mov edx, dword [ebp - 0x780]
add edx, dword [ebp - 0x1a0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1a0]
movsx edx, byte [ebp + ecx - 0x8a4]
cmp eax, edx
jne 0x4189b9
jmp 0x4188ff
jmp 0x4189c0
push ebx
call 0x4189d1
add byte [edi + 0x44], al
cmp byte [eax + 0x3b], cl
inc esp
xor cl, byte ds:[eax + 0x42]
add esp, 4
or ebx, 0x165f
pop ebx
push ecx
call 0x4189e8
add byte [ecx], bh
dec esi
xor bh, byte [ebx + esi]
add esp, 4
sub ecx, 0x38ff
pop ecx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
cmp ecx, eax
jne 0x418a1f
mov dword [ebp - 0xcd4], 0
jmp 0x418a8e
push ecx
add ecx, 0x184e0
pop ecx
push edi
push edx
add esp, 4
jmp 0x418a33
sub edi, 0x40d3
call 0x418a47
add byte [ebp + 0x3c], cl
inc ebx
inc edx
aaa
cmp dword [edi], esi
xor eax, 0x8104c483
out 0xca, eax
sub eax, 0x8b5f0000
lea eax, [eax + 0x3fffff8]
lea esp, [eax - 2]
invalid
cmp dword [ebp - 0xcd4], 0
jne 0x418aa5
mov edx, dword [ebp - 0x19b0]
mov dword [ebp - 0x3f8], edx
jmp 0x418ab6
jmp 0x41888f
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0
je 0x418b91
push ebx
push edx
add esp, 4
or ebx, 0x4412
pop ebx
push edi
xor edi, 0xe54f
and edi, 0x222d
and edi, 0x3815
call 0x418af1
add byte [edi + 0x45], al
aas
cmp eax, 0x3743404c
Function at 0x418da2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push ebx
or ebx, 0xc2d4
jmp 0x418db3
pop ebx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x418dd1
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x418e2b
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x418cf9
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x418cf9
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x418e15
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x418e1f
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x418e74
push eax
xor eax, 0x111dc
and eax, 0x331c
add eax, 0x7d0a
and eax, 0x102a3
pop eax
push eax
push edi
add esp, 4
call 0x418e62
add byte [esi + 0x33], al
inc esp
dec edi
cmp byte [ebp + ecx*2 + 0x3b], al
dec esi
add esp, 4
pop eax
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x418edc
push edx
push eax
add esp, 4
xor edx, 0xa153
pop edx
push eax
sub eax, 0x63bd
sub eax, 0x7fc7
pop eax
push edx
push eax
add esp, 4
or edx, 0x139f9
sub edx, 0x13b6a
sub edx, 0x13a60
pop edx
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x418ed2
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x418c9d
mov dword [ebp - 0x2fc], 0

Function at 0x418e62
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push ebx
or ebx, 0xc2d4
jmp 0x418db3
pop ebx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x418dd1
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x418e2b
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x418cf9
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x418cf9
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x418e15
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x418e1f
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x418e74
push eax
xor eax, 0x111dc
and eax, 0x331c
add eax, 0x7d0a
and eax, 0x102a3
pop eax
push eax
push edi
add esp, 4
call 0x418e62
add byte [esi + 0x33], al
inc esp
dec edi
cmp byte [ebp + ecx*2 + 0x3b], al
dec esi
add esp, 4
pop eax
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x418edc
push edx
push eax
add esp, 4
xor edx, 0xa153
pop edx
push eax
sub eax, 0x63bd
sub eax, 0x7fc7
pop eax
push edx
push eax
add esp, 4
or edx, 0x139f9
sub edx, 0x13b6a
sub edx, 0x13a60
pop edx
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x418ed2
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x418c9d
mov dword [ebp - 0x2fc], 0
Function at 0x445b86
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x7fb960]
test eax, eax
je 0x445cf8
push eax
call fcn.0069870e
add esp, 4
test eax, eax
jne 0x445cf8
mov eax, dword [0x7fb960]
push eax
push 1
push 2
push 0x7faaf0
call fcn.006986f1
mov ecx, dword [0x7fb960]
push ecx
push 1
push 0x802
push 0x7fabf8
call fcn.006986f1
mov edx, dword [0x7fb960]
push edx
push 1
push 4
push 0x7fa0ec
call fcn.006986f1
mov eax, dword [0x7fb960]
push eax
push 1
push 4
push 0x7fa0bc
call fcn.006986f1
mov ecx, dword [0x7fb960]
add esp, 0x40
push ecx
push 1
push 0x100
push 0x7f9f60
call fcn.006986f1
mov edx, dword [0x7fb960]
push edx
push 1
push 0x100
push 0x7faaf8
call fcn.006986f1
mov eax, dword [0x7fb960]
push eax
push 1
push 0x100
push 0x7fb850
call fcn.006986f1
mov ecx, dword [0x7fb960]
push ecx
push 1
push 0x28
push 0x7fb828
call fcn.006986f1
mov edx, dword [0x7fb960]
add esp, 0x40
push edx
push 1
push 0x28
push 0x7fa094
call fcn.006986f1
mov eax, dword [0x7fb960]
push eax
push 1
push 0x1e
push 0x7fa06c
call fcn.006986f1
mov ecx, dword [0x7fb960]
push ecx
push 1
push 0x1e
push 0x7fa0cc
call fcn.006986f1
mov edx, dword [0x7fb960]
push edx
push 1
push 0x1e
push 0x7fb808
call fcn.006986f1
mov eax, dword [0x7fb960]
add esp, 0x40
push eax
push 1
push 0xa
push 0x7fa060
call fcn.006986f1
mov ecx, dword [0x7fb960]
push ecx
push 1
push 0xa
push 0x7fa0c0
call fcn.006986f1
mov edx, dword [0x7fb960]
push edx
push 1
push 8
push 0x7fb3fc
call fcn.006986f1
mov eax, dword [0x7fb960]
push eax
push 1
push 4
push 0x7fa090
call fcn.006986f1
mov ecx, dword [0x7fb960]
add esp, 0x40
push ecx
push 1
push 4
push 0x7faaf4
call fcn.006986f1
add esp, 0x10
ret
Function at 0x445d10
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x7fb960]
test eax, eax
je 0x445e8d
push eax
push 1
push 2
push 0x7faaf0
call fcn.00697336
mov eax, dword [0x7fb960]
push eax
push 1
push 0x802
push 0x7fabf8
call fcn.00697336
mov ecx, dword [0x7fb960]
push ecx
push 1
push 4
push 0x7fa0ec
call fcn.00697336
mov edx, dword [0x7fb960]
push edx
push 1
push 4
push 0x7fa0bc
call fcn.00697336
mov eax, dword [0x7fb960]
add esp, 0x40
push eax
push 1
push 0x100
push 0x7f9f60
call fcn.00697336
mov ecx, dword [0x7fb960]
push ecx
push 1
push 0x100
push 0x7faaf8
call fcn.00697336
mov edx, dword [0x7fb960]
push edx
push 1
push 0x100
push 0x7fb850
call fcn.00697336
mov eax, dword [0x7fb960]
push eax
push 1
push 0x28
push 0x7fb828
call fcn.00697336
mov ecx, dword [0x7fb960]
add esp, 0x40
push ecx
push 1
push 0x28
push 0x7fa094
call fcn.00697336
mov edx, dword [0x7fb960]
push edx
push 1
push 0x1e
push 0x7fa06c
call fcn.00697336
mov eax, dword [0x7fb960]
push eax
push 1
push 0x1e
push 0x7fa0cc
call fcn.00697336
mov ecx, dword [0x7fb960]
push ecx
push 1
push 0x1e
push 0x7fb808
call fcn.00697336
mov edx, dword [0x7fb960]
add esp, 0x40
push edx
push 1
push 0xa
push 0x7fa060
call fcn.00697336
mov eax, dword [0x7fb960]
push eax
push 1
push 0xa
push 0x7fa0c0
call fcn.00697336
mov ecx, dword [0x7fb960]
push ecx
push 1
push 8
push 0x7fb3fc
call fcn.00697336
mov edx, dword [0x7fb960]
push edx
push 1
push 4
push 0x7fa090
call fcn.00697336
mov eax, dword [0x7fb960]
add esp, 0x40
push eax
push 1
push 4
push 0x7faaf4
call fcn.00697336
mov ecx, dword [0x7fb960]
push ecx
call fcn.006968c0
add esp, 0x14
ret
inc dword [0x7fb964]
push ebx
push 0x100
xor ebx, ebx
push ebx
push 0x7faaf8
call fcn.00695690
push 0x100
push ebx
push 0x7fb850
call fcn.00695690
pxor xmm0, xmm0
movq qword [0x7fa0c0], xmm0
pxor xmm0, xmm0
movq qword [0x7fa060], xmm0
pxor xmm0, xmm0
add esp, 0x18
movq qword [0x7fb808], xmm0
movq qword [0x7fb810], xmm0
movq qword [0x7fb818], xmm0
pxor xmm0, xmm0
mov word [0x7fa0c8], bx
mov word [0x7fa068], bx
mov dword [0x7fb820], ebx
mov word [0x7fb824], bx
movq qword [0x7fa0cc], xmm0
movq qword [0x7fa0d4], xmm0
movq qword [0x7fa0dc], xmm0
mov dword [0x7fa0e4], ebx
mov word [0x7fa0e8], bx
cmp byte [0x7fb95d], bl
je 0x4471c3
call fcn.00445b60
jmp 0x4471d2
call fcn.00449c90
call fcn.00449900
call fcn.00446b50
cmp byte [0x7fb95c], bl
pop ebx
je 0x4471e0
jmp 0x445d00
ret
Function at 0x44a4e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x7dcee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
lea eax, [esi + esi + 2]
call fcn.00697040
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x6dcea0
push edi
call fcn.0069947e
mov esi, eax
add esp, 8
test esi, esi
je 0x44a5ce
push 0x8000
push 0
push 0
push esi
call fcn.00698db3
push 2
push 0
push esi
call fcn.00699333
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.0069923b
mov eax, dword [ebp + 0xc]
add esp, 0x24
test eax, eax
je 0x44a573
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
push 0
push 0
push esi
call fcn.00699333
mov eax, dword [ebp - 0xc]
mov edx, eax
add esp, 0xc
or edx, dword [ebp - 8]
mov ebx, eax
jne 0x44a591
mov eax, 1
push 1
push 0x122
push str..FilesIOWin32LoadSave.cpp
push eax
call fcn.00693100
push esi
push ebx
mov edi, eax
push 1
push edi
call fcn.006986f1
push esi
call fcn.00696ca7
add esp, 0x24
mov eax, edi
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0069528d
mov esp, ebp
pop ebp
ret
xor eax, eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0069528d
mov esp, ebp
pop ebp
ret
Function at 0x44bc80
Capabilities:
Create thread

Disassembly:
cmp dword [0x7fd1dc], 8
jge 0x44bce1
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push 0
push 0
push esi
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x44bcc4
push str.Create_Http_Thread
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044adc0
push esi
call fcn.0044bc30
add esp, 0xc
mov al, 1
pop esi
ret
mov edx, dword [0x7fd1dc]
lea ecx, [edx*8 + 0x7fd190]
inc edx
mov dword [ecx], eax
mov dword [ecx + 4], esi
mov dword [0x7fd1dc], edx
mov al, 1
pop esi
ret
xor al, al
ret

Function at 0x44c120
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x7dcee0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.0044aab0
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 0xc
push 0
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x804]
push ecx
push 0
push 0xfde9
call ebx
mov esi, eax
lea eax, [esi + esi + 2]
call fcn.00697040
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
lea edx, [ebp - 0x804]
push edx
push 0
push 0xfde9
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
lea esp, [ebp - 0x810]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0069528d
mov esp, ebp
pop ebp
ret

Function at 0x44c250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x7dcee0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
push eax
lea edx, [ebp - 0x804]
push 0x800
push edx
mov dword [ebp - 0x808], ecx
call fcn.0044aab0
lea eax, [ebp - 0x804]
push eax
call fcn.004ec0f0
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 0x10
push 0
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x804]
push ecx
push 0
push 0xfde9
call ebx
mov esi, eax
lea eax, [esi + esi + 2]
call fcn.00697040
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
lea edx, [ebp - 0x804]
push edx
push 0
push 0xfde9
call ebx
push 0x6dd150
push edi
call fcn.0069947e
mov esi, eax
add esp, 8
test esi, esi
jne 0x44c2e8
xor al, al
jmp 0x44c306
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x808]
push esi
push eax
push 1
push ecx
call fcn.00697336
push esi
call fcn.00696ca7
add esp, 0x14
mov al, 1
lea esp, [ebp - 0x814]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0069528d
mov esp, ebp
pop ebp
ret
Function at 0x4884c0
Capabilities:
Read file on windows

Disassembly:
cmp byte [esi], 0
je 0x4884fa
mov ecx, dword [esi + 0xc]
push ecx
push edi
push 1
push eax
call fcn.006986f1
add esp, 0x10
cmp edi, eax
je 0x488520
mov edx, dword [esi + 0xc]
push edx
call fcn.00698742
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 0x211
push eax
call fcn.00488040
add esp, 8
xor al, al
ret
cmp dword [esi + 8], edi
jae 0x48850f
push 0x211
call fcn.00488040
add esp, 4
xor al, al
ret
mov ecx, dword [esi + 0xc]
push edi
push ecx
push eax
call fcn.00695f10
add esp, 0xc
add dword [esi + 0xc], edi
mov al, 1
ret

Function at 0x497ee0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, edi
shr eax, 2
lea esi, [edx + eax*4]
neg eax
mov edx, eax
je 0x497f23
lea esp, [esp]
mov eax, dword [esi + edx*4]
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, ecx
rol eax, 0xd
add edx, 1
lea ecx, [eax + eax*4 - 0x19ab949c]
jne 0x497f00
mov eax, edi
and eax, 3
xor edx, edx
sub eax, 1
je 0x497f49
sub eax, 1
je 0x497f40
sub eax, 1
jne 0x497f5f
movzx edx, byte [esi + 2]
shl edx, 0x10
movzx eax, byte [esi + 1]
shl eax, 8
xor edx, eax
movzx eax, byte [esi]
xor eax, edx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor ecx, eax
xor ecx, edi
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
pop edi
xor eax, ecx
pop esi
ret

Function at 0x4aae70
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x4ab820
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
ret
Function at 0x4aefe0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x304
mov eax, dword [0x7dcee0]
xor eax, esp
mov dword [esp + 0x300], eax
push esi
push edi
push 0x200
lea eax, [esp + 0x10c]
push 0
push eax
call fcn.00695690
push 0x100
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.00695690
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
add esp, 0x18
push 0x100
lea edx, [esp + 0x10c]
push edx
push str.temp
mov esi, str.C:_temp
call edi
push 0x100
test eax, eax
ja 0x4af05e
lea edx, [esp + 0x10c]
push edx
push 0x6e3ba0
call edi
test eax, eax
jbe 0x4af077
push 0x100
lea eax, [esp + 0x10c]
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.0069bca9
lea esi, [esp + 0x14]
add esp, 0xc
mov eax, dword [0xa18c28]
test eax, eax
je 0x4af089
push eax
call fcn.0053c0a0
add esp, 4
push esi
call fcn.005410f0
push eax
mov dword [0xa18c28], eax
call fcn.005410f0
mov ecx, dword [esp + 0x310]
add esp, 8
pop edi
pop esi
xor ecx, esp
mov dword [0xa18c2c], eax
call fcn.0069528d
add esp, 0x304
ret
jmp 0x4aefe0

Function at 0x4af0d0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x304
mov eax, dword [0x7dcee0]
xor eax, esp
mov dword [esp + 0x300], eax
push esi
push edi
push 0x200
lea eax, [esp + 0x10c]
push 0
push eax
call fcn.00695690
push 0x100
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.00695690
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
add esp, 0x18
push 0x100
lea edx, [esp + 0x10c]
push edx
push str.temp
mov esi, str.C:_temp
call edi
push 0x100
test eax, eax
ja 0x4af05e
lea edx, [esp + 0x10c]
push edx
push 0x6e3ba0
call edi
test eax, eax
jbe 0x4af077
push 0x100
lea eax, [esp + 0x10c]
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.0069bca9
lea esi, [esp + 0x14]
add esp, 0xc
mov eax, dword [0xa18c28]
test eax, eax
je 0x4af089
push eax
call fcn.0053c0a0
add esp, 4
push esi
call fcn.005410f0
push eax
mov dword [0xa18c28], eax
call fcn.005410f0
mov ecx, dword [esp + 0x310]
add esp, 8
pop edi
pop esi
xor ecx, esp
mov dword [0xa18c2c], eax
call fcn.0069528d
add esp, 0x304
ret
jmp 0x4aefe0