joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433750
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x10], 0
push edi
mov dword [esp + 0x1c], 0
cmp dword [esi], 0
jne 0x4337bd
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0xf0000008
push 1
push 0
push 0
push esi
call edi
test eax, eax
jne 0x4337bd
push eax
push 1
push eax
push str.Spreadsheet_Tools
push esi
call edi
test eax, eax
jne 0x4337bd
push 8
push 1
push eax
push str.Spreadsheet_Tools
push esi
call edi
test eax, eax
jne 0x4337bd
push 0x20
push 1
push eax
push str.Spreadsheet_Tools
push esi
call edi
test eax, eax
je 0x4337d8
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0x24]
call fcn.004334b0
add esp, 8
test al, al
jne 0x4337e3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
mov esi, dword [edi + 4]
sub esi, dword [edi]
mov ecx, esi
and ecx, 7
je 0x43380e
mov eax, 8
mov byte [esp + 0x13], 0
sub eax, ecx
mov ecx, edi
add esi, eax
lea eax, [esp + 0x13]
push eax
push edi
push esi
call fcn.00422560
push esi
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], esi
push eax
push 0
push 0
push 0
push 0
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ebx, eax
test ebx, ebx
je 0x433865
mov eax, dword [esp + 0x18]
cmp eax, esi
jbe 0x43384b
lea ecx, [esp + 0x13]
mov byte [esp + 0x13], 0
push ecx
push edi
push eax
mov ecx, edi
call fcn.00422560
push esi
lea eax, [esp + 0x1c]
push eax
push dword [edi]
push 0
push 0
push 0
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ebx, eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x433890
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 4], 0
push edi
mov dword [ebp - 8], 0
cmp dword [esi], 0
jne 0x4338f7
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0xf0000008
push 1
push 0
push 0
push esi
call edi
test eax, eax
jne 0x4338f7
push eax
push 1
push eax
push str.Spreadsheet_Tools
push esi
call edi
test eax, eax
jne 0x4338f7
push 8
push 1
push eax
push str.Spreadsheet_Tools
push esi
call edi
test eax, eax
jne 0x4338f7
push 0x20
push 1
push eax
push str.Spreadsheet_Tools
push esi
call edi
test eax, eax
je 0x433910
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
call fcn.004334b0
add esp, 8
test al, al
jne 0x43391a
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor esi, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
cmp ecx, eax
je 0x433940
sub eax, ecx
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push ecx
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x435f20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov edx, ecx
push edi
mov byte [ebp - 1], 0
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x4360c1
mov eax, dword [edx + 4]
cmp eax, dword [esi + 4]
jne 0x4360c1
mov eax, dword [edx + 8]
cmp eax, dword [esi + 8]
jne 0x4360c1
mov eax, dword [edx + 0xc]
cmp eax, dword [esi + 0xc]
jne 0x4360c1
mov al, byte [edx + 0x12]
cmp al, byte [esi + 0x12]
jne 0x4360c1
mov al, byte [edx + 0x10]
cmp al, byte [esi + 0x10]
jne 0x4360c1
mov al, byte [edx + 0x11]
cmp al, byte [esi + 0x11]
jne 0x4360c1
mov eax, dword [edx + 0x14]
cmp eax, dword [esi + 0x14]
jne 0x4360c1
mov eax, dword [edx + 0x18]
cmp eax, dword [esi + 0x18]
jne 0x4360c1
cmp dword [esi + 0x38], 8
lea eax, [esi + 0x24]
mov ecx, eax
jb 0x435fa7
mov ecx, dword [eax]
cmp dword [edx + 0x38], 8
lea ebx, [edx + 0x24]
jb 0x435fb3
mov ebx, dword [edx + 0x24]
mov edi, dword [edx + 0x34]
cmp edi, dword [eax + 0x10]
jne 0x4360c1
test edi, edi
je 0x435fe5
sub ebx, ecx
nop word [eax + eax]
mov ax, word [ebx + ecx]
cmp ax, word [ecx]
jne 0x4360c1
add ecx, 2
sub edi, 1
jne 0x435fd0
cmp dword [esi + 0x50], 8
lea eax, [esi + 0x3c]
mov ecx, eax
jb 0x435ff2
mov ecx, dword [eax]
cmp dword [edx + 0x50], 8
lea ebx, [edx + 0x3c]
jb 0x435ffe
mov ebx, dword [edx + 0x3c]
mov edi, dword [edx + 0x4c]
cmp edi, dword [eax + 0x10]
jne 0x4360c1
test edi, edi
je 0x436025
sub ebx, ecx
mov ax, word [ebx + ecx]
cmp ax, word [ecx]
jne 0x4360c1
add ecx, 2
sub edi, 1
jne 0x436010
mov eax, dword [edx + 0x1c]
cmp eax, dword [esi + 0x1c]
jne 0x4360c1
mov al, byte [edx + 0x20]
cmp al, byte [esi + 0x20]
jne 0x4360c1
cmp dword [esi + 0x74], 8
lea eax, [esi + 0x60]
mov ecx, eax
jb 0x43604a
mov ecx, dword [eax]
cmp dword [edx + 0x74], 8
lea ebx, [edx + 0x60]
jb 0x436056
mov ebx, dword [edx + 0x60]
mov edi, dword [edx + 0x70]
cmp edi, dword [eax + 0x10]
jne 0x4360c1
test edi, edi
je 0x436075
sub ebx, ecx
mov ax, word [ebx + ecx]
cmp ax, word [ecx]
jne 0x4360c1
add ecx, 2
sub edi, 1
jne 0x436064
cmp dword [esi + 0x8c], 8
lea eax, [esi + 0x78]
mov ecx, eax
jb 0x436085
mov ecx, dword [eax]
cmp dword [edx + 0x8c], 8
lea esi, [edx + 0x78]
jb 0x436094
mov esi, dword [edx + 0x78]
mov edx, dword [edx + 0x88]
cmp edx, dword [eax + 0x10]
jne 0x4360c1
test edx, edx
je 0x4360b6
sub esi, ecx
mov ax, word [esi + ecx]
cmp ax, word [ecx]
jne 0x4360c1
add ecx, 2
sub edx, 1
jne 0x4360a5
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43d520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0x43d741
cmp eax, 3
jb 0x43d596
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x43d5d3
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x43d5d3
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x43d5bd
mov dword [esi + 0x6afa0], eax
mov edx, ebx
mov ecx, esi
call fcn.0043d200
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x43d6c3
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
mov edx, ecx
mov ecx, esi
push eax
call fcn.0043c970
mov ecx, dword [esi + 0x6af90]
add esp, 4
sub ecx, edi
mov dword [ebp - 4], eax
mov dword [esi + 0x6af90], ecx
cmp edi, dword [esi + 0x6af98]
ja 0x43d688
cmp ecx, 3
jb 0x43d688
dec edi
nop word [eax + eax]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x43d620
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [ebp - 4]
jmp 0x43d6ea
mov edx, dword [esi + 0x6af84]
add edx, edi
xor edi, edi
mov dword [esi + 0x6af84], edx
movzx ecx, byte [esi + edx + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 4]
jmp 0x43d6ea
movzx eax, byte [esi + ecx + 0x1af70]
xor edx, edx
push eax
mov ecx, esi
call fcn.0043c970
dec dword [esi + 0x6af90]
add esp, 4
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
lea ecx, [esi + 0x1af70]
test eax, eax
je 0x43d71f
mov eax, dword [esi + 0x6af74]
sub edx, eax
push 0
push edx
lea edx, [eax + ecx]
xor ecx, ecx
test eax, eax
cmovs edx, ecx
mov ecx, esi
call fcn.0043c4c0
mov eax, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], eax
mov eax, dword [esi + 0x6af90]
cmp eax, 0x106
jae 0x43d739
mov ecx, esi
call fcn.0043d3c0
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x43d545
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x43d755
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x43d757
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 1
push eax
call fcn.0043c4c0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e4c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x43e4cb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x43e587
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f8080]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f8080]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f8080]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f8080]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f8080]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f8080]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f8080]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f8080]
sub edi, 1
jne 0x43e4e0
pop edi
test esi, esi
je 0x43e5aa
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f8080]
sub esi, 1
jne 0x43e590
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x43e5c0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x4f8080]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f8080]
mov dword [edi + 8], ecx
pop edi
pop esi
ret
Function at 0x43ed40
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x43ee17
mov ecx, dword [esi + 0x3c]
mov eax, ecx
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x43ed78
cmp dword [esi + 0x40], ebx
jae 0x43ed78
push ecx
call fcn.0047ce1d
add esp, 4
mov dword [esi + 0x3c], 0
xor eax, eax
test eax, eax
jne 0x43ed8e
lea eax, [ebx + ebx]
push eax
call fcn.0047d739
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push eax
call fcn.0047e730
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x43ee14
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, ecx
or edi, 2
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x4f8080]
xor eax, ecx
mov ecx, edi
mov dword [esi + 0x30], eax
xor ecx, 1
movzx eax, al
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x4f8080]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x43eda2
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x43ee55
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x43ee3c
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call fcn.0047e730
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x43ee77
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x43f440
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x84]
test edx, edx
je 0x43f4a3
mov ecx, dword [edi + 0x8c]
mov ebx, dword [edi + 0x88]
cmp ecx, ebx
jae 0x43f4eb
mov esi, dword [ebp + 8]
lea eax, [ecx + edx]
sub ebx, ecx
cmp ebx, dword [ebp + 0xc]
cmova ebx, dword [ebp + 0xc]
push ebx
push eax
push esi
call fcn.0047e730
mov ecx, dword [edi + 0x78]
mov edx, esi
add dword [edi + 0x8c], ebx
add dword [edi + 0x74], ebx
push ebx
call fcn.0043e4c0
add esp, 0x10
mov dword [edi + 0x78], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x43f4e4
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43f4eb
mov esi, dword [ebp - 4]
mov edx, ebx
mov ecx, dword [edi + 0x78]
add dword [edi + 0x74], esi
push esi
call fcn.0043e4c0
add esp, 4
mov dword [edi + 0x78], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x14], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x443060
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x44306b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x443127
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f86f0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f86f0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f86f0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f86f0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f86f0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f86f0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f86f0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f86f0]
sub edi, 1
jne 0x443080
pop edi
test esi, esi
je 0x44314a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f86f0]
sub esi, 1
jne 0x443130
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x443160
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x4f86f0]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f86f0]
mov dword [edi + 8], ecx
pop edi
pop esi
ret

Function at 0x443c50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov ebx, esi
mov dword [ebp - 8], esi
imul ebx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x443c98
push 0
lea ecx, [ebp + 8]
push ecx
push ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x443c8a
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
div esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ebx
add ecx, edx
push esi
push ecx
push dword [ebp - 4]
call fcn.0047e730
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443cd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x443d0b
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x443d06
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x443d38
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x443d1c
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.0047e730
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x443d4c
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x443d43
cmp byte [esi + 8], 0
je 0x443d43
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x445450
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 8], ebx
cmp dword [ebx], 0
jne 0x4455fa
cmp dword [ebx + 4], 0xffffffff
jne 0x4455fa
push edi
lea edi, [ebx + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445487
sub ecx, edx
sar ecx, 1
movzx eax, word [ebx + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x4454c3
cmp eax, 0x2f
je 0x4454c3
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4454b0
mov eax, dword [0x4f4818]
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
push esi
cmp edi, 1
jne 0x4454ee
mov esi, dword [ebp + 8]
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x445509
pop esi
pop edi
mov eax, 0x2000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 2
je 0x445506
cmp edi, 3
je 0x445506
pop esi
pop edi
mov eax, 0x10000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 8]
xor ebx, ebx
xor al, al
mov byte [ebp - 1], al
mov byte [ebp + 0x13], bl
cmp edi, 1
je 0x44554f
cmp edi, 2
jne 0x44556b
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x445549
pop esi
pop edi
mov eax, 0x200
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov byte [ebp + 0x13], 1
jmp 0x445555
mov ebx, esi
mov byte [ebp + 0x13], 0
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
setne al
mov byte [ebp - 1], al
push 0x20
call fcn.0047cddf
add esp, 4
mov esi, eax
cmp edi, 1
je 0x4455a6
cmp edi, 2
je 0x4455a6
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
mov word [esi], 0x100
mov byte [esi + 0x10], 0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0xc], 0
jmp 0x4455d7
mov al, byte [ebp + 0x13]
mov byte [esi + 0x10], al
mov al, byte [ebp - 1]
mov byte [esi], 1
mov byte [esi + 1], al
mov dword [esi + 4], ebx
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
test al, al
je 0x4455d7
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0xc], eax
mov ecx, esi
call fcn.004440d0
mov ecx, dword [ebp - 8]
mov edx, 0x200
pop esi
pop edi
pop ebx
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x1000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x445e00
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x50d080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x445e32
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x445e32
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x445f1c
push edi
mov edi, ebx
mov ecx, ebx
mov edx, eax
cmp dx, 0x2f
je 0x445e51
cmp dx, 0x5c
jne 0x445e53
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x445e45
cmp edi, ebx
je 0x445e9e
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call fcn.0047e730
add esp, 0xc
cmp edi, 0x208
jae 0x445f2c
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, esi
mov word [ebp + edi - 0x414], ax
call fcn.00445e00
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x445ec3
lea ecx, [ebp - 0x20c]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x445eb3
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x445ec5
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x445ee0
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x445f1c
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0047ce22
mov esp, ebp
pop ebp
ret
call fcn.0047d863
int3
Function at 0x456ee0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [edx + 0x14]
push ebx
movzx ebx, word [edx + 6]
add eax, 0x18
push esi
add eax, edx
xor esi, esi
push edi
mov edi, ecx
test ebx, ebx
je 0x456f18
nop dword [eax + eax]
mov edx, dword [eax + 0xc]
cmp edi, edx
jb 0x456f10
mov ecx, dword [eax + 8]
add ecx, edx
cmp edi, ecx
jb 0x456f1f
inc esi
add eax, 0x28
cmp esi, ebx
jb 0x456f00
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [eax + 0x14]
sub eax, edx
add eax, edi
add eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x456f30
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 4], edi
cmp edi, 0xffffffff
je 0x45701b
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 8], eax
test eax, eax
je 0x457014
push esi
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x45700a
mov eax, 0x5a4d
cmp ax, word [esi]
jne 0x457003
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x457000
push dword [ebp + 0xc]
mov edx, edi
mov ecx, esi
call fcn.004573b0
add esp, 4
test al, al
je 0x456fc3
mov bl, 1
jmp 0x457000
mov ecx, dword [edi + 0x88]
test ecx, ecx
je 0x457000
push esi
mov edx, edi
call fcn.00456ee0
mov edx, dword [ebp + 0xc]
mov ecx, edi
add edx, 0x18
push edx
push 0x69
push 0x4feca4
push 0
push eax
push eax
mov edx, esi
call fcn.00457030
add esp, 0x1c
movzx ebx, bl
test al, al
mov ecx, 1
cmovne ebx, ecx
mov edi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret