joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b260
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0x438
mov eax, 0x4742ca
call fcn.0044f666
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x424]
call fcn.00457c52
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x424]
cmp dword [eax - 0xc], 0
je 0x46b4bd
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46b4b7
push dword [ebp - 0x424]
push 0xffffffffffffffff
push str.item_count
push str.NotifyList
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x444], eax
cmp eax, 0xffffffff
je 0x46b4b7
xor esi, esi
mov dword [ebp - 0x43c], 1
mov dword [ebp - 0x428], esi
test eax, eax
jle 0x46b4af
push 0x49ccf0
lea ecx, [ebp - 0x434]
call fcn.00406102
push esi
push str.file_name_
lea eax, [ebp - 0x434]
mov byte [ebp - 4], 1
push str._s_d
push eax
call fcn.00406873
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0042ac90
mov esi, dword [ebp - 0x434]
lea eax, [ebp - 0x218]
add esp, 0x1c
push dword [ebp - 0x424]
push 0x104
push eax
push 0x48a9dc
push esi
push str.NotifyList
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.004394f4
pop ecx
test eax, eax
je 0x46b48a
push 0x49ccf0
lea ecx, [ebp - 0x438]
call fcn.00406102
push dword [ebp - 0x428]
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 2
push str.event_name_
push str._s_d
push eax
call fcn.00406873
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0042ac90
mov edi, dword [ebp - 0x438]
lea eax, [ebp - 0x420]
add esp, 0x1c
push dword [ebp - 0x424]
push 0x104
push eax
push 0x48a9dc
push edi
push str.NotifyList
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x420]
push eax
call fcn.004394f4
pop ecx
test eax, eax
je 0x46b482
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x430]
call fcn.0040651c
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x42c]
call fcn.0040651c
mov byte [ebp - 4], 4
lea eax, [ebp - 0x430]
mov ecx, dword [ebx + 4]
cmp eax, ecx
jae 0x46b446
cmp dword [ebx], eax
ja 0x46b446
sub eax, dword [ebx]
sar eax, 3
mov dword [ebp - 0x440], eax
cmp ecx, dword [ebx + 8]
jne 0x46b439
push ecx
mov ecx, ebx
call fcn.0040f8b7
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x440]
lea eax, [eax + ecx*8]
jmp 0x46b459
cmp ecx, dword [ebx + 8]
jne 0x46b453
push ecx
mov ecx, ebx
call fcn.0040f8b7
lea eax, [ebp - 0x430]
push eax
push dword [ebx + 4]
call fcn.0040f9d2
mov ecx, dword [ebp - 0x42c]
add dword [ebx + 4], 8
lea ecx, [ecx - 0x10]
call fcn.0040630c
mov ecx, dword [ebp - 0x430]
lea ecx, [ecx - 0x10]
call fcn.0040630c
lea ecx, [edi - 0x10]
call fcn.0040630c
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0
call fcn.0040630c
mov esi, dword [ebp - 0x428]
inc esi
mov dword [ebp - 0x428], esi
cmp esi, dword [ebp - 0x444]
jl 0x46b2e1
mov eax, dword [ebp - 0x424]
jmp 0x46b4c4
mov eax, dword [ebp - 0x424]
mov byte [ebp - 0x43c], 0
lea ecx, [eax - 0x10]
call fcn.0040630c
mov al, byte [ebp - 0x43c]
call fcn.0044f621
ret 4
Function at 0x46bb13
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x49a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0042ac90
add esp, 0xc
lea eax, [ebp - 0x20c]
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x48e65c
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0043aeae
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x49dc08], eax
test eax, eax
je 0x46bcbf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WinHttpOpen
push eax
call esi
push str.WinHttpConnect
push dword [0x49dc08]
mov dword [0x49dbac], eax
call esi
push str.WinHttpOpenRequest
push dword [0x49dc08]
mov dword [0x49dbb0], eax
call esi
push str.WinHttpAddRequestHeaders
push dword [0x49dc08]
mov dword [0x49dbb4], eax
call esi
push str.WinHttpSendRequest
push dword [0x49dc08]
mov dword [0x49dbb8], eax
call esi
push str.WinHttpReceiveResponse
push dword [0x49dc08]
mov dword [0x49dbbc], eax
call esi
push str.WinHttpQueryHeaders
push dword [0x49dc08]
mov dword [0x49dbc0], eax
call esi
push str.WinHttpReadData
push dword [0x49dc08]
mov dword [0x49dbc4], eax
call esi
push str.WinHttpCloseHandle
push dword [0x49dc08]
mov dword [0x49dbc8], eax
call esi
push str.WinHttpCrackUrl
push dword [0x49dc08]
mov dword [0x49dbcc], eax
call esi
push str.WinHttpSetOption
push dword [0x49dc08]
mov dword [0x49dbd0], eax
call esi
push str.WinHttpSetTimeouts
push dword [0x49dc08]
mov dword [0x49dbd4], eax
call esi
mov dword [0x49dbd8], eax
cmp dword [0x49dbac], edi
je 0x46bcb7
cmp dword [0x49dbb8], edi
je 0x46bcb7
cmp dword [0x49dbcc], edi
je 0x46bcb7
cmp dword [0x49dbb0], edi
je 0x46bcb7
cmp dword [0x49dbb4], edi
je 0x46bcb7
cmp dword [0x49dbc4], edi
je 0x46bcb7
cmp dword [0x49dbc8], edi
je 0x46bcb7
cmp dword [0x49dbc0], edi
je 0x46bcb7
cmp dword [0x49dbbc], edi
je 0x46bcb7
cmp dword [0x49dbd0], edi
je 0x46bcb7
cmp dword [0x49dbd4], edi
je 0x46bcb7
test eax, eax
je 0x46bcb7
inc edi
mov dword [0x49dba8], edi
jmp 0x46bcc5
mov edi, dword [0x49dba8]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004261a3
mov esp, ebp
pop ebp
ret
Function at 0x46bf8e
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x49a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0xfffffffffffffff5
pop edi
mov esi, ecx
push ecx
push ecx
mov ecx, 0x49dba8
push dword [esi + 8]
call fcn.0046b983
test eax, eax
je 0x46c121
push dword [esi + 8]
mov ecx, 0x49dba8
call fcn.0046b969
test eax, eax
je 0x46c121
push 0x402
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.0042ac90
push 0x402
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], 0x400
push 0
push eax
call fcn.0042ac90
add esp, 0x18
lea eax, [ebp - 0x40c]
mov ecx, 0x49dba8
push eax
lea eax, [ebp - 0x408]
push eax
push 0x13
push dword [esi + 8]
call fcn.0046b93f
test eax, eax
je 0x46c05f
mov eax, dword [ebp - 0x40c]
cmp eax, 0x402
jae 0x46c16a
mov byte [ebp + eax - 0x408], 0
lea eax, [ebp - 0x408]
push eax
call fcn.0043017d
mov edi, eax
xor eax, eax
cmp edi, 0xc8
pop ecx
cmove edi, eax
push 0x402
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], 0x400
push 0
push eax
call fcn.0042ac90
add esp, 0xc
lea eax, [ebp - 0x40c]
mov ecx, 0x49dba8
push eax
lea eax, [ebp - 0x408]
push eax
push 5
push dword [esi + 8]
call fcn.0046b93f
test eax, eax
je 0x46c0b9
mov eax, dword [ebp - 0x40c]
cmp eax, 0x402
jae 0x46c16a
mov byte [ebp + eax - 0x408], 0
cmp dword [0x49dc10], 0
lea eax, [ebp - 0x40c]
push eax
mov ecx, 0x400
lea eax, [ebp - 0x408]
push ecx
push eax
push dword [esi + 8]
mov dword [ebp - 0x40c], ecx
je 0x46c0e7
call dword [0x49dbc8]
jmp 0x46c0ed
call dword [0x49dbf8]
test eax, eax
je 0x46c121
mov eax, dword [ebp - 0x40c]
test eax, eax
je 0x46c129
cmp eax, 0x402
jae 0x46c16a
mov byte [ebp + eax - 0x408], 0
test ebx, ebx
je 0x46c0b9
push 0
push eax
lea eax, [ebp - 0x408]
mov ecx, ebx
push eax
call fcn.0040b12e
jmp 0x46c0b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push dword [esi + 8]
mov ebx, 0x49dba8
mov ecx, ebx
call fcn.0046b911
push dword [esi + 4]
mov ecx, ebx
call fcn.0046b911
push dword [esi]
mov ecx, ebx
call fcn.0046b911
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [esi + 8], eax
xor ecx, ebp
mov dword [esi + 4], eax
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.004261a3
mov esp, ebp
pop ebp
ret 4
call fcn.004265c5
int3

Function at 0x46c703
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
push ebx
push 0x80
push 3
push ebx
inc edi
mov word [ebp - 4], bx
push edi
push connect
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x46c76d
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 2
jb 0x46c766
push ebx
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46c766
cmp byte [ebp - 4], 0xff
jne 0x46c766
cmp byte [ebp - 3], 0xfe
cmove ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46c778
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov word [ebp - 4], 0xfeff
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor ecx, ecx
inc ecx
test eax, eax
cmovne esi, ecx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x46c7ae
Capabilities:
Write file on windows

Disassembly:
push 0xc
mov eax, 0x47456c
call fcn.0044f632
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov eax, dword [0x49ccf0]
mov ecx, 0x49ccf0
xor edi, edi
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
push edi
push 0x80
push 2
push edi
push 1
mov dword [ebp - 4], edi
push 0x40000000
push dword [ebx + 0x10]
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46c84d
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x14], edi
jne 0x46c81d
mov ecx, dword [ebp + 8]
push dword [ecx]
lea ecx, [ebp - 0x10]
call fcn.0040fda5
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push edi
push eax
push dword [esi - 0xc]
push esi
jmp 0x46c838
push ebx
call fcn.0046c778
test eax, eax
je 0x46c846
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x14]
push edi
push edx
mov ecx, dword [eax]
mov eax, dword [ecx - 0xc]
add eax, eax
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46c846
xor edi, edi
inc edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi - 0x10]
call fcn.0040630c
mov eax, edi
call fcn.0044f60c
ret 4
Function at 0x46c924
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov dword [ebp - 0x10], ebx
mov edi, esi
mov dword [ebp - 8], esi
push dword [ebx + 0x10]
mov dword [ebp - 0xc], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46cab3
push esi
push 0x80
push 3
push esi
push 1
push connect
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x46cab3
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp dword [ebp - 8], esi
jne 0x46ca9f
cmp ebx, 0x200000
ja 0x46ca9f
test ebx, ebx
je 0x46ca9f
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x14], esi
lea eax, [ebx + 1]
je 0x46ca0c
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00426214
pop ecx
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test ecx, ecx
je 0x46ca9f
lea eax, [ebx*2 + 2]
push eax
push esi
push ecx
call fcn.0042ac90
add esp, 0xc
push esi
push esi
push 2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x46ca9f
push esi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x46ca98
push eax
call fcn.00426214
mov edi, eax
pop ecx
test edi, edi
je 0x46ca9f
lea eax, [ebx + 1]
push eax
push esi
push edi
call fcn.0042ac90
add esp, 0xc
lea eax, [ebp - 0xc]
push esi
push eax
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46ca9f
push esi
push esi
push 0xffffffffffffffff
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
test ebx, ebx
je 0x46ca9f
xor ecx, ecx
lea eax, [ebx + 2]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00426214
pop ecx
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test ecx, ecx
je 0x46ca9f
lea eax, [ebx*2 + 2]
push eax
push esi
push ecx
call fcn.0042ac90
mov eax, dword [ebp + 8]
add esp, 0xc
push ebx
push dword [eax]
push 0xffffffffffffffff
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x46ca9f
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x46cab3
push edi
call fcn.0042620f
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46d2f1
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x278
mov eax, 0x474724
call fcn.0044f666
mov dword [ebp - 0x26c], edx
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x264]
mov edi, 0x49ccf0
mov dword [ebp - 0x280], ebx
push edi
mov dword [ebp - 0x278], ebx
call fcn.00406102
push edi
lea ecx, [ebp - 0x270]
mov dword [ebp - 4], ebx
call fcn.00406102
push esi
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 1
call fcn.004064f3
lea ecx, [ebp - 0x264]
call fcn.0046d5a0
push dword [ebp - 0x264]
lea eax, [ebp - 0x270]
push str._s.
push eax
call fcn.00406873
mov edi, dword [ebp - 0x270]
lea eax, [ebp - 0x260]
add esp, 0xc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x27c], eax
cmp eax, 0xffffffff
je 0x46d4ef
lea eax, [ebp - 0x234]
push 0x487d20
push eax
call fcn.00439b47
pop ecx
pop ecx
test eax, eax
je 0x46d4be
lea eax, [ebp - 0x234]
push 0x48d6dc
push eax
call fcn.00439b47
pop ecx
pop ecx
test eax, eax
je 0x46d4be
test byte [ebp - 0x260], 0x10
je 0x46d436
push 0x49ccf0
lea ecx, [ebp - 0x274]
call fcn.00406102
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 2
push eax
push dword [ebp - 0x264]
lea eax, [ebp - 0x274]
push str._s_s_
push eax
call fcn.00406873
mov esi, dword [ebp - 0x274]
add esp, 0x10
mov edx, dword [ebp - 0x26c]
mov ecx, esi
call fcn.0046d2f1
test eax, eax
jne 0x46d425
cmp dword [ebp - 0x26c], eax
je 0x46d52d
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.0040630c
jmp 0x46d4be
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x268]
call fcn.0040651c
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 3
call fcn.00406f35
lea eax, [ebp - 0x268]
push eax
lea edx, [ebp - 0x264]
lea ecx, [ebp - 0x284]
call fcn.0040404b
mov esi, dword [ebp - 0x278]
pop ecx
or esi, 1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x46d48f
cmp dword [ebp - 0x26c], eax
jne 0x46d48f
mov bl, 1
mov ecx, dword [ebp - 0x284]
and esi, 0xfffffffe
mov dword [ebp - 0x278], esi
lea ecx, [ecx - 0x10]
call fcn.0040630c
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x268]
lea ecx, [ecx - 0x10]
call fcn.0040630c
test bl, bl
jne 0x46d4e3
xor ebx, ebx
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x46d38e
mov dword [ebp - 0x280], 1
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0x264]
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call ebx
lea ecx, [ebp - 0x264]
call fcn.0046d27c
mov esi, dword [ebp - 0x264]
push esi
call ebx
lea ecx, [edi - 0x10]
call fcn.0040630c
lea ecx, [esi - 0x10]
call fcn.0040630c
mov eax, dword [ebp - 0x280]
call fcn.0044f621
ret
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.0040630c
jmp 0x46d4e3
Function at 0x46d706
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 4
mov eax, 0x4747fd
call fcn.0044f632
mov edi, ecx
push edi
lea ecx, [ebp - 0x10]
call fcn.0040651c
xor esi, esi
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46d77b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x46d77b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x46d77b
lea ecx, [ebp - 0x10]
call fcn.0046d224
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
je 0x46d77e
mov ecx, eax
call fcn.0046d706
test eax, eax
je 0x46d77e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x46d77b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x46d77e
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040630c
mov eax, esi
call fcn.0044f60c
ret

Function at 0x46dcd0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push connect
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x46dd5c
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp dword [ebp - 4], ebx
jne 0x46dd54
cmp edi, 0x200000
ja 0x46dd54
lea eax, [edi + 2]
push eax
call fcn.00426214
pop ecx
push ebx
lea ecx, [ebp + 8]
mov dword [ebp - 8], eax
push ecx
push edi
push eax
push esi
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46dd54
mov eax, dword [ebp + 8]
cmp eax, edi
jne 0x46dd54
mov ecx, dword [ebp - 8]
mov byte [eax + ecx], bl
mov eax, dword [ebp + 8]
mov byte [eax + ecx + 1], bl
inc ebx
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46e1aa
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x474a36
call fcn.0044f666
mov esi, ecx
mov edi, 0x49ccf0
lea ecx, [ebp - 0x30]
xor ebx, ebx
push edi
mov dword [ebp - 0x14], ebx
call fcn.00406102
mov dword [ebp - 4], ebx
mov ecx, edi
mov eax, dword [0x49ccf0]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x28], edi
push ebx
push ebx
push 2
xor ecx, ecx
mov dword [ebp - 0x18], ebx
push ebx
inc ecx
mov dword [ebp - 0x20], ebx
push ecx
push 0x40000000
push dword [ebp + 8]
mov byte [ebp - 4], cl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2c], eax
cmp eax, 0xffffffff
je 0x46e33f
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.0046d81c
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x30]
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
sub ecx, 1
je 0x46e2e2
sub ecx, 1
je 0x46e269
sub ecx, 1
jne 0x46e30f
push ebx
lea ecx, [ebp - 0x14]
mov word [ebp - 0x1c], 0xfeff
push ecx
push 2
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x2c]
call eax
test eax, eax
je 0x46e334
cmp dword [ebp - 0x14], 2
jne 0x46e334
mov eax, dword [esi - 0xc]
mov dword [ebp - 0x18], esi
add eax, eax
jmp 0x46e2dd
push ebx
lea ecx, [ebp - 0x14]
mov word [ebp - 0x24], 0xbbef
push ecx
push 3
lea ecx, [ebp - 0x24]
mov byte [ebp - 0x22], 0xbf
push ecx
push dword [ebp - 0x2c]
call eax
test eax, eax
je 0x46e334
cmp dword [ebp - 0x14], 3
jne 0x46e334
call dword [0x49a054]
test esi, esi
je 0x46e2ae
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x46e2b2
mov eax, ebx
jmp 0x46e2cb
lea edi, [eax + eax]
mov eax, edi
call fcn.0044f6e0
mov ecx, esp
push 0xfde9
push edi
mov edx, esi
call fcn.0040c7a0
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a914
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x18], edi
mov eax, dword [edi - 0xc]
mov dword [ebp - 0x20], eax
jmp 0x46e312
call dword [0x49a054]
mov dword [ebp - 0x18], eax
test esi, esi
je 0x46e2ae
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x46e2ae
lea edi, [eax + eax]
mov eax, edi
call fcn.0044f6e0
mov ecx, esp
push dword [ebp - 0x18]
jmp 0x46e2c3
mov eax, dword [ebp - 0x20]
push ebx
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46e334
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x14], eax
push 1
pop eax
cmove ebx, eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46e342
mov esi, dword [ebp - 0x30]
lea ecx, [edi - 0x10]
call fcn.0040630c
lea ecx, [esi - 0x10]
call fcn.0040630c
mov eax, ebx
lea esp, [ebp - 0x40]
call fcn.0044f621
ret 8
Function at 0x46e3cc
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x474aa4
call fcn.0044f666
mov esi, ecx
mov dword [ebp - 0x220], esi
xor edi, edi
mov dword [ebp - 4], edi
push 0x49ccf0
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x21c], edi
call fcn.00406102
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x21c], 1
call fcn.0042ac90
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004064f3
mov ecx, esi
call fcn.0046d5a0
mov eax, esi
call fcn.0044f621
ret
Function at 0x7ffe5495
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
call 0x7ffe54a0
pop edx
xor dx, dx
add edx, 0xd5e0
xor ecx, ecx
mov cl, 0x1e
xor byte [ecx + edx], 6
loop 0x7ffe54ae
push dword fs:[0x24]
pop dword [edx + 0xa]
mov cl, 0xff
nop
push edx
loop 0x7ffe54c1
cld
mov dword [edx + 0x11], 0xffffacbb
mov ecx, dword [eax + 0x2c]
cld
nop
mov dword [edx + 0x1b], ecx
mov dword [edx + 0x100], ecx
mov dword [eax + 0x2c], esp
push 0
stc
push 0
cld
push 0
cld
push 0
clc
push 0x30
nop
push 0x20
nop
push 0
clc
push 0
add edx, 0xffff7f37
cld
push edx
cld
push edx
nop
cld
push 0
call dword [edx + 0x820c]
add esp, 0x3f8
xor eax, eax
cld
cld
inc eax
stc
ret 0xc
Function at 0x16709d4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x16709de
pushal
call 0x16709e4
pop ebp
sub ebp, 0x10
sub ebp, 0x12709d4
jmp 0x16709fa
mov eax, 0x12709d4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bc
mov edx, 0xdaafc43d
xor byte [eax], dl
inc eax
dec ecx
jne 0x1670a11
jmp 0x1670a24
mov dh, 0xf0
mov dh, 0xb4
add dword [0xfcbc3d3d], edi
lds edi, [0xf03e3d3d]
test dword [ecx], edi
cmp eax, 0x15873d3d
cmp eax, 0xdfca3d3d
cmc
mov dh, 0xbc
xor dword [0xf83e3d3d], edi
insd dword es:[edi], dx
mov al, 0x59
sbb ecx, eax
mov ah, 0x39
sbb dword [ebp - 0x57], edx
hlt