joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4104a0
Capabilities:
Delete file

Disassembly:
sub esp, 0x804
mov eax, dword [0x4b81f4]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
push 0x4bd608
push esi
call fcn.0046d65e
add esp, 8
test eax, eax
je 0x4104e6
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.0046b4eb
add esp, 0x804
ret
mov eax, 0x4000
test word [0x4bd60e], ax
je 0x410606
push edi
push esi
push str._s.
lea edx, [esp + 0x10]
call fcn.004113e0
add esp, 8
push 0x4bd3b8
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4105e8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [ecx]
mov ecx, 0x4ae01c
mov eax, 0x4bd3e4
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x410566
test dx, dx
je 0x410562
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x410566
add eax, 4
add ecx, 4
test dx, dx
jne 0x410540
xor eax, eax
jmp 0x41056b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4105d0
mov ecx, 0x4adce0
mov eax, 0x4bd3e4
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4105a6
test dx, dx
je 0x4105a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4105a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x410580
xor eax, eax
jmp 0x4105ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4105d0
push 0x4bd3e4
push esi
push 0x4ae020
lea edx, [esp + 0x18]
call fcn.004113e0
lea edx, [esp + 0x18]
push edx
call fcn.004104a0
add esp, 0x10
push 0x4bd3b8
push edi
call ebx
test eax, eax
jne 0x410530
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.0046b4eb
add esp, 0x804
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.0046b4eb
add esp, 0x804
ret
Function at 0x410a50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48d551
mov eax, dword fs:[0]
push eax
sub esp, 0x350
mov eax, dword [0x4b81f4]
xor eax, esp
mov dword [esp + 0x348], eax
push ebx
push esi
push edi
mov eax, dword [0x4b81f4]
xor eax, esp
push eax
lea eax, [esp + 0x360]
mov dword fs:[0], eax
cmp byte [0x4bd2df], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
jne 0x410c47
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x156]
push edx
mov word [esp + 0x158], cx
call fcn.0046f9f0
lea eax, [esp + 0x158]
add esp, 0xc
push eax
mov byte [esp + 0x1b], 0
call fcn.00410630
add esp, 4
cmp eax, 1
jne 0x410c32
lea eax, [esp + 0x14c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410af0
sub eax, edx
sar eax, 1
xor edx, edx
test eax, eax
jle 0x410b34
jmp 0x410b10
movzx ecx, word [esp + edx*2 + 0x14c]
cmp cx, 0x41
jb 0x410b2f
cmp cx, 0x5a
ja 0x410b2f
add ecx, 0x20
mov word [esp + edx*2 + 0x14c], cx
inc edx
cmp edx, eax
jl 0x410b10
lea ecx, [esp + 0x14c]
push str.iexplore.exe
push ecx
call fcn.0046c3b8
add esp, 8
lea ecx, [esp + 0x24]
call fcn.0040f730
lea ebx, [esp + 0x14c]
mov edx, ebx
test edx, edx
jne 0x410b64
mov ebx, 0x4ac1f8
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410b70
sub eax, edx
sar eax, 1
lea edi, [eax + 1]
mov ecx, edi
lea esi, [esp + 0x2c]
mov dword [esp + 0x28], eax
call fcn.00410400
cmp byte [esp + 0x140], 0
lea eax, [esp + 0x30]
jne 0x410ba3
mov eax, dword [esp + 0x2c]
lea ecx, [edi + edi]
push ecx
add eax, 4
push ebx
push eax
call fcn.0046fa70
add esp, 0xc
mov dword [esp + 0x368], 1
mov byte [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov edx, dword [esp + 0x18]
push 5
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x374], 2
call fcn.0040e0e0
test al, al
jne 0x410bfc
lea edi, [esp + 0x1c]
call fcn.0040e6d0
mov bl, byte [esp + 0x17]
jmp 0x410bfe
mov bl, 1
lea edi, [esp + 0x1c]
call fcn.0040e630
cmp byte [esp + 0x140], 0
mov dword [esp + 0x24], vtable.t_str.0
jne 0x410c2e
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x30]
cmp eax, ecx
je 0x410c2e
push eax
call fcn.0046b865
add esp, 4
test bl, bl
jne 0x410c47
mov edx, dword [esp + 0x18]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x360]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x348]
xor ecx, esp
call fcn.0046b4eb
mov esp, ebp
pop ebp
ret
Function at 0x410d10
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebp
mov byte [esp + 0x13], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x410d46
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
push esi
push eax
call fcn.0046b942
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
push esi
push ecx
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x410da4
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0x4ad63c
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x410da4
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 0xa]
mov word [edi], cx
movzx edx, word [eax + 8]
mov word [edi + 2], dx
movzx ecx, word [eax + 0xe]
mov word [edi + 4], cx
movzx edx, word [eax + 0xc]
mov word [edi + 6], dx
mov byte [esp + 0xf], 1
cmp esi, ebx
je 0x410db1
push esi
call fcn.0046b865
add esp, 4
mov al, byte [esp + 0xf]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x410dc0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4b81f4]
xor eax, esp
mov dword [esp + 0x210], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.0046f9f0
add esp, 0xc
push 0x104
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x410e19
xor al, al
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0046b4eb
add esp, 0x214
ret
push edi
push str.kernel32.dll
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.0046eb1f
lea ecx, [esp + 0x18]
push ecx
lea edi, [esp + 0x14]
call fcn.00410d10
add esp, 0x10
pop edi
test al, al
je 0x410e02
movzx ecx, word [esp + 4]
movzx edx, word [esp]
movzx eax, word [esp + 2]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x210]
mov dword [esi + 4], edx
xor edx, edx
mov dword [esi + 8], eax
xor ecx, esp
mov dword [esi], 0x114
mov dword [esi + 0x10], 2
mov word [esi + 0x14], dx
mov al, 1
call fcn.0046b4eb
add esp, 0x214
ret
Function at 0x4116c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, eax
mov eax, dword [esp + 0x20]
mov esi, ecx
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 4]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x20]
push ecx
push 0
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x4117eb
test ebx, ebx
je 0x411797
cmp word [ebx], 0
je 0x411797
cmp byte [esi + 0x128], 0
je 0x411729
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x411730
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov eax, ebp
call fcn.0040e680
mov esi, eax
call fcn.0040f390
mov eax, ebp
call fcn.0040e680
mov esi, eax
push 0x4ae1d0
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
mov ecx, dword [esp + 0x28]
add ecx, 4
push ecx
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
push 0x4ad63c
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
push ebx
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
add esp, 0x20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0xc
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x4117a6
mov ebx, dword [esi + 0x14]
mov eax, ebp
call fcn.0040e680
mov esi, eax
call fcn.0040f390
mov eax, ebp
call fcn.0040e680
mov esi, eax
push 0x4ae1d0
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
add ebx, 4
push ebx
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0xc
mov eax, 1
cmp dword [esp + 0x18], eax
je 0x41189c
test ebx, ebx
je 0x411854
cmp word [ebx], 0
je 0x411854
cmp byte [esi + 0x128], 0
je 0x411816
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x41181d
mov edx, dword [esi + 0x14]
mov dword [esp + 0x20], edx
mov eax, ebp
call fcn.0040e680
xor edi, edi
mov esi, eax
call fcn.0040f390
mov eax, ebp
call fcn.0040e680
mov esi, eax
push 0x4ae1e0
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
mov eax, dword [esp + 0x28]
add eax, 4
push eax
jmp 0x411760
cmp byte [esi + 0x128], 0
je 0x411862
add esi, 0x18
jmp 0x411865
mov esi, dword [esi + 0x14]
mov eax, ebp
call fcn.0040e680
mov edi, eax
push 0x4ae1e0
push 0x4ad42c
mov edx, edi
call fcn.0040fd10
add esi, 4
push esi
push 0x4ad42c
mov edx, edi
call fcn.0040fd10
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], ecx
pop ebx
pop ecx
ret 0xc
Function at 0x4118b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
push eax
push ecx
push 1
push 0
mov esi, edx
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x411925
cmp byte [esi + 0x128], 0
push ebx
lea ebx, [esi + 0x18]
jne 0x4118e1
mov ebx, dword [esi + 0x14]
mov eax, ebp
call fcn.0040e680
mov esi, eax
call fcn.0040f390
mov eax, ebp
call fcn.0040e680
mov esi, eax
push 0x4ae1f8
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
add ebx, 4
push ebx
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
add esp, 0x10
pop ebx
pop edi
pop esi
xor al, al
pop ebp
ret 4
pop edi
pop esi
mov al, 1
pop ebp
ret 4
Function at 0x413eb0
Capabilities:
Set file attributes

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov esi, eax
mov eax, dword [edi + 0x130]
mov edx, dword [eax + 0x18]
lea ebx, [edi + 0x130]
push esi
push ebp
mov ecx, ebx
call edx
test al, al
jne 0x413eff
mov eax, ebp
call fcn.0040e680
push 0x4ad640
push 0x4ad42c
mov edx, eax
call fcn.0040fd10
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
mov ecx, ebx
call edx
test al, al
jne 0x413f64
push str.t_mutex::Lock
mov eax, ebp
call fcn.0040e730
xor ecx, ecx
add esp, 4
cmp al, cl
je 0x413ed8
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x14]
mov dword [edi + 0x348], ebx
mov ebx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x1c]
push edx
mov eax, ebp
mov dword [edi + 8], ebx
call fcn.00413cd0
add esp, 0xc
test al, al
jne 0x413fb6
cmp byte [esi + 0x11c], al
je 0x413f7a
add esi, 0xc
jmp 0x413f7d
mov eax, dword [ebx]
mov edx, dword [eax + 0x10]
push ebp
mov ecx, ebx
call edx
test al, al
je 0x413ed8
xor ecx, ecx
jmp 0x413f21
mov esi, dword [esi + 8]
mov eax, ebp
call fcn.0040e680
mov edi, eax
push 0x4ae5fc
push 0x4ad42c
mov edx, edi
call fcn.0040fd10
add esi, 4
push esi
push 0x4ad42c
mov edx, edi
call fcn.0040fd10
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0x80
push ebp
push 0
push eax
push ecx
mov eax, esi
call fcn.0040d4e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 4], eax
mov ebx, 1
cmp eax, 0xffffffff
jne 0x41405a
lea esp, [esp]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x24], eax
cmp eax, 0x20
jne 0x414012
cmp ebx, 3
jge 0x41409b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41402f
cmp eax, 5
jne 0x414070
cmp ebx, 3
jge 0x41409b
push 0x80
mov eax, esi
call fcn.0040d4e0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0x80
push ebp
push 0
push edx
push eax
mov eax, esi
call fcn.0040d4e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
inc ebx
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x413ff0
lea edx, [edi + 0xc]
mov eax, esi
call fcn.0040d580
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret 8
test eax, eax
jne 0x41409b
cmp byte [esi + 0x11c], al
je 0x414081
add esi, 0xc
jmp 0x414084
mov esi, dword [esi + 8]
mov eax, dword [esp + 0x20]
push 0x4ae60c
call fcn.0040a030
add esi, 4
push esi
jmp 0x413ee4
cmp byte [esi + 0x11c], 0
lea ebx, [esi + 0xc]
jne 0x4140aa
mov ebx, dword [esi + 8]
mov ebp, dword [esp + 0x20]
mov eax, ebp
call fcn.0040e680
mov edi, dword [esp + 0x24]
mov esi, eax
call fcn.0040f390
mov eax, ebp
call fcn.0040e680
mov esi, eax
push 0x4ae5fc
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
add ebx, 4
push ebx
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
Function at 0x414190
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov ebx, eax
mov edi, ecx
mov esi, edx
call ebp
test edi, edi
jne 0x4141b9
test ebx, ebx
je 0x4141af
mov dword [ebx], edi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ecx
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41423f
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x4141ea
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esp + 0x18]
call fcn.0040e680
mov esi, eax
call fcn.0040f390
push 0
call ebp
mov eax, dword [esp + 0x18]
call fcn.0040e680
mov esi, eax
push 0x4ae62c
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
add ebx, 4
push ebx
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x414249
mov dword [ebx], eax
test eax, eax
jne 0x4141af
cmp byte [esi + 0x128], al
je 0x41425e
add esi, 0x18
jmp 0x414261
mov esi, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
call fcn.0040e680
mov edi, eax
push 0x4ae63c
push 0x4ad42c
mov edx, edi
call fcn.0040fd10
add esi, 4
push esi
push 0x4ad42c
mov edx, edi
call fcn.0040fd10
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8

Function at 0x4142a0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov edi, eax
mov esi, ecx
call ebp
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41433d
push ebx
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x4142e8
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esp + 0x18]
call fcn.0040e680
mov esi, eax
call fcn.0040f390
push 0
call ebp
mov eax, dword [esp + 0x18]
call fcn.0040e680
mov esi, eax
push 0x4ae65c
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
add ebx, 4
push ebx
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
add esp, 0x10
pop ebx
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 0xc
test edi, edi
je 0x414347
mov ecx, dword [esp + 0xc]
mov dword [edi], ecx
pop edi
pop esi
mov al, 1
pop ebp
pop ecx
ret 0xc
Function at 0x414da0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x48d3ab
mov eax, dword fs:[0]
push eax
sub esp, 0x36c
mov eax, dword [0x4b81f4]
xor eax, esp
mov dword [esp + 0x368], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b81f4]
xor eax, esp
push eax
lea eax, [esp + 0x380]
mov dword fs:[0], eax
mov eax, dword [esp + 0x394]
mov ebp, dword [esp + 0x390]
mov ebx, ecx
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
xor edi, edi
mov dword [esp + 0x1c], ebp
cmp eax, edi
je 0x414e0e
push eax
call fcn.0046b865
add esp, 4
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
lea esi, [esp + 0x24]
call fcn.00415610
mov eax, dword [esp + 0x18]
push edi
push ebp
mov ecx, esi
mov dword [esp + 0x390], edi
call fcn.00413eb0
test al, al
je 0x414edc
mov edx, dword [esp + 0x28]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [esp + 0x20]
push ecx
push edx
mov dword [esp + 0x28], edi
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x414e5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x414e5c
xor esi, esi
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x37c], esi
mov dword [esp + 0x28], edi
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x414e86
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x414e86
xor esi, esi
lea edx, [esi + 4]
push edx
call fcn.0046b942
mov ebp, eax
add esp, 4
cmp ebp, edi
jne 0x414f0a
mov ebx, dword [esp + 0x18]
cmp byte [ebx + 0x11c], 0
je 0x414eaa
add ebx, 0xc
jmp 0x414ead
mov ebx, dword [ebx + 8]
mov eax, dword [esp + 0x1c]
call fcn.0040e680
push 0x4ae71c
mov esi, eax
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
add ebx, 4
push ebx
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
add esp, 0x10
mov dword [esp + 0x388], 0xffffffff
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00413df0
xor al, al
jmp 0x414fdc
mov edi, dword [esp + 0x1c]
push esi
push ebp
push edi
lea ecx, [esp + 0x37c]
call fcn.00415730
test al, al
jne 0x414f55
mov ebx, dword [esp + 0x18]
cmp byte [ebx + 0x11c], al
je 0x414f41
mov eax, edi
add ebx, 0xc
call fcn.0040e680
push 0x4ae5fc
jmp 0x414ebb
mov ebx, dword [ebx + 8]
mov eax, edi
call fcn.0040e680
push 0x4ae5fc
jmp 0x414ebb
lea edi, [esp + 0x24]
call fcn.00414100
mov edi, dword [esp + 0x1c]
push esi
push ebp
push edi
xor eax, eax
xor ecx, ecx
push ebx
mov word [esi + ebp + 2], ax
mov word [esi + ebp], cx
call fcn.00415170
test al, al
jne 0x414fb3
mov eax, dword [esp + 0x18]
cmp byte [eax + 0x11c], 0
lea esi, [eax + 0xc]
jne 0x414f8f
mov esi, dword [eax + 8]
push 0x4ae5fc
mov eax, edi
call fcn.0040a030
add esi, 4
push esi
push 0x4ad42c
mov edx, eax
call fcn.0040fd10
add esp, 8
jmp 0x414edc
mov dword [esp + 0x388], 0xffffffff
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00413df0
mov al, 1
mov ecx, dword [esp + 0x380]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x368]
xor ecx, esp
call fcn.0046b4eb
add esp, 0x378
ret 8
Function at 0x4156e0
Capabilities:
Get file size

Disassembly:
push 0
push eax
mov eax, dword [esp + 0xc]
mov ecx, edi
call fcn.00413eb0
test al, al
jne 0x4156f5
ret 4
mov edx, dword [edi + 4]
push esi
lea ecx, [esp + 8]
push ecx
push edx
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x415720
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x415720
xor esi, esi
mov dword [edi + 0x350], esi
mov al, 1
pop esi
ret 4
Function at 0x416670
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, ebx
call fcn.004163d0
test eax, eax
jl 0x4168a8
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x4166dd
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea esp, [esp]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x4166a0
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x4168a4
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x4a8948]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4a8948]
and esi, 0xff
mov esi, dword [esi*4 + 0x4a9548]
and edi, 0xff
xor esi, dword [edi*4 + 0x4a9d48]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4a8948]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4aa148]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x4a8948]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4a9948]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x4a8948]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4a8948]
and esi, 0xff
mov esi, dword [esi*4 + 0x4a9548]
and edi, 0xff
xor esi, dword [edi*4 + 0x4a9d48]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x4a8948]
and edi, 0xff
xor esi, dword [edi*4 + 0x4a9948]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4a8948]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4aa148]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x4a8948]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4a8948]
and esi, 0xff
mov esi, dword [esi*4 + 0x4a9548]
and edi, 0xff
xor esi, dword [edi*4 + 0x4a9d48]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x4a8948]
and edi, 0xff
xor esi, dword [edi*4 + 0x4a9948]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4a8948]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4aa148]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x4a8948]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4a8948]
and esi, 0xff
mov esi, dword [esi*4 + 0x4a9548]
and edi, 0xff
xor esi, dword [edi*4 + 0x4a9d48]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x4a8948]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4a8948]
and edi, 0xff
xor esi, dword [edi*4 + 0x4a9948]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4aa148]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x4166f1
pop edi
xor eax, eax
pop esi
ret
Function at 0x4173f0
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
mov edi, eax
cmp edi, 3
mov esi, edx
jl 0x417475
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub edi, eax
push ebx
lea ebx, [ebx]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
inc ecx
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edx, 1
jne 0x417410
pop ebx
test edi, edi
jle 0x4174d5
movzx edx, byte [esi]
shr edx, 2
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov al, byte [esi]
and al, 3
inc ecx
shl al, 4
cmp edi, 1
jle 0x41749d
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
cmp edi, 2
jge 0x4174bf
mov eax, 0x3d
mov byte [ecx], al
inc ecx
mov byte [ecx], al
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret
movzx eax, byte [esi + 1]
and eax, 0xf
movsx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret