joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405bd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
push edi
mov edx, 0x811c9dc5
mov esi, dword [eax + 4]
mov edi, dword [eax]
test esi, esi
je 0x405c01
nop dword [eax + eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x405bf0
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40ad60
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x40adc1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x40ada4
cmp edi, 2
jb 0x40ada4
cmp byte [esi], cl
jne 0x40ada4
cmp byte [esi + 1], cl
jne 0x40ada4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x48c000]
jmp 0x40ad75
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x48c000]
test edi, edi
jne 0x40ad75
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x40adf0
cmp cl, 0x23
jne 0x40add7
cmp byte [esi], cl
jne 0x40add7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x48c000]
test cl, cl
jne 0x40adc8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x40af00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x40af14
mov dword [ebx], 0
mov edx, 0x4906d8
call fcn.0040ae00
mov esi, eax
test esi, esi
je 0x40b002
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x40aff8
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x40aff8
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x40aff8
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x40aff8
mov eax, dword [0x56e3a0]
test eax, eax
je 0x40af8c
inc dword [eax + 0xa8]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x40aff8
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x40afdd
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x56e3a0]
add esp, 4
test eax, eax
je 0x40afca
dec dword [eax + 0xa8]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x40afef
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c9e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4bf380]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc4]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0xcc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x48c000]
sub esi, 1
jne 0x40ca13
mov eax, dword [0x56e3a0]
not ebx
cmp dword [eax + 0x3de0], ebx
jne 0x40ca42
mov dword [eax + 0x3de4], ebx
cmp dword [eax + 0x3e24], ebx
jne 0x40ca51
mov byte [eax + 0x3e28], 1
cmp dword [eax + 0x3dc8], ebx
jne 0x40ca6a
push ecx
push edi
mov edx, 4
mov ecx, ebx
call fcn.0041e0f0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00485c99
mov esp, ebp
pop ebp
ret 4

Function at 0x40ca80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4bf380]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x18]
mov edi, 0x10
movss xmm1, dword [edx + 0xe0]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0xe4]
subss xmm0, xmm1
mov ecx, dword [edx + 0xc4]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xcc]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 0xc], xmm0
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x48c000]
sub edi, 1
jne 0x40cb00
mov eax, dword [0x56e3a0]
not edx
cmp dword [eax + 0x3de0], edx
jne 0x40cb2f
mov dword [eax + 0x3de4], edx
cmp dword [eax + 0x3e24], edx
jne 0x40cb3e
mov byte [eax + 0x3e28], 1
mov ecx, dword [ebp - 8]
mov eax, edx
pop edi
xor ecx, ebp
pop esi
call fcn.00485c99
mov esp, ebp
pop ebp
ret 4
Function at 0x4116e0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x41171d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x411703
cmp byte [esi], bl
jne 0x411703
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x48c000]
test bl, bl
jne 0x4116f4
pop edi
pop esi
not ecx
pop ebx
jmp fcn.00411680

Function at 0x416d30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4bf380]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x56e3a0]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x3da8]
mov esi, 4
mov eax, dword [edi + 0xc4]
add edi, 0xc4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x48c000]
sub esi, 1
jne 0x416d71
mov eax, dword [0x56e3a0]
not ebx
cmp dword [eax + 0x3dc8], ebx
jne 0x416dab
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.0041e0f0
add esp, 8
mov ecx, dword [edi + 4]
mov esi, dword [edi]
cmp esi, ecx
jne 0x416dd6
inc esi
test ecx, ecx
je 0x416dc4
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x416dc9
mov eax, 8
cmp eax, esi
mov ecx, edi
cmovg esi, eax
push esi
call fcn.0041ea40
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00485c99
mov esp, ebp
pop ebp
ret
Function at 0x41d180
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x51c4], 0
lea esi, [edi + 0x51c8]
je 0x41d202
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x41d1bc
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.0041edc0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.0040b630
mov edx, dword [esi]
mov ecx, 0x56e399
push dword [edi + 0x51c4]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x51d0]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.0040b630
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4275a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4275da
mov eax, dword [0x56e3a0]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x4275cd
dec dword [eax + 0xa8]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x42760b
mov eax, dword [0x56e3a0]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x4275fe
dec dword [eax + 0xa8]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x42763c
mov eax, dword [0x56e3a0]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x42762f
dec dword [eax + 0xa8]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x427689
mov eax, dword [0x56e3a0]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x42767c
dec dword [eax + 0xa8]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x4276ba
mov eax, dword [0x56e3a0]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x4276ad
dec dword [eax + 0xa8]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x4276eb
mov eax, dword [0x56e3a0]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x4276de
dec dword [eax + 0xa8]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.0042a250
Function at 0x44e750
Capabilities:
Enumerate process modules
Enumerate processes
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x668
mov eax, dword [0x4bf380]
xor eax, esp
mov dword [esp + 0x664], eax
push esi
push edi
mov edi, ecx
xorps xmm0, xmm0
lea eax, [edi + 0x10]
movups xmmword [eax], xmm0
push eax
movups xmmword [eax + 0x10], xmm0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [eax + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
push 2
mov dword [esp + 0x18], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x44e922
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x44e922
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x34]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44e816
test dx, dx
je 0x44e812
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44e816
add eax, 4
add ecx, 4
test dx, dx
jne 0x44e7f0
xor eax, eax
jmp 0x44e81b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44e90d
cmp dword [esp + 0x24], 0x14
jbe 0x44e90d
mov eax, dword [esp + 0x18]
push eax
push 0
push 0x1fffff
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push dword [esp + 0x18]
mov dword [edi], eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0x240], 0x428
lea eax, [esp + 0x240]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
nop dword [eax]
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x260]
nop word [eax + eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x44e8a6
test dx, dx
je 0x44e8a2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x44e8a6
add ecx, 4
add eax, 4
test dx, dx
jne 0x44e880
xor eax, eax
jmp 0x44e8ab
sbb eax, eax
or eax, 1
test eax, eax
je 0x44e8c4
lea eax, [esp + 0x240]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x44e870
jmp 0x44e902
mov eax, dword [esp + 0x254]
push dword [edi + 4]
mov dword [edi + 8], eax
mov eax, dword [esp + 0x25c]
push str.process_id__d_n
mov dword [edi + 0xc], eax
call fcn.00404af0
push dword [edi + 8]
push str.process_base_address___u_n
call fcn.00404af0
push dword [edi + 0xc]
push str.process_module_end___ul_n
call fcn.00404af0
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x44e7e6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x66c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00485c99
mov esp, ebp
pop ebp
ret 4
Function at 0x458360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x45838c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x4583b4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x4583ba
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x458422
jg 0x4583d1
test esi, esi
je 0x458422
test ecx, ecx
jl 0x45841d
jg 0x4583db
test eax, eax
je 0x45841d
cmp edi, ecx
jg 0x4583ef
jl 0x4583e5
cmp esi, eax
jae 0x4583ef
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x458425
mov ecx, dword [ebp + 8]
jmp 0x45842f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x458449
jg 0x45842f
test esi, esi
je 0x458449
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x458449
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x458460
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x45848c
jl 0x458480
test ecx, ecx
jne 0x45848c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x4584a5
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x4584ed
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x4584f3
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x4584f3
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x458566
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x45851c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x458554
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x458566
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x458530
test edi, edi
je 0x458566
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4588e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4bf380]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x458910
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485c99
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x45894c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x45894c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485c99
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x458a23
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x458974
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x458980
movsx eax, bl
jmp 0x4589b8
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x4589e2
sub eax, 1
je 0x4589e2
sub eax, 2
jne 0x458a23
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485c99
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x458a00
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x458a23
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485c99
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00485c99
mov esp, ebp
pop ebp
ret 4
Function at 0x458c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4bf380]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x458cdc
cmp byte [esi + 0x3d], 0
je 0x458cdc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x458cca
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x458c91
sub eax, 1
je 0x458c95
sub eax, 2
jne 0x458cca
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485c99
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x458cb3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x458cca
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485c99
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485c99
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00485c99
mov esp, ebp
pop ebp
ret
Function at 0x461100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 8]
mov edi, edx
and edi, 7
je 0x46112b
cmp edx, edi
jge 0x46111b
call fcn.00460a10
mov eax, dword [esi + 0xc]
mov ecx, edi
shr eax, cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
mov dword [esi + 0xc], eax
xor eax, eax
mov ecx, edx
test edx, edx
jle 0x461158
mov edx, dword [esi + 0xc]
push ebx
mov bl, dl
nop dword [eax]
mov byte [ebp + eax - 4], bl
sub ecx, 8
shr edx, 8
inc eax
mov dword [esi + 0xc], edx
mov bl, dl
test ecx, ecx
jg 0x461140
pop ebx
mov dword [esi + 8], ecx
test ecx, ecx
jns 0x461176
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov dword [eax + 0xc], str.zlib_corrupt
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 4
jge 0x461197
mov edi, dword [esi + 4]
mov ecx, dword [esi]
cmp ecx, edi
jb 0x461188
xor dl, dl
jmp 0x46118d
mov dl, byte [ecx]
inc ecx
mov dword [esi], ecx
mov byte [ebp + eax - 4], dl
inc eax
cmp eax, 4
jl 0x461180
mov eax, dword [ebp - 4]
movzx ecx, byte [ebp - 1]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp - 2]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
jne 0x46115c
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4611e0
mov eax, dword fs:[0x2c]
pop edi
pop esi
mov eax, dword [eax]
mov dword [eax + 0xc], str.read_past_buffer
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x10]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x4611fe
push edi
mov ecx, esi
call fcn.00460b40
add esp, 4
test eax, eax
je 0x46116e
push edi
push dword [esi]
push dword [esi + 0x10]
call sub.VCRUNTIME140.dll_memcpy
add dword [esi], edi
add esp, 0xc
add dword [esi + 0x10], edi
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret