joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d660
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x90
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x8c], eax
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0x98]
mov eax, dword [esp + 0xa0]
push ebx
mov ebx, dword [esp + 0x98]
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ecx
push edx
push 0
push ebp
mov dword [esp + 0x28], eax
call fcn.005269a0
mov esi, eax
push 0
lea eax, [esp + 0x18]
push eax
push esi
mov edi, edx
push ebx
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x14]
cmp eax, esi
jne 0x44d72f
cmp ecx, edi
jne 0x44d72f
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x14]
push ecx
push ebp
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x44d6f3
cmp dword [esp + 0x10], ebp
jne 0x44d6f3
mov eax, 1
jmp 0x44d763
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x80310017
jne 0x44d716
lea eax, [esp + 0x1c]
push str.The_disk_volume_is_locked_by_BitLocker_program._n_nUnlock_the_volume_or_re_create_it_to_remove_the_lock.
push eax
call fcn.00525599
add esp, 8
jmp 0x44d74d
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xa8]
push ebp
push ecx
push esi
push edx
call edi
push eax
push str.Internal_error_2___x__in_reading_volume_sector__d.___d___d___d_.
jmp 0x44d740
mov edx, dword [esp + 0xa8]
push ecx
push eax
push edi
push esi
push edx
push str.Internal_error_1_in_reading_volume_sector__d___d___d___d___d_.
lea eax, [esp + 0x34]
push eax
call fcn.00525599
add esp, 0x1c
push 0
push 0x550910
lea ecx, [esp + 0x24]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00524d83
add esp, 0x90
ret

Function at 0x44d780
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
push esi
push edi
push eax
push ecx
push 0
push edx
call fcn.005269a0
mov ebx, dword [esp + 0x10]
mov esi, eax
push 0
lea eax, [esp + 0x20]
push eax
push esi
mov edi, edx
push ebx
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, esi
jne 0x44d7ef
cmp dword [esp + 0x1c], edi
jne 0x44d7ef
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44d7e9
cmp dword [esp + 0x14], esi
jne 0x44d7e9
pop edi
pop esi
mov eax, 1
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x44dbb0
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x78
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x74], eax
push ebp
mov ebp, dword [esp + 0x80]
mov eax, dword [ebp + 0x734]
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [ebp + 0x3f50], 0
test eax, eax
jne 0x44dbff
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.00524d83
add esp, 0x78
ret
cmp dword [eax], 1
jne 0x44dbea
mov eax, dword [eax + 8]
push eax
push str..PhysicalDrive_d
lea ecx, [esp + 0x40]
push 0x20
push ecx
call fcn.00526008
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.0044d480
add esp, 0x18
test eax, eax
jne 0x44dc3f
pop ebp
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.00524d83
add esp, 0x78
ret
push edi
mov edi, dword [esp + 8]
xor eax, eax
cmp edi, 0xffffffff
je 0x44dcc8
push esi
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x20
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
push 0xc
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
push eax
push 0x2d1400
push edi
mov dword [esp + 0x34], 0xb
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
test esi, esi
je 0x44dcbc
test byte [esp + 0x28], 1
mov esi, 1
je 0x44dcbc
mov dword [ebp + 0x3f50], esi
push edi
call fcn.0044d800
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x7c]
pop edi
pop ebp
xor ecx, esp
call fcn.00524d83
add esp, 0x78
ret
Function at 0x44e340
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x24]
xor ebx, ebx
mov byte [ebp + 0x3b1c], bl
cmp dword [ebp + 0x370], ebx
jne 0x44e369
cmp dword [ebp + 0x36c], ebx
jne 0x44e3c5
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
cmp dword [ebp + 0x36c], ebx
jne 0x44e3c5
call fcn.0044b8f0
cmp eax, ebx
jne 0x44e392
cmp dword [0x5b2db8], ebx
jne 0x44e3a6
cmp dword [0x5b2ebc], ebx
jne 0x44e3a6
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
mov eax, dword [eax + 0x734]
mov ecx, dword [ebp + 0x734]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 8]
je 0x44e3c5
mov eax, dword [0x5b2904]
mov ecx, dword [0x5b2908]
cmp eax, ebx
jne 0x44e3d0
cmp ecx, ebx
jne 0x44e3d0
mov al, byte [esp + 0x28]
sub al, 0x80
mov byte [ebp + 0x3b1c], al
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret
mov dword [esp + 0x24], ebx
cmp eax, ebx
jne 0x44e3e1
mov eax, 0x20019
cmp ecx, ebx
je 0x44e3e6
mov eax, 0x20119
lea ecx, [esp + 8]
push ecx
push eax
push ebx
push str.SYSTEMCurrentControlSetControl
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44e4ac
mov ecx, dword [esp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x28]
push edx
push ebx
lea eax, [esp + 0x18]
push eax
push ebx
push str.SystemBootDevice
push ecx
mov dword [esp + 0x40], ebx
call edi
test eax, eax
jne 0x44e4a0
mov edx, dword [esp + 0x28]
push esi
push edx
call fcn.00401bb0
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x44e49f
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x2c]
push eax
push esi
lea ecx, [esp + 0x1c]
push ecx
push ebx
push str.SystemBootDevice
push edx
call edi
test eax, eax
jne 0x44e496
push esi
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push eax
push str.multi__d_disk__d_rdisk__d_partition__d__s
push esi
call fcn.00525c7d
add esp, 0x1c
cmp eax, 4
jl 0x44e496
mov cl, byte [esp + 0x18]
sub cl, 0x80
mov byte [ebp + 0x3b1c], cl
mov ebx, 1
push esi
call fcn.00401bc0
add esp, 4
pop esi
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x18
ret

Function at 0x44eb70
Capabilities:
Manipulate boot configuration

Disassembly:
push ebx
push esi
mov esi, dword [0x5fd0c0]
xor ebx, ebx
test esi, esi
je 0x44ebd8
push edi
nop
lea edi, [esi + 2]
push str.boot.ini
push edi
call fcn.0044c5f0
add esp, 8
test eax, eax
je 0x44ebb9
push str.ntdetect.com
push edi
call fcn.0044c5f0
add esp, 8
test eax, eax
je 0x44ebb9
push str.ntldr
push edi
call fcn.0044c5f0
add esp, 8
test eax, eax
jne 0x44ebc9
mov esi, dword [esi + 0x3f54]
test esi, esi
jne 0x44eb80
pop edi
pop esi
mov eax, ebx
pop ebx
ret
mov eax, 1
pop edi
mov dword [esi + 0x36c], eax
pop esi
pop ebx
ret
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x451f40
Capabilities:
Encrypt data using aes via x86 extensions
Resolve function by parsing pe exports

Disassembly:
cmp dword [0x5fd0d0], 1
jne 0x451f4e
jmp fcn.00455e80
jmp fcn.00455f22
Function at 0x4547f0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
push 0x40
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x24], ecx
mov dword [eax + 0x20], ecx
push ecx
add eax, 0x28
push eax
call fcn.00454380
add esp, 0xc
xor eax, eax
ret
Function at 0x455570
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push edi
xor edi, edi
cmp dword [esp + 0xc], edi
jle 0x455611
push ebx
push ebp
push esi
mov ecx, dword [eax + edi*8]
mov edx, dword [eax + edi*8 + 4]
xor esi, esi
or esi, ecx
xor eax, eax
or edx, eax
mov ebx, esi
mov ecx, edx
shrd ecx, ebx, 0x10
shr ebx, 0x10
mov eax, ecx
mov ecx, ebx
mov ebp, esi
mov ebx, edx
shld ebp, ebx, 0x10
shld esi, edx, 0x10
shl ebx, 0x10
xor eax, ebx
xor ecx, ebp
shl edx, 0x10
and eax, 0xffff
xor eax, edx
and ecx, 0xffff
xor ecx, esi
mov ebx, eax
mov edx, eax
mov ebp, ecx
mov esi, ecx
shrd edx, esi, 8
shld ebp, ebx, 8
shr esi, 8
shl ebx, 8
shld ecx, eax, 8
xor edx, ebx
xor esi, ebp
shl eax, 8
and edx, 0xff00ff
and esi, 0xff00ff
xor edx, eax
mov eax, dword [esp + 0x14]
xor esi, ecx
mov dword [eax + edi*8], edx
mov dword [eax + edi*8 + 4], esi
inc edi
cmp edi, dword [esp + 0x18]
jl 0x455584
pop esi
pop ebp
pop ebx
pop edi
ret

Function at 0x455620
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
push 0x80
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
push ecx
add eax, 0x50
push eax
call fcn.00454380
add esp, 0xc
xor eax, eax
ret
Function at 0x45b770
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x45b882
mov esi, dword [esp + 0x18]
test esi, esi
je 0x45b882
mov ecx, 0x5a0288
mov eax, esi
sub ecx, esi
mov edx, 0x12
push ebx
lea esp, [esp]
mov ebx, dword [ecx + eax]
mov dword [eax], ebx
add eax, 4
sub edx, 1
jne 0x45b7a0
mov eax, 0x5a02d0
lea ecx, [esi + 0x48]
lea ebx, [edx + 4]
push ebp
lea esp, [esp]
mov edx, 0x100
mov ebp, dword [eax]
mov dword [ecx], ebp
add eax, 4
add ecx, 4
sub edx, 1
jne 0x45b7c5
sub ebx, 1
jne 0x45b7c0
xor eax, eax
lea ebx, [edx + 0x12]
mov edi, edi
movzx ecx, ax
movzx eax, byte [ecx + edi]
mov dword [esp + 0x1c], 0
mov byte [esp + 0x1f], al
lea eax, [ecx + 1]
cdq
mov ebp, 0x38
idiv ebp
lea eax, [ecx + 2]
add esi, 4
movzx edx, byte [edx + edi]
mov byte [esp + 0x1e], dl
cdq
idiv ebp
movzx eax, byte [edx + edi]
mov byte [esp + 0x1d], al
lea eax, [ecx + 3]
cdq
idiv ebp
movzx edx, byte [edx + edi]
mov byte [esp + 0x1c], dl
mov eax, dword [esp + 0x1c]
xor dword [esi - 4], eax
lea eax, [ecx + 4]
cdq
mov ecx, ebp
idiv ecx
sub ebx, 1
movzx eax, dx
jne 0x45b7e0
mov ebx, dword [esp + 0x20]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov esi, ebx
mov edi, 0x209
pop ebp
lea edx, [esp + 0xc]
push ebx
push edx
mov eax, edx
push eax
call fcn.0045b050
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 0xc
add esi, 8
sub edi, 1
jne 0x45b852
pop ebx
lea eax, [edi + 1]
pop edi
pop esi
add esp, 8
ret
pop edi
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x461dc0
Capabilities:
Encrypt data using rc6

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
mov dword [esi], 0xb7e15163
mov eax, 1
jmp 0x461de0
mov ecx, dword [esi + eax*4 - 4]
sub ecx, 0x61c88647
mov dword [esi + eax*4], ecx
inc eax
cmp eax, 0x2c
jb 0x461de0
mov eax, dword [esp + 0x34]
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 0x10]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 0x14]
mov dword [esp + 0x20], edx
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
xor edi, edi
xor edx, edx
xor ecx, ecx
xor eax, eax
mov ebx, 0x84
jmp 0x461e40
mov ebp, dword [esi + edx*4]
add ebp, ecx
add ebp, eax
rol ebp, 3
mov eax, ebp
mov ebp, dword [esp + edi*4 + 0x10]
add ecx, eax
add ebp, ecx
rol ebp, cl
mov dword [esi + edx*4], eax
mov ecx, ebp
mov dword [esp + edi*4 + 0x10], ecx
cmp edx, 0x2b
jne 0x461e68
xor edx, edx
jmp 0x461e69
inc edx
cmp edi, 7
jne 0x461e72
xor edi, edi
jmp 0x461e73
inc edi
sub ebx, 1
jne 0x461e40
pop edi
pop esi
pop ebp
lea eax, [ebx + 1]
pop ebx
add esp, 0x20
ret

Function at 0x4623d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x218]
lea eax, [esp + 8]
push 0x104
push eax
call fcn.00441830
add esp, 8
test eax, eax
jne 0x46241a
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00524d83
add esp, 0x210
ret
push 0x400
push 0
push 0x5fd0d8
call fcn.00526520
mov eax, dword [str.This_is_MBR_STRUCT_signature]
mov edx, 0x5fd0d8
add esp, 0xc
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x462440
push edi
mov ecx, 0x80
mov edi, 0x5fd2d8
mov dword [0x5fd0f8], 1
mov dword [0x5fd0fc], 0x400
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0xc]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x462472
push 0
push 0
push 2
push 0
push 7
mov ecx, 7
mov esi, str._bcve_mbr.bin
rep movsd dword es:[edi], dword [esi]
push 0x40000000
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
pop edi
cmp esi, 0xffffffff
je 0x462402
push 0
lea edx, [esp + 8]
push edx
push 0x400
push 0x5fd0d8
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00524d83
add esp, 0x210
ret
Function at 0x4624f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
push 0x104
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x462538
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00524d83
add esp, 0x210
ret
lea eax, [esp + 8]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x462540
sub eax, edx
sar eax, 1
test eax, eax
jle 0x462567
cmp word [esp + eax*2 + 8], 0x5c
je 0x462567
xor ecx, ecx
mov word [esp + eax*2 + 8], cx
dec eax
test eax, eax
jg 0x462553
push edi
lea edi, [esp + 0xc]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x462570
push esi
push 0
push 0
push 3
push 0
push 7
push closesocket
lea edx, [esp + 0x28]
mov ecx, 7
mov esi, str._bcve_mbr.bin
push edx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4625cd
push 0
lea eax, [esp + 0x10]
push eax
push 0x400
push 0x5fd0d8
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
jne 0x4625e7
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00524d83
add esp, 0x210
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0xc], 0x400
jne 0x4625cd
mov edi, ebx
mov ecx, 0x80
mov esi, 0x5fd2d8
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x218]
pop esi
pop edi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00524d83
add esp, 0x210
ret

Function at 0x4626e0
Capabilities:
Delete file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x208], eax
push str.Rescue_rescue_updated
push 0x5b2994
lea eax, [esp + 8]
push 0x5516e0
push eax
call fcn.00462630
add esp, 0x10
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
mov eax, 1
call fcn.00524d83
add esp, 0x20c
ret
Function at 0x463110
Capabilities:
Create directory

Disassembly:
sub esp, 0x20c
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x210]
test eax, eax
je 0x463145
lea edx, [esp]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x463134
jmp 0x4631c1
lea eax, [esp]
push 0x104
push eax
call fcn.00441830
lea ecx, [esp + 8]
push 0
push ecx
call fcn.005260d0
add esp, 0x10
test eax, eax
je 0x463173
push 0
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x463180
mov ecx, dword [str._rescue.rsc]
mov edx, dword [0x550b64]
mov dword [eax], ecx
mov ecx, dword [0x550b68]
mov dword [eax + 4], edx
mov edx, dword [0x550b6c]
mov dword [eax + 8], ecx
mov ecx, dword [0x550b70]
mov dword [eax + 0xc], edx
mov edx, dword [0x550b74]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
mov eax, dword [esp + 0x218]
mov ecx, dword [esp + 0x214]
push 0
push 0x20
push eax
push 0
push 0
push ecx
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00524d83
add esp, 0x20c
ret
Function at 0x463450
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x10]
sub esp, 8
push ebx
push 3
push closesocket
push ecx
mov dword [eax], 0xff
call fcn.00463110
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
je 0x463491
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x463498
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebx
add esp, 8
ret
push esi
mov esi, dword [esp + 0x18]
push edi
xor edi, edi
push edi
lea edx, [esp + 0x14]
push edx
push 0xcf4
push esi
push ebx
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4635a8
push ebp
cmp dword [esp + 0x14], 0xcf4
jne 0x4635a7
cmp dword [esi + 0x414], 0
jne 0x463533
mov eax, 0x5a3710
mov edx, esi
mov ecx, 0x10
sub edx, eax
mov ebp, dword [edx + eax]
cmp ebp, dword [eax]
jne 0x4635a7
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x4634e5
mov ecx, dword [esp + 0x24]
mov eax, 0x20
lea edx, [esi + 0x418]
lea ebx, [ebx]
mov edi, dword [edx]
cmp edi, dword [ecx]
jne 0x463564
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x463510
xor eax, eax
xor edx, edx
test eax, eax
sete dl
mov edi, edx
test edi, edi
jne 0x463598
inc dword [esp + 0x10]
push 0
lea eax, [esp + 0x18]
push eax
push 0xcf4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4634c0
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret
movzx eax, byte [edx]
movzx edi, byte [ecx]
sub eax, edi
jne 0x463590
movzx eax, byte [edx + 1]
movzx edi, byte [ecx + 1]
sub eax, edi
jne 0x463590
movzx eax, byte [edx + 2]
movzx edi, byte [ecx + 2]
sub eax, edi
jne 0x463590
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
jmp 0x463526
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
mov edi, 1
mov dword [edx], ecx
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4635c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xd04
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0xd00], eax
mov eax, dword [esp + 0xd08]
push esi
push 4
push 0xc0000000
push 0
mov dword [esp + 0x14], eax
call fcn.00463110
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x463610
xor eax, eax
pop esi
mov ecx, dword [esp + 0xd00]
xor ecx, esp
call fcn.00524d83
add esp, 0xd04
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call ebp
test eax, eax
je 0x463644
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
xor eax, eax
pop esi
mov ecx, dword [esp + 0xd00]
xor ecx, esp
call fcn.00524d83
add esp, 0xd04
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
xor edi, edi
push edi
lea ecx, [esp + 0x14]
push ecx
push 0xcf4
lea edx, [esp + 0x28]
push edx
push esi
call ebx
test eax, eax
je 0x4636b0
cmp dword [esp + 0x10], 0xcf4
jne 0x4636b0
cmp dword [esp + 0x430], 0
jne 0x4636ef
mov eax, 0x10
xor ecx, ecx
mov edx, dword [esp + ecx + 0x1c]
cmp edx, dword [ecx + 0x5a3710]
jne 0x4636ef
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x463680
push 0
lea eax, [esp + 0x14]
push eax
push 0xcf4
lea ecx, [esp + 0x28]
push ecx
push esi
inc edi
call ebx
test eax, eax
jne 0x463665
push 2
push 0
push 0
push esi
call ebp
mov eax, dword [esp + 0x14]
push 0
lea edx, [esp + 0x1c]
push edx
push 0xcf4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x463708
cmp dword [esp + 0x18], 0xcf4
jne 0x463708
mov eax, 1
jmp 0x46370a
imul edi, edi, 0xcf4
push 0
push 0
push edi
push esi
call ebp
cmp eax, edi
je 0x4636b9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0xd10]
pop edi
pop ebx
pop ebp
pop esi
xor ecx, esp
call fcn.00524d83
add esp, 0xd04
ret
Function at 0x463730
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xd24
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0xd20], eax
mov eax, dword [esp + 0xd28]
push ebx
push 3
push 0xc0000000
push 0
mov dword [esp + 0x18], eax
call fcn.00463110
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
je 0x463780
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x463798
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xd20]
xor ecx, esp
call fcn.00524d83
add esp, 0xd24
ret
push ebp
push esi
push edi
xor esi, esi
push esi
lea ecx, [esp + 0x14]
push ecx
push 0xcf4
lea edx, [esp + 0x28]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x463838
mov edi, dword [esp + 0xd3c]
cmp dword [esp + 0x10], 0xcf4
jne 0x463838
cmp dword [esp + 0x430], 0
jne 0x46381b
mov eax, 0x10
xor ecx, ecx
mov edi, edi
mov edx, dword [esp + ecx + 0x1c]
cmp edx, dword [ecx + 0x5a3710]
jne 0x463838
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x4637e0
lea edx, [esp + 0x434]
mov ecx, 0x20
mov eax, edi
sub edx, edi
cmp ecx, 4
jb 0x46385a
mov ebp, dword [edx + eax]
cmp ebp, dword [eax]
jne 0x46381b
sub ecx, 4
add eax, 4
jmp 0x463807
push 0
lea eax, [esp + 0x14]
push eax
push 0xcf4
lea ecx, [esp + 0x28]
push ecx
push ebx
inc esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4637c3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0xd30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00524d83
add esp, 0xd24
ret
imul esi, esi, 0xcf4
push 0
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, esi
jne 0x463838
mov ebp, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0xd10], eax
mov dword [esp + 0xd14], eax
mov dword [esp + 0xd18], eax
mov dword [esp + 0xd1c], eax
mov dword [esp + 0xd20], eax
mov dword [esp + 0xd24], eax
mov dword [esp + 0xd28], eax
mov dword [esp + 0xd2c], eax
lea ecx, [eax + 0x20]
lea eax, [esp + 0xd10]
lea edi, [ebp + 0x888]
mov edx, edi
mov esi, eax
sub edx, esi
mov esi, dword [edx + eax]
cmp esi, dword [eax]
jne 0x46390b
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x4638c4
mov eax, 0x20
xor ecx, ecx
lea ecx, [ecx]
mov edx, dword [esp + ecx + 0x8a4]
cmp edx, dword [esp + ecx + 0xd10]
jne 0x4638fd
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x4638e0
jmp 0x46390b
mov ecx, 0x18
lea esi, [esp + 0x8a4]
rep movsd dword es:[edi], dword [esi]
push 0
lea eax, [esp + 0x18]
push eax
push 0xcf4
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x46383f
cmp dword [esp + 0x14], 0xcf4
jne 0x46383f
mov eax, 1
jmp 0x463841