joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f0a5
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x4c02d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
xor ebx, ebx
mov word [ebp - 0xc], ax
push 0x208
lea eax, [ebp - 0x214]
mov dword [ebp - 0xa], ebx
push ebx
push eax
mov edi, ecx
mov word [ebp - 6], bx
call fcn.00475400
push esi
call fcn.00478f03
add esp, 0x10
cmp eax, 3
jl 0x42f0fe
push 3
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.0047cc05
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ebp - 0x218]
shrd ecx, edx, 0x14
shr edx, 0x14
call fcn.00430be0
cvtsd2ss xmm0, xmm0
cmp dword [edi + 0x548], ebx
je 0x42f19c
cvttss2si eax, xmm0
cmp eax, 0x400
jle 0x42f175
mulss xmm0, dword [0x49ad14]
lea eax, [ebp - 0x214]
push ecx
push ecx
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
push 0x49acf8
push eax
call fcn.00424b7f
add esp, 0x10
jmp 0x42f18a
push eax
lea eax, [ebp - 0x214]
push str._dMB
push eax
call fcn.00424b7f
add esp, 0xc
mov ecx, dword [edi + 0x548]
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430265
mov esp, ebp
pop ebp
ret 4
Function at 0x42f79b
Capabilities:
Check if file exists

Disassembly:
push 0xbc
mov eax, 0x492a03
call fcn.004302e1
mov ebx, ecx
mov ecx, dword [ebx + 0x540]
test ecx, ecx
je 0x42f8d3
mov eax, dword [ecx]
lea edx, [ebp - 0xc4]
push edx
call dword [eax + 0x38]
xor edi, edi
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.00436c09
push eax
lea ecx, [ebp - 0x28]
call fcn.00401f2f
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 2
call fcn.004366be
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00478f03
pop ecx
cmp eax, 3
jle 0x42f8b5
push 3
push edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00428990
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
lea ecx, [ebp - 0x40]
push edi
push 1
sbb esi, esi
call fcn.004023bd
and esi, 1
je 0x42f8b5
mov ecx, dword [ebx + 0x534]
test ecx, ecx
je 0x42f84e
mov eax, dword [ecx]
push 1
call dword [eax + 0xec]
mov eax, dword [ebx + 0x528]
mov ecx, edi
mov esi, dword [ebx + 0x524]
mov edi, eax
sub edi, esi
xor edx, edx
add edi, 3
shr edi, 2
cmp esi, eax
cmova edi, edx
test edi, edi
jmp 0x42f896
mov edx, dword [esi]
test edx, edx
je 0x42f890
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov eax, dword [edx]
cmovae ecx, dword [ebp - 0x28]
push ecx
mov ecx, edx
call dword [eax + 4]
mov ecx, dword [ebp - 0xc8]
add esi, 4
inc ecx
cmp ecx, edi
mov dword [ebp - 0xc8], ecx
jne 0x42f871
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov ecx, ebx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0042f0a5
xor edi, edi
jmp 0x42f8c8
mov ecx, dword [ebx + 0x534]
test ecx, ecx
je 0x42f8c8
mov eax, dword [ecx]
push edi
call dword [eax + 0xec]
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.004023bd
call fcn.0043028b
ret
Function at 0x42f8d9
Capabilities:
Get disk size

Disassembly:
push 0x13c
mov eax, 0x492a41
call fcn.004302e1
mov edi, ecx
lea eax, [ebp - 0x28]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x28], xmm0
call fcn.0042d6a3
mov ecx, eax
call fcn.00441179
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 1
push 0x190
push 0x258
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.0042d6a3
mov ecx, eax
call fcn.00441179
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [edi + 0x540]
lea edx, [ebp - 0xac]
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x18], ax
mov dword [ebp - 0x16], ebx
mov word [ebp - 0x12], bx
mov eax, dword [ecx]
push edx
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00436c09
push eax
call fcn.00478f03
or dword [ebp - 4], 0xffffffff
mov esi, eax
pop ecx
lea ecx, [ebp - 0xac]
call fcn.004366be
cmp esi, 3
jl 0x42f9b3
mov ecx, dword [edi + 0x540]
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
push 3
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.00436c09
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0047cc05
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
add esp, 0xc
call fcn.004366be
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov esi, dword [edi + 0x524]
xor ecx, ecx
mov eax, dword [edi + 0x528]
mov edi, eax
sub edi, esi
add edi, 3
shr edi, 2
cmp esi, eax
cmova edi, ecx
test edi, edi
je 0x42fa05
mov ecx, dword [esi]
test ecx, ecx
je 0x42f9fd
mov eax, dword [ecx]
call dword [eax]
add esi, 4
inc ebx
cmp ebx, edi
jne 0x42f9f3
call fcn.0043028b
ret

Function at 0x431be0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492ae3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c02d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x4c779c
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x4c779c
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x49852a
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00435730
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x436313
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x436345
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8

Function at 0x438714
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x438737
or esi, 1
push 1
call edi
test ax, ax
jns 0x438743
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x43874f
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x43875b
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret

Function at 0x43ac0d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [ebp + 8]
cmp eax, dword [ebx + 4]
je 0x43ac40
cmp esi, dword [ebx + 0x60]
je 0x43ad02
cmp byte [ebx + 0xc4], 0
jne 0x43ac40
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
cmp esi, dword [ebx + 0x60]
je 0x43ad02
cmp dword [ebx + 0x60], 0
push edi
je 0x43ac93
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x60]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x11c]
xor edi, edi
mov ecx, ebx
push edi
push edi
push edi
push str.killfocus
push dword [ebx + 0x60]
call fcn.0043a9c5
mov dword [ebx + 0x60], edi
test esi, esi
je 0x43ad01
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x2c]
cmp eax, ebx
jne 0x43ad01
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd8]
test al, al
je 0x43ad01
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xe8]
test al, al
je 0x43ad01
push 7
pop ecx
xor eax, eax
mov dword [ebx + 0x60], esi
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x60]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x11c]
xor eax, eax
mov ecx, ebx
push eax
push eax
push eax
push str.setfocus
push dword [ebx + 0x60]
call fcn.0043a9c5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44b842
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4c02d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x24], 0
je 0x44b8af
cmp dword [esi + 0x1c], 0
je 0x44b8af
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00430c80
mov ebx, esp
test ebx, ebx
je 0x44b8af
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x1c]
push ebx
add ecx, 0x1bc
call fcn.0043675c
mov ecx, dword [esi + 0x1c]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x2c]
mov ecx, eax
call fcn.0043a9c5
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430265
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44e2e1
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x493ad7
call fcn.004302e1
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.0044e670
call fcn.00438405
push eax
lea ecx, [ebp - 0x94]
call fcn.00436583
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0043840b
mov ecx, eax
call fcn.00436d63
test al, al
je 0x44e3f7
push ebx
lea ecx, [ebp - 0x94]
call fcn.004367d0
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00436c09
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x44e368
push str.Error_opening_file
jmp 0x44e4d8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x44e471
cmp edi, 0x400000
ja 0x44e482
and dword [ebp - 0x2c8], 0
push edi
call fcn.00430c6a
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x44e3e0
push ebx
call fcn.00430389
pop ecx
mov ecx, esi
call fcn.0044e670
push 0
push str.Could_not_read_file
jmp 0x44e4d8
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.0044e523
push dword [ebp - 0x2cc]
jmp 0x44e506
call fcn.0043840b
push eax
lea ecx, [ebp - 0x94]
call fcn.004367b3
call fcn.00438537
test al, al
je 0x44e418
call fcn.00438411
jmp 0x44e42f
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.00436c09
push eax
call fcn.00456cb0
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x44e440
push eax
push str.Error_opening_zip_file
jmp 0x44e4d8
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.004566f1
add esp, 0x14
test eax, eax
je 0x44e467
push 0
push str.Could_not_find_ziped_file
jmp 0x44e4d8
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x44e47a
push 0
push str.File_is_empty
jmp 0x44e4d8
cmp ebx, 0x400000
jbe 0x44e48b
push 0
push str.File_too_large
jmp 0x44e4d8
push ebx
call fcn.00430c6a
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.00457070
add esp, 0x18
test eax, eax
je 0x44e4e3
cmp eax, 0x600
je 0x44e4e3
push dword [ebp - 0x2c8]
call fcn.00430389
pop ecx
call fcn.00438537
test al, al
jne 0x44e4d1
push edi
call fcn.0045654b
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.0044e698
mov bl, al
jmp 0x44e50e
call fcn.00438537
test al, al
jne 0x44e4f3
push edi
call fcn.0045654b
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.0044e523
push edi
mov bl, al
call fcn.00430389
pop ecx
lea ecx, [ebp - 0x94]
call fcn.004366be
mov al, bl
call fcn.0043028b
ret 8
Function at 0x453fa6
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x453fba
xor eax, eax
pop ebp
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x453fcc
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x453fb6
push esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x453fe7
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x45401e
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call fcn.004744c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
test eax, eax
jne 0x454022
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x454025
xor eax, eax
inc eax
pop esi
pop ebp
ret

Function at 0x455f63
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x88
mov eax, 0x49161c
call fcn.004302e1
mov esi, ecx
cmp dword [esi + 0x4f0], 0
mov ebx, dword [ebp + 0x14]
je 0x456057
cmp dword [ebp + 8], 0x100
jne 0x45603d
cmp word [ebp + 0xc], 0xd
jne 0x455fd6
cmp byte [esi + 0x4f6], 0
je 0x455fb7
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x455fd6
cmp byte [esi + 0x4f7], 0
jne 0x455fd6
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x455fcf
push 0
push 0
push 0
push str.return
push esi
call fcn.0043a9c5
xor eax, eax
jmp 0x45605a
cmp dword [ebp + 0xc], 0x43
jne 0x45603d
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x45603d
lea eax, [ebp - 0x94]
mov ecx, esi
push eax
call fcn.0045479d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x94]
call fcn.00436c13
lea ecx, [ebp - 0x94]
lea eax, [eax*2 + 2]
push eax
call fcn.00436c09
mov ecx, dword [esi + 0x40]
push eax
push 0x2042
call fcn.00441179
push eax
call fcn.00453fa6
add esp, 0x10
lea ecx, [ebp - 0x94]
call fcn.004366be
jmp 0x455fcf
mov eax, dword [esi + 0x4f0]
push ebx
push dword [ebp + 0x10]
mov ecx, dword [eax + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x45605a
xor eax, eax
inc eax
call fcn.0043028b
ret 0x10
Function at 0x45659d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4c02d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x456653
movzx eax, word [esi]
test ax, ax
je 0x456653
push edi
mov edi, esi
mov ecx, esi
cmp ax, 0x2f
je 0x4565dd
cmp ax, 0x5c
jne 0x4565df
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x4565d1
cmp edi, esi
je 0x456626
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.00481ab8
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x456663
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0045659d
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00478ee1
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0047c3eb
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00430265
mov esp, ebp
pop ebp
ret
call fcn.00430719
int3

Function at 0x456c28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x456ca4
cmp dword [edi + 4], 0xffffffff
jne 0x456ca4
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x498fe8
push esi
call fcn.0047c3eb
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x456c76
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x456c76
mov eax, 0x2000000
jmp 0x456ca9
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00459146
add esp, 0x10
test eax, eax
jne 0x456c94
mov eax, dword [ebp - 4]
jmp 0x456ca9
push eax
call fcn.0045984e
mov dword [edi], eax
mov eax, dword [0x4c7ec8]
pop ecx
jmp 0x456ca9
mov eax, 0x1000000
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x459253
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x459287
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x459282
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4592ae
mov edx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x14]
jbe 0x459297
mov esi, dword [edi + 0x14]
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.004744c0
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x459421
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x45942f
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x4594ee
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a0f48]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a0f48]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a0f48]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a0f48]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a0f48]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a0f48]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a0f48]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a0f48]
sub edi, 1
jne 0x459447
pop edi
test esi, esi
je 0x45950a
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a0f48]
inc edx
sub esi, 1
jne 0x4594f2
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x462a0f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x462a33
cmp dword [esi + 8], edi
jge 0x462a2b
push esi
call fcn.00460cb0
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x462a5c
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x462a3f
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x462a79
mov edx, dword [esi]
cmp edx, dword [esi + 4]
jb 0x462a67
xor eax, eax
jmp 0x462a6f
mov al, byte [edx]
inc edx
mov dword [esi], edx
movzx eax, al
mov byte [ebp + ecx + 8], al
inc ecx
cmp ecx, 4
jl 0x462a5e
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x462aae
push str.zlib_corrupt
call fcn.00460b6b
add esp, 4
jmp 0x462aeb
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x462abe
push str.read_past_buffer
jmp 0x462aa4
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x462ad5
push edi
push esi
call fcn.00460b7a
pop ecx
pop ecx
test eax, eax
je 0x462aeb
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004744c0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x46ae11
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2cc
mov eax, 0x4944c9
call fcn.004302e1
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2cc], ebx
call fcn.00438405
push eax
lea ecx, [ebp - 0x94]
call fcn.00436583
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0043840b
mov ecx, eax
call fcn.00436d63
test al, al
je 0x46aeff
push ebx
lea ecx, [ebp - 0x94]
call fcn.004367d0
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00436c09
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46aea2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004366be
jmp 0x46afe0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x46ae8e
push esi
mov dword [ebp - 0x2c8], edi
call fcn.00430c6a
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2c8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], esi
je 0x46afcb
push edi
call fcn.00430389
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004366be
jmp 0x46afde
call fcn.0043840b
push eax
lea ecx, [ebp - 0x94]
call fcn.004367b3
call fcn.00438537
test al, al
je 0x46af20
call fcn.00438411
jmp 0x46af37
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.00436c09
push eax
call fcn.00456cb0
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x46ae8e
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
push dword [ebp - 0x2cc]
push ebx
call fcn.004566f1
add esp, 0x14
test eax, eax
jne 0x46ae8e
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x46ae8e
push esi
call fcn.00430c6a
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x2d4]
push ebx
call fcn.00457070
add esp, 0x18
test eax, eax
je 0x46afbb
cmp eax, 0x600
je 0x46afbb
push edi
call fcn.00430389
pop ecx
call fcn.00438537
test al, al
jne 0x46aeeb
push ebx
call fcn.0045654b
jmp 0x46aeea
call fcn.00438537
test al, al
jne 0x46afcb
push ebx
call fcn.0045654b
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004366be
test edi, edi
jne 0x46b052
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp - 0x2cc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46b04e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x46b04e
push esi
mov dword [ebp - 0x2d0], edi
call fcn.00430c6a
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2d0]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2d0], esi
je 0x46b04a
push edi
call fcn.00430389
pop ecx
xor edi, edi
test edi, edi
jne 0x46b052
xor eax, eax
jmp 0x46b06d
mov ecx, dword [ebp - 0x2d8]
push esi
push edi
call fcn.0046b075
push 1
push edi
mov esi, eax
call fcn.00430257
pop ecx
pop ecx
mov eax, esi
call fcn.0043028b
ret 4