joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f760
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504fb6
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
push edi
mov eax, dword [0x550910]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [0x5599b0]
call fcn.00433f60
test eax, eax
jne 0x42f7b8
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
push dword [0x5599ac]
call esi
push 0
push dword [0x5599a8]
call esi
push dword [edi + 0x1c]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x16
xor eax, eax
mov byte [edi + 0x2b], 1
push str.download_acceptProduct
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.004067b0
mov dword [ebp - 4], 0
mov eax, dword [0x55999c]
test eax, eax
jne 0x42f82d
push 0x4e0
call fcn.004c6505
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x42f822
push 0x4e0
push 0
push esi
call fcn.004cff40
add esp, 0xc
mov ecx, esi
call fcn.00418e50
jmp 0x42f824
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x55999c], eax
lea ecx, [ebp - 0x40]
push ecx
mov ecx, eax
call fcn.0041b5e0
mov edi, eax
mov byte [ebp - 4], 2
mov eax, dword [0x55999c]
test eax, eax
jne 0x42f885
push 0x4e0
call fcn.004c6505
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 3
test esi, esi
je 0x42f87a
push 0x4e0
push 0
push esi
call fcn.004cff40
add esp, 0xc
mov ecx, esi
call fcn.00418e50
jmp 0x42f87c
xor eax, eax
mov byte [ebp - 4], 2
mov dword [0x55999c], eax
push edi
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.00420fd0
cmp dword [ebp - 0x2c], 8
jb 0x42f8a2
push dword [ebp - 0x40]
call fcn.004c6500
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
jb 0x42f8c7
push dword [ebp - 0x28]
call fcn.004c6500
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x431860
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x505298
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x550910]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00407180
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.00431790
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x4318d1
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.004cc859
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x4318fa
push dword [esp + 0xc]
call fcn.004c6500
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4325d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50538a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x550910]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.0047b408
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x432676
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.004cc859
push 0x54d370
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.004d273b
push edi
push esi
call fcn.0047b2db
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c63a3
mov esp, ebp
pop ebp
ret 4
Function at 0x432fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5053e8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x550910]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x550910]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x433114
cmp byte [ebx + 0x45], 0
je 0x433114
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x433020
xor al, al
jmp 0x433116
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
mov dword [esp + 0x2c], ecx
cmp ecx, 0x10
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 8
cmovae eax, dword [esp + 0x18]
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
jmp 0x433060
cmp dword [esp + 0x2c], 0x10
lea eax, [esp + 0x14]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x18]
cmovae edi, dword [esp + 0x18]
lea esi, [esp + 0x18]
cmovae esi, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4330a1
dec eax
je 0x4330a5
sub eax, 2
je 0x4330fb
xor bl, bl
jmp 0x4330fd
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x4330dc
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004ce764
add esp, 0x10
cmp esi, eax
jne 0x43309d
cmp byte [ebx + 0x45], 0
je 0x4330fb
test esi, esi
jne 0x433060
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.0040b320
jmp 0x433060
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x433110
push dword [esp + 0x18]
call fcn.004c6500
add esp, 4
mov al, bl
jmp 0x433116
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004c63a3
mov esp, ebp
pop ebp
ret
Function at 0x433bb0
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505580
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x550910]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0x26c], esi
cmp eax, 0x64
jne 0x433c06
mov eax, dword [esi + 8]
test eax, eax
je 0x433c1a
push str._force_:_true_
jmp 0x433c16
test eax, eax
jne 0x433c1a
mov eax, dword [esi + 8]
test eax, eax
je 0x433c1a
push 0x52c9f8
push 9
call eax
push dword [esi + 4]
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x533db8
lea edx, [esi + 0xc]
mov dword [esi + 0x40], 7
lea ecx, [ebp - 0x284]
call fcn.00407f00
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x433c4f
mov eax, dword [eax]
lea ecx, [ebp - 0x268]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp dword [ebp - 0x270], 8
mov edi, eax
jb 0x433c76
push dword [ebp - 0x284]
call fcn.004c6500
add esp, 4
xor eax, eax
mov dword [ebp - 0x270], 7
mov dword [ebp - 0x274], 0
mov word [ebp - 0x284], ax
cmp edi, 0xffffffff
je 0x433cf8
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, edi
lea eax, [ebp - 0x268]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x433cf8
cmp word [ebp - 0x23c], 0x2e
je 0x433ca0
lea eax, [ebp - 0x23c]
push eax
lea edx, [esi + 0xc]
lea ecx, [ebp - 0x29c]
call fcn.00407f00
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x433cdc
mov eax, dword [eax]
push eax
call ebx
cmp dword [ebp - 0x288], 8
jb 0x433ca0
push dword [ebp - 0x29c]
call fcn.004c6500
add esp, 4
jmp 0x433ca0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
add esi, 0xc
cmp dword [esi + 0x14], 8
jb 0x433d0a
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, 1
jmp 0x433d34
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c63a3
mov esp, ebp
pop ebp
ret
Function at 0x434160
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x505678
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x550910]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x550910]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [esp + 0x30]
push eax
call fcn.004344d0
push 0
push 0x52c9f8
mov dword [esp + 0x60], 0
push dword [esp + 0x48]
push ecx
lea ecx, [esp + 0x40]
call fcn.00405ad0
test eax, eax
je 0x4342df
push str.Setup_
lea edx, [esp + 0x34]
lea ecx, [esp + 0x1c]
call fcn.00407f00
mov edi, eax
lea esi, [ebx + 0xc]
add esp, 4
cmp esi, edi
je 0x434211
cmp dword [esi + 0x14], 8
jb 0x4341f6
push dword [esi]
call fcn.004c6500
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
push edi
mov word [esi], ax
call fcn.004066e0
cmp dword [esp + 0x2c], 8
jb 0x434224
push dword [esp + 0x18]
call fcn.004c6500
add esp, 4
push 0x533e20
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.00407f00
lea edi, [ebx + 0x24]
mov dword [esp + 0x18], eax
add esp, 4
cmp edi, eax
je 0x434271
cmp dword [edi + 0x14], 8
jb 0x434256
push dword [edi]
call fcn.004c6500
mov eax, dword [esp + 0x18]
add esp, 4
xor ecx, ecx
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], cx
mov ecx, edi
push eax
call fcn.004066e0
cmp dword [esp + 0x2c], 8
jb 0x434284
push dword [esp + 0x18]
call fcn.004c6500
add esp, 4
cmp dword [esi + 0x14], 8
jb 0x43428e
mov eax, dword [esi]
jmp 0x434290
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [esi + 0x14], 8
jb 0x4342a1
mov esi, dword [esi]
push esi
mov ecx, ebx
call fcn.00434320
test al, al
je 0x4342df
cmp dword [edi + 0x14], 8
jb 0x4342b5
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 4], eax
test eax, eax
je 0x4342df
push str.InvokeW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 8], eax
test eax, eax
jne 0x434314
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor bl, bl
cmp dword [esp + 0x44], 8
jb 0x4342f4
push dword [esp + 0x30]
call fcn.004c6500
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004c63a3
mov esp, ebp
pop ebp
ret
mov bl, 1
jmp 0x4342e1
Function at 0x434320
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5056c1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x550910]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x55999c]
test eax, eax
jne 0x434393
push 0x4e0
call fcn.004c6505
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x434385
push 0x4e0
push 0
push esi
call fcn.004cff40
add esp, 0xc
mov ecx, esi
call fcn.00418e50
jmp 0x434387
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x55999c], eax
push 0x533820
push 0x85
push dword [eax + 0x4dc]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4344ab
mov eax, dword [0x55999c]
test eax, eax
jne 0x434400
push 0x4e0
call fcn.004c6505
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
test esi, esi
je 0x4343f2
push 0x4e0
push 0
push esi
call fcn.004cff40
add esp, 0xc
mov ecx, esi
call fcn.00418e50
jmp 0x4343f4
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x55999c], eax
push edi
push dword [eax + 0x4dc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4344ab
mov eax, dword [0x55999c]
test eax, eax
jne 0x434464
push 0x4e0
call fcn.004c6505
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 2
test esi, esi
je 0x434456
push 0x4e0
push 0
push esi
call fcn.004cff40
add esp, 0xc
mov ecx, esi
call fcn.00418e50
jmp 0x434458
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x55999c], eax
push edi
push dword [eax + 0x4dc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x4344ab
push ecx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, esi
mov ecx, eax
call fcn.00438bc0
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x438ed0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505d22
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x550910]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [esi], 0x533bf8
mov dword [esi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
lea edi, [esi + 0x10]
mov eax, dword [esi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push ecx
push edi
lea eax, [ecx - 0x18]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.00431080
mov dword [ebp - 4], 2
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + esi - 4], eax
mov ecx, edi
call fcn.00430f60
lea eax, [edi + 4]
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
lea eax, [edi + 0x14]
mov byte [edi + 0x4c], 0
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov byte [edi + 0x45], 0
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x55a550]
mov dword [edi + 0x50], 0
mov dword [edi + 0x48], eax
mov dword [edi + 0x40], 0
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 3
cmp dword [ecx + 0x14], 8
jb 0x439005
mov ecx, dword [ecx]
mov eax, dword [ebp + 0xc]
push ecx
or eax, 1
push eax
push ecx
mov ecx, edi
call fcn.004391c0
test eax, eax
jne 0x439038
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 0xc]
add ecx, esi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x439030
or eax, 4
push 0
push eax
call fcn.00431ad0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x439050
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505d67
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x550910]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x533bf0
mov dword [edi + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
lea esi, [edi + 4]
mov eax, dword [edi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
push esi
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00431080
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.00430f60
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov byte [esi + 0x4c], 0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x45], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x55a550]
mov dword [esi + 0x48], eax
mov eax, edi
mov dword [esi + 0x50], 0
mov dword [esi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43cc40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x55cce0], ecx
inc eax
cmp eax, 0x100
jb 0x43cc43
cmp eax, 0x800
jae 0x43cd13
nop
mov edx, dword [eax*4 + 0x55c8e0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x55cce0]
mov dword [eax*4 + 0x55cce0], edx
inc eax
cmp eax, 0x800
jb 0x43ccf0
mov dword [0x55ece0], 0x43e880
mov dword [0x55ccc8], 0x43e880
mov dword [0x55ece4], 0x43e920
call fcn.0043eb30
mov ecx, dword [0x55ccc8]
test eax, eax
mov edx, 0x43e920
cmove ecx, edx
mov dword [0x55ccc8], ecx
pop ecx
ret
Function at 0x441b10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
xor edi, edi
mov dword [ebp - 4], ebx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x441b36
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 8], 5
sub edx, 4
add edx, ebx
mov dword [ebp - 0xc], edx
lea eax, [edi + ebx]
cmp eax, edx
jae 0x441b5f
lea esp, [esp]
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x441b5f
inc eax
cmp eax, edx
jb 0x441b50
mov ecx, eax
sub ecx, edi
mov edi, eax
sub ecx, ebx
sub edi, ebx
cmp eax, edx
jae 0x441c42
cmp ecx, 2
jbe 0x441c02
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x441c34
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp + 8]
add ecx, edi
add edi, 5
sub ebx, ecx
mov dword [ebp - 8], ecx
test esi, esi
je 0x441bdc
and esi, 6
mov edx, ebx
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x441bd7
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
sub ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov ebx, dword [ebp - 4]
jmp 0x441b42
shr esi, cl
test esi, esi
je 0x441b7c
cmp esi, 4
ja 0x441c29
cmp esi, 3
je 0x441c29
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x441b7c
or esi, 8
shr esi, 1
inc edi
jmp 0x441b42
mov ebx, dword [ebp - 4]
or esi, 8
shr esi, 1
inc edi
jmp 0x441b42
cmp ecx, 2
jbe 0x441c57
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
shr esi, cl
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x444d50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506462
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x550910]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [esi], 0x5344b4
mov dword [esi + 0x10], 0x5344ac
mov dword [esi + 0x78], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
push ecx
lea edi, [esi + 0x18]
mov dword [ebp - 4], 0
push edi
mov dword [ebp - 0x10], 1
call fcn.00444c40
mov dword [ebp - 4], 1
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x78]
mov dword [ecx + esi - 4], eax
mov ecx, edi
call fcn.00430f60
lea eax, [edi + 4]
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
lea eax, [edi + 0x14]
mov byte [edi + 0x4c], 0
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov byte [edi + 0x45], 0
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x55a550]
mov dword [edi + 0x50], 0
mov dword [edi + 0x48], eax
mov dword [edi + 0x40], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x444e5f
mov eax, dword [eax]
push ecx
push 0xb
push eax
mov ecx, edi
call fcn.004391c0
test eax, eax
jne 0x444e8d
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 0xc]
add ecx, esi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x444e85
or eax, 4
push 0
push eax
call fcn.00431ad0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10