joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4223d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, eax
mov ebx, edi
call fcn.00422190
mov al, byte [ebp + 0xc]
push 0
push 0x80
push 3
push 0
mov byte [edi + 4], al
push 1
test al, al
je 0x422404
mov eax, dword [ebp + 8]
push 0x80000000
push eax
jmp 0x42240d
mov ecx, dword [ebp + 8]
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi + 8], eax
cmp eax, 0xffffffff
jne 0x42242c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
lea edx, [ebp + 0xc]
push edx
push pe_nt_image_headers32
lea ecx, [edi + 0xc]
push ecx
push eax
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [edi + 0x10c]
cmp eax, 0xa
jl 0x422421
cmp eax, 0xb
jg 0x422421
cmp eax, 0xa
jle 0x422482
cmp byte [edi + 0x118], 1
je 0x422421
mov eax, dword [edi + 8]
cmp eax, 0xffffffff
je 0x4224bb
mov edx, dword [edi + 0x114]
push 0
push edx
push eax
xor edx, edx
call fcn.00421ff0
jmp 0x4224bb
mov ecx, dword [edi + 0x110]
mov edx, dword [edi + 8]
imul ecx, ecx, 0x13c
xor eax, eax
neg ecx
adc eax, eax
neg eax
cmp edx, 0xffffffff
jne 0x4224a5
or eax, edx
mov dword [ebp - 4], edx
jmp 0x4224b5
push eax
push ecx
push edx
mov edx, 2
call fcn.00421ff0
mov dword [ebp - 4], edx
mov dword [edi + 0x114], eax
mov eax, dword [edi + 0x110]
test eax, eax
je 0x422526
lea ebx, [edi + 0x2a0]
push ebx
call fcn.004236f0
mov edx, dword [edi + 8]
cmp edx, 0xffffffff
je 0x4224ec
mov esi, dword [edi + 0x110]
mov ecx, dword [ebx]
imul esi, esi, 0x13c
call fcn.00422040
mov ecx, dword [ebx + 4]
sub ecx, dword [ebx]
mov eax, 0x67b23a55
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
xor esi, esi
test eax, eax
jle 0x422526
mov ebx, dword [ebx]
add ebx, 0x100
mov ecx, dword [ebx]
cmp ecx, dword [ebx + 8]
ja 0x422421
inc esi
add ebx, 0x13c
cmp esi, eax
jl 0x422510
call fcn.00422e70
mov eax, 0x545020
mov ecx, edi
call fcn.004235e0
mov ebx, dword [ebp + 8]
add edi, 0x220
call fcn.00421b70
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x422550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x300
mov eax, dword [0x551aa8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov ebx, esi
mov edi, ecx
call fcn.00422190
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x4225a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050bf32
mov esp, ebp
pop ebp
ret
push pe_nt_image_headers32
lea edi, [esi + 0xc]
push ebx
push edi
call sub.MSVCR100.dll_memset
push str.EyedentityGames_Packing_File_0.1
push 0x100
push edi
call dword [sym.imp.MSVCR100.dll_strcpy_s]
mov eax, dword [esi + 8]
add esp, 0x18
mov dword [esi + 0x10c], 0xb
mov dword [esi + 0x110], ebx
mov dword [esi + 0x114], 0x400
cmp eax, 0xffffffff
je 0x422594
push ebx
lea ecx, [ebp - 0x2fc]
push ecx
push pe_nt_image_headers32
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
mov dword [ebp - 0x2fc], ebx
call edi
test eax, eax
je 0x422594
push 0x2f0
lea edx, [ebp - 0x2f8]
push ebx
push edx
call sub.MSVCR100.dll_memset
mov eax, dword [esi + 8]
add esp, 0xc
cmp eax, 0xffffffff
je 0x422646
push ebx
lea ecx, [ebp - 0x2fc]
push ecx
push 0x2f0
lea edx, [ebp - 0x2f8]
push edx
push eax
mov dword [ebp - 0x2fc], ebx
call edi
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 4], bl
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0050bf32
mov esp, ebp
pop ebp
ret
Function at 0x422740
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, eax
cmp dword [esi + 8], 0xffffffff
push edi
je 0x42285e
mov ecx, esi
call fcn.004229b0
cmp eax, 0xffffffff
je 0x42285e
imul eax, eax, 0x13c
add eax, dword [esi + 0x2a0]
mov ebx, eax
je 0x42285e
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x422792
mov ecx, dword [ebx + 0x10c]
push 0
push ecx
push eax
xor edx, edx
call fcn.00421ff0
mov edx, dword [ebx + 0x100]
push edx
call dword [sym.imp.mfc100u.dll_new__]
mov esi, dword [esi + 8]
add esp, 4
mov edi, eax
cmp esi, 0xffffffff
je 0x4227c8
mov ecx, dword [ebx + 0x100]
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edi
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [ebx + 0x104]
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.mfc100u.dll_new__]
add esp, 4
cmp dword [ebx + 0x118], 0
mov dword [ebp - 4], eax
je 0x42282f
cmp dword [0x55c740], 0
jne 0x422805
push 0x22
push str.D:ProjectDragonNestCommonutilitySingleton.h
push str.s_pObj
call dword [0x551f68]
add esp, 0xc
mov eax, dword [ebx + 0x100]
dec eax
je 0x42282f
mov edi, edi
mov edx, eax
and edx, 0x8000007f
jns 0x42281f
dec edx
or edx, 0xffffff80
inc edx
mov cl, byte [edx + str.RALUKAT_b]
xor cl, byte [eax + edi - 1]
xor byte [eax + edi], cl
dec eax
jne 0x422810
mov ecx, dword [ebx + 0x100]
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov eax, edi
lea esi, [ebp - 8]
call fcn.00425510
test eax, eax
je 0x422867
mov esi, dword [sym.imp.mfc100u.dll_delete__]
push edi
call esi
mov edx, dword [ebp - 4]
add esp, 4
push edx
call esi
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
je 0x422887
push 0x234
push str.EtFileSystem.cpp
push str.dwOrigin__dwOriginalSize
call dword [0x551f68]
add esp, 0xc
push edi
call dword [sym.imp.mfc100u.dll_delete__]
add esp, 4
push 0x148
call dword [sym.imp.mfc100u.dll_new]
add esp, 4
test eax, eax
je 0x4228ac
mov esi, eax
call fcn.00421bf0
jmp 0x4228ae
xor eax, eax
mov esi, ebx
lea edi, [eax + 4]
mov ecx, 0x4f
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax + 0x140], ecx
mov dword [eax + 0x144], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4228e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, eax
cmp dword [esi + 8], 0xffffffff
push edi
jne 0x4228fa
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.004229b0
cmp eax, 0xffffffff
je 0x4228f1
imul eax, eax, 0x13c
add eax, dword [esi + 0x2a0]
mov ebx, eax
je 0x4228f1
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x42292f
mov ecx, dword [ebx + 0x10c]
push 0
push ecx
push eax
xor edx, edx
call fcn.00421ff0
mov edx, dword [ebx + 0x100]
push edx
call dword [sym.imp.mfc100u.dll_new__]
mov esi, dword [esi + 8]
add esp, 4
mov dword [ebp - 8], eax
cmp esi, 0xffffffff
je 0x422966
mov edx, dword [ebx + 0x100]
push 0
lea ecx, [ebp - 4]
push ecx
push edx
push eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x148
call dword [sym.imp.mfc100u.dll_new]
add esp, 4
test eax, eax
je 0x422981
mov esi, eax
call fcn.00421bf0
jmp 0x422983
xor eax, eax
mov esi, ebx
lea edi, [eax + 4]
mov ecx, 0x4f
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov dword [eax + 0x140], ecx
mov dword [eax + 0x144], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x423000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor ebx, ebx
push edi
cmp byte [esi + 4], bl
jne 0x4230e5
cmp byte [esi + 0x118], bl
je 0x4230e5
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x42304e
mov ecx, dword [esi + 0x114]
push ebx
lea edx, [ebp - 4]
push edx
push ecx
push eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x42304e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [esi + 8]
cmp edi, 0xffffffff
je 0x423090
mov ecx, dword [esi + 0x2a4]
sub ecx, dword [esi + 0x2a0]
push ebx
lea eax, [ebp - 4]
push eax
mov eax, 0x67b23a55
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esi + 0x2a0]
imul ecx, ecx, 0x13c
push ecx
push edx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov byte [esi + 0x118], bl
cmp eax, 0xffffffff
je 0x4230bf
push ebx
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x4230bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x4230df
push ebx
lea edx, [ebp - 4]
push edx
push pe_nt_image_headers32
lea ecx, [esi + 0xc]
push ecx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [esi + 0x118], bl
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4230f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jl 0x42319b
mov ecx, dword [esi + 0x2a4]
sub ecx, dword [esi + 0x2a0]
mov eax, 0x67b23a55
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jge 0x42319b
mov ecx, dword [esi + 0x2a0]
imul edi, edi, 0x13c
mov dword [ecx + edi + 0x100], ebx
mov edx, dword [esi + 0x2a0]
mov dword [edx + edi + 0x104], ebx
mov ecx, dword [esi + 8]
cmp ecx, 0xffffffff
je 0x423176
mov eax, dword [esi + 0x114]
push ebx
lea edx, [ebp - 4]
add eax, edi
push edx
push eax
push ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x423176
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x42319b
mov edx, dword [esi + 0x2a0]
push ebx
lea ecx, [ebp - 4]
push ecx
push 0x13c
add edx, edi
push edx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x551aa8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [esi + 8], 0xffffffff
push ebx
push edi
mov edi, ecx
je 0x4235c6
cmp byte [edi], 0x5c
jne 0x42348b
push edi
lea eax, [ebp - 0x110]
push 0x104
push eax
call dword [sym.imp.MSVCR100.dll_strcpy_s]
jmp 0x4234ba
lea ecx, [esi + 0x11c]
push ecx
lea edx, [ebp - 0x110]
push 0x104
push edx
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
push edi
lea eax, [ebp - 0x110]
push 0x104
push eax
call dword [sym.imp.MSVCR100.dll_strcat_s]
add esp, 0xc
lea edx, [ebp - 0x110]
mov ecx, esi
call fcn.004229b0
mov dword [ebp - 0x11c], eax
cmp eax, 0xffffffff
je 0x4235c6
mov ecx, dword [esi + 0x2a0]
mov edi, eax
imul edi, edi, 0x13c
xor ebx, ebx
mov dword [ecx + edi + 0x100], ebx
mov edx, dword [esi + 0x2a0]
mov dword [edx + edi + 0x104], ebx
mov ecx, dword [esi + 8]
cmp ecx, 0xffffffff
je 0x42353a
mov eax, dword [esi + 0x114]
push ebx
lea edx, [ebp - 0x114]
add eax, edi
push edx
push eax
push ecx
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x118], eax
cmp eax, 0xffffffff
jne 0x42353a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x423565
mov edx, dword [esi + 0x2a0]
push ebx
lea ecx, [ebp - 0x114]
push ecx
push 0x13c
add edx, edi
push edx
push eax
mov dword [ebp - 0x114], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x42359a
push ebx
lea ecx, [ebp - 0x114]
push ecx
push ebx
push eax
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x118], eax
cmp eax, 0xffffffff
jne 0x42359a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x11c]
mov ecx, esi
call fcn.00422d40
mov edx, dword [ebp - 0x11c]
mov ecx, esi
call fcn.00422bd0
mov al, 1
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050bf32
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0050bf32
mov esp, ebp
pop ebp
ret
Function at 0x4251e0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [0x551aa8]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_strcpy_s]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x21c]
push 0x104
push eax
call ebx
mov esi, dword [sym.imp.MSVCR100.dll_strcat_s]
add esp, 0xc
push str..
lea ecx, [ebp - 0x21c]
push 0x104
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x35c]
push edx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x360], eax
cmp eax, 0xffffffff
je 0x4252f0
cmp byte [ebp - 0x330], 0x2e
je 0x4252c0
push edi
lea ecx, [ebp - 0x114]
push 0x104
push ecx
call ebx
add esp, 0xc
push 0x545020
lea edx, [ebp - 0x114]
push 0x104
push edx
call esi
add esp, 0xc
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x114]
push 0x104
push ecx
call esi
add esp, 0xc
test byte [ebp - 0x35c], 0x10
je 0x4252b3
lea edx, [ebp - 0x114]
push edx
call fcn.004251e0
add esp, 4
jmp 0x4252c0
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x360]
lea ecx, [ebp - 0x35c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x425250
mov eax, dword [ebp - 0x360]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050bf32
mov esp, ebp
pop ebp
ret

Function at 0x425310
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x551aa8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.MSVCR100.dll_strcpy_s]
lea eax, [ebp - 0x108]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x425345
sub eax, edx
cmp byte [ebp + eax - 0x109], 0x5c
je 0x425372
push 0x545020
lea ecx, [ebp - 0x108]
push 0x104
push ecx
call dword [sym.imp.MSVCR100.dll_strcat_s]
add esp, 0xc
push esi
push edi
mov edi, dword [sym.imp.MSVCR100.dll_strchr]
lea edx, [ebp - 0x108]
push 0x5c
push edx
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x4253bc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp byte [esi - 1], 0x3a
je 0x4253ac
push 0
lea eax, [ebp - 0x108]
push eax
mov byte [esi], 0
call ebx
mov byte [esi], 0x5c
push 0x5c
inc esi
push esi
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x425395
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0050bf32
mov esp, ebp
pop ebp
ret
Function at 0x4253d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4253f3
sub eax, ecx
xor ecx, ecx
xor esi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
cmp eax, 2
jl 0x4254a3
mov eax, dword [ebp + 8]
movsx eax, byte [eax + esi]
imul eax, eax
cdq
mov edi, eax
add dword [ebp - 0x28], edi
mov ebx, edx
mov edx, dword [ebp - 0x14]
adc dword [ebp - 0x24], ebx
shld edx, ecx, 8
push 0xffffff
push 0xfffffffffffffffd
shl ecx, 8
or edx, ebx
or ecx, edi
push edx
push ecx
call fcn.0050ce40
xor dword [ebp - 0x10], edi
xor dword [ebp - 0xc], ebx
mov ecx, eax
mov eax, dword [ebp + 8]
movsx eax, byte [eax + esi + 1]
imul eax, eax
mov dword [ebp - 0x14], edx
cdq
mov edi, eax
add dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x14]
mov ebx, edx
adc dword [ebp - 0x1c], ebx
shld eax, ecx, 8
push 0xffffff
push 0xfffffffffffffffd
shl ecx, 8
or eax, ebx
or ecx, edi
push eax
push ecx
call fcn.0050ce40
xor dword [ebp - 0x10], edi
xor dword [ebp - 0xc], ebx
mov ecx, eax
mov eax, dword [ebp - 4]
add esi, 2
dec eax
mov dword [ebp - 0x14], edx
cmp esi, eax
jb 0x425415
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
cmp esi, eax
jae 0x4254e2
mov edx, dword [ebp + 8]
movsx eax, byte [esi + edx]
imul eax, eax
cdq
mov esi, eax
mov eax, dword [ebp - 0x14]
shld eax, ecx, 8
push 0xffffff
mov edi, edx
push 0xfffffffffffffffd
shl ecx, 8
or eax, edi
or ecx, esi
push eax
push ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], edi
call fcn.0050ce40
xor dword [ebp - 0x10], esi
mov ecx, eax
mov dword [ebp - 0x14], edx
xor ebx, edi
mov edx, dword [ebp - 0x10]
shl edx, 0x10
or edx, dword [ebp - 0x14]
xor eax, eax
or eax, ecx
add eax, dword [ebp - 0x20]
pop edi
adc edx, dword [ebp - 0x1c]
add eax, dword [ebp - 0x28]
pop esi
adc edx, dword [ebp - 0x24]
add eax, dword [ebp - 0x30]
pop ebx
adc edx, dword [ebp - 0x2c]
mov esp, ebp
pop ebp
ret
Function at 0x427e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, edx
jb 0x427eb9
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call sub.MSVCR100.dll_memcpy
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x427e90
sub eax, ebx
jmp 0x427e92
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x427e81
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x427eaf
sub eax, ebx
jmp 0x427eb1
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x427ea0
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x427f13
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, esi
add edx, dword [edi + 0x38]
mov esi, eax
push edx
call fcn.00427b40
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x427eff
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx eax, byte [esi]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x427f13
mov edx, dword [edi]
cmp dword [edx + 4], 0
jne 0x427e45
pop esi
pop ebx
ret
Function at 0x4327f0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x3e0]
mov dword [esi], vtable.CxImageMNG.0
test eax, eax
je 0x432830
push eax
mov byte [esi + 0x3f7], 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0x3e0]
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x3e0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x3d8]
test eax, eax
je 0x432843
push eax
call sub.MSVCR100.dll_free
add esp, 4
mov eax, dword [esi + 0x3dc]
test eax, eax
je 0x432856
push eax
call sub.MSVCR100.dll_free
add esp, 4
cmp dword [esi + 0x3d0], 0
lea eax, [esi + 0x3d0]
je 0x43286e
push eax
call fcn.004b3af0
add esp, 4
mov ecx, esi
mov dword [esi], vtable.CxImage.0
call fcn.0042bef0
mov ecx, esi
pop esi
jmp fcn.0042be40

Function at 0x441040
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x441072
push esi
call fcn.004417d0
add esp, 4
cmp byte [esi + 0x40], 0
je 0x44106b
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
pop ebp
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4410ee
mov eax, dword [esi + 0x1a0]
cmp byte [eax + 0x10], 0
je 0x4410dd
mov eax, dword [esi + 8]
test eax, eax
je 0x441097
mov ecx, dword [eax]
push esi
call ecx
add esp, 4
mov edx, dword [esi + 0x1a0]
mov eax, dword [edx]
push esi
call eax
add esp, 4
test eax, eax
je 0x4410d8
cmp eax, 2
je 0x4410dd
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x441088
cmp eax, 3
je 0x4410bf
cmp eax, 1
jne 0x441088
inc dword [ecx + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 8]
jl 0x441088
mov ecx, dword [esi + 0x120]
add dword [eax + 8], ecx
jmp 0x441088
xor al, al
pop esi
pop ebp
ret
mov edx, dword [esi + 0x7c]
mov dword [esi + 0x84], edx
call fcn.00440d00
pop esi
pop ebp
ret
cmp eax, 0xcc
je 0x441110
mov eax, dword [esi]
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov edx, dword [esi + 0x14]
mov dword [ecx + 0x18], edx
mov eax, dword [esi]
mov ecx, dword [eax]
push esi
call ecx
add esp, 4
call fcn.00440d00
pop esi
pop ebp
ret
Function at 0x444190
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [edi + 4], ebx
call fcn.0041d210
push 0x54
push edi
mov dword [ebp - 4], eax
call fcn.0044ccf0
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x4441d7
push edi
call fcn.00401300
mov eax, dword [edi]
mov dword [eax + 0x14], 0x38
mov ecx, dword [edi]
mov dword [ecx + 0x18], ebx
mov edx, dword [edi]
mov eax, dword [edx]
push edi
call eax
add esp, 8
mov dword [esi], fcn.004436b0
mov dword [esi + 4], fcn.004437e0
mov dword [esi + 8], fcn.00443880
mov dword [esi + 0xc], fcn.00443930
mov dword [esi + 0x10], 0x4439e0
mov dword [esi + 0x14], 0x443a50
mov dword [esi + 0x18], 0x443ac0
mov dword [esi + 0x1c], 0x443da0
mov dword [esi + 0x20], 0x443ef0
mov dword [esi + 0x24], fcn.00444040
mov dword [esi + 0x28], 0x444150
mov dword [esi + 0x30], 0x3b9aca00
mov ecx, dword [ebp - 4]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call sub.MSVCR100.dll_getenv
add esp, 4
cmp eax, ebx
je 0x4442ab
lea edx, [ebp + 0xb]
push edx
lea ecx, [ebp - 4]
push ecx
push str._ld_c
push eax
mov byte [ebp + 0xb], 0x78
call sub.MSVCR100.dll_sscanf
add esp, 0x10
test eax, eax
jle 0x4442ab
mov al, byte [ebp + 0xb]
cmp al, 0x6d
je 0x444286
cmp al, 0x4d
jne 0x44429f
mov eax, dword [ebp - 4]
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
pop edi
mov dword [esi + 0x2c], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret