joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4146f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, edx
mov dword [ebp - 4], ebx
mov edx, dword [esi + 0x3c]
cmp dword [edx], ebx
jne 0x414730
mov eax, dword [esi + 0x78]
mov ecx, dword [esi]
or eax, 0x1e
push ebx
and eax, 0x87f7f
push eax
mov eax, dword [ecx + 0x18]
push edx
push ebx
push ecx
call eax
mov ebx, eax
add esp, 0x14
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x414872
mov ecx, dword [esi + 0x18]
cmp ecx, dword [esi + 0x24]
jbe 0x414770
mov eax, dword [esi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.00471ef0
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0x14], edx
lea edx, [ebp - 0x18]
push edx
push 5
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [esi + 0x24], eax
nop dword [eax]
test edi, edi
je 0x414870
mov ebx, dword [edi + 0xc]
mov dword [ebp - 0xc], ebx
cmp ebx, dword [esi + 0x18]
ja 0x414862
test byte [edi + 0x14], 0x20
jne 0x414862
mov eax, dword [esi + 0x80]
lea ecx, [ebx - 1]
cdq
push edx
push eax
push 0
push ecx
call fcn.00471ef0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
cmp ebx, 1
jne 0x414818
mov ecx, dword [edi + 0x10]
movzx edx, byte [ecx + 0x64]
movzx eax, byte [ecx + 0x65]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0x66]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0x67]
shl edx, 8
or edx, eax
mov eax, dword [edi]
inc edx
mov dword [ebp - 4], edx
mov ebx, edx
mov ecx, dword [ebp - 4]
shr ebx, 0x18
mov byte [eax + 0x18], bl
shr edx, 0x10
mov byte [eax + 0x19], dl
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 4]
mov byte [eax + 0x1b], bl
mov ebx, dword [ebp - 8]
shr ecx, 8
mov byte [eax + 0x1a], cl
mov eax, dword [edi]
mov byte [eax + 0x5e], cl
mov ecx, dword [ebp - 4]
mov byte [eax + 0x5c], bl
mov ebx, dword [ebp - 0xc]
mov byte [eax + 0x5d], dl
mov byte [eax + 0x5f], cl
mov eax, dword [edi]
mov dword [eax + 0x60], 0x20e22d00
push dword [ebp - 0x10]
mov eax, dword [esi + 0x3c]
push dword [ebp - 0x14]
mov edx, dword [edi]
push dword [esi + 0x80]
mov ecx, dword [eax]
push edx
push eax
mov dword [ebp - 0xc], edx
mov eax, dword [ecx + 0xc]
call eax
add esp, 0x14
mov dword [ebp - 4], eax
cmp ebx, 1
jne 0x41484b
mov eax, dword [ebp - 0xc]
movups xmm0, xmmword [eax + 0x18]
movups xmmword [esi + 0x64], xmm0
cmp ebx, dword [esi + 0x20]
jbe 0x414853
mov dword [esi + 0x20], ebx
push dword [edi]
mov ecx, dword [esi + 0x58]
mov edx, ebx
call fcn.00422570
add esp, 4
mov ebx, dword [ebp - 4]
mov edi, dword [edi + 8]
test ebx, ebx
je 0x414770
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434d30
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, edx
mov eax, ecx
mov dword [esp + 4], eax
push esi
push edi
test ebx, ebx
jne 0x434d4f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x50
call fcn.0040a250
mov edi, eax
test edi, edi
je 0x434d46
mov esi, dword [ebp + 8]
mov edx, dword [ebx]
mov ecx, dword [esp + 0xc]
push esi
call fcn.00434890
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [edi], eax
mov edx, dword [ebx + 8]
push esi
call fcn.00434a00
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [edi + 8], eax
mov edx, dword [ebx + 0xc]
push esi
call fcn.00434870
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [edi + 0xc], eax
mov edx, dword [ebx + 0x10]
push esi
call fcn.00434890
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [edi + 0x10], eax
mov edx, dword [ebx + 0x14]
push esi
call fcn.00434870
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [edi + 0x14], eax
mov edx, dword [ebx + 0x18]
push esi
call fcn.00434890
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [edi + 0x18], eax
mov al, byte [ebx + 4]
mov byte [edi + 4], al
mov edx, dword [ebx + 0x1c]
push esi
call fcn.00434d30
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [edi + 0x1c], eax
mov edx, dword [ebx + 0x28]
push esi
call fcn.00434870
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [edi + 0x28], eax
mov edx, dword [ebx + 0x2c]
push esi
call fcn.00434870
mov dword [edi + 0x2c], eax
add esp, 4
mov dword [edi + 0x30], 0
mov ecx, 0xfff7
mov dword [edi + 0x34], 0
mov ax, word [ebx + 6]
and ax, cx
mov dword [edi + 0x24], 0
mov word [edi + 6], ax
mov eax, edi
mov dword [edi + 0x38], 0xffffffff
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi + 0x40], 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, edx
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
push esi
mov esi, ecx
mov dword [ebp - 8], esi
push edi
mov edi, eax
test eax, eax
je 0x43c32f
cmp byte [eax], dl
je 0x43c327
inc edi
cmp byte [edi], dl
jne 0x43c322
sub edi, eax
and edi, 0x3fffffff
xor ebx, ebx
cmp dword [esi + 4], edx
jle 0x43c3db
nop word [eax + eax]
mov eax, ebx
mov ecx, ebx
xor eax, 1
cmp ebx, 2
cmovl ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x43c3ab
mov edx, ecx
mov ecx, dword [esi + 8]
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x43c38d
nop dword [eax]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x49fb50]
cmp cl, byte [edx + 0x49fb50]
jne 0x43c38d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x43c370
movzx ecx, byte [esi]
movzx eax, byte [eax]
mov esi, dword [ebp - 8]
movzx ecx, byte [ecx + 0x49fb50]
movzx eax, byte [eax + 0x49fb50]
sub eax, ecx
jne 0x43c3ce
mov ecx, dword [ebp - 0xc]
mov eax, dword [esi + 8]
add ecx, ecx
mov edx, dword [ebp - 0x10]
push edi
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.0040d700
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x43c3db
jmp 0x43c3d1
mov edx, dword [ebp - 4]
inc ebx
cmp ebx, dword [esi + 4]
jl 0x43c340
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43c490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, edx
xor edx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
push ebx
push edi
mov edi, eax
test eax, eax
je 0x43c4bd
cmp byte [eax], dl
je 0x43c4b5
nop dword [eax]
inc edi
cmp byte [edi], dl
jne 0x43c4b0
sub edi, eax
and edi, 0x3fffffff
mov eax, dword [ecx + 4]
xor ebx, ebx
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x43c569
push esi
mov esi, dword [ecx + 8]
mov dword [ebp - 0x14], esi
mov ecx, ebx
mov eax, ebx
xor ecx, 1
cmp ebx, 2
cmovl eax, ecx
mov ecx, dword [ebp + 8]
shl eax, 4
add esi, eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 8], eax
test ecx, ecx
je 0x43c53b
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x43c520
nop dword [eax]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x49fb50]
cmp cl, byte [edx + 0x49fb50]
jne 0x43c51d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x43c500
mov edx, dword [ebp - 4]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x49fb50]
movzx ecx, byte [ecx + 0x49fb50]
sub eax, ecx
jne 0x43c553
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
lea ecx, [eax + 0x18]
push edi
call fcn.0040d700
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x43c560
mov esi, dword [ebp - 0x14]
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x43c4d4
pop esi
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
add edx, edx
mov ecx, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0xc], edi
mov eax, dword [edi + 8]
mov eax, dword [eax + edx*8 + 0xc]
add eax, 0x18
mov dword [ebp - 8], eax
test ecx, ecx
je 0x43c5be
cmp byte [ecx], 0
je 0x43c5b6
nop dword [eax + eax]
inc esi
cmp byte [esi], 0
jne 0x43c5b0
sub esi, ecx
and esi, 0x3fffffff
mov edx, dword [eax]
xor ebx, ebx
mov dword [ebp - 0x10], edx
test edx, edx
je 0x43c607
mov eax, ecx
mov dword [ebp - 4], eax
test esi, esi
jle 0x43c5fb
mov edi, esi
movzx eax, byte [eax]
lea ecx, [ebx*8]
dec edi
movzx edx, byte [eax + 0x49fb50]
mov eax, dword [ebp - 4]
xor edx, ecx
inc eax
xor ebx, edx
mov dword [ebp - 4], eax
test edi, edi
jg 0x43c5d4
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov eax, ebx
xor edx, edx
div dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ebx, edx
push ebx
mov edx, ecx
mov ecx, eax
push esi
call fcn.0040d5f0
add esp, 8
test eax, eax
je 0x43c66c
mov ecx, dword [ebp - 8]
mov edx, eax
mov esi, dword [eax + 8]
push ebx
call fcn.0040d6a0
add esp, 4
test esi, esi
je 0x43c66c
mov edx, dword [esi + 0x10]
mov ecx, dword [edx + 0x10]
cmp ecx, esi
jne 0x43c640
mov eax, dword [esi + 0x20]
mov dword [edx + 0x10], eax
jmp 0x43c659
test ecx, ecx
je 0x43c659
mov eax, dword [ecx + 0x20]
cmp eax, esi
je 0x43c653
mov ecx, eax
test ecx, ecx
jne 0x43c644
jmp 0x43c659
mov eax, dword [esi + 0x20]
mov dword [ecx + 0x20], eax
push dword [esi + 0x1c]
push edi
call fcn.00409fe0
push esi
push edi
call fcn.00409fe0
add esp, 0x10
or dword [edi + 0xc], 0x200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x28], edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x18], edi
test edx, edx
je 0x43ca0d
test edi, edi
je 0x43c886
cmp dword [edi + 0x1f8], 0
jne 0x43c895
mov eax, 0xffff
add word [edx + 0x20], ax
jne 0x43ca0d
mov ebx, dword [edx + 0x10]
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x43c982
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x24], eax
test edi, edi
je 0x43c8ba
cmp dword [edi + 0x1f8], 0
jne 0x43c95f
mov esi, dword [ebx]
mov ecx, esi
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x43c8de
cmp byte [esi], 0
je 0x43c8d6
nop word [eax + eax]
inc ecx
cmp byte [ecx], 0
jne 0x43c8d0
sub ecx, esi
and ecx, 0x3fffffff
mov eax, dword [ebx + 0x24]
add eax, 0x18
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov edx, dword [eax]
mov dword [ebp - 0x20], edx
test edx, edx
je 0x43c938
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], esi
test ecx, ecx
jle 0x43c929
mov edi, ecx
mov ecx, esi
movzx eax, byte [ecx]
lea edx, [ebx*8]
dec edi
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x49fb50]
xor esi, edx
xor ebx, esi
test edi, edi
jg 0x43c903
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov eax, ebx
xor edx, edx
div dword [ebp - 0x20]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
jmp 0x43c93a
xor edx, edx
push edx
mov dword [ebp - 4], edx
mov edx, esi
push ecx
mov ecx, eax
call fcn.0040d5f0
add esp, 8
test eax, eax
je 0x43c95f
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, eax
call fcn.0040d6a0
add esp, 4
push dword [ebx + 0x1c]
push edi
call fcn.00409fe0
push ebx
push edi
call fcn.00409fe0
mov eax, dword [ebp - 0x24]
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ebx, eax
test eax, eax
jne 0x43c8a3
mov ebx, dword [ebp - 0x28]
mov ecx, edi
mov edx, ebx
call fcn.00446c80
mov edx, ebx
mov ecx, edi
call fcn.0043c7f0
push dword [ebx]
push edi
call fcn.00409fe0
push dword [ebx + 0x28]
push edi
call fcn.00409fe0
mov edx, dword [ebx + 0x1c]
add esp, 0x10
mov ecx, edi
call fcn.0044e5d0
mov edx, dword [ebx + 0x2c]
mov ecx, edi
call fcn.004344b0
test edi, edi
je 0x43c9cc
cmp dword [edi + 0x1f8], 0
jne 0x43c9d5
mov edx, ebx
xor ecx, ecx
call fcn.004598b0
cmp dword [ebx + 0x3c], 0
je 0x43ca03
xor esi, esi
cmp dword [ebx + 0x38], esi
jle 0x43c9f7
mov eax, dword [ebx + 0x3c]
push dword [eax + esi*4]
push edi
call fcn.00409fe0
inc esi
add esp, 8
cmp esi, dword [ebx + 0x38]
jl 0x43c9e2
push dword [ebx + 0x3c]
push edi
call fcn.00409fe0
add esp, 8
push ebx
push edi
call fcn.00409fe0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ca20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
shl edx, 4
mov ecx, dword [ebp + 8]
push ebx
push esi
add edx, dword [eax + 8]
mov esi, ecx
mov dword [ebp - 0x14], eax
push edi
test ecx, ecx
je 0x43ca50
cmp byte [ecx], 0
je 0x43ca48
inc esi
cmp byte [esi], 0
jne 0x43ca42
sub esi, ecx
and esi, 0x3fffffff
mov ebx, dword [edx + 0xc]
xor edi, edi
add ebx, 8
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x43ca9f
mov ebx, esi
test esi, esi
jle 0x43ca93
mov esi, ecx
nop
movzx eax, byte [esi]
lea ecx, [edi*8]
dec ebx
lea esi, [esi + 1]
movzx edx, byte [eax + 0x49fb50]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x43ca70
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, edi
mov ebx, dword [ebp - 0x10]
xor edx, edx
div dword [ebp - 0xc]
mov edi, edx
push edi
mov edx, ecx
mov ecx, ebx
push esi
call fcn.0040d5f0
add esp, 8
test eax, eax
je 0x43cac3
mov esi, dword [eax + 8]
mov edx, eax
push edi
mov ecx, ebx
call fcn.0040d6a0
add esp, 4
jmp 0x43cac5
xor esi, esi
mov edx, esi
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.0043c860
or dword [esi + 0xc], 0x200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
add edx, edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push ebx
mov eax, dword [eax + 8]
push esi
push edi
mov esi, ecx
mov ebx, dword [eax + edx*8 + 0xc]
add ebx, 0x28
mov dword [ebp - 0x10], ebx
test ecx, ecx
je 0x456c9e
cmp byte [ecx], 0
je 0x456c96
nop dword [eax + eax]
inc esi
cmp byte [esi], 0
jne 0x456c90
sub esi, ecx
and esi, 0x3fffffff
mov eax, dword [ebx]
xor edi, edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x456ce3
mov ebx, esi
test esi, esi
jle 0x456cd7
mov esi, ecx
movzx eax, byte [esi]
lea ecx, [edi*8]
dec ebx
lea esi, [esi + 1]
movzx edx, byte [eax + 0x49fb50]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x456cb4
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, edi
mov ebx, dword [ebp - 0x10]
xor edx, edx
div dword [ebp - 0xc]
mov edi, edx
push edi
mov edx, ecx
mov ecx, ebx
push esi
call fcn.0040d5f0
add esp, 8
test eax, eax
je 0x456d44
mov esi, dword [eax + 8]
mov edx, eax
push edi
mov ecx, ebx
call fcn.0040d6a0
add esp, 4
test esi, esi
je 0x456d44
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x18]
jne 0x456d31
mov ecx, esi
call fcn.004569c0
lea ecx, [eax + 0x40]
mov eax, dword [ecx]
cmp eax, esi
je 0x456d2a
lea ecx, [eax + 0x20]
mov eax, dword [ecx]
cmp eax, esi
jne 0x456d21
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
mov dword [ecx], eax
mov edx, esi
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.004567c0
or dword [esi + 0xc], 0x200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4674e0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push 0
push 0
push str.userprofile
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
xor ebx, ebx
test edi, edi
jne 0x46750b
mov ecx, esi
call fcn.00403b00
pop edi
pop esi
mov eax, ebx
pop ebx
ret 4
js 0x467571
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x467528
push edi
mov ecx, esi
call fcn.00404ed0
push edi
push dword [esi]
push str.userprofile
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [esi]
test eax, eax
jne 0x467540
xor ecx, ecx
jmp 0x467552
push dword [eax - 8]
push eax
call fcn.0047ab02
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x467571
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x467571
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov ebx, 1
pop edi
pop esi
mov word [eax + ecx*2], dx
mov eax, ebx
pop ebx
ret 4
push 0x80070057
call fcn.00402240
int3
Function at 0x46b730
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x46b73b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x46b7f7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a1bb8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a1bb8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a1bb8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a1bb8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a1bb8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a1bb8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a1bb8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a1bb8]
sub edi, 1
jne 0x46b750
pop edi
test esi, esi
je 0x46b81a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4a1bb8]
sub esi, 1
jne 0x46b800
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x46bf30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x46bf73
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46bf65
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x46bf84
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.00474330
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46bfb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x46bfeb
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46bfe6
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x46c018
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x46bffc
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.00474330
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x46c02c
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x46c023
cmp byte [esi + 8], 0
je 0x46c023
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x46c185
cmp byte [edi + 1], 0
je 0x46c17d
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x46c18b
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], eax
cmp byte [edi], 0
push ebx
je 0x46c1b0
cmp byte [edi + 1], 0
je 0x46c1a9
push 1
push 0
push 0
push dword [edi + 4]
call ecx
mov ebx, eax
sub ebx, dword [edi + 0xc]
jmp 0x46c1b3
xor ebx, ebx
mov dword [ebp - 0xc], ebx
jmp 0x46c1c2
mov ebx, dword [edi + 0x1c]
mov eax, 0xffff
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
cmp ebx, eax
jae 0x46c1c5
mov dword [ebp - 8], ebx
push esi
push 0x404
call fcn.0048066a
mov esi, eax
add esp, 4
test esi, esi
jne 0x46c1e3
pop esi
pop ebx
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov eax, 4
mov dword [ebp - 4], 0xffffffff
cmp ecx, eax
jbe 0x46c2e8
nop word [eax + eax]
add eax, 0x400
cmp eax, ecx
mov edx, eax
mov eax, 0x404
cmova edx, ecx
mov ecx, ebx
sub ecx, edx
mov dword [ebp - 0x1c], edx
sub ebx, ecx
mov dword [ebp - 0x18], ecx
cmp ebx, 0x404
cmova ebx, eax
cmp byte [edi], 0
je 0x46c24a
cmp byte [edi + 1], 0
je 0x46c2e8
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x46c24d
mov dword [edi + 0x1c], ecx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 0x10], ebx
je 0x46c275
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46c270
mov byte [edi + 8], 1
mov eax, dword [ebp - 0x14]
jmp 0x46c29e
mov edx, dword [edi + 0x1c]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
jbe 0x46c288
mov ecx, dword [edi + 0x18]
sub ecx, edx
mov dword [ebp - 0x10], ecx
push ecx
mov ecx, dword [edi + 0x14]
add ecx, edx
push ecx
push esi
call fcn.00474330
mov eax, dword [ebp - 0x10]
add esp, 0xc
add dword [edi + 0x1c], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x46c2e8
lea eax, [ebx - 3]
test eax, eax
js 0x46c2d0
nop
dec eax
cmp byte [eax + esi], 0x50
jne 0x46c2cc
cmp byte [eax + esi + 1], 0x4b
jne 0x46c2cc
cmp byte [eax + esi + 2], 5
jne 0x46c2cc
cmp byte [eax + esi + 3], 6
je 0x46c2fb
test eax, eax
jns 0x46c2b0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x46c2e8
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
cmp eax, ecx
jb 0x46c200
push esi
call fcn.004793e5
mov eax, dword [ebp - 4]
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x46c2d3