joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428850
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x428871
push esi
call fcn.00427660
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x4288e5
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x4288d2
dec ecx
je 0x4288bd
sub ecx, 2
je 0x4288aa
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x42892a
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x42894b
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x428970
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x428997
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00428850
mov dword [esp + 4], eax
jmp 0x4289b1
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
je 0x4289bd
xor eax, eax
pop edi
pop ecx
ret 8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x4289d9
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x4289e9
mov esi, 2
jmp 0x428a05
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x4289f8
mov esi, 3
jmp 0x428a05
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x428a62
mov esi, 4
mov edx, dword [esp + 0x14]
mov byte [edx], cl
cmp dword [edi + 4], 0
je 0x428a34
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push edi
call fcn.00428850
mov edx, eax
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 8]
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8

Function at 0x42bbf1
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x484130]
call fcn.0043ad4c
mov ebx, eax
test ebx, ebx
je 0x42bc55
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x42bc1a
push dword [esp + 0xc]
push ebx
call eax
jmp 0x42bc55
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.DLL_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.0043b860
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.DLL_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.0043b930
pop edi
pop esi
pop ebx
ret 8
Function at 0x42f3d4
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0x484140]
call fcn.0043ace3
xor ebp, ebp
mov esi, eax
cmp dword [0x4838f8], ebp
jne 0x42f4b0
xor ebx, ebx
inc ebx
mov dword [0x4838f8], ebx
call fcn.004306f8
mov edi, 0xa4
push edi
push ebp
push 0x483900
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x483900], 0x13
lea eax, [esp + 0x10]
mov dword [0x483904], edi
mov dword [0x483910], 0x42f31f
mov dword [0x483914], 0x42f66a
push eax
mov dword [0x483968], 0x42f2fa
mov dword [0x48396c], 0x42f5b5
mov dword [0x48390c], 0x42f2d5
mov dword [0x483990], 0x42f33a
mov dword [0x4839a4], ebx
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42f4b0
cmp dword [esp + 0x20], ebx
je 0x42f498
cmp dword [esp + 0x20], 2
jne 0x42f4b0
cmp dword [esp + 0x14], 5
jae 0x42f4a0
mov dword [0x4839a4], ebp
jmp 0x42f4b0
jne 0x42f4b0
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
and dword [0x4839a4], eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.0043381e
mov eax, dword [esp + 0x140]
push ebp
push dword [0x482640]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebp
push str.BUTTON
push ebp
call dword [sym.imp.USER32.DLL_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x42f586
push dword [esp + 0x128]
push dword [0x484130]
call fcn.0043ad74
mov edi, dword [esp + 0x13c]
mov esi, eax
mov dword [esi + 0x10], edi
test edi, edi
je 0x42f555
push edi
call fcn.00435c44
test eax, eax
je 0x42f555
push ebp
push ebp
push edi
call fcn.0043588e
mov dword [esi + 0x18], eax
jmp 0x42f558
mov dword [esi + 0x18], ebp
push 0x42f024
push 0xfffffffffffffffc
push ebx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], ebp
call dword [sym.imp.USER32.DLL_SetWindowLongW]
push 0x483900
push ebx
push esi
push dword [esp + 0x134]
mov dword [0x4838fc], eax
call fcn.0042f77a
mov ebx, eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x114
ret 0x1c
Function at 0x4324dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov ebx, eax
test ebx, ebx
je 0x43256f
push 9
call esi
test al, al
jns 0x43256f
push 0x11
call esi
test al, al
js 0x43256f
push 0x10
call esi
test al, al
js 0x43256f
push 0x12
call esi
test al, al
js 0x43256f
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.USER32.DLL_GetClassNameW]
push 5
lea eax, [ebp - 0x24]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x432551
push 4
lea eax, [ebp - 0x24]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x43256f
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.DLL_SendMessageW]
test eax, 0x800
jne 0x43256f
xor eax, eax
jmp 0x4325f0
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x432597
push 0x11
call esi
test al, al
js 0x43258f
push 0x10
call esi
test al, al
js 0x43258f
push 0x12
call esi
test al, al
jns 0x432597
push 1
push edi
call fcn.004325f8
mov esi, dword [sym.imp.USER32.DLL_GetPropW]
test ebx, ebx
je 0x4325ad
push str.PB_Hotkey
push ebx
call esi
test eax, eax
jne 0x4325ed
push str.PB_WindowID
push edi
call esi
mov esi, eax
test esi, esi
je 0x4325ed
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x4325ed
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x4325ed
lea eax, [esi - 1]
push eax
push dword [0x484134]
call fcn.0043ad4c
test eax, eax
je 0x4325ed
mov eax, dword [eax + 8]
jmp 0x4325ef
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x433e6c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
jne 0x433e7d
mov eax, dword [esp + 0xc]
jmp 0x433f59
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x433f3a
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x468800]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x468800]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x468800]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x468800]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x468800]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x468800]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x468800]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x468800]
dec edi
jne 0x433e9d
pop edi
test esi, esi
je 0x433f53
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x468800]
inc edx
dec esi
jne 0x433f3e
not ecx
pop esi
mov eax, ecx
pop ebx
ret 0xc
Function at 0x433f60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push dword [esp + 0x24]
xor edi, edi
mov esi, 0x100000
mov dword [esp + 0x14], edi
xor ebx, ebx
call fcn.004340e0
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x43409d
mov eax, dword [esp + 0x20]
test eax, eax
je 0x43409d
push ebx
push pe_nt_image_headers32
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x43409d
push esi
push ebx
push dword [0x48263c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x24], eax
test eax, eax
je 0x434093
mov eax, dword [ebp + 4]
push ebx
push dword [esp + 0x2c]
call eax
mov ebx, eax
test ebx, ebx
je 0x434081
cmp dword [esp + 0x30], edi
jl 0x43400b
mov eax, dword [esp + 0x2c]
jg 0x433ff9
test eax, eax
je 0x43400b
push 0
lea ecx, [esp + 0x34]
push ecx
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
add edi, 0x100000
mov eax, ebp
adc ecx, 0
and eax, edx
mov dword [esp + 0x10], ecx
cmp eax, 0xffffffff
je 0x434041
cmp ecx, edx
jl 0x434041
jg 0x434037
cmp edi, ebp
jbe 0x434041
mov esi, ebp
sub esi, edi
add esi, 0x100000
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [esp + 0x30]
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
push dword [esp + 0x28]
push ebx
mov eax, dword [eax + 8]
call eax
cmp dword [esp + 0x14], 0x100000
mov edx, dword [esp + 0x38]
je 0x434013
mov ebp, dword [esp + 0x18]
push ebx
mov eax, dword [ebp + 0xc]
call eax
push dword [esp + 0x24]
push 0
push dword [0x48263c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x3c]
push ebx
call fcn.00434190
test ebx, ebx
je 0x4340b1
mov eax, dword [ebp + 0x10]
push ebx
call eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x20

Function at 0x4344af
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
test esi, esi
je 0x43450c
push esi
call dword [esi + 0x58]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x98], ecx
test edi, edi
jne 0x43450c
mov eax, dword [esi + 0x70]
test eax, eax
je 0x4344eb
push ebx
push esi
call eax
push esi
push ebx
push dword [0x48263c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [0x4841a8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x4841ac], ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x435da2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push 0x468c10
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x483f1c], eax
test eax, eax
je 0x435dd0
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x483f18], eax
lea eax, [ebp - 0x114]
mov dword [0x483f20], 1
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x435e32
cmp dword [ebp - 0x104], 1
jne 0x435e07
and dword [0x483f20], 0
jmp 0x435e4a
cmp dword [ebp - 0x104], 2
jne 0x435e32
cmp dword [ebp - 0x110], 5
jb 0x435dfe
jne 0x435e32
mov eax, dword [ebp - 0x10c]
neg eax
sbb eax, eax
and eax, dword [0x483f20]
mov dword [0x483f20], eax
jmp 0x435e37
mov eax, dword [0x483f20]
test eax, eax
je 0x435e4a
call fcn.0043567d
neg eax
sbb eax, eax
and dword [0x483f20], eax
mov esp, ebp
pop ebp
ret

Function at 0x436eb0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x436ee2
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x436edd
cmp dword [esp + 0xc], esi
je 0x436ef9
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x445270
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ecx
mov eax, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
cmp esi, eax
jb 0x445280
mov esi, eax
test esi, esi
je 0x445312
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
sub ebp, ebx
mov dword [esp + 0x10], esi
lea ecx, [ecx]
mov eax, dword [edi + 8]
mov dl, byte [ebx + ebp]
or eax, 2
mov ecx, eax
mov byte [esp + 0x20], dl
xor ecx, 1
imul ecx, eax
lea eax, [esp + 0x20]
push 1
push eax
shr ecx, 8
xor cl, dl
mov byte [ebx], cl
mov eax, dword [edi]
not eax
push eax
call fcn.00441ce0
not eax
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [edi + 4], eax
mov al, byte [edi + 7]
mov byte [esp + 0x38], al
lea eax, [esp + 0x38]
push eax
mov eax, dword [edi + 8]
not eax
push eax
call fcn.00441ce0
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [edi + 8], eax
dec esi
jne 0x4452a0
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret

Function at 0x445320
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x14]
mov dword [esi], 0x12345678
mov dword [esi + 4], 0x23456789
mov dword [esi + 8], 0x34567890
test edi, edi
je 0x4453a5
push ebx
mov ebx, dword [esp + 0x14]
jmp 0x445350
movzx eax, byte [ebx]
mov byte [esp + 0x10], al
lea eax, [esp + 0x10]
push 1
push eax
mov eax, dword [esi]
not eax
push eax
call fcn.00441ce0
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
movzx eax, byte [esi + 7]
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.00441ce0
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [esi + 8], eax
dec edi
jne 0x445350
pop ebx
pop edi
xor eax, eax
pop esi
ret

Function at 0x447bd0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
cmp edi, eax
jb 0x447bdf
mov edi, eax
test edi, edi
je 0x447c5d
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
sub ebp, ebx
mov eax, dword [esi + 8]
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
lea eax, [esp + 0x1c]
push 1
push eax
shr ecx, 8
xor cl, byte [ebx + ebp]
mov byte [ebx], cl
mov eax, dword [esi]
not eax
mov byte [esp + 0x24], cl
push eax
call fcn.00441ce0
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
mov al, byte [esi + 7]
mov byte [esp + 0x34], al
lea eax, [esp + 0x34]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.00441ce0
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [esi + 8], eax
dec edi
jne 0x447bf4
pop esi
pop ebp
pop ebx
pop edi
ret
Function at 0x447c80
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x24], 0xc
jae 0x447c98
mov eax, dword [esp + 0x28]
mov byte [eax], 0xff
or eax, 0xffffffff
add esp, 0x10
ret
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x24]
mov dword [esi], 0x12345678
mov dword [esi + 4], 0x23456789
mov dword [esi + 8], 0x34567890
test edi, edi
je 0x447d15
push ebx
mov ebx, dword [esp + 0x24]
nop
movzx eax, byte [ebx]
mov byte [esp + 0x30], al
lea eax, [esp + 0x30]
push 1
push eax
mov eax, dword [esi]
not eax
push eax
call fcn.00441ce0
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
movzx eax, byte [esi + 7]
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.00441ce0
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [esi + 8], eax
dec edi
jne 0x447cc0
pop ebx
push 0xc
lea eax, [esp + 0x10]
push eax
push 0xc
push dword [esp + 0x34]
push esi
call fcn.00447bd0
mov ecx, dword [esp + 0x44]
add esp, 0x14
mov al, byte [esp + 0x17]
pop edi
mov byte [ecx], al
xor eax, eax
pop esi
add esp, 0x10
ret
Function at 0x44d760
Capabilities:
Terminate process

Disassembly:
mov edx, dword [str.Fatal_Internal_Error_in_libarchive:]
mov ecx, edx
push esi
lea esi, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44d770
sub ecx, esi
push ecx
push edx
push 2
call fcn.00453430
mov edx, dword [esp + 0x18]
add esp, 0xc
mov ecx, edx
lea esi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44d790
sub ecx, esi
push ecx
push edx
push 2
call fcn.00453430
push 1
push 0x46dbf8
push 2
call fcn.00453430
add esp, 0x18
push dword [esp + 8]
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
int3

Function at 0x44dde0
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 0x30]
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 4], 0
mov edi, dword [ebx + 4]
mov eax, dword [ebx]
mov dword [esp + 0x18], eax
lea eax, [edi + 1]
push eax
push esi
call fcn.0044ed20
mov ebp, dword [sym.imp.MSVCRT.dll_memmove]
add esp, 8
test eax, eax
je 0x44de37
mov eax, dword [esi + 4]
add eax, dword [esi]
push edi
push dword [esp + 0x1c]
push eax
call ebp
mov eax, dword [esi]
add esp, 0xc
add dword [esi + 4], edi
mov ecx, dword [esi + 4]
mov byte [ecx + eax], 0
jmp 0x44de46
push str.Out_of_memory
push 1
call fcn.0044d760
add esp, 8
mov dword [esi + 0x10], 0
lea edi, [esi + 0xc]
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 4]
inc eax
mov dword [esp + 0x18], ecx
add eax, ecx
push eax
push edi
call fcn.0044ed20
add esp, 8
test eax, eax
je 0x44de97
push dword [esp + 0x18]
mov eax, dword [edi]
push dword [esp + 0x18]
add eax, dword [edi + 4]
push eax
call ebp
mov eax, dword [esp + 0x24]
add esp, 0xc
add dword [edi + 4], eax
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov byte [ecx + eax], 0
jmp 0x44dea6
push str.Out_of_memory
push 1
call fcn.0044d760
add esp, 8
mov dword [esi + 0x1c], 0
add esi, 0x18
mov edi, dword [ebx + 0x1c]
mov ebx, dword [ebx + 0x18]
mov eax, dword [esi + 4]
inc eax
add eax, edi
add eax, eax
push eax
push esi
call fcn.0044ed20
add esp, 8
test eax, eax
je 0x44def2
mov ecx, dword [esi + 4]
lea eax, [edi + edi]
push eax
mov eax, dword [esi]
push ebx
lea eax, [eax + ecx*2]
push eax
call ebp
add dword [esi + 4], edi
add esp, 0xc
mov ecx, dword [esi + 4]
xor edx, edx
mov eax, dword [esi]
pop edi
pop esi
pop ebp
mov word [eax + ecx*2], dx
pop ebx
ret
pop edi
pop esi
pop ebp
pop ebx
mov dword [esp + 8], str.Out_of_memory
mov dword [esp + 4], 1
jmp fcn.0044d760
Function at 0x452ed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll__errno]
test eax, 0xffff7fff
jne 0x452fb4
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x452f4d
call ebx
cmp eax, 3
jne 0x452f33
push ebp
call fcn.00453200
mov esi, eax
add esp, 4
test esi, esi
jne 0x452f27
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x452f4d
call ebx
push eax
call fcn.00452e00
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x452fa8
push 0
push 0x2000001
push 3
push 0
push 0
push 0
test esi, esi
je 0x452f6d
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x452f74
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov edi, eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
cmp edi, 0xffffffff
jne 0x452f97
call ebx
push eax
call fcn.00452e00
add esp, 4
or eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push edi
call dword [sym.imp.MSVCRT.dll__open_osfhandle]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
test esi, esi
jne 0x45304b
mov eax, dword [esp + 0x18]
push dword [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.MSVCRT.dll__open]
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x4530d9
call edi
cmp dword [eax], 0xd
jne 0x453021
test dword [esp + 0x18], 0x100
je 0x453021
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x452ffd
call ebx
push eax
call fcn.00452e00
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x453011
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0x15
or eax, 0xffffffff
pop ebx
ret
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0xd
or eax, 0xffffffff
pop ebx
ret
call edi
cmp dword [eax], 2
jne 0x4530d9
push ebp
call fcn.00453200
mov esi, eax
add esp, 4
test esi, esi
jne 0x45304b
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
ret
push dword [esp + 0x1c]
mov ebp, dword [esp + 0x1c]
push ebp
push esi
call dword [sym.imp.MSVCRT.dll__wopen]
add esp, 0xc
mov dword [esp + 0x18], eax
test eax, eax
jns 0x4530c6
call edi
cmp dword [eax], 0xd
jne 0x4530c6
test ebp, 0x100
je 0x4530c6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45309f
call ebx
push eax
call fcn.00452e00
add esp, 4
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x4530be
call edi
push esi
mov dword [eax], 0x15
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
call edi
mov dword [eax], 0xd
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret