joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447401
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
cmp dword [ebx + 0x60], eax
jne 0x447421
mov ecx, dword [ebx + 0x4080]
add ecx, dword [ebx + 0x7c]
je 0x447424
xor eax, eax
inc eax
mov esi, ebx
mov dword [ebx + 0x8534], eax
call fcn.0043a926
test eax, eax
je 0x44743d
or eax, 0xffffffff
jmp 0x44759b
mov esi, dword [ebx + 0x8598]
push edi
mov edi, dword [ebx + 0x74]
call fcn.0043b062
mov eax, dword [ebx + 0x85c0]
xor esi, esi
cmp eax, esi
jbe 0x447598
shl eax, 2
push eax
call fcn.0050513d
pop ecx
mov dword [ebx + 0x87ec], eax
cmp eax, esi
je 0x44759f
mov ecx, dword [ebx + 0x85c0]
shl ecx, 2
push ecx
push esi
push eax
call fcn.00507370
add esp, 0xc
mov dword [ebp + 8], esi
cmp dword [ebx + 0x85c0], esi
jbe 0x447598
mov eax, dword [ebx + 0x85e4]
imul eax, dword [ebx + 0x64]
imul eax, dword [ebx + 0x85e0]
cmp eax, 0x4000000
jb 0x447558
lea eax, [ebp - 0x410]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor esi, esi
cmp eax, esi
je 0x44759f
cmp eax, edi
jae 0x44759f
lea eax, [ebp - 0x208]
push eax
push esi
push 0x5c0aac
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x44759f
lea edx, [ebp - 0x208]
lea eax, [ebp - 0x207]
cmp word [ebp + esi*2 - 0x208], 0
je 0x44752b
mov cl, byte [eax - 1]
test cl, cl
je 0x44751b
mov byte [edx], cl
inc edx
mov cl, byte [eax]
test cl, cl
je 0x447524
mov byte [edx], cl
inc edx
inc esi
inc eax
inc eax
cmp esi, edi
jb 0x447506
mov byte [ebp + esi - 0x208], 0
mov esi, dword [ebp + 8]
push 0x5c0ab4
lea eax, [ebp - 0x208]
push eax
mov eax, dword [ebx + 0x87ec]
shl esi, 2
add eax, esi
push eax
call fcn.0043a470
add esp, 0xc
jmp 0x44756b
mov esi, dword [ebp + 8]
mov eax, dword [ebx + 0x87ec]
shl esi, 2
add eax, esi
call fcn.0043a68e
test eax, eax
jne 0x44759f
mov eax, dword [ebx + 0x87ec]
mov ecx, dword [ebx + 0x85bc]
mov edi, dword [eax + esi]
mov esi, dword [ecx + esi]
call fcn.0043b062
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebx + 0x85c0]
jb 0x447497
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
or eax, 0xffffffff
jmp 0x44759a
Function at 0x455b50
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, ecx
push 0x40
lea esi, [edi + 0x255]
push 0x5c06a4
push esi
call fcn.00504e78
add esp, 0xc
test eax, eax
je 0x455b7c
push eax
call fcn.0050537f
add esp, 4
pop edi
mov al, 1
pop esi
ret
cmp byte [edi + 0x364], 0
je 0x455b8a
pop edi
xor al, al
pop esi
ret
push 0x40
push 0x575158
push esi
call fcn.00504e78
mov esi, eax
add esp, 0xc
test esi, esi
je 0x455b85
push esi
push 1
push 4
push str.EPKD
call fcn.005099d3
push esi
push 1
push 4
push 0x575140
call fcn.005099d3
push esi
push 1
push 4
add edi, 0x150
push edi
call fcn.005099d3
push esi
call fcn.0050537f
add esp, 0x34
pop edi
mov al, 1
pop esi
ret
Function at 0x455e50
Capabilities:
Delete file
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x55ad36
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x5f168c]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f168c]
xor eax, esp
push eax
lea eax, [esp + 0x178]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [esp + 0x30]
call fcn.0045cd60
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea edi, [ebx + 0x255]
push edi
lea ecx, [esp + 0x40]
mov dword [esp + 0x190], 0
call fcn.0045d140
test eax, eax
jne 0x455eed
add ebx, 0x155
push ebx
push str.EncryptIndex:_Cannot_open_pack_index_file___s
call fcn.0045e490
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0x180], 0xffffffff
call fcn.0045d0c0
xor al, al
jmp 0x456049
lea ecx, [esp + 0x30]
call fcn.0045cfe0
push eax
call fcn.00503d0c
add esp, 4
lea ecx, [esp + 0x30]
mov esi, eax
call fcn.0045cfe0
mov ecx, dword [esp + 0x18]
push eax
push ecx
push esi
call fcn.00506e30
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.0045d2c0
mov ebp, dword [0x5f9160]
push 0x5e7004
lea ecx, [esp + 0x34]
mov byte [esp + 0x184], 1
call fcn.0045cfe0
push eax
push esi
lea edx, [esp + 0x28]
push edx
mov ecx, ebp
call fcn.0045d9c0
test al, al
jne 0x455f87
add ebx, 0x155
push ebx
push str.EncryptIndex:_Cannot_encrypt___s
call fcn.0045e490
add esp, 8
test esi, esi
je 0x455f71
push esi
call fcn.00504754
add esp, 4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x180], 0
call fcn.0045dd80
jmp 0x455ed2
lea ecx, [esp + 0x30]
call fcn.0045d020
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call ebp
test eax, eax
je 0x455f96
push 0x575158
push edi
call fcn.00504f3c
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x455fbf
add ebx, 0x155
push ebx
push str.EncryptIndex:_Cannot_open_file_for_writing___s
jmp 0x455f5c
mov eax, dword [esp + 0x1c]
push ebp
push 1
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], eax
call fcn.0045d1c0
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call fcn.005099d3
add esp, 0x10
cmp eax, 1
je 0x45600c
push edi
push str.Encryptindex:_Cannot_write_to_file___s
call fcn.0045e490
add esp, 8
test esi, esi
je 0x456001
push esi
call fcn.00504754
add esp, 4
push ebp
call fcn.0050537f
jmp 0x455f6e
push ebp
call fcn.0050537f
push esi
mov byte [ebx + 0x154], 1
call fcn.00504754
add esp, 8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x180], 0
call fcn.0045dd80
lea ecx, [esp + 0x30]
mov dword [esp + 0x180], 0xffffffff
call fcn.0045d0c0
mov al, 1
mov ecx, dword [esp + 0x178]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x160]
xor ecx, esp
call fcn.0050a9d0
add esp, 0x170
ret

Function at 0x4560f0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
call fcn.00455e40
test al, al
je 0x456143
cmp dword [esi], 0
jne 0x456121
cmp dword [esi + 0x20], 0x10
jb 0x45610c
mov eax, dword [esi + 0xc]
jmp 0x45610f
lea eax, [esi + 0xc]
push 0x40
push 0x5753f0
push eax
call fcn.00504e78
add esp, 0xc
mov dword [esi], eax
mov eax, dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
push eax
push 1
push ecx
push esi
call fcn.005099d3
push esi
push 0x5753ec
call fcn.0050ad17
add esp, 0x18
pop esi
ret 8
Function at 0x45a2e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0x10
jb 0x45a2ef
mov edx, dword [eax + 4]
jmp 0x45a2f2
lea edx, [eax + 4]
push esi
mov esi, dword [eax + 0x14]
add esi, edx
xor eax, eax
cmp edx, esi
jae 0x45a311
push edi
nop
movzx edi, byte [edx]
imul eax, eax, 0x1000193
inc edx
xor eax, edi
cmp edx, esi
jb 0x45a300
pop edi
xor edx, edx
div dword [ecx + 4]
pop esi
mov eax, edx
ret 4
Function at 0x45aee0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [ebx + 4]
add ecx, 4
cmp dword [ecx + 0x18], 0x10
push edi
jb 0x45aefa
mov eax, dword [ecx + 4]
jmp 0x45aefd
lea eax, [ecx + 4]
mov ecx, dword [ecx + 0x14]
add ecx, eax
xor edi, edi
cmp eax, ecx
jae 0x45af20
jmp 0x45af10
movzx edx, byte [eax]
imul edi, edi, 0x1000193
inc eax
xor edi, edx
cmp eax, ecx
jb 0x45af10
cmp dword [esi], 0
je 0x45af33
mov eax, dword [esp + 0x18]
push eax
mov ecx, esi
call fcn.0045ae90
jmp 0x45af63
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.00456580
cmp dword [esi + 4], eax
lea ecx, [esi + 4]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
jb 0x45af51
mov eax, ecx
mov edx, dword [eax]
mov dword [ecx], edx
mov ecx, esi
call fcn.004562c0
mov ecx, esi
call fcn.004560a0
mov eax, edi
xor edx, edx
div dword [esi + 4]
mov eax, dword [esi]
pop edi
lea ecx, [eax + edx*4]
mov edx, dword [ebx + 4]
mov dword [ebx + 4], 0
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [esp + 0xc]
mov dword [ecx], edx
inc dword [esi + 0x10]
mov dword [esi + 0x18], ecx
pop esi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret 0xc

Function at 0x45afa0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0xffffffffffffffff
push 0x55b458
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f168c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x34]
cmp dword [ebx + 0x18], 0x10
jb 0x45afd8
mov eax, dword [ebx + 4]
jmp 0x45afdb
lea eax, [ebx + 4]
mov ecx, dword [ebx + 0x14]
add ecx, eax
xor ebp, ebp
cmp eax, ecx
jae 0x45aff6
movzx edx, byte [eax]
imul ebp, ebp, 0x1000193
inc eax
xor ebp, edx
cmp eax, ecx
jb 0x45afe6
xor edx, edx
mov eax, ebp
div dword [esi + 4]
mov eax, dword [esi]
push ebx
mov ecx, esi
lea edi, [eax + edx*4]
push edi
call fcn.0045a450
mov ecx, eax
xor eax, eax
cmp ecx, eax
je 0x45b020
mov eax, dword [esp + 0x30]
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
jmp 0x45b093
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], eax
call fcn.0045a5f0
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x18]
push ecx
lea edx, [ebx + 4]
push edx
push 0
call fcn.0045a660
mov eax, dword [esi + 0x10]
add esp, 0xc
inc eax
push eax
mov ecx, esi
mov byte [esp + 0x21], 1
call fcn.0045ae90
test al, al
je 0x45b077
mov eax, ebp
xor edx, edx
div dword [esi + 4]
mov ecx, dword [esi]
lea edi, [ecx + edx*4]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], ebx
inc dword [esi + 0x10]
cmp edi, dword [esi + 0x18]
jae 0x45b088
mov dword [esi + 0x18], edi
mov eax, dword [esp + 0x30]
mov dword [eax + 4], ebx
mov byte [eax + 8], 1
mov dword [eax], edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x45b7d0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x55b5f0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5f168c]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f168c]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov eax, dword [esp + 0x74]
mov edi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x80]
mov esi, ecx
mov ecx, dword [esp + 0x78]
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
call fcn.00403a81
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x70], ebx
call fcn.0045e770
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.0045b7a0
add esp, 0xc
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x6c], 1
jae 0x45b86e
lea eax, [esp + 0x2c]
mov edx, dword [esp + 0x3c]
add edx, eax
xor ecx, ecx
cmp eax, edx
jae 0x45b892
lea ebx, [ebx]
movzx ebx, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebx
cmp eax, edx
jb 0x45b880
xor ebx, ebx
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.0045a380
mov esi, dword [eax + 4]
mov edx, dword [eax]
mov dword [esp + 0x18], edx
cmp esi, ebx
jne 0x45b8f6
mov esi, 0x10
cmp dword [esp + 0x40], esi
jb 0x45b8cc
mov eax, dword [esp + 0x2c]
push eax
call fcn.0050475f
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp dword [esp + 0x5c], esi
jb 0x45b8ef
mov ecx, dword [esp + 0x48]
push ecx
call fcn.0050475f
add esp, 4
xor al, al
jmp 0x45b9b7
cmp dword [esp + 0x5c], 0x10
mov eax, dword [esp + 0x48]
jae 0x45b905
lea eax, [esp + 0x48]
mov edx, dword [esp + 0x58]
push edx
push eax
call fcn.0045e5a0
mov ecx, eax
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [esi + 8]
mov dword [edi], edx
mov eax, dword [esi + 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi + 0x10]
mov dword [edi + 8], edx
mov eax, dword [esi + 0x14]
mov dword [edi + 0xc], eax
mov edx, dword [esi + 0x18]
mov dword [ebp], edx
mov eax, dword [esi + 0x1c]
mov dword [ebp + 4], eax
mov edx, dword [esi + 0x20]
mov dword [ebp + 8], edx
mov eax, dword [esi + 0x24]
add esp, 8
mov dword [ebp + 0xc], eax
xor eax, eax
lea esp, [esp]
xor dword [edi + eax*4], ecx
inc eax
cmp eax, 4
jb 0x45b960
xor eax, eax
jmp 0x45b970
xor dword [ebp + eax*4], ecx
inc eax
cmp eax, 4
jb 0x45b970
mov esi, 0x10
cmp dword [esp + 0x40], esi
jb 0x45b992
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0050475f
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp dword [esp + 0x5c], esi
jb 0x45b9b5
mov edx, dword [esp + 0x48]
push edx
call fcn.0050475f
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.0050a9d0
add esp, 0x5c
ret 0x10
Function at 0x45b9e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0xffffffffffffffff
push 0x55b628
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5f168c]
xor eax, esp
mov dword [esp + 0x30], eax
push ebp
push esi
push edi
mov eax, dword [0x5f168c]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
mov esi, ecx
mov ecx, dword [esp + 0x5c]
push 0xffffffffffffffff
push 0
mov dword [esp + 0x20], ecx
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
call fcn.00403a81
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x50], 0
call fcn.0045e770
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x2c]
add esp, 4
cmp edi, 0x10
jae 0x45ba70
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x38]
lea edx, [ecx + eax]
xor ecx, ecx
cmp eax, edx
jae 0x45ba94
lea ecx, [ecx]
movzx ebp, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebp
cmp eax, edx
jb 0x45ba80
mov ebp, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
mov dword [esp + 0x14], ecx
push eax
lea ecx, [esi + 0x20]
call fcn.0045a380
mov esi, dword [eax + 4]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
test esi, esi
je 0x45bace
mov eax, dword [esi + 0x34]
sub eax, dword [esi + 0x30]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
test eax, eax
jg 0x45bae4
mov dword [ebp], 0
cmp edi, 0x10
jb 0x45bae0
mov edx, dword [esp + 0x28]
push edx
call fcn.0050475f
add esp, 4
xor al, al
jmp 0x45bb0f
mov eax, dword [esi + 0x34]
sub eax, dword [esi + 0x30]
jne 0x45baf5
call fcn.00504cec
mov edi, dword [esp + 0x3c]
mov ecx, dword [esi + 0x30]
mov dword [ebp], ecx
cmp edi, 0x10
jb 0x45bb0d
mov edx, dword [esp + 0x28]
push edx
call fcn.0050475f
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0050a9d0
add esp, 0x40
ret 0xc
Function at 0x45cec0
Capabilities:
Get system information on windows
Print debug messages
Read file via mapping

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x24
push esi
mov esi, ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x130], ecx
test eax, eax
jne 0x45cede
mov eax, dword [esi + 0x114]
mov edx, eax
add edx, ecx
mov dword [esi + 0x134], eax
cmp edx, dword [esi + 0x114]
jbe 0x45cef9
xor eax, eax
pop esi
add esp, 0x24
ret 0xc
push ebx
push ebp
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esi + 0x130]
mov edi, dword [esp + 0x2c]
mov eax, ecx
xor edx, edx
div edi
push 0
imul eax, edi
mov ebx, eax
mov eax, dword [esi + 0x134]
mov edi, ecx
add ecx, eax
push ecx
mov ecx, dword [esi + 0x110]
push 0
push 2
push 0
push ecx
lea ebp, [eax + edx]
sub edi, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 0x12c], eax
test eax, eax
jne 0x45cf62
push str.CMappedFile::Map__m_hFM_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x24
ret 0xc
push ebp
push ebx
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x138], eax
test eax, eax
jne 0x45cf99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CMappedFile::Map__m_lpMapData__lu
call fcn.0045e490
add esp, 8
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x24
ret 0xc
mov edx, dword [esp + 0x38]
add eax, edi
mov dword [esi + 0x13c], eax
mov dword [edx], eax
mov eax, dword [esi + 0x13c]
mov ecx, dword [esi + 0x134]
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x128], 0
call fcn.0045cdc0
mov eax, dword [esi + 0x134]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x24
ret 0xc

Function at 0x45e290
Capabilities:
Get file size

Disassembly:
push ebp
push esi
push edi
mov esi, ecx
call fcn.0045e270
mov ebp, dword [esp + 0x10]
push 0x104
lea eax, [esi + 8]
push ebp
push eax
call fcn.005073f0
mov edi, dword [esp + 0x20]
add esp, 0xc
mov eax, 1
cmp edi, 2
jne 0x45e2c8
mov ecx, 0xc0000000
lea eax, [edi + 1]
jmp 0x45e2cd
mov ecx, SysReAllocString
xor edx, edx
cmp edi, 1
setne dl
push 0
push 0x80
add edx, 3
push edx
push 0
push eax
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x110], eax
cmp eax, 0xffffffff
je 0x45e313
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 4], edi
pop edi
mov dword [esi + 0x114], eax
pop esi
mov eax, 1
pop ebp
ret 8
pop edi
mov dword [esi + 0x110], 0
pop esi
xor eax, eax
pop ebp
ret 8
Function at 0x45e5a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, 0xffffffff
push esi
cmp edx, 0x10
jb 0x45e723
movsx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
movsx esi, byte [ecx + 1]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
movsx esi, byte [ecx + 2]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
movsx esi, byte [ecx + 3]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
movsx esi, byte [ecx + 4]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
movsx esi, byte [ecx + 5]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
movsx esi, byte [ecx + 6]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
movsx esi, byte [ecx + 7]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
movsx esi, byte [ecx + 8]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
movsx esi, byte [ecx + 9]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
movsx esi, byte [ecx + 0xa]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
movsx esi, byte [ecx + 0xb]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
movsx esi, byte [ecx + 0xc]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
movsx esi, byte [ecx + 0xd]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
movsx esi, byte [ecx + 0xe]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
movsx esi, byte [ecx + 0xf]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
add ecx, 0x10
sub edx, 0x10
cmp edx, 0x10
jae 0x45e5b5
test edx, edx
je 0x45e74b
jmp 0x45e730
movsx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5e9438]
inc ecx
sub edx, 1
jne 0x45e730
not eax
pop esi
ret

Function at 0x45e8c0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor eax, eax
mov esi, 0x20
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
add ebx, edx
mov ebp, eax
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebp, eax
xor ebx, ebp
add ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
sub eax, 0x61c88647
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
dec esi
add edx, ebx
test esi, esi
ja 0x45e8d7
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret
Function at 0x45e930
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, 0xc6ef3720
mov esi, 0x20
lea ebx, [ebx]
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebp, eax
add ebx, edx
xor ebx, ebp
sub ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
add eax, 0x61c88647
mov ebp, eax
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
dec esi
sub edx, ebx
test esi, esi
ja 0x45e950
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
ret

Function at 0x461ba0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x55bb8c
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x5f168c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [0x5e9844]
lea ecx, [esi + 4]
mov dword [ecx], eax
mov edx, dword [0x5e9844]
lea edi, [esi + 8]
mov dword [esp + 0x1c], 0
mov dword [edi], edx
mov eax, dword [0x5e9844]
lea ebp, [esi + 0xc]
mov dword [ebp], eax
mov edx, dword [0x5e9844]
mov dword [esi + 0x20], edx
mov edx, dword [esp + 0x28]
or eax, 0xffffffff
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x24]
push edx
mov byte [esp + 0x20], 3
mov dword [esi], eax
call fcn.0045f4a0
mov eax, dword [esp + 0x2c]
push eax
mov ecx, edi
call fcn.0045f4a0
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, ebp
call fcn.0045f4a0
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], edx
mov byte [esi + 0x18], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 0x18