joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4028d3
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x482c90
mov eax, dword [ecx + 0x9c4]
cmp eax, 0x270
jl 0x482d58
cmp eax, 0x271
jne 0x482cb2
push 0x1571
call fcn.00401eec
push ebx
push esi
push edi
lea edx, [ecx + 4]
mov esi, 0xe3
lea ecx, [ecx]
mov eax, dword [edx + 4]
xor eax, dword [edx]
add edx, 4
and eax, 0x7fffffff
xor eax, dword [edx - 4]
mov ebx, eax
shr eax, 1
and ebx, 1
xor eax, dword [ebx*4 + 0x61d968]
xor eax, dword [edx + 0x630]
dec esi
mov dword [edx - 4], eax
jne 0x482cc0
lea edx, [ecx + 0x390]
mov esi, 0x18c
mov eax, dword [edx + 4]
xor eax, dword [edx]
add edx, 4
and eax, 0x7fffffff
xor eax, dword [edx - 4]
mov ebx, eax
shr eax, 1
and ebx, 1
xor eax, dword [ebx*4 + 0x61d968]
xor eax, dword [edx - 0x390]
dec esi
mov dword [edx - 4], eax
jne 0x482cf5
mov eax, dword [ecx + 0x9c0]
xor eax, dword [ecx + 4]
pop edi
and eax, 0x7fffffff
xor eax, dword [ecx + 0x9c0]
mov edx, eax
and edx, 1
mov edx, dword [edx*4 + 0x61d968]
xor edx, dword [ecx + 0x634]
shr eax, 1
mov dword [ecx + 0x9c4], esi
xor edx, eax
pop esi
mov dword [ecx + 0x9c0], edx
pop ebx
mov eax, dword [ecx + 0x9c4]
mov edx, dword [ecx + eax*4 + 4]
inc eax
mov dword [ecx + 0x9c4], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov ecx, edx
and ecx, 0xff3a58ad
shl ecx, 7
xor edx, ecx
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret

Function at 0x403675
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x47ffa0
mov ecx, dword [ecx + 4]
jmp fcn.004028d3

Function at 0x4100b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp edx, edi
jae 0x4100db
push esi
nop
mov al, byte [edx]
xor al, byte [ecx]
shr dword [ecx], 8
movzx eax, al
mov eax, dword [eax*4 + 0x62cc20]
xor eax, dword [ecx]
inc edx
mov dword [ecx], eax
cmp edx, edi
jb 0x4100c0
pop esi
pop edi
pop ebp
ret 8

Function at 0x410920
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x62d0ec], 0
jne 0x410982
push ebx
xor bl, bl
push esi
mov byte [ebp - 4], bl
xor eax, eax
mov cl, 0x80
test bl, cl
je 0x410941
xor eax, 0x80000000
test eax, eax
jns 0x41094e
add eax, eax
xor eax, 0x4c11db7
jmp 0x410950
add eax, eax
shr cl, 1
jne 0x410938
push eax
call fcn.004012da
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call fcn.00401ca3
movzx ecx, al
add esp, 8
inc bl
mov dword [ecx*4 + 0x62cc20], esi
mov byte [ebp - 4], bl
jne 0x410934
pop esi
mov byte [0x62d0ec], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b700
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x598723
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x628d00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov edx, dword [esi]
mov dword [ebp - 0xa8], eax
mov eax, dword [edx + 0x74]
call eax
mov ecx, dword [esi + 0x34]
lea edx, [eax + edi]
cmp edx, ecx
jle 0x41b750
sub ecx, eax
mov edi, ecx
mov ecx, dword [ebp - 0xa8]
mov edx, dword [esi + 8]
push 0
lea eax, [ebp - 0xac]
push eax
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41b7e6
push 0x30
push str.d:workingcopyjss3pc_srcjss3steameschatosproject_snowfoxengineWin32_FilePartitionStream.h
call fcn.004040d9
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
lea edi, [ecx + esi + 4]
add esi, 0xc
push esi
lea edx, [ebp - 0x68]
push str.Failed_to_read_from_file_stream___
push edx
call fcn.004042a0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0xa8], esp
push 0x5bba88
push eax
push ecx
mov dword [ebp - 4], 0
call fcn.00403c01
add esp, 0xc
push edi
lea ecx, [ebp - 0xa4]
call fcn.00404a7a
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.0040314d
push 0x5f5bf8
lea edx, [ebp - 0x4c]
push edx
mov dword [ebp - 0x4c], vtable.snowfox::EReadError.0
call fcn.00531c74
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00531be5
mov esp, ebp
pop ebp
ret 8
Function at 0x4204f0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x599221
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x628d00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi + 4]
mov dword [esi], vtable.snowfox::CBufferedArchiveFileLoader.1.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 4], vtable.snowfox::CBufferedArchiveFileLoader.0
mov dword [ebp - 4], 0
lea edi, [esi + 0x64]
mov dword [ebp - 0x14], edi
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push ecx
lea edx, [ebp - 0x18]
push edx
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00402ed2
mov edi, dword [edi + 4]
push edi
call fcn.00530f9e
add esp, 4
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 2
call fcn.0040403e
cmp dword [esi + 0x44], 0x10
jb 0x42057d
mov eax, dword [esi + 0x30]
push eax
call fcn.00530f9e
add esp, 4
mov dword [esi + 0x44], 0xf
mov dword [esi + 0x40], 0
mov byte [esi + 0x30], 0
mov ecx, dword [esi + 0xc]
mov dword [esi + 8], vtable.snowfox::CCriticalSection.1.0
mov edx, dword [ecx + 4]
lea eax, [esi + 0x10]
push eax
mov dword [edx + esi + 0xc], vtable.snowfox::CCriticalSection.0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [esi + 0x2c]
mov edx, dword [ecx + 4]
mov dword [edx + esi + 0x2c], vtable.snowfox::CNonCopyable.0
mov dword [esi + 0x28], vtable.snowfox::CObject.0
mov dword [esi], vtable.snowfox::IInterface.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x421cc0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x628d00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040337d
mov eax, dword [ebp - 0x20]
mov ebx, 0x10
add esp, 8
cmp dword [ebp - 0xc], ebx
jae 0x421cf5
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x160]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x421d2d
cmp dword [ebp - 0xc], ebx
jb 0x421d1b
mov edx, dword [ebp - 0x20]
push edx
call fcn.00530f9e
add esp, 4
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00531be5
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [ebp - 0x160], bl
jne 0x421d75
lea eax, [ebp - 0x160]
push eax
push esi
call edi
test eax, eax
jne 0x421d34
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0xc], ebx
jb 0x421d62
mov edx, dword [ebp - 0x20]
push edx
call fcn.00530f9e
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00531be5
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0xc], ebx
jb 0x421d8d
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00530f9e
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00531be5
mov esp, ebp
pop ebp
ret

Function at 0x422400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5996f3
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x628d00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push 0
mov esi, ecx
lea ecx, [ebp - 0xa8]
push ecx
push edx
push eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4224c5
push 0x67
push str...SnowFoxEngineFileStream.cpp
call fcn.004040d9
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 4]
lea edi, [edx + esi + 4]
add esi, 0xc
push esi
lea eax, [ebp - 0x68]
push str.Failed_to_read_from_file_stream___
push eax
call fcn.004042a0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0xac], esp
push 0x5bba88
push eax
push ecx
mov dword [ebp - 4], 0
call fcn.00403c01
add esp, 0xc
push edi
lea ecx, [ebp - 0xa4]
call fcn.00404a7a
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.0040314d
push 0x5f5bf8
lea edx, [ebp - 0x4c]
push edx
mov dword [ebp - 0x4c], vtable.snowfox::EReadError.0
call fcn.00531c74
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00531be5
mov esp, ebp
pop ebp
ret 8
Function at 0x422530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x599743
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x628d00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push 0
mov esi, ecx
lea ecx, [ebp - 0xa8]
push ecx
push edx
push eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4225f5
push 0x72
push str...SnowFoxEngineFileStream.cpp
call fcn.004040d9
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 4]
lea edi, [edx + esi + 4]
add esi, 0xc
push esi
lea eax, [ebp - 0x68]
push str.Failed_to_write_to_file_stream___
push eax
call fcn.004042a0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0xac], esp
push 0x5bba88
push eax
push ecx
mov dword [ebp - 4], 0
call fcn.00403c01
add esp, 0xc
push edi
lea ecx, [ebp - 0xa4]
call fcn.00401fa5
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.0040314d
push 0x5f6878
lea edx, [ebp - 0x4c]
push edx
mov dword [ebp - 0x4c], vtable.snowfox::EWriteError.0
call fcn.00531c74
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00531be5
mov esp, ebp
pop ebp
ret 8

Function at 0x422660
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x599793
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x628d00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x74]
call edx
mov ecx, dword [ebp + 8]
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x70]
push ecx
mov ecx, esi
call edx
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edx, dword [esi]
mov ebx, eax
mov eax, dword [edx + 0x70]
push edi
mov ecx, esi
call eax
test ebx, ebx
jne 0x422733
push 0x7f
push str...SnowFoxEngineFileStream.cpp
call fcn.004040d9
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 4]
lea edi, [edx + esi + 4]
add esi, 0xc
push esi
lea eax, [ebp - 0x68]
push str.Failed_to_set_size_to_file_stream___
push eax
call fcn.004042a0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0xa8], esp
push 0x5bba88
push eax
push ecx
mov dword [ebp - 4], ebx
call fcn.00403c01
add esp, 0xc
push edi
lea ecx, [ebp - 0xa4]
call fcn.00401fa5
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.0040314d
push 0x5f6878
lea edx, [ebp - 0x4c]
push edx
mov dword [ebp - 0x4c], vtable.snowfox::EWriteError.0
call fcn.00531c74
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00531be5
mov esp, ebp
pop ebp
ret 4
Function at 0x42d2d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x628d00]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
call fcn.004031fc
call fcn.00403ea9
call fcn.00403a99
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x44]
push 0x5bd4f4
push ecx
call fcn.00535605
lea edx, [ebp - 0x44]
push 0
push edx
call fcn.00403dd7
add esp, 0x18
call fcn.00403dc8
push 0
push 0
push 0
push 0x4039a4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov word [0x65a168], cx
mov ecx, dword [ebp - 4]
mov dword [0x62d11c], eax
xor eax, eax
xor ecx, ebp
mov word [0x65a164], ax
call fcn.00531be5
mov esp, ebp
pop ebp
ret

Function at 0x446510
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x62d110]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x28], 0x40
mov dword [ebp - 0x24], 0x402b4e
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
mov eax, dword [eax + 0x78]
push eax
push edi
call dword [sym.imp.USER32.dll_LoadIconA]
push 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ecx, dword [0x62d110]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], esi
mov edx, dword [ecx + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], edx
call dword [sym.imp.USER32.dll_RegisterClassA]
cmp byte [0x6e170c], 0
je 0x4465a5
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
call esi
mov ecx, dword [0x6e1734]
push 7
lea ebx, [ecx + eax*2]
call esi
mov edi, eax
push 4
add edi, edi
call esi
lea esi, [edi + eax]
add esi, dword [0x6e1738]
mov edi, dword [ebp + 8]
jmp 0x4465b1
mov ebx, dword [0x6e1734]
mov esi, dword [0x6e1738]
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_RegisterClassA]
mov eax, dword [0x62d110]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
push 0
push edi
push 0
push 0
push esi
push ebx
push SysReAllocString
push SysReAllocString
push 0xca0000
push ecx
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458da0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x69d478]
mov byte [eax], cl
mov eax, dword [0x69d46c]
inc dword [0x69d478]
inc eax
mov dword [0x69d46c], eax
cmp eax, 0x34bc0
jl 0x458dea
mov edx, dword [0x69d460]
mov eax, dword [0x69e748]
push edx
push 1
push 0x34bc0
push eax
mov dword [0x69d46c], 0
mov dword [0x69d478], eax
call fcn.00535ef2
add esp, 0x10
ret

Function at 0x459260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x628d00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x69d468]
test eax, eax
je 0x4593ae
cmp eax, 2
jne 0x459394
mov cl, byte [0x69d480]
push esi
push edi
call fcn.00458da0
mov cl, byte [0x69d474]
call fcn.00458da0
mov eax, dword [0x69d478]
mov byte [eax], 0xff
mov ecx, dword [0x69d460]
mov eax, dword [0x69d46c]
mov edx, dword [0x69e748]
inc dword [0x69d478]
push ecx
inc eax
push 1
push eax
push edx
mov dword [0x69d46c], eax
call fcn.00535ef2
mov eax, dword [0x69d460]
push eax
call fcn.00532d18
add esp, 0x14
push 0x400
lea ecx, [ebp - 0x404]
push ecx
mov ecx, 0x6e1700
call fcn.004041b0
lea edi, [ebp - 0x404]
dec edi
jmp 0x459300
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x459300
mov dx, word [0x5bbf38]
mov eax, dword [0x62d110]
mov word [edi], dx
mov eax, dword [eax + 0x4e2c]
mov edx, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x459320
lea edi, [ebp - 0x404]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x459330
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 0x10
mov ecx, eax
and ecx, 3
push 0x61d768
rep movsb byte es:[edi], byte [esi]
push 0x69d020
lea ecx, [ebp - 0x404]
push ecx
mov ecx, 0x69e74c
call fcn.00402a59
lea edx, [ebp - 0x404]
push edx
call fcn.00535f9c
mov eax, dword [0x69e748]
add esp, 4
pop edi
pop esi
test eax, eax
je 0x4593a4
push eax
call fcn.00531d4e
add esp, 4
mov dword [0x69e748], 0
jmp 0x4593a4
mov eax, dword [0x69e748]
push eax
mov ecx, 0x69e74c
call fcn.004015d2
mov dword [0x69d468], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00531be5
mov esp, ebp
pop ebp
ret
Function at 0x45a630
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59aedb
mov eax, dword fs:[0]
push eax
sub esp, 0xc1c
mov eax, dword [0x628d00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0xc28]
call fcn.0040321a
xor ebx, ebx
mov dword [ebp - 0xc20], ebx
mov dword [ebp - 0xc1c], ebx
mov dword [ebp - 0xc18], ebx
push 0x400
lea eax, [ebp - 0x410]
push eax
mov ecx, 0x6e1700
mov dword [ebp - 4], ebx
call fcn.004041b0
lea edi, [ebp - 0x410]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x45a6a0
mov cx, word [0x5bbf38]
mov edx, dword [0x62d110]
mov word [edi], cx
mov eax, dword [edx + 0x4e24]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45a6c0
lea edi, [ebp - 0x410]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x45a6d0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x400
lea eax, [ebp - 0x810]
rep movsb byte es:[edi], byte [esi]
push eax
mov ecx, 0x6e1700
call fcn.004041b0
lea edi, [ebp - 0x810]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x45a705
mov cx, word [0x5bbf38]
mov edx, dword [0x62d110]
mov word [edi], cx
mov eax, dword [edx + 0x4e2c]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45a725
lea edi, [ebp - 0x810]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x45a735
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0xc10]
push edx
call fcn.00535605
add esp, 0xc
push ebx
lea eax, [ebp - 0xc10]
push eax
lea ecx, [ebp - 0x810]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x45a796
push eax
call fcn.00530f9e
add esp, 4
lea ecx, [ebp - 0xc28]
mov dword [ebp - 0xc20], ebx
mov dword [ebp - 0xc1c], ebx
mov dword [ebp - 0xc18], ebx
call fcn.00402c39
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00531be5
mov esp, ebp
pop ebp
ret
Function at 0x45b470
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x628d00]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x400
lea eax, [ebp - 0x404]
push eax
push str.AppData
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edi, [ebp - 0x404]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x45b4a2
mov cx, word [0x5bbf38]
lea eax, [ebp - 0x404]
mov word [edi], cx
dec eax
jmp 0x45b4c0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x45b4c0
mov edx, dword [str.Qute]
mov cl, byte [0x5c437c]
mov dword [eax], edx
lea edx, [ebp - 0x404]
push edx
mov byte [eax + 4], cl
call fcn.00535fa7
lea edi, [ebp - 0x404]
add esp, 4
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x45b4f0
mov ax, word [0x5bbf38]
mov word [edi], ax
lea eax, [ebp - 0x404]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x45b508
mov ecx, dword [str.Eschatos]
mov edx, dword [0x5c4370]
mov dword [eax], ecx
mov cl, byte [0x5c4374]
mov dword [eax + 4], edx
lea edx, [ebp - 0x404]
push edx
mov byte [eax + 8], cl
call fcn.00535fa7
lea edi, [ebp - 0x404]
add esp, 4
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x45b540
mov ax, word [0x5bbf38]
mov word [edi], ax
lea eax, [ebp - 0x404]
dec eax
pop edi
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x45b560
mov ecx, dword [str.replay]
mov dx, word [0x5c4368]
mov dword [eax], ecx
mov cl, byte [0x5c436a]
mov word [eax + 4], dx
lea edx, [ebp - 0x404]
push edx
mov byte [eax + 6], cl
call fcn.00535fa7
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 4
call fcn.00531be5
mov esp, ebp
pop ebp
ret
Function at 0x4643e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x628d00]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x6dc260]
xor eax, eax
push esi
mov esi, 1
mov word [0x6a078c], ax
mov dword [0x6dc368], 0x6c0798
mov dword [0x6da15c], ecx
mov dword [0x6da154], eax
lea esp, [esp]
push ecx
call fcn.0040326f
add esp, 4
test eax, eax
jne 0x46442f
xor esi, esi
mov ecx, dword [0x6da15c]
mov eax, dword [0x6dc260]
mov edx, ecx
sub edx, eax
cmp edx, dword [0x6dc264]
jl 0x464420
movsx edx, word [0x6a078c]
xor ecx, ecx
mov word [0x6da150], cx
mov ecx, dword [0x6dc368]
lea edx, [ecx + edx*4]
mov dword [0x6da15c], eax
mov dword [0x6da154], 0
mov dword [0x6dc368], edx
cmp esi, 1
jne 0x4645af
push edi
push eax
call fcn.00401d84
mov edi, eax
add esp, 4
cmp edi, esi
jne 0x464586
mov eax, dword [0x6da15c]
sub eax, dword [0x6dc260]
cmp eax, dword [0x6dc264]
jl 0x464586
cmp byte [0x6dc370], 0
je 0x464586
mov ecx, dword [0x62d110]
mov edx, dword [ecx + 0x4e60]
push 0x6dc370
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.00535605
mov ecx, dword [0x62d110]
mov eax, dword [ecx + 0x7d24]
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.00533a88
mov esi, eax
add esp, 0x14
test esi, esi
je 0x464516
mov eax, dword [0x6dc368]
push esi
push 1
sub eax, 0x6c0798
push eax
push 0x6c0798
call fcn.00535ef2
push esi
call fcn.00532d18
add esp, 0x14
mov ecx, dword [0x62d110]
mov edx, dword [ecx + 0x4e64]
push 0x6dc370
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.00535605
mov ecx, dword [0x62d110]
mov eax, dword [ecx + 0x7d24]
push eax
lea edx, [ebp - 0x104]
push edx
call fcn.00533a88
mov esi, eax
add esp, 0x14
test esi, esi
je 0x464586
push esi
push 1
push 2
push 0x6a078c
call fcn.00535ef2
movsx eax, word [0x6a078c]
push esi
push 1
shl eax, 5
push eax
push 0x6a0798
call fcn.00535ef2
push esi
call fcn.00532d18
add esp, 0x24
mov eax, dword [0x6dc260]
test eax, eax
je 0x464598
push eax
call fcn.005325ba
add esp, 4
call fcn.004028ba
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00531be5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00531be5
mov esp, ebp
pop ebp
ret

Function at 0x475b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b0a8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x628d00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
call fcn.0040321a
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push eax
push ecx
xor esi, esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.00403be3
mov ebx, dword [ebp + 0xc]
cmp ebx, esi
jle 0x475b60
mov edi, dword [ebp + 8]
nop
lea ecx, [ebp - 0x14]
call fcn.00403675
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x475b50
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.00402c39
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x475bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b0d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x628d00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
call fcn.0040321a
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push eax
push ecx
xor esi, esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.00403be3
mov ebx, dword [ebp + 0xc]
cmp ebx, esi
jle 0x475c10
mov edi, dword [ebp + 8]
nop
lea ecx, [ebp - 0x14]
call fcn.00403675
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x475c00
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.00402c39
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10