joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586066
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5ea00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x4321ec
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x4321ec
call fcn.00431560
mov esi, eax
jmp 0x4322dc
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x43220f
call fcn.00431560
jmp 0x4322cf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x43222d
call fcn.00431560
jmp 0x4322cf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x43224e
mov esi, 0x8007000e
jmp 0x4322d1
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00433ed0
jmp 0x432278
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x43228f
mov esi, 0x8007000e
jmp 0x4322d1
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x4322af
call fcn.00431560
jmp 0x4322cf
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00432fa0
mov esi, eax
test edi, edi
je 0x4322dc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x432300
lea ecx, [ebp - 0x418]
call fcn.00434050
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00436912
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4344c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ecx
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
mov ecx, dword [esi + 8]
call fcn.004343b0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
test eax, eax
je 0x4344e7
mov ecx, dword [esi + 8]
mov dword [ecx + 0xc], eax
mov edi, dword [esi + 8]
lea eax, [ebp + 0xc]
push eax
push 0
push edi
push 0x434330
push 0
push 0
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x10], eax
test eax, eax
je 0x43452b
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x43452b
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], 0
mov eax, dword [esi + 8]
pop edi
pop esi
mov al, byte [eax + 4]
pop ebp
ret 0xc
Function at 0x434640
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5861c8
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x5ea00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x638], edi
lea eax, [edi + 8]
mov dword [edi], 0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x63c], edi
jb 0x43469a
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], ecx
mov dword [edi + 0x34], 7
mov dword [edi + 0x30], ecx
cmp dword [edi + 0x34], 8
jb 0x4346b7
mov eax, dword [edi + 0x20]
jmp 0x4346ba
lea eax, [edi + 0x20]
xor ecx, ecx
mov word [eax], cx
lea eax, [edi + 0x38]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x4346d4
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [edi + 0x50]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x4346ee
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 3
push ecx
mov dword [edi + 0x68], ecx
mov dword [edi + 0x6c], ecx
call fcn.00462b87
push eax
call fcn.0046ee99
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.0045eed0
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x4347a7
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x634]
push eax
call fcn.0045eed0
add esp, 0xc
lea eax, [ebp - 0x634]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x434798
test eax, eax
je 0x434798
add eax, eax
cmp eax, 0x412
jae 0x434793
xor ecx, ecx
mov word [ebp + eax - 0x634], cx
lea eax, [ebp - 0x634]
jmp 0x43479e
call fcn.00436f5c
lea eax, [ebp - 0x220]
push eax
lea ecx, [edi + 0x20]
call fcn.0041fda0
mov eax, dword [edi + 0x30]
test eax, eax
je 0x4347d3
cmp dword [edi + 0x34], 8
jb 0x4347b9
mov ecx, dword [edi + 0x20]
jmp 0x4347bc
lea ecx, [edi + 0x20]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x4347d3
push 1
push 0x5e00e0
lea ecx, [edi + 0x20]
call fcn.004231d0
cmp dword [edi + 0x30], 0
jne 0x4347e8
push 3
push 0x5e1e3c
lea ecx, [edi + 0x20]
call fcn.0041fdf0
mov dword [edi + 4], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00436912
mov esp, ebp
pop ebp
ret
Function at 0x434810
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x48], 0
je 0x43482c
cmp dword [edi + 0x4c], 8
lea eax, [edi + 0x38]
jb 0x434825
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x68]
test eax, eax
je 0x434843
push eax
call fcn.00436bef
add esp, 4
mov dword [edi + 0x68], 0
mov eax, dword [edi + 0x64]
lea esi, [edi + 0x50]
cmp eax, 8
jb 0x434859
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00420100
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x43486f
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x38]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x43488a
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00420100
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4348a0
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x20]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x4348bb
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00420100
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4348d1
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov eax, dword [edi + 0x1c]
cmp eax, 8
jb 0x4348eb
inc eax
lea ecx, [edi + 8]
push eax
push dword [edi + 8]
call fcn.00420100
mov dword [edi + 0x1c], 7
cmp dword [edi + 0x1c], 8
mov dword [edi + 0x18], 0
jb 0x43490a
mov eax, dword [edi + 8]
xor ecx, ecx
pop edi
pop esi
mov word [eax], cx
ret
xor eax, eax
mov word [edi + 8], ax
pop edi
pop esi
ret
Function at 0x43a3b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x5f9a80], ecx
inc eax
cmp eax, 0x100
jb 0x43a3b2
cmp eax, 0x800
jae 0x43a483
nop
mov edx, dword [eax*4 + 0x5f9680]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x5f9a80]
mov dword [eax*4 + 0x5f9a80], edx
inc eax
cmp eax, 0x800
jb 0x43a460
mov dword [0x5f5904], 0x43b220
call fcn.0043b050
mov ecx, dword [0x5f5904]
test eax, eax
mov edx, 0x43b2c0
cmove ecx, edx
mov dword [0x5f5904], ecx
ret
Function at 0x43b5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x43b5c0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x43b5f2
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x43b5ef
inc esi
cmp esi, edx
jb 0x43b5e0
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x43b71c
cmp ecx, 3
jbe 0x43b632
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x43b670
cmp cl, 0xff
je 0x43b670
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x43b5d4
dec ecx
shl eax, cl
and eax, 7
je 0x43b60a
movzx ecx, byte [eax + 0x5896ec]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x5896e4], 0
mov cl, byte [edx + 4]
je 0x43b65a
test cl, cl
je 0x43b65a
cmp cl, 0xff
jne 0x43b60a
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x43b5d4
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x43b69e
lea edx, [edi + ebx]
add edx, esi
jmp 0x43b6a4
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x43b6e2
movzx edi, byte [eax + 0x5896ec]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x43b6ce
cmp cl, 0xff
jne 0x43b6e2
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x43b691
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x43b5d4
pop edi
pop esi
cmp ecx, 3
jbe 0x43b731
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d660
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586443
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ea00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x5f5908
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x5f5908
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x5dfdb1
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0043f2f0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44415a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
xor esi, esi
inc esi
push esi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, 0xffffffff
jne 0x44418d
xor eax, eax
jmp 0x4441fb
call fcn.00445bf9
test al, al
je 0x4441a9
push esi
push edi
push ebx
pop eax
push edi
pop ebp
push esp
push eax
pop ecx
pop edi
push ecx
pop edx
push esp
pop ebx
push esp
pop edx
mov ebx, dword [ebp - 8]
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push 0
push eax
push edi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00445c83
test al, al
je 0x4441ec
push esp
push esp
push ebp
push edi
push ecx
pop ebx
pop esi
pop esp
push eax
pop ebp
pop ebp
pop ecx
push ebp
push eax
pop edi
pop eax
pop ebp
push esp
mov edi, dword [ebp + 0x10]
xor esi, esi
inc esi
cmp dword [ebp - 8], 0
je 0x4441f7
cmp edi, dword [ebp - 4]
je 0x4441f9
xor esi, esi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x445fab
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5ea00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0045eed0
push 0x5e0140
lea eax, [ebp - 0x20c]
push str.C:log_s.log
push eax
call fcn.004257b0
add esp, 0x18
call fcn.0044598c
test al, al
je 0x446010
push ebx
pop edx
push ebp
push ecx
push esp
push esp
pop esi
pop ebx
pop edx
pop edx
pop ebx
push esi
push eax
push esp
push esp
pop eax
pop ebx
pop eax
pop esi
pop eax
pop ebp
pop edi
push ebx
push edi
pop ebx
pop edx
call fcn.00445b2a
test al, al
je 0x446035
push esi
pop esp
push eax
push esi
push ebx
push esi
pop esp
push edi
pop ebp
push edi
push edx
pop edi
pop esp
push ecx
push ecx
pop eax
push ecx
pop ebp
push ebp
push ebx
pop esi
pop edi
pop ebx
push eax
pop ebp
push esp
push esi
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
pop esi
neg eax
pop ebx
call fcn.00436912
mov esp, ebp
pop ebp
ret
Function at 0x44635a
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00480e50
mov eax, dword [0x5ea00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
mov dword [ebp - 0x1008], eax
call fcn.00462b87
mov dword [ebp - 0x1014], eax
lea eax, [ebp - 0x1014]
push eax
mov dword [ebp - 0x1010], edx
call fcn.0046ff2e
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 0x10]
push edi
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x1004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.00445e21
add esp, 0x28
call fcn.004457a9
test al, al
je 0x4463f4
push ebp
push ebp
pop esi
push ecx
pop edi
push edi
push eax
push edi
pop ebx
pop ebx
push esi
push ebp
push esi
push edx
push ebx
push esp
xor ebx, ebx
push dword [ebp - 0x1008]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor edi, edi
inc edi
test eax, eax
cmovne ebx, edi
mov dword [ebp - 0x100c], ebx
call fcn.004458bd
test al, al
je 0x44643c
push eax
push eax
pop edi
push eax
pop ebp
pop ebx
pop ebx
pop edx
pop ecx
pop edi
pop edx
push eax
pop eax
push ecx
push esp
pop ebp
push ebp
pop esi
pop ecx
push esp
pop ebp
pop esp
push esi
push ebx
push edx
pop edi
push edx
push esi
mov ebx, dword [ebp - 0x100c]
xor edi, edi
inc edi
push 0x58a4c0
push dword [ebp - 0x1008]
call fcn.0046dd0a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4464ef
test ebx, ebx
jne 0x446479
push esi
push 2
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0xfeff
push edi
push eax
call fcn.0046fba5
add esp, 0x10
call fcn.00445bf9
test al, al
je 0x446492
push esi
push edi
push ebx
pop eax
push edi
pop ebp
push esp
push eax
pop ecx
pop edi
push ecx
pop edx
push esp
pop ebx
push esp
pop edx
lea eax, [ebp - 0x1004]
push eax
call fcn.0046f177
push esi
add eax, eax
push eax
lea eax, [ebp - 0x1004]
push 1
push eax
call fcn.0046fba5
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xd
push 1
push eax
call fcn.0046fba5
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xa
push 1
push eax
call fcn.0046fba5
push esi
call fcn.0046db08
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00436912
mov esp, ebp
pop ebp
ret
Function at 0x446b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x446bcf
push ebx
push edi
xor edi, edi
push str.c335b80a32136330ebfa2439bf4cbfcb
mov dword [ebp + 8], edi
call fcn.0046f6d0
mov ebx, dword [ebp + 0xc]
mov edx, edi
pop ecx
test ebx, ebx
je 0x446b8c
mov cl, byte [edi + str.c335b80a32136330ebfa2439bf4cbfcb]
xor byte [edx + esi], cl
inc edi
xor ecx, ecx
cmp edi, eax
cmovge edi, ecx
inc edx
cmp edx, ebx
jb 0x446b76
cmp ebx, 1
jle 0x446bc3
cmp byte [esi], 0x37
jne 0x446bc3
mov al, byte [esi + 1]
cmp al, 0x7a
je 0x446ba1
cmp al, 0x5a
jne 0x446bc3
lea eax, [ebp + 8]
push eax
push ebx
push esi
call fcn.004379c0
test eax, eax
je 0x446bc3
mov edx, dword [ebp + 8]
test edx, edx
je 0x446bc3
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x446bcd
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x447071
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x586f06
call fcn.00480ef9
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x8c]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x44709c
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x44717a
xor esi, esi
mov dword [ebp - 0x814], 7
push esi
xor eax, eax
mov dword [ebp - 0x818], esi
push 0x5dfd10
lea ecx, [ebp - 0x828]
mov word [ebp - 0x828], ax
call fcn.0041fdf0
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.0045eed0
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x5dfec8
push eax
call fcn.004257b0
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 5], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x44712f
call fcn.00446f8d
jmp 0x447134
call fcn.00447047
push eax
lea ecx, [ebp - 0x828]
call fcn.00422ee0
push esi
push 1
lea ecx, [ebp - 0x840]
call fcn.0041fd30
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.00462ab4
pop ecx
push 0
push 1
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.0041fd30
mov eax, esi
call fcn.00480eb4
ret 0xc
Function at 0x447184
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x586f50
call fcn.00480ef9
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.0045eed0
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4471e1
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.0041fba0
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x447227
mov eax, dword [esi]
jmp 0x447229
mov eax, esi
push ebx
push eax
call fcn.0046f115
pop ecx
pop ecx
test eax, eax
jne 0x447275
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x447259
call fcn.00446f8d
jmp 0x44725e
call fcn.00447047
push eax
mov ecx, esi
call fcn.00422ee0
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.0041fd30
mov eax, esi
call fcn.00480eb4
ret 0x10
Function at 0x447e91
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x5ea00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.0045eed0
lea eax, [edi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x447eca
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x58a090
push eax
call fcn.004257b0
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x447f02
lea eax, [ebp - 0x20c]
push eax
call fcn.00448d02
pop ecx
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0045eed0
push str.UseVestige.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x58a078
push eax
call fcn.004257b0
add esp, 0x1c
cmp word [ebp - 0x414], si
jne 0x447f41
mov eax, esi
jmp 0x447f4e
lea eax, [ebp - 0x414]
push eax
call fcn.0046f177
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [edi + 0x8c]
call fcn.0041fdf0
push 0x208
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.0045eed0
push str.UseCache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x58a078
push eax
call fcn.004257b0
add esp, 0x1c
cmp word [ebp - 0x61c], si
jne 0x447fa0
mov eax, esi
jmp 0x447fad
lea eax, [ebp - 0x61c]
push eax
call fcn.0046f177
pop ecx
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [edi + 0xa4]
call fcn.0041fdf0
push 0x208
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.0045eed0
lea eax, [ebp - 0xa44]
push 0x5e00bc
push eax
call fcn.0044939b
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x447fee
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x5e1e44
push eax
call fcn.004257b0
add esp, 0xc
lea ecx, [ebp - 0xa44]
push esi
push 1
call fcn.0041fd30
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x44802f
lea eax, [ebp - 0x824]
push eax
call fcn.00448d02
pop ecx
push 0x208
lea eax, [ebp - 0xa2c]
push esi
push eax
call fcn.0045eed0
push str.UseCache.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push 0x58a078
push eax
call fcn.004257b0
add esp, 0x1c
cmp word [ebp - 0xa2c], si
je 0x448079
lea eax, [ebp - 0xa2c]
push eax
call fcn.0046f177
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [edi + 0xbc]
call fcn.0041fdf0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00436912
mov esp, ebp
pop ebp
ret