joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4657c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x5a8518]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x465944
mov cl, byte [esp + 3]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov esi, edx
mov edi, edi
cmp ebp, 0xffffffff
je 0x46580e
test ebp, ebp
je 0x4658b0
dec ebp
cmp dword [ebx + 4], 0
je 0x465827
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004656a0
mov dword [esp + 0x14], eax
jmp 0x465841
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x13]
cmp eax, 1
jne 0x4658b0
test cl, cl
je 0x465855
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x13]
mov eax, dword [esp + 0x18]
mov edi, esi
mov edx, dword [esp + 0x20]
dec eax
sub edi, edx
cmp edi, eax
jle 0x465890
mov eax, dword [esp + 0x18]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x5a8518]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x20], edx
lea esi, [edi + edx]
test cl, cl
je 0x4658b0
cmp dword [esp + 0x2c], 0
jne 0x465800
cmp cl, 0xd
je 0x4658b7
cmp cl, 0xa
jne 0x465800
dec esi
jmp 0x465927
cmp dword [esp + 0x2c], 0
jne 0x465927
cmp cl, 0xa
jne 0x4658bf
dec esi
jmp 0x465927
cmp cl, 0xd
jne 0x465927
dec esi
cmp dword [ebx + 4], 0
je 0x4658de
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004656a0
mov dword [esp + 0x14], eax
jmp 0x4658f4
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x465927
cmp dword [ebx + 4], 0
je 0x465906
inc dword [ebx + 0xc]
jmp 0x465927
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x20]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x465950
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push 0x1000
push 0
push dword [0x5a8518]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 8], ecx
test ecx, ecx
je 0x465afd
mov ax, word [esp]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x1c], 0x7ff
cmp ebp, 0xffffffff
je 0x4659a4
test ebp, ebp
je 0x465a5d
dec ebp
cmp dword [ebx + 4], 0
je 0x4659bd
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004656a0
mov dword [esp + 0x14], eax
jmp 0x4659d7
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp eax, 2
mov ax, word [esp + 0x10]
jne 0x465a5d
test ax, ax
je 0x4659f1
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, edi
mov edx, dword [esp + 0x1c]
sub esi, ecx
sar esi, 1
cmp esi, edx
jle 0x465a38
mov eax, dword [esp + 0x20]
add edx, 0x800
add eax, 0x1000
mov dword [esp + 0x1c], edx
push eax
push ecx
push 8
push dword [0x5a8518]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov ax, word [esp + 0x10]
mov dword [esp + 0x18], ecx
lea edi, [ecx + esi*2]
test ax, ax
je 0x465a5d
cmp dword [esp + 0x30], 0
jne 0x465996
cmp ax, 0xd
je 0x465a64
cmp ax, 0xa
jne 0x465996
sub edi, 2
jmp 0x465adc
cmp dword [esp + 0x30], 0
jne 0x465adc
cmp ax, 0xa
jne 0x465a6f
sub edi, 2
jmp 0x465adc
cmp ax, 0xd
jne 0x465adc
sub edi, 2
cmp dword [ebx + 4], 0
je 0x465a91
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004656a0
mov dword [esp + 0x14], eax
jmp 0x465aa7
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x10], 0xa
je 0x465adc
cmp dword [ebx + 4], 0
je 0x465abb
add dword [ebx + 0xc], 2
jmp 0x465adc
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x38]
mov ecx, edi
sub ecx, dword [esp + 0x18]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
xor eax, eax
add esp, 0x18
ret 0x10
Function at 0x465b10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x5a8518]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x465c60
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x465b5c
test edi, edi
je 0x465bcd
dec edi
push esi
push ebp
call fcn.00465df0
mov dword [esp + 0x20], eax
test eax, eax
jne 0x465b6f
xor cl, cl
jmp 0x465b71
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x465bb4
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x5a8518]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x465bcd
test eax, eax
jne 0x465b52
cmp cl, 0xd
je 0x465bd1
cmp cl, 0xa
jne 0x465b52
dec esi
jmp 0x465c43
test eax, eax
jne 0x465c43
cmp cl, 0xa
jne 0x465bd9
dec esi
jmp 0x465c43
cmp cl, 0xd
jne 0x465c43
dec esi
cmp dword [ebp + 4], 0
je 0x465bf8
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.004656a0
mov dword [esp + 0x20], eax
jmp 0x465c0f
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x465c43
cmp dword [ebp + 4], 0
je 0x465c21
inc dword [ebp + 0xc]
jmp 0x465c43
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x465c70
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x465d77
cmp dword [esi + 0x14], 1
jne 0x465cbb
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x465d38
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x465d23
dec eax
je 0x465d0c
sub eax, 2
je 0x465cf7
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.00464c60
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x465d65
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x465ce1
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
Function at 0x465df0
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x465e17
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.004656a0
mov dword [esp + 4], eax
jmp 0x465e31
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
je 0x465e3d
xor eax, eax
pop edi
pop ecx
ret 8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x465e59
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x465e69
mov esi, 2
jmp 0x465e85
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x465e78
mov esi, 3
jmp 0x465e85
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x465ee2
mov esi, 4
mov edx, dword [esp + 0x14]
mov byte [edx], cl
cmp dword [edi + 4], 0
je 0x465eb4
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push edi
call fcn.004656a0
mov edx, eax
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 8]
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8
Function at 0x467caa
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x467df2
xor ecx, ecx
cmp word [eax], cx
je 0x467df2
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x467d03
cmp eax, 3
jne 0x467d3d
cmp word [esp + 0xa], 0x3a
jne 0x467d3d
cmp eax, 2
jne 0x467d21
lea eax, [esp + 8]
push 0x563264
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x467df2
push 0xfffffffffffffffe
pop edi
jmp 0x467df2
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x467d52
cmp ax, bx
jne 0x467d5c
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x467d45
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x467d9b
test byte [esp + 0x21c], 0x10
je 0x467d82
push 0xfffffffffffffffe
pop edi
jmp 0x467d92
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x467df0
cmp word [esp + 0x10], bp
jne 0x467da9
cmp word [esp + 0x12], bp
je 0x467dc8
cmp word [esp + 0x10], bx
jne 0x467db7
cmp word [esp + 0x12], bx
je 0x467dc8
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x467df0
cmp word [esp + 0x12], ax
jne 0x467df0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x467ddd
test al, 0x10
je 0x467df0
jmp 0x467ded
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x467df0
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4
Function at 0x467e83
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0x5aa1bc]
push esi
test eax, eax
jne 0x467ea8
push fcn.00467fb0
push 0x10
push 0x258
call fcn.0047cf43
mov dword [0x5aa1bc], eax
push dword [esp + 0xc]
push eax
call fcn.0047ceaf
mov esi, eax
test esi, esi
je 0x467fa9
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x467eca
mov edi, 0x54d038
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x467eda
xor eax, eax
cmp word [ebx], ax
jne 0x467edf
mov ebx, 0x563268
push edi
call sub.MSVCRT.dll_wcslen
push ebx
mov dword [esp + 0x24], eax
call sub.MSVCRT.dll_wcslen
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x5a8518]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x467f90
push edi
push eax
call sub.MSVCRT.dll_wcscpy
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x467f40
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x467f44
push 0x563264
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
jmp 0x467f44
mov edi, dword [esp + 0x18]
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x467f68
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x467f7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x467f7c
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0x5a8518]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x467fa7
cmp dword [esp + 0x14], 0xffffffff
je 0x467f9b
mov esi, dword [esp + 0x14]
push esi
push dword [0x5aa1bc]
call fcn.0047ce21
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc

Function at 0x468127
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x468150
test byte [esp + 8], 2
je 0x468144
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x468152
xor eax, eax
ret 8

Function at 0x469416
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
test esi, esi
je 0x469473
push esi
call dword [esi + 0x58]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x98], ecx
test edi, edi
jne 0x469473
mov eax, dword [esi + 0x70]
test eax, eax
je 0x469452
push ebx
push esi
call eax
push esi
push ebx
push dword [0x5a8518]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [0x5ab298]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x5ab29c], ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x46947b
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x5ab298]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 0x90]
add ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 0x8c]
add ecx, dword [esp + 0xc]
push ecx
push dword [esp + 0xc]
push eax
call dword [eax + 0x24]
ret 0xc

Function at 0x469518
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x5ab298]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [esp + 0xc]
mov ecx, dword [eax + 0x90]
add ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 0x8c]
add ecx, dword [esp + 0xc]
push ecx
push eax
call dword [eax + 0x50]
ret 0xc

Function at 0x46a596
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x10c
push 8
push dword [0x5a8518]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x5ab298]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x5ab29c], esi
mov eax, esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 1
mov dword [esi + 0x78], 7
mov dword [esi], 0x469666
mov dword [esi + 4], 0x469686
mov dword [esi + 8], 0x46a392
mov dword [esi + 0xc], 0x46971e
mov dword [esi + 0x10], 0x469c1b
mov dword [esi + 0x14], 0x469bad
mov dword [esi + 0x18], 0x469beb
mov dword [esi + 0x1c], 0x469c03
mov dword [esi + 0x20], fcn.00469c77
mov dword [esi + 0x24], 0x469a7c
mov dword [esi + 0x28], fcn.004698d1
mov dword [esi + 0x2c], 0x4697e8
mov dword [esi + 0x30], 0x469b43
mov dword [esi + 0x34], 0x469a98
mov dword [esi + 0x38], 0x469cf4
mov dword [esi + 0x3c], 0x469dfa
mov dword [esi + 0x40], 0x469e9e
mov dword [esi + 0x44], 0x469f35
mov dword [esi + 0x48], 0x46a033
mov dword [esi + 0x4c], 0x46a214
mov dword [esi + 0x50], 0x46a084
mov dword [esi + 0x54], 0x46a2d6
mov dword [esi + 0x58], 0x46a3d1
mov dword [esi + 0x5c], 0x46a48c
mov dword [esi + 0x60], 0x46a504
mov dword [esi + 0x64], 0x46a54a
pop esi
ret

Function at 0x46a87d
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x184
push 8
push dword [0x5a8518]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x5ab298]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x5ab29c], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.0046d59a
mov dword [esi + 0x58], 0x46b490
mov eax, esi
mov dword [esi + 0x5c], 0x46b4dc
mov dword [esi + 0x10], fcn.0046b031
mov dword [esi + 0x30], 0x46af23
mov dword [esi + 0x64], 0x46b566
mov dword [esi + 0x60], 0x46b51e
mov dword [esi + 0x34], 0x46abd3
mov dword [esi + 0x24], 0x46abaa
mov dword [esi + 0x28], 0x46ab7f
mov dword [esi + 0x2c], 0x46aad1
mov dword [esi + 0x44], 0x46b296
pop esi
ret 4
Function at 0x47082e
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xd4]
mov dword [esp + 4], eax
test edx, edx
je 0x4708e4
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
neg eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
push edi
lea edi, [ecx + eax*4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xcc]
mov ebp, edi
imul ecx, ebx
add ecx, dword [esi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x4708c4
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, esi
dec edx
jne 0x47089f
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec edx
inc ebx
cmp dword [esi + 0xe8], 0
mov dword [esp + 0x3c], edx
jne 0x4708d9
add edi, dword [esp + 0x14]
jmp 0x4708dd
add edi, dword [esp + 0x24]
test edx, edx
jne 0x47087d
pop edi
pop ebp
pop ebx
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x470bef
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
test ebx, ebx
je 0x470cc9
imul eax, dword [esp + 0x1c], 3
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
neg ecx
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
push edi
imul edi, dword [esp + 0x30], 3
mov dword [esp + 0x10], ecx
add eax, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], edi
mov esi, dword [eax + 0xcc]
imul esi, ebp
mov dword [esp + 0x34], edi
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x28]
test edx, edx
jle 0x470c9f
mov ebp, dword [esp + 0x34]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov edi, edx
movzx eax, byte [esi]
movzx ecx, byte [ebp]
imul ecx, dword [esp + 0x40]
imul eax, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [esi], al
inc esi
dec edi
jne 0x470c67
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x470cb6
add edi, ecx
jmp 0x470cba
add edi, dword [esp + 0x24]
mov dword [esp + 0x38], edi
test ebx, ebx
jne 0x470c3d
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x4712e9
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x47139e
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x47137f
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x47135a
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x471394
add edx, dword [esp + 0x14]
jmp 0x471398
add edx, dword [esp + 0x24]
test esi, esi
jne 0x471338
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24
Function at 0x472bd7
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
push esi
push edi
xor edi, edi
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push 0x80000000
push dword [esp + 0x2c]
mov ebp, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x472c5b
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push edi
push dword [0x5a8518]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x472c53
push ebp
lea eax, [esp + 0x1c]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x472c44
cmp dword [esp + 0x18], ebx
jne 0x472c44
push ebx
push edi
push dword [esp + 0x1c]
call fcn.00472ca3
mov ebp, eax
push edi
push 0
push dword [0x5a8518]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc

Function at 0x474f47
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x5aa3d4], eax
test eax, eax
je 0x474f75
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5aa3d0], eax
lea eax, [ebp - 0x114]
mov dword [0x5aa3d8], 1
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x474fd7
cmp dword [ebp - 0x104], 1
jne 0x474fac
and dword [0x5aa3d8], 0
jmp 0x474fef
cmp dword [ebp - 0x104], 2
jne 0x474fd7
cmp dword [ebp - 0x110], 5
jb 0x474fa3
jne 0x474fd7
mov eax, dword [ebp - 0x10c]
neg eax
sbb eax, eax
and eax, dword [0x5aa3d8]
mov dword [0x5aa3d8], eax
jmp 0x474fdc
mov eax, dword [0x5aa3d8]
test eax, eax
je 0x474fef
call fcn.0047474d
neg eax
sbb eax, eax
and dword [0x5aa3d8], eax
mov esp, ebp
pop ebp
ret

Function at 0x476050
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x476082
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x47607d
cmp dword [esp + 0xc], esi
je 0x476099
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret