joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429f50
Capabilities:
Connect to http server
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x4a4f28
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5564a4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, ecx
push 0
push 0
push 0
push 0
push 0x5023b0
mov dword [esp + 0x34], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov esi, dword [esp + 0x28]
mov dword [esi], eax
jne 0x429fcb
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429fc4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x42a100
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionA]
push 4
lea ecx, [esp + 0x18]
push ecx
push 2
push eax
mov dword [esp + 0x24], 0x1388
call edi
mov eax, dword [esi]
push 4
lea edx, [esp + 0x18]
push edx
push 5
push eax
call edi
mov edx, dword [esi]
push 4
lea ecx, [esp + 0x18]
push ecx
push 6
push edx
call edi
mov ecx, dword [esi]
push 4
lea eax, [esp + 0x18]
push eax
push 7
push ecx
call edi
mov eax, dword [esi]
push 4
lea edx, [esp + 0x18]
push edx
push 8
push eax
call edi
mov ecx, dword [0x55865c]
movzx edi, word [0x54a8ac]
push 0
call fcn.0043f4a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je case.default.0x42a060
call fcn.0041eb80
mov ecx, eax
call fcn.0041e1e0
cmp eax, 1
jne case.default.0x42a060
call fcn.00421b80
mov ecx, eax
call fcn.00435df0
cmp eax, 3
ja case.default.0x42a060
jmp dword [eax*4 + 0x42a118]
mov edi, 0x2725
jmp case.default.0x42a060
mov edi, 0x2727
jmp case.default.0x42a060
mov edi, 0x2729
jmp case.default.0x42a060
mov edi, 0x272b
mov ebx, dword [esp + 0x30]
mov edx, dword [ebp + 8]
movzx ecx, di
push ecx
push ebx
push str.Connecting_Ftp_:__s__d
push edx
call fcn.00427200
push eax
call fcn.00426f60
mov eax, dword [esi]
add esp, 0x14
push 0
push 0
push 1
push 0x4f7df8
push str.anonymous
push edi
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
jne 0x42a0d7
mov edx, dword [esi]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea eax, [ebx - 0x10]
jmp 0x429fa3
lea eax, [ebx - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a0fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x435700
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
mov eax, dword [0x5564a4]
xor eax, esp
mov dword [esp + 0x408], eax
mov ecx, dword [esp + 0x414]
mov eax, dword [esp + 0x410]
push esi
mov esi, dword [esp + 0x41c]
push edi
mov edi, dword [esp + 0x424]
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x435793
mov edx, dword [esp + 8]
lea eax, [esp + 0x428]
push eax
push edi
lea ecx, [esp + 0x14]
push ecx
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x435797
push 0
push 0x400
lea ecx, [esp + 0x18]
push ecx
push 0
push esi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
xor eax, eax
jmp 0x43579c
mov eax, 1
mov ecx, dword [esp + 0x410]
pop edi
pop esi
xor ecx, esp
call fcn.004752ab
add esp, 0x40c
ret 0x14
Function at 0x436a50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a8a48
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5564a4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, ecx
mov esi, dword [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push esi
push str..Map_
push str.MapPath
push str.Path
mov dword [esp + 0x30], 0
call edi
push esi
push str..System_
push str.SystemPath
push str.Path
call edi
push esi
push str..MapEntity_
push str.EntityPath
push str.Path
call edi
push esi
push str..ScreenShots_
push str.ScreenShotsPath
push str.Path
call edi
push esi
push str..Map_
push str.MapPath
push str.Path
call edi
push esi
push str..Map_
push str.MapPath
push str.Path
call edi
push ecx
mov dword [esp + 0x18], esp
lea ebx, [esi - 0x10]
mov dword [esp + 0x18], esp
push ebx
call fcn.00402280
mov ecx, dword [esp + 0x1c]
add eax, 0x10
mov dword [ecx], eax
add esp, 4
mov ecx, ebp
call fcn.00436360
push esi
push 0x5033e0
push str.ZbufferBits
push str.RenderState
call edi
push esi
push 0x5033e0
push str.ZbufferBits
push str.RenderState
call edi
fld1
push esi
push ecx
fstp dword [esp]
push str.SoundVol
push str.Sound
call fcn.00436290
fld1
add esp, 0x10
push esi
push ecx
fstp dword [esp]
push str.MusicVol
push str.Sound
call fcn.00436290
add esp, 0xc
mov dword [esp + 0x18], esp
mov dword [esp + 0x18], esp
push ebx
call fcn.00402280
mov edx, dword [esp + 0x1c]
add esp, 4
add eax, 0x10
mov dword [edx], eax
push 0
mov ecx, ebp
call fcn.004365e0
push esi
push str.TRUE
push str.AviPlayCodec
push 0x500904
call edi
mov dword [esp + 0x20], 0xffffffff
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x436bc6
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x437780
Capabilities:
Read .ini file

Disassembly:
sub esp, 8
push esi
push edi
mov esi, ecx
call fcn.00405660
add eax, 0x194c
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x10], esp
mov edi, esp
push eax
call fcn.00402280
add eax, 0x10
mov dword [edi], eax
lea eax, [esp + 0x10]
add esp, 4
push eax
call fcn.004051d0
mov eax, dword [eax]
add esp, 8
push eax
push 0
push 0x50347c
push str.SERVER_OPEN_PLAN
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov byte [esi + 0x2946], al
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4377f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
add esp, 8
ret

Function at 0x437800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a92b6
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
mov eax, dword [0x5564a4]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
push 0x437660
push 0x437600
push 0x78
push 0x2c
lea eax, [esi + 4]
push eax
mov dword [esi], vtable.CWorldDataManager.0
call fcn.00476b1f
push 0x437660
push 0x437600
push 0x78
push 0x2c
lea ecx, [esi + 0x14a4]
push ecx
mov dword [esp + 0x40], 0
call fcn.00476b1f
xor eax, eax
or ebp, 0xffffffff
mov dword [esi + 0x2964], ebp
mov dword [esi + 0x2948], eax
mov dword [esi + 0x294c], eax
mov dword [esi + 0x2950], eax
mov dword [esi + 0x2954], eax
mov dword [esi + 0x2958], eax
mov dword [esi + 0x295c], eax
mov word [esi + 0x2944], ax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 1
mov byte [esi + 0x2946], al
mov dword [esp + 0xc], eax
call fcn.004356e0
push 4
lea edx, [esp + 0x10]
push edx
push str.WorldCode
push str.SoftwareCCRRFonline_
push reloc.WS2_32.dll_bind
lea ecx, [esp + 0x30]
mov byte [esp + 0x40], 2
call fcn.00435700
test eax, eax
jne 0x4378e6
mov dword [esi + 0x2960], ebp
lea eax, [esp + 0xc]
push eax
call fcn.00476c14
mov ecx, esp
mov dword [esp + 0x14], esp
push str..NetLogWorldDataManager_Log
mov dword [esi + 0x2960], eax
call fcn.00401d30
lea ecx, [esp + 0x14]
push ecx
call fcn.004051d0
mov eax, dword [eax]
add esp, 4
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
mov byte [esp + 0x34], 3
call fcn.00401d30
mov byte [esp + 0x30], 4
call fcn.00427200
mov ecx, eax
mov byte [esp + 0x30], 3
call fcn.00427270
mov dword [esi + 0x2968], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x2c], 2
lea edx, [eax + 0xc]
lock xadd dword [edx], ebp
dec ebp
test ebp, ebp
jg 0x437964
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 1
call fcn.004356f0
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x24
ret
Function at 0x43c8a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4ab493
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5564a4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
push ebx
call fcn.0043c450
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x56ec4c
or eax, 0xffffffff
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x4f7df8
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.0043bb50
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x43c930
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ab4b8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5564a4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x28]
test esi, esi
jne 0x43c970
push esi
push esi
push esi
push 2
call fcn.0043dd80
xor al, al
jmp 0x43cafa
call fcn.0043bdc0
push 2
or eax, 0xffffffff
push 0
push esi
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
call fcn.00476499
push esi
call fcn.004763a4
push 0
push 0
push esi
mov edi, eax
call fcn.00476499
add esp, 0x1c
test edi, edi
jg 0x43c9b7
push 0
push 0
push 0
push 0xd
mov ecx, ebx
call fcn.0043dd80
xor al, al
jmp 0x43cafa
mov dword [esp + 0x14], 0x56ec4c
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0
call fcn.0043bab0
lea eax, [edi + 1]
push eax
call fcn.0045815d
push esi
push 1
mov ebp, eax
push edi
push ebp
mov byte [ebp], 0
call fcn.00478454
add esp, 0x14
cmp eax, 1
je 0x43ca2d
push ebp
call fcn.0045818d
add esp, 4
push 0
push 0
push 0
push 2
mov ecx, ebx
call fcn.0043dd80
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
cmp eax, 0x56ec4c
je 0x43ca26
push eax
call fcn.0045818d
add esp, 4
xor al, al
jmp 0x43cafa
mov byte [edi + ebp], 0
cmp byte [ebp], 0
mov eax, ebp
mov esi, ebp
je 0x43caa2
jmp 0x43ca40
mov cl, byte [esi]
cmp cl, 0xa
jne 0x43ca60
mov ecx, esi
sub ecx, eax
add ecx, 1
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0043bc40
add esi, 1
mov eax, esi
jmp 0x43ca9d
cmp cl, 0xd
jne 0x43ca9a
mov ecx, esi
sub ecx, eax
test ecx, ecx
jle 0x43ca78
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0043bc40
push 1
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0xa
call fcn.0043bc40
cmp byte [esi + 1], 0xa
jne 0x43ca59
add esi, 2
mov eax, esi
jmp 0x43ca9d
add esi, 1
cmp byte [esi], 0
jne 0x43ca40
sub esi, eax
je 0x43cab1
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.0043bc40
push ebp
call fcn.0045818d
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
mov eax, dword [ebx]
mov eax, dword [eax + 8]
add esp, 4
push ecx
push 0
add edx, 8
push edx
mov ecx, ebx
call eax
cmp byte [ebx + 0x2c], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
jne 0x43ca16
cmp eax, 0x56ec4c
je 0x43caf8
push eax
call fcn.0045818d
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x4453a0
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x4453c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4453d3
xor al, al
ret
mov ecx, dword [esp + 8]
mov dword [ecx], eax
mov al, 1
ret

Function at 0x445610
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x445632
cmp byte [esp + 0xc], al
je 0x44562e
push esi
push 0x73
call fcn.0043fa60
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x445700
Capabilities:
Access peb ldr_data
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4b1e08
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
mov eax, dword [0x5564a4]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x10]
call fcn.00440980
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
call fcn.004456d0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
mov eax, dword [esp + 8]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x445777
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0044bad0
mov al, bl
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x28
ret
Function at 0x4457a0
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x4b1e40
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5564a4]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [esp + 0x58]
xor ebx, ebx
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00440980
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x54], ebx
call fcn.004456d0
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x30]
push ecx
push esi
mov byte [esp + 0x60], 1
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x4458df
push 0x504c7c
lea ecx, [esp + 0x18]
call fcn.0040cd30
mov esi, dword [esp + 0x14]
mov ebp, dword [esi - 0xc]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
lea edi, [ebp + 1]
sub eax, edi
or eax, ecx
jge 0x44585f
push edi
lea ecx, [esp + 0x18]
call fcn.004015c0
mov esi, dword [esp + 0x14]
cmp edi, ebx
mov byte [esi + ebp], 0x5c
jl 0x4458d5
cmp edi, dword [esi - 8]
jg 0x4458d5
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x30]
push ecx
mov dword [esi - 0xc], edi
push esi
mov byte [edi + esi], bl
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x4458df
lea eax, [esi - 0x10]
mov byte [esp + 0x50], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4458ac
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x50], 0xffffffff
call fcn.0044bad0
xor eax, eax
xor edx, edx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
push 0x80070057
call fcn.00401090
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
lea eax, [esi - 0x10]
mov byte [esp + 0x50], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x445907
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x50], 0xffffffff
call fcn.0044bad0
mov eax, edi
mov edx, ebp
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret

Function at 0x445a30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push esi
push 0
push 0
call ebp
mov esi, eax
test esi, esi
jne 0x445a49
pop esi
xor al, al
pop ebp
ret
push ebx
push edi
push esi
call fcn.00458188
add esp, 4
mov edi, eax
push edi
push esi
mov bl, 1
call ebp
test eax, eax
jne 0x445a72
push edi
xor bl, bl
call fcn.0045818d
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
pop ebp
ret
mov ecx, dword [esp + 0x14]
push edi
call fcn.00401cf0
push edi
call fcn.0045818d
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
pop ebp
ret
Function at 0x445fd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x34
mov eax, dword [0x5564a4]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [eax + 8]
push esi
push edi
push 1
mov dword [esp + 0x14], eax
push 0x1e
lea eax, [esp + 0x28]
mov edi, ecx
push eax
mov ecx, ebp
mov dword [esp + 0x20], ebp
call fcn.0044b6e0
mov eax, 4
mov ecx, 0x55496c
lea edx, [esp + 0x20]
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x446029
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x446011
test eax, eax
je 0x446086
movzx esi, byte [edx]
movzx ebx, byte [ecx]
sub esi, ebx
jne 0x446078
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x446086
movzx esi, byte [edx]
movzx ebx, byte [ecx]
sub esi, ebx
jne 0x446078
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x446086
movzx esi, byte [edx]
movzx ebx, byte [ecx]
sub esi, ebx
jne 0x446078
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x446086
movzx esi, byte [edx]
movzx ecx, byte [ecx]
sub esi, ecx
je 0x446086
test esi, esi
mov eax, 1
jg 0x446088
or eax, 0xffffffff
jmp 0x446088
xor eax, eax
test eax, eax
je 0x4460a3
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004752ab
add esp, 0x34
ret 4
mov edx, dword [esp + 0x10]
mov ax, word [esp + 0x26]
mov ecx, dword [edx + 0x14]
mov bl, al
shr ecx, 4
shr bl, 3
not cl
and bl, 1
test cl, 1
je 0x4460cb
mov dl, byte [edi + 8]
xor dl, al
test dl, 0xf
jne 0x44608c
mov ax, word [esp + 0x3a]
mov cx, word [esp + 0x3c]
mov si, word [esp + 0x28]
mov word [edi + 0x58], 0
mov word [edi + 0x58], ax
movzx edx, word [ebp + 0x2a]
movzx eax, ax
mov dword [esp + 0x18], edx
cdq
push 1
mov word [esp + 0x20], cx
mov ecx, dword [ebp + 4]
mov ebp, dword [ecx]
push edx
push eax
mov eax, dword [ebp + 0x10]
call eax
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
push ecx
push ebp
lea ecx, [edi + 0x2c]
call fcn.0044cc60
test al, al
je 0x44608c
mov eax, dword [esp + 0x32]
mov ecx, dword [esp + 0x36]
xor edx, edx
cmp si, 0x63
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ecx
jne 0x446141
cmp byte [edi + 0x5a], 0xff
je 0x446141
push edx
push 0x78
call fcn.0043fa60
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x14]
mov ecx, eax
shr ecx, 1
not cl
test cl, 1
je 0x44615d
cmp si, word [edi + 0xa]
jne 0x44608c
test bl, bl
jne 0x4461a3
test al, 0xc
jne 0x4461a3
mov ecx, dword [esp + 0x2e]
mov ebx, eax
shr ebx, 3
not bl
test bl, 1
je 0x44617e
cmp ecx, dword [edi + 0x10]
jne 0x44608c
shr eax, 2
not al
test al, 1
je 0x4461a3
mov eax, dword [edi + 0x20]
cmp eax, edx
je 0x446197
cmp eax, dword [edi + 0x14]
jne 0x44608c
mov edx, dword [edi + 0x24]
cmp edx, dword [edi + 0x18]
jne 0x44608c
mov cx, word [esp + 0x18]
pop edi
xor eax, eax
cmp word [ebp + 0x2a], cx
mov ecx, dword [esp + 0x3c]
pop esi
pop ebp
sete al
pop ebx
xor ecx, esp
call fcn.004752ab
add esp, 0x34
ret 4
Function at 0x446aa0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b2031
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5564a4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CZipFileHeader.0
xor ebx, ebx
mov eax, vtable.CZipArray_class_CZipExtraData__.0
mov dword [esi + 0x30], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x2c], eax
mov dword [esp + 0x18], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x40], eax
lea ecx, [esi + 0x5c]
mov byte [esp + 0x18], 1
call fcn.00449f60
mov byte [esp + 0x18], 2
call fcn.0043f4c0
xor ecx, ecx
cmp eax, ebx
sete cl
mov byte [esi + 0x6c], bl
mov dword [esi + 0x74], ebx
mov dword [esi + 0x70], ecx
lea ecx, [esi + 0x78]
call fcn.00449f60
mov dword [esi + 0x54], ebx
mov word [esi + 0xc], bx
mov word [esi + 0xe], bx
mov word [esi + 0xa], 8
mov word [esi + 4], bx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov word [esi + 0x58], bx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], ebx
mov word [esi + 0x1c], bx
mov dword [esi + 0x68], ebx
mov byte [esi + 0x5a], 0xff
mov byte [esi + 0x5b], bl
mov word [esi + 8], bx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x446d70
Capabilities:
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x4b20cb
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5564a4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x20]
movzx eax, word [edi + 4]
mov word [esi + 4], ax
movzx ecx, word [edi + 6]
mov word [esi + 6], cx
movzx edx, word [edi + 8]
mov word [esi + 8], dx
movzx eax, word [edi + 0xa]
mov word [esi + 0xa], ax
movzx ecx, word [edi + 0xc]
mov word [esi + 0xc], cx
movzx edx, word [edi + 0xe]
mov word [esi + 0xe], dx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 0x18]
mov dword [esi + 0x18], edx
movzx eax, word [edi + 0x1c]
mov word [esi + 0x1c], ax
movzx ecx, word [edi + 0x1e]
mov word [esi + 0x1e], cx
mov edx, dword [edi + 0x20]
mov dword [esi + 0x20], edx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x54]
mov dword [esi + 0x54], ecx
movzx edx, word [edi + 0x58]
lea ecx, [edi + 0x2c]
mov word [esi + 0x58], dx
mov eax, dword [edi + 0x28]
push ecx
lea ecx, [esi + 0x2c]
mov dword [esi + 0x28], eax
call fcn.00446930
lea edx, [edi + 0x40]
push edx
lea ecx, [esi + 0x40]
call fcn.00446930
mov ebx, dword [esi + 0x68]
test ebx, ebx
mov al, byte [edi + 0x5a]
mov byte [esi + 0x5a], al
je 0x446e57
mov eax, dword [ebx]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x446e4e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
call fcn.0045818d
add esp, 4
cmp dword [edi + 0x68], 0
je 0x446eab
push 4
call fcn.0045815d
mov ebx, eax
add esp, 4
mov dword [esp + 0x20], ebx
test ebx, ebx
mov dword [esp + 0x18], 0
je 0x446e9c
mov eax, dword [edi + 0x68]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00402280
add esp, 4
add eax, 0x10
mov dword [ebx], eax
mov dword [esp + 0x18], 0xffffffff
mov dword [esi + 0x68], ebx
jmp 0x446eb2
xor ebx, ebx
mov dword [esp + 0x18], 0xffffffff
mov dword [esi + 0x68], ebx
jmp 0x446eb2
mov dword [esi + 0x68], 0
lea ecx, [edi + 0x5c]
push ecx
lea ecx, [esi + 0x5c]
call fcn.0044a040
lea edx, [edi + 0x78]
push edx
lea ecx, [esi + 0x78]
call fcn.0044a040
mov ecx, dword [edi + 0x6c]
lea eax, [edi + 0x6c]
mov dword [esi + 0x6c], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x70], edx
mov eax, dword [eax + 8]
mov dword [esi + 0x74], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x448020
Capabilities:
Read file via mapping

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x448031
xor al, al
pop esi
ret 4
push str.ZipArchive_Mapping_File
push 0
push 0
push 4
push 0
call fcn.00445390
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi], eax
je 0x44802b
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor ecx, ecx
test eax, eax
mov dword [esi + 4], eax
setne cl
mov al, cl
pop esi
ret 4