joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ec10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x44ec1b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x44ecd7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4809e0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4809e0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4809e0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4809e0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4809e0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4809e0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4809e0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4809e0]
sub edi, 1
jne 0x44ec30
pop edi
test esi, esi
je 0x44ecfa
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4809e0]
sub esi, 1
jne 0x44ece0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x44f550
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov ebx, esi
mov dword [ebp - 8], esi
imul ebx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x44f598
push 0
lea ecx, [ebp + 8]
push ecx
push ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44f58a
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
div esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ebx
add ecx, edx
push esi
push ecx
push dword [ebp - 4]
call fcn.00455f90
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f5d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x44f60b
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44f606
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x44f638
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x44f61c
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.00455f90
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x44f64c
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x44f643
cmp byte [esi + 8], 0
je 0x44f643
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
cmp byte [ebx], 0
je 0x44f7b9
cmp byte [ebx + 1], 0
je 0x44f7ec
push 2
push 0
push 0
push dword [ebx + 4]
call esi
cmp byte [ebx], 0
je 0x44f7bf
cmp byte [ebx + 1], 0
je 0x44f7b2
push 1
push 0
push 0
push dword [ebx + 4]
call esi
sub eax, dword [ebx + 0xc]
jmp 0x44f7c2
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x44f7d1
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x1c]
mov esi, 0xffff
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
cmp eax, esi
jae 0x44f7d6
mov esi, eax
mov dword [ebp - 0x10], eax
push 0x404
call fcn.0045b984
mov edi, eax
add esp, 4
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x44f7f6
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 4], 0xffffffff
cmp esi, eax
jbe 0x44f906
nop word [eax + eax]
mov edx, dword [ebp - 8]
add eax, 0x400
cmp eax, esi
mov ecx, esi
cmovbe ecx, eax
mov eax, 0x404
sub edx, ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x404
mov dword [ebp - 0x1c], edx
mov esi, ecx
cmova esi, eax
cmp byte [ebx], 0
mov dword [ebp - 0x18], esi
je 0x44f881
cmp byte [ebx + 1], 0
je 0x44f906
mov eax, dword [ebx + 0xc]
push 0
push 0
add eax, edx
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [ebx], 0
mov edx, esi
je 0x44f886
push 0
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44f87c
mov byte [ebx + 8], 1
mov eax, dword [ebp - 0x14]
jmp 0x44f8b7
mov dword [ebx + 0x1c], edx
mov edx, esi
mov edi, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x14]
lea eax, [edi + esi]
mov esi, dword [ebx + 0x18]
sub esi, edi
cmp eax, dword [ebx + 0x18]
cmovbe esi, edx
add ecx, edi
push esi
push ecx
push dword [ebp - 0xc]
call fcn.00455f90
lea ecx, [esi + edi]
mov eax, esi
mov esi, dword [ebp - 0x18]
add esp, 0xc
mov edi, dword [ebp - 0xc]
mov dword [ebx + 0x1c], ecx
xor edx, edx
div esi
cmp eax, 1
jne 0x44f906
lea ecx, [esi - 3]
test ecx, ecx
js 0x44f8f1
lea eax, [edi + 3]
add eax, ecx
nop dword [eax]
mov edx, ecx
lea eax, [eax - 1]
dec ecx
cmp byte [eax - 3], 0x50
jne 0x44f8ed
cmp byte [edx + edi], 0x4b
jne 0x44f8ed
cmp byte [eax - 1], 5
jne 0x44f8ed
cmp byte [eax], 6
je 0x44f919
test ecx, ecx
jns 0x44f8d0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x44f906
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x10]
cmp eax, esi
jb 0x44f810
push edi
call fcn.00456504
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov dword [ebp - 4], eax
jmp 0x44f8f4
Function at 0x450140
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x4502fc
cmp dword [edi + 0x18], 0
je 0x4502fc
cmp dword [edi + 0x7c], 0
je 0x450169
call fcn.00450640
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.0044fee0
add esp, 8
test eax, eax
je 0x45018d
pop edi
mov eax, 0xffffff99
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call fcn.0045b984
mov esi, eax
add esp, 4
test esi, esi
je 0x4501d0
push 0x4000
call fcn.0045b984
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x4501dc
push esi
call fcn.00456504
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x3c]
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x54], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x40], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x450234
lea ecx, [esi + 4]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.0044ef50
test eax, eax
jne 0x450234
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov cl, byte [edi + 0x30]
mov dword [esi + 0x58], eax
and cl, 1
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x30]
shr eax, 3
mov byte [esi + 0x6c], cl
test al, 1
je 0x450258
mov al, byte [edi + 0x39]
jmp 0x45025b
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov edx, 0xc
xor eax, eax
mov dword [esi + 0x70], 0x12345678
test cl, cl
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
cmovne eax, edx
mov dword [esi + 0x7c], eax
test ebx, ebx
je 0x4502dd
nop dword [eax]
mov al, byte [ebx]
test al, al
je 0x4502dd
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, ecx
shr ecx, 8
movzx eax, al
mov eax, dword [eax*4 + 0x4809e0]
xor eax, ecx
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x70], eax
movzx eax, al
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4809e0]
mov dword [esi + 0x78], ecx
add ebx, 1
jne 0x450290
mov eax, dword [ebp - 0xc]
add eax, 0x1e
mov dword [edi + 0x7c], esi
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xffffff9a
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450d90
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x49d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x450dc2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x450dc2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x450eac
push edi
mov edi, ebx
mov ecx, ebx
mov edx, eax
cmp dx, 0x2f
je 0x450de1
cmp dx, 0x5c
jne 0x450de3
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x450dd5
cmp edi, ebx
je 0x450e2e
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call fcn.00455f90
add esp, 0xc
cmp edi, 0x208
jae 0x450ebc
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, esi
mov word [ebp + edi - 0x414], ax
call fcn.00450d90
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x450e53
lea ecx, [ebp - 0x20c]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x450e43
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x450e55
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x450e70
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x450eac
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00452408
mov esp, ebp
pop ebp
ret
call fcn.004529c5
int3
Function at 0x4512a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x477a87
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x49d00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x44c
call fcn.00452a9f
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov esi, dword [ebp + 0xc]
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
mov dword [edi + 0x238], 0xffffffff
mov dword [edi + 0x23c], 0
mov dword [edi + 0x240], 0
test esi, esi
je 0x45134d
mov ecx, esi
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x451320
sub ecx, edx
lea eax, [ecx + 1]
push eax
call fcn.00452ad4
add esp, 4
mov dword [edi + 0x23c], eax
sub eax, esi
nop dword [eax]
mov cl, byte [esi]
lea esi, [esi + 1]
mov byte [eax + esi - 1], cl
test cl, cl
jne 0x451340
mov dword [ebp - 4], 0xffffffff
cmp dword [edi], 0
jne 0x45147b
cmp dword [edi + 4], 0xffffffff
jne 0x45147b
lea esi, [edi + 0x244]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x451380
sub ecx, edx
sar ecx, 1
movzx eax, word [edi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x4513bc
cmp eax, 0x2f
je 0x4513bc
add esi, 0xfffffffe
mov ax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x4513a4
mov eax, dword [0x4844a0]
mov edi, esi
mov dword [edi], eax
mov edi, dword [ebp - 0x10]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x451474
push 1
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
cmp esi, 0xffffffff
push 0x20
setne bl
call fcn.00452a9f
mov ecx, dword [ebp - 0x14]
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [eax], 1
mov byte [eax + 0x10], 1
mov byte [eax + 1], bl
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
mov dword [eax + 0xc], 0
cmp esi, 0xffffffff
je 0x451438
push 1
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov eax, ecx
mov ecx, eax
call fcn.0044f930
mov dword [edi], eax
test eax, eax
je 0x451474
push 8
mov dword [0x4a1e34], 0
call fcn.00452a9f
add esp, 4
mov dword [eax], 1
mov dword [eax + 4], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x200
jmp 0x451480
mov eax, 0x1000000
mov dword [0x4a1e34], eax
mov eax, dword [edi + 0x23c]
test eax, eax
je 0x451498
push eax
call fcn.00452acf
add esp, 4
mov eax, dword [edi + 0x240]
mov dword [edi + 0x23c], 0
test eax, eax
je 0x4514b5
push eax
call fcn.00452acf
add esp, 4
push 0x44c
push edi
mov dword [edi + 0x240], 0
call fcn.00452873
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451c50
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x451d27
mov ecx, dword [esi + 0x3c]
mov eax, ecx
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x451c88
cmp dword [esi + 0x40], ebx
jae 0x451c88
push ecx
call fcn.00452acf
add esp, 4
mov dword [esi + 0x3c], 0
jmp 0x451c8c
test eax, eax
jne 0x451c9e
lea eax, [ebx + ebx]
push eax
call fcn.00452ad4
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push eax
call fcn.00455f90
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x451d24
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, ecx
or edi, 2
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x4820f0]
xor eax, ecx
mov ecx, edi
mov dword [esi + 0x30], eax
xor ecx, 1
movzx eax, al
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x4820f0]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x451cb2
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x451d65
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x451d4c
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call fcn.00455f90
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x451d87
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4659d8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046584e
Function at 0x4356a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax + 2]
and ecx, 0xff00
cmp ecx, 0x100
jne 0x4357f3
push 0
push 0
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx + 8]
mov ecx, dword [ebp + 0x14]
imul ecx, eax
mov edx, dword [ebp + 0x10]
add edx, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x84]
mov edx, dword [ecx + edx*4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax + 8]
mov edx, dword [ebp + 0x14]
imul edx, ecx
mov eax, dword [ebp + 0x10]
add eax, edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x88]
mov eax, dword [edx + eax*4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x70]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x70]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, 1
test edx, edx
je 0x4357f1
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 0x10], cl
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
and eax, 0xff
and eax, 0x7f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x435775
jmp 0x435857
mov ecx, dword [ebp - 0x10]
and ecx, 0xff
and ecx, 0x80
test ecx, ecx
je 0x4357b8
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
test edx, edx
je 0x4357b6
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x435788
jmp 0x4357ec
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 0x10], cl
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
test eax, eax
je 0x4357ec
mov edx, dword [ebp - 4]
mov al, byte [ebp - 0x10]
mov byte [edx], al
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x4357c9
jmp 0x43573e
jmp 0x435857
push 0
push 0
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx + 6]
mov ecx, dword [ebp + 0x10]
imul ecx, eax
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx + 6]
mov edx, dword [ebp + 0x14]
imul edx, eax
mov eax, dword [ebp + 8]
xor esi, esi
mov si, word [eax + 8]
imul edx, esi
lea ecx, [ecx + edx + 0x200]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx + 6]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4412c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov byte [ebp - 0x18], 0x21
mov byte [ebp - 0x17], 0xff
mov byte [ebp - 0x16], 0xb
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x14], 0x45
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0x12], 0x53
mov byte [ebp - 0x11], 0x43
mov byte [ebp - 0x10], 0x41
mov byte [ebp - 0xf], 0x50
mov byte [ebp - 0xe], 0x45
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x30
mov byte [ebp - 0xa], 3
mov byte [ebp - 9], 1
mov ax, word [ebp + 0xc]
mov word [ebp - 8], ax
mov byte [ebp - 6], 0
mov ecx, dword [ebp - 0x18]
and ecx, 0xff
push ecx
call dword [ebp + 8]
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x441333
mov eax, dword [ebp - 0x1c]
jmp 0x44148a
mov edx, dword [ebp - 0x17]
and edx, 0xff
push edx
call dword [ebp + 8]
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x441354
mov eax, dword [ebp - 0x1c]
jmp 0x44148a
mov eax, dword [ebp - 0x16]
and eax, 0xff
push eax
call dword [ebp + 8]
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x441374
mov eax, dword [ebp - 0x1c]
jmp 0x44148a
mov dword [ebp - 4], 0
jmp 0x441386
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 8
jge 0x4413ae
mov edx, dword [ebp - 4]
movsx eax, byte [ebp + edx - 0x15]
push eax
call dword [ebp + 8]
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4413ac
mov eax, dword [ebp - 0x1c]
jmp 0x44148a
jmp 0x44137d
mov dword [ebp - 4], 0
jmp 0x4413c0
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 3
jge 0x4413e8
mov edx, dword [ebp - 4]
movsx eax, byte [ebp + edx - 0xd]
push eax
call dword [ebp + 8]
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4413e6
mov eax, dword [ebp - 0x1c]
jmp 0x44148a
jmp 0x4413b7
mov ecx, dword [ebp - 0xa]
and ecx, 0xff
push ecx
call dword [ebp + 8]
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x441409
mov eax, dword [ebp - 0x1c]
jmp 0x44148a
mov edx, dword [ebp - 9]
and edx, 0xff
push edx
call dword [ebp + 8]
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x441427
mov eax, dword [ebp - 0x1c]
jmp 0x44148a
mov eax, dword [ebp - 8]
and eax, 0xffff
and eax, 0xff
push eax
call dword [ebp + 8]
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x441449
mov eax, dword [ebp - 0x1c]
jmp 0x44148a
mov ecx, dword [ebp - 8]
and ecx, 0xffff
sar ecx, 8
push ecx
call dword [ebp + 8]
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x44146a
mov eax, dword [ebp - 0x1c]
jmp 0x44148a
mov edx, dword [ebp - 6]
and edx, 0xff
push edx
call dword [ebp + 8]
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x441488
mov eax, dword [ebp - 0x1c]
jmp 0x44148a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4bcf50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.005c6250
cmp dword [0x6ba57c], 0
je 0x4bcf79
mov eax, dword [0x6ba57c]
push eax
call fcn.0055d4a0
add esp, 4
xor eax, eax
jmp 0x4bd082
push 0
mov ecx, dword [0x761714]
push ecx
push 0
mov edx, dword [0x7567cc]
push edx
push 0x50
push 0x64
push 0x14
push 0x14
push 0x54c80000
push str.Output_Color_Reduction
push str.reduceClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x6ba57c], eax
cmp dword [0x6ba57c], 0
jne 0x4bcfc2
mov eax, 1
jmp 0x4bd082
mov eax, dword [0x761904]
push eax
mov ecx, dword [0x6ba57c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x6ba57c]
push edx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [0x6ba57c]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [0x6ba588], 0x4bd0f0
push 0
mov ecx, dword [0x6ba588]
push ecx
mov edx, dword [0x6ba57c]
push edx
push str.ReduceDlg
mov eax, dword [0x761714]
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x6ba580], eax
cmp dword [0x6ba580], 0
je 0x4bd034
mov ecx, dword [0x6ba580]
push ecx
call dword [sym.imp.USER32.dll_BringWindowToTop]
cmp dword [0x6ba580], 0
je 0x4bd080
lea edx, [ebp - 0x14]
push edx
mov eax, dword [0x6ba580]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
push 4
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [ebp - 8]
add edx, eax
mov dword [ebp - 4], edx
push 6
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0
push 0
push 0
mov edx, dword [0x6ba57c]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
mov esp, ebp
pop ebp
ret