joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c22c3bc
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
lea eax, [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
add esp, 0x2c
ret

Function at 0x6c22c3f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x5c
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x18], 0x8235
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x10
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 1
mov ecx, edx
imul ecx, eax
shl ecx, 2
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x38
mov dword [esp + 4], 1
lea eax, [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
add esp, 0x5c
ret

Function at 0x6c22c470
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x5c
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x18], 0x73646976
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], 0
mov word [esp + 0x24], 0
mov word [esp + 0x26], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x8235
mov dword [esp + 0x30], 0xf4240
mov dword [esp + 0x34], 0
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x38], ecx
mov ecx, edx
imul ecx, eax
shl ecx, 2
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov word [esp + 0x48], 0
mov word [esp + 0x4a], 0
mov word [esp + 0x4c], dx
mov word [esp + 0x4e], ax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x38
mov dword [esp + 4], 1
lea eax, [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
add esp, 0x5c
ret

Function at 0x6c22c528
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x48
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x18], 0x28
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov word [esp + 0x24], 1
cmp ecx, 0x32335652
je 0x6c22c5c0
mov dword [esp + 0x28], ecx
mov ecx, 3
mov ebx, 0x18
mov word [esp + 0x26], bx
imul eax, edx
imul eax, ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0x48
mov dword [esp + 0x34], 0x48
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x28
mov dword [esp + 4], 1
lea eax, [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
add esp, 0x48
pop ebx
ret
mov dword [esp + 0x28], 0
mov ecx, 4
mov ebx, 0x20
jmp 0x6c22c565
Function at 0x6c22c5d4
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], 0x30307869
lea edx, [eax*8 + 0x20]
mov dword [esp + 0x14], edx
mov word [esp + 0x18], 2
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1b], 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x62643030
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
mov dword [esp + 4], 1
lea eax, [esp + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
add esp, 0x3c
ret

Function at 0x6c22c64c
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x11c
mov eax, dword [esp + 0x120]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x124]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xf8
mov dword [esp + 4], 1
lea eax, [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
add esp, 0x11c
ret
Function at 0x6c22ca7c
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x48]
test ebx, ebx
je 0x6c22cb35
mov eax, dword [0x6c459068]
cmp dword [esp + 0x4c], eax
jae 0x6c22cb35
mov eax, ebp
and eax, 3
je 0x6c22caae
sub ebp, eax
add ebp, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
lea eax, [esp + 0x50]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [esp + 4], ebx
mov dword [esp], ebp
call fcn.6c22c3bc
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebp
mov dword [esp + 4], 1
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov ebx, dword [0x6c459078]
mov esi, dword [ebx + 4]
lea eax, [esi + 1]
mov edx, dword [ebx + 8]
cmp eax, edx
ja 0x6c22cb40
mov edx, dword [ebx + 0xc]
mov dword [ebx + 4], eax
imul esi, dword [ebx]
add edx, esi
mov eax, dword [esp + 0x50]
mov dword [edx], eax
mov dword [edx + 4], 0x10
mov eax, dword [0x6c459074]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ebp
lea eax, [eax + ebp + 8]
mov dword [0x6c459074], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edx
shr eax, 2
mov ecx, 1
cmove eax, ecx
add eax, edx
mov dword [esp + 0x1c], eax
mov edi, dword [ebx]
imul eax, edi
add eax, 0x13
mov dword [esp], eax
call sub.msvcrt.dll_malloc
lea edx, [eax + 0x13]
and edx, 0xfffffff0
mov dword [edx - 4], eax
mov ecx, edi
imul ecx, esi
mov esi, dword [ebx + 0xc]
mov edi, edx
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax - 4]
mov dword [esp], eax
mov dword [esp + 0x18], edx
call sub.msvcrt.dll_free
mov edx, dword [esp + 0x18]
mov dword [ebx + 0xc], edx
mov eax, dword [esp + 0x1c]
mov dword [ebx + 8], eax
mov esi, dword [ebx + 4]
lea eax, [esi + 1]
jmp 0x6c22cb0c
Function at 0x6c22cba4
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
test esi, esi
je 0x6c22cd78
mov eax, dword [0x6c459074]
and eax, 3
jne 0x6c22cd80
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.indx
call sub.msvcrt.dll_fwrite
mov dword [esp + 4], esi
mov eax, dword [0x6c459068]
lea eax, [eax*8 + 0x20]
mov dword [esp], eax
call fcn.6c22c3bc
mov dword [esp + 4], esi
mov eax, dword [0x6c459068]
mov dword [esp], eax
call fcn.6c22c5d4
mov dword [esp], esi
call sub.msvcrt.dll_ftell
mov dword [0x6c45907c], eax
mov dword [esp + 8], 1
mov eax, dword [0x6c459068]
shl eax, 3
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_fseek
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], str.idx1
call sub.msvcrt.dll_fwrite
mov dword [esp + 4], esi
mov eax, dword [0x6c459078]
mov eax, dword [eax + 4]
shl eax, 4
mov dword [esp], eax
call fcn.6c22c3bc
mov eax, dword [0x6c459078]
mov dword [esp + 0xc], esi
mov edx, dword [eax + 4]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x10
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
call sub.msvcrt.dll_ftell
mov edi, eax
mov dword [esp + 8], 0
mov eax, dword [0x6c45907c]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_fseek
mov eax, dword [0x6c459078]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x6c22ccfc
mov ecx, dword [eax]
xor edx, edx
xor ebx, ebx
jmp 0x6c22ccca
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 2
mov dword [esp + 4], 4
imul edx, ecx
add edx, dword [eax + 0xc]
add edx, 8
mov dword [esp], edx
call sub.msvcrt.dll_fwrite
inc ebx
mov edx, ebx
mov eax, dword [0x6c459078]
cmp ebx, dword [eax + 4]
jb 0x6c22ccc8
mov dword [esp + 8], 0
mov eax, dword [0x6c45906c]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_fseek
mov dword [esp + 4], esi
sub edi, 8
mov dword [esp], edi
call fcn.6c22c3bc
mov dword [esp + 8], 0
mov eax, dword [0x6c459070]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_fseek
mov dword [esp + 4], esi
mov eax, dword [0x6c459074]
mov dword [esp], eax
call fcn.6c22c3bc
mov ebx, dword [0x6c459078]
test ebx, ebx
je 0x6c22cd78
mov eax, dword [ebx + 0xc]
mov eax, dword [eax - 4]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 0x20], ebx
add esp, 0x10
pop ebx
pop esi
pop edi
jmp fcn.6c2df6f4
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov ebx, 4
sub ebx, eax
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_fseek
add dword [0x6c459074], ebx
jmp 0x6c22cbc4
Function at 0x6c22d068
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x6c22d140
mov byte [ebx + 4], 0x4c
mov byte [ebx + 5], 0x55
mov byte [ebx + 6], 0x43
mov byte [ebx + 7], 0x41
mov dword [ebx + 8], 0x1000
mov dword [ebx + 0xc], 0xffffffff
xor eax, eax
lea esi, [esi]
mov dword [ebx + eax + 0x10], 0
mov dword [ebx + eax + 0x14], 0
mov dword [ebx + eax + 0x18], 0
add eax, 0xc
cmp eax, 0xc000
jne 0x6c22d0a4
mov dword [esp + 4], 0x6c367caf
mov dword [esp], esi
call sub.msvcrt.dll_fopen
mov dword [ebx], eax
test eax, eax
je 0x6c22d13a
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xc018
mov dword [esp + 4], 1
lea eax, [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx]
test eax, eax
je 0x6c22d13a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, dword [ebx]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xc018
mov dword [esp + 4], 1
add ebx, 4
mov dword [esp], ebx
call sub.msvcrt.dll_fread
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp + 4], 0x6c367cac
mov dword [esp], esi
call sub.msvcrt.dll_fopen
test eax, eax
je 0x6c22d081
mov dword [esp], eax
call sub.msvcrt_ruby200.dll_fclose
mov dword [esp + 4], 0x6c367cb3
mov dword [esp], esi
call sub.msvcrt.dll_fopen
mov dword [ebx], eax
jmp 0x6c22d0fd

Function at 0x6c22d17c
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx]
test eax, eax
je 0x6c22d1d3
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, dword [ebx]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xc018
mov dword [esp + 4], 1
lea eax, [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt_ruby200.dll_fclose
mov dword [ebx], 0
add esp, 0x18
pop ebx
ret
Function at 0x6c22d308
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov eax, dword [ebx]
mov dword [esp + 0x14], eax
test eax, eax
je 0x6c22d337
mov esi, dword [ebx + 0xc018]
test esi, esi
je 0x6c22d337
mov eax, dword [ebx + 0xc010]
mov dword [ebx + 0xc], eax
cmp eax, 0xfff
je 0x6c22d340
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x600c]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x6008]
add dword [esp + 0x18], eax
mov eax, dword [ebx + 0xc00c]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0xc008]
add dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
sub dword [esp + 0x10], eax
mov dword [ebx + 0xc], 0x7ff
lea eax, [ebx + 0x6014]
mov edx, 0x800
mov ebp, 3
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x18]
nop
sub dword [eax], ebx
lea edi, [eax - 0x6004]
lea esi, [eax - 4]
mov ecx, ebp
rep movsd dword es:[edi], dword [esi]
mov dword [eax], 0
mov dword [eax + 4], 0
add eax, 0xc
dec edx
jne 0x6c22d390
mov ebx, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, dword [ebx]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xc018
mov dword [esp + 4], 1
lea eax, [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov esi, 0x100000
cmp dword [esp + 0x18], 0x100000
cmovle esi, dword [esp + 0x18]
mov dword [esp], esi
call sub.msvcrt.dll_malloc
mov ebp, eax
mov ecx, dword [esp + 0x10]
test ecx, ecx
jle 0x6c22d4b3
mov eax, dword [esp + 0x18]
add eax, 0xc018
mov dword [esp + 0x14], eax
xor edi, edi
mov eax, dword [esp + 0x10]
sub eax, edi
cmp esi, eax
cmovg esi, eax
mov dword [esp + 8], 0
mov eax, dword [esp + 0x14]
add eax, edi
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, dword [ebx]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], ebp
call sub.msvcrt.dll_fread
mov dword [esp + 8], 0
lea eax, [edi + 0xc018]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, dword [ebx]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], ebp
call sub.msvcrt.dll_fwrite
add edi, esi
cmp dword [esp + 0x10], edi
jg 0x6c22d434
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], ebp
call sub.msvcrt.dll_free
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6c22d4e8
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
imul esi, dword [esp + 0x28]
mov eax, dword [ebx + 0xc010]
lea eax, [eax + eax*2]
mov eax, dword [ebx + eax*4 + 0x18]
sub eax, dword [ebx + 0xc014]
cmp esi, eax
cmovg esi, eax
mov eax, dword [ebx]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_fread
add dword [ebx + 0xc014], esi
mov eax, esi
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x6c22d540
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
imul esi, dword [esp + 0x28]
mov eax, dword [ebx]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0xc010]
lea eax, [eax + eax*2]
add dword [ebx + eax*4 + 0x18], esi
add dword [ebx + 0xc014], esi
mov eax, esi
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x6c22d5e4
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x83c
mov ebx, dword [esp + 0x850]
mov ebp, dword [esp + 0x854]
mov eax, dword [esp + 0x858]
mov dword [ebx + 0xc41c], eax
lea eax, [ebx + 0xc420]
mov dword [esp + 0x28], eax
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], ebp
call fcn.6c265f58
mov dword [esp + 0x2c], eax
mov dword [esp], ebp
call fcn.6c22d028
mov dword [esp + 4], eax
lea esi, [esp + 0x30]
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x2e
mov dword [esp], esi
call sub.msvcrt.dll_strrchr
test eax, eax
je 0x6c22d65a
mov byte [eax], 0
mov eax, esi
jmp 0x6c22d664
mov byte [eax - 1], 0x5f
mov dl, byte [eax]
inc eax
test dl, dl
je 0x6c22d690
cmp dl, 0x20
je 0x6c22d660
cmp dl, 0x2d
je 0x6c22d660
cmp dl, 0x3c
je 0x6c22d660
cmp dl, 0x3e
je 0x6c22d660
cmp dl, 0x2c
je 0x6c22d660
cmp dl, 0x5b
je 0x6c22d660
cmp dl, 0x5d
je 0x6c22d660
jmp 0x6c22d664
lea eax, [esp + 0x430]
mov dword [esp + 4], eax
mov dword [esp], 0x400
call sub.KERNEL32.dll_GetTempPathA
sub esp, 8
lea edi, [ebx + 0xc01c]
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x2c]
add eax, dword [esp + 0x858]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x430]
mov dword [esp + 8], eax
mov dword [esp + 4], str._ss_u__s.cache
mov dword [esp], edi
call sub.msvcrt.dll_sprintf
mov eax, dword [ebx + 0xc41c]
test eax, eax
je 0x6c22d758
mov dword [esp + 4], str.copyright
mov dword [esp], ebp
call fcn.6c29548c
mov esi, eax
test eax, eax
je 0x6c22d797
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], str.uncompressing__s_to__s_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.6c295664
mov dword [esp], esi
call fcn.6c2957c8
mov dword [esp], esi
test al, al
je 0x6c22d790
call fcn.6c295720
mov eax, dword [ebx + 0xc41c]
jmp 0x6c22d75a
xor eax, eax
test eax, eax
sete al
movzx eax, al
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.6c22d068
cmp dword [ebx + 4], 0x4143554c
je 0x6c22d782
mov byte [ebx + 0xc01c], 0
add esp, 0x83c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.6c29abc4
jmp 0x6c22d74e
mov dword [esp + 4], ebp
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
jmp 0x6c22d74e
Function at 0x6c22d928
Capabilities:
Delete file
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
mov dword [esp], ebx
call fcn.6c22d17c
mov eax, dword [ebx + 0xc41c]
test eax, eax
jne 0x6c22d9b6
lea esi, [ebx + 0xc420]
lea edi, [ebx + 0xc01c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], str.compressing__s_to__s_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], str.copyright
mov dword [esp], esi
call fcn.6c29a98c
mov esi, eax
test eax, eax
je 0x6c22d9ae
mov dword [esp + 8], edi
mov dword [esp + 4], str.content
mov dword [esp], eax
call fcn.6c29aa50
mov dword [esp], esi
call fcn.6c2957c8
mov dword [esp], esi
test al, al
je 0x6c22d9c8
call fcn.6c295720
mov dword [esp], edi
call sub.msvcrt.dll_remove
mov dword [esp + 0x20], ebx
add esp, 0x10
pop ebx
pop esi
pop edi
jmp fcn.6c22d17c
call fcn.6c29abc4
jmp 0x6c22d9ae
Function at 0x6c2586d4
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, eax
mov esi, edx
mov edi, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], str.Texture:__Texture::_s____TextureVideoClip___n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x1a
mov dword [esp + 4], 1
mov dword [esp], str._tType:__TextureVideoClip__n
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0xe
mov dword [esp + 4], 1
mov dword [esp], str._tVersion:_202_n
call sub.msvcrt.dll_fwrite
mov dword [esp + 8], esi
mov dword [esp + 4], str._tTextureName:__Texture::_s__n
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x12
mov dword [esp + 4], 1
mov dword [esp], str._tProperties60:___n
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x29
mov dword [esp + 4], 1
mov dword [esp], str._t_tProperty:__UseMaterial____bool_______1_n
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], 0x6c369796
call sub.msvcrt.dll_fwrite
mov dword [esp + 8], esi
mov dword [esp + 4], str._tMedia:__Video::_s__n
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x6c483060
mov dword [esp + 4], str._tFilename:___s_s__n
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x6c483460
mov dword [esp + 4], str._tRelativeFilename:___s_s__n
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0xe
mov dword [esp + 4], 1
mov dword [esp], str._tScaling:_1_1_n
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 1
mov dword [esp], str._tTexture_Mapping_Type:__UV__n
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x11
mov dword [esp + 4], 1
mov dword [esp], str._tMaterialMode:_1_n
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x6c36981b
call sub.msvcrt.dll_fwrite
add esp, 0x10
pop ebx
pop esi
pop edi
ret
Function at 0x6c25c270
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, eax
mov esi, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], str.Video:__Video::_s____Clip___n
mov dword [esp], eax
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_fprintf
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0xe
mov dword [esp + 4], 1
mov dword [esp], str._tType:__Clip__n
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x6c483060
mov dword [esp + 4], str._tFilename:___s_s__n
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x6c483460
mov dword [esp + 4], str._tRelativeFilename:___s_s__n
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x6c36981b
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], edx
mov ecx, str.Texture
mov eax, str.Video
call fcn.6c25c190
add esp, 0x24
pop ebx
pop esi
ret
Function at 0x6c263a70
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebx
sub esp, 0x18
lea eax, [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp], 0x6c48e1e0
call sub.msvcrt.dll_vsprintf
mov byte [0x6c4901df], 0
mov dword [esp + 4], 0x6c4901e0
mov dword [esp], 0x400
call sub.KERNEL32.dll_GetTempPathA
sub esp, 8
mov dword [esp + 8], 0x6c4901e0
mov dword [esp + 4], str._sLIGHTUP.log
mov dword [esp], 0x6c4905e0
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], 0x6c36b822
mov dword [esp], 0x6c4905e0
call sub.msvcrt.dll_fopen
mov ebx, eax
test eax, eax
je 0x6c263afc
mov dword [esp + 4], eax
mov dword [esp], 0x6c48e1e0
call sub.msvcrt.dll_fputs
mov dword [esp], ebx
call sub.msvcrt_ruby200.dll_fclose
mov dword [esp], 0x6c48e1e0
call sub.KERNEL32.dll_OutputDebugStringA
push ebx
add esp, 0x18
pop ebx
ret

Function at 0x6c265f58
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, dword [esp + 8]
mov dl, byte [ecx]
mov eax, 0x811c9dc5
test dl, dl
je 0x6c265f87
mov ebx, eax
shl ebx, 0x10
add ebx, eax
lea ebx, [eax + ebx*2]
lea ebx, [eax + ebx*8]
lea ebx, [eax + ebx*8]
lea ebx, [eax + ebx*2]
movsx eax, dl
xor eax, ebx
inc ecx
mov dl, byte [ecx]
test dl, dl
jne 0x6c265f68
pop ebx
ret
Function at 0x6c282358
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x14
mov ecx, dword [0x6c4b3348]
test ecx, ecx
je 0x6c282388
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
add esp, 0x14
pop esi
pop edi
ret
mov esi, dword [0x6c4b3358]
mov edi, eax
mov ecx, edx
rep movsb byte es:[edi], byte [esi]
mov dword [0x6c4b3358], esi
add esp, 0x14
pop esi
pop edi
ret
Function at 0x6c286848
Capabilities:
Encrypt data using rc4 ksa
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
mov edi, edx
xor esi, esi
lea esi, [esi]
call fcn.6c282974
movzx edx, byte [esi + 0x6c375460]
cmp eax, edx
jne 0x6c28687c
inc esi
cmp esi, 8
jne 0x6c286854
cmp ebx, 1
je 0x6c28688c
mov edx, edi
mov eax, ebx
pop ebx
pop esi
pop edi
jmp fcn.6c285a08
mov dword [0x6c4b3340], 0x6c3750fc
xor eax, eax
pop ebx
pop esi
pop edi
ret
mov eax, 1
pop ebx
pop esi
pop edi
ret

Function at 0x6c286c2c
Capabilities:
Encrypt data using rc4 ksa
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x6c4b3348], 0
mov dword [0x6c4b3358], eax
add eax, dword [esp + 8]
mov dword [0x6c4b3360], eax
xor edx, edx
mov eax, 1
jmp fcn.6c286848

Function at 0x6c2875f8
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov ebx, dword [esp + 0x40]
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov edi, eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov dword [esp], edi
call sub.msvcrt.dll_malloc
mov esi, eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov eax, dword [esp + 0x50]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.6c2875c0
mov dword [esp], esi
mov dword [esp + 0x2c], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x2c]
add esp, 0x30
pop ebx
pop esi
pop edi
ret