joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415fa0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x74
mov eax, dword [0x43d504]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
mov ebx, dword [esp + 0x80]
push ebp
push esi
mov esi, dword [esp + 0x84]
push edi
lea eax, [esp + 0x64]
push eax
xor edi, edi
push esi
mov dword [esp + 0x84], 7
mov dword [esp + 0x80], edi
mov word [esp + 0x70], di
call fcn.00402d59
xor eax, eax
push 0x44
lea ecx, [esp + 0x2c]
push edi
push ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call fcn.0041a390
mov eax, dword [ebx + 0x14]
add esp, 0x14
xor ebp, ebp
cmp eax, edi
mov dword [esp + 0x20], 0x44
je 0x4160bc
lea edi, [eax + 0x208]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00418ee3
push 0x4359d8
mov ebp, eax
push edi
push ebp
call fcn.0041bc87
add esp, 0x10
cmp dword [esi + 0x18], 8
jb 0x416055
mov esi, dword [esi + 4]
jmp 0x416058
add esi, 4
push esi
push edi
push ebp
call fcn.0041bc0d
push 0x4364a4
push edi
push ebp
call fcn.0041bc0d
mov esi, 8
add esp, 0x18
cmp dword [ebx + 0x18], esi
jb 0x41607e
mov ebx, dword [ebx + 4]
jmp 0x416081
add ebx, 4
push ebx
push edi
push ebp
call fcn.0041bc0d
mov eax, dword [esp + 0x74]
add esp, 0xc
cmp dword [esp + 0x7c], esi
jae 0x41609a
lea eax, [esp + 0x68]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
push 0
push 0
push 1
push 0
push 0
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
xor edi, edi
jmp 0x4160fa
mov eax, dword [esp + 0x68]
mov ecx, 8
cmp dword [esp + 0x7c], ecx
jae 0x4160cf
lea eax, [esp + 0x68]
cmp dword [esi + 0x18], ecx
jb 0x4160d9
mov esi, dword [esi + 4]
jmp 0x4160dc
add esi, 4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
push edi
push edi
push 1
push edi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, 8
cmp eax, edi
jne 0x416126
cmp dword [esp + 0x7c], esi
jb 0x416111
mov eax, dword [esp + 0x68]
push eax
call fcn.00419b13
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0041a372
add esp, 0x74
ret
mov eax, dword [esp + 0x14]
cmp eax, edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x41613b
push eax
call ebx
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x41615d
cmp byte [esp + 0x90], 0
je 0x41615a
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
push eax
call ebx
cmp ebp, edi
je 0x41616a
push ebp
call fcn.00419fa6
add esp, 4
cmp dword [esp + 0x7c], esi
jb 0x41617d
mov ecx, dword [esp + 0x68]
push ecx
call fcn.00419b13
add esp, 4
mov ecx, dword [esp + 0x80]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.0041a372
add esp, 0x74
ret
Function at 0x416840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x414
mov eax, dword [0x43d504]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
mov ebx, dword [esp + 0x424]
push ebp
mov ebp, dword [esp + 0x424]
push esi
push edi
mov edi, dword [esp + 0x428]
mov esi, ecx
call dword [0x43d4dc]
xor eax, eax
push 2
push eax
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4168a3
call fcn.00414040
mov esi, eax
jmp 0x416968
push ebx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4168bc
call fcn.00414040
jmp 0x41695f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
test ebp, ebp
jne 0x4168d4
call fcn.00414040
jmp 0x41695f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x416908
lea eax, [esp + 0x20]
cmp dword [esp + 0x1c], eax
je 0x4168f8
lea ecx, [esp + 0x1c]
call fcn.00414820
lea ecx, [esp + 0x10]
call fcn.004147b0
mov eax, 0x8007000e
jmp 0x416982
push eax
lea ecx, [esp + 0x20]
call fcn.00414f00
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jne 0x416921
mov esi, 0x8007000e
jmp 0x416961
call dword [0x43d4dc]
push esi
push ebx
push esi
push ebp
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x41693f
call fcn.00414040
jmp 0x41695f
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x434]
mov word [ecx + eax*2], 0
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x1c]
call fcn.00415df0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x20]
cmp dword [esp + 0x1c], ecx
je 0x416980
lea ecx, [esp + 0x1c]
call fcn.00414820
jmp 0x416980
mov eax, esi
mov ecx, dword [esp + 0x420]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041a372
add esp, 0x414
ret 0x10
Function at 0x418910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 4]
sub esp, 0x88
push esi
push 0x436724
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x41893a
xor al, al
pop esi
add esp, 0x88
ret
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4189c2
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, dword [esp + 0x9c]
mov esi, eax
test esi, esi
je 0x4189a3
cmp dword [edi + 0x18], 8
jb 0x418973
mov eax, dword [edi + 4]
jmp 0x418976
lea eax, [edi + 4]
push 1
push 0x40
push 0x20
push eax
lea ecx, [esp + 0x1c]
call fcn.004184d0
push esi
push ebx
lea ecx, [esp + 0x14]
call fcn.00418380
lea ecx, [esp + 0xc]
call fcn.00417f50
lea ecx, [esp + 0xc]
call fcn.00418020
push edi
call fcn.004034ec
add esp, 4
xor ecx, ecx
cmp eax, esi
pop edi
jne 0x4189c2
cmp edx, ecx
jne 0x4189c2
pop ebx
mov al, 1
pop esi
add esp, 0x88
ret
pop ebx
xor al, al
pop esi
add esp, 0x88
ret

Function at 0x419a61
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x43d504]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004199f6
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0041a390
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x419ab0
cmp dword [ebp - 0x1c], 5
jb 0x419ac8
jmp 0x419ac4
cmp dword [ebp - 0x10], 1
jne 0x419ac8
cmp dword [ebp - 0x1c], 4
ja 0x419ac4
jne 0x419ac8
cmp dword [ebp - 0x18], 0
jbe 0x419ac8
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x436948
call fcn.00413860
test eax, eax
jge 0x419ae9
mov byte [0x43ec80], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041a372
add ebp, 0x78
leave
ret

Function at 0x41a372
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43d504]
jne 0x41a37c
repz ret
jmp fcn.0042229c
Function at 0x426f26
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x43d8b8]
je 0x426f41
inc edi
cmp edi, 0x17
jb 0x426f32
cmp edi, 0x17
jae 0x4270c1
push ebp
push 3
call fcn.0042d010
cmp eax, 1
pop ecx
je 0x42708d
push 3
call fcn.0042d010
test eax, eax
pop ecx
jne 0x426f75
cmp dword [0x43d510], 1
je 0x42708d
cmp ebx, 0xfc
je 0x4270c0
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x43f490
push ebp
call fcn.00421aed
add esp, 0xc
test eax, eax
je 0x426fab
push esi
push esi
push esi
push esi
push esi
call fcn.00419da9
add esp, 0x14
push 0x104
mov esi, 0x43f4a9
push esi
push 0
mov byte [0x43f5ad], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x426fef
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00421aed
add esp, 0xc
test eax, eax
je 0x426fef
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00419da9
add esp, 0x14
push esi
call fcn.0041cd10
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x427034
push esi
call fcn.0041cd10
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x43f7a4
push 0x437944
sub ecx, eax
push ecx
push eax
call fcn.0042aeb6
add esp, 0x14
test eax, eax
je 0x427034
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00419da9
add esp, 0x14
jmp 0x427036
xor esi, esi
push 0x437940
push ebx
push ebp
call fcn.0042adf6
add esp, 0xc
test eax, eax
je 0x427056
push esi
push esi
push esi
push esi
push esi
call fcn.00419da9
add esp, 0x14
push dword [edi*8 + 0x43d8bc]
push ebx
push ebp
call fcn.0042adf6
add esp, 0xc
test eax, eax
je 0x427078
push esi
push esi
push esi
push esi
push esi
call fcn.00419da9
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0042ce53
add esp, 0xc
jmp 0x4270c0
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4270c0
cmp ebp, 0xffffffff
je 0x4270c0
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x43d8bc]
push dword [esi]
call fcn.0041cd10
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x42ce53
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00421ca4
xor ebx, ebx
cmp dword [0x43fa74], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x42cf29
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x42d009
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x42d009
push eax
call fcn.00421c36
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43fa74], eax
call esi
push eax
call fcn.00421c36
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43fa78], eax
call esi
push eax
call fcn.00421c36
mov dword [0x43fa7c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00420a73
test eax, eax
pop ecx
pop ecx
je 0x42cef7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00419da9
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x42cf29
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00421c36
cmp eax, ebx
pop ecx
mov dword [0x43fa84], eax
je 0x42cf29
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00421c36
pop ecx
mov dword [0x43fa80], eax
mov eax, dword [0x43fa80]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x42cfae
cmp dword [0x43fa84], ecx
je 0x42cfae
push eax
call fcn.00421cad
push dword [0x43fa84]
mov esi, eax
call fcn.00421cad
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x42cfae
cmp edi, ebx
je 0x42cfae
call esi
cmp eax, ebx
je 0x42cf7b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42cf7b
test byte [ebp - 0x18], 1
jne 0x42cfae
lea eax, [ebp - 0x10]
push eax
call fcn.00420aaa
test eax, eax
pop ecx
je 0x42cf96
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00419da9
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x42cfa5
or dword [ebp + 0x10], 0x200000
jmp 0x42cfe9
or dword [ebp + 0x10], 0x40000
jmp 0x42cfe9
mov eax, dword [0x43fa78]
cmp eax, dword [ebp - 8]
je 0x42cfe9
push eax
call fcn.00421cad
cmp eax, ebx
pop ecx
je 0x42cfe9
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x42cfe9
mov eax, dword [0x43fa7c]
cmp eax, dword [ebp - 8]
je 0x42cfe9
push eax
call fcn.00421cad
cmp eax, ebx
pop ecx
je 0x42cfe9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43fa74]
call fcn.00421cad
cmp eax, ebx
pop ecx
je 0x42d009
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42d00b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1c1c058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01c1c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1c1c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1c1c06a
add dl, dl
jne 0x1c1c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1c1c0dc
xor eax, eax
add dl, dl
jne 0x1c1c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1c1c17d
add dl, dl
jne 0x1c1c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c1c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c1c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c1c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1c1c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1c1c075
mov eax, 1
add dl, dl
jne 0x1c1c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c1c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1c1c0e1
sub eax, ebx
mov ebx, 1
jne 0x1c1c128
mov ecx, 1
add dl, dl
jne 0x1c1c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1c1c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1c1c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1c1c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1c1c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1c1c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1c1c136
cmp eax, 0x7d00
jae 0x1c1c16d
cmp eax, 0x500
jb 0x1c1c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1c1c075
cmp eax, 0x7f
ja 0x1c1c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1c1c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1c1c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1c1c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x445710
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6d20
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5569c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
push 8
mov dword [ebx], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.004b259f
mov edi, eax
add esp, 4
test edi, edi
je 0x4457bd
push 1
mov dword [ebp - 4], 0
call fcn.004b0dba
add esp, 4
mov dword [edi + 4], eax
jmp 0x4457bf
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.00447890
mov dword [esi + 0xc], ebx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea edx, [esi + 0x18]
mov byte [esi + 0x48], 0
lea edi, [esi + 0x24]
mov byte [esi + 0x3d], 0
lea ebx, [esi + 0x28]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
mov dword [eax], 0
mov dword [edx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0
mov dword [ecx], 0
mov dword [edi], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x55a7f4]
mov ecx, dword [0x55a7f8]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448bf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6fdd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x5569c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.004b259f
mov edi, eax
add esp, 4
test edi, edi
je 0x448c8d
push 1
mov dword [ebp - 4], 0
call fcn.004b0dba
add esp, 4
mov dword [edi + 4], eax
jmp 0x448c8f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.00445580
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x448cea
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x448cea
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x448d06
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x448d29
cmp byte [ebp + 0xc], 0
je 0x448d15
push esi
call fcn.004b1df1
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x448d35
mov esi, str.ios_base::badbit_set
jmp 0x448d45
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.00441820
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.0043d600
push 0x543294
lea eax, [ebp - 0x28]
push eax
call fcn.004b3d03
int3
Function at 0x451ba0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x55aa08], 0
push esi
mov esi, ecx
jne 0x451be2
xor eax, eax
nop
mov edx, eax
mov cl, al
and dl, 0x80
neg dl
sbb dl, dl
add cl, cl
and dl, 0x1d
xor dl, cl
movzx ecx, dl
xor ecx, eax
mov byte [eax + 0x55a808], dl
mov byte [ecx + 0x55a908], al
inc eax
cmp eax, 0x100
jb 0x451bb0
mov byte [0x55aa08], 1
mov eax, esi
pop esi
ret

Function at 0x451bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
mov eax, edi
mov dword [ebp - 4], esi
imul eax, edx
mov dword [ebp - 8], eax
test edi, edi
je 0x451c8b
push ebx
mov eax, esi
mov ecx, esi
shr eax, 1
and ecx, 1
imul eax, dword [ebp + 0x18]
xor bh, bh
xor bl, bl
add eax, ecx
test edx, edx
je 0x451c61
mov esi, dword [ebp - 8]
mov edi, edx
nop dword [eax]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x1c]
add edx, eax
xor bl, byte [eax + ecx]
movzx ecx, byte [eax + ecx]
movzx eax, bh
xor ecx, eax
mov eax, edx
sub eax, esi
cmp edx, esi
cmovb eax, edx
mov bh, byte [ecx + 0x55a808]
sub edi, 1
jne 0x451c30
mov esi, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
movzx eax, bh
movzx ecx, byte [eax + 0x55a808]
movzx eax, bl
xor ecx, eax
mov eax, dword [ebp + 8]
add eax, esi
inc esi
mov dword [ebp - 4], esi
mov cl, byte [ecx + 0x55a908]
mov byte [eax], cl
xor cl, bl
mov byte [eax + edi], cl
cmp esi, edi
jb 0x451c10
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x455130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
push esi
cmp dword [ebp + 0x14], eax
je 0x455168
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea ecx, [ecx + 0x4f2d20]
mov dword [ebp - 4], ecx
sub edi, ebx
mov esi, dword [ebp - 4]
lea edx, [eax + ebx]
mov cl, byte [edi + edx]
xor cl, byte [esi + eax]
inc eax
mov byte [edx], cl
cmp eax, dword [ebp + 0x14]
jb 0x455152
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4605b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
xorps xmm0, xmm0
push esi
mov esi, ecx
movlpd qword [ebp - 8], xmm0
jb 0x460613
ja 0x4605cf
cmp dword [ebp + 0xc], 0
jbe 0x460613
push ebx
mov ebx, dword [ebp - 4]
push edi
mov edi, dword [ebp - 8]
nop word [eax + eax]
mov eax, dword [ebp + 8]
movzx edx, word [esi]
movzx ecx, byte [edi + eax]
mov eax, edx
shr eax, 8
xor ecx, eax
shl edx, 8
xor dx, word [ecx*2 + 0x4f40f8]
add edi, 1
mov word [esi], dx
adc ebx, 0
cmp ebx, dword [ebp + 0x10]
jb 0x4605e0
ja 0x460611
cmp edi, dword [ebp + 0xc]
jb 0x4605e0
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46d6a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9845
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5569c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov ecx, dword [esi]
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], 0
mov eax, dword [ecx + 4]
lea ecx, [ebx + 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp + 0xc], ecx
cmp byte [eax + 0xd], 0
jne 0x46d751
mov esi, eax
mov eax, dword [ecx]
mov dword [ebp - 0x1c], eax
nop word [eax + eax]
cmp dword [ebx + 0x14], 0xf
lea eax, [esi + 0x10]
mov dword [ebp - 0x14], esi
mov ecx, ebx
jbe 0x46d710
mov ecx, dword [ebx]
cmp dword [eax + 0x14], 0xf
mov edx, dword [eax + 0x10]
jbe 0x46d71b
mov eax, dword [eax]
push dword [ebp - 0x1c]
push ecx
push edx
push eax
call fcn.00455c50
add esp, 0x10
test eax, eax
je 0x46d73b
jns 0x46d73b
mov esi, dword [esi + 8]
mov dword [ebp - 0x10], 0
jmp 0x46d746
mov edi, esi
mov dword [ebp - 0x10], 1
mov esi, dword [esi]
cmp byte [esi + 0xd], 0
je 0x46d700
mov esi, dword [ebp - 0x18]
jmp 0x46d754
mov dword [ebp + 0xc], ecx
cmp byte [edi + 0xd], 0
jne 0x46d7a5
cmp dword [edi + 0x24], 0xf
lea eax, [edi + 0x10]
mov edx, dword [eax + 0x10]
jbe 0x46d768
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0xf
mov ecx, ebx
jbe 0x46d772
mov ecx, dword [ebx]
push edx
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
push ecx
call fcn.00455c50
add esp, 0x10
test eax, eax
je 0x46d788
js 0x46d7a5
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 4], 0x4ec4ec4
je 0x46d836
mov dword [ebp - 0x20], esi
push 0x34
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.004b259f
mov edi, eax
add esp, 4
mov dword [ebp - 0x1c], edi
push ebx
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 1
call fcn.004459c0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
push edi
push dword [ebp - 0x10]
mov dword [edi + 0x28], 0
push dword [ebp - 0x14]
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov word [edi + 0xc], 0
call fcn.00458230
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00458690
int3