joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455430
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x70ca88], eax
je 0x45544e
mov eax, 0x10dd
jmp 0x455530
mov eax, dword [0x70ca98]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4554cd
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
xor eax, eax
mov al, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x4554ab
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x10], 0
je 0x4554ab
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call fcn.004555a0
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.0045d0e4
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x455456
mov dword [0x70ca98], 0
call fcn.00455540
mov ecx, dword [0x70ca94]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x45551a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0045d0e4
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x4554e5
mov dword [0x70ca94], 0
mov dword [0x70ca88], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x455aa0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x455ab5
xor eax, eax
jmp 0x455b2a
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x10000
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x455ae2
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x38d
jae 0x455b25
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
cmp dword [eax + edx + 0x40], 0
je 0x455b23
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x455b1f
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x455b23
xor eax, eax
jmp 0x455b2a
jmp 0x455ad9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x455be0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x70ca8c], 0
je 0x455bf9
mov eax, dword [0x70ca8c]
jmp 0x455c99
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x455c0b
xor eax, eax
jmp 0x455c99
push 8
call fcn.0045d148
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x455c61
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x455c4a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0045d0e4
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x70ca8c], eax
mov dword [0x70ca90], 0
mov eax, dword [ebp - 8]
jmp 0x455c99
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x455c7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x455c2b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x70ca94]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x70ca94], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4564e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.004565b0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x45659c
cmp dword [ebp - 4], 0x50000000
jb 0x45651c
cmp dword [ebp - 4], 0x80000000
ja 0x45651c
mov dword [ebp - 4], 0x80010000
jmp 0x4564f5
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.0045d0f0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x456542
jmp 0x45659c
cmp dword [ebp - 0x10], 0x10000
jne 0x456585
cmp dword [ebp - 0x14], 0x10000
jb 0x456585
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x456578
mov eax, dword [ebp - 0x24]
jmp 0x45659e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x456597
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.004565b0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4564f5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4565f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.004566c0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x4566b4
cmp dword [ebp - 4], 0x50000000
jb 0x456631
cmp dword [ebp - 4], 0x80000000
ja 0x456631
mov dword [ebp - 4], 0x4fff0000
jmp 0x45660a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.0045d0f0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x456657
jmp 0x4566b4
cmp dword [ebp - 0x10], 0x10000
jne 0x45669a
cmp dword [ebp - 0x14], 0x10000
jb 0x45669a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x45668d
mov eax, dword [ebp - 0x24]
jmp 0x4566b6
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x4566af
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.004566c0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x45660a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x457550
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x45756e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x457563
pop esi
ret
Function at 0x457650
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.0045b7b0
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x4577a0
test ecx, ecx
je 0x4577a0
inc ecx
push ecx
call fcn.0045d148
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0045d2f0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4576c9
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x45778d
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.0045d148
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x457751
cmp eax, 0xea
jne 0x457779
push esi
call fcn.0045d0e4
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0045d148
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x45771c
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x45775f
cmp eax, 2
jne 0x457779
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.0045b720
add esp, 8
mov dword [esp + 0x10], eax
push esi
call fcn.0045d0e4
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.0045d0e4
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x4577ce
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x4577da
mov edx, dword [esp + 0x40]
test edx, edx
je 0x4577da
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.0045b720
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4578a0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x28]
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
cmp eax, 0x80000301
push edi
ja 0x457920
je 0x457911
cmp eax, 0x80000101
ja 0x45790a
je 0x457911
cmp eax, reloc.WS2_32.dll_connect
je 0x4578ed
cmp eax, 0x80000005
jne 0x457935
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], 3
test eax, eax
je 0x45797b
mov ebx, dword [eax + 4]
lea ebp, [eax + 8]
jmp 0x45797b
mov ebp, dword [esp + 0x44]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 1
mov ebx, ecx
inc ebx
jmp 0x45797b
cmp eax, 0x80000201
jne 0x457935
mov ebx, 4
lea ebp, [esp + 0x44]
mov dword [esp + 0xc], ebx
jmp 0x45797b
cmp eax, 0x80000401
je 0x457966
cmp eax, 0x80000501
je 0x457952
cmp eax, 0x80000601
je 0x45793e
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
fld qword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
call fcn.0045d1ec
jmp 0x457973
fld dword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
call fcn.0045d1ec
jmp 0x457973
mov eax, dword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
lea ebp, [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0045b7b0
mov edi, dword [esp + 0x3c]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x20], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], 0
test edx, edx
je 0x457a56
test ecx, ecx
je 0x457a56
inc ecx
push esi
push ecx
call fcn.0045d148
mov edi, dword [esp + 0x40]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x2c], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0045d2f0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4579f8
mov byte [esi], 0
inc esi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x457a4c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x457a41
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.0045d0e4
add esp, 4
pop esi
mov eax, dword [esp + 0x18]
pop edi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x457a70
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret
Function at 0x458140
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x458168
pop edi
or eax, eax
pop esi
ret
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], 0xffffffff
jne 0x45818a
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, edi
pop edi
pop esi
ret

Function at 0x458190
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x144
push ebx
mov ebx, dword [esp + 0x14c]
push ebp
mov ebp, dword [esp + 0x15c]
push esi
push edi
mov esi, dword [ebp]
mov dword [esp + 0x10], 0
test ebx, ebx
je 0x45821b
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x45821b
test esi, esi
je 0x4581d5
cmp esi, 0xffffffff
je 0x4581d5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp], esi
je 0x458261
mov eax, dword [esp + 0x160]
test eax, eax
je 0x458204
mov ecx, dword [esp + 0x14]
and ecx, 0x10
cmp cl, 0x10
je 0x45821b
jmp 0x458213
mov edx, dword [esp + 0x15c]
mov eax, dword [esp + 0x14]
test edx, eax
je 0x45821b
mov dword [esp + 0x10], 1
test esi, esi
je 0x458261
cmp esi, 0xffffffff
je 0x458261
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x458298
mov eax, dword [esp + 0x160]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x14]
push eax
push esi
je 0x45826e
call edi
test eax, eax
je 0x458261
mov ecx, dword [esp + 0x14]
and ecx, 0x10
cmp cl, 0x10
jne 0x458298
lea edx, [esp + 0x14]
push edx
push esi
call edi
test eax, eax
jne 0x458249
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x144
ret
call edi
test eax, eax
je 0x458261
mov ebx, dword [esp + 0x15c]
test dword [esp + 0x14], ebx
jne 0x458298
lea ecx, [esp + 0x14]
push ecx
push esi
call edi
test eax, eax
jne 0x45827b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00456fe0
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret

Function at 0x458300
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret
Function at 0x458570
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x45857d
xor eax, eax
pop esi
ret
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
jne 0x45858f
pop esi
ret
cmp ecx, 1
jne 0x45859d
cmp byte [esi], 0x5c
jne 0x45859d
xor eax, eax
pop esi
ret
push esi
call fcn.00458320
add esp, 4
test eax, eax
je 0x4585b1
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x4585c0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x458629
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.00456fe0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x458630
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
test ebx, ebx
push edi
jne 0x458643
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push ebx
call fcn.0045bfb0
add esp, 4
test eax, eax
jne 0x458655
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, dword [esp + 0x24]
test edi, edi
jg 0x458664
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [ebx]
xor esi, esi
cmp eax, 1
jne 0x4586bb
mov ebx, dword [ebx + 4]
push edi
call fcn.0045d148
add esp, 4
mov ebp, eax
lea eax, [esp + 0x18]
push esi
push eax
push edi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x45869e
push ebp
call fcn.0045d0e4
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
push ecx
push ebp
call fcn.0045b920
push ebp
mov esi, eax
call fcn.0045d0e4
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x4586fd
mov ebx, dword [ebx + 4]
lea edx, [edi + 8]
push edx
call fcn.00456fe0
mov esi, eax
add esp, 4
lea ecx, [esi + 8]
mov dword [esi], 1
mov dword [esi + 4], edi
mov eax, dword [ebx]
push edi
push ecx
mov ecx, ebx
call dword [eax + 0x20]
test eax, eax
jne 0x4586fa
push esi
call fcn.00457070
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x458770
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x458783
xor eax, eax
pop esi
add esp, 8
ret
push esi
call fcn.0045bfb0
add esp, 4
test eax, eax
jne 0x458795
pop esi
add esp, 8
ret
mov eax, dword [esi]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push edi
mov dword [esp + 0x10], 0
jne 0x45880c
mov eax, dword [esp + 0x1c]
mov edi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x45883e
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x4587f8
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x4587c8
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
pop edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 8
ret
cmp eax, 2
jne 0x45883e
mov eax, dword [esp + 0x1c]
mov esi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x45883e
lea edi, [esp + 0x2c]
lea ebx, [eax - 1]
mov eax, dword [edi]
mov edx, dword [esi]
mov ecx, dword [eax + 4]
add eax, 8
push ecx
push eax
mov ecx, esi
call dword [edx + 0x24]
add edi, 0xc
dec ebx
jne 0x458827
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret

Function at 0x458850
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x1c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x45887a
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x45887a
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
ret

Function at 0x459c20
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.0045d148
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x459c8a
push esi
lea edi, [eax + 0x400]
call fcn.0045d0e4
push edi
call fcn.0045d148
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x459c5a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x459ca6
push ecx
push esi
call fcn.0045b720
add esp, 8
mov ebx, eax
push esi
call fcn.0045d0e4
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x45b270
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x45b302
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x45b2f4
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x45b2ec
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x45b2b5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0xaad108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00aad258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xaad12e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaad11a
add dl, dl
jne 0xaad139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaad18c
xor eax, eax
add dl, dl
jne 0xaad146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaad22d
add dl, dl
jne 0xaad155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaad160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaad16b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaad176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xaad182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xaad125
mov eax, 1
add dl, dl
jne 0xaad19a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaad1a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaad191
sub eax, ebx
mov ebx, 1
jne 0xaad1d8
mov ecx, 1
add dl, dl
jne 0xaad1be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaad1c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaad1b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaad125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xaad1ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaad1fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaad1e6
cmp eax, 0x7d00
jae 0xaad21d
cmp eax, 0x500
jb 0xaad218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaad125
cmp eax, 0x7f
ja 0xaad220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaad125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xaad24e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xaad125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10