joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e1ab
Capabilities:
Set registry value

Disassembly:
push ebp
sub esp, 0x300
lea ebp, [esp - 4]
mov eax, dword [0x4f9590]
xor eax, ebp
mov dword [ebp + 0x300], eax
push 0x20
mov eax, 0x4c5950
call fcn.00494508
mov eax, dword [ebp + 0x310]
mov esi, dword [ebp + 0x30c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x314]
xor ebx, ebx
push 0xff
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x201]
push ebx
push eax
mov byte [ebp + 0x200], bl
call fcn.00493f80
add esp, 0xc
push ebx
push ebx
mov edi, 0x100
push edi
lea eax, [ebp + 0x200]
push eax
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
call esi
push 0xff
lea eax, [ebp + 1]
push ebx
push eax
mov byte [ebp], bl
call fcn.00493f80
add esp, 0xc
push ebx
push ebx
push edi
lea eax, [ebp]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x10]
push ebx
push ebx
call esi
push 5
lea eax, [ebp + 0x200]
push str.HKCR_
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
call fcn.004b6c8e
add esp, 0xc
test eax, eax
jne 0x44e273
mov dword [ebp - 0x10], SysReAllocString
push str.HKCR_
jmp 0x44e2c1
push 5
lea eax, [ebp + 0x200]
push str.HKCU_
push eax
call fcn.004b6c8e
add esp, 0xc
test eax, eax
jne 0x44e29b
mov dword [ebp - 0x10], SysReAllocString
push str.HKCU_
jmp 0x44e2c1
push 5
lea eax, [ebp + 0x200]
push str.HKLM_
push eax
call fcn.004b6c8e
add esp, 0xc
test eax, eax
jne 0x44e2d1
mov dword [ebp - 0x10], reloc.OLEAUT32.dll_SysReAllocString
push str.HKLM_
call fcn.00494a70
lea eax, [ebp + eax + 0x200]
pop ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x14], ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x44e308
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 0x14], ebx
je 0x44e3bc
push 0xff
lea eax, [ebp + 0x101]
push ebx
push eax
mov byte [ebp + 0x100], bl
call fcn.00493f80
add esp, 0xc
push ebx
push ebx
push edi
lea eax, [ebp + 0x100]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x24]
push ebx
push ebx
call esi
lea eax, [ebp + 0x100]
push eax
lea ecx, [ebp - 0x20]
call fcn.00472760
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], ebx
call fcn.004109b0
add esp, 0xc
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.004727f0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00472740
lea ecx, [ebp - 0x20]
call fcn.004724c0
push eax
push ebx
lea ecx, [ebp - 0x20]
call fcn.004731d0
push eax
push 1
push ebx
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x20]
call fcn.00473260
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00472740
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x300]
xor ecx, ebp
call fcn.004944f9
add ebp, 0x304
leave
ret 0xc
Function at 0x44e3e1
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x4c5980
call fcn.00494508
mov esi, ecx
push str.in_USER_BeginInstall__
lea ecx, [ebp - 0x18]
call fcn.00472760
lea eax, [ebp - 0x18]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.00411cd0
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x18]
call fcn.00472740
cmp dword [esi + 0xa50], edi
jne 0x44e43b
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push 0x434565
push edi
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xa50], eax
call fcn.004945e0
ret
Function at 0x44e814
Capabilities:
Check internet connectivity via wininet

Disassembly:
push 0xc
mov eax, 0x4c5980
call fcn.00494508
push str.in_USER_IsConnect__
lea ecx, [ebp - 0x18]
call fcn.00472760
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
call fcn.00411cd0
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x18]
call fcn.00472740
mov esi, dword [ebp + 8]
test esi, esi
je 0x44e873
and dword [esi + 8], 0
and dword [ebp - 0x10], 0
push 3
pop eax
mov word [esi], ax
push 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x44e873
mov dword [esi + 8], 1
call fcn.004945e0
ret 4

Function at 0x44ebdc
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0xc0]
sub esp, 0x140
mov eax, dword [0x4f9590]
xor eax, ebp
mov dword [ebp + 0xbc], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc8]
mov esi, 0xff
xor ebx, ebx
push esi
lea eax, [ebp - 0x43]
push ebx
push eax
mov byte [ebp - 0x44], bl
call fcn.00493f80
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x44]
push eax
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 7
lea eax, [ebp - 0x44]
push str.http:__
push eax
call fcn.004b6c8e
add esp, 0xc
test eax, eax
je 0x44ec58
push 8
lea eax, [ebp - 0x44]
push str.https:__
push eax
call fcn.004b6c8e
add esp, 0xc
test eax, eax
jne 0x44eca9
push 0x38
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.00493f80
lea eax, [ebp - 0x44]
mov dword [ebp - 0x70], eax
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x440
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], str.open
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x44eca9
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xbc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004944f9
add ebp, 0xc0
leave
ret 8
Function at 0x468dec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x468e33
cmp edx, 0x10
jl 0x468e1f
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x468e0c
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x468e33
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x468e2b
and edx, 3
cmp edx, 3
jne 0x468e47
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x468e4c
cmp edx, 2
jne 0x468e58
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x468e5d
cmp edx, 1
jne 0x468e63
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x46dc80
Capabilities:
Get system information on windows

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0xe8], 0
jne 0x46dce9
xor eax, eax
mov dword [edi + 0x24], eax
push esi
lea esi, [edi + 0x24]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
push str.GetNativeSystemInfo
mov dword [esi + 0x1c], eax
push 0x4cd9d8
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
test eax, eax
je 0x46dcd8
call eax
pop esi
mov dword [edi + 0xe8], 1
pop edi
ret
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [edi + 0xe8], 1
pop esi
pop edi
ret

Function at 0x46dcf0
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test ebx, ebx
jne 0x46dd85
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 8]
push ecx
lea edx, [esi + 0x104]
push edx
push eax
push eax
mov eax, dword [ebp - 4]
push str.MHz
push eax
call edi
mov ecx, dword [esi + 0xf4]
push ecx
call fcn.0049377b
push 0x100
mov dword [esi + 0xf4], ebx
call fcn.00493ffa
add esp, 8
mov dword [esi + 0xf4], eax
mov byte [eax], bl
mov eax, dword [esi + 0xf4]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
push eax
push ebx
push ebx
push str.ProcessorNameString
push ecx
mov dword [ebp - 0xc], 0x100
call edi
pop edi
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg ebx
sbb eax, eax
pop esi
and eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e6f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4f9590]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov eax, dword [ebx + 0xf8]
push edi
push eax
call fcn.0049377b
mov edi, 0x100
push edi
mov dword [ebx + 0xf8], 0
call fcn.00493ffa
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
add esp, 8
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x104]
push edx
mov dword [ebx + 0xf8], eax
mov byte [eax], 0
push 1
mov dword [ebp - 0x108], edi
call esi
mov edx, dword [ebx + 0xf8]
lea ecx, [ebp - 0x104]
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x46e760
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 2
mov dword [ebp - 0x10c], edi
call esi
cmp dword [ebp - 0x10c], 0
je 0x46e7dd
mov edi, dword [ebx + 0xf8]
add edi, dword [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x46e798
mov dx, word [0x4cd9c8]
lea eax, [ebp - 0x104]
mov word [edi], dx
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46e7b2
mov edi, dword [ebp - 0x108]
sub eax, esi
add edi, dword [ebx + 0xf8]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46e7c7
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004944f9
mov esp, ebp
pop ebp
ret
Function at 0x46e7f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4f9590]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push eax
lea eax, [ebp - 0x404]
push 0x4db3f0
push eax
mov dword [ebp - 0x408], 0x80004005
call fcn.0049543b
lea ecx, [ebp - 0x404]
push 0x4d5084
push ecx
call fcn.00493860
xor ebx, ebx
add esp, 0x14
mov dword [ebp - 0x420], eax
cmp eax, ebx
jne 0x46e859
mov eax, 0x80040082
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004944f9
mov esp, ebp
pop ebp
ret 4
push esi
push edi
lea edx, [ebp - 0x40c]
push edx
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
xor edi, edi
lea esp, [esp]
cmp esi, ebx
je 0x46e890
cmp esi, 0xea
jne 0x46e9d4
cmp dword [ebp - 0x408], ebx
je 0x46e9d4
push 0xff
lea eax, [ebp - 0x103]
push ebx
push eax
mov byte [ebp - 0x104], bl
call fcn.00493f80
mov eax, dword [ebp - 0x40c]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x104]
push edx
push edi
push eax
mov dword [ebp - 0x41c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
inc edi
cmp esi, ebx
jne 0x46e884
push 0xff
lea ecx, [ebp - 0x203]
push ebx
push ecx
mov byte [ebp - 0x204], bl
call fcn.00493f80
lea edx, [ebp - 0x104]
push edx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
lea eax, [ebp - 0x204]
push 0x4cdcc8
push eax
call fcn.0049543b
add esp, 0x1c
lea ecx, [ebp - 0x410]
push ecx
push 0x20019
push ebx
lea edx, [ebp - 0x204]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x414], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46e880
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x410]
lea ecx, [ebp - 0x304]
push ecx
lea edx, [ebp - 0x418]
push edx
push ebx
push str.ServiceName
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x414], ebx
jbe 0x46e9c2
mov eax, dword [ebp - 0x420]
lea ecx, [ebp - 0x304]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x46e9b3
cmp dl, bl
je 0x46e9af
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x46e9b3
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x46e993
xor eax, eax
jmp 0x46e9b8
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x46e9c2
mov dword [ebp - 0x408], ebx
mov ecx, dword [ebp - 0x410]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46e880
mov edx, dword [ebp - 0x40c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x408]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004944f9
mov esp, ebp
pop ebp
ret 4
Function at 0x4706c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4f9590]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.00493f80
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 6
push 0xc
jb 0x470738
call fcn.00493ffa
add esp, 4
test eax, eax
je 0x47072c
mov ecx, eax
call fcn.004709f0
push eax
mov ecx, esi
call fcn.004705c0
jmp 0x470757
xor eax, eax
push eax
mov ecx, esi
call fcn.004705c0
jmp 0x470757
call fcn.00493ffa
add esp, 4
test eax, eax
je 0x47074d
mov ecx, eax
call fcn.00471650
jmp 0x47074f
xor eax, eax
push eax
mov ecx, esi
call fcn.00470640
mov eax, dword [esi]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
xor ecx, ebp
add eax, 0x8007000e
pop esi
call fcn.004944f9
mov esp, ebp
pop ebp
ret
Function at 0x474d70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x18
mov dword [ebp - 4], 0
call fcn.00493ffa
add esp, 4
test eax, eax
je 0x474d97
mov ecx, eax
call fcn.004bb530
mov esi, eax
test esi, esi
jne 0x474da3
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push ebx
push edi
push esi
call ecx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x474dd9
mov edi, dword [ebp + 0x10]
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push edi
push esi
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x1c]
push ebx
push edi
push 1
push esi
call edx
push eax
call fcn.0049a72e
add esp, 0x10
test eax, eax
jns 0x474de2
xor eax, eax
mov edi, 0x80004005
jmp 0x474de5
mov edi, dword [ebp - 4]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x14]
push eax
push esi
call edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push esi
push edi
push eax
call edx
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x474e20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x4f9590]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x4cfa48
push eax
call fcn.00494fff
mov esi, eax
add esp, 8
test esi, esi
je 0x474ea4
push esi
call fcn.0049a494
add esp, 4
test eax, eax
jne 0x474e9b
lea esp, [esp]
push esi
push 0x200
lea eax, [ebp - 0x204]
push 1
push eax
call fcn.0049a72e
add esp, 0x10
test eax, eax
jle 0x474e8e
push edi
push eax
lea ecx, [ebp - 0x204]
push 1
push ecx
call fcn.0049ac5a
add esp, 0x10
push esi
call fcn.0049a494
add esp, 4
test eax, eax
je 0x474e60
push esi
call fcn.00494b68
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004944f9
mov esp, ebp
pop ebp
ret
Function at 0x475630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0xc]
call fcn.004724b0
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
mov edx, dword [esi + 0x58]
push edx
mov edx, dword [esi + 0x54]
push edx
mov edx, dword [esi + 0x40]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
mov edx, dword [ebp - 4]
test edx, edx
jle 0x4757d7
lea esp, [esp]
mov eax, dword [esi + 0x4c]
sub eax, 0
je 0x4756df
dec eax
jne 0x4757b1
mov ecx, dword [esi + 0x5c]
cmp ecx, dword [esi + 0x60]
jle 0x4756b2
mov ecx, dword [esi + 0x48]
push ecx
push edx
mov edx, dword [esi + 0x40]
push 1
push edx
call fcn.0049ac5a
add dword [esi + 0x60], eax
mov ecx, dword [esi + 0x5c]
mov eax, ecx
sub eax, dword [esi + 0x60]
add esp, 0x10
cmp eax, 0x8000
jge 0x4756af
mov dword [esi + 0x58], eax
cmp ecx, dword [esi + 0x60]
jne 0x4757b1
mov eax, dword [esi + 0x48]
test eax, eax
je 0x4756c8
push eax
call fcn.00494b68
add esp, 4
mov eax, 0x200
mov dword [esi + 0x4c], 0
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
jmp 0x4757b1
mov eax, dword [str.rnempty0]
mov edi, dword [esi + 0x40]
push eax
lea ecx, [ebp - 0x14]
mov dword [esi + 0x50], edi
call fcn.00472760
cmp byte [eax + 7], 0xff
jne 0x4756fb
mov eax, dword [eax]
push edi
push eax
call fcn.004948c4
add esp, 8
test eax, eax
lea ecx, [ebp - 0x14]
sete bl
call fcn.00472740
lea ecx, [ebp - 0xc]
push ecx
test bl, bl
je 0x47574c
mov edx, dword [esi + 0x50]
mov eax, dword [esi + 0x14]
add edx, 0x159
push edx
push eax
call fcn.00474f50
add esp, 0xc
test eax, eax
jns 0x4757b1
lea ecx, [ebp - 0xc]
mov byte [esi + 0x20], 5
call fcn.00472740
pop edi
pop esi
mov eax, 0x8004008a
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x14]
push eax
add eax, 0x159
push eax
push edx
call fcn.00475110
xor edi, edi
add esp, 0x10
mov dword [esi + 0x48], eax
cmp eax, edi
je 0x475734
mov eax, dword [esi + 0x50]
add eax, 0x7c
push 0xb
push eax
call fcn.00474f10
add esp, 8
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], edi
cmp eax, edi
jle 0x4757a5
mov dword [esi + 0x4c], 1
mov dword [esi + 0x54], edi
cmp eax, 0x8000
jge 0x47579c
mov dword [esi + 0x58], eax
jmp 0x4757b1
mov dword [esi + 0x58], 0x8000
jmp 0x4757b1
mov ecx, dword [esi + 0x48]
push ecx
call fcn.00494b68
add esp, 4
mov eax, dword [esi + 0x3c]
mov edx, dword [eax]
mov edx, dword [edx + 0x24]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [esi + 0x58]
push ecx
mov ecx, dword [esi + 0x54]
push ecx
mov ecx, dword [esi + 0x40]
push ecx
push eax
call edx
mov edx, dword [ebp - 4]
test edx, edx
jg 0x475670
lea ecx, [ebp - 0xc]
call fcn.00472740
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4757f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 0x38]
push ebx
call fcn.00478e70
xor edi, edi
cmp dword [esi + 0x44], edi
je 0x47581b
mov eax, dword [esi + 0x44]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push eax
call edx
mov edi, eax
lea ecx, [ebp - 0x30]
call fcn.0047d960
push edi
lea eax, [ebp - 0x30]
push eax
call fcn.0047dbe0
test edi, edi
je 0x475847
mov esi, dword [esi + 0x44]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x1c]
push edi
push esi
call edx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0047de50
push ebx
lea ecx, [ebp - 0x30]
push ecx
call fcn.0047d190
push eax
push 1
lea edx, [ebp - 0x30]
push edx
call fcn.0047d170
push eax
call fcn.0049ac5a
add esp, 0x10
lea ecx, [ebp - 0x30]
call fcn.0047d9d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x476080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4f9590]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [eax + 0x40]
push edi
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], eax
call fcn.004724b0
cmp byte [ebx], 0
push edi
je 0x4760c9
push 0x5c
push ebx
lea eax, [ebp - 0x30]
push str._s_c_s
push eax
call fcn.00473410
add esp, 0x14
jmp 0x4760d1
lea ecx, [ebp - 0x30]
call fcn.00472890
cmp byte [ebp - 0x29], 0xff
lea eax, [ebp - 0x30]
jne 0x4760dd
mov eax, dword [ebp - 0x30]
push 0x4cfa48
push eax
call fcn.00494fff
add esp, 8
mov ebx, eax
push edi
test ebx, ebx
jne 0x47610d
push str.Cant_open_file__s_for_reading__skipping_n
call fcn.0049c25c
add eax, 0x40
push eax
call fcn.004966ab
add esp, 0xc
jmp 0x4761ff
push str.Processing_file__s_for_compression_n
call fcn.0049c25c
add eax, 0x20
push eax
call fcn.004966ab
push 0x200
push 0
push esi
call fcn.00493f80
add esp, 0x18
cmp byte [ebp - 0x29], 0xff
lea eax, [ebp - 0x30]
jne 0x47613c
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
push edi
push ecx
lea ecx, [ebp - 0x28]
mov edx, esi
call fcn.00475880
add esp, 8
mov dword [ebp - 0x34], eax
test eax, eax
jns 0x47618e
push edi
push str.Cant_stat__s__skipping_n
call fcn.0049c25c
add eax, 0x40
push eax
call fcn.004966ab
push ebx
call fcn.00494b68
add esp, 0x10
lea ecx, [ebp - 0x30]
call fcn.00472740
mov eax, dword [ebp - 0x34]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004944f9
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x14]
push edx
push edi
mov edi, dword [ebp - 0x38]
mov ecx, dword [edi + 0x38]
call fcn.00478e20
mov eax, dword [edi + 0x3c]
mov ecx, dword [eax]
lea edx, [ebp - 0x3c]
push edx
push 0x200
push esi
push eax
mov eax, dword [ecx + 0x14]
call eax
push ebx
call fcn.0049a494
add esp, 4
test eax, eax
jne 0x4761f6
push ebx
push 0x8000
push 1
push esi
call fcn.0049a72e
add esp, 0x10
test eax, eax
jle 0x4761e9
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea edi, [ebp - 0x3c]
push edi
push eax
mov eax, dword [edx + 0x14]
push esi
push ecx
call eax
mov edi, dword [ebp - 0x38]
push ebx
call fcn.0049a494
add esp, 4
test eax, eax
je 0x4761c0
push ebx
call fcn.00494b68
add esp, 4
lea ecx, [ebp - 0x30]
call fcn.00472740
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004944f9
mov esp, ebp
pop ebp
ret
Function at 0x476920
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4fd8f4], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
mov esi, ecx
je 0x476950
call ebx
sub eax, dword [0x4fd8f4]
cmp eax, 0xc8
jae 0x476950
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x1c]
push edi
xor edi, edi
test eax, eax
je 0x4769b8
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], edi
mov ecx, dword [eax]
push 0x4dade8
push eax
mov eax, dword [ecx]
call eax
cmp dword [ebp - 4], edi
je 0x4769b8
call ebx
mov edx, dword [ebp + 8]
mov dword [0x4fd8f4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov edi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x476999
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp edi, 0x80040088
jne 0x4769b8
mov eax, dword [esi + 0x44]
test eax, eax
je 0x4769b8
push eax
call fcn.00494b68
add esp, 4
mov dword [esi + 0x44], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x477b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 0x38]
push ebx
call fcn.00478e70
xor edi, edi
cmp dword [esi + 0x40], edi
je 0x477b4b
mov eax, dword [esi + 0x40]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push eax
call edx
mov edi, eax
lea ecx, [ebp - 0x30]
call fcn.0047d960
push edi
lea eax, [ebp - 0x30]
push eax
call fcn.0047dbe0
test edi, edi
je 0x477b77
mov esi, dword [esi + 0x40]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x1c]
push edi
push esi
call edx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0047de50
push ebx
lea ecx, [ebp - 0x30]
push ecx
call fcn.0047d190
push eax
push 1
lea edx, [ebp - 0x30]
push edx
call fcn.0047d170
push eax
call fcn.0049ac5a
add esp, 0x10
lea ecx, [ebp - 0x30]
call fcn.0047d9d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4