joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e850
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472ee8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [edi + 0xf0]
mov eax, dword [edx + 0x30]
mov ecx, dword [edx + 0x34]
mov dword [ebp - 0x24], eax
add eax, 1
mov dword [edx + 0x30], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], ecx
adc ecx, 0
push eax
lea eax, [ebp - 0x1c]
mov dword [edx + 0x34], ecx
push eax
lea ecx, [edi + 0xe0]
call fcn.00422870
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x58], 0xf
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x40], 0xf
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov esi, dword [ebx + 0x14]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x5c], 0
mov byte [ebp - 0x6c], 0
mov dword [ebp - 0x44], 0
mov byte [ebp - 0x54], 0
cmp esi, dword [ebx + 0x18]
je 0x41e944
mov ecx, dword [ebp - 0x70]
mov dword [esi], eax
mov eax, dword [ebp - 0x74]
mov dword [esi + 8], eax
lea eax, [ebp - 0x6c]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
push eax
mov dword [ebp - 0x14], esi
mov dword [esi + 4], edx
mov dword [ebp - 0x18], ecx
call fcn.00405f50
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 2
lea ecx, [esi + 0x28]
push eax
mov dword [ebp - 0x18], ecx
call fcn.00405f50
add dword [ebx + 0x14], 0x40
jmp 0x41e951
lea eax, [ebp - 0x7c]
push eax
push esi
lea ecx, [ebx + 0x10]
call fcn.00422c30
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0
call fcn.00421dc0
push dword [ebp - 0x20]
lea edx, [edi + 0x48]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x3c]
call fcn.004254f0
add esp, 8
mov ebx, dword [ebp + 0xc]
lea edx, [ebp - 0x3c]
mov dword [ebp - 4], 3
add ebx, 0x1c
mov ecx, dword [edi + 4]
mov esi, dword [ebp + 8]
push ebx
push edx
mov eax, dword [ecx]
push esi
call dword [eax + 0xc]
cmp dword [esi], 0
mov dword [ebp - 0x10], 1
jne 0x41e9c8
push 4
call fcn.0044c2e3
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 4
lea eax, [edi + 0x18]
push dword [ebx]
push eax
call fcn.00430a80
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x20], eax
mov edx, dword [ebp - 0x28]
cmp edx, 0x10
jb 0x41e9f8
mov ecx, dword [ebp - 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41e9ee
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41ea0d
push edx
push ecx
call fcn.0044c564
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
call fcn.00450fe0
int3
Function at 0x42ebc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx + 4]
push esi
mov esi, dword [ecx]
push edi
imul ecx, eax, 0xc6a4a793
lea edx, [esi + eax]
lea edi, [esi + 4]
cmp edi, edx
ja 0x42ebf2
mov eax, dword [esi]
add edi, 4
add eax, ecx
add esi, 4
imul ecx, eax, 0xc6a4a793
mov eax, ecx
shr eax, 0x10
xor ecx, eax
cmp edi, edx
jbe 0x42ebd7
sub edx, esi
sub edx, 1
je 0x42ec15
sub edx, 1
je 0x42ec0c
sub edx, 1
jne 0x42ec2a
movsx eax, byte [esi + 2]
shl eax, 0x10
add ecx, eax
movsx eax, byte [esi + 1]
shl eax, 8
add ecx, eax
movsx eax, byte [esi]
add eax, ecx
imul eax, eax, 0xc6a4a793
pop edi
pop esi
mov ecx, eax
shr ecx, 0x18
xor eax, ecx
ret
pop edi
mov eax, ecx
pop esi
ret

Function at 0x432bc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473fae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
mov dword [ebp - 0x14], 0
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov dword [ebx], 0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
test eax, eax
je 0x432c34
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x10]
push 0
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x432c34
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [eax], edi
mov dword [eax + 4], ecx
jmp 0x432cf9
lea ecx, [ebp - 0x3c]
call fcn.004329c0
mov dword [ebp - 4], 1
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x432c4d
mov ecx, dword [eax]
cmp dword [esi + 0x18], 0x10
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1c], ecx
lea ecx, [esi + 4]
mov dword [ebp - 0x18], eax
jb 0x432c62
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ecx
push eax
push 5
lea ecx, [ebp + 0xc]
call fcn.00424090
mov dword [ebp - 0x14], 3
mov byte [ebp - 4], 2
mov eax, dword [ebx]
mov esi, dword [ebp + 0xc]
cmp eax, esi
je 0x432cc0
push eax
call fcn.0044c595
add esp, 4
test esi, esi
jne 0x432ca2
xor eax, eax
jmp 0x432cbe
mov edi, dword [esi]
add edi, 5
push edi
call fcn.0044c7e5
push edi
push esi
push eax
mov dword [ebp + 8], eax
call fcn.0044df90
mov eax, dword [ebp + 8]
add esp, 0x10
mov dword [ebx], eax
push esi
call fcn.0044c595
mov edx, dword [ebp - 0x28]
add esp, 4
cmp edx, 0x10
jb 0x432cf9
mov ecx, dword [ebp - 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x432cef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432d0e
push edx
push ecx
call fcn.0044c564
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00450fe0
int3
Function at 0x432ef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47402e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebx], 0
mov esi, dword [ebp + 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], 1
push eax
push dword [ebp + 0x14]
movlpd qword [ebp - 0x34], xmm0
push esi
push dword [edi + 4]
mov dword [ebp - 0x24], 0
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x433038
lea ecx, [ebp - 0x4c]
call fcn.004329c0
mov dword [ebp - 4], 1
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x432f89
mov ecx, dword [eax]
cmp dword [edi + 0x1c], 0x10
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x18], ecx
lea ecx, [edi + 8]
mov dword [ebp - 0x14], eax
jb 0x432f9e
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], ecx
push eax
push 5
lea ecx, [ebp + 0x14]
call fcn.00424090
mov dword [ebp - 0x10], 3
mov byte [ebp - 4], 2
mov eax, dword [ebx]
mov esi, dword [ebp + 0x14]
cmp eax, esi
je 0x432ffd
push eax
call fcn.0044c595
add esp, 4
test esi, esi
jne 0x432fde
xor ebx, ebx
jmp 0x432ff6
mov edi, dword [esi]
add edi, 5
push edi
call fcn.0044c7e5
push edi
mov ebx, eax
push esi
push ebx
call fcn.0044df90
add esp, 0x10
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov ebx, eax
push esi
call fcn.0044c595
mov edx, dword [ebp - 0x38]
add esp, 4
cmp edx, 0x10
jb 0x433043
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x43302c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x433058
push edx
push ecx
call fcn.0044c564
add esp, 8
jmp 0x433043
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
mov dword [ecx], esi
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
call fcn.00450fe0
int3
Function at 0x433060
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474060
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x28], edi
mov esi, dword [ebp + 8]
lea ecx, [edi + 4]
mov dword [ebp - 4], 0
push esi
mov dword [edi], vtable.leveldb::Win32::Win32MapFile.0
call fcn.00405f50
mov ecx, dword [0x496c48]
xor edx, edx
mov dword [ebp - 0x24], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], ecx
lea eax, [ecx + 0xffff]
mov dword [edi + 0x28], 0
div ecx
mov dword [edi + 0x2c], 0
imul eax, ecx
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x24], eax
xor eax, eax
mov dword [edi + 0x44], 0
mov byte [edi + 0x48], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov byte [ebp - 4], 2
cmp dword [esi + 0x14], 0x10
jb 0x43311a
mov esi, dword [esi]
push 0x104
lea eax, [ebp - 0x230]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x24]
call fcn.00406110
cmp dword [ebp - 0x10], 8
lea esi, [ebp - 0x24]
cmovae esi, dword [ebp - 0x24]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
push 0
sbb eax, eax
push 0x80
neg eax
add eax, 2
push eax
push 0
push 7
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x1c], eax
cmp edx, 8
jb 0x4331ae
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4331a4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4331c2
push edx
push ecx
call fcn.0044c564
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
call fcn.00450fe0
int3
Function at 0x433bd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474155
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
push dword [ebp + 8]
lea ecx, [ebp - 0x3c]
call fcn.00405f50
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.00432880
cmp dword [eax + 0x14], 0x10
jb 0x433c2f
mov eax, dword [eax]
push ebx
push 0x104
lea ecx, [ebp - 0x244]
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x24]
call fcn.00406110
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
test eax, eax
setne bl
cmp edx, 8
jb 0x433ca5
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x433c9b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x433cfc
push edx
push ecx
call fcn.0044c564
add esp, 8
mov edx, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
cmp edx, 0x10
jb 0x433ce9
mov ecx, dword [ebp - 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x433cdf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x433cfc
push edx
push ecx
call fcn.0044c564
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
call fcn.00450fe0
int3
Function at 0x4340f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474206
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24c
mov dword [ebp - 0x10], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x50]
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 1
call fcn.00405f50
mov dword [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.00432880
cmp dword [eax + 0x14], 0x10
jb 0x43416e
mov eax, dword [eax]
push 0x104
lea ecx, [ebp - 0x258]
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x28]
call fcn.00406110
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x434235
cmp dword [ebp - 0x3c], 0x10
lea eax, [ebp - 0x50]
push esi
cmovae eax, dword [ebp - 0x50]
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x30], str.Could_not_delete_file.
push eax
push 5
mov dword [ebp - 0x2c], 0x16
call fcn.00424090
mov dword [ebp - 0x10], 3
mov byte [ebp - 4], 3
mov eax, dword [ebx]
mov esi, dword [ebp + 0xc]
cmp eax, esi
je 0x43422b
push eax
call fcn.0044c595
add esp, 4
test esi, esi
jne 0x43420a
xor ebx, ebx
jmp 0x434224
push edi
mov edi, dword [esi]
add edi, 5
push edi
call fcn.0044c7e5
push edi
mov ebx, eax
push esi
push ebx
call fcn.0044df90
add esp, 0x10
pop edi
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov ebx, eax
push esi
call fcn.0044c595
add esp, 4
pop esi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x43426b
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x434261
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4342c2
push edx
push ecx
call fcn.0044c564
add esp, 8
mov edx, dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 0x10
jb 0x4342af
mov ecx, dword [ebp - 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4342a5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4342c2
push edx
push ecx
call fcn.0044c564
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
call fcn.00450fe0
int3
Function at 0x4342d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474256
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x258
mov dword [ebp - 0x10], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x5c]
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 1
call fcn.00405f50
mov dword [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.00432880
cmp dword [eax + 0x14], 0x10
jb 0x43434e
mov eax, dword [eax]
push edi
push 0x104
lea ecx, [ebp - 0x264]
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x28]
call fcn.00406110
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
lea eax, [ebp - 0x34]
push eax
push edi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4343c2
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x434448
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
push esi
cmovae eax, dword [ebp - 0x5c]
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x3c], str.Could_not_get_the_file_size.
push eax
push 5
mov dword [ebp - 0x38], 0x1c
call fcn.00424090
mov dword [ebp - 0x10], 3
mov byte [ebp - 4], 3
mov eax, dword [ebx]
mov esi, dword [ebp + 0xc]
cmp eax, esi
je 0x43443e
push eax
call fcn.0044c595
add esp, 4
test esi, esi
jne 0x43441c
xor ebx, ebx
jmp 0x434437
mov edi, dword [esi]
add edi, 5
push edi
call fcn.0044c7e5
push edi
mov ebx, eax
push esi
push ebx
call fcn.0044df90
mov edi, dword [ebp - 0x2c]
add esp, 0x10
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov ebx, eax
push esi
call fcn.0044c595
add esp, 4
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x14]
pop edi
cmp edx, 8
jb 0x434486
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43447c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4344dd
push edx
push ecx
call fcn.0044c564
add esp, 8
mov edx, dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 0x10
jb 0x4344ca
mov ecx, dword [ebp - 0x5c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4344c0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4344dd
push edx
push ecx
call fcn.0044c564
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
call fcn.00450fe0
int3
Function at 0x434b00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0045a286
add esp, 0xc
pop ebp
ret 8

Function at 0x434b20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474366
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x328
push ebx
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp + 8]
push edi
mov dword [ebx], 0
lea eax, [ebp - 0x334]
mov dword [ebp - 4], 0
push eax
push 0x104
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov dword [ebp - 0x28], 0
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x334]
mov dword [ebp - 0x18], 0
push eax
mov dword [ebp - 0x14], 7
call fcn.00406110
push 0
push 0
push 0x104
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x12c]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x12c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434bd2
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x12c]
sub ecx, edx
push ecx
push eax
mov ecx, edi
call fcn.00401bb0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x434c27
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x434c1d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x434c92
push edx
push ecx
call fcn.0044c564
add esp, 8
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0xd
jb 0x434c60
lea eax, [ecx + 0xd]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0x10
jb 0x434c45
mov eax, dword [edi]
push esi
push 0xd
lea esi, [eax + ecx]
push str.leveldb_test_
push esi
call fcn.0044df90
add esp, 0xc
mov byte [esi + 0xd], 0
pop esi
jmp 0x434c77
push 0xd
push str.leveldb_test_
mov byte [ebp + 0xc], 0
mov ecx, edi
push dword [ebp + 0xc]
push 0xd
call fcn.0040a120
mov ecx, edi
call fcn.00432880
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
call fcn.00450fe0
int3
Function at 0x4387c0
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4747ed
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
mov dword fs:[0], esp
call fcn.0044d5c0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov eax, edi
cmp dword [edi + 0x14], 0x10
jb 0x4387f3
mov eax, dword [edi]
push 0x48a9e0
push eax
call fcn.0045653f
mov esi, eax
add esp, 8
mov dword [ebp - 0x14], esi
test esi, esi
je 0x438956
mov dword [ebx + 0x10], 0
mov eax, ebx
cmp dword [ebx + 0x14], 0x10
jb 0x43881f
mov eax, dword [ebx]
push esi
mov byte [eax], 0
call fcn.0045a366
add esp, 4
test eax, eax
jne 0x438937
push esi
push 0x1000
lea eax, [ebp - 0x1030]
push 1
push eax
call fcn.004577f8
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x438861
push esi
call fcn.0045a392
add esp, 4
test eax, eax
jne 0x43896d
push edi
lea eax, [ebp - 0x1030]
mov dword [ebp - 0x30], 0
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
call fcn.00401bb0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x30]
cmp dword [ebp - 0x1c], 0x10
mov ecx, dword [ebx + 0x10]
mov edi, dword [ebp - 0x30]
cmovae edx, edi
mov eax, dword [ebx + 0x14]
sub eax, ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x20]
cmp ecx, eax
ja 0x4388dc
cmp dword [ebx + 0x14], 0x10
mov esi, dword [ebp - 0x10]
lea eax, [ecx + esi]
mov dword [ebx + 0x10], eax
mov eax, ebx
jb 0x4388c3
mov eax, dword [ebx]
push ecx
add esi, eax
push edx
push esi
call fcn.0044df90
mov eax, dword [ebp - 0x20]
add esp, 0xc
mov byte [esi + eax], 0
mov esi, dword [ebp - 0x14]
jmp 0x4388f0
push ecx
push edx
mov byte [ebp - 0x18], 0
push dword [ebp - 0x18]
push ecx
mov ecx, ebx
call fcn.0040a120
mov edi, dword [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
jb 0x438926
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x43891c
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438951
push ecx
push edi
call fcn.0044c564
add esp, 8
push esi
call fcn.0045a366
add esp, 4
test eax, eax
je 0x438833
push esi
call fcn.00456915
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00450fe0
mov ecx, edi
call fcn.00405ec0
push eax
call fcn.0045a40a
add esp, 4
push 1
call fcn.00455c97
push str.fread
call fcn.0045a40a
add esp, 4
push 1
call fcn.00455c97
int3
Function at 0x43a5e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
not ecx
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x43a614
test bl, 3
je 0x43a611
movzx eax, byte [ebx]
inc ebx
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x484678]
sub edi, 1
jne 0x43a5f4
mov dword [ebp + 0xc], ebx
cmp edi, 0xc
jb 0x43a6f3
mov eax, 0xaaaaaaab
mul edi
push esi
shr edx, 3
mov dword [ebp + 8], edx
nop dword [eax + eax]
xor ecx, dword [ebx]
sub edi, 0xc
mov ebx, dword [ebx + 8]
mov eax, ebx
shr eax, 0x10
movzx edx, al
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x484a78]
xor edx, dword [eax*4 + 0x484e78]
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 4]
mov eax, esi
shr eax, 0x10
movzx eax, al
xor edx, dword [eax*4 + 0x485a78]
mov eax, esi
shr eax, 8
movzx eax, al
xor edx, dword [eax*4 + 0x485e78]
mov eax, ecx
shr eax, 0x10
movzx eax, al
xor edx, dword [eax*4 + 0x486a78]
mov eax, ecx
shr eax, 8
movzx eax, al
xor edx, dword [eax*4 + 0x486e78]
mov eax, ebx
shr eax, 0x18
xor edx, dword [eax*4 + 0x484678]
mov eax, esi
shr eax, 0x18
xor edx, dword [eax*4 + 0x485678]
mov eax, ecx
shr eax, 0x18
xor edx, dword [eax*4 + 0x486678]
movzx eax, bl
mov ebx, dword [ebp + 0xc]
xor edx, dword [eax*4 + 0x485278]
mov eax, dword [ebx + 4]
add ebx, 0xc
movzx eax, al
mov dword [ebp + 0xc], ebx
xor edx, dword [eax*4 + 0x486278]
movzx eax, cl
xor edx, dword [eax*4 + 0x487278]
sub dword [ebp + 8], 1
mov ecx, edx
jne 0x43a630
pop esi
test edi, edi
je 0x43a711
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x484678]
sub edi, 1
jne 0x43a6f7
not ecx
pop edi
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x463e89
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00463cff