joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42cdb7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004296a6
and dword [ebp - 0x14], 0
cmp dword [0x44f1d4], 0
mov dword [ebp - 0x18], eax
jne 0x42ce6a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x42cf12
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x437548
push ebx
call edi
test eax, eax
je 0x42cf12
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44f1d4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44f1d8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44f1dc], eax
call edi
push eax
call esi
mov dword [0x44f1e4], eax
test eax, eax
je 0x42ce6a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44f1e0], eax
mov eax, dword [0x44f1e0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x42cec3
cmp dword [0x44f1e4], ecx
je 0x42cec3
push eax
call esi
push dword [0x44f1e4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x42cec3
test ebx, ebx
je 0x42cec3
call edi
test eax, eax
je 0x42ceba
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42ceba
test byte [ebp - 8], 1
jne 0x42cec3
or dword [ebp + 0x10], 0x200000
jmp 0x42cef6
mov eax, dword [0x44f1d8]
cmp eax, dword [ebp - 0x18]
je 0x42cef6
push eax
call esi
test eax, eax
je 0x42cef6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42cef6
mov eax, dword [0x44f1dc]
cmp eax, dword [ebp - 0x18]
je 0x42cef6
push eax
call esi
test eax, eax
je 0x42cef6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44f1d4]
call esi
test eax, eax
je 0x42cf12
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x42cf14
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004217a4
leave
ret

Function at 0xdbaeb0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdbaeba
pushal
call 0xdbaec0
pop ebp
sub ebp, 0x10
sub ebp, 0x9baeb0
jmp 0xdbaed6
mov eax, 0x9baeb0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a0
mov edx, 0xac008a4c
xor byte [eax], dl
inc eax
dec ecx
jne 0xdbaeed
jmp 0xdbaf00
mov dword [ecx + 0x4c70c5c7], 0x8dcd4c4c
mov ah, 0x4c
dec esp
dec esp
dec edi
xor esp, 0x4c4c4c48
mul byte [esp + ecx*2 + 0x4c]
dec esp
mov ebx, 0xc7844fae
int 0x40
dec esp
dec esp
dec esp
dec edi
mov dword [esp + ebx], ebx
and al, 0xd4
mov dword [0x5a244c50], eax
xor cl, byte [ebp + ecx*2 + 0x60]
push 0xacb47024
les esp, [ecx + ecx*2 - 0x5ab3b3b4]
bound ecx, qword [esp + ecx*2 + 0x4c]
sbb edi, eax
mov al, byte [0x4c44c9c7]
dec esp
dec esp
invalid
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x401647
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
call sub.kernel32.dll_GetCommandLineA
mov dword [0x405120], eax
mov ecx, ebp
add ecx, 8
mov dword [0x40508e], ecx
mov dword [0x405124], 0x30
mov dword [0x405128], 3
mov dword [0x405130], 0
mov dword [0x405134], 0
mov dword [0x40512c], 0x403148
mov eax, 0xffff0000
mov ebx, section..text
and ebx, eax
mov dword [0x405086], ebx
mov dword [0x405138], ebx
mov dword [0x405144], 0xf
mov dword [0x40514c], 0x405067
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [0x40513c], eax
mov dword [0x405150], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [0x405140], eax
push 0x405124
call sub.user32.dll_RegisterClassExA
push 0
push dword [0x405086]
push 0
push 0
push 0x2bc
push 0x1f4
push 0xa0
push 0x12c
push 0x40000
push str.Hello_word
push str.2class
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x405118], eax
push 0
push dword [0x405118]
call sub.user32.dll_ShowWindow
push dword [0x405118]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
push 0x405154
call sub.user32.dll_GetMessageA
or eax, eax
je 0x40176b
push 0x405154
call sub.user32.dll_TranslateMessage
push 0x405154
call sub.user32.dll_DispatchMessageA
jmp 0x401741
mov eax, dword [0x40515c]
mov esi, dword [0x4051b4]
lea ecx, [0x405086]
add esi, eax
call esi
ret
Function at 0x402090
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4a73e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4020e0
mov edx, str.Error_creating_process_snapshot
mov ecx, 0x4a8770
call fcn.00408f80
push eax
call fcn.00409230
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460630
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x402128
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x214]
push str.gta_sa.exe
push eax
call fcn.00465b32
add esp, 8
test eax, eax
je 0x402141
lea eax, [ebp - 0x238]
push eax
push esi
call edi
test eax, eax
jne 0x402102
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460630
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x230]
xor ecx, ebp
pop edi
pop esi
call fcn.00460630
mov esp, ebp
pop ebp
ret
Function at 0x402a80
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4a73e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
mov esi, ecx
push eax
push 0
push 0
mov dword [ebp - 0x20], esi
push 0x4a2f6c
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x402b1e
mov ebx, dword [ebp - 0x20]
push edi
lea edi, [ebp - 7]
mov eax, 0xcccccccd
dec edi
mul ebx
shr edx, 3
mov al, dl
mov cl, dl
shl al, 2
add cl, al
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [edi], bl
mov ebx, edx
test ebx, ebx
jne 0x402ac0
mov dword [esi + 0x10], edx
lea eax, [ebp - 7]
mov dword [esi + 0x14], edx
mov dword [esi], edx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], 0xf
mov byte [esi], dl
cmp edi, eax
je 0x402b0b
mov ecx, eax
sub ecx, edi
push ecx
push edi
mov ecx, esi
call fcn.00407d20
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460630
mov esp, ebp
pop ebp
ret
mov ch, 8
mov dword [esi + 0x10], 0
mov cl, 0x7a
mov byte [ebp - 0x28], ch
mov dl, cl
mov dword [esi + 0x14], 0
mov ah, cl
mov byte [ebp - 0x22], 0
xor cl, ch
mov dword [esi], 0
xor dl, ch
mov byte [ebp - 0x26], cl
mov al, 0x4d
mov byte [ebp - 0x25], dl
mov bl, 0x67
mov dword [esi + 0x10], 0
xor al, ch
mov dword [esi + 0x14], 0xf
xor bl, ch
mov byte [ebp - 0x27], al
xor ah, ch
mov byte [ebp - 0x24], bl
lea ecx, [ebp - 0x27]
mov byte [ebp - 0x23], ah
mov byte [ebp - 0x22], 0
lea edx, [ecx + 1]
mov byte [esi], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402b80
sub ecx, edx
lea eax, [ebp - 0x27]
push ecx
push eax
mov ecx, esi
call fcn.00407d20
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00460630
mov esp, ebp
pop ebp
ret
Function at 0x403c60
Capabilities:
Terminate process

Disassembly:
push ecx
mov edx, str.Injector_failed__please_try_again_
mov ecx, 0x4a8688
call fcn.00408f80
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x404ef0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x404fd6
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x404fc5
jg 0x404f30
test edx, edx
je 0x404fc5
nop dword [eax]
call fcn.00407aa0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x404f84
jg 0x404f47
test esi, esi
je 0x404f84
cmp ebx, eax
jg 0x404f57
jl 0x404f51
cmp edi, esi
jae 0x404f57
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.004620f0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x404fa9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x404fbf
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x404f30
jl 0x404fbf
test edi, edi
jne 0x404f30
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov edx, dword [eax]
lea eax, [ecx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
test edx, edx
je 0x404ffe
mov eax, dword [eax]
mov edx, dword [eax]
jmp 0x405004
xor edx, edx
mov dword [esp + 0x18], eax
mov eax, edx
cdq
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
test edi, edi
jl 0x40506c
jg 0x405019
test esi, esi
je 0x40506c
test edx, edx
jl 0x405067
jg 0x405023
test eax, eax
je 0x405067
cmp edi, edx
jg 0x405037
jl 0x40502d
cmp esi, eax
jae 0x405037
mov eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov ebx, dword [ebp + 8]
push eax
push ebx
push dword [esp + 0x24]
call fcn.004620f0
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x14]
add ebx, edx
mov ecx, dword [esp + 0xc]
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x10]
sub dword [eax], edx
mov eax, dword [ecx + 0x20]
add dword [eax], edx
jmp 0x40506f
mov ebx, dword [ebp + 8]
jmp 0x405079
mov ebx, dword [ebp + 8]
test edi, edi
jl 0x405092
jg 0x405079
test esi, esi
je 0x405092
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x405092
push eax
push esi
push 1
push ebx
call fcn.004686eb
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4050b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x4050e2
jl 0x4050d5
test ecx, ecx
jne 0x4050e2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x4051a2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00407ac0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x40514e
jg 0x40510d
test esi, esi
je 0x40514e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x405125
mov eax, dword [esp + 0x10]
jl 0x40511f
cmp eax, esi
jae 0x405125
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.004620f0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x40516f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40518b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x4050f4
jl 0x40518b
test ecx, ecx
jne 0x4050f4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x4051e6
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x4051e6
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.004620f0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x405257
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x40520c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x405242
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0046909c
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x405257
cmp edi, eax
ja 0x405220
test edi, edi
je 0x405257
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0046909c
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4055c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4a73e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4055f0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460630
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40562c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40562c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460630
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x405714
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x405654
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x405687
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0046577c
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460630
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x4056e7
sub eax, 1
je 0x4056e7
sub eax, 2
jne 0x405714
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.0046577c
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460630
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x405704
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004686eb
add esp, 0x10
cmp edi, eax
jne 0x405714
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x405617
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00460630
mov esp, ebp
pop ebp
ret 4
Function at 0x4075a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4a73e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40765a
cmp byte [esi + 0x3d], 0
je 0x40765a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x407648
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x407610
sub eax, 1
je 0x407614
sub eax, 2
jne 0x407648
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460630
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x407631
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004686eb
add esp, 0x10
cmp edi, eax
jne 0x407648
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460630
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460630
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00460630
mov esp, ebp
pop ebp
ret

Function at 0x408a20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488ac0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4a73e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00460643
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0045fbf2
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412a90
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x412b3f
push esi
call fcn.00426d30
add esp, 4
test al, al
jne 0x412b3f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x412ab7
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.00431720
add esp, 0xc
test eax, eax
je 0x412aeb
sub eax, esi
push eax
push 0x2e
push esi
call fcn.00431720
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x412aed
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x412b1e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.00422760
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x412b00
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x41e0e0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp byte [esi + 0x6cb], 0
je 0x41e17d
cmp dword [esi + 0x1a4], 0
je 0x41e137
push esi
call fcn.0040dba0
push 1
push esi
mov byte [esp + 0x14], al
call fcn.0040de30
push dword [esi + 0x154]
mov eax, dword [esi + 0x1a4]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call eax
push dword [esp + 0x28]
push esi
call fcn.0040de30
add esp, 0x28
pop esi
ret
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, 0
je 0x41e14c
sub eax, 1
je 0x41e14c
sub eax, 1
jne 0x41e17d
push dword [esi + 0x150]
lea eax, [ecx*2 + 0x48ab94]
push 1
add eax, ecx
push 2
push eax
call fcn.004686eb
push dword [esi + 0x150]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.004686eb
add esp, 0x20
pop esi
ret

Function at 0x420970
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push 0x48afc4
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x42098a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x4a2fbc
push esi
call fcn.0046b3a0
add esp, 8
test eax, eax
je 0x4209d2
test ebp, ebp
je 0x4209c3
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x4209f8
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4209f8
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x420aaf
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x420a15
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x420aa5
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x420aa5
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x420a47
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x420a60
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x420a70
test ebp, ebp
je 0x420a9c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x4a7004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x4a7004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret