joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4330d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 0x38]
push ebx
call fcn.00435520
xor edi, edi
cmp dword [esi + 0x40], edi
je 0x4330fb
mov eax, dword [esi + 0x40]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push eax
call edx
mov edi, eax
lea ecx, [ebp - 0x30]
call fcn.0043a290
push edi
lea eax, [ebp - 0x30]
push eax
call fcn.0043a520
test edi, edi
jbe 0x433127
mov esi, dword [esi + 0x40]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x1c]
push edi
push esi
call edx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0043a790
push ebx
lea ecx, [ebp - 0x30]
push ecx
call fcn.00439b10
push eax
push 1
lea edx, [ebp - 0x30]
push edx
call fcn.00439af0
push eax
call fcn.00454129
add esp, 0x10
lea ecx, [ebp - 0x30]
call fcn.0043a300
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x435320
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 0x34]
push eax
mov edi, 0x400
call fcn.0043a9a0
add esp, 4
cmp dword [ebp - 0x2c], 8
jne 0x4353e2
push esi
lea ecx, [ebp - 0x18]
call fcn.0042ef70
push 0x104
lea ecx, [ebp - 0x18]
call fcn.0042fba0
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0042fc30
test esi, esi
pop esi
je 0x4353da
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.0042eff0
cmp eax, 0xffffffff
je 0x4353da
push eax
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0042f870
push eax
lea ecx, [ebp - 0x18]
call fcn.0042f210
lea ecx, [ebp - 0x20]
call fcn.0042f1d0
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.0042f660
cmp byte [ebp - 0x11], 0xff
lea eax, [ebp - 0x18]
jne 0x4353b8
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x4353da
mov edi, dword [ebp - 4]
imul edi, dword [ebp - 8]
lea ecx, [ebp - 0x18]
call fcn.0042f1d0
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x435520
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x60]
call fcn.0043a290
push esi
lea ecx, [ebp - 0x60]
call fcn.00439b30
lea eax, [ebp - 0x60]
push eax
call fcn.00439b10
lea ecx, [ebp - 0x30]
mov edi, eax
call fcn.0043a290
cmp byte [esi + 0x23], 0xff
lea eax, [esi + 0x1c]
jne 0x43555a
mov eax, dword [eax]
push 4
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.0043a790
push edi
lea edx, [ebp - 0x30]
push edx
call fcn.0043a520
lea eax, [ebp - 0x30]
push eax
call fcn.00439b10
mov ebx, dword [ebp + 8]
push ebx
mov esi, eax
push esi
push 1
lea ecx, [ebp - 0x30]
push ecx
call fcn.00439af0
push eax
call fcn.00454129
add esp, 0x10
cmp eax, esi
je 0x4355b4
lea ecx, [ebp - 0x30]
call fcn.0043a300
lea ecx, [ebp - 0x60]
call fcn.0043a300
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
push edi
push 1
lea edx, [ebp - 0x60]
push edx
call fcn.00439af0
push eax
call fcn.00454129
add esp, 0x10
lea ecx, [ebp - 0x30]
cmp eax, edi
jne 0x43559b
call fcn.0043a300
lea ecx, [ebp - 0x60]
call fcn.0043a300
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43a940
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x7fffffff
jne 0x43a959
xor eax, eax
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x28], 0
jne 0x43a993
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemFloatingPointProcessor
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43a953
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x43a9a0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x94
lea eax, [ebp - 0x98]
push 0
or edi, 0xffffffff
push eax
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x9c], 0
call fcn.0044f270
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dx, word [ebp - 0x8c]
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x90]
mov word [ebp - 0xa8], dx
xor edx, edx
cmp dword [ebp - 0x88], 2
mov word [ebp - 0xac], ax
sete dl
mov word [ebp - 0xaa], cx
mov esi, edx
test esi, esi
je 0x43aa3a
mov edi, 8
jmp 0x43aa5b
cmp ax, 4
jae 0x43aa47
mov edi, 2
jmp 0x43aa5b
jne 0x43aa5b
cmp cx, 0xa
sbb edi, edi
and edi, 0xfffffc04
add edi, 0x400
test ebx, ebx
je 0x43ab2d
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0xd0]
cmp eax, 3
ja case.default.0x43aa80
jmp dword [eax*4 + 0x43ab40]
test esi, esi
je 0x43aaca
mov ax, word [ebp - 0xac]
cmp ax, 3
ja 0x43aaa4
jne 0x43aaca
cmp word [ebp - 0xaa], 0x32
jb 0x43aaca
movzx eax, word [ebp - 0xb0]
sub eax, 4
js 0x43aaef
test eax, eax
je 0x43aae8
cmp eax, 1
je 0x43aae1
sub eax, 2
neg eax
sbb eax, eax
and eax, 0xfffffffb
add eax, 4
mov esi, eax
jmp 0x43ab0e
mov eax, dword [ebp - 0xb8]
sub eax, 0x182
je 0x43aaef
sub eax, 0x64
je 0x43aae8
sub eax, 0x64
jne case.default.0x43aa80
mov esi, 2
jmp 0x43ab0e
mov esi, 1
jmp 0x43ab0e
mov esi, 0xfffffffe
jmp 0x43ab0e
mov esi, 0x40
jmp 0x43ab0e
mov esi, 0x20
jmp 0x43ab0e
mov esi, 8
jmp 0x43ab0e
or esi, 0xffffffff
call fcn.0043a940
mov ecx, dword [ebp - 0xac]
mov edx, dword [ebp - 0xa8]
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f6d0
mov esp, ebp
pop ebp
ret
Function at 0x43f840
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043f2a0
Function at 0x441420
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4946a4]
cmp dword [eax], 0
push edi
mov edi, dword [ebp + 0xc]
jne 0x441436
xor eax, eax
pop edi
pop ebp
ret
mov eax, dword [eax]
push ebx
mov ebx, dword [ebp + 8]
push esi
push eax
push edi
push 1
push ebx
call fcn.00453eec
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
je 0x441459
test esi, esi
jne 0x44156d
cmp byte [0x4947e8], 0
je 0x44156d
mov ecx, dword [0x4946a4]
xor esi, esi
push esi
push esi
push ecx
mov dword [0x4946ae], esi
call fcn.00440e80
mov edx, dword [0x4947ee]
add esp, 0xc
cmp edx, dword [0x4947ea]
je 0x44156d
mov eax, dword [0x4946a4]
push 0x104
add eax, 0x23
push 0
push eax
call fcn.0044f270
mov ecx, dword [0x4947ea]
push 1
push ecx
call fcn.004463d0
mov edx, dword [0x4946a4]
add esp, 0x14
add edx, 0x23
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x4414c0
mov edx, dword [0x4947ea]
mov eax, dword [0x4947f2]
imul edx, edx, 0x16
mov ecx, dword [edx + eax + 2]
mov edx, dword [0x4946a4]
add edx, 0x23
push 0x473618
push edx
mov dword [0x4946aa], ecx
call fcn.004508f8
mov ecx, dword [0x4946a4]
mov dword [ecx], eax
mov eax, dword [0x4946a4]
add esp, 8
cmp dword [eax], 0
je 0x44157a
mov edx, dword [eax]
push edx
call fcn.00459449
push eax
call fcn.004584d6
add esp, 8
cmp eax, dword [0x4946aa]
jne 0x441595
mov eax, dword [0x4946a4]
mov ecx, dword [eax]
push ecx
push edi
lea edx, [esi + ebx]
push 1
push edx
call fcn.00453eec
inc dword [0x4947ea]
sub edi, eax
add esp, 0x10
add esi, eax
test edi, edi
jle 0x44156d
mov eax, dword [0x4946a4]
push 0
push 0
push eax
call fcn.00440e80
mov ecx, dword [0x4947ee]
add esp, 0xc
cmp ecx, dword [0x4947ea]
jne 0x441491
add dword [0x4946ae], esi
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
ret
add eax, 0x23
push eax
push 0x3e8
call fcn.00443060
add esp, 8
pop esi
pop ebx
mov eax, 1
pop edi
pop ebp
ret
push 0x4727a6
push 0x3f2
call fcn.00443060
add esp, 8
pop esi
pop ebx
mov eax, 1
pop edi
pop ebp
ret
Function at 0x441620
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x441630
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [0x4946aa]
sub eax, ebx
cmp byte [0x4947e8], 0
push esi
push edi
mov dword [0x4946aa], eax
je 0x441841
test eax, eax
jge 0x441841
add eax, ebx
cmp byte [0x4946a9], 0
mov dword [0x4946aa], eax
je 0x4416cf
test eax, eax
je 0x4416cf
mov ecx, dword [0x4946a4]
mov edx, dword [ecx + 4]
push edx
push eax
mov eax, dword [0x49477e]
push 1
push eax
call fcn.00454129
mov eax, dword [0x4947ea]
add esp, 0x10
test eax, eax
je 0x44168e
dec eax
jmp 0x441690
xor eax, eax
mov ecx, dword [0x4946a4]
push 1
push eax
add ecx, 4
push ecx
call fcn.00440e80
mov edx, dword [0x4946a4]
add edx, 0x23
push edx
push 0xbef
call fcn.004440b0
add esp, 0x14
cmp eax, 0x6b
je 0x44187e
call fcn.004415c0
test eax, eax
jne 0x44188d
mov eax, dword [0x4947ea]
xor edi, edi
cmp eax, dword [0x4947ee]
jae 0x4418a0
mov ecx, dword [0x4946a4]
push 0x104
add ecx, 0x23
push 0
push ecx
call fcn.0044f270
mov edx, dword [0x4947ea]
push 1
push edx
call fcn.004463d0
mov edx, dword [0x4946a4]
add esp, 0x14
add edx, 0x23
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x441712
mov eax, dword [0x4947ea]
mov ecx, dword [0x4947f2]
imul eax, eax, 0x16
mov esi, dword [eax + ecx + 2]
call fcn.00448af0
mov byte [0x4946a9], al
test al, al
je 0x44175c
mov edx, dword [0x4946a4]
add edx, 0x23
push edx
call fcn.00441010
add esp, 4
cmp eax, 1
je 0x44188d
mov al, byte [0x4946a9]
mov ecx, dword [0x4946aa]
inc dword [0x4947ea]
mov edx, ebx
sub edx, ecx
sub edx, edi
cmp esi, edx
ja 0x4417ff
test al, al
je 0x4417c2
mov eax, dword [0x4946a4]
mov edx, dword [eax + 4]
mov eax, dword [0x49477e]
push edx
push esi
add eax, ecx
add eax, edi
push 1
push eax
call fcn.00454129
mov ecx, dword [0x4946a4]
add ecx, 0x23
push ecx
push 0xbef
call fcn.004440b0
add esp, 0x18
cmp eax, 0x6b
je 0x44187e
call fcn.004415c0
test eax, eax
jne 0x44188d
mov eax, dword [0x4947ea]
test eax, eax
je 0x4417ce
dec eax
jmp 0x4417d0
xor eax, eax
mov edx, dword [0x4946a4]
push 1
push eax
add edx, 4
push edx
call fcn.00440e80
mov eax, dword [0x4947ea]
add esp, 0xc
add edi, esi
cmp eax, dword [0x4947ee]
jb 0x4416e2
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
test al, al
je 0x44182e
mov edx, dword [0x4946a4]
mov eax, dword [edx + 4]
push eax
mov eax, dword [0x49477e]
mov edx, ebx
sub edx, ecx
sub edx, edi
push edx
add eax, ecx
add eax, edi
push 1
push eax
call fcn.00454129
mov ecx, dword [0x4946aa]
add esp, 0x10
sub esi, ebx
add esi, edi
add ecx, esi
pop edi
pop esi
mov dword [0x4946aa], ecx
xor eax, eax
pop ebx
pop ebp
ret
cmp byte [0x4946a9], 0
je 0x4418a0
mov ecx, dword [0x4946a4]
mov edx, dword [ecx + 4]
mov eax, dword [0x49477e]
push edx
push ebx
push 1
push eax
call fcn.00454129
mov ecx, dword [0x4946a4]
add ecx, 0x23
push ecx
push 0xbef
call fcn.004440b0
add esp, 0x18
cmp eax, 0x6b
jne 0x441897
push 0
push 0x3fb
call fcn.00443060
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
call fcn.004415c0
test eax, eax
jne 0x44188d
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x441940
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0044f270
push 0x104
lea ecx, [ebp - 0x108]
push 0
push ecx
call fcn.0044f270
add esp, 0x18
lea edx, [ebp - 0x20c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [ebp - 0x20c], 0
je 0x4419d1
lea eax, [ebp - 0x20c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4419a5
sub eax, edx
cmp byte [ebp + eax - 0x20d], 0x5c
je 0x4419d1
lea edi, [ebp - 0x20c]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4419c0
mov ax, word [0x4726c4]
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x108]
push str._sXZIP_d
push edx
call fcn.0044fbbf
add esp, 0x10
cmp byte [ebp - 0x108], 0
je 0x441a31
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x441a05
sub eax, edx
cmp byte [ebp + eax - 0x109], 0x5c
je 0x441a31
lea edi, [ebp - 0x108]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x441a20
mov ax, word [0x4726c4]
mov word [edi], ax
lea ecx, [ebp - 0x108]
push ecx
call fcn.00440de0
add esp, 4
lea eax, [ebp - 0x108]
mov edx, esi
mov ecx, eax
pop edi
sub edx, ecx
pop esi
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x441a50
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f6d0
mov esp, ebp
pop ebp
ret
Function at 0x445800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4947e4]
mov ecx, dword [eax + 0xd]
mov edx, dword [ebp + 8]
push ebx
add ecx, edx
cmp ecx, dword [eax + 9]
push esi
push edi
jle 0x445974
mov ecx, dword [eax + 9]
mov edi, dword [eax + 0xd]
mov esi, dword [ebp + 0x14]
mov ebx, ecx
sub ebx, edi
sub edi, ecx
add edi, edx
test ebx, ebx
jle 0x445853
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push ebx
push 1
push eax
call fcn.00454129
add esp, 0x10
mov dword [esi], eax
cmp eax, ebx
jne 0x44596a
mov eax, dword [0x4947e4]
cmp edi, dword [eax + 9]
jle 0x4458ea
lea esp, [esp]
mov edx, dword [eax + 1]
mov eax, dword [0x4946a4]
push 1
lea ecx, [ebp + 0x10]
push ecx
push edx
add eax, 0x127
push eax
call fcn.00445670
add esp, 0x10
cmp eax, 1
je 0x445964
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x4947e4]
mov eax, dword [edx + 9]
push ecx
mov ecx, dword [esi]
add ecx, dword [ebp + 0xc]
push eax
push 1
push ecx
call fcn.00454129
add dword [esi], eax
mov eax, dword [0x4947e4]
mov edx, dword [eax + 9]
mov dword [eax + 0xd], edx
mov eax, dword [0x4947e4]
sub edi, dword [eax + 9]
inc dword [eax + 1]
mov eax, dword [0x4946a4]
mov ecx, dword [0x4947e4]
mov edx, dword [ecx + 1]
add eax, 0x127
push eax
dec edx
push edx
push 0xc02
call fcn.004441a0
mov eax, dword [0x4947e4]
add esp, 0x1c
cmp edi, dword [eax + 9]
jg 0x445860
test edi, edi
je 0x44598f
mov edx, dword [eax + 1]
mov eax, dword [0x4946a4]
push 1
lea ecx, [ebp + 0x10]
push ecx
push edx
add eax, 0x127
push eax
call fcn.00445670
add esp, 0x10
cmp eax, 1
je 0x445964
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi]
add edx, dword [ebp + 0xc]
push ecx
push edi
push 1
push edx
call fcn.00454129
add dword [esi], eax
mov eax, dword [0x4947e4]
mov dword [eax + 0xd], edi
mov eax, dword [0x4947e4]
inc dword [eax + 1]
mov ecx, dword [0x4946a4]
mov edx, dword [0x4947e4]
mov eax, dword [edx + 1]
add ecx, 0x127
push ecx
dec eax
push eax
push 0xc02
call fcn.004441a0
add esp, 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov dword [esi], 0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
add dword [eax + 0xd], edx
mov ecx, dword [ebp + 0x10]
push ecx
push edx
mov edx, dword [ebp + 0xc]
push 1
push edx
call fcn.00454129
mov ecx, dword [ebp + 0x14]
add esp, 0x10
mov dword [ecx], eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x445a40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4946a4]
cmp byte [eax + 0x19], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], 0
jne 0x445a7f
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push ecx
push edi
push esi
push edx
call fcn.00454129
imul esi, edi
add esp, 0x10
add dword [0x4946b2], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4947e4]
cmp byte [eax], 1
jne 0x445ab0
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
mov ecx, esi
imul ecx, edi
push edx
push eax
push ecx
call fcn.004459a0
add esp, 0x10
test eax, eax
je 0x445ad7
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
mov edx, esi
imul edx, edi
push eax
push ecx
push edx
call fcn.00445800
add esp, 0x10
test eax, eax
je 0x445ad7
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
imul esi, edi
add dword [0x4946b2], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x445af0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
push 1
push ebx
call fcn.00453eec
mov esi, dword [ebp + 0x14]
add esp, 0x10
mov dword [esi], eax
cmp eax, edi
je 0x445bfd
sub edi, eax
mov eax, dword [0x4947e4]
cmp edi, dword [eax + 9]
jle 0x445b9f
mov edx, dword [eax + 1]
mov eax, dword [0x4946a4]
push 0
lea ecx, [ebp + 0x10]
push ecx
push edx
add eax, 0x127
push eax
call fcn.00445670
add esp, 0x10
cmp eax, 1
je 0x445c04
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x4947e4]
mov eax, dword [edx + 9]
push ecx
mov ecx, dword [esi]
push eax
add ecx, ebx
push 1
push ecx
call fcn.00453eec
add dword [esi], eax
mov eax, dword [0x4947e4]
mov edx, dword [0x4946a4]
sub edi, dword [eax + 9]
mov eax, dword [eax + 1]
add edx, 0x127
push edx
push eax
push 0xc03
call fcn.004441a0
mov eax, dword [0x4947e4]
inc dword [eax + 1]
mov eax, dword [0x4947e4]
add esp, 0x1c
cmp edi, dword [eax + 9]
jg 0x445b25
mov edx, dword [eax + 1]
mov eax, dword [0x4946a4]
push 0
lea ecx, [ebp + 0x10]
push ecx
push edx
add eax, 0x127
push eax
call fcn.00445670
add esp, 0x10
test eax, eax
jne 0x445c04
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi]
push ecx
push edi
add edx, ebx
push 1
push edx
call fcn.00453eec
add dword [esi], eax
mov eax, dword [0x4946a4]
mov ecx, dword [0x4947e4]
mov edx, dword [ecx + 1]
add eax, 0x127
push eax
push edx
push 0xc03
call fcn.004441a0
mov eax, dword [0x4947e4]
add esp, 0x1c
inc dword [eax + 1]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
mov dword [esi], 0
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x445cc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4946a4]
cmp byte [eax + 0x17], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], 0
jne 0x445cff
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push ecx
push edi
push esi
push edx
call fcn.00453eec
imul esi, edi
add esp, 0x10
sub dword [0x4946b2], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4947e4]
cmp byte [eax], 1
jne 0x445d30
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
mov ecx, esi
imul ecx, edi
push edx
push eax
push ecx
call fcn.00445c20
add esp, 0x10
test eax, eax
je 0x445d57
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
mov edx, esi
imul edx, edi
push eax
push ecx
push edx
call fcn.00445af0
add esp, 0x10
test eax, eax
je 0x445d57
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
imul esi, edi
sub dword [0x4946b2], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x447000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x14], 0
push edi
mov edi, dword [0x4946a4]
je 0x447019
cmp byte [edi + 0x331], 0
jmp 0x447020
cmp byte [edi + 0x332], 0
je 0x44707c
mov ecx, dword [ebp + 8]
mov eax, ecx
push esi
lea esi, [eax + 1]
jmp 0x447030
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x447030
sub eax, esi
cmp byte [edi + 0x332], 0
lea edx, [eax - 1]
je 0x44707b
test edx, edx
jle 0x44707b
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x44707b
mov edi, dword [ebp + 0xc]
push ebx
xor eax, eax
test edx, edx
jle 0x447074
lea ebx, [ebx]
movzx ebx, byte [eax + ecx]
xor byte [esi + edi], bl
movzx ebx, byte [eax + ecx + 1]
xor byte [eax + ecx], bl
inc eax
cmp eax, edx
jl 0x447060
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x447054
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x447410
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x108]
push edx
push eax
call fcn.004589f8
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x310]
push edx
call fcn.00458d35
add esp, 0x28
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f6d0
mov esp, ebp
pop ebp
ret
Function at 0x448870
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0044f270
push 0x104
lea ecx, [ebp - 0x108]
push 0
push ecx
call fcn.0044f270
mov al, 0x3a
add esp, 0x18
cmp byte [ebx + 1], al
je 0x448934
cmp byte [esi + 1], al
je 0x448939
lea edx, [ebp - 0x20c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004589f8
add esp, 0x14
cmp byte [ebp - 0x108], 0
je 0x448992
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x448905
sub eax, edx
cmp byte [ebp + eax - 0x109], 0x5c
je 0x448992
lea edi, [ebp - 0x108]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x448920
mov dx, word [0x4726c4]
mov word [edi], dx
jmp 0x448992
cmp byte [esi + 1], al
jne 0x448992
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push esi
call fcn.004589f8
add esp, 0x14
cmp byte [ebp - 0x108], 0
je 0x448992
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x448961
sub eax, edx
cmp byte [ebp + eax - 0x109], 0x5c
je 0x448992
lea edi, [ebp - 0x108]
dec edi
jmp 0x448980
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x448980
mov cx, word [0x4726c4]
mov word [edi], cx
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x448996
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4489a6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
and ecx, 3
push 0
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.0046510c
add esp, 8
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f6d0
mov esp, ebp
pop ebp
ret