joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458562
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x458587
cmp eax, edi
jge 0x45857f
mov eax, esi
call fcn.00457f16
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
xor ecx, ecx
cmp dword [esi + 8], ecx
jle 0x4585a9
mov al, byte [esi + 0xc]
shr dword [esi + 0xc], 8
add dword [esi + 8], 0xfffffff8
mov byte [ebp + ecx - 4], al
inc ecx
cmp dword [esi + 8], 0
jg 0x45858e
cmp ecx, 4
jge 0x4585c8
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x4585b6
xor eax, eax
jmp 0x4585be
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x4585ac
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x4585fa
mov eax, str.zlib_corrupt
call fcn.00455b33
jmp 0x458635
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x45860a
mov eax, str.read_past_buffer
jmp 0x4585f3
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x45861f
mov ecx, edi
call fcn.00457f41
test eax, eax
je 0x458635
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004170c0
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret

Function at 0x45ec80
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x100000
call fcn.00416ff2
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
push 0
push 0
push 0
push 0
push str.Microsoft_Internet_Explorer
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x45ecc0
xor eax, eax
jmp 0x45eccf
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 1
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x45ed70
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x10], 0
jne 0x45ed96
mov dword [ebp - 0x10], 0
lea ecx, [ebp + 8]
call fcn.00401880
mov eax, dword [ebp - 0x10]
jmp 0x45eddb
mov dword [ebp - 8], 0
lea ecx, [ebp + 8]
call fcn.00401970
mov dword [ebp - 0xc], eax
push 0x20000000
mov ecx, dword [ebp - 0xc]
push ecx
lea ecx, [ebp + 8]
call fcn.00401950
push eax
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp + 8]
call fcn.00401880
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x45f2a0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d769
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x499078]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb0], ecx
mov eax, dword [ebp - 0xb0]
cmp dword [eax + 4], 0
jne 0x45f2e4
xor eax, eax
jmp 0x45f3fc
mov ecx, dword [ebp - 0xb0]
cmp dword [ecx + 0x10], 0
jne 0x45f2f7
xor eax, eax
jmp 0x45f3fc
xor edx, edx
mov word [ebp - 0x50], dx
push 0x3a
push 0
lea eax, [ebp - 0x4e]
push eax
call fcn.00416c80
add esp, 0xc
mov dword [ebp - 0x54], 0x3c
push 0
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x50]
push edx
push 0
push 5
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jne 0x45f3d9
push str.WinHttpQueryHeaders_fail
lea ecx, [ebp - 0x74]
call fcn.004016f0
mov dword [ebp - 4], 0
push str..CHTTPClientWTPCtrl.cpp
lea ecx, [ebp - 0x90]
call fcn.004016f0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x74]
push edx
push 0xbd
lea eax, [ebp - 0x90]
push eax
call fcn.0047a760
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x90]
call fcn.00401770
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.00401770
push 0x489508
lea ecx, [ebp - 0xac]
call fcn.004016f0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xac]
push ecx
call fcn.00401500
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
call fcn.00401770
xor eax, eax
jmp 0x45f3fc
mov dword [ebp - 0x10], 0
push 0xa
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x50]
push eax
call fcn.0041c541
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041694e
mov esp, ebp
pop ebp
ret 4
Function at 0x45f510
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d7cc
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x499078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 0xc], 0
jne 0x45f572
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x28]
call fcn.00401880
mov eax, dword [ebp - 0x14]
jmp 0x45f630
cmp dword [ebp + 8], 0
je 0x45f581
mov dword [ebp - 0x40], str.POST
jmp 0x45f588
mov dword [ebp - 0x40], 0x4894a0
mov ecx, dword [ebp + 0x44]
push ecx
push 0
push 0
push 0
lea ecx, [ebp + 0xc]
call fcn.00401950
push eax
mov edx, dword [ebp - 0x40]
push edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edx, dword [ebp - 0x3c]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 0x10], 0
jne 0x45f60b
push 0x4894a8
lea ecx, [ebp - 0x30]
call fcn.004016f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
push ecx
call fcn.00401500
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.00401770
mov dword [ebp - 0x34], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x28]
call fcn.00401880
mov eax, dword [ebp - 0x34]
jmp 0x45f630
mov dword [ebp - 0x38], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x28]
call fcn.00401880
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x40
Function at 0x45ff30
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0x74
push 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.00416c80
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 0x70], 0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x45feb0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x70], 1
jne 0x45ff7a
mov eax, 1
jmp 0x45ff7c
xor eax, eax
pop ebp
ret

Function at 0x45ffb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x499078]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x84], 0
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0045ff30
add esp, 0xc
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jne 0x46001c
xor eax, eax
jmp 0x460115
cmp dword [ebp - 0x7c], 1
jne 0x46003d
mov eax, dword [ebp - 0x14]
push eax
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x88], eax
jmp 0x460056
lea eax, [ebp - 0x78]
push eax
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x460066
xor eax, eax
jmp 0x460115
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x90], eax
mov edx, dword [ebp - 0x88]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x460113
mov edx, dword [ebp - 0x90]
add edx, 0xa
push edx
call fcn.00416ff2
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x90]
add eax, 0xa
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00416c80
add esp, 0xc
mov edx, dword [ebp - 0x90]
push edx
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004170c0
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov dword [edx], eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x90]
mov dword [ecx], edx
mov eax, 1
jmp 0x460115
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041694e
mov esp, ebp
pop ebp
ret
Function at 0x461840
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cdf3
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x499078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
lea eax, [ebp + 8]
push eax
call fcn.00401840
mov dword [ebp - 0x38], eax
call fcn.00461540
add esp, 0x20
push 0x489654
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x30]
push edx
call fcn.00404ef0
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call fcn.00401950
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x30]
call fcn.00401880
lea ecx, [ebp + 8]
call fcn.00401950
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 0x34], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401880
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4618f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ce26
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x499078]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x24]
call fcn.00401d60
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 0x489638
call fcn.00401800
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x5c], ecx
mov byte [ebp - 4], 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x50], esp
mov edx, dword [ebp + 8]
push edx
call fcn.00401840
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 0
call fcn.00461410
add esp, 0x3c
lea ecx, [ebp - 0x44]
call fcn.004017d0
mov byte [ebp - 4], 2
mov eax, dword [0x48ebac]
push eax
push 0
lea ecx, [ebp - 0x44]
call fcn.00403120
push 0
lea ecx, [ebp - 0x24]
call fcn.00401e10
push eax
lea ecx, [ebp - 0x44]
call fcn.004018a0
mov dword [ebp - 0x48], 1
jmp 0x4619ab
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x24]
call fcn.00401df0
cmp dword [ebp - 0x48], eax
jae 0x4619f4
push 0x48963c
lea ecx, [ebp - 0x44]
call fcn.00401900
mov edx, dword [ebp - 0x48]
push edx
lea ecx, [ebp - 0x24]
call fcn.00401e10
mov ecx, eax
call fcn.00401950
push eax
lea ecx, [ebp - 0x44]
call fcn.00401900
push 0
lea ecx, [ebp - 0x44]
call fcn.00401950
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4619a2
mov dword [ebp - 0x54], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00401880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00401dd0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.0041694e
mov esp, ebp
pop ebp
ret
Function at 0x4624b0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, dword [ecx]
and eax, 0xff
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
shr ecx, 8
xor ecx, dword [eax*4 + 0x489ce8]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0xff
mov edx, dword [ebp + 8]
add ecx, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
imul edx, edx, 0x8088405
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shr edx, 0x18
mov eax, dword [ebp + 8]
xor edx, dword [eax + 8]
and edx, 0xff
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x489ce8]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret
Function at 0x462530
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x462540
xor eax, eax
jmp 0x4626dd
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x46269e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x489ce8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x489ce8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x489ce8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x489ce8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x489ce8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x489ce8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x489ce8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x489ce8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x462549
cmp dword [ebp + 0x10], 0
je 0x4626d7
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x489ce8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x4626a4
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x462f70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x84], 0
je 0x463032
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x8c]
cmp eax, dword [edx + 0x88]
jb 0x462fa4
xor eax, eax
jmp 0x4630a2
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x88]
sub eax, dword [edx + 0x8c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jbe 0x462fc7
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x84]
mov eax, dword [ebp - 0x10]
add edx, dword [eax + 0x8c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004170c0
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x8c]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x8c], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x74]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x74], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x78]
push edx
call fcn.00462530
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x78], eax
mov eax, dword [ebp - 4]
jmp 0x4630a2
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x7c], 0
je 0x463096
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x463063
xor eax, eax
jmp 0x4630a2
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x74]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x74], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x78]
push edx
call fcn.00462530
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x78], eax
mov eax, dword [ebp - 0xc]
jmp 0x4630a2
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0x1000000
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x463110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
movzx edx, byte [ecx + 0x2d]
test edx, edx
je 0x4631f2
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x3c], 0
je 0x463161
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x40]
cmp edx, dword [ebp + 0xc]
jae 0x463161
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00416aec
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x3c], 0
jne 0x46318d
mov edx, dword [ebp + 0xc]
shl edx, 1
push edx
call fcn.00416d66
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x3c], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x40], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x3c]
push ecx
call fcn.004170c0
add esp, 0xc
mov dword [ebp - 8], 0
jmp 0x4631b6
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x4631e9
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 8]
movzx ecx, byte [edx + eax]
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x30
push edx
call fcn.004630d0
add esp, 8
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x3c]
mov ecx, dword [ebp - 8]
mov byte [edx + ecx], al
jmp 0x4631ad
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x20], 0
je 0x46324d
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
cmp eax, dword [ecx + 0x28]
jb 0x46321a
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x14], 0x30000
xor eax, eax
jmp 0x463282
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x18]
add eax, dword [ecx + 0x24]
push eax
call fcn.004170c0
add esp, 0xc
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x24], eax
mov eax, dword [ebp + 0xc]
jmp 0x463282
mov edx, dword [ebp - 0x18]
cmp dword [edx + 4], 0
je 0x463276
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
jmp 0x463282
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x14], 0x1000000
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4635d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x499078]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x463604
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x463604
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
test eax, eax
jne 0x463613
jmp 0x463728
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x218]
movzx ecx, word [eax]
test ecx, ecx
je 0x463665
mov edx, dword [ebp - 0x218]
movzx eax, word [edx]
cmp eax, 0x2f
je 0x46364b
mov ecx, dword [ebp - 0x218]
movzx edx, word [ecx]
cmp edx, 0x5c
jne 0x463654
mov eax, dword [ebp - 0x218]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x218]
add ecx, 2
mov dword [ebp - 0x218], ecx
jmp 0x463622
mov edx, dword [ebp - 4]
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x4636c8
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
sar ecx, 1
shl ecx, 1
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x420]
push eax
call fcn.004170c0
add esp, 0xc
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
sar ecx, 1
xor edx, edx
mov word [ebp + ecx*2 - 0x420], dx
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004635d0
add esp, 8
mov edx, dword [ebp - 0x214]
add edx, 2
mov dword [ebp - 0x214], edx
xor eax, eax
mov word [ebp - 0x210], ax
cmp dword [ebp + 8], 0
je 0x4636ef
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.0041ba27
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.0041b9aa
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x463728
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041694e
mov esp, ebp
pop ebp
ret