joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4483a9
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xddc
mov eax, dword [0x4e8070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0xdd8], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0xdd4], eax
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x620], ax
xor ebx, ebx
lea eax, [ebp - 0x61e]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0xdd0], edi
call fcn.00499dd0
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push ebx
push eax
call fcn.00499dd0
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.00499dd0
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
add esp, 0xc
mov dword [ebp - 0xdcc], ebx
test eax, 0xffffffe0
jne 0x448448
xor eax, eax
jmp 0x4485a3
lea eax, [ebp - 0x620]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0x4f3f68
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call ebx
push eax
lea eax, [ebp - 0x620]
push eax
push 0x4ca894
lea eax, [ebp - 0x418]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x18
push 0x4f3f68
call edi
push eax
call ebx
push eax
lea eax, [ebp - 0x620]
push eax
push 0x4ca894
lea eax, [ebp - 0x210]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
xor eax, eax
mov word [ebp - 0xdc8], ax
lea edi, [ebp - 0xdc6]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x798
stosw word es:[edi], ax
xor ebx, ebx
lea eax, [ebp - 0xdb8]
push ebx
push eax
call fcn.00499dd0
mov edi, dword [ebp - 0xdd8]
add esp, 0x24
push edi
xor esi, esi
lea ecx, [ebp - 0xdc8]
call fcn.0044800c
pop ecx
test eax, eax
jne 0x448536
push dword [ebp - 0xdd0]
lea eax, [ebp - 0x210]
push eax
push edi
call fcn.00448260
add esp, 0xc
test eax, eax
je 0x448527
push ebx
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0xdcc], eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x44859d
push dword [ebp - 0xdd4]
lea eax, [ebp - 0x418]
push eax
push edi
call fcn.00448302
add esp, 0xc
test eax, eax
je 0x448585
push dword [ebp - 0xdd0]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00448260
add esp, 0xc
test eax, eax
je 0x448585
push ebx
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0xdcc], eax
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x418]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
call esi
mov eax, dword [ebp - 0xdcc]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049795f
leave
ret
Function at 0x449b19
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b6dcf
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x4e8070]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov esi, ecx
lea eax, [esp + 0x14]
push eax
call fcn.0044955c
pop ecx
and dword [esp + 0x38], 0
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
push dword [ebp + 8]
lea ecx, [esp + 0x1c]
call fcn.00448040
add esp, 0xc
test esi, esi
je 0x449bb0
mov ecx, dword [esp + 0xc]
test ebx, ebx
je 0x449b85
mov dword [ebx], ecx
cmp dword [ebp + 0x10], 0
mov dword [esi], eax
jne 0x449bb0
test eax, eax
je 0x449bb0
cmp ecx, 2
jne 0x449bb0
push 0
push str.CryptoMode
push str.Softwareprojonepodlp_smprule_
call fcn.0042fa8f
dec eax
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [esi], eax
lea esi, [esp + 0x14]
call fcn.0040c695
push dword [esp + 0x14]
call fcn.00497e2f
mov eax, dword [esp + 0x14]
pop ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x449bd9
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4e8070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push edi
xor ebx, ebx
inc ebx
push ebx
mov edi, ecx
push edi
push eax
mov dword [ebp - 0x24], eax
call esi
test eax, eax
jne 0x449c96
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x449c28
push 0
push edi
mov eax, ebx
call fcn.0042d949
push ebx
push edi
push dword [ebp - 0x24]
call esi
jmp 0x449c98
call fcn.0042dd90
push eax
push edi
push str._s._08x
lea ecx, [ebp - 0x20]
call fcn.0042f9b3
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp dword [ebp - 8], 8
jae 0x449c4b
lea eax, [ebp - 0x1c]
push ebx
push eax
push edi
call esi
test eax, eax
je 0x449c92
push ebx
push edi
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x449c81
cmp dword [ebp - 8], 8
mov esi, dword [ebp - 0x1c]
jae 0x449c6b
lea esi, [ebp - 0x1c]
call fcn.0042d86e
mov edi, ebx
push 0
push ebx
lea esi, [ebp - 0x20]
call fcn.00403ead
mov eax, edi
jmp 0x449c98
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x449c8d
lea eax, [ebp - 0x1c]
push ebx
push edi
push eax
call esi
xor edi, edi
jmp 0x449c72
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049795f
leave
ret
Function at 0x449ccd
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4e8070]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
cmp ebx, esi
je 0x449dac
push esi
push ebx
call fcn.0044a506
pop ecx
pop ecx
test eax, eax
je 0x449dac
xor eax, eax
push 0x206
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push esi
push eax
call fcn.00499dd0
add esp, 0xc
call fcn.0042dd90
push eax
push ebx
push str._s._08x
lea eax, [ebp - 0x214]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push ebx
call fcn.00449ca7
mov dword [ebp - 0x22c], esi
xor eax, eax
lea edi, [ebp - 0x228]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
push ebx
lea esi, [ebp - 0x22c]
stosd dword es:[edi], eax
call fcn.0044972a
pop ecx
mov edi, eax
lea eax, [ebp - 0x214]
push eax
push ebx
call fcn.004499ca
pop ecx
pop ecx
test eax, eax
je 0x449d9f
xor esi, esi
lea eax, [ebp - 0x214]
push eax
mov ecx, ebx
call fcn.00449bd9
pop ecx
test eax, eax
jne 0x449dbd
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x449d7e
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049795f
leave
ret
test edi, edi
je 0x449dce
push ebx
lea esi, [ebp - 0x22c]
call fcn.004497c3
pop ecx
xor eax, eax
inc eax
jmp 0x449dae
Function at 0x449ee2
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x478
mov eax, 0x4bbe85
call fcn.004991ba
mov esi, ecx
push esi
mov dword [ebp - 0x42c], esi
call fcn.00449dd3
pop ecx
test eax, eax
je 0x44a15d
push esi
call fcn.00449e19
pop ecx
test eax, eax
je 0x44a15d
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov dword [ebp - 0x428], ebx
call fcn.00499dd0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.0042dd90
push eax
push str.___08x
lea ecx, [ebp - 0x468]
call fcn.0042f9b3
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x449f72
mov eax, dword [eax + 4]
jmp 0x449f75
add eax, 4
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
lea eax, [ebp - 0x21c]
push eax
call edi
push ebx
push 1
lea esi, [ebp - 0x468]
call fcn.00403ead
lea esi, [ebp - 0x21c]
call fcn.0042d2b4
test eax, eax
je 0x44a149
mov ecx, dword [ebp - 0x42c]
mov edx, esi
call fcn.004503d1
test eax, eax
jne 0x44a149
mov eax, dword [ebp + 8]
mov dword [ebp - 0x434], eax
push ebx
lea eax, [ebp - 0x428]
push ebx
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x434]
push eax
push 0x44a165
push 1
mov eax, esi
push eax
call fcn.0042cd96
cmp dword [ebp - 0x428], ebx
je 0x44a149
xor eax, eax
push 0x206
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push ebx
push eax
call fcn.00499dd0
add esp, 0xc
push dword [ebp - 0x42c]
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x42c]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, eax
cmp esi, ebx
je 0x44a04c
push str..rar
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44a04c
mov esi, 0x4c3b44
push esi
call fcn.0042dd90
push eax
push str..._08x._s
lea ecx, [ebp - 0x468]
call fcn.0042f9b3
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x44a071
mov eax, dword [eax + 4]
jmp 0x44a074
add eax, 4
push eax
lea eax, [ebp - 0x424]
push eax
call edi
push ebx
push 1
lea esi, [ebp - 0x468]
call fcn.00403ead
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x44c]
push eax
call fcn.0042d167
lea eax, [ebp - 0x484]
push eax
lea ecx, [ebp - 0x44c]
mov dword [ebp - 4], ebx
call fcn.0044c695
add esp, 0xc
lea ecx, [ebp - 0x424]
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0044ff99
mov ebx, eax
neg ebx
sbb bl, bl
pop ecx
lea edi, [ebp - 0x484]
inc bl
mov byte [ebp - 4], 0
call fcn.00419a46
push dword [ebp - 0x484]
call fcn.00497e2f
pop ecx
test bl, bl
je 0x44a127
xor esi, esi
mov ecx, dword [ebp - 0x42c]
lea eax, [ebp - 0x424]
push eax
call fcn.00449bd9
pop ecx
test eax, eax
jne 0x44a12e
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x44a0f3
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x44a12e
and dword [ebp - 0x428], 0
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x44c]
call fcn.0040c5a0
push dword [ebp - 0x44c]
call fcn.00497e2f
pop ecx
lea eax, [ebp - 0x21c]
push eax
call fcn.0042d89c
mov eax, dword [ebp - 0x428]
jmp 0x44a15f
xor eax, eax
call fcn.0049923d
ret
Function at 0x44a186
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x234
mov eax, dword [0x4e8070]
xor eax, esp
mov dword [esp + 0x230], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [esp + 0x10], eax
cmp ebx, esi
je 0x44a2c4
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44a2c4
xor eax, eax
push 0x206
mov word [esp + 0x34], ax
lea eax, [esp + 0x36]
push esi
push eax
mov dword [esp + 0x18], esi
call fcn.00499dd0
add esp, 0xc
call fcn.0042dd90
push eax
push ebx
push str._s._08x
lea eax, [esp + 0x3c]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push ebx
call fcn.00449ca7
mov dword [esp + 0x1c], esi
xor eax, eax
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
push ebx
lea esi, [esp + 0x1c]
stosd dword es:[edi], eax
call fcn.0044972a
pop ecx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x30]
push eax
push ebx
call fcn.00449a7b
xor esi, esi
pop ecx
inc esi
pop ecx
test eax, eax
je 0x44a281
xor edi, edi
lea eax, [esp + 0x30]
push eax
mov ecx, ebx
call fcn.00449bd9
pop ecx
test eax, eax
jne 0x44a25f
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 5
jl 0x44a23e
jmp 0x44a281
cmp dword [ebp + 0xc], 2
mov dword [esp + 0xc], esi
jne 0x44a281
push 2
mov ecx, ebx
call fcn.00449ee2
pop ecx
test eax, eax
je 0x44a281
mov eax, dword [esp + 0x10]
test eax, eax
je 0x44a281
mov dword [eax], esi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 0xc], esi
jne 0x44a2ac
push esi
mov ecx, ebx
call fcn.00449ee2
pop ecx
test eax, eax
je 0x44a2ac
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], esi
test eax, eax
je 0x44a2ac
mov dword [eax], esi
cmp dword [esp + 0x14], 0
je 0x44a2be
push ebx
lea esi, [esp + 0x1c]
call fcn.004497c3
pop ecx
mov eax, dword [esp + 0xc]
jmp 0x44a2c6
xor eax, eax
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049795f
mov esp, ebp
pop ebp
ret
Function at 0x44a2db
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b8ca4
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x4e8070]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push esi
push edi
mov eax, dword [0x4e8070]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x18], edi
inc ebx
cmp byte [esi + 8], 7
mov dword [esp + 0x20], eax
jne 0x44a362
push str.exts:
lea ecx, [esp + 0x48]
call fcn.00403461
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0xbc], edi
push esi
mov dword [esp + 0x20], ebx
call fcn.0040172f
pop ecx
pop ecx
mov byte [esp + 0x17], bl
test al, al
jne 0x44a367
mov byte [esp + 0x17], 0
or dword [esp + 0xb8], 0xffffffff
test byte [esp + 0x18], bl
je 0x44a380
push edi
push ebx
lea ecx, [esp + 0x4c]
call fcn.00403db0
cmp byte [esp + 0x17], 0
je 0x44a4e0
lea eax, [esp + 0x44]
push eax
push ecx
push esi
mov edx, str.exts
call fcn.00437a7b
pop ecx
push eax
call fcn.00436d1d
mov dword [esp + 0xb8], ebx
cmp dword [eax + 0x18], 0x10
jb 0x44a3b5
mov eax, dword [eax + 4]
jmp 0x44a3b8
add eax, 4
push 0x4cade0
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0042f7f9
add esp, 0xc
push edi
push ebx
lea ecx, [esp + 0x4c]
mov byte [esp + 0xc0], 3
call fcn.00403db0
push dword [esp + 0x38]
lea edi, [esp + 0x30]
lea esi, [esp + 0x1c]
call fcn.0040c5c5
push dword [esp + 0x3c]
lea esi, [esp + 0x28]
call fcn.0040c5c5
mov eax, dword [esp + 0x18]
test eax, eax
je 0x44a40a
cmp eax, dword [esp + 0x24]
je 0x44a40f
call fcn.00497df5
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x28]
je 0x44a4cd
lea esi, [esp + 0x18]
call fcn.00427a9f
push eax
lea ecx, [esp + 0x90]
call fcn.00401215
pop ecx
lea eax, [esp + 0x68]
lea ecx, [esp + 0x8c]
mov byte [esp + 0xb8], 4
call fcn.004104f6
mov esi, eax
lea eax, [esp + 0x60]
lea ecx, [esp + 0x8c]
call fcn.00410515
mov edi, eax
lea eax, [esp + 0x78]
lea ecx, [esp + 0x8c]
call fcn.004104f6
push dword [esi + 4]
push dword [esi]
push dword [edi + 4]
push dword [edi]
push dword [eax + 4]
push dword [eax]
lea eax, [esp + 0x88]
push eax
call fcn.00428e3b
add esp, 0x1c
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x28]
call fcn.004102a2
push 0
push ebx
lea esi, [esp + 0x94]
mov byte [esp + 0xc0], 3
call fcn.00403ead
lea esi, [esp + 0x18]
call fcn.00403666
jmp 0x44a3fc
lea esi, [esp + 0x2c]
call fcn.00403fe9
push dword [esp + 0x2c]
call fcn.00497e2f
pop ecx
mov al, bl
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.0049795f
mov esp, ebp
pop ebp
ret
Function at 0x44e19f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
test edx, edx
je 0x44e1c3
push esi
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4e9a48]
dec edx
inc ecx
test edx, edx
jne 0x44e1a7
pop esi
not eax
ret

Function at 0x44e386
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x4e8070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x478], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x474], eax
push edi
lea eax, [ebp - 0x470]
call fcn.0045a2cb
push ebx
mov edi, 0x400
push edi
lea eax, [ebp - 0x418]
push 1
push eax
call fcn.004a59a1
add esp, 0x10
jmp 0x44e3f9
lea ecx, [ebp - 0x418]
push ecx
lea esi, [ebp - 0x470]
call fcn.0045a2ef
push ebx
push edi
lea eax, [ebp - 0x418]
push 1
push eax
call fcn.004a59a1
add esp, 0x14
test eax, eax
jne 0x44e3d4
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x470]
call fcn.0045a385
mov esi, dword [ebp - 0x474]
pop ecx
push 0x10
lea eax, [ebp - 0x14]
push eax
call fcn.00430ba3
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049795f
leave
ret

Function at 0x44e4f6
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x14c
mov eax, dword [0x4e8070]
xor eax, ebp
mov dword [ebp + 0x64], eax
mov eax, dword [ebp + 0x70]
and dword [ebp - 0xe4], 0
push esi
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp + 0x74]
push 0x3f
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 3]
push 0
push eax
mov esi, ecx
mov byte [ebp - 4], 0
call fcn.00499dd0
add esp, 0xc
cmp dword [ebp + 0x7c], 0x40
ja 0x44e553
push dword [ebp + 0x7c]
lea eax, [ebp - 4]
push esi
push eax
call fcn.0049a300
add esp, 0xc
jmp 0x44e584
push edi
lea eax, [ebp - 0xd8]
call fcn.0045b4d7
push dword [ebp + 0x7c]
push esi
mov esi, eax
call fcn.0045b502
lea eax, [ebp + 0x50]
push eax
mov ecx, esi
call fcn.0045b59a
add esp, 0xc
push 5
pop ecx
lea esi, [ebp + 0x50]
lea edi, [ebp - 4]
rep movsd dword es:[edi], dword [esi]
pop edi
xor ecx, ecx
mov al, byte [ebp + ecx - 4]
mov dl, al
xor dl, 0x36
xor al, 0x5c
mov byte [ebp + ecx - 0x60], dl
mov byte [ebp + ecx - 0xbc], al
inc ecx
cmp ecx, 0x40
jb 0x44e586
lea eax, [ebp - 0x20]
call fcn.0045b4d7
lea eax, [ebp - 0x60]
push 0x40
push eax
lea esi, [ebp - 0x20]
call fcn.0045b502
push dword [ebp + 0x78]
push dword [ebp - 0xe0]
call fcn.0045b502
lea eax, [ebp + 0x50]
push eax
mov ecx, esi
call fcn.0045b59a
lea eax, [ebp - 0x7c]
call fcn.0045b4d7
lea eax, [ebp - 0xbc]
push 0x40
push eax
lea esi, [ebp - 0x7c]
call fcn.0045b502
lea eax, [ebp + 0x50]
push 0x14
push eax
call fcn.0045b502
lea eax, [ebp + 0x3c]
push eax
mov ecx, esi
call fcn.0045b59a
mov esi, dword [ebp - 0xdc]
add esp, 0x28
push 0x14
lea eax, [ebp + 0x3c]
push eax
call fcn.00430ba3
mov ecx, dword [ebp + 0x64]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0049795f
add ebp, 0x68
leave
ret
Function at 0x44e626
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4e8070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x144], 0
push esi
mov dword [ebp - 0x140], eax
mov eax, dword [ebp + 0xc]
push 0x3f
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0xa7]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0xa8], 0
call fcn.00499dd0
add esp, 0xc
cmp dword [ebp + 0x14], 0x40
ja 0x44e68a
push dword [ebp + 0x14]
lea eax, [ebp - 0xa8]
push esi
push eax
call fcn.0049a300
add esp, 0xc
jmp 0x44e6c8
lea eax, [ebp - 0x138]
call fcn.0045b65a
mov eax, dword [ebp + 0x14]
push esi
lea ecx, [ebp - 0x138]
call fcn.0045b69a
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x138]
call fcn.0045b726
push 0x20
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.0049a300
add esp, 0x14
xor ecx, ecx
mov al, byte [ebp + ecx - 0xa8]
mov dl, al
xor dl, 0x36
xor al, 0x5c
mov byte [ebp + ecx - 0x48], dl
mov byte [ebp + ecx - 0x110], al
inc ecx
cmp ecx, 0x40
jb 0x44e6ca
lea eax, [ebp - 0xd0]
call fcn.0045b65a
lea eax, [ebp - 0x48]
push eax
push 0x40
pop eax
lea ecx, [ebp - 0xd0]
call fcn.0045b69a
push dword [ebp - 0x13c]
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0xd0]
call fcn.0045b69a
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xd0]
call fcn.0045b726
lea eax, [ebp - 0xd0]
call fcn.0045b65a
lea eax, [ebp - 0x110]
push eax
push 0x40
pop eax
lea ecx, [ebp - 0xd0]
call fcn.0045b69a
lea eax, [ebp - 0x28]
push eax
push 0x20
pop eax
lea ecx, [ebp - 0xd0]
call fcn.0045b69a
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xd0]
call fcn.0045b726
mov esi, dword [ebp - 0x140]
add esp, 0x18
push 0x20
lea eax, [ebp - 0x68]
push eax
call fcn.00430ba3
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0049795f
leave
ret
Function at 0x44fb02
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x44fb58
cmp eax, 0xffffffff
je 0x44fb58
push esi
lea ecx, [ebp - 4]
push ecx
push 4
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44fb58
cmp dword [ebp - 4], 4
jne 0x44fb58
cmp dword [ebp - 8], 0x21726152
jne 0x44fb58
inc esi
lea eax, [ebp - 0xc]
call fcn.0040681e
mov eax, esi
pop esi
leave
ret
Function at 0x44ff99
Capabilities:
Check if file exists

Disassembly:
push 0x68
mov eax, 0x4b4e7c
call fcn.004991ba
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x58]
push eax
mov esi, ecx
call fcn.0041b34e
and dword [ebp - 4], 0
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov ecx, dword [esi]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
jmp 0x45000e
lea esi, [ebp - 0x34]
call fcn.00432e32
cmp dword [eax + 0x18], 8
jb 0x44ffdf
mov eax, dword [eax + 4]
jmp 0x44ffe2
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x450006
lea esi, [ebp - 0x34]
call fcn.00432e32
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x58]
push ecx
push edx
push eax
lea edi, [ebp - 0x58]
call fcn.0041b3d3
lea esi, [ebp - 0x34]
call fcn.00419672
lea edi, [ebp - 0x3c]
lea esi, [ebp - 0x34]
call fcn.0041e1dc
test al, al
jne 0x44ffcc
cmp dword [ebp - 0x40], 0
jne 0x450041
mov esi, 0x44e
lea edi, [ebp - 0x58]
call fcn.00419a46
push dword [ebp - 0x58]
call fcn.00497e2f
pop ecx
mov eax, esi
call fcn.0049923d
ret
mov edi, ebx
call fcn.0042d1aa
mov esi, ebx
call fcn.0042d86e
push ebx
push 0x4cb3fc
push 0x4cb400
lea ecx, [ebp - 0x2c]
call fcn.0042f9b3
add esp, 0xc
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x58]
mov ecx, dword [eax]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], eax
jmp 0x4500ce
lea esi, [ebp - 0x34]
call fcn.00432e32
cmp dword [eax + 0x18], 8
jb 0x450092
mov eax, dword [eax + 4]
jmp 0x450095
add eax, 4
push eax
push str.___s_
lea ecx, [ebp - 0x74]
call fcn.0042f9b3
pop ecx
pop ecx
push 0xffffffffffffffff
push 0
push eax
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.0040c7f8
push 0
push 1
lea esi, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.00403ead
lea esi, [ebp - 0x34]
call fcn.00419672
lea edi, [ebp - 0x3c]
lea esi, [ebp - 0x34]
call fcn.0041e1dc
test al, al
jne 0x45007f
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push ebx
call esi
test eax, eax
je 0x45010b
push 0x4cada4
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x45010b
push str.__md1M
lea eax, [ebp - 0x2c]
push eax
call fcn.0040c4c2
push 0
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x5c], 0xf
call fcn.0040492f
mov byte [ebp - 4], 4
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x45012c
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x74]
push ecx
push eax
call fcn.0044f9e4
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x74]
mov edi, eax
call fcn.00403db0
test edi, edi
je 0x450151
mov esi, ebx
call fcn.0042d86e
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.00403ead
mov esi, edi
jmp 0x450028