joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ff70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x14]
mov eax, edx
push ebx
mov ebx, dword [ecx + 0x10a8]
push ebp
mov ebp, dword [ecx + 0x10ac]
push esi
lea esi, [edx + 1]
mov dword [esp + 0x20], 4
sub eax, esi
mov dword [esp + 0x10], eax
mov eax, edx
sub eax, esi
add eax, 2
sub edx, esi
mov dword [esp + 0x14], eax
push edi
mov edi, dword [ecx + 0x10a4]
lea eax, [edx + 3]
mov edx, dword [ecx + 0x10b0]
mov dword [esp + 0x1c], eax
lea ebx, [ebx]
mov eax, dword [esp + 0x14]
lea esi, [esi + 4]
movzx eax, byte [eax + esi - 4]
xor edi, dword [ecx + eax*4 + 0xba4]
mov dword [ecx + 0x10a4], edi
movzx eax, byte [esi - 4]
xor ebx, dword [ecx + eax*4 + 0xba4]
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x10a8], ebx
movzx eax, byte [eax + esi - 4]
xor ebp, dword [ecx + eax*4 + 0xba4]
mov eax, dword [esp + 0x1c]
mov dword [ecx + 0x10ac], ebp
movzx eax, byte [eax + esi - 4]
xor edx, dword [ecx + eax*4 + 0xba4]
sub dword [esp + 0x24], 1
mov dword [ecx + 0x10b0], edx
jne 0x45ffc0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x460030
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x1dc
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x1d8], eax
mov eax, dword [esp + 0x1e8]
push ebx
mov ebx, dword [esp + 0x1e4]
push ebp
push esi
mov esi, dword [esp + 0x1f0]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1fc]
mov dword [esp + 0x10], eax
push edi
cmp esi, 0x40
jbe 0x4600ae
lea eax, [esp + 0xf8]
push eax
call fcn.0048d780
push esi
push ebx
lea eax, [esp + 0x100]
push eax
call fcn.0048d7d0
lea eax, [esp + 0x1a8]
push eax
lea eax, [esp + 0xfc]
push eax
call fcn.0048d630
lea ebx, [esp + 0x1a8]
mov esi, 0x20
xor edx, edx
test esi, esi
je 0x4600d5
mov edi, ebx
lea eax, [esp + 0x168]
sub edi, eax
nop
lea ecx, [esp + 0x168]
add ecx, edx
inc edx
mov al, byte [edi + ecx]
xor al, 0x36
mov byte [ecx], al
cmp edx, esi
jb 0x4600c0
mov ebp, 0x40
cmp esi, ebp
jae 0x4600fe
mov ecx, ebp
lea edi, [esp + 0x168]
sub ecx, esi
add edi, esi
mov edx, ecx
mov eax, 0x36363636
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
call fcn.0048d780
push 0x40
lea eax, [esp + 0x16c]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0048d7d0
push dword [esp + 0x1fc]
lea eax, [esp + 0x1c]
push dword [esp + 0x14]
push eax
call fcn.0048d7d0
lea eax, [esp + 0x1c8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0048d630
lea eax, [esp + 0x88]
push eax
call fcn.0048d780
xor edx, edx
test esi, esi
je 0x460175
lea eax, [esp + 0x168]
sub ebx, eax
nop
lea ecx, [esp + 0x168]
add ecx, edx
inc edx
mov al, byte [ebx + ecx]
xor al, 0x5c
mov byte [ecx], al
cmp edx, esi
jb 0x460160
cmp esi, ebp
jae 0x460199
sub ebp, esi
lea edi, [esp + 0x168]
mov ecx, ebp
add edi, esi
mov edx, ecx
mov eax, 0x5c5c5c5c
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push 0x40
lea eax, [esp + 0x16c]
push eax
lea eax, [esp + 0x90]
push eax
call fcn.0048d7d0
push 0x20
lea eax, [esp + 0x1cc]
push eax
lea eax, [esp + 0x90]
push eax
call fcn.0048d7d0
push dword [esp + 0x14]
lea eax, [esp + 0x8c]
push eax
call fcn.0048d630
mov ecx, dword [esp + 0x1e8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x1dc
ret 0x14
Function at 0x460200
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xcc
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 0xd8]
push ebx
mov ebx, dword [esp + 0xd4]
push ebp
mov ebp, dword [esp + 0xe8]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xf0]
push esi
mov esi, dword [esp + 0xe8]
mov dword [esp + 0x10], eax
mov eax, esi
mov dword [esp + 0x14], ebx
cmp esi, 0x40
jb 0x460259
mov eax, 0x40
push eax
push ecx
lea eax, [esp + 0x78]
push eax
call fcn.004edb80
add esp, 0xc
cmp esi, 0x44
jae 0x4603e2
lea eax, [esi + 1]
mov byte [esp + esi + 0x70], 0
cmp eax, 0x44
jae 0x4603e2
mov byte [esp + eax + 0x70], 0
lea eax, [esi + 2]
cmp eax, 0x44
jae 0x4603e2
push edi
mov byte [esp + eax + 0x74], 0
lea eax, [esp + 0x54]
push eax
lea eax, [esi + 4]
mov byte [esp + esi + 0x7b], 1
push eax
lea eax, [esp + 0x7c]
push eax
push dword [esp + 0xf0]
push ebx
call fcn.00460030
mov eax, dword [esp + 0xfc]
lea esi, [esp + 0x54]
dec eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x1c], eax
lea edi, [esp + 0x34]
mov eax, dword [esp + 0x10]
mov ecx, 8
mov dword [esp + 0x2c], eax
xor ebp, ebp
mov eax, dword [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x20], 0x10
mov dword [esp + 0x24], 0x10
mov dword [esp + 0x30], eax
mov dword [esp + 0x10], ebp
mov edi, edi
mov ebx, dword [esp + ebp + 0x1c]
test ebx, ebx
je 0x460375
mov ebp, dword [esp + 0x18]
lea esp, [esp]
lea eax, [esp + 0xb8]
push eax
push 0x20
lea eax, [esp + 0x5c]
push eax
push dword [esp + 0xf0]
push ebp
call fcn.00460030
mov ecx, 8
lea esi, [esp + 0xb8]
lea edi, [esp + 0x54]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movzx ecx, byte [esp + eax + 0x54]
xor byte [esp + eax + 0x34], cl
movzx ecx, byte [esp + eax + 0x55]
xor byte [esp + eax + 0x35], cl
movzx ecx, byte [esp + eax + 0x56]
xor byte [esp + eax + 0x36], cl
movzx ecx, byte [esp + eax + 0x57]
xor byte [esp + eax + 0x37], cl
add eax, 4
cmp eax, 0x20
jb 0x460340
sub ebx, 1
jne 0x460310
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + ebp + 0x28]
lea esi, [esp + 0x34]
add ebp, 4
mov ecx, 8
mov dword [esp + 0x10], ebp
rep movsd dword es:[edi], dword [esi]
cmp ebp, 0xc
jb 0x460300
push 0x44
lea eax, [esp + 0x78]
push eax
call fcn.0048bcb0
push 0x20
lea eax, [esp + 0x38]
push eax
call fcn.0048bcb0
push 0x20
lea eax, [esp + 0x58]
push eax
call fcn.0048bcb0
push 0x20
lea eax, [esp + 0xbc]
push eax
call fcn.0048bcb0
mov ecx, dword [esp + 0xd8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0xcc
ret 0x20
call fcn.004ebafc
int3
Function at 0x4611c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
mov ecx, dword [esi]
mov eax, dword [edi]
cmp eax, ecx
jbe 0x461229
mov edx, 1
cmp ecx, edx
jb 0x461202
mov ebp, dword [esp + 0x14]
lea ecx, [esi + 4]
mov ebx, edi
sub ebx, esi
sub ebp, esi
lea ebx, [ebx]
mov eax, dword [ebx + ecx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
inc edx
mov dword [ecx + ebp - 4], eax
cmp edx, dword [esi]
jbe 0x4611f0
mov eax, dword [edi]
sub eax, dword [esi]
mov ebx, dword [esp + 0x14]
shl eax, 2
push eax
lea eax, [edi + edx*4]
push eax
lea eax, [ebx + edx*4]
push eax
call fcn.004edb80
mov eax, dword [edi]
add esp, 0xc
mov dword [ebx], eax
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
jae 0x46127a
mov edx, 1
cmp eax, edx
jb 0x461253
mov ebp, dword [esp + 0x14]
lea ecx, [esi + 4]
mov ebx, edi
sub ebx, esi
sub ebp, esi
mov eax, dword [ecx + ebx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
inc edx
mov dword [ecx + ebp - 4], eax
cmp edx, dword [edi]
jbe 0x461241
mov eax, dword [esi]
sub eax, dword [edi]
mov ebx, dword [esp + 0x14]
shl eax, 2
push eax
lea eax, [esi + edx*4]
push eax
lea eax, [ebx + edx*4]
push eax
call fcn.004edb80
mov eax, dword [esi]
add esp, 0xc
mov dword [ebx], eax
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
test eax, eax
je 0x461294
mov ebx, edi
lea edx, [esi + eax*4]
sub ebx, esi
mov ecx, dword [edx + ebx]
xor ecx, dword [edx]
jne 0x461294
sub edx, 4
sub eax, 1
jne 0x461285
mov ebx, dword [esp + 0x14]
mov dword [ebx], eax
test eax, eax
je 0x4612b7
sub edi, esi
lea edx, [esi + eax*4]
sub ebx, esi
mov ecx, dword [edx + edi]
lea edx, [edx - 4]
xor ecx, dword [edx + 4]
mov dword [edx + ebx + 4], ecx
sub eax, 1
jne 0x4612a5
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x4616c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x58
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x64]
push ebx
mov ebx, dword [esp + 0x64]
push esi
mov esi, dword [esp + 0x64]
mov dword [esp + 8], ebx
cmp dword [ebx], 0
mov dword [esp + 0xc], eax
je 0x461802
mov ecx, dword [eax]
test ecx, ecx
je 0x461802
mov edx, eax
lea eax, [esp + 0x10]
push edi
mov edi, dword [0x56b708]
sub edx, eax
lea eax, [edx + ecx*4]
mov eax, dword [esp + eax + 0x14]
mov eax, dword [edi + eax*4]
mov dword [esp + ecx*4 + 0x14], eax
sub ecx, 1
jne 0x461706
push 0x90
push ecx
push esi
call fcn.004ee100
mov edi, dword [ebx]
add esp, 0xc
test edi, edi
je 0x46179a
mov ecx, dword [0x56b708]
push ebp
mov ebp, dword [0x56b704]
jmp 0x461740
mov eax, dword [ebx + edi*4]
mov ebx, dword [ecx + eax*4]
cmp ebx, 0x7fff
je 0x461790
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
test eax, eax
je 0x461790
lea edx, [eax - 1]
add edx, edi
lea edx, [esi + edx*4]
mov ecx, dword [esp + eax*4 + 0x18]
cmp ecx, 0x7fff
je 0x461782
add ecx, ebx
cmp ecx, 0x7fff
jb 0x46177c
add ecx, 0xffff8001
mov ecx, dword [ebp + ecx*4]
xor dword [edx], ecx
sub edx, 4
sub eax, 1
jne 0x461760
mov ecx, dword [0x56b708]
mov ebx, dword [esp + 0x10]
sub edi, 1
jne 0x461740
pop ebp
mov eax, dword [esp + 0x10]
mov edx, dword [ebx]
pop edi
mov ecx, dword [eax]
dec ecx
add edx, ecx
mov dword [esi], edx
cmp edx, 0x11
jle 0x4617ce
lea ecx, [esi - 0x38]
lea ecx, [ecx + edx*4]
add edx, 0xffffffef
mov eax, dword [ecx + 0x38]
lea ecx, [ecx - 4]
xor dword [ecx - 8], eax
xor dword [ecx + 4], eax
mov dword [ecx + 0x3c], 0
sub edx, 1
jne 0x4617b6
cmp dword [esi], 0x11
jbe 0x461808
mov dword [esi], 0x11
lea esp, [esp]
mov eax, dword [esi]
cmp dword [esi + eax*4], 0
jne 0x461808
add eax, 0xffffffff
mov dword [esi], eax
jne 0x4617e0
pop esi
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.004ebbd8
add esp, 0x58
ret 0xc
mov dword [esi], 0
mov ecx, dword [esp + 0x5c]
pop esi
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x58
ret 0xc
Function at 0x461960
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
mov ecx, dword [edi]
test ecx, ecx
je 0x461a5a
mov eax, dword [edi + ecx*4]
push ebx
mov ebx, dword [0x56b704]
push ebp
mov ebp, dword [0x56b708]
push esi
mov eax, dword [ebp + eax*4]
cmp eax, 0x7fff
je 0x4619a7
add eax, eax
cmp eax, 0x7fff
jb 0x46199a
add eax, 0xffff8001
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + eax*4]
mov dword [edx + ecx*8 - 4], eax
jmp 0x4619b3
mov edx, dword [esp + 0x14]
mov dword [edx + ecx*8 - 4], 0
mov esi, dword [edi]
sub esi, 1
je 0x461a08
lea ecx, [esi*8 - 4]
add ecx, edx
jmp 0x4619d0
mov dword [ecx + 4], 0
mov eax, dword [edi + esi*4]
mov eax, dword [ebp + eax*4]
cmp eax, 0x7fff
je 0x4619fa
add eax, eax
cmp eax, 0x7fff
jb 0x4619f3
add eax, 0xffff8001
mov eax, dword [ebx + eax*4]
mov dword [ecx], eax
jmp 0x461a00
mov dword [ecx], 0
sub ecx, 8
sub esi, 1
jne 0x4619d0
mov eax, dword [edi]
lea esi, [eax*2 - 1]
mov dword [edx], esi
cmp esi, 0x11
jle 0x461a39
lea ecx, [esi - 0xe]
add esi, 0xffffffef
lea ecx, [edx + ecx*4]
mov eax, dword [ecx + 0x38]
lea ecx, [ecx - 4]
xor dword [ecx - 8], eax
xor dword [ecx + 4], eax
mov dword [ecx + 0x3c], 0
sub esi, 1
jne 0x461a21
cmp dword [edx], 0x11
pop esi
pop ebp
pop ebx
jbe 0x461a64
mov dword [edx], 0x11
mov eax, dword [edx]
cmp dword [edx + eax*4], 0
jne 0x461a64
add eax, 0xffffffff
mov dword [edx], eax
jne 0x461a47
pop edi
ret 8
mov eax, dword [esp + 8]
mov dword [eax], 0
pop edi
ret 8
Function at 0x467770
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50716b
mov eax, dword fs:[0]
push eax
mov eax, 0x5028
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x3010]
push 0x800
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x46795d
cmp eax, 0x800
jae 0x46795d
push 0x800
lea eax, [ebp - 0x4010]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x46795d
cmp eax, 0x800
jae 0x46795d
lea eax, [ebp - 0x3010]
push eax
call fcn.00478eb0
mov ebx, eax
lea eax, [ebp - 0x4010]
push eax
call fcn.00478eb0
mov esi, eax
cmp word [esi], 0
je 0x46795d
push esi
push ebx
call fcn.00491ab0
test eax, eax
je 0x46795d
push esi
push edi
call fcn.00478eb0
push eax
call fcn.00491ab0
test eax, eax
jne 0x46795d
mov word [ebp - 0x1010], ax
xor esi, esi
test ax, ax
jne 0x4678b1
push 0x800
push edi
lea eax, [ebp - 0x1010]
push eax
call fcn.0048e710
push esi
push str.rtmp_d
push 0x800
lea eax, [ebp - 0x1010]
push eax
call fcn.00478eb0
push eax
call fcn.004028e0
add esp, 0x10
lea eax, [ebp - 0x1010]
push eax
call fcn.00469360
test al, al
je 0x467896
xor eax, eax
mov word [ebp - 0x1010], ax
jmp 0x46789d
mov ax, word [ebp - 0x1010]
add esi, 0x7b
cmp esi, 0x2710
jl 0x467844
test ax, ax
je 0x46795d
push 0x800
push edi
lea eax, [ebp - 0x2010]
push eax
call fcn.0048e710
push 0x800
push ebx
lea eax, [ebp - 0x2010]
push eax
call fcn.00478fb0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x2010]
push eax
call esi
test eax, eax
je 0x46795d
lea ecx, [ebp - 0x5034]
call fcn.00467980
mov dword [ebp - 4], 0
xor bl, bl
push edi
call fcn.00469360
test al, al
jne 0x46791d
push 0x12
push edi
lea ecx, [ebp - 0x5034]
call fcn.00467ce0
mov bl, al
lea eax, [ebp - 0x2010]
push eax
lea eax, [ebp - 0x1010]
push eax
call esi
test bl, bl
je 0x467947
lea ecx, [ebp - 0x5034]
call fcn.00467b10
lea ecx, [ebp - 0x5034]
call fcn.00467df0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5034]
call fcn.004679c0
mov al, 1
jmp 0x46795f
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ebbd8
mov esp, ebp
pop ebp
ret 4
Function at 0x467e20
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
jne 0x467e37
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0xc]
mov ebp, dword [esp + 0x14]
push 0
push eax
push ebx
push ebp
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x467edf
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x467e8e
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x467e72
cmp eax, 3
jne 0x467e8e
cmp ebx, 0x4e20
jbe 0x467e8e
push 0x4e20
push ebp
mov ecx, esi
call fcn.00467e20
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp dword [esi + 0xc], 1
jne 0x467ea8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x467ea8
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
cmp dword [esi + 0xc], 0
jne 0x467ed5
cmp ebx, 0x8000
jbe 0x467ed5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x467ed5
push 0x8000
push ebp
mov ecx, esi
call fcn.00467e20
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x468010
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1010
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x100c], eax
mov edx, dword [esp + 0x1014]
push ebx
mov ebx, dword [esp + 0x101c]
push ebp
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
cmp byte [edi + 0x1c], 0
mov dword [edi + 0x1020], 0
jne 0x468058
test bl, 4
jne 0x468058
xor cl, cl
jmp 0x46805a
mov cl, 1
mov eax, ebx
shr eax, 1
push esi
and al, 1
movzx esi, al
neg esi
sbb esi, esi
and esi, 0xc0000000
add esi, 0x80000000
test bl, 1
je 0x46807f
or esi, 0x40000000
shr ebx, 3
not ebx
and ebx, 1
test cl, cl
je 0x46808e
or ebx, 2
xor eax, eax
cmp byte [edi + 0x15], al
push 0
setne al
dec eax
and eax, 0x8000000
push eax
push 3
push 0
push ebx
push esi
push edx
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x468116
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push 0x800
push eax
push dword [esp + 0x1c]
call fcn.004785a0
test al, al
je 0x468105
push 0
push dword [esp + 0x1c]
lea eax, [esp + 0x24]
push 3
push 0
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x468100
mov dword [esp + 0x10], eax
cmp ebp, 0xffffffff
jne 0x468116
cmp dword [esp + 0x10], 2
jne 0x468116
mov dword [edi + 0x1020], 1
cmp ebp, 0xffffffff
mov byte [edi + 0x12], 0
mov dword [edi + 0xc], 0
setne bl
mov byte [edi + 0x10], 0
pop esi
test bl, bl
je 0x468145
push 0x800
push dword [esp + 0x14]
lea ecx, [edi + 0x1e]
mov dword [edi + 4], ebp
push ecx
call fcn.0048e710
mov ecx, dword [esp + 0x1018]
mov al, bl
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x1010
ret 8
Function at 0x468660
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, ecx
test ebx, ebx
jne 0x468679
pop ebp
mov al, 1
pop ebx
add esp, 0x14
ret 8
cmp dword [ebp + 0xc], 1
jne 0x46868a
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp + 4], eax
push esi
push edi
mov ecx, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 0xc], 0
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0
je 0x4686f4
xor esi, esi
test ebx, ebx
je 0x468717
jmp 0x4686b0
mov eax, ebx
sub eax, esi
cmp eax, 0x4000
jb 0x4686c0
mov eax, 0x4000
push 0
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0x34]
add eax, esi
push eax
push dword [ebp + 4]
call ecx
cmp eax, 1
sete al
mov byte [esp + 0x2c], al
test al, al
je 0x468717
mov ecx, dword [sym.imp.KERNEL32.dll_WriteFile]
add esi, 0x4000
cmp esi, ebx
jb 0x4686b0
jmp 0x46870f
push 0
lea eax, [esp + 0x14]
push eax
push ebx
push dword [esp + 0x34]
push dword [ebp + 4]
call ecx
cmp eax, 1
sete al
mov byte [esp + 0x2c], al
test al, al
jne 0x468804
cmp byte [ebp + 0x14], 0
je 0x468804
cmp dword [ebp + 0xc], 0
jne 0x468804
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, ebp
mov eax, dword [ebp]
mov eax, dword [eax + 0x10]
call eax
mov dword [esp + 0x18], eax
lea eax, [ebp + 0x1e]
push eax
mov dword [esp + 0x20], edx
call fcn.004694b0
push edi
mov dword [esp + 0x18], eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
cmp esi, ecx
jb 0x4687a7
ja 0x468769
cmp dword [esp + 0x14], ebx
jbe 0x4687a7
mov esi, dword [esp + 0x18]
mov edx, esi
mov edi, dword [esp + 0x1c]
sub edx, ebx
mov eax, edi
sbb eax, ecx
test eax, eax
jg 0x4687a7
jl 0x468784
cmp edx, 0xffffffff
ja 0x4687a7
mov eax, ebx
add eax, esi
adc ecx, edi
mov dword [esp + 0x20], ecx
js 0x4687a7
jg 0x468797
cmp eax, 0xffffffff
jbe 0x4687a7
lea esi, [ebp + 0x1e]
mov ecx, 0x56df60
push esi
call fcn.004634d0
jmp 0x4687aa
lea esi, [ebp + 0x1e]
push 0
push esi
mov ecx, 0x56df60
call fcn.00462b00
test al, al
je 0x4687f4
mov eax, dword [esp + 0x10]
mov ecx, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jae 0x468692
test eax, eax
je 0x468692
mov esi, dword [ebp]
mov ecx, ebp
push 0
mov eax, dword [esi + 0x10]
call eax
sub eax, dword [esp + 0x14]
mov ecx, ebp
sbb edx, 0
push edx
push eax
call dword [esi + 0xc]
jmp 0x46868c
lea edx, [ebp + 0x1e]
mov ecx, 0x56df60
push edx
push 0
call fcn.00463460
mov al, byte [esp + 0x2c]
pop edi
pop esi
mov byte [ebp + 8], 1
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x468890
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x507208
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
mov eax, dword [0x528af4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
cmp dword [esi + 0x10], 0
jbe 0x468903
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov eax, 0x54
mov word [ebp - 0x20], ax
mov eax, dword [esi]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x468919
push eax
call fcn.004f252e
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x468e90
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1004
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
test bl, bl
jne 0x468ee7
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004785a0
test al, al
je 0x468ee7
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x468ee9
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x1004
ret 4

Function at 0x468f10
Capabilities:
Delete file

Disassembly:
mov eax, 0x1004
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test bl, bl
jne 0x468f67
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004785a0
test al, al
je 0x468f67
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
jmp 0x468f69
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x1004
ret 4
Function at 0x469360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x100c]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4693b0
push 0x800
lea eax, [esp + 0xc]
push eax
push ebx
call fcn.004785a0
test al, al
je 0x4693b0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov ecx, dword [esp + 0x1008]
xor eax, eax
cmp esi, 0xffffffff
pop esi
setne al
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x1004
ret 4

Function at 0x4693e0
Capabilities:
Delete file

Disassembly:
sub esp, 0x20
cmp dword [ecx + 0x10], 0
jbe 0x469435
xor eax, eax
mov dword [ecx + 0x10], 0
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov eax, 0x54
mov word [esp + 0x10], ax
mov eax, dword [ecx]
mov dword [esp + 8], eax
lea eax, [esp]
push eax
mov dword [esp + 8], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret

Function at 0x469440
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
push edi
mov edi, dword [esp + 0x1010]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x469492
push 0x800
lea eax, [esp + 0xc]
push eax
push edi
call fcn.004785a0
test al, al
je 0x469490
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x469492
mov eax, esi
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004ebbd8
add esp, 0x1004
ret 4

Function at 0x4694b0
Capabilities:
Get disk size

Disassembly:
mov eax, 0x101c
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x1018], eax
mov eax, dword [esp + 0x1020]
lea ecx, [esp + 0x18]
push 0x800
push ecx
push eax
call fcn.00478280
lea eax, [esp + 8]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 0x14]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 8]
push eax
movzx eax, word [esp + 0x24]
lea ecx, [esp + 0x24]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x469541
mov edx, dword [esp + 4]
cmp edx, dword [esp + 0xc]
ja 0x469541
xor eax, eax
add eax, dword [esp]
adc edx, 0
mov ecx, dword [esp + 0x1018]
xor ecx, esp
call fcn.004ebbd8
add esp, 0x101c
ret 4
mov ecx, dword [esp + 0x1018]
xor eax, eax
xor ecx, esp
xor edx, edx
call fcn.004ebbd8
add esp, 0x101c
ret 4