joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496e6e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca35e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496f91
push ecx
lea ecx, [esi + 0x18]
call fcn.004b668e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496fa8
push ecx
lea ecx, [esi + 0x24]
call fcn.004b659e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e02ce
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005137be
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e03f1
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffaee
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0408
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff9fe
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5299fe
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055ceee
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529b21
push ecx
lea ecx, [esi + 0x18]
call fcn.0054921e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529b38
push ecx
lea ecx, [esi + 0x24]
call fcn.0054912e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5488fe
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
in al, 0xa2
dec ecx
invalid
scasd eax, dword es:[edi]
inc eax
add eax, 0x708cc5d7
mov bh, 0x35
push ebx
push ss
mov bh, 0x83
fdiv qword [edx + 0x56b18507]
jo 0x548905
jecxz 0x54888f
scasd eax, dword es:[edi]
movsd dword es:[edi], dword [esi]
and esp, ecx
test al, 0xb7
test ebp, ecx
loopne 0x5488d4
cwde
out 0xc0, al
int1
inc esp
clc
push esp
xlatb
into
not dword [0x83460ee6]
mov bh, 0x48
dec eax
mov eax, dword [0x9fb36a56]
jecxz 0x548934
je 0x5488fd
cmp ebx, 0xffffff9b
or ebx, ebx
ror dword [eax + 0x57], 0xb5
mov cl, 0xe3
int 0xa4
mov dh, 0x55
push ebp
mov dh, 0x50
mov byte [edx + 0x1b8c3f6a], dl
xchg ebp, eax
mov eax, dword [0x537435a3]
xchg edi, eax
mov dword [0x4680d957], eax
cmpsd dword [esi], dword es:[edi]
clc
mul ch
and al, 0x1f
and eax, 0x403a70f7
movsb byte es:[edi], byte [esi]
cmp al, byte [eax - 0x5c]
fisttp dword [ebx - 0x1a2a879f]
mov esp, ecx
dec ecx
in al, dx
push 0xfffffffffffffff2
cdq
jecxz 0x5488cb
inc edi
mov ch, 0xb3
push ebp
xor al, byte [ebp + 0x37]
xchg edi, eax
xchg edi, eax
cmp dword [eax], ebp
sar byte [eax], 0xeb
or byte [0xad5bea34], al
js 0x5489a8
ffree st(5)
iretd
pop ss
pushal
pop es
push ebx
push es
lea esp, [edi]
mov byte [ebp - 0x7a8a31c6], 0x26
mov ebp, 0x2ff67a81
mov bh, 0xef
push ebp
push esp
lodsb al, byte [esi]
or ch, cl
je 0x80ad57e
rcl dword [edi], cl
scasb al, byte es:[edi]
or ecx, dword [ecx - 0x1a287ef0]
adc edx, dword [ebp - 0x76a1380f]
and ch, ch
xchg ebx, eax
sbb dword [esi - 0x75b7425c], esi
cmpsb byte [esi], byte es:[edi]
push ebp
push ebx
xchg esi, eax
adc eax, 0xd09836
pop eax
out dx, eax
sub esi, 0xa588f7b3
pushfd
xchg ebx, eax
add byte [ecx], bl
adc al, 0x3d
push edx
pop ecx
adc ah, byte [eax]
sub esp, dword [esi + 0x52]
mov ebx, 0xf9ebfb16
invalid
Function at 0x57300e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a64fe
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x573131
push ecx
lea ecx, [esi + 0x18]
call fcn.0059282e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x573148
push ecx
lea ecx, [esi + 0x24]
call fcn.0059273e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5bcfee
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005f04de
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bd111
push ecx
lea ecx, [esi + 0x18]
call fcn.005dc80e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bd128
push ecx
lea ecx, [esi + 0x24]
call fcn.005dc71e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5efebe
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
cmp ecx, 0xffffff82
movsb byte es:[edi], byte [esi]
sbb eax, 0xd8ab9534
aas
Function at 0x60667e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00639b6e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x6067a1
push ecx
lea ecx, [esi + 0x18]
call fcn.00625e9e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x6067b8
push ecx
lea ecx, [esi + 0x24]
call fcn.00625dae
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x624bde
Capabilities:
Encode data using xor

Disassembly:
add byte [edx - 0x6a9d14d0], 0
jne 0x624b90
adc edx, eax
push esp
jl 0x624b69
push edx
into
cmp ch, byte [eax - 0xea08b9c]
and ch, byte [edi + 0x59fcea11]
invalid
cmp dh, bl
jb 0x624b09
fidiv word [ebx]
bound esp, qword [ecx]
xchg ecx, eax
inc eax
add dword [eax + 0x5a], ecx
sub byte [ebp - 0x28], 0x19
insd dword es:[edi], dx
fcomp dword [ecx]
inc eax
int 0x76
mov bl, 0xf8
mov dl, 0x93
div dword [esi + eax]
pop ebx
mov al, byte [0xaa58229b]
invalid
sbb ebp, esi
lodsd eax, dword ss:[esi]
push cs
fucompi st(1)
jecxz 0x624b16
ja 0x624bef
pop esp
scasd eax, dword es:[edi]
imul byte [eax - 0x29bf42ef]
adc bl, byte [edx - 0x3e394226]
and dword [esi], esp
jl 0x624c0c
xor dword [ebp - 0x18], ebx
cmp ah, byte [ebx - 0x1c9463c5]
pop esp
call 0x9c9deee3
imul esp, ebx, 0x5c
outsd dx, dword [esi]
push es
xchg dword [edi - 0x4d], edx
sub bh, byte [ebx - 0x4e]
int1
jp 0x624b5b
clc
lar edi, edi
jge 0x624ba4
mov dword [0x8bde5f3a], esi
mov al, byte [0x5854b56c]
sbb ebx, 0x93d609d1
rol byte [ebx], 1
invalid
mov ebp, 0xf5cb36ef
test al, 0x88
jecxz 0x624b85
adc byte [ebp + edi*4 - 0x4ff34c29], ah
dec eax
inc ebx
and cl, byte [ebx - 0x3f]
and dword [0xc55578b], ebx
push ss
or ebp, dword [edx - 0x5e]
mov ebp, ebp
or dword [edx + 0x4a], 0xffffffdb
pop edi
and al, 0x4a
cmp dword [ebp - 0x67], 0xd4aa599d
adc ecx, dword [esi]
pop ecx
stosb byte es:[edi], al
aam 0x13
push cs
xor al, 0x51
scasd eax, dword es:[edi]
cli
fnsave dword [eax + esi*8 - 0x5dfa4ded]
shl dword [ecx - 0x67a38f78], 0x20
jle 0x624c05
cmp esi, dword [esi + 0x1a]
or edx, eax
inc ecx
shr byte [ebx], cl
xor ebp, 0xad946720
ror ebx, 0xe6
sub dword [ecx], esi
mov ebp, 0x9e5e5827
retf

Function at 0x64d80d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x656338
cmp edx, dword [eax]
je 0x64d82f
add eax, 8
inc ecx
cmp eax, 0x6563c8
jl 0x64d820
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x656338]
jne 0x64d95d
mov eax, dword [0xa59c90]
cmp eax, 1
je 0x64d937
test eax, eax
jne 0x64d860
cmp dword [0x656264], 1
je 0x64d937
cmp edx, 0xfc
je 0x64d95d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d897
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064e1f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e680
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64d8da
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064e680
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x652a3c
push edi
call fcn.00650550
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064e1f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064e200
lea eax, [ebp - 0xa0]
push 0x652a1c
push eax
call fcn.0064e200
push dword [esi + 0x65633c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064e200
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.006504c4
add esp, 0x2c
pop edi
jmp 0x64d95d
invalid
lea eax, [ebp + 8]
Function at 0x407e5c
Capabilities:
Hash data with crc32

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x4082d0
Capabilities:
Hash data with crc32

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x40c21c
Capabilities:
Hash data with crc32

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x40ef3c
Capabilities:
Hash data with crc32

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x411194
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00411148
test al, al
jne 0x4111b5
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x411201
xor eax, eax
push ebp
push 0x4111f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404f58
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4111f8
lea eax, [ebp - 0xc]
call fcn.00411184
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411440
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x411448
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x411535
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call 0x40ea30
mov edx, dword [ebp - 8]
mov ecx, 0x411550
xor eax, eax
call fcn.00411324
push 0
mov eax, dword [ebp - 4]
call fcn.00404f58
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x411503
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x411462
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x35
call fcn.00410f4c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.004084dc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0040efb8
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x67
call fcn.00410f1c
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x406f70]
call fcn.0040c21c
call fcn.004040b0
jmp 0x411462
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404ecc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41153c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404ec4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ec4
ret

Function at 0x411564
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x417d90]
cmp dword [eax], 2
jne 0x4115cc
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x411587
xor eax, eax
jmp 0x4115db
lea eax, [esp + 8]
push eax
push 0x4115e0
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4115cc
xor eax, eax
jmp 0x4115db
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret