joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c4d8
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x472af8]
je 0x41c4f3
inc edi
cmp edi, 0x17
jb 0x41c4e4
cmp edi, 0x17
jae 0x41c673
push ebp
push 3
call fcn.004212c0
cmp eax, 1
pop ecx
je 0x41c63f
push 3
call fcn.004212c0
test eax, eax
pop ecx
jne 0x41c527
cmp dword [0x4720f0], 1
je 0x41c63f
cmp ebx, 0xfc
je 0x41c672
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x475528
push ebp
call fcn.00416fd9
add esp, 0xc
test eax, eax
je 0x41c55d
push esi
push esi
push esi
push esi
push esi
call fcn.00411047
add esp, 0x14
push 0x104
mov esi, 0x475541
push esi
push 0
mov byte [0x475645], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41c5a1
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00416fd9
add esp, 0xc
test eax, eax
je 0x41c5a1
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00411047
add esp, 0x14
push esi
call fcn.00413f50
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x41c5e6
push esi
call fcn.00413f50
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x47583c
push 0x462c9c
sub ecx, eax
push ecx
push eax
call fcn.004197bd
add esp, 0x14
test eax, eax
je 0x41c5e6
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00411047
add esp, 0x14
jmp 0x41c5e8
xor esi, esi
push 0x462c98
push ebx
push ebp
call fcn.0041974c
add esp, 0xc
test eax, eax
je 0x41c608
push esi
push esi
push esi
push esi
push esi
call fcn.00411047
add esp, 0x14
push dword [edi*8 + 0x472afc]
push ebx
push ebp
call fcn.0041974c
add esp, 0xc
test eax, eax
je 0x41c62a
push esi
push esi
push esi
push esi
push esi
call fcn.00411047
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00421103
add esp, 0xc
jmp 0x41c672
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x41c672
cmp ebp, 0xffffffff
je 0x41c672
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x472afc]
push dword [esi]
call fcn.00413f50
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x421103
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004166bc
xor ebx, ebx
cmp dword [0x475b90], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4211d9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4212b9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4212b9
push eax
call fcn.0041664e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x475b90], eax
call esi
push eax
call fcn.0041664e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x475b94], eax
call esi
push eax
call fcn.0041664e
mov dword [0x475b98], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00417e04
test eax, eax
pop ecx
pop ecx
je 0x4211a7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00411047
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4211d9
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0041664e
cmp eax, ebx
pop ecx
mov dword [0x475ba0], eax
je 0x4211d9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041664e
pop ecx
mov dword [0x475b9c], eax
mov eax, dword [0x475b9c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x42125e
cmp dword [0x475ba0], ecx
je 0x42125e
push eax
call fcn.004166c5
push dword [0x475ba0]
mov esi, eax
call fcn.004166c5
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x42125e
cmp edi, ebx
je 0x42125e
call esi
cmp eax, ebx
je 0x42122b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42122b
test byte [ebp - 0x18], 1
jne 0x42125e
lea eax, [ebp - 0x10]
push eax
call fcn.00417e3b
test eax, eax
pop ecx
je 0x421246
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00411047
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x421255
or dword [ebp + 0x10], 0x200000
jmp 0x421299
or dword [ebp + 0x10], 0x40000
jmp 0x421299
mov eax, dword [0x475b94]
cmp eax, dword [ebp - 8]
je 0x421299
push eax
call fcn.004166c5
cmp eax, ebx
pop ecx
je 0x421299
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x421299
mov eax, dword [0x475b98]
cmp eax, dword [ebp - 8]
je 0x421299
push eax
call fcn.004166c5
cmp eax, ebx
pop ecx
je 0x421299
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x475b90]
call fcn.004166c5
cmp eax, ebx
pop ecx
je 0x4212b9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4212bb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x425080
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [edx]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x463b00]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
add eax, 1
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x463b00]
mov dword [edx + 8], ecx
ret
Function at 0x4250d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
push edi
mov edi, eax
mov esi, edx
jne 0x4250df
pop edi
xor eax, eax
pop esi
ret
cmp edi, 8
not esi
jb 0x4251c7
push ebp
mov ebp, edi
shr ebp, 3
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + 0x463b00]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x463b00]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + 0x463b00]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x463b00]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x463b00]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x463b00]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x463b00]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x463b00]
add ecx, 1
sub edi, 8
sub ebp, 1
mov esi, eax
jne 0x4250f0
pop ebp
test edi, edi
je 0x4251ec
jmp 0x4251d0
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x463b00]
add ecx, 1
sub edi, 1
jne 0x4251d0
mov eax, esi
pop edi
not eax
pop esi
ret
Function at 0x426240
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esi + 0x78]
test ecx, ecx
push edi
je 0x426288
mov eax, dword [esi + 0x80]
mov edi, dword [esi + 0x7c]
cmp eax, edi
jae 0x4262c5
sub edi, eax
cmp edi, edx
jbe 0x42625e
mov edi, edx
push edi
add eax, ecx
push eax
push ebx
call fcn.00414bd0
mov edx, dword [esi + 0x6c]
add dword [esi + 0x80], edi
add dword [esi + 0x68], edi
add esp, 0xc
mov eax, edi
mov ecx, ebx
call fcn.004250d0
mov dword [esi + 0x6c], eax
mov eax, edi
pop edi
pop ecx
ret
mov eax, dword [esi + 0x70]
test eax, eax
je 0x4262be
push 0
lea ecx, [esp + 8]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4262c5
mov edi, dword [esp + 4]
mov edx, dword [esi + 0x6c]
add dword [esi + 0x68], edi
mov eax, edi
mov ecx, ebx
call fcn.004250d0
mov dword [esi + 0x6c], eax
mov eax, edi
pop edi
pop ecx
ret
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop ecx
ret
Function at 0x427560
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x4c
push ebx
push ebp
push esi
mov esi, eax
push edi
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x427586
mov eax, 0x200
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
mov eax, dword [esp + 0x28]
mov edx, eax
xor ebp, ebp
and edx, 1
je 0x427598
mov ebp, 1
test al, 2
je 0x42759f
or ebp, 2
test al, 4
je 0x4275a6
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x4275b0
or ebp, 0x10
test al, 0x20
je 0x4275b7
or ebp, 0x20
test ecx, ecx
je 0x4275c3
or ebp, 0x40000000
jmp 0x4275c9
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x4275d9
or ebp, 0x800000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x28
mov dword [esp + 0x18], eax
jbe 0x427684
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x20]
push ecx
push 2
lea edx, [esp + 0x20]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [esp + 0x20]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push esi
call ebx
cmp word [esp + 0x14], 0x54ad
jne 0x427684
mov eax, dword [esp + 0x20]
lea edx, [eax + 0x34]
cmp dword [esp + 0x18], edx
jbe 0x427684
push 0
push 0
push eax
push esi
call edi
push 0
lea eax, [esp + 0x20]
push eax
push 4
lea ecx, [esp + 0x30]
push ecx
push esi
call ebx
mov eax, dword [esp + 0x24]
cmp eax, 0x5a4d
je 0x42767e
cmp eax, 0x454e
je 0x42767e
cmp eax, 0x454c
je 0x42767e
cmp eax, 0x4550
jne 0x427684
or ebp, 0x400000
mov eax, dword [esp + 0x60]
test eax, eax
je 0x42768e
mov dword [eax], ebp
mov eax, dword [esp + 0x64]
test eax, eax
je 0x42769c
mov edx, dword [esp + 0x18]
mov dword [eax], edx
mov ebx, dword [esp + 0x68]
test ebx, ebx
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
je 0x427714
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
push 0
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
call fcn.0045d460
mov dword [ebx], eax
push 0
mov edx, edi
sub edx, 0xd53e8000
mov eax, esi
push 0x989680
sbb eax, 0x19db1de
push eax
push edx
call fcn.0045d460
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
push 0
sub ecx, 0xd53e8000
push 0x989680
sbb edx, 0x19db1de
push edx
push ecx
mov dword [ebx + 4], eax
call fcn.0045d460
mov dword [ebx + 8], eax
mov ebx, dword [esp + 0x6c]
test ebx, ebx
je 0x427741
push esi
push edi
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.004260e0
movzx edx, word [esp + 0x24]
movzx eax, word [esp + 0x28]
shl edx, 0x10
add esp, 0x10
or edx, eax
mov dword [ebx], edx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret
Function at 0x427aa0
Capabilities:
Encode data using xor
Hash data with crc32
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
je 0x427b80
mov eax, dword [esi + 0x3c]
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x427ad4
cmp dword [esi + 0x40], edi
jae 0x427ad4
push eax
call fcn.00410615
add esp, 4
mov dword [esi + 0x3c], ebp
cmp dword [esi + 0x3c], ebp
jne 0x427aeb
lea eax, [edi + edi]
push eax
call fcn.0041000f
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.00414bd0
add esp, 0xc
cmp edi, ebp
jbe 0x427b7c
mov edx, dword [esi + 0x3c]
mov bl, byte [edx + ebp]
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
movzx ecx, bl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x463b00]
shr edi, 8
xor ecx, edi
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
add ecx, 1
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x463b00]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, bl
mov byte [ecx + ebp], al
add ebp, 1
cmp ebp, dword [esp + 0x18]
jb 0x427b01
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x3c]
pop ebp
mov edx, dword [esi + 0x20]
test edx, edx
je 0x427bb9
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x427ba1
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.00414bd0
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x427bda
push 0
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x4292d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x414
mov eax, dword [0x472100]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
mov ebx, dword [esp + 0x41c]
test ebx, ebx
push esi
mov esi, dword [esp + 0x424]
je 0x42930d
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42930d
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [esi]
test ax, ax
je 0x4293d9
mov ecx, esi
mov edx, esi
movzx eax, ax
cmp ax, 0x2f
je 0x42932c
cmp ax, 0x5c
jne 0x42932e
mov ecx, edx
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x429320
cmp ecx, esi
je 0x429372
sub ecx, esi
sar ecx, 1
push edi
add ecx, ecx
mov edi, ecx
push edi
lea eax, [esp + 0x218]
push esi
push eax
call fcn.00414bd0
lea ecx, [esp + 0x220]
push ecx
push ebx
mov word [esp + edi + 0x228], 0
call fcn.004292d0
add esp, 0x14
pop edi
test ebx, ebx
mov word [esp + 8], 0
je 0x429390
push 0x103
lea edx, [esp + 0xc]
push ebx
push edx
call fcn.00413831
add esp, 0xc
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x429397
sub eax, edx
sar eax, 1
mov ecx, 0x103
sub ecx, eax
push ecx
lea edx, [esp + 0xc]
push esi
push edx
call fcn.004137f4
add esp, 0xc
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4293d9
push 0
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [esp + 0x418]
pop esi
pop ebx
xor ecx, esp
call fcn.00410ae1
add esp, 0x414
ret

Function at 0x429550
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, ebx
imul edi, dword [esp + 8]
cmp byte [esi], 0
je 0x429582
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push edi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x429578
mov byte [esi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop edi
ret
xor eax, eax
mov ecx, edi
add ecx, dword [esi + 0x28]
adc eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x24]
jl 0x42959e
jg 0x429598
cmp ecx, dword [esi + 0x20]
jbe 0x42959e
mov edi, dword [esi + 0x20]
sub edi, dword [esi + 0x28]
mov eax, dword [esi + 0x1c]
add eax, dword [esi + 0x28]
push edi
push eax
push edx
call fcn.00414bd0
add esp, 0xc
add dword [esi + 0x28], edi
mov eax, edi
pop edi
adc dword [esi + 0x2c], 0
xor edx, edx
div ebx
ret

Function at 0x429860
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [edx]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4658c0]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
add eax, 1
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x4658c0]
mov dword [edx + 8], ecx
ret
Function at 0x4298b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
push edi
mov edi, eax
mov esi, edx
jne 0x4298bf
pop edi
xor eax, eax
pop esi
ret
cmp edi, 8
not esi
jb 0x4299a7
push ebp
mov ebp, edi
shr ebp, 3
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + 0x4658c0]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4658c0]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + 0x4658c0]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4658c0]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4658c0]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4658c0]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4658c0]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4658c0]
add ecx, 1
sub edi, 8
sub ebp, 1
mov esi, eax
jne 0x4298d0
pop ebp
test edi, edi
je 0x4299cc
jmp 0x4299b0
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x4658c0]
add ecx, 1
sub edi, 1
jne 0x4299b0
mov eax, esi
pop edi
not eax
pop esi
ret
Function at 0x42a670
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
xor al, bl
movzx ebx, al
xor ebx, edx
shr edx, 8
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4658c0]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
add edx, 1
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x4658c0]
pop ebx
mov dword [esi + 8], ecx
ret

Function at 0x42d2a0
Capabilities:
Get common file path

Disassembly:
cmp dword [edi], 0
push esi
jne 0x42d360
cmp dword [edi + 4], 0xffffffff
jne 0x42d360
lea esi, [edi + 0x244]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, esi
lea edx, [eax + 2]
jmp 0x42d2d0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42d2d0
sub eax, edx
sar eax, 1
movzx eax, word [edi + eax*2 + 0x242]
cmp ax, 0x5c
je 0x42d325
cmp ax, 0x2f
je 0x42d325
mov eax, esi
lea edx, [eax + 2]
jmp 0x42d300
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42d300
sub eax, edx
sar eax, 1
mov ecx, 0x103
sub ecx, eax
push ecx
push 0x465d58
push esi
call fcn.004137f4
add esp, 0xc
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push edx
push eax
lea esi, [esp + 0x14]
call fcn.0042a610
add esp, 8
test eax, eax
jne 0x42d347
mov eax, dword [esp + 0xc]
pop esi
ret 8
call fcn.0042ca30
mov dword [edi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop esi
ret 8
mov eax, 0x1000000
pop esi
ret 8
Function at 0x42d370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x42d38c
mov eax, 0xffffff9a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [edi + 0x18], ebx
je 0x42d37f
cmp dword [edi + 0x7c], ebx
je 0x42d39b
call fcn.0042c620
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.0042bd90
add esp, 0xc
test eax, eax
je 0x42d3c3
mov eax, 0xffffff99
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 0x84
call fcn.004122e2
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x42d404
push 0x4000
call fcn.004122e2
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
add esp, 4
cmp eax, ebx
mov dword [ebp], eax
mov dword [ebp + 0x44], ecx
mov dword [ebp + 0x48], edx
mov dword [ebp + 0x4c], ebx
jne 0x42d411
push ebp
call fcn.00412205
add esp, 4
mov eax, 0xffffff98
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov dword [ebp + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [ebp + 0x54], ecx
mov dword [ebp + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [ebp + 0x64], edx
mov ecx, dword [edi]
mov dword [ebp + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [ebp + 0x68], edx
mov dword [ebp + 0x18], ebx
cmp eax, ebx
jne 0x42d459
lea esi, [ebp + 4]
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
call fcn.0042cc20
test eax, eax
jne 0x42d459
mov dword [ebp + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [ebp + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [ebp + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [ebp + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x42d483
mov cl, byte [edi + 0x39]
mov byte [ebp + 0x80], cl
jmp 0x42d48c
mov dl, byte [edi + 0x3f]
mov byte [ebp + 0x80], dl
mov al, byte [ebp + 0x6c]
mov esi, dword [esp + 0x24]
neg al
lea edx, [ebp + 0x70]
mov dword [edx], 0x12345678
mov dword [ebp + 0x74], 0x23456789
mov dword [ebp + 0x78], 0x34567890
sbb eax, eax
and eax, 0xc
cmp esi, ebx
mov dword [ebp + 0x7c], eax
je 0x42d4c8
mov cl, byte [esi]
cmp cl, bl
je 0x42d4c8
call fcn.00429860
add esi, 1
jne 0x42d4b8
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x1c]
lea eax, [ecx + edx + 0x1e]
mov dword [ebp + 0x3c], eax
mov dword [ebp + 8], ebx
mov dword [edi + 0x7c], ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x42e3e0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x42e3ff
cmp eax, 0x106
je 0x42e3ff
push 0x106
call fcn.00406380
mov eax, dword [esi]
push eax
mov eax, dword [esp + 0x10]
push 0
push 0x466c9c
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x42e42c
mov edx, edi
nop
add edx, 2
add ecx, 1
cmp word [edx], 0
jne 0x42e420
mov word [edi + ecx*2], 0
pop edi
mov dword [esi + 4], ecx
pop esi
ret
Function at 0x42ea60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x472100]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, 1
test byte [0x475e30], al
mov dword [esp], 0
jne 0x42eab2
or dword [0x475e30], eax
mov eax, dword [0x474db4]
mov edx, dword [eax + 0xc]
mov ecx, 0x474db4
call edx
add eax, 0x10
push 0x460cb0
mov dword [0x475e2c], eax
call fcn.00410e71
add esp, 4
mov eax, dword [0x475e2c]
cmp dword [eax - 0xc], 0
jne 0x42eb22
push 0x104
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x42eb1d
lea eax, [esp + 4]
lea edx, [eax + 2]
jmp 0x42eae0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42eae0
sub eax, edx
sar eax, 1
push ebx
lea ecx, [esp + 8]
mov ebx, eax
push ecx
mov eax, 0x475e2c
call fcn.00401960
mov eax, 0x475e2c
call fcn.0042e710
push 8
push 0x4664b8
push 0x475e2c
call fcn.00401850
pop ebx
mov eax, dword [0x475e2c]
add eax, 0xfffffff0
call fcn.004018f0
mov ecx, dword [esp + 0x20c]
add eax, 0x10
mov dword [esi], eax
xor ecx, esp
mov eax, esi
call fcn.00410ae1
add esp, 0x210
ret

Function at 0x42f010
Capabilities:
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x45e2ea
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x472100]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00401b40
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebp, 0xffffffff
cmp eax, ebp
jne 0x42f109
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
test eax, eax
jne 0x42f109
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x42f109
lea ecx, [esp + 0x14]
call fcn.0042ed00
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
jne 0x42f0cb
add eax, 0xfffffff0
mov dword [esp + 0x20], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x42f0b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push eax
call fcn.0042f010
add esp, 4
test eax, eax
jne 0x42f0f7
lea eax, [esp + 0x14]
call fcn.00401a00
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 0
push esi
call edi
test eax, eax
jne 0x42f109
call ebx
cmp eax, 0xb7
jne 0x42f0d8
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x42f12a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret