joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e0d0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5715f8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5eaea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov al, byte [esi + 0xc0]
test al, al
je 0x44e246
cmp al, 2
jne 0x44e169
mov eax, dword [esi + 0xa0]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0xa0]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0xa4]
mov edi, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x10]
test ecx, ecx
jl 0x44e142
jg 0x44e13b
cmp eax, 0x800000
jbe 0x44e142
mov eax, 0x800000
xor ecx, ecx
push 0
add edx, eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 0x10
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], edx
push eax
push 0x980c8
push dword [esi]
adc edi, ecx
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
push 0
push dword [esi + 0xa4]
push dword [esi + 0xa0]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x44e23e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x44]
call fcn.0044d3b0
push eax
mov edx, str.Cannot_set_file_pointer_4_._Code
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00453260
add esp, 4
lea ecx, [esi + 0x30]
push eax
call fcn.004494f0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x44e1f0
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44e1e6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44e265
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov edx, dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x44e23a
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44e230
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44e26a
push edx
push ecx
call fcn.0052edf8
add esp, 8
xor al, al
jmp 0x44e248
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret 8
call fcn.0054a8a1
call fcn.0054a8a1
int3
Function at 0x452170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x45225b
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x45224a
jg 0x4521b0
test edx, edx
je 0x45224a
nop dword [eax]
call fcn.0044ab70
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x452207
jg 0x4521c7
test esi, esi
je 0x452207
cmp ebx, eax
jg 0x4521d7
jl 0x4521d1
cmp edi, esi
jae 0x4521d7
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xc]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [esp + 0x18]
call fcn.00546460
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x10]
jmp 0x45222c
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x452244
mov eax, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
add eax, esi
mov dword [esp + 0x10], eax
test ebx, ebx
jg 0x4521b0
jl 0x452244
test edi, edi
jne 0x4521b0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x45227d
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x45227f
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x452335
jg 0x45229a
test esi, esi
je 0x452335
test eax, eax
jl 0x4522e3
jg 0x4522a4
test ebx, ebx
je 0x4522e3
cmp edi, eax
jg 0x4522b4
jl 0x4522ae
cmp esi, ebx
jae 0x4522b4
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.00546460
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 0x2c]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x4522ea
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test edi, edi
jl 0x452335
jg 0x4522f4
test esi, esi
je 0x452335
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x452335
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x452320
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [esp + 0x1c]
call fcn.0054bb7f
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x459950
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572310
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5eaea4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x28], ecx
jb 0x4599a1
mov esi, dword [edi]
lea ebx, [eax + eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x4599c1
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x4599b0
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edx
mov esi, dword [ebx + 4]
mov dword [ebp - 0x24], ecx
lea eax, [eax + ecx*8]
mov dword [ebp - 0x1c], eax
cmp esi, dword [eax]
je 0x459a41
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x459a41
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
jb 0x4599f6
mov edx, dword [edx]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x459a00
mov ecx, dword [edi]
cmp dword [edi + 0x10], eax
mov eax, dword [ebp - 0x1c]
jne 0x4599e1
push dword [edi + 0x10]
call fcn.00452f90
add esp, 4
test eax, eax
mov eax, dword [ebp - 0x1c]
jne 0x4599e1
mov eax, dword [ebp - 0x20]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebx + 4]
push edi
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax + 4]
push ecx
push eax
mov dword [ebp - 0x18], ecx
call fcn.0044bb50
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x459afc
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x459ab1
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ecx, ebx
push esi
push edi
call fcn.00459c00
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00459b60
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x459a23
push str.list_T__too_long
call fcn.0052c00e
int3
Function at 0x459c80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5eaea4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jb 0x459cad
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x459cc9
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x459cb8
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x459d02
cmp eax, edi
jne 0x459cfa
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x459d0a
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x459d0a
cmp eax, edi
jne 0x459d0d
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [ecx], esi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.0044afa0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax], esi
pop esi
pop ebx
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret 8
Function at 0x459d70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572340
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5eaea4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], eax
cmp dword [edi + 0x14], 8
mov ebx, dword [edi + 0x10]
mov dword [ebp - 0x20], ecx
jb 0x459dc3
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x459de4
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x459dd0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
lea eax, [eax + ecx*8]
mov esi, dword [esi + 4]
mov dword [ebp - 0x18], eax
cmp dword [eax], esi
je 0x459e04
mov esi, dword [eax + 4]
mov esi, dword [esi]
mov ebx, dword [edi + 0x10]
cmp esi, dword [eax]
je 0x459e82
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
jb 0x459e1c
mov edx, dword [edx]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x459e26
mov ecx, dword [edi]
cmp ebx, eax
mov eax, dword [ebp - 0x18]
jne 0x459e07
push ebx
call fcn.00452f90
add esp, 4
test eax, eax
mov eax, dword [ebp - 0x18]
jne 0x459e07
mov edi, dword [ebp + 0x10]
push edi
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov edx, dword [edi]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [eax + 8]
call fcn.0044afa0
mov eax, dword [ebp - 0x20]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x459eaf
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
push esi
push edi
call fcn.00459c00
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00459b60
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x459e64
Function at 0x45b010
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Timestomp file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5723d8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5eaea4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x3c], ebx
push edi
push ebx
call fcn.00552b37
add esp, 8
test eax, eax
jne 0x45b05a
mov eax, 1
jmp 0x45b1cf
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45b1cf
mov ecx, edi
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
movq qword [ebp - 0x20], xmm0
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45b080
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ecx + 1]
push eax
lea ecx, [ebp - 0x20]
call fcn.0045b4c0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
sub eax, esi
push edi
sar eax, 1
push eax
push esi
call fcn.00552436
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp byte [ebp + 8], 0
je 0x45b10b
push 0
push 0x2000000
push 3
push 0
push 3
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x40], eax
cmp eax, 0xffffffff
je 0x45b10b
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
test ebx, ebx
jne 0x45b15d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x45b19d
mov ecx, edi
call fcn.00469a40
push ebx
push edi
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
test ebx, ebx
jne 0x45b15d
mov ecx, esi
call fcn.00469a40
push ebx
push edi
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
test ebx, ebx
je 0x45b19d
cmp byte [ebp + 8], 0
je 0x45b19d
push 0
push 0x2000000
push 3
push 0
push 3
push 0x80000100
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x45b19d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x45b1cd
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x45b1c3
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45b1eb
push ecx
push esi
call fcn.0052edf8
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret
call fcn.0054a8a1
int3
Function at 0x45b670
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5eaea4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x70
push 2
push 1
push 0
call dword [sym.imp.USER32.dll_RegisterHotKey]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x20]
push 0
push 0
push 0
push eax
call edi
test eax, eax
je 0x45b770
push ebx
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call ebx
cmp dword [ebp - 0x1c], 0x312
jne 0x45b73f
cmp dword [ebp - 0x18], 1
jne 0x45b73f
cmp byte [0x5eb9f5], 0
je 0x45b764
cmp byte [0x5eb9f4], 0
je 0x45b6ff
mov al, byte [0x5f22c0]
and al, 1
mov byte [0x5eb9f4], 0
mov byte [0x5f17c0], al
jmp 0x45b704
mov al, byte [0x5f17c0]
test al, al
je 0x45b71b
push 0
push dword [0x5f17b0]
call esi
mov byte [0x5f17c0], 0
jmp 0x45b73f
call fcn.0045b5d0
push 5
push dword [0x5f17b0]
call esi
mov ecx, dword [0x5f22c0]
or ecx, 1
call fcn.00463200
mov byte [0x5f17c0], 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call edi
test eax, eax
jne 0x45b6b7
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret
push 1
push 0
call dword [sym.imp.USER32.dll_UnregisterHotKey]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret
Function at 0x45ebe0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edi + 0x18]
imul ecx, ecx, 0x1000193
pop edi
pop esi
and eax, ecx
pop ebp
ret 4

Function at 0x45f1f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572850
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5eaea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.SYSTEMDRIVE
mov dword [ebp - 4], 0
call fcn.005517e6
mov edx, eax
mov dword [ebp - 0x18], 0
mov ecx, edx
mov dword [ebp - 0x14], 7
add esp, 4
xor eax, eax
mov word [ebp - 0x28], ax
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45f250
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0044a8b0
push 5
push str._temp
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00451c00
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push 0x5d7e94
lea ecx, [ebp - 0x28]
call fcn.00451c00
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push eax
call fcn.00451c00
lea eax, [ebp - 0x28]
mov ecx, 0x5ebc9c
push dword [ebp - 0x18]
test esi, esi
je 0x45f2ca
mov ecx, 0x5ebcb4
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0044a8b0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x45f30e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45f304
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f373
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x45f358
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45f34e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f378
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret
call fcn.0054a8a1
call fcn.0054a8a1
int3
Function at 0x45f430
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0052f5a0
mov eax, dword [0x5eaea4]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov ecx, 1
mov edx, 0x5f22bc
mov eax, 0x3e7
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x45f501
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x100c]
push eax
call dword [sym.imp.USER32.dll_wvsprintfW]
mov esi, eax
test esi, esi
jle 0x45f501
push 0x5f22a4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x5f22a0]
test cl, 2
je 0x45f4dd
mov edx, dword [0x5ebc98]
cmp edx, 0xffffffff
je 0x45f4dd
push 0
lea eax, [ebp - 0x1010]
push eax
lea eax, [esi + esi]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x100c]
push eax
push edx
call esi
push 0
lea eax, [ebp - 0x1010]
push eax
push 4
push 0x5d8c24
push dword [0x5ebc98]
call esi
mov ecx, dword [0x5f22a0]
test cl, 1
je 0x45f4f6
lea edx, [ebp - 0x100c]
call fcn.00461b80
push eax
call fcn.00461e40
add esp, 4
push 0x5f22a4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret
Function at 0x463200
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572bb8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5eaea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [0x5f22c0], ecx
test cl, 2
je 0x46334c
push str.SYSTEMDRIVE
call fcn.005517e6
mov edx, eax
mov dword [ebp - 0x18], 0
mov ecx, edx
mov dword [ebp - 0x14], 7
add esp, 4
xor eax, eax
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x463260
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0044a8b0
push 5
push str._temp
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00451c00
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push 0x5d7e94
lea ecx, [ebp - 0x28]
call fcn.00451c00
cmp dword [0x5ebce0], 8
lea ecx, [ebp - 0x28]
push dword [0x5ebcdc]
mov eax, 0x5ebccc
cmovae eax, dword [0x5ebccc]
push eax
call fcn.00451c00
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push SysReAllocString
push 4
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 2
push 0
xorps xmm0, xmm0
mov dword [0x5ebce4], eax
movq qword [ebp - 0x30], xmm0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x46334c
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x463342
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46337b
push edx
push ecx
call fcn.0052edf8
add esp, 8
cmp dword [0x5f22c0], 0
je 0x463361
mov eax, 1
mov ecx, 0x5f22dc
xchg dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret
call fcn.0054a8a1
int3