joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408ee0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408e94
test al, al
jne 0x408f01
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408f4d
xor eax, eax
push ebp
push 0x408f3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004033cc
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408f44
lea eax, [ebp - 0xc]
call fcn.00408ed0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409254
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x409343
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406c68
mov edx, dword [ebp - 8]
mov ecx, 0x40935c
xor eax, eax
call fcn.00409148
push 0
mov eax, dword [ebp - 4]
call fcn.004033cc
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x409311
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409274
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00408d1c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404bf8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.004071f8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.00408cec
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x4045c4
call fcn.004057f4
call fcn.00402e88
jmp 0x409274
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004031e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40934a
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403170
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403170
ret

Function at 0x40936c
Capabilities:
Shutdown system

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov esi, edx
mov ebx, eax
cmp dword [0x40b07c], 2
jne 0x4093d9
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x409394
xor eax, eax
jmp 0x4093e6
lea eax, [esp + 8]
push eax
push 0x4093ec
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x4093d9
xor eax, eax
jmp 0x4093e6
push esi
push ebx
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x409400
Capabilities:
Check if file exists

Disassembly:
xor edx, edx
mov eax, 2
call fcn.0040936c
ret
Function at 0x409410
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40946a
inc esi
xor edi, edi
cmp edi, 1
jne 0x409436
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x409444
cmp edi, 1
jle 0x409444
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408ee0
test eax, eax
jne 0x40946a
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x40946a
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x40946a
inc edi
dec esi
jne 0x409426
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x409474
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x4094c1
xor ebx, ebx
jmp 0x4094b6
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00404ba4
test eax, eax
jne 0x4094b5
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x409571
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409497
mov al, byte [ebp - 1]
sub al, 1
jb 0x4094cc
je 0x4094d5
jmp 0x4094de
call fcn.00406f98
mov edi, eax
jmp 0x4094e0
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x4094e0
xor edi, edi
test di, di
je 0x409571
xor ebx, ebx
jmp 0x40951c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x40951b
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x409510
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x40951b
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409571
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4094ed
xor ebx, ebx
jmp 0x409566
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x409565
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x40955a
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x409565
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409571
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x40952b
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4098dc
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4099af
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4099c8
push ebx
push 0x4099d4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040336c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033cc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x40995c
mov al, 0x62
call fcn.00409580
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004098b0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409965
call fcn.004098b0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4099b6
lea eax, [ebp - 4]
call fcn.00403150
ret

Function at 0x409a48
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409afc
jmp 0x409af1
cmp dword [esi + 0x10], 0x1000
jne 0x409add
test byte [esi + 0x15], 1
jne 0x409add
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a9c
cmp eax, 2
je 0x409a9c
cmp eax, 0x10
je 0x409a9c
cmp eax, 0x20
jne 0x409ab1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409ab1
mov bl, 1
xor ebp, ebp
jmp 0x409ac2
mov eax, dword [esi]
add eax, ebp
call fcn.00409a40
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409ab5
test bl, bl
je 0x409add
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409afc
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a74
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40107a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x44ef34
push str.C:UsersPublicDownloadso6o787.dat
call fcn.0040a590
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4010a5
xor eax, eax
jmp 0x40118f
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040a773
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4010d1
mov edx, dword [ebp - 4]
push edx
call fcn.0040a7d2
add esp, 4
xor eax, eax
jmp 0x40118f
lea eax, [ebp - 0x134]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040a5c4
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401102
mov edx, dword [ebp - 4]
push edx
call fcn.0040a7d2
add esp, 4
xor eax, eax
jmp 0x40118f
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], 0
jmp 0x401129
mov ecx, dword [ebp - 0x138]
add ecx, 1
mov dword [ebp - 0x138], ecx
mov edx, dword [ebp - 0x138]
cmp edx, dword [ebp - 0x13c]
jge 0x401173
lea eax, [ebp - 0x134]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0040a5c4
add esp, 0xc
mov dword [ebp - 8], eax
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0040a737
add esp, 0xc
mov dword [ebp - 8], eax
jmp 0x40111a
mov eax, dword [ebp - 4]
push eax
call fcn.0040a7d2
add esp, 4
push str.C:UsersPublicDownloadso6o787.dat
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x401193
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x9e3779b9
mov ecx, dword [ebp - 0x10]
shl ecx, 3
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
jmp 0x4011d2
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 8
jge 0x401236
mov eax, dword [ebp - 0xc]
shl eax, 4
mov ecx, dword [ebp + 0x10]
add eax, dword [ecx + 8]
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 4]
xor eax, edx
mov ecx, dword [ebp - 0xc]
shr ecx, 5
mov edx, dword [ebp + 0x10]
add ecx, dword [edx + 0xc]
xor eax, ecx
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
shl edx, 4
mov eax, dword [ebp + 0x10]
add edx, dword [eax]
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 4]
xor edx, ecx
mov eax, dword [ebp - 0x14]
shr eax, 5
mov ecx, dword [ebp + 0x10]
add eax, dword [ecx + 4]
xor edx, eax
mov eax, dword [ebp - 0xc]
sub eax, edx
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
jmp 0x4011c9
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret
Function at 0x40129c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
push 0x44723c
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x10], eax
push 2
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov dword [ebp - 0xc], eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 0xc]
push ecx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0040124a
add esp, 0xc
push 0x447240
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x402463
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441885
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0x10
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push 0x2712
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
push ecx
call fcn.0040b2c0
add esp, 0xc
lea edx, [ebp - 0x20]
push edx
push str.Mozilla_5.0__iPhone__CPU_iPhone_OS_14_0_1_like_Mac_OS_X__AppleWebKit_605.1.15__KHTML__like_Gecko__Mobile_15E148_MicroMessenger_8.0.27_0x18001b34__NetType_4G_Language_zh_CN
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push 0x2722
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
push ecx
call fcn.0040b2c0
add esp, 0xc
push 5
push 0x44
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
push eax
call fcn.0040b2c0
add esp, 0xc
push 1
push 0x34
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call fcn.0040b2c0
add esp, 0xc
push 1
push 0x63
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
push ecx
call fcn.0040b2c0
add esp, 0xc
push 0
push 0x2f
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
push eax
call fcn.0040b2c0
add esp, 0xc
push 0x40266c
push 0x4e2b
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call fcn.0040b2c0
add esp, 0xc
mov eax, dword [ebp - 0x24]
push eax
push 0x2711
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call fcn.0040b2c0
add esp, 0xc
push 0
push 0x40
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
push ecx
call fcn.0040b2c0
add esp, 0xc
push 0
push 0x51
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
push eax
call fcn.0040b2c0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x402698
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406233
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x406243
xor eax, eax
jmp 0x40640c
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x4063c4
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x444174]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x444174]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x444174]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x444174]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x444174]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x444174]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x444174]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x444174]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x40624c
cmp dword [ebp + 0x10], 0
je 0x406406
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x444174]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x4063ca
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x40640e
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
xor edx, eax
and edx, 0xff
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
shr ecx, 8
mov edx, dword [edx*4 + 0x444174]
xor edx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
and edx, 0xff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
add ecx, edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
imul ecx, ecx, 0x8088405
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shr ecx, 0x18
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
xor eax, ecx
and eax, 0xff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
shr edx, 8
mov eax, dword [eax*4 + 0x444174]
xor eax, edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret

Function at 0x4073c2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x14]
xor edx, edx
mov dl, byte [ecx]
test edx, edx
je 0x407412
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x407408
mov edx, dword [ebp + 0x14]
mov byte [edx + 8], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp + 0xc]
jmp 0x40746c
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x14]
cmp ecx, dword [edx + 0x18]
jbe 0x407432
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x18]
sub edx, dword [ecx + 0x1c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp + 0x14]
add edx, dword [eax + 0x1c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x408e46
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x408e60
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 4], 0xffffffff
je 0x408e6a
mov eax, 0x1000000
jmp 0x408f47
mov edx, dword [ebp - 0x18]
add edx, 0x140
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp - 0x18]
add eax, 0x140
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dl, byte [ecx + eax + 0x13f]
mov byte [ebp - 0xc], dl
movsx eax, byte [ebp - 0xc]
cmp eax, 0x5c
je 0x408ec6
movsx ecx, byte [ebp - 0xc]
cmp ecx, 0x2f
je 0x408ec6
push 0x44766c
mov edx, dword [ebp - 0x18]
add edx, 0x140
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
cmp dword [ebp + 0x10], 1
jne 0x408eff
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x14], eax
xor ecx, ecx
cmp dword [ebp - 0x14], 0xffffffff
setne cl
mov byte [ebp - 0x10], cl
mov edx, dword [ebp - 0x10]
and edx, 0xff
test edx, edx
jne 0x408eff
mov eax, 0x2000000
jmp 0x408f47
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004070c1
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x408f25
mov eax, dword [ebp - 4]
jmp 0x408f47
mov ecx, dword [ebp - 8]
push ecx
call fcn.00407846
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x408f45
mov eax, 0x200
jmp 0x408f47
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc