joyce8/EMBER2024-capa huggingface dataset:
Function at 0x604200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x54], 0x34007b
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x54]
mov eax, 0x708a80
mov dword [ebp - 0x50], 0x360044
push edi
mov dword [ebp - 0x4c], 0x390036
mov edx, 0x27
mov dword [ebp - 0x48], 0x420042
sub esi, eax
mov dword [ebp - 0x44], 0x2d0033
mov dword [ebp - 0x40], 0x340041
mov dword [ebp - 0x3c], 0x450034
mov dword [ebp - 0x38], 0x34002d
mov dword [ebp - 0x34], 0x410038
mov dword [ebp - 0x30], 0x2d0039
mov dword [ebp - 0x2c], 0x450039
mov dword [ebp - 0x28], 0x450039
mov dword [ebp - 0x24], 0x33002d
mov dword [ebp - 0x20], 0x380034
mov dword [ebp - 0x1c], 0x370030
mov dword [ebp - 0x18], 0x420032
mov dword [ebp - 0x14], 0x410046
mov dword [ebp - 0x10], 0x330046
mov dword [ebp - 0xc], 0x7d0032
nop dword [eax]
lea ecx, [edx + 0x7fffffd7]
test ecx, ecx
je 0x6042ce
movzx ecx, word [esi + eax]
test cx, cx
je 0x6042ce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x6042b0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret

Function at 0x6042f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x54], 0x34007b
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x54]
mov eax, 0x708b88
mov dword [ebp - 0x50], 0x360044
push edi
mov dword [ebp - 0x4c], 0x390036
mov edx, 0x27
mov dword [ebp - 0x48], 0x420042
sub esi, eax
mov dword [ebp - 0x44], 0x2d0033
mov dword [ebp - 0x40], 0x340041
mov dword [ebp - 0x3c], 0x450034
mov dword [ebp - 0x38], 0x34002d
mov dword [ebp - 0x34], 0x410038
mov dword [ebp - 0x30], 0x2d0039
mov dword [ebp - 0x2c], 0x450039
mov dword [ebp - 0x28], 0x450039
mov dword [ebp - 0x24], 0x33002d
mov dword [ebp - 0x20], 0x380034
mov dword [ebp - 0x1c], 0x370030
mov dword [ebp - 0x18], 0x420032
mov dword [ebp - 0x14], 0x410046
mov dword [ebp - 0x10], 0x330046
mov dword [ebp - 0xc], 0x7d0032
nop dword [eax]
lea ecx, [edx + 0x7fffffd7]
test ecx, ecx
je 0x6043be
movzx ecx, word [esi + eax]
test cx, cx
je 0x6043be
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x6043a0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x6043e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x54], 0x45007b
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x54]
mov eax, 0x708b30
mov dword [ebp - 0x50], 0x420039
push edi
mov dword [ebp - 0x4c], 0x380032
mov edx, 0x27
mov dword [ebp - 0x48], 0x330044
sub esi, eax
mov dword [ebp - 0x44], 0x2d0031
mov dword [ebp - 0x40], 0x380033
mov dword [ebp - 0x3c], 0x310043
mov dword [ebp - 0x38], 0x34002d
mov dword [ebp - 0x34], 0x410034
mov dword [ebp - 0x30], 0x2d0034
mov dword [ebp - 0x2c], 0x370039
mov dword [ebp - 0x28], 0x450030
mov dword [ebp - 0x24], 0x35002d
mov dword [ebp - 0x20], 0x340037
mov dword [ebp - 0x1c], 0x370042
mov dword [ebp - 0x18], 0x310041
mov dword [ebp - 0x14], 0x340033
mov dword [ebp - 0x10], 0x300043
mov dword [ebp - 0xc], 0x7d0039
nop dword [eax]
lea ecx, [edx + 0x7fffffd7]
test ecx, ecx
je 0x6044ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x6044ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x604490
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret

Function at 0x6044d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x54], 0x45007b
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x54]
mov eax, 0x708ad8
mov dword [ebp - 0x50], 0x420039
push edi
mov dword [ebp - 0x4c], 0x380032
mov edx, 0x27
mov dword [ebp - 0x48], 0x330044
sub esi, eax
mov dword [ebp - 0x44], 0x2d0031
mov dword [ebp - 0x40], 0x380033
mov dword [ebp - 0x3c], 0x310043
mov dword [ebp - 0x38], 0x34002d
mov dword [ebp - 0x34], 0x410034
mov dword [ebp - 0x30], 0x2d0034
mov dword [ebp - 0x2c], 0x370039
mov dword [ebp - 0x28], 0x450030
mov dword [ebp - 0x24], 0x35002d
mov dword [ebp - 0x20], 0x340037
mov dword [ebp - 0x1c], 0x370042
mov dword [ebp - 0x18], 0x310041
mov dword [ebp - 0x14], 0x340033
mov dword [ebp - 0x10], 0x300043
mov dword [ebp - 0xc], 0x7d0039
nop dword [eax]
lea ecx, [edx + 0x7fffffd7]
test ecx, ecx
je 0x60459e
movzx ecx, word [esi + eax]
test cx, cx
je 0x60459e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x604580
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x604cb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67e5df
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x6eb874]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
lea eax, [ebx + 8]
mov dword [ebx + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebx + 0x20], eax
mov dword [ebp - 4], 4
lea ecx, [ebx + 0x28]
mov dword [ebx], vtable.CChannelImpl.0
call fcn.00413220
mov byte [ebp - 4], 5
lea eax, [ebx + 0x34]
mov dword [ebx + 0x2c], 0
push eax
mov dword [ebx + 0x30], vtable._BaseModule::CCriticalSection.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 6
lea esi, [ebx + 0x4c]
push 0
mov dword [ebp - 0x14], esi
mov ecx, esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00606070
mov dword [esi], eax
mov byte [ebp - 4], 9
lea eax, [ebx + 0x58]
push eax
mov dword [ebx + 0x54], vtable._BaseModule::CCriticalSection.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0xa
lea esi, [ebx + 0x70]
mov dword [ebp - 0x14], esi
push 8
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.006135e5
mov dword [esi], eax
add esp, 4
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov byte [ebp - 4], 0xd
mov dword [ebx + 0x84], 0
mov byte [ebp - 4], 0xe
mov dword [ebx + 0x88], 0
mov byte [ebp - 4], 0xf
mov dword [ebx + 0x8c], 0
mov byte [ebp - 4], 0x10
mov ecx, 0x708be4
push dword [ebp + 8]
call fcn.00416a40
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6058b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67e958
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6eb874]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x84], 0
jne 0x6059c7
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
call ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x88]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ecx, ecx
je 0x605917
push ecx
call edi
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x88], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0xffffffff
push 0
push 0
push 0
push 0
mov dword [ebp - 0x10], 0
call ebx
mov ebx, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0x8c]
test ecx, ecx
je 0x605955
push ecx
call edi
mov dword [esi + 0x8c], ebx
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
push 0
push 0
push esi
push 0x605ee0
push 0
push 0
mov dword [ebp - 0x14], 0
call fcn.00644f69
mov ebx, eax
add esp, 0x18
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 2
mov eax, dword [esi + 0x84]
test eax, eax
je 0x60599f
push eax
call edi
mov dword [esi + 0x84], ebx
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0xffffffff
cmp dword [esi + 0x84], 0
mov dword [ebp - 0x10], 0
je 0x605a82
cmp dword [esi + 0x88], 0
je 0x605a82
cmp dword [esi + 0x8c], 0
je 0x605a82
mov eax, dword [esi + 0x54]
lea ebx, [esi + 0x54]
push ebx
call dword [eax]
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x78]
inc eax
cmp ecx, eax
ja 0x605a05
push 1
lea ecx, [esi + 0x70]
call fcn.00606100
mov ecx, dword [esi + 0x78]
lea eax, [ecx - 1]
and dword [esi + 0x7c], eax
mov ecx, dword [esi + 0x80]
add ecx, dword [esi + 0x7c]
mov eax, dword [esi + 0x78]
dec eax
and ecx, eax
lea eax, [ecx*4]
mov ecx, dword [esi + 0x74]
mov dword [ebp - 0x14], eax
cmp dword [ecx + eax], 0
jne 0x605a46
push 0x14
call fcn.006135e5
mov ecx, dword [ebp - 0x14]
add esp, 4
mov edx, dword [esi + 0x74]
mov dword [ecx + edx], eax
mov ecx, dword [esi + 0x74]
mov eax, dword [ebp - 0x14]
push dword [ebp + 8]
mov ecx, dword [eax + ecx]
call fcn.006150b0
inc dword [esi + 0x80]
mov eax, dword [ebx]
push ebx
call dword [eax + 4]
push dword [esi + 0x8c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x6066d2
Capabilities:
Delete file
Query environment variable
Set file attributes

Disassembly:
push 0x224
mov eax, 0x67ea36
call fcn.006140ad
push 0x208
xor esi, esi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0063a460
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x6b4eac
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov dword [ebp - 0x220], esi
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
push eax
call fcn.00424e50
push str.MicrosoftWindowsThemesTranscodedWallpaper.jpg
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], esi
call fcn.0047d5c0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 0x80
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp + 8], 0
mov esi, eax
je 0x606792
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
lea ecx, [ebp - 0x230]
call fcn.00424ad0
test esi, esi
setne al
call fcn.00614068
ret

Function at 0x6067a8
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0x1c
mov eax, 0x67ea66
call fcn.006140ad
mov esi, dword [ebp + 8]
mov edi, esi
cmp dword [esi + 0x14], 8
jb 0x6067c1
mov edi, dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6067d4
shr al, 4
and al, 1
jmp 0x60682f
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.006070d8
xor ebx, ebx
lea ecx, [ebp - 0x28]
push esi
mov dword [ebp - 4], ebx
call fcn.00476fd0
test al, al
jne 0x606825
lea eax, [ebp - 0x28]
push eax
call fcn.006067a8
pop ecx
test al, al
je 0x606825
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x606823
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x606825
push esi
call fcn.006068ef
pop ecx
test al, al
je 0x606825
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.006070d3
mov al, bl
call fcn.00614068
ret

Function at 0x6068ef
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x6068fd
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x606910
shr eax, 4
and al, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x606b1a
Capabilities:
Get file version info

Disassembly:
push 0x14
mov eax, 0x67eafd
call fcn.00614079
mov eax, dword [ebp + 0x24]
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x20], eax
xor ebx, ebx
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push ebx
cmovae eax, dword [ebp + 8]
push eax
mov dword [ebp - 4], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
test eax, eax
je 0x606be5
xor ecx, ecx
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00613615
mov esi, eax
pop ecx
test esi, esi
je 0x606be5
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push esi
push dword [ebp - 0x10]
cmovae eax, dword [ebp + 8]
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x606bde
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x34
push eax
push 0x6b4ea4
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x606bde
mov ecx, dword [ebp - 0x14]
mov bl, 1
mov edx, dword [ebp - 0x18]
mov ax, word [ecx + 0xa]
mov word [edi], ax
mov ax, word [ecx + 8]
mov word [edx], ax
mov ax, word [ecx + 0xe]
mov edx, dword [ebp - 0x1c]
mov word [edx], ax
mov ax, word [ecx + 0xc]
mov ecx, dword [ebp - 0x20]
mov word [ecx], ax
push esi
call fcn.0061361e
pop ecx
lea ecx, [ebp + 8]
call fcn.00424ad0
mov al, bl
call fcn.00614053
ret
Function at 0x607c96
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path

Disassembly:
push 0x43c
mov eax, 0x67ed0e
call fcn.006140ad
mov edi, ecx
mov ecx, dword [edi + 4]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
call fcn.00608c0e
test al, al
je 0x607cc9
mov ecx, dword [edi + 4]
call fcn.00608be9
mov ecx, dword [edi + 8]
call fcn.006083c9
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x607eb1
mov ecx, dword [edi + 4]
push ebx
call fcn.00608c1e
test eax, eax
je 0x607eb1
test esi, esi
je 0x607d07
push 0x100
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0065493d
add esp, 0xc
jmp 0x607dc9
push 0x208
xor esi, esi
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.0063a460
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call fcn.00415500
push eax
lea ecx, [ebp - 0x424]
call fcn.00413170
lea eax, [ebp - 0x420]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x424]
push 0x6b5314
push eax
call fcn.00422a10
mov esi, dword [ebp - 0x424]
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x607d77
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x428]
call fcn.004131e0
push dword [ebp - 0x428]
lea eax, [ebp - 0x218]
push esi
push str._s_s_new.idx
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x428]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.0040e540
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.0040e540
lea eax, [ebp - 0x430]
mov ecx, edi
push eax
lea eax, [ebp - 0x438]
push eax
push ebx
call fcn.00607c3e
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x607e5d
lea eax, [ebp - 0x448]
mov ecx, edi
push eax
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00607c3e
test eax, eax
je 0x607e5d
mov eax, dword [ebp - 0x434]
cmp eax, dword [ebp - 0x43c]
jne 0x607e5d
mov eax, dword [ebp - 0x438]
cmp eax, dword [ebp - 0x440]
jne 0x607e5d
mov eax, dword [ebp - 0x42c]
cmp eax, dword [ebp - 0x444]
jne 0x607e5d
mov eax, dword [ebp - 0x430]
cmp eax, dword [ebp - 0x448]
jne 0x607e5d
mov ecx, dword [edi + 8]
lea eax, [ebp - 0x218]
push eax
call fcn.00608490
mov bl, al
test bl, bl
jne 0x607ead
mov ecx, dword [edi + 4]
call fcn.00608c06
mov ecx, dword [edi + 4]
push eax
call fcn.00608c0a
push eax
mov ecx, edi
call fcn.006079e9
mov bl, al
test bl, bl
je 0x607ead
mov ecx, dword [edi + 8]
lea eax, [ebp - 0x218]
push eax
call fcn.0060859e
mov bl, al
test bl, bl
je 0x607ead
lea eax, [ebp - 0x430]
mov ecx, edi
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00607ebb
mov al, bl
jmp 0x607eb3
xor al, al
call fcn.00614068
ret 8
Function at 0x608490
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
push esi
mov dword [ebp - 4], eax
call fcn.00608a3a
cmp dword [ebp + 8], 0
je 0x608597
push 0x6b51e0
push dword [ebp + 8]
call fcn.00643e6a
mov esi, eax
mov dword [ebp - 8], esi
pop ecx
pop ecx
test esi, esi
je 0x608597
push ebx
push edi
push 2
xor ebx, ebx
push ebx
push esi
call fcn.00644811
push esi
call fcn.00644e0a
push ebx
mov edi, eax
push ebx
push esi
mov dword [ebp + 8], edi
call fcn.00644811
push esi
push 1
lea eax, [ebp - 0x14]
push 8
push eax
call fcn.0064440b
add esp, 0x2c
cmp dword [ebp - 0x14], 0x78646972
jne 0x60858a
cmp dword [ebp - 0x10], 0x8000
jae 0x60858a
lea eax, [edi - 8]
push eax
call fcn.00643ed3
mov edi, eax
mov dword [ebp - 0xc], edi
pop ecx
test edi, edi
je 0x60858a
mov eax, dword [ebp + 8]
push esi
push 1
add eax, 0xfffffff8
push eax
push edi
call fcn.0064440b
mov eax, dword [ebp + 8]
add esp, 0x10
add eax, 0xfffffff8
mov ecx, edi
add eax, edi
cmp dword [ebp - 0x10], ebx
jle 0x60857d
mov esi, dword [ebp - 4]
mov edi, eax
mov eax, dword [ecx + 0x2c]
add eax, 0x32
add eax, ecx
mov dword [ebp + 8], eax
cmp eax, edi
ja 0x608577
lea eax, [ecx + 0xc]
push eax
push dword [ecx + 8]
lea eax, [ecx + 0x30]
push dword [ecx + 4]
push dword [ecx]
mov ecx, esi
push eax
call fcn.0060833c
mov ecx, dword [ebp + 8]
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x608548
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
push edi
call fcn.0063e41a
cmp ebx, dword [ebp - 0x10]
pop ecx
sete bl
push esi
call fcn.00643f54
pop ecx
pop edi
mov al, bl
pop ebx
jmp 0x608599
xor al, al
pop esi
leave
ret 4
Function at 0x60859e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
test eax, eax
je 0x6086cd
push 0x6b5520
push eax
call fcn.00643e6a
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x6086cd
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x250]
push edi
push ebx
push 1
push 8
push eax
mov dword [ebp - 0x250], 0x78646972
mov dword [ebp - 0x24c], ecx
call fcn.0064d751
mov edx, dword [esi]
lea edi, [ebp - 0x234]
add esp, 0x10
mov dword [ebp - 0x248], edx
xor eax, eax
mov esi, dword [edx]
and dword [ebp - 0x23c], 0
and dword [ebp - 0x238], 0
cmp esi, edx
push 8
pop ecx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x240], esi
stosw word es:[edi], ax
jmp 0x6086b5
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0063a460
add esp, 0xc
lea edi, [ebp - 0x23c]
add esi, 0x14
push 0xb
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x244]
push dword [esi + 0x10]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
add eax, eax
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push 0x100
push dword [esi + 0x10]
push eax
call fcn.0065493d
mov eax, dword [ebp - 0x210]
push ebx
add eax, 0x32
push 1
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.0064d751
add esp, 0x1c
lea ecx, [ebp - 0x240]
call fcn.00608278
mov esi, dword [ebp - 0x240]
cmp esi, dword [ebp - 0x248]
mov dword [ebp - 0x244], esi
jne 0x608633
push ebx
call fcn.00643f54
pop ecx
mov al, 1
pop edi
jmp 0x6086cf
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.006135ac
leave
ret 4

Function at 0x608c1e
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
call fcn.00608be9
mov ebx, dword [ebp + 8]
lea eax, [esi + 4]
xor edi, edi
test ebx, ebx
jne 0x608c3e
mov ecx, edi
jmp 0x608c55
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x608c43
sub ecx, edx
lea eax, [esi + 4]
sar ecx, 1
push ecx
push ebx
mov ecx, eax
call fcn.0040e650
push edi
push edi
push 4
push edi
push 1
push SysReAllocString
xorps xmm0, xmm0
mov dword [ebp - 4], edi
push ebx
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x18], eax
cmp eax, 0xffffffff
jne 0x608c88
xor eax, eax
jmp 0x608cd5
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x608ca6
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x18], 0xffffffff
jmp 0x608c84
cmp dword [ebp - 0xc], 0
jbe 0x608cd2
push dword [ebp - 0xc]
mov ecx, esi
call fcn.00608bbc
cmp dword [esi + 0x14], 0
je 0x608cd2
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push dword [esi + 0x14]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x608cd5
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x608cdc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x14]
test ecx, ecx
jne 0x608cf2
cmp dword [edi + 0x18], 0xffffffff
je 0x608d6b
cmp dword [ebp + 0xc], 0
je 0x608d6b
cmp dword [ebp + 0x10], 0
mov esi, dword [ebp + 0x14]
jl 0x608d06
cmp dword [ebp + 0x10], esi
jl 0x608d6b
test ecx, ecx
je 0x608d27
mov edx, dword [ebp + 8]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x10]
jg 0x608d6b
push esi
lea eax, [ecx + edx]
push eax
push dword [ebp + 0xc]
call fcn.00639960
add esp, 0xc
jmp 0x608d67
cmp dword [edi + 0x18], 0xffffffff
je 0x608d67
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
and dword [ebp + 0x10], 0
push 0
cdq
push ecx
push eax
push dword [edi + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 0xc]
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x608d6b
cmp esi, dword [ebp + 0x10]
jne 0x608d6b
mov eax, esi
jmp 0x608d6e
or eax, 0xffffffff
pop edi
pop esi
leave
ret 0x10

Function at 0x60a990
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0060a9a0

Function at 0x60ac20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0060aed0