joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov esi, dword [edi + 0x18]
push esi
call fcn.00412fa9
push esi
mov ebx, eax
call fcn.00412fa9
add esp, 8
mov dword [ebp - 4], eax
test ebx, ebx
je 0x402e36
test eax, eax
je 0x402e36
push dword [edi]
push esi
push 1
push ebx
call fcn.004102fc
add esp, 0x10
cmp eax, esi
je 0x402dc6
push 0x40
push str.fread
push 0x43fe18
mov dword [0x43fc0c], 0xd5
call fcn.0040bfa6
push 0x104
xor eax, eax
mov dword [0x43fc08], esi
push str.C:JenkinsAE_build_workHibun_AE_Current_src_sftlcmn_sftl_arc3.c
push 0x43fe98
mov word [0x43fe96], ax
mov word [0x43fe16], ax
call fcn.0040bfa6
mov esi, dword [ebp - 4]
add esp, 0x18
xor eax, eax
mov word [0x44009e], ax
push ebx
call fcn.0040facf
add esp, 4
jmp 0x402e99
cmp dword [edi + 0x28], 0
je 0x402e11
push 0
push dword [ebp + 8]
mov ecx, edi
push esi
mov esi, dword [ebp - 4]
mov edx, esi
push ebx
call fcn.00402870
cdq
add esp, 0x10
cmp dword [0x43fc0c], 0
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], edx
jne 0x402e8b
push eax
push esi
push dword [ebp - 8]
call fcn.004087b0
add esp, 0xc
push ebx
call fcn.0040facf
add esp, 4
jmp 0x402e99
push esi
push ebx
push dword [ebp - 8]
call fcn.004087b0
add esp, 0xc
mov dword [edi + 0x20], esi
mov esi, dword [ebp - 4]
mov dword [edi + 0x24], 0
push ebx
call fcn.0040facf
add esp, 4
jmp 0x402e99
push 0x40
push str.malloc
push 0x43fe18
mov dword [0x43fc0c], 0xc9
call fcn.0040bfa6
push 0x104
xor eax, eax
mov dword [0x43fc08], esi
push str.C:JenkinsAE_build_workHibun_AE_Current_src_sftlcmn_sftl_arc3.c
push 0x43fe98
mov word [0x43fe96], ax
mov word [0x43fe16], ax
call fcn.0040bfa6
xor eax, eax
add esp, 0x18
mov word [0x44009e], ax
test ebx, ebx
je 0x402e96
mov esi, dword [ebp - 4]
push ebx
call fcn.0040facf
add esp, 4
jmp 0x402e99
mov esi, dword [ebp - 4]
test esi, esi
je 0x402ea6
push esi
call fcn.0040facf
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403190
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x402c
call fcn.00424210
mov eax, dword [0x43e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0x4020], ecx
push edi
mov dword [ebp - 0x4028], ebx
mov esi, 0x32
mov dword [ebp - 0x4024], 0
nop word [eax + eax]
push 0x43a734
push ebx
call fcn.0040f36d
mov edi, eax
add esp, 8
mov dword [ebp - 0x402c], edi
test edi, edi
jne 0x40327f
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
add esi, 0x32
cmp esi, 0x41a
jb 0x4031d0
push 0x40
push str.fopen
push 0x43fe18
mov dword [0x43fc0c], 0xde
call fcn.0040bfa6
xor eax, eax
mov dword [0x43fc08], 1
add esp, 0xc
mov word [0x43fe96], ax
test ebx, ebx
je 0x403247
push 0x104
push ebx
push 0x43fc10
call fcn.0040bfa6
add esp, 0xc
push 0x104
xor eax, eax
push str.C:JenkinsAE_build_workHibun_AE_Current_src_sftlcmn_sftl_arc3.c
push 0x43fe98
mov word [0x43fe16], ax
call fcn.0040bfa6
add esp, 0xc
xor eax, eax
mov word [0x44009e], ax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406bb3
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x4020]
mov ebx, dword [eax + 0x1c]
mov edi, dword [eax + 0x18]
test ebx, ebx
jl 0x40342d
jg 0x4032ba
test edi, edi
je 0x40342d
nop dword [eax]
test ebx, ebx
jne 0x4032ba
cmp edi, 0x2000
ja 0x4032ba
mov esi, edi
mov dword [ebp - 0x401c], 1
jmp 0x4032c9
mov esi, 0x2000
mov dword [ebp - 0x401c], 0
push dword [eax]
lea eax, [ebp - 0x2010]
push esi
push 1
push eax
call fcn.004102fc
add esp, 0x10
cmp eax, esi
jne 0x4033bd
mov ecx, dword [ebp - 0x4020]
lea eax, [ebp - 0x2010]
cmp dword [ecx + 0x28], 0
je 0x403328
push dword [ebp - 0x4024]
lea edx, [ebp - 0x4018]
push dword [ebp - 0x401c]
push esi
push eax
call fcn.00402870
add esp, 0x10
mov dword [ebp - 0x401c], eax
cmp dword [0x43fc0c], 0
jne 0x40342d
jmp 0x403341
push esi
push eax
lea eax, [ebp - 0x4018]
push eax
call fcn.004087b0
add esp, 0xc
mov dword [ebp - 0x401c], esi
mov eax, esi
push dword [ebp - 0x402c]
push eax
lea eax, [ebp - 0x4018]
push 1
push eax
call fcn.0040d029
add esp, 0x10
cmp eax, dword [ebp - 0x401c]
jne 0x40338d
mov eax, dword [ebp - 0x4020]
sub edi, esi
sbb ebx, 0
add dword [ebp - 0x4024], esi
test ebx, ebx
jg 0x4032ba
jl 0x40342d
test edi, edi
jne 0x4032a0
jmp 0x40342d
push 0x40
push str.fwrite
push 0x43fe18
mov dword [0x43fc0c], 0xe0
call fcn.0040bfa6
xor eax, eax
mov word [0x43fe96], ax
mov eax, dword [ebp - 0x401c]
mov dword [0x43fc08], eax
jmp 0x4033e6
push 0x40
push str.fread
push 0x43fe18
mov dword [0x43fc0c], 0xd5
call fcn.0040bfa6
xor eax, eax
mov dword [0x43fc08], esi
mov word [0x43fe96], ax
mov eax, dword [ebp - 0x4028]
add esp, 0xc
test eax, eax
je 0x403406
push 0x104
push eax
push 0x43fc10
call fcn.0040bfa6
add esp, 0xc
push 0x104
xor eax, eax
push str.C:JenkinsAE_build_workHibun_AE_Current_src_sftlcmn_sftl_arc3.c
push 0x43fe98
mov word [0x43fe16], ax
call fcn.0040bfa6
add esp, 0xc
xor eax, eax
mov word [0x44009e], ax
push dword [ebp - 0x402c]
call fcn.0040ae9a
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406bb3
mov esp, ebp
pop ebp
ret
Function at 0x403450
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x43e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov edx, 0x440a20
xorps xmm0, xmm0
push esi
mov esi, ecx
push edi
movups xmmword [ebp - 0x24], xmm0
lea ecx, [edx + 1]
movups xmmword [ebp - 0x14], xmm0
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x403480
sub edx, ecx
cmp dword [esi + 4], 0xb
jge 0x4035a0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x5c], 0x67452301
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
push edx
mov edx, 0x440a20
lea ecx, [ebp - 0xa0]
call fcn.00405310
lea edx, [ebp - 0xb0]
lea ecx, [ebp - 0xa0]
call fcn.00405420
movups xmm0, xmmword [ebp - 0xb0]
push 0
push 0x440a20
mov ecx, esi
movups xmmword [esi + 0x4d], xmm0
call fcn.00401ff0
push 1
lea edx, [ebp - 0x24]
mov ecx, esi
call fcn.00402d20
add esp, 0xc
xorps xmm0, xmm0
cmp dword [esi + 0x64], 2
movups xmmword [esi + 0x2c], xmm0
je 0x403526
movups xmmword [esi + 0x6d], xmm0
movups xmmword [esi + 0x7d], xmm0
cmp byte [esi + 0x4c], 2
je 0x403530
movups xmmword [esi + 0x3c], xmm0
mov edi, dword [esi + 0x60]
mov dword [esi + 0x28], 0
test edi, edi
je 0x403562
mov eax, dword [edi + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
test eax, eax
je 0x40354e
push eax
call ebx
mov eax, dword [edi + 0x10]
test eax, eax
je 0x403558
push eax
call ebx
push edi
call ebx
mov dword [esi + 0x60], 0
cmp dword [0x43fc0c], 0
jne 0x40366b
cmp dword [esi + 0x64], 4
movups xmm0, xmmword [ebp - 0x24]
jne 0x403667
movups xmmword [esi + 0x8d], xmm0
pop edi
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [esi + 0x9d], xmm0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406bb3
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x44]
mov ecx, 0x440a20
push eax
call fcn.00404680
movups xmm0, xmmword [ebp - 0x44]
push 0x440a20
mov ecx, esi
movups xmmword [esi + 0x8d], xmm0
movups xmm0, xmmword [ebp - 0x34]
movups xmmword [esi + 0x9d], xmm0
call fcn.004024c0
push dword [ebp + 8]
lea edx, [ebp - 0x24]
mov ecx, esi
call fcn.00402d20
add esp, 0xc
xorps xmm0, xmm0
cmp dword [esi + 0x64], 2
movups xmmword [esi + 0x2c], xmm0
je 0x4035f5
movups xmmword [esi + 0x6d], xmm0
movups xmmword [esi + 0x7d], xmm0
cmp byte [esi + 0x4c], 2
je 0x4035ff
movups xmmword [esi + 0x3c], xmm0
mov edi, dword [esi + 0x60]
mov dword [esi + 0x28], 0
test edi, edi
je 0x403631
mov eax, dword [edi + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
test eax, eax
je 0x40361d
push eax
call ebx
mov eax, dword [edi + 0x10]
test eax, eax
je 0x403627
push eax
call ebx
push edi
call ebx
mov dword [esi + 0x60], 0
cmp dword [0x43fc0c], 0
jne 0x40366b
cmp dword [esi + 0x64], 4
movups xmm0, xmmword [ebp - 0x24]
jne 0x403667
movups xmmword [esi + 0x8d], xmm0
pop edi
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [esi + 0x9d], xmm0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406bb3
mov esp, ebp
pop ebp
ret
movups xmmword [esi + 0x4d], xmm0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406bb3
mov esp, ebp
pop ebp
ret
Function at 0x4038d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x43e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
cmp dword [esi + 4], 0xb
jge 0x403994
mov byte [ebp + eax - 0x28], al
inc eax
cmp eax, 0x10
jl 0x4038f4
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
push 0x10
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xa4]
call fcn.00405310
lea edx, [ebp - 0xb8]
lea ecx, [ebp - 0xa4]
call fcn.00405420
movups xmm0, xmmword [ebp - 0xb8]
xor ecx, ecx
movups xmmword [esi + 0x4d], xmm0
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 0x10
jl 0x403960
lea eax, [ebp - 0x18]
mov byte [ebp - 8], 0
push 0
push eax
mov ecx, esi
call fcn.00401ff0
push 1
mov edx, 0x440a7d
mov ecx, esi
call fcn.00402d20
add esp, 0xc
jmp 0x403a53
mov byte [ebp + eax - 0x28], al
inc eax
cmp eax, 0x10
jl 0x403994
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xa8], 0
call fcn.00405b90
mov edi, dword [ebp - 0xa8]
test edi, edi
je 0x403a07
mov eax, dword [0x4400a0]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403a07
push 0x43b02c
push eax
call ebx
test eax, eax
je 0x4039e5
push 0
push 0x10
lea ecx, [ebp - 0x28]
push ecx
push dword [edi + 4]
call eax
mov eax, dword [0x4400a0]
test eax, eax
je 0x403a07
push 0x43b03c
push eax
call ebx
test eax, eax
je 0x403a07
push 0
push 0x20
lea ecx, [ebp - 0x48]
push ecx
push dword [edi + 4]
call eax
mov ecx, edi
call fcn.00405d80
movups xmm0, xmmword [ebp - 0x48]
xor ecx, ecx
movups xmmword [esi + 0x8d], xmm0
movups xmm0, xmmword [ebp - 0x38]
movups xmmword [esi + 0x9d], xmm0
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 0x10
jl 0x403a26
lea eax, [ebp - 0x18]
mov byte [ebp - 8], 0
push eax
mov ecx, esi
call fcn.004024c0
push 1
mov edx, 0x440a7d
mov ecx, esi
call fcn.00402d20
add esp, 8
cmp dword [esi + 0x64], 2
xorps xmm0, xmm0
movups xmmword [esi + 0x2c], xmm0
je 0x403a68
movups xmmword [esi + 0x6d], xmm0
movups xmmword [esi + 0x7d], xmm0
cmp byte [esi + 0x4c], 2
je 0x403a72
movups xmmword [esi + 0x3c], xmm0
mov edi, dword [esi + 0x60]
mov dword [esi + 0x28], 0
test edi, edi
je 0x403aa4
mov eax, dword [edi + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
test eax, eax
je 0x403a90
push eax
call ebx
mov eax, dword [edi + 0x10]
test eax, eax
je 0x403a9a
push eax
call ebx
push edi
call ebx
mov dword [esi + 0x60], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406bb3
mov esp, ebp
pop ebp
ret
Function at 0x403ac0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x43e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
xor eax, eax
mov dword [ebp - 0xa8], ebx
push edi
cmp dword [esi + 4], 0xb
jge 0x403ba3
nop dword [eax]
mov byte [ebp + eax - 0x28], al
inc eax
cmp eax, 0x10
jl 0x403af0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
push 0x10
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xa4]
call fcn.00405310
lea edx, [ebp - 0xbc]
lea ecx, [ebp - 0xa4]
call fcn.00405420
movups xmm0, xmmword [ebp - 0xbc]
xor ecx, ecx
movups xmmword [esi + 0x4d], xmm0
nop dword [eax]
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 0x10
jl 0x403b60
lea eax, [ebp - 0x18]
mov byte [ebp - 8], 0
push 0
push eax
mov ecx, esi
call fcn.00401ff0
push dword [esi]
call fcn.004100d5
mov dword [0x43f994], edx
mov ecx, esi
push 1
mov edx, ebx
mov dword [0x43f990], eax
call fcn.00402d20
add esp, 0x10
jmp 0x403c7c
mov byte [ebp + eax - 0x28], al
inc eax
cmp eax, 0x10
jl 0x403ba3
lea ecx, [ebp - 0xac]
mov dword [ebp - 0xac], 0
call fcn.00405b90
mov edi, dword [ebp - 0xac]
test edi, edi
je 0x403c1c
mov eax, dword [0x4400a0]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403c16
push 0x43b02c
push eax
call ebx
test eax, eax
je 0x403bf4
push 0
push 0x10
lea ecx, [ebp - 0x28]
push ecx
push dword [edi + 4]
call eax
mov eax, dword [0x4400a0]
test eax, eax
je 0x403c16
push 0x43b03c
push eax
call ebx
test eax, eax
je 0x403c16
push 0
push 0x20
lea ecx, [ebp - 0x48]
push ecx
push dword [edi + 4]
call eax
mov ebx, dword [ebp - 0xa8]
mov ecx, edi
call fcn.00405d80
movups xmm0, xmmword [ebp - 0x48]
xor ecx, ecx
movups xmmword [esi + 0x8d], xmm0
movups xmm0, xmmword [ebp - 0x38]
movups xmmword [esi + 0x9d], xmm0
nop dword [eax + eax]
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 0x10
jl 0x403c40
lea eax, [ebp - 0x18]
mov byte [ebp - 8], 0
push eax
mov ecx, esi
call fcn.004024c0
push dword [esi]
call fcn.004100d5
mov dword [0x43f994], edx
mov ecx, esi
push 1
mov edx, ebx
mov dword [0x43f990], eax
call fcn.00402d20
add esp, 0xc
cmp dword [esi + 0x64], 2
xorps xmm0, xmm0
movups xmmword [esi + 0x2c], xmm0
je 0x403c91
movups xmmword [esi + 0x6d], xmm0
movups xmmword [esi + 0x7d], xmm0
cmp byte [esi + 0x4c], 2
je 0x403c9b
movups xmmword [esi + 0x3c], xmm0
mov edi, dword [esi + 0x60]
mov dword [esi + 0x28], 0
test edi, edi
je 0x403ccd
mov eax, dword [edi + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
test eax, eax
je 0x403cb9
push eax
call ebx
mov eax, dword [edi + 0x10]
test eax, eax
je 0x403cc3
push eax
call ebx
push edi
call ebx
mov dword [esi + 0x60], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406bb3
mov esp, ebp
pop ebp
ret
Function at 0x403ce0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x43e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
xor eax, eax
mov dword [ebp - 0xa8], ebx
push edi
cmp dword [esi + 4], 0xb
jge 0x403db1
nop dword [eax]
mov byte [ebp + eax - 0x28], al
inc eax
cmp eax, 0x10
jl 0x403d10
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
push 0x10
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xa4]
call fcn.00405310
lea edx, [ebp - 0xbc]
lea ecx, [ebp - 0xa4]
call fcn.00405420
movups xmm0, xmmword [ebp - 0xbc]
xor ecx, ecx
movups xmmword [esi + 0x4d], xmm0
nop dword [eax]
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 0x10
jl 0x403d80
lea eax, [ebp - 0x18]
mov byte [ebp - 8], 0
push 0
push eax
mov ecx, esi
call fcn.00401ff0
push 1
mov edx, ebx
mov ecx, esi
call fcn.00402d20
add esp, 0xc
jmp 0x403e7a
mov byte [ebp + eax - 0x28], al
inc eax
cmp eax, 0x10
jl 0x403db1
lea ecx, [ebp - 0xac]
mov dword [ebp - 0xac], 0
call fcn.00405b90
mov edi, dword [ebp - 0xac]
test edi, edi
je 0x403e2a
mov eax, dword [0x4400a0]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403e24
push 0x43b02c
push eax
call ebx
test eax, eax
je 0x403e02
push 0
push 0x10
lea ecx, [ebp - 0x28]
push ecx
push dword [edi + 4]
call eax
mov eax, dword [0x4400a0]
test eax, eax
je 0x403e24
push 0x43b03c
push eax
call ebx
test eax, eax
je 0x403e24
push 0
push 0x20
lea ecx, [ebp - 0x48]
push ecx
push dword [edi + 4]
call eax
mov ebx, dword [ebp - 0xa8]
mov ecx, edi
call fcn.00405d80
movups xmm0, xmmword [ebp - 0x48]
xor ecx, ecx
movups xmmword [esi + 0x8d], xmm0
movups xmm0, xmmword [ebp - 0x38]
movups xmmword [esi + 0x9d], xmm0
nop dword [eax]
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 0x10
jl 0x403e50
lea eax, [ebp - 0x18]
mov byte [ebp - 8], 0
push eax
mov ecx, esi
call fcn.004024c0
push 1
mov edx, ebx
mov ecx, esi
call fcn.00402d20
add esp, 8
cmp dword [esi + 0x64], 2
xorps xmm0, xmm0
movups xmmword [esi + 0x2c], xmm0
je 0x403e8f
movups xmmword [esi + 0x6d], xmm0
movups xmmword [esi + 0x7d], xmm0
cmp byte [esi + 0x4c], 2
je 0x403e99
movups xmmword [esi + 0x3c], xmm0
mov edi, dword [esi + 0x60]
mov dword [esi + 0x28], 0
test edi, edi
je 0x403ecb
mov eax, dword [edi + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
test eax, eax
je 0x403eb7
push eax
call ebx
mov eax, dword [edi + 0x10]
test eax, eax
je 0x403ec1
push eax
call ebx
push edi
call ebx
mov dword [esi + 0x60], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406bb3
mov esp, ebp
pop ebp
ret
Function at 0x404530
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x43e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
mov dword [ebp - 0x68], ecx
push ebx
mov ebx, dword [ebp + 8]
mov ecx, eax
push esi
push edi
mov dword [ebp - 0x64], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404553
sub ecx, edx
mov edx, ebx
sar ecx, 1
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x404567
sub edx, esi
lea edi, [edx + ecx]
lea eax, [edi*2 + 2]
push eax
call fcn.00412fa9
mov esi, eax
add esp, 4
test esi, esi
jne 0x4045e8
push 0x40
push str.malloc
push 0x43fe18
mov dword [0x43fc0c], 0xc9
call fcn.0040bfa6
push 0x104
xor eax, eax
mov dword [0x43fc08], edi
push str.C:JenkinsAE_build_workHibun_AE_Current_src_sftlcmn_sftl_crypt.c
push 0x43fe98
mov word [0x43fe96], ax
mov word [0x43fe16], ax
call fcn.0040bfa6
add esp, 0x18
xor eax, eax
mov word [0x44009e], ax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406bb3
mov esp, ebp
pop ebp
ret
push ebx
push dword [ebp - 0x64]
push str._s_S
push esi
call fcn.00401d40
mov ecx, esi
add esp, 0x10
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404600
sub ecx, edx
mov dword [ebp - 0x60], 0
sar ecx, 1
mov dword [ebp - 0x1c], 0x67452301
mov dword [ebp - 0x18], 0xefcdab89
mov dword [ebp - 0x14], 0x98badcfe
mov dword [ebp - 0x10], 0x10325476
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ecx + ecx]
mov edx, esi
push eax
lea ecx, [ebp - 0x60]
call fcn.00405310
mov edx, dword [ebp - 0x68]
lea ecx, [ebp - 0x60]
call fcn.00405420
push esi
call fcn.0040facf
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00406bb3
mov esp, ebp
pop ebp
ret
Function at 0x404aa0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x404abe
pop edi
or eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
test bl, 1
je 0x404b26
and ebx, 0xfffffffe
mov esi, 0x32
nop dword [eax]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 4], eax
cmp eax, 1
je 0x404b26
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
add esi, 0x32
cmp esi, 0x41a
jb 0x404ad0
cmp dword [ebp - 4], 0
jne 0x404b26
push 0x40
push str.SetFileAttributes
push 0x43fe18
mov dword [0x43fc0c], 0xcb
call fcn.0040bfa6
add esp, 0xc
xor eax, eax
mov word [0x43fe96], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x404b92
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x32
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], eax
cmp eax, 1
je 0x404bdf
call ebx
cmp eax, 2
je 0x404b64
call ebx
cmp eax, 3
je 0x404b64
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
add esi, 0x32
cmp esi, 0x41a
jb 0x404b31
cmp dword [ebp - 4], 0
jne 0x404bdf
push 0x40
push str.DeleteFile
push 0x43fe18
mov dword [0x43fc0c], 0xcb
call fcn.0040bfa6
add esp, 0xc
xor eax, eax
mov word [0x43fe96], ax
call ebx
mov dword [0x43fc08], eax
test edi, edi
je 0x404bae
push 0x104
push edi
push 0x43fc10
call fcn.0040bfa6
add esp, 0xc
push 0x104
xor eax, eax
push str.C:JenkinsAE_build_workHibun_AE_Current_src_sftlcmn_sftl_filesys.c
push 0x43fe98
mov word [0x43fe16], ax
call fcn.0040bfa6
add esp, 0xc
xor eax, eax
mov word [0x44009e], ax
or eax, 0xffffffff
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40aeca
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x43f4e8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40af0a
cmp byte [ebx], 0xa
jne 0x40af0a
or byte [eax + edi + 0x28], 4
jmp 0x40af0f
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x40b00d
mov al, byte [edx]
cmp al, 0x1a
je 0x40afef
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x40af3e
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x40af63
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x40af6d
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x40af20
jmp 0x40b00d
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40afea
cmp dword [ebp - 0xc], 0
je 0x40afea
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x43f4e8]
test byte [eax + edi + 0x28], 0x48
je 0x40afc4
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x40afaf
mov byte [esi], dl
jmp 0x40afc0
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x43f4e8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x40b00d
cmp byte [ebp - 1], 0xa
jne 0x40afd3
cmp esi, ebx
jne 0x40afd3
mov byte [esi], 0xa
jmp 0x40b00c
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040f7b0
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x40b00d
mov byte [esi], 0xd
jmp 0x40b00c
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x43f4e8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x40b009
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x40b00d
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret