joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4075b0
Capabilities:
Create directory
Query environment variable

Disassembly:
mov eax, dword [0x43c384]
test eax, eax
jne 0x407622
push 0x104
call fcn.0041bc9a
add esp, 4
push 0x104
push eax
push str.APPDATA
mov dword [0x43c384], eax
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov edx, dword [0x43c384]
mov eax, edx
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4075e7
mov ecx, dword [str.Microsoftdtsc]
mov dword [eax], ecx
mov ecx, dword [0x4367c0]
mov dword [eax + 4], ecx
mov ecx, dword [0x4367c4]
mov dword [eax + 8], ecx
mov ecx, dword [0x4367c8]
push 0
push edx
mov dword [eax + 0xc], ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov eax, dword [0x43c384]
ret

Function at 0x4077b0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
push 0x104
lea eax, [esp + 8]
push eax
push ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
lea eax, [esp + 4]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
mov byte [esi + 4], 0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4077e8
sub eax, edx
push eax
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.004025b0
mov eax, esi
add esp, 0x108
ret

Function at 0x407810
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407838
xor al, al
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
lea esp, [esp]
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push esi
push ebx
call ebp
mov eax, dword [esp + 0x10]
add esi, eax
sub edi, eax
test eax, eax
ja 0x407850
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret

Function at 0x407880
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4078a8
xor eax, eax
pop ebx
pop ecx
ret
push esi
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp dword [esp + 0x18], 0
mov esi, eax
jne 0x407909
push esi
call fcn.0041bc9a
mov edi, dword [esp + 0x20]
add esp, 4
mov dword [esp + 0x18], eax
mov dword [edi], esi
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [edi], esi
mov edi, dword [esp + 0x1c]
lea esp, [esp]
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
push edi
push ebx
call ebp
mov eax, dword [esp + 0x10]
sub esi, eax
add edi, eax
test eax, eax
ja 0x4078e0
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
mov edi, dword [esp + 0x1c]
cmp dword [edi], esi
jae 0x4078cf
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [edi], esi
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x407930
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
push ebx
mov ebx, eax
lea edx, [esp + 8]
sub edx, ebx
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x407940
lea eax, [esp + 8]
push 0x5c
push eax
call fcn.0041c830
add esp, 8
test eax, eax
je 0x407962
mov byte [eax], 0
push 0
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
setne al
test al, al
jne 0x40798f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
je 0x40798f
xor al, al
pop ebx
add esp, 0x108
ret
mov edx, dword [esp + 0x110]
mov eax, dword [0x43c2f8]
push esi
push edi
push 0
push 0x80000000
push 0xffffffffffffffff
push 0
push edx
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
je 0x4079d3
lea ecx, [esp + 0xc]
push ecx
push edi
xor eax, eax
call fcn.00407ba0
add esp, 8
push edi
mov esi, eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test esi, esi
jne 0x4079df
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x108
ret
mov edx, dword [esp + 0xc]
push edx
push esi
push ebx
call fcn.00407810
push esi
mov bl, al
call fcn.0041bb78
add esp, 0x10
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x108
ret

Function at 0x407a10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
mov ebx, eax
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x407a20
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x407a32
sub eax, esi
lea eax, [eax + edx + 4]
call fcn.00429860
mov esi, esp
push edi
push ebx
push str.__s___s
push esi
call fcn.0041bec6
push pe_nt_image_headers32
lea eax, [ebp - 0x58]
push 0
push eax
mov dword [ebp - 0x5c], 0x44
call fcn.00420e90
add esp, 0x1c
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
setne bl
test bl, bl
je 0x407ab6
cmp byte [ebp + 8], 0
je 0x407aa4
mov eax, dword [ebp - 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov ecx, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x10]
push edx
call esi
mov al, bl
lea esp, [ebp - 0x64]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407ba0
Capabilities:
Check http status code
Get http content length

Disassembly:
sub esp, 0x418
mov edx, dword [esp + 0x41c]
push ebx
push ebp
mov ebp, dword [esp + 0x428]
push esi
mov esi, dword [sym.imp.WININET.dll_HttpQueryInfoA]
push edi
push 0
mov edi, eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0x20000013
mov ebx, 4
push edx
mov byte [esp + 0x27], 0
mov dword [esp + 0x30], ebx
call esi
cmp dword [esp + 0x24], 0xc8
je 0x407bf9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x418
ret
test edi, edi
jne 0x407c41
mov edx, dword [esp + 0x42c]
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x20000005
push edx
mov dword [esp + 0x34], ebx
call esi
test eax, eax
jne 0x407c2f
mov eax, 0x400
mov byte [esp + 0x13], 1
mov dword [esp + 0x18], eax
jmp 0x407c33
mov eax, dword [esp + 0x18]
push eax
mov dword [ebp], eax
call fcn.0041bc9a
add esp, 4
mov edi, eax
mov esi, dword [ebp]
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
lea ebx, [ebx]
mov edx, dword [esp + 0x42c]
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x30]
push ecx
push edx
call ebx
cmp dword [esp + 0x14], esi
jbe 0x407c97
cmp byte [esp + 0x13], 0
je 0x407bec
mov esi, dword [ebp]
lea eax, [esi + esi]
push eax
push edi
mov dword [ebp], eax
call fcn.0041ca1b
mov edi, eax
add esp, 8
test edi, edi
je 0x407bec
mov eax, dword [esp + 0x14]
mov edx, dword [ebp]
push eax
lea ecx, [esp + 0x2c]
sub edx, esi
push ecx
add edx, edi
push edx
call fcn.00421440
mov eax, dword [esp + 0x20]
add esp, 0xc
sub esi, eax
test eax, eax
ja 0x407c50
sub dword [ebp], esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x418
ret
Function at 0x407d20
Capabilities:
Connect to http server
Parse url
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x3c
push ebx
push esi
push edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x407d30
sub eax, edx
lea esi, [eax + 1]
mov eax, esi
call fcn.00429860
mov eax, esi
mov edi, esp
call fcn.00429860
mov ebx, esp
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.00420e90
mov edx, dword [ebp + 8]
add esp, 0xc
lea ecx, [ebp - 0x3c]
push ecx
push 0
push 0
push edx
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], ebx
mov dword [ebp - 4], esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
mov eax, dword [ebp - 0x24]
mov ecx, dword [0x43c2f8]
push 0
push 0
push 3
push 0
push 0
push eax
push edi
push ecx
call dword [sym.imp.WININET.dll_InternetConnectA]
mov esi, eax
test esi, esi
je 0x407df7
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
push 0
push 0
push 0
push edx
push 0
push eax
push ecx
push esi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x14]
push edx
mov edi, eax
mov eax, dword [ebp + 0x18]
push eax
push 0xffffffffffffffff
push ecx
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x407e03
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push esi
call edi
xor eax, eax
lea esp, [ebp - 0x48]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x24]
mov eax, dword [ebp + 0x20]
push edx
push edi
call fcn.00407ba0
add esp, 8
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, eax
call edi
push esi
call edi
mov eax, ebx
lea esp, [ebp - 0x48]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409810
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esi + 0x4090], 0
je 0x4098c9
cmp dword [esi + 0x6c], 0
jbe 0x4098c9
push ebx
push ebp
mov ebx, 0xffffff78
push edi
lea edi, [esi + 0x88]
sub ebx, esi
jmp 0x409840
movzx ecx, byte [edi]
mov eax, dword [esi + 0x4094]
mov ebp, dword [esi + 0x40a0]
xor ecx, eax
mov edx, dword [esi + 0x409c]
shr eax, 8
and ecx, 0xff
mov ecx, dword [ebp + ecx*4]
xor ecx, eax
movzx eax, cl
add eax, dword [esi + 0x4098]
mov dword [esi + 0x4094], ecx
mov ecx, dword [esi + 0x409c]
imul eax, eax, 0x8088405
add eax, 1
mov dword [esi + 0x4098], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
and edx, 0xfffd
shr ecx, 8
xor ecx, dword [ebp + eax*4]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
mov dword [esi + 0x409c], ecx
shr eax, 8
xor byte [edi], al
add edi, 1
lea ecx, [ebx + edi]
cmp ecx, dword [esi + 0x6c]
jb 0x409840
pop edi
pop ebp
pop ebx
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x20]
push edx
mov edx, dword [esi + 0x1c]
lea eax, [esi + 0x88]
push eax
mov eax, dword [esi + 8]
push ecx
push edx
call eax
add esp, 0x10
cmp eax, dword [esi + 0x6c]
mov dword [esi + 0x6c], 0
je 0x4098f4
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x40a230
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x40a237
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.0040a240
Function at 0x40a240
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x40a272
lea esp, [esp]
test cl, 3
je 0x40a272
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x434538]
add ecx, 1
sub esi, 1
jne 0x40a250
cmp esi, 0x20
push ebx
push edi
jb 0x40a45c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x434938]
xor edx, dword [ebx*4 + 0x434d38]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x434538]
add ecx, 4
xor edx, dword [eax*4 + 0x435138]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x434938]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x434d38]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x434538]
add ecx, 4
xor eax, dword [edx*4 + 0x435138]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x434938]
xor edx, dword [ebx*4 + 0x434d38]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x434538]
xor edx, dword [eax*4 + 0x435138]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x434938]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x434d38]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x434538]
xor eax, dword [edx*4 + 0x435138]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x434938]
xor edx, dword [ebx*4 + 0x434d38]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x434538]
xor edx, dword [eax*4 + 0x435138]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x434938]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x434d38]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x434538]
and edx, 0xff
xor eax, dword [edx*4 + 0x435138]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x434938]
xor edx, dword [ebx*4 + 0x434d38]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x434538]
add ecx, 4
xor edx, dword [eax*4 + 0x435138]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x434938]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x434d38]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x434538]
and edx, 0xff
xor eax, dword [edx*4 + 0x435138]
sub edi, 1
jne 0x40a282
cmp esi, 4
jb 0x40a4a9
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x434938]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x434d38]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x434538]
and eax, 0xff
xor edi, dword [eax*4 + 0x435138]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x40a466
test esi, esi
pop edi
pop ebx
je 0x40a4cd
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x434538]
add ecx, 1
sub esi, 1
jne 0x40a4b0
not eax
pop esi
ret
Function at 0x40f990
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebp
push esi
push edi
push 0x4368c4
push eax
call fcn.0041cd41
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
push esi
push edi
push str.6:lengthi_llde
push ebx
mov ebp, eax
call fcn.0041d981
mov ecx, dword [esp + 0x28]
push 0x5c
push ecx
call fcn.0041c830
add esp, 0x20
test eax, eax
jne 0x40f9d2
mov eax, dword [esp + 0x10]
jmp 0x40f9d5
add eax, 1
push ebx
mov ecx, eax
call fcn.0040f920
push 0x10000
push str.12:piece_lengthi_de
push ebx
call fcn.0041d981
add esp, 0x10
push 0
push 0x10000
push esi
push edi
call fcn.0042b8c0
push 0
push 0x10000
push esi
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
call fcn.0042b800
or eax, edx
je 0x40fa22
add dword [esp + 0x14], 1
adc dword [esp + 0x18], 0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push 0
push 0x14
push edx
push eax
call fcn.00426560
push edx
push eax
push str.6:pieces_lld:
push ebx
call fcn.0041d981
add esp, 0x10
test ebp, ebp
je 0x40fadd
push 0x14
call fcn.0041bc9a
push 0x10000
mov edi, eax
call fcn.0041bc9a
push str.computing_sha1...
mov esi, eax
call fcn.0041d8bc
call fcn.0041c373
add eax, 0x20
push eax
call fcn.0041c73c
push ebp
push 0x10000
push 1
push esi
call fcn.0041cfb1
add esp, 0x20
test eax, eax
je 0x40fab8
nop
push edi
push eax
push esi
call fcn.0041a5d0
push ebx
push 0x14
push 1
push edi
call fcn.0041d115
push ebp
push 0x10000
push 1
push esi
call fcn.0041cfb1
add esp, 0x2c
test eax, eax
jne 0x40fa90
push esi
call fcn.0041bb78
push edi
call fcn.0041bb78
push ebp
call fcn.0041d527
push str.done_n
call fcn.0041d8bc
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov ecx, dword [esp + 0x10]
push ecx
push str.could_not_open_file__s_n
call fcn.0041c373
add eax, 0x40
push eax
call fcn.0041d981
add esp, 0xc
pop edi
pop esi
mov eax, 1
pop ebp
ret
Function at 0x40fbc0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1fa0
call fcn.0041e890
push ebx
push ebp
mov ebp, dword [esp + 0x1fb8]
push esi
push edi
mov esi, ecx
push 0x4368c4
push esi
call fcn.0041cd41
push esi
push str.adding__s_n
mov edi, eax
call fcn.0041d8bc
add esp, 0x10
test edi, edi
je 0x40fd03
push 0x1f9c
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00420e90
mov eax, dword [esp + 0x1fd0]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x40fc18
sub eax, ecx
lea edx, [eax + esi + 1]
lea ebx, [esp + 0x10]
call fcn.0040fb10
mov edx, dword [esp + 0x1fbc]
mov eax, dword [esp + 0x1fb8]
mov ecx, ebx
push ecx
mov ecx, dword [esp + 0x1fb8]
push edx
push eax
push str.d6:lengthi_llde4:_see
push ecx
call fcn.0041d981
mov eax, dword [0x43c344]
mov ecx, dword [0x43c348]
push edi
mov edx, ebp
sub edx, eax
push edx
add ecx, eax
push 1
push ecx
call fcn.0041cfb1
add esp, 0x24
test eax, eax
je 0x40fcea
jmp 0x40fc80
mov esi, dword [0x43c344]
add esi, eax
cmp esi, ebp
mov dword [0x43c344], esi
jne 0x40fcce
mov ebx, dword [0x43c340]
mov eax, dword [0x43c33c]
lea edx, [ebx + 0x14]
push edx
push eax
call fcn.0041ca1b
mov ecx, dword [0x43c348]
add ebx, eax
push ebx
push esi
push ecx
mov dword [0x43c33c], eax
call fcn.0041a5d0
add dword [0x43c340], 0x14
add esp, 0x14
xor esi, esi
mov dword [0x43c344], esi
mov eax, dword [0x43c348]
push edi
mov edx, ebp
sub edx, esi
push edx
add eax, esi
push 1
push eax
call fcn.0041cfb1
add esp, 0x10
test eax, eax
jne 0x40fc80
push edi
call fcn.0041d527
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1fa0
ret
push esi
push str.could_not_open_file__s_n
call fcn.0041c373
add eax, 0x40
push eax
call fcn.0041d981
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1fa0
ret
Function at 0x40ff50
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x41c
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, eax
mov eax, edi
call fcn.00410100
mov ebx, eax
test ebx, ebx
je 0x4100cb
push 0x10000
call fcn.0041bc9a
add esp, 4
push esi
push str.5:filesl
mov ebp, eax
call fcn.0041d60e
push edi
push 0x436d18
lea eax, [esp + 0x38]
push 0x400
push eax
call fcn.0041d750
push edi
push 0x10000
push 0
lea ecx, [esp + 0x4c]
push ecx
push esi
push ebx
call fcn.0040fd30
push esi
mov ecx, edi
call fcn.0040f920
add esp, 0x34
push 0x10000
push str.e12:piece_length:_de
push esi
call fcn.0041d981
mov eax, dword [0x43c340]
mov edi, dword [0x43c344]
add esp, 0xc
test eax, eax
jne 0x40ffe3
test edi, edi
je 0x410047
xor edx, edx
test edi, edi
setle dl
sub edx, 1
and edx, 0x14
add edx, eax
push edx
push str.6:pieces_d:
push esi
call fcn.0041d981
mov eax, dword [0x43c33c]
add esp, 0xc
test eax, eax
je 0x41001d
mov ecx, dword [0x43c340]
push esi
push ecx
push 1
push eax
call fcn.0041d115
add esp, 0x10
mov eax, dword [0x43c344]
test eax, eax
je 0x410047
lea edx, [esp + 0x14]
push edx
push eax
push ebp
call fcn.0041a5d0
add esp, 0xc
push esi
push 0x14
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0041d115
add esp, 0x10
mov eax, dword [0x43c33c]
test eax, eax
je 0x410059
push eax
call fcn.0041bb78
add esp, 4
push ebp
call fcn.0041bb78
add esp, 4
cmp dword [0x43c330], 0
jne 0x410081
push str.warning:_no_files_found_in_directory_n
call fcn.0041c373
add eax, 0x40
push eax
call fcn.0041d981
add esp, 8
mov eax, dword [ebx]
or esi, 0xffffffff
cmp eax, 0xffffffff
je 0x410096
push eax
call fcn.0041e1da
add esp, 4
mov esi, eax
mov ecx, dword [ebx + 0x134]
push ecx
call fcn.0041bb78
add esp, 4
push ebx
call fcn.0041bb78
add esp, 4
cmp esi, 0xffffffff
jne 0x4100be
call fcn.0041ded1
mov dword [eax], 9
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
push edi
push str.could_not_read_directory__s_n
call fcn.0041c373
add eax, 0x40
push eax
call fcn.0041d981
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x41c
ret
Function at 0x4102c0
Capabilities:
Check mutex on windows
Move file

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
push edi
push str.up534
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
push 0xffffffffffffffff
push eax
mov dword [0x43c2fc], eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [esp + 0x124]
mov ecx, dword [0x43c2f8]
push 0
push 0x80000000
push 0xffffffffffffffff
push 0
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x4103c4
lea edx, [esp + 0x14]
push edx
push esi
xor eax, eax
call fcn.00407ba0
add esp, 8
push esi
mov ebp, eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test ebp, ebp
je 0x4103c4
cmp dword [0x43c380], 0
mov esi, dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
jne 0x410366
push 0x104
call fcn.0041bc9a
add esp, 4
push 0x104
push eax
push 0
mov dword [0x43c380], eax
call edi
push eax
call esi
mov eax, dword [0x43c380]
push eax
lea ecx, [esp + 0x1c]
push 0x436de4
push ecx
call fcn.0041bec6
add esp, 0xc
cmp dword [0x43c380], 0
jne 0x4103a6
push 0x104
call fcn.0041bc9a
add esp, 4
push 0x104
push eax
push 0
mov dword [0x43c380], eax
call edi
push eax
call esi
mov eax, dword [0x43c380]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
test eax, eax
jne 0x4103d1
push ebp
call fcn.0041bb78
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
cmp dword [0x43c380], 0
jne 0x4103f9
push 0x104
call fcn.0041bc9a
add esp, 4
push 0x104
push eax
push 0
mov dword [0x43c380], eax
call edi
push eax
call esi
mov ecx, dword [esp + 0x14]
mov edx, dword [0x43c380]
push ecx
push ebp
push edx
call fcn.00407810
add esp, 0xc
test al, al
je 0x4103bb
push 0
call fcn.00407570
mov edi, str.up534
call fcn.00407a10
add esp, 4
push ebp
mov bl, al
call fcn.0041bb78
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x110
ret

Function at 0x410440
Capabilities:
Check mutex on windows
Delete file

Disassembly:
sub esp, 0x104
push str.up534
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
push 0xffffffffffffffff
push eax
mov dword [0x43c2fc], eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [0x43c2fc]
push eax
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
cmp dword [0x43c380], 0
jne 0x41049f
push 0x104
call fcn.0041bc9a
add esp, 4
push 0x104
push eax
push 0
mov dword [0x43c380], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov ecx, dword [0x43c380]
push ecx
lea edx, [esp + 4]
push 0x436de4
push edx
call fcn.0041bec6
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
add esp, 0x104
ret