joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4909c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push dword [ebp + 0xc]
mov ebx, ecx
call fcn.006b9cb4
mov edi, eax
add esp, 4
mov dword [ebp + 0xc], edi
lea edx, [eax + 2]
jmp 0x4909e0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4909e0
sub eax, edx
sar eax, 1
inc eax
push eax
push edi
call fcn.006be594
add esp, 8
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x490a21
cmp eax, 0x50
je 0x490a21
cmp eax, 0xb7
je 0x490a21
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 0x228]
push esi
mov esi, dword [eax]
cmp esi, eax
je 0x490ab9
mov dword [ebx + 0x230], esi
push 0x2e
push dword [esi + 8]
call fcn.006b7843
add esp, 8
test eax, eax
je 0x490a91
push eax
call fcn.006b9cb4
mov edi, eax
add esp, 4
mov dword [ebp - 4], edi
test edi, edi
je 0x490a91
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x490a60
sub ecx, edx
sar ecx, 1
inc ecx
push ecx
push edi
call fcn.006be594
push edi
push dword [ebp + 0xc]
call fcn.006bbd91
push dword [ebp - 4]
mov edi, eax
call fcn.006b31f8
add esp, 0x14
test edi, edi
jne 0x490aab
push dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, ebx
push dword [esi + 8]
call dword [eax + 0x20]
test eax, eax
je 0x490ad7
cmp dword [ebx + 0x238], 0
jne 0x490ab9
mov esi, dword [esi]
cmp esi, dword [ebx + 0x228]
jne 0x490a32
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x490ac9
push eax
call fcn.006b31f8
add esp, 4
pop esi
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x490ae7
push edi
call fcn.006b31f8
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4915f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
jne 0x491615
push dword [esi + 4]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.006b5539
add esp, 0x10
pop esi
pop ebp
ret 0xc
cmp eax, 1
jne 0x491672
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x491629
mov eax, dword [ebp + 0x10]
pop esi
pop ebp
ret 0xc
mov edx, dword [esi + 0x10]
push edi
mov edi, dword [ebp + 0x10]
lea eax, [edx + edi]
cmp eax, dword [esi + 0xc]
jbe 0x491658
push 0x2ff
push str....._source_archiveUnalz.cpp
push str.assert_at_file:_s_line:_d_n
call fcn.006baa6c
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebp
ret 0xc
push edi
push dword [ebp + 0xc]
add ecx, edx
push ecx
call fcn.006b3670
add esp, 0xc
mov eax, edi
add dword [esi + 0x10], edi
pop edi
pop esi
pop ebp
ret 0xc
push 0x309
push str....._source_archiveUnalz.cpp
push str.assert_at_file:_s_line:_d_n
call fcn.006baa6c
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ebp
ret 0xc
Function at 0x4922b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 4], ecx
push edi
test eax, eax
je 0x4922cf
mov dword [eax], ecx
mov eax, ebx
or eax, ecx
je 0x492490
lea esp, [esp]
mov eax, dword [esi + 0x5dd8]
lea eax, [eax + eax*2]
mov edi, dword [esi + eax*8 + 0x20]
lea ecx, [esi + eax*8]
mov eax, dword [ecx + 0x2c]
cdq
sub edi, eax
mov eax, dword [ecx + 0x24]
sbb eax, edx
sub edi, dword [esi + 0x5de8]
sbb eax, dword [esi + 0x5dec]
cmp dword [ebp + 0xc], eax
jg 0x492316
jl 0x492312
cmp ebx, edi
jae 0x492316
mov edi, ebx
jmp 0x492322
mov edi, dword [ecx + 0x20]
sub edi, dword [ecx + 0x2c]
sub edi, dword [esi + 0x5de8]
test edi, edi
je 0x49247b
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
add eax, dword [ebp + 8]
push edi
push eax
push dword [ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x492357
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x49247b
mov ecx, dword [ebp - 8]
cmp edi, ecx
jne 0x492459
add dword [esi + 0x5de0], ecx
mov edi, dword [ebp + 0xc]
adc dword [esi + 0x5de4], 0
add dword [esi + 0x5de8], ecx
mov eax, dword [ebp - 4]
adc dword [esi + 0x5dec], 0
sub ebx, ecx
sbb edi, 0
add eax, ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], eax
test ecx, ecx
je 0x492398
mov dword [ecx], eax
mov eax, dword [esi + 0x5dd8]
lea eax, [eax + eax*2]
mov edi, dword [esi + eax*8 + 0x20]
lea ecx, [esi + eax*8]
mov eax, dword [ecx + 0x2c]
cdq
sub edi, eax
mov eax, dword [ecx + 0x24]
mov ecx, dword [esi + 0x5dec]
sbb eax, edx
mov edx, edi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x5de8], edx
jne 0x492404
cmp ecx, eax
jne 0x492406
mov eax, dword [esi + 0x5dd8]
inc eax
mov dword [esi + 0x5dd8], eax
lea eax, [eax + eax*2]
cmp dword [esi + eax*8 + 0x18], 0xffffffff
lea ecx, [esi + eax*8]
je 0x49243f
mov eax, dword [ecx + 0x28]
push 0
cdq
push 0
push eax
mov dword [esi + 0x5de8], eax
mov dword [esi + 0x5dec], edx
push dword [ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x492429
cmp ecx, eax
jl 0x492429
jg 0x492412
cmp dword [esi + 0x5de8], edx
jbe 0x492429
push 0x4ea
push str....._source_archiveUnalz.cpp
push str.assert_at_file:_s_line:_d_n
call fcn.006baa6c
add esp, 0xc
mov eax, ebx
or eax, edi
jne 0x4922e0
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
or ebx, edi
mov dword [esi + 0x5df0], 1
jne 0x492485
lea eax, [ebx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x4d0
push str....._source_archiveUnalz.cpp
push str.assert_at_file:_s_line:_d_n
call fcn.006baa6c
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [esi + 0x5df0], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x492520
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push ebx
push esi
push edi
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
mov ebx, dword [edx + 8]
mov edi, dword [edx + 0xc]
mov esi, dword [edx + 0x10]
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x492560
mov ax, word [edx + 0x10]
or ax, 2
movzx ecx, ax
mov eax, ecx
xor eax, 1
imul eax, ecx
mov ecx, dword [ebp - 0x14]
sar eax, 8
xor al, byte [ebp + ecx - 0x10]
movzx ecx, al
xor ecx, ebx
shr ebx, 8
and ecx, 0xff
xor ebx, dword [ecx*4 + 0x77eff0]
movzx ecx, bl
add ecx, edi
mov dword [edx + 8], ebx
imul edi, ecx, 0x8088405
inc edi
mov ecx, edi
mov dword [edx + 0xc], edi
shr ecx, 0x18
xor ecx, esi
shr esi, 8
and ecx, 0xff
xor esi, dword [ecx*4 + 0x77eff0]
mov ecx, dword [ebp - 0x14]
mov dword [edx + 0x10], esi
mov byte [ebp + ecx - 0x10], al
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0xc
jl 0x492560
cmp dword [edx + 0x5df8], 0
mov ecx, dword [edx + 0x6008]
pop edi
pop esi
pop ebx
je 0x492600
mov edx, dword [ecx + 0xf]
movzx ecx, al
xor eax, eax
shr edx, 8
cmp edx, ecx
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret 4
xor edx, edx
cmp byte [ecx + 0x1a], al
mov ecx, dword [ebp - 4]
sete dl
xor ecx, ebp
mov eax, edx
call fcn.006b3266
mov esp, ebp
pop ebp
ret 4
Function at 0x499540
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6fc0b3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0xa
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0x11
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xa
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0xa
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0x11
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0xa
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0x11
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0xa
lea esi, [edi + 0x88]
mov dword [esi], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov eax, dword [0x7e7970]
mov dword [edi + 0xa0], eax
mov byte [ebp - 4], 6
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 0x98], 0xffffffff
mov dword [edi + 0x9c], 0xffffffff
mov dword [edi + 0xa4], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0xffffffff
cmp dword [esi + 4], 0
jg 0x4996c3
push 0xffffffffffffffff
push 1
mov ecx, esi
call fcn.0043fbf0
mov esi, dword [esi]
push 0x790eb0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x790eb0
push eax
mov ecx, esi
call fcn.00428920
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a2cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0x10
mov ecx, dword [ebp + 8]
mov eax, edx
mov dword [ebp - 0x10], eax
mov ebx, edi
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 4], ecx
xor eax, dword [ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov dword [ebp - 0xc], eax
movzx esi, al
shr ecx, 8
movzx edx, cl
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
and eax, 0xff
mov eax, dword [edi + eax*4 + 0x48]
add eax, dword [edi + ecx*4 + 0x448]
xor eax, dword [edi + edx*4 + 0x848]
add eax, dword [edi + esi*4 + 0xc48]
xor eax, dword [ebp - 4]
dec dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
jne 0x4a2ce3
mov ecx, dword [edi + 0x44]
xor ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [edx], ecx
mov ecx, dword [edi + 0x40]
xor ecx, eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4a2d50
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 8], 0x12
push esi
push edi
mov ecx, 0x400
mov dword [ebp - 0x10], ebx
lea edi, [ebx + 0x48]
mov esi, 0x77dff0
rep movsd dword es:[edi], dword [esi]
mov eax, 0x77dfa0
xor esi, esi
sub eax, ebx
mov edi, ebx
mov ebx, eax
movzx eax, byte [esi + edx]
lea edi, [edi + 4]
inc esi
xor ecx, ecx
cmp esi, dword [ebp + 8]
cmovge esi, ecx
shl eax, 8
movzx ecx, byte [esi + edx]
inc esi
or ecx, eax
xor eax, eax
cmp esi, dword [ebp + 8]
cmovge esi, eax
shl ecx, 8
movzx eax, byte [esi + edx]
inc esi
or eax, ecx
xor ecx, ecx
cmp esi, dword [ebp + 8]
cmovge esi, ecx
shl eax, 8
movzx ecx, byte [esi + edx]
inc esi
or ecx, eax
xor eax, eax
cmp esi, dword [ebp + 8]
cmovge esi, eax
mov eax, dword [ebx + edi - 4]
xor eax, ecx
dec dword [ebp - 8]
mov dword [edi - 4], eax
jne 0x4a2d81
mov ebx, dword [ebp - 0x10]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
mov ecx, ebx
push eax
lea edx, [ebp - 4]
call fcn.004a2cc0
mov eax, dword [ebp - 4]
add esp, 4
mov dword [ebx + esi*4], eax
mov eax, dword [ebp - 8]
mov dword [ebx + esi*4 + 4], eax
add esi, 2
cmp esi, 0x12
jl 0x4a2de8
lea esi, [ebx + 0x4c]
mov dword [ebp - 0xc], 4
jmp 0x4a2e20
mov edi, 0x80
lea eax, [ebp - 8]
mov ecx, ebx
push eax
lea edx, [ebp - 4]
call fcn.004a2cc0
mov eax, dword [ebp - 4]
add esp, 4
mov dword [esi - 4], eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
add esi, 8
dec edi
jne 0x4a2e25
dec dword [ebp - 0xc]
jne 0x4a2e20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a2e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x4a2e79
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 4], ecx
lea ecx, [ebx + 0x44]
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x10
push edi
xor eax, dword [ecx]
mov ecx, eax
movzx edi, al
shr ecx, 8
mov esi, eax
movzx edx, cl
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
and eax, 0xff
mov eax, dword [ebx + eax*4 + 0x48]
add eax, dword [ebx + ecx*4 + 0x448]
xor eax, dword [ebx + edx*4 + 0x848]
mov edx, esi
add eax, dword [ebx + edi*4 + 0xc48]
mov ecx, dword [ebp - 8]
xor eax, dword [ebp - 4]
sub ecx, 4
dec dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
jne 0x4a2e90
mov ecx, dword [ebx + 4]
xor ecx, eax
mov eax, dword [ebx]
xor eax, edx
mov edx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [edx], eax
mov eax, 1
mov dword [edx + 4], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a56b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov edx, 0xc0000000
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, al
mov ecx, 1
mov dword [ebp - 0xac], esi
cmp byte [edi + 0x16], 0
mov dword [edi + 0xc18], 0
cmovne eax, ecx
cmp byte [ebp + 0x14], 0
mov ecx, SysReAllocStringLen
cmovne ecx, edx
test al, al
mov dword [ebp - 0xa4], ecx
mov edx, 3
mov ecx, 1
mov eax, 0x8000000
cmovne ecx, edx
mov edx, dword [0x7e8a20]
mov dword [ebp - 0xa8], ecx
xor ecx, ecx
cmp byte [edi + 0x15], cl
cmovne eax, ecx
mov dword [ebp - 0xa0], eax
cmp edx, 0xffffffff
jne 0x4a576b
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x94]
mov dword [0x7e8a20], edx
mov dword [0x80abac], ecx
jmp 0x4a5771
mov ecx, dword [0x80abac]
xor eax, eax
cmp edx, 2
cmove eax, ecx
test eax, eax
je 0x4a57a8
test ebx, ebx
je 0x4a57a8
cmp word [ebx], 0
je 0x4a57a8
push 0
push dword [ebp - 0xa0]
push 3
push 0
push dword [ebp - 0xa8]
push dword [ebp - 0xa4]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x4a57c7
push 0
push dword [ebp - 0xa0]
push 3
push 0
push dword [ebp - 0xa8]
push dword [ebp - 0xa4]
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xa0], eax
cmp eax, 0xffffffff
jne 0x4a57ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov eax, dword [ebp - 0xa0]
jne 0x4a57ed
mov dword [edi + 0xc18], 1
cmp eax, 0xffffffff
mov byte [edi + 0x12], 0
mov dword [edi + 0xc], 0
setne dl
mov byte [edi + 0x10], 0
mov byte [ebp - 0x99], dl
test dl, dl
je 0x4a58ac
mov dword [edi + 4], eax
test ebx, ebx
je 0x4a5840
mov eax, edi
mov ecx, ebx
sub eax, ebx
add eax, 0x418
mov esi, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
movzx eax, word [ecx - 2]
test ax, ax
jne 0x4a5824
mov esi, dword [ebp - 0xac]
jmp 0x4a5849
xor eax, eax
mov word [edi + 0x418], ax
test esi, esi
je 0x4a5860
mov ecx, edi
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi + 0x16], al
test al, al
jne 0x4a5851
jmp 0x4a5880
push 0
push 0
push 0x10000000
lea eax, [edi + 0x17]
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dl, byte [ebp - 0x99]
cmp dword [edi + 4], 0xffffffff
je 0x4a58ac
xor ecx, ecx
jmp 0x4a5890
cmp dword [ecx*4 + 0x805ed0], 0
je 0x4a58a5
inc ecx
cmp ecx, 0x100
jb 0x4a5890
jmp 0x4a58ac
mov dword [ecx*4 + 0x805ed0], edi
mov ecx, dword [ebp - 4]
mov al, dl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006b3266
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a5b30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4a5b55
dec eax
je 0x4a5b4a
dec eax
jne 0x4a5b55
push 0xfffffffffffffff4
jmp 0x4a5b4c
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0x4a5ba7
mov eax, dword [ebp + 0xc]
xor edi, edi
test eax, eax
jle 0x4a5ba2
mov ebx, eax
mov eax, 0x4000
lea ecx, [ebp - 4]
cmp ebx, eax
push 0
cmovl eax, ebx
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
test al, al
je 0x4a5bc5
add edi, 0x4000
sub ebx, 0x4000
cmp edi, dword [ebp + 0xc]
jl 0x4a5b66
jmp 0x4a5bc1
mov al, byte [ebp + 0xf]
jmp 0x4a5bc1
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
test al, al
jne 0x4a5c09
cmp byte [esi + 0x14], 0
je 0x4a5c09
cmp dword [esi + 0xc], 0
jne 0x4a5c09
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push 1
mov ebx, eax
mov dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4a5bfa
call edi
lea ecx, [esi + 0x17]
call fcn.004ade00
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov byte [esi + 8], 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4a5d30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0xc], 1
jne 0x4a5d55
mov eax, 0x4e20
cmp edi, eax
push 0xfffffffffffffff6
cmovg edi, eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push 0
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4a5dc8
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x4a5da2
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x4a5d85
cmp eax, 3
jne 0x4a5da2
cmp edi, 0x4e20
jle 0x4a5da2
push 0x4e20
push dword [ebp + 8]
mov ecx, esi
call fcn.004a5d30
pop edi
pop esi
pop ebp
ret 8
cmp dword [esi + 0xc], 1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4a5dbd
call esi
cmp eax, 0x6d
jne 0x4a5dbd
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
call esi
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret 8
Function at 0x4a9950
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4a995b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004a9970
Function at 0x4ad960
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [0x7e8a20]
cmp ecx, 0xffffffff
jne 0x4ad9b5
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [ebp - 0x88]
mov edx, dword [ebp - 0x94]
mov dword [0x7e8a20], ecx
mov dword [0x80abac], edx
jmp 0x4ad9bb
mov edx, dword [0x80abac]
xor eax, eax
cmp ecx, 2
cmove eax, edx
test eax, eax
je 0x4ad9dc
test esi, esi
je 0x4ad9dc
cmp word [esi], 0
je 0x4ad9dc
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4ad9e5
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4ada0a
push dword [ebp + 8]
mov edx, esi
mov ecx, edi
call fcn.004ae0a0
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4ada1f
cmp eax, 3
mov eax, 1
jne 0x4ada24
mov eax, 2
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.006b3266
mov esp, ebp
pop ebp
ret

Function at 0x4ade00
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea edx, [ebp - 0x408]
mov edi, ecx
call fcn.004a9430
cmp dword [0x809538], 0
jne 0x4ade5a
push 0x78b6d0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4ade4d
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x809538], eax
jmp 0x4ade52
mov eax, dword [0x809538]
test eax, eax
je 0x4adeec
mov ecx, edi
call fcn.004a8bc0
mov esi, eax
lea eax, [ebp - 0x408]
sub esi, edi
push esi
push edi
push eax
call fcn.006b8fd0
add esp, 0xc
mov byte [ebp + esi - 0x408], 0
lea eax, [ebp - 0x428]
mov dword [ebp - 0x40c], 0
xor ecx, ecx
mov dword [ebp - 0x410], 0
cmp byte [ebp - 0x408], cl
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x408]
cmove eax, ecx
push eax
call dword [0x809538]
test eax, eax
je 0x4adeec
mov edx, dword [ebp - 0x40c]
cmp edx, dword [ebp - 0x424]
ja 0x4adeec
xor eax, eax
add eax, dword [ebp - 0x410]
adc edx, 0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x420]
xor ecx, ecx
cmp byte [ebp - 0x408], cl
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x408]
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x4adf3b
mov eax, 0x163e00
xor edx, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x418]
imul eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
mul dword [ebp - 0x414]
call fcn.006b3266
mov esp, ebp
pop ebp
ret
Function at 0x4adf60
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
mov edx, dword [0x7e8a20]
push edi
mov edi, ecx
cmp edx, 0xffffffff
jne 0x4adfb5
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x94]
mov dword [0x7e8a20], edx
mov dword [0x80abac], ecx
jmp 0x4adfbb
mov ecx, dword [0x80abac]
xor eax, eax
cmp edx, 2
cmove eax, ecx
test eax, eax
je 0x4adfda
test esi, esi
je 0x4adfda
cmp word [esi], 0
je 0x4adfda
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x4adfe1
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
pop edi
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.006b3266
mov esp, ebp
pop ebp
ret

Function at 0x4ae000
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
mov edx, dword [0x7e8a20]
push edi
mov edi, ecx
cmp edx, 0xffffffff
jne 0x4ae055
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x94]
mov dword [0x7e8a20], edx
mov dword [0x80abac], ecx
jmp 0x4ae05b
mov ecx, dword [0x80abac]
xor eax, eax
cmp edx, 2
cmove eax, ecx
test eax, eax
je 0x4ae088
test esi, esi
je 0x4ae088
cmp word [esi], 0
je 0x4ae088
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.006b3266
mov esp, ebp
pop ebp
ret

Function at 0x4ae0a0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x7e8a20]
mov ebx, ecx
push edi
mov edi, edx
cmp esi, 0xffffffff
jne 0x4ae0f6
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x94]
mov dword [0x7e8a20], esi
mov dword [0x80abac], ecx
jmp 0x4ae0fc
mov ecx, dword [0x80abac]
xor eax, eax
cmp esi, 2
cmove eax, ecx
test eax, eax
je 0x4ae11e
test edi, edi
je 0x4ae11e
cmp word [edi], 0
je 0x4ae11e
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x4ae128
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp - 4]
test eax, eax
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.006b3266
mov esp, ebp
pop ebp
ret