joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e730
Capabilities:
Copy file
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x62acc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.Settings
mov esi, edx
lea eax, [ebp - 0x110]
push esi
push str.Profile__s_s
push 0x104
push eax
mov edi, ecx
call fcn.00407c70
add esp, 0x14
lea eax, [ebp - 0x218]
push 0
push eax
lea eax, [ebp - 0x110]
push 0xffffffffffffffff
push eax
call fcn.0042d590
lea eax, [ebp - 0x218]
push eax
push 0x91ddb0
push edi
call fcn.0040d280
add esp, 0x1c
test eax, eax
jne 0x41e9bf
push str.Options0
push esi
push str.Profile__s_s
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00407c70
add esp, 0x14
lea eax, [ebp - 0x218]
push 0
push eax
lea eax, [ebp - 0x110]
push 0xffffffffffffffff
push eax
call fcn.0042d590
lea eax, [ebp - 0x218]
push eax
push 0x91f954
push edi
call fcn.0040d3f0
add esp, 0x1c
lea eax, [ebp - 0x110]
push str.Options1
push esi
push str.Profile__s_s
push 0x104
push eax
call fcn.00407c70
add esp, 0x14
lea eax, [ebp - 0x218]
push 0
push eax
lea eax, [ebp - 0x110]
push 0xffffffffffffffff
push eax
call fcn.0042d590
lea eax, [ebp - 0x218]
push eax
push 0x91f968
push edi
call fcn.0040d3f0
add esp, 0x1c
test edi, edi
jne 0x41e9bf
push esi
push 0x104
push 0x634978
call fcn.00503df9
add esp, 0xc
push esi
push 0x104
push 0x91ddb0
call fcn.00503df9
add esp, 0xc
lea eax, [ebp - 0x110]
push str.EarthView.bmp
push 0x634978
push 0x910534
push str._sProfile__s_s
push 0x104
push eax
call fcn.00407c70
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x110]
add esp, 0x18
push edi
push 0x91e110
push eax
call esi
push str.EVScrsvr.bmp
push 0x634978
push 0x910534
push str._sProfile__s_s
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00407c70
add esp, 0x18
lea eax, [ebp - 0x110]
push edi
push 0x91ded8
push eax
call esi
mov eax, dword [0x915d9c]
test eax, eax
je 0x41e907
push 0x634978
push edi
push 0x14d
push 0x513
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push edi
push edi
push 0x8001
push dword [0x915d9c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x91f958]
movsx ecx, byte [eax + 0x88]
call fcn.0042c7f0
mov eax, dword [0x91f96c]
lea ecx, [ebp - 0x23c]
push ecx
push 0
movsx eax, byte [eax + 0x88]
push eax
push 0x42c640
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x634978
push 0x910534
push str._sProfile__s.tmp
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00407c70
lea eax, [ebp - 0x110]
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x230], eax
add esp, 0x14
mov eax, 0x494
mov dword [ebp - 0x22c], 0
mov word [ebp - 0x228], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x238]
movlpd qword [ebp - 0x226], xmm0
push eax
mov dword [ebp - 0x21e], 0
mov dword [ebp - 0x234], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
Function at 0x420390
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp byte [0x91dfdf], 0
je 0x4203c6
mov eax, esi
inc esi
cmp eax, 0x64
jge 0x4203c6
push 1
push 0x32
mov ecx, 0x90fe00
mov byte [0x91decb], 1
call fcn.0043fb90
cmp byte [0x91dfdf], 0
jne 0x4203a0
lea eax, [ebp - 4]
mov dword [0x91e100], 0
push eax
push 0
push 0
push 0x420010
push 0
push 0
mov byte [0x91decb], 0
mov byte [0x91dfdf], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
test eax, eax
jne 0x420412
mov byte [0x91dfdf], al
mov eax, 3
mov dword [0x91e100], 3
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x91e100]
mov esp, ebp
pop ebp
ret

Function at 0x420780
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp byte [0x91dfde], 0
je 0x4207b6
mov eax, esi
inc esi
cmp eax, 0x64
jge 0x4207b6
push 2
push 0x32
mov ecx, 0x90fe00
mov byte [0x91deca], 1
call fcn.0043fb90
cmp byte [0x91dfde], 0
jne 0x420790
lea eax, [ebp - 4]
mov byte [0x91deca], 0
push eax
push 0
push 0
push 0x420430
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
test eax, eax
jne 0x4207f1
mov byte [0x91dfde], al
mov eax, 3
mov dword [0x91e0fc], 3
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x91e0fc]
mov esp, ebp
pop ebp
ret
Function at 0x421110
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x2c]
push ebx
push esi
push edi
mov esi, dword [eax]
mov ebx, ecx
mov eax, dword [0x11a8fe0]
mov dword [ebp - 4], edx
cmp eax, dword [esi + 4]
jle 0x42115d
push 0x11a8fe0
call fcn.004fe966
add esp, 4
cmp dword [0x11a8fe0], 0xffffffff
jne 0x42115d
push 0
call fcn.0050d930
push 0x11a8fe0
call fcn.004fe915
add esp, 8
xor edi, edi
test ebx, ebx
jns 0x42117c
cmp dword [0x91e218], edi
jne 0x4211a4
cmp dword [0x91e21c], edi
jne 0x4211a4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
je 0x42119a
cmp ebx, 1
jne 0x42118b
mov dword [0x91e21c], ebx
jmp 0x4211a4
cmp ebx, 2
jne 0x4211a4
mov dword [0x91e21c], 1
mov dword [0x91e218], 1
xor edx, edx
cmp dword [ebp - 4], 1
cmovle edx, dword [ebp - 4]
cmp byte [ebp + 8], 0
mov dword [0x91e108], edx
je 0x42120d
xor esi, esi
nop dword [eax]
cmp byte [esi + 0x91dfdc], 0
je 0x421201
nop dword [eax]
mov eax, edi
inc edi
cmp eax, 0x64
jge 0x421201
push 3
push 0x32
mov ecx, 0x90fe00
mov byte [esi + 0x91dec8], 1
mov dword [esi*4 + 0x91e218], 1
call fcn.0043fb90
cmp byte [esi + 0x91dfdc], 0
jne 0x4211d0
inc esi
cmp esi, 2
jl 0x4211c0
mov edx, dword [0x91e108]
cmp byte [0x91dfdc], 0
jne 0x421173
cmp byte [0x91dfdd], 0
jne 0x421173
xor ecx, ecx
mov eax, 1
nop
cmp edx, 1
mov esi, ecx
cmove esi, eax
cmp dword [esi*4 + 0x91e218], 1
jne 0x42124b
cmp byte [esi + 0x91dfdc], 0
je 0x42125b
dec eax
inc ecx
cmp eax, 0xffffffff
jg 0x421230
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi*4 + 0x91e218], 0
cmp esi, 5
jae 0x4212dd
lea eax, [ebp - 8]
mov byte [esi + 0x91dec8], 0
push eax
push 0
push esi
push 0x420bc0
push 0
push 0
mov byte [esi + 0x91dfdc], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x4212b0
mov byte [esi + 0x91dfdc], al
lea eax, [edi + 3]
pop edi
mov dword [esi*4 + 0x91e0f4], 3
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x634511], 0
je 0x4212c2
push 0xfffffffffffffff1
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [esi*4 + 0x91e0f4], 0
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004fed6e
int3
Function at 0x4282a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x62acc0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push ecx
mov edi, edx
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
test ebx, ebx
je 0x42837f
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x18]
xor edx, edx
add edx, eax
lea eax, [ebp - 0x18]
push 0
adc ecx, 0
add edx, 0xfffffff4
push eax
push edx
adc ecx, 0xffffffff
push ebx
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x42837f
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x42837f
cmp dword [ebp - 0x1c], 0xc
jne 0x42837f
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
test edi, edi
je 0x428359
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x40], eax
mov eax, ecx
shr eax, 4
and al, 1
mov dword [edi + 0x44], edx
mov byte [edi + 0x48], al
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42836c
movq xmm0, qword [ebp - 0x14]
movq qword [eax], xmm0
mov dword [eax + 8], edx
mov eax, ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
Function at 0x42c570
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x62acc0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call fcn.00500bb0
add esp, 0xc
lea eax, [ebp - 0x108]
push str.SYSTEM.INI
push 0x104
push eax
push 0x614196
push str.SCRNSAVE.EXE
push str.boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0
lea eax, [ebp - 0x10c]
push eax
push 0
push 0xe
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea eax, [ebp - 0x108]
push 0x91dff0
push eax
call fcn.00504753
add esp, 8
test eax, eax
jne 0x42c627
mov eax, 0x88888889
imul dword [ebp - 0x10c]
mov eax, dword [0x91f96c]
add edx, dword [ebp - 0x10c]
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [eax + 0x8c], ecx
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret

Function at 0x42c730
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x62acc0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call fcn.00500bb0
add esp, 0xc
lea eax, [ebp - 0x108]
push str.WIN.INI
push 0x104
push eax
push 0x614196
push str.Wallpaper
push str.Desktop
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x108]
push str.EarthView.bmp
push eax
call fcn.005000e0
add esp, 8
test eax, eax
jne 0x42c7d3
cmp byte [0x634515], al
jne 0x42c7c3
mov eax, dword [0x91f958]
cmp byte [eax + 0x88], 0
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
Function at 0x42c7f0
Capabilities:
Change the wallpaper
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x62acc0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
mov edi, ecx
call fcn.00500bb0
add esp, 0xc
cmp dword [0xa13280], 0
jne 0x42c834
test edi, edi
je 0x42ca3c
push esi
cmp edi, 1
jne 0x42c993
lea eax, [ebp - 0x110]
mov ecx, 0x911330
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
call fcn.0042f4d0
push eax
push 0
push str.Control_PanelDesktop
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0x91e110
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00503df9
add esp, 0xc
cmp byte [0x634516], 0
je 0x42c926
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42c8a5
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.Wallpaper
push dword [ebp - 0x10c]
call esi
push 2
push 0x616d88
push 1
push 0
push str.WallpaperStyle
push dword [ebp - 0x10c]
call esi
push 2
push 0x616d9c
push 1
push 0
push str.TileWallpaper
push dword [ebp - 0x10c]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.WallpaperOriginX
push dword [ebp - 0x10c]
call esi
push str.WallpaperOriginY
push dword [ebp - 0x10c]
call esi
push 3
push 0
jmp 0x42c965
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 2
push 0x616dd8
push 1
push 0
push str.WallpaperStyle
push dword [ebp - 0x10c]
call esi
push 2
push 0x616d88
push 1
push 0
push str.TileWallpaper
push dword [ebp - 0x10c]
call esi
push 3
lea eax, [ebp - 0x108]
push eax
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov dword [0xa13280], edi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
push 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0xffffffffffffffff
push str.BackupWPPath
call fcn.0042d500
add esp, 0x14
lea eax, [ebp - 0x110]
mov ecx, 0x911330
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
call fcn.0042f4d0
push eax
push 0
push str.Control_PanelDesktop
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.WallpaperOriginX
push dword [ebp - 0x10c]
call esi
push str.WallpaperOriginY
push dword [ebp - 0x10c]
call esi
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
lea eax, [ebp - 0x108]
push eax
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov dword [0xa13280], edi
test edi, edi
jne 0x42ca3b
push 1
push edi
push edi
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
Function at 0x42cf90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x42cfae
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42cfa5
sub eax, edx
or ebx, 0xffffffff
test eax, eax
je 0x42cfcf
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
xor ebx, dword [edx*4 + 0x90f170]
sub eax, 1
jne 0x42cfb5
not ebx
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x42d2a0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62acc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.00508ec0
add esp, 0x10
cmp byte [ebp - 0x20c], 0
je 0x42d3b6
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42d2e3
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ebx, [ebp - 0x20c]
sub ecx, edx
lea eax, [ebp - 0x20c]
add ebx, ecx
push eax
mov esi, ebx
call edi
cmp eax, 0xffffffff
jne 0x42d37f
nop dword [eax]
test esi, esi
je 0x42d33c
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.00500480
mov esi, eax
add esp, 8
test esi, esi
je 0x42d32e
mov byte [esi], 0
lea eax, [ebp - 0x20c]
push eax
call edi
cmp eax, 0xffffffff
je 0x42d310
cmp esi, ebx
jae 0x42d37f
test esi, esi
je 0x42d349
mov byte [esi], 0x5c
jmp 0x42d358
cmp byte [ebp - 0x20c], 0
lea esi, [ebp - 0x20c]
je 0x42d35e
inc esi
cmp byte [esi], 0
jne 0x42d358
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x20c]
push eax
call edi
cmp eax, 0xffffffff
je 0x42d392
cmp esi, ebx
jb 0x42d340
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x42d3a0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
Function at 0x42d660
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x62acc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x42d697
cmp dword [ebp + 0x1c], 1
mov eax, 0x910638
mov ecx, 0x910534
cmovne eax, ecx
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00508ec0
add esp, 0x10
test ebx, ebx
je 0x42d6dd
push 0x5a074c
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.005111bf
push ebx
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.005111bf
add esp, 0x18
test esi, esi
je 0x42d70c
push 0x5a0750
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.005111bf
push esi
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.005111bf
add esp, 0x18
push 0
push 0
push 3
push 0
push 3
push closesocket
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42d742
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10c], 0
push 0
test edi, edi
jne 0x42d761
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10c], eax
jmp 0x42d773
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x18]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret

Function at 0x42de00
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
nop word [eax + eax]
xor eax, eax
test cl, 1
je 0x42de1b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x42de26
bts eax, 6
shr ecx, 1
test cl, 1
je 0x42de31
bts eax, 5
shr ecx, 1
test cl, 1
je 0x42de3c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x42de47
bts eax, 3
shr ecx, 1
test cl, 1
je 0x42de52
bts eax, 2
shr ecx, 1
test cl, 1
je 0x42de5d
bts eax, 1
test cl, 2
je 0x42de66
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
xor edx, edx
lea ecx, [edx + 1]
nop dword [eax]
test bl, 1
je 0x42deff
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x42def0
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x90f170], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x42de10
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e090
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0
push 3
push 0
push 3
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42e0bb
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
push 0
test eax, eax
jne 0x42e0e4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42e770
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
push 0
setne bl
push 0x80
lea ebx, [ebx*2 + 2]
push ebx
push 0
push 0
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42e7fe
push 0x5c
push edi
call fcn.00500480
mov esi, eax
add esp, 8
test esi, esi
je 0x42e7d6
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42e7d3
push 1
push edi
call fcn.0042d2a0
add esp, 8
mov byte [esi], 0x5c
push 0
push 0x80
push ebx
push 0
push 0
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42e7fe
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x14], 1
jne 0x42e811
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e840
Capabilities:
Check if file exists
Get file attributes
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x62acc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
cmp ecx, 0xffffffff
je 0x42e881
push ecx
push eax
push str._s_d
lea eax, [ebp - 0x310]
push 0x104
push eax
call fcn.00407c70
add esp, 0x14
jmp 0x42e898
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x310]
push 0x104
push eax
call fcn.00508ec0
add esp, 0x10
cmp dword [ebp + 0x18], 1
mov ecx, 0x910638
push 0xffffffffffffffff
mov eax, 0x910534
cmove eax, ecx
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00508ec0
push 0x5a074c
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.005111bf
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.005111bf
push 0x5a0750
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.005111bf
push 0x5a0764
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.005111bf
add esp, 0x40
lea eax, [ebp - 0x108]
push eax
push str._s_tmp
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00407c70
add esp, 0x10
lea eax, [ebp - 0x20c]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [ebp + 0x14]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42e9cd
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.00500480
mov esi, eax
add esp, 8
test esi, esi
je 0x42e9a3
lea eax, [ebp - 0x20c]
mov byte [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42e9a0
lea eax, [ebp - 0x20c]
push 1
push eax
call fcn.0042d2a0
add esp, 8
mov byte [esi], 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42e9cd
xor eax, eax
jmp 0x42e9f6
push 0
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x314]
cmp eax, edi
je 0x42ea0d
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret
push 9
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
and eax, edi
pop edi
pop esi
pop ebx
call fcn.004fe8dc
mov esp, ebp
pop ebp
ret