joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6093c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b0df8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x82f184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0xc]
mov eax, 0x2aaaaaab
sub ecx, dword [esi + 8]
mov edi, dword [ebp + 0xc]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
cmp dword [esi], 0
je 0x60940a
inc eax
add eax, edx
test eax, eax
jne 0x6094af
mov ecx, 0x16
mov dword [ebp - 0x44], 0xd000da
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x40], 0xe400d4
mov dword [ebp - 0x3c], 0xd200d8
mov dword [ebp - 0x38], 0xd100c9
mov dword [ebp - 0x34], 0xae00ac
mov dword [ebp - 0x30], 0xa700a3
mov dword [ebp - 0x2c], 0xa4009b
mov dword [ebp - 0x28], 0xb500b4
mov dword [ebp - 0x24], 0xac0097
mov dword [ebp - 0x20], 0xbb00a7
mov dword [ebp - 0x1c], 0xb400b8
mov dword [ebp - 0x18], 0xce
lea ecx, [eax + 0xb8]
xor word [ebp + eax*2 - 0x44], cx
inc eax
mov ecx, dword [ebp - 0x48]
cmp eax, ecx
jb 0x609470
xor eax, eax
mov word [ebp + ecx*2 - 0x44], ax
lea ecx, [ebp - 0x44]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x609490
sub ecx, edx
lea eax, [ebp - 0x44]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.004044f0
xor al, al
jmp 0x60950b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x11]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x4c], edi
movups xmm0, xmmword [ebp - 0x58]
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x80], vtable..177.0
movups xmmword [ebp - 0x7c], xmm0
mov dword [ebp - 0x5c], eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.0042e9e0
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x5c]
test ecx, ecx
je 0x609508
mov edx, dword [ecx]
lea eax, [ebp - 0x80]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076d59e
mov esp, ebp
pop ebp
ret 8
Function at 0x6096a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b0e68
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.0078f690
mov eax, dword [0x82f184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
cmp dword [ecx + 0x14], 8
jb 0x6096e1
mov ecx, dword [ecx]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x6097be
cmp esi, 0xffffffff
je 0x6097be
lea eax, [ebp - 0x201c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov dword [ebp - 0x2020], ebx
cmp ebx, 0xffffffff
je 0x6097be
mov eax, dword [ebp - 0x201c]
xor edi, edi
mov dword [ebp - 0x2028], eax
mov dword [ebp - 0x2014], 0
push 0
lea eax, [ebp - 0x2014]
push eax
push 0x2000
lea eax, [ebp - 0x2010]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x6097a6
mov eax, dword [ebp - 0x2014]
test eax, eax
je 0x6097a6
mov ecx, dword [ebp + 0x2c]
mov dword [ebp - 0x2018], eax
lea eax, [ebp - 0x2010]
mov dword [ebp - 0x2024], eax
test ecx, ecx
je 0x6097fd
mov eax, dword [ecx]
lea edx, [ebp - 0x2018]
push edx
lea edx, [ebp - 0x2024]
push edx
call dword [eax + 8]
mov eax, dword [ebp - 0x2014]
add edi, eax
test eax, eax
jne 0x609744
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
jne 0x6097be
cmp dword [ebp - 0x2028], 0
jne 0x6097be
mov bl, 1
jmp 0x6097c0
xor bl, bl
mov dword [ebp - 4], 4
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x6097df
mov esi, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076d59e
mov esp, ebp
pop ebp
ret
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
int3
Function at 0x609810
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b0eeb
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x82f184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xc4]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xa8], esi
push edi
mov dword [ebp - 0x80], 0
call fcn.00404120
mov dword [ebp - 0x80], 2
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0xc4]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xa4]
call fcn.00403b80
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 3
push eax
call fcn.00418540
add esp, 4
mov byte [ebp - 0x79], al
lea ecx, [ebp - 0x8c]
call fcn.00404220
lea ecx, [ebp - 0xa4]
call fcn.00404490
lea ecx, [ebp - 0xc4]
mov dword [ebp - 4], 0xffffffff
call fcn.00404490
cmp byte [ebp - 0x79], 0
je 0x609a71
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub eax, 0
je 0x609a71
sub eax, 1
je 0x609922
sub eax, 1
jne 0x609a71
push edi
push esi
call fcn.00609ab0
jmp 0x609a82
push 0x40
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 4
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x78], 0
lea ecx, [ebp - 0xdc]
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0x67452301
mov dword [ebp - 0x6c], 0xefcdab89
push edi
mov dword [ebp - 0x68], 0x98badcfe
mov dword [ebp - 0x64], 0x10325476
call fcn.00404120
mov dword [ebp - 0x80], 0xa
mov dword [ebp - 4], 5
lea eax, [ebp - 0x78]
sub esp, 0x28
mov dword [ebp - 0x14], eax
mov eax, esp
lea ecx, [ebp - 0x78]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xdc]
mov dword [eax], vtable..178.0
mov dword [eax + 0x24], eax
call fcn.006096a0
add esp, 0x28
mov byte [ebp - 0x79], al
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 4
call fcn.00404490
cmp byte [ebp - 0x79], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x80], 0xe
je 0x609a5c
push ecx
lea eax, [ebp - 0x79]
mov dword [ebp - 0x18], 0
push eax
xorps xmm0, xmm0
mov byte [ebp - 0x79], 0
push 0x10
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.0041e2a0
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x78]
mov edx, dword [ebp - 0x20]
call fcn.0065b150
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0xf4]
call fcn.0041d7f0
mov edi, eax
cmp esi, edi
je 0x609a49
mov ecx, esi
call fcn.00407a10
movups xmm0, xmmword [edi]
movups xmmword [esi], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea ecx, [ebp - 0xf4]
call fcn.00407a10
lea ecx, [ebp - 0x20]
call fcn.0040f050
mov eax, 0x58
lea ecx, [ebp - 0x78]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x609a64
jmp 0x609a82
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076d59e
mov esp, ebp
pop ebp
ret 8
Function at 0x60b100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b1110
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x82f184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov esi, dword [eax + 0xc]
lea ecx, [ebp - 0x28]
mov edi, dword [eax + 8]
mov eax, dword [eax + 4]
add eax, 0x58
push eax
call fcn.00404120
push esi
push edi
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
call fcn.0060a880
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call fcn.00404490
mov eax, dword [ebp - 0x10]
test bl, bl
je 0x60b1ac
mov eax, dword [eax + 0x10]
xor ecx, ecx
mov byte [eax], 1
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 7
mov word [eax + 4], cx
mov byte [eax + 0x1c], cl
mov byte [eax + 0x34], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [eax + 0xc]
xor eax, eax
mov dword [ebp - 0x30], 0xd
mov dword [ebp - 0x2c], 0xc900cd
mov dword [ebp - 0x28], 0xda00de
mov dword [ebp - 0x24], 0xd800c8
mov dword [ebp - 0x20], 0xda00e1
mov dword [ebp - 0x1c], 0xb300b2
mov dword [ebp - 0x18], 0xb100ad
mov dword [ebp - 0x14], 0xc5009b
nop dword [eax]
lea ecx, [eax + 0xb8]
xor word [ebp + eax*2 - 0x2c], cx
inc eax
mov ecx, dword [ebp - 0x30]
cmp eax, ecx
jb 0x60b1f0
xor eax, eax
mov word [ebp + ecx*2 - 0x2c], ax
lea eax, [ebp - 0x2c]
push edx
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0041ee30
add esp, 0xc
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea ecx, [esi + 4]
mov dword [esi], 1
call fcn.00404120
lea ecx, [ebp - 0x48]
mov byte [esi + 0x1c], 0
mov byte [esi + 0x34], 0
call fcn.00404490
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x611f20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x611f2b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x611fe7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cd430]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cd430]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cd430]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cd430]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cd430]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cd430]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cd430]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cd430]
sub edi, 1
jne 0x611f40
pop edi
test esi, esi
je 0x61200a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cd430]
sub esi, 1
jne 0x611ff0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x6127d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x82f184]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov ebx, esi
mov dword [ebp - 0xc], esi
imul ebx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 8], eax
cmp byte [edi], 0
je 0x61282c
push 0
lea ecx, [ebp - 8]
push ecx
push ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x612814
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
xor edx, edx
pop edi
div esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0076d59e
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ebx
add ecx, edx
push esi
push ecx
push dword [ebp - 8]
call sub.VCRUNTIME140.dll_memcpy
add dword [edi + 0x1c], esi
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, esi
xor edx, edx
xor ecx, ebp
div dword [ebp - 0xc]
pop edi
pop esi
pop ebx
call fcn.0076d59e
mov esp, ebp
pop ebp
ret
Function at 0x6131b0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x61336c
cmp dword [edi + 0x18], 0
je 0x61336c
cmp dword [edi + 0x7c], 0
je 0x6131d9
call fcn.00613660
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.00612ff0
add esp, 8
test eax, eax
je 0x6131fd
pop edi
mov eax, 0xffffff99
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x613243
push 0x4000
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x61324f
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], 0
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], 0
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x6132aa
lea ecx, [esi + 4]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00612270
test eax, eax
jne 0x6132aa
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x6132cd
mov al, byte [edi + 0x39]
jmp 0x6132d0
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov ecx, 0xc
xor eax, eax
cmp byte [esi + 0x6c], al
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x61334d
nop
mov al, byte [ebx]
test al, al
je 0x61334d
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, ecx
shr ecx, 8
movzx eax, al
mov eax, dword [eax*4 + 0x7cd430]
xor eax, ecx
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x70], eax
movzx eax, al
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cd430]
mov dword [esi + 0x78], ecx
add ebx, 1
jne 0x613300
mov eax, dword [ebp - 0xc]
add eax, 0x1e
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xffffff9a
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6136d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 8], ebx
cmp dword [ebx], 0
jne 0x61387a
cmp dword [ebx + 4], 0xffffffff
jne 0x61387a
push edi
lea edi, [ebx + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x613707
sub ecx, edx
sar ecx, 1
movzx eax, word [ebx + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x613743
cmp eax, 0x2f
je 0x613743
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x613730
mov eax, dword [0x7cd374]
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
push esi
cmp edi, 1
jne 0x61376e
mov esi, dword [ebp + 8]
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x613789
pop esi
pop edi
mov eax, 0x2000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 2
je 0x613786
cmp edi, 3
je 0x613786
pop esi
pop edi
mov eax, 0x10000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 8]
xor ebx, ebx
xor al, al
mov byte [ebp - 1], al
mov byte [ebp + 0x13], bl
cmp edi, 1
je 0x6137cf
cmp edi, 2
jne 0x6137eb
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6137c9
pop esi
pop edi
mov eax, 0x200
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov byte [ebp + 0x13], 1
jmp 0x6137d5
mov ebx, esi
mov byte [ebp + 0x13], 0
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
setne al
mov byte [ebp - 1], al
push 0x20
call fcn.0076d2e3
add esp, 4
mov esi, eax
cmp edi, 1
je 0x613826
cmp edi, 2
je 0x613826
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
mov word [esi], 0x100
mov byte [esi + 0x10], 0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0xc], 0
jmp 0x613857
mov al, byte [ebp + 0x13]
mov byte [esi + 0x10], al
mov al, byte [ebp - 1]
mov byte [esi], 1
mov byte [esi + 1], al
mov dword [esi + 4], ebx
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
test al, al
je 0x613857
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0xc], eax
mov ecx, esi
call fcn.00612bc0
mov ecx, dword [ebp - 8]
mov edx, 0x200
pop esi
pop edi
pop ebx
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x1000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x613f30
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x82f184]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x613f62
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x613f62
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x61404c
push edi
mov edi, ebx
mov ecx, ebx
mov edx, eax
cmp dx, 0x2f
je 0x613f81
cmp dx, 0x5c
jne 0x613f83
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x613f75
cmp edi, ebx
je 0x613fce
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp edi, 0x208
jae 0x61405c
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, esi
mov word [ebp + edi - 0x414], ax
call fcn.00613f30
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x613ff3
lea ecx, [ebp - 0x20c]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x613fe3
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x613ff5
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x614010
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x61404c
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0076d59e
mov esp, ebp
pop ebp
ret
call fcn.0076dfa3
int3
Function at 0x616030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0x616251
cmp eax, 3
jb 0x6160a6
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x6160e3
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x6160e3
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x6160cd
mov dword [esi + 0x6afa0], eax
mov edx, ebx
mov ecx, esi
call fcn.00615d10
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x6161d3
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
mov edx, ecx
mov ecx, esi
push eax
call fcn.00615830
mov ecx, dword [esi + 0x6af90]
add esp, 4
sub ecx, edi
mov dword [ebp - 4], eax
mov dword [esi + 0x6af90], ecx
cmp edi, dword [esi + 0x6af98]
ja 0x616198
cmp ecx, 3
jb 0x616198
dec edi
nop word [eax + eax]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x616130
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [ebp - 4]
jmp 0x6161fa
mov edx, dword [esi + 0x6af84]
add edx, edi
xor edi, edi
mov dword [esi + 0x6af84], edx
movzx ecx, byte [esi + edx + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 4]
jmp 0x6161fa
movzx eax, byte [esi + ecx + 0x1af70]
xor edx, edx
push eax
mov ecx, esi
call fcn.00615830
dec dword [esi + 0x6af90]
add esp, 4
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
lea ecx, [esi + 0x1af70]
test eax, eax
je 0x61622f
mov eax, dword [esi + 0x6af74]
sub edx, eax
push 0
push edx
lea edx, [eax + ecx]
xor ecx, ecx
test eax, eax
cmovs edx, ecx
mov ecx, esi
call fcn.00615380
mov eax, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], eax
mov eax, dword [esi + 0x6af90]
cmp eax, 0x106
jae 0x616249
mov ecx, esi
call fcn.00615ed0
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x616055
mov eax, dword [esi + 0x6af74]
mov ecx, dword [esi + 0x6af84]
sub ecx, eax
test eax, eax
js 0x61627f
push 1
lea edx, [esi + 0x1af70]
push ecx
add edx, eax
mov ecx, esi
call fcn.00615380
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push ecx
xor edx, edx
mov ecx, esi
call fcn.00615380
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x616ff0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x616ffb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x6170b7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cebf0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cebf0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cebf0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cebf0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cebf0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cebf0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cebf0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cebf0]
sub edi, 1
jne 0x617010
pop edi
test esi, esi
je 0x6170da
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cebf0]
sub esi, 1
jne 0x6170c0
not ecx
mov eax, ecx
pop esi
pop ebp
ret