joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4383ef
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp + 0xc]
sub edi, dword [esi + 0x18]
sub eax, dword [esi + 0x14]
mov edx, dword [esi]
push 1
xor ebx, ebx
push edi
push eax
mov ecx, esi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [edx + 0x6c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xe0]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x438528
push eax
call fcn.00429306
mov ebx, eax
test ebx, ebx
pop ecx
je 0x4384f5
mov eax, dword [ebx + 0x10]
push 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x438469
lea eax, [ebx + 0x14]
push eax
call fcn.00429b64
movzx eax, word [ebp + 0xc]
movzx edi, di
shl edi, 0x10
or edi, eax
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x202
call fcn.004296b0
mov eax, dword [ebp - 0x10]
cmp dword [esi + 0xe0], eax
jne 0x4384bf
mov ecx, dword [ebx + 0x40]
xor eax, eax
cmp ecx, eax
je 0x4384b1
cmp word [ecx], ax
je 0x4384b1
push 1
push eax
push eax
push ecx
push 0x48bd0c
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4384f5
cmp dword [ebx + 0x10], eax
je 0x4384f5
mov dword [ebp - 4], 1
jmp 0x4384f5
mov eax, dword [ebx]
push 1
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x4384de
lea eax, [ebx + 0x14]
push eax
call fcn.00429b64
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x2a3
call fcn.004296b0
mov dword [ebp - 8], 1
xor ecx, ecx
cmp dword [ebp - 4], ecx
mov dword [esi + 0xe0], ecx
je 0x438506
push 0x67
jmp 0x438521
cmp dword [ebp - 8], ecx
je 0x438528
cmp dword [ebp - 0xc], ecx
je 0x438528
mov edx, dword [ebp - 0x14]
lea eax, [esi + 0xdc]
cmp edx, dword [eax]
jne 0x43851f
mov dword [eax], ecx
push 0x6a
mov edi, ebx
call fcn.00438050
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x439ae8
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x47a438
call fcn.0044ce07
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.00409130
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push eax
push str.__02d__02d__02d__03d__n
lea ecx, [ebp + 8]
call fcn.0041298e
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00408f63
call fcn.0044cea6
ret 4
Function at 0x43ae76
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x120
mov eax, dword [0x49c0b8]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa8]
push edi
push eax
call fcn.00445850
add esp, 0xc
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x43aed9
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x114
call esi
cmp eax, edi
je 0x43af87
mov eax, dword [ebp - 0x98]
dec eax
je 0x43af73
dec eax
jne 0x43af87
cmp dword [ebp - 0xa4], 6
jne 0x43af24
inc eax
cmp dword [ebp - 0xa0], eax
jne 0x43af0c
xor ecx, ecx
cmp byte [ebp + 0x72], al
setne cl
add ecx, 8
jmp 0x43af20
cmp dword [ebp - 0xa0], edi
jne 0x43af60
xor ecx, ecx
cmp byte [ebp + 0x72], al
setne cl
lea ecx, [ecx + ecx + 7]
mov edi, ecx
jmp 0x43af87
cmp dword [ebp - 0xa4], 5
jne 0x43af53
cmp dword [ebp - 0xa0], 2
jne 0x43af3a
push 5
jmp 0x43af70
cmp dword [ebp - 0xa0], 1
jne 0x43af47
push 6
jmp 0x43af70
cmp dword [ebp - 0xa0], edi
jne 0x43af87
push 3
jmp 0x43af70
cmp dword [ebp - 0xa4], 4
ja 0x43af87
push 4
jmp 0x43af70
cmp dword [ebp - 0xa0], 2
jne 0x43af87
cmp byte [ebp + 0x72], al
jne 0x43af87
push 0xa
pop edi
jmp 0x43af87
mov eax, dword [ebp - 0x9c]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov ecx, dword [ebp + 0x74]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00446679
add ebp, 0x78
leave
ret

Function at 0x43b134
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [ecx + 8]
push ebx
push esi
push edi
xor edi, edi
inc edi
cmp edx, edi
jne 0x43b1b3
mov ecx, dword [ecx + 0xc]
cmp ecx, 0x2710
jne 0x43b157
mov ebx, eax
call fcn.0043b898
mov eax, edi
jmp 0x43b1bc
cmp ecx, 0x1450
jne 0x43b166
call fcn.0043b886
jmp 0x43b153
cmp ecx, 0x898
je 0x43b15f
cmp ecx, 0x1838
je 0x43b15f
cmp ecx, 0xce4
je 0x43b15f
cmp ecx, 0xc80
jne 0x43b18d
call fcn.0040faff
jmp 0x43b153
cmp ecx, 0x1068
jne 0x43b19e
mov esi, eax
call fcn.0043b951
jmp 0x43b153
cmp ecx, 0x4b0
jne 0x43b1b3
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43b153
and dword [eax + 0x378], 0
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x43b73d
Capabilities:
Get graphical window text
Inspect load icon resource

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push edi
push 0xc8
push 0x400000
mov ebx, eax
call esi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 1
mov ebp, 0x80
push ebp
push dword [ebx + 4]
call edi
push 0xc8
push 0x400000
call esi
push eax
push 0
push ebp
push dword [ebx + 4]
call edi
call fcn.00406f50
mov ecx, eax
push 0xd
add ecx, 4
pop esi
call fcn.004081f6
test eax, eax
je 0x43b797
mov eax, dword [eax + 4]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebx + 0x36c]
push eax
call fcn.0042488b
call fcn.0043b7bc
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
ret 4
Function at 0x43c07a
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ecx
push ebx
push ebp
push edi
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [esi + 4]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebx
mov ebp, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push ebp
mov dword [esp + 0x18], eax
call ebx
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor edi, edi
push edi
push dword [esp + 0x10]
push ebp
call ebx
mov dword [esi + 0x380], edi
mov dword [0x49fa40], edi
mov ecx, dword [esi + 0x37c]
cmp ecx, edi
pop edi
pop ebp
pop ebx
je 0x43c0eb
mov eax, dword [ecx]
call dword [eax + 0x14]
xor eax, eax
pop ecx
ret
Function at 0x43c76c
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
xor esi, esi
mov edi, eax
cmp edi, esi
mov dword [esp + 0x18], esi
jne 0x43c7a3
mov eax, dword [0x49fc10]
cmp eax, esi
je 0x43c791
mov edi, dword [eax + 4]
jmp 0x43c793
xor edi, edi
cmp edi, esi
jne 0x43c7a3
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, esi
je 0x43c7c8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x43c7c8
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x43c7c8
push esi
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x18], 1
push esi
push edi
mov eax, ebp
mov dword [ebp + 0x318], esi
call fcn.0043c608
mov ecx, eax
cmp ecx, esi
mov dword [esp + 0x10], ecx
jne 0x43c7f1
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x43c90f
mov eax, dword [0x49fc10]
cmp eax, esi
mov dword [esp + 0x1c], esi
je 0x43c808
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov dword [eax + 4], ecx
lea ebx, [ebp + 4]
push ebx
mov eax, edi
call fcn.00440418
cmp dword [ebp + 0x308], esi
je 0x43c8ae
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push 0x2001
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x24]
je 0x43c871
push 1
push eax
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x24]
je 0x43c891
push esi
push eax
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0xffffffffffffffec
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x80000
je 0x43c8ae
push esi
push esi
push 0xf
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, ebp
call fcn.0043cefb
push 0x97
push esi
push esi
push esi
push esi
push esi
push dword [ebx]
mov dword [ebp + 0x318], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x18], esi
je 0x43c8f1
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, esi
je 0x43c8f1
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx]
jne 0x43c8f1
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x49fc10]
cmp eax, esi
je 0x43c901
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], ecx
push dword [ebx]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp + 0x31c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x43e7ee
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x28]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
test edi, edi
jne 0x43e83a
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0xf4]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
test edi, edi
jne 0x43e83a
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x1c0]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
cmp dword [esi + 0x2a8], 0
je 0x43e8b2
lea ebx, [esi + 0x2b4]
cmp dword [ebx], 0
je 0x43e857
call dword [sym.imp.USER32.dll_ReleaseCapture]
and dword [ebx], 0
cmp dword [esi + 0x2a8], edi
jne 0x43e8ab
push edi
call fcn.00429306
mov edi, eax
movzx eax, word [ebp + 0x10]
pop ecx
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, edi
push 0x205
call fcn.004296b0
mov eax, dword [esi + 4]
or dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xd
mov dword [ebp - 0x14], eax
mov ecx, dword [edi + 0x10]
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0x14]
push ecx
push 0xffffffffffffffff
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
and dword [esi + 0x2a8], 0
pop edi
pop ebx
leave
ret 0xc
Function at 0x43eb3e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
xor ebx, ebx
lea edi, [esi + 0x2b4]
cmp dword [edi], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
je 0x43eb6f
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [edi], ebx
mov ebx, dword [ebp + 0x10]
push 1
push ebx
push dword [ebp + 0xc]
lea ecx, [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x30]
test eax, eax
mov dword [ebp - 4], eax
jne 0x43ebb3
push 1
push ebx
push dword [ebp + 0xc]
lea ecx, [esi + 0xf4]
mov eax, dword [ecx]
call dword [eax + 0x30]
test eax, eax
mov dword [ebp - 4], eax
jne 0x43ebb3
push 1
push ebx
push dword [ebp + 0xc]
lea ecx, [esi + 0x1c0]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x2a4]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x43ed05
push eax
call fcn.00429306
mov edi, eax
test edi, edi
pop ecx
je 0x43ec84
mov eax, dword [edi + 0x10]
push 2
mov dword [ebp - 8], eax
mov eax, dword [edi]
push 0
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x34]
test eax, eax
je 0x43ebf9
push 1
push edi
call fcn.0043cecb
movzx eax, word [ebp + 0xc]
movzx ebx, bx
shl ebx, 0x10
or ebx, eax
push ebx
push dword [ebp + 8]
mov ecx, edi
push 0x202
call fcn.004296b0
mov eax, dword [ebp - 4]
cmp dword [esi + 0x2a4], eax
jne 0x43ec4f
mov ecx, dword [edi + 0x40]
xor eax, eax
cmp ecx, eax
je 0x43ec41
cmp word [ecx], ax
je 0x43ec41
push 1
push eax
push eax
push ecx
push 0x48bd0c
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x43ec84
cmp dword [edi + 0x10], eax
je 0x43ec84
mov dword [ebp - 0xc], 1
jmp 0x43ec84
mov eax, dword [edi]
push 1
push 0
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x34]
test eax, eax
je 0x43ec6d
push 1
push edi
call fcn.0043cecb
push ebx
push dword [ebp + 8]
mov ecx, edi
push 0x2a3
call fcn.004296b0
mov dword [ebp - 0x10], 1
xor eax, eax
cmp dword [ebp - 0xc], eax
mov dword [esi + 0x2a4], eax
je 0x43ecc6
mov eax, dword [esi + 4]
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi]
mov ecx, edi
mov dword [ebp - 0x20], 1
call dword [eax + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x24]
push 0x4e
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x43ed05
cmp dword [ebp - 0x10], eax
je 0x43ed05
mov ecx, dword [ebp - 8]
cmp ecx, eax
je 0x43ed05
mov eax, dword [esi + 4]
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x28]
push ecx
push 0xffffffffffffffff
push 0x4e
push eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x14]
add esi, 0x2a0
cmp eax, dword [esi]
jne 0x43ed05
and dword [esi], 0
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x440a42
Capabilities:
Extract resource via kernel32 functions

Disassembly:
test esi, esi
jne 0x440a49
xor al, al
ret
push edi
push 0x48e7c0
push 0x7d
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x440a62
xor al, al
pop edi
ret
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x440a84
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x440a88
xor al, al
jmp 0x440a96
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, dword [esp + 0x10]
mov dword [eax], ebx
mov al, 1
pop ebx
pop edi
ret

Function at 0x440a99
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ecx, ecx
cmp dword [ebp + 8], ecx
push esi
push edi
je 0x440aee
cmp dword [ebp + 0xc], ecx
je 0x440aee
mov eax, dword [ebp + 0x10]
xor esi, esi
cmp dword [ebp + 0xc], ecx
jbe 0x440aee
push 0x5851f42d
push 0x4c957f2d
push ecx
push eax
call fcn.0045a980
add eax, 1
adc edx, 0
mov ecx, edx
mov ebx, eax
mov edi, ecx
shrd ebx, edi, 0x13
mov edx, esi
and edx, 3
xor bl, byte [ebp + edx + 0x10]
shr edi, 0x13
mov edi, dword [ebp + 8]
xor byte [esi + edi], bl
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x440ab5
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x441394
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 4
mov eax, 0x47a415
call fcn.0044ce07
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00409130
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4413d4
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00408f63
mov eax, esi
call fcn.0044cea6
ret
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4413be
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov ebx, 0xb7
cmp eax, ebx
je 0x4413be
lea ecx, [ebp - 0x10]
call fcn.0044134b
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x44140b
xor esi, esi
jmp 0x4413c1
push eax
call fcn.00441394
test eax, eax
pop ecx
je 0x441407
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4413be
call edi
cmp eax, ebx
jne 0x441407
jmp 0x4413be
Function at 0x441429
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x274
mov eax, 0x47a3e5
call fcn.0044ce70
mov eax, dword [0x49ead4]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, 0x49ead4
mov ecx, esi
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x27c], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x264], eax
mov dword [ebp - 4], ebx
mov eax, dword [0x49ead4]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x270], eax
push edi
lea eax, [ebp - 0x264]
push eax
mov byte [ebp - 4], 1
call fcn.00409107
lea eax, [ebp - 0x264]
push eax
call fcn.0044124c
pop ecx
push dword [ebp - 0x264]
lea eax, [ebp - 0x270]
push 0x48bea4
push eax
call fcn.00407d26
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x278], eax
je 0x441637
lea eax, [ebp - 0x234]
push 0x48beb0
push eax
call fcn.00445ab8
test eax, eax
pop ecx
pop ecx
je 0x441606
lea eax, [ebp - 0x234]
push 0x48beb4
push eax
call fcn.00445ab8
test eax, eax
pop ecx
pop ecx
je 0x441606
test byte [ebp - 0x260], 0x10
je 0x441575
mov eax, dword [0x49ead4]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x234]
push eax
mov byte [ebp - 4], 2
push dword [ebp - 0x264]
lea eax, [ebp - 0x274]
push str._s_s_
push eax
call fcn.00407d26
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x274]
push edi
call fcn.00441429
add esp, 0x18
test eax, eax
jne 0x441564
cmp dword [ebp + 0xc], ebx
je 0x441671
lea eax, [edi - 0x10]
mov byte [ebp - 4], 1
call fcn.00408f63
jmp 0x441606
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.00409130
lea eax, [ebp - 0x26c]
mov byte [ebp - 4], 3
call fcn.00411631
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x264]
call fcn.00411764
or dword [ebp - 0x268], 1
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4415ce
cmp dword [ebp + 0xc], ebx
jne 0x4415ce
mov bl, 1
jmp 0x4415d0
xor bl, bl
test byte [ebp - 0x268], 1
je 0x4415ee
mov eax, dword [ebp - 0x280]
and dword [ebp - 0x268], 0xfffffffe
add eax, 0xfffffff0
call fcn.00408f63
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x26c]
add eax, 0xfffffff0
call fcn.00408f63
test bl, bl
jne 0x44162b
xor ebx, ebx
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4414d1
mov dword [ebp - 0x27c], 1
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x264]
call fcn.004412d6
mov esi, dword [ebp - 0x264]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp - 0x270]
add eax, 0xfffffff0
call fcn.00408f63
lea eax, [esi - 0x10]
call fcn.00408f63
mov eax, dword [ebp - 0x27c]
call fcn.0044ceba
ret
lea eax, [edi - 0x10]
mov byte [ebp - 4], 1
call fcn.00408f63
jmp 0x44162b
Function at 0x443d00
Capabilities:
Compute adler32 checksum

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
movzx ecx, di
shr edi, 0x10
test esi, esi
mov ebx, eax
jne 0x443d1a
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
ret
test ebx, ebx
jbe 0x443e1c
push ebp
cmp ebx, 0x15b0
mov eax, ebx
jb 0x443d32
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x443ddb
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x443d50
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x443d50
test eax, eax
je 0x443def
nop
movzx edx, byte [esi]
add ecx, edx
add esi, 1
add edi, ecx
sub eax, 1
jne 0x443de0
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x443d23
pop ebp
mov eax, edi
pop edi
shl eax, 0x10
pop esi
or eax, ecx
pop ebx
ret

Function at 0x4442f0
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x4442f7
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.00444300
Function at 0x444300
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x444332
lea esp, [esp]
test cl, 3
je 0x444332
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x486148]
add ecx, 1
sub esi, 1
jne 0x444310
cmp esi, 0x20
push ebx
push edi
jb 0x44451c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x486548]
xor edx, dword [ebx*4 + 0x486948]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x486148]
add ecx, 4
xor edx, dword [eax*4 + 0x486d48]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x486548]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x486948]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x486148]
add ecx, 4
xor eax, dword [edx*4 + 0x486d48]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x486548]
xor edx, dword [ebx*4 + 0x486948]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x486148]
xor edx, dword [eax*4 + 0x486d48]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x486548]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x486948]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x486148]
xor eax, dword [edx*4 + 0x486d48]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x486548]
xor edx, dword [ebx*4 + 0x486948]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x486148]
xor edx, dword [eax*4 + 0x486d48]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x486548]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x486948]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x486148]
and edx, 0xff
xor eax, dword [edx*4 + 0x486d48]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x486548]
xor edx, dword [ebx*4 + 0x486948]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x486148]
add ecx, 4
xor edx, dword [eax*4 + 0x486d48]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x486548]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x486948]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x486148]
and edx, 0xff
xor eax, dword [edx*4 + 0x486d48]
sub edi, 1
jne 0x444342
cmp esi, 4
jb 0x444569
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x486548]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x486948]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x486148]
and eax, 0xff
xor edi, dword [eax*4 + 0x486d48]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x444526
test esi, esi
pop edi
pop ebx
je 0x44458d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x486148]
add ecx, 1
sub esi, 1
jne 0x444570
not eax
pop esi
ret