joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427a82
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x20
push dword [ebp + 0xc]
call fcn.0042aa92
mov ebx, eax
push 0
mov dword [ebp - 8], ebx
call fcn.00444813
pop ecx
and eax, 0xffff
push eax
call fcn.00446f23
pop ecx
call fcn.00446f35
imul eax, eax, 0x3e8
cdq
mov ecx, 0x7fff
idiv ecx
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push str._04i
push eax
call fcn.004450ab
mov edi, ebx
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x427adc
mov esi, 0x461134
lea eax, [ebp - 0x2c]
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427af0
mov edi, ebx
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x427afc
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x2710
jmp 0x427b76
push ebx
call fcn.0042942d
pop ecx
test al, al
jne 0x427b5f
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427b2b
sub eax, edx
cmp eax, 0x104
jae 0x427bb6
mov edi, dword [ebp + 0xc]
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
setne al
test al, al
jne 0x427b84
inc dword [ebp - 4]
push dword [ebp - 4]
push edi
push str._s._04i
jmp 0x427b6d
inc dword [ebp - 4]
push dword [ebp - 4]
push dword [ebp + 0xc]
push str._s._4i
push ebx
call fcn.004450ab
add esp, 0x10
cmp dword [ebp - 4], esi
jl 0x427b1b
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
push ebx
call fcn.0042bdce
mov esi, dword [ebp + 8]
pop ecx
mov eax, edi
call fcn.00427eec
mov edx, edi
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x427b9b
mov bl, 1
mov eax, dword [ebp + 8]
lea edi, [ebp - 8]
call fcn.0042abf3
mov al, bl
jmp 0x427b7d
xor bl, bl
jmp 0x427ba7
Function at 0x427bba
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [eax + 0x180]
sub esp, 0x108
push ebx
push esi
mov eax, ecx
push edi
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x427bd1
sub eax, esi
test ecx, ecx
je 0x427c48
test eax, eax
je 0x427c48
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dl, byte [ecx]
inc ecx
mov byte [esi], dl
inc esi
test dl, dl
jne 0x427be7
cmp byte [eax + edi - 1], 0x5c
mov ebx, 0x45d86c
je 0x427c0a
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x427bfe
mov esi, ebx
movsw word es:[edi], word [esi]
mov edi, dword [ebp + 0xc]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x427c0e
mov esi, str.__temp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0xc]
push 0
mov eax, edi
call fcn.0042be29
pop ecx
test al, al
je 0x427d61
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x427c35
mov esi, ebx
movsw word es:[edi], word [esi]
mov edi, 0x104
jmp 0x427c67
push dword [ebp + 0xc]
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x427d61
cmp eax, edi
jae 0x427d61
mov eax, dword [ebp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427c6d
sub eax, edx
mov esi, eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x427c7e
sub eax, ecx
lea eax, [eax + esi + 1]
cmp eax, edi
jae 0x427d61
push 0x46109c
push dword [ebp + 8]
call fcn.00444510
pop ecx
pop ecx
test eax, eax
je 0x427cab
add eax, 3
jmp 0x427cae
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x108]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x427cb6
lea eax, [ebp - 0x108]
cmp byte [ebp - 0x108], cl
je 0x427d22
movsx ecx, byte [eax]
cmp ecx, 0x2f
jg 0x427d05
je 0x427d00
cmp ecx, 0x22
je 0x427d19
cmp ecx, 0x2a
je 0x427d19
cmp ecx, 0x2e
jne 0x427d1c
mov cl, byte [eax + 1]
test cl, cl
je 0x427d19
cmp cl, 0x2e
je 0x427cfa
cmp cl, 0x5c
je 0x427d19
jmp 0x427d1c
mov byte [eax + 1], 0x5f
jmp 0x427d19
mov byte [eax], 0x5c
jmp 0x427d1c
cmp ecx, 0x3c
je 0x427d19
cmp ecx, 0x3d
jle 0x427d1c
cmp ecx, 0x3f
jle 0x427d19
cmp ecx, 0x7c
jne 0x427d1c
mov byte [eax], 0x5f
inc eax
cmp byte [eax], 0
jne 0x427cce
lea eax, [ebp - 0x108]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427d2a
mov edi, dword [ebp + 0xc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x427d37
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 0xc]
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
call fcn.0042be29
test al, al
pop ecx
setne al
jmp 0x427d63
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x427d6a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
push dword [ebp + 8]
mov esi, 0x80
push esi
lea eax, [ebp - 0x80]
push 1
push eax
call fcn.00445c95
add esp, 0x10
cmp eax, esi
je 0x427d96
xor al, al
jmp 0x427e4e
lea eax, [ebp - 0x80]
mov byte [ebp - 1], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427da0
sub eax, edx
jmp 0x427db3
cmp byte [ebp + eax - 0x80], 0
jne 0x427d8f
inc eax
cmp eax, esi
jb 0x427dab
lea eax, [ebp - 0x100]
push eax
push str.size
lea eax, [ebp - 0x80]
push eax
call fcn.00427e53
test al, al
je 0x427d8f
lea eax, [ebp - 0x100]
push edi
push eax
call fcn.00444068
pop ecx
mov edi, eax
lea eax, [ebp - 0x100]
push eax
push str.hash
lea eax, [ebp - 0x80]
push eax
call fcn.00427e53
test al, al
je 0x427e10
lea eax, [ebp - 0x100]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427e02
sub eax, edx
cmp eax, 0x20
jb 0x427e14
xor al, al
jmp 0x427e4d
push 0x24
call fcn.004441b8
pop ecx
test eax, eax
je 0x427e2b
and dword [eax + 0x20], 0
mov byte [eax], 0
mov edx, eax
jmp 0x427e2d
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
lea eax, [ebp - 0x100]
mov esi, edx
mov ecx, eax
sub esi, ecx
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x427e3e
mov dword [edx + 0x20], edi
mov al, 1
pop edi
pop esi
leave
ret 8
Function at 0x42c05a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push esi
push eax
push 0
push dword [eax + 0x20]
lea eax, [ebp - 0x84]
push str.size:__llu__hash:__s
push eax
call fcn.004450ab
lea eax, [ebp - 0x84]
add esp, 0x14
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42c087
sub eax, ecx
mov esi, 0x80
cmp eax, esi
jae 0x42c0b0
mov edx, esi
sub edx, eax
push edx
lea ecx, [ebp + eax - 0x84]
push 0
push ecx
call fcn.0044ded0
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0x84]
push esi
push 1
push eax
call fcn.00447136
add esp, 0x10
cmp eax, esi
je 0x42c0cd
xor al, al
jmp 0x42c0d8
push dword [ebp + 8]
call fcn.00446e17
pop ecx
mov al, 1
pop esi
leave
ret 4
Function at 0x43084d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push 0
mov ebx, eax
push 0x23
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x430877
xor al, al
jmp 0x4308f8
lea eax, [ebp - 0x104]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x430880
sub eax, edx
cmp eax, 0xf8
jae 0x430870
lea eax, [ebp - 0x104]
mov edx, ebx
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43089c
push esi
push edi
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4308ab
mov eax, 0x45d86c
mov esi, eax
movsw word es:[edi], word [esi]
mov edi, ebx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4308bf
mov esi, 0x45cd08
movsd dword es:[edi], dword [esi]
cmp byte [ebp + 8], cl
je 0x4308f4
mov edi, ebx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4308d5
mov esi, eax
dec ebx
movsw word es:[edi], word [esi]
mov edi, ebx
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4308e4
mov esi, str.cache
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
mov al, 1
pop esi
pop ebx
leave
ret
Function at 0x43a6ac
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x10]
call fcn.004472e3
pop ecx
pop ecx
test eax, eax
jne 0x43a81b
push 0x200
call fcn.00444443
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43a6e1
push ebx
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
sub eax, ecx
inc eax
call fcn.0043aaa1
mov ebx, eax
mov edi, ebx
mov dword [ebp - 0xc], ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x43a700
mov ecx, dword [ebp + 0x14]
push esi
mov esi, 0x45d86c
movsw word es:[edi], word [esi]
mov edx, ecx
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43a715
sub ecx, edx
mov edi, ebx
mov esi, edx
mov edx, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x43a725
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x17c]
mov ecx, edx
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x43a803
mov dword [ebp - 4], 0x200
mov dword [ebp + 0x14], 0x80
lea eax, [ebp - 0x150]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a76c
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
sub eax, edx
inc eax
call fcn.0043aaa1
mov ebx, eax
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x43a786
mov esi, 0x45d86c
lea eax, [ebp - 0x150]
movsw word es:[edi], word [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43a79d
mov edi, ebx
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x43a7ab
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [ebp + 0x14], 2
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0xc]
jae 0x43a7e7
add dword [ebp - 4], 0x200
push dword [ebp - 4]
sub dword [ebp + 0x14], 0xffffff80
push dword [esi]
call fcn.00444e46
pop ecx
pop ecx
test eax, eax
je 0x43a821
mov dword [esi], eax
mov eax, dword [esi]
mov dword [eax], ebx
lea eax, [ebp - 0x17c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43a763
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
call fcn.0043abda
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop edi
pop ebx
xor eax, eax
leave
ret 0x10
mov eax, dword [esi]
test eax, eax
je 0x43a82e
push eax
call fcn.00444db8
pop ecx
and dword [esi], 0
jmp 0x43a818
Function at 0x43af0a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
and dword [ebp - 8], 0
push esi
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
mov byte [ebp - 1], 1
call fcn.004472e3
pop ecx
pop ecx
test eax, eax
jne 0x43af5a
push 0x45eb14
push dword [ebp + 8]
call fcn.004459de
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x43af61
push dword [ebp + 8]
push str.ERROR:_Unable_to_open__s_for_reading_n
call fcn.004479fd
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
test eax, eax
je 0x43af5a
and dword [eax], 0
xor al, al
pop esi
leave
ret 8
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.00444443
pop ecx
mov dword [edi], eax
test eax, eax
je 0x43af5a
mov ecx, dword [ebp - 0x2c]
mov byte [eax + ecx], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
test ecx, ecx
je 0x43af88
mov dword [ecx], eax
test eax, eax
jbe 0x43afef
sub eax, dword [ebp - 8]
mov esi, eax
cmp esi, 0x8000
jbe 0x43af9e
mov esi, 0x8000
push dword [ebp - 0x10]
push esi
push 1
push dword [ebp - 0xc]
call fcn.00445c95
add esp, 0x10
cmp eax, esi
jne 0x43afc3
add dword [ebp - 8], eax
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 8], eax
jb 0x43af8c
jmp 0x43afef
push dword [ebp + 8]
push dword [ebp - 8]
push esi
push str.Unable_to_read__li_bytes_at_offset__li_from_file__s_n
call fcn.004479fd
push dword [edi]
call fcn.00444db8
mov eax, dword [ebp + 0xc]
and dword [edi], 0
add esp, 0x14
test eax, eax
je 0x43afeb
and dword [eax], 0
mov byte [ebp - 1], 0
push dword [ebp - 0x10]
call fcn.0044615f
mov al, byte [ebp - 1]
pop ecx
jmp 0x43af5c
Function at 0x43c443
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push 0x40
pop eax
cmp dword [ebp + 0x10], eax
jbe 0x43c45a
mov dword [ebp + 0x10], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], ebx
cmp dword [ebp + 0x14], ebx
je 0x43c4b3
push dword [0x475d6c]
call fcn.0043c122
pop ecx
push ebx
push 1
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
push dword [ebp + 0x14]
call fcn.0043c5e9
add esp, 0x18
push dword [0x475d6c]
test al, al
je 0x43c55a
call fcn.0043c136
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
jmp 0x43c4d0
mov eax, dword [0x475d6c]
mov esi, 0x476738
mov dword [esp + 0xc], eax
mov edi, 0x475d70
jmp 0x43c4d1
push dword [ebp + 0x14]
call fcn.0043c15e
pop ecx
mov eax, dword [ebp + 0x10]
cmp dword [esi], eax
jae 0x43c4c8
push dword [esp + 0xc]
call fcn.0043c122
pop ecx
push ebx
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push ebx
call fcn.00444c03
mov ecx, dword [esi]
mov dword [esp + 0x28], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x18
mov dword [edi + ecx*4], eax
mov eax, dword [esi]
cmp dword [edi + eax*4], 0xffffffff
jne 0x43c535
push 0x32
call ebx
xor eax, eax
push eax
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call fcn.00444c03
mov ecx, dword [esi]
add esp, 0x18
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 5
mov dword [edi + ecx*4], eax
jl 0x43c504
mov eax, dword [esi]
cmp dword [edi + eax*4], 0xffffffff
jne 0x43c545
dec eax
mov dword [esi], eax
or eax, 0xffffffff
jmp 0x43c562
push 0
call ebx
mov eax, dword [esi]
push dword [edi + eax*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc dword [esi]
push dword [esp + 0xc]
call fcn.0043c136
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43cec1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43ced5
sub eax, edx
cmp eax, 0x104
jae 0x43d058
lea eax, [ebp - 0x3c]
push eax
push esi
call fcn.004472e3
pop ecx
pop ecx
test eax, eax
jne 0x43cf09
test dword [ebp - 0x36], 0x4000
je 0x43cf09
mov al, 1
jmp 0x43d05a
lea edx, [ebp - 0x144]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43cf13
push 0x5c
pop ebx
lea eax, [ebp - 0x144]
push ebx
push eax
call fcn.004445b0
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x43d022
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43cf3c
sub eax, edx
cmp eax, 3
jbe 0x43cf7d
cmp byte [esi + 1], bl
jne 0x43cf7d
push ebx
add esi, 2
push esi
call fcn.004445b0
pop ecx
pop ecx
test eax, eax
je 0x43d022
inc eax
push ebx
push eax
call fcn.004445b0
pop ecx
pop ecx
test eax, eax
je 0x43d022
push ebx
inc eax
push eax
jmp 0x43d015
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43cf82
sub eax, edx
mov edi, eax
lea eax, [ebp - 0x144]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43cf96
sub eax, ecx
cmp edi, eax
je 0x43d01e
mov al, byte [esi - 1]
cmp al, 0x3a
je 0x43d012
cmp al, bl
jne 0x43d01e
jmp 0x43d012
lea eax, [ebp - 0x144]
mov byte [esi], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43cfbc
sub eax, edx
je 0x43d010
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.004472e3
pop ecx
pop ecx
test eax, eax
jne 0x43cfff
test dword [ebp - 0x36], 0x4000
jne 0x43d010
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
push str.Cant_create_dir__s:_non_dir__s_in_the_way
call fcn.004479fd
add esp, 0xc
jmp 0x43d058
lea eax, [ebp - 0x144]
push eax
call fcn.00446e73
pop ecx
test eax, eax
jne 0x43d05f
mov byte [esi], bl
push ebx
inc esi
push esi
call fcn.004445b0
pop ecx
mov esi, eax
pop ecx
test esi, esi
jne 0x43cfb0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x43d038
test al, 0x10
jne 0x43cf02
push dword [ebp + 8]
call fcn.00446e73
pop ecx
test eax, eax
je 0x43cf02
push dword [ebp + 8]
push str.Unable_to_create_dir__s
call fcn.004479fd
pop ecx
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x144]
push eax
push str.Cant_create_dir__s:_mkdir_fails
jmp 0x43d051
Function at 0x43d0f3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x118
push ebx
push esi
push edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43d105
sub eax, ecx
cmp eax, 0x104
jbe 0x43d11c
xor al, al
jmp 0x43d1b6
push dword [ebp + 8]
lea eax, [ebp - 0x118]
call fcn.0043cde6
pop ecx
lea eax, [ebp - 0x118]
push eax
call fcn.0043cec1
pop ecx
test al, al
je 0x43d115
xor ebx, ebx
mov byte [ebp - 1], bl
mov edi, str.__s__n
push 0x46120c
push dword [ebp + 8]
call fcn.004459de
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x43d1bb
push dword [ebp + 8]
push str.Unable_to_open__s_for_writing__will_try_again_in_1_sec
call fcn.004479fd
and dword [ebp - 8], 0
lea esi, [ebp - 8]
call fcn.0043d06d
push dword [ebp - 8]
push edi
call fcn.004479fd
push dword [ebp - 8]
call fcn.00444db8
add esp, 0x14
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x19
jb 0x43d146
push dword [ebp + 8]
push str.ERROR:_Couldnt_open__s_for_writing_n
call fcn.00445765
add eax, 0x40
push eax
call fcn.00445cb2
add esp, 0xc
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov byte [ebp - 1], 1
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], ebx
jbe 0x43d23c
mov esi, dword [ebp + 0x10]
sub esi, ebx
mov eax, 0x8000
cmp esi, eax
jbe 0x43d1dc
mov esi, eax
push dword [ebp - 0xc]
push esi
push 1
push dword [ebp - 8]
call fcn.00447136
add esp, 0x10
cmp eax, esi
jne 0x43d1fd
add dword [ebp - 8], esi
add ebx, esi
cmp ebx, dword [ebp + 0x10]
jb 0x43d1cc
jmp 0x43d23c
push dword [ebp + 8]
push ebx
push esi
push str.ERROR:_Unable_to_write__li_bytes_at_offset__li_to__s_n
call fcn.00445765
add eax, 0x40
push eax
call fcn.00445cb2
and dword [ebp - 8], 0
add esp, 0x14
lea esi, [ebp - 8]
call fcn.0043d06d
push dword [ebp - 8]
push edi
call fcn.004479fd
push dword [ebp - 8]
call fcn.00444db8
add esp, 0xc
mov byte [ebp - 1], 0
push dword [ebp - 0xc]
call fcn.0044615f
pop ecx
jmp 0x43d1b3
Function at 0x43d24a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], 1
call fcn.004472e3
pop ecx
pop ecx
test eax, eax
jne 0x43d2bc
push 0x45eb14
push dword [ebp + 8]
call fcn.004459de
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x43d2c2
push dword [ebp + 8]
push str.ERROR:_Unable_to_open__s_for_reading_n
call fcn.004479fd
lea esi, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.0043d06d
push dword [ebp - 8]
push str.__s__n
call fcn.004479fd
push dword [ebp - 8]
call fcn.00444db8
mov eax, dword [ebp + 0xc]
add esp, 0x14
cmp eax, ebx
je 0x43d2bc
mov dword [eax], ebx
xor al, al
pop esi
pop ebx
leave
ret
mov dword [edi], ebx
xor esi, esi
push dword [ebp - 0x2c]
call fcn.00444443
pop ecx
mov dword [edi], eax
cmp eax, ebx
jne 0x43d305
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x1e
jl 0x43d2c6
cmp dword [edi], ebx
jne 0x43d305
push dword [ebp + 8]
push str.Cabby:_Unable_to_allocate_memory_to_read__s_to_mem_n
call fcn.00445765
add eax, 0x40
push eax
call fcn.00445cb2
add esp, 0xc
jmp 0x43d2bc
mov ecx, dword [ebp + 0xc]
mov ebx, dword [edi]
mov eax, dword [ebp - 0x2c]
test ecx, ecx
je 0x43d313
mov dword [ecx], eax
test eax, eax
jbe 0x43d3ab
sub eax, dword [ebp - 8]
mov esi, eax
mov eax, 0x8000
cmp esi, eax
jbe 0x43d32b
mov esi, eax
push dword [ebp - 0xc]
push esi
push 1
push ebx
call fcn.00445c95
add esp, 0x10
cmp eax, esi
jne 0x43d34d
add dword [ebp - 8], eax
add ebx, eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 8], eax
jb 0x43d31b
jmp 0x43d3ab
push dword [ebp + 8]
push dword [ebp - 8]
push esi
push str.Cabby:_Unable_to_read__li_bytes_at_offset__li_from_file__s_n
call fcn.00445765
add eax, 0x40
push eax
call fcn.00445cb2
and dword [ebp - 8], 0
add esp, 0x14
lea esi, [ebp - 8]
call fcn.0043d06d
push dword [ebp - 8]
push str.__s__n
call fcn.00445765
add eax, 0x40
push eax
call fcn.00445cb2
push dword [ebp - 8]
call fcn.00444db8
push edi
call fcn.00444db8
mov eax, dword [ebp + 0xc]
add esp, 0x14
test eax, eax
je 0x43d3a7
and dword [eax], 0
mov byte [ebp - 1], 0
push dword [ebp - 0xc]
call fcn.0044615f
mov al, byte [ebp - 1]
pop ecx
jmp 0x43d2be

Function at 0x43ebfc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x43ec43
cmp edx, 0x10
jl 0x43ec2f
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x43ec1c
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x43ec43
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x43ec3b
and edx, 3
cmp edx, 3
jne 0x43ec57
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x43ec5c
cmp edx, 2
jne 0x43ec68
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x43ec6d
cmp edx, 1
jne 0x43ec73
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret