joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012de
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b044]
jne 0x4012e8
repz ret
jmp fcn.004050a3

Function at 0x40ce29
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00408765
xor ebx, ebx
cmp dword [0x42d4a8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40cefe
push 0x423b88
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40ce69
xor eax, eax
jmp 0x40cfc2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x423b7c
push edi
call esi
cmp eax, ebx
je 0x40ce62
push eax
call fcn.00408702
mov dword [esp], 0x423b6c
push edi
mov dword [0x42d4a8], eax
call esi
push eax
call fcn.00408702
mov dword [esp], 0x423b58
push edi
mov dword [0x42d4ac], eax
call esi
push eax
call fcn.00408702
mov dword [0x42d4b0], eax
lea eax, [ebp - 8]
push eax
call fcn.00407171
test eax, eax
pop ecx
pop ecx
je 0x40cecc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004052ab
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40cefe
push 0x423b3c
push edi
call esi
push eax
call fcn.00408702
cmp eax, ebx
pop ecx
mov dword [0x42d4b8], eax
je 0x40cefe
push 0x423b24
push edi
call esi
push eax
call fcn.00408702
pop ecx
mov dword [0x42d4b4], eax
mov eax, dword [0x42d4b4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40cf77
cmp dword [0x42d4b8], esi
je 0x40cf77
push eax
call fcn.0040876e
pop ecx
call eax
cmp eax, ebx
je 0x40cf44
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x42d4b8]
call fcn.0040876e
pop ecx
call eax
test eax, eax
je 0x40cf44
test byte [ebp - 0x18], 1
jne 0x40cf77
lea eax, [ebp - 0xc]
push eax
call fcn.004071a8
test eax, eax
pop ecx
je 0x40cf5f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004052ab
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40cf6e
or dword [ebp + 0x10], 0x200000
jmp 0x40cfa8
or dword [ebp + 0x10], 0x40000
jmp 0x40cfa8
mov eax, dword [0x42d4ac]
cmp eax, esi
je 0x40cfa8
push eax
call fcn.0040876e
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40cfa8
mov eax, dword [0x42d4b0]
cmp eax, esi
je 0x40cfa8
push dword [ebp - 4]
push eax
call fcn.0040876e
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x42d4a8]
call fcn.0040876e
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40f560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
xor ecx, ecx
cmp dword [ebp - 8], 0xffffffff
setne cl
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40f5c0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40f5dd
xor eax, eax
jmp 0x40f648
mov ecx, dword [ebp - 0xc]
and ecx, 1
je 0x40f5ee
mov edx, dword [ebp - 0xc]
xor edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
and eax, 4
je 0x40f5ff
mov ecx, dword [ebp - 0xc]
xor ecx, 4
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
and edx, 2
je 0x40f610
mov eax, dword [ebp - 0xc]
xor eax, 2
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0x20
je 0x40f621
mov edx, dword [ebp - 0xc]
xor edx, 0x20
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40f650
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004012f0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x40f69f
cmp dword [ebp + 0xc], 0
jne 0x40f6a9
jmp 0x40f73b
cmp dword [ebp + 0x10], 0
je 0x40f6bf
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004022d8
add esp, 4
test eax, eax
jne 0x40f6c3
jmp 0x40f73b
lea edx, [ebp - 0x210]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp + 0x10]
push eax
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.004013e0
add esp, 0xc
push 0x424c68
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 4]
push eax
call fcn.00401956
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x40f70f
jmp 0x40f73b
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402027
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.004020b5
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004012de
mov esp, ebp
pop ebp
ret
Function at 0x40f750
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004012f0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x40f79f
cmp dword [ebp + 0xc], 0
jne 0x40f7a9
jmp 0x40f877
cmp dword [ebp + 0x10], 0
je 0x40f7bf
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004022d8
add esp, 4
test eax, eax
jne 0x40f7c9
jmp 0x40f877
cmp dword [0x42c0a0], 3
jne 0x40f7ff
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x424c5c
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.004013e0
add esp, 0xc
jmp 0x40f811
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [ebp + 0x10]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.004013e0
add esp, 0xc
push 0x424c60
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00401956
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x40f84b
jmp 0x40f877
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00402027
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.004020b5
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004012de
mov esp, ebp
pop ebp
ret

Function at 0x40f890
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004012f0
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x40f8d8
cmp dword [ebp + 0xc], 0
jne 0x40f8e2
jmp 0x40f98b
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
je 0x40f916
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004022d8
add esp, 4
test eax, eax
jbe 0x40f916
push 0x424c30
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 4]
push eax
call fcn.00401956
add esp, 0xc
jmp 0x40f959
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x424c38
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.004013e0
add esp, 0xc
push 0x424c54
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.00401956
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x40f981
mov edx, dword [ebp - 4]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040224b
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.004020b5
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004012de
mov esp, ebp
pop ebp
ret
Function at 0x40fcb0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, dword [ecx]
and eax, 0xff
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4252f8]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0xff
mov edx, dword [ebp + 8]
add ecx, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
imul edx, edx, 0x8088405
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shr edx, 0x18
mov eax, dword [ebp + 8]
xor edx, dword [eax + 8]
and edx, 0xff
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4252f8]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret
Function at 0x40fd30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x40fd40
xor eax, eax
jmp 0x40fedd
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x40fe9e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4252f8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4252f8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x4252f8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4252f8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4252f8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x4252f8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4252f8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4252f8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x40fd49
cmp dword [ebp + 0x10], 0
je 0x40fed7
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4252f8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x40fea4
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x40fee0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x84], 0
je 0x40ffa2
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x8c]
cmp eax, dword [edx + 0x88]
jb 0x40ff14
xor eax, eax
jmp 0x410012
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x88]
sub eax, dword [edx + 0x8c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jbe 0x40ff37
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x84]
mov eax, dword [ebp - 0x10]
add edx, dword [eax + 0x8c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401460
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x8c]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x8c], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x74]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x74], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x78]
push edx
call fcn.0040fd30
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x78], eax
mov eax, dword [ebp - 4]
jmp 0x410012
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x7c], 0
je 0x410006
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40ffd3
xor eax, eax
jmp 0x410012
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x74]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x74], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x78]
push edx
call fcn.0040fd30
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x78], eax
mov eax, dword [ebp - 0xc]
jmp 0x410012
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0x1000000
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x410080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
movzx edx, byte [ecx + 0x2d]
test edx, edx
je 0x410161
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x3c], 0
je 0x4100d1
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x40]
cmp edx, dword [ebp + 0xc]
jae 0x4100d1
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.004023ab
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x3c], 0
jne 0x4100fd
mov edx, dword [ebp + 0xc]
shl edx, 1
push edx
call fcn.00403c31
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x3c], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x40], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x3c]
push ecx
call fcn.00401460
add esp, 0xc
mov dword [ebp - 8], 0
jmp 0x410126
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x410158
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 8]
mov cl, byte [edx + eax]
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x30
push edx
call fcn.00410040
add esp, 8
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x3c]
mov ecx, dword [ebp - 8]
mov byte [edx + ecx], al
jmp 0x41011d
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x20], 0
je 0x4101bc
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
cmp eax, dword [ecx + 0x28]
jb 0x410189
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x14], 0x30000
xor eax, eax
jmp 0x4101f1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x18]
add eax, dword [ecx + 0x24]
push eax
call fcn.00401460
add esp, 0xc
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x24], eax
mov eax, dword [ebp + 0xc]
jmp 0x4101f1
mov edx, dword [ebp - 0x18]
cmp dword [edx + 4], 0
je 0x4101e5
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
jmp 0x4101f1
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x14], 0x1000000
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x410280
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x4102b4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4102b4
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
test eax, eax
jne 0x4102c3
jmp 0x4103ce
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x218]
movzx ecx, word [eax]
test ecx, ecx
je 0x410315
mov edx, dword [ebp - 0x218]
movzx eax, word [edx]
cmp eax, 0x2f
je 0x4102fb
mov ecx, dword [ebp - 0x218]
movzx edx, word [ecx]
cmp edx, 0x5c
jne 0x410304
mov eax, dword [ebp - 0x218]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x218]
add ecx, 2
mov dword [ebp - 0x218], ecx
jmp 0x4102d2
mov edx, dword [ebp - 4]
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x410378
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
sar ecx, 1
shl ecx, 1
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x420]
push eax
call fcn.00401460
add esp, 0xc
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
sar ecx, 1
mov word [ebp + ecx*2 - 0x420], 0
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00410280
add esp, 8
mov ecx, dword [ebp - 0x214]
add ecx, 2
mov dword [ebp - 0x214], ecx
mov word [ebp - 0x210], 0
cmp dword [ebp + 8], 0
je 0x41039a
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.004013c4
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0040139a
add esp, 8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4103ce
push 0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004012de
mov esp, ebp
pop ebp
ret
Function at 0x410530
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x14]
movzx edx, byte [ecx]
test edx, edx
je 0x41057f
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x410575
mov edx, dword [ebp + 0x14]
mov byte [edx + 8], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp + 0xc]
jmp 0x4105d9
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x14]
cmp ecx, dword [edx + 0x18]
jbe 0x41059f
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x18]
sub edx, dword [ecx + 0x1c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp + 0x14]
add edx, dword [eax + 0x1c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401460
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x410bc0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, dword [ecx]
and eax, 0xff
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4270b8]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0xff
mov edx, dword [ebp + 8]
add ecx, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
imul edx, edx, 0x8088405
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shr edx, 0x18
mov eax, dword [ebp + 8]
xor edx, dword [eax + 8]
and edx, 0xff
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4270b8]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret
Function at 0x410c40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x410c50
xor eax, eax
jmp 0x410ded
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x410dae
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4270b8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4270b8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x4270b8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4270b8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4270b8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x4270b8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4270b8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4270b8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x410c59
cmp dword [ebp + 0x10], 0
je 0x410de7
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4270b8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x410db4
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret