joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424aeb
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0x20
pop ebx
call fcn.004278d5
mov ebx, eax
push 0
mov dword [ebp - 8], ebx
call fcn.0043e861
pop ecx
and eax, 0xffff
push eax
call fcn.0043e649
pop ecx
call fcn.0043e65b
imul eax, eax, 0x3e8
cdq
mov ecx, 0x7fff
idiv ecx
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push str._04i
push eax
call fcn.0043c3ca
mov edi, ebx
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x424b46
mov esi, 0x458c68
lea eax, [ebp - 0x2c]
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424b5a
mov edi, ebx
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x424b66
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x2710
jmp 0x424be0
push ebx
call fcn.004263c5
pop ecx
test al, al
jne 0x424bc9
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424b95
sub eax, edx
cmp eax, 0x104
jae 0x424c20
mov edi, dword [ebp + 0xc]
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
setne al
test al, al
jne 0x424bee
inc dword [ebp - 4]
push dword [ebp - 4]
push edi
push str._s._04i
jmp 0x424bd7
inc dword [ebp - 4]
push dword [ebp - 4]
push dword [ebp + 0xc]
push str._s._4i
push ebx
call fcn.0043c3ca
add esp, 0x10
cmp dword [ebp - 4], esi
jl 0x424b85
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
push ebx
call fcn.00428b70
mov esi, dword [ebp + 8]
pop ecx
mov eax, edi
call fcn.00424f56
mov edx, edi
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x424c05
mov bl, 1
mov eax, dword [ebp + 8]
lea edi, [ebp - 8]
call fcn.004279f5
mov al, bl
jmp 0x424be7
xor bl, bl
jmp 0x424c11
Function at 0x424c24
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [eax + 0x558]
sub esp, 0x108
push ebx
push esi
mov eax, ecx
push edi
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x424c3b
sub eax, esi
test ecx, ecx
je 0x424cb2
test eax, eax
je 0x424cb2
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dl, byte [ecx]
inc ecx
mov byte [esi], dl
inc esi
test dl, dl
jne 0x424c51
cmp byte [eax + edi - 1], 0x5c
mov ebx, 0x45569c
je 0x424c74
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x424c68
mov esi, ebx
movsw word es:[edi], word [esi]
mov edi, dword [ebp + 0xc]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x424c78
mov esi, str.__temp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0xc]
push 0
mov eax, edi
call fcn.00428bcb
pop ecx
test al, al
je 0x424dcb
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x424c9f
mov esi, ebx
movsw word es:[edi], word [esi]
mov edi, 0x104
jmp 0x424cd1
push dword [ebp + 0xc]
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x424dcb
cmp eax, edi
jae 0x424dcb
mov eax, dword [ebp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424cd7
sub eax, edx
mov esi, eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x424ce8
sub eax, ecx
lea eax, [eax + esi + 1]
cmp eax, edi
jae 0x424dcb
push 0x458f8c
push dword [ebp + 8]
call fcn.0043b880
pop ecx
pop ecx
test eax, eax
je 0x424d15
add eax, 3
jmp 0x424d18
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x108]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x424d20
lea eax, [ebp - 0x108]
cmp byte [ebp - 0x108], cl
je 0x424d8c
movsx ecx, byte [eax]
cmp ecx, 0x2f
jg 0x424d6f
je 0x424d6a
cmp ecx, 0x22
je 0x424d83
cmp ecx, 0x2a
je 0x424d83
cmp ecx, 0x2e
jne 0x424d86
mov cl, byte [eax + 1]
test cl, cl
je 0x424d83
cmp cl, 0x2e
je 0x424d64
cmp cl, 0x5c
je 0x424d83
jmp 0x424d86
mov byte [eax + 1], 0x5f
jmp 0x424d83
mov byte [eax], 0x5c
jmp 0x424d86
cmp ecx, 0x3c
je 0x424d83
cmp ecx, 0x3d
jle 0x424d86
cmp ecx, 0x3f
jle 0x424d83
cmp ecx, 0x7c
jne 0x424d86
mov byte [eax], 0x5f
inc eax
cmp byte [eax], 0
jne 0x424d38
lea eax, [ebp - 0x108]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424d94
mov edi, dword [ebp + 0xc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x424da1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 0xc]
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
call fcn.00428bcb
test al, al
pop ecx
setne al
jmp 0x424dcd
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x424dd4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
push dword [ebp + 8]
mov esi, 0x80
push esi
lea eax, [ebp - 0x80]
push 1
push eax
call fcn.0043cfb4
add esp, 0x10
cmp eax, esi
je 0x424e00
xor al, al
jmp 0x424eb8
lea eax, [ebp - 0x80]
mov byte [ebp - 1], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424e0a
sub eax, edx
jmp 0x424e1d
cmp byte [ebp + eax - 0x80], 0
jne 0x424df9
inc eax
cmp eax, esi
jb 0x424e15
lea eax, [ebp - 0x100]
push eax
push str.size
lea eax, [ebp - 0x80]
push eax
call fcn.00424ebd
test al, al
je 0x424df9
lea eax, [ebp - 0x100]
push edi
push eax
call fcn.0043b3d8
pop ecx
mov edi, eax
lea eax, [ebp - 0x100]
push eax
push str.hash
lea eax, [ebp - 0x80]
push eax
call fcn.00424ebd
test al, al
je 0x424e7a
lea eax, [ebp - 0x100]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424e6c
sub eax, edx
cmp eax, 0x20
jb 0x424e7e
xor al, al
jmp 0x424eb7
push 0x24
call fcn.0043b528
pop ecx
test eax, eax
je 0x424e95
and dword [eax + 0x20], 0
mov byte [eax], 0
mov edx, eax
jmp 0x424e97
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
lea eax, [ebp - 0x100]
mov esi, edx
mov ecx, eax
sub esi, ecx
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x424ea8
mov dword [edx + 0x20], edi
mov al, 1
pop edi
pop esi
leave
ret 8
Function at 0x428dfc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push esi
push eax
push 0
push dword [eax + 0x20]
lea eax, [ebp - 0x84]
push str.size:__llu__hash:__s
push eax
call fcn.0043c3ca
lea eax, [ebp - 0x84]
add esp, 0x14
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x428e29
sub eax, ecx
mov esi, 0x80
cmp eax, esi
jae 0x428e52
mov edx, esi
sub edx, eax
push edx
lea ecx, [ebp + eax - 0x84]
push 0
push ecx
call fcn.004451c0
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0x84]
push esi
push 1
push eax
call fcn.0043e7df
add esp, 0x10
cmp eax, esi
je 0x428e6f
xor al, al
jmp 0x428e7a
push dword [ebp + 8]
call fcn.0043e482
pop ecx
mov al, 1
pop esi
leave
ret 4
Function at 0x42c574
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
push ebx
push edi
push 0x4590f4
push dword [ebp + 8]
call fcn.0043ccfd
mov edi, eax
pop ecx
pop ecx
mov dword [esp + 8], edi
test edi, edi
jne 0x42c5c9
call fcn.0043e520
push dword [eax]
call fcn.0043e28c
pop ecx
push eax
push dword [ebp + 8]
push str.unable_to_open__s_for_writing:__s_n
call fcn.0043ca84
add eax, 0x40
push eax
call fcn.0043cfd1
add esp, 0x10
xor al, al
jmp 0x42c7ac
push dword [ebp + 8]
call fcn.00428b70
pop ecx
push esi
lea eax, [esp + 0x14]
push str.__s__r_n
push eax
call fcn.0043c3ca
lea eax, [esp + 0x1c]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42c5ec
sub eax, ecx
mov ebx, eax
push edi
push ebx
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0043e7df
add esp, 0x10
push edi
cmp eax, ebx
je 0x42c62e
call fcn.0043d47e
pop ecx
push dword [ebp + 8]
call fcn.0043e569
pop ecx
push dword [esi + 0x270]
call fcn.00433559
xor al, al
jmp 0x42c7ab
call fcn.0043e482
pop ecx
push dword [esi + 0x274]
call fcn.00433545
pop ecx
mov ecx, dword [esi + 0x238]
test ecx, ecx
jne 0x42c667
push dword [esi + 0x274]
call fcn.00433559
pop ecx
push edi
call fcn.0043d47e
pop ecx
push dword [ebp + 8]
call fcn.0043e569
jmp 0x42c627
push 0x454bbf
push 0x45546c
mov eax, esi
call fcn.004287fe
push eax
lea eax, [esp + 0x14]
push str..ver_s_r_n
push eax
call fcn.0043c3ca
add esp, 0xc
push dword [esi + 0x274]
call fcn.00433559
lea eax, [esp + 0x14]
pop ecx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42c69e
sub eax, ecx
mov ebx, eax
push edi
push ebx
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0043e7df
add esp, 0x10
push edi
cmp eax, ebx
jne 0x42c60d
call fcn.0043e482
and dword [esp + 0x10], 0
pop ecx
xor eax, eax
jmp 0x42c780
mov eax, dword [esi + 0x260]
inc dword [esp + 0xc]
test eax, eax
je 0x42c6fc
push ebx
push dword [esi + 0x268]
call fcn.00428749
and eax, edx
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x42c77c
push 0x454bbf
push 0x45546c
push ebx
mov eax, edi
call fcn.004302de
push eax
push ebx
lea eax, [esp + 0x18]
push str._s_s_r_n
push eax
call fcn.0043c3ca
mov edi, 0x458f24
lea eax, [esp + 0x20]
push edi
push eax
call fcn.0043b880
add esp, 0x18
jmp 0x42c740
push edi
push eax
mov byte [eax], 0x5c
call fcn.0043b880
pop ecx
pop ecx
test eax, eax
jne 0x42c734
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42c74b
push dword [esp + 8]
sub eax, edx
mov edi, eax
push edi
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0043e7df
add esp, 0x10
push dword [esp + 8]
cmp eax, edi
jne 0x42c60d
call fcn.0043e482
pop ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esi + 0x234]
mov ecx, edi
call fcn.004329b7
mov ebx, eax
test ebx, ebx
jne 0x42c6d5
push dword [esp + 8]
call fcn.0043d47e
pop ecx
push dword [ebp + 8]
call fcn.00428b70
mov al, 1
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4327ef
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x10]
call fcn.0043e98c
pop ecx
pop ecx
test eax, eax
jne 0x43295e
push 0x200
call fcn.0043b7b3
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x432824
push ebx
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
sub eax, ecx
inc eax
call fcn.004329ce
mov ebx, eax
mov edi, ebx
mov dword [ebp - 0xc], ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x432843
mov ecx, dword [ebp + 0x14]
push esi
mov esi, 0x45569c
movsw word es:[edi], word [esi]
mov edx, ecx
mov al, byte [ecx]
inc ecx
test al, al
jne 0x432858
sub ecx, edx
mov edi, ebx
mov esi, edx
mov edx, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x432868
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x17c]
mov ecx, edx
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x432946
mov dword [ebp - 4], 0x200
mov dword [ebp + 0x14], 0x80
lea eax, [ebp - 0x150]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4328af
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
sub eax, edx
inc eax
call fcn.004329ce
mov ebx, eax
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4328c9
mov esi, 0x45569c
lea eax, [ebp - 0x150]
movsw word es:[edi], word [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4328e0
mov edi, ebx
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4328ee
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [ebp + 0x14], 2
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0xc]
jae 0x43292a
add dword [ebp - 4], 0x200
push dword [ebp - 4]
sub dword [ebp + 0x14], 0xffffff80
push dword [esi]
call fcn.0043c165
pop ecx
pop ecx
test eax, eax
je 0x432964
mov dword [esi], eax
mov eax, dword [esi]
mov dword [eax], ebx
lea eax, [ebp - 0x17c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4328a6
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
call fcn.00432b07
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop edi
pop ebx
xor eax, eax
leave
ret 0x10
mov eax, dword [esi]
test eax, eax
je 0x432971
push eax
call fcn.0043c0d7
pop ecx
and dword [esi], 0
jmp 0x43295b
Function at 0x432e1c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
and dword [ebp - 0xc], 0
push ebx
push edi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
mov byte [ebp - 5], 1
call fcn.0043e98c
pop ecx
pop ecx
test eax, eax
jne 0x432e6d
push 0x4568a4
push dword [ebp + 8]
call fcn.0043ccfd
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x432e75
push dword [ebp + 8]
push str.ERROR:_Unable_to_open__s_for_reading_n
call fcn.0043edcb
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
test eax, eax
je 0x432e6d
and dword [eax], 0
xor al, al
pop edi
pop ebx
leave
ret 0xc
cmp byte [ebp + 0x10], 0
je 0x432e95
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.0043b7b3
pop ecx
mov dword [esi], eax
test eax, eax
je 0x432e6d
mov ecx, dword [ebp - 0x30]
mov byte [eax + ecx], 0
jmp 0x432ea4
push dword [ebp - 0x30]
call fcn.0043b7b3
pop ecx
mov dword [esi], eax
test eax, eax
je 0x432e6d
mov ecx, dword [ebp + 0xc]
mov ebx, dword [esi]
mov eax, dword [ebp - 0x30]
test ecx, ecx
je 0x432eb2
mov dword [ecx], eax
test eax, eax
jbe 0x432f14
sub eax, dword [ebp - 0xc]
mov edi, eax
mov eax, 0x8000
cmp edi, eax
jbe 0x432ec6
mov edi, eax
push dword [ebp - 0x10]
push edi
push 1
push ebx
call fcn.0043cfb4
add esp, 0x10
cmp eax, edi
jne 0x432ee8
add dword [ebp - 0xc], eax
add ebx, eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xc], eax
jb 0x432eb6
jmp 0x432f14
push dword [ebp + 8]
push dword [ebp - 0xc]
push edi
push str.Unable_to_read__li_bytes_at_offset__li_from_file__s_n
call fcn.0043edcb
push dword [esi]
call fcn.0043c0d7
mov eax, dword [ebp + 0xc]
and dword [esi], 0
add esp, 0x14
test eax, eax
je 0x432f10
and dword [eax], 0
mov byte [ebp - 5], 0
push dword [ebp - 0x10]
call fcn.0043d47e
mov al, byte [ebp - 5]
pop ecx
jmp 0x432e6f
Function at 0x43384f
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, eax
push esi
push edi
cmp ebx, 0x40
jbe 0x433865
push 0x40
pop ebx
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
cmp dword [ebp + 0x10], eax
je 0x4338bd
push dword [0x46d4ac]
call fcn.00433545
pop ecx
push 1
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push dword [ebp + 0x10]
call fcn.004339e3
add esp, 0x14
push dword [0x46d4ac]
test al, al
je 0x433963
call fcn.00433559
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
jmp 0x4338da
mov eax, dword [0x46d4ac]
mov esi, 0x46d94c
mov dword [esp + 0xc], eax
mov edi, 0x46d4b0
jmp 0x4338db
push dword [ebp + 0x10]
call fcn.0043356f
pop ecx
cmp dword [esi], ebx
jae 0x4338d2
push dword [esp + 0xc]
call fcn.00433545
pop ecx
xor ebx, ebx
push ebx
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push ebx
call fcn.0043bf22
mov ecx, dword [esi]
mov dword [esp + 0x28], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x18
mov dword [edi + ecx*4], eax
mov eax, dword [esi]
cmp dword [edi + eax*4], 0xffffffff
jne 0x43393e
push 0x32
call ebx
xor eax, eax
push eax
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call fcn.0043bf22
mov ecx, dword [esi]
add esp, 0x18
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 5
mov dword [edi + ecx*4], eax
jl 0x43390d
mov eax, dword [esi]
cmp dword [edi + eax*4], 0xffffffff
jne 0x43394e
dec eax
mov dword [esi], eax
or eax, 0xffffffff
jmp 0x43396b
push 0
call ebx
mov eax, dword [esi]
push dword [edi + eax*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc dword [esi]
push dword [esp + 0xc]
call fcn.00433559
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43422e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x434242
sub eax, edx
cmp eax, 0x104
jae 0x4343c5
lea eax, [ebp - 0x3c]
push eax
push esi
call fcn.0043e98c
pop ecx
pop ecx
test eax, eax
jne 0x434276
test dword [ebp - 0x36], 0x4000
je 0x434276
mov al, 1
jmp 0x4343c7
lea edx, [ebp - 0x144]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x434280
push 0x5c
pop ebx
lea eax, [ebp - 0x144]
push ebx
push eax
call fcn.0043b920
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x43438f
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4342a9
sub eax, edx
cmp eax, 3
jbe 0x4342ea
cmp byte [esi + 1], bl
jne 0x4342ea
push ebx
add esi, 2
push esi
call fcn.0043b920
pop ecx
pop ecx
test eax, eax
je 0x43438f
inc eax
push ebx
push eax
call fcn.0043b920
pop ecx
pop ecx
test eax, eax
je 0x43438f
push ebx
inc eax
push eax
jmp 0x434382
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4342ef
sub eax, edx
mov edi, eax
lea eax, [ebp - 0x144]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x434303
sub eax, ecx
cmp edi, eax
je 0x43438b
mov al, byte [esi - 1]
cmp al, 0x3a
je 0x43437f
cmp al, bl
jne 0x43438b
jmp 0x43437f
lea eax, [ebp - 0x144]
mov byte [esi], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x434329
sub eax, edx
je 0x43437d
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.0043e98c
pop ecx
pop ecx
test eax, eax
jne 0x43436c
test dword [ebp - 0x36], 0x4000
jne 0x43437d
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
push str.Cant_create_dir__s:_non_dir__s_in_the_way
call fcn.0043edcb
add esp, 0xc
jmp 0x4343c5
lea eax, [ebp - 0x144]
push eax
call fcn.0043e599
pop ecx
test eax, eax
jne 0x4343cc
mov byte [esi], bl
push ebx
inc esi
push esi
call fcn.0043b920
pop ecx
mov esi, eax
pop ecx
test esi, esi
jne 0x43431d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4343a5
test al, 0x10
jne 0x43426f
push dword [ebp + 8]
call fcn.0043e599
pop ecx
test eax, eax
je 0x43426f
push dword [ebp + 8]
push str.Unable_to_create_dir__s
call fcn.0043edcb
pop ecx
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x144]
push eax
push str.Cant_create_dir__s:_mkdir_fails
jmp 0x4343be
Function at 0x434460
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x118
push ebx
push esi
push edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x434472
sub eax, ecx
cmp eax, 0x104
jbe 0x434489
xor al, al
jmp 0x434523
push dword [ebp + 8]
lea eax, [ebp - 0x118]
call fcn.00434153
pop ecx
lea eax, [ebp - 0x118]
push eax
call fcn.0043422e
pop ecx
test al, al
je 0x434482
xor ebx, ebx
mov byte [ebp - 1], bl
mov edi, str.__s__n
push 0x4590f4
push dword [ebp + 8]
call fcn.0043ccfd
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x434528
push dword [ebp + 8]
push str.Unable_to_open__s_for_writing__will_try_again_in_1_sec
call fcn.0043edcb
and dword [ebp - 8], 0
lea esi, [ebp - 8]
call fcn.004343da
push dword [ebp - 8]
push edi
call fcn.0043edcb
push dword [ebp - 8]
call fcn.0043c0d7
add esp, 0x14
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x19
jb 0x4344b3
push dword [ebp + 8]
push str.ERROR:_Couldnt_open__s_for_writing_n
call fcn.0043ca84
add eax, 0x40
push eax
call fcn.0043cfd1
add esp, 0xc
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov byte [ebp - 1], 1
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], ebx
jbe 0x4345a9
mov esi, dword [ebp + 0x10]
sub esi, ebx
mov eax, 0x8000
cmp esi, eax
jbe 0x434549
mov esi, eax
push dword [ebp - 0xc]
push esi
push 1
push dword [ebp - 8]
call fcn.0043e7df
add esp, 0x10
cmp eax, esi
jne 0x43456a
add dword [ebp - 8], esi
add ebx, esi
cmp ebx, dword [ebp + 0x10]
jb 0x434539
jmp 0x4345a9
push dword [ebp + 8]
push ebx
push esi
push str.ERROR:_Unable_to_write__li_bytes_at_offset__li_to__s_n
call fcn.0043ca84
add eax, 0x40
push eax
call fcn.0043cfd1
and dword [ebp - 8], 0
add esp, 0x14
lea esi, [ebp - 8]
call fcn.004343da
push dword [ebp - 8]
push edi
call fcn.0043edcb
push dword [ebp - 8]
call fcn.0043c0d7
add esp, 0xc
mov byte [ebp - 1], 0
push dword [ebp - 0xc]
call fcn.0043d47e
pop ecx
jmp 0x434520
Function at 0x4345b7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], 1
call fcn.0043e98c
pop ecx
pop ecx
test eax, eax
jne 0x434629
push 0x4568a4
push dword [ebp + 8]
call fcn.0043ccfd
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x43462f
push dword [ebp + 8]
push str.ERROR:_Unable_to_open__s_for_reading_n
call fcn.0043edcb
lea esi, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.004343da
push dword [ebp - 8]
push str.__s__n
call fcn.0043edcb
push dword [ebp - 8]
call fcn.0043c0d7
mov eax, dword [ebp + 0xc]
add esp, 0x14
cmp eax, ebx
je 0x434629
mov dword [eax], ebx
xor al, al
pop esi
pop ebx
leave
ret
mov dword [edi], ebx
xor esi, esi
push dword [ebp - 0x2c]
call fcn.0043b7b3
pop ecx
mov dword [edi], eax
cmp eax, ebx
jne 0x434672
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x1e
jl 0x434633
cmp dword [edi], ebx
jne 0x434672
push dword [ebp + 8]
push str.Cabby:_Unable_to_allocate_memory_to_read__s_to_mem_n
call fcn.0043ca84
add eax, 0x40
push eax
call fcn.0043cfd1
add esp, 0xc
jmp 0x434629
mov ecx, dword [ebp + 0xc]
mov ebx, dword [edi]
mov eax, dword [ebp - 0x2c]
test ecx, ecx
je 0x434680
mov dword [ecx], eax
test eax, eax
jbe 0x434718
sub eax, dword [ebp - 8]
mov esi, eax
mov eax, 0x8000
cmp esi, eax
jbe 0x434698
mov esi, eax
push dword [ebp - 0xc]
push esi
push 1
push ebx
call fcn.0043cfb4
add esp, 0x10
cmp eax, esi
jne 0x4346ba
add dword [ebp - 8], eax
add ebx, eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 8], eax
jb 0x434688
jmp 0x434718
push dword [ebp + 8]
push dword [ebp - 8]
push esi
push str.Cabby:_Unable_to_read__li_bytes_at_offset__li_from_file__s_n
call fcn.0043ca84
add eax, 0x40
push eax
call fcn.0043cfd1
and dword [ebp - 8], 0
add esp, 0x14
lea esi, [ebp - 8]
call fcn.004343da
push dword [ebp - 8]
push str.__s__n
call fcn.0043ca84
add eax, 0x40
push eax
call fcn.0043cfd1
push dword [ebp - 8]
call fcn.0043c0d7
push edi
call fcn.0043c0d7
mov eax, dword [ebp + 0xc]
add esp, 0x14
test eax, eax
je 0x434714
and dword [eax], 0
mov byte [ebp - 1], 0
push dword [ebp - 0xc]
call fcn.0043d47e
mov al, byte [ebp - 1]
pop ecx
jmp 0x43462b

Function at 0x435f6c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x435fb3
cmp edx, 0x10
jl 0x435f9f
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x435f8c
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x435fb3
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x435fab
and edx, 3
cmp edx, 3
jne 0x435fc7
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x435fcc
cmp edx, 2
jne 0x435fd8
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x435fdd
cmp edx, 1
jne 0x435fe3
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret