joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408c40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x438
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x434], eax
push ebp
mov ebp, dword [esp + 0x440]
push esi
push edi
mov edi, ecx
test dword [edi + 0x58], 0x400000
je 0x408df8
push str..mdmp
push str..mdmp
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x408df8
mov esi, dword [edi + 0x18]
mov word [esp + 0x38], ax
test esi, esi
je 0x408df4
cmp word [esi], ax
je 0x408df4
mov eax, dword [edi + 0x24]
push ebx
xor ebx, ebx
test eax, eax
je 0x408ccf
cmp word [eax], bx
je 0x408ccf
push ebx
push ebx
push 0xff
lea ecx, [esp + 0x48]
push ecx
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.MSVCR100.dll__wsplitpath_s]
add esp, 0x24
mov ebx, 1
mov edi, dword [edi + 0x3c]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.MSVCR100.dll__time64]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.MSVCR100.dll__gmtime64_s]
add esp, 0xc
test eax, eax
je 0x408d1e
lea eax, [esp + 0x3c]
test ebx, ebx
jne 0x408d01
mov eax, str.SQLDmpr
push edi
push eax
push str._ls._p.0
mov eax, 0x104
lea edi, [esp + 0x248]
call fcn.00401210
add esp, 0xc
jmp 0x408d5e
lea ecx, [esp + 0x3c]
test ebx, ebx
jne 0x408d2b
mov ecx, str.SQLDmpr
push dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
push dword [esp + 0x28]
inc eax
push eax
mov eax, dword [esp + 0x38]
add eax, 0x76c
push eax
push edi
push ecx
push str._ls._p.GMT__4d__02d__02d__02d_00_00
mov eax, 0x104
lea edi, [esp + 0x258]
call fcn.00401210
add esp, 0x1c
test eax, eax
jns 0x408d93
push str.Failed_to_generate_dump_filename
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 8
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x440]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040bb9d
add esp, 0x438
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408da3
test al, 0x10
jne 0x408dce
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x408dce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_to_create_dump_directory__ls___Error_Code__0x_x
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0x10
jmp 0x408d76
push str..dmp
lea eax, [esp + 0x240]
push eax
push esi
push 0
push 0x104
push ebp
call dword [sym.imp.MSVCR100.dll__wmakepath_s]
add esp, 0x18
mov eax, 1
jmp 0x408d78
xor eax, eax
jmp 0x408d79
push dword [edi + 0x14]
mov edi, ebp
mov esi, str..mdmp
call fcn.00408e20
jmp 0x408d79
Function at 0x409090
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x413a00
push 0x40c0ae
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [section..data]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x280], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x27c], 0xffffffff
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x274]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [ebp - 0x27c], ebx
cmp ebx, 0xffffffff
je 0x409180
mov ecx, 0x94
lea esi, [ebp - 0x274]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x274]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x409168
mov edi, dword [ebp - 0x280]
lea eax, [edi + 0x2c]
lea ecx, [ebp - 0x248]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40915d
test dx, dx
je 0x409159
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40915d
add ecx, 4
add eax, 4
test dx, dx
jne 0x409137
xor eax, eax
jmp 0x409162
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jle 0x409116
jmp 0x409109
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x409180
mov esi, 1
mov dword [ebp - 0x278], esi
jmp 0x409186
mov esi, dword [ebp - 0x278]
mov dword [ebp - 4], 0xfffffffe
call fcn.004091be
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0040bb9d
mov esp, ebp
pop ebp
ret 4

Function at 0x4091d0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1010
call fcn.0040c540
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [esp + 0x1014]
push ebx
push ebp
mov ebp, dword [esp + 0x1020]
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [esp + 0x18], eax
mov esi, 1
test ebx, ebx
je 0x40929f
nop
cmp esi, 1
jne 0x409280
mov eax, ebx
sub eax, edi
cmp eax, 0x1000
jbe 0x409225
mov eax, 0x1000
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x409284
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409280
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x28]
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jne 0x4092bc
add edi, eax
cmp ebx, edi
ja 0x409210
test esi, esi
jne 0x40929f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.FileCopy:_Unable_to_read_write_file__error__d
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
mov ecx, dword [esp + 0x101c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040bb9d
add esp, 0x1010
ret 8
xor esi, esi
jmp 0x409284
Function at 0x4092d0
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, eax
test ebp, ebp
jne 0x4092e8
pop ebp
mov eax, 1
pop ebx
ret 4
xor eax, eax
mov dword [esp + 0xc], eax
cmp ebx, 0x100000
jbe 0x4092fb
mov ebx, 0x100000
push esi
push edi
push 0x419a96
mov edi, 0x433050
mov esi, str..log
call fcn.00408e20
test eax, eax
je 0x40941e
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push ebp
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4093f0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4093b3
cmp ecx, ebx
jbe 0x409368
push 2
push 0
mov eax, ebx
neg eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4093b3
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push 0x433050
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x4093a0
push esi
push edi
mov ecx, ebx
call fcn.004091d0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x18], eax
call edi
jmp 0x4093d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x433050
push str.Unable_to_open_file__s_for_write__error__d
jmp 0x4093c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push str.Unable_to_set_position_in_file__s__error__d
push 1
mov ebx, 0x415428
call fcn.00401660
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x10
push esi
call edi
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40943d
pop edi
pop esi
xor ecx, ecx
pop ebp
mov word [0x433050], cx
pop ebx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push str.Unable_to_open_file__s__error__d
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0x10
pop edi
pop esi
xor eax, eax
xor ecx, ecx
pop ebp
mov word [0x433050], cx
pop ebx
ret 4
push str.Unable_to_construct_name_for_temporary_log_file
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 8
xor eax, eax
xor ecx, ecx
mov word [0x433050], cx
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x409af0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x70
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x6c], eax
push edi
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
jne 0x409b43
mov edi, str.GetFileVersionInfoSize
call fcn.00409cc0
pop edi
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.0040bb9d
add esp, 0x70
ret
push ebx
push edi
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x409b5f
push edi
push str.Could_not_allocate__d_bytes_of_memory_for_marshaled_slab
jmp 0x409c8b
push ebx
push edi
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x409b93
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov edi, str.GetFileVersionInfo
call fcn.00409cc0
pop ebx
pop edi
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.0040bb9d
add esp, 0x70
ret
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0x412aac
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x409bb8
push esi
push 0x412ab0
jmp 0x409c8b
cmp dword [esp + 0xc], 0
jne 0x409bca
push esi
push str.Fixed_version_resource_for__ls_is_unavailable
jmp 0x409c8b
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
movzx eax, cx
push eax
movzx eax, dx
shr ecx, 0x10
push ecx
push eax
shr edx, 0x10
push edx
push str._u._u:_u._u
mov eax, 0x17
lea edi, [esp + 0x28]
call fcn.00401210
add esp, 0x14
mov ebx, 0x415428
test eax, eax
js 0x409c18
mov eax, edi
push eax
push esi
push str.File_version_of_module__ls_:__ls
push 2
call fcn.00401660
add esp, 0x10
jmp 0x409c28
push eax
push str.File_version_dump_failed_HRESULT_code_0x_x
push 1
call fcn.00401660
add esp, 0xc
mov eax, dword [esp + 8]
mov edx, dword [eax + 0x10]
mov ecx, dword [eax + 0x14]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx ecx, dx
push ecx
shr edx, 0x10
push edx
push str._u._u:_u._u
mov eax, 0x17
lea edi, [esp + 0x58]
call fcn.00401210
add esp, 0x14
test eax, eax
js 0x409c85
mov eax, edi
push eax
push esi
push str.Product_version_of_module__ls_:__ls
push 2
mov ebx, 0x415428
call fcn.00401660
add esp, 0x10
pop ebx
pop edi
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.0040bb9d
add esp, 0x70
ret
push eax
push str.Product_version_dump_failed_HRESULT_code_0x_x
push 1
mov ebx, 0x415428
call fcn.00401660
mov ecx, dword [esp + 0x80]
add esp, 0xc
pop ebx
pop edi
xor ecx, esp
call fcn.0040bb9d
add esp, 0x70
ret
Function at 0x409de0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx + 8]
push ebp
push esi
lea edx, [eax*8 + 8]
xor ebp, ebp
or ecx, 0xffffffff
push edi
mov dword [esp + 0x10], 0
lea esi, [ebx + 8]
test edx, edx
je 0x409e28
lea esp, [esp]
movzx eax, byte [esi]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x413050]
inc esi
dec edx
jne 0x409e10
mov eax, dword [ebx + 4]
cmp ecx, eax
je 0x409e5e
or dword [0x415054], 0x20000400
push eax
push ecx
mov dword [ebx + 8], ebp
mov dword [ebx], ebp
push str.Mismatched_struct_checksum_for_head_slab___computed__X___read__X
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
mov esi, dword [ebx]
mov dword [ebx], ebp
test esi, esi
je 0x409fc6
lea ebx, [ebx]
mov eax, ebp
inc ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], ebp
cmp eax, 0x400
jae 0x409fa7
lea eax, [esp + 0x18]
push eax
mov edi, 0x10
mov ecx, 0x419860
call fcn.004025a0
test eax, eax
je 0x409f8b
mov eax, dword [esp + 0x20]
cmp eax, 0x1000
ja 0x409f66
lea edi, [eax*8 + 0x10]
push edi
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x409f4b
push ebp
mov ecx, 0x419860
call fcn.004025a0
test eax, eax
je 0x409f3b
mov eax, ebp
call fcn.00409fe0
mov ecx, dword [ebp + 4]
cmp eax, ecx
jne 0x409f1b
mov dword [ebx], ebp
mov eax, dword [ebp]
mov dword [esp + 0x2c], ebp
mov dword [ebp], 0
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jmp 0x409f8f
or dword [0x415054], 0x20000400
push ecx
push eax
push str.Mismatched_struct_checksum_for_intermediate_slab___computed__X___read__X
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0x10
push ebp
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov ebp, dword [esp + 0x18]
add esp, 4
jmp 0x409f8b
push edi
push str.Could_not_allocate__d_bytes_of_memory_for_marshaled_slab
push 1
mov ebx, 0x415428
call fcn.00401660
mov ebp, dword [esp + 0x20]
add esp, 0xc
jmp 0x409f8b
or dword [0x415054], 0x20000800
push 0x1000
push eax
push esi
push str.Slab_at__p_did_not_pass_sanity_check___read__d___max_expected__d
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0x14
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x2c]
mov esi, eax
test eax, eax
jne 0x409e70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
or dword [0x415054], 0x20000800
push ebp
push str.Slab_list_did_not_pass_sanity_check___list_too_long___stopping_after__d_elements
push 1
mov ebx, 0x415428
call fcn.00401660
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x409fe0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push esi
lea esi, [eax + 8]
mov eax, dword [esi]
lea edx, [eax*8 + 8]
or eax, 0xffffffff
test edx, edx
je 0x40a019
jmp 0x40a000
movzx ecx, byte [esi]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x413050]
inc esi
dec edx
jne 0x40a000
pop esi
ret
Function at 0x40ae30
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x14], 0x80
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 2
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x10]
mov ax, word [edx]
mov word [ebp - 2], ax
add dword [ebp - 0x10], 2
cmp word [ebp - 2], 0
jne 0x40ae4e
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x20]
sar ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
shl ecx, 1
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40af4b
push 5
push str._dp_
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040a860
movzx ecx, al
test ecx, ecx
je 0x40aee9
mov edx, dword [ebp - 8]
cmp edx, dword [0x41541c]
jb 0x40aede
mov eax, dword [0x41541c]
shl eax, 1
push eax
push 0x4374d0
mov ecx, dword [ebp - 0xc]
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
mov edx, dword [0x41541c]
mov dword [ebp - 0x1c], edx
jmp 0x40aefe
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 8]
jle 0x40af44
mov ecx, dword [ebp - 0x14]
shl ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 8]
shl ecx, 1
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
jmp 0x40af46
jmp 0x40af4b
jmp 0x40ae95
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x40af60
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0x80
mov eax, dword [ebp - 4]
shl eax, 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40b079
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp + 8], 0
je 0x40afe6
cmp dword [ebp + 0xc], 0
je 0x40afe6
push 0x4378e0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 0x4134ec
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
sub edx, 1
cmp dword [ebp - 8], edx
je 0x40afe6
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040a810
test eax, eax
je 0x40afe6
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp - 8], 0xffffffff
jne 0x40b00f
push 0x4376d8
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 0x4134ec
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x40b026
cmp dword [ebp + 0xc], 0
je 0x40b026
mov edx, dword [ebp - 4]
sub edx, 1
cmp dword [ebp - 8], edx
je 0x40b03d
cmp dword [ebp + 8], 0
je 0x40b032
cmp dword [ebp + 0xc], 0
jne 0x40b072
mov eax, dword [ebp - 4]
sub eax, 2
cmp dword [ebp - 8], eax
jne 0x40b072
mov ecx, dword [ebp - 4]
shl ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
shl eax, 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
jmp 0x40b074
jmp 0x40b079
jmp 0x40af87
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x40bb9d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x40bba7
repz ret
jmp fcn.0040bf1f
Function at 0x403910
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x403971
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x403954
cmp edi, 2
jb 0x403954
cmp byte [esi], cl
jne 0x403954
cmp byte [esi + 1], cl
jne 0x403954
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x42a638]
jmp 0x403925
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x42a638]
test edi, edi
jne 0x403925
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x4039a0
cmp cl, 0x23
jne 0x403987
cmp byte [esi], cl
jne 0x403987
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x42a638]
test cl, cl
jne 0x403978
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x403ab0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x403ac4
mov dword [ebx], 0
mov edx, 0x42a414
call fcn.004039b0
mov esi, eax
test esi, esi
je 0x403bb2
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x403ba8
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403ba8
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x403ba8
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403ba8
mov eax, dword [0x4315e8]
test eax, eax
je 0x403b3c
inc dword [eax + 0x36c]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x403ba8
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x403b8d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x4315e8]
add esp, 4
test eax, eax
je 0x403b7a
dec dword [eax + 0x36c]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x403b9f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405090
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc4]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0xcc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x42a638]
sub esi, 1
jne 0x4050c3
mov eax, dword [0x4315e8]
not ebx
cmp dword [eax + 0x1be0], ebx
jne 0x4050f2
mov dword [eax + 0x1be4], ebx
cmp dword [eax + 0x1c1c], ebx
jne 0x405101
mov byte [eax + 0x1c20], 1
cmp dword [eax + 0x1bc8], ebx
jne 0x40511a
push ecx
push edi
mov edx, 4
mov ecx, ebx
call fcn.00414030
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042847b
mov esp, ebp
pop ebp
ret 4
Function at 0x409350
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x40938d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x409373
cmp byte [esi], bl
jne 0x409373
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x42a638]
test bl, bl
jne 0x409364
pop edi
pop esi
not ecx
pop ebx
jmp fcn.004092f0
Function at 0x413120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x2fa8], 0
lea esi, [edi + 0x2fac]
je 0x4131a2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x41315c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00414c40
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00403d40
mov edx, dword [esi]
mov ecx, 0x4315e4
push dword [edi + 0x2fa8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x2fb4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00403d40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41c9ca
mov eax, dword [0x4315e8]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x41c9bd
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x41c9fb
mov eax, dword [0x4315e8]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x41c9ee
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x41ca2c
mov eax, dword [0x4315e8]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x41ca1f
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x41ca79
mov eax, dword [0x4315e8]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x41ca6c
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x41caaa
mov eax, dword [0x4315e8]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x41ca9d
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x41cadb
mov eax, dword [0x4315e8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x41cace
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.0041f230