joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012d2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b044]
jne 0x4012dc
repz ret
jmp fcn.004050f3

Function at 0x40ce79
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004054fd
xor ebx, ebx
cmp dword [0x42d4a8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40cf4e
push 0x423b98
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40ceb9
xor eax, eax
jmp 0x40d012
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x423b8c
push edi
call esi
cmp eax, ebx
je 0x40ceb2
push eax
call fcn.0040549a
mov dword [esp], 0x423b7c
push edi
mov dword [0x42d4a8], eax
call esi
push eax
call fcn.0040549a
mov dword [esp], 0x423b68
push edi
mov dword [0x42d4ac], eax
call esi
push eax
call fcn.0040549a
mov dword [0x42d4b0], eax
lea eax, [ebp - 8]
push eax
call fcn.004076f1
test eax, eax
pop ecx
pop ecx
je 0x40cf1c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004052fb
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40cf4e
push 0x423b4c
push edi
call esi
push eax
call fcn.0040549a
cmp eax, ebx
pop ecx
mov dword [0x42d4b8], eax
je 0x40cf4e
push 0x423b34
push edi
call esi
push eax
call fcn.0040549a
pop ecx
mov dword [0x42d4b4], eax
mov eax, dword [0x42d4b4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40cfc7
cmp dword [0x42d4b8], esi
je 0x40cfc7
push eax
call fcn.00405506
pop ecx
call eax
cmp eax, ebx
je 0x40cf94
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x42d4b8]
call fcn.00405506
pop ecx
call eax
test eax, eax
je 0x40cf94
test byte [ebp - 0x18], 1
jne 0x40cfc7
lea eax, [ebp - 0xc]
push eax
call fcn.00407728
test eax, eax
pop ecx
je 0x40cfaf
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004052fb
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40cfbe
or dword [ebp + 0x10], 0x200000
jmp 0x40cff8
or dword [ebp + 0x10], 0x40000
jmp 0x40cff8
mov eax, dword [0x42d4ac]
cmp eax, esi
je 0x40cff8
push eax
call fcn.00405506
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40cff8
mov eax, dword [0x42d4b0]
cmp eax, esi
je 0x40cff8
push dword [ebp - 4]
push eax
call fcn.00405506
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x42d4a8]
call fcn.00405506
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40f5b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
xor ecx, ecx
cmp dword [ebp - 8], 0xffffffff
setne cl
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40f610
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40f62d
xor eax, eax
jmp 0x40f698
mov ecx, dword [ebp - 0xc]
and ecx, 1
je 0x40f63e
mov edx, dword [ebp - 0xc]
xor edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
and eax, 4
je 0x40f64f
mov ecx, dword [ebp - 0xc]
xor ecx, 4
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
and edx, 2
je 0x40f660
mov eax, dword [ebp - 0xc]
xor eax, 2
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0x20
je 0x40f671
mov edx, dword [ebp - 0xc]
xor edx, 0x20
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40f6a0
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004012f0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x40f6ef
cmp dword [ebp + 0xc], 0
jne 0x40f6f9
jmp 0x40f78b
cmp dword [ebp + 0x10], 0
je 0x40f70f
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040234b
add esp, 4
test eax, eax
jne 0x40f713
jmp 0x40f78b
lea edx, [ebp - 0x210]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp + 0x10]
push eax
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.00401412
add esp, 0xc
push 0x424c78
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 4]
push eax
call fcn.004019c9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x40f75f
jmp 0x40f78b
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040209a
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.00402128
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004012d2
mov esp, ebp
pop ebp
ret
Function at 0x40f7a0
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004012f0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x40f7ef
cmp dword [ebp + 0xc], 0
jne 0x40f7f9
jmp 0x40f8c7
cmp dword [ebp + 0x10], 0
je 0x40f80f
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040234b
add esp, 4
test eax, eax
jne 0x40f819
jmp 0x40f8c7
cmp dword [0x42c0a0], 3
jne 0x40f84f
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x424c6c
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.00401412
add esp, 0xc
jmp 0x40f861
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [ebp + 0x10]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.00401412
add esp, 0xc
push 0x424c70
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.004019c9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x40f89b
jmp 0x40f8c7
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040209a
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.00402128
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004012d2
mov esp, ebp
pop ebp
ret

Function at 0x40f8e0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004012f0
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x40f928
cmp dword [ebp + 0xc], 0
jne 0x40f932
jmp 0x40f9db
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
je 0x40f966
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040234b
add esp, 4
test eax, eax
jbe 0x40f966
push 0x424c40
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 4]
push eax
call fcn.004019c9
add esp, 0xc
jmp 0x40f9a9
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x424c48
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.00401412
add esp, 0xc
push 0x424c64
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.004019c9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x40f9d1
mov edx, dword [ebp - 4]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004022be
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00402128
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004012d2
mov esp, ebp
pop ebp
ret
Function at 0x40fd00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, dword [ecx]
and eax, 0xff
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
shr ecx, 8
xor ecx, dword [eax*4 + 0x425308]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0xff
mov edx, dword [ebp + 8]
add ecx, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
imul edx, edx, 0x8088405
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shr edx, 0x18
mov eax, dword [ebp + 8]
xor edx, dword [eax + 8]
and edx, 0xff
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x425308]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret
Function at 0x40fd80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x40fd90
xor eax, eax
jmp 0x40ff2d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x40feee
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x425308]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x425308]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x425308]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x425308]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x425308]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x425308]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x425308]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x425308]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x40fd99
cmp dword [ebp + 0x10], 0
je 0x40ff27
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x425308]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x40fef4
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x40ff30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x84], 0
je 0x40fff2
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x8c]
cmp eax, dword [edx + 0x88]
jb 0x40ff64
xor eax, eax
jmp 0x410062
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x88]
sub eax, dword [edx + 0x8c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jbe 0x40ff87
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x84]
mov eax, dword [ebp - 0x10]
add edx, dword [eax + 0x8c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004014c0
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x8c]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x8c], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x74]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x74], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x78]
push edx
call fcn.0040fd80
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x78], eax
mov eax, dword [ebp - 4]
jmp 0x410062
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x7c], 0
je 0x410056
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x410023
xor eax, eax
jmp 0x410062
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x74]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x74], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x78]
push edx
call fcn.0040fd80
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x78], eax
mov eax, dword [ebp - 0xc]
jmp 0x410062
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0x1000000
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4100d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
movzx edx, byte [ecx + 0x2d]
test edx, edx
je 0x4101b1
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x3c], 0
je 0x410121
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x40]
cmp edx, dword [ebp + 0xc]
jae 0x410121
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00403b09
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x3c], 0
jne 0x41014d
mov edx, dword [ebp + 0xc]
shl edx, 1
push edx
call fcn.00403d0f
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x3c], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x40], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x3c]
push ecx
call fcn.004014c0
add esp, 0xc
mov dword [ebp - 8], 0
jmp 0x410176
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x4101a8
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 8]
mov cl, byte [edx + eax]
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x30
push edx
call fcn.00410090
add esp, 8
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x3c]
mov ecx, dword [ebp - 8]
mov byte [edx + ecx], al
jmp 0x41016d
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x20], 0
je 0x41020c
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
cmp eax, dword [ecx + 0x28]
jb 0x4101d9
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x14], 0x30000
xor eax, eax
jmp 0x410241
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x18]
add eax, dword [ecx + 0x24]
push eax
call fcn.004014c0
add esp, 0xc
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x24], eax
mov eax, dword [ebp + 0xc]
jmp 0x410241
mov edx, dword [ebp - 0x18]
cmp dword [edx + 4], 0
je 0x410235
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
jmp 0x410241
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x14], 0x1000000
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4102d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x410304
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x410304
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
test eax, eax
jne 0x410313
jmp 0x41041e
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x218]
movzx ecx, word [eax]
test ecx, ecx
je 0x410365
mov edx, dword [ebp - 0x218]
movzx eax, word [edx]
cmp eax, 0x2f
je 0x41034b
mov ecx, dword [ebp - 0x218]
movzx edx, word [ecx]
cmp edx, 0x5c
jne 0x410354
mov eax, dword [ebp - 0x218]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x218]
add ecx, 2
mov dword [ebp - 0x218], ecx
jmp 0x410322
mov edx, dword [ebp - 4]
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x4103c8
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
sar ecx, 1
shl ecx, 1
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x420]
push eax
call fcn.004014c0
add esp, 0xc
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
sar ecx, 1
mov word [ebp + ecx*2 - 0x420], 0
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004102d0
add esp, 8
mov ecx, dword [ebp - 0x214]
add ecx, 2
mov dword [ebp - 0x214], ecx
mov word [ebp - 0x210], 0
cmp dword [ebp + 8], 0
je 0x4103ea
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.004013c4
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0040139a
add esp, 8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41041e
push 0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004012d2
mov esp, ebp
pop ebp
ret
Function at 0x410580
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x14]
movzx edx, byte [ecx]
test edx, edx
je 0x4105cf
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4105c5
mov edx, dword [ebp + 0x14]
mov byte [edx + 8], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp + 0xc]
jmp 0x410629
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x14]
cmp ecx, dword [edx + 0x18]
jbe 0x4105ef
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x18]
sub edx, dword [ecx + 0x1c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp + 0x14]
add edx, dword [eax + 0x1c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004014c0
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x410c10
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, dword [ecx]
and eax, 0xff
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4270c8]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0xff
mov edx, dword [ebp + 8]
add ecx, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
imul edx, edx, 0x8088405
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shr edx, 0x18
mov eax, dword [ebp + 8]
xor edx, dword [eax + 8]
and edx, 0xff
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4270c8]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret
Function at 0x410c90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x410ca0
xor eax, eax
jmp 0x410e3d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x410dfe
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4270c8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4270c8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x4270c8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4270c8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4270c8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x4270c8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4270c8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4270c8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x410ca9
cmp dword [ebp + 0x10], 0
je 0x410e37
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4270c8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x410e04
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret