joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ad330
Capabilities:
Authenticate hmac

Disassembly:
push 0x733481
call fcn.0079de44
mov eax, dword [0xbb88aa82]
pop ebx
sal byte [eax + 0x1d2e1723], cl
je 0x5ad38e
inc esi
jl 0x5ad370
inc esp
add bh, byte [0xfa5c4135]
mul bh
imul edx, dword [eax - 0xde6646c], 0x6b
les esp, [esi - 0x271f72bb]
sbb ecx, dword [ebx - 0x59697ff5]
xor dl, byte [edx]
imul edx, dword [edx], 0xffffffb6
mov esp, 0x939bbde6
xchg ebx, eax
push edx
jecxz 0x5ad33f
pop esi
out 0x57, al
xchg dword [eax + eax*4 + 0x2c], eax
in al, 0x36
add cl, byte [eax - 0x45]
mov byte [0x931418b7], al
and ah, byte [esi]
out dx, al
cmp dword [esi - 0x19], eax
loop 0x5ad3c7
sub byte [ecx + 0x58498788], 0xf
push ds
bound ebx, qword [ecx - 0x6f]
test eax, 0x58498788
nop dword [edx + 0x59]
xchg ecx, eax
xchg edi, eax
cmp cl, 0xef
cmp edi, dword [edi - 0x6a]
lcall 0x3226, 0x69994d07
xchg byte [eax + 0x78], ah
adc dword [eax + 0x7d2d885d], edi
sti
enter 0xffffffffffffb4f0, 0x5c
dec esi
push ebp
xchg dword [edi + 0x53], ebx
shl dword [ebx], cl
arpl word [ebx + 0x21fafa3b], dx
into
fild word [ebp + 0x3b270c58]
cmp eax, 0x3affa987
cmp edi, dword [0x3affa987]
je 0x5ad402
int 0xcf
aam 0x34
pop ds
std
invalid
mov edx, 0xdc47b2a3
mov ebx, 0xc9134c79
mov edx, 0x37d4fe0f
adc byte [ebx], bh
dec esp
jnp 0x5ad46c
in eax, dx
dec esp
hlt
mov esi, 0x74ccc5a3
movsd dword es:[edi], dword [esi]
lock xor byte [0xcccccca7], bl
int3

Function at 0x5beaf0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateDirectoryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5beb18
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x5beb18
xor eax, eax
jmp 0x5beb1d
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x5c0660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x33
mov byte [ebp - 0x10], 0x34
mov byte [ebp - 0xf], 0x35
mov byte [ebp - 0xe], 0x36
mov byte [ebp - 0xd], 0x37
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 0x39
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x62
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x66
mov eax, dword [ebp + 0xc]
shl eax, 1
cmp eax, dword [ebp + 0x14]
jbe 0x5c06bc
or eax, 0xffffffff
jmp 0x5c0709
jmp 0x5c06c7
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jae 0x5c0707
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
sar ecx, 4
and ecx, 0xf
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp + ecx - 0x14]
mov byte [eax + edx*2], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
and eax, 0xf
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov al, byte [ebp + eax - 0x14]
mov byte [edx + ecx*2 + 1], al
jmp 0x5c06be
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x5c5570
Capabilities:
Check http status code

Disassembly:
pushfd
mov bh, 0x4f
add byte [ebx + 0x68c35de5], cl
push 0x97c3b6
invalid
retf 0x1d88
push 0x97c3b6
call fcn.0079de44
push esi
in al, 0x13
inc dword [edi]
dec esi
cdq
push ebp
or byte [ecx - 0x3fd4e082], dh
mov dh, 0x63
movsb byte es:[edi], byte gs:[esi]
enter 0xffffffffffff9a4e, 0x69
sub al, 0x86
cmp al, 0xc8
leave
shl dword [0x655c2e11], 1
jo 0x5c55a0
push dword [ebx - 0x3b]
jae 0x5c5568
adc ecx, esp
int3

Function at 0x5d2de0
Capabilities:
Check for software breakpoints

Disassembly:
push 0xb05753
call fcn.0079de44
xlatb
idiv byte [0x4b2a72b7]
and eax, 0xd9def809
shl dword [ebp - 0x1e4b3500], 1
pushal
push esi
popal
mov dh, 0xe1
outsd dx, dword [esi]
mov bh, 0x3c
rcr byte [ebx - 0x6551b6ee], 1
xchg edx, eax
dec esp
push 0xffffffffffffffb8
mov byte [edi + 0x7fb2b206], dl
mov dh, 0x37
dec ecx
cld
out 0xe3, al
adc dh, byte [ecx + 0x356aedec]
push 0x35
mov ch, 0x99
sbb ebp, esp
aam 0x28
lea eax, [ebx + 0x7f]
pop eax
pop esp
inc ebp
call [ecx]
shl ecx, cl
dec esi
sbb ebx, edx
loope 0x5d2e81
add al, 0xfe
jno 0x5d2e1f
mov bh, 0xbb
lodsd eax, dword [esi]
jnp 0x5d2e61
add eax, 0xe9ca2613
mov dword [0x19d], eax
dec ebp
leave
cmp eax, 0x48962772
jno 0x5d2e6b
retf 0x67e9
xor al, 0x56
jne 0x5d2e0c
mov eax, 0xa54afd73
jae 0x5d2e53
dec edx
movsd dword es:[edi], dword [esi]
add ebp, ebx
push ss
push eax
js 0x58f69bda
pop eax
std
retf 0xc49c
cmp byte [esi + 0x1e], dh
lahf
jb 0x5d2e2f
inc eax
jbe 0x5d2e3f
mov dh, 0xff
std
push es
insb byte es:[edi], dx
and byte [ecx], ch
add byte [esi + 0x38397097], bl
invalid

Function at 0x5de3e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jle 0x5de41b
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x5de413
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x5de41d
inc edx
add eax, 0x28
cmp edx, esi
jl 0x5de403
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5de890
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x3c]
movzx ecx, word [edi + eax + 0x14]
add edi, eax
xor edx, edx
xor ebx, ebx
lea esi, [ecx + edi + 0x18]
cmp dx, word [edi + 6]
jb 0x5de8c3
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push eax
call fcn.005de6d0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
cmp ecx, eax
jb 0x5de8e4
mov edx, dword [esi + 8]
add edx, eax
cmp ecx, edx
jb 0x5de8f7
movzx eax, word [edi + 6]
inc ebx
add esi, 0x28
cmp ebx, eax
jl 0x5de8c0
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x7e620c
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
test dl, dl
je 0x7e621e
add esp, 0xfffffff0
call fcn.0040a278
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0x3e8
mov eax, dword [ebp - 4]
mov byte [eax + 0x14], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 1
cmp dword [0x7fc9ec], 0
jne 0x7e6274
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, 0x7e61a4
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x7f4ec4], eax
add dword [0x7fc9ec], 1
jno 0x7e6282
call fcn.004098b4
mov eax, dword [ebp - 4]
mov edx, dword [0x7fc9ec]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x7e62a6
call fcn.0040a2d0
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x7e74a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040bb28
xor eax, eax
push ebp
push 0x7e7686
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040c560
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0xc]
call fcn.007e6a90
lea eax, [ebp - 0xc]
call fcn.0040c008
mov edx, 1
dec edx
test eax, eax
je 0x7e7507
cmp edx, dword [eax - 4]
jb 0x7e750c
call fcn.004098ac
inc edx
lea eax, [eax + edx - 1]
mov dword [0x800d10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x7e752d
mov eax, dword [ebp - 0x10]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jns 0x7e7539
call fcn.004098ac
mov dword [0x800d14], eax
pushal
mov esi, dword [0x800d10]
mov ecx, dword [0x800d14]
xor al, al
xor ah, ah
mov bl, 0x17
mov bh, 0x78
mov dl, 0x59
mov dh, 0x88
cmp al, 0
jne 0x7e755d
xor byte [esi], bl
cmp al, 1
jne 0x7e7563
xor byte [esi], bh
cmp al, 2
jne 0x7e7569
xor byte [esi], dl
cmp al, 3
jne 0x7e756f
xor byte [esi], dh
inc esi
inc al
cmp al, 4
jne 0x7e7578
xor al, al
loop 0x7e7557
popal
mov eax, 0x7fca64
mov edx, 0x104
call fcn.0040c8b0
mov eax, dword [0x7fca64]
call fcn.0040c724
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
cmp eax, 0xffff
jbe 0x7e75ab
call fcn.004098ac
mov word [0x800d0c], ax
movzx edx, word [0x800d0c]
mov eax, 0x7fca64
call fcn.0040c8b0
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
lea eax, [ebp - 0x1c]
mov edx, dword [0x7fca64]
call fcn.0040c988
mov edx, dword [ebp - 0x1c]
mov eax, 0x800d18
call fcn.004080e0
call fcn.00407140
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x7e75fe
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov eax, 0x800d18
call fcn.00409040
call fcn.00407140
push 0
lea eax, [ebp - 0xc]
call fcn.0040c008
mov edx, 1
dec edx
test eax, eax
je 0x7e7629
cmp edx, dword [eax - 4]
jb 0x7e762e
call fcn.004098ac
inc edx
lea edx, [eax + edx - 1]
mov ecx, 1
mov eax, 0x800d18
call fcn.004082dc
call fcn.00407140
mov eax, 0x800d18
call fcn.004082fc
call fcn.00407140
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7e768d
lea eax, [ebp - 0x1c]
call fcn.0040ba34
lea eax, [ebp - 0x18]
call fcn.0040ba58
lea eax, [ebp - 0xc]
call fcn.0040ba58
lea eax, [ebp - 4]
call fcn.0040ba34
pop eax
jmp eax
Function at 0x406220
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3290
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x4e9154]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x28], esi
call fcn.004065d0
add esp, 4
push 0x15
push 0x4bf860
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00406f30
push eax
lea ecx, [ebp - 0x24]
call fcn.004051d0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x4062b7
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4062ad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406347
push edx
push ecx
call fcn.0043e828
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
cmp dword [ebp - 0x10], 8
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push 0
push eax
push 0
mov dword [ebp - 0x2c], 7
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0xe
push str._scan_info.dat
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 1
call fcn.00406f30
push eax
mov ecx, esi
call fcn.004051d0
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x406335
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40632b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40634c
push edx
push ecx
call fcn.0043e828
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.004850e9
call fcn.004850e9
int3

Function at 0x406360
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b32b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x4e9154]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x10], esi
call fcn.004065d0
add esp, 4
push 0x15
push 0x4bf860
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00406f30
push eax
mov ecx, esi
call fcn.004051d0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4063eb
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4063e1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406412
push edx
push ecx
call fcn.0043e828
add esp, 8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4063f5
mov eax, dword [esi]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.004850e9
int3
Function at 0x406510
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b32b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x4e9154]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x10], esi
call fcn.004065d0
add esp, 4
push 4
push str.log
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00406f30
push eax
mov ecx, esi
call fcn.004051d0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40659b
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406591
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4065c2
push edx
push ecx
call fcn.0043e828
add esp, 8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4065a5
mov eax, dword [esi]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.004850e9
int3

Function at 0x4065d0
Capabilities:
Create directory
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b32eb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4e9154]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0x20a
push 0
push eax
mov dword [ebp - 0x238], esi
call fcn.00481c80
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406654
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.004071c0
push 8
push 0x4bf84c
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0
call fcn.00406f30
push eax
mov ecx, esi
call fcn.004051d0
mov edx, dword [ebp - 0x220]
cmp edx, 8
jb 0x4066d3
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4066c9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406704
push edx
push ecx
call fcn.0043e828
add esp, 8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4066dd
mov eax, dword [esi]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043e83b
mov esp, ebp
pop ebp
ret
call fcn.004850e9
int3
Function at 0x407680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3398
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4e9154]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0043e7f8
mov edi, eax
add esp, 4
test edi, edi
je 0x407724
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0043a1d9
add esp, 4
mov dword [edi + 4], eax
jmp 0x407726
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00404d90
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x407787
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x407787
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x4077aa
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x4077cd
cmp byte [ebp + 0xc], 0
je 0x4077b9
push esi
call fcn.0043a716
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x4077d9
mov esi, str.ios_base::badbit_set
jmp 0x4077e9
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.00407810
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00405600
push 0x4db2ec
lea eax, [ebp - 0x30]
push eax
call fcn.00480d63
int3
Function at 0x40a420
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b374b
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
push ebx
push esi
push edi
mov eax, dword [0x4e9154]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov byte [ebp - 0xd], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push esi
push edi
call fcn.00439760
add esp, 0xc
cmp eax, 1
jne 0x40a59b
call fcn.004417a0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x40a597
push 0xa3
push str.d:jenkins.jenkinsworkspacepay_groupduplicate_file_cleanduplicate_file_clean_clientduplicate_file_mgrduplicate_file_mgr_srcduplicate_file_scancalc_hash.cc
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], al
call fcn.004070c0
push 3
push 0x4bfab8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.004070c0
mov byte [ebp - 4], 1
call fcn.004417a0
mov edi, eax
lea ecx, [ebp - 0xdc]
push 0x27
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00408fc0
mov esi, eax
push str._error__updating_XXH64_state
push esi
mov byte [ebp - 4], 2
call fcn.00409510
mov eax, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xdc]
call fcn.00409720
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x40a555
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40a54b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a5d0
push edx
push ecx
call fcn.0043e828
add esp, 8
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x40a597
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40a58d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a5d5
push edx
push ecx
call fcn.0043e828
add esp, 8
mov byte [ebp - 0xd], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
sub esi, dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [ebx + 0x18], esi
push ebx
adc dword [ebx + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004850e9
call fcn.004850e9
int3
Function at 0x40b040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3778
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4e9154]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0043e7f8
mov edi, eax
add esp, 4
test edi, edi
je 0x40b0e3
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0043a1d9
add esp, 4
mov dword [edi + 4], eax
jmp 0x40b0e5
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00408ba0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x40b145
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x40b145
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x40b169
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x40b18b
cmp byte [ebp + 0xc], 0
je 0x40b178
push esi
call fcn.0043a716
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x40b197
mov esi, str.ios_base::badbit_set
jmp 0x40b1a7
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.00407810
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00405600
push 0x4db2ec
lea eax, [ebp - 0x30]
push eax
call fcn.00480d63
int3
Function at 0x417430
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4e9154]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x2c], 0x32000
push esi
push eax
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x24], 0
call fcn.00438dd0
add esp, 4
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 8
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4174c2
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmovae eax, dword [ebp - 0x1c]
push eax
push 0x32000
push str.min_size
push 0x4bfebc
call esi
cmp dword [ebp - 8], 8
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push 0
push str.un_exclude
push 0x4bfebc
mov dword [ebp - 0x28], 0
call esi
test eax, eax
setne byte [ebp - 0x24]
mov esi, dword [ebp + 8]
movups xmm0, xmmword [ebp - 0x2c]
mov edx, dword [ebp - 8]
movups xmmword [esi], xmm0
cmp edx, 8
jb 0x417502
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4174f8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417513
push edx
push ecx
call fcn.0043e828
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043e83b
mov esp, ebp
pop ebp
ret
call fcn.004850e9
int3

Function at 0x41c030
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edi + 0x18]
imul ecx, ecx, 0x1000193
pop edi
pop esi
and eax, ecx
pop ebp
ret 4