joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405a41
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405d0c
test bl, 8
mov dword [ebp - 8], eax
je 0x405a80
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x434f88], eax
jmp 0x405bfd
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405a9a
test eax, eax
je 0x405bab
test bl, 2
je 0x405bab
mov esi, 0x42f250
push edi
push esi
call fcn.0040632f
cmp dword [ebp + 8], 0
je 0x405ab9
push str..
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405abf
push edi
call fcn.00405c50
cmp word [edi], 0
jne 0x405acf
cmp word [0x42f250], 0x5c
jne 0x405ada
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405ba0
cmp word [ebp - 0x22c], 0x2e
jne 0x405b24
cmp word [ebp - 0x22a], 0
je 0x405b83
cmp word [ebp - 0x22a], 0x2e
jne 0x405b24
cmp word [ebp - 0x228], 0
je 0x405b83
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.0040632f
test byte [ebp - 0x258], 0x10
je 0x405b4f
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405b83
push dword [ebp + 0xc]
push edi
call fcn.00405a41
jmp 0x405b83
push dword [ebp - 4]
push edi
call fcn.004059f9
test eax, eax
jne 0x405b7b
cmp dword [ebp - 4], eax
je 0x405b73
push edi
push 0xfffffffffffffff1
call fcn.00405397
push 0
push edi
call fcn.004060f5
jmp 0x405b83
inc dword [0x434f88]
jmp 0x405b83
push edi
push 0xfffffffffffffff2
call fcn.00405397
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405afc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405bab
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405bfd
cmp dword [ebp - 8], esi
jne 0x405bbf
inc dword [0x434f88]
jmp 0x405bfd
push edi
call fcn.00406672
test eax, eax
je 0x405bfd
push edi
call fcn.00405c04
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004059f9
test eax, eax
jne 0x405bf5
cmp dword [ebp - 4], esi
je 0x405bb7
push edi
push 0xfffffffffffffff1
call fcn.00405397
push esi
push edi
call fcn.004060f5
jmp 0x405bfd
push edi
push 0xffffffffffffffe5
call fcn.00405397
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x405d0c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa50
push esi
call fcn.0040632f
push esi
call fcn.00405caf
mov edi, eax
test edi, edi
jne 0x405d2d
xor eax, eax
jmp 0x405d85
push edi
call fcn.004065c3
test byte [0x434efc], 0x80
je 0x405d4a
mov ax, word [edi]
test ax, ax
je 0x405d29
cmp ax, 0x5c
je 0x405d29
sub edi, esi
sar edi, 1
jmp 0x405d64
call fcn.00406672
test eax, eax
je 0x405d5e
test byte [eax], 0x10
je 0x405d29
push esi
call fcn.00405c50
push esi
call sub.KERNEL32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d50
call fcn.00405c04
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405e00
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405e1f
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405e25
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405e54
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40a558]
dec edi
mov dword [ebp - 8], eax
mov eax, dword [0x40a55c]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x405ea4
test edi, edi
jne 0x405e61
and word [esi], di
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x405e9e
Function at 0x405f7b
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
test esi, esi
mov dword [0x4308e8], 0x55004e
mov dword [0x4308ec], 0x4c
mov edi, 0x400
mov ebp, 0x4308e8
je 0x405fd1
push 1
push 0
push esi
call fcn.00405e25
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x4060f0
cmp eax, edi
jg 0x4060f0
mov esi, 0x4310e8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x4060f0
cmp eax, edi
jg 0x4060f0
push esi
push ebp
push str._ls_ls_r_n
push 0x4304e8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x434ef4]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00406351
push 4
push 0xc0000000
push esi
call fcn.00405e25
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x4060f0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4060e9
push edi
push esi
push ebp
call fcn.00405ea8
test eax, eax
je 0x4060e9
push str._Rename__r_n
push esi
call fcn.00405d8a
test eax, eax
jne 0x406087
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x4060bc
add eax, 0xa
push 0x40a560
push eax
call fcn.00405d8a
mov ebp, eax
test ebp, ebp
je 0x4060b8
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x4060a9
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x4060a3
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x4060be
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x4304e8
push eax
call fcn.00405de0
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.00405ed7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4060f5
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406118
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405f7b
pop ecx
pop ecx
inc dword [0x434f90]
ret 8
Function at 0x4061fd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
mov dword [ebp - 4], 0x800
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040619c
mov esi, dword [ebp + 0x14]
test eax, eax
jne 0x40626d
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp + 0xc]
push esi
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0x18]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and word [esi + 0x7fe], 0
test edi, edi
pop edi
jne 0x40626d
cmp dword [ebp + 0xc], 1
je 0x406271
cmp dword [ebp + 0xc], 2
je 0x406271
and word [esi], 0
pop esi
leave
ret 0x14
Function at 0x406699
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4066bd
xor eax, eax
test eax, eax
je 0x4066d0
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4066d0
xor ecx, ecx
jmp 0x4066d3
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4067fc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4318ec], 0
push esi
jne 0x406833
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40680d
mov dword [ecx*4 + 0x4318e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406808
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406864
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4318e8]
xor eax, esi
inc ecx
dec edx
jne 0x406846
pop edi
not eax
pop esi
ret 0xc
Function at 0x401482
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea eax, [ebp - 0x124]
sub esp, 0x14c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [0x436910]
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
or eax, 8
mov dword [esp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x4015a6
mov eax, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea edi, [ebp - 0x11d]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x124]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [ebp - 0x12c]
sub esp, 0x10
test eax, eax
jne 0x401540
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp - 0x124]
je 0x401525
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov eax, 1
jmp 0x4015a6
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00401482
sub esp, 0xc
test eax, eax
je 0x4014db
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov dword [esp], 4
call fcn.00408089
test eax, eax
push edi
je 0x401581
mov edx, dword [0x436910]
mov dword [esp + 0xc], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], edx
call eax
sub esp, 0x10
jmp 0x4015a6
cmp dword [0x436910], 0
mov eax, 1
jne 0x4015a6
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
push edx
push edx
setne al
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x4039e1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
je 0x403a0c
mov eax, dword [0x427c60]
test eax, eax
je 0x403a00
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ecx
mov dword [0x427c60], 0
jmp 0x403a7b
cmp dword [0x427c60], 0
je 0x403a24
mov dword [esp], 0
call fcn.00408638
push edx
jmp 0x403a7b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x436980]
jbe 0x403a7b
mov eax, dword [0x4369a8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x40392c
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
sub esp, 0x14
mov dword [0x427c60], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
push eax
leave
ret

Function at 0x403a7d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x403abe
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 8
Function at 0x4074a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea eax, [ebp - 0x38]
lea edi, [ebp - 0x2c]
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov byte [ebp - 0x2c], 1
mov byte [ebp - 0x2b], 0
mov word [ebp - 0x2a], 4
mov dword [ebp - 0x28], 0x40b650
mov dword [ebp - 0x24], 0x40b650
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x40b640
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
push edx
push edx
je 0x407504
xor eax, eax
jmp 0x407531
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
jne 0x407531
mov dword [esp + 8], edi
mov dword [esp + 4], 0x80000007
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
sub esp, 0xc
test eax, eax
jne 0x407500
call ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x407569
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [0x435280], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x20], 0x435280
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor edx, edx
sub esp, 0x28
test eax, eax
je 0x4075e5
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push eax
mov eax, edx
leave
ret 4

Function at 0x407836
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push edx
je 0x407861
and eax, 0xfffffffe
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push eax
push eax
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x407868
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push edx
mov edx, 0
cmove eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov ebx, dword [ebp - 4]
leave
ret 0xc
Function at 0x4078c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x1c]
mov esi, 0x65
sub esp, 0x2c
mov ebx, dword [ebp + 8]
dec esi
je 0x40791b
mov dword [ebp - 0x1c], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
mov dword [esp + 0xc], ebx
div ecx
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 4], edi
add byte [ebp - 0x1a], dl
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
sub esp, 0x10
test eax, eax
je 0x4078d8
mov eax, ebx
jmp 0x407920
mov byte [ebx], 0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x40792a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea edx, [ebp - 0x14]
sub esp, 0x34
cmp dword [ebp + 0x18], 1
mov ebx, dword [ebp + 0x14]
mov byte [ebx], 0
mov dword [esp + 0x10], edx
sbb eax, eax
mov dword [esp + 8], 0
xor al, al
add eax, 0x20119
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x4079cc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x400
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x4079b5
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
jbe 0x4079b8
mov byte [ebx], 0
mov eax, dword [ebp - 0x14]
mov byte [ebx + 0x3ff], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x407f4b
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [esp], 0x434a80
mov dword [esp + 4], eax
call fcn.00407aa6
push ebx
push ebx
mov dword [esp], 0x434a80
call fcn.00407725
test eax, eax
push esi
jne 0x407f7d
xor eax, eax
jmp 0x407ff5
mov dword [esp], eax
mov ebx, eax
call fcn.00407b27
test byte [0x436984], 0x80
push ecx
je 0x407f9b
mov al, byte [ebx]
test al, al
je 0x407f79
cmp al, 0x5c
je 0x407f79
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub ebx, 0x434a80
mov dword [esp], 0x434a80
call esi
push ecx
cmp ebx, eax
mov dword [esp], 0x434a80
jge 0x407fda
call fcn.00407f13
test eax, eax
push edx
je 0x407fcb
test byte [eax], 0x10
je 0x407f79
mov dword [esp], 0x434a80
call fcn.004076be
push eax
jmp 0x407fa7
call fcn.00407ae2
push eax
mov dword [esp], 0x434a80
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc eax
push edx
setne al
movzx eax, al
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4

Function at 0x407ffe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x126]
sub esp, 0x134
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x40803b
xor edx, edx
cmp byte [ebp + eax - 0x127], 0x5c
sete dl
jmp 0x408042
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, 0x40b440
add eax, ebx
mov dword [esp + 8], edx
mov dword [esp + 4], str._s_s.dll
mov dword [esp], eax
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x408688
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4352e4], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x4086a5
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x4086d3
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x4086ae
mov dword [ecx*4 + 0x4352e0], eax
inc ecx
cmp ecx, 0x100
jne 0x4086a7
jmp 0x408699
cmp edx, ebx
je 0x4086ec
inc edx
mov cl, al
shr eax, 8
xor cl, byte [edx - 1]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4352e0]
jmp 0x4086d3
pop ebx
not eax
pop esi
pop ebp
ret 0xc
Function at 0x1000d9a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x1000da01
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1000d9e4
cmp edi, 2
jb 0x1000d9e4
cmp byte [esi], cl
jne 0x1000d9e4
cmp byte [esi + 1], cl
jne 0x1000d9e4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10071af8]
jmp 0x1000d9b5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10071af8]
test edi, edi
jne 0x1000d9b5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1000da30
cmp cl, 0x23
jne 0x1000da17
cmp byte [esi], cl
jne 0x1000da17
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10071af8]
test cl, cl
jne 0x1000da08
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x1000dc80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x1000dca5
push 0x599
push str.C:UsersUser_source_reposLANRedTrainerLANRedTrainerimguiimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x1000dcb2
mov dword [edi], 0
mov edx, 0x10078648
mov ecx, esi
call fcn.1000da40
mov esi, eax
test esi, esi
je 0x1000dda2
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x1000dd98
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1000dd98
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x1000dd98
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1000dd98
mov eax, dword [0x10089f58]
test eax, eax
je 0x1000dd2c
inc dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1000dd98
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1000dd7d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x10089f58]
add esp, 4
test eax, eax
je 0x1000dd6a
dec dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x1000dd8f
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret