joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4081fb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00407ed6
test eax, eax
jne 0x40827b
push esi
push dword [ebp + 0xc]
call fcn.0041cc00
push 4
call fcn.0041d030
pop ecx
pop ecx
push 0x699078
push 0x84
call fcn.00414d90
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x408278
push edi
push esi
call fcn.00414d90
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x408270
push esi
call fcn.00414d90
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x408270
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.0041d040
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x40827f
Capabilities:
Accept command line arguments

Disassembly:
push 0x7c
mov eax, 0x617d0c
call fcn.004107f4
lea ecx, [ebp - 0x88]
call fcn.004ac780
xor esi, esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x88]
call fcn.004ace19
push str._fsdqweoo87
lea ecx, [ebp - 0x88]
call fcn.004ad326
test al, al
je 0x408353
xor eax, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0x8100
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 1
push eax
call fcn.004084ab
mov ecx, eax
call fcn.004b2fa0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x50], esi
ja 0x408322
lea eax, [ebp - 0x78]
push eax
call fcn.0040842c
mov ecx, eax
call fcn.004b27c6
push eax
lea ecx, [ebp - 0x60]
call fcn.00402e0f
lea ecx, [ebp - 0x78]
call fcn.0040390c
cmp dword [ebp - 0x50], esi
jbe 0x40833e
sub esp, 0x18
lea eax, [ebp - 0x60]
mov ecx, esp
push eax
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.00403a71
lea ecx, [ebp - 0x30]
call fcn.0040265f
lea ecx, [ebp - 0x60]
call fcn.0040390c
lea ecx, [ebp - 0x30]
call fcn.0040390c
jmp 0x40841b
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x48], vtable.WTL::CMessageLoop.0
pop ecx
xor eax, eax
mov dword [ebp - 0x34], esi
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], esi
movups xmmword [ebp - 0x44], xmm0
rep stosd dword es:[edi], eax
mov byte [ebp - 4], 3
call fcn.004016c4
push eax
lea ecx, [ebp - 0x80]
call fcn.004087b9
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 4
push eax
call fcn.00407f61
call fcn.004016c4
push eax
lea ecx, [ebp - 0x7c]
call fcn.004087b9
push 0x6990a0
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 5
push 0x6990b0
push eax
call fcn.0040893e
add esp, 0xc
mov eax, Ordinal_1
push esi
push eax
push eax
push eax
push eax
push esi
push 0x96880000
push dword [ebp - 0x7c]
push esi
mov esi, 0x6ba8a4
mov ecx, esi
call fcn.0041e000
test eax, eax
jne 0x4083e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x408403
mov ecx, esi
call fcn.0041ddc0
push 1
push 1
mov ecx, esi
call fcn.0041e8b0
lea ecx, [ebp - 0x48]
call fcn.00407d04
call fcn.00407fb5
lea ecx, [ebp - 0x7c]
call fcn.0040879e
lea ecx, [ebp - 0x80]
call fcn.0040879e
lea ecx, [ebp - 0x48]
call fcn.00407cc7
lea ecx, [ebp - 0x88]
call fcn.004ac7c0
call fcn.0041079e
ret
Function at 0x408a37
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x6ab06c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push reloc.gdiplus.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408aae
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x408aae
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 1
push eax
push 4
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fc89
leave
ret
Function at 0x408b27
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push 0x2c4
mov eax, 0x617e0e
call fcn.004107f4
mov esi, edx
mov edi, ecx
sub esp, 0x18
mov eax, esp
push edi
push eax
call fcn.004b371b
pop ecx
pop ecx
lea eax, [ebp - 0x284]
push eax
call fcn.004b0fcc
add esp, 4
xor ebx, ebx
mov dword [ebp - 4], ebx
push esp
call fcn.004b3945
pop ecx
lea eax, [ebp - 0x26c]
push eax
call fcn.004b0fcc
add esp, 0x1c
lea eax, [ebp - 0x26c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x284]
call fcn.00408f0a
test eax, eax
je 0x408d26
lea ecx, [ebp - 0x254]
call fcn.00408aba
push 0x20c
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 2
push ebx
push eax
call fcn.004cd760
add esp, 0xc
lea eax, [ebp - 0x224]
push 0x105
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 8
pop edi
cmp dword [ebp - 0x240], edi
lea eax, [ebp - 0x254]
push ebx
cmovae eax, dword [ebp - 0x254]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x408d1b
lea ecx, [ebp - 0x2cc]
call fcn.004b39bf
lea ecx, [ebp - 0x2cc]
mov byte [ebp - 4], 3
call fcn.004b3ed8
xor eax, eax
mov dword [ebp - 0x22c], ebx
push str._dfwer43243
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x228], 7
mov word [ebp - 0x23c], ax
call fcn.00402d7b
push 0x69923c
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 4
call fcn.00402da2
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x2cc]
call fcn.004b3f84
mov byte [ebp - 4], 5
mov ecx, eax
cmp dword [eax + 0x14], edi
jb 0x408c6a
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x23c]
call fcn.004039d3
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 4
call fcn.0040390c
push 0x699240
lea ecx, [ebp - 0x23c]
call fcn.00402da2
mov eax, esi
cmp dword [esi + 0x14], edi
jb 0x408ca1
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x23c]
push eax
call fcn.004039d3
cmp dword [ebp - 0x228], edi
lea ecx, [ebp - 0x23c]
push ebx
cmovae ecx, dword [ebp - 0x23c]
lea eax, [ebp - 0x254]
cmp dword [ebp - 0x240], edi
push ebx
cmovae eax, dword [ebp - 0x254]
push ecx
push eax
call fcn.004b1d6e
add esp, 0x10
test eax, eax
lea eax, [ebp - 0x254]
setne bl
cmp dword [ebp - 0x240], edi
cmovae eax, dword [ebp - 0x254]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x23c]
call fcn.0040390c
lea ecx, [ebp - 0x2cc]
call fcn.004ac0d7
lea ecx, [ebp - 0x254]
call fcn.0040390c
lea ecx, [ebp - 0x26c]
call fcn.0040390c
lea ecx, [ebp - 0x284]
call fcn.0040390c
mov al, bl
call fcn.0041079e
ret
Function at 0x408fb9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40900f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40900f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x409001
cmp esi, ecx
jae 0x40900f
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x408fef
cmp esi, ecx
jae 0x40900f
cmp word [esi], 0
je 0x40900f
mov eax, esi
jmp 0x409011
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x409242
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 1
mov ecx, dword [edi + 0x798]
mov eax, dword [ecx]
call dword [eax + 0x21c]
mov ecx, dword [edi + 0x79c]
push 0
mov eax, dword [ecx]
call dword [eax + 0x118]
push 0
mov ecx, edi
call fcn.004092e2
lea esi, [edi + 0x34]
mov ebx, 0x201
push ebx
mov ecx, esi
call fcn.00414df0
push eax
mov ecx, esi
call fcn.004153b0
push 0x14
push ebx
mov ecx, esi
call fcn.00414df0
push eax
mov ecx, esi
call fcn.0041d1f0
inc ebx
mov ecx, esi
push ebx
call fcn.00414df0
push eax
mov ecx, esi
call fcn.004153b0
push 0x7d0
push ebx
mov ecx, esi
call fcn.00414df0
push eax
mov ecx, esi
call fcn.0041d1f0
xor eax, eax
push eax
push eax
push edi
push 0x4091b4
push eax
push eax
mov dword [edi + 0x7a8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x7ac], eax
pop edi
pop esi
pop ebx
ret
Function at 0x415470
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x415491
mov ecx, dword [ebp - 4]
or ecx, 8
mov dword [ebp - 4], ecx
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x4154a9
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x4154c1
mov edx, dword [ebp - 4]
or edx, 2
mov dword [ebp - 4], edx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x4154d7
mov ecx, dword [ebp - 4]
or ecx, 4
mov dword [ebp - 4], ecx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x4154ef
mov eax, dword [ebp - 4]
or eax, 0x20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x41c810
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0xa8]
je 0x41c84e
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x108]
je 0x41c84e
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xa8]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x108]
jne 0x41c861
jmp 0x41c9d5
mov edx, dword [ebp - 4]
cmp dword [edx + 0x108], 0
je 0x41c8f3
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x28], 0x17
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x108]
mov edx, dword [ebp - 4]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x108]
mov edx, dword [eax + 0x14c]
call edx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x41c8e6
push 0
push 0
push 0
push str.killfocus
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x108]
push edx
mov ecx, dword [ebp - 4]
call fcn.0041c270
mov eax, dword [ebp - 4]
mov dword [eax + 0x108], 0
cmp dword [ebp + 8], 0
jne 0x41c8fe
jmp 0x41c9d5
cmp dword [ebp + 8], 0
je 0x41c9d5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
call eax
cmp eax, dword [ebp - 4]
jne 0x41c9d5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x108]
call eax
movzx ecx, al
test ecx, ecx
je 0x41c9d5
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x114]
call edx
movzx eax, al
test eax, eax
je 0x41c9d5
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x108], edx
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x48], 0x18
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x40], eax
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x108]
mov edx, dword [ebp - 4]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x108]
mov edx, dword [eax + 0x14c]
call edx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x41c9d5
push 0
push 0
push 0
push str.setfocus
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x108]
push edx
mov ecx, dword [ebp - 4]
call fcn.0041c270
mov esp, ebp
pop ebp
ret 8
Function at 0x41e7a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
push 4
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
push 1
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41e87a
push 0
push 0
push 0
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x41e87a
cmp dword [ebp - 0x24], 0x10
jne 0x41e846
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [eax + 4]
jne 0x41e846
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
lea edx, [ebp - 0x28]
push edx
call fcn.0041d400
add esp, 4
movzx eax, al
test eax, eax
jne 0x41e86d
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x24], 0x12
jne 0x41e875
jmp 0x41e87a
jmp 0x41e7f4
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x24], 0x12
jne 0x41e8a0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x41edf0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x6ab06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x121], 0
mov dword [ebp - 0x120], 0x11c
push 0x118
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.004cd760
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0041ed30
add esp, 0xc
mov edx, dword [ebp - 0x11c]
mov dword [ebp - 0x128], edx
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x114]
mov dword [ebp - 0x130], ecx
cmp dword [ebp - 0x128], 0xa
jb 0x41ee8a
mov byte [ebp - 0x121], 1
jmp 0x41eeac
cmp dword [ebp - 0x128], 6
jne 0x41eeac
movzx edx, byte [ebp - 6]
cmp edx, 1
jne 0x41eeac
cmp dword [ebp - 0x12c], 3
jb 0x41eeac
mov byte [ebp - 0x121], 1
mov al, byte [ebp - 0x121]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fc89
mov esp, ebp
pop ebp
ret
Function at 0x423e20
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x6ab06c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x423e54
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x423e54
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
test eax, eax
jne 0x423e63
jmp 0x423fcc
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x41c], ecx
mov edx, dword [ebp - 0x41c]
mov dword [ebp - 0x418], edx
mov eax, dword [ebp - 0x418]
movzx ecx, word [eax]
test ecx, ecx
je 0x423ebe
mov edx, dword [ebp - 0x418]
movzx eax, word [edx]
cmp eax, 0x2f
je 0x423ea1
mov ecx, dword [ebp - 0x418]
movzx edx, word [ecx]
cmp edx, 0x5c
jne 0x423ead
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp - 0x418]
add ecx, 2
mov dword [ebp - 0x418], ecx
jmp 0x423e78
mov edx, dword [ebp - 0x41c]
mov dword [ebp - 0x424], edx
mov eax, dword [ebp - 0x41c]
cmp eax, dword [ebp + 0xc]
je 0x423f4e
mov ecx, dword [ebp - 0x41c]
sub ecx, dword [ebp + 0xc]
sar ecx, 1
shl ecx, 1
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x414]
push eax
call fcn.004ccc60
add esp, 0xc
mov ecx, dword [ebp - 0x41c]
sub ecx, dword [ebp + 0xc]
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x420], ecx
cmp dword [ebp - 0x420], 0x208
jae 0x423f17
jmp 0x423f1c
call fcn.0041045b
xor edx, edx
mov eax, dword [ebp - 0x420]
mov word [ebp + eax - 0x414], dx
lea ecx, [ebp - 0x414]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00423e20
add esp, 8
mov eax, dword [ebp - 0x424]
add eax, 2
mov dword [ebp - 0x424], eax
mov ecx, 2
imul edx, ecx, 0
mov dword [ebp - 0x428], edx
cmp dword [ebp - 0x428], 0x208
jae 0x423f6a
jmp 0x423f6f
call fcn.0041045b
xor eax, eax
mov ecx, dword [ebp - 0x428]
mov word [ebp + ecx - 0x20c], ax
cmp dword [ebp + 8], 0
je 0x423f98
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.004de117
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.004de0e6
add esp, 8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x423fcc
push 0
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fc89
mov esp, ebp
pop ebp
ret
Function at 0x424d10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x424d2a
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 4], 0xffffffff
je 0x424d34
mov eax, 0x1000000
jmp 0x424e1e
mov edx, dword [ebp - 0xc]
add edx, 0x244
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, dword [ebp - 0xc]
add eax, 0x244
push eax
call fcn.004de139
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx + eax*2 + 0x242]
mov word [ebp - 8], dx
movzx eax, word [ebp - 8]
cmp eax, 0x5c
je 0x424d92
movzx ecx, word [ebp - 8]
cmp ecx, 0x2f
je 0x424d92
push 0x699108
mov edx, dword [ebp - 0xc]
add edx, 0x244
push edx
call fcn.004de0e6
add esp, 8
cmp dword [ebp + 0x10], 1
jne 0x424dd6
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x424dba
mov dword [ebp - 0x10], 1
jmp 0x424dc1
mov dword [ebp - 0x10], 0
mov cl, byte [ebp - 0x10]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
jne 0x424dd6
mov eax, 0x2000000
jmp 0x424e1e
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00429ee0
add esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x424dfc
mov eax, dword [ebp - 0x1c]
jmp 0x424e1e
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0042abd0
add esp, 4
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x424e1c
mov eax, 0x200
jmp 0x424e1e
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x425770
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul ecx, eax, 0
movsx edx, byte [ebp + 0xc]
mov eax, dword [ebp + 8]
xor edx, dword [eax + ecx]
and edx, 0xff
mov ecx, 4
imul eax, ecx, 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax]
shr eax, 8
xor eax, dword [edx*4 + 0x6235c8]
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + edx], eax
mov edx, 4
shl edx, 0
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + ecx]
and ecx, 0xff
mov eax, dword [ebp + 8]
add ecx, dword [eax + edx]
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], ecx
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
imul eax, dword [edx + ecx], 0x8088405
add eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
mov eax, 4
shl eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov ecx, dword [edx + ecx]
shr ecx, 0x18
mov edx, dword [ebp + 8]
xor ecx, dword [edx + eax]
and ecx, 0xff
mov eax, 4
shl eax, 1
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax]
shr eax, 8
xor eax, dword [ecx*4 + 0x6235c8]
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
pop ebp
ret

Function at 0x42a070
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
movzx edx, byte [ecx]
test edx, edx
je 0x42a0bf
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42a0b5
mov edx, dword [ebp + 0x14]
mov byte [edx + 8], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp + 0xc]
jmp 0x42a119
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
cmp ecx, dword [edx + 0x18]
jbe 0x42a0df
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x18]
sub edx, dword [ecx + 0x1c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp + 0x14]
add edx, dword [eax + 0x1c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ccc60
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp - 8]
xor edx, edx
div dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret