joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a7d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x4de4e4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov esi, dword [ebp + 8]
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x42a89e
cmp eax, 0x104
ja 0x42a89e
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x224]
call fcn.0040cb10
lea eax, [ebp - 0x23c]
push eax
sub esp, 8
lea eax, [ebp - 0x224]
cmp dword [ebp - 0x210], 8
lea ecx, [ebp - 0x254]
mov edx, esp
cmovae eax, dword [ebp - 0x224]
mov dword [edx], eax
mov eax, dword [ebp - 0x214]
mov dword [edx + 4], eax
call fcn.00427600
mov ecx, eax
call fcn.00429350
push eax
mov ecx, esi
call fcn.00427680
lea ecx, [ebp - 0x23c]
call fcn.00401f50
lea ecx, [ebp - 0x254]
call fcn.00401f50
lea ecx, [ebp - 0x224]
call fcn.00401f50
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049510d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0049510d
mov esp, ebp
pop ebp
ret

Function at 0x42a970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4de4e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x42aa1b
cmp word [ebp - 0x20c], 0
je 0x42aa1b
sub esp, 8
lea eax, [ebp - 0x20c]
mov edx, esp
mov dword [edx], eax
cmp word [ebp - 0x20c], 0
jne 0x42a9e0
xor ecx, ecx
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.00427600
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049510d
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20c]
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42a9f0
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.00427600
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049510d
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x224]
call fcn.00427660
lea eax, [ebp - 0x224]
push eax
call fcn.0042aa80
add esp, 4
mov ecx, esi
test al, al
je 0x42aa49
lea eax, [ebp - 0x224]
push eax
call fcn.004275d0
jmp 0x42aa60
sub esp, 8
mov eax, esp
mov dword [eax], 0x4c13ac
mov dword [eax + 4], 3
call fcn.00427600
lea ecx, [ebp - 0x224]
call fcn.00401f50
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0049510d
mov esp, ebp
pop ebp
ret
Function at 0x42aa80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x4de4e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x42ab35
lea eax, [ebp - 0x228]
push eax
sub esp, 8
lea eax, [ebp - 0x210]
mov edx, esp
mov dword [edx], eax
cmp word [ebp - 0x210], 0
jne 0x42aad8
xor eax, eax
jmp 0x42aaf0
lea eax, [ebp - 0x210]
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42aae1
sub eax, esi
sar eax, 1
lea ecx, [ebp - 0x240]
mov dword [edx + 4], eax
call fcn.00427600
mov ecx, eax
call fcn.00429350
push eax
mov ecx, edi
call fcn.00427680
lea ecx, [ebp - 0x228]
call fcn.00401f50
lea ecx, [ebp - 0x240]
call fcn.00401f50
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049510d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0049510d
mov esp, ebp
pop ebp
ret

Function at 0x42ad30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x42ad3e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x42add0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], 0
cmp dword [eax + 0x14], 8
push edi
mov edi, dword [ebp + 0x10]
jb 0x42adf0
mov eax, dword [eax]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.0042ad50
mov eax, dword [ebp - 4]
test eax, eax
je 0x42ae44
cmp eax, 0xffffffff
je 0x42ae44
push 0
lea ecx, [ebp - 8]
push ecx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42ae41
mov esi, dword [ebp - 8]
cmp esi, edi
jne 0x42ae41
mov eax, dword [ebp - 4]
jmp 0x42ae47
mov eax, dword [ebp - 4]
or esi, 0xffffffff
test eax, eax
je 0x42ae71
cmp eax, 0xffffffff
je 0x42ae71
call fcn.00429770
push eax
mov eax, dword [ebp + 4]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
call fcn.00429d70
push dword [ebp - 4]
call fcn.00429a00
add esp, 0x14
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x433600
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movsd xmm0, qword [0x4e3500]
ucomisd xmm0, qword [0x4c17c8]
mov dword [ebp - 4], 0
lahf
test ah, 0x44
jnp 0x43362d
fld qword [0x4e3500]
mov esp, ebp
pop ebp
ret
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 2
mov dword [ebp - 4], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [0x4e3510]
test cl, 1
jne 0x43366e
rdtsc
or ecx, 1
mov dword [0x4e3508], eax
mov dword [0x4e3510], ecx
mov dword [0x4e350c], edx
test cl, 2
jne 0x43369e
lea eax, [ebp - 0xc]
or ecx, 2
xorps xmm0, xmm0
mov dword [0x4e3510], ecx
push eax
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0xc]
mov dword [0x4e3518], eax
mov eax, dword [ebp - 8]
mov dword [0x4e351c], eax
rdtsc
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0xc]
movq qword [ebp - 0xc], xmm0
push eax
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 4]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [0x4e3518]
mov edx, dword [ebp - 8]
sbb edx, dword [0x4e351c]
call fcn.00494d80
mov edx, dword [ebp - 0x10]
movaps xmm1, xmm0
mov ecx, dword [ebp - 0x14]
movsd qword [ebp - 0xc], xmm1
call fcn.00494dc0
movsd xmm1, qword [ebp - 0xc]
divsd xmm1, xmm0
movsd xmm0, qword [0x4c17d0]
comisd xmm0, xmm1
movsd qword [ebp - 0xc], xmm1
jbe 0x433723
fldz
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub edi, dword [0x4e3508]
mov ecx, edi
sbb ebx, dword [0x4e350c]
mov edx, ebx
call fcn.00494d80
divsd xmm0, qword [ebp - 0xc]
pop edi
pop esi
pop ebx
movsd qword [0x4e3500], xmm0
fld qword [0x4e3500]
mov esp, ebp
pop ebp
ret

Function at 0x4337c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
push edi
test esi, esi
je 0x4337e8
call fcn.00430440
cmp eax, 1
jl 0x4337e8
mov dword [ebp - 4], 0x10000
jmp 0x4337ea
xor esi, esi
push 0xc
call fcn.00494794
mov ecx, dword [ebp + 0xc]
add esp, 4
mov ebx, dword [ebp + 0x10]
mov edi, eax
test ebx, ebx
push 0
push dword [ebp - 4]
mov dword [edi], ecx
setne cl
push edi
push 0x433b50
push esi
mov byte [edi + 4], cl
mov ecx, dword [ebp + 0x14]
push 0
mov dword [edi + 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x433836
push edi
call fcn.0049478f
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x433845
pop edi
mov dword [ebx], eax
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434540
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x4345b1
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x4345b1
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x4345f8
cmp esi, eax
jne 0x4345a5
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x4345de
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x43465b
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x43467d
mov edx, dword [ebp + 0x10]
lea edi, [edx + 0xc]
mov dword [ebp + 0xc], edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
mov eax, dword [edi + 0x14]
cmp eax, 0x10
jb 0x434629
inc eax
mov ecx, edi
push eax
push dword [edi]
call fcn.00406730
mov edx, dword [ebp + 0xc]
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], 0
jb 0x43463f
mov edi, dword [edi]
push edx
mov byte [edi], 0
call fcn.0049478f
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
pop ebp
ret 0xc
cmp eax, esi
jne 0x434663
mov dword [ecx], edi
jmp 0x43467d
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x43467d
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.004379d0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0xc
Function at 0x4346a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 4], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x43471c
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x43471c
mov ecx, dword [edi]
nop dword [eax]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x434760
cmp esi, eax
jne 0x434710
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x434749
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x4347aa
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x4347cc
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
lea ecx, [ebx + 0xc]
mov eax, dword [ebp - 4]
dec dword [eax + 8]
call fcn.00438000
push dword [ebx + 0xc]
call fcn.0049478f
push ebx
mov dword [ebx + 0xc], 0
call fcn.0049478f
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x4347b2
mov dword [ecx], edi
jmp 0x4347cc
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x4347cc
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.00437a70
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4349f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
mov dword [ebp - 8], ecx
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp esi, eax
je 0x434a5e
mov esi, dword [ecx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x434a5e
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x434a7e
cmp esi, eax
jne 0x434a52
mov eax, dword [ebx + 4]
push 0xc
mov edi, dword [eax]
mov eax, dword [edi + 4]
mov dword [ebp - 4], eax
call fcn.00494794
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x434a90
jmp 0x434b49
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edx, [ecx + 4]
mov dword [ecx], edi
test edx, edx
je 0x434a9e
mov eax, dword [ebp - 4]
mov dword [edx], eax
lea eax, [ecx + 8]
test eax, eax
je 0x434aad
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ecx + 8], eax
mov eax, 0x15555554
sub eax, dword [ebx + 8]
cmp eax, 1
jb 0x434b4e
inc dword [ebx + 8]
mov dword [edi + 4], ecx
mov eax, dword [edx]
mov dword [eax], ecx
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x434af4
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 8]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x434b0e
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x434b30
cmp eax, esi
jne 0x434b16
mov dword [ecx], edi
jmp 0x434b30
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x434b30
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.0044cda0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.0049a721
push 0x4c137c
call fcn.00493569
int3
Function at 0x438380
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
mov esi, dword [edi + 0xc]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
mov edx, dword [edi + 4]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
add ecx, ecx
mov ebx, dword [esi + ecx*4]
lea edi, [esi + ecx*4]
mov esi, dword [ebp + 0xc]
cmp ebx, edx
jne 0x4383de
mov ecx, edx
jmp 0x4383e3
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x438432
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x4383f2
mov eax, dword [eax]
jmp 0x4383d6
mov esi, dword [esi]
mov ecx, eax
mov dword [ebp + 0xc], esi
nop dword [eax]
cmp ebx, edx
jne 0x438408
mov esi, edx
jmp 0x43840d
mov esi, dword [edi + 4]
mov esi, dword [esi]
cmp eax, esi
je 0x43841d
mov esi, dword [ebp + 0xc]
cmp esi, dword [eax + 8]
jne 0x43841d
mov eax, dword [eax]
jmp 0x438400
cmp ecx, eax
je 0x438432
mov edx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [edx + 4], eax
mov eax, edx
mov dword [edx], ecx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov dword [eax + 4], edx
pop ebp
ret 8

Function at 0x4384b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x438521
cmp dword [ecx], edi
jne 0x438519
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x438529
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x438529
cmp dword [ecx], edi
jne 0x43852c
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.0049478f
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4388a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x438911
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x438911
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x438955
cmp esi, eax
jne 0x438905
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x43893e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x43898b
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x4389ad
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0xc]
dec dword [ebx + 8]
call fcn.00401f50
push edi
call fcn.0049478f
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
pop ebp
ret 0xc
cmp eax, esi
jne 0x438993
mov dword [ecx], edi
jmp 0x4389ad
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x4389ad
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.00438d60
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0xc
Function at 0x438e00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x438e5b
mov ecx, esi
jmp 0x438e60
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x438e85
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x438e6f
mov eax, dword [eax]
jmp 0x438e53
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
mov ecx, dword [ebp + 8]
cmovne eax, esi
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x439d00
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.00429150
test al, al
jne 0x439d21
mov ecx, dword [ebp + 0xc]
call fcn.00429150
test al, al
jne 0x439d21
pop ebp
jmp fcn.0042ac00
xor al, al
pop ebp
ret

Function at 0x439d50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
test ebx, ebx
je 0x439d73
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x439d6e
mov eax, dword [ebx]
jmp 0x439d70
mov eax, ebx
mov byte [eax], 0
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00429150
test al, al
je 0x439d89
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0x4c1b90
push esi
call fcn.0042aca0
mov edi, eax
add esp, 8
mov dword [ebp - 4], edi
test edi, edi
jne 0x439daa
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10000
call fcn.00494ed4
push edi
push 0x10000
mov esi, eax
mov dword [ebp + 0xc], 0
push 1
push esi
call fcn.004a3b98
mov edi, eax
add esp, 0x14
test edi, edi
je 0x439e1d
mov eax, dword [ebp + 0x10]
test ebx, ebx
je 0x439df3
mov ecx, eax
mov eax, edi
sub ecx, dword [ebp + 0xc]
cmp ecx, edi
cmovb eax, ecx
mov ecx, ebx
push eax
push esi
call fcn.00405e20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
sub eax, ecx
cmp eax, edi
jb 0x439e33
push dword [ebp - 4]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp + 0xc], ecx
call fcn.004a3b98
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 0x10]
test edi, edi
jne 0x439dd7
mov ebx, dword [ebp - 4]
push ebx
call fcn.004a369c
add esp, 4
test eax, eax
jne 0x439e36
mov byte [ebp + 0xf], 1
jmp 0x439e3a
mov ebx, dword [ebp - 4]
mov byte [ebp + 0xf], 0
push ebx
call fcn.0049d836
add esp, 4
test esi, esi
je 0x439e50
push esi
call fcn.00494a38
add esp, 4
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret