joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6000b857
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.6000b332
and dword [ebp - 4], 0
mov ebx, eax
shl ebx, 2
add esp, 0xc
mov dword [ebp - 8], eax
test ebx, ebx
jle 0x6000b8c9
lea edx, [esi + ebx*4 + 8]
lea ecx, [esi + 8]
mov eax, dword [edx - 8]
mov edi, dword [ecx - 8]
add dword [ebp - 4], 4
mov dword [ecx - 8], eax
mov eax, dword [edx - 4]
mov dword [edx - 8], edi
mov edi, dword [ecx - 4]
mov dword [ecx - 4], eax
mov eax, dword [edx]
mov dword [edx - 4], edi
mov edi, dword [ecx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [edx], edi
mov edi, dword [ecx + 4]
mov dword [ecx + 4], eax
mov dword [edx + 4], edi
sub ebx, 4
add ecx, 0x10
sub edx, 0x10
cmp dword [ebp - 4], ebx
jl 0x6000b888
mov eax, dword [ebp - 8]
cmp eax, 1
jle 0x6000ba3b
lea ecx, [eax - 1]
mov dword [ebp - 4], ecx
mov ecx, 0xff
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + 0x3da3b68]
add esi, 0x10
mov edx, dword [esi]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + 0x3da3b68]
and edi, ecx
mov edi, dword [edi*4 + 0x3da3f68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x3da4768]
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + 0x3da3b68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x3da4368]
movzx ebx, byte [esi + 5]
and edx, ecx
mov edx, dword [edx*4 + 0x3da3b68]
and edx, ecx
xor edi, dword [edx*4 + 0x3da4b68]
mov edx, dword [esi + 4]
mov dword [esi], edi
mov ebx, dword [ebx*4 + 0x3da3b68]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + 0x3da3b68]
and edi, ecx
mov edi, dword [edi*4 + 0x3da3f68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x3da4768]
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + 0x3da3b68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x3da4368]
movzx ebx, byte [esi + 9]
and edx, ecx
mov edx, dword [edx*4 + 0x3da3b68]
and edx, ecx
xor edi, dword [edx*4 + 0x3da4b68]
mov edx, dword [esi + 8]
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + 0x3da3b68]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + 0x3da3b68]
and edi, ecx
mov edi, dword [edi*4 + 0x3da3f68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x3da4768]
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + 0x3da3b68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x3da4368]
movzx ebx, byte [esi + 0xd]
and edx, ecx
mov edx, dword [edx*4 + 0x3da3b68]
and edx, ecx
xor edi, dword [edx*4 + 0x3da4b68]
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + 0x3da3b68]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + 0x3da3b68]
and edi, ecx
mov edi, dword [edi*4 + 0x3da3f68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x3da4768]
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + 0x3da3b68]
and edx, ecx
mov edx, dword [edx*4 + 0x3da3b68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x3da4368]
and edx, ecx
xor edi, dword [edx*4 + 0x3da4b68]
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
jne 0x6000b8dd
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6000c6e4
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 0x100
lea esi, [edi + 0x404]
push 8
dec ebx
push ebx
mov ecx, edi
sub esi, 4
call fcn.6000c667
shl eax, 0x18
push 8
mov dword [esi], eax
pop ecx
mov edx, eax
and edx, 0x80000000
dec ecx
neg edx
sbb edx, edx
and edx, 0x4c11db7
add eax, eax
xor eax, edx
test ecx, ecx
jne 0x6000c70a
push 0x20
push eax
mov ecx, edi
call fcn.6000c667
mov dword [esi], eax
test ebx, ebx
jne 0x6000c6f4
pop edi
pop esi
pop ebx
ret

Function at 0x6000c74b
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x60038494
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x3df4718
call fcn.6003f3b8
sub esp, 0x88
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x74]
push eax
call fcn.60035328
mov byte [ebp - 4], 2
lea eax, [ebp + 0x10]
push eax
call fcn.60032972
test eax, eax
je 0x600384df
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x74]
push eax
call fcn.600353ce
mov dword [ebp - 0x14], ebx
jmp 0x60038668
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.6003292e
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x20]
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.60038023
add esp, 0xc
mov byte [ebp - 4], 4
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.60037fd4
add esp, 0xc
mov byte [ebp - 4], 6
lea esi, [ebp - 0x24]
call fcn.600389e5
mov byte [ebp - 4], 7
lea esi, [ebp - 0x34]
call fcn.600389e5
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x44]
call fcn.60032899
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x44]
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.60037fd4
add esp, 0xc
mov byte [ebp - 4], 9
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.60037fd4
add esp, 0xc
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x74]
call fcn.60032881
mov byte [ebp - 4], 9
lea esi, [ebp - 0x34]
call fcn.600389e5
mov byte [ebp - 4], 8
lea esi, [ebp - 0x24]
call fcn.600389e5
mov byte [ebp - 4], 7
lea esi, [ebp - 0x54]
call fcn.600389e5
push 0x10
pop edi
lea esi, [ebp - 0x24]
call fcn.600388fc
push ebx
mov eax, esi
call fcn.60038a26
pop ecx
mov byte [ebp - 4], 0xb
mov eax, esi
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.60037fd4
add esp, 0xc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x74]
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.60038023
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp + 0x10]
call fcn.60032899
mov byte [ebp - 4], 0xe
push esi
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.60037fd4
add esp, 0xc
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x64]
call fcn.60032881
mov byte [ebp - 4], 0xe
lea esi, [ebp - 0x54]
call fcn.600389e5
mov byte [ebp - 4], 0xd
lea esi, [ebp - 0x34]
call fcn.600389e5
mov byte [ebp - 4], 0xc
lea esi, [ebp - 0x84]
call fcn.600389e5
mov byte [ebp - 4], 0xb
lea esi, [ebp - 0x94]
call fcn.600389e5
mov byte [ebp - 4], 7
lea esi, [ebp - 0x24]
call fcn.600389e5
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x74]
push eax
call fcn.600353ce
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 2
lea esi, [ebp - 0x44]
call fcn.600389e5
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x74]
call fcn.6003540f
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.6003540f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x28
Function at 0x6003975b
Capabilities:
Encode data using xor

Disassembly:
push edi
mov ecx, esi
call fcn.60038e5e
mov edi, dword [esi + 8]
cmp edi, dword [ebx + 8]
jbe 0x60039776
mov eax, ebx
call fcn.60038e3f
test eax, eax
jne 0x60039796
mov eax, dword [ebx + 0xc]
mov ecx, dword [esi + 0xc]
test edi, edi
jbe 0x6003978d
mov dx, word [ecx]
xor word [eax], dx
inc ecx
inc ecx
inc eax
inc eax
dec edi
jne 0x60039780
mov ecx, ebx
call fcn.60038e5e
xor eax, eax
pop edi
ret

Function at 0x60039ac2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [ebx + 8]
push 0x10
pop edi
lea esi, [esp + 0x20]
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], eax
call fcn.600388fc
test eax, eax
jne 0x60039bcd
lea esi, [esp + 0x30]
call fcn.600388fc
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x60039bc0
mov edi, esi
mov esi, dword [ebp + 8]
call fcn.6003895e
lea esi, [esp + 0x20]
call fcn.60038a04
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
add eax, dword [esp + 0x28]
mov ecx, dword [ebx + 8]
lea edi, [eax + ecx + 1]
mov eax, esi
call fcn.60038e3f
mov eax, dword [ebx + 0xc]
and dword [esp + 0xc], 0
mov dword [esp + 0x18], eax
mov edi, dword [esp + 0x2c]
xor edx, edx
cmp dword [esp + 0x14], edx
jbe 0x60039b81
mov ecx, dword [esp + 0x3c]
sub ecx, edi
mov ax, word [esp + 0x10]
mov esi, dword [esp + 0x18]
test word [esi + edx*2], ax
je 0x60039b76
mov esi, dword [esp + 0x38]
test esi, esi
jbe 0x60039b76
mov eax, edi
mov bx, word [ecx + eax]
xor word [eax], bx
inc eax
inc eax
dec esi
jne 0x60039b6a
inc edx
inc edi
inc edi
dec ecx
dec ecx
cmp edx, dword [esp + 0x14]
jb 0x60039b51
cmp dword [esp + 0xc], 0xf
je 0x60039b95
lea eax, [esp + 0x30]
call fcn.60038f6a
shl dword [esp + 0x10], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x10
jb 0x60039b3f
lea ecx, [esp + 0x20]
call fcn.60038e5e
push dword [ebp + 0xc]
mov eax, ecx
push eax
call fcn.60038e83
add esp, 8
lea esi, [esp + 0x30]
call fcn.600389e5
lea esi, [esp + 0x20]
call fcn.600389e5
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6003ca8c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.6003f400
mov edi, eax
pop ecx
test edi, edi
je 0x6003caec
cdq
and edx, 3
add eax, edx
sar eax, 2
xor ecx, ecx
xor edx, edx
test eax, eax
jle 0x6003cab8
xor ecx, dword [esi + edx*4]
inc edx
cmp edx, eax
jl 0x6003cab0
mov edx, edi
and edx, 0x80000003
jns 0x6003cac7
dec edx
or edx, 0xfffffffc
inc edx
shl eax, 2
cmp edx, 1
jne 0x6003cad5
movzx eax, byte [eax + esi]
jmp 0x6003cade
cmp edx, 2
jne 0x6003cae2
movzx eax, word [eax + esi]
xor ecx, eax
jmp 0x6003caea
cmp edx, 3
jne 0x6003caea
xor ecx, dword [eax + esi]
mov eax, ecx
pop edi
pop esi
ret
Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x25d47337
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x24ab117f
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40b458
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov dword [esp + 4], ebx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
mov dword [esp], eax
call fcn.00412360
mov dword [esp + 4], ebx
lea esi, [ebx + eax]
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call fcn.00412360
mov dword [esp + 4], ebx
add eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x24]
mov dword [esp], eax
call fcn.00412360
add eax, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [edi + edi]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], edi
je 0x40b51c
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], ebx
mov eax, dword [eax + edi*4]
mov dword [esp], eax
call fcn.00412360
lea ecx, [ebx + eax]
mov dword [esp], ecx
mov dword [ebp - 0x2c], ecx
call fcn.0040ba50
mov ecx, dword [ebp - 0x2c]
cmp eax, 0xa6caa1c5
jne 0x40b50a
mov dword [esp + 4], ebx
mov eax, dword [esi + 0x1c]
mov dword [esp], eax
call fcn.00412360
mov edx, dword [ebp - 0x28]
mov dword [esp + 4], ebx
add eax, ebx
movzx edx, word [edx]
mov eax, dword [eax + edx*4]
mov dword [esp], eax
call fcn.00412360
jmp 0x40b51e
mov dword [esp], ecx
inc edi
call fcn.0040ba50
cmp eax, 0xffe885ef
jne 0x40b4aa
jmp 0x40b4e2
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40b570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov eax, dword [0x417318]
mov dword [ebp - 0x14], eax
mov eax, dword [eax + 0x48e]
test eax, eax
je 0x40b633
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 0x444]
test edx, edx
jne 0x40b633
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], 0
mov esi, dword [eax + ecx + 0x78]
add esi, eax
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x20]
mov ebx, dword [esi + 0x1c]
add ecx, eax
add edi, eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [esi + 0x18]
add ebx, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ebx
xor ebx, ebx
mov edi, dword [ebp - 0x10]
cmp dword [ebp - 0x1c], edi
je 0x40b62a
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x10]
mov esi, dword [edi + esi*4]
cmp word [eax + esi], 0x775a
jne 0x40b625
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x10]
test ebx, ebx
movzx esi, word [edi + esi*2]
jne 0x40b603
mov edi, dword [ebp - 0x18]
mov ebx, dword [edi + esi*4]
add ebx, eax
jmp 0x40b625
mov ecx, dword [ebp - 0x18]
mov edi, dword [ecx + esi*4]
add edi, eax
mov esi, edi
sub edi, ebx
mov ecx, edi
cmp ebx, esi
jbe 0x40b61b
mov edi, ebx
sub edi, esi
mov ecx, edi
test edx, edx
je 0x40b623
cmp edx, ecx
jbe 0x40b625
mov edx, ecx
inc dword [ebp - 0x10]
jmp 0x40b5d2
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x444], edx
add esp, 0x18
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40d8f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ebx, ebx
je 0x40d923
cmp dword [ebp + 0xc], 0
jne 0x40d92a
xor eax, eax
jmp 0x40da08
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, ebx
mov edx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
add edx, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [edx + 0x1c]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
je 0x40d923
lea eax, [ebx + ecx]
mov dword [ebp - 0x40], edx
mov edi, dword [eax + esi*4]
mov dword [esp + 8], 1
mov dword [esp + 4], 0
add edi, ebx
mov dword [ebp - 0x3c], ecx
mov dword [esp], edi
call fcn.0040b9fc
cmp eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
jne 0x40da02
mov eax, dword [ebp - 0x34]
add esi, esi
add esi, ebx
movzx eax, word [esi + eax]
mov esi, dword [ebp - 0x30]
lea eax, [ebx + eax*4]
mov ecx, dword [eax + esi]
add ecx, ebx
mov dword [ebp - 0x24], ecx
cmp ecx, edx
jae 0x40d9a9
mov eax, dword [ebp - 0x24]
jmp 0x40da08
mov eax, dword [ebp - 0x2c]
add eax, ebx
add eax, edx
cmp ecx, eax
jae 0x40d9a4
mov dword [esp], edi
call fcn.00412e48
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x20], ax
inc eax
mov word [ebp - 0x1e], ax
mov eax, dword [0x417318]
mov eax, dword [eax + 0xe0]
test eax, eax
je 0x40d923
lea edx, [ebp - 0x24]
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], ebx
call eax
sub esp, 0x10
test eax, eax
jns 0x40d9a4
jmp 0x40d923
inc esi
jmp 0x40d951
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x412360
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
add ecx, dword [ecx + 0x3c]
movzx eax, word [ecx + 0x14]
lea eax, [ecx + eax + 0x18]
cmp dword [eax + 0x14], edx
ja 0x4123a6
movzx ecx, word [ecx + 6]
imul ecx, ecx, 0x28
add ecx, eax
cmp eax, ecx
je 0x4123a4
mov ebx, dword [eax + 0xc]
cmp edx, ebx
jb 0x41239f
mov esi, dword [eax + 0x10]
add esi, ebx
cmp esi, edx
jbe 0x41239f
add edx, dword [eax + 0x14]
sub edx, ebx
jmp 0x4123a6
add eax, 0x28
jmp 0x412384
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop ebp
ret
Function at 0x404be0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c6a8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5c125c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov dword [ebp - 0x2c], 0
push dword [ecx + 0x248]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x5a3f3c
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], 1
push eax
call fcn.0041afc0
mov ecx, eax
call fcn.0041b2b0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.004448b0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x404c63
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004086f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fce93
mov esp, ebp
pop ebp
ret
Function at 0x40faa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
push esi
mov esi, ecx
test ebx, ebx
je 0x40fac6
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x40fac1
mov eax, dword [ebx]
jmp 0x40fac3
mov eax, ebx
mov byte [eax], 0
call fcn.00417530
test al, al
je 0x40fad7
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov ecx, esi
call fcn.00414e20
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x40faf1
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10000
call fcn.004fd11a
push edi
push 0x10000
mov esi, eax
mov dword [ebp - 8], 0
push 1
push esi
call fcn.0050bebb
mov edi, eax
add esp, 0x14
test edi, edi
je 0x40fb66
mov eax, dword [ebp + 8]
nop
test ebx, ebx
je 0x40fb3c
mov ecx, eax
mov eax, edi
sub ecx, dword [ebp - 8]
cmp ecx, edi
cmovb eax, ecx
mov ecx, ebx
push eax
push esi
call fcn.00408400
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sub eax, ecx
cmp eax, edi
jb 0x40fb7c
push dword [ebp - 0xc]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp - 8], ecx
call fcn.0050bebb
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 8]
test edi, edi
jne 0x40fb20
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0050af04
add esp, 4
test eax, eax
jne 0x40fb7f
mov byte [ebp - 1], 1
jmp 0x40fb83
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 0
push ebx
call fcn.0050b18c
add esp, 4
test esi, esi
je 0x40fb99
push esi
call fcn.004fd115
add esp, 4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x5c125c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x410c2d
cmp byte [ebx + 0x3d], 0
je 0x410c2d
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x410b1d
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004fce93
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x14]
call fcn.00407c30
push 0
push 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.004108e0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
lea eax, [esp + 0x10]
mov ecx, dword [ebx + 0x38]
lea edi, [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
lea esi, [esp + 0x18]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x410bac
sub eax, 1
je 0x410bb0
sub eax, 2
je 0x410c0e
lea ecx, [esp + 0x14]
xor bl, bl
call fcn.004078b0
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004fce93
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3d], 0
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x14]
mov edx, dword [esp + 0x14]
cmp ecx, 0x10
mov esi, dword [esp + 0x10]
cmovae eax, edx
sub esi, eax
je 0x410bef
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [esp + 0x18]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0050b750
add esp, 0x10
cmp esi, eax
jne 0x410b8d
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
cmp byte [ebx + 0x3d], 0
je 0x410c0e
test esi, esi
jne 0x410b50
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.004109b0
jmp 0x410b48
lea ecx, [esp + 0x14]
mov bl, 1
call fcn.004078b0
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004fce93
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004fce93
mov esp, ebp
pop ebp
ret
Function at 0x4142c0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f0
mov eax, dword [0x5c125c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov esi, edx
xor ebx, ebx
push esi
sub esp, 8
mov dword [ebp - 0x2ec], esi
mov dword [ebp - 0x2e8], ebx
push ecx
lea ecx, [ebp - 0x2e4]
call fcn.0041f3d0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0041f4f0
cmp dword [ebp - 0x10], ebx
je 0x414422
nop
cmp byte [ebp - 0x2e4], 0
jne 0x41434a
test bl, 1
je 0x414332
and ebx, 0xfffffffe
lea ecx, [ebp - 0x39c]
mov dword [ebp - 0x2e8], ebx
call fcn.0041ce50
push 0x250
lea eax, [ebp - 0x5ec]
push 0
push eax
call fcn.005033f0
add esp, 0xc
jmp 0x414363
mov ecx, 0x94
lea esi, [ebp - 0x2e0]
lea edi, [ebp - 0x5ec]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2ec]
mov ebx, dword [ebp - 0x5ec]
mov cl, byte [ebp + 8]
test bl, 1
je 0x414399
test cl, cl
jne 0x41437e
mov eax, ebx
shr eax, 4
test al, 1
jne 0x414399
cmp dword [ebp - 0xc], 8
lea ecx, [ebp - 0x20]
mov eax, ebx
cmovae ecx, dword [ebp - 0x20]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov cl, byte [ebp + 8]
shr ebx, 4
test bl, 1
je 0x4143d0
test cl, cl
je 0x4143ea
push 1
mov edx, esi
lea ecx, [ebp - 0x20]
call fcn.004142c0
add esp, 4
test al, al
je 0x41447e
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4143e2
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x41447e
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0041f4f0
lea ecx, [ebp - 0x20]
cmp ecx, eax
je 0x41440a
push 0xffffffffffffffff
push 0
push eax
call fcn.00407e60
lea ecx, [ebp - 0x38]
call fcn.00407740
cmp dword [ebp - 0x10], 0
mov ebx, dword [ebp - 0x2e8]
jne 0x414310
lea ecx, [ebp - 0x20]
call fcn.00407740
mov bl, 1
mov eax, dword [ebp - 0x90]
cmp eax, 0xffffffff
je 0x41443e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x54]
call fcn.0041f8d0
push dword [ebp - 0x54]
call fcn.0056c31e
add esp, 4
mov dword [ebp - 0x54], 0
lea ecx, [ebp - 0x6c]
call fcn.00407740
lea ecx, [ebp - 0x8c]
call fcn.00407740
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fce93
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
call fcn.00407740
xor bl, bl
jmp 0x41442c