joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454660
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x454760
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00454ef0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x4f41a0]
mov dword [esp], ecx
call fcn.0040b720
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x61fa10]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.00453ee0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00453300
add esp, 0x28
ret
call fcn.00460140
jmp fcn.00454660
Function at 0x461400
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x63b6e0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45fbcb
je 0x45fc1e
cmp ebx, 0x20
jbe 0x45fc24
cmp ebx, 0x40
jbe 0x45fc6a
jmp 0x45fd0b
test ebx, ebx
je 0x45fc14
add eax, 0x10
test ax, 0xff0
je 0x45fc00
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x541140]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x541340]
jmp 0x45fbe8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45fbe8
pxor xmm1, xmmword [0x63b6f0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x63b6f0]
pxor xmm2, xmmword [0x63b700]
pxor xmm3, xmmword [0x63b710]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x63b6f0]
pxor xmm2, xmmword [0x63b700]
pxor xmm3, xmmword [0x63b710]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45fd6a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x63b32f], 0
je 0x46141a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45fb90
jmp fcn.004080e0
Function at 0x461420
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40293e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004080e0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.00460140
jmp 0x402900
cmp byte [0x63b32f], 0
je 0x46143b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45fb90
jmp 0x402900
Function at 0x4b10b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b126e
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.00461727
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4b10ea
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x4b1113
lea eax, [0x4f65a0]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.004493f0
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x38]
mov ebx, eax
xor eax, eax
call fcn.00461727
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x54], ecx
movzx ecx, word [esp + 0x6c]
movzx edx, word [esp + 0x70]
shl edx, 0xb
movzx ebx, word [esp + 0x78]
or ebx, edx
movzx edx, byte [esp + 0x75]
test dl, dl
je 0x4b115b
or ebx, 0x80
movzx eax, byte [esp + 0x74]
test al, al
je 0x4b116a
or ebx, 0x100
movzx eax, byte [esp + 0x73]
test al, al
je 0x4b1179
or ebx, 0x200
movzx eax, byte [esp + 0x72]
test al, al
je 0x4b1188
or ebx, 0x400
movzx eax, byte [esp + 0x6e]
test al, al
je 0x4b1197
or ebx, 0xffff8000
movzx eax, byte [esp + 0x76]
test al, al
je 0x4b11a3
or ebx, 0x20
movzx eax, byte [esp + 0x77]
test al, al
je 0x4b11af
or ebx, 0x10
mov word [esp + 0x46], cx
mov word [esp + 0x48], bx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x3c]
lea ecx, [eax + 0xc]
mov edx, dword [esp + 0x40]
mov ebx, dword [esp + 0x38]
cmp edx, ecx
jae 0x4b121a
mov dword [esp + 0x24], eax
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0xc
lea eax, [0x4f65a0]
mov dword [esp + 0x10], eax
call fcn.004494b0
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
add eax, ebx
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.00461e20
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x38]
call fcn.00461be6
add esp, 0x5c
ret
call fcn.00460140
jmp fcn.004b10b0
Function at 0x408688
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4352e4], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x4086a5
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x4086d3
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x4086ae
mov dword [ecx*4 + 0x4352e0], eax
inc ecx
cmp ecx, 0x100
jne 0x4086a7
jmp 0x408699
cmp edx, ebx
je 0x4086ec
inc edx
mov cl, al
shr eax, 8
xor cl, byte [edx - 1]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4352e0]
jmp 0x4086d3
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x40a500
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
or ebp, 0xffffffff
jmp 0x40a522
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40a529
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40a518
mov eax, 1
add ebx, ebx
jne 0x40a53b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40a530
jne 0x40a54c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a530
xor ecx, ecx
sub eax, 3
jb 0x40a560
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40a5d2
mov ebp, eax
add ebx, ebx
jne 0x40a56b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40a578
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40a59c
inc ecx
add ebx, ebx
jne 0x40a588
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40a57d
jne 0x40a599
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a57d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40a5bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40a5ad
jmp 0x40a51e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40a5bc
add edi, ecx
jmp 0x40a51e
pop esi
mov edi, esi
mov ecx, 0x36
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40a5da
cmp byte [edi], 1
jne 0x40a5da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40a5df
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x40a64e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40a60c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa054]
or eax, eax
je 0x40a648
mov dword [ebx], eax
add ebx, 4
jmp 0x40a629
call dword [esi + 0xa05c]
mov ebp, dword [esi + 0xa058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40a682
sub esp, 0xffffff80
jmp 0x401ec0
Function at 0x40d132
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ecx, dword [ebx + 0x3c]
clc
nop
nop
cld
jae 0x40fc81
lodsb al, byte [esi]
popal
add ch, dl
or byte [eax], al
dec dword [edi]
test al, dl
add byte es:[eax], al
push ebp
mov ebp, esp
nop
leave
jmp 0x40debd
pushal
clc
nop
nop
cld
jae 0x40eac5
add byte [eax], al
dec eax
add dh, ch
sbb bh, byte [ecx - 0x7b74ff70]
in al, 0x78
add byte [eax], al
popal
add byte [eax], al
in eax, dx
popal
leave
mov esi, dword [esi]
push ebp
mov ebp, esp
nop
leave
jmp 0x40eb7a
mov ecx, ebx
clc
nop
lodsb al, byte [esi]
inc ebp
add bh, ch
int3
add esi, dword [ebp + 0x24]
mov ecx, dword [ecx + 0x3c]
clc
Function at 0x402e51
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push 8
push ecx
pop eax
pop edx
test al, 1
je 0x402e65
shr eax, 1
xor eax, 0xedb88320
jmp 0x402e67
shr eax, 1
dec edx
jne 0x402e58
mov dword [ecx*4 + 0x4161c0], eax
mov dword [ecx*4 + 0x4181c0], eax
inc ecx
cmp ecx, 0x100
jb 0x402e53
push ebx
push esi
push edi
mov ecx, 0x4165c0
mov edi, 0x101
mov eax, dword [ecx - 0x400]
push 7
push ecx
pop edx
pop esi
movzx ebx, al
shr eax, 8
xor eax, dword [ebx*4 + 0x4161c0]
mov dword [edx], eax
add edx, 0x400
dec esi
jne 0x402e99
add ecx, 4
dec edi
jne 0x402e8e
pop edi
pop esi
pop ebx
ret

Function at 0x402ebb
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4181c4], 0
jne 0x402ec9
call fcn.00402e51
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
or esi, esi
jbe 0x402ef6
test cl, 7
je 0x402ef6
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4161c0]
dec esi
inc ecx
jmp 0x402ed7
cmp esi, 8
jb 0x402f89
push esi
pop edi
shr edi, 3
push ebx
xor eax, dword [ecx]
sub esi, 8
push eax
pop ebx
shr ebx, 0x10
movzx ebx, bl
push eax
pop edx
shr edx, 0x18
mov edx, dword [edx*4 + 0x4171c0]
xor edx, dword [ebx*4 + 0x4175c0]
push eax
pop ebx
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4179c0]
movzx ebx, byte [ecx + 6]
xor edx, dword [ebx*4 + 0x4165c0]
movzx ebx, byte [ecx + 5]
xor edx, dword [ebx*4 + 0x4169c0]
movzx ebx, byte [ecx + 4]
xor edx, dword [ebx*4 + 0x416dc0]
movzx ebx, byte [ecx + 7]
xor edx, dword [ebx*4 + 0x4161c0]
movzx eax, al
xor edx, dword [eax*4 + 0x417dc0]
add ecx, 8
dec edi
push edx
pop eax
jne 0x402f05
pop ebx
jmp 0x402f89
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4161c0]
dec esi
inc ecx
or esi, esi
ja 0x402f75
pop edi
pop esi
ret 0xc

Function at 0x4034a1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00401200
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x403533
push esi
push edi
mov edi, 0x400
push edi
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004071cb
lea eax, [ebp - 0x800]
push eax
call fcn.0040a826
push eax
pop esi
lea eax, [ebp - 0x800]
push eax
call fcn.00407aa8
test al, al
jne 0x40350f
lea eax, [ebp - 0x1000]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1000]
push eax
call fcn.0040a826
lea esi, [esi + eax + 1]
mov eax, 0x104
pop edi
cmp esi, eax
pop esi
jbe 0x403533
push eax
push 0xaf
call fcn.00409b0b
push eax
push 0x414310
call fcn.0040b986
add esp, 0xc
leave
ret 8
Function at 0x4052ec
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30c8
call fcn.00401200
push ebx
push esi
push edi
lea ecx, [ebp - 0x30c8]
call fcn.004039b6
sub edi, edi
push edi
lea eax, [ebp - 0x30c8]
push eax
push dword [ebp + 8]
push edi
call fcn.0040695b
test al, al
je 0x405491
cmp word [ebp - 0x2448], di
je 0x405491
lea eax, [ebp - 0x2448]
push eax
lea eax, [ebp - 0x2cc8]
push eax
call fcn.004072cf
push eax
call fcn.0040eefb
test eax, eax
je 0x405491
lea eax, [ebp - 0x2448]
push eax
push dword [ebp + 8]
call fcn.004072cf
push eax
call fcn.0040eefb
test eax, eax
jne 0x405491
mov word [ebp - 0x800], ax
xor ebx, ebx
mov esi, 0x400
cmp word [ebp - 0x800], di
jne 0x4053e2
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x800]
push eax
call fcn.0040e5a3
push ebx
push str.rtmp_d
push esi
lea eax, [ebp - 0x800]
push eax
call fcn.004072cf
push eax
call fcn.0040aac4
add esp, 0x10
lea eax, [ebp - 0x800]
push eax
push edi
call fcn.00406088
test al, al
je 0x4053ca
xor eax, eax
mov word [ebp - 0x800], ax
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x40537b
cmp word [ebp - 0x800], di
je 0x405491
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1000]
push eax
call fcn.0040e5a3
lea eax, [ebp - 0x2cc8]
push eax
call fcn.004072cf
push eax
lea eax, [ebp - 0x1000]
push eax
call fcn.004072cf
push eax
call fcn.0040a850
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
je 0x405491
lea ecx, [ebp - 0x1c28]
call fcn.00405711
push dword [ebp + 8]
xor bl, bl
push edi
call fcn.00406088
test al, al
jne 0x405458
push 9
push dword [ebp + 8]
lea ecx, [ebp - 0x1c28]
push edi
call fcn.00405a95
mov bl, al
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x800]
push eax
call esi
test bl, bl
je 0x405482
lea ecx, [ebp - 0x1c28]
call fcn.00405783
lea ecx, [ebp - 0x1c28]
call fcn.00405808
lea ecx, [ebp - 0x1c28]
call fcn.004058fd
mov al, 1
jmp 0x405493
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x405920
Capabilities:
Check if file exists

Disassembly:
push ebp
push esp
pop ebp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0xc20], ebx
cmp byte [esi + 0x1c], bl
jne 0x405940
test byte [ebp + 0x10], 4
jne 0x405940
xor al, al
jmp 0x405942
mov al, 1
mov ecx, dword [ebp + 0x10]
shr ecx, 1
and cl, 1
movzx edi, cl
neg edi
sbb edi, edi
and edi, 0xc0000000
add edi, 0x80000000
test byte [ebp + 0x10], 1
je 0x405969
or edi, 0x40000000
mov dword [ebp + 0x10], 1
cmp al, bl
je 0x40597b
mov dword [ebp + 0x10], 3
sub eax, eax
cmp byte [esi + 0x15], bl
setne al
dec eax
and eax, 0x8000000
mov dword [ebp - 4], eax
call fcn.00406a2a
test eax, eax
je 0x4059b5
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x4059b5
cmp word [eax], bx
je 0x4059b5
push ebx
push dword [ebp - 4]
push 3
push ebx
push dword [ebp + 0x10]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x4059c9
push ebx
push dword [ebp - 4]
push 3
push ebx
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
pop edi
cmp edi, 0xffffffff
jne 0x4059e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4059e5
mov dword [esi + 0xc20], 1
cmp edi, 0xffffffff
setne byte [ebp + 0x13]
mov byte [esi + 0x12], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
cmp byte [ebp + 0x13], bl
je 0x405a5d
mov dword [esi + 4], edi
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x405a1e
push edi
call fcn.0040a826
lea eax, [eax + eax + 2]
push eax
push edi
lea eax, [esi + 0x41e]
push eax
call fcn.0040a555
jmp 0x405a27
xor eax, eax
mov word [esi + 0x41e], ax
cmp dword [ebp + 8], ebx
je 0x405a44
push dword [ebp + 8]
call fcn.0040a5a0
inc eax
push eax
push dword [ebp + 8]
lea eax, [esi + 0x1d]
push eax
call fcn.0040a555
jmp 0x405a53
push 0x1000000
lea eax, [esi + 0x1d]
push eax
push edi
call fcn.0040eca0
push dword [esi + 4]
mov ecx, esi
call fcn.0040575c
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x405bb7
Capabilities:
Read file on windows

Disassembly:
push ebp
push esp
pop ebp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 1
mov esi, 0x4e20
jne 0x405bdd
cmp dword [ebp + 0xc], esi
jbe 0x405bd2
mov dword [ebp + 0xc], esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405c2d
mov ecx, edi
call fcn.004058da
test al, al
je 0x405c13
cmp dword [ebp + 0xc], esi
jbe 0x405c13
push esi
push dword [ebp + 8]
push edi
pop ecx
call fcn.00405bb7
jmp 0x405c30
cmp dword [edi + 0xc], 1
jne 0x405c28
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x405c28
xor eax, eax
jmp 0x405c30
or eax, 0xffffffff
jmp 0x405c30
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x405e88
Capabilities:
Write file on windows

Disassembly:
push ebp
push esp
pop ebp
push ecx
cmp dword [ebp + 0xc], 0
push esi
push ecx
pop esi
je 0x405f98
mov eax, dword [esi + 0xc]
or eax, eax
je 0x405eb5
dec eax
je 0x405eaa
dec eax
jne 0x405eb5
push 0xfffffffffffffff4
jmp 0x405eac
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
sub edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0xc], edi
je 0x405f04
cmp dword [ebp + 0xc], edi
jbe 0x405f1f
mov ecx, dword [ebp + 0xc]
sub ecx, edi
mov eax, 0x4000
cmp ecx, eax
jae 0x405edc
push ecx
pop eax
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
je 0x405f1f
add edi, 0x4000
cmp edi, dword [ebp + 0xc]
jb 0x405ecc
jmp 0x405f1b
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
test al, al
jne 0x405f92
cmp byte [esi + 0x14], 0
je 0x405f92
cmp dword [esi + 0xc], 0
jne 0x405f92
push 0
lea eax, [esi + 0x41e]
push eax
lea eax, [esi + 0x1d]
mov edi, 0x418e8c
push eax
push edi
pop ecx
call fcn.00403617
test al, al
je 0x405f7c
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x405ebd
or eax, eax
jbe 0x405ebd
push 0
push esi
pop ecx
call fcn.00405838
mov ecx, dword [ebp - 4]
xor edi, edi
sub eax, ecx
sbb edx, edi
push edx
push eax
mov ecx, esi
call fcn.00405de9
jmp 0x405ebd
lea eax, [esi + 0x41e]
push eax
lea eax, [esi + 0x1d]
push eax
push 0
push 0
push edi
pop ecx
call fcn.004038bd
pop edi
mov byte [esi + 8], 1
pop ebx
pop esi
leave
ret 8

Function at 0x406088
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00406a2a
or eax, eax
je 0x4060b2
mov eax, dword [esp + 8]
or eax, eax
je 0x4060b2
cmp word [eax], 0
je 0x4060b2
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x4060cf
cmp dword [esp + 4], 0
je 0x4060cd
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4060cd
sub eax, eax
inc eax
jmp 0x4060cf
xor eax, eax
ret 8

Function at 0x4060fd
Capabilities:
Get file attributes

Disassembly:
call fcn.00406a2a
test eax, eax
je 0x40611d
mov eax, dword [esp + 8]
test eax, eax
je 0x40611d
cmp word [eax], 0
je 0x40611d
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x406127
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x40612a
Capabilities:
Set file attributes

Disassembly:
push ebp
push esp
pop ebp
call fcn.00406a2a
or eax, eax
je 0x40614f
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x40614f
cmp word [eax], 0
je 0x40614f
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x406161
cmp dword [ebp + 8], 0
je 0x406168
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
jmp 0x40616a
xor al, al
pop ebp
ret 0xc
Function at 0x4061a0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
push esp
pop ebp
push ebx
push esi
call fcn.00406a2a
mov esi, dword [ebp + 0xc]
xor ebx, ebx
or eax, eax
je 0x4061c6
cmp esi, ebx
je 0x4061c6
cmp word [esi], bx
je 0x4061c6
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4061d5
cmp dword [ebp + 8], ebx
je 0x406203
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, ebx
je 0x4061ee
cmp byte [ebp + 0x10], bl
je 0x4061ea
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
call fcn.0040612a
sub eax, eax
jmp 0x406206
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x406203
cmp eax, 3
je 0x406203
sub eax, eax
inc eax
jmp 0x406206
push 2
pop eax
pop esi
pop ebx
pop ebp
ret 0x10