joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c1d0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f0
mov eax, dword [0x48e1e0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov esi, edx
xor ebx, ebx
push esi
sub esp, 8
mov dword [ebp - 0x2ec], esi
mov dword [ebp - 0x2e8], ebx
push ecx
lea ecx, [ebp - 0x2e4]
call fcn.0040eee0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0040f0c0
cmp dword [ebp - 0x10], ebx
je 0x40c397
nop
cmp byte [ebp - 0x2e4], 0
jne 0x40c25a
test bl, 1
je 0x40c242
and ebx, 0xfffffffe
lea ecx, [ebp - 0x39c]
mov dword [ebp - 0x2e8], ebx
call fcn.00402030
push 0x250
lea eax, [ebp - 0x5ec]
push 0
push eax
call fcn.0044d9d0
add esp, 0xc
jmp 0x40c273
mov ecx, 0x94
lea esi, [ebp - 0x2e0]
lea edi, [ebp - 0x5ec]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2ec]
mov ebx, dword [ebp - 0x5ec]
mov cl, byte [ebp + 8]
test bl, 1
je 0x40c2a9
test cl, cl
jne 0x40c28e
mov eax, ebx
shr eax, 4
test al, 1
jne 0x40c2a9
cmp dword [ebp - 0xc], 8
lea ecx, [ebp - 0x20]
mov eax, ebx
cmovae ecx, dword [ebp - 0x20]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov cl, byte [ebp + 8]
shr ebx, 4
test bl, 1
je 0x40c2e0
test cl, cl
je 0x40c2fa
push 1
mov edx, esi
lea ecx, [ebp - 0x20]
call fcn.0040c1d0
add esp, 4
test al, al
je 0x40c37e
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x40c2f2
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40c37e
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0040f0c0
lea ecx, [ebp - 0x20]
cmp ecx, eax
je 0x40c31a
push 0xffffffffffffffff
push 0
push eax
call fcn.004041c0
mov eax, dword [ebp - 0x24]
cmp eax, 8
jb 0x40c36d
mov ecx, dword [ebp - 0x38]
inc eax
cmp eax, 0x7fffffff
ja 0x40c3f6
add eax, eax
cmp eax, 0x1000
jb 0x40c364
test cl, 0x1f
jne 0x40c3f6
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x40c3f6
sub ecx, eax
cmp ecx, 4
jb 0x40c3f6
cmp ecx, 0x23
ja 0x40c3f6
mov ecx, eax
push ecx
call fcn.0044a0ad
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x40c397
mov ebx, dword [ebp - 0x2e8]
jmp 0x40c220
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x40c393
inc eax
lea ecx, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
call fcn.004057f0
xor bl, bl
jmp 0x40c3d8
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x40c3d6
mov ecx, dword [ebp - 0x20]
inc eax
cmp eax, 0x7fffffff
ja 0x40c3f6
add eax, eax
cmp eax, 0x1000
jb 0x40c3cd
test cl, 0x1f
jne 0x40c3fb
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x40c400
sub ecx, eax
cmp ecx, 4
jb 0x40c405
cmp ecx, 0x23
ja 0x40c40a
mov ecx, eax
push ecx
call fcn.0044a0ad
add esp, 4
mov bl, 1
lea ecx, [ebp - 0x2e4]
call fcn.0040efc0
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
call fcn.0044fee1
call fcn.0044fee1
call fcn.0044fee1
call fcn.0044fee1
call fcn.0044fee1
int3
Function at 0x40c4c0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x48e1e0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x40c4fd
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
cmp eax, 0x104
jae 0x40c6b3
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.00408210
push 2
sub esp, 8
mov ecx, eax
call fcn.0040d690
cmp eax, 0xffffffff
mov eax, dword [esp + 0x28]
setne bl
cmp eax, 8
jb 0x40c53e
inc eax
lea ecx, [esp + 0x14]
push eax
push dword [esp + 0x18]
call fcn.004057f0
test bl, bl
je 0x40c5cc
lea eax, [esp + 0x2c]
mov ecx, edi
push eax
call fcn.00408210
push dword [ebp + 0xc]
mov esi, eax
mov ecx, edi
lea eax, [esp + 0x18]
push eax
call fcn.004080b0
mov edx, esi
mov ecx, eax
call fcn.0040c1d0
mov ecx, dword [esp + 0x2c]
add esp, 4
mov bl, al
cmp ecx, 8
jb 0x40c589
inc ecx
push ecx
push dword [esp + 0x18]
lea ecx, [esp + 0x1c]
call fcn.004057f0
xor eax, eax
mov dword [esp + 0x28], 7
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x24], 0
cmp eax, 8
jb 0x40c5b8
inc eax
lea ecx, [esp + 0x2c]
push eax
push dword [esp + 0x30]
call fcn.004057f0
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x14], 8
jb 0x40c5d6
mov eax, dword [edi]
jmp 0x40c5d8
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40c4e9
test bl, 1
je 0x40c610
cmp dword [edi + 0x14], 8
jb 0x40c5f9
mov ecx, dword [edi]
jmp 0x40c5fb
mov ecx, edi
mov eax, ebx
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40c6b3
test bl, 0x10
jne 0x40c63c
cmp dword [edi + 0x14], 8
jb 0x40c61d
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x40c66e
push 0x489420
lea ecx, [esp + 0x30]
call fcn.00402710
mov ebx, 1
lea edx, [esp + 0x2c]
push ebx
mov ecx, edi
call fcn.0040c1d0
add esp, 4
test al, al
jne 0x40c672
mov byte [esp + 0xf], al
jmp 0x40c677
mov ebx, dword [esp + 0x10]
mov byte [esp + 0xf], 1
test bl, 1
je 0x40c685
lea ecx, [esp + 0x2c]
call fcn.00402670
cmp byte [esp + 0xf], 0
je 0x40c6b3
cmp dword [edi + 0x14], 8
jb 0x40c694
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x44]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
Function at 0x40cc20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x40cc2e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x40cc40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x40cc4e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40cc62
shr eax, 4
and eax, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x40cc70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x48e1e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x218]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x40cd9d
sub esp, 8
lea eax, [ebp - 0x218]
mov edx, esp
mov dword [edx], eax
cmp word [ebp - 0x218], 0
jne 0x40ccc0
xor ecx, ecx
jmp 0x40ccdf
lea ecx, [ebp - 0x218]
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ccd0
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x248]
call fcn.00407980
sub esp, 8
mov edx, esp
cmp dword [eax + 0x14], 8
jb 0x40ccfc
mov ecx, dword [eax]
jmp 0x40ccfe
mov ecx, eax
mov dword [edx], ecx
lea ecx, [ebp - 0x230]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.00407980
lea ecx, [ebp - 0x230]
call fcn.00408870
lea eax, [ebp - 0x230]
cmp esi, eax
je 0x40cd32
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.004041c0
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x40cd50
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.004057f0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x220], 0
cmp eax, 8
jb 0x40cd8b
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.004057f0
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
Function at 0x40cdb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x48e1e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x210]
mov esi, ecx
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40ce5b
cmp word [ebp - 0x210], 0
je 0x40ce5b
sub esp, 8
lea eax, [ebp - 0x210]
mov edx, esp
mov dword [edx], eax
cmp word [ebp - 0x210], 0
jne 0x40ce1f
xor ecx, ecx
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.00407980
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x210]
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ce30
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.00407980
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x214], 7
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
call fcn.0040cc70
mov ecx, esi
test al, al
je 0x40cead
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
push eax
mov word [esi], ax
lea eax, [ebp - 0x228]
push eax
call fcn.004041c0
jmp 0x40cec4
sub esp, 8
mov eax, esp
mov dword [eax], 0x489424
mov dword [eax + 4], 3
call fcn.00407980
mov eax, dword [ebp - 0x214]
cmp eax, 8
jb 0x40cee2
inc eax
lea ecx, [ebp - 0x228]
push eax
push dword [ebp - 0x228]
call fcn.004057f0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
Function at 0x40cf00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x48e1e0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0
mov esi, edx
cmp dword [edi + 0x14], 8
jb 0x40cf2d
mov ebx, dword [edi]
jmp 0x40cf2f
mov ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40cf71
test al, 0x10
je 0x40cf53
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x40cf5d
mov dword [esi], 0xfffffff7
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.004080b0
cmp dword [edi + 0x14], 8
jb 0x40cf87
mov eax, dword [edi]
jmp 0x40cf89
mov eax, edi
push dword [edi + 0x10]
push eax
push dword [esp + 0x2c]
push ecx
lea ecx, [esp + 0x24]
call fcn.00408e30
test eax, eax
jne 0x40cfad
test esi, esi
je 0x40cff7
mov dword [esi], 0xfffffffc
xor bl, bl
jmp 0x40cffd
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.0040cf00
test al, al
jne 0x40cfc0
xor bl, bl
jmp 0x40cffd
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40cffb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xb7
jne 0x40cfea
push edi
call fcn.0040cc40
add esp, 4
test al, al
jne 0x40cffb
test esi, esi
je 0x40cff7
mov ecx, ebx
call fcn.00414db0
mov dword [esi], eax
xor bl, bl
jmp 0x40cffd
mov bl, 1
mov ecx, dword [esp + 0x28]
cmp ecx, 8
jb 0x40d015
inc ecx
push ecx
push dword [esp + 0x18]
lea ecx, [esp + 0x1c]
call fcn.004057f0
mov ecx, dword [esp + 0x2c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
Function at 0x40d240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov dword [esp + 0x10], 0
cmp dword [eax + 0x14], 8
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x10], ecx
jb 0x40d269
mov eax, dword [eax]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor ecx, ecx
mov dword [esp + 0xc], ecx
test esi, esi
je 0x40d31e
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0xc]
mov ebx, eax
call fcn.0040d5b0
cmp esi, 0xffffffff
je 0x40d2e1
mov dword [esp + 0xc], esi
call fcn.004166a0
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 4]
mov ecx, dword [0x48fd08]
mov dword [esp + 0x1c], eax
test ecx, ecx
jne 0x40d2ce
call fcn.00415ea0
mov ecx, dword [0x48fd08]
push dword [esp + 0x18]
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push dword [esp + 0x20]
push edx
push esi
call dword [eax + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x40d31e
cmp ecx, 0xffffffff
je 0x40d31e
push 0
lea eax, [esp + 0x18]
push eax
push edi
push dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40d31a
mov esi, dword [esp + 0x14]
cmp esi, edi
jne 0x40d31a
mov ecx, dword [esp + 0xc]
jmp 0x40d321
mov ecx, dword [esp + 0xc]
or esi, 0xffffffff
test ecx, ecx
je 0x40d37f
cmp ecx, 0xffffffff
je 0x40d37f
call fcn.004166a0
mov ebx, dword [ebp + 4]
mov edi, eax
mov ecx, dword [0x48fd08]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], eax
test ecx, ecx
jne 0x40d351
call fcn.00415ea0
mov ecx, dword [0x48fd08]
mov eax, dword [ecx]
lea edx, [esp + 0xc]
push edi
push ebx
push edx
push dword [esp + 0x1c]
call dword [eax + 8]
mov ecx, dword [0x48fd08]
mov edi, dword [esp + 0xc]
test ecx, ecx
jne 0x40d37a
call fcn.00415ea0
mov ecx, dword [0x48fd08]
mov edx, dword [ecx]
push edi
call dword [edx]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d390
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x48e1e0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov word [ebp - 0x210], ax
mov esi, ecx
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40d4e2
cmp eax, 0x104
ja 0x40d4e2
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x240]
call fcn.00402710
sub esp, 8
lea eax, [ebp - 0x240]
cmp dword [ebp - 0x22c], 8
mov ecx, esp
cmovae eax, dword [ebp - 0x240]
mov dword [ecx], eax
mov eax, dword [ebp - 0x230]
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x258]
call fcn.00407980
sub esp, 8
mov edx, esp
cmp dword [eax + 0x14], 8
jb 0x40d424
mov ecx, dword [eax]
jmp 0x40d426
mov ecx, eax
mov dword [edx], ecx
lea ecx, [ebp - 0x228]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.00407980
lea ecx, [ebp - 0x228]
call fcn.00408870
lea eax, [ebp - 0x228]
cmp esi, eax
je 0x40d45a
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.004041c0
mov eax, dword [ebp - 0x214]
cmp eax, 8
jb 0x40d478
inc eax
lea ecx, [ebp - 0x228]
push eax
push dword [ebp - 0x228]
call fcn.004057f0
xor eax, eax
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x218], 0
cmp eax, 8
jb 0x40d4b3
inc eax
lea ecx, [ebp - 0x258]
push eax
push dword [ebp - 0x258]
call fcn.004057f0
mov eax, dword [ebp - 0x22c]
cmp eax, 8
jb 0x40d4d1
inc eax
lea ecx, [ebp - 0x240]
push eax
push dword [ebp - 0x240]
call fcn.004057f0
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0044a31d
mov esp, ebp
pop ebp
ret

Function at 0x40d500
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ecx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.00408680
test al, al
jne 0x40d56c
mov ecx, esi
call fcn.00408680
test al, al
jne 0x40d56c
cmp dword [edi + 0x10], 0x104
jae 0x40d56c
cmp dword [esi + 0x10], 0x104
jae 0x40d56c
cmp dword [esi + 0x14], 8
jb 0x40d535
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x40d53d
mov edi, dword [edi]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40d56c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40d56c
test al, 1
je 0x40d566
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov al, 1
pop edi
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret
Function at 0x40d7e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
test ebx, ebx
je 0x40d807
mov dword [ebx + 0x10], 0
cmp dword [ebx + 0x14], 0x10
jb 0x40d802
mov eax, dword [ebx]
jmp 0x40d804
mov eax, ebx
mov byte [eax], 0
call fcn.00408680
test al, al
je 0x40d819
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x489434
push esi
call fcn.0040d170
mov edi, eax
add esp, 8
mov dword [ebp - 0xc], edi
test edi, edi
je 0x40d810
push 0x10000
call fcn.0044a568
add esp, 4
mov dword [ebp - 8], 0
mov esi, eax
push edi
push 0x10000
push 1
push esi
call fcn.00454575
mov edi, eax
add esp, 0x10
test edi, edi
je 0x40d8a6
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x40d87c
mov ecx, eax
mov eax, edi
sub ecx, dword [ebp - 8]
cmp ecx, edi
cmovb eax, ecx
mov ecx, ebx
push eax
push esi
call fcn.00404690
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sub eax, ecx
cmp eax, edi
jb 0x40d8bc
push dword [ebp - 0xc]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp - 8], ecx
call fcn.00454575
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 8]
test edi, edi
jne 0x40d860
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004540e6
add esp, 4
test eax, eax
jne 0x40d8bf
mov byte [ebp - 1], 1
jmp 0x40d8c3
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 0
push ebx
call fcn.0044ffa7
add esp, 4
test esi, esi
je 0x40d8d9
push esi
call fcn.0044a563
add esp, 4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40d910
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.0040cf00
Function at 0x40d920
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x48e1e0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x4001
cmp dword [esi + 0x14], 8
jb 0x40d949
mov eax, dword [esi]
jmp 0x40d94b
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40d964
shr eax, 4
and al, 1
mov eax, 0x24001
cmovne edi, eax
mov ecx, dword [0x490bcc]
xor eax, eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
test ecx, ecx
je 0x40d997
mov eax, dword [ecx]
lea edx, [esp + 0x28]
push edx
call dword [eax + 8]
push edi
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 0
mov word [esp + 0x38], 0
mov byte [esp + 0x3a], 0
call fcn.00415440
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40d9e0
cmp eax, 0xffffffff
je 0x40d9e0
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0xc]
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push dword [eax]
call fcn.00414c90
mov bl, al
jmp 0x40d9e2
xor bl, bl
lea ecx, [esp + 0xc]
call fcn.00414a80
mov ecx, dword [0x490bcc]
test ecx, ecx
je 0x40d9ff
mov eax, dword [ecx]
lea edx, [esp + 0x28]
push edx
call dword [eax + 0xc]
mov eax, dword [esp + 0x24]
cmp eax, 8
jb 0x40da17
inc eax
lea ecx, [esp + 0x10]
push eax
push dword [esp + 0x14]
call fcn.004057f0
xor eax, eax
mov dword [esp + 0x24], 7
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
call fcn.0040d5b0
mov ecx, dword [esp + 0x34]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044a31d
mov esp, ebp
pop ebp
ret
Function at 0x40fe00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x18]
xor ecx, eax
imul eax, ecx, 0x1000193
and edx, eax
mov eax, dword [esi + 0xc]
mov esi, dword [esi + 4]
mov ecx, dword [eax + edx*8]
add edx, edx
mov ebx, dword [eax + edx*4]
lea edx, [eax + edx*4]
cmp ebx, esi
jne 0x40fe5b
mov eax, esi
jmp 0x40fe60
mov eax, dword [edx + 4]
mov eax, dword [eax]
cmp ecx, eax
je 0x40fe83
mov eax, dword [ecx + 8]
cmp eax, dword [edi]
je 0x40fe6f
mov ecx, dword [ecx]
jmp 0x40fe53
mov eax, dword [edi]
cmp eax, dword [ecx + 8]
mov eax, dword [ebp + 8]
pop edi
cmovne ecx, esi
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4101a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x41021c
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x41021c
mov ecx, dword [edi]
nop word [eax + eax]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x410264
cmp esi, eax
jne 0x410210
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x41024a
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x4102c5
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x4102e7
mov edx, dword [ebp + 0x10]
lea edi, [edx + 0xc]
mov dword [esp + 0xc], edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
mov eax, dword [edi + 0x14]
cmp eax, 8
jb 0x410297
inc eax
mov ecx, edi
push eax
push dword [edi]
call fcn.004057f0
mov edx, dword [esp + 0xc]
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push edx
mov word [edi], ax
call fcn.0044a0ad
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x4102cd
mov dword [ecx], edi
jmp 0x4102e7
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x4102e7
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.00410300
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc