joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb72ed0
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07c4c], 1
jne 0xb72f37
or dword [0xc07c4c], 1
mov dword [0xc07ae0], 0xf5d0f5e2
mov dword [0xc07ae4], 0xfdd0ffe6
mov dword [0xc07ae8], 0xeaebeeea
mov dword [0xc07aec], 0xe6e9d0fd
mov dword [0xc07af0], 0xfcd0eae3
mov dword [0xc07af4], 0xa7fbeefb
mov dword [0xc07af8], 0xeee9afa6
mov dword [0xc07afc], 0xebeae3e6
mov byte [0xc07b00], 0x8f
xor eax, eax
mov cl, byte [eax + 0xc07ae0]
xor cl, 0x8f
mov byte [eax + 0xc07ba0], cl
inc eax
cmp eax, 0x21
jb 0xb72f39
mov eax, 0xc07ba0
ret

Function at 0xb72f54
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07c48], 1
jne 0xb72fd2
or dword [0xc07c48], 1
mov dword [0xc07b04], 0xf5d0f5e2
mov dword [0xc07b08], 0xfdd0ffe6
mov dword [0xc07b0c], 0xeaebeeea
mov dword [0xc07b10], 0xf7ead0fd
mov dword [0xc07b14], 0xeceefdfb
mov dword [0xc07b18], 0xe6e9d0fb
mov dword [0xc07b1c], 0xfbd0eae3
mov dword [0xc07b20], 0xeae7d0e0
mov dword [0xc07b24], 0xa6a7ffee
mov dword [0xc07b28], 0xe6eee9af
mov dword [0xc07b2c], 0x8febeae3
xor eax, eax
mov cl, byte [eax + 0xc07b04]
xor cl, 0x8f
mov byte [eax + 0xc07bc4], cl
inc eax
cmp eax, 0x2c
jb 0xb72fd4
mov eax, 0xc07bc4
ret

Function at 0xb72fef
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07c44], 1
jne 0xb73059
or dword [0xc07c44], 1
mov dword [0xc07b30], 0xe3e6eec9
mov dword [0xc07b34], 0xfbafebea
mov dword [0xc07b38], 0xfdecafe0
mov dword [0xc07b3c], 0xeafbeeea
mov dword [0xc07b40], 0xfceaebaf
mov dword [0xc07b44], 0xeee1e6fb
mov dword [0xc07b48], 0xe1e0e6fb
mov dword [0xc07b4c], 0xfbeeffaf
mov dword [0xc07b50], 0x8fafb5e7
xor eax, eax
mov cl, byte [eax + 0xc07b30]
xor cl, 0x8f
mov byte [eax + 0xc07bf0], cl
inc eax
cmp eax, 0x24
jb 0xb7305b
mov eax, 0xc07bf0
ret

Function at 0xb73076
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07c40], 1
jne 0xb7309a
or dword [0xc07c40], 1
mov dword [0xc07b54], 0xfbeeffaf
mov dword [0xc07b58], 0x8fafb5e7
xor eax, eax
mov cl, byte [eax + 0xc07b54]
xor cl, 0x8f
mov byte [eax + 0xc07c14], cl
inc eax
cmp eax, 8
jb 0xb7309c
mov eax, 0xc07c14
ret

Function at 0xb730b7
Capabilities:
Encode data using xor

Disassembly:
test byte [0xc07c3c], 1
jne 0xb7311d
or dword [0xc07c3c], 1
mov dword [0xc07b5c], 0xe3e6eec9
mov dword [0xc07b60], 0xfbafebea
mov dword [0xc07b64], 0xfdecafe0
mov dword [0xc07b68], 0xeafbeeea
mov dword [0xc07b6c], 0xfbfae0af
mov dword [0xc07b70], 0xaffbfaff
mov dword [0xc07b74], 0xeae3e6e9
mov word [0xc07b78], 0xafb5
mov byte [0xc07b7a], 0x8f
xor eax, eax
mov cl, byte [eax + 0xc07b5c]
xor cl, 0x8f
mov byte [eax + 0xc07c1c], cl
inc eax
cmp eax, 0x1f
jb 0xb7311f
mov eax, 0xc07c1c
ret
Function at 0xb7bbb0
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
mov eax, dword [eax + 0x1f0]
test cl, cl
je 0xb7bbd2
lea esp, [esp]
imul eax, eax, 0xf4243
movzx ecx, cl
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0xb7bbc0
ret
Function at 0xb8b7f0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
pop ebp
ret

Function at 0xb8b8e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1c]
mov edx, 0x40
cmp eax, edx
jb 0xb8b8f9
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x20], 0x80
mov edi, 1
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
mov ecx, 0x38
cmp eax, ecx
jbe 0xb8b952
cmp eax, edx
jae 0xb8b93e
lea esp, [esp]
mov byte [eax + esi + 0x20], bl
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
cmp eax, edx
jb 0xb8b930
lea edx, [esi + 0x20]
push esi
call fcn.00b8b2f0
add esp, 4
mov dword [esi + 0x1c], ebx
mov ecx, 0x38
cmp dword [esi + 0x1c], ecx
jae 0xb8b96f
jmp 0xb8b960
mov edx, dword [esi + 0x1c]
mov byte [esi + edx + 0x20], bl
add dword [esi + 0x1c], edi
cmp dword [esi + 0x1c], ecx
jb 0xb8b960
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x58], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x59], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x5a], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x5c], cl
movzx ecx, byte [esi]
mov byte [esi + 0x5d], dl
lea edx, [esi + 0x20]
push esi
mov byte [esi + 0x5e], al
mov byte [esi + 0x5f], cl
call fcn.00b8b2f0
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
add esp, 4
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
pop edi
pop ebx
mov byte [eax + 0x13], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0xb8d580
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0xb8d680
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x28]
mov edx, 0x40
cmp eax, edx
jb 0xb8d699
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x2c], 0x80
mov edi, 1
add dword [esi + 0x28], edi
mov eax, dword [esi + 0x28]
mov ecx, 0x38
cmp eax, ecx
jbe 0xb8d6f2
cmp eax, edx
jae 0xb8d6de
lea esp, [esp]
mov byte [eax + esi + 0x2c], bl
add dword [esi + 0x28], edi
mov eax, dword [esi + 0x28]
cmp eax, edx
jb 0xb8d6d0
lea eax, [esi + 0x2c]
push esi
call fcn.00b8bad0
add esp, 4
mov dword [esi + 0x28], ebx
mov ecx, 0x38
cmp dword [esi + 0x28], ecx
jae 0xb8d70f
jmp 0xb8d700
mov edx, dword [esi + 0x28]
mov byte [esi + edx + 0x2c], bl
add dword [esi + 0x28], edi
cmp dword [esi + 0x28], ecx
jb 0xb8d700
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x64], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x65], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x67], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x66], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x68], cl
movzx ecx, byte [esi]
mov byte [esi + 0x6a], al
lea eax, [esi + 0x2c]
push esi
mov byte [esi + 0x69], dl
mov byte [esi + 0x6b], cl
call fcn.00b8bad0
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
mov byte [eax + 0x13], cl
movzx edx, byte [esi + 0x1f]
mov byte [eax + 0x14], dl
movzx ecx, byte [esi + 0x1e]
mov byte [eax + 0x15], cl
movzx edx, byte [esi + 0x1d]
mov byte [eax + 0x16], dl
movzx ecx, byte [esi + 0x1c]
mov byte [eax + 0x17], cl
movzx edx, byte [esi + 0x23]
mov byte [eax + 0x18], dl
movzx ecx, byte [esi + 0x22]
mov byte [eax + 0x19], cl
movzx edx, byte [esi + 0x21]
mov byte [eax + 0x1a], dl
movzx ecx, byte [esi + 0x20]
mov byte [eax + 0x1b], cl
movzx edx, byte [esi + 0x27]
mov byte [eax + 0x1c], dl
movzx ecx, byte [esi + 0x26]
add esp, 4
mov byte [eax + 0x1d], cl
movzx edx, byte [esi + 0x25]
mov byte [eax + 0x1e], dl
movzx ecx, byte [esi + 0x24]
pop edi
pop ebx
mov byte [eax + 0x1f], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0xb8ebc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x23c], 0
jne 0xb8ed14
mov eax, dword [esi + 0x240]
cmp eax, 0x10
jge 0xb8ed14
test eax, eax
js 0xb8ed14
mov eax, dword [esi + 0x234]
push eax
call fcn.00b90dd0
add esp, 4
test eax, eax
jne 0xb8ed19
mov ecx, dword [esi + 0x240]
mov eax, dword [ebp + 0x10]
lea edx, [ecx + eax]
cmp edx, 0xc
jbe 0xb8ec1a
or dword [esi + 0x238], 1
push ebx
push edi
xor edi, edi
test ecx, ecx
jne 0xb8ec75
mov ecx, eax
and ecx, 0xfffffff0
mov dword [ebp + 8], ecx
jbe 0xb8ec6e
lea ebx, [esi + 0x1f4]
xor eax, eax
mov edx, dword [ebp + 0xc]
lea ecx, [eax + edi]
mov ecx, dword [ecx + edx]
xor dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jb 0xb8ec34
push ebx
push esi
call fcn.00b90d40
add esp, 8
add dword [esi + 0x248], 0x80
adc dword [esi + 0x24c], 0
add edi, 0x10
cmp edi, dword [ebp + 8]
jb 0xb8ec32
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
add ebx, edi
jmp 0xb8ec78
mov ebx, dword [ebp + 0xc]
cmp edi, eax
jae 0xb8ed0d
sub eax, edi
mov dword [ebp + 8], eax
mov ecx, 1
lea ebx, [ebx]
mov al, byte [ebx]
mov edx, dword [esi + 0x240]
mov byte [esi + edx + 0x224], al
add dword [esi + 0x240], ecx
add ebx, ecx
cmp dword [esi + 0x240], 0x10
jne 0xb8ed03
lea edi, [esi + 0x1f4]
mov eax, edi
mov ecx, 4
lea ecx, [ecx]
movzx edx, byte [eax + 0x30]
xor byte [eax], dl
movzx edx, byte [eax + 0x31]
xor byte [eax + 1], dl
movzx edx, byte [eax + 0x32]
xor byte [eax + 2], dl
movzx edx, byte [eax + 0x33]
xor byte [eax + 3], dl
add eax, 4
dec ecx
jne 0xb8ecc0
push edi
push esi
call fcn.00b90d40
xor eax, eax
add esp, 8
add dword [esi + 0x248], 0x80
mov dword [esi + 0x240], eax
adc dword [esi + 0x24c], eax
mov ecx, 1
sub dword [ebp + 8], ecx
jne 0xb8ec90
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret
mov eax, 0x10
pop esi
pop ebp
ret
Function at 0xb90b90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], edi
cmp eax, edi
je 0xb90c34
push esi
mov eax, dword [ebp + 0x10]
dec dword [ebp + 0xc]
test eax, eax
je 0xb90bc1
call eax
dec dword [ebp - 8]
call fcn.00bab9c8
mov esi, eax
call fcn.00bab9c8
cmp esi, eax
jne 0xb90be0
xor edi, 1
call fcn.00bab9c8
cmp esi, eax
je 0xb90bd4
call fcn.00bab9c8
mov esi, eax
call fcn.00bab9c8
cmp esi, eax
jne 0xb90bfc
xor ebx, 1
call fcn.00bab9c8
cmp esi, eax
je 0xb90bf0
cmp edi, ebx
je 0xb90bc4
mov eax, dword [ebp - 4]
lea ecx, [eax + eax]
or ecx, edi
cmp dword [ebp - 8], 0
mov dword [ebp - 4], ecx
jne 0xb90bc1
mov eax, dword [ebp + 8]
mov dl, cl
mov byte [eax], dl
inc eax
cmp dword [ebp + 0xc], 0
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 8
jne 0xb90bb5
mov eax, dword [ebp - 0xc]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xb90d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
add eax, eax
lea edx, [ecx + eax*8 + 0x258]
push 0x10
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.00ba9f10
add esp, 0xc
mov esi, 1
mov edx, 0x100
movzx ecx, byte [esi + edi]
mov ebx, dword [ebp + 8]
add ecx, edx
xor eax, eax
add ecx, ecx
lea ecx, [ebx + ecx*8 + 0x258]
jmp 0xb90d90
mov ebx, dword [ecx]
xor dword [ebp + eax - 0x10], ebx
add eax, 4
add ecx, 4
cmp eax, 0x10
jl 0xb90d90
add edx, 0x100
inc esi
cmp edx, 0x1000
jl 0xb90d74
push 0x10
lea edx, [ebp - 0x10]
push edx
push edi
call fcn.00ba9f10
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb9a514
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov eax, edx
xor eax, dword [ebp + 0x10]
shr ecx, 5
inc ecx
cmp edx, ecx
jb 0xb9a54b
push esi
push edi
mov esi, dword [ebp + 8]
movzx esi, byte [esi + edx - 1]
mov edi, eax
shl edi, 5
add esi, edi
mov edi, eax
shr edi, 2
add esi, edi
sub edx, ecx
xor eax, esi
cmp edx, ecx
jae 0xb9a52b
pop edi
pop esi
pop ebp
ret

Function at 0xb9e6b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
mov esi, 0x200
call fcn.00b92356
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00b921f5
push dword [ebp + 0xc]
push esi
push 1
push eax
call fcn.00ba9afc
add esp, 0x20
jmp 0xb9e712
cmp esi, 0x3fffffff
ja 0xb9e6f6
add esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00b921f5
push dword [ebp + 0xc]
push esi
push 1
push eax
call fcn.00ba9afc
add esp, 0x18
add dword [ebp - 0x208], eax
cmp eax, esi
jae 0xb9e6ec
lea eax, [ebp - 0x210]
push eax
call fcn.00b922be
pop ecx
pop esi
leave
ret

Function at 0xb9e72c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call fcn.00b92356
push dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push eax
call fcn.00b921f5
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push eax
call fcn.00ba9afc
mov esi, eax
add dword [ebp - 0x208], esi
lea eax, [ebp - 0x210]
push eax
call fcn.00b922be
xor eax, eax
add esp, 0x24
cmp eax, esi
sbb eax, eax
neg eax
pop esi
leave
ret

Function at 0xb9ea1d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, eax
call fcn.00b93304
pop ecx
mov esi, eax
sub esi, ebx
push 1
pop edi
je 0xb9eaae
push ebx
push dword [ebp + 8]
dec esi
call fcn.00b93493
pop ecx
pop ecx
cmp eax, 3
jne 0xb9ea77
test edi, edi
je 0xb9eaa3
push 0
push ebx
push dword [ebp + 8]
call fcn.00b9367c
fstp qword [esp + 4]
mov dword [esp], str._.14g
push dword [ebp + 0xc]
call fcn.00ba713d
add esp, 0x10
test eax, eax
jle 0xb9eaa3
xor edi, edi
inc edi
jmp 0xb9eaa5
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
call fcn.00b92e78
add esp, 0xc
test edi, edi
je 0xb9eaa3
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp - 4]
inc edi
push edi
push eax
call fcn.00ba8871
add esp, 0x10
cmp eax, dword [ebp - 4]
je 0xb9eaa5
xor edi, edi
inc ebx
test esi, esi
jne 0xb9ea38
test edi, edi
je 0xb9eab3
xor eax, eax
inc eax
jmp 0xb9eac2
push 0
push 0
push dword [ebp + 8]
call fcn.00b9201f
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402be4
Capabilities:
Write file on windows

Disassembly:
push 0
mov eax, 0x48f93e
call fcn.004543c4
mov esi, ecx
cmp dword [ebp + 8], 0
je 0x402cb2
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x402cb2
mov eax, dword [esi + 0x14c]
test eax, eax
jne 0x402c78
mov eax, dword [esi + 0x148]
add eax, edi
push eax
push dword [esi + 0x144]
call fcn.0046ec10
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x402c55
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.Unable_to_allocate_memory_for_the_new_block_of_data.__Data_has_been_lost_
call fcn.00402d51
and dword [ebp - 4], 0
call fcn.0040d33a
or dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.0040d682
jmp 0x402cb2
mov eax, dword [esi + 0x148]
push edi
push dword [ebp + 8]
add eax, ecx
mov dword [esi + 0x144], ecx
push eax
call fcn.0046ad00
add esp, 0xc
add dword [esi + 0x148], edi
jmp 0x402cb2
push eax
xor esi, esi
push edi
inc esi
push esi
push dword [ebp + 8]
call fcn.0046ee85
add esp, 0x10
cmp eax, edi
je 0x402cb2
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str.Less_data_was_written_than_expected_while_downloading_data_to_a_file_
call fcn.00402d51
mov dword [ebp - 4], esi
call fcn.0040d33a
or dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.0040d61c
call fcn.0045438d
ret 8

Function at 0x40992c
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x224]
sub esp, 0x224
push 0xffffffffffffffff
push 0x4905a5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4bb0c4]
xor eax, ebp
mov dword [ebp + 0x220], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x22c]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, esi
mov dword [ebp - 0x14], esi
push 0x4add08
mov dword [ebp - 0x10], ebx
call fcn.00402d51
lea eax, [ebp + 0x18]
mov dword [ebp - 4], ebx
push eax
push 0x104
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4099ba
lea edx, [ebp + 0x18]
lea ecx, [ebp]
call fcn.00404cab
push eax
mov ecx, esi
call fcn.00402d04
lea ecx, [ebp]
call fcn.00402dd0
sub esp, 0x18
mov edi, 0x4ae9a8
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.00402d51
sub esp, 0x18
mov dword [ebp - 4], 1
mov ecx, esp
push esi
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00402efd
mov byte [ebp - 4], bl
call fcn.0040431b
add esp, 0x30
test al, al
jne 0x409a04
push edi
call fcn.0046eef0
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00402ea4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x220]
xor ecx, ebp
call fcn.00453227
add ebp, 0x224
leave
ret 4
Function at 0x40afc4
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x240]
sub esp, 0x240
push 0xffffffffffffffff
push 0x4909ed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4bb0c4]
xor eax, ebp
mov dword [ebp + 0x23c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x248]
lea ecx, [ebp + 0x18]
mov edi, 0x4add08
mov dword [ebp - 0x10], esi
push edi
call fcn.00402d51
xor ebx, ebx
lea eax, [ebp + 0x30]
push ebx
push 0x28
push eax
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40b095
lea eax, [ebp]
push eax
call fcn.0040a8f0
push eax
lea ecx, [ebp + 0x18]
call fcn.00402d04
lea ecx, [ebp]
call fcn.00402dd0
sub esp, 0x18
lea eax, [ebp + 0x18]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00402efd
call fcn.004040fd
add esp, 0x18
test al, al
je 0x40b0b1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.Unable_to_get_the_users_home_directory.
call fcn.00402d51
mov byte [ebp - 4], 1
call fcn.0040d33a
mov ecx, eax
mov byte [ebp - 4], bl
call fcn.0040d682
push edi
mov ecx, esi
call fcn.00402d51
jmp 0x40b159
lea edx, [ebp + 0x30]
lea ecx, [ebp]
call fcn.00404cab
push eax
lea ecx, [ebp + 0x18]
call fcn.00402d04
lea ecx, [ebp]
call fcn.00402dd0
sub esp, 0x18
lea eax, [ebp + 0x18]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00402efd
lea ecx, [ebp]
call fcn.004050f1
add esp, 0x18
lea ecx, [ebp + 0x18]
push eax
call fcn.00402d04
lea ecx, [ebp]
call fcn.00402dd0
sub esp, 0x18
lea eax, [ebp + 0x18]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00402efd
call fcn.00409e17
sub esp, 0x18
mov dword [ebp - 0x10], esp
mov ecx, esp
cmp al, 1
jne 0x40b125
push str.Added_username_s__from_the_OS_path_to_the_list_of_filtered_symbols.
call fcn.00402d51
mov byte [ebp - 4], 2
call fcn.0040d33a
mov ecx, eax
mov byte [ebp - 4], bl
call fcn.0040d4dc
jmp 0x40b142
push str.Failed_to_extract_a_username_from_the_users_home_path___Wont_be_able_to_filter_it_
call fcn.00402d51
mov byte [ebp - 4], 3
call fcn.0040d33a
mov ecx, eax
mov byte [ebp - 4], bl
call fcn.0040d682
mov byte [ebp - 0x10], bl
lea eax, [ebp + 0x18]
push dword [ebp - 0x10]
mov ecx, esi
mov dword [esi + 0x10], ebx
push eax
mov dword [esi + 0x14], ebx
call fcn.00402f6b
lea ecx, [ebp + 0x18]
call fcn.00402dd0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x23c]
xor ecx, ebp
call fcn.00453227
add ebp, 0x240
leave
ret 4
Function at 0x40c3d8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40c3ff
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406160
jmp 0x40c4b4
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x40c421
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x40c423
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x40c4a8
jg 0x40c438
test esi, esi
je 0x40c4a8
test ecx, ecx
jl 0x40c481
jg 0x40c442
test eax, eax
je 0x40c481
cmp edi, ecx
jg 0x40c456
jl 0x40c44c
cmp esi, eax
jae 0x40c456
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.0046ad00
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x40c484
mov edx, dword [ebp + 8]
test edi, edi
jl 0x40c4a8
jg 0x40c48e
test esi, esi
je 0x40c4a8
cmp dword [ebx + 0x4c], 0
je 0x40c4a8
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.0046ee85
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc