joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450200
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x4502eb
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4502da
jg 0x450240
test edx, edx
je 0x4502da
nop dword [eax]
call fcn.0044ab50
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x450297
jg 0x450257
test esi, esi
je 0x450297
cmp ebx, eax
jg 0x450267
jl 0x450261
cmp edi, esi
jae 0x450267
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xc]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [esp + 0x18]
call fcn.00544130
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x10]
jmp 0x4502bc
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4502d4
mov eax, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
add eax, esi
mov dword [esp + 0x10], eax
test ebx, ebx
jg 0x450240
jl 0x4502d4
test edi, edi
jne 0x450240
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x45030d
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x45030f
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x4503c5
jg 0x45032a
test esi, esi
je 0x4503c5
test eax, eax
jl 0x450373
jg 0x450334
test ebx, ebx
je 0x450373
cmp edi, eax
jg 0x450344
jl 0x45033e
cmp esi, ebx
jae 0x450344
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.00544130
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 0x2c]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x45037a
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test edi, edi
jl 0x4503c5
jg 0x450384
test esi, esi
je 0x4503c5
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x4503c5
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x4503b0
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [esp + 0x1c]
call fcn.0054984f
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4578e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56fdb0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5e8ea4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x28], ecx
jb 0x457931
mov esi, dword [edi]
lea ebx, [eax + eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x457951
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x457940
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edx
mov esi, dword [ebx + 4]
mov dword [ebp - 0x24], ecx
lea eax, [eax + ecx*8]
mov dword [ebp - 0x1c], eax
cmp esi, dword [eax]
je 0x4579d1
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x4579d1
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
jb 0x457986
mov edx, dword [edx]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x457990
mov ecx, dword [edi]
cmp dword [edi + 0x10], eax
mov eax, dword [ebp - 0x1c]
jne 0x457971
push dword [edi + 0x10]
call fcn.00451020
add esp, 4
test eax, eax
mov eax, dword [ebp - 0x1c]
jne 0x457971
mov eax, dword [ebp - 0x20]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052c886
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebx + 4]
push edi
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax + 4]
push ecx
push eax
mov dword [ebp - 0x18], ecx
call fcn.0044bb30
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x457a8c
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x457a41
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ecx, ebx
push esi
push edi
call fcn.00457b90
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00457af0
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x4579b3
push str.list_T__too_long
call fcn.00529cde
int3
Function at 0x457c10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5e8ea4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jb 0x457c3d
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x457c59
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x457c48
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x457c92
cmp eax, edi
jne 0x457c8a
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x457c9a
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x457c9a
cmp eax, edi
jne 0x457c9d
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [ecx], esi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.0044af80
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax], esi
pop esi
pop ebx
call fcn.0052c886
mov esp, ebp
pop ebp
ret 8
Function at 0x457d00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56fde0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5e8ea4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], eax
cmp dword [edi + 0x14], 8
mov ebx, dword [edi + 0x10]
mov dword [ebp - 0x20], ecx
jb 0x457d53
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x457d74
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x457d60
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
lea eax, [eax + ecx*8]
mov esi, dword [esi + 4]
mov dword [ebp - 0x18], eax
cmp dword [eax], esi
je 0x457d94
mov esi, dword [eax + 4]
mov esi, dword [esi]
mov ebx, dword [edi + 0x10]
cmp esi, dword [eax]
je 0x457e12
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
jb 0x457dac
mov edx, dword [edx]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x457db6
mov ecx, dword [edi]
cmp ebx, eax
mov eax, dword [ebp - 0x18]
jne 0x457d97
push ebx
call fcn.00451020
add esp, 4
test eax, eax
mov eax, dword [ebp - 0x18]
jne 0x457d97
mov edi, dword [ebp + 0x10]
push edi
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov edx, dword [edi]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [eax + 8]
call fcn.0044af80
mov eax, dword [ebp - 0x20]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052c886
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x457e3f
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
push esi
push edi
call fcn.00457b90
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00457af0
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x457df4
Function at 0x458e60
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [0x5e8ea4]
xor eax, esp
mov dword [esp + 0x2c], eax
push esi
push edi
push 0
push 0x2000000
push 3
push 0
push 3
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x458ea9
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0052c886
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call fcn.00550175
cdq
mov ecx, 3
idiv ecx
mov eax, 0xffff
sub eax, edx
add word [esp + 0xc], ax
call fcn.00550175
cdq
mov ecx, 0xc
idiv ecx
inc edx
mov word [esp + 0xe], dx
call fcn.00550175
cdq
mov ecx, 0x1c
idiv ecx
inc edx
mov word [esp + 0x12], dx
call fcn.00550175
cdq
mov ecx, 0x18
idiv ecx
mov word [esp + 0x14], dx
call fcn.00550175
cdq
mov esi, 0x3c
idiv esi
mov word [esp + 0x16], dx
call fcn.00550175
cdq
idiv esi
mov word [esp + 0x18], dx
call fcn.00550175
cdq
mov ecx, 0x3e8
idiv ecx
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x10]
mov word [esp + 0x1e], dx
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0xffffffff
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0052c886
mov esp, ebp
pop ebp
ret
Function at 0x458fa0
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Timestomp file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56fe78
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5e8ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x38], ebx
push edi
push ebx
call fcn.00550807
add esp, 8
test eax, eax
jne 0x458fea
mov eax, 1
jmp 0x45915f
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45915f
mov ecx, edi
mov dword [ebp - 0x14], 0
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459010
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ecx + 1]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00459450
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
sub eax, esi
push edi
sar eax, 1
push eax
push esi
call fcn.00550106
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp byte [ebp + 8], 0
je 0x45909b
push 0
push 0x2000000
push 3
push 0
push 3
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x3c], eax
cmp eax, 0xffffffff
je 0x45909b
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
test ebx, ebx
jne 0x4590ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x45912d
mov ecx, edi
call fcn.004678c0
push ebx
push edi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
test ebx, ebx
jne 0x4590ed
mov ecx, esi
call fcn.004678c0
push ebx
push edi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
test ebx, ebx
je 0x45912d
cmp byte [ebp + 8], 0
je 0x45912d
push 0
push 0x2000000
push 3
push 0
push 3
push 0x80000100
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x45912d
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x45915d
mov ecx, dword [ebp - 0x14]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x459153
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45917b
push ecx
push esi
call fcn.0052cac7
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052c886
mov esp, ebp
pop ebp
ret
call fcn.00548571
int3
Function at 0x459600
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5e8ea4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x70
push 2
push 1
push 0
call dword [sym.imp.USER32.dll_RegisterHotKey]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x20]
push 0
push 0
push 0
push eax
call edi
test eax, eax
je 0x459700
push ebx
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call ebx
cmp dword [ebp - 0x1c], 0x312
jne 0x4596cf
cmp dword [ebp - 0x18], 1
jne 0x4596cf
cmp byte [0x5e99f5], 0
je 0x4596f4
cmp byte [0x5e99f4], 0
je 0x45968f
mov al, byte [0x5f029c]
and al, 1
mov byte [0x5e99f4], 0
mov byte [0x5ef79e], al
jmp 0x459694
mov al, byte [0x5ef79e]
test al, al
je 0x4596ab
push 0
push dword [0x5ef790]
call esi
mov byte [0x5ef79e], 0
jmp 0x4596cf
call fcn.00459560
push 5
push dword [0x5ef790]
call esi
mov ecx, dword [0x5f029c]
or ecx, 1
call fcn.00461130
mov byte [0x5ef79e], 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call edi
test eax, eax
jne 0x459647
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c886
mov esp, ebp
pop ebp
ret
push 1
push 0
call dword [sym.imp.USER32.dll_UnregisterHotKey]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0052c886
mov esp, ebp
pop ebp
ret
Function at 0x45cb20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edi + 0x18]
imul ecx, ecx, 0x1000193
pop edi
pop esi
and eax, ecx
pop ebp
ret 4

Function at 0x45d130
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5702f0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5e8ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.SYSTEMDRIVE
mov dword [ebp - 4], 0
call fcn.0054f4b6
mov edx, eax
mov dword [ebp - 0x18], 0
mov ecx, edx
mov dword [ebp - 0x14], 7
add esp, 4
xor eax, eax
mov word [ebp - 0x28], ax
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45d190
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0044a890
push 5
push str._temp
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0044fc90
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push 0x5d5c80
lea ecx, [ebp - 0x28]
call fcn.0044fc90
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push eax
call fcn.0044fc90
lea eax, [ebp - 0x28]
mov ecx, 0x5e9c84
push dword [ebp - 0x18]
test esi, esi
je 0x45d20a
mov ecx, 0x5e9c9c
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0044a890
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x45d24e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45d244
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45d2b3
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x45d298
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45d28e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45d2b8
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052c886
mov esp, ebp
pop ebp
ret
call fcn.00548571
call fcn.00548571
int3
Function at 0x45d370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0052d270
mov eax, dword [0x5e8ea4]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov ecx, 1
mov edx, 0x5f0298
mov eax, 0x3e7
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x45d441
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x100c]
push eax
call dword [sym.imp.USER32.dll_wvsprintfW]
mov esi, eax
test esi, esi
jle 0x45d441
push 0x5f0280
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x5f027c]
test cl, 2
je 0x45d41d
mov edx, dword [0x5e9c80]
cmp edx, 0xffffffff
je 0x45d41d
push 0
lea eax, [ebp - 0x1010]
push eax
lea eax, [esi + esi]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x100c]
push eax
push edx
call esi
push 0
lea eax, [ebp - 0x1010]
push eax
push 4
push 0x5d6a2c
push dword [0x5e9c80]
call esi
mov ecx, dword [0x5f027c]
test cl, 1
je 0x45d436
lea edx, [ebp - 0x100c]
call fcn.0045fab0
push eax
call fcn.0045fd70
add esp, 4
push 0x5f0280
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.0052c886
mov esp, ebp
pop ebp
ret
Function at 0x461130
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570658
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5e8ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [0x5f029c], ecx
test cl, 2
je 0x46127c
push str.SYSTEMDRIVE
call fcn.0054f4b6
mov edx, eax
mov dword [ebp - 0x18], 0
mov ecx, edx
mov dword [ebp - 0x14], 7
add esp, 4
xor eax, eax
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x461190
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0044a890
push 5
push str._temp
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.0044fc90
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push 0x5d5c80
lea ecx, [ebp - 0x28]
call fcn.0044fc90
cmp dword [0x5e9cc8], 8
lea ecx, [ebp - 0x28]
push dword [0x5e9cc4]
mov eax, 0x5e9cb4
cmovae eax, dword [0x5e9cb4]
push eax
call fcn.0044fc90
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push SysReAllocString
push 4
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 2
push 0
xorps xmm0, xmm0
mov dword [0x5e9ccc], eax
movq qword [ebp - 0x30], xmm0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x46127c
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x461272
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4612ab
push edx
push ecx
call fcn.0052cac7
add esp, 8
cmp dword [0x5f029c], 0
je 0x461291
mov eax, 1
mov ecx, 0x5f02b8
xchg dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052c886
mov esp, ebp
pop ebp
ret
call fcn.00548571
int3