joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60a450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b2588
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0xc]
mov eax, 0x2aaaaaab
sub ecx, dword [esi + 8]
mov edi, dword [ebp + 0xc]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
cmp dword [esi], 0
je 0x60a49a
inc eax
add eax, edx
test eax, eax
jne 0x60a53f
mov ecx, 0x16
mov dword [ebp - 0x44], 0xc300cb
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x40], 0xf300c5
mov dword [ebp - 0x3c], 0xc100c9
mov dword [ebp - 0x38], 0xde00d8
mov dword [ebp - 0x34], 0xdd00dd
mov dword [ebp - 0x30], 0xd000d2
mov dword [ebp - 0x2c], 0xd700ea
mov dword [ebp - 0x28], 0xca00c5
mov dword [ebp - 0x24], 0xdf00e6
mov dword [ebp - 0x20], 0xcc00d6
mov dword [ebp - 0x1c], 0xc700c9
mov dword [ebp - 0x18], 0xbf
lea ecx, [eax + 0xa9]
xor word [ebp + eax*2 - 0x44], cx
inc eax
mov ecx, dword [ebp - 0x48]
cmp eax, ecx
jb 0x60a500
xor eax, eax
mov word [ebp + ecx*2 - 0x44], ax
lea ecx, [ebp - 0x44]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x60a520
sub ecx, edx
lea eax, [ebp - 0x44]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.004044f0
xor al, al
jmp 0x60a59b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x11]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x4c], edi
movups xmm0, xmmword [ebp - 0x58]
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x80], vtable..195.0
movups xmmword [ebp - 0x7c], xmm0
mov dword [ebp - 0x5c], eax
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.0042e9e0
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x5c]
test ecx, ecx
je 0x60a598
mov edx, dword [ecx]
lea eax, [ebp - 0x80]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 8
Function at 0x60a730
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b25f8
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.00790c80
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
cmp dword [ecx + 0x14], 8
jb 0x60a771
mov ecx, dword [ecx]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x60a84e
cmp esi, 0xffffffff
je 0x60a84e
lea eax, [ebp - 0x201c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov dword [ebp - 0x2020], ebx
cmp ebx, 0xffffffff
je 0x60a84e
mov eax, dword [ebp - 0x201c]
xor edi, edi
mov dword [ebp - 0x2028], eax
mov dword [ebp - 0x2014], 0
push 0
lea eax, [ebp - 0x2014]
push eax
push 0x2000
lea eax, [ebp - 0x2010]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x60a836
mov eax, dword [ebp - 0x2014]
test eax, eax
je 0x60a836
mov ecx, dword [ebp + 0x2c]
mov dword [ebp - 0x2018], eax
lea eax, [ebp - 0x2010]
mov dword [ebp - 0x2024], eax
test ecx, ecx
je 0x60a88d
mov eax, dword [ecx]
lea edx, [ebp - 0x2018]
push edx
lea edx, [ebp - 0x2024]
push edx
call dword [eax + 8]
mov eax, dword [ebp - 0x2014]
add edi, eax
test eax, eax
jne 0x60a7d4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
jne 0x60a84e
cmp dword [ebp - 0x2028], 0
jne 0x60a84e
mov bl, 1
jmp 0x60a850
xor bl, bl
mov dword [ebp - 4], 4
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x60a86f
mov esi, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
int3
Function at 0x60a8a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b267b
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xc4]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xa8], esi
push edi
mov dword [ebp - 0x80], 0
call fcn.00404120
mov dword [ebp - 0x80], 2
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 7
mov word [ebp - 0xa4], ax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0xc4]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xa4]
call fcn.00403b80
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 3
push eax
call fcn.00418540
add esp, 4
mov byte [ebp - 0x79], al
lea ecx, [ebp - 0x8c]
call fcn.00404220
lea ecx, [ebp - 0xa4]
call fcn.00404490
lea ecx, [ebp - 0xc4]
mov dword [ebp - 4], 0xffffffff
call fcn.00404490
cmp byte [ebp - 0x79], 0
je 0x60ab01
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub eax, 0
je 0x60ab01
sub eax, 1
je 0x60a9b2
sub eax, 1
jne 0x60ab01
push edi
push esi
call fcn.0060ab40
jmp 0x60ab12
push 0x40
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 4
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x78], 0
lea ecx, [ebp - 0xdc]
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0x67452301
mov dword [ebp - 0x6c], 0xefcdab89
push edi
mov dword [ebp - 0x68], 0x98badcfe
mov dword [ebp - 0x64], 0x10325476
call fcn.00404120
mov dword [ebp - 0x80], 0xa
mov dword [ebp - 4], 5
lea eax, [ebp - 0x78]
sub esp, 0x28
mov dword [ebp - 0x14], eax
mov eax, esp
lea ecx, [ebp - 0x78]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xdc]
mov dword [eax], vtable.MQ.0
mov dword [eax + 0x24], eax
call fcn.0060a730
add esp, 0x28
mov byte [ebp - 0x79], al
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 4
call fcn.00404490
cmp byte [ebp - 0x79], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x80], 0xe
je 0x60aaec
push ecx
lea eax, [ebp - 0x79]
mov dword [ebp - 0x18], 0
push eax
xorps xmm0, xmm0
mov byte [ebp - 0x79], 0
push 0x10
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.0041e2a0
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x78]
mov edx, dword [ebp - 0x20]
call fcn.0065be60
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0xf4]
call fcn.0041d7f0
mov edi, eax
cmp esi, edi
je 0x60aad9
mov ecx, esi
call fcn.00407a10
movups xmm0, xmmword [edi]
movups xmmword [esi], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea ecx, [ebp - 0xf4]
call fcn.00407a10
lea ecx, [ebp - 0x20]
call fcn.0040f050
mov eax, 0x58
lea ecx, [ebp - 0x78]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x60aaf4
jmp 0x60ab12
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 8
Function at 0x60c190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b28a0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x831184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov esi, dword [eax + 0xc]
lea ecx, [ebp - 0x28]
mov edi, dword [eax + 8]
mov eax, dword [eax + 4]
add eax, 0x58
push eax
call fcn.00404120
push esi
push edi
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
call fcn.0060b910
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call fcn.00404490
mov eax, dword [ebp - 0x10]
test bl, bl
je 0x60c23c
mov eax, dword [eax + 0x10]
xor ecx, ecx
mov byte [eax], 1
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 7
mov word [eax + 4], cx
mov byte [eax + 0x1c], cl
mov byte [eax + 0x34], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [eax + 0xc]
xor eax, eax
mov dword [ebp - 0x30], 0xd
mov dword [ebp - 0x2c], 0xda00dc
mov dword [ebp - 0x28], 0xcd00cf
mov dword [ebp - 0x24], 0xcb00d9
mov dword [ebp - 0x20], 0xd500f0
mov dword [ebp - 0x1c], 0xc000c3
mov dword [ebp - 0x18], 0xc600dc
mov dword [ebp - 0x14], 0xb600ea
nop dword [eax]
lea ecx, [eax + 0xa9]
xor word [ebp + eax*2 - 0x2c], cx
inc eax
mov ecx, dword [ebp - 0x30]
cmp eax, ecx
jb 0x60c280
xor eax, eax
mov word [ebp + ecx*2 - 0x2c], ax
lea eax, [ebp - 0x2c]
push edx
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0041ee30
add esp, 0xc
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea ecx, [esi + 4]
mov dword [esi], 1
call fcn.00404120
lea ecx, [ebp - 0x48]
mov byte [esi + 0x1c], 0
mov byte [esi + 0x34], 0
call fcn.00404490
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x612fb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x612fbb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x613077
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cf440]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cf440]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cf440]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cf440]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cf440]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cf440]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cf440]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cf440]
sub edi, 1
jne 0x612fd0
pop edi
test esi, esi
je 0x61309a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cf440]
sub esi, 1
jne 0x613080
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x613860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov ebx, esi
mov dword [ebp - 0xc], esi
imul ebx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 8], eax
cmp byte [edi], 0
je 0x6138bc
push 0
lea ecx, [ebp - 8]
push ecx
push ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x6138a4
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
xor edx, edx
pop edi
div esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ebx
add ecx, edx
push esi
push ecx
push dword [ebp - 8]
call sub.VCRUNTIME140.dll_memcpy
add dword [edi + 0x1c], esi
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, esi
xor edx, edx
xor ecx, ebp
div dword [ebp - 0xc]
pop edi
pop esi
pop ebx
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret
Function at 0x614240
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x6143fc
cmp dword [edi + 0x18], 0
je 0x6143fc
cmp dword [edi + 0x7c], 0
je 0x614269
call fcn.006146f0
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.00614080
add esp, 8
test eax, eax
je 0x61428d
pop edi
mov eax, 0xffffff99
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x6142d3
push 0x4000
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x6142df
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], 0
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], 0
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x61433a
lea ecx, [esi + 4]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00613300
test eax, eax
jne 0x61433a
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x61435d
mov al, byte [edi + 0x39]
jmp 0x614360
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov ecx, 0xc
xor eax, eax
cmp byte [esi + 0x6c], al
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x6143dd
nop
mov al, byte [ebx]
test al, al
je 0x6143dd
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, ecx
shr ecx, 8
movzx eax, al
mov eax, dword [eax*4 + 0x7cf440]
xor eax, ecx
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x70], eax
movzx eax, al
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7cf440]
mov dword [esi + 0x78], ecx
add ebx, 1
jne 0x614390
mov eax, dword [ebp - 0xc]
add eax, 0x1e
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xffffff9a
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x614760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 8], ebx
cmp dword [ebx], 0
jne 0x61490a
cmp dword [ebx + 4], 0xffffffff
jne 0x61490a
push edi
lea edi, [ebx + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x614797
sub ecx, edx
sar ecx, 1
movzx eax, word [ebx + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x6147d3
cmp eax, 0x2f
je 0x6147d3
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x6147c0
mov eax, dword [0x7cf384]
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
push esi
cmp edi, 1
jne 0x6147fe
mov esi, dword [ebp + 8]
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x614819
pop esi
pop edi
mov eax, 0x2000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 2
je 0x614816
cmp edi, 3
je 0x614816
pop esi
pop edi
mov eax, 0x10000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 8]
xor ebx, ebx
xor al, al
mov byte [ebp - 1], al
mov byte [ebp + 0x13], bl
cmp edi, 1
je 0x61485f
cmp edi, 2
jne 0x61487b
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x614859
pop esi
pop edi
mov eax, 0x200
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov byte [ebp + 0x13], 1
jmp 0x614865
mov ebx, esi
mov byte [ebp + 0x13], 0
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
setne al
mov byte [ebp - 1], al
push 0x20
call fcn.0076e8c3
add esp, 4
mov esi, eax
cmp edi, 1
je 0x6148b6
cmp edi, 2
je 0x6148b6
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
mov word [esi], 0x100
mov byte [esi + 0x10], 0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0xc], 0
jmp 0x6148e7
mov al, byte [ebp + 0x13]
mov byte [esi + 0x10], al
mov al, byte [ebp - 1]
mov byte [esi], 1
mov byte [esi + 1], al
mov dword [esi + 4], ebx
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
test al, al
je 0x6148e7
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0xc], eax
mov ecx, esi
call fcn.00613c50
mov ecx, dword [ebp - 8]
mov edx, 0x200
pop esi
pop edi
pop ebx
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x1000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x614fc0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x614ff2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x614ff2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x6150dc
push edi
mov edi, ebx
mov ecx, ebx
mov edx, eax
cmp dx, 0x2f
je 0x615011
cmp dx, 0x5c
jne 0x615013
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x615005
cmp edi, ebx
je 0x61505e
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp edi, 0x208
jae 0x6150ec
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, esi
mov word [ebp + edi - 0x414], ax
call fcn.00614fc0
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x615083
lea ecx, [ebp - 0x20c]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x615073
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x615085
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x6150a0
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x6150dc
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret
call fcn.0076f583
int3
Function at 0x6170c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0x6172e1
cmp eax, 3
jb 0x617136
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x617173
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x617173
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x61715d
mov dword [esi + 0x6afa0], eax
mov edx, ebx
mov ecx, esi
call fcn.00616da0
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x617263
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
mov edx, ecx
mov ecx, esi
push eax
call fcn.006168c0
mov ecx, dword [esi + 0x6af90]
add esp, 4
sub ecx, edi
mov dword [ebp - 4], eax
mov dword [esi + 0x6af90], ecx
cmp edi, dword [esi + 0x6af98]
ja 0x617228
cmp ecx, 3
jb 0x617228
dec edi
nop word [eax + eax]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x6171c0
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [ebp - 4]
jmp 0x61728a
mov edx, dword [esi + 0x6af84]
add edx, edi
xor edi, edi
mov dword [esi + 0x6af84], edx
movzx ecx, byte [esi + edx + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 4]
jmp 0x61728a
movzx eax, byte [esi + ecx + 0x1af70]
xor edx, edx
push eax
mov ecx, esi
call fcn.006168c0
dec dword [esi + 0x6af90]
add esp, 4
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
lea ecx, [esi + 0x1af70]
test eax, eax
je 0x6172bf
mov eax, dword [esi + 0x6af74]
sub edx, eax
push 0
push edx
lea edx, [eax + ecx]
xor ecx, ecx
test eax, eax
cmovs edx, ecx
mov ecx, esi
call fcn.00616410
mov eax, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], eax
mov eax, dword [esi + 0x6af90]
cmp eax, 0x106
jae 0x6172d9
mov ecx, esi
call fcn.00616f60
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x6170e5
mov eax, dword [esi + 0x6af74]
mov ecx, dword [esi + 0x6af84]
sub ecx, eax
test eax, eax
js 0x61730f
push 1
lea edx, [esi + 0x1af70]
push ecx
add edx, eax
mov ecx, esi
call fcn.00616410
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push ecx
xor edx, edx
mov ecx, esi
call fcn.00616410
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x618080
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x61808b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x618147
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7d0c00]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7d0c00]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7d0c00]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7d0c00]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7d0c00]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7d0c00]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7d0c00]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7d0c00]
sub edi, 1
jne 0x6180a0
pop edi
test esi, esi
je 0x61816a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7d0c00]
sub esi, 1
jne 0x618150
not ecx
mov eax, ecx
pop esi
pop ebp
ret