joyce8/EMBER2024-capa huggingface dataset:
Function at 0x582910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x617960]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
lea edx, [eax + 1]
mov dword [ebp - 0x28], eax
movzx ecx, byte [edx + 3]
movzx ebx, byte [eax]
movzx eax, byte [edx]
shl eax, 0x10
shl ebx, 0x18
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov dword [ebp - 0x14], 0
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [ebp - 0x20], ebx
movzx eax, byte [edx + 6]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 9], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
mov edi, dword [ebp + 0x1c]
mov byte [ebp - 6], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov esi, dword [edi]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 5], dl
test eax, eax
je 0x582a99
mov edi, dword [ebp + 8]
sub dword [ebp - 0x10], edi
dec eax
mov dword [ebp + 0x10], eax
test esi, esi
jne 0x582a2c
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
call fcn.00419400
mov ebx, dword [ebp - 0x20]
add esp, 8
mov edx, dword [ebp - 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
inc dword [ebp - 0x14]
mov byte [ebp - 9], bl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov al, byte [ebp + esi - 0xc]
inc esi
mov ecx, dword [ebp - 0x10]
and esi, 7
xor al, byte [edi]
mov byte [ecx + edi], al
inc edi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
test eax, eax
jne 0x5829d6
test ecx, ecx
je 0x582a83
mov edi, dword [ebp - 0x28]
mov eax, ebx
shr eax, 0x18
mov byte [edi], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 1], al
mov eax, ebx
shr eax, 8
mov byte [edi + 2], al
mov eax, edx
shr eax, 0x18
mov byte [edi + 3], bl
mov byte [edi + 4], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 5], al
mov eax, edx
shr eax, 8
mov byte [edi + 6], al
mov byte [edi + 7], dl
mov eax, dword [ebp - 0x18]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049355b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov dword [edi], esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0049355b
mov esp, ebp
pop ebp
ret
Function at 0x586fa0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
cmp dword [ebp + 0x18], esi
jne 0x58702a
mov ecx, dword [ebp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x586fb9
cmp al, 0x6b
jne 0x58702a
inc ecx
cmp al, 0x6b
jne 0x586ffe
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x586fd9
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x586fd9
cmp dl, 0xbb
jne 0x586ff0
inc eax
cmp eax, esi
jl 0x586fc7
sub esi, eax
test eax, eax
jne 0x587001
push 0x83
push str.F:Gitcurllookaside_opensslcrypto_rsa_rsa_x931.c
push 0x8a
jmp 0x587036
push 0x7b
push str.F:Gitcurllookaside_opensslcrypto_rsa_rsa_x931.c
push 0x8a
jmp 0x587036
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x587018
push 0x8b
push str.F:Gitcurllookaside_opensslcrypto_rsa_rsa_x931.c
push 0x8b
jmp 0x587036
push esi
push ecx
push dword [ebp + 8]
call fcn.0049dad0
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
push 0x70
push str.F:Gitcurllookaside_opensslcrypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.0051b3a0
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x59f2e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x59f2ec
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.0059f300
Function at 0x4013c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x4013f6
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 8], edx
jge 0x40146e
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call fcn.00401160
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x10]
cmp dword [ebp + 0xc], edx
jb 0x401436
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
cmp edx, dword [ebp - 0xc]
jbe 0x40143d
mov eax, 0xc1
jmp 0x401470
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0xc]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004465f0
add esp, 0xc
jmp 0x4013e4
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401500
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x401536
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 8], edx
jge 0x401644
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
jne 0x401559
jmp 0x401524
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x20000000
je 0x40156f
mov dword [ebp - 0x10], 1
jmp 0x401576
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x40000000
je 0x401592
mov dword [ebp - 0x14], 1
jmp 0x401599
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x80000000
je 0x4015b5
mov dword [ebp - 0x18], 1
jmp 0x4015bc
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x20
je 0x4015db
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], 1
mov ecx, dword [ebp - 0x1c]
shl ecx, 4
mov edx, dword [ebp - 0x20]
lea eax, [ecx + edx*8 + section..data]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x4000000
je 0x40160e
mov edx, dword [ebp - 0xc]
or edx, 0x200
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0xc]
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40163f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401646
jmp 0x401524
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x401fb0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x401fc8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x40201a
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x401fe9
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jae 0x40200b
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp - 8]
and ecx, 1
xor edx, edx
sub edx, ecx
and edx, 0xedb88320
xor eax, edx
mov dword [ebp - 8], eax
jmp 0x401fe0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax*4 + 0x464920], ecx
jmp 0x401fbf
mov dword [ebp - 4], 0x100
jmp 0x40202c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x800
jae 0x402064
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x464520]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
and edx, 0xff
mov eax, dword [ebp - 0x10]
shr eax, 8
xor eax, dword [edx*4 + 0x464920]
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x464920], eax
jmp 0x402023
mov dword [0x464918], 0x4020b0
mov dword [0x464914], 0x4020b0
mov esp, ebp
pop ebp
ret
Function at 0x402500
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
shr eax, 2
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 8]
shr ecx, 1
add ecx, 3
mov edx, 4
imul eax, edx, 0
mov edx, dword [ebp - 8]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x402556
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x18]
add edx, 4
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jae 0x40256e
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [edx + ecx*4], eax
jmp 0x402544
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 4]
mov dword [ebp - 4], eax
imul ecx, dword [ebp + 8], 3
mov edx, dword [ebp - 8]
lea eax, [edx + ecx*4 + 0x70]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0
jne 0x40260d
mov ecx, dword [ebp - 4]
shr ecx, 8
and ecx, 0xff
movzx edx, byte [ecx + str.cw]
xor edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xff
movzx ecx, byte [eax + str.cw]
shl ecx, 8
or edx, ecx
mov eax, dword [ebp - 4]
shr eax, 0x18
movzx ecx, byte [eax + str.cw]
shl ecx, 0x10
or edx, ecx
mov eax, dword [ebp - 4]
and eax, 0xff
movzx ecx, byte [eax + str.cw]
shl ecx, 0x18
or edx, ecx
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0xc]
shl edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
and eax, 0x100
je 0x402605
mov dword [ebp - 0xc], 0x1b
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
jmp 0x40266e
cmp dword [ebp - 0x10], 4
jne 0x40266e
cmp dword [ebp + 8], 6
jbe 0x40266e
mov edx, dword [ebp - 4]
and edx, 0xff
movzx eax, byte [edx + str.cw]
mov ecx, dword [ebp - 4]
shr ecx, 8
and ecx, 0xff
movzx edx, byte [ecx + str.cw]
shl edx, 8
or eax, edx
mov ecx, dword [ebp - 4]
shr ecx, 0x10
and ecx, 0xff
movzx edx, byte [ecx + str.cw]
shl edx, 0x10
or eax, edx
mov ecx, dword [ebp - 4]
shr ecx, 0x18
movzx edx, byte [ecx + str.cw]
shl edx, 0x18
or eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, dword [eax + edx]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax + edx*4], ecx
mov edx, dword [ebp - 8]
add edx, 4
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x1c]
jne 0x402590
mov esp, ebp
pop ebp
ret 4
Function at 0x404830
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e8
mov eax, dword [0x4610c4]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, ax
cmp eax, 6
je 0x40488b
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0
je 0x40488b
push 0xc00
call dword [ebp - 0x2e8]
test eax, eax
je 0x40488b
jmp 0x4049f3
push 0x106
lea ecx, [ebp - 0x2d4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0
je 0x4048b8
cmp dword [ebp - 0x2e0], 0x104
jbe 0x4048bd
jmp 0x4049f3
mov edx, dword [ebp - 0x2e0]
movzx eax, word [ebp + edx*2 - 0x2d6]
cmp eax, 0x5c
je 0x4048f2
mov ecx, 0x5c
mov edx, dword [ebp - 0x2e0]
mov word [ebp + edx*2 - 0x2d4], cx
mov eax, dword [ebp - 0x2e0]
add eax, 1
mov dword [ebp - 0x2e0], eax
mov ecx, dword [str.userenv]
mov dword [ebp - 0x2e4], ecx
mov edx, dword [ebp - 0x2e4]
movsx eax, byte [edx]
test eax, eax
je 0x4049f3
mov ecx, dword [ebp - 0x2e0]
lea edx, [ebp + ecx*2 - 0x2d4]
mov dword [ebp - 0x2dc], edx
mov eax, dword [ebp - 0x2e4]
mov cl, byte [eax]
mov byte [ebp - 0x2d5], cl
mov edx, dword [ebp - 0x2e4]
add edx, 1
mov dword [ebp - 0x2e4], edx
movsx eax, byte [ebp - 0x2d5]
test eax, eax
jne 0x40494c
jmp 0x40496e
movzx cx, byte [ebp - 0x2d5]
mov edx, dword [ebp - 0x2dc]
mov word [edx], cx
mov eax, dword [ebp - 0x2dc]
add eax, 2
mov dword [ebp - 0x2dc], eax
jmp 0x404922
mov ecx, 2
imul edx, ecx, 0
mov eax, 0x2e
mov ecx, dword [ebp - 0x2dc]
mov word [ecx + edx], ax
mov edx, 2
shl edx, 0
mov eax, 0x64
mov ecx, dword [ebp - 0x2dc]
mov word [ecx + edx], ax
mov edx, 2
shl edx, 1
mov eax, 0x6c
mov ecx, dword [ebp - 0x2dc]
mov word [ecx + edx], ax
mov edx, 2
imul eax, edx, 3
mov ecx, 0x6c
mov edx, dword [ebp - 0x2dc]
mov word [edx + eax], cx
mov eax, 2
shl eax, 2
xor ecx, ecx
mov edx, dword [ebp - 0x2dc]
mov word [edx + eax], cx
push 8
push 0
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x4048fe
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004453e7
mov esp, ebp
pop ebp
ret
Function at 0x40ca80
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
xor edx, edx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0x6a09e667
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x20], 0xbb67ae85
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x20], 0x3c6ef372
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x20], 0xa54ff53a
mov ecx, 4
shl ecx, 2
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0x510e527f
mov eax, 4
imul ecx, eax, 5
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0x9b05688c
mov eax, 4
imul ecx, eax, 6
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0x1f83d9ab
mov eax, 4
imul ecx, eax, 7
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x20], 0x5be0cd19
pop ebp
ret 4

Function at 0x40cfb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
call fcn.0044a4e7
add esp, 0x18
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.0040ccb0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x411800
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453775
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4610c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x463ed4]
test eax, eax
jne 0x41187f
push 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.0040f180
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.0040d180
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040d110
cmp dword [ebp - 0x1c], 0
je 0x41187d
mov al, 1
jmp 0x4118fd
jmp 0x411893
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x411893
mov al, 1
jmp 0x4118fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4118a4
xor al, al
jmp 0x4118fd
lea ecx, [ebp - 0x60]
call fcn.004112a0
mov dword [ebp - 4], 1
push 0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x60]
call fcn.00412dc0
movzx eax, al
test eax, eax
jne 0x4118e0
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.00411350
mov al, byte [ebp - 0xd]
jmp 0x4118fd
lea ecx, [ebp - 0x60]
call fcn.004120b0
mov byte [ebp - 0xe], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.00411350
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x411c50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4537ed
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4610c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00413790
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x411cb2
mov ecx, dword [ebp - 0x10]
and ecx, 0x10
jne 0x411cb2
mov edx, dword [ebp - 0x10]
and edx, 1
je 0x411cb2
mov eax, dword [ebp - 0x10]
and eax, 0xfffffffe
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00412780
movzx edx, al
test edx, edx
jne 0x411cb2
xor al, al
jmp 0x411d1b
movzx eax, byte [0x463ed4]
test eax, eax
jne 0x411d07
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.0040f180
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.0040d180
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040d110
cmp dword [ebp - 0x1c], 0
je 0x411d05
mov al, 1
jmp 0x411d1b
jmp 0x411d19
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x411d19
mov al, 1
jmp 0x411d1b
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x412120
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453870
mov eax, dword fs:[0]
push eax
sub esp, 0x370
mov eax, dword [0x4610c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x370], 0x114
movzx eax, byte [0x463ed4]
test eax, eax
jne 0x4121fa
mov ecx, 1
imul edx, ecx, 0
mov dword [ebp - 0x35c], edx
cmp dword [ebp - 0x35c], 0x115
jae 0x412180
jmp 0x412185
call fcn.004458b7
mov eax, dword [ebp - 0x35c]
mov byte [ebp + eax - 0x128], 0
lea ecx, [ebp - 0x128]
push ecx
push 0x114
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x358], eax
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 0x37c]
push eax
call fcn.0040f150
mov dword [ebp - 0x368], eax
mov ecx, dword [ebp - 0x368]
mov dword [ebp - 0x36c], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x36c]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040dcb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x37c]
call fcn.0040d110
jmp 0x412252
mov eax, 2
imul ecx, eax, 0
mov dword [ebp - 0x360], ecx
cmp dword [ebp - 0x360], 0x22a
jae 0x412216
jmp 0x41221b
call fcn.004458b7
xor edx, edx
mov eax, dword [ebp - 0x360]
mov word [ebp + eax - 0x354], dx
lea ecx, [ebp - 0x354]
push ecx
push 0x114
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x358], eax
lea edx, [ebp - 0x354]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040de30
mov eax, dword [ebp + 8]
push eax
call fcn.00414f00
cmp dword [ebp - 0x358], 0
je 0x41227c
cmp dword [ebp - 0x358], 0x114
jae 0x41227c
mov dword [ebp - 0x364], 1
jmp 0x412286
mov dword [ebp - 0x364], 0
mov al, byte [ebp - 0x364]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004453e7
mov esp, ebp
pop ebp
ret 4

Function at 0x412780
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4534cd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4610c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x463ed4]
test eax, eax
jne 0x4127fe
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.0040f180
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
call fcn.0040d180
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0040d110
cmp dword [ebp - 0x18], 0
je 0x4127fc
mov al, 1
jmp 0x412816
jmp 0x412814
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x412814
mov al, 1
jmp 0x412816
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x413790
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4537ed
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4610c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x463ed4]
test eax, eax
jne 0x413805
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.0040f180
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.0040d180
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040d110
mov eax, dword [ebp - 0x1c]
jmp 0x413820
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x41381d
mov eax, dword [ebp - 0x10]
jmp 0x413820
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x413d60
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x413d97
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x413d97
xor al, al
jmp 0x413db4
xor edx, edx
mov eax, dword [ebp - 4]
mov cl, 0x20
call fcn.00445460
xor ecx, ecx
add eax, dword [ebp - 8]
adc edx, ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x414350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0xc], 0x400000
jbe 0x414369
mov dword [ebp + 0xc], 0x400000
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
call fcn.004107f0
mov byte [ebp - 1], al
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc