joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c237
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
mov edx, dword [esp + 0x1c]
lea ecx, [esp]
call fcn.0041f000
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.Control_PanelDesktopWindowMetrics
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov ebx, eax
and ebx, ebx
jne 0x40c2f3
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov ebx, eax
and ebx, ebx
jne 0x40c2ea
push dword [esp + 8]
call fcn.00440eb0
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x40c2ea
lea eax, [esp + 8]
push eax
push dword [esp + 0x10]
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov ebx, eax
and ebx, ebx
jne 0x40c2e1
push dword [esp + 0xc]
call sub.GDI32.DLL_CreateFontIndirectW
mov dword [esp + 0x10], eax
push dword [esp + 0xc]
call fcn.00440ed0
push dword [esp + 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [esp + 0x10]
jmp 0x40c2fb
push dword [esp]
call fcn.00443ab0
add esp, 0x14
pop ebx
ret 4

Function at 0x40d1a0
Capabilities:
Identify system language via api

Disassembly:
push ebx
xor eax, eax
push eax
call sub.KERNEL32.dll_GetUserDefaultLangID
mov ebx, eax
and ebx, 0x3ff
push ebx
mov ebx, 7
cmp ebx, dword [esp]
jne 0x40d1c9
mov dword [esp + 4], 0
jmp 0x40d2d3
mov ebx, 0x25
cmp ebx, dword [esp]
jne 0x40d1e0
mov dword [esp + 4], 1
jmp 0x40d2d3
mov ebx, 9
cmp ebx, dword [esp]
jne 0x40d1f7
mov dword [esp + 4], 2
jmp 0x40d2d3
mov ebx, 0xa
cmp ebx, dword [esp]
jne 0x40d20e
mov dword [esp + 4], 3
jmp 0x40d2d3
mov ebx, 0xc
cmp ebx, dword [esp]
jne 0x40d225
mov dword [esp + 4], 4
jmp 0x40d2d3
mov ebx, 0x12
cmp ebx, dword [esp]
jne 0x40d23c
mov dword [esp + 4], 5
jmp 0x40d2d3
mov ebx, 0x10
cmp ebx, dword [esp]
jne 0x40d253
mov dword [esp + 4], 6
jmp 0x40d2d3
mov ebx, 0x13
cmp ebx, dword [esp]
jne 0x40d267
mov dword [esp + 4], 7
jmp 0x40d2d3
mov ebx, 0x16
cmp ebx, dword [esp]
jne 0x40d27b
mov dword [esp + 4], 8
jmp 0x40d2d3
mov ebx, 0x19
cmp ebx, dword [esp]
jne 0x40d28f
mov dword [esp + 4], 9
jmp 0x40d2d3
mov ebx, 0x1a
cmp ebx, dword [esp]
jne 0x40d2a3
mov dword [esp + 4], 0xa
jmp 0x40d2d3
mov ebx, 0x1d
cmp ebx, dword [esp]
jne 0x40d2b7
mov dword [esp + 4], 0xb
jmp 0x40d2d3
mov ebx, 0x1f
cmp ebx, dword [esp]
jne 0x40d2cb
mov dword [esp + 4], 0xc
jmp 0x40d2d3
mov dword [esp + 4], 2
pop eax
mov eax, dword [esp]
jmp 0x40d2db
add esp, 4
pop ebx
ret
Function at 0x4114ec
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.004439e0
push dword [esp + 0x14]
call fcn.00443930
mov edx, 0x46103a
lea ecx, [esp + 4]
call fcn.0041f008
lea eax, [esp]
push eax
push dword [esp + 0x14]
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
mov ebx, eax
and ebx, ebx
jne 0x4115c1
call fcn.00443780
push eax
push eax
push 0x104
call fcn.004427e0
lea eax, [esp + 8]
push eax
call fcn.004437c0
mov eax, dword [esp + 4]
push eax
push dword [esp + 4]
call sub.SHELL32.DLL_SHGetPathFromIDListW
mov ebx, eax
cmp ebx, 1
jne 0x4115ab
call fcn.00443780
push eax
push eax
push 1
push dword [esp + 0x10]
call fcn.00441ee0
call fcn.00443850
mov edx, 0x461318
call fcn.00443880
mov ecx, eax
call fcn.004438f0
jne 0x4115a9
mov edx, dword [esp + 4]
call fcn.00443780
push eax
call fcn.00443980
mov edx, 0x461318
call fcn.00443980
lea eax, [esp + 8]
push eax
call fcn.004437c0
jmp 0x4115b9
mov edx, 0x46103a
lea ecx, [esp + 4]
call fcn.0041f008
push dword [esp]
call sub.OLE32.DLL_CoTaskMemFree
mov edx, dword [esp + 4]
call fcn.00443780
push eax
call fcn.00443980
pop eax
push eax
call fcn.004438c0
pop edx
add eax, edx
jmp 0x4115e6
push dword [esp + 4]
call fcn.00443ab0
add esp, 8
pop ebx
ret 4

Function at 0x41fa3c
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push dword [ebp + 8]
push dword [0x4e5a20]
call fcn.0044150d
mov edi, eax
test edi, edi
je 0x41fae2
mov esi, dword [sym.imp.USER32.DLL_SendMessageW]
push 0
push dword [ebp + 0xc]
push 0x419
push dword [edi]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41fae2
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x41d
push dword [edi]
call esi
mov dword [ebp - 0x40], 0x30
mov dword [ebp - 0x3c], 0x10
mov eax, dword [edi]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], ebx
lea eax, [ebp - 0x40]
push eax
xor ebx, ebx
push ebx
push 0x433
mov dword [ebp - 0x20], ebx
push dword [edi + 4]
call esi
lea eax, [ebp - 0x40]
push eax
push ebx
push 0x432
push dword [edi + 4]
call esi
xor eax, eax
inc eax
jmp 0x41fae4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41fc3a
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
xor esi, esi
push esi
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esp + 0xc], eax
test eax, eax
je 0x41fcd2
push ebx
push ebp
mov ebp, 0x4e5a28
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x4e4a78]
mov ebx, 0x4e4a78
test esi, esi
je 0x41fcaa
push edi
push 0
lea edi, [esi + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41fca3
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esi]
push edi
push ebx
call fcn.00441d60
pop ecx
pop ecx
jmp 0x41fca5
mov esi, dword [esi]
test esi, esi
jne 0x41fc7d
pop edi
mov esi, dword [0x4e1890]
inc dword [0x4e1890]
push 0x10
push ebx
call fcn.00441da0
pop ecx
pop ecx
mov ecx, dword [esp + 0x14]
push ebp
mov dword [eax], ecx
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
pop ebx
mov eax, esi
pop esi
ret 8
Function at 0x42383d
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [esp + 0x10], ebx
je 0x42388c
push dword [esp + 0x10]
push 0x4237bb
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x4e4cb8]
cmp esi, ebx
je 0x4238e0
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x423884
cmp byte [esi + 0x10], bl
je 0x423884
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, edi
cmp edi, ebx
jne 0x423861
jmp 0x4238e0
mov esi, dword [0x4e4cb8]
cmp esi, ebx
je 0x4238e0
push ebp
mov ebp, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x4238d9
cmp byte [esi + 0x11], bl
je 0x4238b6
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], bl
je 0x4238cc
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x4e4cb8
call fcn.00441d60
pop ecx
pop ecx
mov esi, ebp
cmp ebp, ebx
jne 0x423897
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x423970
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [0x4e5a4c]
call fcn.00441681
or dword [ebp - 4], 0xffffffff
mov ebx, eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx ecx, word [eax]
test cx, cx
je 0x423a35
mov edx, dword [ebp + 8]
push 2
pop esi
cmp cx, 0x20
jne 0x4239b1
add eax, esi
cmp word [eax], 0x20
je 0x4239a9
movzx ecx, word [eax]
mov dword [ebp - 8], 1
cmp ecx, 0x22
jne 0x4239ec
add eax, esi
movzx ecx, word [eax]
mov edi, eax
test cx, cx
je 0x4239e8
cmp cx, 0x22
je 0x4239dc
add eax, esi
movzx ecx, word [eax]
test cx, cx
jne 0x4239cc
cmp word [eax], 0
je 0x4239e8
mov edx, eax
add eax, esi
jmp 0x423a11
mov edx, eax
jmp 0x423a11
test cx, cx
je 0x423a0d
mov edi, eax
cmp cx, 0x20
je 0x423a03
add eax, esi
movzx ecx, word [eax]
test cx, cx
jne 0x4239f3
cmp word [eax], 0
mov edx, eax
je 0x423a11
jmp 0x4239e4
and dword [ebp - 8], 0
mov ecx, dword [ebx]
cmp ecx, dword [ebp - 4]
jne 0x423a1f
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x423a40
xor edi, edi
cmp dword [ebp - 8], edi
je 0x423a29
inc dword [ebp - 4]
movzx ecx, word [eax]
test cx, cx
jne 0x4239a3
cmp dword [ebp + 8], 0
jne 0x423a50
mov eax, dword [ebp - 4]
jmp 0x423a56
test edi, edi
je 0x423a53
sub edx, edi
sar edx, 1
mov dword [ecx], edx
inc dword [ebx]
mov eax, edi
jmp 0x423a56
mov ecx, dword [ebp + 8]
and dword [ecx], 0
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x423fbb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x14]
push edi
xor edi, edi
test eax, eax
je 0x42407b
mov ecx, dword [esi + 0x1c]
cmp ecx, ebx
jl 0x424020
push ebx
push eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 0x1c]
add esp, 0xc
cmp eax, ebx
jle 0x424007
mov ecx, dword [esi + 0x14]
sub eax, ebx
push eax
lea eax, [ecx + ebx]
push eax
push ecx
call sub.MSVCRT.dll_memmove
add esp, 0xc
sub dword [esi + 0x1c], ebx
jmp 0x42407b
push dword [esi + 0x14]
push 0
push dword [0x4e4898]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi + 0x14], edi
and dword [esi + 0x1c], edi
jmp 0x42407b
push ecx
push eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
mov edi, dword [esi + 0x1c]
add esp, 0xc
push dword [esi + 0x14]
push 0
push dword [0x4e4898]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi + 0x14], 0
and dword [esi + 0x1c], 0
jmp 0x42407b
and dword [ebp + 8], 0
push 0
lea eax, [ebp + 8]
push eax
mov eax, ebx
sub eax, edi
push eax
mov eax, dword [ebp + 0xc]
add eax, edi
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x424078
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x424081
add edi, dword [ebp + 8]
cmp edi, ebx
jl 0x42404b
jmp 0x424084
add edi, dword [ebp + 8]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4242ad
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4e4cc8], 0
jne 0x4242bf
call fcn.004241e1
push esi
push edi
push dword [0x4e4cc4]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
mov esi, eax
test esi, esi
jne 0x4242e4
call fcn.004241e1
push dword [0x4e4cc4]
call edi
mov esi, eax
mov eax, dword [ebp + 8]
push 0x11
lea ecx, [esi + 8]
pop edx
mov edi, eax
imul edi, edi, 0x53a9b4fb
xor eax, eax
inc eax
sub eax, edi
mov dword [ecx + 0x44], eax
imul eax, eax, 0x53a9b4fb
xor edi, edi
inc edi
sub edi, eax
mov eax, edi
mov dword [ecx], eax
add ecx, 4
dec edx
jne 0x4242ed
and dword [esi], edx
push 0x1f
mov dword [esi + 4], 0xa
pop edi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.0042419a
dec edi
pop ecx
pop ecx
jne 0x42431e
pop edi
pop esi
leave
ret 4
Function at 0x4254de
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x45c
push ebx
push esi
or esi, 0xffffffff
mov ebx, esi
test eax, eax
je 0x425623
cmp word [eax], 0
je 0x425623
push 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [ebp + eax*2 - 0x20e]
cmp eax, 2
je 0x42553b
cmp eax, 3
jne 0x425580
cmp word [ebp - 0x20a], 0x3a
jne 0x425580
cmp eax, 2
jne 0x42555d
lea eax, [ebp - 0x20c]
push 0x45a1c4
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x425623
jmp 0x425620
xor eax, eax
mov word [ecx], ax
sub ecx, 2
cmp word [ecx], 0x5c
je 0x425578
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4255cb
test byte [ebp - 0x45c], 0x10
je 0x4255b0
push 0xfffffffffffffffe
pop ebx
or esi, 0xffffffff
jmp 0x4255c2
mov esi, dword [ebp - 0x440]
xor ebx, ebx
or ebx, dword [ebp - 0x43c]
xor edx, edx
or esi, edx
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x425623
cmp word [ebp - 0x20c], 0x5c
jne 0x4255df
cmp word [ebp - 0x20a], 0x5c
je 0x4255f3
cmp word [ebp - 0x20c], 0x2e
jne 0x425623
cmp word [ebp - 0x20a], 0x2e
jne 0x425623
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42560b
test al, 0x10
je 0x425623
jmp 0x42561d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x425623
or esi, 0xffffffff
push 0xfffffffffffffffe
pop ebx
mov edx, esi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x42596c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [0x4e4ce4], edi
jne 0x425996
push fcn.00425939
push 0x10
push 0x258
call fcn.004415f3
mov dword [0x4e4ce4], eax
cmp dword [ebp + 0xc], edi
jne 0x4259a2
mov dword [ebp + 0xc], 0x45a0c0
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x4259ae
cmp word [ebx], di
jne 0x4259b3
mov ebx, 0x45a1bc
push dword [ebp + 0xc]
call sub.MSVCRT.dll_wcslen
push ebx
mov esi, eax
call sub.MSVCRT.dll_wcslen
pop ecx
pop ecx
add eax, esi
lea eax, [eax + eax + 4]
push eax
push edi
push dword [0x4e4898]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x425a76
push dword [ebp + 0xc]
push edi
call sub.MSVCRT.dll_wcscpy
pop ecx
pop ecx
test esi, esi
je 0x425a0a
mov eax, dword [ebp + 0xc]
cmp word [eax + esi*2 - 2], 0x5c
je 0x425a0a
push 0x45a1c4
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
push dword [ebp + 8]
push dword [0x4e4ce4]
call fcn.00441470
mov esi, eax
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x425a3b
and dword [esi + 4], 0
jmp 0x425a4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x425a52
mov dword [esi + 4], 1
mov dword [ebp - 4], esi
jmp 0x425a67
cmp dword [ebp + 8], 0xffffffff
jne 0x425a64
push esi
push dword [0x4e4ce4]
call fcn.004415a3
and dword [esi], 0
push edi
push 0
push dword [0x4e4898]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x425ac5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x425b3b
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea eax, [ebp + eax*2 - 0x20c]
jmp 0x425b1c
movzx edx, word [eax - 2]
cmp edx, 0x20
je 0x425b19
cmp edx, 0x5c
je 0x425b19
cmp edx, 0x2f
jne 0x425b26
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x425b06
xor ecx, ecx
mov word [eax], cx
push ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x425b3d
xor eax, eax
leave
ret 4
Function at 0x425b5a
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x425c2f
push edi
push esi
push pe_nt_image_headers32
push 3
push esi
push 3
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x425c2e
mov esi, dword [ebp + 0x10]
push esi
call fcn.00435f29
push esi
mov word [ebp - 0x20], ax
call fcn.00435f4a
push esi
mov word [ebp - 0x1e], ax
call fcn.00435f66
push esi
mov word [ebp - 0x1c], ax
call fcn.00435f81
push esi
mov word [ebp - 0x1a], ax
call fcn.00435f9c
push esi
mov word [ebp - 0x18], ax
call fcn.00435fb7
push esi
mov word [ebp - 0x16], ax
call fcn.00435fd2
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
xor eax, eax
xor edx, edx
xor ecx, ecx
cmp dword [ebp + 0xc], 1
jne 0x425c0d
lea edx, [ebp - 8]
jmp 0x425c1b
cmp dword [ebp + 0xc], 2
jne 0x425c18
lea ecx, [ebp - 8]
jmp 0x425c1b
lea eax, [ebp - 8]
push ecx
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x426980
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push ebx
push esi
or esi, 0xffffffff
xor ebx, ebx
mov dword [esp + 8], 0x80000
test eax, eax
je 0x426b8e
push edi
push ebx
push pe_nt_image_headers32
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [esp + 0x1c], edi
cmp edi, 0xffffffff
je 0x426b8d
mov eax, dword [0x4e4898]
push ebp
push 0x80000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x426b85
cmp dword [esp + 0x30], ebx
jl 0x426a01
mov eax, dword [esp + 0x2c]
jg 0x4269f2
test eax, eax
je 0x426a01
push 0
lea ecx, [esp + 0x34]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x34]
add edx, 0x80000
mov dword [esp + 0x28], edx
jmp 0x426a15
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
sub dword [esp + 0x28], 0x80000
add ebx, 0x80000
and eax, ecx
mov dword [esp + 0x14], ebx
cmp eax, 0xffffffff
je 0x426a4d
mov eax, ebx
cdq
cmp edx, ecx
jl 0x426a4d
jg 0x426a45
cmp eax, dword [esp + 0x34]
jbe 0x426a4d
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x1c]
push edx
push eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [esp + 0x18]
mov eax, ebp
mov edx, ebx
cmp ebx, 8
jb 0x426b4c
mov edi, ebx
shr edi, 3
jmp 0x426a80
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
mov dword [esp + 0x1c], ecx
mov ecx, esi
mov esi, dword [esp + 0x1c]
shr ecx, 8
xor ecx, dword [esi*4 + 0x45a250]
movzx esi, byte [eax + 1]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x45a250]
movzx esi, byte [eax + 2]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x45a250]
movzx esi, byte [eax + 3]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x45a250]
movzx esi, byte [eax + 4]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x45a250]
movzx esi, byte [eax + 5]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x45a250]
movzx esi, byte [eax + 6]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x45a250]
movzx esi, byte [eax + 7]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x45a250]
add eax, 8
sub edx, 8
dec edi
mov esi, ecx
jne 0x426a80
mov edi, dword [esp + 0x20]
test edx, edx
je 0x426b69
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x45a250]
inc eax
dec edx
jne 0x426b50
cmp ebx, 0x80000
je 0x426a11
mov edx, dword [0x4e4898]
push ebp
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
mov eax, esi
pop esi
not eax
pop ebx
add esp, 0x14
ret 0x14
Function at 0x42c330
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esi + 0x14], eax
jne 0x42c365
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x42c8e0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
fldz
mov ecx, dword [0x4e5a88]
fstp dword [esp]
push eax
push ecx
call fcn.0044150d
test eax, eax
je 0x42c927
cmp dword [eax + 4], 0
lea edx, [esp]
je 0x42c914
push 4
push edx
push eax
call fcn.0042d5f0
fld dword [esp]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
fld dword [esp]
pop ecx
ret 4

Function at 0x42c930
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x4e5a88]
push eax
push ecx
mov byte [esp + 0xb], 0
call fcn.0044150d
test eax, eax
je 0x42c97a
cmp dword [eax + 4], 0
lea edx, [esp + 3]
je 0x42c967
push 1
push edx
push eax
call fcn.0042d5f0
movsx eax, byte [esp + 3]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movsx eax, byte [esp + 3]
pop ecx
ret 4

Function at 0x42c990
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test esi, esi
je 0x42ca93
cmp word [esi], ax
je 0x42ca93
mov eax, dword [esp + 0xc]
mov ecx, dword [0x4e5a88]
push edi
push eax
push ecx
call fcn.0044150d
mov edi, eax
test edi, edi
je 0x42ca8e
mov eax, dword [esp + 0x18]
cmp eax, 0x19
jne 0x42ca2e
cmp dword [edi + 4], 0
mov eax, esi
lea edx, [eax + 2]
je 0x42ca00
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42c9e0
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push edx
push esi
push edi
call fcn.0042d710
pop edi
pop esi
pop ecx
ret 0xc
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42ca00
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0xc]
push ecx
lea edx, [eax + eax]
mov eax, dword [edi]
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor ecx, ecx
cmp eax, 2
setne cl
lea edx, [esp + 0x14]
push edx
push esi
lea eax, [ecx - 1]
and eax, 0xfde9
push eax
call fcn.0042d810
mov esi, eax
test esi, esi
je 0x42ca8e
cmp dword [edi + 4], 0
je 0x42ca68
mov eax, dword [esp + 0x14]
push eax
push esi
push edi
call fcn.0042d710
mov dword [esp + 8], eax
jmp 0x42ca7e
mov edx, dword [esp + 0x14]
mov eax, dword [edi]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [0x4e4898]
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc