joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f46c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004d41c9
add esp, 0xc
ror eax, 8
ror eax, 0x18
jg 0x4f46fa
jne 0x4f46f0
jns 0x4f46f2
lea edi, [edi]
lea esp, [esp]
jle 0x4f46fa
mov esi, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.004d4cba
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4f47c2
xor eax, eax
jmp 0x4f482f
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004ebc60
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004d41c9
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x4f47ec
xor eax, eax
jmp 0x4f482f
jg 0x4f47ee
js 0x4f480c
pushf
jl 0x4f47f4
jo 0x4f47f6
popf
jo 0x4f47fa
lea ecx, [ecx + 0x2a55]
lea ecx, [ecx - 0x2a55]
lea esp, [esp]
jns 0x4f480c
mov ecx, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.004e9301
add esp, 4
test eax, esi
mov esp, esp
jge 0x4f4824
jae 0x4f4820
jl 0x4f4824
sub eax, 0xc4d8b2f
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f4bd1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004d41c9
add esp, 0xc
cmc
add edi, 0
jns 0x4f4c05
pushf
cmp edx, dword [esp + 0x10]
and esp, 0xffffffff
shl edx, 0
popf
jge 0x4f4c00
jle 0x4f4c02
js 0x4f4c05
mov esp, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
jl 0x4f4c37
test dword [esp], eax
add esi, dword [esp]
sub esi, dword [esp]
jbe 0x4f4c4e
jno 0x4f4c44
jns 0x4f4c46
jae 0x4f4c48
je 0x4f4c4a
ja 0x4f4c4e
ljmp 0xe980:0xec4d8abd
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov edi, edi
jl 0x4f4cb2
je 0x4f4cc7
pushf
rol ecx, 4
rol ecx, 0x1c
popf
xchg esp, esp
jl 0x4f4cc2
jge 0x4f4cc4
jne 0x4f4cc7
mov edi, 0xfdffeee8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.004d4cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4f4cdc
xor eax, eax
jmp 0x4f4d5c
std
cld
jns 0x4f4ce9
js 0x4f4ce2
xchg edx, edx
nop
js 0x4f4ce9
ljmp 0x8b50:0xec458d0e
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004ebc60
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004d41c9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4f4d46
shl edi, 0
mov ebx, ebx
jno 0x4f4d1d
jne 0x4f4d18
nop
jo 0x4f4d1d
mov eax, 0xfc458b9e
mov eax, dword [ebp - 4]
push eax
call fcn.004e9301
add esp, 4
test edx, 0x2bfe
je 0x4f4d31
jne 0x4f4d3d
jg 0x4f4d35
jno 0x4f4d37
lea eax, [eax]
je 0x4f4d3d
sub eax, 0x84d8bc4
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x4f4d5c
cmp eax, dword [esp + 0x10]
ror edi, 3
rol edi, 3
jp 0x4f4d5a
nop
je 0x4f4d55
lea esi, [esi]
jnp 0x4f4d5a
add eax, 0x5e5fc033
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f6db5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004d41c9
add esp, 0xc
shr edi, 0
jns 0x4f6dda
jp 0x4f6de7
jbe 0x4f6dde
jnp 0x4f6de0
jp 0x4f6de2
xchg esp, esp
jnp 0x4f6de7
mov ecx, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
lea ecx, [ecx + 0xc9a]
lea ecx, [ecx - 0xc9a]
mov esp, esp
jp 0x4f6e31
jle 0x4f6e29
jnp 0x4f6e2b
jl 0x4f6e2d
jnp 0x4f6e31
ljmp 0xe980:0xf04d8ac8
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
lea edi, [edi + 0x7044]
sub edi, 0x7044
clc
test dword [esp + 0x10], edx
xor edx, esi
xor edx, esi
je 0x4f6eb7
pushf
add edx, dword [esp]
sub edx, dword [esp]
popf
lea eax, [eax]
jne 0x4f6eb7
add eax, 0xfdbb40e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.004d29fc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4f6ec9
xor eax, eax
jmp 0x4f6f08
lea ecx, [ecx]
jle 0x4f6ee5
pushf
shr esi, 0
popf
lea edx, [edx + 0x3104]
lea edx, [edx - 0x3104]
mov esp, esp
jg 0x4f6ee5
add eax, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004ebc60
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004d41c9
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4012c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push dword [ebp + 0xc]
mov esi, ecx
push dword [esi]
call fcn.004ec744
push dword [esi]
mov esi, dword [ebp + 0x10]
push esi
push 1
push dword [ebp + 8]
call fcn.004ecd47
xor ecx, ecx
add esp, 0x1c
cmp esi, eax
sete cl
pop esi
mov eax, ecx
pop ebp
ret 0xc

Function at 0x401300
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5384b0
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x592830]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x1c], ecx
xor edi, edi
sub esp, 8
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x6c], edi
call fcn.004058e0
add esp, 8
test eax, eax
je 0x401364
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x400
call fcn.004ebc43
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
test eax, eax
jne 0x401389
mov esi, 0x8000ffff
jmp 0x4014a0
push 0x400
call fcn.004ebc43
mov ebx, eax
add esp, 4
mov dword [ebp - 0x34], ebx
mov byte [ebp - 4], 1
test ebx, ebx
jne 0x4013ad
mov esi, 0x8000ffff
jmp 0x401494
mov eax, esi
cdq
mov ecx, edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
test ecx, ecx
jl 0x401487
jg 0x4013dd
test eax, eax
je 0x401487
lea ebx, [ebx]
test ecx, ecx
jl 0x4013eb
jg 0x4013dd
cmp eax, 0x400
jb 0x4013eb
mov esi, 0x400
mov dword [ebp - 0x28], 0
jmp 0x4013f0
mov esi, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x1c]
push dword [eax]
push esi
push 1
push dword [ebp - 0x24]
call fcn.004ecd47
add esp, 0x10
cmp esi, eax
jne 0x401483
mov eax, esi
cdq
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], esi
sbb dword [ebp - 0x18], edx
mov dword [ebp - 0x6c], eax
lea esp, [esp]
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x5c], 0x400
mov dword [ebp - 0x60], ebx
call fcn.00405a70
cmp eax, 2
je 0x40147b
cmp eax, 0xfffffffb
jbe 0x401441
cmp eax, 0xfffffffd
jbe 0x40147b
mov eax, dword [ebp + 8]
mov esi, 0x400
push dword [eax]
sub esi, dword [ebp - 0x5c]
push esi
push 1
push ebx
call fcn.004ec47b
add esp, 0x10
cmp eax, esi
jne 0x40147b
add edi, esi
cmp dword [ebp - 0x5c], 0
je 0x401420
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jl 0x401487
mov eax, dword [ebp - 0x14]
jle 0x4013c2
jmp 0x4013d0
lea ecx, [ebp - 0x6c]
call fcn.004071b0
xor esi, esi
jmp 0x401494
lea ecx, [ebp - 0x6c]
call fcn.004071b0
mov esi, 1
push ebx
call fcn.004ebc0b
mov eax, dword [ebp - 0x24]
add esp, 4
push eax
call fcn.004ebc0b
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4014c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538670
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x592830]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 4], 0
xor edi, edi
push 0x540eac
push ecx
mov byte [ebp - 4], 1
call fcn.004ec5bd
mov esi, eax
add esp, 8
mov dword [ebp - 0x14], esi
test esi, esi
je 0x4015ad
push 2
push edi
push esi
call fcn.004ec744
add esp, 0xc
push esi
call fcn.004ecb1c
add esp, 4
push edi
push edi
push esi
call fcn.004ec744
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x30], eax
push esi
push 0x1e
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
lea eax, [ebp - 0x34]
push 1
push eax
mov dword [ebp - 0x34], edi
call fcn.004ecd47
add esp, 0x10
cmp eax, 0x1e
jne 0x4015ad
push 0x540eb0
push ebx
call fcn.004ec5bd
mov edi, eax
add esp, 8
mov dword [ebp - 0x10], edi
test edi, edi
je 0x4015ad
movzx ecx, word [ebp - 0x18]
movzx eax, word [ebp - 0x1a]
push 1
add ecx, eax
push ecx
push esi
call fcn.004ec744
mov edx, dword [ebp - 0x22]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.00401300
add esp, 4
test eax, eax
je 0x4015ad
mov ebx, 1
jmp 0x4015af
xor ebx, ebx
test edi, edi
je 0x4015bc
push edi
call fcn.004ec63e
add esp, 4
test esi, esi
je 0x4015c9
push esi
call fcn.004ec63e
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4015e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0
mov esi, ecx
push 0x3c
push dword [esi]
mov dword [ebp - 0x10], 0
call fcn.004ec744
push dword [esi]
lea eax, [ebp - 0x10]
push 4
push 1
push eax
call fcn.004ecd47
add esp, 0x1c
cmp eax, 4
je 0x40161c
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
push 0
add eax, 0x18
push eax
push dword [esi]
call fcn.004ec744
push dword [esi]
lea eax, [ebp - 0xc]
push 2
push 1
push eax
call fcn.004ecd47
add esp, 0x1c
cmp eax, 2
jne 0x401613
mov eax, dword [ebp - 0x10]
push 0
add eax, 0x14
push eax
push dword [esi]
call fcn.004ec744
push dword [esi]
lea eax, [ebp - 8]
push 2
push 1
push eax
call fcn.004ecd47
add esp, 0x1c
cmp eax, 2
jne 0x401613
mov eax, dword [ebp - 0x10]
push 0
add eax, 6
push eax
push dword [esi]
call fcn.004ec744
push dword [esi]
lea eax, [ebp - 4]
push 2
push 1
push eax
call fcn.004ecd47
add esp, 0x1c
cmp eax, 2
jne 0x401613
push 0x28
call fcn.004ebc43
mov edi, eax
add esp, 4
test edi, edi
je 0x4016dc
movzx ecx, word [ebp - 4]
dec ecx
push 0x28
lea eax, [ecx + ecx*4]
movzx ecx, word [ebp - 8]
add ecx, dword [ebp - 0x10]
lea eax, [eax + 3]
lea eax, [ecx + eax*8]
push eax
push edi
mov ecx, esi
call fcn.004012c0
test eax, eax
je 0x4016dc
mov esi, dword [edi + 0x14]
add esi, dword [edi + 0x10]
push edi
call fcn.004ebc0b
add esp, 4
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
or esi, 0xffffffff
call fcn.004ebc0b
add esp, 4
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401d70
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538342
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x592830]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.UrlDownload.0
mov dword [ebp - 4], 5
cmp dword [esi + 0x48], 0x10
jb 0x401db3
mov ebx, dword [esi + 0x34]
jmp 0x401db6
lea ebx, [esi + 0x34]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401ddd
test eax, 0x400
jne 0x401ddd
push ebx
test al, 0x10
je 0x401dd7
mov ecx, esi
call fcn.00402b70
jmp 0x401ddd
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esi + 0x48], 0x10
jb 0x401de8
mov eax, dword [esi + 0x34]
jmp 0x401deb
lea eax, [esi + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov byte [ebp - 4], 4
cmp dword [esi + 0x80], 0x10
jb 0x401e0a
push dword [esi + 0x6c]
call fcn.004ebc0b
add esp, 4
mov dword [esi + 0x80], 0xf
mov dword [esi + 0x7c], 0
mov byte [esi + 0x6c], 0
mov byte [ebp - 4], 3
mov ecx, dword [esi + 0x64]
test ecx, ecx
je 0x401e2f
call fcn.00514f00
mov byte [ebp - 4], 2
cmp dword [esi + 0x60], 0x10
jb 0x401e44
push dword [esi + 0x4c]
call fcn.004ebc0b
add esp, 4
mov dword [esi + 0x60], 0xf
mov dword [esi + 0x5c], 0
mov byte [esi + 0x4c], 0
mov byte [ebp - 4], 1
cmp dword [esi + 0x48], 0x10
jb 0x401e6b
push dword [esi + 0x34]
call fcn.004ebc0b
add esp, 4
mov dword [esi + 0x48], 0xf
mov dword [esi + 0x44], 0
mov byte [esi + 0x34], 0
mov byte [ebp - 4], 0
cmp dword [esi + 0x30], 0x10
jb 0x401e92
push dword [esi + 0x1c]
call fcn.004ebc0b
add esp, 4
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], 0
mov byte [esi + 0x1c], 0
mov dword [ebp - 4], 0xffffffff
cmp dword [esi + 0x18], 0x10
jb 0x401ebc
push dword [esi + 4]
call fcn.004ebc0b
add esp, 4
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
mov byte [esi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402b70
Capabilities:
Delete directory
Delete file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5383c8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x592830]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov eax, dword [0x592830]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], esi
mov edi, dword [ebp + 8]
push 0x30
lea eax, [esp + 0x20]
push 0
push eax
call fcn.004f2670
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push edi
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.rxmss.dll_RFileEnumFirstA]
test eax, eax
js 0x402d2f
mov ebx, dword [sym.imp.rxmss.dll_RFileEnumNext]
jmp 0x402bf0
test dword [esp + 0x3c], 0x400
jne 0x402d09
mov ecx, dword [esp + 0x40]
mov edx, 0x5411b8
call fcn.004044c0
test eax, eax
je 0x402d09
mov ecx, dword [esp + 0x40]
mov edx, 0x540fc8
call fcn.004044c0
test eax, eax
je 0x402d09
cmp byte [edi], 0
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], 0
mov byte [esp + 0x50], 0
jne 0x402c48
xor eax, eax
jmp 0x402c59
mov eax, edi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402c50
sub eax, edx
push eax
push edi
lea ecx, [esp + 0x58]
call fcn.00405040
push 1
push 0x540ed8
lea ecx, [esp + 0x58]
mov dword [esp + 0x80], 0
call fcn.00404ac0
mov edx, dword [esp + 0x40]
cmp byte [edx], 0
jne 0x402c8c
xor ecx, ecx
jmp 0x402c9e
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402c91
sub ecx, esi
mov esi, dword [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x58]
call fcn.00404ac0
test byte [esp + 0x3c], 0x10
lea eax, [esp + 0x50]
je 0x402cc8
cmp dword [esp + 0x64], 0x10
mov ecx, esi
cmovae eax, dword [esp + 0x50]
push eax
call fcn.00402b70
jmp 0x402cd9
cmp dword [esp + 0x64], 0x10
cmovae eax, dword [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 0x78], 0xffffffff
cmp dword [esp + 0x64], 0x10
jb 0x402cf4
push dword [esp + 0x50]
call fcn.004ebc0b
add esp, 4
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], 0
mov byte [esp + 0x50], 0
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x18]
call ebx
test eax, eax
jns 0x402bf0
push dword [esp + 0x14]
call dword [sym.imp.rxmss.dll_RFileEnumClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004ebb9e
mov esp, ebp
pop ebp
ret 4
Function at 0x402db0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 2
push 0
push esi
mov ebx, ecx
call fcn.004ec744
push esi
call fcn.004ecb1c
mov edi, eax
add esp, 0x10
test edi, edi
jg 0x402de9
push esi
call fcn.004ec63e
add esp, 4
mov eax, 0x80004005
pop edi
pop esi
pop ebx
pop ebp
ret 4
push edi
call fcn.004ebc43
push 0
push 0
push esi
mov dword [ebx], eax
call fcn.004ec744
push esi
push edi
push 1
push dword [ebx]
call fcn.004ecd47
push esi
call fcn.004ec63e
add esp, 0x24
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x403140
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x592830]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push edi
mov dword [ebp - 0x808], ecx
call fcn.004ebbad
add esp, 8
cmp eax, 0xffffffff
jne 0x403177
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, edi
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x403180
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
sub esi, ecx
call fcn.004f2670
mov al, byte [edi + esi - 1]
add esp, 0xc
cmp al, 0x2f
je 0x4031b3
cmp al, 0x5c
je 0x4031b3
push edi
push str._s_dat
jmp 0x4031b9
push edi
push str._sdat
lea eax, [ebp - 0x804]
push eax
call fcn.004ed19d
add esp, 0xc
cmp byte [ebp - 0x804], 0
jne 0x4031d5
xor ecx, ecx
jmp 0x4031e9
lea ecx, [ebp - 0x804]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4031e0
sub ecx, edx
mov esi, dword [ebp - 0x808]
push ecx
lea eax, [ebp - 0x804]
add esi, 0x34
push eax
mov ecx, esi
call fcn.00405040
cmp dword [esi + 0x14], 0x10
jb 0x403209
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004ebb9e
mov esp, ebp
pop ebp
ret 4
Function at 0x4078a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4078ab
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004078c0
Function at 0x429160
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov ebx, ecx
call fcn.00428fe0
mov edi, eax
test edi, edi
jne 0x4291f0
push 0xaf
push str.crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [edi + 1]
lea ecx, [edi + 2]
call fcn.004144f0
push 0x5709a8
push esi
push 0x5709e4
push ebx
push str.fopen_
push 5
call fcn.00415160
add esp, 0x24
call fcn.004eeb81
cmp dword [eax], 2
je 0x4291cb
call fcn.004eeb81
cmp dword [eax], 6
je 0x4291cb
push 0xb8
push str.crypto_bio_bss_file.c
push 2
jmp 0x4291da
push 0xb6
push str.crypto_bio_bss_file.c
push 0x80
mov edx, 0x6d
lea ecx, [edx - 0x4d]
call fcn.004144f0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov ecx, 0x593fec
call fcn.0041b550
mov esi, eax
push edi
test esi, esi
jne 0x42920f
call fcn.004ec63e
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 1
mov edx, 0x6a
mov ecx, esi
call fcn.0041bb80
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x429a90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x592830]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov esi, 0x400
mov dword [ebp - 0x43c], ebx
test edi, edi
jne 0x429acc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ebb9e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x438]
push eax
push edi
call fcn.005089cb
add esp, 8
test eax, eax
js 0x429ab9
xorps xmm2, xmm2
mov edx, 0x30
lea ecx, [ebp - 0x438]
call fcn.00412e80
push 0x540eac
push edi
call fcn.004ec5bd
add esp, 8
mov dword [ebp - 0x440], eax
test eax, eax
je 0x429c01
test dword [ebp - 0x432], 0x2000
je 0x429b30
push 0
push 4
push 0
push eax
call fcn.004efa85
mov eax, dword [ebp - 0x440]
add esp, 0x10
mov edi, 0x400
test esi, esi
jle 0x429b3e
cmp esi, edi
cmovl edi, esi
push eax
push edi
lea eax, [ebp - 0x408]
push 1
push eax
call fcn.004ecd47
mov ebx, eax
add esp, 0x10
test ebx, ebx
jle 0x429bd4
mov eax, dword [0x59faa8]
test eax, eax
jne 0x429b92
lea edx, [eax + 1]
mov ecx, 0x59fbd8
call fcn.0048b190
mov ecx, eax
test ecx, ecx
je 0x429b88
mov eax, dword [ecx + 0x1c]
mov dword [0x59faa8], eax
test eax, eax
jne 0x429c14
call fcn.0042c830
mov eax, 0x5943dc
mov dword [0x59faa8], eax
mov eax, dword [eax + 0xc]
test eax, eax
je 0x429bb6
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
sub esp, 8
lea ecx, [ebp - 0x408]
movsd qword [esp], xmm0
push edi
push ecx
call eax
add esp, 0x10
add dword [ebp - 0x43c], ebx
mov eax, dword [ebp - 0x440]
test esi, esi
jle 0x429b30
sub esi, edi
test esi, esi
jg 0x429b30
push dword [ebp - 0x440]
call fcn.004ec63e
mov ecx, dword [fcn.004f2670]
add esp, 4
lea eax, [ebp - 0x408]
push 0x400
push 0
push eax
call ecx
mov ebx, dword [ebp - 0x43c]
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004ebb9e
mov esp, ebp
pop ebp
ret
mov dword [0x59faa4], ecx
jmp 0x429b92