joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f76a
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48264d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
mov eax, dword [0x49e390]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x48], 1
call fcn.00432a05
call dword [0x484208]
mov dword [esp + 0x10], eax
jmp 0x42f7cf
xor esi, esi
mov ebx, dword [0x484208]
call ebx
sub eax, dword [esp + 0x10]
cmp eax, 0x3e8
jb 0x42f7f4
call ebx
cmp dword [ebp + 8], esi
mov dword [esp + 0x10], eax
je 0x42f7f4
mov ecx, edi
call fcn.004301da
mov eax, dword [edi + 0x108]
cmp eax, esi
mov ecx, dword [edi + 0x104]
je 0x42f87a
cmp eax, 0xffffffff
je 0x42f87a
cmp ecx, esi
push 2
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
pop eax
je 0x42f81d
cmp ecx, 0xffffffff
jne 0x42f820
xor eax, eax
inc eax
push 1
push 0x64
push esi
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [0x48412c]
cmp eax, esi
je 0x42f87a
cmp eax, 1
jne 0x42f7cf
cmp dword [esp + 0x20], esi
je 0x42f84a
push dword [esp + 0x20]
call fcn.0045ea9c
pop ecx
cmp dword [esp + 0x30], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
je 0x42f866
push dword [esp + 0x30]
call fcn.0045ea9c
pop ecx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [edi + 0x140]
push eax
call dword [0x484310]
lea esi, [edi + 0x114]
mov ebx, esi
lea eax, [esp + 0x2c]
call fcn.0043291f
call fcn.00432b42
lea esi, [edi + 0x124]
mov ebx, esi
lea eax, [esp + 0x1c]
call fcn.0043375a
call fcn.0043389e
lea eax, [edi + 0x140]
push eax
call dword [0x484330]
lea eax, [esp + 0x2c]
call fcn.00432acd
mov esi, eax
test esi, esi
je 0x42f8ed
ja 0x42f8d6
call fcn.0045fb07
test esi, esi
jle 0x42f8ed
mov ebx, dword [esp + 0x30]
mov edx, ebx
mov ecx, edi
call fcn.00431c24
add ebx, 0x68
dec esi
jne 0x42f8de
cmp dword [esp + 0x20], 0
je 0x42f7cd
mov esi, dword [esp + 0x24]
sub esi, dword [esp + 0x20]
sar esi, 6
je 0x42f7cd
test esi, esi
ja 0x42f914
call fcn.0045fb07
test esi, esi
jle 0x42f7cd
mov ebx, dword [esp + 0x20]
mov edx, ebx
mov ecx, edi
call fcn.004318a0
add ebx, 0x40
dec esi
jne 0x42f91e
jmp 0x42f7cd
Function at 0x401341
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push 0x44
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x54]
push edi
push eax
call fcn.00401312
push 0x10
lea eax, [ebp - 0x10]
push edi
push eax
mov dword [ebp - 0x54], esi
call fcn.00401312
push dword [ebp + 0xc]
mov esi, section..data
push dword [ebp + 8]
push str.__s___s
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
neg eax
sbb eax, eax
neg eax
pop edi
dec eax
pop esi
leave
ret
Function at 0x5c8350
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
jne 0x5c836f
mov ebx, dword [ebp + 8]
push eax
call fcn.005c7920
test al, al
je 0x5c83a9
mov ebx, dword [ebp + 0xc]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5c8377
sub eax, edx
mov esi, eax
push esi
mov dword [ebp + 0xc], esi
call fcn.005ced64
lea ecx, [ebp + 0xc]
push ecx
mov edi, eax
push edi
push esi
push ebx
call fcn.005c4680
add esp, 0x14
test al, al
jne 0x5c83b4
push edi
call fcn.005cf454
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
xor ebx, ebx
push edx
push edi
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x2c], 0x67452301
mov dword [ebp - 0x28], 0xefcdab89
mov dword [ebp - 0x24], 0x98badcfe
mov dword [ebp - 0x20], 0x10325476
mov dword [ebp - 0x1c], 0xc3d2e1f0
mov byte [ebp - 0x7c], bl
call fcn.005c4790
mov dword [ebp + 0xc], 0x40
cmp byte [ebp - 0x7c], bl
jne 0x5c8407
call fcn.005c4d10
mov byte [ebp - 0x7c], 1
xor eax, eax
lea esp, [esp]
mov ecx, dword [ebp + eax*4 - 0x2c]
bswap ecx
mov dword [ebp + eax*4 - 0x18], ecx
inc eax
cmp eax, 5
jb 0x5c8410
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x18]
push 0x14
push ecx
call fcn.005c4560
mov edx, dword [ebp + 0xc]
push edi
mov byte [ebp + edx - 0xbc], bl
call fcn.005cf454
mov bl, byte [ebp + 0x10]
add esp, 0x14
mov eax, 0x5e0438
test bl, bl
jne 0x5c845a
mov eax, 0x5e0450
mov edi, dword [ebp + 8]
push 0
push eax
call fcn.005c7e30
push 1
lea eax, [ebp - 0xbc]
push eax
call fcn.005c7e30
test bl, bl
je 0x5c847c
call fcn.005c7f10
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x433006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx - 0x6f6ffb3d], eax
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00431219
Function at 0x43b637
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
mov edi, dword [esp]
add esp, 4
sub edx, edx
add edx, 1
call fcn.0043b67f
sub esi, esi
add edx, edx
xor dword [ebx], edi
or edx, esi
add esi, 1
inc ebx
mov esi, 0x9d157086
add edx, esi
mov edx, edx
cmp ebx, eax
jne fcn.0043b637
sub esp, 4
mov dword [esp], 0x60a8ef0f
pop esi
mov esi, esi
ret
Function at 0x402d90
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa1840
call fcn.0040d7f0
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xa1820], 0
push eax
push eax
push eax
mov word [ebp - 0xa180c], ax
lea eax, [ebp - 0xa181c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xa1820]
mov dword [ebp - 0xa181c], 0x10001
push eax
mov dword [ebp - 0xa1818], 0x5622
mov dword [ebp - 0xa1814], 0x5622
mov dword [ebp - 0xa1810], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xa17fc
lea eax, [ebp - 0xa1808]
push 0
push eax
call fcn.004043f0
add esp, 0xc
xor eax, eax
mov edx, eax
mov ecx, eax
shr edx, 0xd
shr ecx, 8
or dl, cl
movsx ecx, al
movsx edx, dl
imul edx, ecx
mov ecx, eax
shr ecx, 0x10
xor cl, al
or dl, cl
add dl, 0x40
mov byte [ebp + eax - 0xa1808], dl
inc eax
cmp eax, 0xa17fc
jb 0x402e13
lea eax, [ebp - 0xa1808]
mov dword [ebp - 0xa183c], 0xa17fc
mov dword [ebp - 0xa1840], eax
lea eax, [ebp - 0xa1840]
push 0x20
push eax
push dword [ebp - 0xa1820]
mov dword [ebp - 0xa1838], 0
mov dword [ebp - 0xa1834], 0
mov dword [ebp - 0xa1830], 0
mov dword [ebp - 0xa182c], 0
mov dword [ebp - 0xa1828], 0
mov dword [ebp - 0xa1824], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403605
mov esp, ebp
pop ebp
ret
Function at 0x4031c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50c40
call fcn.0040d7f0
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x50c20], 0
push eax
push eax
push eax
mov word [ebp - 0x50c0c], ax
lea eax, [ebp - 0x50c1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50c20]
mov dword [ebp - 0x50c1c], 0x10001
push eax
mov dword [ebp - 0x50c18], 0x2b11
mov dword [ebp - 0x50c14], 0x2b11
mov dword [ebp - 0x50c10], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x50bfe
lea eax, [ebp - 0x50c08]
push 0
push eax
call fcn.004043f0
add esp, 0xc
xor eax, eax
mov ecx, eax
mov edx, 4
shr ecx, 2
sar edx, cl
mov ecx, eax
xor dl, al
shr ecx, 6
or dl, cl
mov byte [ebp + eax - 0x50c08], dl
inc eax
cmp eax, 0x50bfe
jb 0x403243
lea eax, [ebp - 0x50c08]
mov dword [ebp - 0x50c3c], 0x50bfe
mov dword [ebp - 0x50c40], eax
lea eax, [ebp - 0x50c40]
push 0x20
push eax
push dword [ebp - 0x50c20]
mov dword [ebp - 0x50c38], 0
mov dword [ebp - 0x50c34], 0
mov dword [ebp - 0x50c30], 0
mov dword [ebp - 0x50c2c], 0
mov dword [ebp - 0x50c28], 0
mov dword [ebp - 0x50c24], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403605
mov esp, ebp
pop ebp
ret
Function at 0x1024cac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10c09c0]
jne 0x1024cb6
repz ret
jmp fcn.0102afdc

Function at 0x10339b3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0102a916
and dword [ebp - 4], 0
cmp dword [0x11c5d78], 0
mov ebx, eax
jne 0x1033a64
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1033b15
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1033b15
push eax
call fcn.0102a8a4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x11c5d78], eax
call esi
push eax
call fcn.0102a8a4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x11c5d7c], eax
call esi
push eax
call fcn.0102a8a4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x11c5d80], eax
call esi
push eax
call fcn.0102a8a4
pop ecx
mov dword [0x11c5d88], eax
test eax, eax
je 0x1033a64
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0102a8a4
pop ecx
mov dword [0x11c5d84], eax
mov eax, dword [0x11c5d84]
cmp eax, ebx
je 0x1033abc
cmp dword [0x11c5d88], ebx
je 0x1033abc
push eax
call fcn.0102a91f
push dword [0x11c5d88]
mov esi, eax
call fcn.0102a91f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1033abc
test edi, edi
je 0x1033abc
call esi
test eax, eax
je 0x1033ab3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1033ab3
test byte [ebp - 0xc], 1
jne 0x1033abc
or dword [ebp + 0x10], 0x200000
jmp 0x1033af5
mov eax, dword [0x11c5d7c]
cmp eax, ebx
je 0x1033af5
push eax
call fcn.0102a91f
pop ecx
test eax, eax
je 0x1033af5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1033af5
mov eax, dword [0x11c5d80]
cmp eax, ebx
je 0x1033af5
push eax
call fcn.0102a91f
pop ecx
test eax, eax
je 0x1033af5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x11c5d78]
call fcn.0102a91f
pop ecx
test eax, eax
je 0x1033b15
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1033b17
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401a80
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x406480
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4064a1
mov eax, 0xff
call fcn.00401a80
xor byte [esi], al
inc esi
dec ebx
jne 0x406491
pop esi
pop ebx
ret

Function at 0x40c350
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0x43fe98
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_short_int_const____thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::c_str_void_const]
push eax
call fcn.0040edd0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40c382
mov eax, dword [ebp - 4]
jmp 0x40c47f
push 4
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40c39e
mov eax, dword [ebp - 4]
jmp 0x40c47f
push 4
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
push 4
push 1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx]
cmp eax, 0xeffe
jne 0x40c3f7
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 2]
test edx, edx
jne 0x40c3f7
mov dword [ebp - 4], 6
jmp 0x40c46f
mov eax, dword [ebp - 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x40c418
mov edx, dword [ebp - 8]
movzx eax, word [edx + 2]
cmp eax, 0xfeff
jne 0x40c418
mov dword [ebp - 4], 7
jmp 0x40c46f
mov ecx, dword [ebp - 8]
movzx edx, word [ecx]
cmp edx, 0xefbb
jne 0x40c444
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 2]
or ecx, 0xff00
cmp ecx, 0xbf
jne 0x40c444
mov dword [ebp - 4], 1
jmp 0x40c46f
mov edx, dword [ebp - 8]
movzx eax, word [edx]
cmp eax, 0xfeff
jne 0x40c45a
mov dword [ebp - 4], 3
jmp 0x40c46f
mov ecx, dword [ebp - 8]
movzx edx, word [ecx]
cmp edx, 0xfffe
jne 0x40c46f
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x40cd10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x43fe98
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_short_int_const____thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::c_str_void_const]
push eax
call fcn.0040edd0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40cd38
xor al, al
jmp 0x40cdce
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCR80.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCR80.dll_ftell]
add esp, 4
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCR80.dll_rewind]
add esp, 4
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
add edx, 2
push edx
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
jne 0x40cd8b
xor al, al
jmp 0x40cdce
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
add ecx, 2
push ecx
push 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
push 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40cde0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x43fefc
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_short_int_const____thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::c_str_void_const]
push eax
call fcn.0040edd0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40ce05
xor al, al
jmp 0x40ce2b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40deb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x45da50]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x40df48
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40df13
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const__]
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x40df48
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 0x14]
call ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [eax + 8]
call edx
cmp dword [ebp - 8], 0
sete al
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00430f9c
mov esp, ebp
pop ebp
ret 8

Function at 0x40e050
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x45da50]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
push 0
lea eax, [ebp - 0x128]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x128], 0x114
push 0x24
push 0
lea ecx, [ebp - 0x14c]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [ebp - 0x14c]
cmp ecx, 9
je 0x40e0c8
movzx edx, word [ebp - 0x14c]
cmp edx, 6
jne 0x40e0db
call fcn.0040e000
test eax, eax
je 0x40e0d7
mov al, 1
jmp 0x40e0ec
xor al, al
jmp 0x40e0ec
call fcn.0040e000
test eax, eax
je 0x40e0ea
mov al, 1
jmp 0x40e0ec
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430f9c
mov esp, ebp
pop ebp
ret
Function at 0x40eec0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
jmp 0x40eed8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jg 0x40ef5f
push 8
mov edx, dword [ebp - 4]
push edx
call fcn.0040ef70
shl eax, 0x18
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [edx + ecx*4], eax
mov dword [ebp - 8], 0
jmp 0x40ef09
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 8
jge 0x40ef40
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx*4]
shl eax, 1
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + ecx*4]
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
xor eax, ecx
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx + edx*4], eax
jmp 0x40ef00
push 0x20
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.0040ef70
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx + edx*4], eax
jmp 0x40eecf
mov esp, ebp
pop ebp
ret 8

Function at 0x40f050
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
jmp 0x40f068
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xff
jg 0x40f0c0
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 8
jmp 0x40f089
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jle 0x40f0b1
mov eax, dword [ebp - 4]
and eax, 1
je 0x40f0a7
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, 0x4c11db7
mov dword [ebp - 4], ecx
jmp 0x40f0af
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jmp 0x40f080
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax*4 + 0x45dbf0], ecx
jmp 0x40f05f
mov esp, ebp
pop ebp
ret

Function at 0x40f130
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x45da50]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
push eax
push 0x200
push 1
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
and edx, 0x8000001f
jns 0x40f17f
dec edx
or edx, 0xffffffe0
inc edx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
test edx, edx
jne 0x40f1a1
call dword [sym.imp.MSVCR80.dll___iob_func]
add eax, 0x20
push eax
push 0x2e
call dword [sym.imp.MSVCR80.dll_putc]
add esp, 8
cmp dword [ebp - 4], 0
jne 0x40f1a9
jmp 0x40f1c2
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0040f0d0
mov dword [ebp - 8], eax
jmp 0x40f151
call dword [sym.imp.MSVCR80.dll___iob_func]
add eax, 0x20
push eax
push 0x20
call dword [sym.imp.MSVCR80.dll_putc]
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, 0xffffffff
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00430f9c
mov esp, ebp
pop ebp
ret 4
Function at 0x415900
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4343ec
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x45da50]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45da50]
xor eax, esp
push eax
lea eax, [esp + 0x244]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x254]
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
push eax
push ebx
push ecx
push ebx
lea eax, [esp + 0x24]
push eax
mov ecx, ebx
call fcn.00414f10
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call esi
lea ecx, [esp + 0x38]
push ecx
push 0x104
call esi
cmp word [esp + 0x38], 0
lea ebp, [esp + 0x38]
je 0x4159fd
nop
push ebp
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x4159de
push ebp
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_unsigned_short_int_const__]
mov esi, dword [ebx + 4]
mov eax, dword [esi + 4]
lea edx, [esp + 0x1c]
push edx
push eax
push esi
mov ecx, ebx
mov dword [esp + 0x258], 0
call fcn.00406e60
push 1
mov ecx, ebx
mov edi, eax
call fcn.004044c0
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
lea ecx, [esp + 0x1c]
mov dword [eax], edi
mov dword [esp + 0x24c], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4159e3
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 + 2], cx
lea ebp, [ebp + eax*2 + 2]
jne 0x415980
mov ecx, dword [esp + 0x244]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00430f9c
add esp, 0x23c
ret 4