joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b17b
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x100691d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x108], ecx
mov esi, dword [ebp + 8]
movzx eax, word [ebp + 0x24]
xor ebx, ebx
push 0xa
push eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x1000d1cd
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000d1cd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov dword [ebp - 0x104], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp dword [ebp - 0x104], ebx
jne 0x1000d0bf
test edi, edi
je 0x1000d1cd
cmp dword [ebp + 0x1c], ebx
jbe 0x1000d149
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x40]
call fcn.10006520
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 1
call fcn.10003d10
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xc4]
call fcn.10005de0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xc4]
call fcn.10005630
lea esi, [edi + 1]
mov byte [ebp - 4], 2
push esi
call fcn.10033d6d
push esi
mov ebx, eax
push 0
push ebx
call fcn.1002f800
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
push edi
push ebx
push dword [ebp - 0x104]
call fcn.100035e0
add esp, 0x20
lea ecx, [ebp - 0x28]
call fcn.10001e90
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10001e90
sub esp, 0x18
mov ecx, ebx
mov edx, esp
lea esi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d164
sub ecx, esi
push ecx
push ebx
mov ecx, edx
call fcn.10002080
lea eax, [ebp - 0x58]
push eax
call fcn.10006950
add esp, 0x1c
push 1
push 1
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x100]
call fcn.1000b1e0
mov esi, dword [ebp - 0x108]
lea eax, [ebp - 0x100]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.1000e440
lea ecx, [ebp - 0x100]
call fcn.1000c0c0
cmp dword [esi + 4], 0
lea ecx, [ebp - 0x58]
seta bl
call fcn.10001e90
jmp 0x1000d1cf
xor bl, bl
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x1000d1ff
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000d1f5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000d21f
push edx
push ecx
call fcn.10018430
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100184a4
mov esp, ebp
pop ebp
ret 0x20
call fcn.10033b09
int3
Function at 0x10010f40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b53b
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x100691d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x414], 0
jne 0x1001114a
call fcn.10011340
test eax, eax
je 0x100110cb
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1002f800
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x10010faa
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10010f00
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.1002f800
mov edi, dword [ebp + 0xc]
add esp, 0x14
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x10010fda
mov eax, dword [edi]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.10010f00
add esp, 8
cmp dword [edi + 0x10], 0
jne 0x10011003
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.10011170
jmp 0x1001114a
xor eax, eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
push 0x10051268
lea ecx, [ebp - 0x438]
mov dword [ebp - 4], eax
call fcn.10007740
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10011040
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x438]
call fcn.10003840
push 2
push 0x1005126c
lea ecx, [ebp - 0x438]
call fcn.10003840
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10011080
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x438]
call fcn.10003840
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
mov ecx, esi
cmovae eax, dword [ebp - 0x438]
push eax
call fcn.10011170
lea ecx, [ebp - 0x438]
call fcn.10003730
jmp 0x1001114a
push 0x104
push 0
push esi
mov byte [esi + 0x414], 1
call fcn.1002f800
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x100110ed
mov eax, dword [eax]
push eax
push esi
call fcn.10010f00
push 0x104
lea edi, [esi + 0x208]
push 0
push edi
call fcn.1002f800
mov eax, dword [ebp + 0xc]
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x10011115
mov eax, dword [eax]
push eax
push edi
call fcn.10010f00
mov eax, dword [ebp + 0x10]
add esp, 8
mov eax, dword [eax]
mov dword [esi + 0x410], eax
lea eax, [ebp - 0x43c]
push eax
push 0
push esi
push 0x100111f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100184a4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011170
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push eax
lea eax, [ebp - 0x54]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push dword [ebp + 8]
movlpd qword [ebp - 0x50], xmm0
push 0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
movups xmmword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100111e1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 4

Function at 0x10011340
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x100691d4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.1002f800
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jg 0x100113b2
cmp dword [ebp - 0x118], 2
jg 0x100113b2
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100184a4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.100184a4
mov esp, ebp
pop ebp
ret
Function at 0x10014ac0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b926
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x100691d4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x10014b6c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x10014b6c
call fcn.10012b40
mov edi, eax
jmp 0x10014c8b
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x10014b8f
call fcn.10012b40
jmp 0x10014c7e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x10014bad
call fcn.10012b40
jmp 0x10014c7e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x10014bce
mov edi, 0x8007000e
jmp 0x10014c80
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x10014cc4
jb 0x10014bec
cmp eax, 0xffffffff
ja 0x10014cc4
cmp eax, 0x400
jbe 0x10014c01
push eax
lea ecx, [ebp - 0x418]
call fcn.10012a60
jmp 0x10014c27
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x10014c27
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x10014c3e
mov edi, 0x8007000e
jmp 0x10014c80
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x10014c5e
call fcn.10012b40
jmp 0x10014c7e
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.10014920
mov edi, eax
test esi, esi
je 0x10014c8b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10014ca4
lea ecx, [ebp - 0x418]
call fcn.10012fe0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100184a4
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.10003bc0
int3
Function at 0x1001a2e4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10044e6d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10044b2d
Function at 0x401050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, dword [ebx + 0x3c]
push edi
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
xor edi, edi
mov ecx, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
add ecx, ebx
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
add ecx, ebx
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 0x18]
add edx, ebx
mov dword [ebp - 4], edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x4010c4
lea esp, [esp]
mov edx, dword [edx + edi*4]
add edx, ebx
mov eax, 0x21f6
movsx esi, byte [edx]
test esi, esi
je 0x4010b7
mov ecx, eax
shl eax, 5
lea edx, [edx + 1]
add eax, esi
movsx esi, byte [edx]
add eax, ecx
test esi, esi
jne 0x4010a1
mov ecx, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
je 0x4010cf
mov edx, dword [ebp - 4]
inc edi
cmp edi, ecx
jb 0x401090
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + edi*2]
pop edi
mov eax, dword [ecx + eax*4]
pop esi
add eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401900
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4021d8
push 0x401aa0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x403050], 0xffffffff
mov dword [0x403054], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x40304c]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x403048]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x403058], ecx
call fcn.00401a90
mov eax, dword [0x403030]
test eax, eax
jne 0x401991
push 0x401a80
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00401a60
push 0x40300c
push 0x403008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x403044]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [0x403040]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x403004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov edx, dword [ebp - 0x20]
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401130
add esp, 0xc
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x401a30
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x403e59
pop dword [ebp - 0x48]
mov eax, 0xac67213f
add eax, 0x53d91d1a
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xcc52f3ed
sub dword [ebp - 0x58], 0x7e00aea2
mov dword [ebp - 0x54], 0x3f8f4d62
add dword [ebp - 0x54], 0xf2a3fee3
mov dword [ebp - 0x50], 0x3c262b26
sub dword [ebp - 0x50], 0xefd9e6f8
mov dword [ebp - 0x4c], 0xe892b835
add dword [ebp - 0x4c], 0x176d47cb
lea eax, [ebp - 0x58]
push eax
mov eax, 0xad9e5d47
sub eax, 0xad5dece3
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xed48cff7
add dword [ebp - 0x58], 0x8729995f
mov dword [ebp - 0x54], 0xa3e05326
add dword [ebp - 0x54], 0x9d8c0e4f
mov dword [ebp - 0x50], 0x23201adf
add dword [ebp - 0x50], 0x404f518d
mov dword [ebp - 0x4c], 0x5da3ce4b
sub dword [ebp - 0x4c], 0x5da3ce4b
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x39409
push 0
call eax
mov ecx, 0x7b684ec1
add ecx, 0x84980344
mov esi, eax
mov edx, 0xd0563a36
sub edx, 0xd0153a36
add edx, dword [ebp - 0x48]
mov ebx, 0xd3a30b5a
sub dword [ebp - 0x38], eax
mov edi, dword [edx]
sub dword [ebp - 4], 0xb91e439a
xor edi, ebx
sub dword [ebp - 0x10], ecx
mov dword [esi], edi
add esi, 0xf61be246
sub esi, 0xf61be242
add edx, 0x7404a9a4
add edx, 0x8bfb5660
loop 0x403f70
add eax, 0x4307c4f6
sub eax, 0x43068a0f
xor ebx, ebx
add ebx, eax
add eax, 0x635d2db8
add eax, 0x9ca2d24d
mov ecx, 0x5bf01d3c
sub ecx, 0x5bb01d3c
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0xef11d0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xef11da
push ds
or al, 0
add byte [eax], al
add byte [eax], al
pushal
call 0xef11e0
pop ebp
sub ebp, 0x10
sub ebp, 0xaf11d0
jmp 0xef11f6
mov eax, 0xaf11d0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c8
mov edx, 0x8b968895
xor byte [eax], dl
inc eax
dec ecx
jne 0xef120d
jmp 0xef1220
push ds
pop eax
push ds
sbb al, 0xa9
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
adc al, 0x54
insd dword es:[edi], dx
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
xchg esi, eax
pop eax
sub eax, 0x95959593
das
mov ebp, 0x62959595
ja 0xef11d3
pop ebp
push ds
adc al, 0x99
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
xchg esi, eax
push eax
sbb cl, dh
mov cl, 0x69
sbb al, 0x91
mov cl, 0xc5
std
jmp 0xfe84c73c
Function at 0x4015b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48dd3d
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4c143c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xorps xmm0, xmm0
xor edi, edi
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
cmp dword [ebx], edi
je 0x401714
mov eax, dword [ebx + 4]
test eax, eax
je 0x401714
cmp eax, 0x8000
ja 0x401714
xor esi, esi
mov dword [ebx + 0xc], edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x6c], eax
lea edx, [edi + 2]
test eax, eax
je 0x40166b
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00458edd
add esp, 4
mov edi, eax
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x401652
mov eax, edi
jmp 0x401677
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.00458ee6
add esp, 4
xor edi, edi
xor ecx, ecx
xor eax, eax
jmp 0x401677
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x6c], eax
test eax, eax
je 0x401710
mov eax, dword [ebx + 4]
mov edx, 2
add eax, 2
mov esi, 0xe
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045f1f4
add esp, 4
mov dword [ebx + 0xc], eax
test eax, eax
je 0x401700
push dword [ebx]
push edi
push str._ls_ls
push dword [ebp - 0x14]
push eax
call fcn.00401480
add esp, 0x14
test eax, eax
js 0x4016fb
push 0x50
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0045b1d0
add esp, 0xc
lea ecx, [ebp - 0x68]
push dword [ebx + 0xc]
call fcn.00403080
push 0
lea ecx, [ebp - 0x68]
call fcn.00402ee0
lea ecx, [ebp - 0x68]
mov esi, eax
call fcn.00403020
jmp 0x401700
mov esi, 0x6f
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x401710
push edi
call fcn.00458ee6
add esp, 4
mov eax, esi
jmp 0x401719
mov eax, 0x57
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458eeb
mov esp, ebp
pop ebp
ret
Function at 0x4023e0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4c143c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push edi
push 0xf0000000
push 1
push 0
push 0
push eax
mov edi, edx
mov dword [ebp - 0xc], 0
mov ebx, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x402465
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x402465
push 0
push edi
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x402465
push 0
lea eax, [ebp - 0x10]
push eax
push esi
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
test eax, eax
je 0x402476
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x402486
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00458eeb
mov esp, ebp
pop ebp
ret 4

Function at 0x4034dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x4034e8
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4034fb
test al, 0x10
jne 0x4034fb
mov al, 1
ret
xor al, al
ret

Function at 0x404c5e
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov esi, dword [eax]
mov edi, 0x811c9dc5
movzx eax, word [eax + 4]
lea ebx, [esi + eax*2]
jmp 0x404c8d
movzx eax, word [esi]
push eax
call fcn.00471042
imul edi, edi, 0x1000193
pop ecx
movzx ecx, ax
xor edi, ecx
add esi, 2
cmp esi, ebx
jne 0x404c75
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x405b93
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x405b9b
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405bae
test al, 0x10
je 0x405bae
mov al, 1
ret
xor al, al
ret
Function at 0x406f14
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0x14
mov eax, dword [0x4c143c]
xor eax, esp
mov dword [esp + 0xc], eax
cmp dword [ecx + 0x14], 8
push ebx
push ebp
push esi
push edi
mov ebp, edx
jb 0x406f30
mov ecx, dword [ecx]
xor edi, edi
push edi
push 0x10000000
push 3
push edi
push 1
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406fc2
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x406fb7
mov eax, dword [esp + 0x14]
cmp eax, edi
jl 0x406fb7
mov ebx, dword [esp + 0x10]
jg 0x406f72
cmp ebx, edi
jbe 0x406fb7
cmp edi, eax
jne 0x406fb7
push edi
push ebx
push edi
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
test edi, edi
je 0x406fb7
xor eax, eax
push eax
push eax
push eax
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x406fab
mov dword [ebp + 4], eax
mov al, 1
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x10], edi
jmp 0x406fc4
cmp edi, 0xffffffff
je 0x406fb7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x406fc2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00458eeb
add esp, 0x14
ret
Function at 0x409a87
Capabilities:
Allocate thread local storage
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], esi
and dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], 0x4e4
and dword [esi + 0x28], 0
push 0xc
push eax
mov word [esi + 0x18], ax
lea eax, [esi + 4]
push eax
mov dword [esi + 0x2c], 7
call fcn.0045b1d0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [section..data], eax
cmp eax, 0xffffffff
jne 0x409adf
push str.TlsAlloc___failed.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
pop esi
leave
ret

Function at 0x409b79
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409b8e
xor eax, eax
jmp 0x409b98
and al, 0x10
xor cl, cl
cmp cl, al
sbb eax, eax
neg eax
pop ebp
ret 4

Function at 0x409c0e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4c143c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov edi, ecx
call fcn.00409b79
test eax, eax
jne 0x409cb0
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0045b1d0
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0045ed7b
add esp, 0x18
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.0040a71a
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0045b45b
pop ecx
pop ecx
test eax, eax
jne 0x409c80
push 0xf
pop eax
jmp 0x409cb2
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.00409c0e
test eax, eax
jne 0x409cb2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x409cb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x409cb2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00458eeb
leave
ret 4

Function at 0x40a6d3
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
test dword [ebp + 0xc], 0x100
je 0x40a6ee
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 0x10]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0x40
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.0045fe69
mov ecx, dword [ebp - 4]
or edx, 0xffffffff
add esp, 0x14
test eax, eax
cmovne ecx, edx
mov eax, ecx
leave
ret 0xc