joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005fbd1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x1005fbeb
call fcn.1000cb56
mov esi, dword [eax + 0xc]
push dword [0x1016c5c8]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x1005fc09
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x1005fc01
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x1005fc36
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x1005fc03
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.1005faff
mov esi, eax
jmp 0x1005fc28

Function at 0x100ded62
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x100ded7a
mov edi, dword [esi + 0xc]
jmp 0x100dedba
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x100ded93
call fcn.10019215
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x100deda8
call fcn.10019215
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x100dedba
call fcn.10019215
call fcn.1000cb56
cmp dword [eax + 0x3c], 0
je 0x100dedcf
push edi
mov ecx, ebx
call fcn.100ddb94
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.100dec7c
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x100deded
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x100dedf9
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x100f9185
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101672f8]
jne 0x100f918f
repz ret
jmp fcn.100ff334
Function at 0x1010e0c5
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xac
mov eax, dword [str.KERNEL32.DLL]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
sub esp, 4
mov edi, eax
mov ebx, dword [0x10164ffc]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
mov eax, dword [0x10164ffc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.1010e07c
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
mov ecx, dword [str.hospice.pdf]
mov eax, 0
cmp word [ebx], 0
je 0x1010e16a
add eax, 1
cmp word [ebx + eax*2], 0
jne 0x1010e160
cmp word [ebx + eax*2 - 2], 0x5c
je 0x1010e183
mov word [ebx + eax*2], 0
sub eax, 1
cmp word [ebx + eax*2 - 2], 0x5c
jne 0x1010e172
movzx edx, byte [ecx]
lea esi, [ebx + eax*2]
lea eax, [ecx + 1]
test dl, dl
je 0x1010e1a4
movsx dx, dl
mov word [esi], dx
movzx edx, byte [eax]
add esi, 2
add eax, 1
test dl, dl
jne 0x1010e190
mov dword [esp + 4], 0x44
lea eax, [esp + 0x5c]
mov dword [esp], eax
call fcn.1010e07c
mov dword [esp + 4], 0x10
lea eax, [esp + 0x4c]
mov dword [esp], eax
call fcn.1010e07c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x1010e405
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub esp, 8
mov ebp, eax
mov esi, dword [0x10164ff8]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
mov eax, dword [0x10164ff8]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.1010e07c
mov dword [esp + 0x48], 0
mov dword [esp + 0x10], 0
lea eax, [esp + 0x48]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x1010e405
mov eax, dword [esp + 0x48]
mov dword [esp + 0x24], eax
mov ebx, dword [0x10164fe8]
add ebx, esi
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
test edx, edx
je 0x1010e2d7
mov eax, 0
add dword [ebx + eax*4 + 8], ecx
add eax, 1
cmp eax, edx
jne 0x1010e2cc
mov eax, dword [0x10164fe4]
add ebx, eax
lea eax, [ebx + 1]
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov ebp, eax
test eax, eax
je 0x1010e405
movsx eax, byte [ebx]
add ebx, eax
lea eax, [ebx + 1]
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov edi, eax
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
nop
mov ecx, 0x6045763d
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x86b66
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4040d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x4040fc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x404124
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x40412a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x404192
jg 0x404141
test esi, esi
je 0x404192
test ecx, ecx
jl 0x40418d
jg 0x40414b
test eax, eax
je 0x40418d
cmp edi, ecx
jg 0x40415f
jl 0x404155
cmp esi, eax
jae 0x40415f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x404195
mov ecx, dword [ebp + 8]
jmp 0x40419f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x4041b9
jg 0x40419f
test esi, esi
je 0x4041b9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x4041b9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4041d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x4041fc
jl 0x4041f0
test ecx, ecx
jne 0x4041fc
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x404215
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x40425d
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x404263
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x404263
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x4042d6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x40428c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x4042c4
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x4042d6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x4042a0
test edi, edi
je 0x4042d6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x45900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x404680
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044c9de
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4046bc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4046bc
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044c9de
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x404793
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4046e4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4046f0
movsx eax, bl
jmp 0x404728
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x404752
sub eax, 1
je 0x404752
sub eax, 2
jne 0x404793
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044c9de
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x404770
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x404793
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044c9de
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044c9de
mov esp, ebp
pop ebp
ret 4
Function at 0x404d50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x45900c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x404e0c
cmp byte [esi + 0x3d], 0
je 0x404e0c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x404dfa
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x404dc1
sub eax, 1
je 0x404dc5
sub eax, 2
jne 0x404dfa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044c9de
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x404de3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x404dfa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044c9de
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044c9de
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0044c9de
mov esp, ebp
pop ebp
ret

Function at 0x408d20
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x408d81
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x408d64
cmp edi, 2
jb 0x408d64
cmp byte [esi], cl
jne 0x408d64
cmp byte [esi + 1], cl
jne 0x408d64
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x44fff8]
jmp 0x408d35
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x44fff8]
test edi, edi
jne 0x408d35
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x408db0
cmp cl, 0x23
jne 0x408d97
cmp byte [esi], cl
jne 0x408d97
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x44fff8]
test cl, cl
jne 0x408d88
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x408ec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x408ed4
mov dword [ebx], 0
mov edx, 0x44f9e8
call fcn.00408dc0
mov esi, eax
test esi, esi
je 0x408fc2
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x408fb8
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x408fb8
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x408fb8
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x408fb8
mov eax, dword [0x4595e8]
test eax, eax
je 0x408f4c
inc dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x408fb8
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x408f9d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x4595e8]
add esp, 4
test eax, eax
je 0x408f8a
dec dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x408faf
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416e50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x45900c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
lea edx, [ebp - 8]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [0x4595e8]
push esi
push edi
mov esi, 4
mov edi, dword [eax + 0x3f04]
mov eax, dword [edi + 0xfc]
mov ebx, dword [edi + 0x104]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x44fff8]
sub esi, 1
jne 0x416e90
mov eax, dword [0x4595e8]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x416eca
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.004282e0
add esp, 8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [edi + 0xfc]
call fcn.004284e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044c9de
mov esp, ebp
pop ebp
ret
Function at 0x41d140
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x53b8], 0
lea esi, [edi + 0x53bc]
je 0x41d1c2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x41d17c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.004290f0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00409500
mov edx, dword [esi]
mov ecx, 0x4595e1
push dword [edi + 0x53b8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x53c4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00409500
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41d5a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
mov dword [ebp - 4], ecx
push esi
lea esi, [ecx + 1]
push edi
test bl, bl
je 0x41d5e8
or edi, 0xffffffff
nop dword [eax]
cmp bl, 0x23
jne 0x41d5cf
cmp byte [esi], bl
jne 0x41d5cf
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x44fff8]
test bl, bl
jne 0x41d5c0
mov ebx, dword [0x4595e8]
mov edi, dword [ebx + 0x5390]
test edi, edi
je 0x41d620
lea esi, [edi + 4]
test esi, esi
je 0x41d620
not eax
cmp dword [esi], eax
je 0x41d62f
mov edx, dword [esi - 4]
mov ecx, dword [ebx + 0x5388]
add edx, esi
add ecx, 4
xor esi, esi
add ecx, edi
cmp edx, ecx
cmovne esi, edx
test esi, esi
jne 0x41d601
mov ecx, dword [ebp - 4]
call fcn.0041d4c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41d640
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x4595e8]
test bl, bl
je 0x41d686
or edi, 0xffffffff
cmp bl, 0x23
jne 0x41d667
cmp byte [esi], bl
jne 0x41d667
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x44fff8]
test bl, bl
jne 0x41d658
mov edi, dword [0x4595e8]
mov esi, dword [edi + 0x537c]
xor ecx, ecx
not eax
test esi, esi
jle 0x41d6ac
mov edi, dword [edi + 0x5384]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x41d6b2
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x41d6a0
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x431500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43153a
mov eax, dword [0x4595e8]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x43152d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x43156b
mov eax, dword [0x4595e8]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x43155e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x43159c
mov eax, dword [0x4595e8]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x43158f
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x4315e9
mov eax, dword [0x4595e8]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x4315dc
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x43161a
mov eax, dword [0x4595e8]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x43160d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x43164b
mov eax, dword [0x4595e8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x43163e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00433e30