joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2e00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x53000]
push edi
or ebp, 0xffffffff
jmp 0x4a2e22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a2e29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a2e18
mov eax, 1
add ebx, ebx
jne 0x4a2e3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a2e4c
jne 0x4a2e6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a2e6b
dec eax
add ebx, ebx
jne 0x4a2e58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a2e30
add ebx, ebx
jne 0x4a2e67
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4a2ebd
xor ecx, ecx
sub eax, 3
jb 0x4a2e83
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a2ef2
sar eax, 1
mov ebp, eax
jmp 0x4a2e8e
add ebx, ebx
jne 0x4a2e8e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a2e5c
inc ecx
add ebx, ebx
jne 0x4a2e9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a2e5c
add ebx, ebx
jne 0x4a2ea9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a2e9e
jne 0x4a2eba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a2e9e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a2edc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a2ece
jmp 0x4a2e1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a2edc
add edi, ecx
jmp 0x4a2e1e
pop esi
mov edi, esi
mov ecx, 0x12
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a2efa
cmp byte [edi], 0
jne 0x4a2efa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a2eff
lea edi, [esi + 0xa0000]
mov eax, dword [edi]
or eax, eax
je 0x4a2f6e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa5c00]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa5c50]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a2f2c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa5c54]
or eax, eax
je 0x4a2f68
mov dword [ebx], eax
add ebx, 4
jmp 0x4a2f49
call dword [esi + 0xa5c64]
mov ebp, dword [esi + 0xa5c58]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4a2fa2
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x402a80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402a99
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402ad4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402ad0
lea ebx, [ebx]
cmp esi, eax
jae 0x402ad4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402ac0
cmp esi, eax
jb 0x402ada
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x404ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x404f33
test esi, esi
je 0x404f33
mov ebp, dword [esp + 0x18]
test ebp, ebp
jbe 0x404f33
xor eax, eax
test ebp, ebp
jbe 0x404f28
mov cl, byte [eax + edi]
mov edx, esi
sar edx, 8
xor dl, cl
movzx ecx, cl
add ecx, esi
imul ecx, ecx, 0xce6d
mov byte [eax + edi], dl
add ecx, 0x58bf
add eax, 1
cmp eax, ebp
mov esi, ecx
jb 0x404f01
pop edi
pop esi
mov eax, 1
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebp
ret 0xc

Function at 0x404f40
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
ret

Function at 0x4050c0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x44e968
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x46b9d8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SoftwareMyRxjh
push reloc.WS2_32.dll_accept
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405121
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareMyRxjh
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx - 0xc]
lea esi, [ecx - 0x10]
mov eax, esi
cmp dword [eax + 0xc], 1
jle 0x405149
mov edx, dword [eax + 4]
push edx
lea ecx, [esp + 0x28]
call fcn.00402cc0
mov ecx, dword [esp + 0x24]
lea esi, [ecx - 0x10]
mov eax, esi
or ebx, 0xffffffff
add dword [eax + 0xc], ebx
jne 0x405154
mov dword [eax + 0xc], ebx
mov eax, dword [esp + 0x10]
push edi
push ecx
push 1
push 0
push str.Path
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esp + 0x1c], ebx
lea ecx, [esi + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x405184
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x406e00
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
push esi
xor ebx, ebx
xor ecx, ecx
test bl, 1
je 0x406e10
mov ecx, 0x80
mov eax, ebx
shr eax, 1
test al, 1
je 0x406e1b
or ecx, 0x40
shr eax, 1
test al, 1
je 0x406e24
or ecx, 0x20
shr eax, 1
test al, 1
je 0x406e2d
or ecx, 0x10
shr eax, 1
test al, 1
je 0x406e36
or ecx, 8
shr eax, 1
test al, 1
je 0x406e3f
or ecx, 4
shr eax, 1
test al, 1
je 0x406e48
or ecx, 2
test al, 2
je 0x406e4f
or ecx, 1
shl ecx, 0x18
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov dword [ebx*4 + 0x4700d0], ecx
mov eax, ecx
xor edx, edx
mov ecx, 0x1f
mov edi, edi
test al, 1
je 0x406f1d
mov esi, 1
shl esi, cl
or edx, esi
sub ecx, 1
shr eax, 1
cmp ecx, 0xffffffff
jg 0x406f10
mov dword [ebx*4 + 0x4700d0], edx
add ebx, 1
cmp ebx, 0xff
jle 0x406e04
pop esi
pop ebx
ret

Function at 0x406ff0
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov al, byte [esi + 1]
mov bl, byte [esi]
push edi
mov edi, dword [esp + 0x14]
xor ecx, ecx
test edi, edi
mov byte [esp + 0x10], al
jbe 0x407069
lea ebx, [ebx]
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
je 0x407062
mov eax, 0x24924925
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 2
lea edx, [eax*8]
sub edx, eax
mov eax, ecx
sub eax, edx
je 0x407062
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea edx, [edx + edx*2]
mov eax, ecx
sub eax, edx
je 0x407062
mov dl, byte [ecx + esi]
sub dl, byte [esp + 0x10]
xor dl, bl
mov byte [ecx + esi], dl
add ecx, 1
cmp ecx, edi
jb 0x407010
movzx eax, byte [esi + 0x3c]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x5a
mov byte [eax + esi], 0x50
movzx ecx, byte [esi + 0x3c]
pop edi
mov byte [ecx + esi + 1], 0x45
pop esi
mov eax, 1
pop ebx
ret
Function at 0x407090
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, dword [esp + 0x10]
movzx ecx, word [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
mov dword [esp + 0x20], 0
call fcn.00413466
push esi
mov edi, eax
push 0
push edi
call fcn.00438170
push esi
push ebx
push edi
call fcn.00438760
add esp, 0x1c
test esi, esi
je 0x40714a
mov edx, dword [esp + 0x14]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
test ebx, ebx
je 0x40714a
push esi
push edi
call fcn.00406ff0
add esp, 8
push 0
lea eax, [esp + 0x20]
push eax
push esi
push edi
push ebx
mov byte [edi], 0x4d
mov byte [edi + 1], 0x5a
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.0041346b
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
ret 0x10
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10

Function at 0x407540
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
mov edx, dword [edx]
or eax, 0xffffffff
test ecx, ecx
je 0x407576
push esi
push edi
movzx edi, byte [edx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x4700d0]
sub ecx, 1
add edx, 1
test ecx, ecx
jne 0x407553
pop edi
pop esi
not eax
ret
Function at 0x407d90
Capabilities:
Copy file
Create process on windows
Delete file

Disassembly:
sub esp, 0x260
mov eax, dword [0x46b9d8]
xor eax, esp
mov dword [esp + 0x25c], eax
push ebx
push esi
push edi
push 0x207
lea eax, [esp + 0x65]
push 0
push eax
mov byte [esp + 0x6c], 0
call fcn.00438170
mov edi, dword [esp + 0x284]
push 0x4541f2
push edi
call fcn.004383b9
mov esi, dword [esp + 0x288]
mov ebx, dword [esp + 0x284]
add esp, 0x14
test eax, eax
push 0
push esi
jne 0x407df0
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x407dfe
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebp
push 0
push 0x4000000
push 3
push 0
push 1
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x44
lea ecx, [esp + 0x24]
push 0
push ecx
mov edi, eax
call fcn.00438170
push ebx
push edi
xor eax, eax
push esi
lea edx, [esp + 0x7c]
push str._s__d___s_
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 0x44
mov word [esp + 0x70], ax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [esp + 0x84]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test ebp, ebp
je 0x407ea1
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
pop ebp
je 0x407ead
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407ec9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebx
jg 0x407ee8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x26c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407f0b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.00437a5c
add esp, 0x260
ret 0xc
Function at 0x407f30
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x158
mov eax, dword [0x46b9d8]
xor eax, esp
mov dword [esp + 0x154], eax
mov eax, dword [0x46a278]
push ebx
push esi
mov esi, dword [esp + 0x164]
shl eax, 4
mov ecx, dword [eax + 0x4704f4]
mov edx, dword [eax + 0x4704f0]
push esi
push ecx
push edx
lea eax, [esp + 0x68]
push str..clientclient.exe__s__s__k_192198425__t_28665689__s
push eax
call fcn.00439335
push 0x44
lea ecx, [esp + 0x30]
push 0
push ecx
call fcn.00438170
add esp, 0x20
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x1c]
push eax
push str..client
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x7c]
push ecx
push 0
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
lea eax, [esi - 0x10]
setne bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407fd3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x15c]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.00437a5c
add esp, 0x158
ret

Function at 0x408850
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x44f092
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x46b9d8]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46b9d8]
xor eax, esp
push eax
lea eax, [esp + 0x124]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x134]
xor eax, eax
mov dword [esp + 0x14], eax
push 0x103
push eax
mov dword [esp + 0x134], eax
mov byte [esp + 0x24], al
lea eax, [esp + 0x25]
push eax
mov edi, ecx
mov dword [esp + 0x24], ebp
call fcn.00438170
mov esi, dword [0x46a23a]
mov ebx, dword [0x46a23e]
push esi
lea ecx, [esp + 0x2c]
push 0x46a242
push ecx
call fcn.00438760
mov ecx, dword [edi + 0x27dc]
add esp, 0x18
test ecx, ecx
je 0x40896d
push esi
push ebx
lea edx, [esp + 0x24]
push edx
call fcn.00404ee0
call fcn.0041b4c9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40890c
push 0x80004005
call fcn.00401010
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp], eax
lea ecx, [esp + 0x1c]
push ecx
push 0x454a2c
push ebp
mov dword [esp + 0x138], 0
mov dword [esp + 0x20], 1
call fcn.004086b0
add esp, 0xc
mov eax, ebp
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.00437a5c
add esp, 0x11c
ret 8
push 0
push 0x454a28
push 0x454a0c
mov ecx, edi
call fcn.00415c92
push 0xffffffffffffffff
call fcn.00439667
int3
Function at 0x40e2b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x44fb83
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46b9d8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.0041c3ec
xor ecx, ecx
lea ebp, [esi + 0x10]
mov dword [esi], vtable.CMemDC.0
mov dword [esp + 0x28], ecx
mov dword [ebp + 4], ecx
mov dword [ebp], vtable.CBitmap.0
mov ebx, dword [esp + 0x30]
xor eax, eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ecx
cmp dword [ebx + 0xc], ecx
mov byte [esp + 0x28], 1
sete al
cmp eax, ecx
mov dword [esi + 0x30], eax
je 0x40e380
mov eax, dword [ebx]
mov edx, dword [eax + 0x50]
lea edi, [esi + 0x20]
push edi
mov ecx, ebx
call edx
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, esi
call fcn.0041c8fa
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
mov ecx, dword [edi + 8]
sub ecx, dword [edi]
push eax
mov eax, dword [ebx + 4]
push ecx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, ebp
call fcn.0041cbc1
test ebp, ebp
je 0x40e35e
mov ebp, dword [ebp + 4]
mov ecx, dword [esi + 4]
push ebp
push ecx
call fcn.0041cc8f
mov edx, dword [esi + 0x24]
mov dword [esi + 0x18], eax
mov eax, dword [edi]
push edx
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0041c500
jmp 0x40e392
mov edx, dword [ebx + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov ecx, dword [ebx + 8]
mov dword [esi + 8], ecx
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x40f980
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x40f98b
xor eax, eax
ret
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x14]
cmp edi, 8
not esi
jb 0x40fa87
push ebp
mov ebp, edi
shr ebp, 3
jmp 0x40f9b0
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + 0x456a90]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x456a90]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + 0x456a90]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x456a90]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x456a90]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x456a90]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x456a90]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x456a90]
add ecx, 1
sub edi, 8
sub ebp, 1
mov esi, eax
jne 0x40f9b0
pop ebp
test edi, edi
je 0x40faac
jmp 0x40fa90
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x456a90]
add ecx, 1
sub edi, 1
jne 0x40fa90
mov eax, esi
pop edi
not eax
pop esi
ret

Function at 0x40fac0
Capabilities:
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [edx]
movzx ecx, byte [esp + 8]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x456a90]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
add eax, 1
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x456a90]
mov dword [edx + 8], ecx
ret

Function at 0x410060
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ebx
imul esi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x4100a2
mov ecx, dword [esp + 0x10]
mov edx, dword [edi + 4]
push 0
lea eax, [esp + 0x18]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x410096
mov byte [edi + 8], 1
mov eax, dword [esp + 0x14]
pop edi
xor edx, edx
pop esi
div ebx
pop ebx
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
lea edx, [ecx + esi]
cmp edx, eax
jbe 0x4100b3
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
add eax, ecx
mov ecx, dword [esp + 0x10]
push esi
push eax
push ecx
call fcn.00438760
add dword [edi + 0x1c], esi
add esp, 0xc
pop edi
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
ret
Function at 0x411060
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x46b9d8]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
mov ebp, dword [esp + 0x218]
push edi
mov edi, dword [esp + 0x218]
test edi, edi
je 0x41109d
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41109d
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [ebp]
test al, al
je 0x41115d
push esi
mov esi, ebp
mov ecx, ebp
lea ecx, [ecx]
cmp al, 0x2f
je 0x4110b8
cmp al, 0x5c
jne 0x4110ba
mov esi, ecx
mov al, byte [ecx + 1]
add ecx, 1
test al, al
jne 0x4110b0
cmp esi, ebp
je 0x4110f2
sub esi, ebp
push esi
lea eax, [esp + 0x114]
push ebp
push eax
call fcn.00438760
lea ecx, [esp + 0x11c]
push ecx
push edi
mov byte [esp + esi + 0x124], 0
call fcn.00411060
add esp, 0x14
test edi, edi
mov byte [esp + 0xc], 0
je 0x41110f
lea edx, [esp + 0xc]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x411103
mov eax, ebp
mov edx, ebp
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x411113
lea edi, [esp + 0xc]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x411125
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0xc]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
pop esi
jne 0x41115d
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [esp + 0x210]
pop edi
pop ebp
xor ecx, esp
call fcn.00437a5c
add esp, 0x20c
ret
Function at 0x412950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
cmp edi, ebx
jne 0x41296a
pop edi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x18], ebx
je 0x41295f
cmp dword [edi + 0x7c], ebx
je 0x41297d
push edi
call fcn.004109c0
add esp, 4
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push edi
call fcn.004107e0
add esp, 0x10
test eax, eax
je 0x4129a4
pop edi
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
push esi
push 0x84
call fcn.00439bb9
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4129e5
push 0x4000
call fcn.00439bb9
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add esp, 4
cmp eax, ebx
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0x4129f1
push esi
call fcn.00439d80
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x412a3d
lea eax, [esi + 4]
push eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.0040fd70
add esp, 4
test eax, eax
jne 0x412a3d
mov dword [esi + 0x40], 1
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x58], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x5c], edx
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov ecx, dword [edi + 0x30]
shr ecx, 3
test cl, 1
je 0x412a67
mov dl, byte [edi + 0x39]
mov byte [esi + 0x80], dl
jmp 0x412a70
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov cl, byte [esi + 0x6c]
neg cl
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [esi + 0x70]
mov dword [ebx], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
sbb ecx, ecx
and ecx, 0xc
test ebp, ebp
mov dword [esi + 0x7c], ecx
je 0x412ab7
lea ecx, [ecx]
movzx eax, byte [ebp]
test al, al
je 0x412ab7
push eax
push ebx
call fcn.0040fac0
add esp, 8
add ebp, 1
jne 0x412aa0
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x14]
lea ecx, [edx + eax + 0x1e]
pop ebp
mov dword [esi + 0x3c], ecx
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 8
ret