joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411ad0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, dword [0x421070]
mov esi, dword [ebp + 0xc]
test ebx, ebx
je 0x411ba1
mov eax, dword [0x421580]
mov edx, 0x40
sub edx, eax
mov ebx, dword [ebp + 8]
cmp esi, edx
jl 0x411baf
add eax, 0x421540
push ecx
push edx
push ebx
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [0x421580]
mov eax, 0x40
sub eax, edx
pop ecx
add ebx, eax
sub esi, eax
pop eax
push 0x421540
push 0x42152c
call fcn.004155d0
mov edx, dword [0x421528]
xor ecx, ecx
add esp, 0x10
mov al, byte [ecx + 0x421540]
xor byte [edx + 0x421078], al
inc edx
cmp edx, 0x4b0
setl al
and eax, 0xff
inc ecx
neg eax
and edx, eax
cmp ecx, 0x14
jne 0x411b38
mov dword [0x421528], edx
cmp edx, 0x13
jle 0x411ba8
xor eax, eax
mov dword [0x421580], 0
mov edx, 0x40
cmp esi, 0x3f
jg 0x411afd
mov eax, 0x421540
push edx
push esi
push ebx
push eax
call sub.msvcrt.dll_memcpy
mov ebx, dword [0x421580]
add ebx, esi
add esp, 0x10
mov dword [0x421580], ebx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
call fcn.004117a0
jmp 0x411b68
add eax, 0x421540
jmp 0x411b87

Function at 0x411c60
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x54], 0
pop ebp
ret

Function at 0x412510
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x50
lea edi, [ebp - 0x4c]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push 0x40
push 0x36
push edi
call sub.msvcrt.dll_memset
add esp, 0x10
test ebx, ebx
jle 0x4125c7
mov edx, 1
lea esi, [esi]
mov al, byte [edx + esi - 1]
xor byte [edx + edi - 1], al
mov eax, edx
inc edx
cmp ebx, eax
jg 0x4125b6
mov eax, dword [ebp + 8]
push eax
call fcn.00411c60
mov eax, dword [ebp + 8]
push 0x40
push edi
push eax
call fcn.00411cd0
add esp, 0xc
push 0x40
push 0x5c
push edi
call sub.msvcrt.dll_memset
mov edx, 1
add esp, 0x10
lea esi, [esi]
mov al, byte [edx + esi - 1]
xor byte [edx + edi - 1], al
mov eax, edx
inc edx
cmp ebx, eax
jg 0x4125c0
mov ebx, dword [ebp + 8]
add ebx, 0x5c
push ebx
call fcn.00411c60
push 0x40
push edi
push ebx
call fcn.00411cd0
cld
mov ecx, 0x10
xor eax, eax
rep stosd dword es:[edi], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x3f
jle 0x412540
jmp 0x41254f
cmp eax, 0x3f
jle 0x412580
jmp 0x41258f
mov esi, dword [ebp + 8]
push esi
call fcn.00411c60
mov ebx, dword [ebp + 8]
push 0x40
push edi
push ebx
call fcn.00411cd0
add esp, 0xc
push 0x40
push 0x5c
push edi
call sub.msvcrt.dll_memset
add esp, 0x10
jmp 0x41258f
Function at 0x4158f0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x58], 0
pop ebp
ret

Function at 0x415a70
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x50
lea edi, [ebp - 0x4c]
mov ebx, ecx
mov dword [ebp - 0x50], eax
push 0x40
push 0x36
push edi
mov esi, edx
call sub.msvcrt.dll_memset
add esp, 0x10
test ebx, ebx
jle 0x415b27
mov edx, 1
lea esi, [esi]
mov al, byte [edx + esi - 1]
xor byte [edx + edi - 1], al
mov eax, edx
inc edx
cmp ebx, eax
jg 0x415b16
mov eax, dword [ebp - 0x50]
push eax
call fcn.004158f0
mov eax, dword [ebp - 0x50]
push 0x40
push edi
push eax
call fcn.00415930
add esp, 0xc
push 0x40
push 0x5c
push edi
call sub.msvcrt.dll_memset
mov edx, 1
add esp, 0x10
lea esi, [esi]
mov al, byte [edx + esi - 1]
xor byte [edx + edi - 1], al
mov eax, edx
inc edx
cmp ebx, eax
jg 0x415b20
mov ebx, dword [ebp - 0x50]
add ebx, 0x60
push ebx
call fcn.004158f0
push 0x40
push edi
push ebx
call fcn.00415930
cld
mov ecx, 0x10
xor eax, eax
rep stosd dword es:[edi], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x3f
jle 0x415aa0
jmp 0x415aaf
cmp eax, 0x3f
jle 0x415ae0
jmp 0x415aef
mov eax, dword [ebp - 0x50]
push eax
call fcn.004158f0
mov eax, dword [ebp - 0x50]
push 0x40
push edi
push eax
call fcn.00415930
add esp, 0xc
push 0x40
push 0x5c
push edi
call sub.msvcrt.dll_memset
add esp, 0x10
jmp 0x415aef

Function at 0x415f90
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret
Function at 0x59a1bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
test eax, 0x80000000
je 0x59a1d9
mov edx, eax
and edx, 0x7fffffff
mov dword [ebp - 0xc], edx
jmp 0x59a1de
xor edx, edx
mov dword [ebp - 0xc], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
and dword [ebp - 4], 0
mov eax, dword [ebx + 0x3c]
push edi
mov esi, dword [eax + ebx + 0x78]
lea eax, [eax + ebx + 0x18]
add esi, ebx
mov eax, dword [eax + 0x64]
mov edi, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x24]
add edi, ebx
add ecx, ebx
add eax, ebx
test edx, edx
mov dword [ebp - 0x10], eax
je 0x59a21e
mov eax, dword [esi + 0x10]
imul eax, eax, 0x3fffffff
add eax, edx
jmp 0x59a25c
and dword [ebp + 8], 0
cmp dword [esi + 0x18], 0
jbe 0x59a264
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
push dword [ebp + 0xc]
mov eax, dword [eax]
add eax, ebx
push eax
call fcn.0059a28a
pop ecx
test eax, eax
pop ecx
jne 0x59a252
inc dword [ebp + 8]
add dword [ebp - 8], 4
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x18]
jb 0x59a22b
jmp 0x59a264
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
movzx eax, word [eax + ecx*2]
mov edi, dword [edi + eax*4]
add edi, ebx
mov dword [ebp - 4], edi
cmp dword [ebp + 0x10], 0
je 0x59a282
cmp dword [ebp - 4], esi
jbe 0x59a282
mov eax, dword [ebp - 0x14]
add eax, esi
cmp dword [ebp - 4], eax
jae 0x59a282
push dword [ebp - 0xc]
push ebx
call dword [ebp + 0x10]
jmp 0x59a285
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x59a2b4
Capabilities:
Encode data using xor

Disassembly:
push ecx
push eax
push esi
push edi
mov ecx, edi
sub ecx, eax
mov esi, eax
mov edi, esi
lodsb al, byte [esi]
xor al, 0x4c
stosb byte es:[edi], al
loop 0x59a2c0
pop edi
pop esi
pop eax
pop ecx
ret

Function at 0x59a2cb
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
Function at 0x40219a
Capabilities:
Terminate process

Disassembly:
xor edi, edi
xor esi, esi
mov edx, eax
mov eax, 5
add eax, 5
inc eax
test eax, 0xb
jne 0x4021bc
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401906], eax
ret

Function at 0x401045
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 0x82
push 3
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4011cd
mov dword [ebp - 4], eax
push 2
push 0
push 0xfffffda8
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
push 0x258
push 0x403620
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
lea esi, [0x403620]
lea edi, [0x403878]
mov ecx, 0x64
jmp 0x4010b4
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
or ecx, ecx
jne 0x4010ad
lea esi, [0x403620]
add esi, 0x64
lea edi, [0x403978]
mov ecx, 0x64
jmp 0x4010d5
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
or ecx, ecx
jne 0x4010ce
lea esi, [0x403620]
add esi, 0xc8
lea edi, [0x403a78]
mov ecx, 0x64
jmp 0x4010f9
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
or ecx, ecx
jne 0x4010f2
lea esi, [0x403620]
add esi, 0x12c
lea edi, [0x403b78]
mov ecx, 0x64
jmp 0x40111d
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
or ecx, ecx
jne 0x401116
lea esi, [0x403620]
add esi, 0x190
lea edi, [0x403c78]
mov ecx, 0x64
jmp 0x401141
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
or ecx, ecx
jne 0x40113a
lea esi, [0x403620]
add esi, 0x1f4
lea edi, [0x403d78]
mov ecx, 0x64
jmp 0x401165
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
or ecx, ecx
jne 0x40115e
push 0x403f78
push 0x403878
call section..text
push 0x404078
push 0x403978
call section..text
push 0x404178
push 0x403a78
call section..text
push 0x404278
push 0x403b78
call section..text
push 0x404378
push 0x403c78
call section..text
push 0x404478
push 0x403d78
call section..text
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
jmp 0x4011e7
push 0
push str.Error
push str.Open_TempFile_Error
push 0
call sub.user32.dll_MessageBoxA
push 0
call sub.kernel32.dll_ExitProcess
leave
ret 4
Function at 0x401220
Capabilities:
Reference cloudflare dns server

Disassembly:
push 0xffffffffffffffff
push 0x407331
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 0x2c]
mov ecx, edi
call sub.MFC42.DLL_CString::CString_2
lea ebx, [esi + 0x30]
mov dword [esp + 0x1c], 0
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_2
lea ebp, [esi + 0x34]
mov byte [esp + 0x1c], 1
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_2
push str.1.0.0.1
mov ecx, ebx
mov byte [esp + 0x20], 2
mov dword [esi], 0x408608
mov dword [esi + 0x28], 0
call sub.MFC42.DLL_CString::operator_1
push 0x40ba58
mov ecx, ebp
call sub.MFC42.DLL_CString::operator_1
push 0x40ba58
mov ecx, edi
call sub.MFC42.DLL_CString::operator_1
mov ecx, 0x19
xor eax, eax
lea edi, [esi + 0x38]
rep stosd dword es:[edi], eax
mov ecx, esi
call fcn.004014b0
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x9c], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4013d0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
test eax, eax
je 0x40149d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.BroadCast_Process
push eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esi + 0x28]
push str.Call_Process
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.Get_ObjInfoList
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi + 0x28]
push str.RsCommxFree
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x28]
push str.Register_Client
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.UnRegister_Client
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi + 0x28]
push str.GetSessionID
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x28]
push str.SetCallEnterPoint
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.Get_ActiveObjInfoList
push ecx
mov dword [esi + 0x20], eax
call edi
mov ecx, dword [esi + 8]
mov dword [esi + 0x24], eax
test ecx, ecx
pop edi
je 0x40149d
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x40149d
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40149d
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x40149d
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x40149d
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x40149d
test eax, eax
je 0x40149d
mov eax, dword [esi + 0x20]
test eax, eax
je 0x40149d
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x402e40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 5
mov esi, str.SoftwareRisingRav
lea edi, [esp + 0x11c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x3c
lea edi, [esp + 0x130]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x19]
mov byte [esp + 0x18], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
lea ecx, [esp + 0x11c]
push eax
push 1
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402f94
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push str.installpath
push edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402f28
lea edi, [esp + 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x402efa
cmp byte [esp + ecx + 0x17], 0x5c
je 0x402efa
mov byte [esp + ecx + 0x18], 0x5c
mov byte [esp + ecx + 0x19], 0
mov edi, str.Guidll.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebp + 0x108], eax
je 0x402f94
push str._SetFilter_12
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x224]
mov dword [ebp + 0x14c], eax
test ecx, ecx
je 0x402f76
test eax, eax
je 0x402f87
push 1
lea edx, [ebp + 0x10c]
push 2
push edx
jmp 0x402f85
test eax, eax
je 0x402f87
push 2
lea ecx, [ebp + 0x10c]
push 2
push ecx
call eax
mov edx, dword [ebp + 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
add esp, 0x214
ret 4
Function at 0x405f30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov eax, dword [eax]
lea ecx, [eax + eax*8]
mov esi, dword [ecx*8 + 0x40c884]
lea edi, [ecx*8 + 0x40c840]
cmp esi, 0xffffffff
jne 0x405f58
pop edi
mov eax, 0x57
pop esi
ret 0x14
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x14]
cmp ecx, eax
ja 0x405f6d
pop edi
mov eax, 0x22080
pop esi
ret 0x14
cdq
push 0
push 0x200
push edx
push eax
call fcn.00406ee0
push 0
push 0
push edx
push eax
push esi
call dword [0x40c960]
test eax, eax
jne 0x405f97
pop edi
mov eax, 0x22081
pop esi
ret 0x14
mov eax, dword [esp + 0x14]
cmp eax, 0x10
jne 0x405fd1
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push 0
shl eax, 9
push edx
mov edx, dword [edi + 0x44]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405f8d
mov eax, dword [esp + 0xc]
test eax, eax
je 0x405f8d
pop edi
xor eax, eax
pop esi
ret 0x14
cmp eax, 0x20
jne 0x406011
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push 0
shl ecx, 9
push eax
mov eax, dword [edi + 0x44]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x406007
mov eax, dword [esp + 0xc]
test eax, eax
je 0x406007
pop edi
xor eax, eax
pop esi
ret 0x14
pop edi
mov eax, 0x22082
pop esi
ret 0x14
pop edi
mov eax, 0x22083
pop esi
ret 0x14
Function at 0x406020
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x210]
push edi
mov edi, 0x200
mov eax, dword [esi + 0x14]
push 0
dec eax
push edi
cdq
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], edi
call fcn.00406ee0
push 0
push 0
push edx
push eax
mov eax, dword [esi + 0x44]
push eax
call dword [0x40c960]
test eax, eax
je 0x4061ad
mov eax, dword [esi + 0x44]
lea ecx, [esp + 8]
push 0
push ecx
lea edx, [esp + 0x18]
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4061d7
cmp dword [esp + 8], edi
jne 0x4061d7
mov eax, dword [esp + 0x30]
cmp eax, 0x654b654b
je 0x4060a6
cmp eax, 0x6b72694b
jne 0x4061d7
mov eax, 1
cmp word [esp + 0x3c], ax
jne 0x4060d6
cmp dword [esp + 0x218], 0x1001
jne 0x4060d6
mov ecx, dword [esp + 0x5b]
mov edx, dword [esp + 0x5f]
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
pop edi
pop esi
add esp, 0x208
ret
mov ecx, dword [esp + 0x40]
mov eax, dword [esi + 0x14]
and ecx, 0xffff
push ebx
sub eax, ecx
push ebp
dec eax
push 0
cdq
push edi
push edx
push eax
call fcn.00406ee0
mov edi, eax
mov eax, dword [esp + 0x4a]
and eax, 0xffff
mov ebx, edx
shl eax, 9
push eax
mov dword [esp + 0x14], eax
call sub.MFC42.DLL_operatornew
mov edx, dword [esi + 0x44]
add esp, 4
mov ebp, eax
push 0
push 0
push ebx
push edi
push edx
call dword [0x40c960]
test eax, eax
je 0x40619a
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x44]
lea eax, [esp + 0x10]
push 0
push eax
push ecx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40619a
mov ecx, dword [esp + 0x4a]
mov edx, dword [esp + 0x10]
and ecx, 0xffff
mov eax, ecx
shl eax, 9
cmp edx, eax
jne 0x40619a
shl ecx, 5
xor edx, edx
mov eax, ebp
test ecx, ecx
jle 0x40617c
mov ebx, dword [esp + 0x220]
xor edi, edi
mov di, word [eax + 2]
cmp edi, ebx
je 0x40617c
inc edx
add eax, 0x10
cmp edx, ecx
jl 0x406163
cmp edx, ecx
jge 0x40619a
mov ecx, dword [esi + 0x14]
mov edi, dword [eax + 8]
sub ecx, edi
mov dword [esp + 0x14], 1
dec ecx
mov dword [esi + 0x20], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x24], edx
push ebp
call sub.MFC42.DLL_operatordelete
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
pop ebp
pop ebx
jne 0x4061e9
mov ecx, dword [esp + 0x218]
or eax, 0xffffffff
cmp ecx, eax
jne 0x4061df
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
sub ecx, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
pop edi
mov eax, 1
pop esi
add esp, 0x208
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4061ad
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x208
ret
Function at 0x406200
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x408
push ebx
push esi
mov esi, dword [esp + 0x414]
push edi
mov ebx, 0x200
push 0
mov eax, dword [esi + 0x14]
push ebx
dec eax
mov edi, 0x1001
cdq
push edx
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], ebx
call fcn.00406ee0
push 0
push 0
push edx
push eax
mov eax, dword [esi + 0x44]
push eax
call dword [0x40c960]
test eax, eax
je 0x4063d8
mov eax, dword [esi + 0x44]
lea ecx, [esp + 0xc]
push 0
push ecx
lea edx, [esp + 0x1c]
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4063d8
cmp dword [esp + 0xc], ebx
jne 0x4063d8
mov eax, dword [esp + 0x34]
cmp eax, 0x654b654b
je 0x406288
cmp eax, 0x6b72694b
jne 0x4063d8
mov ecx, dword [esp + 0x44]
mov eax, dword [esi + 0x14]
and ecx, 0xffff
push ebp
sub eax, ecx
push 0
dec eax
push ebx
cdq
push edx
push eax
call fcn.00406ee0
mov edi, eax
mov eax, dword [esp + 0x4a]
and eax, 0xffff
mov ebx, edx
shl eax, 9
push eax
mov dword [esp + 0x14], eax
call sub.MFC42.DLL_operatornew
mov edx, dword [esi + 0x44]
add esp, 4
mov ebp, eax
push 0
push 0
push ebx
push edi
push edx
call dword [0x40c960]
test eax, eax
je 0x4063be
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x44]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x10]
push 0
push eax
push ecx
push ebp
push edx
call ebx
test eax, eax
je 0x4063be
mov ecx, dword [esp + 0x4a]
mov edx, dword [esp + 0x10]
and ecx, 0xffff
mov eax, ecx
shl eax, 9
cmp edx, eax
jne 0x4063be
shl ecx, 5
xor edx, edx
mov eax, ebp
test ecx, ecx
jle 0x406335
mov edi, 0x201
cmp word [eax + 2], di
je 0x406335
inc edx
add eax, 0x10
cmp edx, ecx
jl 0x406327
cmp edx, ecx
jge 0x4063be
mov ecx, dword [esi + 0x14]
mov edx, dword [eax + 8]
sub ecx, edx
push 0
push 0x200
lea eax, [ecx + 0xff]
mov dword [esi + 0x20], eax
cdq
push edx
push eax
call fcn.00406ee0
push 0
push 0
push edx
mov edx, dword [esi + 0x44]
push eax
push edx
call dword [0x40c960]
mov edx, dword [esi + 0x44]
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x218]
rep stosd dword es:[edi], eax
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x220]
push 0x200
push ecx
push edx
mov dword [esp + 0x24], 0x200
call ebx
push 0xa
lea eax, [esp + 0x21c]
push str.LenovoHDBM
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
mov esi, 0x1002
test eax, eax
je 0x4063c2
mov esi, dword [esp + 0x14]
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x408
ret
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x408
ret
Function at 0x5466cc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x548168
sub eax, eax
test esi, esi
je 0x5467a4
sub eax, 1
test ecx, ecx
je 0x5467a2
test esi, 3
je 0x54670a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x5466ef
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x546789
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x546714
mov ecx, edx
test ecx, ecx
je 0x5467a2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x54678f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x5467ac
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0054682f
jae 0x5467ba
xor ecx, ecx
call fcn.0054682f
jae 0x5467e9
xor eax, eax
call fcn.0054682f
jae 0x5467f9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0054682f
adc al, al
jae 0x5467db
jne 0x546825
stosb byte es:[edi], al
jmp 0x5467bd
call fcn.0054683b
sub ecx, ebx
jne 0x546802
call fcn.00546839
jmp 0x546821
lodsb al, byte [esi]
shr eax, 1
je 0x54684b
adc ecx, ecx
jmp 0x54681e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00546839
cmp eax, 0x7d00
jae 0x54681e
cmp ah, 5
jae 0x54681f
cmp eax, 0x7f
ja 0x546820
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5467bd
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret