joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de1f7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5181bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x4ec7b0
mov dword [ebp - 0x14], edi
mov dword [edi + 0x50], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
push 0
push 0
lea esi, [edi + 4]
mov dword [ebp - 4], 0
push esi
mov dword [ebp - 0x10], 1
call fcn.0040c1e0
mov eax, dword [edi]
push 8
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + edi - 4], eax
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004433ba
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40c72a
push 1
mov byte [ebp - 4], 2
call fcn.0041fdfb
add esp, 4
mov dword [ebx + 4], eax
jmp 0x40c72c
xor ebx, ebx
lea eax, [esi + 4]
mov dword [esi + 0x34], ebx
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov dword [esi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4135c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dee9c
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x5181bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x220], ebx
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.004128c0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00466070
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [ebp - 0x224]
push 0x104
push eax
push 0x4ec534
push 0x4ed3d4
push dword [ebx + 0x68]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x22c]
push eax
call fcn.0041cf40
add esp, 4
mov ecx, dword [eax]
mov byte [ebp - 4], 1
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov esi, dword [ebp - 0x228]
or ebx, 0xffffffff
mov byte [ebp - 0x219], al
mov byte [ebp - 4], 0
test esi, esi
je 0x413698
mov ecx, ebx
lock xadd dword [esi + 4], ecx
jne 0x413698
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x413698
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
cmp byte [ebp - 0x219], 0
je 0x41371e
lea eax, [ebp - 0x22c]
push eax
call fcn.0041cf40
add esp, 4
mov edi, dword [eax]
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 2
call fcn.0040c680
mov esi, eax
push str.local__updated_ver_
push esi
mov byte [ebp - 4], 3
call fcn.00402690
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00402690
mov eax, dword [edi]
add esp, 0x10
mov ecx, edi
push esi
call dword [eax + 8]
lea ecx, [ebp - 0x2c4]
call fcn.00404370
mov esi, dword [ebp - 0x228]
test esi, esi
je 0x41371e
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x41371e
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x41371e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 0x220]
push dword [eax + 0x64]
call fcn.0048569a
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x224]
sete cl
add eax, 0xfffffff0
mov dword [ebp - 0x220], ecx
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41376d
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x220]
jmp 0x41376f
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004437fa
mov esp, ebp
pop ebp
ret
Function at 0x4147e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov byte [esi + 0x68], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x414821
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.004164a0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x414ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5181bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x414b51
cmp byte [esi + 0x3d], 0
je 0x414b51
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x414b07
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x414b19
sub eax, 1
je 0x414b1d
sub eax, 2
je 0x414b51
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004437fa
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x414b3a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00487bdc
add esp, 0x10
cmp edi, eax
jne 0x414b07
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004437fa
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004437fa
mov esp, ebp
pop ebp
ret
Function at 0x41a970
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
call fcn.0041a020
test eax, eax
je 0x41a984
mov ecx, esi
pop esi
jmp fcn.0041a990
xor eax, eax
pop esi
ret
Function at 0x41d7b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dfecf
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x5181bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
push 0x180
push 0x40
push 0x8101
push ebx
push edi
mov dword [ebp - 0x2c], 0
call fcn.0048a7e3
add esp, 0x14
mov dword [ebp - 0x30], eax
test eax, eax
je 0x41d9c1
mov dword [ebp - 0xcc], 0x4ec7b0
mov dword [ebp - 0x7c], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
push 0
push 0
lea eax, [ebp - 0xc8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x2c], 1
call fcn.0040c1e0
mov eax, dword [ebp - 0xcc]
push 8
mov dword [ebp - 4], 1
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xcc], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0xd0], eax
mov dword [ebp - 0xc8], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004433ba
mov esi, eax
add esp, 4
test esi, esi
je 0x41d89b
push 1
mov byte [ebp - 4], 2
call fcn.0041fdfb
add esp, 4
mov dword [esi + 4], eax
jmp 0x41d89d
xor esi, esi
lea eax, [ebp - 0xc4]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xa4]
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xc8], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 4
push 0x4f017c
push dword [ebp - 0x30]
lea eax, [ebp - 0xcc]
mov dword [ebp - 4], 3
push str._error.__
push ebx
push 0x4f0198
push eax
call fcn.00402690
add esp, 8
push eax
call fcn.00402690
add esp, 8
push eax
call fcn.00402690
add esp, 8
mov ecx, eax
call fcn.00410580
push eax
call fcn.00402690
add esp, 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0xcc]
push eax
call fcn.0041dab0
cmp dword [eax + 0x14], 8
jb 0x41d9a7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x28]
call fcn.00403c70
lea ecx, [ebp - 0xcc]
call fcn.00404370
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x41d9d7
push 2
push 0
push eax
call fcn.0048ae43
add esp, 0xc
jmp 0x41d9da
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004437fa
mov esp, ebp
pop ebp
ret 4
Function at 0x41dd20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5181bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 8], 0
je 0x41dd47
call fcn.0041da00
mov byte [esi + 8], 0
cmp dword [esi + 4], 0x40000000
jle 0x41dd83
mov eax, dword [esi + 0x24]
cmp eax, 0xffffffff
je 0x41dd68
push eax
call fcn.0048a996
add esp, 4
mov dword [esi + 0x24], 0xffffffff
cmp dword [esi + 0x20], 8
lea eax, [esi + 0xc]
jb 0x41dd73
mov eax, dword [eax]
push eax
call fcn.004899f9
add esp, 4
mov ecx, esi
call fcn.0041da00
push 0xfde9
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.0041db70
add esp, 0xc
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x41dda0
mov eax, dword [eax]
mov ecx, dword [esi + 0x24]
cmp ecx, 0xffffffff
je 0x41ddb7
push edx
push eax
push ecx
call fcn.0048b47e
add esp, 0xc
mov ebx, eax
jmp 0x41ddba
or ebx, 0xffffffff
mov edx, dword [ebp - 8]
cmp edx, 0x10
jb 0x41ddea
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41dde0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41de26
push edx
push ecx
call fcn.004433ea
add esp, 8
test ebx, ebx
jle 0x41de04
add dword [esi + 4], ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004437fa
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x14], 8
jb 0x41de0c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004437fa
mov esp, ebp
pop ebp
ret 4
call fcn.004701f6
int3

Function at 0x41df40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dffe0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5181bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi], 0
mov esi, dword [ebp + 8]
je 0x41dfd1
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x41dfd1
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41dfd1
push 0x4ec534
lea ecx, [ebp - 0x40]
call fcn.0040c510
push dword [esi]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.0040c510
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
push dword [edi]
call fcn.00446f10
add esp, 0xc
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.00403c70
lea ecx, [ebp - 0x40]
call fcn.00403c70
mov eax, esi
jmp 0x41dfd3
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004437fa
mov esp, ebp
pop ebp
ret 4

Function at 0x43c560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043c0d0
Function at 0x43d840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e29e3
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x5181bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x80], 0
mov dword [edi], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x7c], 0
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004145c0
mov eax, dword [ebp - 0x80]
add esp, 8
test eax, eax
je 0x43da53
mov esi, dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
call esi
test eax, eax
je 0x43da53
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x43da53
push eax
call esi
test eax, eax
je 0x43da53
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
push 0x201
push dword [ebp - 0x80]
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 2
push SysStringLen
call fcn.0043d790
mov esi, dword [ebp - 0x90]
test eax, eax
jne 0x43da44
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00466070
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push dword [ebp - 0x7c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43da44
mov eax, dword [ebp - 0x84]
cmp eax, 1
je 0x43d96b
cmp eax, 2
jne 0x43da44
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x43d98c
test cl, 1
jne 0x43da44
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x43d992
jmp 0x43da44
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x43da44
lea ecx, [ebp - 0x78]
call fcn.0043bb30
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x78]
call fcn.0043bc10
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], 0
push eax
lea eax, [ebp - 0x20]
push 0x4f48fc
push eax
call fcn.0043df00
push 0x2a
push dword [ebp - 0x78]
call fcn.0043c0d0
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x84], eax
jne 0x43da3c
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x43d9f2
sub edx, ecx
lea eax, [ebp - 0x74]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.0043b8b0
push dword [0x5181b0]
lea eax, [ebp - 0x74]
push dword [0x5181ac]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x43da2d
mov dword [edi], 1
lea ecx, [ebp - 0x78]
call fcn.00417110
mov edi, 1
jmp 0x43da46
lea ecx, [ebp - 0x78]
call fcn.00417110
xor edi, edi
test esi, esi
je 0x43da55
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43da55
xor edi, edi
push dword [ebp - 0x7c]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push dword [ebp - 0x80]
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004437fa
mov esp, ebp
pop ebp
ret
Function at 0x43da90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x43daa5
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43dab0
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x440dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x440e31
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x440dff
cmp eax, 2
jne 0x440e1b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x440e2b
test ecx, ecx
je 0x440e26
test cl, 1
jne 0x440e1b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x440e2b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x446cd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5181bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
jne 0x446eb5
test edi, edi
je 0x446eb5
mov ecx, dword [esi + 0x20]
mov eax, 0x532ae21d
sub ecx, dword [esi + 0x1c]
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x446eb5
imul eax, ebx, 0x314
mov ebx, dword [esi + 0x1c]
mov ebx, dword [eax + ebx]
test byte [ebx + 0x26], 0x10
jne 0x446eb5
mov eax, dword [ebp + 0x10]
cmp dword [ebx + 0x18], eax
ja 0x446eb5
mov esi, dword [esi + 0xc]
mov edx, dword [ebx + 0x2a]
movzx eax, word [edx + esi + 0x1c]
movzx ecx, word [edx + esi + 0x1a]
add eax, edx
add ecx, eax
lea eax, [esi + 0x1e]
add eax, ecx
movzx ecx, word [ebx + 0xa]
mov dword [ebp - 8], eax
test cx, cx
jne 0x446eca
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 0xc], ecx
test esi, esi
je 0x446dbd
test eax, eax
je 0x446d89
cmp ecx, esi
jb 0x446d89
push esi
push eax
push edi
call fcn.00465570
add esp, 0xc
jmp 0x446dbd
push ecx
push 0
push edi
call fcn.00466070
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x446da8
call fcn.0047030d
mov dword [eax], 0x16
jmp 0x446db8
cmp dword [ebp - 0xc], esi
jae 0x446dbd
call fcn.0047030d
mov dword [eax], 0x22
call fcn.004701e6
mov edx, dword [ebx + 0x14]
test edx, edx
je 0x446eae
or eax, 0xffffffff
cmp edx, 8
jb 0x446e86
mov esi, edx
shr esi, 3
nop dword [eax]
movzx ecx, byte [edi]
sub edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f4e58]
movzx ecx, byte [edi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f4e58]
movzx ecx, byte [edi + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f4e58]
movzx ecx, byte [edi + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f4e58]
movzx ecx, byte [edi + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f4e58]
movzx ecx, byte [edi + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f4e58]
movzx ecx, byte [edi + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f4e58]
movzx ecx, byte [edi + 7]
add edi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f4e58]
sub esi, 1
jne 0x446de0
test edx, edx
je 0x446eaa
nop word [eax + eax]
movzx ecx, byte [edi]
lea edi, [edi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f4e58]
sub edx, 1
jne 0x446e90
not eax
jmp 0x446eb0
xor eax, eax
cmp eax, dword [ebx + 0x10]
je 0x446ef6
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004437fa
mov esp, ebp
pop ebp
ret 0xc
cmp ecx, 8
jne 0x446eb5
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push dword [ebp + 0x10]
push edi
push dword [ebx + 0x14]
push eax
call fcn.0044ce10
add esp, 0x14
test eax, eax
je 0x446eb5
mov eax, dword [ebp - 8]
cmp eax, dword [ebx + 0x10]
jne 0x446eb5
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004437fa
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4471a0
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2eef
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5181bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x58
call fcn.004433ba
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x4471f7
push 0x58
push 0
push esi
call fcn.00466070
add esp, 0xc
mov ecx, esi
call fcn.00444e20
mov esi, eax
jmp 0x4471f9
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0x14], 8
jb 0x44720b
mov edi, dword [edi]
test edi, edi
je 0x4472a8
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4472a8
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4472a8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0x16
jb 0x4472a8
push 0
push 0
push 0
push 2
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp dword [esi + 4], 0
mov dword [esi + 8], eax
je 0x4472a8
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x4472a8
push dword [esi + 0x14]
mov ecx, esi
push eax
call fcn.00446050
test eax, eax
je 0x4472a8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4472be
mov ecx, esi
call fcn.00444fa0
push 0x58
push esi
call fcn.004433ea
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x448a50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
test edx, edx
je 0x448b4f
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x448b4f
or eax, 0xffffffff
cmp esi, 8
jb 0x448b27
push edi
mov edi, esi
shr edi, 3
nop dword [eax]
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f66b8]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f66b8]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f66b8]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f66b8]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f66b8]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f66b8]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f66b8]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f66b8]
sub edi, 1
jne 0x448a80
pop edi
test esi, esi
je 0x448b4a
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4f66b8]
sub esi, 1
jne 0x448b30
not eax
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret