joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4503d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x45042e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x4503f0
mov eax, dword [edi]
jmp 0x450519
cmp eax, 0x4e0
jb 0x450519
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x450450
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x4504a0
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4512eb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45132a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45132a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45132a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x45132a
cmp dword [ecx + 0x74], 0xe
jbe 0x45132a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push 0x9b0c758b
lea eax, [ebp - 0x78]
push 0x78
aam 0x95
call fcn.004086e0
mov ecx, dword [ebp + 8]
mov edx, dword [0x6b11c8]
nop
push ecx
add edx, 0x40
push 0xfaedd4ac
push edx
call dword [sym.imp.MSVCRT.dll_fprintf]
test byte ds:[edx], 0x41
add byte [eax], bh
les ebx, [ecx - 0x7b]
sal byte [edi + ecx + 0x50], 0x68
push esp
rol byte [eax], cl
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
adc byte [eax - 0x6f656f70], 0x90
nop
nop
nop
nop

Function at 0x405730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
test ebx, ebx
xadd ecx, edi
add byte [eax], al
add byte [esi - 0x75], dl
mov eax, dword [esi]
mov eax, dword [esi]
push 1
push 0
push 0
loop 0x40573a
imul ecx, dword [ebp], 0x11763d65
add dword [eax], eax
fld qword [edi]
mov dword [esi + 4], 0
mov byte [0xf6ea0876], al
jne 0x405748
mov esi, ebx
xor byte [esi - 0x32], al
test dword [0xe551274], edx
mov edi, 0x29
push 9
push ecx
mov dword [esi + 4], edi
call 0xf840e8d0
mov esi, dword [eax + 8]
test al, 0xf6
jne 0x40576d
test edi, edi
je 0x405806
mov ebx, 0xb743
push esi
push ebx
mov dword [ebp - 4], esi
call 0x55406ce6
imul esi, dword [ebp + 8], 0x33
dec ecx
mov dword [ebx], esp
add dh, byte [ebp + 0x23]
mov edx, dword [esi]
push 1
push 0
push 0
push edx
call fcn.0040a4b0
cmp eax, 0x11176
jne 0x4057c7
mov edi, 0xf400fa01
xchg dword [edi], eax
invalid

Function at 0x40a5d6
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [ebp - 0x43]
test ebx, ebx
push edi
mov dword [ebp - 4], 0x7d0000
jge 0x40a5f9
mov eax, dword [ebp + 0xc]
xor ebx, ebx
fdivr dword [eax]
add byte [ecx + ecx - 0x17], dh
dec esp
imul edx, ebx, 0x75c98543
pop esi
lea eax, [ebx*4 + 4]
push esi
push eax
call dword [0x64409a5c]
add esp, 0x61
mov edi, eax
test ebx, ebx
mov dword [ebp - 0xc], edi
jnp 0x40a64a
mov al, 0x45
or al, 0x8b
idiv dword [ecx]
invalid
mov eax, dword [ebp - 4]
lea eax, [eax + eax*2 + 1]
push eax
mov dword [ecx], edi
cld
call dword [0x40ed5c]
add esp, 4
xor ecx, ecx
test ebx, ebx
mov dword [ebp - 8], eax
dec eax
invalid
Function at 0x55d700
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe8000]
push edi
or ebp, 0xffffffff
jmp 0x55d722
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x55d729
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55d718
mov eax, 1
add ebx, ebx
jne 0x55d73b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x55d74c
jne 0x55d76b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55d76b
dec eax
add ebx, ebx
jne 0x55d758
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x55d730
add ebx, ebx
jne 0x55d767
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x55d7bd
xor ecx, ecx
sub eax, 3
jb 0x55d783
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x55d7f2
sar eax, 1
mov ebp, eax
jmp 0x55d78e
add ebx, ebx
jne 0x55d78e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55d75c
inc ecx
add ebx, ebx
jne 0x55d79c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55d75c
add ebx, ebx
jne 0x55d7a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x55d79e
jne 0x55d7ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x55d79e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x55d7dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x55d7ce
jmp 0x55d71e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x55d7dc
add edi, ecx
jmp 0x55d71e
pop esi
mov edi, esi
mov ecx, 0x37ef
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x55d7fa
cmp byte [edi], 0x13
jne 0x55d7fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x55d7ff
lea edi, [esi + 0x15a000]
mov eax, dword [edi]
or eax, eax
je 0x55d877
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1652f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1653a8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x55d82c
mov ecx, edi
jns 0x55d85b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1653ac]
or eax, eax
je 0x55d871
mov dword [ebx], eax
add ebx, 4
jmp 0x55d849
call dword [esi + 0x1653bc]
mov ebp, dword [esi + 0x1653b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x55d8ab
sub esp, 0xffffff80
jmp 0x46ef3e
Function at 0x401100
Capabilities:
Get common file path
Set file attributes

Disassembly:
sub esp, 0x85c
mov eax, dword [0x41ea50]
xor eax, esp
mov dword [esp + 0x854], eax
push ebx
push ebp
push esi
push edi
push 0x104
xor esi, esi
push 0x41fcf8
push esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40128c
lea eax, [esp + 0x658]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40128c
push esi
call fcn.00406c18
add esp, 4
push edx
push eax
lea ecx, [esp + 0x660]
push ecx
push str._s_version__d.cfg
lea edx, [esp + 0x258]
push 0x104
push edx
call fcn.00406543
push str.version.cfg
push str.updatepack
push 0x41c42c
lea eax, [esp + 0x474]
push 0x104
push eax
mov word [esp + 0x47a], si
call fcn.00406543
add esp, 0x2c
mov word [esp + 0x656], si
call fcn.00406410
mov ebp, eax
cmp ebp, esi
je 0x40128c
cmp dword [ebp], 1
je 0x4011d9
mov dword [0x41fcf4], 0x80000
jmp 0x40122b
mov esi, dword [ebp + 4]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x454]
push edx
lea ebx, [esp + 0x1c]
call fcn.00405e70
mov esi, dword [esp + 0x14]
cmp esi, 0xffffffff
mov dword [0x41fcf4], eax
je 0x40122b
push 0x80
lea eax, [esp + 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x248]
push ecx
mov ecx, esi
mov eax, ebp
call fcn.00406510
add esp, 4
test eax, eax
jne 0x40125b
lea edx, [esp + 0x248]
push edx
mov ebx, 0x420518
mov edi, 0x420310
call fcn.00401910
add esp, 4
test eax, eax
je 0x40125b
cmp word [0x420310], 0
je 0x40125b
mov dword [esp + 0x10], 1
cmp dword [ebp], 1
je 0x40126d
mov dword [0x41fcf4], 0x80000
jmp 0x40128c
mov esi, dword [ebp + 4]
call fcn.004063b0
test esi, esi
mov dword [0x41fcf4], eax
je 0x401283
call fcn.004064c0
push ebp
call fcn.004071ab
add esp, 4
push 0x80
lea eax, [esp + 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x248]
push ecx
call fcn.00406614
mov ecx, dword [esp + 0x868]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00406c09
add esp, 0x85c
ret
Function at 0x401570
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x44c
mov eax, dword [0x41ea50]
xor eax, esp
mov dword [esp + 0x444], eax
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [esp + 0x10], esi
call fcn.00406410
mov edi, eax
test edi, edi
je 0x40169b
mov ebp, 0x41bc80
cmp dword [edi], 1
mov dword [esp + 0x14], 0xffffffff
je 0x4015be
mov dword [0x41fcf4], 0x80000
jmp 0x40163e
mov esi, dword [edi + 4]
lea eax, [esp + 0x18]
push eax
push ebp
lea ebx, [esp + 0x1c]
call fcn.00405e70
mov esi, dword [esp + 0x14]
cmp esi, 0xffffffff
mov dword [0x41fcf4], eax
je 0x40163e
lea ecx, [esp + 0x1c]
push ecx
push 0x41ff00
push str._s_s
lea edx, [esp + 0x254]
push 0x104
push edx
call fcn.00406543
add esp, 0x14
push 0x80
lea eax, [esp + 0x24c]
push eax
mov word [esp + 0x456], 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [edi], 1
jne 0x401657
mov eax, dword [edi + 4]
push esi
push eax
lea ecx, [esp + 0x250]
call fcn.00406080
test eax, eax
mov dword [0x41fcf4], eax
jne 0x401661
add ebp, 0x208
cmp ebp, str.gameupdater.exe
jl 0x4015a2
mov ebx, 1
jmp 0x401665
mov dword [0x41fcf4], 0x80000
mov ebx, dword [esp + 0x10]
cmp dword [edi], 1
je 0x401678
mov dword [0x41fcf4], 0x80000
mov eax, ebx
jmp 0x40169d
mov esi, dword [edi + 4]
call fcn.004063b0
test esi, esi
mov dword [0x41fcf4], eax
je 0x40168e
call fcn.004064c0
push edi
call fcn.004071ab
add esp, 4
mov eax, ebx
jmp 0x40169d
mov eax, esi
mov ecx, dword [esp + 0x454]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00406c09
add esp, 0x44c
ret

Function at 0x4016c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x66c
mov eax, dword [0x41ea50]
xor eax, esp
mov dword [esp + 0x664], eax
push esi
push edi
push 0x40
xor edi, edi
lea eax, [esp + 0x20]
push edi
push eax
mov dword [esp + 0x24], 0x44
call fcn.0040c1e0
push edi
push 0x420108
call fcn.004066f5
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x40175f
push 0x420108
push 0x41c454
lea ecx, [esp + 0x270]
push 0x200
push ecx
call fcn.00406543
add esp, 0x10
push 0x10
push 0x41c348
lea edx, [esp + 0x270]
push edx
push edi
call esi
push 0x10
push 0x41c348
push 0x41c48c
push edi
call esi
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x664]
xor ecx, esp
call fcn.00406c09
add esp, 0x66c
ret
push 0x41fcf8
push 0x420108
push str.__s___s
lea eax, [esp + 0x6c]
push 0x104
push eax
call fcn.00406543
add esp, 0x14
lea ecx, [esp + 0x18]
push ecx
mov word [esp + 0x26a], di
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x1c]
push eax
push edi
push edi
push 0x20
push edi
push edi
push edi
lea ecx, [esp + 0x80]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401737
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00406c09
add esp, 0x66c
ret
Function at 0x401a70
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x2810
call fcn.00415e90
mov eax, dword [0x41ea50]
xor eax, esp
mov dword [esp + 0x280c], eax
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0xffc
lea eax, [esp + 0x1024]
mov ebx, ecx
push ebp
push eax
mov dword [esp + 0x20], ebx
xor edi, edi
mov dword [esp + 0x1028], ebp
call fcn.0040c1e0
push 0xffc
lea ecx, [esp + 0x30]
push ebp
push ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
xor esi, esi
mov dword [esp + 0x34], ebp
call fcn.0040c1e0
add esp, 0x18
cmp ebx, ebp
mov word [esp + 0x201c], bp
je 0x401b9f
lea edx, [esp + 0x10]
push edx
push 0x1000
lea eax, [esp + 0x1024]
push eax
mov dword [ebx], ebp
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x401b9f
mov ebx, dword [esp + 0x10]
shr ebx, 2
cmp ebx, ebp
jle 0x401b8f
mov ecx, dword [esp + edi*4 + 0x101c]
push ecx
push ebp
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebp
je 0x401b88
lea edx, [esp + 0x18]
push edx
push 0x1000
lea eax, [esp + 0x24]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x401b88
mov edx, dword [esp + 0x1c]
push 0x400
lea ecx, [esp + 0x2020]
push ecx
push edx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x401b88
lea eax, [esp + 0x201c]
push 0x420108
push eax
mov word [esp + 0x2822], bp
call fcn.00406f2f
add esp, 8
test eax, eax
jne 0x401b88
mov eax, dword [esp + 0x14]
add dword [eax], 1
add edi, 1
cmp edi, ebx
jl 0x401b11
cmp esi, ebp
mov edi, 1
je 0x401b9f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x281c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00406c09
add esp, 0x2810
ret

Function at 0x401bc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x41ea50]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0x218]
push esi
xor esi, esi
test eax, eax
mov dword [esp + 4], esi
mov dword [esp + 8], 0x208
je 0x401c69
cmp word [eax], si
je 0x401c69
test edi, edi
je 0x401c69
push eax
push str.SOFTWAREKingsoftJX3
push 0x41c52c
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.00406543
add esp, 0x14
lea ecx, [esp + 4]
push ecx
push 0x20019
push esi
lea edx, [esp + 0x18]
push edx
push 0x80000002
mov word [esp + 0x226], si
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401c5a
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push edi
push esi
push esi
push str.installPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401c5a
lea esi, [eax + 1]
mov eax, dword [esp + 4]
test eax, eax
je 0x401c69
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00406c09
add esp, 0x214
ret
Function at 0x403ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
push edi
mov edi, eax
mov esi, edx
jne 0x403adf
pop edi
xor eax, eax
pop esi
ret
cmp edi, 8
not esi
jb 0x403bc7
push ebp
mov ebp, edi
shr ebp, 3
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + 0x41b828]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x41b828]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + 0x41b828]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x41b828]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x41b828]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x41b828]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x41b828]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x41b828]
add ecx, 1
sub edi, 8
sub ebp, 1
mov esi, eax
jne 0x403af0
pop ebp
test edi, edi
je 0x403bec
jmp 0x403bd0
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x41b828]
add ecx, 1
sub edi, 1
jne 0x403bd0
mov eax, esi
pop edi
not eax
pop esi
ret

Function at 0x403c00
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [edx]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x41b828]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
add eax, 1
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x41b828]
mov dword [edx + 8], ecx
ret

Function at 0x403c50
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
xor al, bl
movzx ebx, al
xor ebx, edx
shr edx, 8
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x41b828]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
add edx, 1
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x41b828]
pop ebx
mov dword [esi + 8], ecx
ret

Function at 0x404410
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x404442
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404438
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x404455
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call fcn.0040f960
add dword [edi + 0x1c], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret
Function at 0x404470
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x4044a3
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x13]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40449d
mov byte [esi + 8], 1
mov edi, dword [esp + 8]
jmp 0x4044cf
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x4044b5
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x14]
push edi
add edx, ebx
push edx
lea eax, [esp + 0x13]
push eax
call fcn.0040f960
add esp, 0xc
add ebx, edi
mov dword [esi + 0x1c], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x4044e6
movzx ecx, byte [esp + 3]
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
xor eax, eax
add esp, 8
ret
cmp byte [esi], 0
je 0x4044e0
cmp byte [esi + 8], 0
je 0x4044e0
or eax, 0xffffffff
add esp, 8
ret
Function at 0x4045d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x404615
cmp byte [esi + 1], 0
je 0x40461d
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x404632
cmp byte [esi + 1], 0
je 0x404624
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [esi + 0xc]
mov dword [esp + 4], ebp
jmp 0x40463b
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x4045ee
or eax, 0xffffffff
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x40463b
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov ebp, eax
push edi
or edi, 0xffffffff
cmp ebp, 0xffffffff
mov dword [esp + 0xc], edi
jae 0x40464e
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call fcn.004071ff
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40466c
pop ebx
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x18
ret
mov eax, 4
cmp edi, eax
mov dword [esp + 0x18], 0xffffffff
jbe 0x404781
jmp 0x40468f
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
cmp eax, edi
mov dword [esp + 0x14], edi
ja 0x4046a0
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
cmp ebp, 0x404
mov dword [esp + 0x20], eax
jbe 0x4046b9
mov ebp, 0x404
cmp byte [esi], 0
je 0x4046de
cmp byte [esi + 1], 0
je 0x404781
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4046e1
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebp
je 0x404709
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404703
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x40472f
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x40471a
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
push edi
add ecx, eax
push ecx
push ebx
call fcn.0040f960
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x404781
lea eax, [ebp - 3]
test eax, eax
jl 0x404773
nop
sub eax, 1
cmp byte [eax + ebx], 0x50
jne 0x40475e
cmp byte [eax + ebx + 1], 0x4b
jne 0x40475e
cmp byte [eax + ebx + 2], 5
jne 0x40475e
cmp byte [eax + ebx + 3], 6
je 0x404764
test eax, eax
jge 0x404740
jmp 0x404773
mov edx, dword [esp + 0x20]
add eax, edx
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x404781
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x404683
push ebx
call fcn.00406fc0
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret