joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51d400
Capabilities:
Get socket status

Disassembly:
sub esp, 0x210
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
cmp eax, 0xffffffff
je 0x51d54d
mov dword [esp + 0x114], eax
mov dword [esp + 0x10], eax
mov ecx, 1
lea eax, [esp + 4]
push eax
push 0
mov dword [esp + 0x118], ecx
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x11c]
push edx
push 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call sub.ws2_32.dll_select
cmp eax, 0xffffffff
je 0x51d54d
cmp byte [esi + 0x48], 0
jne 0x51d4c7
mov ecx, dword [esi + 0x5c]
lea eax, [esp + 0xc]
push eax
push ecx
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
je 0x51d491
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
mov byte [esi + 0x48], 1
call eax
pop esi
add esp, 0x210
ret
push 0
call fcn.005c9f98
add esp, 4
cmp edx, dword [esi + 0xc]
jl 0x51d54d
jg 0x51d4af
cmp eax, dword [esi + 8]
jbe 0x51d54d
mov ecx, esi
call fcn.0051d040
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
pop esi
add esp, 0x210
ret
mov edx, dword [esi + 0x5c]
lea ecx, [esp + 0xc]
push ecx
push edx
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
je 0x51d510
mov eax, dword [esi + 0x34]
cmp eax, dword [esi + 0x38]
jle 0x51d510
mov ecx, esi
call fcn.0051d3a0
test al, al
jne 0x51d510
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x51d510
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
mov ecx, esi
call fcn.0051d040
pop esi
add esp, 0x210
ret
mov edx, dword [esi + 0x5c]
lea ecx, [esp + 0x110]
push ecx
push edx
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
je 0x51d530
mov ecx, esi
call fcn.0051cf60
test al, al
je 0x51d53d
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
mov ecx, esi
call edx
test al, al
jne 0x51d54d
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
mov ecx, esi
call edx
mov ecx, esi
call fcn.0051d040
pop esi
add esp, 0x210
ret
Function at 0x5225a0
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [esp + 4]
mov byte [ecx + 0x19], al
test al, al
je 0x5225ba
mov eax, dword [ecx + 4]
push 5
push eax
call dword [sym.imp.user32.dll_ShowWindow]
ret 4
mov ecx, dword [ecx + 4]
push 0
push ecx
call dword [sym.imp.user32.dll_ShowWindow]
ret 4

Function at 0x523ae0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61396f
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.00513a30
xor ebx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esi + 4], vtable.CLightBase.0
mov eax, esi
mov dword [esi + 8], vtable.CSingleton_class_CLightManager_.0
mov dword [0x6ed9b0], eax
push 4
mov byte [esp + 0x30], 2
mov dword [esi], vtable.CLightManager.2.0
mov dword [esi + 4], vtable.CLightManager.1.0
mov dword [esi + 8], vtable.CLightManager.0
lea edi, [esi + 0xc]
call fcn.005c58a1
add esp, 4
cmp eax, ebx
je 0x523b5a
mov dword [eax], edi
jmp 0x523b5c
xor eax, eax
mov dword [edi], eax
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
lea edx, [esp + 0x13]
push edx
lea eax, [esp + 0x17]
mov ebx, 3
lea ecx, [esi + 0x2c]
push eax
mov byte [esp + 0x34], bl
call fcn.005160e0
lea ecx, [esi + 0x4c]
mov byte [esp + 0x2c], 4
call fcn.004b6ad0
lea ecx, [esi + 0x78]
mov byte [esp + 0x2c], 5
call fcn.005237c0
fldz
fst dword [esp + 0x18]
mov dword [esi + 0x70], ebx
mov ecx, dword [esp + 0x18]
fst dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
fstp dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], eax
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x524580
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x118
mov eax, dword [0x6ac9e8]
xor eax, esp
mov dword [esp + 0x114], eax
mov ecx, dword [0x6eee94]
cmp ecx, 0xe00e0804
je 0x5246c7
cmp ecx, 0xe0090404
je 0x5246c7
mov eax, dword [0x6ef6c8]
test eax, eax
je 0x5246c7
push ebx
mov edx, 0x404
xor bl, bl
cmp cx, dx
jne 0x5246de
push ebp
push esi
push edi
mov ecx, 0xa
mov esi, str.softwaremicrosoftwindowscurrentversion_
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
and eax, 0xffff0000
movsw word es:[edi], word [esi]
mov ebp, eax
movsb byte es:[edi], byte [esi]
mov eax, str.MSTCIPH
cmp ebp, 0x5010000
jae 0x5245ff
mov eax, str.TINTLGNT
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x524601
lea edi, [esp + 0x20]
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x524610
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x10]
push eax
and ecx, 3
push 0x20019
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5246ac
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.Keyboard_Mapping
push edx
mov dword [esp + 0x30], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x5246a1
mov al, byte [esp + 0x14]
cmp ebp, 0x5000000
ja 0x524689
cmp al, 0x22
je 0x52469f
cmp al, 0x23
je 0x52469f
cmp ebp, 0x5010000
je 0x524699
cmp ebp, 0x5020000
jne 0x5246a1
sub al, 0x22
cmp al, 2
ja 0x5246a1
mov bl, 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x118
ret
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x118
ret
mov ecx, dword [esp + 0x118]
mov al, bl
pop ebx
xor ecx, esp
call fcn.005c5ea5
add esp, 0x118
ret
Function at 0x5248c0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub esp, 0x18
mov eax, dword [0x6ac9e8]
xor eax, esp
mov dword [esp + 0x14], eax
push 0
call dword [sym.imp.user32.dll_GetKeyboardLayout]
mov dword [0x6eee94], eax
cmp dword [0x6ef71c], eax
je 0x524a0a
push esi
mov esi, dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 8
lea ecx, [esp + 0x14]
push ecx
movzx edx, ax
push 0x1004
push edx
mov dword [0x6ef71c], eax
call esi
lea edx, [esp + 0x10]
call fcn.00524830
mov dword [0x6ef6d8], eax
cmp dword [0x69395c], eax
je 0x524a09
push 0x6eedf4
mov dword [0x69395c], eax
call dword [sym.imp.user32.dll_GetKeyboardLayoutNameA]
movzx ecx, word [0x6eee94]
mov eax, ecx
and eax, 0x3ff
sub eax, 4
je 0x524973
sub eax, 0xd
je 0x524960
sub eax, 1
jne case.default.0x524985
mov byte [0x6ed9ce], al
mov dword [0x6ed9c8], 0x69393e
jmp 0x5249ec
mov byte [0x6ed9ce], 1
mov dword [0x6ed9c8], 0x693944
jmp 0x5249ec
mov eax, ecx
shr eax, 0xa
dec eax
mov byte [0x6ed9ce], 1
cmp eax, 4
ja case.default.0x524985
jmp dword [eax*4 + 0x524a1c]
mov byte [0x6ed9ce], 0
mov dword [0x6ed9c8], 0x693932
jmp 0x5249ec
mov dword [0x6ed9c8], 0x693938
jmp 0x5249ec
push 0xa
lea edx, [esp + 8]
push edx
push 3
push ecx
mov dword [0x6ed9c8], 0x69392c
call esi
movsx ax, byte [esp + 4]
mov ecx, dword [0x6ed9c8]
mov word [ecx], ax
movsx dx, byte [esp + 5]
movzx eax, dx
push eax
call fcn.005ca4ca
mov ecx, dword [0x6ed9c8]
add esp, 4
mov word [ecx + 2], ax
cmp dword [0x6ef6d4], 0x4e8
je 0x524a09
mov edx, dword [0x6ef6d8]
mov dword [0x6ef6d4], edx
call fcn.00523de0
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x18
ret
Function at 0x525980
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x10c
mov eax, dword [0x6ac9e8]
xor eax, esp
mov dword [esp + 0x108], eax
cmp byte [0x6ef6c0], 0
mov eax, dword [esp + 0x110]
push edi
mov edi, ecx
jne 0x525b53
cmp byte [0x6ef704], 0
mov dword [0x6eee98], eax
jne 0x5259e7
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x5259e7
push 0x6ef700
push 0x635c2c
push 1
push 0
push 0x64dc38
mov byte [0x6ef704], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
push 0x6eee00
mov dword [0x6eee00], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
push 0x105
lea eax, [esp + 8]
push eax
mov byte [0x6ef6c1], 0
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x525acd
lea eax, [esp + 4]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x525a20
mov ecx, dword [str.imm32.dll]
mov edx, dword [0x635e7c]
mov dword [eax], ecx
mov cx, word [0x635e80]
mov dword [eax + 4], edx
mov dl, byte [0x635e82]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [esp + 4]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [0x6eedf0], eax
test eax, eax
je 0x525ac6
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.ImmLockIMC
push eax
call esi
mov ecx, dword [0x6eedf0]
push str.ImmUnlockIMC
push ecx
mov dword [0x6eeeb0], eax
call esi
mov edx, dword [0x6eedf0]
push str.ImmLockIMCC
push edx
mov dword [0x6eeeac], eax
call esi
mov dword [0x6eeea8], eax
mov eax, dword [0x6eedf0]
push str.ImmUnlockIMCC
push eax
call esi
mov ecx, dword [0x6eedf0]
push str.ImmDisableTextFrameService
push ecx
mov dword [0x6eeea4], eax
call esi
pop esi
test eax, eax
je 0x525acd
push 0xffffffffffffffff
call eax
jmp 0x525acd
mov byte [0x6ef6c1], 1
mov edx, dword [0x6eee98]
push edx
mov byte [0x6ef6c0], 1
call sub.imm32.dll_ImmGetContext
push eax
mov dword [edi + 4], eax
mov eax, dword [0x6eee98]
push eax
call sub.imm32.dll_ImmReleaseContext
call fcn.005248c0
call fcn.00525300
push 2
call fcn.00525330
add esp, 4
call fcn.00525830
test eax, eax
setne cl
mov byte [0x6ef6c3], cl
call fcn.00524a30
cmp byte [0x6ef6c3], 0
je 0x525b53
mov edx, dword [0x6eee94]
and edx, 0x3ff
cmp edx, 4
jne 0x525b42
call fcn.00524e20
mov byte [0x6ef6c5], 1
test eax, eax
jne 0x525b49
mov byte [0x6ef6c5], 0
push 0
call fcn.005254f0
add esp, 4
mov ecx, dword [esp + 0x10c]
pop edi
xor ecx, esp
mov al, 1
call fcn.005c5ea5
add esp, 0x10c
ret 4
Function at 0x526540
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60d4f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6ac9e8]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
mov esi, ecx
mov ecx, dword [esp + 8]
push ecx
push edx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.00526000
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.005262e0
cmp dword [esp + 0x24], 0x10
jb 0x5265da
mov edx, dword [esp + 0x10]
push edx
call fcn.005c5896
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x30
ret 0x1c

Function at 0x527a20
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x6ac9e8]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, ecx
call fcn.00527a00
mov ecx, esi
call fcn.004827e0
lea eax, [esp + 4]
push eax
push 0x101
call sub.ws2_32.dll_WSAStartup
test eax, eax
je 0x527a6e
xor al, al
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x194
ret
mov ecx, dword [esp + 0x194]
mov al, 1
mov byte [esi + 4], al
pop esi
xor ecx, esp
call fcn.005c5ea5
add esp, 0x194
ret

Function at 0x52afb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x613d38
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x20]
push eax
call fcn.005217a0
xor edi, edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.CGraphicImage.0
call fcn.00538750
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x78], ecx
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8

Function at 0x52b020
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6143d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CGraphicImage.0
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.005387c0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00521710
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x52bd90
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
mov esi, ecx
call sub.ws2_32.dll_gethostbyname
test eax, eax
jne 0x52bda7
xor al, al
pop esi
ret 4
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esi + 4], eax
mov al, 1
pop esi
ret 4

Function at 0x52d120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x613e63
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
push eax
call fcn.005217a0
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CAttributeData.0
call fcn.004b6ad0
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 1
call fcn.004b6ad0
fldz
fstp dword [esi + 0x30]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x53d2e0
Capabilities:
Create directory

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x53d387
cmp byte [edi], 0
je 0x53d387
mov eax, edi
lea edx, [eax + 1]
jmp 0x53d300
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x53d300
sub eax, edx
cmp eax, 3
jb 0x53d317
cmp byte [edi + 1], 0x3a
jne 0x53d317
add edi, 3
mov eax, edi
mov dword [esp + 8], edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x53d320
push ebp
sub eax, edx
lea ebp, [eax + 1]
push esi
push ebp
call fcn.005c523d
add esp, 4
cmp byte [edi], 0
mov esi, eax
je 0x53d37c
push ebx
xor ebx, ebx
mov eax, dword [esp + 0x14]
mov al, byte [eax]
cmp al, 0x2f
je 0x53d34f
cmp al, 0x5c
jne 0x53d36c
push ebp
push 0
push esi
call fcn.005c5560
push ebx
push edi
push esi
call fcn.005c68c0
add esp, 0x18
push 0
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov eax, dword [esp + 0x14]
inc eax
inc ebx
cmp byte [eax], 0
mov dword [esp + 0x14], eax
jne 0x53d341
pop ebx
push esi
call fcn.005c6b29
add esp, 4
pop esi
pop ebp
pop edi
ret
Function at 0x53e230
Capabilities:
Get system information on windows
Print debug messages
Read file via mapping

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x24
push esi
mov esi, ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x130], ecx
test eax, eax
jne 0x53e24e
mov eax, dword [esi + 0x114]
mov edx, eax
add edx, ecx
mov dword [esi + 0x134], eax
cmp edx, dword [esi + 0x114]
jbe 0x53e269
xor eax, eax
pop esi
add esp, 0x24
ret 0xc
push ebx
push ebp
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [esi + 0x130]
mov edi, dword [esp + 0x2c]
mov eax, ecx
xor edx, edx
div edi
push 0
imul eax, edi
mov ebx, eax
mov eax, dword [esi + 0x134]
mov edi, ecx
add ecx, eax
push ecx
mov ecx, dword [esi + 0x110]
push 0
push 2
push 0
push ecx
lea ebp, [eax + edx]
sub edi, ebx
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
mov dword [esi + 0x12c], eax
test eax, eax
jne 0x53e2d2
push str.CMappedFile::Map__m_hFM_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x24
ret 0xc
push ebp
push ebx
push 0
push 4
push eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [esi + 0x138], eax
test eax, eax
jne 0x53e309
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push str.CMappedFile::Map__m_lpMapData__lu
call fcn.0053cd50
add esp, 8
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x24
ret 0xc
mov edx, dword [esp + 0x38]
add eax, edi
mov dword [esi + 0x13c], eax
mov dword [edx], eax
mov eax, dword [esi + 0x13c]
mov ecx, dword [esi + 0x134]
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x128], 0
call fcn.0053e130
mov eax, dword [esi + 0x134]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x24
ret 0xc

Function at 0x541ca0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, 0xc6ef3720
mov esi, 0x20
lea ebx, [ebx]
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebp, eax
add ebx, edx
xor ebx, ebp
sub ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
add eax, 0x61c88647
mov ebp, eax
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
dec esi
sub edx, ebx
test esi, esi
ja 0x541cc0
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
ret
Function at 0x541df0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, 0xffffffff
push esi
cmp edx, 0x10
jb 0x541f73
movsx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
movsx esi, byte [ecx + 1]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
movsx esi, byte [ecx + 2]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
movsx esi, byte [ecx + 3]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
movsx esi, byte [ecx + 4]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
movsx esi, byte [ecx + 5]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
movsx esi, byte [ecx + 6]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
movsx esi, byte [ecx + 7]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
movsx esi, byte [ecx + 8]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
movsx esi, byte [ecx + 9]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
movsx esi, byte [ecx + 0xa]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
movsx esi, byte [ecx + 0xb]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
movsx esi, byte [ecx + 0xc]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
movsx esi, byte [ecx + 0xd]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
movsx esi, byte [ecx + 0xe]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
movsx esi, byte [ecx + 0xf]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
add ecx, 0x10
sub edx, 0x10
cmp edx, 0x10
jae 0x541e05
test edx, edx
je 0x541f9b
jmp 0x541f80
movsx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x694638]
inc ecx
sub edx, 1
jne 0x541f80
not eax
pop esi
ret
Function at 0x5422a0
Capabilities:
Get file size
Get system information on windows
Read file via mapping

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
push edi
xor ebp, ebp
push ebp
push ebx
call dword [sym.imp.kernel32.dll_GetFileSize]
mov esi, eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov edi, dword [esp + 0x2c]
push ebp
push esi
push ebp
push 2
push ebp
push ebx
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
je 0x54231a
xor eax, eax
xor edx, edx
div edi
imul eax, edi
add edx, esi
push edx
push eax
push ebp
push 4
push ebx
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov edi, eax
push esi
push edi
call fcn.00541df0
add esp, 8
mov esi, eax
test edi, edi
je 0x542309
push edi
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x24
ret

Function at 0x542380
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5423a9
xor eax, eax
pop esi
ret
push edi
push 0
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x542780
Capabilities:
Get file size

Disassembly:
push ebp
push esi
push edi
mov esi, ecx
call fcn.00542760
mov ebp, dword [esp + 0x10]
push 0x104
lea eax, [esi + 8]
push ebp
push eax
call fcn.005c68c0
mov edi, dword [esp + 0x20]
add esp, 0xc
mov eax, 1
cmp edi, 2
jne 0x5427b8
mov ecx, 0xc0000000
lea eax, [edi + 1]
jmp 0x5427bd
mov ecx, 0x80000000
xor edx, edx
cmp edi, 1
setne dl
push 0
push 0x80
add edx, 3
push edx
push 0
push eax
push ecx
push ebp
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [esi + 0x110], eax
cmp eax, 0xffffffff
je 0x542803
push 0
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [esi + 4], edi
pop edi
mov dword [esi + 0x114], eax
pop esi
mov eax, 1
pop ebp
ret 8
pop edi
mov dword [esi + 0x110], 0
pop esi
xor eax, eax
pop ebp
ret 8