joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a900
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.004e1f60
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1818]
push edi
mov edi, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x1814]
push ecx
push str.DeviceHarddisk_dPartition_d
push eax
call fcn.004172d0
add esp, 0x10
cmp eax, 2
je 0x42a950
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1810]
push eax
push 0x401
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
je 0x42a93f
push esi
lea eax, [ebp - 0x1810]
push eax
push str._sCnCrypt_Write_Protection_Removal.cmd
lea eax, [ebp - 0x808]
push 0x401
push eax
call fcn.00405500
lea eax, [ebp - 0x1810]
push eax
push str._sCnCrypt_Write_Protection_Removal.diskpart
lea eax, [ebp - 0x100c]
push 0x401
push eax
call fcn.00405500
lea eax, [ebp - 0x808]
push 0x519b1c
push eax
call fcn.004ed562
mov esi, eax
add esp, 0x28
test esi, esi
jne 0x42a9d6
push edi
call fcn.00417c00
add esp, 4
xor eax, eax
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x100c]
push eax
push eax
push str._diskpart__s___s__n_pause_n_del___s____s_
push esi
call fcn.00405ab0
lea eax, [ebp - 0x808]
push eax
push esi
call fcn.00415a00
push esi
call fcn.004ed5ef
lea eax, [ebp - 0x100c]
push 0x519b1c
push eax
call fcn.004ed562
mov esi, eax
add esp, 0x28
test esi, esi
jne 0x42aa45
push edi
call fcn.00417c00
add esp, 4
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x1814]
push str.select_disk__d_nattributes_disk_clear_readonly_n
push esi
call fcn.00405ab0
mov eax, dword [ebp - 0x1818]
add esp, 0xc
test eax, eax
je 0x42aa72
push eax
push str.select_partition__d_nattributes_volume_clear_readonly_n
push esi
call fcn.00405ab0
add esp, 0xc
push str.exit_n
push esi
call fcn.00405ab0
lea eax, [ebp - 0x100c]
push eax
push esi
call fcn.00415a00
push esi
call fcn.004ed5ef
add esp, 0x14
lea eax, [ebp - 0x808]
push 5
push 0
push 0
push eax
call fcn.00416ae0
test eax, eax
mov edx, 0x518484
mov ecx, str.runas
cmove ecx, edx
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop edi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x42abb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x908
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x401
lea eax, [ebp - 0x908]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x42abe6
push str.INVALID_PATH
call fcn.00417300
add esp, 4
xor eax, eax
nop dword [eax + eax]
movzx ecx, word [eax + str.X:pagefile.sys_0_0]
lea eax, [eax + 2]
mov word [ebp + eax - 0x106], cx
test cx, cx
jne 0x42abf0
movsx ax, byte [ebp - 0x908]
lea ecx, [ebp - 0x104]
lea edx, [ecx + 2]
mov word [ebp - 0x104], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ac20
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 4]
push eax
lea eax, [ebp - 0x104]
push eax
push str.PagingFiles
push str.SystemCurrentControlSetControlSession_ManagerMemory_Management
call fcn.004c1010
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret

Function at 0x42ad90
Capabilities:
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e7ab
mov eax, dword fs:[0]
push eax
mov eax, 0x104c
call fcn.004e1f60
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push str.Device_
push esi
call fcn.0042c560
add esp, 8
cmp eax, esi
jne 0x42ae0b
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ade0
sub ecx, edx
sar ecx, 1
cmp ecx, 8
jbe 0x42ae0b
push 0
lea eax, [ebp - 0x1058]
push eax
push esi
call fcn.0042a7a0
add esp, 0xc
jmp 0x42af20
push esi
call fcn.00429d20
add esp, 4
test eax, eax
je 0x42aeed
push esi
lea ecx, [ebp - 0x82c]
call fcn.00403e70
lea eax, [ebp - 0x82c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x844]
push eax
call fcn.004283d0
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x42ae4d
mov eax, dword [eax]
push 0x400
lea ecx, [ebp - 0x814]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceW]
test eax, eax
mov eax, dword [ebp - 0x830]
setne bl
cmp eax, 8
jb 0x42ae83
inc eax
lea ecx, [ebp - 0x844]
push eax
push dword [ebp - 0x844]
call fcn.004052a0
xor eax, eax
mov dword [ebp - 0x830], 7
mov word [ebp - 0x844], ax
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x834], 0
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x42aec5
inc eax
lea ecx, [ebp - 0x82c]
push eax
push dword [ebp - 0x82c]
call fcn.004052a0
xor eax, eax
mov dword [ebp - 0x818], 7
mov dword [ebp - 0x81c], 0
mov word [ebp - 0x82c], ax
test bl, bl
je 0x42aeed
mov eax, 1
jmp 0x42af20
push esi
call fcn.00414f30
add esp, 4
test eax, eax
je 0x42af1e
push esi
call fcn.00414f30
add esp, 4
test eax, eax
je 0x42aee6
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
shr eax, 4
and eax, 1
je 0x42aee6
push 2
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x42cad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x56ab4c], 0
jne 0x42cae8
mov eax, 1
mov esp, ebp
pop ebp
ret
cmp dword [0x56ab58], 0
je 0x42cb03
mov eax, dword [0x56ab58]
push eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 0
push esi
je 0x42cb67
mov eax, dword [0x56ab5c]
mov esi, dword [0x56ab60]
mov ecx, dword [0x56ab64]
cdq
push edx
push eax
push ecx
push esi
call fcn.004e2b40
push dword [ebp + 8]
mov ecx, eax
mov esi, edx
mov eax, dword [0x56ab4c]
cdq
sub ecx, eax
mov eax, dword [0x56ab4c]
sbb esi, edx
cdq
and edx, 0x1ff
add eax, edx
sar eax, 9
push eax
shrd ecx, esi, 9
lea eax, [ebp - 0xc]
push eax
push dword [0x56ab48]
shr esi, 9
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], esi
call fcn.004b7a50
add esp, 0x10
cmp dword [0x56ab30], 0
je 0x42cbe3
push 0xffffffffffffffff
push dword [0x56ab40]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x42cbdc
cmp dword [0x56ab58], 0
je 0x42cbab
push dword [0x56ab40]
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov eax, dword [0x56ab58]
push eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [0x56ab4c]
push esi
push dword [0x56ab48]
push dword [0x56ab3c]
call fcn.004e4130
add esp, 0xc
mov dword [0x56ab54], esi
push dword [0x56ab44]
call dword [sym.imp.KERNEL32.DLL_SetEvent]
test eax, eax
jne 0x42cc05
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
push dword [0x56ab4c]
mov eax, dword [0x56ab50]
push dword [0x56ab48]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x42cbdc
mov dword [0x56ab4c], 0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42cc40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x56ab58], 0
je 0x42cc5c
mov eax, dword [0x56ab58]
push eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
pop ebp
ret
add dword [0x56ab60], 1
push esi
adc dword [0x56ab64], 0
mov eax, dword [0x56ab5c]
push eax
mov eax, dword [0x56ab4c]
push dword [ebp + 8]
add eax, dword [0x56ab48]
push eax
call fcn.004e4130
mov eax, dword [0x56ab5c]
mov esi, 0x100000
add dword [0x56ab4c], eax
push 0xe
call fcn.0041c0d0
add esp, 0x10
mov ecx, 0x10000
test eax, eax
cmove esi, ecx
cmp dword [0x56ab4c], esi
jne 0x42ccc0
push dword [ebp + 0xc]
call fcn.0042cad0
add esp, 4
test eax, eax
je 0x42cd10
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x56ab78]
cmp eax, 0x19
jbe 0x42cd20
mov eax, dword [0x56ab5c]
mov esi, dword [0x56ab60]
mov ecx, dword [0x56ab64]
cdq
push edx
push eax
push ecx
push esi
call fcn.004e2b40
mov esi, dword [0x56ab70]
mov ecx, dword [0x56ab74]
add esi, eax
adc ecx, edx
push ecx
push esi
call fcn.0041efe0
mov eax, dword [0x56ab6c]
add esp, 8
cmp dword [eax], 0
je 0x42cd15
xor eax, eax
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x56ab78], eax
mov eax, 1
pop esi
pop ebp
ret
Function at 0x42ce20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
mov dword [0x56ab3c], 0
mov dword [0x56ab40], 0
mov dword [0x56ab44], 0
push ebx
push esi
push edi
push 0xe
mov dword [0x56ab68], eax
mov esi, 0x100000
call fcn.0041c0d0
test eax, eax
mov ecx, 0x10000
cmove esi, ecx
push esi
call fcn.004f1588
mov esi, dword [sym.imp.KERNEL32.DLL_SetLastError]
add esp, 8
mov dword [0x56ab48], eax
test eax, eax
je 0x42cfa2
cmp dword [0x56ab68], 0
je 0x42cf1a
mov edi, dword [sym.imp.KERNEL32.DLL_CreateEventW]
push 0
push 1
push 0
push 0
call edi
mov dword [0x56ab40], eax
test eax, eax
je 0x42cfa6
push 0
push 0
push 0
push 0
call edi
mov dword [0x56ab44], eax
test eax, eax
je 0x42cfa6
call fcn.0042ce00
push eax
call fcn.004f1588
add esp, 4
mov dword [0x56ab3c], eax
test eax, eax
je 0x42cfa2
push 0
push 0
mov dword [0x56ab34], 0
push 0x42cd30
mov dword [0x56ab58], 0
call fcn.004f1e00
add esp, 0xc
mov dword [0x56ab38], eax
cmp eax, 0xffffffff
je 0x42cfa6
mov dword [0x56ab30], 1
push dword [ebp + 0x1c]
mov eax, dword [ebp + 0x20]
push dword [ebp + 0x18]
cdq
push edx
push eax
call fcn.004e2b40
mov edi, eax
mov ebx, edx
add edi, dword [ebp + 0x10]
lea eax, [ebp - 8]
push 0
adc ebx, dword [ebp + 0x14]
push eax
push ebx
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x42cfa6
cmp dword [ebp - 8], edi
jne 0x42cfa6
cmp dword [ebp - 4], ebx
jne 0x42cfa6
mov eax, dword [ebp + 0x10]
mov dword [0x56ab70], eax
mov eax, dword [ebp + 0x14]
mov dword [0x56ab74], eax
mov eax, dword [ebp + 0x18]
mov dword [0x56ab60], eax
mov eax, dword [ebp + 0x1c]
mov dword [0x56ab64], eax
mov eax, dword [ebp + 0x20]
mov dword [0x56ab5c], eax
mov eax, dword [ebp + 0xc]
pop edi
mov dword [0x56ab50], eax
mov eax, dword [ebp + 0x24]
pop esi
mov dword [0x56ab6c], eax
mov eax, 1
mov dword [0x56ab4c], 0
pop ebx
mov esp, ebp
pop ebp
ret
push 0xe
call esi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [0x56ab40]
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test ecx, ecx
je 0x42cfc1
push ecx
call edi
mov eax, dword [0x56ab44]
test eax, eax
je 0x42cfcd
push eax
call edi
mov eax, dword [0x56ab3c]
test eax, eax
je 0x42cfdf
push eax
call fcn.004ec0b7
add esp, 4
mov eax, dword [0x56ab48]
test eax, eax
je 0x42cff1
push eax
call fcn.004ec0b7
add esp, 4
push ebx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d780
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x42d7c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x84
je 0x42d82a
cmp eax, 0xa1
je 0x42d82a
cmp eax, 0xa3
je 0x42d82a
cmp eax, 0x2a1
ja 0x42d806
je 0x42d7f9
cmp eax, 0x14
je 0x42d7f0
cmp eax, 0x20a
jne 0x42d80d
mov eax, 1
pop ebp
ret 0xc
mov dword [ecx + 0x14], 1
xor eax, eax
pop ebp
ret 0xc
cmp eax, 0x2a3
je 0x42d816
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00424c20
mov dword [ecx + 0x18], 0
xor eax, eax
mov dword [ecx + 0x14], 0
pop ebp
ret 0xc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ecx + 0x10]
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop ebp
ret 0xc

Function at 0x42de30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x42df2a
movzx eax, word [ebx]
test ax, ax
je 0x42df2a
push edi
mov edi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x42de70
cmp ax, 0x5c
jne 0x42de72
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x42de64
cmp edi, ebx
je 0x42debf
sub edi, ebx
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push ebx
push eax
call fcn.004ec074
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x42df3a
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0042de30
add esp, 8
lea ecx, [ebp - 0x414]
sub ecx, esi
nop word [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x42ded0
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x42dee2
lea edi, [ebp - 0x414]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42df00
mov ecx, ebx
lea eax, [ebp - 0x414]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
call fcn.004e2a5f
int3
Function at 0x42e4e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x42e579
cmp dword [esi + 4], 0xffffffff
jne 0x42e579
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x42e510
cmp dword [ebp + 0x10], 1
mov eax, dword [0x518b40]
mov dword [edi], eax
mov edi, dword [ebp + 8]
jne 0x42e543
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 1
je 0x42e543
pop edi
mov eax, 0x2000000
pop esi
pop ebp
ret 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00430dd0
add esp, 0x10
test eax, eax
jne 0x42e563
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 0xc
push eax
call fcn.00431560
add esp, 4
mov dword [esi], eax
mov eax, dword [0x56abac]
pop edi
pop esi
pop ebp
ret 0xc
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x430f20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ebx
imul esi, dword [ebp + 0x10]
cmp dword [edi], 0
je 0x430f61
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x430f55
mov dword [edi + 0xc], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x430f72
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.004e4130
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x431080
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x43108e
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x43114d
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51b480]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51b480]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51b480]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51b480]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51b480]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51b480]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51b480]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51b480]
sub edi, 1
jne 0x4310a6
pop edi
test esi, esi
je 0x43116b
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51b480]
sub esi, 1
jne 0x431151
not eax
pop esi
pop ebp
ret
Function at 0x433920
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x43392e
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x4339ed
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51ce70]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51ce70]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51ce70]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51ce70]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51ce70]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51ce70]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51ce70]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51ce70]
sub edi, 1
jne 0x433946
pop edi
test esi, esi
je 0x433a0b
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51ce70]
sub esi, 1
jne 0x4339f1
not eax
pop esi
pop ebp
ret
Function at 0x4341b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x4343bc
cmp dword [esi + 0x6af90], 3
jb 0x434228
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x434266
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x434266
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x43424f
mov dword [esi + 0x6afa0], eax
push ebx
push esi
call fcn.00434e50
mov ecx, dword [esi + 0x6af90]
mov edi, eax
add esp, 8
cmp edi, ecx
cmova edi, ecx
cmp edi, 3
jb 0x434339
lea eax, [edi - 3]
push eax
mov eax, dword [esi + 0x6af84]
sub eax, dword [esi + 0x6af88]
push eax
push esi
call fcn.00433ce0
sub dword [esi + 0x6af90], edi
add esp, 0xc
mov dword [ebp + 8], eax
cmp edi, dword [esi + 0x6af98]
ja 0x434300
cmp dword [esi + 0x6af90], 3
jb 0x434300
dec edi
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [esi + edx + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x4342a4
mov eax, dword [ebp + 8]
jmp 0x434359
add dword [esi + 0x6af84], edi
xor edi, edi
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp + 8]
jmp 0x43435f
mov eax, dword [esi + 0x6af84]
movzx eax, byte [eax + esi + 0x1af70]
push eax
push 0
push esi
call fcn.00433ce0
add esp, 0xc
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x43439a
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x434377
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x434379
xor edx, edx
mov eax, dword [esi + 0x6af84]
push 0
sub eax, ecx
push eax
push edx
push esi
call fcn.00434610
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x4343af
push esi
call fcn.004344b0
add esp, 4
cmp dword [esi + 0x6af90], 0
jne 0x4341d3
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x4343d0
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x4343d2
xor edx, edx
mov eax, dword [esi + 0x6af84]
push 1
sub eax, ecx
push eax
push edx
push esi
call fcn.00434610
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x435d80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x58]
test edx, edx
je 0x435dd2
mov ecx, dword [edi + 0x60]
mov ebx, dword [edi + 0x5c]
cmp ecx, ebx
jae 0x435e19
mov esi, dword [ebp + 8]
lea eax, [ecx + edx]
sub ebx, ecx
cmp ebx, dword [ebp + 0xc]
cmova ebx, dword [ebp + 0xc]
push ebx
push eax
push esi
call fcn.004e4130
add dword [edi + 0x60], ebx
add dword [edi + 0x48], ebx
push ebx
push esi
push dword [edi + 0x4c]
call fcn.00433920
add esp, 0x18
mov dword [edi + 0x4c], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x50]
test eax, eax
je 0x435e12
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x435e19
mov esi, dword [ebp - 4]
add dword [edi + 0x48], esi
push esi
push ebx
push dword [edi + 0x4c]
call fcn.00433920
add esp, 0xc
mov dword [edi + 0x4c], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0xc], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x436320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
je 0x4363e2
mov eax, dword [esi + 0x20]
push ebx
mov ebx, dword [esi + 0x1c]
push edi
mov edi, dword [ebp + 0xc]
add ebx, edi
cmp ebx, eax
jb 0x4363c1
add eax, eax
push 0
cmp eax, ebx
cmova ebx, eax
push ebx
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x436383
push ebx
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov dword [ebp - 4], eax
test eax, eax
jne 0x436391
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop ebx
mov eax, 0x300
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [esi + 0x20]
push dword [esi + 0x18]
push eax
call fcn.004e4130
add esp, 0xc
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x20], ebx
mov dword [esi + 4], eax
mov ecx, dword [esi + 0x1c]
add ecx, dword [esi + 0x18]
push edi
push dword [ebp + 8]
push ecx
call fcn.004e4130
add esp, 0xc
mov eax, edi
add dword [esi + 0x1c], edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
test eax, eax
je 0x43640c
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esi + 0x10]
pop esi
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0xc], 0x1000000
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8