joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a32caab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x2a35572a
call fcn.2a304215
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x2a32cccc
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2a31be6f
add esp, 0x10
test eax, eax
js 0x2a32ccc6
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x2a32cb4f
push edi
call fcn.2a32df9a
pop ecx
test al, al
je 0x2a32cb4f
mov eax, edi
call fcn.2a352aa0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2a32cb61
push edi
lea ecx, [ebp - 0x424]
call fcn.2a31be6f
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2a31be6f
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2a32ccc6
push 0x60
push ebx
push eax
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x2a32cbb9
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x2a32cbb9
call fcn.2a32b317
mov ebx, eax
jmp 0x2a32cc95
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x2a32cbe0
call fcn.2a32b317
jmp 0x2a32cc88
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x2a32cbd6
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x2a32cc13
mov ebx, 0x8007000e
jmp 0x2a32cc8a
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a31be6f
jmp 0x2a32cc39
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x2a32cc0c
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2a31be6f
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2a31be6f
mov ebx, eax
test edi, edi
je 0x2a32cc95
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a32ccae
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccbe
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32ccb4
mov eax, ebx
jmp 0x2a32ccfa
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x2a32cce1
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccf1
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32cce7
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.2a30424f
ret 0x10
Function at 0x4071f9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407237
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40720d
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x407208
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407264
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x407245
not eax
pop ebp
ret 0xc
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40673a
pop dword [ebp - 0x2c]
mov eax, 0x22507c41
add eax, 0xddefeaf9
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xbbea09fb
add dword [ebp - 0x3c], 0x92683b50
mov dword [ebp - 0x38], 0xa6fc780
add dword [ebp - 0x38], 0x27c384c5
mov dword [ebp - 0x34], 0xc890884a
sub dword [ebp - 0x34], 0x7c44441c
mov dword [ebp - 0x30], 0x6df7c04f
add dword [ebp - 0x30], 0x92083fb1
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x799ac3a7
sub eax, 0x795a42a3
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xfda5a0b5
sub dword [ebp - 0x3c], 0x8933375f
mov dword [ebp - 0x38], 0x3f94f7bd
add dword [ebp - 0x38], 0x1d769b8
mov dword [ebp - 0x34], 0xb33b5c3d
add dword [ebp - 0x34], 0xb034102f
mov dword [ebp - 0x30], 0xacae1f51
sub dword [ebp - 0x30], 0xacae1f51
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x439751d1
sub eax, 0x4356d0d1
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x34725
push 0
call eax
mov ecx, 0xa193d2f9
add ecx, 0x5e6c68c0
xor edi, edi
add edi, eax
mov ebx, 0x8383700f
add ebx, 0x7cc373f1
add ebx, dword [ebp - 0x2c]
mov edx, 0xa45e5c91
add edx, 0x82cf89af
sub dword [ebp - 8], ecx
mov esi, dword [ebx]
add dword [ebp - 4], edx
add esi, edx
mov dword [ebp - 0x28], 0x7d273e3a
mov dword [edi], esi
xor dword [ebp - 8], 0x779c04a9
add edi, 4
add ebx, 0xff4eac02
add ebx, 0xb15402
loop 0x40685e
add eax, 0x5ed54c45
sub eax, 0x5ed46a8e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4e23fbb3
sub ecx, 0x4de3fbb3
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x5d086318
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x32b73725
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409b38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x409b47
pop dword [ebp - 4]
mov eax, 0x93204fbe
sub eax, 0x92dfb477
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xe4d3a1ab
sub dword [ebp - 0x14], 0x96815c60
mov dword [ebp - 0x10], 0x8b64004e
add dword [ebp - 0x10], 0xa6cf4bf7
mov dword [ebp - 0xc], 0xc028a273
add dword [ebp - 0xc], 0x8c23a1bb
mov dword [ebp - 8], 0xb0b037f3
sub dword [ebp - 8], 0xb0b037f3
lea eax, [ebp - 0x14]
push eax
mov eax, 0x8c849117
sub eax, 0x8c43c0c3
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xa8772abf
sub dword [ebp - 0x14], 0x3404c169
mov dword [ebp - 0x10], 0x5091be16
sub dword [ebp - 0x10], 0xf255ca1
mov dword [ebp - 0xc], 0x1114d87b
add dword [ebp - 0xc], 0x525a93f1
mov dword [ebp - 8], 0x33a8acaa
add dword [ebp - 8], 0xcc575356
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x178356da
sub eax, 0x1742868e
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3b6fa
push 0
call eax
mov ecx, 0x4f93
mov esi, eax
mov edi, 0xa2b1a019
sub edi, 0xa26ff019
add edi, dword [ebp - 4]
mov edx, 0xcd86b5e4
add edx, 0x1f68db7c
mov ebx, dword [edi]
xor ebx, edx
mov dword [esi], ebx
add esi, 0x3586e88d
sub esi, 0x3586e889
add edi, 0x6a61677a
add edi, 0x959e988a
loop 0x409c63
add eax, 0x1311f
xor ebx, ebx
add ebx, eax
add eax, 0x75e8a92e
sub eax, 0x75e8a929
mov ecx, 0x400000
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x414560
Capabilities:
Encode data using xor

Disassembly:
mov cl, ch
cmp eax, 0x9d1070e5
cmp al, 0xf0
out 0xe4, al
xor byte [esp + edx*2 + 0x6163f4ea], dh
mov edi, dword [ebx - 0x579414fa]
or byte [eax - 0x66839405], bl
outsb dx, byte [esi]
fcomp qword [edi]
imul edi, dword [ecx + ebx*4 + 0x6e], 0xffffffdc
pop ds
mov al, 0xcc
loop 0x4145a6
loop 0x4145a6
loop 0x4145a6
sbb cl, byte [ebp + 0x73]
pop edx
jp 0x414591
lodsb al, byte [esi]
push esi
jbe 0x414543
imul ecx, dword [edi + 0x29], 0xffffffc6
loopne 0x414557
sub bl, byte [esi - 0x63]
xchg dword [edx - 0x28d75d5], edx
rol edi, 0x96
sub ecx, dword [edx - 0x383e028e]
xchg esi, eax
das
pop esp
cli
xchg ebx, eax
mov bh, 0x72
mov esp, ecx
push cs
and edi, dword [ecx]
sbb ecx, dword [esi + eax*4 + 0x23]
add al, byte [ecx + 0x65]
call 0x607eef05
mov al, 0x2e
xchg ebx, eax
jo 0x41453c
cmp eax, 0x932eb060
aaa
xchg ebp, eax
xor dword [esi + edx*4], esp
mov eax, 0x4b85dd13
pushfd
pop esp
push esi
enter 0xffffffffffffcf8d, 0x54
xchg edx, eax
jns 0x414577
invalid
loope 0x4145b2
mov ecx, 0x242fcabb
xchg esi, eax
and al, 0x96
test edi, 0xd3f7fc81
dec esi
sub eax, 0xdf75fed1
mov eax, dword [0x48ea0637]
sub dword [ebx], esp
int 0x59
aaa
popfd
test al, 0xc9
salc
fadd qword [esp + ebp*2]
mov bh, 0x88
enter 0x7bea, 0xffffffffffffffc5
inc ebp
into
sub eax, 0xac938828
inc edi
jno 0x4145da
rcr byte [esi], 1
or dh, byte [ecx + 0x2d0f583c]
mov ebx, 0xfa9c3ef0
Function at 0x436f2a
Capabilities:
Get common file path

Disassembly:
sub esp, 0x74c
xor eax, eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x19
lea edi, [esp + 0x10]
push 0x64
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x178]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x78]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x278]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x274]
lea edx, [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x178]
push edx
push eax
push ecx
call fcn.00409fe0
lea edx, [esp + 0x284]
lea eax, [esp + 0x84]
push edx
lea ecx, [esp + 0x188]
push eax
push ecx
lea edx, [esp + 0x390]
push str._s_t_s_t_s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x398]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x24
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebp, [esi + 0xb4]
mov ebx, ecx
cmp ebx, 0xfffffffd
jbe 0x436fde
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
mov ecx, dword [ebp + 4]
xor edx, edx
cmp ecx, edx
je 0x437014
mov al, byte [ecx - 1]
test al, al
je 0x437014
cmp al, 0xff
je 0x437014
cmp ebx, edx
jne 0x437048
dec al
pop edi
mov byte [ecx - 1], al
mov dword [ebp + 4], edx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edx
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x74c
ret
cmp ebx, edx
jne 0x437032
push 1
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x74c
ret
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
ja 0x43703e
cmp eax, ebx
jae 0x437051
push 1
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push ebx
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Copy_unsigned_int_]
mov edi, dword [ebp + 4]
mov ecx, ebx
mov eax, ecx
lea esi, [esp + 0x374]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 4]
pop edi
mov dword [ebp + 8], ebx
pop esi
mov byte [ecx + ebx], 0
pop ebp
pop ebx
add esp, 0x74c
ret
Function at 0x43c9a0
Capabilities:
Move file

Disassembly:
sub esp, 0x208
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x20c]
push ebx
push esi
mov esi, dword [esp + 0x218]
push edi
mov edi, esi
push 0x104
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x114]
mov ebx, ecx
push eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.004091f0
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push ebx
push esi
call fcn.004091f0
lea edx, [esp + 0x2c]
lea eax, [esp + 0x130]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x208
ret

Function at 0x441610
Capabilities:
Encode data using xor

Disassembly:
mov dword [ecx], 0x45bd4c
jmp fcn.004153a0
Function at 0x411120
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
test ecx, ecx
je 0x411199
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 7
jmp 0x411168
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jl 0x41118e
mov eax, dword [ebp - 4]
and eax, 1
neg eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
shr ecx, 1
mov edx, dword [ebp - 0x14]
and edx, 0xedb88320
xor ecx, edx
mov dword [ebp - 4], ecx
jmp 0x41115f
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x411134
mov eax, dword [ebp - 4]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x41f2f0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
xor ecx, ecx
xor edx, edx
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x6a09e667
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x4c], 0xbb67ae85
mov eax, 4
shl eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0x3c6ef372
mov edx, 4
imul eax, edx, 3
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0xa54ff53a
mov edx, 4
shl edx, 2
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x510e527f
mov ecx, 4
imul edx, ecx, 5
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x9b05688c
mov ecx, 4
imul edx, ecx, 6
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x1f83d9ab
mov ecx, 4
imul edx, ecx, 7
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x5be0cd19
mov esp, ebp
pop ebp
ret
Function at 0x45df40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bf838
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00536a20
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x24], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x25], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x30], 0
push 0x6dadd0
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.00523eb0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
call fcn.0045e570
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x45ed90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x6e6140
push 0x40
push 0
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
call fcn.00695c80
add esp, 0xc
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x44], 0
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x44], 0
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x67452301
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x4c], 0xefcdab89
mov eax, 4
shl eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0x98badcfe
mov edx, 4
imul eax, edx, 3
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0x10325476
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x503cc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x503cd0
xor eax, eax
jmp 0x503e6d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x503e2e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x6f0858]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x6f0858]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x6f0858]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x6f0858]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x6f0858]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x6f0858]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x6f0858]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x6f0858]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x503cd9
cmp dword [ebp + 0x10], 0
je 0x503e67
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x6f0858]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x503e34
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x507830
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul ecx, eax, 0
movsx edx, byte [ebp + 0xc]
mov eax, dword [ebp + 8]
xor edx, dword [eax + ecx]
and edx, 0xff
mov ecx, 4
imul eax, ecx, 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax]
shr eax, 8
xor eax, dword [edx*4 + 0x6f0858]
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + edx], eax
mov edx, 4
shl edx, 0
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + ecx]
and ecx, 0xff
mov eax, dword [ebp + 8]
add ecx, dword [eax + edx]
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], ecx
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
imul eax, dword [edx + ecx], 0x8088405
add eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
mov eax, 4
shl eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov ecx, dword [edx + ecx]
shr ecx, 0x18
mov edx, dword [ebp + 8]
xor ecx, dword [edx + eax]
and ecx, 0xff
mov eax, 4
shl eax, 1
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax]
shr eax, 8
xor eax, dword [ecx*4 + 0x6f0858]
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
pop ebp
ret
Function at 0x51f010
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], 0
jne 0x51f036
push 0
push 0
push 0
push 2
mov ecx, dword [ebp - 0x10]
call fcn.005211e0
xor al, al
jmp 0x51f1d6
mov ecx, dword [ebp - 0x10]
call fcn.0051e4b0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.0051d9a0
mov dword [ebp - 0x18], 0
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.006a534b
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.006a4e38
add esp, 4
mov dword [ebp - 0x18], eax
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.006a534b
add esp, 0xc
cmp dword [ebp - 0x18], 0
jg 0x51f09c
push 0
push 0
push 0
push 0xc
mov ecx, dword [ebp - 0x10]
call fcn.005211e0
xor al, al
jmp 0x51f1d6
mov eax, dword [ebp - 0x18]
add eax, 1
push eax
call fcn.0054e149
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0xc], ecx
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov edx, dword [ebp + 8]
push edx
push 1
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.006a575f
add esp, 0x10
cmp eax, 1
je 0x51f107
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
push eax
call fcn.0054e144
add esp, 4
push 0
push 0
push 0
push 2
mov ecx, dword [ebp - 0x10]
call fcn.005211e0
xor al, al
jmp 0x51f1d6
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov byte [ebp - 1], 0xd
mov byte [ebp - 2], 0xa
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x18]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
test edx, edx
je 0x51f185
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0xd
jne 0x51f167
mov edx, dword [ebp - 0x14]
mov byte [edx], 0xa
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movsx eax, byte [edx]
cmp eax, 0xa
jne 0x51f165
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x51f183
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x51f124
mov ecx, dword [ebp - 0x14]
mov byte [ecx], 0
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.0054e144
add esp, 4
mov ecx, dword [ebp - 0x10]
call fcn.0051dff0
movzx eax, al
test eax, eax
jne 0x51f1cc
mov dword [ebp - 0x1c], 1
jmp 0x51f1d3
mov dword [ebp - 0x1c], 0
mov al, byte [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8