joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413bc0
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4c2320]
xor eax, ebp
mov dword [ebp - 4], eax
push str.HTTP_1.0_404_NOT_FOUND_r_n
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413bf5
push esi
mov esi, dword [sym.imp.WS2_32.dll_send]
push 0
sub eax, edx
push eax
lea ecx, [ebp - 0x404]
push ecx
push edi
call esi
push str.Server:_bd_httpd_0.1.0_r_n
lea edx, [ebp - 0x404]
push 0x400
push edx
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x413c34
push 0
sub eax, ecx
push eax
lea eax, [ebp - 0x404]
push eax
push edi
call esi
push str.Content_Type:_text_html_r_n
lea ecx, [ebp - 0x404]
push 0x400
push ecx
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x413c70
push 0
sub eax, ecx
push eax
lea edx, [ebp - 0x404]
push edx
push edi
call esi
push 0x49cafc
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x413ca8
push 0
sub eax, ecx
push eax
lea ecx, [ebp - 0x404]
push ecx
push edi
call esi
push str._HTML__TITLE_Not_Found__TITLE__r_n
lea edx, [ebp - 0x404]
push 0x400
push edx
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x413ce0
push 0
sub eax, ecx
push eax
lea eax, [ebp - 0x404]
push eax
push edi
call esi
push str._BODY__P_Not_Found_r_n
lea ecx, [ebp - 0x404]
push 0x400
push ecx
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x413d18
push 0
sub eax, ecx
push eax
lea edx, [ebp - 0x404]
push edx
push edi
call esi
push str.Not_Found_r_n
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x413d50
push 0
sub eax, ecx
push eax
lea ecx, [ebp - 0x404]
push ecx
push edi
call esi
push str.__BODY___HTML__r_n
lea edx, [ebp - 0x404]
push 0x400
push edx
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413d88
push 0
sub eax, edx
push eax
lea eax, [ebp - 0x404]
push eax
push edi
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00449592
mov esp, ebp
pop ebp
ret
Function at 0x413db0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, eax
mov ebx, edi
call fcn.00413e40
mov ebx, dword [ebp + 8]
push 0x4ba7f4
push ebx
mov dword [ebp - 4], 0
call fcn.00449cb0
add esp, 8
test eax, eax
jne 0x413df2
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.0041d450
mov esi, eax
add esp, 4
test esi, esi
jne 0x413e10
lea ecx, [ebp - 4]
push ecx
call fcn.0041d4e0
mov esi, eax
add esp, 4
test esi, esi
jne 0x413e10
call fcn.00413bc0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.004138a0
add esp, 8
push 0
push esi
mov esi, dword [ebp - 4]
push esi
push edi
call dword [sym.imp.WS2_32.dll_send]
push esi
call fcn.0044a529
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413e40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4c2320]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_recv]
jmp 0x413e60
lea ecx, [ebp - 0x404]
mov eax, 0x4bb2a8
jmp 0x413e70
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x413e90
test dl, dl
je 0x413e8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x413e90
add eax, 2
add ecx, 2
test dl, dl
jne 0x413e70
xor eax, eax
jmp 0x413e95
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x413f32
xor esi, esi
xor al, al
mov byte [ebp - 0x405], al
cmp al, 0xa
je 0x413f22
push 0
push 1
lea eax, [ebp - 0x405]
push eax
push ebx
call edi
test eax, eax
jle 0x413f12
mov al, byte [ebp - 0x405]
cmp al, 0xd
jne 0x413f08
push 2
push 1
lea ecx, [ebp - 0x405]
push ecx
push ebx
call edi
test eax, eax
jle 0x413f00
cmp byte [ebp - 0x405], 0xa
jne 0x413f00
push 0
push 1
lea edx, [ebp - 0x405]
push edx
push ebx
call edi
mov al, byte [ebp - 0x405]
mov byte [ebp + esi - 0x404], al
inc esi
jmp 0x413f1a
mov al, 0xa
mov byte [ebp - 0x405], al
mov byte [ebp + esi - 0x404], al
inc esi
jmp 0x413f1a
mov al, 0xa
mov byte [ebp - 0x405], al
cmp esi, 0x3ff
jl 0x413ea7
mov byte [ebp + esi - 0x404], 0
test esi, esi
jg 0x413e60
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00449592
mov esp, ebp
pop ebp
ret
Function at 0x413f50
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4c2320]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413f81
push str.socket
call fcn.0044d496
add esp, 4
movzx ecx, word [edi]
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, 2
push ecx
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push str.127.0.0.1
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x10
lea edx, [ebp - 0x14]
push edx
push esi
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x413fd2
push str.bind
call fcn.0044d496
add esp, 4
cmp word [edi], 0
jne 0x41400d
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push esi
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x414000
push str.getsockname
call fcn.0044d496
add esp, 4
mov edx, dword [ebp - 0x12]
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [edi], ax
push 5
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jns 0x414027
push str.listen
call fcn.0044d496
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00449592
mov esp, ebp
pop ebp
ret
Function at 0x414040
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4c2320]
xor eax, ebp
mov dword [ebp - 4], eax
push str.HTTP_1.0_501_Method_Not_Implemented_r_n
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414075
push esi
mov esi, dword [sym.imp.WS2_32.dll_send]
push 0
sub eax, edx
push eax
lea ecx, [ebp - 0x404]
push ecx
push edi
call esi
push str.Server:_bd_httpd_0.1.0_r_n
lea edx, [ebp - 0x404]
push 0x400
push edx
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4140b4
push 0
sub eax, ecx
push eax
lea eax, [ebp - 0x404]
push eax
push edi
call esi
push str.Content_Type:_text_html_r_n
lea ecx, [ebp - 0x404]
push 0x400
push ecx
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4140f0
push 0
sub eax, ecx
push eax
lea edx, [ebp - 0x404]
push edx
push edi
call esi
push 0x49cafc
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x414128
push 0
sub eax, ecx
push eax
lea ecx, [ebp - 0x404]
push ecx
push edi
call esi
push str._HTML__HEAD__TITLE_Method_Not_Implemented_r_n
lea edx, [ebp - 0x404]
push 0x400
push edx
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x414160
push 0
sub eax, ecx
push eax
lea eax, [ebp - 0x404]
push eax
push edi
call esi
push str.__TITLE___HEAD__r_n
lea ecx, [ebp - 0x404]
push 0x400
push ecx
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x414198
push 0
sub eax, ecx
push eax
lea edx, [ebp - 0x404]
push edx
push edi
call esi
push str._BODY__P_HTTP_request_method_not_supported._r_n
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4141d0
push 0
sub eax, ecx
push eax
lea ecx, [ebp - 0x404]
push ecx
push edi
call esi
push str.__BODY___HTML__r_n
lea edx, [ebp - 0x404]
push 0x400
push edx
call fcn.00449625
lea eax, [ebp - 0x404]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414208
push 0
sub eax, edx
push eax
lea eax, [ebp - 0x404]
push eax
push edi
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00449592
mov esp, ebp
pop ebp
ret
Function at 0x414a80
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4c2320]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4cd31c], 2
jne 0x414b97
mov eax, dword [0x4cd320]
mov eax, dword [eax + 4]
mov ecx, str.__showad
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x414ad0
test dl, dl
je 0x414acc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x414ad0
add eax, 2
add ecx, 2
test dl, dl
jne 0x414ab0
xor eax, eax
jmp 0x414ad5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x414aeb
call fcn.00414a30
cmp dword [0x4cd31c], 2
jne 0x414b97
mov ecx, dword [0x4cd320]
push esi
mov esi, dword [ecx + 4]
mov ecx, str.__scrash
mov eax, esi
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x414b20
test dl, dl
je 0x414b1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x414b20
add eax, 2
add ecx, 2
test dl, dl
jne 0x414b00
xor eax, eax
jmp 0x414b25
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x414b42
push str.CRASH
mov ecx, 0x49cb08
call fcn.004157a0
add esp, 4
push 0
call fcn.0044ceab
push 0xa
push str.__waitpid
push esi
call fcn.00449b21
add esp, 0xc
test eax, eax
jne 0x414b96
mov edx, dword [0x4cd320]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
call fcn.0044c6bd
add esp, 4
test eax, eax
je 0x414b96
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x414b96
push 0x7d0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
push 0x406300
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
cmp dword [0x4cd31c], 2
jne 0x414be3
mov eax, dword [0x4cd320]
mov eax, dword [eax + 4]
mov ecx, str.__tcrash
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x414bd8
test dl, dl
je 0x414bd4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x414bd8
add eax, 2
add ecx, 2
test dl, dl
jne 0x414bb8
xor eax, eax
jmp 0x414bdd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x414be3
mov byte [eax], al
push str.ZqxGGjMutexOne
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x414c1c
push str.ZqxGGjMutexOne
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.0040d0a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449592
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [0x4d0f80]
lea ecx, [ebp - 8]
push ecx
push 0x1f4
push 2
push 0
push 0
push edx
push 0xffff
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00449592
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4151f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push str.lastc
push str.Softwarekkvsvr
push reloc.WS2_32.dll_accept
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x415235
xor esi, esi
jmp 0x415238
mov esi, dword [ebp - 4]
push 0
call fcn.0044a5fe
mov ecx, eax
sub eax, esi
cdq
xor eax, edx
add esp, 4
sub eax, edx
pop esi
cmp eax, 0x14
jge 0x415257
xor eax, eax
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push str.lastc
push str.Softwarekkvsvr
push reloc.WS2_32.dll_accept
mov dword [ebp - 0xc], ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x415280
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x4c2320]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x16f]
push 0
push eax
mov byte [ebp - 0x170], 0
call fcn.0044f160
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x170]
push ecx
push 0
call esi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 5
push 0x49cafb
push str.__scrash
lea edx, [ebp - 0x170]
push edx
push str.open
push 0
call edi
call fcn.004151f0
test eax, eax
je 0x415350
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x68]
push str.__waitpid_d
push eax
call fcn.004495a1
push 0x104
lea ecx, [ebp - 0x277]
push 0
push ecx
mov byte [ebp - 0x278], 0
call fcn.0044f160
add esp, 0x18
push 0x104
lea edx, [ebp - 0x278]
push edx
push 0
call esi
push 5
push 0x49cafb
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x278]
push ecx
push str.open
push 0
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00449592
mov esp, ebp
pop ebp
ret

Function at 0x415500
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484ef8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4c2320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.004029a0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
inc eax
push eax
call fcn.00449581
add esp, 4
cmp dword [ebp - 0x18], 0x10
mov esi, eax
mov eax, dword [ebp - 0x2c]
jae 0x41556d
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
push ecx
push eax
push esi
call fcn.0044a8e0
mov edx, dword [ebp - 0x1c]
push esi
push 0
push 0x415480
mov byte [edx + esi], 0
call fcn.00449eb4
add esp, 0x18
cmp dword [ebp - 0x18], 0x10
jb 0x4155a1
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0044a567
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00449592
mov esp, ebp
pop ebp
ret
Function at 0x416740
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4829db
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4c2320]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x4bb70c
call fcn.0046a91c
push 4
mov dword [ebp - 4], 0
call fcn.0044a64f
mov edi, eax
add esp, 4
test edi, edi
je 0x4167c0
call fcn.0046acca
mov dword [edi], eax
call fcn.0046aa89
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0046a9be
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4167b6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0046a9e6
jmp 0x4167c2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4179f0
Capabilities:
Delete file
Write file on windows

Disassembly:
push esi
push 0x4ba5c0
push edi
call fcn.0044ad72
mov esi, eax
add esp, 8
test esi, esi
je 0x417a25
push esi
push 1
push 2
push 0x4bb7d4
call fcn.0044ba39
add esp, 0x10
push esi
cmp eax, 1
je 0x417a29
call fcn.0044b86e
add esp, 4
xor eax, eax
pop esi
ret
call fcn.0044b86e
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
pop esi
ret
Function at 0x417b70
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov edi, ecx
cmp byte [edi], 0x2a
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
je 0x417b97
mov eax, 1
cmp dword [ebp + 0xc], eax
jne 0x417b97
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
lea esp, [esp]
mov esi, ebx
mov edx, edi
mov al, byte [esi]
test al, al
je 0x417c46
mov cl, byte [edx]
cmp cl, 0x2a
je 0x417c10
cmp cl, 0x3f
je 0x417c0c
cmp cl, 0x5e
je 0x417be5
xor cl, al
test cl, 0xdf
je 0x417c0c
cmp byte [edx], 0
jne 0x417bd1
cmp dword [ebp + 0x10], 0
jne 0x417c31
cmp dword [ebp - 4], 0
je 0x417c3d
inc ebx
cmp dword [ebp - 8], 0
jne 0x417ba0
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
jmp 0x417ba0
mov cl, al
and cl, 0xdf
cmp cl, 0x41
jb 0x417bf4
cmp cl, 0x5a
jbe 0x417bd1
cmp al, 0x30
jl 0x417bfc
cmp al, 0x39
jle 0x417bd1
cmp al, 0x5f
je 0x417bd1
cmp al, 0x2d
je 0x417bd1
cmp al, 0x2e
je 0x417bd1
cmp al, 0x25
je 0x417bd1
inc esi
inc edx
jmp 0x417ba4
cmp byte [edx + 1], 0
mov eax, 1
lea edi, [edx + 1]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov ebx, esi
jne 0x417ba0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edx], 0x2a
jne 0x417c4c
inc edx
xor eax, eax
cmp byte [edx], al
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a5a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x41a5a7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x41a67d
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x49e4e8]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x49e4e8]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x49e4e8]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x49e4e8]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x49e4e8]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x49e4e8]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x49e4e8]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x49e4e8]
add ecx, 8
sub edx, 8
dec esi
jne 0x41a5c0
pop edi
test edx, edx
je 0x41a69a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x49e4e8]
inc ecx
dec edx
jne 0x41a681
not eax
pop esi
ret

Function at 0x41ad00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ebx
imul esi, dword [ebp + 0xc]
cmp byte [edi], 0
je 0x41ad36
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41ad2c
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
div ebx
pop esi
pop ebp
ret
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
lea edx, [ecx + esi]
cmp edx, eax
jbe 0x41ad47
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x10]
add eax, ecx
mov ecx, dword [ebp + 8]
push esi
push eax
push ecx
call fcn.0044d7e0
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop esi
pop ebp
ret

Function at 0x41ad70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x41ada3
mov edx, dword [esi + 4]
push 0
lea eax, [ebp - 8]
push eax
push edi
lea ecx, [ebp - 1]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41ad9e
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x41adce
mov eax, dword [esi + 0x14]
push ebx
mov ebx, dword [esi + 0x18]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x41adb5
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x10]
push edi
add edx, ebx
push edx
lea eax, [ebp - 1]
push eax
call fcn.0044d7e0
add esp, 0xc
add ebx, edi
mov dword [esi + 0x18], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x41ade3
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x41addd
cmp byte [esi + 8], 0
je 0x41addd
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x41ae80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [esi], 0
je 0x41aec7
cmp byte [esi + 1], 0
je 0x41aecf
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebx
je 0x41aee1
cmp byte [esi + 1], 0
je 0x41aed5
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
sub ebx, dword [esi + 0xc]
mov dword [ebp - 4], ebx
jmp 0x41aee9
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x18], ecx
jmp 0x41aea1
xor eax, eax
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 4]
jmp 0x41aee9
mov eax, dword [esi + 0x18]
mov dword [ebp - 4], eax
mov ebx, eax
push edi
mov edi, 0xffff
mov dword [ebp - 8], edi
cmp ebx, edi
jae 0x41aefb
mov dword [ebp - 8], ebx
mov edi, ebx
push 0x404
call fcn.00449c1b
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x41af15
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0x14], 0
cmp edi, eax
jbe 0x41b029
jmp 0x41af39
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
add eax, 0x400
mov dword [ebp - 0xc], edi
cmp eax, edi
ja 0x41af48
mov dword [ebp - 0xc], eax
mov eax, ebx
sub eax, dword [ebp - 0xc]
sub ebx, eax
mov dword [ebp - 0x1c], eax
cmp ebx, 0x404
jbe 0x41af5f
mov ebx, 0x404
cmp byte [esi], 0
je 0x41af84
cmp byte [esi + 1], 0
je 0x41b029
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x41af87
mov dword [esi + 0x18], eax
cmp byte [esi], 0
mov edi, ebx
je 0x41afb0
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi + 4]
push 0
lea eax, [ebp - 0x18]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41afab
mov byte [esi + 8], 1
mov eax, dword [ebp - 0x18]
jmp 0x41afd9
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea edx, [eax + ebx]
cmp edx, ecx
jbe 0x41afc1
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x10]
mov edx, dword [ebp - 0x10]
push edi
add ecx, eax
push ecx
push edx
call fcn.0044d7e0
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div ebx
cmp eax, 1
jne 0x41b029
lea eax, [ebx - 3]
test eax, eax
jle 0x41b01d
lea esp, [esp]
mov ecx, dword [ebp - 0x10]
dec eax
cmp byte [eax + ecx], 0x50
jne 0x41b00f
cmp byte [eax + ecx + 1], 0x4b
jne 0x41b00f
cmp byte [eax + ecx + 2], 5
jne 0x41b00f
cmp byte [eax + ecx + 3], 6
je 0x41b015
test eax, eax
jg 0x41aff0
jmp 0x41b01d
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
jne 0x41b029
mov edx, dword [ebp - 8]
cmp dword [ebp - 0xc], edx
jb 0x41af30
mov eax, dword [ebp - 0x10]
push eax
call fcn.00449be1
mov eax, dword [ebp - 0x14]
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret