joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4acd37
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov bh, 0x67
jae 0x4acd8c
pop edx
mov ebp, 0xc1d2dc2f
xchg edx, eax
stosd dword es:[edi], eax
mov dl, 0xd8
cmpsb byte [esi], byte es:[edi]
cmp eax, 0x2de938ad
pop edi
lahf
outsb dx, byte [esi]
inc esi
xchg ebp, esp
mov cs, word [edi]
fidivr dword [edi - 0x36]
dec esp
popfd
mov ecx, 0x68c248af
cmpsb byte [esi], byte es:[edi]
in eax, dx
and dh, 0xb7
sti
out dx, eax
dec ebp
push ss
stosd dword es:[edi], eax
neg bh
add eax, dword [eax + 0x8ddd07b]
je 0x4acdca
aaa
adc byte [edx + 0x6b], al
das
iretd
fdivr st(6)
sal byte [0x2b842e9e], cl
call 0x6e2d3c66
add al, 0x29
outsd dx, dword ss:[esi]
rol dword [edx], cl
aas
inc esp
bound esi, qword [ebx - 0x2997697e]
and bl, 0xa4
xor ebp, ecx
mov esi, 0x4278bb19
jge 0x4acd8a
add al, 0x54
mov ss, eax
jns 0x4ace15
xor byte [edi - 0x325b21dc], 0xe3
push 0x50ccd85
shr byte [edx + 0x50], cl
jl 0x4ace2d
mov ch, 0x2b
test byte [ecx], bh
dec esp
xor eax, 0xa245a239
sub eax, 0xa2934ffb
xchg esi, eax
into
dec ebp
out dx, eax
sub eax, dword [ecx + edi - 0x5dc6cab4]
inc ebp
mov byte [0x934ffb2d], al
mov byte [0xef4dce96], al
jae 0x4acdfb
pop eax
cmp ch, byte [ebx - 0x4b]
push ebx
xor dword [edx + edx - 0x19b4a787], esi
cmpsb byte ss:[esi], byte es:[edi]
xor eax, 0xbc3f8b5
mov edx, 0xa8f98922
in al, 0xab
jne 0x4acdec
imul ecx, ebp, 0x37
int 0x37
int 0x62
int 0x32
rol dword [eax], 0xd6
loope 0x4ace07
mov eax, dword [0x28a0ce7d]
inc esp
retf
jge 0x4acdd7
mov al, byte [0xfdcb4428]
dec ebx
das
movsb byte es:[edi], byte [esi]
mov ch, 0xb
xchg ah, ch
mov dh, 0xf7
jmp 0x4ace0f
mov ebp, cs
mov edi, 0x63421e37
xchg edx, eax
mov esi, 0x853449d7
add al, 0x7b
mov dh, 0x6d
aaa
aaa
out dx, eax
inc esp
sal byte [eax - 0x1d880ac1], cl
popfd
int1
push edi
adc dword [eax], ebx
jmp 0x8413859d

Function at 0x4afad4
Capabilities:
Encode data using xor

Disassembly:
jmp dword [edx + eax*2 - 0x4a]
fcom dword [edx + 0x6a0cc28d]
ret 0x4d74
xchg dword [ecx], esp
xchg ecx, eax
aaa
mov dword [0x221bad05], eax
push 0x19187ece
fucom st(7)
sbb eax, 0x7e9f1a8d
xlatb
jle 0x4afb25
out 0x1c, al
or al, 0xd7
push ecx
clc
push ecx
aaa
insd dword es:[edi], dx
dec edi
insd dword es:[edi], dx
ja 0x4afaa7
ja 0x4afacb
test dword [ebx], ecx
cmp al, 0x8c
leave
invalid
dec ebp
sub dword [ebp - 0x2e7def6d], ebx
or byte [ebx + 0x3ee47e07], al
add dl, byte [ecx]
and cl, byte [ebp + 9]
dec ebp
loop 0x4afb81
mov bl, 0xd
imul ecx, dword [ebp + 4], 0x2ac3f1f
push eax
cmc
mov ebx, 0x3aab1c1
and edx, dword [eax]
mov edi, 0xee6adf9b
sal dword [ecx + 0x102303aa], 0xbf
wait
fild qword [edx - 0x12]
cli
add edx, dword [eax - 0x68966dc1]
movsd dword es:[edi], dword [esi]
inc ecx
arpl word [0xcd7f50a3], bp
add dh, byte [eax + 0x7f]
push ecx
push es
nop
mov al, 0x62
push edi
aam 0xb9
jo 0x4afb46
mov ecx, 0xf651c770
push ecx
mul byte [eax]
ret
and bl, al
and dword [eax - 0x61], ebp
xor ecx, dword [ebp - 0x41]
aam 0x41
cli
loop 0x4afb7c
and dl, bl
aas
or dword [0xc0b12c81], 0x4101a24c
add dword [ecx - 0x1d356494], esp
lea edi, [edi]
cmp eax, 0xb9d1434d
push ds
sar byte [eax + 0x10], 1
mov edi, 0x3f21c539
popal
mov edx, 0xd7b0325a
jno 0x4afb6b
fbld tbyte [edx + 0x16]
hlt
Function at 0x401286
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44d008]
jne 0x401290
repz ret
jmp fcn.00401ca5

Function at 0x40c2f1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404b11
and dword [ebp - 4], 0
cmp dword [0x44fc60], 0
mov ebx, eax
jne 0x40c3a2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c453
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40c453
push eax
call fcn.00404a9f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44fc60], eax
call esi
push eax
call fcn.00404a9f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44fc64], eax
call esi
push eax
call fcn.00404a9f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44fc68], eax
call esi
push eax
call fcn.00404a9f
pop ecx
mov dword [0x44fc70], eax
test eax, eax
je 0x40c3a2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404a9f
pop ecx
mov dword [0x44fc6c], eax
mov eax, dword [0x44fc6c]
cmp eax, ebx
je 0x40c3fa
cmp dword [0x44fc70], ebx
je 0x40c3fa
push eax
call fcn.00404b1a
push dword [0x44fc70]
mov esi, eax
call fcn.00404b1a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c3fa
test edi, edi
je 0x40c3fa
call esi
test eax, eax
je 0x40c3f1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c3f1
test byte [ebp - 0xc], 1
jne 0x40c3fa
or dword [ebp + 0x10], 0x200000
jmp 0x40c433
mov eax, dword [0x44fc64]
cmp eax, ebx
je 0x40c433
push eax
call fcn.00404b1a
pop ecx
test eax, eax
je 0x40c433
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c433
mov eax, dword [0x44fc68]
cmp eax, ebx
je 0x40c433
push eax
call fcn.00404b1a
pop ecx
test eax, eax
je 0x40c433
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44fc60]
call fcn.00404b1a
pop ecx
test eax, eax
je 0x40c453
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c455
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x448150
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x808
mov eax, dword [0x44d008]
xor eax, esp
mov dword [esp + 0x804], eax
cmp dword [0x451538], 0xfc7
mov dword [esp], 0x343f0
jne 0x44817f
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
add dword [esp + 4], 0xd
mov eax, dword [0x45023c]
imul eax, dword [esp + 4]
add eax, 0x269ec3
cmp dword [0x451538], 0x1381
mov dword [0x45023c], eax
movzx esi, word [0x45023e]
jne 0x4481b6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
and esi, 0x7fff
cmp dword [0x451538], 0x8e7
jne 0x4481d9
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401286
add esp, 0x808
ret

Function at 0x448200
Capabilities:
Get file attributes

Disassembly:
cmp dword [0x451538], 0x930
jne 0x448220
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push 0
push 0
call esi
push 0
push 0
call esi
pop esi
cmp dword [0x451538], 0x114e
mov eax, dword [esp + 4]
mov dword [0x45023c], eax
jne 0x448240
push str.behenisifimoj
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret

Function at 0x448370
Capabilities:
Compare security identifiers

Disassembly:
mov eax, dword [0x451538]
sub esp, 0x1c
push esi
mov esi, dword [0x45024c]
push edi
mov edi, eax
cmp eax, 0x5dd
jne 0x448393
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov eax, dword [0x44e560]
push eax
call fcn.00448200
add esp, 4
cmp dword [0x451538], 0x2f
jne 0x4483cd
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call fcn.00448250
add esp, 4
cmp dword [0x451538], 0x568
jne 0x4483ec
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommMask]
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x4487c0
Capabilities:
Access the windows event log
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x44d008]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
xor ebx, ebx
cmp dword [0x451538], 0x997
jne 0x448801
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
cmp ebx, 0x846604
jne 0x448818
mov eax, dword [0x44f1bc]
add eax, 0xa231
mov dword [0x451538], eax
cmp dword [0x451538], 0x141
jne 0x448873
xor edx, edx
xor ecx, ecx
mov word [esp + 0x12], dx
xor eax, eax
mov word [esp + 0xe], cx
lea edx, [esp + 0x18]
push edx
mov word [esp + 0x10], ax
mov eax, dword [esp + 0x10]
push eax
mov word [esp + 0x18], cx
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
call esi
push 0
lea eax, [esp + 0x24]
push eax
call edi
mov dword [0x44ffc0], 0xec58acac
mov dword [0x44ffc4], 0xffffffff
inc ebx
cmp ebx, 0x1254905
jl 0x4487eb
call fcn.00448400
cmp dword [0x451538], 0xc
jne 0x44889a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00401286
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4019c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4019db
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401a12
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401a0e
jmp 0x401a00
cmp esi, eax
jae 0x401a12
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401a00
cmp esi, eax
jb 0x401a19
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x401ea0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5ad21c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x24], 0x10
lea eax, [ebx + 0x10]
jb 0x401ebb
mov eax, dword [eax]
push esi
push edi
push eax
mov eax, dword [ebx + 4]
push 0x2712
push eax
call fcn.00514080
add esp, 0xc
mov edi, 0x75
mov eax, str.Mozilla_5.0__Macintosh__Intel_Mac_OS_X_10_15_7__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_120.0.0.0_Safari_537.36
lea esi, [ebp - 0x20]
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x20], 0
call fcn.00401070
mov eax, dword [ebp - 0x20]
mov esi, 0x10
cmp dword [ebp - 0xc], esi
jae 0x401f03
lea eax, [ebp - 0x20]
mov ecx, dword [ebx + 4]
push eax
push 0x2722
push ecx
call fcn.00514080
mov edx, dword [ebx + 4]
push 5
push 0x44
push edx
call fcn.00514080
mov eax, dword [ebx + 4]
push 1
push 0x34
push eax
call fcn.00514080
mov ecx, dword [ebx + 4]
push 1
push 0x63
push ecx
call fcn.00514080
mov edx, dword [ebx + 4]
push 0
push 0x2f
push edx
call fcn.00514080
mov eax, dword [ebx + 4]
push 0x3c
push 0x4e
push eax
call fcn.00514080
mov ecx, dword [ebx + 4]
add esp, 0x48
push 0x4020e0
push 0x4e2b
push ecx
call fcn.00514080
mov edx, dword [ebx + 4]
push ebx
push 0x2711
push edx
call fcn.00514080
mov eax, dword [ebx + 4]
push 0
push 0x2b
push eax
call fcn.00514080
mov ecx, dword [ebx + 4]
push ebx
push 0x2749
push ecx
call fcn.00514080
mov edx, dword [ebx + 4]
push fcn.005447c0
push 0x4e58
push edx
call fcn.00514080
mov eax, dword [ebx + 4]
push 0
push 0x40
push eax
call fcn.00514080
mov ecx, dword [ebx + 4]
add esp, 0x48
push 0
push 0x51
push ecx
call fcn.00514080
add esp, 0xc
cmp dword [ebp - 0xc], esi
pop edi
pop esi
jb 0x401fda
mov edx, dword [ebp - 0x20]
push edx
call fcn.00407661
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f9765
mov esp, ebp
pop ebp
ret
Function at 0x4022c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x5ad21c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.00407470
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x4022f3
call fcn.00407560
test eax, eax
je 0x402306
mov edi, ebx
call fcn.004075d0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f9765
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], al
mov dword [ebp - 0x10], edi
cmp dword [ebx], 1
je 0x402328
mov dword [0x5b50ec], 0x80000
jmp 0x4022ec
mov esi, dword [ebx + 4]
mov ecx, dword [esi]
or edx, 0xffffffff
cmp dword [ecx + 4], edx
jg 0x40233c
mov ecx, 0x10000
jmp 0x40237f
cmp dword [esi + 4], edx
je 0x40234d
mov edi, ecx
call fcn.004067a0
or edx, 0xffffffff
xor edi, edi
mov eax, dword [esi]
mov dword [esi + 4], edx
mov eax, dword [eax + 4]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
xor ecx, ecx
mov dword [0x5b50ec], ecx
cmp ecx, edi
jne 0x4022ec
xor ecx, ecx
mov esi, eax
cmp eax, ecx
jle 0x402401
jmp 0x4023a2
xor ecx, ecx
mov dword [ebp - 0x138], ecx
mov byte [ebp - 0x134], 0
mov dword [ebp - 0x10], ecx
cmp dword [ebx], 1
je 0x4023c3
mov dword [0x5b50ec], 0x80000
jmp 0x4023d7
mov ecx, dword [ebx + 4]
push edi
lea edx, [ebp - 0x138]
call fcn.004069a0
mov dword [0x5b50ec], eax
cmp dword [ebx], 1
je 0x4023e8
mov dword [0x5b50ec], 0x80000
jmp 0x4023fc
mov ecx, dword [ebx + 4]
push edi
lea edx, [ebp - 0x134]
call fcn.004070d0
mov dword [0x5b50ec], eax
inc edi
cmp edi, esi
jl 0x4023a0
cmp dword [ebx], 1
je 0x402412
mov dword [0x5b50ec], 0x80000
jmp 0x402431
mov esi, dword [ebx + 4]
call fcn.00407410
mov dword [0x5b50ec], eax
test esi, esi
je 0x402428
call fcn.00407510
push ebx
call fcn.00407661
add esp, 4
push str.C:UsersPublicDownloadsdhew.dat
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004f9765
mov esp, ebp
pop ebp
ret
Function at 0x402460
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
xor edi, edi
push edi
push str.C:UsersPublicDownloadshe.dat
call fcn.0054cfca
mov eax, str.56165fg4k1d34yh
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402481
sub eax, edx
push 0x58e16c
push str.C:UsersPublicDownloadshe.dat
mov dword [ebp - 8], eax
call fcn.004fa8b0
push 0x58e110
push str.C:UsersPublicDownloadsdhew.dat
mov esi, eax
call fcn.004fa8b0
push esi
mov ebx, eax
call fcn.004fac6b
add esp, 0x14
test eax, eax
jne 0x402509
lea esp, [esp]
push esi
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.004faf05
push esi
call fcn.004fac6b
add esp, 0x14
test eax, eax
jne 0x4024fc
mov eax, edi
cdq
idiv dword [ebp - 8]
push ebx
push 1
push 1
mov cl, byte [edx + str.56165fg4k1d34yh]
xor byte [ebp - 1], cl
lea edx, [ebp - 1]
push edx
call fcn.004faa1e
add esp, 0x10
inc edi
push esi
call fcn.004fac6b
add esp, 4
test eax, eax
je 0x4024c0
push esi
call fcn.004fa780
push ebx
call fcn.004fa780
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404e50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x404e57
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x404f2d
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x58f7f0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x58f7f0]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x58f7f0]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x58f7f0]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x58f7f0]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x58f7f0]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x58f7f0]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x58f7f0]
add ecx, 8
sub edx, 8
dec esi
jne 0x404e70
pop edi
test edx, edx
je 0x404f4a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x58f7f0]
inc ecx
dec edx
jne 0x404f31
not eax
pop esi
ret

Function at 0x404f50
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x58f7f0]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x58f7f0]
mov dword [edx + 8], ecx
ret

Function at 0x404fa0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x58f7f0]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x58f7f0]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0x405710
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ebx
imul esi, dword [ebp + 0xc]
cmp byte [edi], 0
je 0x405746
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40573c
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
div ebx
pop esi
pop ebp
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
lea edx, [ecx + esi]
cmp edx, eax
jbe 0x405757
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
add eax, ecx
mov ecx, dword [ebp + 8]
push esi
push eax
push ecx
call fcn.004ff520
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop esi
pop ebp
ret
Function at 0x405780
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x4057b3
mov edx, dword [esi + 4]
push 0
lea eax, [ebp - 8]
push eax
push edi
lea ecx, [ebp - 1]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4057ae
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x4057de
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x4057c5
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x14]
push edi
add edx, ebx
push edx
lea eax, [ebp - 1]
push eax
call fcn.004ff520
add esp, 0xc
add ebx, edi
mov dword [esi + 0x1c], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x4057f3
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x4057ed
cmp byte [esi + 8], 0
je 0x4057ed
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x405890
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [esi], 0
je 0x4058d7
cmp byte [esi + 1], 0
je 0x4058df
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebx
je 0x4058f2
cmp byte [esi + 1], 0
je 0x4058e6
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
sub ebx, dword [esi + 0xc]
mov dword [ebp - 4], ebx
jmp 0x4058fa
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x4058b1
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 4]
jmp 0x4058fa
mov eax, dword [esi + 0x1c]
mov dword [ebp - 4], eax
mov ebx, eax
push edi
mov edi, 0xffff
mov dword [ebp - 8], edi
cmp ebx, edi
jae 0x40590c
mov dword [ebp - 8], ebx
mov edi, ebx
push 0x404
call fcn.004fb1cf
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x405929
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0x14], 0xffffffff
cmp edi, eax
jbe 0x405a3d
jmp 0x405949
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
add eax, 0x400
mov dword [ebp - 0xc], edi
cmp eax, edi
ja 0x405958
mov dword [ebp - 0xc], eax
mov eax, ebx
sub eax, dword [ebp - 0xc]
sub ebx, eax
mov dword [ebp - 0x1c], eax
cmp ebx, 0x404
jbe 0x40596f
mov ebx, 0x404
cmp byte [esi], 0
je 0x405994
cmp byte [esi + 1], 0
je 0x405a3d
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x405997
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebx
je 0x4059c0
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi + 4]
push 0
lea eax, [ebp - 0x18]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4059bb
mov byte [esi + 8], 1
mov eax, dword [ebp - 0x18]
jmp 0x4059e9
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebx]
cmp edx, ecx
jbe 0x4059d1
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
mov edx, dword [ebp - 0x10]
push edi
add ecx, eax
push ecx
push edx
call fcn.004ff520
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebx
cmp eax, 1
jne 0x405a3d
lea eax, [ebx - 3]
test eax, eax
js 0x405a2b
lea esp, [esp]
mov ecx, dword [ebp - 0x10]
dec eax
cmp byte [eax + ecx], 0x50
jne 0x405a1f
cmp byte [eax + ecx + 1], 0x4b
jne 0x405a1f
cmp byte [eax + ecx + 2], 5
jne 0x405a1f
cmp byte [eax + ecx + 3], 6
je 0x405a25
test eax, eax
jns 0x405a00
jmp 0x405a2b
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x405a3d
mov edx, dword [ebp - 8]
cmp dword [ebp - 0xc], edx
jb 0x405940
mov eax, dword [ebp - 0x10]
push eax
call fcn.004fb195
mov eax, dword [ebp - 0x14]
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406910
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi], 0
push edi
jne 0x406993
cmp dword [esi + 4], 0xffffffff
jne 0x406993
lea edi, [esi + 0x140]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406937
sub eax, edx
mov al, byte [eax + esi + 0x13f]
cmp al, 0x5c
je 0x406961
cmp al, 0x2f
je 0x406961
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406950
mov ax, word [0x58fde8]
mov word [edi], ax
lea ecx, [ebp - 4]
push ecx
call fcn.00405670
add esp, 4
test eax, eax
jne 0x406979
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret
call fcn.00405a60
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0x1000000
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x406fd0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5ad21c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x407004
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x407004
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [ebx]
test al, al
je 0x4070be
push esi
mov esi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x40701b
cmp al, 0x5c
jne 0x40701d
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x407013
cmp esi, ebx
je 0x407051
sub esi, ebx
push esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004ff520
lea ecx, [ebp - 0x20c]
push ecx
push edi
mov byte [ebp + esi - 0x20c], 0
call fcn.00406fd0
add esp, 0x14
mov byte [ebp - 0x108], 0
test edi, edi
je 0x407070
lea edx, [ebp - 0x108]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x407066
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407074
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x407084
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop esi
cmp eax, 0xffffffff
jne 0x4070be
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004f9765
mov esp, ebp
pop ebp
ret