joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402028
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x402223
xor ebx, ebx
cmp word [edi], bx
je 0x402223
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40205b
test al, 0x10
jne 0x402140
movzx ecx, word [edi + 2]
xor edx, edx
mov dword [ebp - 4], 0x3a
mov eax, edx
push 0x5c
mov dword [ebp + 8], eax
mov dword [ebp - 8], edx
pop esi
cmp cx, word [ebp - 4]
jne 0x402083
cmp word [edi + 4], si
je 0x40212b
cmp word [edi], si
jne 0x40212b
cmp cx, si
jne 0x40212b
lea ecx, [edi + 4]
cmp word [ecx], 0x3f
jne 0x4020fd
cmp word [edi + 6], dx
je 0x4020fd
movzx esi, word [edi + 8]
test si, si
je 0x4020fa
movzx ecx, word [edi + 0xa]
cmp cx, word [ebp - 4]
jne 0x4020bc
lea ebx, [edi + 8]
jmp 0x40212d
cmp esi, 0x55
jne 0x40212d
cmp ecx, 0x4e
jne 0x40212d
cmp word [edi + 0xc], 0x43
jne 0x40212d
push 0x5c
pop ecx
cmp word [edi + 0xe], cx
jne 0x40212d
cmp word [edi + 0x10], cx
jne 0x40212d
push ecx
lea eax, [edi + 0x12]
push eax
call fcn.0041327a
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x402223
mov eax, dword [ebp + 8]
add ebx, 2
jmp 0x40212d
push 0x5c
pop esi
push esi
push ecx
call fcn.0041327a
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x402223
add ebx, 2
mov esi, ebx
sub esi, edi
sar esi, 1
mov dword [ebp - 8], esi
lea eax, [esi + 4]
push eax
call fcn.00416f46
pop ecx
mov dword [ebp + 8], eax
jmp 0x40212d
mov ebx, edi
xor ecx, ecx
cmp word [ebx + 2], cx
jne 0x402148
test eax, eax
je 0x402140
push eax
call fcn.00416f2b
pop ecx
xor eax, eax
inc eax
jmp 0x402225
push edi
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
mov esi, eax
call fcn.00416a45
lea ecx, [esi*2 + 4]
mov ebx, eax
push ecx
mov dword [ebp - 4], ebx
call fcn.00416f46
pop ecx
pop ecx
mov esi, eax
push 0x42d428
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call fcn.0040229b
mov eax, dword [ebp - 8]
pop ecx
test eax, eax
je 0x4021a7
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4021a4
push eax
push edi
inc eax
push eax
push esi
call fcn.00416932
push ebx
call fcn.00416f2b
add esp, 0x14
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x42d42c
push ebx
call fcn.00416a03
add esp, 0xc
test eax, eax
je 0x402203
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push eax
push esi
call edi
push 0x42d42c
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4021df
test al, 0x10
jne 0x4021ec
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x402215
lea eax, [ebp - 0xc]
push eax
push 0x42d42c
push 0
call fcn.00416a03
add esp, 0xc
test eax, eax
jne 0x4021c3
push ebx
call fcn.00416f2b
push esi
call fcn.00416f2b
pop ecx
jmp 0x40213f
push ebx
call fcn.00416f2b
push esi
call fcn.00416f2b
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40237a
Capabilities:
Enumerate pe sections
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004122f0
push ebx
push esi
push dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 0x1004]
push 0x1000
inc ebx
xor esi, esi
push ebx
push eax
call fcn.00417bad
mov edx, eax
add esp, 0x10
cmp edx, 0x200
jl 0x402439
mov eax, 0x5a4d
cmp word [ebp - 0x1004], ax
jne 0x402439
mov ecx, dword [ebp - 0xfc8]
test ecx, ecx
jle 0x402439
lea eax, [edx - 0x138]
cmp ecx, eax
jge 0x402439
lea ecx, [ebp + ecx - 0x1004]
cmp dword [ecx], 0x4550
jne 0x402439
movzx eax, word [ecx + 6]
mov dword [ebp - 4], eax
movzx eax, word [ecx + 0x14]
push edi
lea edi, [ecx + 0x18]
mov ecx, dword [ebp - 4]
add edi, eax
lea eax, [ebp - 0x1004]
sub eax, edi
add edx, eax
sub edx, 0x28
test edx, edx
jle 0x40242d
test dword [edi + 0x24], 0x40000040
lea eax, [ebx + 1]
movzx ecx, ax
movzx eax, bx
cmove ecx, eax
add edi, 0x28
movzx eax, cx
mov ecx, dword [ebp - 4]
mov ebx, eax
cmp ax, cx
jb 0x402403
cmp bx, cx
jne 0x402438
mov esi, dword [edi + 0x14]
add esi, dword [edi + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40271a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
push ebx
push esi
push edi
push 0x10000
call fcn.00416f46
pop ecx
mov ebx, eax
call fcn.00402fbb
xor edi, edi
push edi
push edi
push edi
push 0x67
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov esi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push edi
push dword [ebp + 0x1c]
push dword [ebp + 8]
call fcn.004180e4
add esp, 0xc
push 0x3ec
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, eax
mov dword [ebp - 8], 0x19000
mov eax, dword [ebp + 0x14]
sub eax, dword [ebp + 0x1c]
cdq
idiv dword [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
push edi
push 0x406
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp + 8]
xorps xmm0, xmm0
push 0x10000
push 1
push ebx
movlpd qword [ebp + 0x14], xmm0
call fcn.00417bad
mov edi, eax
add esp, 0x10
cmp edi, 0xffffffff
je 0x402866
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x1c], eax
test edi, edi
je 0x402866
push edi
push ebx
call fcn.00402ffa
add dword [ebp + 0x1c], edi
mov edi, dword [ebp - 4]
pop ecx
pop ecx
adc edi, 0
push 0
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x1c]
push 0
push 0
push dword [ebp - 8]
push edi
push eax
call fcn.00412240
push eax
push 0x402
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x402848
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x402848
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push dword [ebp + 8]
push 0x10000
push 1
push ebx
call fcn.00417bad
mov edi, eax
add esp, 0x10
cmp edi, 0xffffffff
jne 0x4027cb
push ebx
call fcn.00416f2b
pop ecx
test esi, esi
je 0x402878
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [ebp + 0x10], 0
mov eax, dword [0x43cef8]
pop edi
not eax
pop esi
mov dword [0x43cef8], eax
pop ebx
je 0x4028de
cmp dword [ebp + 0x10], eax
je 0x4028de
push 0x100
lea eax, [ebp - 0x228]
push eax
push 0x12
push dword [0x43cad8]
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [ebp + 0x20]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x628]
push 0x10
push 0x42d4c4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
leave
ret
Function at 0x402fbb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
xor esi, esi
push 8
mov edi, esi
pop ebx
mov edx, edi
mov ecx, edi
shr edx, 1
mov eax, edx
mov edi, edx
xor eax, 0xedb88320
and cl, 1
cmovne edi, eax
sub ebx, 1
jne 0x402fc5
mov dword [esi*4 + 0x43cf00], edi
inc esi
cmp esi, 0x100
jb 0x402fc0
or dword [0x43cef8], 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x402ffa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x40302f
mov edx, dword [0x43cef8]
push edi
mov edi, dword [ebp + 8]
movzx ecx, byte [esi + edi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x43cf00]
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40300f
mov dword [0x43cef8], edx
pop edi
pop esi
pop ebp
ret

Function at 0x403489
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x43e5d4], 0
jne 0x403571
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [ebp + 8]
xor edi, edi
push edi
push dword [0x43cad8]
push 0x3e8
push eax
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 4]
push eax
mov eax, dword [ecx + 8]
sub eax, dword [ecx]
push eax
push dword [ecx + 4]
push dword [ecx]
push 0x56b40440
push edi
push str.LISTBOX
push 0x40080
call dword [sym.imp.USER32.dll_CreateWindowExW]
push edi
push dword [ebp + 0xc]
mov dword [0x43e5d4], eax
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x43e5e0], edi
jne 0x403507
push 0xfffffffffffffffc
push dword [0x43e5d4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [0x43e5e0], eax
push 0x4038fc
push 0xfffffffffffffffc
push dword [0x43e5d4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp dword [0x43e5e4], edi
jne 0x403570
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push edi
push 0x403a0b
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ebx, 0xcb
mov dword [0x43e5e4], eax
push ebx
push dword [0x43e5d8]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
je 0x40356f
push edi
push ebx
push dword [0x43e5d8]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
pop ebx
pop edi
pop ebp
ret
Function at 0x403c11
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], 0x800
push 0x20
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], ebx
push ebx
push eax
call fcn.00413120
add esp, 0xc
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [ebp + 8]
mov esi, eax
push 2
pop edx
lea eax, [ebp - 4]
mov dword [ebp - 0x18], ecx
mov ecx, dword [str.Microsoft_Windows_Network]
xor edi, edi
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], edx
push eax
push ebx
inc edi
mov dword [ebp - 0x28], ebx
push edi
push edx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], ecx
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x403cbd
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push edi
push 2
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x403cb5
jmp 0x403c9d
push dword [esi + 0x14]
call fcn.00402b83
pop ecx
mov dword [ebp - 8], 0x800
lea eax, [ebp - 8]
mov dword [ebp - 0xc], edi
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
je 0x403c8d
push dword [ebp - 4]
call sub.MPR.dll_WNetCloseEnum
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403d7c
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 8], 0x800
push 0x20
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], edi
push edi
push eax
call fcn.00413120
add esp, 0xc
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [str.Microsoft_Windows_Network]
mov esi, eax
push 2
pop edx
lea eax, [ebp - 4]
mov dword [ebp - 0x2c], edx
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], edi
push eax
xor ebx, ebx
mov dword [ebp - 0x20], edx
push edi
inc ebx
mov dword [ebp - 0x18], edi
push ebx
push edx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], ecx
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x403eae
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ebx
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
jne 0x403ea0
push dword [ebp - 4]
call sub.MPR.dll_WNetCloseEnum
mov dword [ebp - 4], edi
lea eax, [ebp - 0x22c]
push dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
push ebx
push 2
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x403ea0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x800
push eax
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push dword [ebp - 4]
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
jne 0x403ea0
mov edi, dword [ebp + 8]
test edi, edi
je 0x403e78
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push edi
push dword [esi + 0x14]
call fcn.00418284
add esp, 0xc
test eax, eax
jne 0x403e81
push dword [esi + 0x14]
call fcn.00402b83
pop ecx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x800
push eax
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push dword [ebp - 4]
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
je 0x403e5c
cmp dword [ebp - 4], 0
je 0x403eae
push dword [ebp - 4]
call sub.MPR.dll_WNetCloseEnum
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403eba
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
lea eax, [ebp - 0x458]
push esi
push dword [ebp + 8]
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x403f81
test byte [ebp - 0x250], 0x10
je 0x403f68
push 0x42d558
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x403f68
push 0x42d55c
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x403f68
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x458]
push str._s_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x458]
push eax
call fcn.00403eba
add esp, 0x14
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x403efb
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
leave
ret
Function at 0x404f77
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1394
call fcn.004122f0
push ebx
push esi
push edi
push 2
push 0xffffffffffffffff
xor eax, eax
lea ebx, [ebp - 0x394]
push 0xfffff000
push dword [0x43e660]
mov dword [0x43e650], eax
mov word [ebp - 0x393], ax
mov byte [ebp - 0x391], al
call fcn.004180aa
add esp, 0x10
cmp eax, 0xffffffff
je 0x405102
push dword [0x43e660]
call fcn.00418f79
pop ecx
mov esi, eax
mov ecx, 0x1000
add esi, ecx
mov edi, edx
adc edi, 0
xor eax, eax
test edi, edi
jl 0x4050cf
jg 0x404fef
cmp esi, ecx
jb 0x4050cf
cmp dword [0x43cec8], eax
jne 0x4050f0
mov al, byte [ebx + 1]
add esi, 0xfffff000
push dword [0x43e660]
mov byte [ebp - 0x394], al
adc edi, 0xffffffff
mov al, byte [ebx + 2]
mov byte [ebp - 0x393], al
mov al, byte [ebx + 3]
push ecx
mov byte [ebp - 0x392], al
lea eax, [ebp - 0x1394]
push 1
push eax
call fcn.00417bad
push 1
push 0xffffffffffffffff
push 0xffffe000
push dword [0x43e660]
call fcn.004180aa
mov ah, byte [ebp - 0x393]
lea ebx, [ebp - 0x395]
add esp, 0x20
lea edx, [ebp - 0x393]
mov al, byte [edx - 1]
movzx ecx, byte [edx + 1]
shl ecx, 8
mov byte [ebp - 1], al
movzx eax, ah
or ecx, eax
movzx eax, byte [ebp - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
je 0x4050a1
mov ah, byte [ebp - 1]
lea ecx, [ebp - 0x1392]
dec ebx
dec edx
cmp edx, ecx
jae 0x40505d
mov ecx, 0x1000
jmp 0x404fdb
lea ecx, [ebp - 0x1394]
mov eax, ebx
sub eax, ecx
cdq
add esi, eax
mov ecx, esi
adc edi, edx
add ecx, 4
push 0
mov eax, edi
adc eax, 0
push eax
push ecx
push dword [0x43e660]
call fcn.004180aa
xor eax, eax
add esp, 0x10
inc eax
test eax, eax
jne 0x4050f7
test edi, edi
jl 0x4050dd
jg 0x405107
test esi, esi
jne 0x405107
xor eax, eax
push eax
push eax
push eax
push dword [0x43e660]
call fcn.004180aa
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cmp eax, 1
je 0x4051b2
jmp 0x4050dd
mov esi, 0x1000
push 0
push 0
push 0
push dword [0x43e660]
call fcn.004180aa
push dword [0x43e660]
lea eax, [ebp - 0x1394]
push esi
push 1
push eax
call fcn.00417bad
mov ecx, eax
add esp, 0x20
mov al, byte [ebx + 1]
mov byte [ebp + ecx - 0x1394], al
lea edx, [ebp + ecx - 0x1395]
mov al, byte [ebx + 2]
mov byte [ebp + ecx - 0x1393], al
mov al, byte [ebx + 3]
mov byte [ebp + ecx - 0x1392], al
jmp 0x405180
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
je 0x40518f
dec edx
lea eax, [ebp - 0x1394]
cmp edx, eax
jae 0x405159
jmp 0x4050dd
lea eax, [ebp - 0x1394]
sub edx, eax
mov eax, edx
cdq
add eax, 4
push 0
adc edx, 0
push edx
push eax
push dword [0x43e660]
call fcn.004180aa
add esp, 0x10
xor eax, eax
inc eax
jmp 0x4050f2
Function at 0x4051ba
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
call fcn.00404f77
test eax, eax
je 0x405260
push 0x200
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.00413120
push dword [0x43e660]
lea eax, [ebp - 0x220]
push 0x12
push 1
push eax
call fcn.00417bad
add esp, 0x1c
cmp eax, 0x12
jne 0x405269
lea eax, [ebp - 0x220]
mov dword [0x43cef0], eax
call fcn.00401dd5
mov dword [ebp - 4], eax
call fcn.00401dd5
mov ebx, eax
call fcn.00401dd5
call fcn.00401dd5
call fcn.00401e12
mov edi, eax
call fcn.00401e12
mov esi, eax
call fcn.00401dd5
mov edx, dword [ebp + 0xc]
mov ecx, eax
test edx, edx
jl 0x40526f
jg 0x405256
cmp dword [ebp + 8], edi
jb 0x40526f
test edx, edx
jl 0x40526f
jg 0x405256
cmp dword [ebp + 8], esi
jb 0x40526f
cmp dword [ebp - 4], 0
jne 0x405260
test ebx, ebx
je 0x40526f
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
jne 0x4053b2
push 1
push 0xffffffffffffffd6
pop eax
sub eax, ecx
cdq
push edx
push eax
push dword [0x43e660]
call fcn.004180aa
push dword [0x43e660]
lea eax, [ebp - 0x220]
push 0x14
push 1
push eax
call fcn.00417bad
add esp, 0x20
cmp byte [ebp - 0x220], 0x50
jne 0x40538e
cmp byte [ebp - 0x21f], 0x4b
jne 0x40538e
cmp byte [ebp - 0x21e], 6
jne 0x40538e
cmp byte [ebp - 0x21d], 7
jne 0x40538e
lea eax, [ebp - 0x218]
mov dword [0x43cef0], eax
call fcn.00401e48
push 0
push edx
push eax
push dword [0x43e660]
mov dword [0x43e648], eax
mov dword [0x43e64c], edx
call fcn.004180aa
push dword [0x43e660]
lea eax, [ebp - 0x220]
push 4
push 1
push eax
call fcn.00417bad
add esp, 0x20
cmp byte [ebp - 0x220], 0x50
jne 0x4053bf
cmp byte [ebp - 0x21f], 0x4b
jne 0x4053bf
cmp byte [ebp - 0x21e], 6
jne 0x4053bf
cmp byte [ebp - 0x21d], 6
jne 0x4053bf
push dword [0x43e660]
lea eax, [ebp - 0x220]
push 0x34
push 1
push eax
call fcn.00417bad
add esp, 0x10
cmp eax, 0x34
jne 0x405382
lea eax, [ebp - 0x1f4]
mov dword [0x43cef0], eax
call fcn.00401e48
mov dword [0x43e648], eax
mov dword [0x43e64c], edx
mov dword [0x43e650], 1
jmp 0x4053bf
push 0
push 0
push 0
push dword [0x43e660]
xorps xmm0, xmm0
movlpd qword [0x43e648], xmm0
call fcn.004180aa
add esp, 0x10
jmp 0x405260
and dword [0x43e64c], 0
mov dword [0x43e648], esi
push 0
push 0
push 0
push dword [0x43e660]
call fcn.004180aa
mov eax, dword [0x43e648]
add esp, 0x10
mov edx, dword [0x43e64c]
jmp 0x405264
Function at 0x4061f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
xor esi, esi
push 8
mov edi, esi
pop ebx
mov edx, edi
mov ecx, edi
shr edx, 1
mov eax, edx
mov edi, edx
xor eax, 0xedb88320
and cl, 1
cmovne edi, eax
sub ebx, 1
jne 0x4061fd
mov dword [esi*4 + 0x43e670], edi
inc esi
cmp esi, 0x100
jne 0x4061f8
pop edi
pop esi
pop ebx
ret

Function at 0x40622b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
not ecx
test edx, edx
je 0x406257
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43e670]
inc esi
sub edx, 1
jne 0x40623e
pop esi
not ecx
mov eax, ecx
pop ebp
ret

Function at 0x40627b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
push ebx
push esi
push edi
push dword [0x43e660]
call fcn.00418f79
mov ebx, dword [ebp + 0xc]
mov edi, 0x400
push edi
mov esi, eax
mov dword [ebp - 4], edx
push 0
push ebx
mov dword [ebp - 8], esi
call fcn.00413120
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x48]
mov byte [eax], 0
mov eax, dword [ecx + 0x4c]
xor ecx, ecx
mov word [eax], cx
push dword [0x43e660]
push edi
push 1
push ebx
call fcn.00417bad
add esp, 0x20
jmp 0x4063d2
cmp eax, 0x14
jbe 0x4063da
add eax, 0xffffffec
mov dword [ebp - 0xc], eax
je 0x406393
mov ecx, dword [ebp - 4]
lea edi, [ebx + 2]
mov edx, dword [ebp - 0xc]
push 0xfffffffffffffffe
pop eax
sub eax, ebx
mov dword [ebp - 0x10], eax
cmp byte [edi - 2], 0x50
jne 0x406374
cmp byte [edi - 1], 0x4b
jne 0x406374
cmp byte [edi], 3
jne 0x406374
cmp byte [edi + 1], 4
jne 0x406374
push dword [0x43e660]
call fcn.00418f79
mov ecx, dword [ebp - 4]
add esi, 4
push 0
adc ecx, 0
mov dword [ebp - 0x18], eax
push ecx
push esi
push dword [0x43e660]
mov dword [ebp - 0x14], edx
call fcn.004180aa
lea eax, [ebp - 0x818]
push eax
push dword [ebp + 8]
call fcn.004072a7
add esp, 0x1c
test eax, eax
jne 0x4063e3
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [0x43e660]
call fcn.004180aa
mov eax, dword [ebp - 0x10]
add esp, 0x10
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
add esi, 1
mov dword [ebp - 8], esi
adc ecx, 0
inc edi
add eax, edi
mov dword [ebp - 4], ecx
cmp eax, edx
mov eax, dword [ebp - 0x10]
jb 0x4062f9
mov edi, 0x400
push 1
push 0xffffffffffffffff
push 0xffffffffffffffec
push dword [0x43e660]
call fcn.004180aa
push dword [0x43e660]
call fcn.00418f79
push edi
push 0
push ebx
mov esi, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
call fcn.00413120
push dword [0x43e660]
push edi
push 1
push ebx
call fcn.00417bad
add esp, 0x30
test eax, eax
jne 0x4062d3
xor eax, eax
pop edi
pop esi
xor edx, edx
pop ebx
leave
ret
xor eax, eax
inc eax
jmp 0x4063dc