joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ba2f
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x44a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor ebx, ebx
mov dword [ebp - 0x214], ecx
lea eax, [ebp - 0x20c]
mov esi, edx
push ebx
push eax
call fcn.004307e0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41bb03
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41bac0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41bad2
mov eax, dword [ebp - 0x210]
xor ecx, ecx
add ecx, ebx
mov dword [esi], ecx
adc eax, 0
mov dword [esi + 4], eax
push dword [esi]
and dword [ebp - 0x218], 0
call fcn.0042f4a9
pop ecx
mov ecx, dword [ebp - 0x214]
push 0
mov dword [ecx], eax
lea ecx, [ebp - 0x218]
push ecx
push dword [esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042f335
leave
ret
Function at 0x4348a6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4348e5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4348e5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4348e5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4348e5
cmp dword [ecx + 0x74], 0xe
jbe 0x4348e5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4366b0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44139c
push 0x441394
push str.FlsAlloc
push 0x1f
call fcn.0043658c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4366e4
push dword [ebp + 8]
mov ecx, esi
call dword [0x43f25c]
call esi
jmp 0x4366ea
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x43672e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4413ac
push 0x4413a4
push str.FlsGetValue
push 0x21
call fcn.0043658c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x436765
push dword [ebp + 8]
mov ecx, esi
call dword [0x43f25c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x43676d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4413b4
push 0x4413ac
push str.FlsSetValue
push 0x22
call fcn.0043658c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4367a7
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x43f25c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x437d42
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x437ddf
push ebx
push esi
call fcn.00437d0b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004362b9
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x437d8c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x437dde
push edi
push eax
call fcn.004363c8
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x437dac
call fcn.0043638e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x437ddd
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004362b9
add esp, 0x20
test eax, eax
jne 0x437dcb
push edi
call fcn.0043638e
jmp 0x437dd3
push ebx
call fcn.0043638e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x407a30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x516147
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x568cb8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi], vtable.NKZ::CKZArchive.0
mov dword [esi + 4], vtable.NKZ::CKZArchive.1.0
mov dword [esi + 0xc], ebx
mov dword [esp + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
lea ecx, [esi + 0x58]
call fcn.004012b0
xor eax, eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov word [esi + 0x52], ax
mov byte [esi + 0x41], bl
mov byte [esi + 0x42], bl
mov dword [esi + 0x44], ebx
mov byte [esi + 0x48], bl
mov dword [esi + 0x49], eax
mov dword [esi + 0x4d], eax
xor ecx, ecx
xor edx, edx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov word [esi + 0x80], cx
mov word [esi + 0x54], dx
mov byte [esi + 0x40], bl
lea eax, [esi + 0x88]
push eax
mov byte [esp + 0x18], 4
call fcn.00434170
mov dword [esi + 0xa0], vtable.NKZ::CBuffer_unsigned_char_.0
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc4], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x40a920
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x16c
mov eax, dword [0x568cb8]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push ebp
mov ebp, dword [esp + 0x178]
push edi
cmp esi, 0xffffffff
je 0x40aaee
test ebp, ebp
je 0x40aaee
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
push esi
call edi
test eax, eax
jne 0x40a981
call fcn.0040ab10
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.004b8307
add esp, 0x16c
ret
push 0x40
lea eax, [esp + 0x134]
push 0
push eax
call fcn.004b83b0
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0xc
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x40
lea edx, [esp + 0x13c]
push edx
push esi
mov dword [esp + 0x20], 0
call ebx
test eax, eax
je 0x40a964
cmp dword [esp + 0xc], 0x40
je 0x40a9df
mov eax, 0x80004005
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.004b8307
add esp, 0x16c
ret
mov eax, dword [esp + 0x16c]
push 0
cdq
push 0
push edx
push eax
push esi
call edi
test eax, eax
je 0x40a964
push 0xf8
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004b83b0
add esp, 0xc
push 0
lea ecx, [esp + 0x10]
push ecx
push 0xf8
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
test eax, eax
je 0x40a964
cmp dword [esp + 0xc], 0xf8
jne 0x40a9c2
movzx eax, word [esp + 0x16]
dec eax
lea eax, [eax + eax*4]
push 1
add eax, eax
xor ecx, ecx
push ecx
add eax, eax
push ecx
add eax, eax
push eax
push esi
call edi
test eax, eax
je 0x40a964
xor eax, eax
push eax
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
lea eax, [esp + 0x10]
push eax
push 0x28
lea ecx, [esp + 0x114]
push ecx
push esi
call ebx
test eax, eax
je 0x40a964
cmp dword [esp + 0xc], 0x28
jne 0x40a9c2
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
add eax, edx
mov dword [ebp], eax
xor eax, eax
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.004b8307
add esp, 0x16c
ret
mov ecx, dword [esp + 0x174]
pop edi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x80070057
call fcn.004b8307
add esp, 0x16c
ret
Function at 0x40ab30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp edi, ebx
je 0x40ac38
cmp eax, ebx
je 0x40ac38
cmp word [eax], bx
je 0x40ac38
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x40ab62
mov dword [ecx], ebx
push ebx
push ebx
push 3
push ebx
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40ab88
call fcn.0040ab10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [esp + 0x18]
push eax
push 4
push edi
push esi
mov dword [edi], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40abb9
call fcn.0040ab10
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi], 0x4d
jne 0x40ac28
cmp byte [edi + 1], 0x5a
jne 0x40ac28
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], ebx
call fcn.0040a920
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40abeb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x10]
xor eax, eax
push eax
push eax
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x40aba2
mov eax, dword [ebp + 8]
mov dword [edi], 0
test eax, eax
je 0x40ac0f
mov dword [eax], ebx
push 0
lea edx, [esp + 0x18]
push edx
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40aba2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b0d0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x40b0df
mov dword [esi], 0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [eax + 8]
push edx
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40b113
call fcn.0040ab10
pop esi
ret 0x10
test esi, esi
je 0x40b11d
mov edx, dword [esp + 0x14]
mov dword [esi], edx
xor eax, eax
pop esi
ret 0x10

Function at 0x40b190
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x40b1a8
mov eax, 0x80070057
pop esi
add esp, 8
ret 8
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 8]
lea eax, [esp + 4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x40b1cb
call fcn.0040ab10
pop esi
add esp, 8
ret 8
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esi], eax
mov dword [esi + 4], ecx
xor eax, eax
pop esi
add esp, 8
ret 8
Function at 0x40b9b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x515b90
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x568cb8]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x568cb8]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x80]
mov eax, dword [esp + 0x84]
xor ebx, ebx
mov dword [esp + 0x14], eax
cmp dword [ebp + 0x14], ebx
je 0x40bbd8
cmp dword [ebp + 0x30], ebx
je 0x40bbd8
lea ecx, [esp + 0x50]
call fcn.004012b0
mov dword [esp + 0x78], ebx
mov eax, dword [ebp + 0x30]
lea esi, [eax - 1]
cmp esi, ebx
jl 0x40bb69
lea edi, [ebp + 0x1c]
cmp dword [edi + 0x14], esi
ja 0x40ba30
call fcn.004809be
mov ecx, edi
call fcn.00401e70
movzx eax, word [eax + esi*2]
lea ecx, [esp + 0x50]
push ecx
cmp ax, 0x39
jne 0x40bae1
lea edx, [esp + 0x38]
push 0x30
push edx
call fcn.0040ddb0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x84], 3
call fcn.00402110
lea ecx, [esp + 0x34]
mov byte [esp + 0x78], bl
call fcn.00401320
cmp esi, ebx
jne 0x40bad3
push 0x53b358
lea ecx, [esp + 0x1c]
call fcn.004012e0
lea ecx, [esp + 0x50]
push ecx
push eax
lea edx, [esp + 0x3c]
push edx
mov byte [esp + 0x84], 4
call fcn.0040dcf0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x84], 5
call fcn.00402110
lea ecx, [esp + 0x34]
call fcn.00401320
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], bl
call fcn.00401320
sub esi, 1
jns 0x40ba26
jmp 0x40bb69
inc eax
push eax
lea edx, [esp + 0x20]
push edx
call fcn.0040ddb0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x84], 1
call fcn.00402110
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], bl
call fcn.00401320
sub esi, 1
js 0x40bb69
cmp dword [edi + 0x14], esi
ja 0x40bb21
call fcn.004809be
mov ecx, edi
call fcn.00401e70
movzx edx, word [eax + esi*2]
lea eax, [eax + esi*2]
lea ecx, [esp + 0x50]
push ecx
push edx
lea eax, [esp + 0x20]
push eax
call fcn.0040ddb0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x84], 2
call fcn.00402110
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], bl
call fcn.00401320
sub esi, 1
jns 0x40bb17
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x58]
lea esi, [ebp + 0x1c]
push ecx
mov ecx, esi
call fcn.00402110
push esi
lea edx, [esp + 0x38]
push ebp
push edx
call fcn.0040dcf0
add ebp, 0x38
push ebp
push eax
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x90], 6
call fcn.0040dcf0
add esp, 0x18
mov ecx, dword [esp + 0x14]
push 0xffffffffffffffff
push ebx
push eax
mov byte [esp + 0x84], 7
call fcn.00402110
lea ecx, [esp + 0x18]
call fcn.00401320
lea ecx, [esp + 0x34]
call fcn.00401320
lea ecx, [esp + 0x50]
call fcn.00401320
mov eax, 1
jmp 0x40bbda
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004b8307
add esp, 0x68
ret 8
Function at 0x4109a0
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x88
mov eax, dword [0x568cb8]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x8c]
push ebx
xor ebx, ebx
push ebp
xor ecx, ecx
mov dword [esp + 0x14], eax
xor eax, eax
push esi
push edi
mov dword [esp + 0x20], 0x6a09e667
mov dword [esp + 0x24], 0xbb67ae85
mov dword [esp + 0x28], 0x3c6ef372
mov dword [esp + 0x2c], 0xa54ff53a
mov dword [esp + 0x30], 0x510e527f
mov dword [esp + 0x34], 0x9b05688c
mov dword [esp + 0x38], 0x1f83d9ab
mov dword [esp + 0x3c], 0x5be0cd19
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ebx
mov byte [esp + 0x8c], bl
mov dword [esp + 0x8d], eax
mov word [esp + 0x91], ax
mov byte [esp + 0x93], al
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
jmp 0x410a44
mov ecx, dword [esp + 0x40]
mov ebp, dword [esp + 0xa4]
mov edi, dword [esp + 0xa0]
mov esi, ecx
and esi, 0x3f
cmp ebp, ebx
jbe 0x410a8a
jmp 0x410a60
mov cl, byte [edi]
mov byte [esp + esi + 0x48], cl
inc esi
inc edi
add dword [esp + 0x40], 1
adc dword [esp + 0x44], ebx
dec ebp
cmp esi, 0x40
jne 0x410a82
lea edx, [esp + 0x20]
xor esi, esi
call fcn.00416430
cmp ebp, ebx
ja 0x410a60
mov ecx, dword [esp + 0x40]
and ecx, 0x3f
mov ebp, 8
lea edi, [esp + 0x8c]
mov esi, ecx
jmp 0x410aa0
mov dl, byte [edi]
mov byte [esp + esi + 0x48], dl
inc esi
inc edi
add dword [esp + 0x40], 1
adc dword [esp + 0x44], ebx
dec ebp
cmp esi, 0x40
jne 0x410ac2
lea edx, [esp + 0x20]
xor esi, esi
call fcn.00416430
cmp ebp, ebx
ja 0x410aa0
xor eax, eax
jmp 0x410ad0
add byte [esp + eax + 0x8c], 1
jne 0x410ae0
inc eax
cmp eax, 8
jl 0x410ad0
add dword [esp + 0x10], 1
adc dword [esp + 0x14], ebx
jne 0x410af9
cmp dword [esp + 0x10], 0x80000
jb 0x410a40
mov eax, dword [esp + 0x1c]
lea edi, [esp + 0x20]
call fcn.004164f0
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b8307
add esp, 0x88
ret 0xc
Function at 0x4168b0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
lea ebp, [ebx + 0x1c]
shr ebx, 2
mov eax, ebx
shr eax, 1
add eax, 3
push esi
mov dword [ecx], eax
add ecx, 0x10
xor esi, esi
mov dword [esp + 0xc], ebp
test ebx, ebx
jbe 0x4168e1
mov eax, dword [edx]
mov dword [ecx + esi*4], eax
inc esi
add edx, 4
cmp esi, ebx
jb 0x4168d4
cmp esi, ebp
jae 0x4169d2
mov edx, esi
sub edx, ebx
lea eax, [ecx + edx*4]
mov dword [esp + 0x14], eax
push edi
xor edx, edx
mov eax, esi
div ebx
mov edi, dword [ecx + esi*4 - 4]
test edx, edx
jne 0x41695e
movzx eax, byte [eax + 0x56a324]
mov edx, edi
and edx, 0xff
movzx edx, byte [edx + 0x56a418]
mov ebp, edi
shr ebp, 0x18
movzx ebp, byte [ebp + 0x56a418]
shl edx, 8
or edx, ebp
mov ebp, edi
shr ebp, 0x10
shr edi, 8
and ebp, 0xff
movzx ebp, byte [ebp + 0x56a418]
and edi, 0xff
movzx edi, byte [edi + 0x56a418]
shl edx, 8
or edx, ebp
mov ebp, dword [esp + 0x10]
shl edx, 8
xor edi, eax
or edi, edx
jmp 0x4169b6
cmp ebx, 6
jbe 0x4169b6
cmp edx, 4
jne 0x4169b6
mov edx, edi
shr edx, 0x10
and edx, 0xff
movzx eax, byte [edx + 0x56a418]
mov edx, edi
shr edx, 0x18
movzx edx, byte [edx + 0x56a418]
shl edx, 8
or eax, edx
mov edx, edi
shr edx, 8
and edx, 0xff
movzx edx, byte [edx + 0x56a418]
shl eax, 8
and edi, 0xff
or eax, edx
movzx edx, byte [edi + 0x56a418]
shl eax, 8
or eax, edx
mov edi, eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
xor edx, edi
mov dword [ecx + esi*4], edx
inc esi
add eax, 4
mov dword [esp + 0x18], eax
cmp esi, ebp
jb 0x4168f5
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x417cb0
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x417cb7
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.00417cc0
Function at 0x418650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5150b1
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push edi
mov eax, dword [0x568cb8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
xor ebx, ebx
mov dword [edi + 0x2c], ebx
mov dword [esp + 0x18], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov eax, dword [esp + 0x24]
mov byte [esp + 0x18], 2
mov dword [edi + 0xc], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], eax
mov dword [edi + 0x10], ebx
cmp dword [edi + 0x30], esi
je 0x4186c2
cmp esi, ebx
je 0x4186b0
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
mov eax, dword [edi + 0x30]
cmp eax, ebx
je 0x4186bf
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [edi + 0x30], esi
cmp dword [edi + 0x2c], ebp
je 0x4186e6
cmp ebp, ebx
je 0x4186d4
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
push ebp
call ecx
mov eax, dword [edi + 0x2c]
cmp eax, ebx
je 0x4186e3
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [edi + 0x2c], ebp
mov eax, dword [edi + 0x14]
sub eax, 1
mov ecx, dword [esp + 0x2c]
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x24], ecx
mov dword [edi + 0x28], ebx
mov byte [edi + 8], bl
je 0x418715
sub eax, 1
jne 0x41871a
mov ecx, edi
call fcn.004189e0
jmp 0x41871a
call fcn.004188e0
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x418740
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x514d61
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x568cb8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, 2
mov dword [esp + 0x14], eax
cmp dword [esi + 0x14], eax
jne 0x4187b9
cmp dword [esi + 0x10], 1
jne 0x4187b9
mov edi, dword [esi]
cmp byte [edi], 0
jne 0x4187b9
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 4]
push eax
push ecx
mov byte [edi + 0x18], 0
call fcn.004be993
mov dword [edi + 4], eax
mov dword [esi + 0xc], eax
call fcn.004c213d
mov edx, dword [esi + 0x18]
add eax, 0x20
push eax
mov eax, dword [esi + 0xc]
push edx
push 1
push eax
call fcn.004b965b
add esp, 0x18
cmp dword [esi + 0x14], 0
jne 0x4187e2
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x418825
mov edx, dword [esi + 0x34]
test edx, edx
je 0x418825
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x418825
mov edi, dword [eax]
push 0
push ecx
mov ecx, dword [edi + 0xc]
push edx
push eax
call ecx
jmp 0x418825
cmp dword [esi + 0x10], 0
jne 0x418804
cmp byte [esi + 8], 0
je 0x4187fa
mov edx, dword [esi + 0xc]
push edx
call fcn.004bd575
add esp, 4
mov eax, dword [esi + 4]
test eax, eax
je 0x418825
push eax
jmp 0x41881d
mov edi, dword [esi]
test edi, edi
je 0x418825
cmp byte [edi + 0x18], 0
je 0x41881c
mov eax, dword [edi + 4]
push eax
call fcn.004bd575
add esp, 4
push edi
call fcn.004b7ea4
add esp, 4
mov eax, dword [esi + 0x34]
test eax, eax
je 0x41883c
push eax
call fcn.004b7eaf
add esp, 4
mov dword [esi + 0x34], 0
mov byte [esp + 0x14], 0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x418850
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], 0xffffffff
mov esi, dword [esi + 0x2c]
test esi, esi
je 0x418867
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x4189e0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x514d1b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x568cb8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x10], ebx
jne 0x418b00
push 0x1c
call fcn.004bd0c6
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], ebx
cmp esi, ebx
je 0x418a53
mov eax, 0x10000
push eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov byte [esi], bl
mov byte [esi + 0x18], 1
mov dword [esi + 8], eax
call fcn.004bdff7
add esp, 4
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x418a55
mov byte [esi], 1
jmp 0x418a55
xor esi, esi
push 1
push 0x100000
mov dword [esp + 0x28], 0xffffffff
call fcn.004c202b
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x418ab1
call fcn.004c213d
push eax
push 0x100000
push 1
push ebp
call fcn.004be4fb
add esp, 0x10
cmp eax, ebx
jle 0x418ab1
lea esp, [esp]
mov ecx, ebp
call fcn.00418560
call fcn.004c213d
push eax
push 0x100000
push 1
push ebp
call fcn.004be4fb
add esp, 0x10
cmp eax, ebx
jg 0x418a90
cmp byte [esi], bl
je 0x418abd
mov dword [edi + 0xc], ebx
mov dword [edi + 0x18], ebx
jmp 0x418adc
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 4]
push eax
push ecx
mov byte [esi + 0x18], bl
call fcn.004be993
mov dword [esi + 4], eax
mov dword [edi + 0xc], eax
mov edx, dword [esi + 0x14]
add esp, 8
mov dword [edi + 0x18], edx
cmp byte [esi + 0x18], bl
je 0x418aed
mov eax, dword [esi + 4]
push eax
call fcn.004bd575
add esp, 4
push esi
call fcn.004b7ea4
push ebp
call fcn.004bd575
add esp, 8
mov byte [edi + 8], 1
call fcn.004188e0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4254c0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push eax
call fcn.00425630
mov ecx, eax
add ecx, 0x38
call fcn.00401000
mov eax, dword [esp + 8]
cmp dword [eax + 0x14], 0
je 0x4254ee
push eax
call fcn.00425630
mov ecx, eax
add ecx, 0x54
call fcn.00401000
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x14], 0
je 0x425508
push eax
call fcn.00425630
mov ecx, eax
add ecx, 0x1c
call fcn.00401000
mov eax, dword [0x5710d8]
push esi
lea ecx, [esp + 0xc]
push ecx
push 0
push eax
push 0x42b530
push 0
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
pop esi
ret