joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4207a6
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x420615
mov dword [esp], 0x617aa4
call fcn.0041fd85
mov eax, dword [0x4d3400]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4207ed
mov eax, dword [ebp - 0x20]
jmp 0x420938
call fcn.0041f661
mov dword [ebp - 0x20], eax
mov eax, entry3
test eax, eax
je 0x420804
cmp dword [ebp - 0x20], 0
jne 0x42080e
mov eax, 0
jmp 0x420938
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0041f758
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x4208e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x4d3400]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x420935
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4209fc
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.004207a6
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.00420639
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x420a57
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
call eax
mov eax, dword [0x4d3400]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x420b81
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x420ae9
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x420aa6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0041f56f
mov dword [ebp - 0x10], 0
mov eax, dword [0x4d3400]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x420b81
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x420b19
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x420b81
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0041f56f
mov dword [ebp - 0x10], 0
mov eax, dword [0x4d3400]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax
Function at 0x4225a4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x4d3410
call fcn.0041ef06
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x4225d0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x422612
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str..._.._.._mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call fcn.0041c7e4
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x4d3410
call fcn.0041ef7e
mov eax, dword [ebp + 0xc]
leave
ret

Function at 0x485f50
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x485f90
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
je 0x485f61
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x4c83b0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov edx, 1
sub esp, 0x18
mov eax, dword [esp + 0x20]
test eax, eax
cmovne edx, eax
mov ebx, edx
mov dword [esp], ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test eax, eax
je 0x4c83d5
add esp, 0x18
pop ebx
ret
call fcn.004c2880
test eax, eax
je 0x4c9e54
call eax
jmp 0x4c83c4

Function at 0x4c8920
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call fcn.004c86c0
mov edx, dword [eax]
add dword [eax + 4], 1
test edx, edx
je 0x4c9e4c
mov ecx, dword [edx + 0x30]
mov ebx, dword [edx + 0x34]
mov esi, 1
add ecx, 0xbcd4d500
mov edi, ecx
adc ebx, 0xb8b1aabc
xor ecx, ecx
cmp esi, edi
sbb ecx, ebx
jae 0x4c8977
xor ecx, ecx
mov dword [eax], ecx
lea ebx, [edx + 0x30]
mov dword [esp], ebx
call fcn.00411460
mov dword [esp], ebx
call fcn.004c84a0
jmp 0x4c9e4c
neg dword [edx + 0x14]
jmp 0x4c895f
Function at 0x4c9e3c
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [fcn.004c9e2c]
mov dword [esp], eax
call fcn.00428220
call fcn.004c9e2c
nop
nop
nop
mov dword [esp], 4
call fcn.004c8440
mov dword [eax], fcn.004c04a0
mov dword [esp + 8], fcn.004c04a0
mov dword [esp + 4], 0x5cedb4
mov dword [esp], eax
call fcn.004c8980
nop
nop
nop
sub edx, 1
mov dword [esp], eax
jne 0x4c9f05
call fcn.004c84a0
mov ecx, eax
mov eax, dword [eax]
call dword [eax + 8]
mov dword [esp], 2
mov ebx, eax
call esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xb
mov dword [esp + 4], 1
mov dword [esp], str.__what__:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], 2
call esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call fcn.004c85a0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov dword [esp], edi
call fcn.0041cc38
call fcn.004c8920
call fcn.004c84a0
call fcn.004c85a0
jmp 0x4c9ef3
Function at 0x4cb520
Capabilities:
Query environment variable

Disassembly:
push edi
sub esp, 0x18
mov eax, dword [esp + 0x20]
lea edi, [eax + 0x60]
mov dword [esp], edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test eax, eax
je 0x4c8482
mov edx, eax
lea edi, [edx + 4]
mov ecx, edx
xor eax, eax
mov dword [edx], 0
and edi, 0xfffffffc
mov dword [edx + 0x5c], 0
sub ecx, edi
add ecx, 0x60
shr ecx, 2
rep stosd dword es:[edi], eax
add esp, 0x18
lea eax, [edx + 0x60]
pop edi
ret
mov eax, edi
call fcn.00428540
mov edx, eax
test eax, eax
je 0x4cb50c
jmp 0x4c8459
call fcn.004c9e2c
nop
nop
nop
call fcn.004c9e2c
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x30
mov dword [esp + 4], 0
mov dword [esp], 0x4d3780
call fcn.0041ec2c
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x4d3784], 0
mov dword [0x4d3788], 0
mov dword [0x4d378c], 0
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], str.obj_size
mov ebx, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 9
mov dword [esp + 0x28], str.obj_count
mov dword [esp + 0x2c], 0x40
test eax, eax
jne 0x4cb5b6
jmp 0x4cb676
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
mov ebx, eax
test eax, eax
je 0x4cb630
xor eax, eax
cmp byte [ebx], 0x3a
sete al
add ebx, eax
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, 0x62696c67
xor edx, 0x2e787863
or eax, edx
jne 0x4cb5a0
mov eax, dword [ebx + 7]
mov edx, dword [ebx + 0xb]
xor eax, 0x5f68652e
xor edx, 0x6c6f6f70
or eax, edx
jne 0x4cb5a0
cmp byte [ebx + 0xf], 0x2e
jne 0x4cb5a0
add ebx, 0x10
lea esi, [esp + 0x18]
mov edi, dword [esi]
test edi, edi
je 0x4cb613
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x4cb61d
cmp byte [ebx + edi], 0x3d
je 0x4cb6a4
add esi, 0xc
lea eax, [esp + 0x30]
cmp eax, esi
jne 0x4cb5f6
jmp 0x4cb5a0
mov eax, dword [esp + 0x2c]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x20]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x4d378c], ebx
test ebx, ebx
jne 0x4cb685
mov dword [esp], 0x4c9300
call fcn.00401494
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov dword [0x4d378c], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov dword [0x4d3788], eax
test eax, eax
je 0x4cb6e2
xor edx, edx
mov dword [0x4d3784], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x4cb663
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
lea eax, [ebx + edi + 1]
mov dword [esp], eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
mov ebx, dword [esp + 0x14]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x4cb6d2
test dl, dl
jne 0x4cb5a0
test eax, eax
js 0x4cb5a0
mov dword [esi + 8], eax
jmp 0x4cb5a0
xor ecx, ecx
mov dword [0x4d378c], ecx
jmp 0x4cb663
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x4fcc5faf
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x2b711ba7
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0xb412b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0xb450a0
push edi
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
dec dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.00b411ad
test eax, eax
jne 0xb41323
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0xb41340
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0xb41323
cmp dword [ebp - 0x10], 4
jne 0xb41323
cmp dword [ebp - 8], 1
jne 0xb41323
cmp dword [esi + 0xc], ebx
je 0xb4136e
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0xb4133b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
leave
ret 4
lea eax, [ebp + 8]
push eax
mov eax, dword [esi + 4]
mov dword [ebp + 8], ebx
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
je 0xb41323
mov eax, dword [esi + 4]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 4]
mov dword [eax + 8], ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
jmp 0xb41323
Function at 0xb425d1
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
cmp eax, edi
jne 0xb42d32
mov eax, dword [esi + 0x30]
cmp eax, edi
jne 0xb4303e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp eax, edi
je 0xb42616
push dword [eax + 0x64]
call dword [sym.imp.RPCRT4.dll_RpcMgmtSetServerStackSize]
cmp dword [esi + 0x34], edi
jne 0xb432d7
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
test byte [esi + 0x38], bl
jne 0xb432c4
push ebx
lea ecx, [esi + 0x20]
push ecx
push dword [esi + 0x1c]
push dword [esi + 0x18]
push dword [esi + 0x14]
push eax
call fcn.00b42d61
test eax, eax
jne 0xb425ec
jmp 0xb432bd
shl eax, 0xa
push eax
jmp 0xb42610
xor eax, eax
jmp 0xb4262b
push 4
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0xb425ec
jmp 0xb432bd
push ebx
push edi
push ebx
call dword [sym.imp.ntdll.dll_RtlSetProcessIsCritical]
add esp, 0xc
jmp 0xb4261f
Function at 0x401126
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret

Function at 0x40112c
Capabilities:
Identify system language via api
Terminate process

Disassembly:
push eax
mov dword [esp], 0x78a13529
mov eax, 0x78a13529
cmp eax, 0xaeaab18d
je 0x4011b3
cmp eax, 0x78a13529
je 0x401156
cmp eax, 0xb8b656b8
jne 0x401139
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movsx ecx, ax
cmp ecx, 0x43e
jle 0x401181
cmp ecx, 0x818
jg 0x40119b
add eax, 0xfffffbc1
cmp ax, 4
ja 0x4011b3
mov ecx, 0x13
jmp 0x401194
add eax, 0xfffffbe7
cmp ax, 0x13
ja 0x4011b3
movzx eax, ax
mov ecx, 0xc8401
bt ecx, eax
jae 0x4011b3
jmp 0x40114e
movzx eax, ax
cmp eax, 0x819
je 0x40114e
cmp eax, 0x843
je 0x40114e
cmp eax, 0x82c
je 0x40114e
pop eax
ret

Function at 0x4011f9
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push 0x4662f9
push ecx
call fcn.0044dc85
add esp, 8
xor esi, esi
test eax, eax
je 0x401286
mov edi, eax
push 2
push 0
push eax
call fcn.0044c0bd
add esp, 0xc
push edi
call fcn.0044c40c
add esp, 4
test eax, eax
js 0x40127d
mov ebp, eax
push edi
call fcn.0044fa4c
add esp, 4
lea eax, [ebp + 1]
push eax
call dword [0x472054]
add esp, 4
test eax, eax
je 0x40127d
mov ebx, eax
push edi
push ebp
push 1
push eax
call fcn.0044f139
add esp, 0x10
test eax, eax
je 0x40126b
mov ebp, eax
push edi
call fcn.0044ea93
add esp, 4
test eax, eax
je 0x40128d
push edi
call fcn.0044e90e
add esp, 4
push ebx
call dword [0x472050]
jmp 0x401283
push edi
call fcn.0044e90e
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.0044e90e
add esp, 4
mov byte [ebx + ebp], 0
mov esi, ebx
jmp 0x401286

Function at 0x402751
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
test edx, edx
je 0x402779
mov edi, 0x1505
xor esi, esi
movzx ebx, byte [ecx + esi]
test ebx, ebx
je 0x402780
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp edx, esi
jne 0x40275f
jmp 0x402782
mov eax, 0x1505
jmp 0x402782
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x40c398
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov ebp, dword [esp + 0x6c]
mov edx, dword [esp + 0x68]
mov edi, esp
mov ecx, 5
mov esi, 0x466670
rep movsd dword es:[edi], dword [esi]
cmp ebp, 0x40
jb 0x40c418
shr ebp, 6
xor ebx, ebx
mov esi, edx
xor edi, edi
movzx eax, byte [esi + edi]
mov dword [esp + edi + 0x14], eax
movzx ecx, byte [esi + edi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + edi + 0x14], ecx
movzx eax, byte [esi + edi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + edi + 0x14], eax
movzx ecx, byte [esi + edi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + edi + 0x14], ecx
add edi, 4
cmp edi, 0x40
jne 0x40c3c3
mov ecx, esp
lea edx, [esp + 0x14]
call fcn.0040c4b2
inc ebx
lea edx, [esi + edi]
cmp ebx, ebp
jne 0x40c3bf
add esi, edi
mov edx, esi
mov ebp, dword [esp + 0x6c]
xor ebx, ebx
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov esi, ebp
and esi, 0x3f
je 0x40c44c
xor eax, eax
movzx edi, byte [edx + eax]
mov ecx, ebx
and cl, 0x18
shl edi, cl
mov ecx, eax
and ecx, 0xfffffffc
xor dword [esp + ecx + 0x14], edi
inc eax
add ebx, 8
cmp esi, eax
jne 0x40c430
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
xor eax, eax
inc eax
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x14], eax
cmp esi, 0x38
jb 0x40c484
mov ecx, esp
lea edi, [esp + 0x14]
mov edx, edi
call fcn.0040c4b2
xor eax, eax
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x70]
lea edx, [esp + 0x14]
mov dword [edx + 0x38], ebx
shr ebp, 0x1d
mov dword [edx + 0x3c], ebp
mov ecx, esp
call fcn.0040c4b2
xor eax, eax
mov ecx, dword [esp + eax*4]
mov dword [esi + eax*4], ecx
inc eax
cmp eax, 5
jne 0x40c49e
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x413624
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x413723
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x41371c
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebp, esi
sub ebp, eax
xor edx, edx
cmp ebp, 8
mov dword [esp], esi
jb 0x4136cd
xor esi, esi
mov eax, esi
movzx edx, byte [ebx + esi]
add edx, edi
add ecx, edx
movzx esi, byte [ebx + esi + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebx + eax + 7]
add edi, edx
add ecx, edi
lea esi, [eax + 8]
add eax, 0xf
cmp eax, ebp
jb 0x41366d
mov edx, ebp
and edx, 0x1ff8
add ebx, esi
mov esi, dword [esp]
mov eax, ebp
sub eax, edx
jbe 0x4136e7
xor edx, edx
movzx esi, byte [ebx + edx]
add edi, esi
add ecx, edi
inc edx
cmp eax, edx
jne 0x4136d5
add ebx, eax
mov esi, dword [esp]
mov eax, edi
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov eax, ecx
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, ebp
mov ebp, 0x15b0
jne 0x413661
shl ecx, 0x10
or ecx, edi
jmp 0x413726
xor ecx, ecx
inc ecx
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x413730
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
not ebx
cmp ecx, 4
jb 0x4137a5
mov eax, 0xff
mov esi, ebx
shr esi, 8
movzx edi, byte [edx]
and ebx, eax
xor ebx, edi
xor esi, dword [ebx*4 + 0x4668a0]
mov edi, esi
shr edi, 8
movzx ebx, byte [edx + 1]
and esi, eax
xor esi, ebx
xor edi, dword [esi*4 + 0x4668a0]
mov esi, edi
shr esi, 8
movzx ebx, byte [edx + 2]
and edi, eax
xor edi, ebx
xor esi, dword [edi*4 + 0x4668a0]
mov ebx, esi
shr ebx, 8
movzx edi, byte [edx + 3]
and esi, eax
xor esi, edi
xor ebx, dword [esi*4 + 0x4668a0]
add edx, 4
add ecx, 0xfffffffc
cmp ecx, 3
ja 0x41374b
test ecx, ecx
je 0x4137c9
xor esi, esi
mov eax, ebx
shr eax, 8
movzx edi, byte [edx + esi]
movzx ebx, bl
xor ebx, edi
xor eax, dword [ebx*4 + 0x4668a0]
inc esi
mov ebx, eax
cmp ecx, esi
jne 0x4137ad
jmp 0x4137cb
mov eax, ebx
not eax
pop esi
pop edi
pop ebx
ret

Function at 0x4138e5
Capabilities:
Compute adler32 checksum

Disassembly:
mov ecx, dword [esp + 4]
mov edx, ecx
cmp ecx, 0xa
jl 0x4138f5
mov edx, 0xa
test ecx, ecx
jns 0x4138fe
mov edx, 6
xor eax, eax
cmp ecx, 4
setl al
shl eax, 0xe
or eax, dword [edx*4 + 0x466cf0]
cmp dword [esp + 8], 0
jle 0x41391c
or eax, 0x1000
test ecx, ecx
je 0x413937
mov ecx, dword [esp + 0xc]
dec ecx
cmp ecx, 3
ja case.default.0x41392a
jmp dword [ecx*4 + 0x468214]
or eax, 0x20000
ret
or eax, 0x80000
ret
and eax, 0xfffff000
ret
or eax, 0x10000
ret
or eax, 0x40000
ret
Function at 0x41c1dc
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push esi
call fcn.0044c43c
add esp, 4
test edi, edi
js 0x41c210
mov ecx, dword [esp + 0x10]
xor eax, ecx
xor edx, edi
or edx, eax
je 0x41c214
push 0
push edi
push ecx
push esi
call fcn.0044c0f7
add esp, 0x10
test eax, eax
je 0x41c214
xor eax, eax
jmp 0x41c227
push esi
push dword [esp + 0x20]
push 1
push dword [esp + 0x24]
call fcn.0044f139
add esp, 0x10
pop esi
pop edi
ret