joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ae58
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x44aea4
cmp dword [ebp - 0x84], 2
jne 0x44aea4
cmp dword [ebp - 0x90], 5
jg 0x44aea2
cmp dword [ebp - 0x90], 5
jne 0x44aea4
cmp dword [ebp - 0x8c], 1
jl 0x44aea4
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44ef28
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov byte [0x49a76c], 0
cmp dword [0x4980dc], 2
jne 0x44ef5b
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x44ef5b
cmp dword [esp + 4], 5
setge byte [0x49a76c]
add esp, 0x94
ret

Function at 0x450460
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x49a830
mov eax, esi
mov edx, 8
test al, 1
je 0x45047c
shr eax, 1
xor eax, 0xedb88320
jmp 0x45047e
shr eax, 1
dec edx
jne 0x45046f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x450468
pop esi
ret

Function at 0x450494
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x49a82c], 0
jne 0x4504b7
call fcn.00450460
push 1
push 0x49a82c
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x4504e2
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x49a830]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4504bd
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x450e94
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret

Function at 0x451b70
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00403738
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jle 0x451c12
mov eax, ebx
call fcn.00402648
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x451c0b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x451bf5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x451c34
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x451bf5
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451c28
mov eax, dword [ebp - 0x10]
call fcn.00402660
ret
cmp dword [0x4980dc], 1
je 0x451c28
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00451994
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471ae4
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x471ba5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x471b8a
test bl, 0x10
je 0x471b8a
lea ecx, [ebp - 4]
mov edx, 0x471bbc
mov eax, esi
call fcn.0042c548
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x471bd0
mov eax, 0x471be0
call fcn.0042cd60
mov edx, 0x471bf8
mov eax, dword [ebp - 8]
call fcn.00406acc
test eax, eax
jne 0x471b8a
mov eax, dword [ebp - 4]
call fcn.00406f58
lea ecx, [ebp - 0xc]
mov edx, 0x471c28
mov eax, esi
call fcn.0042c548
mov eax, dword [ebp - 0xc]
call fcn.00406f58
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.00403738
mov edi, eax
push edi
call sub.kernel32.dll_SetFileAttributesA
push edi
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471bac
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403420
ret

Function at 0x4726b4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x472788
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
je 0x472772
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.00452c10
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x4727a0
call fcn.00457204
mov edx, ebx
mov eax, dword [0x49b2f8]
call fcn.0040b44c
mov ebx, eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebx]
call fcn.00403574
mov ecx, 0x14
cdq
idiv ecx
push eax
mov ecx, edi
mov edx, esi
mov al, byte [ebp - 1]
call fcn.0045c85c
test al, al
jne 0x472772
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
jne 0x472757
mov eax, 0x4727d4
call fcn.00456ff8
jmp 0x472772
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x472830
call fcn.00457204
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47278f
lea eax, [ebp - 0x18]
call fcn.00403400
ret
Function at 0x405d6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a0c], 0
push esi
jne 0x405da2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d7c
mov dword [ecx*4 + 0x422a08], eax
inc ecx
cmp ecx, 0x100
jl 0x405d77
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dd3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a08]
xor eax, esi
inc ecx
dec edx
jne 0x405db5
pop edi
not eax
pop esi
ret 0xc

Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x54d5b88
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x432024
nop
nop
nop
nop
mov eax, str.rSn
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x53d81872
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x100018b0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x100018ee
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x100018e6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x100018f0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x100018d6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100019c0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x100019f1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100019f1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x100019f1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100ab8f1
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x10121c20
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10121c17
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10121c35
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
add al, 1
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10121c93
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10121c7a
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10121c83
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10121c8d
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10121c6f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10121bf9
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10121ce0
dec eax
je 0x10121cd7
sub eax, 3
je 0x10121cce
mov dword [ebp - 4], 0x40
jmp 0x10121cfd
mov dword [ebp - 4], 4
jmp 0x10121ce3
mov dword [ebp - 4], 0x20
jmp 0x10121ce3
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10121d2f
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10121caf
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10121540
fistp qword [ebx + 0x75ff295b]
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x10121d3b
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100b10d5
Capabilities:
Terminate process

Disassembly:
jmp fcn.101b2130
jmp 0x10197ca0
cmp ecx, dword [0x10252dc0]
jne 0x10197caa
repz ret
jmp 0x100acc10
Function at 0x47ad70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4b000]
lea eax, [edi + 0x6ded4]
push dword [eax]
mov dword [eax], 0xcd0dc90d
push eax
push edi
jmp 0x47ad9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x47ada1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47ad90
mov eax, 1
add ebx, ebx
jne 0x47adb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47adc4
jne 0x47ade3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47ade3
dec eax
add ebx, ebx
jne 0x47add0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x47ada8
add ebx, ebx
jne 0x47addf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x47ae35
xor ecx, ecx
sub eax, 3
jb 0x47adfb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47ae6a
sar eax, 1
mov ebp, eax
jmp 0x47ae06
add ebx, ebx
jne 0x47ae06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47add4
inc ecx
add ebx, ebx
jne 0x47ae14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47add4
add ebx, ebx
jne 0x47ae21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47ae16
jne 0x47ae32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47ae16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47ae54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47ae46
jmp 0x47ad96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47ae54
add edi, ecx
jmp 0x47ad96
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x1910
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x47ae76
cmp byte [edi], 0x11
jne 0x47ae76
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x47ae7b
lea edi, [esi + 0x76000]
mov eax, dword [edi]
or eax, eax
je 0x47aef3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7b1dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7b248]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47aea8
mov ecx, edi
jns 0x47aed7
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7b250]
or eax, eax
je 0x47aeed
mov dword [ebx], eax
add ebx, 4
jmp 0x47aec5
call dword [esi + 0x7b24c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x47af24
cmp al, 0xef
ja 0x47af17
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x47aef9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x47af06
mov ebp, dword [esi + 0x7b254]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47af58
sub esp, 0xffffff80
jmp 0x427dad
Function at 0x401960
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x20], 0xffffffff
je 0x40196d
mov al, 1
pop esi
ret
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x401978
xor al, al
pop esi
ret
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x20], eax
cmp eax, 0xffffffff
jne 0x4019c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4019c2
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
je 0x4019d7
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
cmp dword [esi + 0x20], 0xffffffff
pop esi
setne al
ret

Function at 0x4019f0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4926cc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x20]
mov edi, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x401a30
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00452ca6
mov esp, ebp
pop ebp
ret 8
Function at 0x4022c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f68a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4926cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.004524f3
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x402366
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], str.bad_locale_name
call fcn.004546ad
push 0x48cdd0
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], vtable.std::runtime_error.0
call fcn.00458aab
push edi
push esi
call fcn.004523cf
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452ca6
mov esp, ebp
pop ebp
ret 4
Function at 0x403c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46f6e8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4926cc]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x4926cc]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x403d64
cmp byte [ebx + 0x45], 0
je 0x403d64
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x403c70
xor al, al
jmp 0x403d66
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
cmp ecx, 0x10
cmovae eax, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 8
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
jmp 0x403cb0
cmp dword [esp + 0x2c], 0x10
mov ecx, dword [ebx + 0x40]
lea eax, [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x2c]
lea edi, [esp + 0x1c]
cmovae edi, dword [esp + 0x1c]
lea esi, [esp + 0x1c]
cmovae esi, dword [esp + 0x1c]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x403cf1
dec eax
je 0x403cf5
sub eax, 2
je 0x403d4b
xor bl, bl
jmp 0x403d4d
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp ecx, 0x10
lea eax, [esp + 0x18]
cmovae eax, edx
sub esi, eax
je 0x403d2c
push dword [ebx + 0x50]
cmp ecx, 0x10
push esi
lea eax, [esp + 0x20]
cmovae eax, edx
push 1
push eax
call fcn.00454969
add esp, 0x10
cmp esi, eax
jne 0x403ced
cmp byte [ebx + 0x45], 0
je 0x403d4b
test esi, esi
jne 0x403cb0
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.004038d0
jmp 0x403cb0
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x403d60
push dword [esp + 0x18]
call fcn.00452ca1
add esp, 4
mov al, bl
jmp 0x403d66
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00452ca6
mov esp, ebp
pop ebp
ret

Function at 0x403ef0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403f09
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403f44
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x403f40
lea ebx, [ebx]
cmp esi, edx
jae 0x403f44
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x403f30
cmp esi, edx
jb 0x403f4b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406960
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x40696b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x406a35
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x47b090]
movzx eax, byte [edx + 1]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x47b090]
movzx eax, byte [edx + 2]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x47b090]
movzx eax, byte [edx + 3]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x47b090]
movzx eax, byte [edx + 4]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x47b090]
movzx eax, byte [edx + 5]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x47b090]
movzx eax, byte [edx + 6]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x47b090]
movzx eax, byte [edx + 7]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x47b090]
add edx, 8
sub esi, 8
dec edi
jne 0x406980
pop edi
test esi, esi
je 0x406a5a
lea esp, [esp]
movzx eax, byte [edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x47b090]
lea edx, [edx + 1]
dec esi
jne 0x406a40
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x407240
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4926cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
mov esi, ebx
imul esi, dword [ebp + 8]
cmp byte [edi], 0
mov eax, ecx
mov dword [ebp - 8], eax
je 0x407286
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x407281
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x4072ae
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x407297
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp - 8]
call fcn.004583d0
add esp, 0xc
add dword [edi + 0x18], esi
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor edx, edx
div ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00452ca6
mov esp, ebp
pop ebp
ret
Function at 0x4072d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4926cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp byte [esi], 0
push edi
mov dword [ebp - 0xc], ebx
mov edi, 1
je 0x407315
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 5]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x407310
mov byte [esi + 8], 1
mov edi, dword [ebp - 0xc]
jmp 0x407342
mov ebx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x407326
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x10]
add eax, ebx
push edi
push eax
lea eax, [ebp - 5]
push eax
call fcn.004583d0
lea eax, [ebx + edi]
mov ebx, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi + 0x18], eax
cmp edi, 1
jne 0x407360
movzx eax, byte [ebp - 5]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452ca6
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x40734d
cmp byte [esi + 8], 0
je 0x40734d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.00452ca6
mov esp, ebp
pop ebp
ret