joyce8/EMBER2024-capa huggingface dataset:
Function at 0x780032d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x780293e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.xxxxxxx
push 0x78024ec4
push 0x60000
push 0xdec0a0
call dword [sym.imp.dsound.dll_unsigned_long_int___cdecl_FindPattern_unsigned_long_int__unsigned_long_int__unsigned_char___char__]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, eax
add esp, 0x10
test edi, edi
je 0x7800335e
push edi
push 0x78024ecc
push str._s_hook_pes_no_crowd____08x_n
call fcn.7800ce8b
mov esi, dword [sym.imp.dsound.dll_void___cdecl__Global_Log_wchar_t_const___wchar_t_const__]
push str.Patch_performance_fix_20_:_remove_crowd__3d_turf
push 0x78024f64
call esi
add esp, 0x14
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push edi
call ebx
test eax, eax
je 0x78003350
push 2
push 0x78024f7c
push edi
call fcn.78009480
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 2
push edi
call ebx
jmp 0x78003373
mov esi, dword [sym.imp.dsound.dll_void___cdecl__Global_Log_wchar_t_const___wchar_t_const__]
push str.Error_20.
push 0x78024f94
call esi
add esp, 8
push 0x78024fac
push 0x78024fb8
push 0x60000
push 0xde2768
call dword [sym.imp.dsound.dll_unsigned_long_int___cdecl_FindPattern_unsigned_long_int__unsigned_long_int__unsigned_char___char__]
mov edi, eax
add esp, 0x10
test edi, edi
je 0x780033f8
push edi
push 0x78024fc4
push str._s_hook_pes_no_crowd2____08x_n
call fcn.7800ce8b
push str.Patch_performance_fix_21_:_remove_crowd_light_map
push 0x7802505c
call esi
lea esi, [edi - 0xa]
add esp, 0x14
test esi, esi
je 0x78003407
lea eax, [ebp - 8]
push eax
push 0x40
push 3
push esi
call ebx
test eax, eax
je 0x780033db
push 3
push 0x78025074
push esi
call fcn.78009480
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 3
push esi
call ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.7800ce67
mov esp, ebp
pop ebp
ret
push str.Error_21.
push 0x7802508c
call esi
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.7800ce67
mov esp, ebp
pop ebp
ret
Function at 0x78003880
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
push str.msvcr110.dll
call esi
mov edi, eax
test edi, edi
jne 0x780038a4
push str.msvcr100.dll
call esi
mov edi, eax
jmp 0x780038b1
push str.version_msvcr110._n
call fcn.7800ce8b
add esp, 4
test edi, edi
je 0x78003969
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.malloc
push edi
call esi
push str.calloc
push edi
call esi
push str.realloc
push edi
call esi
push 0x780259f0
push edi
call esi
push str._aligned_malloc
push edi
call esi
push 0x78025a08
push 0x78025a14
push 0x80000
push 0x52a069
mov dword [ebp - 4], eax
call dword [sym.imp.dsound.dll_unsigned_long_int___cdecl_FindPattern_unsigned_long_int__unsigned_long_int__unsigned_char___char__]
mov esi, eax
add esp, 0x10
test esi, esi
je 0x78003969
mov edi, dword [sym.imp.dsound.dll_void___cdecl__Global_Log_wchar_t_const___wchar_t_const__]
push ebx
mov ebx, dword [sym.imp.dsound.dll_unsigned_long_int___cdecl_FindPatternNext_unsigned_long_int__unsigned_long_int__unsigned_char___char__]
lea ebx, [ebx]
push 0x78025a20
push 0x78025a2c
push 0x80000
push esi
call ebx
mov esi, eax
add esp, 0x10
test esi, esi
je 0x78003968
push str.Patch_aligned_malloc.
push 0x78025a64
call edi
lea ecx, [esi - 5]
add esp, 8
test ecx, ecx
je 0x78003963
push dword [ebp - 4]
xor edx, edx
push 0xe8
call fcn.78002650
add esp, 8
add esi, 0xb
jne 0x78003920
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x78004a30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 2
push 0
push ebx
mov dword [ebp - 4], ecx
call fcn.7800db9e
add esp, 0xc
test eax, eax
jne 0x78004ab6
push ebx
call fcn.7800df76
mov esi, eax
add esp, 4
test esi, esi
js 0x78004ab6
jne 0x78004a6c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [0x7802be6c], 0
jne 0x78004a7a
call fcn.780081a0
push esi
call fcn.78008710
mov edi, eax
test edi, edi
jne 0x78004a92
lea eax, [edi - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push ebx
call fcn.7800db9e
add esp, 0xc
push ebx
push esi
push 1
push edi
call fcn.7800e1a1
add esp, 0x10
cmp eax, esi
je 0x78004ac4
push edi
call fcn.780087a0
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.78004cd0
push edi
mov esi, eax
call fcn.780087a0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x78007340
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x780293e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov edx, dword [esi + 0xc]
cmp edi, edx
jne 0x78007369
mov eax, dword [edi + 0x1000]
mov dword [esi + 0xc], eax
jmp 0x7800738e
test edx, edx
je 0x7800738e
lea ecx, [ecx]
mov eax, dword [edx + 0x1000]
cmp eax, edi
je 0x78007382
mov edx, eax
test eax, eax
jne 0x78007370
jmp 0x7800738e
mov eax, dword [edi + 0x1000]
mov dword [edx + 0x1000], eax
mov edx, dword [edi + 0x102c]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov dword [eax + 4], ecx
lea ecx, [esi + 0x10]
mov dword [edx + 4], 0
mov dword [edx + 8], 0
call fcn.78006b20
push 0x7802be70
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4000
push 0x2000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x78007406
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x1000
lea eax, [ebp - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
sub dword [0x7802c814], 0x2000
push 0x7802be70
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [edi - 0x1000]
add ecx, dword [esi]
lea eax, [edi + 0x2000]
cmp ecx, eax
jb 0x78007437
mov edx, 0x1000
call fcn.780082e0
mov esi, dword [esi]
push 0x7802be70
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [0x7802c818], esi
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
test eax, eax
jne 0x7800748d
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x1000
lea eax, [ebp - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x7802be70
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.7800ce67
mov esp, ebp
pop ebp
ret 4
Function at 0x78007940
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x780293e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [edi + 0x18]
xor eax, eax
test esi, esi
je 0x78007975
mov ecx, dword [ebp + 8]
cmp dword [esi], ecx
je 0x78007993
mov eax, esi
mov esi, dword [esi + 8]
test esi, esi
jne 0x78007968
xor bl, bl
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.7800ce67
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 8]
test eax, eax
jne 0x7800799f
mov dword [edi + 0x18], ecx
jmp 0x780079a2
mov dword [eax + 8], ecx
mov ebx, dword [esi + 4]
mov eax, dword [esi]
add ebx, 0xfff
push 0x7802be70
mov dword [ebp - 8], eax
and ebx, 0xfffff000
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4000
push ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x78007a03
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x1000
lea eax, [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
sub dword [0x7802c814], ebx
push 0x7802be70
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7802be70
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [0x7802c818], ebx
push 0x8000
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x78007a68
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 0x1000
lea eax, [ebp - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x7802be70
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, esi
and ecx, 0xfffff000
xor edx, edx
mov eax, dword [ecx]
mov dword [esi], eax
inc dword [ecx + 8]
mov dword [ecx], esi
mov eax, 0xff4
div dword [edi + 0x1c]
mov esi, dword [ecx + 8]
cmp esi, eax
jne 0x78007ad0
mov eax, dword [edi + 0x20]
xor edx, edx
cmp eax, ecx
je 0x78007aa9
mov edi, edi
mov edx, eax
mov eax, dword [eax + 4]
cmp eax, ecx
jne 0x78007aa0
mov eax, dword [ecx + 4]
test edx, edx
jne 0x78007ac0
push ecx
mov dword [edi + 0x20], eax
call fcn.78006c80
mov bl, 1
jmp 0x78007977
push ecx
mov dword [edx + 4], eax
call fcn.78006c80
mov bl, 1
jmp 0x78007977
cmp esi, 1
jne 0x78007ade
mov eax, dword [edi + 0x20]
mov dword [ecx + 4], eax
mov dword [edi + 0x20], ecx
mov bl, 1
jmp 0x78007977
Function at 0x78016995
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x780293e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.78014be7
mov dword [ebp - 0x14], eax
cmp dword [0x7802b5d0], edi
jne 0x78016a86
push 0x800
push edi
push 0x78020424
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x78016a13
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x78016b66
push 0x78020424
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x78016b66
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x78016b66
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x7802b5d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x7802b5d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x7802b5d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x7802b5e0], eax
test eax, eax
je 0x78016a83
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x7802b5dc], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x78016aab
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x78016a9e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x78016ac0
push 4
pop eax
jmp 0x78016b68
cmp dword [ebp - 0x14], edi
je 0x78016ac0
push dword [0x7802b5d0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x78016aa5
mov eax, dword [0x7802b5dc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x78016b1e
cmp dword [0x7802b5e0], esi
je 0x78016b1e
push eax
call ebx
push dword [0x7802b5e0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x78016b1e
test eax, eax
je 0x78016b1e
call ecx
test eax, eax
je 0x78016b13
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x78016b13
test byte [ebp - 8], 1
jne 0x78016b1e
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x78016b4e
mov eax, dword [0x7802b5d4]
cmp eax, esi
je 0x78016b4b
push eax
call ebx
test eax, eax
je 0x78016b4b
call eax
mov edi, eax
test edi, edi
je 0x78016b4b
mov eax, dword [0x7802b5d8]
cmp eax, esi
je 0x78016b4b
push eax
call ebx
test eax, eax
je 0x78016b4b
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x7802b5d0]
call ebx
test eax, eax
je 0x78016b66
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x78016b68
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.7800ce67
leave
ret
Function at 0x10001e00
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x118
mov eax, dword [0x10015400]
xor eax, esp
mov dword [esp + 0x114], eax
push ebp
mov ebp, dword [esp + 0x120]
push edi
mov edi, dword [esp + 0x128]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x10001e39
mov eax, 0x80004005
jmp 0x10001ecf
lea eax, [esp + 8]
push eax
push 0x2000000
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001ecd
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push ecx
mov dword [esp + 0x30], 0x104
call esi
test eax, eax
jne 0x10001eb9
nop
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.10001e00
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push ecx
mov dword [esp + 0x30], 0x104
call esi
test eax, eax
je 0x10001e80
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop esi
xor eax, eax
mov ecx, dword [esp + 0x11c]
pop edi
pop ebp
xor ecx, esp
call fcn.1000af66
add esp, 0x118
ret 8
Function at 0x10001ef0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x178
mov eax, dword [0x10015400]
xor eax, esp
mov dword [esp + 0x174], eax
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x180]
mov edx, dword [esp + 0x184]
push ebx
mov ebx, dword [esp + 0x19c]
push esi
push edi
mov edi, dword [esp + 0x198]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x194]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x19c]
mov dword [esp + 0x28], eax
push 0x27
lea eax, [esp + 0x134]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x1a4]
push eax
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x20], edx
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x130]
push edx
lea eax, [esp + 0x30]
push 0x1001085c
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x30]
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x10001fac
or eax, 0x80070000
jmp 0x100020f0
push ebp
push edi
lea eax, [esp + 0x34]
push 0x10010858
push eax
call esi
mov edx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
add esp, 0xc
push 0x104
lea ecx, [esp + 0x34]
push ecx
push 1
push 0
push edx
call ebp
mov edi, eax
test edi, edi
je 0x10001ff5
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
or eax, 0x80070000
jmp 0x100020ef
push ebx
lea ecx, [esp + 0x34]
push 0x10010858
push ecx
call esi
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edi, eax
test edi, edi
je 0x10002037
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
or eax, 0x80070000
jmp 0x100020ef
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x34]
push 0x10010858
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0xc
lea edx, [esp + 0x30]
push edx
call ebx
mov ecx, dword [esp + 0x14]
add eax, 1
push eax
lea eax, [esp + 0x34]
push eax
push 1
push 0
push ecx
call ebp
mov edi, eax
test edi, edi
je 0x1000208f
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
mov eax, edi
or eax, 0x80070000
jmp 0x100020ef
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x34]
push 0x10010858
push edx
call esi
add esp, 0xc
lea eax, [esp + 0x30]
push eax
call ebx
mov edx, dword [esp + 0x14]
add eax, 1
push eax
lea ecx, [esp + 0x34]
push ecx
push 1
push 0
push 0x10010848
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call edi
test esi, esi
jle 0x100020ed
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop ebp
mov ecx, dword [esp + 0x180]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000af66
add esp, 0x178
ret 0x20
Function at 0x401784
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
not eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jmp 0x40183a
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xc384c0]
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
add eax, 1
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xc384c0]
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
add eax, 2
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xc384c0]
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
add eax, 3
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xc384c0]
xor eax, edx
mov dword [ebp - 4], eax
add dword [ebp - 8], 4
sub dword [ebp + 0x10], 4
cmp dword [ebp + 0x10], 3
ja 0x40179d
jmp 0x401871
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xc384c0]
xor eax, edx
mov dword [ebp - 4], eax
add dword [ebp - 8], 1
sub dword [ebp + 0x10], 1
cmp dword [ebp + 0x10], 0
jne 0x401846
mov eax, dword [ebp - 4]
not eax
leave
ret
Function at 0x420110
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004269a0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004269a0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x420170
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0xc6f07c]
test esi, esi
jle 0x420290
mov eax, dword [0xc6f080]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x4201a4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x420227
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x420190
mov dword [esp], ebx
call fcn.00420af0
mov edi, eax
test eax, eax
je 0x4202b7
mov eax, dword [0xc6f080]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00420c30
mov edx, dword [0xc6f080]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x420297
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x420220
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x420230
add dword [0xc6f07c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0xc6f080]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x420220
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00420110
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4201ae
mov eax, dword [0xc6f080]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00420110
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00420110
lea esi, [esi]
nop
Function at 0x420770
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0xc6f098
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0xc6f090]
sub esp, 4
test ebx, ebx
je 0x4207c5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4207be
test esi, esi
je 0x4207be
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4207a0
mov dword [esp], 0xc6f098
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x420af0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x420b15
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x420b20
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x420b15
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x420b68
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x420b5e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x420b6a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x420b50
xor eax, eax
pop ebx
pop esi
ret
Function at 0x10001760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1000177d
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100017b2
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x100017ae
lea ecx, [ecx]
cmp esi, eax
jae 0x100017b2
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x100017a0
cmp esi, eax
jb 0x100017b9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret