joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4054be
Capabilities:
Check if file exists
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x411050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push edi
mov word [ebp - 0x10], ax
mov word [ebp - 0xe], ax
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], ax
mov word [ebp - 8], ax
mov edi, 0x104
push edi
lea eax, [ebp - 0x218]
xor ebx, ebx
push eax
push ebx
mov dword [0x412e2c], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, ebx
jne 0x40552e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x405634
and eax, 0xffff
or eax, 0x80070000
jmp 0x405634
cmp eax, edi
jne 0x40553c
mov eax, 0x8007007a
jmp 0x405634
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.0040e7a5
pop ecx
pop ecx
cmp eax, ebx
jne 0x40555a
mov eax, 0x8000ffff
jmp 0x405634
push esi
add eax, 2
lea esi, [ebp - 0x220]
mov dword [ebp - 0x21c], eax
call fcn.00405667
test eax, eax
js 0x405593
mov eax, dword [ebp - 0x220]
test ax, ax
je 0x405593
mov word [ebp - 0x10], ax
and eax, 0x3ff
or eax, 0x400
push 2
mov word [ebp - 0xe], ax
pop ebx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [ebp + ebx*2 - 0x10], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov word [ebp + ebx*2 - 0xe], ax
mov eax, 0x409
mov word [ebp + ebx*2 - 0xc], ax
add ebx, 3
cmp ebx, 5
jbe 0x4055c5
mov eax, 0x8000ffff
jmp 0x405633
mov eax, dword [ebp - 0x21c]
lea ecx, [ebp - 0x218]
sub eax, ecx
sar eax, 1
mov esi, edi
sub esi, eax
xor edi, edi
test ebx, ebx
jle 0x40562e
movzx eax, word [ebp + edi*2 - 0x10]
push 0x403774
push eax
push 0x403878
push esi
push esi
push dword [ebp - 0x21c]
call fcn.0040e7d8
add esp, 0x18
test eax, eax
js 0x405642
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x405649
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x405629
cmp eax, 3
je 0x405629
cmp eax, 0x7e
jne 0x405652
inc edi
cmp edi, ebx
jl 0x4055df
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00405bb1
leave
ret
mov eax, 0x8007007a
jmp 0x405633
mov dword [0x412e2c], eax
xor eax, eax
jmp 0x405633
test eax, eax
jle 0x405633
and eax, 0xffff
or eax, 0x80070000
jmp 0x405633
Function at 0x4056be
Capabilities:
Check if file exists
Load windows common language runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
test esi, esi
je 0x405701
and dword [esi], 0
and dword [ebp - 4], 0
push edi
push 0x4031cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x40570f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x405708
cmp eax, 0x7e
je 0x405708
test eax, eax
jle 0x4056fd
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x405743
mov eax, 0x80004003
leave
ret
mov edi, 0x80040641
jmp 0x405743
push 0x4038a4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x405724
xor edi, edi
inc edi
jmp 0x405743
lea ecx, [ebp - 4]
push ecx
push 0x4038cc
push 0x4031bc
call eax
mov edi, eax
test edi, edi
js 0x405743
mov eax, dword [ebp - 4]
and dword [ebp - 4], 0
mov dword [esi], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x405750
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
pop edi
leave
ret

Function at 0x405bb1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411050]
jne 0x405bbb
repz ret
jmp fcn.004074a3
Function at 0x40a210
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x411050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406cfe
and dword [ebp - 0x14], 0
cmp dword [0x412ba0], 0
mov dword [ebp - 0x18], eax
jne 0x40a2c3
push 0x402128
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40a36b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40211c
push ebx
call edi
test eax, eax
je 0x40a36b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40210c
push ebx
mov dword [0x412ba0], eax
call edi
push eax
call esi
push 0x4020f8
push ebx
mov dword [0x412ba4], eax
call edi
push eax
call esi
push 0x4020dc
push ebx
mov dword [0x412ba8], eax
call edi
push eax
call esi
mov dword [0x412bb0], eax
test eax, eax
je 0x40a2c3
push 0x4020c4
push ebx
call edi
push eax
call esi
mov dword [0x412bac], eax
mov eax, dword [0x412bac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40a31c
cmp dword [0x412bb0], ecx
je 0x40a31c
push eax
call esi
push dword [0x412bb0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40a31c
test ebx, ebx
je 0x40a31c
call edi
test eax, eax
je 0x40a313
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40a313
test byte [ebp - 8], 1
jne 0x40a31c
or dword [ebp + 0x10], 0x200000
jmp 0x40a34f
mov eax, dword [0x412ba4]
cmp eax, dword [ebp - 0x18]
je 0x40a34f
push eax
call esi
test eax, eax
je 0x40a34f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40a34f
mov eax, dword [0x412ba8]
cmp eax, dword [ebp - 0x18]
je 0x40a34f
push eax
call esi
test eax, eax
je 0x40a34f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x412ba0]
call esi
test eax, eax
je 0x40a36b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40a36d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405bb1
leave
ret
Function at 0x401c3f
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x401c60
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x401c57
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x401c4f
mov eax, ebx
leave
ret

Function at 0x401c86
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x401ce5
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x401d12
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x401d01
xor ecx, eax
xor edx, ebx
dec edi
jne 0x401cf2
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x401d38
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x401cd9
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x402423
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x402446
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x402446
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x402450
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x402492
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4024f4
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4024ef
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4024da
test dl, dl
je 0x4024d6
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4024da
add ecx, 2
add eax, 2
test dl, dl
jne 0x4024ba
xor eax, eax
jmp 0x4024df
sbb eax, eax
or eax, 1
test eax, eax
je 0x402500
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4024a7
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x402585
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4025a8
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4025a8
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4025b2
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4025f4
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x402656
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x402651
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40263c
test dl, dl
je 0x402638
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40263c
add ecx, 2
add eax, 2
test dl, dl
jne 0x40261c
xor eax, eax
jmp 0x402641
sbb eax, eax
or eax, 1
test eax, eax
je 0x402662
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x402609
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4026f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x402717
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x402717
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x402721
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x402763
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4027c5
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4027c0
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4027ab
test dl, dl
je 0x4027a7
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4027ab
add ecx, 2
add eax, 2
test dl, dl
jne 0x40278b
xor eax, eax
jmp 0x4027b0
sbb eax, eax
or eax, 1
test eax, eax
je 0x4027d1
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x402778
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x40285e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x402881
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x402881
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40288b
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4028cd
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40292f
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40292a
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x402915
test dl, dl
je 0x402911
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x402915
add ecx, 2
add eax, 2
test dl, dl
jne 0x4028f5
xor eax, eax
jmp 0x40291a
sbb eax, eax
or eax, 1
test eax, eax
je 0x40293b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4028e2
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4029d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4029f7
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4029f7
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x402a01
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x402a43
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x402aa5
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x402aa0
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x402a8b
test dl, dl
je 0x402a87
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x402a8b
add ecx, 2
add eax, 2
test dl, dl
jne 0x402a6b
xor eax, eax
jmp 0x402a90
sbb eax, eax
or eax, 1
test eax, eax
je 0x402ab1
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x402a58
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x402b45
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x402b68
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x402b68
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x402b72
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x402bb4
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x402c16
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x402c11
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x402bfc
test dl, dl
je 0x402bf8
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x402bfc
add ecx, 2
add eax, 2
test dl, dl
jne 0x402bdc
xor eax, eax
jmp 0x402c01
sbb eax, eax
or eax, 1
test eax, eax
je 0x402c22
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x402bc9
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x402cb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x402cd7
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x402cd7
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x402ce1
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x402d23
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x402d85
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x402d80
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x402d6b
test dl, dl
je 0x402d67
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x402d6b
add ecx, 2
add eax, 2
test dl, dl
jne 0x402d4b
xor eax, eax
jmp 0x402d70
sbb eax, eax
or eax, 1
test eax, eax
je 0x402d91
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x402d38
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x402e23
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x402e46
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x402e46
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x402e50
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x402e92
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x402ef4
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x402eef
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x402eda
test dl, dl
je 0x402ed6
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x402eda
add ecx, 2
add eax, 2
test dl, dl
jne 0x402eba
xor eax, eax
jmp 0x402edf
sbb eax, eax
or eax, 1
test eax, eax
je 0x402f00
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x402ea7
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x407fd8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x407ffb
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40808e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x4080b1
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40826a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x40828d
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc