joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fe900
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x54ca88
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x59b364]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004011ff
mov dword [esi], 0x568a54
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x18], 0
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x4fe965
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov dword [esi], 0x568a40
mov dword [esi + 0x30], 0x568a3c
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4fea00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x54cac3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x59b364]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004fe900
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_base.0
lea eax, [esi + 0x30]
mov byte [esp + 0x18], 1
mov dword [esi], 0x568a4c
mov dword [eax], 0x568a48
mov dword [esi + 0x44], 0x568a5c
cmp edi, ecx
je 0x4fea62
lea ecx, [edi + 0x30]
push ecx
push eax
call fcn.00466580
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4ffe70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x571b78
mov dword [esp], eax
mov dword [esp + 4], 0x558800
mov dword [esp + 8], 0x562258
mov dword [esp + 0xc], 0x568eb4
mov dword [esp + 0x10], 0x568eb0
mov dword [esp + 0x14], 0x556ec0
mov dword [esp + 0x18], 0x556d60
mov dword [esp + 0x1c], 0x568eac
mov dword [esp + 0x20], 0x55ea0c
mov dword [esp + 0x24], str.___:
mov dword [esp + 0x28], 0x57203c
mov dword [esp + 0x2c], 0x555b88
mov dword [esp + 0x30], 0x555d6c
mov dword [esp + 0x34], 0x568ea8
mov dword [esp + 0x38], 0x556b68
mov dword [esp + 0x3c], 0x572040
mov dword [esp + 0x40], 0x57204c
mov dword [esp + 0x44], str.0123456789
mov dword [esp + 0x48], 0x568bb0
mov dword [esp + 0x4c], str.BDMS
mov dword [esp + 0x50], 0x568e98
mov dword [esp + 0x54], 0x568e94
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x568e90
mov dword [esp + 0x64], 0x568e8c
mov dword [esp + 0x68], 0x571de4
mov dword [esp + 0x6c], 0x572038
mov dword [esp + 0x70], 0x568bb4
mov dword [esp + 0x74], 0x5665f4
mov dword [esp + 0x78], 0x556eb8
mov dword [esp + 0x7c], 0x566648
mov dword [esp + 0x80], 0x568b78
mov dword [esp + 0x84], 0x568b70
mov dword [esp + 0x88], 0x568b68
mov dword [esp + 0x8c], 0x568bac
mov dword [esp + 0x90], 0x572048
mov dword [esp + 0x94], 0x556764
mov dword [esp + 0x98], 0x572078
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x572074
mov dword [esp + 0xc0], 0x568c38
mov dword [esp + 0xc4], 0x568c20
mov dword [esp + 0xc8], 0x567058
mov dword [esp + 0xcc], str.ZYXWVUTRQPOLKJIHGFA
mov dword [esp + 0xd0], 0x568c58
mov dword [esp + 0xd4], 0x568e88
mov dword [esp + 0xd8], 0x568b84
mov dword [esp + 0xdc], 0x568c3c
mov dword [esp + 0xe0], 0x556ebc
mov dword [esp + 0xe4], 0x568e84
mov dword [esp + 0xe8], 0x568c48
mov dword [esp + 0xec], 0x568c34
cmp cl, 0x3c
jae 0x50008d
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret

Function at 0x5139d8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x59b364]
jne 0x5139e2
repz ret
jmp fcn.0051e97c
Function at 0x530f55
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0051e12f
and dword [ebp - 4], 0
cmp dword [0x5a21b0], 0
mov ebx, eax
jne 0x531006
push 0x5711b8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5310b7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5711ac
push edi
call esi
test eax, eax
je 0x5310b7
push eax
call fcn.0051e0bd
mov dword [esp], 0x57119c
push edi
mov dword [0x5a21b0], eax
call esi
push eax
call fcn.0051e0bd
mov dword [esp], 0x571188
push edi
mov dword [0x5a21b4], eax
call esi
push eax
call fcn.0051e0bd
mov dword [esp], 0x57116c
push edi
mov dword [0x5a21b8], eax
call esi
push eax
call fcn.0051e0bd
pop ecx
mov dword [0x5a21c0], eax
test eax, eax
je 0x531006
push 0x571154
push edi
call esi
push eax
call fcn.0051e0bd
pop ecx
mov dword [0x5a21bc], eax
mov eax, dword [0x5a21bc]
cmp eax, ebx
je 0x53105e
cmp dword [0x5a21c0], ebx
je 0x53105e
push eax
call fcn.0051e138
push dword [0x5a21c0]
mov esi, eax
call fcn.0051e138
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x53105e
test edi, edi
je 0x53105e
call esi
test eax, eax
je 0x531055
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x531055
test byte [ebp - 0xc], 1
jne 0x53105e
or dword [ebp + 0x10], 0x200000
jmp 0x531097
mov eax, dword [0x5a21b4]
cmp eax, ebx
je 0x531097
push eax
call fcn.0051e138
pop ecx
test eax, eax
je 0x531097
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x531097
mov eax, dword [0x5a21b8]
cmp eax, ebx
je 0x531097
push eax
call fcn.0051e138
pop ecx
test eax, eax
je 0x531097
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5a21b0]
call fcn.0051e138
pop ecx
test eax, eax
je 0x5310b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5310b9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5396e0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x54ddc8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x59b364]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x28]
test esi, esi
jne 0x539720
push esi
push esi
push esi
push 2
call fcn.0053ab60
xor al, al
jmp 0x5398a4
call fcn.00538970
push 2
or eax, 0xffffffff
push 0
push esi
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
call fcn.00514938
push esi
call fcn.00517850
push 0
push 0
push esi
mov edi, eax
call fcn.00514938
add esp, 0x1c
test edi, edi
jg 0x539767
push 0
push 0
push 0
push 0xd
mov ecx, ebx
call fcn.0053ab60
xor al, al
jmp 0x5398a4
mov dword [esp + 0x14], 0x5a21e0
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0
call fcn.00538660
lea eax, [edi + 1]
push eax
call fcn.00513541
push esi
push 1
mov ebp, eax
push edi
push ebp
mov byte [ebp], 0
call fcn.00516dbc
add esp, 0x14
cmp eax, 1
je 0x5397dd
push ebp
call fcn.00511b06
add esp, 4
push 0
push 0
push 0
push 2
mov ecx, ebx
call fcn.0053ab60
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
cmp eax, 0x5a21e0
je 0x5397d6
push eax
call fcn.00511b06
add esp, 4
xor al, al
jmp 0x5398a4
mov byte [edi + ebp], 0
cmp byte [ebp], 0
mov eax, ebp
mov esi, ebp
je 0x53984c
jmp 0x5397f0
mov cl, byte [esi]
cmp cl, 0xa
jne 0x53980c
mov ecx, esi
sub ecx, eax
inc ecx
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.005387f0
inc esi
mov eax, esi
jmp 0x539847
cmp cl, 0xd
jne 0x539846
mov ecx, esi
sub ecx, eax
test ecx, ecx
jle 0x539824
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.005387f0
push 1
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0xa
call fcn.005387f0
cmp byte [esi + 1], 0xa
jne 0x539807
add esi, 2
mov eax, esi
jmp 0x539847
inc esi
cmp byte [esi], 0
jne 0x5397f0
sub esi, eax
je 0x53985b
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.005387f0
push ebp
call fcn.00511b06
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
mov eax, dword [ebx]
mov eax, dword [eax + 8]
add esp, 4
push ecx
push 0
add edx, 8
push edx
mov ecx, ebx
call eax
cmp byte [ebx + 0x2c], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
jne 0x5397c6
cmp eax, 0x5a21e0
je 0x5398a2
push eax
call fcn.00511b06
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x53c240
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x88
push 0xffffffffffffffff
push 0x54e028
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x59b364]
xor eax, ebp
mov dword [ebp + 0x84], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x90]
xor edi, edi
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x53c292
xor eax, eax
jmp 0x53c3d6
push edi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
call fcn.0045bad0
push edi
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x14]
push edx
mov byte [ebp - 4], 1
call fcn.004e6920
mov eax, dword [eax]
add esp, 0xc
cmp eax, edi
je 0x53c2cf
cmp eax, 1
je 0x53c2cf
mov eax, 1
jmp 0x53c2d1
xor eax, eax
test al, al
sete bl
cmp dword [ebp - 0x20], 8
mov byte [ebp - 4], 0
jb 0x53c2ec
mov eax, dword [ebp - 0x34]
push eax
call fcn.00511b06
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], edi
mov word [ebp - 0x34], cx
test bl, bl
jne 0x53c28b
push 0x556e84
push esi
call fcn.00515310
mov esi, eax
add esp, 8
mov dword [ebp - 0x1c], esi
cmp esi, edi
je 0x53c39d
push esi
push 1
lea edx, [ebp]
push 0x84
push edx
call fcn.00516dbc
add esp, 0x10
cmp eax, 1
jne 0x53c38a
mov eax, dword [ebp]
cmp eax, dword [ebp + 0x94]
jne 0x53c377
push esi
call fcn.0053cb10
mov ecx, dword [ebp + 0x14]
add ecx, 0x84
add esp, 4
cmp eax, ecx
jne 0x53c364
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0xffffffff
jmp 0x53c3ca
mov dword [0x5a21ec], 8
mov dword [ebp - 4], 0xffffffff
jmp 0x53c3ca
mov dword [0x5a21ec], 6
mov dword [ebp - 4], 0xffffffff
jmp 0x53c3ca
mov dword [0x5a21ec], 2
mov dword [ebp - 4], 0xffffffff
jmp 0x53c3ca
mov dword [0x5a21ec], 1
mov dword [ebp - 4], 0xffffffff
jmp 0x53c3ca
push esi
call fcn.00514a79
mov eax, dword [ebp - 0x18]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.005139d8
add ebp, 0x88
mov esp, ebp
pop ebp
ret
Function at 0x53c7c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e0b0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x59b364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
xor ecx, ecx
xor bl, bl
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], ecx
cmp eax, ecx
je 0x53c873
mov edi, dword [ebp + 0xc]
cmp edi, ecx
je 0x53c873
push 0x556e84
push eax
call fcn.00515310
mov esi, eax
add esp, 8
mov dword [ebp - 0x18], esi
test esi, esi
je 0x53c834
mov eax, dword [ebp + 0x10]
push esi
push 1
push eax
push edi
call fcn.00516dbc
add esp, 0x10
cmp eax, 1
jne 0x53c834
mov bl, al
mov dword [ebp - 4], 0xffffffff
jmp 0x53c850
test esi, esi
je 0x53c85d
push esi
call fcn.00514a79
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x53c890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e0d0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x59b364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
xor ecx, ecx
xor bl, bl
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x18], ecx
cmp eax, ecx
je 0x53c943
mov edi, dword [ebp + 0xc]
cmp edi, ecx
je 0x53c943
push 0x556620
push eax
mov dword [ebp - 4], ecx
call fcn.00515310
mov esi, eax
add esp, 8
mov dword [ebp - 0x18], esi
test esi, esi
je 0x53c904
mov eax, dword [ebp + 0x10]
push esi
push 1
push eax
push edi
call fcn.005147be
add esp, 0x10
cmp eax, 1
jne 0x53c904
mov bl, al
mov dword [ebp - 4], 0xffffffff
jmp 0x53c920
test esi, esi
je 0x53c92d
push esi
call fcn.00514a79
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x53d1f0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e270
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x59b364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp + 8]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x53d278
push 0
push 0
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi], eax
test eax, eax
je 0x53d278
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
test eax, eax
jne 0x53d2d3
mov dword [ebp - 4], 0xffffffff
jmp 0x53d291
mov eax, dword [esi + 4]
test eax, eax
je 0x53d29f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esi]
test eax, eax
je 0x53d2b1
cmp eax, 0xffffffff
je 0x53d2b1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 8]
mov dword [esi], 0
test eax, eax
je 0x53d2ca
cmp eax, 0xffffffff
je 0x53d2ca
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x53d340
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x54e2a9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x59b364]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov dword [esp + 0x28], edi
mov byte [edi + 4], bl
mov ecx, 1
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebx
cmp byte [esp + 0x4c], bl
je 0x53d3aa
mov ecx, 0x101
cmp dword [eax + 0x18], 0x10
jb 0x53d3b5
mov eax, dword [eax + 4]
jmp 0x53d3b8
add eax, 4
lea esi, [esp + 0x18]
push esi
push ecx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x53d475
cmp dword [ebp + 0x18], 0x10
lea eax, [ebp + 4]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], eax
jb 0x53d3e6
mov eax, dword [eax]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x28]
push edx
push ebx
push eax
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x53d46a
mov eax, dword [esp + 0x14]
cmp eax, ebx
jbe 0x53d46a
cmp dword [esp + 0x20], 3
je 0x53d46a
push eax
call fcn.00513da7
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x53d46a
mov ecx, dword [esp + 0x14]
push ecx
push ebx
push esi
call fcn.00513c50
add esp, 0xc
cmp dword [ebp + 0x18], 0x10
jb 0x53d43d
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
jmp 0x53d441
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push esi
push ebx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x53d461
push esi
mov ecx, edi
call fcn.00405454
push esi
call fcn.00513cca
add esp, 4
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x401360
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431ce0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x43b040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
push 0x2c
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push 0
push esi
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call sub.VCRUNTIME140.dll_memset
lea edi, [esi + 0x3c]
add esp, 0xc
lea eax, [edi + 0x10]
mov dword [ebp - 0x10], edi
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [edi], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov ecx, dword [eax + 4]
test ecx, ecx
jns 0x401458
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
lea ecx, [edi + 0x10]
call fcn.00419a50
lea eax, [edi + 0x10]
mov dword [eax], 0
xorps xmm0, xmm0
mov dword [edi + 0x2c], 0
mov eax, esi
mov dword [edi + 0x30], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x34], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x84], 0
movups xmmword [esi + 0x74], xmm0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403be0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x403c41
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x403c24
cmp edi, 2
jb 0x403c24
cmp byte [esi], cl
jne 0x403c24
cmp byte [esi + 1], cl
jne 0x403c24
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x434460]
jmp 0x403bf5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x434460]
test edi, edi
jne 0x403bf5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x403c70
cmp cl, 0x23
jne 0x403c57
cmp byte [esi], cl
jne 0x403c57
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x434460]
test cl, cl
jne 0x403c48
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x403e00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x403e13
mov dword [ebx], 0
mov edx, 0x434054
call fcn.00403c80
mov esi, eax
test esi, esi
je 0x403f32
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x403f28
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403f28
push esi
call edi
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x403f28
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403f28
mov ecx, edi
call fcn.00407010
mov dword [ebp + 8], eax
test eax, eax
je 0x403f28
push esi
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, edi
je 0x403f11
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [0x43b418]
add esp, 4
test ecx, ecx
je 0x403efe
movsx edx, word [ecx + 0x5ee4]
lea eax, [ecx + 0x5ee8]
mov esi, dword [ecx + 0x3f08]
lea eax, [eax + edx*8]
cmp dword [eax], esi
je 0x403ef4
lea eax, [edx + 1]
mov edi, 6
cdq
idiv edi
movzx eax, dx
mov word [ecx + 0x5ee4], ax
cwde
add eax, 0xbdd
xor edx, edx
lea eax, [ecx + eax*8]
mov dword [eax], esi
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5ee0]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x403f20
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x406a10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x43b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, 4
mov eax, dword [edi + 0xec]
mov ebx, dword [edi + 0xf4]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x434460]
sub esi, 1
jne 0x406a50
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3fc4], ebx
jne 0x406a87
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.004190a0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430d53
mov esp, ebp
pop ebp
ret 4
Function at 0x409f80
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x409fbd
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x409fa3
cmp byte [esi], bl
jne 0x409fa3
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x434460]
test bl, bl
jne 0x409f94
pop edi
pop esi
not ecx
pop ebx
jmp fcn.00409f20