joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407150
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x58ac5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov bl, 1
push edi
mov edi, ecx
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x260], eax
mov byte [ebp - 0x255], bl
cmp byte [edi + 0x31], 0
je 0x407369
push esi
call fcn.0045ce70
inc eax
push eax
push esi
push 0x4d45c0
push str.UTF_16LE
call fcn.004681a0
mov esi, eax
mov word [ebp - 0x254], 0x1c02
xor eax, eax
mov dword [ebp - 0x264], esi
push 0x58
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x2bc]
push eax
mov byte [ebp - 0x252], 5
call fcn.004b4000
lea eax, [ebp - 0x254]
mov dword [ebp - 0x2bc], 0x58
push eax
mov eax, dword [ebp - 0x25c]
push dword [eax + 8]
call fcn.004602e0
mov bh, byte [ebp + 0x14]
add esp, 0x28
neg eax
mov dword [ebp - 0x28c], esi
mov ecx, 2
mov dword [ebp - 0x29c], 0x104
sbb eax, eax
and eax, dword [ebp - 0x24c]
test bh, bh
mov dword [ebp - 0x2b8], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x2a0], eax
mov eax, 0x1000
cmovne eax, ecx
xor esi, esi
push esi
push esi
mov dword [ebp - 0x288], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x25c], eax
test eax, eax
je 0x40727f
lea ecx, [eax + eax]
push ecx
call fcn.0045bff0
mov esi, eax
add esp, 4
test esi, esi
je 0x40727f
push esi
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x40727f
push esi
call fcn.0045bfc0
add esp, 4
xor esi, esi
lea eax, [ebp - 0x2bc]
push eax
test bh, bh
je 0x407292
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
jmp 0x407298
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x40730e
lea eax, [ebp - 0x20c]
push eax
call fcn.0045e3b0
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push str.UTF_16LE
push 0x4d45c0
call fcn.004681a0
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x4072f8
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x25c], ebx
mov ecx, dword [ecx + 0x24]
test ecx, ecx
je 0x40738e
mov eax, dword [ecx]
lea edx, [ebp - 0x25c]
push edx
mov eax, dword [eax + 8]
call eax
test al, al
jne 0x4072ff
mov byte [ebp - 0x255], 0
push ebx
call fcn.0045bfc0
mov bl, byte [ebp - 0x255]
add esp, 4
push dword [ebp - 0x264]
call fcn.0045bfc0
add esp, 4
test esi, esi
je 0x407330
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
call fcn.0045bfc0
add esp, 4
test bl, bl
jne 0x40737b
cmp byte [edi + 0x30], bl
mov ecx, str.Could_not_open_file.
push 0
mov eax, str.Could_not_save_file.
cmove eax, ecx
push eax
push str.Error
push 0x10
call fcn.00461150
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b20f1
mov esp, ebp
pop ebp
ret 0x10
push eax
lea ecx, [edi + 8]
mov dword [edi + 4], esi
call fcn.00406e60
mov al, byte [ebp + 0x14]
mov byte [edi + 0x30], al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b20f1
mov esp, ebp
pop ebp
ret 0x10
call fcn.004b20a0
int3
Function at 0x412fd0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [0x693740]
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + 0x1248]
mov dword [ebp - 4], eax
test cl, 0x10
jne 0x413145
mov ebx, dword [edi + 0x1b90]
test ebx, ebx
je 0x413043
cmp dword [edi + 0x1298], ebx
jne 0x41313c
mov esi, dword [edi + 0x12bc]
xor ecx, ecx
cmp esi, 0xffffffff
cmove esi, ecx
cmp byte [esi + edi + 0xc4], cl
je 0x41313c
cmp byte [eax + 0xb3], cl
jne 0x41313c
xor cl, cl
jmp 0x4130ea
cmp byte [edi + 0xc4], 0
je 0x41313c
cmp byte [eax + 0xb3], 0
jne 0x41313c
test byte [edi + 0x1b98], 1
jne 0x41307e
cmp dword [edi + 0x1298], esi
je 0x41313c
cmp dword [edi + 0x12b4], eax
jne 0x41313c
test cl, 8
je 0x41313c
lea esi, [edi + 0x1b9c]
mov ecx, eax
push esi
call fcn.00416d90
mov ebx, eax
push ebx
mov dword [edi + 0x1b90], ebx
call fcn.0041a3d0
push dword [edi + 0x1b94]
push ebx
push esi
call fcn.0041a040
mov cl, al
add esp, 0x10
mov byte [ebp + 0xb], cl
test cl, cl
je 0x4130dd
cmp byte [edi + 0xae0], 0
je 0x4130dd
mov esi, dword [ebp - 4]
push esi
push ebx
call fcn.00422eb0
push 0
push esi
call fcn.004164f0
mov cl, byte [ebp + 0xb]
add esp, 0x10
cmp dword [edi + 0x1298], ebx
jne 0x41313c
mov eax, dword [ebp - 4]
xor esi, esi
mov byte [edi + 0x12a5], cl
mov ecx, dword [eax + 0xec]
mov eax, dword [eax + 0xf4]
mov eax, dword [eax + ecx*4 - 4]
mov dword [ebp - 8], eax
mov eax, dword [0x693740]
cmp byte [eax + esi + 0xc4], 0
jne 0x413118
mov byte [ebp + 0xb], 0
jmp 0x413131
movss xmm1, dword [eax + 0x58]
movss xmm0, dword [eax + esi*4 + 0xb38]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae byte [ebp + 0xb]
call fcn.00422fa0
cmp byte [ebp + 0xb], 0
jne 0x41317e
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
or ebx, 0xffffffff
mov al, 0x23
mov edx, 0x5471f5
or esi, 0xffffffff
cmp al, 0x23
jne 0x413160
cmp byte [edx], al
jne 0x413160
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x546268]
test al, al
jne 0x413152
mov esi, dword [ebp - 0x10]
not ebx
cmp byte [edi + 0x1e8c], 0
jne 0x4131c0
call fcn.004144f0
mov eax, dword [ebp - 8]
mov dword [edi + 0x1ea8], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x1ea4], ebx
mov byte [edi + 0x1e8c], 1
mov dword [edi + 0x1e90], eax
mov dword [edi + 0x1e98], esi
cmp ebx, dword [edi + 0x1298]
jne 0x4131c0
mov byte [edi + 0x12a6], 1
mov ebx, dword [ebp - 0xc]
mov eax, dword [edi + 0x11c8]
mov dword [edi + 0x1e94], eax
mov byte [edi + 0x1e8d], 1
test bl, 1
jne 0x413233
cmp dword [edi + 0x1ef4], 0
je 0x413227
test dword [edi + 0x1ee8], 0x1000
je 0x413227
mov esi, dword [0x693740]
push 0x2030347
push 0
push str.Tooltip_Hidden
call fcn.004104e0
mov eax, dword [esi + 0x1248]
add esp, 0xc
mov byte [eax + 0xb3], 1
mov byte [eax + 0xb5], 1
mov byte [eax + 0xd4], 1
jmp 0x413233
push 0
push 0
call fcn.004135b0
add esp, 8
test bl, 0x12
jne 0x41323f
and dword [edi + 0x1b98], 0xfffffffe
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416250
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
push ebx
push esi
push edi
mov bl, byte [ecx]
lea esi, [ecx + 1]
mov edi, dword [0x693740]
test bl, bl
je 0x41629e
or edi, 0xffffffff
nop
cmp bl, 0x23
jne 0x41627f
cmp byte [esi], bl
jne 0x41627f
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x546268]
test bl, bl
jne 0x416270
mov edi, dword [0x693740]
mov ecx, dword [edi + 0x3004]
not eax
mov edx, dword [edi + 0x300c]
pop edi
pop esi
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*4]
pop ebx
cmp edx, ecx
je 0x4162cc
nop dword [eax]
cmp dword [edx + 4], eax
je 0x4162d0
add edx, 0x24
cmp edx, ecx
jne 0x4162c0
xor eax, eax
pop ebp
ret
mov eax, edx
pop ebp
ret

Function at 0x416350
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
push ebx
push esi
mov bl, byte [ecx]
lea esi, [ecx + 1]
test bl, bl
je 0x416391
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x416377
cmp byte [esi], bl
jne 0x416377
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x546268]
test bl, bl
jne 0x416368
pop edi
pop esi
not eax
pop ebx
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004162e0

Function at 0x416d90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x10]
mov edi, 0x10
movss xmm1, dword [edx + 0x108]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x10c]
subss xmm0, xmm1
mov ecx, dword [edx + 0xec]
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 8], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xf4]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 4], xmm0
not edx
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x546268]
sub edi, 1
jne 0x416e00
not edx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x416e30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
not eax
lea esi, [ebp + 8]
mov edi, 4
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x546268]
sub edi, 1
jne 0x416e42
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x416e70
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
mov ecx, dword [ebp + 8]
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.00418350
Function at 0x418350
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x41839e
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x418381
cmp edi, 2
jb 0x418381
cmp byte [esi], cl
jne 0x418381
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x546268]
test edi, edi
jne 0x418367
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x4183cd
cmp cl, 0x23
jne 0x4183b4
cmp byte [esi], cl
jne 0x4183b4
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x546268]
test cl, cl
jne 0x4183a5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x4185b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
xor ecx, ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x4185d0
cmp eax, esi
jae 0x418724
mov bl, byte [eax]
test bl, bl
je 0x418724
movzx ecx, bl
mov edx, esi
shr ecx, 3
movsx edi, byte [ecx + 0x546b64]
xor ecx, ecx
test edi, edi
mov dword [ebp - 8], edi
sete cl
add ecx, edi
mov dword [ebp - 0xc], ecx
test esi, esi
jne 0x4185ff
lea edx, [ecx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, bl
mov byte [ebp - 4], cl
cmp esi, edx
jae 0x418613
mov bh, byte [esi]
jmp 0x418615
xor bh, bh
lea esi, [eax + 2]
mov byte [ebp - 3], bh
cmp esi, edx
jae 0x418623
mov ch, byte [esi]
jmp 0x418625
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 2], ch
cmp esi, edx
jae 0x418633
mov bl, byte [esi]
jmp 0x418635
xor bl, bl
mov edi, dword [edi*4 + 0x546b84]
movzx edx, ch
movzx ecx, cl
and edi, ecx
movzx esi, bh
shl edi, 6
mov ecx, esi
and ecx, 0x3f
mov byte [ebp - 1], bl
or edi, ecx
movzx ebx, bl
shl edi, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or edi, ecx
and esi, 0xc0
mov ecx, ebx
shl edi, 6
and ecx, 0x3f
shr ebx, 2
or edi, ecx
or ebx, edx
mov ecx, dword [ebp - 8]
shr ebx, 2
or ebx, esi
mov esi, dword [ebp - 8]
shr ebx, 2
mov ecx, dword [ecx*4 + 0x546bac]
shr edi, cl
cmp edi, dword [esi*4 + 0x546b98]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or ebx, ecx
mov ecx, edi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or ebx, edx
cmp ecx, edi
sbb ecx, ecx
and ecx, 0x100
or ebx, ecx
mov ecx, dword [esi*4 + 0x546bc0]
xor ebx, 0x2a
sar ebx, cl
test ebx, ebx
je 0x418716
xor edx, edx
cmp byte [ebp - 1], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 4], cl
setne cl
add edx, ecx
cmp dword [ebp - 0xc], edx
cmovl edx, dword [ebp - 0xc]
mov ecx, edx
add eax, ecx
mov ecx, dword [ebp - 0x10]
inc ecx
jmp 0x4185be
mov ecx, dword [ebp - 0xc]
add eax, ecx
mov ecx, dword [ebp - 0x10]
inc ecx
jmp 0x4185be
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
dec eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x14], ecx
lea eax, [ebx + eax*2]
mov dword [ebp - 0x18], eax
cmp ebx, eax
mov eax, dword [ebp + 0x10]
jae 0x418946
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push edi
nop dword [eax]
test esi, esi
je 0x4187cc
cmp eax, esi
jae 0x418941
mov bl, byte [eax]
mov byte [ebp + 0xf], bl
test bl, bl
je 0x418941
movzx ecx, bl
mov edx, esi
shr ecx, 3
xor ebx, ebx
movsx ecx, byte [ecx + 0x546b64]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
test esi, esi
jne 0x4187fb
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp + 0xf]
mov byte [ebp - 3], cl
cmp esi, edx
jae 0x418813
mov ch, byte [esi]
mov byte [ebp + 0xf], ch
jmp 0x418817
mov byte [ebp + 0xf], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x418822
mov ch, byte [esi]
jmp 0x418824
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 2], ch
cmp esi, edx
jae 0x418832
mov al, byte [esi]
jmp 0x418834
xor al, al
movzx esi, byte [ebp + 0xf]
movzx edx, ch
movzx ecx, cl
movzx edi, al
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x546b84]
and eax, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], eax
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov eax, dword [ebp - 8]
and ecx, 0x3f
or eax, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x546bac]
shr eax, cl
mov esi, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
cmp esi, dword [eax*4 + 0x546b98]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [eax*4 + 0x546bc0]
mov eax, dword [ebp - 0x10]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x418924
xor edx, edx
mov esi, 0xfffd
cmp byte [ebp - 1], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp + 0xf], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
mov ebx, edx
mov ecx, dword [ebp - 0x14]
add eax, ebx
mov dword [ebp - 0x10], eax
mov word [ecx], si
add ecx, 2
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 0x18]
jb 0x4187c0
mov ebx, dword [ebp + 8]
pop edi
pop esi
xor edx, edx
mov word [ecx], dx
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x418954
mov dword [edx], eax
sub ecx, ebx
sar ecx, 1
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a7f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x3060], 0
lea ecx, [esi + 0x3064]
je 0x41a854
push 0
call fcn.00428500
push dword [ebp + 0x10]
lea ecx, [esi + 0x3064]
push dword [ebp + 0xc]
call fcn.00427b90
mov edx, dword [esi + 0x3064]
mov ecx, 0x693744
push dword [esi + 0x3060]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x306c]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call fcn.004b7751
add esp, 0x10
pop edi
pop esi
pop ebp
ret
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00427b90
pop edi
pop esi
pop ebp
ret
Function at 0x41fbd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x693740]
lea edx, [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1248]
mov esi, 4
mov eax, dword [ebp + 8]
add edi, 0xec
mov dword [ebp + 8], eax
mov eax, dword [edi]
mov ebx, dword [edi + 8]
mov dword [ebp - 4], eax
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x546268]
sub esi, 1
jne 0x41fc04
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [ebp - 4]
cmp ecx, esi
jne 0x41fc4e
inc ecx
test esi, esi
je 0x41fc3a
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x41fc3f
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.004282b0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x693740]
sub esp, 8
cmp dword [ebp + 8], 0
mov dword [eax + 0x2ff4], 0
je 0x42278c
push ebx
push esi
push edi
mov edi, dword [0x693740]
mov dword [ebp - 4], edi
push 0
mov dword [edi + 0x2ff4], 0
add edi, 0x2ff8
mov ecx, edi
call fcn.00428500
mov ecx, dword [edi]
mov ebx, dword [edi + 4]
cmp ecx, ebx
jne 0x422709
lea esi, [ecx + 1]
test ebx, ebx
je 0x4226bf
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
add eax, ebx
jmp 0x4226c4
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ebx
jle 0x422709
push dword [0x693748]
push esi
call dword [0x588050]
mov ebx, eax
add esp, 8
mov eax, dword [edi + 8]
test eax, eax
je 0x422701
push dword [edi]
push eax
push ebx
call fcn.004b3a80
push dword [0x693748]
push dword [edi + 8]
call dword [0x588054]
add esp, 0x14
mov ecx, dword [edi]
mov dword [edi + 8], ebx
mov dword [edi + 4], esi
mov eax, dword [edi + 8]
mov byte [ecx + eax], 0
mov ecx, dword [ebp - 4]
inc dword [edi]
mov ebx, dword [edi]
mov eax, dword [ecx + 0x3004]
mov esi, dword [ecx + 0x300c]
lea eax, [eax + eax*8]
lea eax, [esi + eax*4]
cmp esi, eax
je 0x422747
mov ebx, eax
nop
mov eax, dword [esi + 0x1c]
push edi
push esi
push ecx
call eax
mov ecx, dword [ebp - 4]
add esi, 0x24
add esp, 0xc
cmp esi, ebx
jne 0x422730
mov ebx, dword [edi]
lea eax, [ebx - 1]
mov edi, 0x693744
neg ebx
push 0x547210
push dword [ebp + 8]
sbb ebx, ebx
and ebx, eax
mov eax, dword [ecx + 0x3000]
test eax, eax
cmovne edi, eax
call fcn.004177e0
mov esi, eax
add esp, 8
test esi, esi
je 0x422789
push esi
push ebx
push 1
push edi
call fcn.004b7751
push esi
call fcn.004b677e
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42fe90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x42feb7
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.0041a920
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42fedc
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.0041a920
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x42ff01
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.0041a920
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x42ff42
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.0041a920
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x42ff67
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.0041a920
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x42ff8c
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.0041a920
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.0042b720
Function at 0x452540
Capabilities:
Encode data using xor

Disassembly:
jmp 0x456c50
jmp fcn.00457060

Function at 0x452f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
mov edx, 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 8]
movzx ecx, word [esi + 0x2e]
imul ecx, dword [ebp + 0x14]
add ecx, dword [ebp + 0x10]
lea ecx, [eax + ecx*2]
mov eax, ecx
xor eax, 1
movzx ebx, byte [eax + esi + 0x48]
movzx eax, byte [esi + ecx + 0x48]
shl eax, 8
or ebx, eax
mov eax, ebx
mov ecx, ebx
shr eax, 0xc
test al, 1
mov eax, dword [ebp + 0xc]
cmovne edx, dword [ebp + 0x1c]
add esi, 0x48
and eax, dword [ebp + 0x1c]
xor edx, eax
shr ecx, 0xb
mov eax, ebx
and cl, 1
and eax, 0x7ff
imul eax, dword [ebp + 0x20]
add esi, eax
neg cl
sbb cl, cl
shr ebx, 0xd
shl ebx, 0xc
and ecx, 0xffffff07
add ebx, dword [edi + 4]
lea esi, [esi + edx*4]
mov dword [ebp + 8], ebx
xor eax, eax
mov ebx, dword [ebp + 0x24]
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], ecx
mov edi, dword [ebx]
mov dl, al
xor dl, cl
inc eax
movzx ecx, dl
shr ecx, 1
movzx esi, byte [ecx + esi]
mov cl, dl
not cl
and cl, 1
shl cl, 2
shr esi, cl
movzx ecx, byte [edi]
and esi, 0xf
add esi, dword [ebp + 8]
add ecx, ecx
mov cl, byte [esi + ecx*8]
mov esi, dword [ebp + 0x10]
mov byte [edi], cl
inc dword [ebx]
mov ecx, dword [ebp + 0x14]
cmp eax, 8
jb 0x452fb5
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x456a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
lea esi, [edi + 0xc00]
mov bl, al
lea eax, [esi - 0xc00]
push ebx
push 0
push 0
push eax
call fcn.00454400
push ebx
push 1
lea eax, [esi - 0x600]
push 0
push eax
call fcn.00454400
push ebx
push 2
push 0
push esi
call fcn.00454400
push ebx
push 0
lea eax, [esi + 0x600]
push 1
push eax
call fcn.00454400
add esp, 0x40
lea eax, [esi + 0xc00]
push ebx
push 1
push 1
push eax
call fcn.00454400
push ebx
push 2
lea eax, [esi + 0x1200]
push 1
push eax
call fcn.00454400
push ebx
push 0
lea eax, [esi + 0x1800]
push 2
push eax
call fcn.00454400
mov eax, dword [ebp - 4]
add esp, 0x30
inc eax
add esi, 6
mov dword [ebp - 4], eax
cmp eax, 0x100
jb 0x456a25
xor edx, edx
mov eax, edx
shr eax, 1
xor eax, edx
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0x11
mov eax, ecx
shl eax, 4
add eax, ecx
shr eax, 2
not al
and al, 4
mov byte [edi + edx + 0x2a00], al
inc edx
cmp edx, 0x100
jb 0x456ab5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret