joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418308
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00417c40
xor eax, eax
push ebp
push 0x418479
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x418463
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x418353
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x41835d
call fcn.004038a4
jmp 0x418480
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00412a20
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x418458
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x41840b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x4183f8
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403280
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004182c0
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x41848c]
cmp dl, byte [eax + 0x28]
je 0x41845f
call fcn.0040a32c
jmp 0x41845f
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00412a40
jmp 0x41845f
cmp ecx, ebx
jge 0x418427
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00412a40
jmp 0x41835d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00412a20
cmp edx, dword [esp + 4]
jne 0x418447
cmp eax, dword [esp]
pop edx
pop eax
jne 0x41835d
push ebp
call fcn.004182c0
pop ecx
jmp 0x41845f
push ebp
call fcn.004182c0
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418480
mov eax, dword [ebp - 4]
call fcn.00417c4c
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418490
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4185b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00417c40
xor eax, eax
push ebp
push 0x418595
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4184e0
call fcn.004038a4
jmp 0x41859c
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x41857f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x41857f
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403280
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x41857f
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00409b20
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4185cc
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x41a5b8]
mov dl, 1
mov eax, dword [0x416f54]
call fcn.0040a444
call fcn.004037f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41859c
mov eax, dword [ebp - 4]
call fcn.00417c4c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4185b9
lea eax, [ebp - 0x28]
call main
ret
Function at 0x401220
Capabilities:
Link many functions at runtime

Disassembly:
push str.._HONDA_SPEC.dll
call fcn.00401140
add esp, 4
mov dword [0x40a934], eax
test eax, eax
jne 0x401248
push str.Failed_load_OpenDiagSpecFuncDll_n
call fcn.00402a30
mov eax, dword [0x40a934]
add esp, 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AdjustFunction
push eax
call esi
mov dword [0x40b5d4], eax
mov eax, dword [0x40a934]
push str.ShowSystemInfo_SRS4E
push eax
call esi
mov ecx, dword [0x40a934]
push str.CheckFunction
push ecx
mov dword [0x40a5e0], eax
call esi
mov edx, dword [0x40a934]
push str.SystemInformation
push edx
mov dword [0x40b6cc], eax
call esi
mov dword [0x40b618], eax
mov eax, dword [0x40a934]
push str.CMBSFunc
push eax
call esi
mov ecx, dword [0x40a934]
push str.SetSrsSubSysPara
push ecx
mov dword [0x40a970], eax
call esi
mov edx, dword [0x40a934]
push str.ShowRegisterMenu
push edx
mov dword [0x40aa20], eax
call esi
mov dword [0x40a8d0], eax
mov eax, dword [0x40a934]
push str.ShowImmobiFuncMenu
push eax
call esi
mov ecx, dword [0x40a934]
push str.CMBS_HistoryRecord
push ecx
mov dword [0x40a99c], eax
call esi
mov edx, dword [0x40a934]
push str.SelfDefine
push edx
mov dword [0x40b534], eax
call esi
mov dword [0x40b710], eax
mov eax, dword [0x40a934]
push str.AdjustBcm
push eax
call esi
mov ecx, dword [0x40a934]
push str.CheckBcm
push ecx
mov dword [0x40b598], eax
call esi
mov edx, dword [0x40a934]
push str.MaintenanceMinder
push edx
mov dword [0x40b6a4], eax
call esi
mov dword [0x40a98c], eax
mov eax, dword [0x40a934]
push str.SendPCUSecurity
push eax
call esi
mov ecx, dword [0x40a934]
push str.ShowRegMenu_OPS
push ecx
mov dword [0x40aa4c], eax
call esi
mov dword [0x40aae0], eax
mov al, 1
pop esi
ret
Function at 0x401370
Capabilities:
Link many functions at runtime

Disassembly:
push str.._HONDA_DTCF.dll
call fcn.00401140
add esp, 4
mov dword [0x40a9b0], eax
test eax, eax
jne 0x401398
push str.Failed_load_OpenDiagDtcFuncDll_n
call fcn.00402a30
mov eax, dword [0x40a9b0]
add esp, 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ClearDtc
push eax
call esi
mov dword [0x40a88c], eax
mov eax, dword [0x40a9b0]
push str.ReadDtc
push eax
call esi
mov ecx, dword [0x40a9b0]
push str.SetExDtcFlag
push ecx
mov dword [0x40b6c4], eax
call esi
mov edx, dword [0x40a9b0]
push str.SetClrCmdFlag
push edx
mov dword [0x40a644], eax
call esi
mov dword [0x40a878], eax
mov eax, dword [0x40a9b0]
push str.EcuResetModel
push eax
call esi
mov ecx, dword [0x40a9b0]
push str.OtherClearFunction
push ecx
mov dword [0x40a624], eax
call esi
mov edx, dword [0x40a9b0]
push str.CheckSelf
push edx
mov dword [0x40a954], eax
call esi
mov dword [0x40b5e0], eax
mov eax, dword [0x40a9b0]
push str.ReadBcmDtc
push eax
call esi
mov ecx, dword [0x40a9b0]
push str.ClearBcmDtc
push ecx
mov dword [0x40b63c], eax
call esi
mov edx, dword [0x40a9b0]
push str.ReadHVACDtc
push edx
mov dword [0x40b69c], eax
call esi
mov dword [0x40a8bc], eax
mov eax, dword [0x40a9b0]
push str.ClearHVACDtc
push eax
call esi
mov ecx, dword [0x40a9b0]
push str.ShowAllDtcContext
push ecx
mov dword [0x40a8d8], eax
call esi
mov edx, dword [0x40a9b0]
push str.ReadCurDtc
push edx
mov dword [0x40b590], eax
call esi
mov dword [0x40a604], eax
mov eax, dword [0x40a9b0]
push str.ReadHisDtc
push eax
call esi
mov ecx, dword [0x40a9b0]
push str.GetDtcNumberAndCod
push ecx
mov dword [0x40a8ac], eax
call esi
mov dword [0x40a630], eax
mov al, 1
pop esi
ret
Function at 0x4014c0
Capabilities:
Link many functions at runtime

Disassembly:
push str.._HONDA_COMM.dll
call fcn.00401140
add esp, 4
mov dword [0x40a9d0], eax
test eax, eax
jne 0x4014e8
push str.Failed_load_OpenDiagCommDll_n
call fcn.00402a30
mov eax, dword [0x40a9d0]
add esp, 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OpenCommAbstractLayer
push eax
call esi
mov dword [0x40b654], eax
call eax
mov eax, dword [0x40a9d0]
push str.InitCan2Comm
push eax
call esi
mov ecx, dword [0x40a9d0]
push str.InitCommRefData_HondaPrtl
push ecx
mov dword [0x40a8cc], eax
call esi
mov edx, dword [0x40a9d0]
push str.MulFuncSRCmd_HONDA
push edx
mov dword [0x40a650], eax
call esi
mov dword [0x40b6b0], eax
mov eax, dword [0x40a9d0]
push str.EnterBoschProtocol
push eax
call esi
mov ecx, dword [0x40a9d0]
push str.HondaSRAutoLen
push ecx
mov dword [0x40b5bc], eax
call esi
mov edx, dword [0x40a9d0]
push str.SetLineVoltage_Honda
push edx
mov dword [0x40b62c], eax
call esi
mov dword [0x40b634], eax
mov eax, dword [0x40a9d0]
push str.MySetLinkKeep
push eax
call esi
mov ecx, dword [0x40a9d0]
push str.MyBoschLinkKeep
push ecx
mov dword [0x40a914], eax
call esi
mov edx, dword [0x40a9d0]
push str.SetConnType
push edx
mov dword [0x40a9ec], eax
call esi
mov dword [0x40b728], eax
mov eax, dword [0x40a9d0]
push str.InitMulCANIDCan2Comm
push eax
call esi
mov ecx, dword [0x40a9d0]
push str.CheckSystemBCM
push ecx
mov dword [0x40a628], eax
call esi
mov edx, dword [0x40a9d0]
push str.EnterBCM_MODE1
push edx
mov dword [0x40b670], eax
call esi
mov dword [0x40a868], eax
mov eax, dword [0x40a9d0]
push str.EnterBCM_MODE2
push eax
call esi
mov ecx, dword [0x40a9d0]
push str.SendCmdAndRecv_KWP
push ecx
mov dword [0x40a86c], eax
call esi
mov edx, dword [0x40a9d0]
push str.IniCommParamKWP
push edx
mov dword [0x40b52c], eax
call esi
mov dword [0x40a87c], eax
mov eax, dword [0x40a9d0]
push str.CheckSystemMVCS
push eax
call esi
mov ecx, dword [0x40a9d0]
push str.CheckSystemSVT
push ecx
mov dword [0x40aa58], eax
call esi
mov edx, dword [0x40a9d0]
push str.ConnectorReset
push edx
mov dword [0x40a8b8], eax
call esi
mov dword [0x40a894], eax
mov eax, dword [0x40a9d0]
push str.SetSCSLine
push eax
call esi
mov dword [0x40b660], eax
mov al, 1
pop esi
ret
Function at 0x4023e0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x40b5f0]
test eax, eax
jne 0x402411
push str.._HONDA_SYSP.dll
call fcn.00401140
add esp, 4
mov dword [0x40b5f0], eax
test eax, eax
jne 0x402411
push str.Failed_load_DiagFuncDll_n
call fcn.00402a30
mov eax, dword [0x40b5f0]
add esp, 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SendActCmd_System
push eax
call esi
mov dword [0x40a97c], eax
mov eax, dword [0x40b5f0]
push str.SendFuncExitCmd
push eax
call esi
mov ecx, dword [0x40b5f0]
push str.SetEngineSysInfo
push ecx
mov dword [0x40b6bc], eax
call esi
mov edx, dword [0x40b5f0]
push str.SetOtherInfo
push edx
mov dword [0x40b6e0], eax
call esi
mov dword [0x40a9a8], eax
mov eax, dword [0x40b5f0]
push str.SendExitCmd_ENG
push eax
call esi
mov ecx, dword [0x40b5f0]
push str.SetConnectAndMarket
push ecx
mov dword [0x40a958], eax
call esi
mov edx, dword [0x40b5f0]
push str.SystemDispose
push edx
mov dword [0x40a848], eax
call esi
mov dword [0x40a920], eax
mov eax, dword [0x40b5f0]
push str.SendActCmd_ENG
push eax
call esi
mov ecx, dword [0x40b5f0]
push str.SendActCmd_CAN
push ecx
mov dword [0x40b70c], eax
call esi
mov edx, dword [0x40b5f0]
push str.SendActCmd_HONDA
push edx
mov dword [0x40b6d4], eax
call esi
mov dword [0x40a990], eax
mov eax, dword [0x40b5f0]
push str.SendActCmd_BCM
push eax
call esi
mov ecx, dword [0x40b5f0]
push str.SendEndCmd_BCM
push ecx
mov dword [0x40b678], eax
call esi
mov edx, dword [0x40b5f0]
push str.SetLinkKeep_BCM
push edx
mov dword [0x40b5c8], eax
call esi
mov dword [0x40a950], eax
mov eax, dword [0x40b5f0]
push str.SendEndCmd_KWP
push eax
call esi
mov ecx, dword [0x40b5f0]
push str.SendEnterCmd_KWP
push ecx
mov dword [0x40a9bc], eax
call esi
mov edx, dword [0x40b5f0]
push str.SystemSearch
push edx
mov dword [0x40a5d4], eax
call esi
mov dword [0x40b5a0], eax
mov eax, dword [0x40b5f0]
push str.DtcCheck
push eax
call esi
mov ecx, dword [0x40b5f0]
push str.GetSysCommbps
push ecx
mov dword [0x40b630], eax
call esi
mov dword [0x40a9c0], eax
mov al, 1
pop esi
ret
Function at 0x4014f0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 4]
push eax
push edi
mov dword [esp + 0xc], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401566
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
mov esi, dword [sym.imp.MSVCRT.dll__stricmp]
call ebx
cmp dword [esp + 0x14], eax
jne 0x401539
mov ecx, dword [esp + 0x24]
mov dword [0x405380], ecx
lea edx, [esp + 0x30]
push str.explorer.exe
push edx
call esi
add esp, 8
test eax, eax
jne 0x401555
mov eax, dword [esp + 0x14]
mov dword [0x40537c], eax
lea ecx, [esp + 0xc]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401527
pop esi
pop ebx
pop edi
add esp, 0x128
ret

Function at 0x401000
Capabilities:
Allocate or change rwx memory
Check for foreground window switch
Check for time delay via gettickcount
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x403008]
cmp eax, 0
jne 0x401021
mov eax, dword [0x40300c]
cmp eax, 0
jne 0x401021
jmp 0x4010b6
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 4], eax
push 0x1388
call sub.KERNEL32.dll_Sleep
call sub.USER32.dll_GetForegroundWindow
cmp eax, 0
je 0x401021
mov dword [ebp - 0x14], eax
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp - 4]
cmp eax, 0x1388
jl 0x401021
lea eax, [ebp - 8]
push eax
call sub.USER32.dll_GetCursorPos
cmp eax, 0
je 0x401021
mov eax, dword [0x403008]
cmp eax, 0
je 0x401093
push 0x3e8
call sub.KERNEL32.dll_Sleep
lea eax, [ebp - 0x10]
push eax
call sub.USER32.dll_GetCursorPos
cmp eax, 0
je 0x401067
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
cmp eax, ebx
je 0x401021
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
cmp eax, ebx
je 0x401067
mov eax, dword [0x40300c]
cmp eax, 0
je 0x4010b6
push 0x1388
call sub.KERNEL32.dll_Sleep
call sub.USER32.dll_GetForegroundWindow
cmp eax, 0
je 0x401093
cmp eax, dword [ebp - 0x14]
je 0x401093
push dword [0x403000]
mov eax, 0x40301a
mov ebx, 0x40322a
sub ebx, eax
push ebx
push 0x40301a
call fcn.00402bce
lea eax, [ebp - 4]
push eax
push 0x40
mov eax, 0x40112a
mov ebx, fcn.00402bce
sub ebx, eax
push ebx
push 0x40112a
call sub.KERNEL32.dll_VirtualProtect
push dword [0x403004]
mov eax, 0x40112a
mov ebx, fcn.00402bce
sub ebx, eax
push ebx
push 0x40112a
call fcn.00402bce
lea eax, [ebp - 4]
push eax
push dword [eax]
mov eax, 0x40112a
mov ebx, fcn.00402bce
sub ebx, eax
push ebx
push 0x40112a
call sub.KERNEL32.dll_VirtualProtect
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
cmp al, 0x2d
int 0
add byte [esp + ecx - 0x43ffff30], bh
invalid
Function at 0x407e64
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x6f1d482b
or esp, dword [edx]
push eax
mov ah, 0xb8
sar byte [edx + ebx*2 + 0x68e86dc4], 0xbc
mov ebp, 0x6ab2c617
call [ebx - 0x13]
rol dword [eax - 0x1e], 0xb0
sub ebx, esp
invalid
jecxz 0x407e45
dec eax
and byte [edi - 0x5f85d5a9], bh
imul esp, dword [ebx], 0x53bbb251
invalid
ret
stc
mov edx, 0x776874b7
fisubr word [ebx]
sbb edi, eax
mov ch, 0xd2
jge 0x407e33
sub al, 0x64
int1
or al, 0x53
jne 0x407e85
or eax, 0xf4c6029d
push esi
call 0xc75d30a8
jb 0x407df0
xchg byte [ebx], dh
clc
sbb dl, dl
cmpsb byte [esi], byte es:[edi]
xor al, 0xbc
pop eax
cmp dl, byte [edi + 0x32f6e65e]
and dword [esi - 0x55e042f0], eax
into
cmp cl, ah
sti
in al, 0x24
mov ebp, 0x475ac34f
in al, 0x4e
sbb al, byte [eax + ebp*2 - 0x4185bb1c]
fist word [edi + eax*4 - 0x72825758]
mov word [eax], ss
test byte [ebx], al
iretd
int3
Function at 0x47a9c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and eax, 1
test al, al
je 0x47a9ef
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x47a9f2
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x47a9d6
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x548d64], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x47a9cb
mov byte [0x549164], 1
mov esp, ebp
pop ebp
ret

Function at 0x47aa20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp byte [0x549164], 0
jne 0x47aa43
call fcn.0047a9c0
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x47aa82
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x14]
and eax, 0xff
mov eax, dword [eax*4 + 0x548d64]
mov edx, dword [ebp - 0x14]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x47aa56
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4c6a58
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4c6a5e
ret
Function at 0x51a9c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and eax, 1
test al, al
je 0x51a9ef
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x51a9f2
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x51a9d6
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x548d64], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x51a9cb
mov byte [0x549164], 1
mov esp, ebp
pop ebp
ret

Function at 0x51aa20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp byte [0x549164], 0
jne 0x51aa43
call fcn.0051a9c0
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x51aa82
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x14]
and eax, 0xff
mov eax, dword [eax*4 + 0x548d64]
mov edx, dword [ebp - 0x14]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x51aa56
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x418730
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x413015
lea edi, [esi - 0x12015]
push edi
jmp 0x41874a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x418751
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x418740
mov eax, 1
add ebx, ebx
jne 0x418763
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x418758
jne 0x418774
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x418758
xor ecx, ecx
sub eax, 3
jb 0x418788
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4187fa
mov ebp, eax
add ebx, ebx
jne 0x418793
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4187a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4187c4
inc ecx
add ebx, ebx
jne 0x4187b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4187a5
jne 0x4187c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4187a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4187e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4187d5
jmp 0x418746
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4187e4
add edi, ecx
jmp 0x418746
pop esi
mov edi, esi
mov ecx, 0xb97
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x418802
cmp byte [edi], 4
jne 0x418802
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x418807
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x418876
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18110]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x418834
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18118]
or eax, eax
je 0x418870
mov dword [ebx], eax
add ebx, 4
jmp 0x418851
call dword [esi + 0x18114]
mov ebp, dword [esi + 0x1811c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4188aa
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x413c39
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x413c5a
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x413c51
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x413c49
mov eax, ebx
leave
ret

Function at 0x413c80
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x413cdf
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x413d0c
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x413cfb
xor ecx, eax
xor edx, ebx
dec edi
jne 0x413cec
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x413d32
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x413cd3
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8