joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4699b4
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
mov esi, edx
mov ebx, eax
lea eax, [ebp - 4]
push eax
push esi
mov eax, dword [0x472fe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
push 0x1008
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetFileInfoA
lea eax, [ebx + 0x10]
lea edx, [ebp - 0x158]
mov ecx, 0x104
call fcn.00403c20
mov eax, dword [ebp - 0x160]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 4]
call fcn.0046d3c0
sub esi, 3
je 0x469a48
dec esi
je 0x469a57
sub esi, 0xd
je 0x469a2a
dec esi
je 0x469a39
jmp 0x469a64
lea eax, [ebx + 0xc]
mov edx, 0x469a74
call fcn.00403a44
jmp 0x469a64
lea eax, [ebx + 0xc]
mov edx, 0x469aa8
call fcn.00403a44
jmp 0x469a64
lea eax, [ebx + 0xc]
mov edx, 0x469adc
call fcn.00403a44
jmp 0x469a64
lea eax, [ebx + 0xc]
mov edx, 0x469b38
call fcn.00403a44
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46b77c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.00403e34
push eax
mov eax, esi
call fcn.00403e34
push eax
mov eax, ebx
call fcn.00403e34
push eax
push 0
mov eax, dword [0x472fe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
call fcn.00432d7c
push eax
call sub.shell32.dll_ShellExecuteA
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x46c95c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
xor edx, edx
mov dword [ebp - 0x408], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46c9cb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x400
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x408]
lea edx, [ebp - 0x401]
mov ecx, 0x401
call fcn.00403c20
mov eax, dword [ebp - 0x408]
mov edx, ebx
call fcn.00409cb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c9d2
lea eax, [ebp - 0x408]
call fcn.004039f0
ret
Function at 0x46cacc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403e24
mov eax, dword [ebp - 8]
call fcn.00403e24
mov eax, dword [ebp - 0xc]
call fcn.00403e24
xor eax, eax
push ebp
push 0x46cbe0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00407de0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00403a88
mov eax, dword [ebp + 8]
sub eax, 1
jb 0x46cb32
je 0x46cb39
dec eax
je 0x46cb40
jmp 0x46cb47
mov ebx, 1
jmp 0x46cb4c
mov ebx, 3
jmp 0x46cb4c
mov ebx, 2
jmp 0x46cb4c
mov ebx, 1
push ebx
mov eax, dword [ebp - 0xc]
call fcn.00403e34
push eax
mov eax, dword [ebp - 8]
call fcn.00403e34
push eax
mov eax, dword [ebp - 4]
call fcn.00403e34
push eax
push 0
mov eax, dword [0x472fe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
cmp ebx, 0x20
jge 0x46cbc5
push 0x30
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00408ae0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x20]
xor ecx, ecx
pop eax
call fcn.00408a04
mov eax, dword [ebp - 0x14]
call fcn.00403e34
mov edx, eax
mov ecx, 0x46cbf0
mov eax, dword [0x472fe0]
mov eax, dword [eax]
call fcn.0044af28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cbe7
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403a14
ret

Function at 0x46cbf8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46ccba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402a80
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0xc
mov eax, dword [0x472fe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExA
mov ebx, dword [ebp - 0x1c]
cmp ebx, 0x20
jae 0x46cc9f
push 0x30
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0x44]
mov eax, ebx
call fcn.00408ae0
mov eax, dword [ebp - 0x44]
push eax
xor eax, eax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
lea edx, [ebp - 0x4c]
xor ecx, ecx
pop eax
call fcn.00408a04
mov eax, dword [ebp - 0x40]
call fcn.00403e34
mov edx, eax
mov ecx, 0x46ccc8
mov eax, dword [0x472fe0]
mov eax, dword [eax]
call fcn.0044af28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ccc1
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00403a14
ret
Function at 0x46d094
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46d22e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 0x30]
mov eax, esi
sub eax, 2
jb 0x46d0ec
je 0x46d14d
dec eax
je 0x46d1a9
dec eax
sub eax, 2
jae 0x46d203
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.0046d23c
push eax
mov eax, dword [0x472fe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
push 0x1008
push 0x160
lea eax, [ebp - 0x16c]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebp - 4]
call fcn.0046d3c0
lea eax, [ebx + 0x10]
lea edx, [ebp - 0x160]
mov ecx, 0x104
call fcn.00403c20
mov eax, dword [ebp - 0x168]
mov dword [ebx + 0x28], eax
jmp 0x46d203
lea edx, [ebp - 0x170]
mov eax, 2
call fcn.0046eb24
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 8]
call fcn.00407de0
lea edx, [ebp - 0x174]
mov eax, 0x17
call fcn.0046eb24
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0xc]
call fcn.00407de0
cmp dword [ebp - 8], 0
jne 0x46d19c
lea eax, [ebx + 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00403a44
jmp 0x46d203
lea eax, [ebx + 0x10]
mov edx, dword [ebp - 8]
call fcn.00403a44
jmp 0x46d203
lea edx, [ebp - 0x178]
mov eax, 6
call fcn.0046eb24
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 8]
call fcn.00407de0
lea edx, [ebp - 0x17c]
mov eax, 0x1f
call fcn.0046eb24
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0xc]
call fcn.00407de0
cmp dword [ebp - 8], 0
jne 0x46d1f8
lea eax, [ebx + 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00403a44
jmp 0x46d203
lea eax, [ebx + 0x10]
mov edx, dword [ebp - 8]
call fcn.00403a44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d235
lea eax, [ebp - 0x17c]
mov edx, 4
call fcn.00403a14
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403a14
ret
Function at 0x46e070
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403e24
xor eax, eax
push ebp
push 0x46e233
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x10]
call fcn.00403a88
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov cl, 1
mov edx, dword [ebp - 4]
call fcn.00450108
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebx + 8]
mov edx, 0x46e24c
call fcn.004504a4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebx + 0xc]
mov edx, 0x46e260
call fcn.004504a4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebx + 0x18]
mov edx, 0x46e274
call fcn.004504a4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebx + 0x10]
mov edx, 0x46e284
call fcn.004504a4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebx + 0x28]
mov edx, 0x46e294
call fcn.00450548
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebx + 0x2c]
mov edx, 0x46e2a8
call fcn.00450548
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebx + 0x14]
mov edx, 0x46e2b8
call fcn.004504a4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov cl, byte [ebx + 0x1c]
mov edx, 0x46e2c8
call fcn.0045058c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov cl, byte [ebx + 0x1d]
mov edx, 0x46e2d8
call fcn.0045058c
movzx ecx, word [ebx + 0x34]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x46e2f0
call fcn.00450548
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov cl, byte [ebx + 0x1e]
mov edx, 0x46e300
call fcn.0045058c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov cl, byte [ebx + 0x1f]
mov edx, 0x46e314
call fcn.0045058c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov cl, byte [ebx + 0x20]
mov edx, 0x46e328
call fcn.0045058c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebx + 0x30]
mov edx, 0x46e33c
call fcn.00450548
mov eax, dword [ebx + 4]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x46e1f8
inc edi
xor esi, esi
mov eax, dword [ebp + 8]
push eax
mov edx, esi
mov eax, dword [ebx + 4]
call fcn.0040db84
push eax
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00407f60
mov eax, dword [ebp - 0xc]
pop edx
call fcn.0046e070
pop ecx
inc esi
dec edi
jne 0x46e1d1
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov edx, 0x46e354
call fcn.00403cbc
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov cl, 1
call fcn.00450108
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e23a
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403a14
ret
Function at 0x46eb24
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff824
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x46ebbc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004039f0
lea eax, [ebp - 4]
push eax
push esi
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x46eb80
lea eax, [ebp - 0x7da]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [ebp - 0x7da]
call fcn.004084bc
lea eax, [ebp - 8]
call fcn.004053c4
push eax
push 1
call sub.ole32.dll_CoGetMalloc
call fcn.0040b4fc
test al, al
je 0x46eba6
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ebc3
lea eax, [ebp - 8]
call fcn.004053c4
ret

Function at 0x46f0f6
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffea0
mov ecx, dword [0x472e10]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x4299b4]
call fcn.00438590
mov dword [0x4749e4], eax
push 0x4000
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x46f170
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x46f11b
mov edx, eax
mov eax, dword [0x4749e4]
call fcn.004388ec
mov eax, dword [0x4749e4]
mov byte [eax + 0x36], 1
mov ecx, dword [0x472e10]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x4299b4]
call fcn.00438590
mov dword [0x4749e8], eax
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x46f170
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x46f168
mov edx, eax
mov eax, dword [0x4749e8]
call fcn.004388ec
mov eax, dword [0x4749e8]
mov byte [eax + 0x36], 1
add esp, 0x160
ret
Function at 0x46f174
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x17c], ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x174], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403e24
xor eax, eax
push ebp
push 0x46f305
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040811c
test al, al
jne 0x46f1d5
mov eax, dword [ebp - 4]
call fcn.0045da38
test al, al
jne 0x46f1d5
xor ebx, ebx
jmp 0x46f2df
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 4]
call fcn.00408218
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x170]
call fcn.00407c10
mov eax, dword [ebp - 0x170]
mov edx, 0x46f31c
call fcn.00403d80
je 0x46f237
lea edx, [ebp - 0x17c]
mov eax, dword [ebp - 4]
call fcn.00408218
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x178]
call fcn.00407c10
mov eax, dword [ebp - 0x178]
mov edx, 0x46f32c
call fcn.00403d80
jne 0x46f270
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [ebp - 4]
call fcn.00403e34
push eax
call sub.shell32.dll_ExtractIconExA
test bl, bl
je 0x46f262
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyIcon
jmp 0x46f2df
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_DestroyIcon
jmp 0x46f2df
mov eax, ebx
xor al, 1
and eax, 0xff
xor eax, eax
add eax, 0x4000
xor edx, edx
mov dl, bl
add eax, edx
push eax
push 0x160
lea eax, [ebp - 0x16c]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403e34
push eax
call sub.shell32.dll_SHGetFileInfoA
test bl, bl
je 0x46f2c4
push 0
mov eax, dword [ebp - 0x168]
push eax
mov eax, dword [0x4749e8]
call fcn.00438928
push eax
call sub.comctl32.dll_ImageList_GetIcon
mov ebx, eax
jmp 0x46f2df
push 0
mov eax, dword [ebp - 0x168]
push eax
mov eax, dword [0x4749e4]
call fcn.00438928
push eax
call sub.comctl32.dll_ImageList_GetIcon
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f30c
lea eax, [ebp - 0x17c]
mov edx, 4
call fcn.00403a14
lea eax, [ebp - 4]
call fcn.004039f0
ret

Function at 0x46f528
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.00403e34
push eax
mov eax, esi
call fcn.00403e34
push eax
mov eax, ebx
call fcn.00403e34
push eax
push 0
mov eax, dword [0x472fe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
call fcn.00432d7c
push eax
call sub.shell32.dll_ShellExecuteA
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x405861
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec eax
neg eax
mov dword [esp + ecx - 0x790bb6b], ecx
mov edx, ecx
ror dx, 0xa8
not eax
inc ecx
xchg dword [esp + ecx - 0x790bb6c], ecx
xor ebx, eax
btr edx, edx
adc edi, eax
movsx eax, dl
mov dword [esp + ecx - 0x790bb6f], edx
movzx cx, byte [ecx + ebp - 0x790bb6f]
mov dl, byte [ebp + edx*2 - 0xf20df74]
pop eax
jmp 0x416965

Function at 0x40d3cd
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not ecx
lea ecx, [ecx + edx - 0x35e3526e]
xor byte [esp + edx - 0x667ff4f6], dh
mul dl
sal dword [esp + edx - 0x667ff501], 0x3c
ror ecx, 3
dec eax
rol dx, 0x42
dec ecx
pop edx
xor ebx, ecx
dec byte [esp]
sar edx, 0x8c
adc edx, dword [esp + 4]
add edi, ecx
lea edx, [edx*4 + 0x3491c08d]
neg dx
mov edx, dword [edx + ebp - 0x4369408f]
pop ecx
seto al
xor ax, word [ebp + ecx*2 + 0x3089f4be]
xor cx, 0x4015
rol byte [esp + ecx*2 + 0x30897494], 0xc6
lea ebp, [ecx + ebp + 0x1844ba50]
sbb ecx, dword [esp + ecx*2 + 0x30897494]
mov dword [esp], ecx
bts ecx, 0x97
mov word ss:[edx], ax
not dword [esp]
jae 0x40b5d4
lea eax, [ecx + eax + 0x740f93a5]
setns cl
ror dl, 0x26
ror eax, 2
or ecx, 0xf8b9303a
or word [esp], dx
sbb eax, 0xe012db99
bts ecx, ecx
xchg ecx, edx
lea edx, [ecx + ecx*8 + 0x43112d86]
not eax
jb 0x416d12
call fcn.0041c4e6
rol al, 1
xor ecx, ecx
xadd edx, ecx
xor al, 0x88
or ecx, ecx
not dl
setbe dl
adc al, 0x39
mov eax, ecx
mov dword [esp + eax - 0x24804648], edi
ret
movzx ax, byte [ebp]
mov cl, byte [ebp + 2]
add ebp, 2
mov dword [esp], 0x811a442d
sal dl, 3
pop edx
sal al, cl
sal dx, 0xeb
movsx ecx, dx
lea edx, [edx + ecx - 0x38d2066c]
mov word [edx + ebp - 0x4848c994], ax
xor dl, ch
sal ecx, 0xc5
movsx eax, cl
lea esi, [edx + esi - 0x4848ca00]
add eax, dword [edx + esi - 0x4848c9fc]
shl edx, 0x89
xor eax, ebx
sar ecx, 0x2d
push ecx
jns 0x406da0
jp 0x406959
xor cx, 0x2d16
mov ax, word [ebp + ecx - 0x6330440f]
jae 0x414081
bt dx, ax
xor ebx, ecx
add edi, ecx
neg ax
push eax
or dx, ax
mov dword [esp + edx*2 - 0x78ebeca2], edi
ret
mov cl, byte [ecx + ebp - 0x6330440d]
adc ebp, 4
jmp 0x4092e3
Function at 0x415a4d
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
lea ebp, [edx + ebp - 0x4c123f]
neg dl
rol dx, 0xc1
sub ecx, 0x662d3886
mov word [ebp + edx - 0x4c257e], ax
lea eax, [ecx + ecx*4 + 0x370c7fa0]
lea esi, [edx + esi - 0x4c2582]
mov edx, dword [edx + esi - 0x4c257e]
and cx, ax
ror al, 0x64
cbw
xor edx, ebx
xor edx, 0xa481b63f
dec cx
sub edx, 0x8099ea15
bt ecx, ecx
neg edx
jmp 0x40b70a
push 0x66266f12
push 0x5aa48025
shld eax, edx, cl
mov edx, 0x6831a82b
pop edx
mov dword [ebp + edx - 0x5aa48025], eax
mov dword [esp + edx - 0x5aa48025], edi
ret 8
jns 0x40616d
mov edx, dword [esi + edx*2 - 0x50]
rol cl, 0xe3
sbb word [esp + ecx - 0x5fb016cf], cx
bt ax, ax
xor edx, ebx
push ecx
add eax, dword [esp + eax - 0x74a01c28]
or word [esp + ecx - 0x5fb016cc], 0xbbb2
lea edx, [edx + eax + 0xe59e6a2]
shl eax, cl
not edx
or ecx, ecx
neg edx
xchg byte [esp + ecx - 0x5fb016cb], al
xor eax, eax
bts ecx, 0x99
adc edx, eax
ror cx, 0xea
sal ax, cl
bswap edx
inc al
cbw
xor ebx, edx
add edi, edx
lea edx, [ecx*8 - 0x3c529d0]
dec dl
inc cx
mov eax, dword [ebp + eax*2 - 2]
sal cl, 1
setae byte [esp + ecx - 0x5fb0b488]
mov edx, dword [ebp + ecx - 0x5fb0b488]
ror ecx, cl
mov cl, byte [ecx + ebp - 0x48c5fb03]
dec dword [esp + 2]
add byte [esp + 4], 0x1c
ror word [esp], 0x67
adc ebp, 5
jmp 0x407b3a
sub eax, eax
neg eax
dec edx
sub eax, 0xf21326b4
not cl
seto cl
ror edx, 2
neg edx
cwde
bt ecx, ecx
btc eax, eax
xor ebx, edx
ror eax, 0x70
xor ax, cx
adc edi, edx
cwde
jmp edi
not al
and dl, 0xb3
rol al, 1
xor bl, al
lea eax, [esp + eax + 0xc]
rol cl, 0x47
lea edx, [edx + edx - 0x22584f44]
adc ecx, dword [esp + ecx*2 + 8]
mov cx, word [eax + ecx - 0x206e5cbb]
sbb ebp, 2
mov word [ebp], cx
lea ecx, [edx*4 - 0x50c63251]
shl dl, cl
pop edx
pop ecx
pop ecx
je fcn.00410704
mov eax, 0x74a01c28
push eax
movzx edx, byte [esp + eax - 0x74a01c28]
lea esi, [esi + eax - 0x74a01c2c]
mov ecx, 0x5fb0163a
sub dword [esp + eax - 0x74a01c28], eax
jns 0x40acf5
mov edx, 0x4c22481c
mov ecx, dword [ebp + edx - 0x4c22481c]
sar edx, 0xa8
rol dx, 0x43
mov ax, word ss:[ecx + edx*2 - 0x982482]
jne 0x409bfa
mov eax, dword [esp + edx*8 - 0x3d3e2348]
mov ecx, dword [esp + edx - 0x7a7c457]
push edx
push edx
mov dword [esp + edx*8 - 0x3d3e233c], edx
mov edx, dword [esp + edx*4 - 0x1e9f118c]
call fcn.00419b00
ror eax, 0x79
lea ebp, [eax + ebp - 0x1193fe]
mov word [ebp + eax*4 - 0x465000], cx
movsx edx, word [esp + eax*2 - 0x232800]
call fcn.00416729
sub esi, 4
mov edx, dword [esi]
mov eax, 0x23a44905
rol al, 0x47
mov ecx, eax
xor edx, ebx
rol edx, cl
push eax
bt cx, ax
ror byte [esp + ecx*2 - 0x47489302], cl
lea edx, [edx + eax*2 + 0x746f4db8]
btc cx, cx
xchg word [esp + eax*2 - 0x47489302], ax
cwde
neg edx
not edx
add byte [esp + eax*2 - 0x4652], cl
bswap ecx
xor ebx, edx
btc ecx, ecx
adc edi, edx
pop edx
push eax
add cl, byte [esp + eax*8 - 0x11945]
mov edx, dword [ebp + eax - 0x2329]
xchg dword [esp + eax - 0x2329], ecx
dec ax
mov cx, word [eax + edx - 0x2328]
jge 0x415af9
Function at 0x4087a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
movzx edx, byte [eax + 8]
mov edi, ecx
movzx ecx, byte [eax + 9]
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
mov ebx, dword [ebp + 8]
xor edx, ecx
movzx ecx, byte [eax + 0xa]
imul edx, edx, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x408817
cmp ecx, eax
jne 0x40880f
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x40881f
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x40881f
cmp ecx, eax
jne 0x40881f
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x10
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.0044b829
add esp, 8
mov dword [ebx], esi
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x40e3d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40e3fb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f870
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x40e41d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x40e41f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x40e4a3
jg 0x40e434
test esi, esi
je 0x40e4a3
test ecx, ecx
jl 0x40e47d
jg 0x40e43e
test eax, eax
je 0x40e47d
cmp edi, ecx
jg 0x40e452
jl 0x40e448
cmp esi, eax
jae 0x40e452
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.00462a20
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x40e480
mov edx, dword [ebp + 8]
test edi, edi
jl 0x40e4a3
jg 0x40e48a
test esi, esi
je 0x40e4a3
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x40e4a3
push eax
push esi
push 1
push edx
call fcn.0046c3f3
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40e4c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40e4eb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f790
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x40e50d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x40e50f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x40e5ae
jg 0x40e52c
test esi, esi
je 0x40e5ae
test ecx, ecx
jl 0x40e579
jg 0x40e536
test eax, eax
je 0x40e579
cmp ebx, ecx
jg 0x40e54a
jl 0x40e540
cmp esi, eax
jae 0x40e54a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.00462a20
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x40e580
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x40e5ae
jg 0x40e58a
test esi, esi
je 0x40e5ae
cmp dword [edi + 0x4c], 0
je 0x40e5ae
mov ecx, edi
call fcn.0040ecc0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.0046c63c
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc