joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4586c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4a20
mov eax, dword fs:[0]
push eax
push ebx
mov eax, dword [0x68e500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
movups xmmword [ecx + 0x10], xmm0
movq qword [ecx + 0x20], xmm0
mov dword [ecx + 0x28], 0
mov eax, dword [eax]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebx + 0xc]
mov dword [ecx], 0x10000000
mov dword [ecx + 4], 4
mov eax, dword [eax]
mov dword [ecx + 0x30], eax
mov eax, dword [ecx + 4]
and eax, 0xfffffff
or eax, 0x10000000
mov dword [ecx + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [ecx + 8], 8
mov eax, dword [eax]
mov dword [ecx + 0x34], eax
mov eax, dword [ecx + 8]
and eax, 0xfffffff
or eax, 0x10000000
mov dword [ecx + 8], eax
mov eax, dword [ebx + 0x14]
mov dword [ecx + 0xc], 0xc
mov eax, dword [eax]
mov dword [ecx + 0x38], eax
mov eax, dword [ecx + 0xc]
and eax, 0xfffffff
or eax, 0x10000000
mov dword [ecx + 0xc], eax
mov eax, dword [ebx + 0x18]
mov dword [ecx + 0x10], 0x10
mov al, byte [eax]
mov byte [ecx + 0x3c], al
mov eax, dword [ecx + 0x10]
and eax, 0xfffffff
or eax, 0x50000000
mov dword [ecx + 0x10], eax
mov eax, dword [ebx + 0x1c]
mov edx, eax
mov dword [ecx + 0x14], 0x11
cmp dword [eax + 0x14], 0xf
jbe 0x4587aa
mov edx, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ecx + 0x41], eax
mov dword [ecx + 0x3d], edx
mov eax, dword [ecx + 0x14]
and eax, 0xfffffff
or eax, 0xc0000000
mov dword [ecx + 0x14], eax
mov eax, dword [ebx + 0x20]
mov edx, eax
mov dword [ecx + 0x18], 0x19
cmp dword [eax + 0x14], 0xf
jbe 0x4587d7
mov edx, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ecx + 0x49], eax
mov dword [ecx + 0x45], edx
mov eax, dword [ecx + 0x18]
and eax, 0xfffffff
or eax, 0xc0000000
mov dword [ecx + 0x18], eax
mov eax, dword [ebx + 0x24]
mov edx, eax
mov dword [ecx + 0x1c], 0x21
cmp dword [eax + 0x14], 0xf
jbe 0x458804
mov edx, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ecx + 0x51], eax
mov dword [ecx + 0x4d], edx
mov eax, dword [ecx + 0x1c]
and eax, 0xfffffff
or eax, 0xc0000000
mov dword [ecx + 0x1c], eax
mov eax, dword [ebx + 0x28]
mov dword [ecx + 0x20], 0x29
mov dword [ecx + 0x55], eax
mov eax, dword [ecx + 0x20]
and eax, 0xfffffff
or eax, 0xb0000000
mov dword [ecx + 0x20], eax
mov eax, dword [ebx + 0x2c]
mov edx, eax
mov dword [ecx + 0x24], 0x2d
cmp dword [eax + 0x14], 0xf
jbe 0x45884e
mov edx, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ecx + 0x5d], eax
mov dword [ecx + 0x59], edx
mov eax, dword [ecx + 0x24]
and eax, 0xfffffff
or eax, 0xc0000000
mov dword [ecx + 0x24], eax
mov eax, dword [ebx + 0x30]
mov dword [ecx + 0x28], 0x35
mov eax, dword [eax]
mov dword [ecx + 0x61], eax
mov eax, dword [ecx + 0x28]
and eax, 0xfffffff
or eax, 0x10000000
mov dword [ecx + 0x28], eax
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x2c
Function at 0x4667c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov esi, edx
mov dword [ebp - 8], edx
lea eax, [ecx - 1]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], eax
mov edi, edx
sar eax, 1
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x18], eax
cmp edx, eax
jge 0x466862
nop word [eax + eax]
add edi, edi
lea ecx, [edi + 2]
lea eax, [ecx*8]
sub eax, ecx
lea esi, [ebx + eax*4]
lea ebx, [esi - 0x1c]
mov edx, esi
push ebx
call fcn.00466030
movzx ecx, al
add esp, 4
xor ecx, 1
inc ecx
add edi, ecx
mov ecx, dword [ebp - 8]
test al, al
cmove ebx, esi
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [ebp - 4]
lea ecx, [ecx + eax*4]
mov eax, dword [ebx]
mov dword [ecx], eax
lea eax, [ebx + 4]
push eax
add ecx, 4
call fcn.00409bc0
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], edi
cmp edi, eax
jl 0x466800
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0xc], edi
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
jne 0x46689f
mov edx, dword [ebp - 0x1c]
mov edi, ecx
test dl, 1
jne 0x46689f
lea eax, [edx*8]
sub eax, edx
lea edx, [ebx + eax*4]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [ebx + eax*4]
mov eax, dword [edx - 0x1c]
mov dword [ecx], eax
lea eax, [edx - 0x18]
push eax
add ecx, 4
call fcn.00409bc0
mov edi, dword [ebp - 0x20]
cmp esi, edi
jge 0x4668f0
jmp 0x4668a8
mov ebx, dword [ebp - 4]
push dword [ebp - 0x14]
lea esi, [edi - 1]
sar esi, 1
lea eax, [esi*8]
sub eax, esi
lea ebx, [ebx + eax*4]
mov edx, ebx
call fcn.00466030
add esp, 4
test al, al
je 0x4668f0
mov ecx, dword [ebp - 4]
lea eax, [edi*8]
sub eax, edi
lea ecx, [ecx + eax*4]
mov eax, dword [ebx]
mov dword [ecx], eax
lea eax, [ebx + 4]
push eax
add ecx, 4
call fcn.00409bc0
mov edi, esi
cmp dword [ebp - 0x10], esi
jl 0x4668a5
mov edx, dword [ebp - 0x14]
lea eax, [edi*8]
mov ecx, dword [ebp - 4]
sub eax, edi
lea ecx, [ecx + eax*4]
mov eax, dword [edx]
mov dword [ecx], eax
lea eax, [edx + 4]
push eax
add ecx, 4
call fcn.00409bc0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov dword [ebp - 8], edx
lea eax, [ecx - 1]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], eax
sar eax, 1
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x18], eax
cmp edx, eax
jge 0x4669b1
add edi, edi
lea ecx, [edi + 2]
lea eax, [ecx*8]
sub eax, ecx
lea esi, [ebx + eax*4]
lea ebx, [esi - 0x1c]
mov edx, esi
push ebx
call fcn.00466120
movzx ecx, al
add esp, 4
xor ecx, 1
inc ecx
add edi, ecx
mov ecx, dword [ebp - 8]
test al, al
cmove ebx, esi
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [ebp - 4]
push ebx
lea esi, [ecx + eax*4]
mov ecx, esi
call fcn.00409bc0
mov eax, dword [ebx + 0x18]
mov ebx, dword [ebp - 4]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], edi
cmp edi, eax
jl 0x466954
mov dword [ebp - 0xc], edi
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
jne 0x4669ee
mov edx, dword [ebp - 0x1c]
mov edi, ecx
test dl, 1
jne 0x4669ee
lea eax, [edx*8]
sub eax, edx
add eax, 0xfffffff9
lea edi, [ebx + eax*4]
lea eax, [ecx*8]
sub eax, ecx
push edi
lea esi, [ebx + eax*4]
mov ecx, esi
call fcn.00409bc0
mov eax, dword [edi + 0x18]
mov edi, dword [ebp - 0x20]
mov dword [esi + 0x18], eax
cmp dword [ebp - 0x10], edi
jge 0x466a3e
jmp 0x4669f8
mov ebx, dword [ebp - 4]
push dword [ebp - 0x14]
lea esi, [edi - 1]
sar esi, 1
lea eax, [esi*8]
sub eax, esi
lea ebx, [ebx + eax*4]
mov edx, ebx
call fcn.00466120
add esp, 4
test al, al
je 0x466a3e
mov ecx, dword [ebp - 4]
lea eax, [edi*8]
sub eax, edi
push ebx
lea edi, [ecx + eax*4]
mov ecx, edi
call fcn.00409bc0
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x18], eax
mov edi, esi
cmp dword [ebp - 0x10], esi
jl 0x4669f5
mov ecx, dword [ebp - 4]
lea eax, [edi*8]
mov ebx, dword [ebp - 0x14]
sub eax, edi
push ebx
lea esi, [ecx + eax*4]
mov ecx, esi
call fcn.00409bc0
mov eax, dword [ebx + 0x18]
pop edi
mov dword [esi + 0x18], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4678b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eb471
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x68e500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x18]
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov al, byte [esi + 0x14]
mov byte [edi + 0x14], al
lea eax, [esi + 0x18]
push eax
call fcn.00409c90
lea eax, [esi + 0x30]
mov dword [ebp - 4], 0
lea ecx, [edi + 0x30]
push eax
call fcn.00409c90
lea eax, [esi + 0x48]
mov byte [ebp - 4], 1
lea ecx, [edi + 0x48]
push eax
call fcn.00409c90
lea eax, [esi + 0x60]
mov byte [ebp - 4], 2
lea ecx, [edi + 0x60]
push eax
call fcn.00409c90
lea eax, [esi + 0x78]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x78]
call fcn.00409c90
mov eax, dword [esi + 0x90]
mov dword [edi + 0x90], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x46b4a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x46b501
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x46b4e4
cmp edi, 2
jb 0x46b4e4
cmp byte [esi], cl
jne 0x46b4e4
cmp byte [esi + 1], cl
jne 0x46b4e4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x675e80]
jmp 0x46b4b5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x675e80]
test edi, edi
jne 0x46b4b5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x46b530
cmp cl, 0x23
jne 0x46b517
cmp byte [esi], cl
jne 0x46b517
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x675e80]
test cl, cl
jne 0x46b508
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x46b640
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x46b653
mov dword [ebx], 0
mov edx, 0x675b90
call fcn.0046b540
mov esi, eax
test esi, esi
je 0x46b730
push esi
call fcn.005bf498
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x46b727
push 2
push 0
push esi
call fcn.005bea45
add esp, 0xc
test eax, eax
jne 0x46b727
push esi
call fcn.005bf498
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x46b727
push 0
push dword [ebp + 8]
push esi
call fcn.005bea45
add esp, 0xc
test eax, eax
jne 0x46b727
mov eax, dword [0x693270]
test eax, eax
je 0x46b6c6
inc dword [eax + 0xb0]
push edi
call fcn.005b115b
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x46b727
push esi
push edi
push 1
push eax
call fcn.005b9bc8
add esp, 0x10
push esi
cmp eax, edi
je 0x46b711
call fcn.005b17b3
mov eax, dword [0x693270]
add esp, 4
test eax, eax
je 0x46b6ff
dec dword [eax + 0xb0]
push dword [ebp + 8]
call fcn.005b0eba
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.005b17b3
add esp, 4
test ebx, ebx
je 0x46b71f
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.005b17b3
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x46eab0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x68e500]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x18]
mov edi, 0x10
movss xmm1, dword [edx + 0x100]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x104]
subss xmm0, xmm1
mov ecx, dword [edx + 0xe4]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xec]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 0xc], xmm0
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x675e80]
sub edi, 1
jne 0x46eb30
mov ecx, dword [ebp - 8]
not edx
pop edi
xor ecx, ebp
mov eax, edx
pop esi
call fcn.005aa453
mov esp, ebp
pop ebp
ret 4

Function at 0x470b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x693270]
mov ebx, edx
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
mov eax, dword [esi + 0x1ae8]
mov edx, dword [eax]
inc dword [esi + 0xa8]
mov ecx, dword [edi + 0x264]
mov dword [ebp - 4], edx
cmp dword [ecx + 0x7c], 1
jle 0x470bbf
push ecx
add ecx, 0x78
call fcn.004859e0
mov edx, dword [ebp - 4]
mov edi, dword [edi + 0x264]
mov esi, dword [edx + ebx*4 + 0x70]
mov eax, dword [edi]
test eax, eax
je 0x470c32
cmp eax, 1
jne 0x470be3
mov eax, dword [edi + 8]
cmp dword [eax + 0x1c], 0
jne 0x470be3
cmp dword [eax + 0x20], 0
je 0x470c32
mov eax, dword [esi]
mov ecx, dword [esi + 4]
cmp eax, ecx
jne 0x470c19
lea edx, [eax + 1]
mov dword [ebp - 8], edx
test ecx, ecx
je 0x470c04
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [ebp - 8]
sar eax, 1
add eax, ecx
jmp 0x470c09
mov eax, 8
cmp eax, edx
mov ecx, esi
cmovg edx, eax
push edx
call fcn.00480c60
mov edx, dword [ebp - 4]
mov ecx, dword [esi]
mov eax, dword [esi + 8]
mov dword [eax + ecx*4], edi
inc dword [esi]
inc dword [edx + 0x3c]
mov eax, dword [edi + 0x18]
add dword [edx + 0x44], eax
mov eax, dword [edi + 0xc]
add dword [edx + 0x40], eax
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + 0x188]
mov eax, dword [eax + 0x180]
lea edi, [esi + eax*4]
cmp esi, edi
je 0x470c72
nop dword [eax + eax]
mov ecx, dword [esi]
cmp byte [ecx + 0xaa], 0
je 0x470c6b
cmp byte [ecx + 0xb1], 0
jne 0x470c6b
mov edx, ebx
call fcn.00470b80
add esi, 4
cmp esi, edi
jne 0x470c50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471e70
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [0x693270]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov ebx, dword [esi + 0x1160]
mov ecx, ebx
mov dword [ebp - 8], edx
mov eax, dword [ebx + 0xc]
and eax, 4
or eax, 0x1000103
or edi, eax
cmp dword [ebx + 0x190], 0
mov dword [ebp + 0x10], edi
jne 0x471eb7
cmp dword [esi + 0x1d24], 0
mov eax, 0x228
je 0x471ebc
mov eax, 0x1f8
movss xmm4, dword [eax + ebx]
xorps xmm3, xmm3
movss xmm5, dword [eax + ebx + 4]
subss xmm4, dword [ecx + 0xf0]
subss xmm5, dword [ecx + 0xf4]
mov ecx, dword [ebp + 8]
movss xmm2, dword [0x67acf4]
mov dword [ebp + 8], 0
mov dword [ebp - 4], 2
cvttss2si eax, dword [ecx]
movd xmm1, eax
cvttss2si eax, dword [ecx + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
lahf
xor ecx, ecx
test ah, 0x44
mov eax, 1
cmovnp ecx, eax
ucomiss xmm0, xmm3
lahf
test ah, 0x44
mov eax, dword [ebp + 8]
cmovnp eax, dword [ebp - 4]
or eax, ecx
comiss xmm3, xmm1
mov dword [ebp + 8], eax
jb 0x471f3f
addss xmm1, xmm4
comiss xmm1, xmm2
jae 0x471f3f
movaps xmm1, xmm2
comiss xmm3, xmm0
jb 0x471f50
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x471f50
movaps xmm0, xmm2
or dword [esi + 0x1a10], 2
mov ecx, dword [ebp - 0xc]
movss dword [esi + 0x1a30], xmm1
movss dword [esi + 0x1a34], xmm0
mov dword [esi + 0x1a18], 1
mov eax, dword [ebx + 4]
push edx
test ecx, ecx
je 0x471f93
push ecx
push eax
push str._s__s__08X
lea eax, [ebp - 4]
push 0
push eax
call fcn.0046b3f0
add esp, 0x18
jmp 0x471fa7
push eax
push str._s__08X
lea eax, [ebp - 4]
push 0
push eax
call fcn.0046b3f0
add esp, 0x14
cmp byte [ebp + 0xc], 0
movss xmm0, dword [esi + 0xab8]
movss dword [ebp - 0xc], xmm0
jne 0x471fc4
mov dword [esi + 0xab8], 0
mov ecx, dword [ebp - 4]
xor edx, edx
push edi
call fcn.004745d0
mov edi, dword [esi + 0x1160]
add esp, 4
movss xmm0, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
movss dword [esi + 0xab8], xmm0
cmp word [edi + 0xb6], 1
mov byte [ebp + 0xf], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], edi
mov dword [edi + 0x74], edx
mov byte [edi + 0xc6], al
jne 0x472016
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ebx + 0xf0], ecx
mov dword [ebx + 0xf4], eax
mov edi, edx
mov al, 0x23
not edi
mov edx, 0x675b05
mov ebx, edi
cmp al, 0x23
jne 0x472031
cmp byte [edx], al
jne 0x472031
cmp byte [edx + 1], al
cmove ebx, edi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x675e80]
test al, al
jne 0x472023
mov edi, dword [ebp - 0xc]
not ebx
cmp dword [esi + 0x11ac], ebx
jne 0x47205c
call fcn.0046ec40
mov eax, dword [ebp - 8]
cmp dword [esi + 0x1af8], eax
jne 0x4720aa
test dword [ebp + 0x10], 0x800000
jne 0x4720aa
cmp word [edi + 0x14c], 0
jne 0x472083
cmp byte [edi + 0x152], 0
je 0x4720aa
xor edx, edx
mov ecx, edi
call fcn.00477170
xor dl, dl
mov ecx, edi
call fcn.0047c1d0
mov edx, edi
mov ecx, ebx
call fcn.0046eb60
mov eax, dword [esi + 0x1b1c]
mov dword [esi + 0x11cc], eax
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x477b10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x68e500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x693270]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1160]
mov esi, 4
mov eax, dword [edi + 0xe4]
add edi, 0xe4
mov dword [ebp - 8], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x675e80]
sub esi, 1
jne 0x477b50
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x477b97
inc ecx
test esi, esi
je 0x477b85
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x477b8a
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.00480c60
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005aa453
mov esp, ebp
pop ebp
ret
Function at 0x482c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x482c96
mov eax, dword [0x693270]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x482c86
dec dword [eax + 0xb0]
push ecx
call fcn.005b0eba
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x482cca
mov eax, dword [0x693270]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x482cba
dec dword [eax + 0xb0]
push ecx
call fcn.005b0eba
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x482cfe
mov eax, dword [0x693270]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x482cee
dec dword [eax + 0xb0]
push ecx
call fcn.005b0eba
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x482d4e
mov eax, dword [0x693270]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x482d3e
dec dword [eax + 0xb0]
push ecx
call fcn.005b0eba
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x482d82
mov eax, dword [0x693270]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x482d72
dec dword [eax + 0xb0]
push ecx
call fcn.005b0eba
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x482db6
mov eax, dword [0x693270]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x482da6
dec dword [eax + 0xb0]
push ecx
call fcn.005b0eba
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00485790
Function at 0x4aafe0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1394
call fcn.005ab330
mov eax, dword [0x68e500]
xor eax, esp
mov dword [esp + 0x1390], eax
push ebx
push esi
mov ebx, ecx
push edi
mov edi, edx
mov dword [esp + 0xc], ebx
call fcn.00597ec8
mov dword [esp + 0x1394], 0xffffffff
mov esi, 1
mov dword [esp + 0x14], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, esi
mov dword [esp + esi*4 + 0x14], eax
inc esi
cmp esi, 0x270
jb 0x4ab022
lea eax, [ebx - 0x80000000]
mov dword [esp + 0x10], 0x270
add ebx, 0x80000000
lea esi, [edi - 0x80000000]
cmp dword [esp + 0xc], 0x80000000
lea ecx, [esp + 0x10]
cmovae ebx, eax
cmp edi, 0x80000000
lea eax, [edi - 0x80000000]
cmovae esi, eax
sub esi, ebx
cmp esi, 0xffffffff
jne 0x4ab086
call fcn.004ae4f0
mov ecx, eax
jmp 0x4ab0c1
inc esi
call fcn.004ae4f0
mul esi
mov dword [esp + 0xc], eax
mov ecx, edx
cmp eax, esi
jae 0x4ab0c1
mov eax, esi
xor edx, edx
neg eax
div esi
mov edi, edx
cmp dword [esp + 0xc], edi
jae 0x4ab0c1
nop dword [eax + eax]
lea ecx, [esp + 0x10]
call fcn.004ae4f0
mul esi
mov ecx, edx
cmp eax, edi
jb 0x4ab0b0
add ecx, ebx
cmp ecx, 0x80000000
pop edi
pop esi
lea edx, [ecx - 0x80000000]
lea eax, [ecx - 0x80000000]
mov ecx, dword [esp + 0x1394]
cmovae eax, edx
pop ebx
xor ecx, esp
call fcn.005aa453
mov esp, ebp
pop ebp
ret

Function at 0x4ab7f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4ab882
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x4ab80d
mov eax, dword [esi]
push edi
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 4], eax
lea ecx, [eax + eax]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4ab87b
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi + 0x14], 0xf
jbe 0x4ab846
mov esi, dword [esi]
push dword [ebp - 4]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x4ab87b
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ae4f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x4ae54d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x4ae510
mov eax, dword [esi]
jmp 0x4ae627
cmp eax, 0x4e0
jb 0x4ae627
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x4ae566
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
nop
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x4ae5b0
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret