joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101894a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x6c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov dword [0x101aa360], 0x1410
call fcn.10189770
xor ecx, ecx
mov dword [0x101aa35c], 0x163b
mov edx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
lea edx, section..data
mov esi, eax
add esi, 1
imul edi, eax, 0x78
mov ebx, edx
add ebx, edi
add ebx, 0x58
imul eax, eax, 0x78
add edx, eax
add edx, 0x5c
mov eax, dword [edx]
movzx edx, word [ebx]
xor edx, eax
add edx, ecx
cmp esi, 0x407
mov eax, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], esi
jne 0x101894d5
lea eax, [0x1018b17d]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x101aa35c], 0x3bc
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], ecx
call fcn.1018a520
mov dword [0x101aa360], 0x17c9
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.10189090
mov ecx, eax
mov dword [0x101aa378], eax
mov eax, esp
mov edx, dword [ebp - 0x40]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov dword [0x101aa360], 0x1739
mov edx, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
lea edx, section..data
imul esi, eax, 0x78
mov edi, edx
add edi, esi
add edi, 0x5c
mov esi, dword [edi]
imul edi, eax, 0x78
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x78
add edx, ebx
add edx, 0x58
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x4c]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], edx
call fcn.1018a420
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
add eax, ecx
mov edx, dword [ebp - 0x58]
add edx, 1
cmp edx, 0x407
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], edx
jne 0x101895a9
mov dword [0x101aa360], 0x22ea
mov eax, dword [ebp - 0x4c]
add eax, 0x28684
mov ecx, dword [ebp - 0x4c]
add ecx, 0x1d65
mov edx, dword [ebp - 0x4c]
mov dword [esp], edx
mov dword [esp + 4], edx
mov esi, dword [ebp - 0x40]
mov dword [esp + 8], esi
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x68], ecx
call fcn.10189b60
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x64]
mov dword [ecx], edx
mov dword [ecx + 4], 0x13d200
mov edx, dword [ebp - 0x68]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], 0x2020
mov dword [0x101aa35c], 0x1434
add esp, 0x6c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10189690
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [0x101aa35c], 0x2ba
mov dword [0x101aa360], 0xffffe8fe
lea eax, [fcn.10189690]
mov dword [ebp - 4], eax
jmp 0x101896b5
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 8], eax
jne 0x101896e2
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
cmp dword [eax + ecx], 0x4550
jne 0x101896e2
mov eax, dword [ebp - 8]
add esp, 0xc
pop ebp
ret
mov eax, dword [ebp - 8]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [0x101aa35c], 0xfffff2fa
mov dword [ebp - 4], eax
jmp 0x101896b5

Function at 0x1018a260
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [0x101aa35c], 0x9d2
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x3c]
mov dword [0x101aa35c], 0x2420
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], eax
jmp 0x1018a2be
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1018a364
jmp 0x1018a3ab
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x1018a2f5
mov dword [0x101aa360], 0xffffe35a
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
jl 0x1018a2be
mov eax, dword [ebp - 0x20]
mov dword [0x101aa35c], 0x568
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x1018a3ab
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1018a3ab
mov dword [0x101aa35c], 0x23ba
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1018a3ab
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff6
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x64
je 0x1018a2a6
jmp 0x1018a3ab
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1018a3ab
mov eax, dword [0x101aa360]
add eax, 0x1815
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [0x101aa360], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
jne 0x1018a3ab
mov eax, 1
mov dword [0x101aa35c], 0x263b
mov dword [ebp - 0x2c], eax
jmp 0x1018a3ba
xor eax, eax
mov dword [0x101aa360], 0x18b8
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add esp, 0x2c
pop ebp
ret
Function at 0x401012
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x40910f]
shl eax, 2
mov dword [0x409113], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00402860
pop edx
call fcn.00401bfc
call fcn.00402864
push 0
call fcn.0040347c
pop ecx
push 0x4090b8
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x409117], eax
push 0
jmp fcn.00406f30

Function at 0x402554
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x405fb8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x40601a
call fcn.00405f68
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0040297c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0040297c
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x406078
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x40b25c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x406152
cmp dword [0x40b258], 0
jne 0x406152
cmp dword [0x40b44c], 0
je 0x40610c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00405e68
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4060f2
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00405e68
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4060f2
lea ebx, [ebp - 0x84]
jmp 0x4060f3
inc ebx
call fcn.00406034
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x40618d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x40b260
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0040297c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x40b263
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x40618d
cmp dword [0x40b258], 0
je 0x40616c
cmp dword [0x40b258], 0xffffffff
je 0x40618d
push esi
call dword [0x40b258]
pop ecx
mov eax, dword [0x40b25c]
test eax, eax
je 0x40618d
cmp dword [0x40b25c], 0xffffffff
je 0x40618d
cmp byte [eax], 0
je 0x40618d
push esi
push eax
call fcn.00405fb8
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406978
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x40c820], 0
jne 0x4069f9
cmp dword [0x40c840], 0
jne 0x4069a8
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x40c840], eax
test eax, eax
jne 0x4069a8
push str.GetEnvironmentStrings_failed
call fcn.004061a4
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x40c840]
jmp 0x4069bc
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0040297c
pop ecx
mov edi, eax
test eax, eax
jne 0x4069b4
lea edi, [ebp + 1]
push edi
call fcn.00401b0c
pop ecx
mov ebx, eax
mov dword [0x40c824], ebx
test ebx, ebx
jne 0x4069e6
xor eax, eax
jmp 0x406abc
push edi
mov edx, dword [0x40c840]
push edx
push ebx
call fcn.00402868
add esp, 0xc
jmp 0x406a19
xor esi, esi
mov ebx, dword [0x40c820]
jmp 0x406a13
push eax
call fcn.0040297c
pop ecx
test eax, eax
jne 0x406a0f
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x406a03
lea ebx, [esi + 4]
push 4
mov dword [0x40c828], ebx
inc ebx
push ebx
call fcn.0040190c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x406a3c
xor eax, eax
jmp 0x406abc
cmp dword [0x40c820], 0
jne 0x406a6d
xor esi, esi
mov ebx, dword [0x40c824]
mov eax, dword [esp]
mov ebp, eax
jmp 0x406a5e
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0040297c
pop ecx
mov edi, eax
test eax, eax
jne 0x406a54
jmp 0x406a9e
xor esi, esi
mov ebx, dword [0x40c820]
mov eax, dword [esp]
mov edi, eax
jmp 0x406a98
push eax
call fcn.0040297c
pop ecx
test eax, eax
je 0x406a8d
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x406a91
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x406a7c
mov eax, dword [0x40c820]
test eax, eax
je 0x406aae
push eax
call fcn.00401b1c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x40c820], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x401d26
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret

Function at 0x401f90
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x404
mov dword [esp], 0xff
mov esi, esp
lea eax, [esp + 0x204]
push esi
push eax
call dword [str.tt_ru]
cmp dword [esp], 8
jne 0x402061
movzx eax, word [esp + 0x204]
test ax, ax
je 0x402061
mov ecx, 0x47
lea edx, [esp + 0x206]
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul edi, ecx, 0x3983
movzx eax, ax
imul ecx, eax, 0x1177f
xor ecx, edi
movzx eax, word [edx]
add edx, 2
test ax, ax
jne 0x401fe0
cmp ecx, 0x56cf7626
jne 0x402061
mov dword [esp], 0xff
lea eax, [esp + 4]
push esi
push eax
call dword [0x431b84]
cmp dword [esp], 7
jne 0x402061
movzx eax, word [esp + 4]
test ax, ax
je 0x402061
mov ecx, 0x47
lea edx, [esp + 6]
imul esi, ecx, 0x3983
movzx eax, ax
imul ecx, eax, 0x1177f
xor ecx, esi
movzx eax, word [edx]
add edx, 2
test ax, ax
jne 0x402030
cmp ecx, 0xb09406c7
jne 0x402061
push 0xb09406c7
call fcn.00401d30
add esp, 4
xor eax, eax
add esp, 0x404
pop esi
pop edi
ret

Function at 0x402800
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x4028e7
test edx, edx
je 0x4028e7
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x40284a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x402851
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x402830
jmp 0x402853
mov esi, 0x1505
jmp 0x402853
mov esi, ecx
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jb 0x4028e7
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x402884
inc ebx
dec ebp
je 0x4028e5
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x4028e5
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402880
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00415c60
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402880
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00415cf0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402880
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x4028e7
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4028f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
push 0x2e
push edi
call fcn.00410be0
add esp, 8
test eax, eax
je 0x402956
mov ebx, eax
jmp 0x402934
mov edi, ebx
inc edi
push 0x2e
push edi
call fcn.00410be0
add esp, 8
mov ebx, eax
test eax, eax
je 0x402956
mov eax, ebx
sub eax, edi
mov ecx, esi
mov edx, edi
push eax
call fcn.00402800
add esp, 4
xor esi, esi
test eax, eax
je 0x402920
cmp dword [eax + 4], 4
jne 0x402920
mov esi, dword [eax + 8]
jmp 0x402920
xor eax, eax
test esi, esi
je 0x4029b6
test edi, edi
je 0x4029b6
push edi
call fcn.00415c60
add esp, 4
test eax, eax
je 0x40299a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [edi + ebp]
test edx, edx
je 0x4029a1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc ebp
mov ecx, ebx
cmp eax, ebp
jne 0x402980
jmp 0x4029a3
mov ebx, 0x1505
jmp 0x4029a3
mov ebx, ecx
mov dword [esp + 8], eax
mov ecx, dword [esi + 0x20]
lea ebp, [ecx - 1]
mov edx, ecx
sub edx, 1
jae 0x4029be
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov dword [esp], esi
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 4], edx
jmp 0x4029d4
inc ebp
dec ecx
je 0x4029b4
mov eax, ebp
and eax, edx
mov esi, dword [esp + 0x14]
mov esi, dword [esi + eax*4]
cmp esi, 0xffffffff
je 0x4029b4
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + esi*4], ebx
jne 0x4029d0
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 0x10], eax
push eax
mov dword [esp + 0x10], ecx
call fcn.00415c60
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
add esp, 4
cmp eax, dword [esp + 8]
jne 0x4029d0
push dword [esp + 8]
push dword [esp + 0x14]
push edi
call fcn.00415cf0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x4029d0
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + esi*4]
jmp 0x4029b6
Function at 0x402b80
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x402c88
mov esi, edx
test edx, edx
je 0x402c88
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x402c88
push esi
call fcn.00415c60
add esp, 4
test eax, eax
je 0x402bda
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402be1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402bc0
jmp 0x402be3
mov ebp, 0x1505
jmp 0x402be3
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x402c90
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x402c4a
call fcn.00402d80
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x402c88
push ecx
call fcn.00415c60
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x402cff
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402ca8
inc ebx
dec esi
je 0x402bff
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402c04
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402ca0
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00415c60
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402ca0
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00415cf0
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402ca0
mov eax, 0xffffffff
jmp 0x402c88
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402d18
inc ebx
dec esi
je 0x402c45
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402c4a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402d10
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00415c60
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402d10
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00415cf0
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402d10
jmp 0x402c4a
Function at 0x404920
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x404ac6
mov ebp, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebp, ebp
je 0x404abf
mov edx, 0x5e6ea9af
mov eax, ebp
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebp
sub edx, eax
jmp 0x4049aa
add esi, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov eax, edi
mov ebx, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov eax, ecx
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub ebp, dword [esp + 8]
mov edx, 0x15b0
je 0x404abf
xor ebx, ebx
cmp edx, 8
jb 0x404a22
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ebx
mov ebx, edx
movzx edx, byte [esi + eax]
add edx, edi
add ecx, edx
movzx edi, byte [esi + eax + 1]
add edi, edx
add ecx, edi
movzx edx, byte [esi + eax + 2]
add edx, edi
add ecx, edx
movzx edi, byte [esi + eax + 3]
add edi, edx
add ecx, edi
movzx edx, byte [esi + eax + 4]
add edx, edi
add ecx, edx
movzx edi, byte [esi + eax + 5]
add edi, edx
add ecx, edi
movzx edx, byte [esi + eax + 6]
add edx, edi
add ecx, edx
movzx edi, byte [esi + eax + 7]
add edi, edx
mov edx, ebx
add ecx, edi
lea ebx, [eax + 8]
add eax, 0xf
cmp eax, edx
jb 0x4049c0
mov eax, edx
and eax, 0x1ff8
add esi, ebx
mov ebx, eax
mov eax, edx
sub eax, ebx
mov dword [esp + 8], edx
jbe 0x404978
mov dword [esp + 0x10], ebp
mov ebp, ebx
not ebp
add ebp, edx
mov dword [esp], ebp
mov ebp, edx
and ebp, 3
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
je 0x404a73
neg ebp
xor eax, eax
mov ebx, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx]
inc ebx
add edi, edx
add ecx, edi
dec eax
cmp ebp, eax
jne 0x404a60
sub dword [esp + 4], eax
jmp 0x404a75
mov ebx, esi
mov eax, dword [esp]
cmp eax, 3
jb 0x404970
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
xor edx, edx
nop
nop
nop
nop
nop
movzx ebp, byte [ebx + edx]
add ebp, edi
add ecx, ebp
movzx edi, byte [ebx + edx + 1]
add edi, ebp
add ecx, edi
movzx ebp, byte [ebx + edx + 2]
add ebp, edi
add ecx, ebp
movzx edi, byte [ebx + edx + 3]
add edi, ebp
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x404a90
jmp 0x404970
shl ecx, 0x10
or ecx, edi
jmp 0x404acb
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4090b0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40915a
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x40922b
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x40922b
add dword [esi + 0x60], ebx
adc dword [esi + 0x64], 0
mov edx, dword [esi + 0x70]
not edx
cmp ebx, 4
jb 0x40914a
nop
nop
nop
nop
nop
nop
movzx eax, dl
shr edx, 8
movzx ebp, byte [ecx]
xor eax, ebp
xor edx, dword [eax*4 + 0x428db4]
movzx eax, dl
shr edx, 8
movzx ebp, byte [ecx + 1]
xor eax, ebp
xor edx, dword [eax*4 + 0x428db4]
movzx eax, dl
shr edx, 8
movzx ebp, byte [ecx + 2]
xor eax, ebp
xor edx, dword [eax*4 + 0x428db4]
movzx eax, dl
shr edx, 8
movzx ebp, byte [ecx + 3]
xor eax, ebp
xor edx, dword [eax*4 + 0x428db4]
add ecx, 4
add ebx, 0xfffffffc
cmp ebx, 3
ja 0x4090f0
test ebx, ebx
je 0x4091be
mov eax, edx
test bl, 1
jne 0x409164
mov ebp, ebx
cmp ebx, 1
jne 0x409181
jmp 0x4091be
mov eax, 0xffffffff
jmp 0x40922d
shr eax, 8
movzx ebp, byte [ecx]
movzx edx, dl
xor edx, ebp
xor eax, dword [edx*4 + 0x428db4]
inc ecx
lea ebp, [ebx - 1]
mov edx, eax
cmp ebx, 1
je 0x4091be
xor ebx, ebx
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, dl
shr edx, 8
movzx edi, byte [ecx + ebx]
xor eax, edi
xor edx, dword [eax*4 + 0x428db4]
movzx eax, dl
shr edx, 8
movzx edi, byte [ecx + ebx + 1]
xor eax, edi
xor edx, dword [eax*4 + 0x428db4]
add ebx, 2
cmp ebp, ebx
jne 0x409190
not edx
mov dword [esi + 0x70], edx
test byte [esi + 0x50], 0xf
je 0x4091fa
add esi, 0xc8
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, esp
push 0
push 0
push 0
push eax
push dword [esp + 0x2c]
push esi
call fcn.00404cd0
add esp, 0x18
mov ecx, eax
mov eax, 0xfffffff4
cmp ecx, 1
jbe 0x40922b
jmp 0x40922d
mov edi, dword [esp + 0x20]
push edi
push dword [esp + 0x20]
push dword [esi + 0x7c]
push dword [esi + 0x78]
push dword [esi + 0x44]
call dword [esi + 0x3c]
add esp, 0x14
mov ecx, eax
mov eax, 0xfffffff8
cmp ecx, edi
jne 0x40922d
add dword [esi + 0x78], edi
adc dword [esi + 0x7c], 0
add dword [esi + 0x68], edi
adc dword [esi + 0x6c], 0
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40d610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x14]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov edi, dword [str.tr_tr]
mov ebp, ebx
jmp 0x40d634
cmp ebx, ebp
je 0x40d654
mov ebp, dword [ebp]
cmp dword [ebp + 0x18], 0
je 0x40d630
push 0x428a42
push dword [ebp + 0x30]
call edi
test eax, eax
je 0x40d64f
cmp ebx, ebp
jne 0x40d634
mov eax, dword [ebp + 0x18]
jmp 0x40d656
xor eax, eax
push 0xab87776c
push eax
call fcn.0040d690
add esp, 8
push dword [esp + 0x18]
call eax
test esi, esi
je 0x40d67a
push esi
push eax
call fcn.0040d690
add esp, 8
jmp 0x40d67c
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret