joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd5e0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
movsx eax, byte [esi + 8]
cmp eax, 5
ja case.0x4bd390.4
jmp dword [eax*4 + 0x4bd498]
mov eax, dword [esi]
mov edx, dword [esi + 4]
pop esi
ret
call fcn.004bde90
test al, al
jne case.0x4bd390.1
jmp 0x4bd3f0
mov edx, SysReAllocStringLen
xor ecx, ecx
call fcn.004dbced
movsd xmm1, qword [esi]
comisd xmm1, xmm0
jb 0x4bd42f
mov edx, SysReAllocString
or ecx, 0xffffffff
call fcn.004dbced
movsd xmm1, qword [esi]
comisd xmm0, xmm1
jb 0x4bd42f
movapd xmm0, xmm1
pop esi
jmp fcn.004dbb4d
xor eax, eax
xor edx, edx
pop esi
ret
xor eax, eax
cmp byte [esi], al
pop esi
setne al
cdq
ret
movdqu xmm0, xmmword [str.LargestUInt_out_of_Int64_range]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movq xmm0, qword [0x503ea4]
movq qword [ecx + 0x10], xmm0
mov eax, dword [0x503eac]
mov dword [ecx + 0x18], eax
mov ax, word [0x503eb0]
mov word [ecx + 0x1c], ax
mov al, byte [0x503eb2]
mov byte [ecx + 0x1e], al
call fcn.004dae39
movdqu xmm0, xmmword [str.double_out_of_Int64_range]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movq xmm0, qword [0x503ec4]
movq qword [ecx + 0x10], xmm0
mov ax, word [0x503ecc]
mov word [ecx + 0x18], ax
call fcn.004dae39
movdqu xmm0, xmmword [str.Value_is_not_convertible_to_Int64.]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movdqu xmm0, xmmword [0x503ee0]
movdqu xmmword [ecx + 0x10], xmm0
mov ax, word [0x503ef0]
mov word [ecx + 0x20], ax
mov al, byte [0x503ef2]
mov byte [ecx + 0x22], al
call fcn.004dae39
lea ecx, [ecx]
loopne 0x4bd46d
dec ebx
add byte [edi - 0x61ffb42d], dl
ror dword [ebx], cl
test eax, 0x5e004bd3
aam 75
add dh, ah
ror dword [ebx], cl
jmp 0x4bd380
Function at 0x4bd5f0
Capabilities:
Terminate process

Disassembly:
jmp 0x4bd600
push esi
mov esi, ecx
movsx eax, byte [esi + 8]
cmp eax, 5
ja case.0x4bd610.4
jmp dword [eax*4 + 0x4bd708]
call fcn.004be080
test al, al
je 0x4bd664
mov eax, dword [esi]
mov edx, dword [esi + 4]
pop esi
ret
movsd xmm0, qword [esi]
comisd xmm0, xmmword [0x52bfa0]
jb 0x4bd6a3
or edx, 0xffffffff
or ecx, 0xffffffff
call fcn.004dbc5c
movsd xmm1, qword [esi]
comisd xmm0, xmm1
jb 0x4bd6a3
movapd xmm0, xmm1
pop esi
jmp fcn.004dbb3e
xor eax, eax
xor edx, edx
pop esi
ret
xor eax, eax
cmp byte [esi], al
pop esi
setne al
cdq
ret
movdqu xmm0, xmmword [str.LargestInt_out_of_UInt64_range]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movq xmm0, qword [0x503f04]
movq qword [ecx + 0x10], xmm0
mov eax, dword [0x503f0c]
mov dword [ecx + 0x18], eax
mov ax, word [0x503f10]
mov word [ecx + 0x1c], ax
mov al, byte [0x503f12]
mov byte [ecx + 0x1e], al
call fcn.004dae39
movdqu xmm0, xmmword [str.double_out_of_UInt64_range]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movq xmm0, qword [0x503f24]
movq qword [ecx + 0x10], xmm0
mov ax, word [0x503f2c]
mov word [ecx + 0x18], ax
mov al, byte [0x503f2e]
mov byte [ecx + 0x1a], al
call fcn.004dae39
movdqu xmm0, xmmword [str.Value_is_not_convertible_to_UInt64.]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movdqu xmm0, xmmword [0x503f40]
movdqu xmmword [ecx + 0x10], xmm0
mov eax, dword [0x503f50]
mov dword [ecx + 0x20], eax
call fcn.004dae39
nop
push esp
salc
dec ebx
add byte [edi], dl
salc
dec ebx
add byte [eax], ah
salc
dec ebx
add byte [edi], ah
salc
dec ebx
add dl, bl
salc
dec ebx
add byte [edx - 0x2a], bl
dec ebx
add byte [esi - 0x75], dl
push esi
mov esi, ecx
Function at 0x4bd720
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
movsx eax, byte [esi + 8]
cmp eax, 5
ja case.0x4bd730.4
jmp dword [eax*4 + 0x4bd84c]
call fcn.004be0e0
test al, al
je 0x4bd782
mov eax, dword [esi]
pop esi
ret
call fcn.004be0e0
test al, al
jne 0x4bd740
jmp 0x4bd7b7
movsd xmm0, qword [esi]
comisd xmm0, xmmword [0x52bfa0]
jb 0x4bd7ee
movsd xmm1, qword [0x503fa8]
comisd xmm1, xmm0
jb 0x4bd7ee
pop esi
jmp fcn.004dbb2f
xor eax, eax
pop esi
ret
xor eax, eax
cmp byte [esi], al
pop esi
setne al
ret
movdqu xmm0, xmmword [str.LargestInt_out_of_UInt_range]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movq xmm0, qword [0x503e24]
movq qword [ecx + 0x10], xmm0
mov eax, dword [0x503e2c]
mov dword [ecx + 0x18], eax
mov al, byte [0x503e30]
mov byte [ecx + 0x1c], al
call fcn.004dae39
movdqu xmm0, xmmword [str.LargestUInt_out_of_UInt_range]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movq xmm0, qword [0x503e44]
movq qword [ecx + 0x10], xmm0
mov eax, dword [0x503e4c]
mov dword [ecx + 0x18], eax
mov ax, word [0x503e50]
mov word [ecx + 0x1c], ax
call fcn.004dae39
movdqu xmm0, xmmword [str.double_out_of_UInt_range]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movq xmm0, qword [0x503e64]
movq qword [ecx + 0x10], xmm0
mov al, byte [0x503e6c]
mov byte [ecx + 0x18], al
call fcn.004dae39
movdqu xmm0, xmmword [str.Value_is_not_convertible_to_UInt.]
mov ecx, 0x29a
push 0x7b
add al, byte [eax]
add byte [edx + 0x7b], ch
movdqu xmmword [ecx], xmm0
movdqu xmm0, xmmword [0x503e80]
movdqu xmmword [ecx + 0x10], xmm0
mov ax, word [0x503e90]
mov word [ecx + 0x20], ax
call fcn.004dae39
mov edi, edi
jne 0x4bd825
inc ecx
adc byte [esi - 0x5f], ah
nop
push eax
add byte [esi - 0x77], ah
inc ecx
and al, ch
out dx, eax
aad 1
add byte [ebx + 0x4bd775ff], cl
dec ebx
add byte [edi], dh
xlatb
dec ebx
add byte [edi + edx*8 + 0x4b], al
add byte [edi - 0x29], cl
dec ebx
add byte [ebx], bl
fmul dword [ebx]
jns 0x4bd839
dec ebx
add ah, cl
int3

Function at 0x4bd870
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp esi, 0xffffffff
jne 0x4bd88c
mov esi, dword [ebp + 8]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4bd883
sub esi, ecx
mov eax, SysReAllocString
cmp esi, 0x7fffffff
cmovae esi, eax
lea eax, [esi + 1]
push eax
call fcn.004d833a
mov edi, eax
add esp, 4
test edi, edi
je 0x4bd8c3
push esi
push dword [ebp + 8]
push edi
call fcn.004db0a0
add esp, 0xc
mov byte [edi + esi], 0
mov eax, edi
pop edi
pop esi
pop ebp
ret
movdqu xmm0, xmmword [0x503d58]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movdqu xmm0, xmmword [0x503d68]
movdqu xmmword [ecx + 0x10], xmm0
mov eax, dword [0x503d78]
mov dword [ecx + 0x20], eax
mov ax, word [0x503d7c]
mov word [ecx + 0x24], ax
mov al, byte [0x503d7e]
mov byte [ecx + 0x26], al
call fcn.004dae39
int3
Function at 0x4be320
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x4be335
push eax
call fcn.004d6e42
add esp, 4
mov ecx, dword [ebp + 8]
mov al, byte [ecx]
test al, al
je 0x4be342
cmp al, 0x2f
jne 0x4be354
push 0xffffffffffffffff
push ecx
call fcn.004bd870
add esp, 8
mov dword [esi], eax
pop esi
pop ebp
ret 4
movdqu xmm0, xmmword [str.Comments_must_start_with__]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movq xmm0, qword [0x503d90]
movq qword [ecx + 0x10], xmm0
mov ax, word [0x503d98]
mov word [ecx + 0x18], ax
mov al, byte [0x503d9a]
mov byte [ecx + 0x1a], al
call fcn.004dae39
int3
Function at 0x4eac75
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5415b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004dcc9f
mov dword [ebp - 0x14], eax
cmp dword [0x547614], esi
jne 0x4ead68
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4eacf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4eae48
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4eae48
push 0x506ac8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4eae48
push eax
call ebx
push 0x506ad4
push edi
mov dword [0x547614], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x547618], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x54761c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x547624], eax
test eax, eax
je 0x4ead65
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x547620], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4ead8d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4ead80
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4eada2
push 4
pop eax
jmp 0x4eae4a
cmp dword [ebp - 0x14], esi
je 0x4eada2
push dword [0x547614]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4ead87
mov eax, dword [0x547620]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4eae00
cmp dword [0x547624], edi
je 0x4eae00
push eax
call ebx
push dword [0x547624]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4eae00
test eax, eax
je 0x4eae00
call ecx
test eax, eax
je 0x4eadf5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4eadf5
test byte [ebp - 8], 1
jne 0x4eae00
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4eae30
mov eax, dword [0x547618]
cmp eax, edi
je 0x4eae2d
push eax
call ebx
test eax, eax
je 0x4eae2d
call eax
mov esi, eax
test esi, esi
je 0x4eae2d
mov eax, dword [0x54761c]
cmp eax, edi
je 0x4eae2d
push eax
call ebx
test eax, eax
je 0x4eae2d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x547614]
call ebx
test eax, eax
je 0x4eae48
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4eae4a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5e2a
mov esp, ebp
pop ebp
ret
Function at 0x42295b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42299a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42299a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42299a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42299a
cmp dword [ecx + 0x74], 0xe
jbe 0x42299a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42a0fb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42a198
push ebx
push esi
call fcn.0042a0c4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042a058
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42a145
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42a197
push edi
push eax
call fcn.00428b90
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42a165
call fcn.00428bde
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42a196
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042a058
add esp, 0x20
test eax, eax
jne 0x42a184
push edi
call fcn.00428bde
jmp 0x42a18c
push ebx
call fcn.00428bde
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42b3a7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x433eb0
push 0x433ea8
push str.FlsAlloc
push 0x1f
call fcn.0042b266
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b3db
push dword [ebp + 8]
mov ecx, esi
call dword [0x431144]
call esi
jmp 0x42b3e1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42b425
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x433ec0
push 0x433eb8
push str.FlsGetValue
push 0x21
call fcn.0042b266
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b45c
push dword [ebp + 8]
mov ecx, esi
call dword [0x431144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42b464
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x433ec8
push 0x433ec0
push str.FlsSetValue
push 0x22
call fcn.0042b266
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b49e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x431144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x430770
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43079d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43079d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401c80
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [edx]
mov byte [ecx], al
movzx eax, byte [edx + 1]
mov byte [ecx + 1], al
movzx eax, byte [edx + 2]
mov byte [ecx + 2], al
movzx eax, byte [edx + 3]
push ebx
mov byte [ecx + 3], al
mov ebx, 4
movzx eax, byte [edx + 4]
push esi
lea esi, [ecx + 1]
mov byte [ecx + 4], al
movzx eax, byte [edx + 5]
mov byte [ecx + 5], al
movzx eax, byte [edx + 6]
push edi
lea edi, [ecx + 3]
mov byte [ecx + 6], al
movzx eax, byte [edx + 7]
mov byte [ecx + 7], al
movzx eax, byte [edx + 8]
mov byte [ecx + 8], al
movzx eax, byte [edx + 9]
mov byte [ecx + 9], al
movzx eax, byte [edx + 0xa]
mov byte [ecx + 0xa], al
movzx eax, byte [edx + 0xb]
mov byte [ecx + 0xb], al
movzx eax, byte [edx + 0xc]
mov byte [ecx + 0xc], al
movzx eax, byte [edx + 0xd]
mov byte [ecx + 0xd], al
movzx eax, byte [edx + 0xe]
mov byte [ecx + 0xe], al
movzx eax, byte [edx + 0xf]
mov dword [ebp - 8], edi
lea edi, [ecx + 0x11]
mov byte [ecx + 0xf], al
sub ecx, esi
lea eax, [esi + 0xc]
mov dword [ebp - 0xc], ecx
mov dl, byte [eax + 1]
mov ch, byte [ecx + eax]
mov cl, byte [eax]
mov byte [ebp - 1], dl
mov dl, byte [eax + 2]
mov byte [ebp - 2], dl
mov edx, dword [ebp - 8]
mov byte [ebp - 4], ch
mov byte [ebp - 3], cl
test bl, 3
jne 0x401d6d
movzx edx, cl
movzx ecx, byte [ebp - 1]
mov cl, byte [ecx + 0x50d880]
mov byte [ebp - 3], cl
movzx ecx, byte [ebp - 2]
mov cl, byte [ecx + 0x50d880]
mov byte [ebp - 1], cl
movzx ecx, byte [ebp - 4]
mov cl, byte [ecx + 0x50d880]
mov byte [ebp - 2], cl
mov ecx, ebx
shr ecx, 2
mov ch, byte [ecx + 0x50da80]
xor ch, byte [edx + 0x50d880]
mov edx, dword [ebp - 8]
mov cl, byte [edi - 0x11]
inc ebx
xor cl, ch
mov byte [edi - 1], cl
mov cl, byte [eax - 0xc]
add eax, 4
xor cl, byte [ebp - 3]
mov byte [edi], cl
mov cl, byte [edx - 1]
xor cl, byte [ebp - 1]
mov byte [edi + 1], cl
mov cl, byte [edx]
add edx, 4
xor cl, byte [ebp - 2]
mov byte [edi + 2], cl
add edi, 4
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
cmp ebx, 0x2c
jb 0x401d10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402230
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov ebx, 4
push esi
push edi
mov dword [ebp - 8], eax
mov esi, ecx
lea edi, [eax + 0xa0]
nop dword [eax + eax]
mov edx, 4
mov al, byte [edi]
inc edi
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0x402255
sub ebx, 1
jne 0x402250
mov eax, dword [ebp - 8]
add eax, 0x90
mov byte [ebp - 1], 9
mov dword [ebp - 0xc], eax
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
nop dword [eax + eax]
mov ecx, edi
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x50d980]
mov byte [ecx - 4], al
sub edx, 1
jne 0x4022e0
inc edi
sub ebx, 1
jne 0x4022d0
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ebx, 4
mov edi, 4
nop dword [eax]
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
sub edi, 1
jne 0x402310
sub ebx, 1
jne 0x402304
mov ecx, esi
call fcn.00401de0
mov dl, byte [ebp - 1]
sub dword [ebp - 0xc], 0x10
dec dl
mov byte [ebp - 1], dl
test dl, dl
jne 0x402274
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
mov ecx, edi
mov edx, 4
nop dword [eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x50d980]
mov byte [ecx - 4], al
sub edx, 1
jne 0x4023a0
inc edi
sub ebx, 1
jne 0x402392
sub dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 8]
mov ecx, 4
nop dword [eax]
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x4023d0
sub dword [ebp - 0xc], 1
jne 0x4023c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4023f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
add eax, 0xb0
mov dword [ebp - 4], eax
push esi
mov esi, eax
test ebx, ebx
je 0x402446
dec ebx
shr ebx, 4
push edi
mov edi, dword [ebp + 0xc]
inc ebx
mov eax, edi
sub esi, edi
mov edx, 0x10
nop dword [eax]
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x402420
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.00401fe0
mov esi, edi
add edi, 0x10
sub ebx, 1
jne 0x402413
mov eax, dword [ebp - 4]
pop edi
movups xmm0, xmmword [esi]
pop esi
pop ebx
movups xmmword [eax], xmm0
mov esp, ebp
pop ebp
ret

Function at 0x402460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x4024b0
mov ecx, dword [ebp + 8]
dec ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
lea edi, [ecx + 0xb0]
shr ebx, 4
sub edi, esi
inc ebx
movups xmm0, xmmword [esi]
mov edx, ecx
mov ecx, esi
call fcn.00402230
mov ecx, 0x10
mov al, byte [edi + esi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x402491
mov ecx, dword [ebp + 8]
sub edi, 0x10
movups xmmword [ecx + 0xb0], xmm0
sub ebx, 1
jne 0x402480
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4024c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x74], 0x67452301
mov dword [ebp - 0x70], 0xefcdab89
mov dword [ebp - 0x6c], 0x98badcfe
mov dword [ebp - 0x68], 0x10325476
call fcn.00402be0
add esp, 4
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0x18]
call fcn.00402cb0
lea ecx, [ebx + 3]
mov dword [ebp - 0x78], 0
lea eax, [ebp - 0x18]
mov edi, 0x10
sub eax, ecx
lea esi, [ecx + 0x10]
lea ebx, [eax - 1]
mov ax, word [ebp - 0x78]
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi - 1]
movzx edx, byte [ebx + esi + 1]
add edi, 0xffff
add dx, cx
add ax, dx
mov cl, al
mov word [ebp - 0x78], ax
shr ax, 8
mov byte [esi + 1], cl
test di, di
jne 0x402540
mov edx, dword [ebp - 0x7c]
xor edi, edi
mov eax, dword [edx]
mov ecx, eax
sub ecx, dword [ebp + 8]
cmp eax, dword [ebp + 8]
cmovb ecx, edi
xor eax, eax
mov dword [edx], ecx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c1fe9
mov esp, ebp
pop ebp
ret
Function at 0x405080
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x400000
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0x400000
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0x400000
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [0x544f88], 0
mov esi, eax
je 0x4050cc
call fcn.004160a0
mov dword [0x544f88], 0
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp + 0x10]
mov edx, esi
push ecx
mov ecx, eax
call fcn.00415e20
add esp, 8
mov dword [0x544f88], eax
xor ecx, ecx
mov edx, 4
test eax, eax
cmove ecx, edx
pop edi
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x409320
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x409351
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x409340
pop edi
mov eax, esi
pop esi
pop ebp
ret 8