joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1279037b
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x12790651
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x71f064e5
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x71efd4ab
push 0xffffffffffffffff
call fcn.1278757b
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x127903e5
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.127903fd
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x12790645
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x12790619
Function at 0x1279fe4b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1279fe6d
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1279fe6d
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1279fe6d
ret
cmp word [ebx + 4], 0x14c
jne 0x1279fe6d
test word [ebx + 0x16], 2
je 0x1279fe6d
test word [ebx + 0x16], 0x100
je 0x1279fe6d
cmp word [ebx + 0x18], 0x10b
jne 0x1279fe6d
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1279fe6d
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1279fef9
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1279fe8d
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.12786dd8
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1279fe6d
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x1279fef9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1279fe6d
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1279fe6d
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1279fe6d
ret
cmp word [ebx + 4], 0x14c
jne 0x1279fe6d
test word [ebx + 0x16], 2
je 0x1279fe6d
test word [ebx + 0x16], 0x100
je 0x1279fe6d
cmp word [ebx + 0x18], 0x10b
jne 0x1279fe6d
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1279fe6d
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1279fef9
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1279fe8d
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.12786dd8
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1279fe6d
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x1279ffb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x127a0009
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1279ffb0
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1279ffbf
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x12ba5c62
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x127a0010
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.12786e86
cmp eax, dword [ebp + 0xc]
pop eax
je 0x127a00af
add edi, 4
add eax, 2
dec ecx
jne 0x1279fff5
call 0x127a005c
loope 0x127a0052
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x127a00ac
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x127a00bd
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x127a0070
cmp eax, ecx
ja 0x127a0070
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x127a00fa
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x127a00f0
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.12787365
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x1279ffbf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x127a0009
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1279ffb0
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1279ffbf
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x12ba5c62
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x127a0010
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.12786e86
cmp eax, dword [ebp + 0xc]
pop eax
je 0x127a00af
add edi, 4
add eax, 2
dec ecx
jne 0x1279fff5
call 0x127a005c
loope 0x127a0052
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x127a00ac
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x127a00bd
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x127a0070
cmp eax, ecx
ja 0x127a0070
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x127a00fa
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x127a00f0
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.12787365
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x1007d200]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0x4c08f5fe
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
sub eax, 0xc0eaa208
je 0x100010c3
jmp 0x1000103b
mov eax, dword [ebp - 0x20]
sub eax, 0xc7074799
je 0x10001195
jmp 0x1000104e
mov eax, dword [ebp - 0x20]
sub eax, 0x4c08f5fe
je 0x1000108c
jmp 0x10001061
mov eax, dword [ebp - 0x20]
sub eax, 0x5a35c385
je 0x10001136
jmp 0x10001074
mov eax, dword [ebp - 0x20]
sub eax, 0x69fcf138
je 0x10001184
jmp 0x10001087
jmp 0x1000119c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
push eax
mov edx, esp
mov dword [ebp - 0x10], ecx
mov dword [edx], eax
xor ecx, ecx
xor edi, edi
mov ecx, dword [ebp - 0x10]
mov edi, dword [edx]
not byte [edi]
xor eax, eax
xor eax, 0x55
sub byte [edi], 0x84
add byte [edi], 0x67
nop
nop
imul byte [edi]
inc edi
loop 0x100010a3
mov dword [ebp - 0x14], 0xc0eaa208
jmp 0x1000119c
mov ecx, dword [0x1007e550]
mov eax, dword [0x1007e54c]
mov edx, ecx
sub edx, 0x9f3f5e34
sub edx, 1
add edx, 0x9f3f5e34
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc7074799
mov ecx, 0x5a35c385
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x1000119c
mov eax, dword [0x1007e550]
mov ecx, dword [0x1007e54c]
mov edx, eax
sub edx, 0x12e6e2a3
sub edx, 1
add edx, 0x12e6e2a3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc7074799
mov ecx, 0x69fcf138
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x1000119c
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.100102f0
lea esp, [ebp - 8]
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x14], 0x5a35c385
jmp 0x10001025
Function at 0x10013bf5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10013c34
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10013c34
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10013c34
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10013c34
cmp dword [ecx + 0x74], 0xe
jbe 0x10013c34
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001694a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100169e7
push ebx
push esi
call fcn.10016913
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100168a7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10016994
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100169e6
push edi
push eax
call fcn.10017905
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100169b4
call fcn.10015471
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100169e5
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100168a7
add esp, 0x20
test eax, eax
jne 0x100169d3
push edi
call fcn.10015471
jmp 0x100169db
push ebx
call fcn.10015471
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10016c54
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f348
push 0x1001f340
push str.FlsAlloc
push 0x1f
call fcn.10016b70
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10016c88
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001d150]
call esi
jmp 0x10016c8e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10016cd2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f358
push 0x1001f350
push str.FlsGetValue
push 0x21
call fcn.10016b70
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10016d09
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001d150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10016d11
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001f360
push 0x1001f358
push str.FlsSetValue
push 0x22
call fcn.10016b70
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10016d4b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001d150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001c270
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001c29d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001c29d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40c558
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push ebx
push esi
mov ecx, edx
mov edx, eax
mov esi, ecx
shr esi, 2
and ecx, 3
test esi, esi
je 0x40c5df
je 0x40c60e
mov eax, 0xffffffff
xor ebx, ebx
mov dword [esp], edi
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5bc0a0]
movzx edi, byte [edx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5bc0a0]
movzx edi, byte [edx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5bc0a0]
movzx edi, byte [edx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5bc0a0]
add edx, 4
inc ebx
cmp ebx, esi
jb 0x40c57b
mov edi, dword [esp]
jmp 0x40c5e4
mov eax, 0xffffffff
test ecx, ecx
je 0x40c608
je 0x40c608
xor ebx, ebx
inc edx
movzx esi, byte [edx - 1]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5bc0a0]
inc ebx
cmp ebx, ecx
jb 0x40c5ec
not eax
pop ecx
pop ebx
pop esi
ret
mov eax, 0xffffffff
jmp 0x40c5e4

Function at 0x40c61c
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
lea edx, [esp]
push 8
push edx
push dword [eax]
call fcn.00470b88
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add esp, 0x14
ret
Function at 0x40d560
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push edi
push esi
push ebp
push ebx
push esi
mov dword [esp], edx
mov eax, dword [eax]
inc dword [0x841ea4]
mov edi, ecx
xor esi, esi
xor esi, ecx
cmp ecx, 4
jl 0x40d5a1
imul ebp, dword [edx], 0x5bd1e995
mov ebx, ebp
shr ebx, 0x18
xor ebp, ebx
imul ebx, ebp, 0x5bd1e995
imul esi, esi, 0x5bd1e995
xor esi, ebx
add edx, 4
add edi, 0xfffffffc
cmp edi, 4
jge 0x40d57b
cmp edi, 3
je 0x40d5b2
cmp edi, 2
je 0x40d5bb
cmp edi, 1
je 0x40d5c4
jmp 0x40d5cf
movzx edi, byte [edx + 2]
shl edi, 0x10
xor esi, edi
movzx edi, byte [edx + 1]
shl edi, 8
xor esi, edi
movzx edx, byte [edx]
xor esi, edx
imul esi, esi, 0x5bd1e995
mov edx, esi
shr edx, 0xd
xor esi, edx
imul esi, esi, 0x5bd1e995
mov edi, esi
shr edi, 0xf
xor esi, edi
and esi, 0x7fffffff
add esi, 0x80000000
test eax, eax
je 0x40d632
mov edi, dword [0x841ea0]
mov ebx, eax
mov ebp, ecx
inc edi
mov dword [0x841ea0], edi
cmp esi, dword [ebx + 0x1c]
jne 0x40d629
cmp ebp, dword [ebx + 0x18]
jne 0x40d623
push ebp
mov edx, dword [esp + 4]
push edx
push dword [ebx + 0x14]
call fcn.00471110
add esp, 0xc
test eax, eax
je 0x40d638
inc dword [0x841e9c]
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jne 0x40d5fd
mov eax, ebx
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret
mov eax, ebx
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x417768
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x5bcbf0]
cmp eax, 0x270
jl 0x417836
xor edx, edx
mov eax, dword [edx*4 + 0x5efda0]
and eax, 0x80000000
mov ecx, dword [edx*4 + 0x5efda4]
and ecx, 0x7fffffff
or eax, ecx
mov ecx, eax
shr ecx, 1
and eax, 1
xor ecx, dword [edx*4 + 0x5f03d4]
xor ecx, dword [eax*4 + 0x594538]
mov dword [edx*4 + 0x5efda0], ecx
inc edx
cmp edx, 0xe3
jl 0x41777a
cmp edx, 0x26f
jge 0x417802
mov eax, dword [edx*4 + 0x5efda0]
and eax, 0x80000000
mov ecx, dword [edx*4 + 0x5efda4]
and ecx, 0x7fffffff
or eax, ecx
mov ecx, eax
shr ecx, 1
and eax, 1
xor ecx, dword [edx*4 + 0x5efa14]
xor ecx, dword [eax*4 + 0x594538]
mov dword [edx*4 + 0x5efda0], ecx
inc edx
cmp edx, 0x26f
jl 0x4177c2
mov edx, dword [0x5f075c]
and edx, 0x80000000
mov eax, dword [0x5efda0]
and eax, 0x7fffffff
or edx, eax
mov ecx, edx
shr ecx, 1
xor ecx, dword [0x5f03d0]
and edx, 1
xor ecx, dword [edx*4 + 0x594538]
mov dword [0x5f075c], ecx
xor eax, eax
lea edx, [eax + 1]
mov dword [0x5bcbf0], edx
mov eax, dword [eax*4 + 0x5efda0]
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
ret
Function at 0x425988
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x28
mov ebx, eax
test ebx, ebx
je 0x425a4d
movsx edx, byte [0x5bcbf8]
test edx, edx
je 0x4259a9
mov eax, ebx
call fcn.00425a5c
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x425a4d
mov edx, dword [eax + 0x30]
mov ecx, dword [eax + 0x34]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 0x38]
mov ecx, dword [eax + 0x3c]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 0x40]
mov ecx, dword [eax + 0x44]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov edx, dword [eax + 0x48]
mov ecx, dword [eax + 0x4c]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
mov esi, ebx
mov ebx, eax
mov eax, esi
lea edx, [esp + 8]
call fcn.004110bc
mov edx, dword [ebx + 0x70]
mov ecx, dword [ebx + 0x74]
add dword [esp + 8], edx
adc dword [esp + 0xc], ecx
mov edx, dword [ebx + 0x78]
mov ecx, dword [ebx + 0x7c]
add dword [esp + 0x10], edx
adc dword [esp + 0x14], ecx
mov edx, dword [ebx + 0x70]
mov ecx, dword [ebx + 0x74]
add dword [esp + 0x18], edx
adc dword [esp + 0x1c], ecx
mov edx, dword [ebx + 0x78]
mov ecx, dword [ebx + 0x7c]
add dword [esp + 0x20], edx
adc dword [esp + 0x24], ecx
mov esi, dword [esi + 0x10]
cmp esi, dword [0x841ba8]
je 0x425a45
mov ebx, dword [esi + 0x44]
test ebx, ebx
jne 0x4259f0
xor eax, eax
add esp, 0x28
pop ebx
pop esi
ret
mov eax, 0xffffffff
add esp, 0x28
pop ebx
pop esi
ret
Function at 0x4393c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x58
mov edi, dword [esp + 0x78]
test eax, eax
je 0x439584
mov ebx, dword [eax + 0x44]
test edx, edx
je 0x43957d
mov esi, dword [edx + 0x44]
mov eax, ecx
cdq
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov eax, edi
cdq
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov ecx, dword [ebx + 0x88]
mov dword [esp + 0x14], ecx
mov edi, dword [ebx + 0x8c]
mov dword [esp + 0x18], edi
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x88]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0x8c]
mov dword [esp + 0x30], eax
lea eax, [esp + 4]
call fcn.00406514
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
mov byte [esi + 0xa8], 1
movsx ecx, word [ebx + 0xa2]
cmp ecx, 0x100
je 0x4394f8
mov dword [esp + 0x44], edx
mov dword [esp + 0x3c], eax
movsx ecx, word [ebx + 0xa2]
movsx edi, word [esi + 0xa2]
mov dword [esp + 0x54], edi
cmp dword [esp + 0x4c], 0
jle 0x4394ee
xor edi, edi
mov ebp, ebx
mov ebx, ecx
jmp 0x43948d
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], edx
mov ecx, dword [esp + 0x40]
add ecx, ecx
add ecx, ecx
add ecx, dword [esi + 0xc0]
imul edx, dword [esi + 0x88]
add edx, edx
add edx, edx
add ecx, edx
mov edx, dword [esp + 0x38]
add edx, edx
add edx, edx
add edx, dword [ebp + 0xc0]
imul eax, dword [ebp + 0x88]
add eax, eax
add eax, eax
add edx, eax
mov eax, dword [esp + 0x48]
add eax, eax
add eax, eax
push eax
push ebx
mov eax, dword [esp + 0x5c]
push eax
push edx
push ecx
call dword [0x5d9b04]
add esp, 0x14
mov edx, dword [esp + 0x44]
inc edx
mov eax, dword [esp + 0x3c]
inc eax
inc edi
cmp edi, dword [esp + 0x4c]
jl 0x439485
xor eax, eax
add esp, 0x58
pop ebx
pop ebp
pop esi
pop edi
ret
mov dword [esp + 0x44], edx
mov dword [esp + 0x3c], eax
movsx ecx, word [esi + 0xa2]
cmp dword [esp + 0x4c], 0
jle 0x4394ee
xor edi, edi
mov ebp, ecx
jmp 0x43951c
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], edx
mov ecx, dword [esp + 0x40]
add ecx, ecx
add ecx, ecx
add ecx, dword [esi + 0xc0]
imul edx, dword [esi + 0x88]
add edx, edx
add edx, edx
add ecx, edx
mov edx, dword [esp + 0x38]
add edx, edx
add edx, edx
add edx, dword [ebx + 0xc0]
imul eax, dword [ebx + 0x88]
add eax, eax
add eax, eax
add edx, eax
mov eax, dword [esp + 0x48]
add eax, eax
add eax, eax
push eax
push ebp
push edx
push ecx
call dword [0x5d9b00]
add esp, 0x10
mov edx, dword [esp + 0x44]
inc edx
mov eax, dword [esp + 0x3c]
inc eax
inc edi
cmp edi, dword [esp + 0x4c]
jl 0x439514
jmp 0x4394ee
xor esi, esi
jmp 0x4393e1
xor ebx, ebx
jmp 0x4393d6
Function at 0x439e4d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x4c
mov ebp, eax
test ebp, ebp
je 0x43a09a
mov ebx, dword [ebp + 0x44]
movsx ecx, cl
test ecx, ecx
je 0x439e6a
mov ebp, edx
mov edx, dword [ebp + 0x44]
mov dword [esp + 0x3c], edx
mov eax, ebp
call fcn.00411000
mov edi, dword [esp + 0x6c]
neg edi
mov dword [esp + 0x40], edi
mov ecx, dword [esp + 0x74]
neg ecx
mov esi, dword [ebx + 0x88]
mov edx, dword [esp + 0x70]
lea edx, [edx + esi - 1]
mov dword [esp + 0x44], edx
mov eax, dword [ebx + 0x8c]
mov esi, dword [esp + 0x78]
lea esi, [esi + eax - 1]
mov dword [esp + 0x38], esi
sub edx, edi
lea edi, [edx + 1]
mov dword [esp + 0x48], edi
sub esi, ecx
inc esi
test edi, edi
jle 0x439fc9
test esi, esi
jle 0x439fc9
lea eax, [edx*4 + 4]
cmp edi, 0x2000
jg 0x43a05d
imul eax, esi
lea edx, [eax + edx*4 + 8]
push edx
mov dword [esp + 0x38], ecx
call fcn.004704bc
mov ecx, dword [esp + 0x38]
add esp, 4
mov dword [esp + 0x30], eax
mov edx, eax
test edx, edx
je 0x43a022
mov edx, esi
imul edx, dword [esp + 0x48]
add edx, edx
add edx, edx
push dword [0x5bcc58]
push edx
mov edi, dword [esp + 0x38]
push edi
mov dword [esp + 0x40], ecx
call dword [0x5d9aa8]
mov ecx, dword [esp + 0x40]
add esp, 0xc
mov edx, dword [esp + 0x6c]
test edx, edx
jle 0x439fe8
mov edx, dword [esp + 0x3c]
mov byte [edx + 0xa8], 1
mov edx, dword [esp + 0x30]
test edx, edx
je 0x439fdb
mov dword [esp + 0xc], ecx
mov edi, dword [esp + 0x44]
mov dword [esp + 0x10], edi
mov edx, dword [esp + 0x38]
mov dword [esp + 0x14], edx
mov edx, dword [ebx + 0x88]
mov dword [esp + 0x18], edx
mov edx, dword [ebx + 0x8c]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x74]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x30]
mov edx, dword [ebx + 0xc0]
mov ecx, dword [esp + 0x40]
call fcn.0043a0b0
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x48]
call fcn.00433c28
mov eax, ebp
call fcn.00411000
xor eax, eax
add esp, 0x4c
pop ebx
pop ebp
pop esi
pop edi
ret
push 0x848640
push 0x8472b0
call fcn.00409038
add esp, 8
mov eax, 0xffffffff
add esp, 0x4c
pop ebx
pop ebp
pop esi
pop edi
ret
mov edx, dword [esp + 0x70]
test edx, edx
jg 0x439f35
mov edx, dword [esp + 0x74]
test edx, edx
jg 0x439f35
mov edx, dword [esp + 0x78]
test edx, edx
jg 0x439f35
movzx edx, byte [ebx + 0xa8]
mov edi, dword [esp + 0x3c]
mov byte [edi + 0xa8], dl
jmp 0x439f40
push esi
mov edx, edi
push edx
push 0
push 0x84861c
push 0x8472b0
mov dword [esp + 0x48], ecx
call fcn.004a1aa0
mov ecx, dword [esp + 0x48]
push 0
push 1
push 0x1965e
mov dword [esp + 0x54], ecx
call fcn.0046d578
mov ecx, dword [esp + 0x54]
add esp, 0x20
jmp 0x439f01
push esi
mov edx, edi
push edx
push 0x8485f4
push 0x8472b0
mov dword [esp + 0x44], ecx
call fcn.00409038
mov ecx, dword [esp + 0x44]
push 1
push 0x186aa
mov dword [esp + 0x4c], ecx
call fcn.0046d5d4
mov ecx, dword [esp + 0x4c]
add esp, 0x18
xor edx, edx
mov dword [esp + 0x30], edx
jmp 0x439f01
xor ebx, ebx
jmp 0x439e61
Function at 0x440c48
Capabilities:
Read file on windows

Disassembly:
push esi
lea edx, [esp]
push 1
push edx
push dword [eax]
call fcn.00470b88
movsx eax, byte [esp + 0xc]
add esp, 0x10
ret