joyce8/EMBER2024-capa huggingface dataset:
Function at 0x569ea0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x625b30
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x6c4490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x48], edx
mov eax, dword [ebp + 8]
mov ebx, 4
mov dword [ebp - 0x4c], eax
mov ecx, dword [eax]
mov dword [ebp - 0x44], ecx
test ecx, ecx
jle 0x56a060
jmp 0x569ef0
mov eax, dword [eax + ebx]
add ebx, 4
cmp dword [edx + 0x1420], 0
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ebx
je 0x569f35
mov ecx, dword [edx + 0x141c]
mov eax, dword [edx + 0x142c]
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x569f26
mov ecx, dword [ebp - 0x44]
lea esi, [ebp - 0x50]
add eax, 0xffffffe4
mov dword [ebp - 0x50], eax
jmp 0x569f3f
mov ecx, dword [ebp - 0x44]
lea esi, [ebp - 0x50]
mov dword [ebp - 0x50], 0
jmp 0x569f3f
mov dword [ebp - 0x60], 0
lea esi, [ebp - 0x60]
mov esi, dword [esi]
test esi, esi
je 0x56a053
lea esp, [esp]
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.0045c150
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004ada80
add esp, 8
cmp dword [ebp - 0x14], 0x10
mov byte [ebp - 4], 2
jb 0x569f9b
push dword [ebp - 0x28]
call fcn.004ec310
add esp, 4
cmp dword [ebp - 0x2c], 0x10
lea edx, [ebp - 0x40]
mov ecx, dword [ebp - 0x30]
cmovae edx, dword [ebp - 0x40]
xor eax, eax
add ecx, edx
mov dword [ebp - 0x14], 0xf
mov ebx, ecx
mov dword [ebp - 0x18], 0
sub ebx, edx
mov byte [ebp - 0x28], 0
xor edi, edi
cmp edx, ecx
cmova ebx, eax
test ebx, ebx
je 0x569fe3
mov edi, edi
movzx ecx, byte [edx]
lea edx, [edx + 1]
imul eax, eax, 0x1000193
inc edi
xor eax, ecx
cmp edi, ebx
jb 0x569fd0
cmp dword [ebp - 0x58], eax
je 0x56a01b
cmp dword [ebp - 0x2c], 0x10
mov dword [ebp - 4], 0xffffffff
jb 0x56a000
push dword [ebp - 0x40]
call fcn.004ec310
add esp, 4
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x56a00c
add esi, 0xffffffe4
jmp 0x56a00e
xor esi, esi
test esi, esi
jne 0x569f50
mov ebx, dword [ebp - 0x54]
jmp 0x56a04d
mov ecx, dword [esi + 0x18]
call fcn.0056b150
mov ecx, dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x54]
add ecx, ebx
push ecx
mov ecx, eax
call fcn.0056d780
add ebx, eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x2c], 0x10
jb 0x56a04d
push dword [ebp - 0x40]
call fcn.004ec310
add esp, 4
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
dec ecx
mov dword [ebp - 0x44], ecx
jne 0x569ef0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dfa14
mov esp, ebp
pop ebp
ret 4
Function at 0x56b020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp dword [edx + 0x13e4], 0x20
je 0x56b034
xor al, al
pop ebp
ret 4
cmp byte [edx + 0x365], 0
jne 0x56b075
cmp dword [edx + 0x13e8], 0x10
push esi
push edi
lea edi, [edx + 0x13d4]
jb 0x56b050
mov edi, dword [edi]
mov esi, dword [ebp + 8]
xor ecx, ecx
xor dword [edi + ecx*4], esi
inc ecx
mov eax, dword [edx + 0x13e4]
add esi, 0x1000193
shr eax, 2
cmp ecx, eax
jne 0x56b055
pop edi
mov byte [edx + 0x365], 1
pop esi
mov al, 1
pop ebp
ret 4

Function at 0x56b160
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x625cf8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6c4490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x56b291
cmp byte [ebx + 0x46], 0
je 0x56b291
mov eax, dword [ebx]
push 0xffff
call dword [eax + 0xc]
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
jne 0x56b1bf
xor al, al
jmp 0x56b293
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
nop
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x40]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x56b22a
dec eax
je 0x56b22e
sub eax, 2
je 0x56b27a
xor bl, bl
jmp 0x56b27c
mov byte [ebx + 0x46], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x56b260
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.005e086d
add esp, 0x10
cmp esi, eax
jne 0x56b226
cmp byte [ebx + 0x46], 0
je 0x56b27a
test esi, esi
jne 0x56b1f0
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00464e60
jmp 0x56b1f0
mov bl, 1
cmp dword [ebp - 0x14], 0x10
jb 0x56b28d
push dword [ebp - 0x28]
call fcn.004ec310
add esp, 4
mov al, bl
jmp 0x56b293
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dfa14
mov esp, ebp
pop ebp
ret
Function at 0x57a710
Capabilities:
Check for peb ntglobalflag flag
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x626266
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6c4490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.UI::CWindow.0
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], 0
mov byte [edi + 4], 0
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x64]
push 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [edi + 0x55], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], eax
mov dword [edi + 0x60], 0
push 0
mov dword [ebp - 4], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
call fcn.0047d800
mov dword [edi + 0x64], eax
push 0
mov dword [edi + 0x6c], 0
lea ecx, [edi + 0x70]
push 0
mov byte [ebp - 4], 1
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
call fcn.0047d800
mov dword [edi + 0x70], eax
mov eax, edi
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x50], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x58c020
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
push edi
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x58c030
mov edi, 0x1505
mov esi, 0
sub ecx, edx
je 0x58c057
movsx edx, byte [esi + ebx]
mov eax, edi
shl eax, 5
inc esi
add edi, eax
add edi, edx
cmp esi, ecx
jb 0x58c045
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5932a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6271ae
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6c4490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [0x71b254], edi
mov dword [edi], vtable.CRaceManager.0
lea ecx, [edi + 4]
mov dword [ebp - 4], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.00464bf0
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 1
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call fcn.00486070
mov dword [edi + 0xc], eax
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 2
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.00469a80
mov dword [edi + 0x14], eax
mov ecx, edi
mov dword [edi + 0x30], 0xf
mov dword [edi + 0x2c], 0
mov byte [edi + 0x1c], 0
call fcn.00594210
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x593380
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x627204
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6c4490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CRaceManager.0
mov dword [ebp - 4], 4
call fcn.00593580
cmp dword [edi + 0x30], 0x10
jb 0x5933cf
push dword [edi + 0x1c]
call fcn.004ec310
add esp, 4
mov dword [edi + 0x30], 0xf
lea ecx, [edi + 0x14]
mov dword [edi + 0x2c], 0
mov byte [edi + 0x1c], 0
mov eax, dword [edi + 0x14]
push eax
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.0048fd80
push dword [edi + 0x14]
call fcn.004ec310
mov eax, dword [edi + 0xc]
lea ecx, [edi + 0xc]
add esp, 4
mov byte [ebp - 4], 1
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.004dd890
push dword [edi + 0xc]
call fcn.004ec310
mov eax, dword [edi + 4]
lea ecx, [edi + 4]
add esp, 4
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.004645f0
push dword [edi + 4]
call fcn.004ec310
mov dword [edi], vtable.CSingleton_class_CRaceManager_.0
add esp, 4
mov dword [0x71b254], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5b5d70
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x629aa7
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6c4490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CArea.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
lea ecx, [edi + 0x64]
mov byte [ebp - 4], 7
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
call fcn.00464bf0
mov dword [edi + 0x64], eax
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
lea ecx, [edi + 0x8c]
mov byte [ebp - 4], 0xa
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0
call fcn.00464bf0
mov dword [edi + 0x8c], eax
lea ecx, [edi + 0x98]
mov byte [ebp - 4], 0xb
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0
call fcn.00469a50
mov dword [edi + 0x98], eax
mov eax, edi
mov dword [edi + 0x84], 0xff00ff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5cdeb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x623b1b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6c4490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
sub edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
inc edi
sub esi, ebx
inc esi
je 0x5cdf7d
test edi, edi
je 0x5cdf7d
push 0x40
call fcn.005dfa23
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x5cdf1a
mov ecx, eax
call fcn.005d24d0
mov ecx, eax
jmp 0x5cdf1c
xor ecx, ecx
mov eax, dword [ebp + 0x10]
cmp edi, esi
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0xc], eax
cmovg esi, edi
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], ebx
mov dword [ecx + 8], edx
mov dword [ecx + 0x24], esi
movzx eax, word [eax + 0x8c]
imul eax, edx
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
add eax, ebx
mov dword [ecx + 0x28], eax
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x5d2b60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62ac68
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6c4490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [0x71b278], edi
mov dword [edi], vtable.CSoundManager.0
lea ecx, [edi + 0x6c]
mov dword [ebp - 4], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
call fcn.00469a80
mov dword [edi + 0x6c], eax
mov eax, edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0x43480000
mov dword [edi + 0x1c], 0x447a0000
mov dword [edi + 0x20], 0x3f800000
mov dword [edi + 0x24], 0x3f800000
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x68], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x601e69
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6c4490]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.005eb3e2
mov dword [ebp - 0x14], eax
cmp dword [0x7177bc], esi
jne 0x601f5c
push 0x800
push esi
push 0x6593ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x601ee9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x60203c
push esi
push esi
push 0x6593ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x60203c
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x60203c
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x7177bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x7177c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x7177c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x7177cc], eax
test eax, eax
je 0x601f59
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x7177c8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x601f81
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x601f74
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x601f96
push 4
pop eax
jmp 0x60203e
cmp dword [ebp - 0x14], esi
je 0x601f96
push dword [0x7177bc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x601f7b
mov eax, dword [0x7177c8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x601ff4
cmp dword [0x7177cc], edi
je 0x601ff4
push eax
call ebx
push dword [0x7177cc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x601ff4
test eax, eax
je 0x601ff4
call ecx
test eax, eax
je 0x601fe9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x601fe9
test byte [ebp - 8], 1
jne 0x601ff4
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x602024
mov eax, dword [0x7177c0]
cmp eax, edi
je 0x602021
push eax
call ebx
test eax, eax
je 0x602021
call eax
mov esi, eax
test esi, esi
je 0x602021
mov eax, dword [0x7177c4]
cmp eax, edi
je 0x602021
push eax
call ebx
test eax, eax
je 0x602021
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x7177bc]
call ebx
test eax, eax
je 0x60203c
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x60203e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dfa14
mov esp, ebp
pop ebp
ret
Function at 0x619410
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
lea ebx, [edx + eax]
mov dword [ebp - 8], ebx
cmp eax, 0x10
jb 0x6194b5
mov esi, dword [ebp + 0x10]
lea eax, [ebx - 0x10]
mov dword [ebp - 4], eax
lea edi, [esi + 0x24234428]
lea ebx, [esi - 0x7a143589]
lea eax, [esi + 0x61c8864f]
lea esp, [esp]
imul ecx, dword [edx], 0x7a143589
sub edi, ecx
imul ecx, dword [edx + 4], 0x7a143589
rol edi, 0xd
imul edi, edi, 0x9e3779b1
sub ebx, ecx
imul ecx, dword [edx + 8], 0x7a143589
rol ebx, 0xd
imul ebx, ebx, 0x9e3779b1
sub esi, ecx
imul ecx, dword [edx + 0xc], 0x7a143589
rol esi, 0xd
add edx, 0x10
imul esi, esi, 0x9e3779b1
sub eax, ecx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp edx, dword [ebp - 4]
jbe 0x619450
rol eax, 0x12
rol esi, 0xc
rol ebx, 7
add eax, esi
add eax, ebx
rol edi, 1
mov ebx, dword [ebp - 8]
add eax, edi
jmp 0x6194bd
mov eax, dword [ebp + 0x10]
add eax, 0x165667b1
add eax, dword [ebp + 0xc]
lea esi, [edx + 4]
cmp esi, ebx
ja 0x6194ea
jmp 0x6194d0
imul ecx, dword [edx], 0x3d4d51c3
mov edx, esi
lea esi, [edx + 4]
sub eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp esi, ebx
jbe 0x6194d0
mov edi, ebx
xor ecx, ecx
sub edi, edx
xor esi, esi
cmp edx, ebx
cmova edi, ecx
test edi, edi
je 0x61951c
jmp 0x619500
movzx ecx, byte [edx]
lea edx, [edx + 1]
imul ecx, ecx, 0x165667b1
inc esi
add ecx, eax
rol ecx, 0xb
imul eax, ecx, 0x9e3779b1
cmp esi, edi
jb 0x619500
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul ecx, ecx, 0x85ebca77
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x43b648
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop edx
and eax, esi
call fcn.0043b66d
push eax
pop esi
xor dword [ebx], edx
and eax, esi
inc ebx
add esi, esi
dec eax
cmp ebx, ecx
jne fcn.0043b648
push eax
pop esi
sub esi, eax
sub eax, eax
ret
Function at 0x410de3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419510]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040ae86
and dword [ebp - 0x14], 0
cmp dword [0x815e70], 0
mov dword [ebp - 0x18], eax
jne 0x410e96
push 0x4038dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x410f3e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4038d0
push ebx
call edi
test eax, eax
je 0x410f3e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4038c0
push ebx
mov dword [0x815e70], eax
call edi
push eax
call esi
push 0x4038ac
push ebx
mov dword [0x815e74], eax
call edi
push eax
call esi
push 0x403890
push ebx
mov dword [0x815e78], eax
call edi
push eax
call esi
mov dword [0x815e80], eax
test eax, eax
je 0x410e96
push 0x403878
push ebx
call edi
push eax
call esi
mov dword [0x815e7c], eax
mov eax, dword [0x815e7c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x410eef
cmp dword [0x815e80], ecx
je 0x410eef
push eax
call esi
push dword [0x815e80]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x410eef
test ebx, ebx
je 0x410eef
call edi
test eax, eax
je 0x410ee6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x410ee6
test byte [ebp - 8], 1
jne 0x410eef
or dword [ebp + 0x10], 0x200000
jmp 0x410f22
mov eax, dword [0x815e74]
cmp eax, dword [ebp - 0x18]
je 0x410f22
push eax
call esi
test eax, eax
je 0x410f22
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x410f22
mov eax, dword [0x815e78]
cmp eax, dword [ebp - 0x18]
je 0x410f22
push eax
call esi
test eax, eax
je 0x410f22
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x815e70]
call esi
test eax, eax
je 0x410f3e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x410f40
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408ac1
leave
ret
Function at 0x413560
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x100c
call fcn.00411950
cmp dword [0xb99c0c], 0x37
jne 0x4135fa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea eax, [esp + 0x810]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0xb9ac00]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x81ac5c]
mov byte [ecx + esi], al
add esp, 0x100c
ret