joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403f70
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x128
mov eax, dword [0x4b000c]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x34]
mov esi, edx
push eax
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov edi, dword [esp + 0x13c]
shr esi, 0x10
and esi, 0x1ff
mov eax, esi
or eax, 0x8000000
test edi, edi
push 0
cmovne eax, esi
cmp dword [0xc0da24], 0
je 0x403fd9
push 0xa
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x40]
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
mov ebp, 1
jmp 0x403fed
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x3c]
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_ToAscii]
xor ebp, ebp
mov ebx, eax
xor esi, esi
test ebx, ebx
jle 0x404094
mov ecx, dword [0xc0dab4]
mov dword [esp + 0x10], 1
xor edx, edx
test ebp, ebp
je 0x40403a
movzx eax, word [esp + esi*2 + 0x20]
cmp eax, 0x20
jb 0x40401c
cmp eax, 0x7e
jbe 0x404023
cmp eax, 0xa0
jb 0x40408b
cmp edi, 1
jne 0x404067
cmp dword [0xc0d9d8], eax
mov dword [0xc0d9d8], eax
cmove edx, dword [esp + 0x10]
jmp 0x40406d
movzx eax, byte [esp + esi + 0x14]
cmp eax, 0x20
jb 0x404049
cmp eax, 0x7e
jbe 0x404050
cmp eax, 0xa0
jb 0x40408b
cmp edi, 1
jne 0x404067
cmp dword [0xc0d9d8], eax
mov dword [0xc0d9d8], eax
cmove edx, dword [esp + 0x10]
jmp 0x40406d
mov dword [0xc0d9d8], edx
test ecx, ecx
je 0x40408b
cmp dword [0xc0d9e4], 0
jne 0x40407e
test edx, edx
jne 0x40408b
push edi
push eax
call ecx
mov ecx, dword [0xc0dab4]
add esp, 8
inc esi
cmp esi, ebx
jl 0x404007
mov ecx, dword [esp + 0x134]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046ad4d
add esp, 0x128
ret
Function at 0x4049d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0xc0db18]
test eax, eax
je 0x4049f0
push eax
push dword [0xc0db20]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [0xc0db18], 0
mov eax, dword [0xc0db20]
test eax, eax
je 0x404a24
cmp dword [0xc0da20], 0x101
jg 0x404a13
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0xc0db20]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xc0db20], 0
mov eax, dword [0xc0db24]
test eax, eax
je 0x404a43
push eax
push str.GLFW
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [0xc0db24], 0
cmp dword [0xc0dab8], 0
je 0x404a56
push 4
push 0
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
ret

Function at 0x404d00
Capabilities:
Create thread

Disassembly:
sub esp, 8
mov eax, dword [0x4b000c]
xor eax, esp
mov dword [esp + 4], eax
cmp dword [0x4d3824], 0
push ebx
mov ebx, ecx
jne 0x404d2d
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046ad4d
add esp, 8
ret
push esi
push edi
push 0xc0da7c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x18
call fcn.00470e7c
mov esi, eax
add esp, 4
test esi, esi
je 0x404d83
mov edi, dword [0xc0da60]
lea eax, [edi + 1]
mov dword [0xc0da60], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x403440
push 0
push 0
mov dword [esi + 0xc], ebx
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x404da5
push esi
call fcn.00470e61
add esp, 4
push 0xc0da7c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or edi, 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0046ad4d
add esp, 8
ret
mov dword [esi + 0x10], eax
mov ecx, 0xc0da64
mov eax, dword [esp + 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [0xc0da68]
test eax, eax
je 0x404dc9
nop dword [eax]
mov ecx, eax
mov eax, dword [ecx + 4]
test eax, eax
jne 0x404dc0
mov dword [ecx + 4], esi
push 0xc0da7c
mov dword [esi], ecx
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0046ad4d
add esp, 8
ret
Function at 0x4050a0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
mov eax, dword [0x4b000c]
xor eax, esp
mov dword [esp + 0x24], eax
cmp dword [0x4d3824], 0
je 0x405288
cmp dword [0xc0dac8], 0
je 0x405288
push ebx
xor ebx, ebx
mov dword [0xc0d9e8], ebx
cmp dword [0xc0dabc], ebx
je 0x4050f4
mov eax, dword [0xc0dad4]
cdq
sub eax, edx
sar eax, 1
mov dword [0xc0d9ec], eax
mov eax, dword [0xc0dad8]
cdq
sub eax, edx
sar eax, 1
jmp 0x405103
mov eax, dword [0xc0d880]
mov dword [0xc0d9ec], eax
mov eax, dword [0xc0d884]
push esi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push edi
push 1
push 0
push 0
mov dword [0xc0d9f0], eax
lea eax, [esp + 0x20]
push 0
push eax
call esi
test eax, eax
je 0x405160
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebp
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [esp + 0x1c], 0x12
je 0x405147
lea eax, [esp + 0x18]
push eax
call edi
lea eax, [esp + 0x18]
push eax
call ebp
jmp 0x40514c
mov ebx, 1
push 1
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
jne 0x405130
pop ebp
cmp dword [0xc0da20], 0x101
jl 0x4051f8
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call esi
push 0xa1
movzx edi, ax
call esi
movzx esi, ax
cmp edi, 0x8000
jae 0x4051c1
cmp byte [0xc0d9ae], 1
jne 0x4051c1
mov eax, dword [0xc0d9dc]
mov ecx, dword [0xc0dab0]
neg eax
sbb al, al
and al, 2
mov byte [0xc0d9ae], al
test ecx, ecx
je 0x4051c7
push 0
push 0x11f
call ecx
add esp, 8
mov ecx, dword [0xc0dab0]
cmp esi, 0x8000
jae 0x4051f8
cmp byte [0xc0d9af], 1
jne 0x4051f8
mov eax, dword [0xc0d9dc]
neg eax
sbb al, al
and al, 2
mov byte [0xc0d9af], al
test ecx, ecx
je 0x4051f8
push 0
push 0x120
call ecx
add esp, 8
cmp dword [0xc0d9e8], 0
pop edi
pop esi
je 0x405241
cmp dword [0xc0dabc], 0
je 0x405241
mov eax, dword [0xc0dad4]
sar eax, 1
mov dword [esp + 4], eax
mov eax, dword [0xc0dad8]
sar eax, 1
mov dword [esp + 8], eax
lea eax, [esp + 4]
push eax
push dword [0xc0db20]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.USER32.dll_SetCursorPos]
test ebx, ebx
pop ebx
je 0x405288
cmp dword [0x4d3824], 0
je 0x405288
cmp dword [0xc0dac8], 0
je 0x405279
cmp dword [0xc0dabc], 0
je 0x405279
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
mov dword [0xc0dabc], 0
call fcn.004049d0
mov dword [0xc0dac8], 0
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x28
ret
Function at 0x4060b0
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0x48
mov eax, dword [0x4b000c]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
movups xmm0, xmmword [esi + 0xb0]
mov edx, dword [esi + 0xe4]
mov eax, dword [esi + 0xc0]
movups xmmword [esi + 0xc4], xmm0
mov dword [esi + 0xd4], eax
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [esp + 0x50], edx
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
imul ecx, ecx, 0x1000193
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0040e590
mov eax, dword [eax + 4]
test eax, eax
je 0x406142
cmp eax, dword [0x7a4010]
je 0x406142
mov eax, dword [eax + 0xc]
test eax, eax
je 0x406142
movups xmm0, xmmword [eax + 0x3c]
movq xmm1, qword [eax + 0x4c]
jmp 0x406149
xorps xmm0, xmm0
movq xmm1, xmm0
movzx eax, word [esi + 0xd8]
movss xmm2, dword [0x4a96e4]
mov word [esi + 0xda], ax
movzx eax, word [esi + 0xdc]
mov word [esi + 0xde], ax
movzx eax, word [esi + 0xe0]
mov word [esi + 0xe2], ax
xor eax, eax
movups xmmword [esp + 0x10], xmm0
mov word [esi + 0xe0], ax
mov word [esi + 0xdc], ax
mov word [esi + 0xd8], ax
or eax, 0xffffffff
shufps xmm0, xmm0, 0xff
comiss xmm2, xmm0
movq qword [esp + 0x44], xmm1
movq qword [esp + 0x20], xmm1
jb 0x4061b6
mov word [esi + 0xd8], ax
movss xmm1, dword [0x4a95b4]
mov ebp, 1
comiss xmm0, xmm1
jb 0x4061cf
mov word [esi + 0xd8], bp
movss xmm0, dword [esp + 0x44]
comiss xmm2, xmm0
jb 0x4061e1
mov word [esi + 0xdc], bp
comiss xmm0, xmm1
jb 0x4061ed
mov word [esi + 0xdc], ax
mov ebx, dword [esp + 0x10]
lea edi, [esi + 0x70]
xor edx, edx
mov cl, byte [edi]
lea edi, [edi + 2]
mov eax, ebp
shl eax, cl
test ebx, eax
setne al
mov byte [esi + edx + 0xb0], al
inc edx
cmp edx, 0x10
jb 0x4061f6
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046ad4d
add esp, 0x48
ret
Function at 0x40de00
Capabilities:
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x28]
mov ebx, ecx
cmp edx, ebp
je 0x40df6f
mov eax, dword [ebx + 4]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 4]
mov dword [esp + 0xc], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [esp + 0x24], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [esp + 0x10], ecx
lea eax, [edi + eax*8]
mov dword [esp + 0x18], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
nop dword [eax]
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.0046b385
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [esp + 0x1c]
je 0x40dec7
cmp esi, ebp
jne 0x40de80
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x2c]
jne 0x40df64
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
pop edi
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
cmp eax, dword [esp + 0x2c]
jne 0x40dedd
mov eax, dword [esp + 0x20]
mov dword [ecx], eax
jmp 0x40dee1
mov eax, dword [esp + 0x14]
mov dword [ecx + 4], eax
cmp esi, ebp
je 0x40df64
nop dword [eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [esp + 0x24]
lea eax, [eax + ecx*8]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
nop word [eax + eax]
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.0046b385
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [esp + 0x1c]
je 0x40df79
cmp esi, ebp
jne 0x40df40
mov eax, dword [esp + 0x10]
mov dword [eax], esi
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, ebp
jne 0x40def0
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x40e1f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48fc25
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x24], edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.0040e590
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40e273
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x40e3cd
cmp dword [0x7a4014], 0xfffffff
je 0x40e3e3
mov dword [ebp - 0x2c], 0x7a4010
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x28], 0
call fcn.0046b355
mov ecx, dword [ebx]
mov esi, eax
lea edi, [esi + 8]
add esp, 4
mov dword [edi], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x28], esi
mov ecx, dword [ecx]
mov dword [edi + 4], ecx
mov dword [ebp - 4], 1
mov ecx, dword [0x7a4014]
mov ebx, dword [0x7a4028]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4a9880]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x4a9880]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x7a400c]
comiss xmm1, xmm0
jbe 0x40e37c
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call fcn.0048bdc0
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.0048cc50
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x40e35f
cmp ebx, 0x200
jae 0x40e35d
shl ebx, 3
cmp ebx, ecx
jae 0x40e35f
mov ebx, ecx
push ebx
call fcn.0040e410
push dword [ebp - 0x20]
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.0040e590
mov ecx, dword [0x7a4014]
mov edx, dword [eax]
jmp 0x40e37f
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x7a4014], ecx
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [0x7a4024]
and eax, dword [ebp - 0x20]
mov ecx, dword [0x7a4018]
mov edi, dword [ecx + eax*8]
cmp edi, dword [0x7a4010]
jne 0x40e3b1
mov dword [ecx + eax*8], esi
jmp 0x40e3c0
cmp edi, edx
jne 0x40e3ba
mov dword [ecx + eax*8], esi
jmp 0x40e3c4
cmp dword [ecx + eax*8 + 4], ebx
jne 0x40e3c4
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x24]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.unordered_map_set_too_long
call fcn.0046c1c3
int3
Function at 0x40e410
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
mov eax, 0x1fffffff
bsr ecx, eax
push ebx
push ebp
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [esp + 0x1c]
cmp ecx, eax
ja 0x40e577
lea eax, [ecx - 1]
mov esi, dword [0x7a4010]
or eax, edi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x7a4018
lea eax, [edi + edi]
push eax
call fcn.0040e0f0
mov ecx, dword [0x7a4010]
lea ebx, [edi - 1]
mov dword [0x7a4024], ebx
mov dword [0x7a4028], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x40e56d
nop word [eax + eax]
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x7a4018]
imul edi, edi, 0x1000193
and edi, ebx
lea ebp, [eax + edi*8]
mov dword [esp + 0x14], ebp
cmp dword [ebp], esi
jne 0x40e4d0
mov dword [ebp], ecx
mov dword [ebp + 4], ecx
jmp 0x40e540
mov eax, dword [ebp + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x40e50a
mov eax, dword [eax]
mov dword [esp + 0x10], eax
cmp eax, ecx
je 0x40e505
mov ebx, dword [ecx + 4]
mov ebp, dword [esp + 0x10]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov ebp, dword [esp + 0x14]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov dword [ebp + 4], ecx
jmp 0x40e540
mov ebp, dword [ebp]
mov edi, eax
cmp ebp, eax
je 0x40e521
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x40e551
cmp ebp, eax
jne 0x40e513
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov dword [edx + 4], ebp
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
je 0x40e56d
mov ebx, dword [0x7a4024]
jmp 0x40e480
mov ebx, dword [ecx + 4]
mov ebp, dword [eax]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x40e540
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
push str.invalid_hash_bucket_count
call fcn.0046c1c3
int3
Function at 0x413890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 8]
sar eax, 4
push ebx
push ebp
mov ebp, edx
lea ecx, [eax*2 + 0x7b30a8]
cdq
and edx, 0x3f
mov dword [esp + 0x10], ecx
push esi
push edi
mov edi, 0x7b30a8
lea ebx, [edx + eax]
mov eax, dword [esp + 0x20]
sar ebx, 6
test eax, eax
je 0x4138e4
movzx ecx, byte [eax + ebx*4]
lea edx, [eax + ebx*4]
movzx eax, byte [edx + 2]
mov word [0x4d9b6c], cx
movzx ecx, byte [edx + 3]
shl cx, 8
or cx, ax
mov word [0x4d9b68], cx
mov eax, dword [esp + 0x1c]
mov esi, ebx
shr eax, 3
shl ebx, 5
shl esi, 7
add ebp, ebx
add esi, 0x7b30a8
xor ebx, ebx
lea eax, [eax*2 + 0x7b30a8]
mov dword [esp + 0x20], eax
cmp eax, 0x7b30a8
jbe 0x41394c
nop
movzx edx, byte [ebp]
lea eax, [ebp + 1]
test ebx, ebx
mov ecx, edx
cmove eax, ebp
shr ecx, 4
test ebx, ebx
mov ebp, eax
cmove ecx, edx
cmp esi, dword [esp + 0x18]
jb 0x41393b
call fcn.004137f0
mov word [edi], ax
add edi, 2
jmp 0x413943
call fcn.004137f0
add esi, 2
xor ebx, 1
cmp edi, dword [esp + 0x20]
jb 0x413910
sub esi, edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x415090
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, edx
mov eax, ecx
mov dword [esp + 0x10], eax
mov bh, byte [esi]
test bh, 1
je 0x415259
mov dl, byte [esi + 0xa]
mov bl, byte [esi + 8]
mov dword [esp + 0xc], edx
push ebp
push edi
movzx edi, word [esi + 6]
test bh, 2
je 0x4150f4
mov ch, byte [esi + 3]
mov cl, byte [esi + 2]
mov byte [esp + 0x13], ch
cmp cl, ch
jne 0x4150ee
test byte [eax + 0x1a], 1
jne 0x4150f4
mov eax, dword [esi + 0xc]
movzx ecx, cl
lea ebp, [eax + ecx*4]
movsx ecx, word [ebp]
cmp edi, ecx
jne 0x41512b
movzx eax, word [ebp + 2]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret
test byte [eax + 0x1a], 1
je 0x415132
test bh, 4
je 0x41515f
mov al, byte [esi + 5]
mov byte [esp + 0x24], al
cmp bl, al
jb 0x41515f
mov bl, byte [esi + 4]
mov eax, dword [esi + 0xc]
cmp bl, byte [esp + 0x24]
movzx ecx, bl
movzx edx, bl
movzx edi, word [eax + ecx*4]
movzx ebp, word [eax + ecx*4 + 2]
lea eax, [ebx + 1]
movzx eax, al
cmovne edx, eax
jmp 0x41523c
mov cl, byte [esi + 2]
mov ch, byte [esp + 0x13]
cmp bl, ch
jb 0x4150f4
mov eax, dword [esi + 0xc]
mov bl, cl
movzx ecx, bl
movzx edi, word [eax + ecx*4]
movzx ebp, word [eax + ecx*4 + 2]
lea eax, [ebx + 1]
mov cl, byte [esi + 2]
cmp cl, byte [esp + 0x13]
movzx edx, cl
movzx eax, al
cmovne edx, eax
jmp 0x41523c
mov ebp, dword [esi + 0xc]
movzx eax, bl
shl eax, 2
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 1]
movsx ecx, word [ebp + eax*4 - 4]
mov eax, dword [esp + 0x24]
cmp edi, ecx
jle 0x4151ab
movzx ebp, word [eax + ebp + 2]
test bh, 8
je 0x415238
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
or byte [eax + 0x1a], 2
test bp, bp
jne 0x41523c
xor ecx, ecx
mov word [eax + 0xe], cx
jmp 0x41523c
add eax, ebp
movzx ecx, dl
mov dword [esp + 0x1c], ecx
cmp bl, dl
je 0x41521d
lea ebp, [ebp + ecx*4]
mov dword [esp + 0x24], ebp
mov edx, dword [esp + 0x24]
movzx ebp, word [eax + 2]
movzx eax, word [eax]
movzx edx, word [edx]
mov dword [esp + 0x18], edx
cmp ax, dx
mov edx, dword [esp + 0x14]
je 0x415216
cmp di, ax
je 0x415216
movsx edx, ax
mov eax, dword [esp + 0x24]
movsx ecx, bp
movsx eax, word [eax + 2]
sub eax, ecx
movsx ecx, di
sub ecx, edx
imul eax, ecx
mov ecx, dword [esp + 0x18]
movsx ecx, cx
sub ecx, edx
cdq
idiv ecx
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
add eax, ebp
movzx eax, ax
movzx ebp, ax
jmp 0x415221
mov eax, ebp
movzx ebp, ax
jmp 0x415221
movzx ebp, word [eax + 2]
mov eax, dword [esi + 0xc]
inc edi
movsx ecx, word [eax + ecx*4]
movzx eax, di
cmp eax, ecx
jl 0x415238
mov bl, dl
inc dl
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x14]
movzx ecx, bl
mov ax, bp
mov word [esi + 6], di
pop edi
mov word [esi + 8], cx
movzx ecx, dl
pop ebp
mov word [esi + 0xa], cx
pop esi
pop ebx
add esp, 0x10
ret
mov ax, word [esp + 0x1c]
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x425480
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x10]
cmp eax, 0xca
jne 0x4254dc
mov eax, dword [esi + 4]
push 0x1c
push 1
push esi
mov eax, dword [eax]
call eax
add esp, 0xc
mov dword [esi + 0x1a0], eax
mov ecx, esi
mov dword [eax], 0x42ace0
mov dword [eax + 4], 0x42ae40
mov dword [eax + 8], 0
call fcn.0042a650
cmp dword [esi + 0x40], 0
je 0x4254d3
pop edi
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
jmp 0x4254e3
cmp eax, 0xcb
jne 0x42555c
mov eax, dword [esi + 0x1b0]
cmp dword [eax + 0x10], 0
je 0x425547
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x4254ff
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1b0]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x425542
cmp eax, 2
je 0x425547
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4254f0
cmp eax, 3
je 0x425527
cmp eax, 1
jne 0x4254f0
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x4254f0
mov eax, dword [esi + 0x13c]
add eax, edi
mov dword [edx + 8], eax
jmp 0x4254f0
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
mov ecx, esi
pop edi
mov dword [esi + 0x98], eax
pop esi
jmp 0x425590
cmp eax, 0xcc
je 0x42557e
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x11
mov ecx, dword [esi]
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
pop edi
mov ecx, esi
pop esi
jmp 0x425590
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x10], 0xcc
je 0x4255bd
mov eax, dword [esi + 0x1a0]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x8c], 0
mov dword [esi + 0x10], 0xcc
mov eax, dword [esi + 0x1a0]
cmp dword [eax + 8], 0
je 0x425653
mov ecx, dword [esi + 0x8c]
lea ebx, [esi + 0x8c]
nop dword [eax]
cmp ecx, dword [esi + 0x74]
jae 0x425626
mov eax, dword [esi + 8]
mov edi, ecx
test eax, eax
je 0x425607
mov dword [eax + 4], ecx
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x74]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
mov edi, dword [ebx]
add esp, 4
mov eax, dword [esi + 0x1a4]
push 0
push ebx
push 0
mov eax, dword [eax + 4]
push esi
call eax
mov ecx, dword [ebx]
add esp, 0x10
cmp ecx, edi
je 0x42566c
cmp ecx, dword [esi + 0x74]
jb 0x4255e5
mov eax, dword [esi + 0x1a0]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x1a0]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
xor ecx, ecx
mov eax, dword [esi + 0x1a0]
add esp, 8
cmp dword [eax + 8], ecx
jne 0x4255e0
xor eax, eax
cmp dword [esi + 0x44], eax
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x10], eax
mov eax, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret