joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058ed
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push esi
lea ecx, [ebp - 0x18]
call fcn.0040174b
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push 1
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.0040174e
mov esi, eax
test esi, esi
je 0x4059b1
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.0040752b
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.004073d0
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.004073d0
and byte [ebp - 0x21b], 0
lea eax, [ebp - 0x21f]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.004073d0
lea eax, [ebp - 0x11c]
push 0x40f1dc
push eax
call fcn.004073d0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push esi
call fcn.004071e0
mov esi, eax
add esp, 0x40
test esi, esi
lea ecx, [ebp - 0x18]
jne 0x4059b5
call fcn.00401808
xor eax, eax
jmp 0x405a09
call fcn.00401808
push dword [ebp - 4]
lea eax, [ebp - 0x11c]
push esi
push eax
call fcn.00403cbb
push esi
call fcn.0040785b
add esp, 0x10
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.004046d7
pop ecx
test eax, eax
pop ecx
je 0x405a07
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x11c]
push eax
call fcn.00403dfa
pop ecx
push 1
pop esi
mov eax, esi
pop esi
leave
ret

Function at 0x405ee4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
and byte [ebp - 0x10c], 0
push ebx
lea eax, [ebp - 0x10c]
push 0x104
push eax
push 1
push str.spu
call fcn.00403434
pop ecx
pop ecx
push eax
push 0x40f244
push closesocket
call fcn.004044e4
lea eax, [ebp - 0x10c]
push eax
call fcn.00405ca4
movsx eax, byte [ebp - 0x10c]
mov bl, byte [ebp - 0x10a]
push eax
call fcn.0040773e
add esp, 0x1c
and dword [ebp - 8], 0
mov byte [ebp - 1], al
mov al, byte [ebp - 8]
add al, 0x61
cmp al, byte [ebp - 1]
je 0x405f8e
and byte [ebp - 0x10a], 0
mov byte [ebp - 0x10c], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
mov byte [ebp - 0x10a], bl
jne 0x405f8e
push dword [ebp + 8]
lea eax, [ebp - 0x10c]
push 0x405e8c
push eax
call fcn.00403e11
add esp, 0xc
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1a
jl 0x405f48
xor eax, eax
pop ebx
leave
ret 4
Function at 0x40209a
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor esi, esi
push ebp
xor edi, edi
cmp dword [esp + 0x18], esi
je 0x402109
push edi
mov eax, dword [0x412b4c]
push edi
push eax
push dword [0x412b64]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4020c9
mov edi, 1
call fcn.00401f36
test eax, eax
je 0x402120
call fcn.00401fca
test eax, eax
je 0x402120
mov dword [0x413024], 0
mov byte [0x40a7a0], 0
push 0x24
push 0
push 0x412ff0
call fcn.00405bd0
mov dword [0x40a8b0], 0
add esp, 0xc
jmp 0x402125
push 0
mov eax, dword [0x412b64]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x402125
mov edi, 1
test edi, edi
jne 0x4022d6
cmp dword [0x413154], 0
je 0x4022d6
cmp dword [0x40a8ac], 0
je 0x4022d6
test edi, edi
jne 0x4022d6
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
movsx eax, word [0x412b46]
cmp eax, dword [0x40a8b0]
jle 0x4022d6
lea eax, [esp + 0x10]
push 0
push eax
push 0x2e
push 0x40a760
push dword [0x412b64]
call ebx
mov ecx, dword [0x412ecc]
cmp eax, 1
jne 0x4022c9
cmp dword [esp + 0x10], 0x2e
jne 0x4022c9
cmp dword [0x40a760], 0x2014b50
jne 0x4022a9
movsx edx, word [0x40a77c]
movsx eax, word [0x40a77e]
add edx, eax
push 2
movsx eax, word [0x40a780]
lea ebp, [edx + eax]
mov eax, dword [0x413154]
lea ecx, [ebp + ecx + 0x2e]
push ecx
mov dword [0x412ecc], ecx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
test eax, eax
je 0x4022a2
push eax
mov dword [0x413154], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [0x413028], eax
test eax, eax
je 0x40229b
mov eax, dword [0x40a8b0]
push eax
push dword [0x40a8ac]
call fcn.00401c3d
add esp, 8
mov ecx, dword [0x413028]
add ecx, eax
push 0x2e
push 0x40a760
mov dword [0x413028], ecx
push ecx
call fcn.00405f64
lea ecx, [esp + 0x1c]
add esp, 0xc
mov eax, dword [0x413028]
push 0
add eax, 0x2e
push ecx
push ebp
mov dword [0x413028], eax
push eax
push dword [0x412b64]
call ebx
test eax, eax
je 0x402279
cmp ebp, dword [esp + 0x10]
jne 0x402279
inc esi
jmp 0xd8e034
mov esi, 0xffffffff
mov edi, 1
mov eax, dword [0x413154]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x413028], 0
jmp 0x4022ce
mov esi, 0xffffffff
jmp 0x4022c9
mov esi, 0xffffffff
jmp 0x4022c9
cmp dword [0x40a760], 0x4034b50
jne 0x4022c9
cmp word [0x412b46], 0x7fff
jne 0x4022c9
mov word [0x412b46], 0
mov edi, 1
test edi, edi
je 0x402155
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x403ad2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 1]
push 1
push ecx
push dword [0x412b64]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403b00
cmp dword [ebp - 8], 0
je 0x403b00
jmp fcn.00d8c9b0
mov eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x4044e3
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
mov eax, dword [0x40a904]
dec dword [0x40a904]
push ebx
push esi
test eax, eax
push edi
jg 0x4044ff
xor eax, eax
jmp 0x4045d5
cmp dword [0x412b3c], 0
jne 0x4045b4
lea eax, [esp + 0xc]
push 0
push eax
push 0x2800
push dword [0x412b38]
push dword [0x412b68]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x40453f
mov eax, dword [esp + 0xc]
and eax, 0xffff
mov dword [0x412b3c], eax
jmp 0x404549
mov dword [0x412b3c], 0xffffffff
cmp dword [0x412b3c], 0
jg 0x404556
xor eax, eax
jmp 0x4045d5
add dword [0x413030], 0x2800
cmp dword [0x41521c], 0
mov eax, dword [0x412b38]
mov dword [0x412ed0], eax
je 0x4045b4
mov edi, dword [0x40a904]
inc edi
cmp dword [0x412b3c], edi
jg 0x404588
jmp 0xd90e42
mov esi, dword [0x412b38]
mov eax, edi
dec edi
test eax, eax
je 0x4045b4
call fcn.004043bb
movzx ecx, byte [esi]
xor eax, ecx
push eax
mov ebx, eax
call fcn.004043d4
add esp, 4
mov eax, edi
dec edi
mov byte [esi], bl
inc esi
test eax, eax
jne 0x404595
mov eax, dword [0x412ed0]
mov edx, dword [esp + 0x14]
movzx cx, byte [eax]
mov word [edx], cx
mov eax, 8
inc dword [0x412ed0]
dec dword [0x412b3c]
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x408409
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x408470
push ebx
call fcn.004084fc
add esp, 4
test eax, eax
jne 0x408442
mov dword [0x415c0c], 0xf
mov dword [0x415c08], 0xd
jmp 0x4084f3
add bl, 0x40
lea eax, [ebp - 8]
push eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10c]
lea ebx, [ebp - 4]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
jmp 0xd90612
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4084f3
inc eax
cmp eax, 0x104
ja 0x4084f3
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4084b9
mov ecx, dword [ebp + 0x10]
cmp eax, ecx
jg 0x40849e
mov eax, ecx
push eax
call fcn.0040625a
add esp, 4
mov edx, eax
test edx, edx
jne 0x4084ca
mov dword [0x415c08], 0xc
jmp 0x4084f3
cmp eax, dword [ebp + 0x10]
jle 0x4084ca
mov dword [0x415c08], 0x22
jmp 0x4084f3
lea edi, [ebp - 0x10c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, edx
jmp 0x4084f5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4084fc
Capabilities:
Get disk information

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp fcn.00d8e96a
Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x61682565
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x787d77ce
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x424040
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
mov esi, dword [esp + 0x360]
push edi
xor edi, edi
mov dword [esp + 0x14], ecx
push esi
mov dword [esp + 0x14], edi
call fcn.0040c9d0
add esp, 4
test eax, eax
je 0x42420e
mov ebx, dword [esp + 0x368]
test ebx, ebx
je 0x42420e
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [esp + 0x18]
push esi
push eax
call edi
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.0040ce70
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 8
lea edx, [esp + 0x18]
push ebx
push edx
call ebp
lea eax, [esp + 0x220]
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x424137
call fcn.004246e0
lea edx, [esp + 0x11c]
push esi
push edx
call edi
lea eax, [esp + 0x11c]
push 0x104
push eax
call fcn.0040ce70
add esp, 8
lea ecx, [esp + 0x24c]
lea edx, [esp + 0x11c]
push ecx
push edx
call ebp
test byte [esp + 0x220], 0x10
jne 0x42411d
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x11c]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
jl 0x42411d
inc dword [esp + 0x10]
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4240c3
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [esp + 0x18]
push esi
push ecx
call edi
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.0040ce70
add esp, 8
lea eax, [esp + 0x18]
push 0x42b1bc
push eax
call ebp
lea ecx, [esp + 0x220]
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4241fd
call fcn.004246e0
test byte [esp + 0x220], 0x10
je 0x4241e3
cmp byte [esp + 0x24c], 0x2e
je 0x4241e3
lea eax, [esp + 0x11c]
push esi
push eax
call edi
lea ecx, [esp + 0x11c]
push 0x104
push ecx
call fcn.0040ce70
add esp, 8
lea edx, [esp + 0x24c]
lea eax, [esp + 0x11c]
push edx
push eax
call ebp
mov ecx, dword [esp + 0x368]
lea edx, [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
call fcn.00424040
add dword [esp + 0x10], eax
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x42417b
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
mov cl, 1
sal edi, cl
fadd dword [ebp - 0x73c60dac]
invalid
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp dword [eax - 0x16836f70], edx
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x43a880
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x432c20]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.0044f8b0
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0x43a94f
mov eax, 0x42c894
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x43a8c5
sub eax, edx
sar eax, 1
je 0x43a94f
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [fcn.00429234]
push 0x42c894
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.0044d4db
push 0x42c8b0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.0044da2b
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x43a94f
push eax
push 1
push 0x200
push esi
call fcn.0044dd1e
mov eax, dword [esp + 0x14]
push eax
call fcn.0044ddb2
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0044d4cc
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0044d4cc
add esp, 0x214
ret

Function at 0x43a970
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x432c20]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.0044f8b0
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0x43aa75
mov eax, 0x42c7dc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x43a9b5
sub eax, edx
sar eax, 1
je 0x43aa75
cmp dword [0x433fc0], 3
jne 0x43a9fc
push 0x104
lea edx, [esp + 0x10]
push edx
call dword [0x429214]
push 0x42c8b8
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.0044d4db
add esp, 0xc
jmp 0x43aa0c
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [fcn.00429234]
push 0x42c7dc
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.0044d4db
push 0x42c8b0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0044da2b
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x43aa75
push eax
push 1
push 0x200
push esi
call fcn.0044dd1e
mov edx, dword [esp + 0x14]
push edx
call fcn.0044ddb2
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0044d4cc
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0044d4cc
add esp, 0x214
ret
Function at 0x43b130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
or eax, 0xffffffff
push ebx
mov ebx, 1
push ebp
push esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x74], eax
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
call fcn.0044d5d9
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0x42e498]
fadd qword [0x42e4b0]
call fcn.004515d0
mov ebp, eax
xor esi, esi
xor edi, edi
test ebp, ebp
jle 0x43b250
call fcn.0044d5d9
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0x42e498]
fmul qword [0x42e4a8]
fadd qword [0x42e4a0]
call fcn.004515d0
mov ecx, eax
mov eax, dword [esp + ecx*4 + 0x18]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jle 0x43b238
lea esp, [esp]
add ecx, ebx
cmp ecx, 0x1a
jne 0x43b229
xor ecx, ecx
mov eax, dword [esp + ecx*4 + 0x18]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jg 0x43b220
add esi, dword [esp + ecx*4 + 0x18]
mov eax, dword [esp + 0x84]
add ecx, 0x61
mov word [eax + edi*2], cx
add edi, ebx
cmp edi, ebp
jl 0x43b1e7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret

Function at 0x43b2f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x432c20]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push 0x206
xor esi, esi
lea ecx, [esp + 0x12]
xor eax, eax
push esi
push ecx
mov word [esp + 0x18], ax
call fcn.0044f8b0
add esp, 0xc
cmp edi, esi
je 0x43b3d8
mov eax, 0x42c9b4
mov dword [esp + 4], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x43b335
sub eax, edx
sar eax, 1
je 0x43b35f
push 0x42c924
lea edx, [esp + 8]
push 0x42c9b4
push edx
call fcn.0044da2b
add esp, 0xc
jmp 0x43b39a
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [fcn.00429234]
push 0x42c894
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.0044d4db
push 0x42c924
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0044da2b
add esp, 0x18
mov eax, dword [esp + 4]
cmp eax, esi
je 0x43b3bd
push eax
push 1
push 0x200
push edi
call fcn.0044dff1
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0044ddb2
add esp, 0x14
mov eax, 1
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0044d4cc
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0044d4cc
add esp, 0x214
ret
Function at 0x43b3f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push 0x42c8b0
push eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0
call fcn.0044da2b
add esp, 0xc
test eax, eax
je 0x43b414
xor eax, eax
pop ecx
ret
mov edx, dword [esp]
push ebx
push ebp
push esi
push edi
push 2
push 0
push edx
call fcn.0044e0fd
mov eax, dword [esp + 0x1c]
push eax
call fcn.0044e31f
mov ecx, dword [esp + 0x20]
push 0
push 0
push ecx
mov esi, eax
call fcn.0044e0fd
lea ebp, [esi + 0x32]
push ebp
call fcn.0044e3dc
mov edx, dword [esp + 0x30]
push edx
push 1
mov edi, eax
push esi
push edi
call fcn.0044dd1e
mov eax, dword [esp + 0x40]
push eax
call fcn.0044ddb2
lea ebx, [edi + esi]
mov eax, 0x32
call fcn.0043b4c0
mov ecx, dword [esp + 0x4c]
push 0x42c924
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.0044da2b
add esp, 0x40
test eax, eax
je 0x43b492
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x10]
push eax
push 1
push ebp
push edi
call fcn.0044dff1
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0044ddb2
add esp, 0x14
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x43d0e0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x100c
call fcn.00451d60
mov eax, dword [0x432c20]
xor eax, esp
mov dword [esp + 0x1008], eax
mov edx, dword [edi]
mov eax, dword [esp + 0x1010]
push ebx
push ebp
mov ebp, dword [0x4293f4]
xor ebx, ebx
push ebx
push 4
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x1c], eax
call ebp
cmp eax, 4
je 0x43d138
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.0044d4cc
add esp, 0x100c
ret
cmp dword [esp + 8], ebx
jbe 0x43d177
push esi
nop
mov ecx, dword [edi]
push 0
push 0x1000
lea eax, [esp + 0x1c]
push eax
push ecx
call ebp
mov esi, eax
test esi, esi
je 0x43d176
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push eax
push esi
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.0044dff1
add ebx, esi
add esp, 0x10
cmp ebx, dword [esp + 0xc]
jb 0x43d140
pop esi
mov edx, dword [esp + 0xc]
mov eax, dword [edx]
push eax
call fcn.0044ddb2
mov ecx, dword [esp + 0x1014]
add esp, 4
cmp ebx, dword [esp + 8]
pop ebp
sbb eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.0044d4cc
add esp, 0x100c
ret
Function at 0x43eda0
Capabilities:
Hash data using sha1
Read file on windows

Disassembly:
mov eax, 0x1068
call fcn.00451d60
mov eax, dword [0x432c20]
xor eax, esp
mov dword [esp + 0x1064], eax
mov eax, dword [esp + 0x106c]
push ebx
push ebp
push 0x42c8b0
push eax
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x14], ebx
xor ebp, ebp
call fcn.0044da2b
mov eax, dword [esp + 0x14]
add esp, 0xc
cmp eax, ebx
jne 0x43ee0b
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
pop ebp
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
pop ebx
mov ecx, dword [esp + 0x1064]
xor ecx, esp
call fcn.0044d4cc
add esp, 0x1068
ret
push esi
push 2
push ebx
push eax
call fcn.0044e0fd
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0044e31f
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push edx
mov dword [esp + 0x2c], eax
call fcn.0044e0fd
mov eax, dword [esp + 0x28]
push eax
push 0x1000
lea ecx, [esp + 0x94]
push 1
push ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], 0x67452301
mov dword [esp + 0x4c], 0xefcdab89
mov dword [esp + 0x50], 0x98badcfe
mov dword [esp + 0x54], 0x10325476
mov dword [esp + 0x58], 0xc3d2e1f0
call fcn.0044dd1e
mov esi, eax
add esp, 0x2c
cmp esi, ebx
jbe 0x43eeb6
lea edx, [esp + 0x70]
push esi
push edx
lea ebx, [esp + 0x1c]
call fcn.0043ec10
mov eax, dword [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x80]
push 1
push ecx
add ebp, esi
call fcn.0044dd1e
mov esi, eax
add esp, 0x18
test esi, esi
ja 0x43ee81
xor ebx, ebx
push edi
lea esi, [esp + 0x18]
call fcn.0043ecb0
mov edx, dword [esp + 0x10]
push edx
call fcn.0044ddb2
add esp, 8
pop esi
cmp ebp, dword [esp + 0xc]
jb 0x43ede4
mov ecx, dword [esp + 0x106c]
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0044d4cc
add esp, 0x1068
ret

Function at 0x440c70
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0x440c77
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x440d54
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42de68]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x42de68]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x42de68]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42de68]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42de68]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42de68]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42de68]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42de68]
inc ecx
sub edx, 8
sub esi, 1
jne 0x440c90
pop edi
test edx, edx
je 0x440d7b
jmp 0x440d60
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x42de68]
inc ecx
sub edx, 1
jne 0x440d60
not eax
pop esi
ret