joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4188dc
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x4257bc]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x426010]
je 0x418911
inc eax
cmp eax, 0x13
jb 0x418902
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x426010]
jne 0x418a37
mov eax, dword [0x426f84]
cmp eax, 1
je 0x418a0f
cmp eax, edx
jne 0x418941
cmp dword [0x4257b8], 1
je 0x418a0f
cmp ecx, 0xfc
je 0x418a37
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x418977
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00412ae0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.004129c0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4189ab
mov eax, edi
push eax
call fcn.004129c0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x4220d8
push edi
call fcn.004134f0
add esp, 0x10
push edi
call fcn.004129c0
push dword [esi + 0x426014]
mov ebx, eax
call fcn.004129c0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00412040
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00412ae0
push edi
push ebx
call fcn.00412af0
push 0x4220b8
push ebx
call fcn.00412af0
push dword [esi + 0x426014]
push ebx
call fcn.00412af0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0041b07b
add esp, 0x2c
jmp 0x418a37
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x426014]
push dword [esi]
call fcn.004129c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.004142c3
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x41a5a4
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x4257bc]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x41a5d5
xor eax, eax
jmp 0x41a75e
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x427420]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x41a611
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.0041b96a
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x41a6ec
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x41a72a
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x41a675
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x41a666
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x41a646
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41a6b5
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x41a6be
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x41a637
jmp 0x41a6c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x41a759
cmp dword [ebp - 0x6c], edi
je 0x41a72a
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x41a71f
call fcn.0041948b
mov dword [eax], 9
call fcn.00419494
mov dword [eax], esi
jmp 0x41a754
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41a714
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x41a6c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x41a6c0
push dword [ebp - 0x6c]
call fcn.0041949d
pop ecx
jmp 0x41a754
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x41a742
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x41a742
xor eax, eax
jmp 0x41a75c
call fcn.0041948b
mov dword [eax], 0x1c
call fcn.00419494
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x41a75c
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.004142c3
add ebp, 0x3a0
leave
ret
Function at 0x41b07b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x4273d4], ebx
push esi
push edi
jne 0x41b0fb
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x41b136
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x422504
push edi
call esi
test eax, eax
mov dword [0x4273d4], eax
je 0x41b136
push 0x4224f4
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x4273d8], eax
call esi
cmp dword [0x426f14], 2
mov dword [0x4273dc], eax
jne 0x41b0fb
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x4273e4], eax
je 0x41b0fb
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x4273e0], eax
mov eax, dword [0x4273e0]
test eax, eax
je 0x41b140
call eax
test eax, eax
je 0x41b127
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x4273e4]
test eax, eax
je 0x41b127
test byte [ebp - 8], 1
jne 0x41b140
cmp dword [0x426f20], 4
jb 0x41b13a
or byte [ebp + 0x12], 0x20
jmp 0x41b15f
xor eax, eax
jmp 0x41b16f
or byte [ebp + 0x12], 4
jmp 0x41b15f
mov eax, dword [0x4273d8]
test eax, eax
je 0x41b15f
call eax
mov ebx, eax
test ebx, ebx
je 0x41b15f
mov eax, dword [0x4273dc]
test eax, eax
je 0x41b15f
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x4273d4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41c948
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x41c961
or eax, 0xffffffff
jmp 0x41c9c2
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x41c9be
push 0x3d
push esi
call fcn.0041ce00
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x41c9be
cmp esi, eax
je 0x41c9be
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x426f34]
sete cl
cmp eax, dword [0x426f38]
mov dword [ebp - 8], ecx
jne 0x41c9a4
mov edi, eax
call fcn.0041c8e7
mov dword [0x426f34], eax
cmp eax, ebx
jne 0x41c9fd
cmp dword [ebp + 0xc], ebx
je 0x41c9c6
cmp dword [0x426f3c], ebx
je 0x41c9c6
call fcn.0041ba3b
test eax, eax
je 0x41c9fd
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x41c9cf
xor eax, eax
jmp 0x41c9c1
push 4
call fcn.00411d77
cmp eax, ebx
pop ecx
mov dword [0x426f34], eax
je 0x41c9be
mov dword [eax], ebx
cmp dword [0x426f3c], ebx
jne 0x41c9fd
push 4
call fcn.00411d77
cmp eax, ebx
pop ecx
mov dword [0x426f3c], eax
je 0x41c9be
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x426f34]
call fcn.0041c89a
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x41ca5e
cmp dword [esi], ebx
je 0x41ca5e
lea esi, [esi + edi*4]
push dword [esi]
call fcn.00411d89
cmp dword [ebp - 8], ebx
pop ecx
jne 0x41ca41
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x41ca9f
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x41ca38
mov eax, edi
shl eax, 2
push eax
push dword [0x426f34]
call fcn.00412dc8
cmp eax, ebx
pop ecx
pop ecx
je 0x41ca9f
jmp 0x41ca9a
cmp dword [ebp - 8], ebx
jne 0x41cb0a
cmp edi, ebx
jge 0x41ca6d
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x426f34]
call fcn.00412dc8
cmp eax, ebx
pop ecx
pop ecx
je 0x41c9be
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x426f34], eax
cmp dword [ebp + 0xc], ebx
je 0x41caf4
push dword [ebp - 4]
call fcn.004129c0
inc eax
inc eax
push eax
call fcn.00411d77
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x41caf4
push dword [ebp - 4]
push esi
call fcn.00412ae0
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x41caed
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.00411d89
pop ecx
cmp dword [ebp - 8], ebx
je 0x41cb02
push dword [ebp - 4]
call fcn.00411d89
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x41c9c1
push dword [ebp - 4]
call fcn.00411d89
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x41c9cb
Function at 0x1001bdc
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
call fcn.01001beb
jmp fcn.01001b4b

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x401c00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
mov esi, dword [ebp + 0xc]
xor edx, edx
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
lea esp, [esp]
lea esp, [esp]
nop
mov dl, byte [esi]
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x401040]
add esi, 1
sub ecx, 1
jne 0x401c20
not eax
pop edx
pop ecx
pop esi
leave
ret 8

Function at 0x40679a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
jmp 0x4067de
inc ecx
cmp ecx, dword [0x40c029]
jne 0x4067de
push 0x400
push 0x41e4ad
push 0x16
push dword [0x40b7b2]
call fcn.00406bee
push 0x41e4ad
call fcn.00402d3c
xor eax, eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x10
cmp dword [ecx + esi], 0x4550
jne 0x4067a9
add esi, ecx
mov eax, dword [ebp + 8]
add eax, dword [0x40c029]
cmp dword [eax - 4], 0x32505564
jne 0x40681e
push 0x400
push 0x41e8ad
push 0x17
push dword [0x40b7b2]
call fcn.00406bee
push 0x41e8ad
call fcn.00402d3c
jmp 0x4067d3
push esi
movzx eax, word [esi + 6]
dec eax
imul eax, eax, 0x28
movzx ecx, word [esi + 0x14]
add esi, 0x18
add esi, ecx
mov edi, esi
or dword [edi + 0x24], 0x80000000
add edi, eax
pop esi
cmp dword [ebp + 0xc], 4
jne 0x406847
mov ecx, dword [esi + 0x34]
jmp 0x406849
xor ecx, ecx
mov dword [0x405f2a], ecx
mov ebx, dword [esi + 0x28]
mov ecx, dword [esi + 0x34]
mov dword [0x405f22], ebx
add dword [0x405f22], ecx
mov eax, dword [edi + 0xc]
add eax, dword [edi + 0x10]
mov dword [esi + 0x28], eax
cmp dword [ebp + 0xc], 4
jne 0x40687a
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 0x10]
add eax, ebx
jmp 0x40687c
xor eax, eax
mov dword [0x405f2e], eax
mov eax, dword [ebp + 8]
add eax, dword [edi + 0x14]
add eax, dword [edi + 0x10]
mov ecx, 0x405d05
mov ebx, 0x240
mov edx, eax
add edx, ebx
push edx
push ebx
push ecx
push eax
call fcn.00406d02
pop edx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 0x16]
lea ecx, [eax + ecx]
mov ebx, dword [str.GetActiveWindow]
sub ebx, eax
push ebx
push ecx
push edx
call fcn.00406d02
mov eax, dword [ebp + 0x10]
push 0x100
push eax
call fcn.00407040
add dword [edi + 8], eax
add dword [edi + 0x10], eax
or dword [edi + 0x24], 0xe0000000
mov eax, dword [edi + 0xc]
add eax, dword [edi + 8]
mov ebx, dword [esi + 0x38]
push ebx
push eax
call fcn.00407040
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 8]
add eax, dword [0x40c035]
mov dword [eax - 4], 0x32505564
xor eax, eax
inc eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x10
Function at 0x406f90
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
push 0x4c
push 0x41ecb0
call fcn.00406d08
mov eax, dword [ebp + 8]
mov word [eax], 0
mov esi, 0x41ecb0
mov dword [esi], 0x4c
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0x400
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 4], eax
push esi
call 0x40a7dc
or eax, eax
jne 0x406fe5
mov eax, dword [ebp + 8]
mov dword [eax], 0
popal
mov eax, dword [ebp + 8]
cmp byte [eax + 1], 0x3a
jne 0x406ff6
mov eax, 1
jmp 0x406ff8
xor eax, eax
leave
ret 0x10

Function at 0x407140
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push edi
call fcn.00406d74
or eax, eax
je 0x4071a0
mov ebx, eax
jmp 0x40719b
lodsb al, byte [esi]
cmp al, 0x2f
jne 0x40719b
push ebx
push edi
push ebx
push esi
push 1
push 0
call 0x40a7ac
cmp eax, 2
jne 0x40719b
mov byte [ebp - 1], 1
mov edi, dword [ebp + 0x10]
or edi, edi
je 0x407199
add esi, ebx
inc esi
cmp byte [esi], 0x2f
je 0x407196
cmp byte [esi], 0
je 0x407196
lodsb al, byte [esi]
cmp al, 0x22
je 0x407194
stosb byte es:[edi], al
jmp 0x407184
mov byte [edi], 0
jmp 0x4071a0
cmp byte [esi], 0
jne 0x40715f
popal
movzx eax, byte [ebp - 1]
leave
ret 0xc

Function at 0x407200
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.00406d6e
mov esi, 0x41ed00
mov dword [esi], 0x4c
push dword [ebp + 0xc]
pop dword [esi + 0xc]
push dword [ebp + 8]
pop dword [esi + 0x1c]
mov dword [esi + 0x20], 0x400
mov dword [esi + 0x34], 2
push dword [ebp + 0x10]
pop dword [esi + 0x2c]
push dword [ebp + 0x14]
pop dword [esi + 4]
push esi
call 0x40a7e2
or eax, eax
jne 0x407253
mov eax, dword [ebp + 8]
mov dword [eax], 0
popal
mov eax, dword [ebp + 8]
cmp byte [eax + 1], 0x3a
jne 0x407264
mov eax, 1
jmp 0x407266
xor eax, eax
leave
ret 0x14

Function at 0x407270
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
pushal
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
or esi, esi
je 0x4072ca
push esi
call fcn.00406cba
cmp eax, 0xffffffff
jne 0x4072ca
cmp byte [esi], 0
je 0x4072ca
lea edi, [ebp - 0x401]
jmp 0x40729f
lodsb al, byte [esi]
stosb byte es:[edi], al
cmp byte [esi], 0x5c
je 0x4072a9
cmp byte [esi], 0
jne 0x40729d
cmp al, 0x3a
je 0x40729d
lodsb al, byte [esi]
stosb byte es:[edi], al
mov byte [edi], 0
push 0
lea eax, [ebp - 0x401]
push eax
call 0x40a7b2
cmp byte [esi - 1], 0
jne 0x40729b
mov byte [ebp - 1], 1
popal
movzx eax, byte [ebp - 1]
leave
ret 4
Function at 0x4072e0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
or esi, esi
je 0x40734e
push esi
call fcn.00406d74
or eax, eax
je 0x40734e
mov ebx, eax
push 0
call 0x40a776
cmp eax, 1
jne 0x40734e
add ebx, 2
push ebx
push 0x2042
call 0x40a7b8
or eax, eax
je 0x407349
mov ebx, eax
push ebx
call 0x40a7be
or eax, eax
je 0x407349
mov edi, eax
push esi
push edi
call fcn.00406d6e
call 0x40a770
cmp eax, 1
jne 0x407349
push edi
call 0x40a7c4
push ebx
push 1
call 0x40a77c
call 0x40a76a
popal
movzx eax, byte [ebp - 1]
leave
ret 4

Function at 0x401c00
Capabilities:
Hash data with crc32

Disassembly:
push esi
mov esi, dword [0x403080]
push edi
push 0x10000
push 2
call esi
mov edi, dword [0x4030b8]
push eax
mov dword [0x4043a0], eax
call edi
push 0x8040
push 2
mov dword [0x40439c], eax
call esi
push eax
mov dword [0x4043d8], eax
call edi
push 0x400
push 2
mov dword [0x4043c8], eax
call esi
push eax
mov dword [0x4043b8], eax
call edi
mov dword [0x4043a4], eax
and dword [eax], 0
push 1
pop eax
push 8
mov ecx, eax
pop edx
test cl, 1
je 0x401c6a
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x401c6c
shr ecx, 1
dec edx
jne 0x401c5b
mov edx, dword [0x4043a4]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, 0x100
jl 0x401c56
pop edi
pop esi
ret

Function at 0x402cb6
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x402cc8
or eax, 0xffffffff
mov dword [section..data], eax
jmp 0x402d01
mov edx, dword [esp + 8]
mov eax, dword [section..data]
push esi
mov esi, edx
dec edx
test esi, esi
je 0x402cfb
push edi
inc edx
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
mov edi, dword [0x4043a4]
shr eax, 8
mov esi, dword [edi + esi*4]
xor eax, esi
inc ecx
dec edx
jne 0x402cdb
pop edi
mov dword [section..data], eax
pop esi
not eax
ret 8
Function at 0x406c18
Capabilities:
Encode data using xor

Disassembly:
push 8
mov eax, 0x434eb0
call fcn.0042dcc1
xor esi, esi
mov dword [ebp - 4], esi
push esi
push 0xc
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], esi
call fcn.00406981
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 1
mov eax, 0xf51e
xor ax, word [esi*2 + 0x436688]
push esi
mov ecx, ebx
movzx edi, ax
call fcn.00404f1a
inc esi
mov word [eax], di
cmp esi, 0xc
jb 0x406c43
mov eax, ebx
call fcn.0042dd60
ret
Function at 0x414db7
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
movzx eax, word [ebx + 6]
test eax, eax
jle 0x414e39
push esi
push edi
xor edi, edi
mov dword [ebp + 8], eax
mov eax, dword [0x43bfd0]
mov ecx, dword [ebp + 0x10]
mov dword [0x43bffc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x3c]
lea eax, [eax + edi + 0xf8]
push eax
call fcn.00404b56
mov ecx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [esi + 0xc]
add eax, dword [ebx + 0x34]
push dword [esi + 0x14]
mov dword [0x43b228], eax
call fcn.00404b56
mov ecx, dword [esi + 0x10]
add ecx, 0xc
mov dword [0x43b224], ecx
add ecx, 0xfffffff4
push ecx
push eax
push dword [0x43b228]
mov dword [0x43b220], eax
push dword [0x43bffc]
call fcn.0040f4bb
add esp, 0x10
add edi, 0x28
dec dword [ebp + 8]
jne 0x414dcd
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret
Function at 0x4350c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
xor eax, eax
xor ebx, ebx
cmp edx, 0
je 0x435223
mov al, byte [edi]
mov bl, byte [edi + 4]
add edi, 8
lea ecx, [esi + edx]
sub ebp, esi
mov dword [esp + 0x18], ecx
inc al
cmp dword [edi + 0x100], 0xffffffff
je 0x4351f0
mov ecx, dword [edi + eax*4]
and edx, 0xfffffffc
je 0x4351c0
lea edx, [esi + edx - 4]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebp
lea esp, [esp]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
mov ecx, dword [edi + eax*4]
mov ebp, dword [edi + edx*4]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
ror ebp, 8
mov ecx, dword [edi + eax*4]
or ebp, dword [edi + edx*4]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
ror ebp, 8
mov ecx, dword [edi + eax*4]
or ebp, dword [edi + edx*4]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
ror ebp, 8
mov ecx, dword [esp + 0x20]
or ebp, dword [edi + edx*4]
ror ebp, 8
xor ebp, dword [esi]
cmp esi, dword [esp + 0x1c]
mov dword [ecx + esi], ebp
lea esi, [esi + 4]
mov ecx, dword [edi + eax*4]
jb 0x435120
cmp esi, dword [esp + 0x18]
je 0x43521b
mov ebp, dword [esp + 0x20]
lea esp, [esp]
nop
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
mov edx, dword [edi + edx*4]
xor dl, byte [esi]
lea esi, [esi + 1]
mov ecx, dword [edi + eax*4]
cmp esi, dword [esp + 0x18]
mov byte [ebp + esi - 1], dl
jb 0x4351c0
jmp 0x43521b
movzx ecx, byte [edi + eax]
add bl, cl
movzx edx, byte [edi + ebx]
mov byte [edi + ebx], cl
mov byte [edi + eax], dl
add dl, cl
movzx edx, byte [edi + edx]
add al, 1
xor dl, byte [esi]
lea esi, [esi + 1]
movzx ecx, byte [edi + eax]
cmp esi, dword [esp + 0x18]
mov byte [ebp + esi - 1], dl
jb 0x4351f4
dec al
mov byte [edi - 4], bl
mov byte [edi - 8], al
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x408460
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x42ef30], eax
mov edx, 1
dec edx
nop
inc edx
mov eax, edx
dec eax
mov ecx, dword [eax*4 + 0x42ef30]
shr ecx, 0x1e
mov eax, edx
dec eax
mov eax, dword [eax*4 + 0x42ef30]
xor ecx, eax
imul ecx, ecx, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x42ef30], ecx
cmp edx, 0x26f
jl 0x40846c
mov dword [0x426870], 0x270
ret

Function at 0x4084b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 4], esi
mov eax, dword [0x42e010]
cmp eax, dword [0x426800]
je 0x4084d1
mov dword [0x426870], 0x271
mov eax, dword [0x426870]
cmp eax, 0x270
jl 0x4085f9
mov eax, dword [0x426870]
cmp eax, 0x271
jne 0x408508
mov eax, dword [0x42e010]
call fcn.00408460
mov eax, dword [0x42e010]
not eax
mov dword [0x42e010], eax
mov dword [0x426800], eax
mov edx, 0
dec edx
mov esi, esi
inc edx
mov eax, edx
inc eax
mov eax, dword [eax*4 + 0x42ef30]
and eax, 0x7fffffff
mov ebx, dword [edx*4 + 0x42ef30]
and ebx, 0x80000000
or eax, ebx
mov ecx, eax
mov eax, edx
add eax, 0x18d
mov ebx, ecx
shr ebx, 1
mov esi, dword [eax*4 + 0x42ef30]
xor esi, ebx
mov eax, ecx
and eax, 1
mov eax, dword [eax*4 + 0x426880]
xor esi, eax
mov dword [edx*4 + 0x42ef30], esi
cmp edx, 0xe2
jl 0x408510
mov edx, 0xe3
dec edx
inc edx
mov eax, edx
inc eax
mov eax, dword [eax*4 + 0x42ef30]
and eax, 0x7fffffff
mov ebx, dword [edx*4 + 0x42ef30]
and ebx, 0x80000000
or eax, ebx
mov ecx, eax
mov eax, edx
add eax, 0xffffff1d
mov ebx, ecx
shr ebx, 1
mov esi, dword [eax*4 + 0x42ef30]
xor esi, ebx
mov eax, ecx
and eax, 1
mov eax, dword [eax*4 + 0x426880]
xor esi, eax
mov dword [edx*4 + 0x42ef30], esi
cmp edx, 0x26e
jl 0x408568
mov eax, dword [0x42f8ec]
and eax, 0x80000000
mov edx, dword [0x42ef30]
and edx, 0x7fffffff
or eax, edx
mov ecx, eax
shr eax, 1
mov edx, dword [0x42f560]
xor eax, edx
and ecx, 1
mov edx, dword [ecx*4 + 0x426880]
xor eax, edx
mov dword [0x42f8ec], eax
mov dword [0x426870], 0
mov eax, dword [0x426870]
mov edx, dword [eax*4 + 0x42ef30]
inc dword [0x426870]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov ebx, dword [esp]
mov esi, dword [esp + 4]
add esp, 8
ret