joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41260c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b0
mov eax, dword [0x43d078]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x436596
lea esi, [ebp - 0x404]
call fcn.004104e7
xor ebx, ebx
cmp dword [0x65ddc4], ebx
jne 0x412733
push 0x436597
mov esi, 0x65e308
call fcn.00410549
push 0x436688
push 8
pop ebx
lea edi, [ebp - 0x42c]
call fcn.00411c4a
mov edi, eax
mov ebx, 0x65e308
lea esi, [ebp - 0x450]
mov eax, ebx
call fcn.004105c7
lea esi, [ebp - 0x438]
call fcn.00410609
mov esi, ebx
call fcn.0041058d
mov eax, dword [ebp - 0x438]
call fcn.00402920
mov eax, dword [ebp - 0x450]
call fcn.00402920
mov eax, dword [ebp - 0x42c]
call fcn.00402920
push 0x436690
push dword [0x65dbd0]
lea esi, [ebp - 0x420]
lea eax, [ebp - 0x404]
call fcn.00410609
lea esi, [ebp - 0x414]
call fcn.00410609
mov edi, ebx
lea esi, [ebp - 0x444]
call fcn.004105c7
lea esi, [ebp - 0x404]
call fcn.0041058d
mov eax, dword [ebp - 0x444]
call fcn.00402920
mov eax, dword [ebp - 0x414]
call fcn.00402920
mov eax, dword [ebp - 0x420]
call fcn.00402920
push 0x1d400
push 0x43f6e0
sub esp, 0xc
mov eax, esi
mov esi, esp
call fcn.00410519
call fcn.00412446
add esp, 0x14
mov dword [0x65ddc4], 1
xor ebx, ebx
push 0x3e8
lea eax, [ebp - 0x3f4]
push ebx
push eax
mov dword [ebp - 0x408], ebx
mov dword [ebp - 0x3f8], ebx
call fcn.00423b70
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0xc
push dword [ebp + 0x40]
lea eax, [ebp - 0x3f4]
push eax
call esi
push 0x436694
lea eax, [ebp - 0x3f4]
push eax
call esi
push str.dea7c01007a657ba0c601c941632f140
lea eax, [ebp - 0x3f4]
push eax
call esi
push 0x436698
lea eax, [ebp - 0x3f4]
push eax
call esi
push dword [ebp + 0x14]
lea eax, [ebp - 0x3f4]
push eax
call esi
push 0x43669c
lea eax, [ebp - 0x3f4]
push eax
call esi
push dword [ebp + 0x20]
lea eax, [ebp - 0x3f4]
push eax
call esi
push 0x4366a0
lea eax, [ebp - 0x3f4]
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x3f4]
push eax
call esi
push 0x4366a4
lea eax, [ebp - 0x3f4]
push eax
call esi
lea eax, [ebp - 0x3f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x3f4]
push eax
lea eax, [ebp - 0x3f8]
push eax
lea esi, [ebp - 0x408]
call fcn.00411e5d
xor eax, eax
lea edi, [ebp - 0x460]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
lea eax, [ebp - 0x4ac]
push ebx
push eax
call fcn.00423b70
add esp, 0x18
push dword [ebp - 0x3f8]
lea esi, [ebp - 0x414]
push 0x4366a8
lea eax, [ebp - 0x404]
call fcn.00410609
lea esi, [ebp - 0x420]
call fcn.00410609
lea esi, [ebp - 0x404]
call fcn.0041058d
mov eax, dword [ebp - 0x420]
call fcn.00402920
mov eax, dword [ebp - 0x414]
call fcn.00402920
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x4ac]
push eax
push ebx
push ebx
push 0x20
push 1
push ebx
push ebx
push dword [ebp - 0x404]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [ebp - 0x404]
call fcn.00402920
lea esi, [ebp + 0x14]
call fcn.00401cde
mov eax, dword [ebp + 8]
call fcn.00402920
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041cf6e
leave
ret
Function at 0x403ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
test eax, eax
jg 0x403efb
jl 0x403eee
test ecx, ecx
jne 0x403efb
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
mov edi, ecx
je 0x403fd4
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov ecx, ebx
call fcn.00420c10
mov ecx, edx
mov esi, eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jl 0x403f6b
jg 0x403f2b
test esi, esi
je 0x403f6b
mov eax, dword [esp + 0xc]
cmp eax, ecx
jg 0x403f3f
jl 0x403f39
cmp edi, esi
jae 0x403f3f
mov esi, edi
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push dword [esp + 0x18]
call fcn.00473250
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0xc]
sub edi, esi
sbb ecx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x10]
jmp 0x403f8e
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x403fbd
mov eax, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
adc ecx, 0xffffffff
add eax, esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
test ecx, ecx
jg 0x403f12
jl 0x403fc1
test edi, edi
jne 0x403f12
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
sbb edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esp + 0xc]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
sbb edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
test eax, eax
je 0x404023
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [esp + 0x14], edx
mov eax, dword [eax]
test eax, eax
je 0x40402a
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.00473250
mov eax, dword [ebp + 8]
sub edi, esi
add eax, esi
add esp, 0xc
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x10]
jmp 0x40402d
lea eax, [ebx + 0x2c]
mov dword [esp + 0x14], eax
mov esi, dword [ebp + 8]
cmp dword [ebx + 0x4c], 0
je 0x404097
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x404057
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [eax], edx
cmp edi, 0xfff
jbe 0x404082
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.00479ed8
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x404097
cmp edi, eax
ja 0x404060
test edi, edi
je 0x404097
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.00479ed8
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40af80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x498e70
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x51a900]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea eax, [ecx + 4]
mov dword [ecx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
lea ebx, [ecx + 0x24]
mov dword [ebp - 0x14], eax
lea edi, [ecx + 0x28]
mov dword [eax], 0
push 8
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
call fcn.00471a4a
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00470c5a
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [eax + 0x34], esi
call fcn.00406800
mov eax, dword [ebp - 0x10]
lea edx, [eax + 8]
lea ecx, [eax + 0x14]
lea esi, [eax + 4]
mov dword [eax + 0x10], edx
mov dword [eax + 0xc], esi
mov esi, eax
mov dword [eax + 0x1c], ecx
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], edi
mov esi, dword [ebp - 0x14]
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [eax], 0
mov eax, dword [0x5234d8]
mov dword [edi], 0
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [0x5234dc]
mov dword [ebx], 0
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x4c], 0
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414c30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x414c46
mov eax, 6
mov dword [esp + 4], eax
jmp fcn.00417b90
cmp eax, 0x3b9aca00
jge 0x414c56
mov dword [esp + 4], eax
jmp fcn.00417b90
mov ecx, 0x84
mov eax, edx
mov edx, ecx
ret
Function at 0x418240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x41825d
xorps xmm3, xmm3
mov eax, 6
cvtss2sd xmm3, xmm2
mov dword [esp + 4], eax
jmp fcn.00417b90
cmp eax, 0x3b9aca00
jge 0x418274
xorps xmm3, xmm3
cvtss2sd xmm3, xmm2
mov dword [esp + 4], eax
jmp fcn.00417b90
mov ecx, 0x84
mov eax, edx
mov edx, ecx
ret
Function at 0x424a50
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499e6d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x51a900]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
cmp dword [0x52356c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x424aba
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x424aba
push 0x50b4d8
push eax
call esi
mov dword [0x52356c], eax
test eax, eax
jne 0x424aba
xor bl, bl
jmp 0x424bd7
test edi, edi
je 0x424af5
cmp edi, 0xffffffff
je 0x424af5
push str.NtOpenFile
push str.ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call esi
test eax, eax
je 0x424af5
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov cl, byte [eax + 4]
push 0
push 5
mov byte [ebp - 0x14], cl
lea ecx, [ebp - 0x18]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor al, al
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x31], al
lea eax, [ebp + 8]
push eax
call fcn.00422300
mov eax, dword [ebp - 0x20]
push 4
push 0x3000
lea esi, [eax*2 + 2]
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
je 0x424b8a
cmp dword [ebp - 0x1c], 7
lea ecx, [ebp - 0x30]
push 0
cmova ecx, dword [ebp - 0x30]
push esi
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x424b7b
push 0
push 0
push ebx
push dword [0x52356c]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x424b7b
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
sete al
mov byte [ebp - 0x31], al
push 0x8000
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x424bc0
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x424bb6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x424c2b
push ecx
push edx
call fcn.00471a37
add esp, 8
mov bl, byte [ebp - 0x31]
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov ecx, dword [ebp + 0x1c]
cmp ecx, 7
jbe 0x424c0d
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x424c03
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x424c2b
push ecx
push edx
call fcn.00471a37
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00471a29
mov esp, ebp
pop ebp
ret
call fcn.0047694f
int3
Function at 0x425d60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, dword [ecx]
push edi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x425daf
lea edx, [esi + 8]
mov edi, eax
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x425d72
mov eax, dword [esi]
jmp 0x425e95
cmp eax, 0x4e0
jb 0x425e95
push ebx
mov ebx, dword [esi + 0x9c4]
lea edi, [esi + 0x9c4]
push ebp
mov ebp, 0xe3
nop dword [eax]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebp, 1
jne 0x425dd0
mov ebx, dword [esi + 0xd50]
lea edi, [esi + 0xd50]
mov ebp, 0x18c
nop dword [eax]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebp, 1
jne 0x425e20
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
pop ebx
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x438e40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49a310
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x51a900]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [esi], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
jns 0x438f94
mov eax, ecx
xor edi, edi
cdq
sub eax, edx
sar eax, 1
add eax, ecx
test eax, eax
cmovg edi, eax
cmp edi, ecx
jle 0x438f94
lea ecx, [edi*4]
call fcn.0043e250
mov edx, dword [esi + 0x18]
mov dword [ebp - 0x18], eax
test edx, edx
je 0x438f8e
mov ecx, dword [esi + 0x10]
shl ecx, 2
push ecx
push edx
push eax
call fcn.00473250
mov ebx, dword [esi + 0x18]
add esp, 0xc
test ebx, ebx
je 0x438f82
mov ecx, dword [0x524aa8]
test ecx, ecx
je 0x438f82
movsx eax, word [ecx + 0x5e30]
mov edx, dword [ecx + 0x3f08]
mov dword [ebp - 0x14], edx
lea eax, [eax*8 + 0x5e34]
add eax, ecx
cmp dword [eax], edx
je 0x438f78
movsx eax, word [ecx + 0x5e30]
inc eax
mov dword [ebp - 0x10], 6
cdq
idiv dword [ebp - 0x10]
movzx eax, dx
mov edx, dword [ebp - 0x14]
mov word [ecx + 0x5e30], ax
cwde
lea eax, [eax*8 + 0x5e34]
add eax, ecx
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5e2c]
push ebx
call fcn.0047ecbb
mov eax, dword [ebp - 0x18]
add esp, 4
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b040
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x43b09e
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x43b082
cmp edi, 2
jb 0x43b082
cmp byte [esi], cl
jne 0x43b082
cmp byte [esi + 1], cl
jne 0x43b082
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x50c940]
jmp 0x43b053
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x50c940]
test edi, edi
jne 0x43b053
pop edi
pop esi
not eax
pop ebx
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x43b0cd
cmp cl, 0x23
jne 0x43b0b4
cmp byte [esi], cl
jne 0x43b0b4
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x50c940]
test cl, cl
jne 0x43b0a5
pop edi
pop esi
not eax
pop ebx
ret

Function at 0x43b1c0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x43b1d2
mov dword [edi], 0
mov edx, 0x50c50c
call fcn.0043b0e0
mov esi, eax
test esi, esi
je 0x43b27a
push esi
call fcn.0048296a
mov ebp, eax
add esp, 4
cmp ebp, 0xffffffff
je 0x43b271
push 2
push 0
push esi
call fcn.00479c6a
add esp, 0xc
test eax, eax
jne 0x43b271
push esi
call fcn.0048296a
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x43b271
push 0
push ebp
push esi
call fcn.00479c6a
add esp, 0xc
test eax, eax
jne 0x43b271
mov ecx, ebx
call fcn.0043e250
mov ebp, eax
test ebp, ebp
je 0x43b271
push esi
push ebx
push 1
push ebp
call fcn.00479ed8
add esp, 0x10
push esi
cmp eax, ebx
je 0x43b25c
call fcn.0047a71b
add esp, 4
mov ecx, ebp
call fcn.0043e2e0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
call fcn.0047a71b
add esp, 4
test edi, edi
je 0x43b26a
mov dword [edi], ebx
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call fcn.0047a71b
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x43db20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
lea edx, [esp + 0x10]
mov esi, 4
mov eax, dword [edi + 0xec]
mov ebx, dword [edi + 0xf4]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x50c940]
sub esi, 1
jne 0x43db40
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3fc0], ebx
jne 0x43db78
push ecx
push dword [esp + 0x14]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.0044fa90
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
ret 4

Function at 0x43db80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov edx, ecx
push esi
push edi
lea esi, [esp + 8]
mov edi, 0x10
movss xmm1, dword [edx + 0x108]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x10c]
subss xmm0, xmm1
mov ecx, dword [edx + 0xec]
movss dword [esp + 8], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [esp + 0xc], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [esp + 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xf4]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [esp + 0x14], xmm0
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x50c940]
sub edi, 1
jne 0x43dbf1
not edx
pop edi
mov eax, edx
pop esi
add esp, 0x10
ret 4
Function at 0x440fe0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [0x524aa8]
push ebx
push esi
push edi
mov esi, dword [eax + 0x3f78]
mov edi, ecx
mov eax, dword [eax + 0x3f70]
lea ebx, [esi + eax*8]
test eax, eax
je 0x440fbe
nop dword [eax]
mov edx, eax
shr edx, 1
cmp dword [esi + edx*8], edi
lea ecx, [esi + edx*8]
jae 0x440fb8
lea esi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
jmp 0x440fba
mov eax, edx
test eax, eax
jne 0x440fa0
cmp esi, ebx
je 0x440fcd
cmp dword [esi], edi
jne 0x440fcd
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x44101d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x441003
cmp byte [esi], bl
jne 0x441003
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x50c940]
test bl, bl
jne 0x440ff4
pop edi
pop esi
not ecx
pop ebx
jmp 0x440f80
Function at 0x44e960
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x524aa8]
test bl, bl
je 0x44e9a9
push ebp
or ebp, 0xffffffff
nop dword [eax]
cmp bl, 0x23
jne 0x44e98f
cmp byte [esi], bl
jne 0x44e98f
cmp byte [esi + 1], bl
cmove eax, ebp
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x50c940]
test bl, bl
jne 0x44e980
pop ebp
mov ecx, dword [edi + 0x5d44]
not eax
mov edx, dword [edi + 0x5d4c]
pop edi
pop esi
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*4]
pop ebx
cmp edx, ecx
je 0x44e9d0
cmp dword [edx + 4], eax
je 0x44e9d3
add edx, 0x24
cmp edx, ecx
jne 0x44e9c4
xor eax, eax
ret
mov eax, edx
ret
Function at 0x45a020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.00438970
lea ecx, [esi + 0xc]
call fcn.00438970
lea ecx, [esi + 0x18]
call fcn.00438970
mov dword [esi + 0x24], 0
mov ebp, 6
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov edi, dword [esi + 0x44]
test edi, edi
je 0x45a0d0
mov ecx, dword [0x524aa8]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test ecx, ecx
je 0x45a0c0
movsx edx, word [ecx + 0x5e30]
lea eax, [ecx + 0x5e34]
mov ebx, dword [ecx + 0x3f08]
lea eax, [eax + edx*8]
cmp dword [eax], ebx
je 0x45a0b6
lea eax, [edx + 1]
cdq
idiv ebp
movzx eax, dx
mov word [ecx + 0x5e30], ax
cwde
lea eax, [eax*8 + 0x5e34]
add eax, ecx
xor edx, edx
mov dword [eax], ebx
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5e2c]
push edi
call fcn.0047ecbb
add esp, 4
mov dword [esi + 0x44], 0
mov edi, dword [esi + 0x50]
test edi, edi
je 0x45a144
mov ecx, dword [0x524aa8]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test ecx, ecx
je 0x45a134
movsx edx, word [ecx + 0x5e30]
lea eax, [ecx + 0x5e34]
mov ebx, dword [ecx + 0x3f08]
lea eax, [eax + edx*8]
cmp dword [eax], ebx
je 0x45a12a
lea eax, [edx + 1]
cdq
idiv ebp
movzx eax, dx
mov word [ecx + 0x5e30], ax
cwde
lea eax, [eax*8 + 0x5e34]
add eax, ecx
xor edx, edx
mov dword [eax], ebx
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5e2c]
push edi
call fcn.0047ecbb
add esp, 4
mov dword [esi + 0x50], 0
lea ecx, [esi + 0x54]
call fcn.00438970
pop edi
lea ecx, [esi + 0x78]
pop esi
pop ebp
pop ebx
jmp fcn.0045c7b0