joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446325
Capabilities:
Encode data using xor

Disassembly:
invalid
div ch
xchg dh, bh
fisttp word [esi]
mov dl, 0xcb
push esp
lahf
jb 0x44631a
jge 0x4462a4
invalid
xor eax, 0x6e1af573
wait
in eax, dx
in al, dx
xor dword [ebx + 0x7b], edi
out 0x21, eax
and eax, 0xf6778309
jg 0x446378
sar dword [ebp - 0x46c14c13], 0x5b
mov edi, 0x25dd1d9a
mov dl, 0xfb
mov bh, 0xd6
sub ebx, ecx
jbe 0x446310
or ebx, dword [esi + 0xf]
sub edx, dword [ebx]
sub al, 0x8e
leave
jg 0x4463d1
test eax, 0x7bccfbf3
retf
pop edi
and byte [edx + 0xe], 0x6e
jl 0x4463d4
xor esp, esp
stosd dword es:[edi], eax
jne 0x446340
arpl word [edx], bp
mov ecx, dword [edi + 0x777f9e27]
mov eax, 0xff4c6cec
add edx, ecx
xchg ebp, eax
cmp al, 0x51
aaa
iretd
xor bh, byte [ebp + 0x74]
scasd eax, dword es:[edi]
call [ebx]
hlt
popfd
mov esi, 0x8d5f57fe
xor ebx, dword [ecx]
mov ebp, dword [eax + 0x28]
push 2
push edi
pop edi
lea esi, [ebx]
sbb dword [ebx + 0x26a2868], ecx
xor al, 0x2d
add al, byte [edx + 0x42]
push dword [ebx + 0xbfb8d5e]
fisub word [eax - 0x7c]
xchg esi, eax
adc ah, byte [ebx]
adc al, 0xab
sti
or ebx, esi
pushal
test byte [esi - 0x54ebdcee], dl
or ebx, edx
jns 0x4463d6
inc edx
dec ebp
loope 0x4463b5
jp 0x446471
push 0x99ada6a1
sbb eax, 0xb997fc1a
and eax, 0x19c4ee74
mov eax, dword [0x67a121d]
or eax, 0xf887bee1
aaa
lodsb al, byte [esi]
rol byte [edx + edi*2 - 0x403097aa], 1
imul eax, dword [ebp - 0x15301076], 0x6e
jns 0x446421
iretd
aam 0xad
movsd dword es:[edi], dword [esi]
in eax, dx
or eax, edi
or bl, dl
jle 0x4463ea
jbe 0x4463e7
inc edi
salc
xchg edi, eax
invalid
retf

Function at 0x44b776
Capabilities:
Encode data using xor

Disassembly:
jae 0x44b782
out 0x18, al
cmp dl, byte [edx]
sub byte [edx + eax - 0x608f581e], bh
lahf
push edx
inc edx
in eax, 0xc7
add eax, 0x4451d247
mov dl, 0xe8
xor byte [ebx - 0x70], dl
clc
push esp
xor eax, 0x3078096c
inc edx
aad 0xe8
xor al, 0x21
movsb byte es:[edi], byte [esi]
mov cl, byte [esi + 0xc]
call 0x28dc1fd
xor byte [edx - 0x2b], al
call 0x8ae8d8d4
dec esi
or al, 0xe8
push esi
or cl, byte [ecx + 2]
and al, 2
xchg ecx, eax
mov dword [edx + 0x35700c94], 0xf29c743c
sub dword [esi], edi
mov ecx, 0x69421d4a
loope 0x44b798
jae 0x44b7d8
and dword [ebp - 0xe9671ce], 0x6f967868
sbb eax, 0xd4868d98
add eax, 0x3dd353fb
dec ebp
xchg edx, eax
movsb byte es:[edi], byte [esi]
test byte [0x242ecbcc], cl
fistp qword [ebp - 0x70]
inc ebp
sub al, dl
inc esp
hlt
Function at 0xcec058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00cec1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xcec07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcec06a
add dl, dl
jne 0xcec089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcec0dc
xor eax, eax
add dl, dl
jne 0xcec096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcec17d
add dl, dl
jne 0xcec0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcec0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcec0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcec0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xcec0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xcec075
mov eax, 1
add dl, dl
jne 0xcec0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcec0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcec0e1
sub eax, ebx
mov ebx, 1
jne 0xcec128
mov ecx, 1
add dl, dl
jne 0xcec10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcec119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcec105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcec075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xcec13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcec14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcec136
cmp eax, 0x7d00
jae 0xcec16d
cmp eax, 0x500
jb 0xcec168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcec075
cmp eax, 0x7f
ja 0xcec170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcec075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xcec19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xcec075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x5eb1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.005eb140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.005eb140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.005eb140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.005eb140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x5ebbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5ebc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x5fd87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5ebc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x5ebc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6a
sub eax, 0x403d10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x4020b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x4020fb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4020f4
test esi, esi
je 0x4020f4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4020d0
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4022e0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402330
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402408
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40236e
cmp eax, 4
jne 0x402390
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40237e
cmp edx, 4
je 0x40237e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004022e0
Function at 0x410390
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov dl, byte [0x4a18e8]
mov cl, byte [0x493810]
mov al, byte [0x494fb4]
mov byte [0x48f806], dl
mov dl, byte [0x4a9ebc]
mov byte [0x48f805], cl
mov cl, byte [0x4a9ec0]
mov byte [0x48f804], al
mov al, byte [0x48f800]
mov byte [0x48f809], dl
mov dl, byte [0x4b06f8]
mov byte [0x48f808], cl
mov cl, byte [0x462210]
mov byte [0x48f807], al
mov al, byte [0x4a9eb8]
mov byte [0x48f80c], dl
mov dl, byte [0x465d30]
mov byte [0x48f80b], cl
mov cl, byte [0x46220c]
push esi
mov byte [0x48f80a], al
mov al, byte [0x4a9cdc]
mov byte [0x48f80f], dl
push edi
mov byte [0x48f80e], cl
xor edx, edx
mov ecx, 0x1e
mov esi, 0x495ea8
mov edi, 0x48f814
mov byte [0x48f80d], al
mov byte [0x48f810], 0x10
mov byte [0x48f811], dl
mov byte [0x48f812], dl
mov byte [0x48f813], dl
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x1e
mov esi, 0x48c828
mov edi, 0x48f88c
mov eax, dword [0x48df64]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xc5c
mov esi, 0x4aa058
mov edi, 0x48f904
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, 0x4a9d44
mov edi, 0x492a74
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x48df68]
mov dword [0x492a8c], eax
mov eax, dword [0x48df6c]
mov dword [0x492a90], ecx
mov cx, word [0x48df70]
mov dword [0x492a94], eax
mov al, byte [0x48df72]
mov word [0x492a98], cx
mov ecx, dword [0x48df7c]
mov byte [0x492a9a], al
mov eax, dword [0x48df80]
mov dword [0x492a9b], ecx
mov ecx, dword [0x48df84]
mov dword [0x492a9f], eax
mov ax, word [0x48df88]
mov dword [0x492aa3], ecx
mov cl, byte [0x48df8a]
mov word [0x492aa7], ax
mov byte [0x492aa9], cl
mov esi, 0x32a6
or eax, 0xffffffff
xor ecx, ecx
cmp esi, edx
jbe 0x41051c
xor edx, edx
mov edi, eax
mov dl, byte [ecx + 0x48f804]
and edi, 0xff
xor edx, edi
shr eax, 8
mov edx, dword [edx*4 + 0x474000]
xor eax, edx
inc ecx
cmp ecx, esi
jb 0x4104f9
not eax
mov dword [0x493814], esi
pop edi
mov dword [0x48f810], eax
pop esi
ret
Function at 0x426f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x180
mov eax, dword [esp + 0x184]
push ebx
mov ebx, eax
push ebp
shl ebx, 8
add ebx, eax
mov eax, dword [0x4a1910]
shl ebx, 2
lea edx, [esp + 0x1a0]
push edi
lea ecx, [ebx + eax]
mov eax, dword [esp + 0x1a0]
mov dword [esp + 0x18], ecx
push edx
lea ecx, [esp + 0x90]
push eax
push ecx
call dword [sym.imp.USER32.dll_wvsprintfA]
or ebp, 0xffffffff
lea edi, [esp + 0x8c]
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
mov ecx, dword [0x4a1918]
lea edx, [ecx + edi]
cmp edx, 0x100
jg 0x4271aa
push esi
xor esi, esi
test edi, edi
jle 0x426fff
movsx eax, byte [esp + esi + 0x90]
inc esi
mov dl, byte [eax + 0x4658bc]
cmp esi, edi
mov byte [esp + esi + 0x8f], dl
jl 0x426fe5
fld dword [0x45c690]
mov edx, dword [0x4a1910]
xor eax, eax
test edi, edi
jle 0x427027
movsx esi, byte [esp + eax + 0x90]
shl esi, 4
add esi, ebx
inc eax
cmp eax, edi
fadd dword [esi + edx + 8]
jl 0x427011
fild dword [esp + 0x198]
mov eax, dword [esp + 0x1a0]
test eax, eax
fstp dword [esp + 0x10]
fild dword [esp + 0x19c]
fstp dword [esp + 0x18]
je 0x427063
lea eax, [edi - 1]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fadd st(1)
fmul dword [0x45c638]
fsubr dword [esp + 0x10]
fstp dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov esi, dword [0x4a1914]
fstp st(0)
mov eax, dword [eax + 0x400]
mov eax, dword [eax + 0x3c]
mov dword [esp + 0x84], ebp
mov dword [esp + 0x8c], eax
lea eax, [ecx + ecx*2]
shl eax, 3
sub eax, ecx
mov dword [esp + 0x80], ebp
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x78], ebp
mov dword [esp + 0x24], ebp
lea eax, [esi + eax*8]
xor ebp, ebp
mov dword [esp + 0x88], 0
test edi, edi
mov dword [esp + 0x54], 0x4300199a
mov dword [esp + 0x50], 0x4300199a
mov dword [esp + 0x4c], 0x4300199a
mov dword [esp + 0x48], 0x4300199a
mov dword [esp + 0x14], eax
jle 0x4271a1
jmp 0x4270e5
mov edx, dword [0x4a1910]
movsx esi, byte [esp + ebp + 0x90]
fld dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
shl esi, 4
add esi, ebx
mov dword [esp + 0x20], ecx
add esi, edx
mov edx, dword [esp + 0x10]
mov eax, edx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], eax
fadd dword [esi + 8]
mov edx, ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x38], edx
lea eax, [esp + 0x20]
push eax
fst dword [esp + 0x38]
fstp dword [esp + 0x34]
fld dword [esp + 0x1c]
fadd dword [esi + 0xc]
fst dword [esp + 0x44]
fstp dword [esp + 0x40]
fld dword [esi]
fst dword [esp + 0x60]
fstp dword [esp + 0x5c]
fld dword [esi + 8]
fadd dword [esi]
fst dword [esp + 0x68]
fstp dword [esp + 0x64]
fld dword [esi + 4]
fst dword [esp + 0x78]
fstp dword [esp + 0x6c]
fld dword [esi + 0xc]
fadd dword [esi + 4]
fst dword [esp + 0x74]
fstp dword [esp + 0x70]
call fcn.00433130
fld dword [esp + 0x14]
fadd dword [esi + 8]
mov edx, dword [esp + 0x18]
add esp, 4
add edx, 0xb8
inc ebp
fadd dword [0x45c65c]
cmp ebp, edi
mov dword [esp + 0x14], edx
fstp dword [esp + 0x10]
jl 0x4270df
mov ecx, dword [0x4a1918]
add ecx, edi
pop esi
mov dword [0x4a1918], ecx
pop edi
pop ebp
pop ebx
add esp, 0x180
ret
Function at 0x42a9d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
test eax, eax
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
mov ebx, eax
je 0x42a9f4
mov ecx, dword [0x4a9aa4]
shl ebx, 4
mov edx, dword [ecx]
mov byte [ebx + edx + 9], 3
jmp 0x42aa04
mov ecx, dword [0x4a9aa4]
shl ebx, 4
mov edx, dword [ecx]
mov byte [ebx + edx + 9], 0
mov ecx, dword [0x4a9aa4]
lea eax, [eax + eax*4]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov edx, dword [ebx + edx]
lea ebp, [ecx + eax*4]
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x14]
mov eax, dword [ebp + 8]
mov esi, dword [ebp]
cdq
xor eax, edx
mov dword [ebp + 0x10], ecx
sub eax, edx
mov edx, esi
sub edx, eax
mov eax, dword [edx*4 + 0x465b8c]
mov edx, dword [esp + 0x1c]
imul eax, dword [esi*4 + 0x465b8c]
sub edx, 0
je 0x42ab04
dec edx
je 0x42aaaf
dec edx
jne 0x42ab48
test eax, eax
jbe 0x42aaa3
lea esi, [ecx + 3]
mov edi, eax
mov al, byte [esi - 3]
add ecx, 2
movzx dx, byte [esi - 2]
and al, 0xf0
and edx, 0xfff0
movzx ax, al
shl eax, 4
or eax, edx
movzx dx, byte [esi - 1]
shl eax, 4
and edx, 0xfff0
add esi, 4
or eax, edx
mov dl, byte [esi - 4]
shr dl, 4
movzx dx, dl
or eax, edx
dec edi
mov word [ecx - 2], ax
jne 0x42aa61
mov dword [ebp + 0xc], 0xc
jmp 0x42ab48
test eax, eax
jbe 0x42aafb
lea esi, [ecx + 2]
mov edi, eax
mov al, byte [esi - 2]
add ecx, 2
movzx dx, byte [esi - 1]
and al, 0x80
and edx, 0xfff8
movzx ax, al
shl eax, 1
or eax, edx
movzx dx, byte [esi]
shl eax, 5
and edx, 0xfff8
add esi, 4
or eax, edx
mov dl, byte [esi - 3]
shr dl, 3
movzx dx, dl
shl eax, 2
or eax, edx
dec edi
mov word [ecx - 2], ax
jne 0x42aab8
mov dword [ebp + 0xc], 0xb
jmp 0x42ab48
test eax, eax
jbe 0x42ab41
lea esi, [ecx + 2]
mov edi, eax
mov al, byte [esi - 2]
add ecx, 2
movzx dx, byte [esi - 1]
and al, 0xf8
and edx, 0xfffc
movzx ax, al
shl eax, 5
or eax, edx
mov dl, byte [esi]
shr dl, 3
movzx dx, dl
shl eax, 3
or eax, edx
add esi, 3
mov word [ecx - 2], ax
dec edi
jne 0x42ab0d
mov dword [ebp + 0xc], 0xa
mov esi, dword [esp + 0x18]
push ebp
push 3
push esi
push 0
call sub.glide3x.dll__grTexDownloadMipMap_16
mov eax, dword [0x4a9aa4]
pop edi
mov ecx, dword [eax]
mov dword [ebx + ecx], esi
mov edx, dword [0x4a9aa4]
pop esi
pop ebp
mov eax, dword [edx]
mov byte [ebx + eax + 8], 0
pop ebx
ret
Function at 0x434e90
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x4c34e4]
push ebx
push ebp
lea eax, [eax + eax*2]
push esi
mov esi, dword [esp + 0x18]
push edi
lea edx, [ecx + eax*8]
xor eax, eax
mov edi, dword [esi]
mov al, byte [edx]
mov cl, byte [edx + 3]
and ecx, 0xf
mov eax, dword [eax*8 + 0x472b24]
add eax, ecx
xor ecx, ecx
mov cx, word [edx + 6]
add eax, ecx
mov ecx, dword [0x4c34e0]
lea eax, [eax + eax*2]
lea ebp, [ecx + eax*2]
mov eax, dword [esp + 0x18]
lea ecx, [eax*8]
sub ecx, eax
shl ecx, 4
add ecx, eax
mov eax, dword [esi + 8]
mov esi, dword [edx + 0xc]
shl ecx, 3
mov ebx, dword [ecx + 0x4aa25c]
mov ecx, dword [ecx + 0x4aa254]
sub edi, ecx
add eax, ebx
sar ecx, 8
sub esi, ecx
movsx ecx, word [ebp]
add esi, ecx
movsx ecx, word [ebp + 4]
sar ebx, 8
sub ecx, ebx
mov ebx, dword [edx + 0x14]
neg eax
add ecx, ebx
mov ebx, esi
sar eax, 8
sar edi, 8
imul ebx, eax
mov edx, ecx
imul edx, edi
add edx, ebx
test edx, edx
jle 0x434f47
lea edx, [ecx + esi]
test edx, edx
jne 0x434f3b
mov esi, 1
sub esi, ecx
sub eax, edi
add ecx, esi
cdq
pop edi
pop esi
pop ebp
pop ebx
idiv ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x43f8c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
mov eax, dword [0x4c2eb0]
test eax, eax
jne 0x43f8d8
call fcn.0043f480
cmp eax, 1
jne 0x43f8d8
xor eax, eax
pop ecx
ret
mov eax, dword [0x4cf0cc]
mov ecx, dword [0x4c2eb0]
push eax
push 1
push 0x1e
push ecx
call fcn.00447727
mov eax, dword [0x4c2eb0]
add esp, 0x10
cmp dword [eax], 0x4034b50
je 0x43f902
xor eax, eax
pop ecx
ret
mov ecx, dword [eax + 0xe]
xor edx, edx
mov dl, byte [eax + 8]
push ebx
push ebp
push esi
mov esi, edx
mov dword [0x47a07c], ecx
xor edx, edx
xor ecx, ecx
mov dx, word [eax + 0x1c]
mov cx, word [eax + 0x1a]
mov ebp, dword [eax + 0x16]
add edx, ecx
push 1
push edx
mov edx, dword [0x4cf0cc]
push edx
call fcn.00447f21
add esp, 0xc
test esi, esi
jne 0x43fa70
mov eax, dword [0x47a08c]
push edi
test eax, eax
mov dword [0x47a078], esi
je 0x43f9ed
mov ebx, ebp
test ebp, ebp
mov dword [esp + 0x10], ebx
je 0x43fa4c
cmp ebp, 0x8000
mov esi, 0x8000
ja 0x43f971
mov esi, ebp
mov eax, dword [0x4cf0cc]
mov ecx, dword [0x4c2eb4]
push eax
push esi
push 1
push ecx
call fcn.00447727
mov eax, dword [0x47a078]
mov edi, dword [0x4c2eb4]
add esp, 0x10
xor ecx, ecx
not eax
test esi, esi
mov dword [0x47a078], eax
jbe 0x43f9ca
xor edx, edx
mov ebx, eax
mov dl, byte [edi + ecx]
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x474000]
xor eax, edx
inc ecx
cmp ecx, esi
mov dword [0x47a078], eax
jb 0x43f9a1
mov ebx, dword [esp + 0x10]
not eax
mov dword [0x47a078], eax
mov eax, dword [0x4cf0c4]
push eax
push esi
push 1
push edi
call fcn.004475aa
add esp, 0x10
sub ebp, esi
jne 0x43f962
jmp 0x43fa4c
mov ecx, dword [0x4cf0cc]
mov edx, dword [0x4c2eb4]
push ecx
push ebp
push 1
push edx
call fcn.00447727
mov ebx, eax
mov eax, dword [0x47a078]
add esp, 0x10
xor ecx, ecx
not eax
test ebx, ebx
mov dword [0x47a078], eax
jbe 0x43fa45
mov esi, dword [0x4c2eb4]
xor edx, edx
mov edi, eax
mov dl, byte [esi + ecx]
and edi, 0xff
xor edx, edi
shr eax, 8
mov edx, dword [edx*4 + 0x474000]
xor eax, edx
inc ecx
cmp ecx, ebx
mov dword [0x47a078], eax
jb 0x43fa20
not eax
mov dword [0x47a078], eax
mov eax, dword [0x47a078]
mov ecx, dword [0x47a07c]
cmp eax, ecx
pop edi
je 0x43fa5e
xor ebx, ebx
cmp ebx, ebp
je 0x43fa64
xor ebx, ebx
call fcn.0043f4b0
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
cmp esi, 8
jne 0x43fa5c
call fcn.00447242
mov ebx, eax
jmp 0x43fa5e
Function at 0x445160
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
movsx ecx, word [esi]
mov word [esi + 4], cx
mov word [esi + 6], cx
mov edx, dword [0x4c34e4]
lea ecx, [ecx + ecx*2]
movsx eax, byte [esi + 0xc]
lea edi, [edx + ecx*8]
xor ecx, ecx
mov dl, byte [edi + 3]
mov cl, byte [edi]
and edx, 0xf
movsx ebx, byte [ecx*2 + 0x473cd8]
mov ebp, edx
xor edx, edx
mov dx, word [edi + 4]
add ebx, edx
movsx edx, byte [ecx*2 + 0x473cd9]
xor ecx, ecx
mov cx, word [edi + 6]
add edx, ecx
cmp eax, ebp
jl 0x4451b9
lea eax, [ebp - 1]
mov byte [esi + 0xc], al
add edx, eax
add eax, ebx
mov ebx, dword [0x4c34e0]
lea ecx, [edx + edx*2]
lea esi, [eax + eax*2]
lea eax, [eax + eax*2 + 3]
lea edx, [edx + edx*2 + 3]
shl esi, 1
movsx eax, word [ebx + eax*2]
movsx edx, word [ebx + edx*2]
add eax, edx
movsx edx, word [esi + ebx]
shl ecx, 1
add eax, edx
movsx edx, word [ecx + ebx]
add eax, edx
mov ebx, dword [esp + 0x18]
shl eax, 8
cdq
and edx, 3
add eax, edx
mov edx, dword [edi + 0xc]
sar eax, 2
shl edx, 8
add eax, edx
mov dword [ebx], eax
mov edx, dword [0x4c34e0]
movsx eax, word [esi + edx + 8]
movsx ebp, word [esi + edx + 2]
add eax, ebp
movsx ebp, word [ecx + edx + 8]
movsx edx, word [ecx + edx + 2]
add eax, ebp
add eax, edx
shl eax, 8
cdq
and edx, 3
add eax, edx
mov edx, dword [edi + 0x10]
sar eax, 2
shl edx, 8
add eax, edx
mov dword [ebx + 4], eax
mov edx, dword [0x4c34e0]
movsx eax, word [esi + edx + 0xa]
movsx esi, word [esi + edx + 4]
add eax, esi
movsx esi, word [ecx + edx + 0xa]
movsx ecx, word [ecx + edx + 4]
add eax, esi
add eax, ecx
shl eax, 8
cdq
and edx, 3
add eax, edx
mov edx, dword [edi + 0x14]
sar eax, 2
shl edx, 8
add eax, edx
pop edi
pop esi
mov dword [ebx + 8], eax
pop ebp
pop ebx
ret