joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d439
Capabilities:
Print debug messages

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x487590]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 8
mov eax, 0x465a66
call fcn.0043d2f6
mov ebx, ecx
mov ecx, dword [ebx + 4]
mov esi, dword [ebp + 0x80c]
call fcn.0041d08d
push dword [ebx]
mov edx, 0xfff0b9d8
mov edi, eax
call fcn.0041d888
pop ecx
mov edx, esi
lea ecx, [ebp - 0x14]
call fcn.00404c66
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebx + 4]
call fcn.0041d664
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00401551
call fcn.00402f0e
push 1
push 1
push dword [ebx + 4]
call fcn.0040ca44
mov ecx, dword [ebx + 4]
test eax, eax
je 0x40d525
push 0
or edx, 0xffffffff
call fcn.0041d44a
mov edx, eax
lea ecx, [ebp - 0x10]
call fcn.0040384f
mov esi, str.hwang
lea edi, [ebp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp], 0x7f2
lea eax, [ebp + 0xe]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00438850
push dword [ebp - 0x10]
lea eax, [ebp + 0xc]
push str._s_r_n
push eax
call fcn.00437dbf
add esp, 0x18
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebx + 4]
push 0xfffffffffffffffe
pop edx
call fcn.0041d09c
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00401551
jmp 0x40d52c
mov edx, edi
call fcn.0041d09c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00437bed
add ebp, 0x804
leave
ret 4
Function at 0x4157ce
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x808
mov eax, dword [0x487590]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
mov ebp, ecx
cmp dword [ebp + 0x20], 0
jne 0x4158db
push esi
push edi
mov esi, str.hwang
lea edi, [esp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x7f2
lea eax, [esp + 0x22]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00438850
lea eax, [esp + 0x28]
push str.DTLUE::CarouselUIObjectImpl::Play
push eax
call fcn.00437dbf
add esp, 0x14
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp + 0x14]
movss xmm1, dword [0x480988]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mov esi, str.hwang
addsd xmm0, qword [eax*8 + 0x4809a0]
lea edi, [esp + 0x10]
push 0x7f2
lea eax, [esp + 0x22]
push 0
cvtpd2ps xmm0, xmm0
push eax
divss xmm1, xmm0
movss dword [ebp + 0x10], xmm1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movss dword [esp + 0x18], xmm1
movsw word es:[edi], word [esi]
call fcn.00438850
movss xmm0, dword [esp + 0x18]
cvtps2pd xmm0, xmm0
lea eax, [esp + 0x28]
movsd qword [esp + 4], xmm0
mov dword [esp], str.Fade:_0.2f_r_n
push eax
call fcn.00437dbf
add esp, 0x10
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
movzx ecx, word [ebp + 0x18]
lea eax, [ebp - 0x2c]
neg eax
sbb eax, eax
and eax, ebp
push eax
movzx eax, word [ebp + 0x1c]
shl ecx, 0x10
or ecx, eax
push ecx
push 0x2b16
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
mov dword [ebp + 0x20], 1
pop esi
mov ecx, dword [esp + 0x808]
pop ebp
xor ecx, esp
call fcn.00437bed
add esp, 0x808
ret

Function at 0x415bca
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x804
mov eax, dword [0x487590]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
mov ebx, ecx
xor eax, eax
cmp dword [ebx + 0x20], eax
je 0x415c60
push ebp
push esi
push edi
mov dword [ebx + 0x20], eax
mov esi, str.hwang
lea edi, [esp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x7f2
movsd dword es:[edi], dword [esi]
push eax
lea eax, [esp + 0x26]
push eax
movsw word es:[edi], word [esi]
call fcn.00438850
lea eax, [esp + 0x28]
push str.DTLUE::CarouselUIObjectImpl::Stop
push eax
call fcn.00437dbf
add esp, 0x14
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea edi, [ebx - 0x2c]
test edi, edi
cmovne eax, ebx
push eax
movzx eax, word [ebx + 0x1e]
push eax
mov ebp, 0x2b17
push ebp
push dword [ebx - 0x14]
call esi
xor eax, eax
test edi, edi
cmovne eax, ebx
push eax
movzx eax, word [ebx + 0x1c]
push eax
push ebp
push dword [ebx - 0x14]
call esi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x804]
pop ebx
xor ecx, esp
call fcn.00437bed
add esp, 0x804
ret
Function at 0x415c80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x487590]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, str.hwang
lea edi, [ebp - 0x804]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x7f2
lea eax, [ebp - 0x7f6]
push 0
push eax
mov ebx, ecx
movsw word es:[edi], word [esi]
call fcn.00438850
push dword [ebp + 8]
lea eax, [ebp - 0x7f8]
push str.DTLUE::CarouselUIObjectImpl::OnTimer__d
push eax
call fcn.00437dbf
add esp, 0x18
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
movzx eax, word [ebx + 0x1c]
cmp dword [ebp + 8], eax
jne 0x415d03
lea eax, [ebx - 0x2c]
neg eax
sbb eax, eax
and eax, ebx
push eax
movzx eax, word [ebx + 0x1e]
or eax, 0x420000
push eax
push 0x2b16
jmp 0x415d46
movzx ecx, word [ebx + 0x1e]
cmp dword [ebp + 8], ecx
jne 0x415d4f
movss xmm0, dword [ebx + 0xc]
subss xmm0, dword [ebx + 0x10]
comiss xmm0, dword [0x48090c]
movss dword [ebx + 0xc], xmm0
ja 0x415d4f
mov eax, dword [ebx + 8]
inc eax
cdq
idiv dword [ebx + 4]
lea eax, [ebx - 0x2c]
neg eax
sbb eax, eax
and eax, ebx
push eax
push ecx
mov dword [ebx + 0xc], 0x3f800000
push 0x2b17
mov dword [ebx + 8], edx
push dword [ebx - 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437bed
leave
ret 4
Function at 0x419200
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x466767
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x487590]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebp, ecx
xor edi, edi
mov dword [ebp + 4], edi
mov dword [ebp + 8], 2
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x2c], edi
push dword [esp + 0x38]
lea ecx, [esp + 0x20]
push dword [esp + 0x38]
call fcn.00404d2f
test al, al
jne 0x419260
push 0x80004005
call fcn.00401697
mov ebx, dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x18], eax
test eax, eax
je 0x419256
push dword [esp + 0x20]
push dword [0x489e08]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push dword [esp + 0x1c]
push eax
call fcn.00438f90
and dword [esp + 0x20], 0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea eax, [ebp + 4]
push eax
push dword [esp + 0x18]
call dword [sym.imp.gdiplus.dll_GdipLoadImageFromStream]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test ebx, ebx
je 0x4192dd
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x42438c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, edx
push esi
mov dword [ebx], ecx
movzx eax, byte [ecx]
push edi
xor edi, edi
test byte [eax + 0x47e3c1], 8
mov esi, edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
je 0x4243cd
inc ecx
movzx eax, byte [ecx]
test byte [eax + 0x47e3c1], 8
jne 0x4243bc
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00424326
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], eax
cmp byte [ecx], 0x30
jne 0x4244cd
mov dl, byte [ecx + 1]
cmp dl, 0x78
je 0x4243f8
cmp dl, 0x58
jne 0x4244cd
add ecx, 2
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x18]
xorps xmm1, xmm1
lea ecx, [esp + 0x10]
call fcn.00424341
mov edx, dword [esp + 0x10]
cmp byte [edx], 0x2e
jne 0x424436
inc edx
mov dword [esp + 0x10], edx
lea edx, [esp + 0x14]
movapd xmm1, xmm0
lea ecx, [esp + 0x10]
call fcn.00424341
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], edi
jne 0x424444
test esi, esi
je 0x4244cd
mov dword [ebx], edx
imul esi, esi, 0xfffffffc
mov al, byte [edx]
cmp al, 0x70
je 0x424453
cmp al, 0x50
jne 0x4244a0
inc edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], edx
call fcn.00424326
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], eax
movzx ecx, byte [edx]
test byte [ecx + 0x47e3c1], 2
je 0x4244a2
mov bl, byte [edx]
imul edi, edi, 0xa
movsx eax, bl
add eax, 0xffffffd0
add edi, eax
inc edx
mov bl, byte [edx]
movzx eax, bl
test byte [eax + 0x47e3c1], 2
jne 0x424477
cmp dword [esp + 0x18], 0
mov ebx, dword [esp + 0x1c]
je 0x42449e
neg edi
add esi, edi
mov dword [ebx], edx
cmp dword [esp + 0x20], 0
je 0x4244b1
xorpd xmm0, xmmword [0x4809b0]
push esi
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.0043f90d
fstp qword [esp + 0x2c]
movsd xmm0, qword [esp + 0x2c]
add esp, 0xc
jmp 0x4244d0
xorps xmm0, xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425379
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, edx
push edi
mov edx, dword [esi + 0x1c]
mov edi, ecx
mov ecx, esi
call fcn.004234b0
mov ecx, esi
call fcn.0041f5e5
push 0
push 0x70
mov edx, esi
mov ecx, edi
call fcn.00426e5e
pop ecx
pop ecx
pop edi
pop esi
ret
push esi
mov esi, edx
push edi
mov edx, dword [esi + 0x10]
mov edi, ecx
cmp edx, 0x47db08
je 0x422c5d
mov cl, byte [esi + 7]
xor eax, eax
inc eax
shl eax, cl
push 0
mov ecx, edi
imul eax, eax, 0x18
push eax
call fcn.00426e5e
pop ecx
pop ecx
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0xc]
shl eax, 3
push 0
push eax
mov ecx, edi
call fcn.00426e5e
push 0
push 0x20
mov edx, esi
mov ecx, edi
call fcn.00426e5e
add esp, 0x10
pop edi
pop esi
ret
push ebx
push esi
mov esi, edx
push edi
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0xc]
xor ebx, ebx
shl eax, 2
push ebx
push eax
mov edi, ecx
call fcn.00426e5e
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x10]
shl eax, 2
push ebx
push eax
mov ecx, edi
call fcn.00426e5e
mov eax, dword [esi + 0x2c]
mov edx, dword [esi + 8]
shl eax, 3
push ebx
push eax
mov ecx, edi
call fcn.00426e5e
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x14]
shl eax, 2
push ebx
push eax
mov ecx, edi
call fcn.00426e5e
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x18]
imul eax, eax, 0xc
push ebx
push eax
mov ecx, edi
call fcn.00426e5e
mov eax, dword [esi + 0x28]
mov edx, dword [esi + 0x1c]
shl eax, 3
push ebx
push eax
mov ecx, edi
call fcn.00426e5e
push ebx
push 0x50
mov edx, esi
mov ecx, edi
call fcn.00426e5e
add esp, 0x38
pop edi
pop esi
pop ebx
ret
movzx eax, byte [edx + 4]
cmp eax, 8
jg 0x4253c8
je 0x4253c3
sub eax, 4
je 0x4253b5
dec eax
je 0x4253b0
dec eax
je 0x42539a
dec eax
jne 0x4253af
mov eax, dword [edx + 0x10]
add eax, 0x18
jmp 0x4253a5
movzx eax, byte [edx + 6]
lea eax, [eax*4 + 0x10]
push 0
push eax
call fcn.00426e5e
pop ecx
pop ecx
ret
jmp 0x422c35
mov eax, dword [ecx + 0xc]
dec dword [eax + 0x1c]
mov eax, dword [edx + 0xc]
add eax, 0x11
jmp 0x4253a5
jmp 0x41f7dd
sub eax, 9
je 0x4253ec
dec eax
je 0x4253e7
sub eax, 0xa
je 0x4253bb
sub eax, 0x12
jne 0x4253af
movzx eax, byte [edx + 6]
lea eax, [eax*8 + 0x10]
jmp 0x4253a5
jmp fcn.00423489
jmp 0x423569

Function at 0x42b1d4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x487590]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, edx
lea edx, [ebp - 0x218]
mov esi, 0x200
call fcn.0041ec30
jmp 0x42b207
cmp esi, 0x3fffffff
ja 0x42b207
add esi, esi
mov edx, esi
lea ecx, [ebp - 0x218]
call fcn.0041eaee
push edi
push esi
push 1
push eax
call fcn.0043cec8
add dword [ebp - 0x210], eax
add esp, 0x10
cmp eax, esi
jae 0x42b1fd
lea ecx, [ebp - 0x218]
call fcn.0041eba8
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00437bed
leave
ret
Function at 0x42b244
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x487590]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
lea edx, [ebp - 0x21c]
call fcn.0041ec30
mov edx, esi
lea ecx, [ebp - 0x21c]
call fcn.0041eaee
push edi
push esi
push 1
push eax
call fcn.0043cec8
mov esi, eax
add dword [ebp - 0x214], esi
add esp, 0x10
lea ecx, [ebp - 0x21c]
call fcn.0041eba8
mov ecx, dword [ebp - 8]
xor eax, eax
cmp eax, esi
sbb eax, eax
pop edi
xor ecx, ebp
neg eax
pop esi
call fcn.00437bed
leave
ret

Function at 0x42b508
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
call fcn.0041d08d
mov edi, dword [ebp + 8]
mov ebx, eax
push 1
pop esi
sub ebx, edi
jne 0x42b53b
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov edx, edi
dec ebx
call fcn.0041d1e2
cmp eax, 3
jne 0x42b58e
test esi, esi
je 0x42b574
mov ecx, dword [esp + 0xc]
push 0
mov edx, edi
call fcn.0041d321
push ecx
movsd qword [esp], xmm0
push str._.14g
push dword [esp + 0x1c]
call fcn.00441925
add esp, 0x10
test eax, eax
jg 0x42b5bc
xor esi, esi
inc edi
test ebx, ebx
jne 0x42b537
test esi, esi
jne 0x42b52d
mov ecx, dword [esp + 0xc]
push esi
xor edx, edx
call fcn.0041e732
pop ecx
jmp 0x42b530
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
mov edx, edi
call fcn.0041e9c6
pop ecx
test esi, esi
je 0x42b574
push dword [esp + 0x10]
push dword [esp + 0x18]
push 1
push eax
call fcn.0043d117
add esp, 0x10
cmp eax, dword [esp + 0x14]
jne 0x42b574
xor esi, esi
inc esi
jmp 0x42b576
Function at 0x4315c0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, edx
mov esi, dword [edi]
mov dword [esp + 0xc], ecx
test esi, esi
jne 0x4315db
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [edi], 0
mov edx, 0x400000
lea ecx, [ecx]
push 0
lea eax, [esp + 0x1c]
push eax
mov eax, esi
cmp esi, 0x400000
cmova eax, edx
push eax
push ebx
push dword [ecx]
mov dword [esp + 0x2c], 0
call ebp
mov ecx, dword [esp + 0x18]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x431637
test ecx, ecx
je 0x43162f
mov ecx, dword [esp + 0x10]
mov edx, 0x400000
test esi, esi
jne 0x4315f0
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x431650
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, edx
mov esi, dword [edi]
mov dword [esp + 0xc], ecx
test esi, esi
jne 0x43166b
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [edi], 0
mov edx, 0x400000
lea ecx, [ecx]
push 0
lea eax, [esp + 0x1c]
push eax
mov eax, esi
cmp esi, 0x400000
cmova eax, edx
push eax
push ebx
push dword [ecx]
mov dword [esp + 0x2c], 0
call ebp
mov ecx, dword [esp + 0x18]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x4316c7
test ecx, ecx
je 0x4316bf
mov ecx, dword [esp + 0x10]
mov edx, 0x400000
test esi, esi
jne 0x431680
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x434470
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x24
xor eax, eax
push ebx
push ebp
push esi
push edi
lea esp, [esp]
mov edx, eax
and edx, 1
dec edx
not edx
and edx, 0xedb88320
mov ecx, eax
shr ecx, 1
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov edx, ecx
and edx, 1
dec edx
shr ecx, 1
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov edx, ecx
and edx, 1
dec edx
shr ecx, 1
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov edx, ecx
and edx, 1
dec edx
shr ecx, 1
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov dword [eax*4 + 0x48b2b0], ecx
inc eax
cmp eax, 0x100
jb 0x434480
cmp eax, 0x800
jae 0x434553
lea esp, [esp]
mov edx, dword [eax*4 + 0x48aeb0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x48b2b0]
inc eax
mov dword [eax*4 + 0x48b2ac], edx
cmp eax, 0x800
jb 0x434530
lea ecx, [esp + 0x10]
mov dword [0x48d304], 0x4351d0
call fcn.00435280
test eax, eax
je 0x43460b
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov esi, edi
shr esi, 8
shr edi, 4
and esi, 0xff00f
and edi, 0xf00f
xor ecx, ecx
mov eax, 0x489dbc
xor edx, edx
mov ebx, dword [esp + 0x14]
cmp dword [eax - 8], ebx
mov ebx, dword [esp + 0x1c]
jne 0x4345a9
cmp dword [eax - 4], ebp
jne 0x4345a9
cmp dword [eax], ebx
je 0x4345b8
add edx, 0xc
inc ecx
add eax, 0xc
cmp edx, 0x24
jb 0x434593
or ecx, 0xffffffff
sub ecx, 0
je 0x4345f2
dec ecx
je 0x4345e1
dec ecx
jne 0x43460b
cmp esi, 6
jb 0x43460b
jne 0x434601
cmp edi, 0xf
jb 0x43460b
mov dword [0x48d304], 0x435270
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
cmp esi, 5
jb 0x43460b
jne 0x434601
cmp edi, 6
jb 0x43460b
cmp edi, 0xa
jmp 0x4345ff
cmp esi, 6
jb 0x43460b
jne 0x434601
cmp edi, 0x100c
je 0x43460b
mov dword [0x48d304], 0x435270
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x434660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
mov eax, dword [0x487590]
xor eax, esp
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0xa4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0xa8]
push edi
push eax
push dword [ecx + 0x14]
mov edi, edx
mov edx, dword [ecx + 0x10]
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
call fcn.004371e0
add esp, 8
test eax, eax
jne 0x4347f6
mov eax, dword [esp + 0xb0]
mov ebp, dword [esp + 0xa8]
mov ebx, dword [esp + 0xa4]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x50], eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x74], 1
mov dword [esp + 0x70], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x78], 1
nop
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x40000
test ebp, ebp
ja 0x434732
jb 0x43472e
cmp ebx, 0x40000
jae 0x434732
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [edi]
push edi
call eax
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4347e3
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xb0]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea ecx, [esp + 0x38]
call fcn.00436ea0
mov esi, eax
mov eax, dword [esp + 0x28]
sub dword [esp + 0x20], eax
add esp, 0x10
sub ebx, eax
sbb ebp, 0
test esi, esi
jne 0x4347e3
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
cmp ecx, edx
je 0x4347c0
test eax, eax
jne 0x4347aa
cmp dword [esp + 0x1c], ecx
je 0x4347c0
push eax
mov eax, dword [edi + 4]
push edi
call eax
mov esi, eax
add esp, 8
test esi, esi
je 0x434710
jmp 0x4347e3
cmp edx, dword [esp + 0xb0]
jne 0x4347de
cmp dword [esp + 0x10], 0
jne 0x4347de
mov eax, dword [esp + 0x24]
cmp eax, 1
je 0x4347e3
cmp eax, 4
je 0x4347e3
mov esi, 1
push dword [esp + 0x38]
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [eax + 4]
call eax
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437bed
add esp, 0x90
ret
Function at 0x435830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov esi, dword [esi]
mov ebp, ecx
xor edi, edi
and esi, 7
mov dword [esp + 0x14], ebp
cmp edx, 5
jae 0x435855
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
push ebx
lea ecx, [edx - 4]
or ebx, 0xffffffff
add ecx, ebp
mov dword [esp + 0x10], ecx
lea edx, [edi + ebp]
cmp edx, ecx
jae 0x43587d
lea esp, [esp]
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x43587d
inc edx
cmp edx, ecx
jb 0x435870
mov edi, edx
sub edi, ebp
cmp edx, ecx
mov ecx, edi
jae 0x43597e
sub ecx, ebx
cmp ecx, 3
jbe 0x4358b4
xor esi, esi
mov al, byte [edx + 4]
mov ebx, edi
mov dword [esp + 0x14], ebx
test al, al
je 0x4358ef
cmp al, 0xff
je 0x4358ef
mov ecx, dword [esp + 0x10]
and esi, 3
add esi, esi
or esi, 1
inc edi
jmp 0x435862
dec ecx
shl esi, cl
and esi, 7
je 0x435894
movzx eax, byte [esi + 0x47e4cc]
mov ecx, edx
sub ecx, eax
cmp byte [esi + 0x47e4c4], 0
mov al, byte [ecx + 4]
je 0x4358db
test al, al
je 0x4358db
cmp al, 0xff
jne 0x435894
mov ecx, dword [esp + 0x10]
and esi, 3
add esi, esi
mov ebx, edi
or esi, 1
inc edi
jmp 0x435862
movzx ecx, byte [edx + 3]
movzx eax, al
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 1]
shl eax, 8
or eax, ecx
lea ecx, [ecx]
sub eax, edi
lea ebx, [eax - 5]
test esi, esi
je 0x435949
movzx ebp, byte [esi + 0x47e4cc]
shl ebp, 3
mov ecx, 0x18
sub ecx, ebp
mov eax, ebx
shr eax, cl
test al, al
je 0x435936
cmp al, 0xff
jne 0x435949
mov ecx, 0x20
sub ecx, ebp
mov eax, 1
shl eax, cl
dec eax
xor eax, ebx
jmp 0x435910
mov ecx, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
and al, 1
dec al
not al
mov byte [edx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [edx + 3], al
mov eax, ebx
shr eax, 8
mov byte [edx + 1], bl
mov ebx, dword [esp + 0x14]
mov byte [edx + 2], al
add edi, 5
jmp 0x435862
sub ecx, ebx
pop ebx
cmp ecx, 3
jbe 0x435997
mov eax, dword [esp + 0x20]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0x20]
dec ecx
shl esi, cl
and esi, 7
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0xc
ret