joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov edi, dword [ebp + 8]
movzx eax, word [edi]
mov dword [esp + 0x10], 0xdbda736d
mov dword [esp + 0x14], 0
mov word [esp + 0x18], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 9
ja 0x4398fc
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
lea esi, [ecx + edx]
add esi, 0x298481e4
add ecx, 0xe4
and ecx, edx
add ecx, ecx
mov edx, ecx
xor edx, esi
not ecx
and ecx, esi
add ecx, ecx
sub ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0xc4
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0xa
jb 0x4398b0
xor ecx, ecx
cmp dword [esp + 0x10], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4456d4]
mov ecx, dword [edi + 0x3c]
mov edx, dword [edi + ecx]
mov dword [esp + 8], edx
mov dword [esp + 0x10], 0xf3f288bc
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov esi, dword [esp + 4]
cmp esi, 0xb
ja 0x439991
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp + 4]
mov edi, dword [esp + 4]
movzx edi, byte [esp + edi + 0x10]
lea ebx, [esi + 0x5e]
and ebx, edi
mov edx, 0x873f23a1
sub edx, esi
or edx, edi
not edx
add edx, edi
sub edx, ebx
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0x6e
mov esi, dword [esp + 4]
mov byte [esp + esi + 0x10], dl
inc dword [esp + 4]
mov edx, dword [esp + 4]
cmp edx, 0xc
jb 0x439950
xor edx, edx
mov esi, dword [esp + 8]
cmp esi, dword [esp + 0x10]
setne dl
mov ebx, dword [ebp + 8]
jmp dword [edx*4 + 0x4456dc]
jmp dword [0x4456fc]
mov edx, dword [ebx + ecx + 0x7c]
mov esi, dword [ebx + ecx + 0x78]
xor ecx, ecx
test edx, edx
sete cl
jmp dword [ecx*4 + 0x445704]
xor ecx, ecx
test esi, esi
sete cl
jmp dword [ecx*4 + 0x44570c]
jmp dword [0x4456ec]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x7cba41d6
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section._RDATA
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x12f3a38
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x54051301
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x2b877c20
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x414def
Capabilities:
Encode data using xor

Disassembly:
xor dword [eax], ebx
add eax, 4
cmp eax, ecx
jne fcn.00414def
add edx, edi
dec edi
inc edx
ret
Function at 0x404729
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ecx + 0xc]
dec eax
je 0x404750
dec eax
je 0x43d69a
dec eax
je 0x43d68a
dec eax
je 0x404760
sub eax, 3
je 0x404757
dec eax
dec eax
jne 0x43d678
mov al, byte [ecx]
ret
cmp dword [ecx], 0
setne al
ret
xor eax, eax
cmp dword [ecx], eax
jmp 0x43d686
mov ecx, dword [ecx + 8]
xor eax, eax
cmp dword [ecx + 4], eax
jmp 0x43d686
add byte [ebx + 0x6778a3c8], cl
dec esp
add al, ch
stosb byte es:[edi], al
inc edi
add al, byte [eax]
push esi
call dword [0x490358]
xor edx, edx
jmp fcn.00405520
dec ecx
add byte [ebx], dh
shr cl, cl
lea edi, [esi - 4]
call dword [eax - 1]
adc eax, 0x49063c
jmp fcn.004055d7

Function at 0x40476d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx + 0xc], 8
je 0x43d6a4
xor al, al
ret
dec dword [ebx + 0x8bb004]

Function at 0x40486a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
call fcn.0040513d
test al, al
jne 0x404893
cmp dword [esi + 0xc], 3
je 0x404893
mov ecx, esi
call fcn.004049aa
mov ecx, esi
pop esi
test al, al
jne fcn.00404937
jmp fcn.004048a0
pop esi
ret

Function at 0x4048a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
cmp eax, 1
je 0x404909
cmp eax, 2
je 0x404909
push ebx
push edi
call fcn.004050d5
cmp dword [esi + 0xc], 4
mov edi, eax
mov ebx, edx
mov byte [ebp - 1], 0
jne 0x4048d4
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
cmp word [eax], 0x30
je 0x40490e
cmp ebx, 0xffffffff
jl 0x404925
jg 0x4048e3
cmp edi, 0x80000000
jb 0x404925
test ebx, ebx
jl 0x4048f1
jg 0x404925
cmp edi, 0x7fffffff
ja 0x404925
mov ecx, esi
call fcn.00404dc0
cmp byte [ebp - 1], 0
mov dword [esi], edi
jne 0x40492b
mov dword [esi + 0xc], 1
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
movzx eax, word [eax + 2]
cmp eax, 0x78
je 0x43d6cc
cmp eax, 0x58
jne 0x4048d4
jmp 0x43d6cc
mov byte [ebp - 1], 1
jmp 0x4048f1
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 2
jmp 0x404907
add byte [eax], al
mov eax, dword [edi - 0x2f8]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
test eax, eax
je 0x43d6db
cmp dword [eax], 0
jne 0x43d6bd
mov ecx, dword [eax + 4]
call fcn.0040eacf
jmp 0x43d6c6
push dword [eax + 8]
call dword [0x490200]
mov eax, dword [edi - 0x2f8]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x43d6db
push ecx
call fcn.00464879
inc esi
cmp esi, dword [edi - 0x2f4]
jb 0x43d69f
jmp 0x405601
Function at 0x404a2b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xc]
cmp eax, 7
jg 0x43d843
je 0x43d823
dec eax
jne 0x404a86
mov esi, dword [ebp + 8]
cmp dword [esi + 0xc], 1
je 0x43d7cb
push 2
pop ecx
cmp dword [esi + 0xc], ecx
je 0x43d80e
mov ecx, edi
call fcn.00404937
mov ecx, esi
call fcn.00405087
fsubr qword [edi]
fstp qword [edi]
mov ecx, edi
call fcn.00404d1f
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
dec eax
je 0x43d7a7
dec eax
jne 0x404a95
mov ecx, dword [ebp + 8]
jmp 0x404a6b
dec eax
je 0x43d85c
jmp 0x404a74
add byte [ebx + 0x75f685ce], cl
int1
jmp fcn.0040574f
mov esi, dword [ecx + 4]
push ecx
call fcn.00464891
mov ecx, esi
test esi, esi
jne 0x43d7c7
jmp fcn.00405787
inc eax
or dl, byte [eax + 0x6a]
outsd dx, dword [esi]
call fcn.00464afa
jmp fcn.0043dca7
jmp fcn.00405905
pop es
add al, 0x66
cmp dword [eax + 8], 0x33
outsd dx, dword [esi]

Function at 0x404d37
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 8], edi
je 0x404d51
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0xc]
dec eax
jne 0x404d8b
push 0xa
lea eax, [ebp - 0x94]
push eax
push dword [esi]
call fcn.00423622
add esp, 0xc
push 0x10
call fcn.00420f16
pop ecx
test eax, eax
je 0x404d86
lea ecx, [ebp - 0x94]
push ecx
mov ecx, eax
call fcn.00411a36
mov edi, eax
mov dword [esi + 8], edi
jmp 0x404d4b
dec eax
je 0x43da5d
dec eax
jne 0x43d95f
fld qword [esi]
lea eax, [ebp - 0x94]
push ecx
push ecx
fstp qword [esp]
push 0x493ab8
push eax
call fcn.004237fa
add esp, 0x10
jmp 0x404d6a
cld
invalid
and al, 0x10
mov ecx, esi
push dword [eax + edi*4 - 4]
lea eax, [esp + 0x30]
push eax
push dword [ebp + 0xc]
call 0x3ffbb0
test eax, eax
jns 0x43d98a
jmp 0x43dcab
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00474f8b
test eax, eax
jne 0x43d9d3
lea ecx, [esp + 0x58]
call fcn.0041b1a3
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jle 0x43d9d3
mov byte [esp + 0x1b], 0
mov esi, ecx
lea eax, [esp + 0x1b]
push eax
lea ecx, [esp + 0x5c]
call fcn.004518ed
dec esi
jne 0x43d9b5
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
jmp 0x4059ab
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
jmp 0x4059af
mov dword [esp + 0x1c], esi
jmp 0x405d31

Function at 0x404f98
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0xc], 4
je 0x43dc5b
call fcn.00404dc0
push 0x10
mov dword [esi + 0xc], 4
call fcn.00420f16
cmp dword [ebp + 8], 0
pop ecx
je 0x43dc7b
test eax, eax
je 0x404fde
push dword [ebp + 8]
mov ecx, eax
call fcn.00411a36
mov dword [esi + 8], eax
mov eax, esi
pop esi
pop ebp
ret 4
xor eax, eax
jmp 0x404fd4
add cl, ch
pop ebx
jg 0x43dc5c
dec dword [ebx + 0x788b0846]
cmp cl, ch
into
jg 0x43dc67
jmp fcn.00405c3a
inc dword [ebx + 0xb424bc]
add byte [eax], al
add al, 0xf
test eax, ebx
jg 0x43dc75
invalid
mov ah, 0x24
mov al, 0
add byte [eax], al
mov ecx, dword [edi + 8]
call fcn.0040c49c
jmp fcn.00405c68
Function at 0x405087
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0xc]
sub esp, 0x10
dec eax
je 0x40509d
dec eax
je 0x4050cb
dec eax
jne 0x4050a9
fld qword [ecx]
jmp 0x4050a5
fild dword [ecx]
fstp qword [ebp - 8]
fld qword [ebp - 8]
mov esp, ebp
pop ebp
ret
dec eax
jne 0x43dcf0
mov eax, dword [ecx + 8]
mov edx, dword [eax]
call fcn.00404965
test al, al
jne 0x43dd2c
push edx
call fcn.00423e99
pop ecx
jmp 0x4050a5
fild qword [ecx]
fstp qword [ebp - 8]
fld qword [ebp - 8]
jmp 0x4050a5
inc esi
or al, 3
add byte [eax], al
add byte [ebx + 0x7d890c75], cl
adc byte [ecx - 0xf7dbbc], cl
push es
push ds
cld
inc dword [ebp - 0x74f18b40]
inc eax
adc byte [ebx + 0x40016acf], cl
push eax
call fcn.004515ef
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x3c]
call fcn.00451975
mov eax, dword [esp + 0x38]
jmp 0x406a60
pop esp
invalid

Function at 0x4053b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x4c7480]
mov dword [esp + 4], ecx
push esi
push edi
test al, 1
je 0x406949
mov edi, dword [ebp + 0x10]
xor eax, eax
push 8
mov word [esp + 0x54], 1
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], 1
call fcn.00420f16
mov edx, eax
mov dword [esp + 0x30], eax
add esp, 4
test edx, edx
je 0x406ac1
mov dword [edx], 0x14
mov esi, dword [ebp + 0xc]
mov dword [edx + 4], 0
mov dword [esp + 0x4c], edx
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [esp + 0x48], 1
mov dword [esp + 0x14], 0x17
mov eax, dword [edx + 4]
mov eax, dword [eax + ecx*4]
movsx eax, word [eax + 0xa]
mov dword [esp + 0x58], eax
jmp 0x4054bd
or eax, 1
mov dword [0x4c7488], 0
push 0x43b74c
mov dword [0x4c7480], eax
mov dword [0x4c7490], 0
mov dword [0x4c7494], 1
call fcn.00422ea0
add esp, 4
jmp 0x4053cf
xor edx, edx
mov dword [esp + 0x2c], edx
jmp 0x405414
Function at 0x40b020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edx, dword [ebx]
sub esp, 0x10
mov dword [esp + 0x1c], ecx
mov eax, dword [esi + 4]
mov dword [esp + 0x2c], 3
mov eax, dword [eax + edx*4]
mov edx, esp
mov ecx, dword [eax]
movsx edi, word [eax + 0xa]
mov dword [esp + 0x78], edi
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [edx + 0xc], eax
add ecx, 0x134
inc dword [eax]
call fcn.00413740
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x48], eax
test eax, eax
je 0x442fdb
mov edx, dword [ebx]
mov eax, dword [ecx + 0x148]
inc edx
mov esi, dword [esi + 4]
mov dword [esp + 0x84], eax
xor eax, eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], 1
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x64], eax
mov eax, dword [esi + edx*4]
mov dword [esp + 0x34], 0x49098c
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
Function at 0x40e720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or byte [ebx - 0x3174fb90], cl
call fcn.00404d37
mov ecx, dword [esi + 8]
mov eax, 1
xor esi, esi
mov dword [esp + 0x14], ecx
cmp dword [edi + 8], 3
add ecx, dword [ecx + 0x72102444]
invalid
mov eax, dword [edi + 4]
mov ecx, dword [eax + 8]
call fcn.0040502b
mov esi, eax
test esi, esi
js 0x40eb4f
cmp esi, 4
jg 0x40eb4f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp dword [edi + 8], 4
jae 0x445685
cmp eax, 1
jl 0x40eb56
add eax, dword [eax]
invalid
push ecx
dec eax
push ecx
lea ecx, [esp + 0x6c]
mov dword [esp + 0x18], eax
call fcn.00411138
mov edi, eax
test edi, edi
jne 0x445699
push ebx
lea ecx, [esp + 0x68]
call fcn.004111ea
test esi, esi
je 0x4456db
lea ecx, [esp + 0x2c]
call fcn.00411207
cmp esi, 1
je 0x445722
cmp esi, 2
je 0x4457ea
cmp esi, 3
jne 0x445931
mov ebx, dword [esp + 0x38]
xor eax, eax
mov dword [esp + 0x1c], 0x4909ac
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x28], eax
xor esi, esi
jmp 0x40e761
mov eax, 1
jmp 0x40e77c
cmp edi, dword [esi + 0x7c]
jae 0x447715
movzx eax, word [edi]
mov ecx, 0xff
cmp ax, cx
ja 0x40adbe
mov ecx, eax
mov eax, dword [esi + 0x44]
test byte [ecx + eax], 1
je 0x40adbe
add al, 1
add dword [edi], ecx
test byte [eax], dh
push edi
cld
inc dword [ebx - 0x76bdfd39]
jge 0x44568d
add edi, 2
inc edx
mov dword [ebp - 8], edi
cmp edx, dword [ebp - 0xc]
jle 0x445665
retf
jmp 0x444946
cmp edi, dword [esi + 0x7c]
jae 0x447715
movzx eax, word [edi]
mov ecx, 0xff
cmp ax, cx
ja 0x4456d5
mov ecx, eax
mov eax, dword [esi + 0x44]
test byte [ecx + eax], 0x10
jne 0x40adbe
add edi, 2
inc edx
mov dword [ebp - 8], edi
clc
cmp edx, dword [ebp - 0xc]
jle 0x4456b0
jmp 0x444946
cmp edi, dword [esi + 0x7c]
jae 0x447715
movzx eax, word [edi]
mov ecx, 0xff
cmp ax, cx
ja 0x40adbe
mov ecx, eax
mov eax, dword [esi + 0x44]
test byte [ecx + eax], 0x10
je 0x40adbe
inc dword [ebx - 0x76bdfd39]
add edi, 2
inc edx
mov dword [ebp - 8], edi
add al, byte [edx - 0x77]
jge 0x44571f
cmp edx, dword [ebp - 0xc]
jle 0x4456f7
jmp 0x444946
mov dword [ebp - 0x14], 1
add byte [eax], al
cmp edi, dword [esi + 0x7c]
jae 0x4458a0
cmp dword [ebp - 0x24], 0
movzx ecx, word [edi]
je 0x44582d
mov eax, ecx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x44582d
movzx eax, word [edi + 2]
and ecx, 0x3ff
and eax, 0x3ff
shl ecx, 0xa
or ecx, eax
mov dword [ebp - 0x14], 2
add ecx, 0x10000
mov eax, ecx
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
movzx eax, byte [eax + 0x4b3030]
shl eax, 7
and ecx, 0x8000007f
jns 0x44584f
dec ecx
or ecx, 0xffffff80
inc ecx
add eax, ecx
movzx eax, word [eax*2 + 0x4a6530]
movzx eax, byte [eax*8 + 0x4a3f21]
cmp eax, 9
je 0x445874
cmp eax, 5
je 0x445874
cmp eax, 8
je 0x445874
xor eax, eax
jmp 0x445879
mov eax, 1
cmp eax, dword [ebp - 0x38]
je fcn.00445f68
mov eax, dword [ebp - 0x14]
lea edi, [edi + eax*2]
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp - 0x18]
jl 0x4457e5
jmp fcn.00445f68
Function at 0x40e90a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, ch
pop esp
outsd dx, dword [esi]
add dword [eax], eax
mov esi, 0xfffffffa
jmp 0x4458f9
Function at 0x40eaae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 0xc
push dword [esp + 0x20]
call fcn.00420f8c
mov eax, dword [esp + 0x44]
add esp, 4
Function at 0x413c61
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
test dword [esi + 0x28], 0x8000
je 0x4504c9
test byte [esi + 0x28], 0x10
jne 0x413d6a
mov eax, dword [esi + 0x10]
xor ebx, ebx
push ebx
push ebx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x14]
push ebx
mov dword [esp + 0x18], eax
call fcn.0041410a
push ebx
lea ecx, [esp + 0x18]
call fcn.0041433f
test dword [esi + 0x28], 0x4000
jne 0x4504d8
mov ebx, 0x10000
push ebx
call fcn.00420f16
pop ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0041433f
lea ecx, [esp + 0x14]
call fcn.004145ae
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edi
inc dword [eax]
call fcn.004145ae
push ebx
push edi
mov ecx, esi
call fcn.00414220
push 0
push dword [esp + 0x10]
mov ecx, esi
mov ebx, eax
push dword [esp + 0x18]
call fcn.0041410a
test ebx, ebx
je 0x413d71
push ebx
push edi
mov byte [esp + 0x2c], 1
mov dword [esp + 0x30], 0x46
mov dword [esp + 0x34], 0xa
call fcn.0041485a
test eax, eax
jne 0x413d79
test dword [esi + 0x28], 0xff0
jne 0x4504e6
push ebx
push edi
lea ecx, [esp + 0x2c]
call fcn.004145eb
mov dword [esi + 0x2c], eax
cmp eax, 2
jne 0x413d56
mov dword [esi + 0x2c], 4
mov ecx, dword [esi + 0x2c]
call fcn.004145cb
mov dword [esi + 0x30], eax
lea ecx, [esp + 0x14]
call fcn.004145ae
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test byte [esi + 0x28], 1
jne 0x413d61
jmp 0x413d0f
mov dword [esi + 0x2c], eax
jmp 0x413d56
add byte [eax], al
add bh, al
add eax, 0x4c271c
add byte [eax], al
xor ecx, ecx
xor eax, eax
cmp word [edx + 2], ax
sete cl
add edx, 6
mov dword [edi + 4], ecx
jmp 0x41a0c7

Function at 0x41453d
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x414565
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x414557
pop edi
pop esi
pop ebp
ret 4

Function at 0x414ab2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x4508c5
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00425732
add esp, 0x10
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41dd14
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, ecx
mov dword [ebp - 0x140], edx
xor ecx, ecx
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov eax, dword [eax]
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x48], ecx
push ebx
mov ebx, dword [edx]
mov edx, ecx
mov ecx, eax
mov dword [ebp - 0x34], eax
shr ecx, 0xb
and ecx, 1
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x44], ecx
mov ecx, eax
shr ecx, 9
and ecx, 1
movsx eax, al
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xe0], ecx
xor ecx, 1
push edi
mov dword [ebp - 0xe4], ecx
xor ecx, ecx
and eax, dword [ebp - 0xc]
mov esi, dword [esi]
push 0xfffffffffffffffe
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x6c], ecx
pop ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xd8], 0xff
mov dword [ebp - 0x100], 0xfc00
mov dword [ebp - 0x108], 0xdc00
mov dword [ebp - 0x148], 0x2b
invalid
Function at 0x41e5ea
Capabilities:
Encode data using base64

Disassembly:
push ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x68]
push eax
call fcn.0041d9d3
add esp, 0x34
test eax, eax
je 0x41ee94
mov eax, dword [ebp + 0x28]
mov ecx, 0x81
dec dword [eax + 0x58]
cmp ebx, ecx
je 0x453a74
mov esi, dword [ebp - 8]
push 0x7d
pop ecx
cmp ebx, ecx
jl 0x41e62a
add ecx, 3
cmp ebx, ecx
jle 0x41ee35
mov eax, 0x87
cmp ebx, eax
je 0x453a8d
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x94]
mov esi, dword [ebp - 4]
push 0x29
pop edx
cmp word [esi], dx
jne 0x454a0a
mov edx, dword [ebp + 0x2c]
test edx, edx
jne 0x41eb2d
mov edx, dword [ebp - 0x50]
mov dword [ebp - 8], edx
mov edx, 0x91
cmp ebx, edx
je 0x41e6b0
mov edx, dword [ebp - 0x64]
and dword [ebp - 0x9c], 0
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x7c], edx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x70], edx
cmp ebx, 0x81
jl 0x453b1d
cmp edx, 0xfffffffe
je 0x453af5
test ecx, ecx
jns 0x41eda1
test eax, eax
jns 0x41edc0
mov ebx, dword [ebp - 8]
jmp 0x41e150
mov edi, dword [ebp - 0x84]
mov ecx, 0x7fffffeb
mov edx, dword [edx]
sub ecx, edx
lea eax, [edi - 4]
cmp ecx, eax
jl 0x4549d0
mov ebx, dword [ebp - 8]
lea eax, [edi - 4]
mov ecx, dword [ebp + 0x2c]
add eax, edx
push 2
pop edx
add ebx, edx
mov dword [ecx], eax
push 0x78
pop eax
mov word [ebx], dx
add ebx, edx
mov word [ebx], ax
add ebx, edx
mov word [ebx], dx
test eax, eax
jns 0x41edc0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xac], eax
mov eax, ecx
or eax, edi
mov dword [ebp - 0x94], eax
jmp 0x41e6a8
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], eax
jmp 0x41e6b0
dec dword [eax + 0x5c]
jmp 0x41e62a
add dword [ecx], ecx
add byte [edx], ch
lea eax, [ebx + 8]
push eax
call edi
push eax
mov eax, dword [ebp + 0x10]
push dword [eax]
call edi
push eax
call dword [0x490164]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebx + 4], eax
xor eax, eax
push eax
push eax
push ebx
push 0x45932d
push eax
push eax
inc ebp
add byte [eax + 0x50], dl
call dword [0x490168]
pop edi
pop ebx
pop ebp
ret 0xc
add al, 0x8d
lea ebx, [eax - 1]
invalid
Function at 0x41e725
Capabilities:
Encode data using base64

Disassembly:
push 0x2b
pop ebx
cmp ax, bx
je 0x452dd7
push 0x3f
pop ebx
cmp ax, bx
je 0x41ebb6
mov ebx, dword [ebp - 0xe0]
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
push 0x75
pop ecx
cmp word [eax], cx
je 0x452dee
movzx ecx, word [eax]
cmp cx, word [ebp - 0x134]
je 0x453414
cmp cx, word [ebp - 0x10c]
je 0x453414
cmp cx, word [ebp - 0x14c]
je 0x453414
cmp cx, word [ebp - 0x114]
je 0x453414
cmp cx, word [ebp - 0xf8]
jb 0x41ebc6
cmp cx, word [ebp - 0x11c]
jne 0x41e913
test edi, edi
je 0x41ee13
test edx, edx
jne 0x4533dc
cmp edi, 0xffffffff
je 0x41ea4c
cmp edi, dword [ebp - 0xc]
jne 0x4533ee
lea eax, [ebx + 0x66]
mov ebx, dword [ebp - 8]
push 2
pop edx
mov word [ebx], ax
mov esi, dword [ebp - 4]
add ebx, edx
mov dword [ebp - 8], ebx
xor edi, edi
cmp dword [ebp - 0x38], 0
jne 0x453685
mov edi, dword [ebp + 0x28]
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x68]
or dword [edi + 0x68], eax
jmp 0x41e150
cmp cx, word [ebp - 0x150]
je 0x41e7a6
cmp cx, word [ebp - 0x124]
je 0x41e7a6
cmp cx, word [ebp - 0x144]
je 0x41e7a6
cmp ecx, 0x72
je 0x41e7a6
cmp cx, word [ebp - 0x12c]
je 0x41e7a6
cmp ecx, 0x74
je 0x41e7a6
push 0x7d
pop eax
cmp cx, ax
jb 0x4533c0
add eax, 0xa
cmp cx, ax
ja 0x4533c0
mov eax, dword [ebp - 8]
xor edx, edx
mov ebx, eax
mov dword [ebp - 0x24], edx
sub ebx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov edx, 0x87
sar ebx, 1
cmp cx, dx
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x18], ebx
je 0x452e6e
cmp cx, word [ebp - 0xfc]
jb 0x452e8b
mov ecx, dword [ebp - 0xc]
test edx, edx
jne 0x452f72
push dword [ebp - 0x48]
push dword [ebp + 0x28]
push dword [ebp - 0x44]
cmp edi, ecx
jg 0x452f1b
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 0x10]
call fcn.0041f249
mov ecx, dword [ebp - 0x10]
lea eax, [ebx + ebx]
add esp, 0xc
lea esi, [ecx + 2]
push eax
push ecx
push esi
call fcn.00427f40
mov ebx, dword [ebp - 8]
add esp, 0xc
push 2
pop eax
add ebx, eax
mov dword [ebp - 8], ebx
test edi, edi
je 0x452eac
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, 0x92
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], esi
mov word [ecx], ax
xor edi, edi
mov ebx, dword [ebp - 8]
push 2
pop edx
jmp 0x41e7de
invalid
inc ebx