joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41304a
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x414c30
push 1
xor ebx, ebx
push ebx
push 0x414ce0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x41311b
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x414cd0
push eax
call dword [ecx]
test eax, eax
jl 0x413112
cmp byte [ebp + 8], bl
je 0x41309d
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x4130ba
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
cmp dword [ebp + 0x1c], ebx
jne 0x4130cc
push 0x41437c
jmp 0x4130cf
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x4130e4
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x4130f5
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x413109
mov bl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x413135
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8
Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov dword [0x403cdc], eax
lea ecx, [ebp - 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, dword [ebp + 4]
mov dword [0x403b2d], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401031
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x403b2d]
mov dword [ebp - 0x48], eax
mov eax, 0x40168b
mov dword [ebp - 0x54], eax
mov ecx, str.Hello
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor ecx, ecx
push ecx
push dword [0x403b2d]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.klavesn
push eax
mov eax, str.Hello
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403d28], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403d28]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4010ce
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4010c0
mov esp, ebp
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x21721054
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1f546b73
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4010b2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4010ff
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push 0x3ff
push 0x400
push eax
call fcn.00402cd1
lea eax, [ebp - 0x804]
push eax
call fcn.00401059
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b66
leave
ret

Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.0040593d
lea eax, [ebp - 0x404]
push eax
call section..text
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b66
leave
ret
Function at 0x4011a6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
push 0x40eab8
lea eax, [ebp - 4]
xor edi, edi
push 0x411b68
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
call fcn.00401c33
xor ecx, ecx
cmp eax, edi
sete cl
push str.Failed_to_open_executable
push ecx
call fcn.0040110b
push 2
push edi
push dword [ebp - 4]
call fcn.00402d7b
push dword [ebp - 4]
call fcn.00402a86
cdq
mov dword [ebp - 0x18], eax
add eax, 0xfffffefc
add esp, 0x24
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], eax
cmp eax, edi
jge 0x401207
mov dword [ebp - 8], edi
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00402d7b
push dword [ebp - 4]
push 0x104
push 1
push ebx
call fcn.004027a2
push ebx
mov esi, eax
call fcn.00401164
add esp, 0x20
cmp eax, edi
je 0x401249
mov esi, eax
sub eax, ebx
add eax, dword [ebp - 8]
push 5
cdq
pop ecx
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], eax
mov esi, edx
jmp 0x4012c7
mov esi, 0x4100000
push esi
call fcn.00402210
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
add eax, 0xfbf00000
pop ecx
mov dword [ebp - 8], eax
cmp eax, edi
jge 0x40126a
mov dword [ebp - 8], edi
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00402d7b
push dword [ebp - 4]
push esi
push 1
push dword [ebp - 0xc]
call fcn.004027a2
push dword [ebp - 0xc]
mov esi, eax
call fcn.00401164
mov esi, eax
xor eax, eax
cmp esi, edi
setne al
push str.Unable_to_find_an_appended_archive.
mov dword [ebp - 0x14], esi
push eax
call fcn.0040110b
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
push 5
add eax, dword [ebp - 8]
pop ecx
push dword [ebp - 0xc]
cdq
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], eax
mov esi, edx
call fcn.00401f8c
add esp, 0x2c
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x20]
push 0
sub dword [ebp - 0x18], ecx
push dword [ebp - 0x18]
push dword [ebp - 4]
sbb esi, 0
call fcn.00402d7b
push dword [ebp - 4]
mov edi, 0x104
push edi
push 1
push ebx
call fcn.004027a2
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
mov esi, str.Unable_to_read_from_file
neg eax
push esi
push eax
call fcn.0040110b
mov cx, word [ebx]
mov eax, 0x40eb1c
add esp, 0x24
cmp cx, word [eax]
jne 0x40131a
mov dword [ebp - 0x10], ebx
jmp 0x40136e
mov eax, dword [ebp - 0x18]
add eax, 0xfffffefc
jns 0x401326
xor eax, eax
push 0
push eax
push dword [ebp - 4]
call fcn.00402d7b
push dword [ebp - 4]
push edi
push 1
push ebx
call fcn.004027a2
mov edi, eax
xor eax, eax
cmp eax, edi
sbb eax, eax
neg eax
push esi
push eax
call fcn.0040110b
add esp, 0x24
lea eax, [edi + ebx - 1]
jmp 0x401365
mov dx, word [eax]
mov ecx, 0x40eb1c
cmp dx, word [ecx]
je 0x40136b
dec eax
cmp eax, ebx
jae 0x401357
jmp 0x40136e
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
call fcn.00403039
mov eax, dword [ebp - 0x10]
pop ecx
pop edi
pop esi
leave
ret
Function at 0x401485
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8dc
mov eax, dword [0x410004]
xor eax, esp
mov dword [esp + 0x8d8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push 0x70
lea eax, [esp + 0x78]
push eax
push 9
push ebx
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x4014da
cmp dword [esp + 0x10], 0x70
jne 0x4014da
xor eax, eax
inc eax
jmp 0x4014dc
xor eax, eax
push str.Job_information_querying_failed
push eax
call fcn.0040110b
or dword [esp + 0x88], 0x3000
pop ecx
pop ecx
push 0x70
lea eax, [esp + 0x74]
push eax
push 9
push ebx
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
push str.Job_information_setting_failed
push eax
call fcn.0040110b
push 0x44
pop esi
push esi
lea eax, [esp + 0x34]
push edi
push eax
call fcn.004063b0
add esp, 0x14
mov dword [esp + 0x28], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff6
call esi
push eax
lea eax, [esp + 0x64]
call fcn.0040142d
mov dword [esp], str.stdin_duplication_failed
push eax
call fcn.0040110b
pop ecx
pop ecx
push 0xfffffffffffffff5
call esi
push eax
lea eax, [esp + 0x68]
call fcn.0040142d
mov dword [esp], str.stdout_duplication_failed
push eax
call fcn.0040110b
pop ecx
pop ecx
push 0xfffffffffffffff4
call esi
push eax
lea eax, [esp + 0x6c]
call fcn.0040142d
mov dword [esp], str.stderr_duplication_failed
push eax
call fcn.0040110b
pop ecx
pop ecx
push 1
push 0x401465
mov dword [esp + 0x5c], 0x100
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push dword [esp + 0x34]
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, edi
jne 0x4015f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ecx, 0x400
push ecx
lea edx, [esp + 0xe8]
push edx
push ecx
push eax
push edi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea eax, [esp + 0xe0]
push eax
push dword [esp + 0x18]
push str.Unable_to_create_process_using__ls:__ls
push edi
call fcn.004010b2
add esp, 0x10
push dword [esp + 0x18]
mov eax, dword [esp + 0x24]
push ebx
mov dword [0x412570], eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push str.Failed_to_get_exit_code_of_process
push eax
call fcn.0040110b
pop ecx
pop ecx
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x40910b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004042b3
and dword [ebp - 0x14], 0
cmp dword [0x411b38], 0
mov dword [ebp - 0x18], eax
jne 0x4091be
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x409266
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x409266
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x411b38], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x411b3c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x411b40], eax
call edi
push eax
call esi
mov dword [0x411b48], eax
test eax, eax
je 0x4091be
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x411b44], eax
mov eax, dword [0x411b44]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409217
cmp dword [0x411b48], ecx
je 0x409217
push eax
call esi
push dword [0x411b48]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409217
test ebx, ebx
je 0x409217
call edi
test eax, eax
je 0x40920e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40920e
test byte [ebp - 8], 1
jne 0x409217
or dword [ebp + 0x10], 0x200000
jmp 0x40924a
mov eax, dword [0x411b3c]
cmp eax, dword [ebp - 0x18]
je 0x40924a
push eax
call esi
test eax, eax
je 0x40924a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40924a
mov eax, dword [0x411b40]
cmp eax, dword [ebp - 0x18]
je 0x40924a
push eax
call esi
test eax, eax
je 0x40924a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x411b38]
call esi
test eax, eax
je 0x409266
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x409268
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401b66
leave
ret
Function at 0x405f28
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40604c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405e9f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40604c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405e9f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406068
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405f28
xor eax, eax
push ebp
push 0x405f21
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405c64
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405f06
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406088
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405f06
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f28
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406042
cmp byte [ebp - 0xd], 0
jne 0x405f6f
cmp byte [ebp - 0x12], 0
je 0x406042
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405f88
dec ebx
cmp byte [ebx], 0x2e
je 0x405f97
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405f87
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406042
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405fd4
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406042
cmp byte [ebp - 0xd], 0
je 0x406042
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x406042
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431f8c
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea ecx, [eax - 1]
dec eax
bsr ecx, ecx
xor ecx, 0x3f
neg cl
inc ecx
mov esi, 1
dec ecx
shl esi, cl
dec eax
cmp eax, 2
dec esp
cmovb esi, eax
jmp 0x431fbb

Function at 0x432944
Capabilities:
Hash data using fnv

Disassembly:
inc ecx
push edi
inc ecx
push esi
inc ecx
push ebp
inc ecx
push esp
push esi
push edi
push ebp
push ebx
dec eax
sub esp, 0x28
dec eax
mov esi, edx
dec eax
mov edi, ecx
dec eax
mov eax, dword [edx + 0x10]
dec eax
test eax, eax
jle 0x432981
dec eax
mov ecx, dword [esi + 8]
dec eax
add eax, ecx
xor ebx, ebx
dec eax
lea edx, [ebx + ebx*4]
dec eax
movsx ebx, byte [ecx]
dec eax
add ebx, edx
dec eax
inc ecx
dec eax
cmp ecx, eax
jb 0x43296c
jmp 0x432983
xor ebx, ebx
dec esp
mov esp, dword [edi + 8]
dec ebp
test esp, esp
je 0x432a2f
dec eax
imul eax, dword [esi], 0x1000193
dec eax
xor ebx, eax
dec ebp
invalid
inc ebp
xor edi, edi
dec esp
mov eax, edi
dec eax
add esp, 0x28
pop ebx
pop ebp
pop edi
pop esi
inc ecx
pop esp
inc ecx
pop ebp
inc ecx
pop esi
inc ecx
pop edi
ret

Function at 0x432ada
Capabilities:
Hash data using fnv

Disassembly:
push ebp
inc ecx
push edi
inc ecx
push esi
inc ecx
push ebp
inc ecx
push esp
push esi
push edi
push ebx
dec eax
sub esp, 0x58
dec eax
lea ebp, [esp + 0x50]
dec eax
mov dword [ebp], 0xfffffffe
dec ebp
mov edi, eax
dec eax
mov esi, edx
dec eax
mov edi, ecx
dec ecx
mov eax, dword [eax]
dec eax
lea ecx, [ebp - 0x18]
dec eax
Function at 0x4336c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
inc ecx
push edi
inc ecx
push esi
push esi
push edi
push ebx
dec eax
sub esp, 0x38
dec eax
lea ebp, [esp + 0x30]
dec eax
mov dword [ebp], 0xfffffffe
inc esp
mov bl, al
dec eax
mov esi, edx
dec eax
lea eax, [0x28ec5a]
dec eax
mov dword [ecx], eax
dec eax
mov eax, dword [edx]
inc esp
mov dh, byte [eax + 8]
dec eax
mov edi, dword [eax + 0x10]
dec eax
mov dword [ebp - 8], ecx
call 0xffe88922
inc ecx
movzx eax, dh
dec eax
mov ecx, eax
dec eax
shr ecx, 1
test al, 1
dec eax
cmove edi, ecx
dec eax
mov eax, dword [ebp - 8]
dec eax
mov ecx, dword [eax]
dec eax
add ecx, 8
dec eax
mov edx, edi
call 0xffeb2176
dec eax
mov edi, dword [esi]
inc esp
movzx esi, byte [edi + 8]
inc ecx
test dh, 1
je 0x433738
dec esp
mov esi, dword [edi + 0x10]
dec eax
mov edi, dword [edi + 0x18]
jmp 0x43373f
dec eax
add edi, 9
dec ecx
shr esi, 1
inc ecx
mov edi, ebx
inc ecx
xor bh, 1
dec ecx
add esi, edi
dec esp
cmp edi, esi
je 0x4337b4
inc eax
mov dh, byte [edi]
mov al, 1
inc eax
cmp dh, 0x5f
je 0x4337ac
inc ecx
test bh, 1
jne 0x43377f
dec eax
mov ecx, dword [ebp - 8]
call 0xffe88922
dec eax
mov eax, dword [ebp - 8]
dec eax
mov ecx, dword [eax]
dec eax
add ecx, 8
mov edx, esi
call 0xffeb276a
inc esp
mov eax, edi
jmp 0x4337ac
dec eax
mov ecx, dword [ebp - 8]
call 0xffe88922
lea eax, [esi - 0x61]
lea ecx, [esi - 0x20]
cmp al, 0x1a
inc eax
movzx eax, dh
movzx edx, cl
cmovae edx, eax
dec eax
mov eax, dword [ebp - 8]
dec eax
mov ecx, dword [eax]
dec eax
add ecx, 8
call 0xffeb276a
xor eax, eax
dec eax
inc edi
inc ecx
mov edi, eax
jmp 0x433749
test bl, bl
je 0x433809
dec eax
mov eax, dword [ebp - 8]
dec eax
mov eax, dword [eax]
movzx ecx, byte [eax + 8]
test cl, 1
je 0x4337ce
dec eax
mov edx, dword [eax + 0x10]
jmp 0x4337d4
dec eax
mov edx, ecx
dec eax
shr edx, 1
dec eax
test edx, edx
je 0x433809
test cl, 1
je 0x4337e4
dec eax
mov eax, dword [eax + 0x18]
jmp 0x4337e8
dec eax
add eax, 9
inc eax
mov dh, byte [eax]
dec eax
mov ecx, dword [ebp - 8]
call 0xffe88922
lea ecx, [esi - 0x41]
lea edx, [esi + 0x20]
cmp cl, 0x1a
inc eax
movzx ecx, dh
movzx edx, dl
cmovae edx, ecx
mov byte [eax], dl
dec eax
mov eax, dword [ebp - 8]
dec eax
add esp, 0x38
pop ebx
pop edi
pop esi
inc ecx
pop esi
inc ecx
pop edi
pop ebp
ret
Function at 0x444984
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
inc ecx
push edi
inc ecx
push esi
inc ecx
push ebp
inc ecx
push esp
push esi
push edi
push ebx
dec eax
sub esp, 0x208
dec eax
lea ebp, [esp + 0x80]
movaps xmmword [ebp + 0x170], xmm6
dec eax
mov dword [ebp + 0x168], 0xfffffffe
dec ecx
mov edi, edx
dec ecx
mov esi, ecx
mov esi, 0xb8
dec eax
mov ecx, dword [ecx + 8]
dec eax
add ecx, esi
mov edx, 0x90
inc ecx
mov al, 0x22
call fcn.00456e12
dec eax
mov ebx, eax
dec ecx
mov dword [esi + 0x40], eax
mov word [eax + 0x38], 0
inc ecx
test byte [edi + 0x10], 0x10
jne 0x4449f6
dec eax
lea edi, [0x76ab95]
stosd dword es:[edi], eax
jbe 0x4449eb
xor eax, eax
dec eax
mov dword [ebp + 0xd0], eax
jmp 0x444a41
dec ecx
mov ecx, dword [esi + 8]
dec eax
add ecx, esi
mov edx, 0x30
inc ecx
mov al, 7
call fcn.00456e12
dec eax
mov edi, eax
dec eax
mov ecx, eax
xor edx, edx
inc ebp
xor eax, eax
call fcn.0042ae54
dec ecx
mov eax, dword [edi + 0xd0]
dec eax
test eax, eax
dec eax
lea edx, [0x76ab55]
dec eax
cmovne edx, eax
dec eax

Function at 0x444d7c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sal byte [ebp + edx + 0x48], 0x8b
push ebx
or byte [eax - 0x75], cl
or cl, byte [edi]
mov dh, 0x41
or byte [eax + 0x48357401], ch

Function at 0x444e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ecx - 0x73], cl
dec esi
push 0x70768d49

Function at 0x444ea4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ja 0x444ec6
scasb al, byte es:[edi]
inc dword [eax + 0x7500007d]
push ss
Function at 0x445144
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [eax + 0x18], 0
jne 0x4451d2
dec eax
mov eax, dword [ebp + 0x160]
dec eax
mov ecx, dword [eax + 8]
mov eax, 0xb8
dec eax
add ecx, eax
mov edx, 0x10
inc ecx
mov al, 0x12
call fcn.00456e12
movups xmmword [eax], xmm6
dec eax
mov ecx, dword [ebp + 0x158]
dec eax
mov dword [ecx + 0x18], eax
dec eax
mov eax, dword [ebp + 0x160]
dec eax
mov ecx, dword [eax + 8]
dec eax
mov eax, dword [ebp + 0x150]
mov edx, dword [eax + 0x20]
shl edx, 3
call fcn.00433988
dec eax
mov ecx, dword [ebp + 0x158]
dec eax
mov ecx, dword [ecx + 0x18]
dec eax
mov dword [ecx + 8], eax
dec eax
mov eax, dword [ebp + 0x150]
inc esp
mov eax, dword [eax + 0x20]
inc ebp
test eax, eax
jle 0x4451d2
dec eax
mov eax, dword [ebp + 0x158]
dec eax
mov eax, dword [eax + 0x18]
dec eax
mov ecx, dword [eax + 8]
dec ecx
shl eax, 3
xor edx, edx
call 0x635b80
dec eax
mov eax, dword [ebp + 0x160]
dec eax
mov ecx, dword [eax + 8]
dec eax
mov eax, dword [ebp + 0x150]
dec eax
mov eax, dword [eax + 0x28]
dec edx
mov eax, dword [eax + edi*8 + 8]
dec esp
mov ebp, dword [eax]
inc ebp
movzx esp, byte [ebp + 8]
dec ecx
mov esi, dword [ebp + 0x18]
inc ecx
test ah, 1
je 0x445205
dec ecx
mov edi, dword [ebp + 0x10]
jmp 0x44520b
dec esp
mov edi, esp
dec eax
shr edi, 1
lea edx, [edi + 1]
call fcn.00433988
dec eax
mov ebx, eax
dec ecx
add ebp, 9
inc ecx
test ah, 1
dec ecx
cmove esi, ebp
dec eax
mov ecx, eax
dec eax
mov edx, esi
dec ecx
mov eax, edi
call 0x635560
mov byte [ebx + edi], 0
dec eax
mov eax, dword [ebp + 0x158]
dec eax
mov eax, dword [eax + 0x18]
dec eax
mov eax, dword [eax + 8]
dec edx
mov dword [eax + edi*8], ebx