joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bb20
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x458e42
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x473564]
xor eax, esp
mov dword [esp + 0xa4], eax
push ebx
mov eax, dword [0x473564]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 8], ebx
push 4
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push str.win7
mov ecx, esi
mov dword [esp + 0x14], esi
mov byte [esi + 4], bl
call fcn.00403c00
push 0x98
lea eax, [esp + 0x18]
push ebx
mov dword [esp + 0xc0], ebx
push eax
mov dword [esp + 0x14], 1
call fcn.0043e250
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40bbed
mov eax, dword [esp + 0x14]
cmp eax, 6
mov ecx, dword [esp + 0x18]
jne 0x40bbd8
cmp ecx, 1
jne 0x40bbda
push 4
push str.win7
jmp 0x40bbe6
jb 0x40bbed
cmp ecx, 2
jb 0x40bbed
push 5
push str.win10
mov ecx, esi
call fcn.00403c00
mov eax, esi
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.00438866
add esp, 0xb4
ret

Function at 0x40c7e0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x458df8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push edi
mov eax, dword [0x473564]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
xor edi, edi
push 0xffffffffffffffff
push edi
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
call fcn.0040c3a0
mov eax, ebx
mov dword [esp + 0x34], edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40c840
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x18]
call fcn.0040c8f0
push 0xffffffffffffffff
push edi
push eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov eax, esi
mov word [esi + 4], di
call fcn.0040c3a0
cmp dword [esp + 0x28], 8
jb 0x40c887
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0043870c
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x2c
ret
Function at 0x40cac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x473564]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
mov ebx, 0x10
cmp eax, ebx
push edi
mov byte [esp + 0x10], 0x37
mov byte [esp + 0x11], 0x58
mov byte [esp + 0x12], 0x81
mov byte [esp + 0x13], 0x77
mov byte [esp + 0x14], 0x5b
mov byte [esp + 0x15], 0xf8
mov byte [esp + 0x16], 0xa
mov byte [esp + 0x17], 0x70
mov byte [esp + 0x18], 0x66
mov byte [esp + 0x19], 0x46
mov byte [esp + 0x1a], 0x9c
mov byte [esp + 0x1b], 0xb4
mov byte [esp + 0x1c], 0xff
mov byte [esp + 0x1d], 0xa0
mov byte [esp + 0x1e], 0x9e
mov byte [esp + 0x1f], 0x97
mov byte [esp + 0x20], 3
mov byte [esp + 0x21], 0x30
mov byte [esp + 0x22], 0xb7
mov byte [esp + 0x23], 0x4e
mov byte [esp + 0x24], 0xa7
mov byte [esp + 0x25], 0x39
mov byte [esp + 0x26], 0x23
mov byte [esp + 0x27], 0x5a
mov byte [esp + 0x28], 0x64
mov byte [esp + 0x29], 0x2b
mov byte [esp + 0x2a], 0x41
mov byte [esp + 0x2b], 0x4f
mov byte [esp + 0x2c], 0x31
mov byte [esp + 0x2d], 0xce
mov byte [esp + 0x2e], 0x90
mov byte [esp + 0x2f], 0x9a
lea edi, [esi + 4]
jb 0x40cb8b
mov ecx, dword [edi]
jmp 0x40cb8d
mov ecx, edi
lea edx, [esp + 0x10]
cmp edx, ecx
jb 0x40cbc4
cmp eax, ebx
jb 0x40cb9d
mov ecx, dword [edi]
jmp 0x40cb9f
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
lea ecx, [esp + 0x10]
cmp edx, ecx
jbe 0x40cbc4
cmp eax, ebx
jb 0x40cbb2
mov edi, dword [edi]
push ebx
lea edx, [esp + 0x14]
sub edx, edi
push edx
push esi
mov ecx, esi
call fcn.00403810
jmp 0x40cbff
cmp eax, ebx
jae 0x40cbd4
mov eax, dword [esi + 0x14]
push eax
push ebx
mov ecx, esi
call fcn.00404300
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x40cbdf
mov eax, dword [edi]
jmp 0x40cbe1
mov eax, edi
push ebx
lea edx, [esp + 0x14]
push edx
push ecx
push eax
call fcn.00438711
add esp, 0x10
cmp dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
jb 0x40cbfb
mov edi, dword [edi]
mov byte [edi + 0x10], 0
mov ecx, dword [ebp + 0x18]
cmp ecx, ebx
lea esi, [ebp + 4]
jb 0x40cc0d
mov eax, dword [esi]
jmp 0x40cc0f
mov eax, esi
lea edx, [esp + 0x20]
cmp edx, eax
jb 0x40cc57
cmp ecx, ebx
jb 0x40cc1f
mov eax, dword [esi]
jmp 0x40cc21
mov eax, esi
mov edx, dword [ebp + 0x14]
add edx, eax
lea eax, [esp + 0x20]
cmp edx, eax
jbe 0x40cc57
cmp ecx, ebx
jb 0x40cc34
mov esi, dword [esi]
push ebx
lea ecx, [esp + 0x24]
sub ecx, esi
push ecx
push ebp
mov ecx, ebp
call fcn.00403810
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00438866
add esp, 0x24
ret
cmp ecx, ebx
jae 0x40cc67
mov edx, dword [ebp + 0x14]
push edx
push ebx
mov ecx, ebp
call fcn.00404300
mov ecx, dword [ebp + 0x18]
cmp ecx, ebx
jb 0x40cc72
mov eax, dword [esi]
jmp 0x40cc74
mov eax, esi
push ebx
lea edx, [esp + 0x24]
push edx
push ecx
push eax
call fcn.00438711
add esp, 0x10
cmp dword [ebp + 0x18], ebx
mov dword [ebp + 0x14], ebx
jb 0x40cc8e
mov esi, dword [esi]
mov ecx, dword [esp + 0x30]
pop edi
mov byte [esi + 0x10], 0
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438866
add esp, 0x24
ret
Function at 0x40ccb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45b798
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x473564]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
mov eax, dword [0x473564]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
xor ebx, ebx
mov eax, 0xf
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
mov dword [esp + 0x70], ebx
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x74], 1
call fcn.0040cac0
mov ecx, dword [esp + 0x34]
mov ebp, 0x10
add esp, 4
cmp dword [esp + 0x44], ebp
mov dword [esp + 0xc], 1
jae 0x40cd34
lea ecx, [esp + 0x30]
cmp dword [esp + 0x60], ebp
mov eax, dword [esp + 0x4c]
jae 0x40cd42
lea eax, [esp + 0x4c]
push ebx
lea edx, [esp + 0x10]
push edx
push ecx
push eax
mov ecx, esi
lea edx, [esp + 0x20]
call fcn.00410400
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov byte [esp + 0x7c], 2
call fcn.00403810
cmp dword [esp + 0x28], ebp
jb 0x40cd7b
mov eax, dword [esp + 0x14]
push eax
call fcn.0043870c
add esp, 4
cmp dword [esp + 0x44], ebp
jb 0x40cd8e
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0043870c
add esp, 4
cmp dword [esp + 0x60], ebp
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
jb 0x40cdb1
mov edx, dword [esp + 0x4c]
push edx
call fcn.0043870c
add esp, 4
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00438866
add esp, 0x68
ret
Function at 0x40cdd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45b798
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x473564]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
mov eax, dword [0x473564]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
xor ebx, ebx
mov eax, 0xf
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
mov dword [esp + 0x70], ebx
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x74], 1
call fcn.0040cac0
mov eax, dword [esp + 0x34]
mov ebp, 0x10
add esp, 4
cmp dword [esp + 0x44], ebp
mov dword [esp + 0xc], 1
jae 0x40ce54
lea eax, [esp + 0x30]
cmp dword [esp + 0x60], ebp
mov edx, dword [esp + 0x4c]
jae 0x40ce62
lea edx, [esp + 0x4c]
lea ecx, [esp + 0xc]
push ecx
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.00410860
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov byte [esp + 0x7c], 2
call fcn.00403810
cmp dword [esp + 0x28], ebp
jb 0x40ce98
mov edx, dword [esp + 0x14]
push edx
call fcn.0043870c
add esp, 4
cmp dword [esp + 0x44], ebp
jb 0x40ceab
mov eax, dword [esp + 0x30]
push eax
call fcn.0043870c
add esp, 4
cmp dword [esp + 0x60], ebp
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
jb 0x40cece
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.0043870c
add esp, 4
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00438866
add esp, 0x68
ret
Function at 0x4101c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45a91e
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x473564]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esp + 0x14], 2
mov dword [esi], vtable.CryptoPP::Grouper.0
mov dword [esi + 4], vtable.CryptoPP::Grouper.1.0
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov byte [esp + 0x14], 6
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov ecx, dword [esi + 0xc]
cmp ecx, edi
je 0x41022c
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, esi
mov dword [esi + 0xc], edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x412890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45a801
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x473564]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x30]
push 1
push eax
push ecx
lea edi, [esp + 0x1c]
mov dword [esp + 0x30], 1
call fcn.00412b40
push eax
push esi
call fcn.00431ef0
mov byte [esp + 0x24], 0
mov ecx, dword [esp + 0x14]
test ecx, ecx
mov dword [esp + 0xc], 1
je 0x412913
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x412990
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45a801
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x473564]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x30]
push eax
push ecx
push edx
lea edi, [esp + 0x1c]
mov dword [esp + 0x30], 1
call fcn.00412d60
push eax
push esi
call fcn.00431ef0
mov byte [esp + 0x24], 0
mov ecx, dword [esp + 0x14]
test ecx, ecx
mov dword [esp + 0xc], 1
je 0x412a12
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x412a30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45a801
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x473564]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x30]
push eax
push ecx
lea edi, [esp + 0x18]
mov dword [esp + 0x2c], 1
call fcn.00412cb0
push eax
push esi
call fcn.00431ef0
mov byte [esp + 0x24], 0
mov ecx, dword [esp + 0x14]
test ecx, ecx
mov dword [esp + 0xc], 1
je 0x412ab1
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x413310
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
sub esp, 8
push esi
push 0
push 0
push 0
push 1
push 0
mov esi, eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [edi], eax
jne 0x413333
xor al, al
pop esi
add esp, 8
ret
push ebp
mov ebp, 0x10
cmp dword [esi + 0x44], ebp
jb 0x413343
mov ecx, dword [esi + 0x30]
jmp 0x413346
lea ecx, [esi + 0x30]
movzx edx, word [esi + 0x48]
push 0
push 0
push 3
push 0
push 0
push edx
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [edi + 4], eax
jne 0x41336c
pop ebp
xor al, al
pop esi
add esp, 8
ret
cmp dword [esi + 0x64], ebp
jb 0x413376
mov edx, dword [esi + 0x50]
jmp 0x413379
lea edx, [esi + 0x50]
cmp dword [esi + 0x28], ebp
jb 0x413383
mov ecx, dword [esi + 0x14]
jmp 0x413386
lea ecx, [esi + 0x14]
push ebx
mov ebx, dword [esi + 0xc]
push 0
push ebx
push 0
push 0
push str.HTTP_1.0
push edx
push ecx
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
test eax, eax
mov dword [edi + 8], eax
je 0x41342e
mov ebx, dword [sym.imp.WININET.dll_InternetSetOptionA]
push 4
push esi
push 2
push eax
call ebx
test eax, eax
je 0x41342e
mov ecx, dword [edi + 8]
push 4
lea eax, [esi + 4]
push eax
push 5
push ecx
call ebx
test eax, eax
je 0x41342e
mov eax, dword [edi + 8]
push 4
lea edx, [esi + 8]
push edx
push 6
push eax
call ebx
test eax, eax
je 0x41342e
test dword [esi + 0xc], 0x800000
je 0x413437
mov eax, dword [edi + 8]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x1f
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 4
call dword [sym.imp.WININET.dll_InternetQueryOptionA]
test eax, eax
je 0x41342e
mov edx, dword [edi + 8]
or dword [esp + 0xc], 0x3380
push 4
lea ecx, [esp + 0x10]
push ecx
push 0x1f
push edx
call ebx
test eax, eax
jne 0x413437
pop ebx
pop ebp
xor al, al
pop esi
add esp, 8
ret
cmp dword [esi + 0x9c], ebp
mov edx, dword [esi + 0x98]
jb 0x41344d
mov ecx, dword [esi + 0x88]
jmp 0x413453
lea ecx, [esi + 0x88]
cmp dword [esi + 0x80], ebp
mov eax, dword [esi + 0x7c]
jb 0x413463
mov esi, dword [esi + 0x6c]
jmp 0x413466
add esi, 0x6c
push edx
push ecx
push eax
mov eax, dword [edi + 8]
push esi
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestA]
pop ebx
test eax, eax
pop ebp
setne al
pop esi
add esp, 8
ret
Function at 0x4135c0
Capabilities:
Read data from internet
Receive data

Disassembly:
sub esp, 0x408
mov eax, dword [0x473564]
xor eax, esp
mov dword [esp + 0x404], eax
push ebp
mov ebp, dword [esp + 0x410]
push edi
mov edi, dword [esi + 8]
test edi, edi
jne 0x4135e8
xor al, al
jmp 0x413655
push 0x3ff
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call fcn.0043e250
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x400
lea edx, [esp + 0x14]
push edx
push edi
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [esp + 0x18], 0
call edi
test eax, eax
je 0x413653
mov eax, dword [esp + 8]
test eax, eax
je 0x413653
push eax
lea eax, [esp + 0x10]
push eax
mov eax, ebp
call fcn.00404e30
mov eax, dword [esi + 8]
lea ecx, [esp + 8]
push ecx
push 0x400
lea edx, [esp + 0x14]
push edx
push eax
call edi
test eax, eax
jne 0x413625
mov al, 1
mov ecx, dword [esp + 0x40c]
pop edi
pop ebp
xor ecx, esp
call fcn.00438866
add esp, 0x408
ret 4

Function at 0x413f00
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x458c0f
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x473564]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push ebp
push esi
mov eax, dword [0x473564]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov eax, dword [esp + 0x98]
xor ebx, ebx
mov dword [esp + 0x10], ebx
lea ebp, [edi + 4]
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov dword [esp + 0x14], edi
mov byte [ebp], bl
mov dword [esp + 0x90], ebx
push eax
mov eax, dword [esp + 0xa0]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 1
mov byte [esp + 0x84], bl
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.00413670
cmp byte [esp + 0x80], bl
jne 0x413fbe
lea esi, [esp + 0x18]
mov byte [esp + 0x80], 1
call fcn.00413710
mov eax, dword [edi + 0x18]
mov esi, 0x10
cmp eax, esi
jb 0x413fcf
mov ecx, dword [ebp]
jmp 0x413fd1
mov ecx, ebp
lea edx, [esp + 0x70]
cmp edx, ecx
jb 0x41400a
cmp eax, esi
jb 0x413fe2
mov ecx, dword [ebp]
jmp 0x413fe4
mov ecx, ebp
mov edx, dword [edi + 0x14]
add edx, ecx
lea ecx, [esp + 0x70]
cmp edx, ecx
jbe 0x41400a
cmp eax, esi
jb 0x413ff8
mov ebp, dword [ebp]
push esi
lea edx, [esp + 0x74]
sub edx, ebp
push edx
push edi
mov ecx, edi
call fcn.00403810
jmp 0x414046
cmp eax, esi
jae 0x41401a
mov eax, dword [edi + 0x14]
push eax
push esi
mov ecx, edi
call fcn.00404300
mov ecx, dword [edi + 0x18]
cmp ecx, esi
jb 0x414026
mov eax, dword [ebp]
jmp 0x414028
mov eax, ebp
push esi
lea edx, [esp + 0x74]
push edx
push ecx
push eax
call fcn.00438711
add esp, 0x10
cmp dword [edi + 0x18], esi
mov dword [edi + 0x14], esi
jb 0x414043
mov ebp, dword [ebp]
mov byte [ebp + 0x10], bl
mov eax, edi
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.00438866
add esp, 0x84
ret
Function at 0x416000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45b118
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x473564]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
and dword [esp + 0x14], 0xfffffe00
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
mov dword [esp + 0x3c], 1
call fcn.004160d0
test al, al
jne 0x416078
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.0041ca30
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
call fcn.004178e0
mov edx, dword [eax]
lea eax, [esp + 0xc]
call fcn.0041cad0
call fcn.004178e0
mov ecx, dword [eax]
mov eax, dword [edi + 4]
sub eax, dword [esi + 0x44]
mov dword [ecx + 0x10], eax
call fcn.004178e0
mov ecx, dword [eax]
mov eax, dword [edi + 8]
sub eax, dword [esi + 0x44]
mov dword [esp + 0x30], 0xffffffff
mov dword [ecx + 0x14], eax
lea ecx, [esp + 0xc]
call fcn.0041ca30
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x424020
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
mov esi, dword [esp + 8]
push edi
mov edi, eax
jne 0x424031
pop edi
xor eax, eax
pop esi
ret
cmp edi, 8
not esi
jb 0x424119
push ebp
mov ebp, edi
shr ebp, 3
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + 0x463090]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x463090]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + 0x463090]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x463090]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x463090]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x463090]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x463090]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x463090]
add ecx, 1
sub edi, 8
sub ebp, 1
mov esi, eax
jne 0x424042
pop ebp
test edi, edi
je 0x42413c
lea ecx, [ecx]
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x463090]
add ecx, 1
sub edi, 1
jne 0x424120
mov eax, esi
pop edi
not eax
pop esi
ret

Function at 0x424150
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [edx]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x463090]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
add eax, 1
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x463090]
mov dword [edx + 8], ecx
ret

Function at 0x4241a0
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
xor al, bl
movzx ebx, al
xor ebx, edx
shr edx, 8
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x463090]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
add edx, 1
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x463090]
pop ebx
mov dword [esi + 8], ecx
ret

Function at 0x4248b0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ebx
imul esi, dword [esp + 0x10]
cmp byte [edi], 0
je 0x4248e8
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4248dd
mov byte [edi + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
pop esi
div ebx
pop ebx
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x4248fb
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call fcn.0043ca70
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
ret
Function at 0x4253f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x425408
pop edi
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x4253fd
cmp dword [edi + 0x7c], ebx
je 0x425417
call fcn.00425800
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00425210
add esp, 0xc
test eax, eax
je 0x42543d
pop edi
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push ebp
push 0x84
call fcn.0043a027
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x42547f
push 0x4000
call fcn.0043a027
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add esp, 4
cmp eax, ebx
mov dword [ebp], eax
mov dword [ebp + 0x44], ecx
mov dword [ebp + 0x48], edx
mov dword [ebp + 0x4c], ebx
jne 0x42548b
push ebp
call fcn.0043916a
add esp, 4
pop ebp
pop edi
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [ebp + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [ebp + 0x54], ecx
mov dword [ebp + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [ebp + 0x64], edx
mov ecx, dword [edi]
mov dword [ebp + 0x60], ecx
mov edx, dword [edi + 0xc]
push esi
mov dword [ebp + 0x68], edx
cmp eax, ebx
mov dword [ebp + 0x18], ebx
jne 0x4254d4
lea esi, [ebp + 4]
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
call fcn.00424410
test eax, eax
jne 0x4254d4
mov dword [ebp + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [ebp + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [ebp + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [ebp + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x4254fe
mov cl, byte [edi + 0x39]
mov byte [ebp + 0x80], cl
jmp 0x425507
mov dl, byte [edi + 0x3f]
mov byte [ebp + 0x80], dl
mov al, byte [ebp + 0x6c]
mov esi, dword [esp + 0x20]
neg al
lea edx, [ebp + 0x70]
mov dword [edx], 0x12345678
mov dword [ebp + 0x74], 0x23456789
mov dword [ebp + 0x78], 0x34567890
sbb eax, eax
and eax, 0xc
cmp esi, ebx
mov dword [ebp + 0x7c], eax
je 0x425543
mov cl, byte [esi]
cmp cl, bl
je 0x425543
call fcn.00424150
add esi, 1
jne 0x425533
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [ebp + 0x3c], eax
mov dword [ebp + 8], ebx
pop esi
mov dword [edi + 0x7c], ebp
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0xc
ret