joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49af28
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49b066
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
push eax
mov edx, ebx
lea eax, [ebp - 0x14c]
call fcn.00403494
lea eax, [ebp - 0x14c]
mov edx, 0x49b07c
call fcn.0040357c
mov eax, dword [ebp - 0x14c]
call fcn.00403738
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x49b045
xor eax, eax
push ebp
push 0x49b03e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x49b08c
lea eax, [ebp - 0x11c]
mov ecx, 5
call fcn.004078e8
test eax, eax
jne 0x49b00f
test byte [ebp - 0x148], 0x10
jne 0x49b00f
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.0040355c
mov ecx, dword [ebp - 0x14c]
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004035c0
mov esi, dword [ebp - 0x148]
test esi, 1
je 0x49b007
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 8]
call fcn.004073e0
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x49af9f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b045
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b06d
lea eax, [ebp - 0x14c]
call fcn.00403400
lea eax, [ebp - 8]
call fcn.00403400
ret
Function at 0x49b094
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49b18a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00403400
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0042cde4
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x49b1a0
call fcn.00407d84
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004035c0
mov eax, dword [ebp - 0x10]
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
mov esi, eax
cmp esi, 0xffffffff
je 0x49b132
test esi, 0x10
jne 0x49b162
test esi, 1
je 0x49b132
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 0x10]
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
push 1
mov eax, dword [ebp - 0x10]
call fcn.00403738
push eax
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
je 0x49b15c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00403494
jmp 0x49b16f
inc edi
cmp edi, 0xa
je 0x49b16f
inc ebx
cmp ebx, 0x3e8
jne 0x49b0d3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b191
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403420
ret
Function at 0x40726c
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x14], 0
push ebx
mov ebx, ecx
lea ecx, [ebp - 0x14]
push esi
mov esi, edx
mov dword [ebp - 0x38], ebx
push edi
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x34], eax
call fcn.004071b0
mov edi, dword [ebp - 0x14]
mov eax, dword [esi + 8]
add edi, 0x23f
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0xc]
push 0x20
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x2c], eax
pop esi
mov dword [ebp - 0x20], 2
add dword [ebp - 0x20], 3
mov edx, dword [ebp - 0xc]
mov eax, edx
mov ecx, dword [0x1a279a4]
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x4072f4
push 0x401174
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [0x1a279a4]
add eax, dword [ebp - 0x28]
cmp ecx, 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x1a279e8]
mov dword [ebp - 0x24], 0xedeb2e40
cmove eax, dword [ebp - 0x24]
and dword [ebp - 0x24], 0
cmp ecx, 0x3eb
mov dword [0x1a279e8], eax
mov eax, dword [0x1a279f0]
cmove eax, dword [ebp - 0x24]
mov dword [0x1a279f0], eax
lea eax, [edi + edx]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x18], 0
mov dword [0x1a279ec], 0xf4ea3dee
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x1c]
sub ebx, eax
mov dword [ebp - 8], eax
mov eax, ebx
mov dword [ebp - 0x1c], ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
nop
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
xor dword [ebp - 4], eax
cmp dword [0x1a279a4], 0xb03
jne 0x4073cb
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push 0x401178
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov eax, dword [ebp - 4]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], eax
add edi, 0x61c88647
mov dword [ebp - 0x14], edi
dec esi
jne 0x4072bc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x38]
pop edi
pop esi
mov dword [ebx], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407415
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
shr esi, 3
push edi
mov edi, ecx
test esi, esi
je 0x407453
cmp dword [0x1a279a4], 0x959
jne 0x407443
push 0
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.0040726c
add edi, 8
dec esi
jne 0x407425
pop edi
pop esi
pop ebp
ret 4
Function at 0x410c2f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4354f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a853
mov dword [ebp - 0x14], eax
cmp dword [0x1a28788], esi
jne 0x410d22
push 0x800
push esi
push 0x40514c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x410caf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x410e02
push esi
push esi
push 0x40514c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x410e02
push 0x405164
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410e02
push eax
call ebx
push 0x405170
push edi
mov dword [0x1a28788], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x405180
push edi
mov dword [0x1a2878c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x405194
push edi
mov dword [0x1a28790], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1a28798], eax
test eax, eax
je 0x410d1f
push 0x4051b0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1a28794], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x410d47
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x410d3a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x410d5c
push 4
pop eax
jmp 0x410e04
cmp dword [ebp - 0x14], esi
je 0x410d5c
push dword [0x1a28788]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x410d41
mov eax, dword [0x1a28794]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x410dba
cmp dword [0x1a28798], edi
je 0x410dba
push eax
call ebx
push dword [0x1a28798]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x410dba
test eax, eax
je 0x410dba
call ecx
test eax, eax
je 0x410daf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x410daf
test byte [ebp - 8], 1
jne 0x410dba
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x410dea
mov eax, dword [0x1a2878c]
cmp eax, edi
je 0x410de7
push eax
call ebx
test eax, eax
je 0x410de7
call eax
mov esi, eax
test esi, esi
je 0x410de7
mov eax, dword [0x1a28790]
cmp eax, edi
je 0x410de7
push eax
call ebx
test eax, eax
je 0x410de7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1a28788]
call ebx
test eax, eax
je 0x410e02
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x410e04
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409dfe
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [0x4104ec], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [0x4104f0], eax
push 0
push 0x20000
push 0
call dword [sym.imp.KERNEL32.DLL_HeapCreate]
mov dword [0x4104f4], eax
test eax, eax
je fcn.00401418
push 0x410500
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
push 0x410510
push 0x410500
call dword [sym.imp.KERNEL32.DLL_SystemTimeToFileTime]
mov ebx, dword [0x410510]
mov eax, dword [0x410514]
sub ebx, 0xd53e8000
sbb eax, 0x19db1de
xor edx, edx
mov ecx, 0x989680
div ecx
mov dword [0x4104fc], eax
mov eax, ebx
div ecx
mov dword [0x4104f8], eax
ret

Function at 0x4011e0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [0x4104ec]
jmp 0x4011f0
test ecx, ecx
jne 0x401202
xor al, al
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
neg ecx
sub ecx, 2
mov edx, esi
mov eax, 0xc800
cmp ecx, eax
jbe 0x40122b
sub ecx, eax
add eax, edx
push eax
push ecx
push 0
push 0x410518
push 0xc800
push edx
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop ecx
pop edx
jmp 0x401204
push 0
push 0x410518
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop ebx
ret
Function at 0x401252
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
call fcn.00401000
call fcn.0040146b
mov bl, al
cmp byte [0x410521], 0
jne 0x401273
mov esi, str.flat_assembler__version_g.kd3c_r_n
xor ecx, ecx
call fcn.004011e0
test bl, bl
jne 0x401452
xor al, al
movzx ecx, byte [0x410520]
jecxz 0x40128d
or al, 1
dec ecx
je 0x40128d
or al, 2
call fcn.004023e1
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x41051c], eax
mov esi, dword [0x4104e0]
mov edx, dword [0x4104d4]
call fcn.00402974
jb 0x4012eb
mov eax, dword [0x410180]
cmp eax, dword [0x4104dc]
jb 0x40129d
call fcn.0040f912
mov esi, str.Error:
xor ecx, ecx
call fcn.004011e9
mov esi, str.could_not_generate_code_within_the_allowed_number_of_passes
xor ecx, ecx
call fcn.004011e9
mov esi, 0x411fe5
xor ecx, ecx
call fcn.004011e9
jmp 0x4013fa
call fcn.0040f912
cmp dword [0x4101ac], 0
jne 0x4013fa
cmp byte [0x410521], 0
jne 0x4013d5
mov eax, dword [0x410180]
xor edx, edx
call fcn.0040fd7d
call fcn.004011e0
mov esi, str._passes_
cmp dword [0x410180], 1
jne 0x40132e
mov esi, str._pass_
xor ecx, ecx
call fcn.004011e0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x41051c]
xor edx, edx
add eax, 0x32
mov ecx, 0x3e8
div ecx
mov ebx, eax
mov eax, edx
xor edx, edx
mov ecx, 0x64
div ecx
mov dword [0x41051c], eax
xchg ebx, eax
or ebx, eax
je 0x40139c
xor edx, edx
call fcn.0040fd7d
call fcn.004011e0
mov esi, 0x411fe5
mov ecx, 1
call fcn.004011e0
mov eax, dword [0x41051c]
xor edx, edx
call fcn.0040fd7d
call fcn.004011e0
mov esi, 0x4113f6
xor ecx, ecx
call fcn.004011e0
call fcn.0040f63f
push eax
push edx
call fcn.0040fd7d
call fcn.004011e0
pop edx
pop eax
mov esi, str._bytes.
cmp eax, 1
jne 0x4013c2
test edx, edx
jne 0x4013c2
mov esi, str._byte.
xor ecx, ecx
call fcn.004011e0
mov esi, 0x411fe6
xor ecx, ecx
call fcn.004011e0
mov ebx, dword [0x4104d4]
mov edi, dword [0x4104d8]
call fcn.0040f6ec
jb 0x401411
call fcn.0040279d
call fcn.0040107f
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
call fcn.0040f93b
call fcn.0040279d
call fcn.0040107f
push 2
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov ebx, str.failed_to_write_the_output_file
jmp fcn.0040141f
mov esi, str.Usage:_fasmg_source__output__r_nOptional_settings:_r_n_____e_limit____Set_the_maximum_number_of_displayed_errors__default_1__r_n_____p_limit____Set_the_maximum_allowed_number_of_passes__default_100__r_n_____r_limit____Set_the_maximum_depth_of_the_stack__default_10000__r_n_____v_flag_____Enable_or_disable_showing_all_lines_from_the_stack__default_0__r_n_____i_command__Insert_instruction_at_the_beginning_of_source_r_n_____n__________Do_not_show_logo_nor_summary_r_n
xor ecx, ecx
call fcn.004011e0
call fcn.0040107f
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x40146b
Capabilities:
Accept command line arguments

Disassembly:
xor eax, eax
mov dword [0x4104e0], eax
mov dword [0x4104d4], eax
mov dword [0x4104d8], eax
mov byte [0x410521], al
mov byte [0x410520], al
mov dword [0x4104dc], 0x64
mov dword [0x410100], 1
mov dword [0x410104], 0x2710
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov esi, eax
mov edi, eax
or ecx, 0xffffffff
xor al, al
repne scasb al, byte es:[edi]
sub edi, esi
mov ecx, edi
call fcn.004010ad
mov edi, eax
xor ah, ah
lodsb al, byte [esi]
test al, al
je 0x401516
cmp al, 0x22
je 0x4014e4
cmp ax, 0x20
je 0x4014d4
stosb byte es:[edi], al
jmp 0x4014c2
xor al, al
stosb byte es:[edi], al
mov al, byte [esi]
test al, al
je 0x401516
cmp al, 0x20
jne 0x4014e9
inc esi
jmp 0x4014d7
xor ah, 1
jmp 0x4014c2
cmp al, 0x2d
je 0x401523
cmp al, 0x2f
je 0x401523
cmp dword [0x4104d4], 0
je 0x401506
cmp dword [0x4104d8], 0
je 0x40150e
or al, 0xff
ret
mov dword [0x4104d4], edi
jmp 0x4014c0
mov dword [0x4104d8], edi
jmp 0x4014c0
cmp dword [0x4104d4], 0
je 0x401503
xor al, al
stosb byte es:[edi], al
ret
inc esi
lodsb al, byte [esi]
cmp al, 0x65
je 0x40159e
cmp al, 0x45
je 0x40159e
cmp al, 0x69
je 0x401625
cmp al, 0x49
je 0x401625
cmp al, 0x70
je 0x4015da
cmp al, 0x50
je 0x4015da
cmp al, 0x72
je 0x4015bc
cmp al, 0x52
je 0x4015bc
cmp al, 0x76
je 0x40157f
cmp al, 0x56
je 0x40157f
cmp al, 0x6e
je 0x401565
cmp al, 0x4e
jne 0x401503
or byte [0x410521], 0xff
mov al, byte [esi]
cmp al, 0x20
je 0x4014d7
test al, al
jne 0x401503
jmp 0x4014d7
call fcn.004015f8
jb 0x401503
cmp edx, 2
ja 0x401503
mov byte [0x410520], dl
jmp 0x4014d7
call fcn.004015f8
jb 0x401503
test edx, edx
je 0x401503
mov dword [0x410100], edx
jmp 0x4014d7
call fcn.004015f8
jb 0x401503
test edx, edx
je 0x401503
mov dword [0x410104], edx
jmp 0x4014d7
call fcn.004015f8
jb 0x401503
test edx, edx
je 0x401503
mov dword [0x4104dc], edx
jmp 0x4014d7
push edi
cmp byte [esi], 0x20
jne 0x40162e
inc esi
jmp 0x401626
xor ah, ah
cmp byte [esi], 0x22
jne 0x401638
inc esi
inc ah
mov ebx, esi
mov ecx, esi
mov al, byte [esi]
test al, al
je 0x401653
cmp ax, 0x20
je 0x401653
cmp ax, 0x22
je 0x401653
inc esi
cmp al, 0x22
jne 0x40163a
sub ecx, ebx
mov edi, dword [0x4104e0]
lea eax, [ecx + 2]
test edi, edi
je 0x4016ae
mov edx, dword [0x4104e4]
add edi, edx
add eax, edx
cmp eax, dword [0x4104e8]
ja 0x4016c6
xchg ebx, esi
rep movsb byte es:[edi], byte [esi]
mov esi, ebx
sub edi, dword [0x4104e0]
mov dword [0x4104e4], edi
mov al, byte [esi]
test al, al
je 0x401690
cmp al, 0x20
jne 0x40162e
mov edi, dword [0x4104e0]
add edi, dword [0x4104e4]
mov ax, 0xa
stosw word es:[edi], ax
inc dword [0x4104e4]
pop edi
jmp 0x4014d7
push ecx
mov ecx, eax
call fcn.004010ad
mov dword [0x4104e0], eax
mov dword [0x4104e8], ecx
mov edi, eax
pop ecx
jmp 0x401674
push ecx
mov ecx, eax
mov eax, dword [0x4104e0]
call fcn.004010e1
mov dword [0x4104e0], eax
mov dword [0x4104e8], ecx
mov edi, eax
add edi, dword [0x4104e4]
pop ecx
jmp 0x401674
Function at 0x401aa8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov byte [0x4104a2], dl
test ebx, ebx
jne 0x401ab8
mov ebx, dword [0x410184]
mov esi, eax
mov edx, 0x811c9dc5
mov dword [0x410270], ecx
mov ecx, 4
xor dl, al
imul edx, edx, 0x1000193
shr eax, 8
loop 0x401aca
mov eax, dword [0x410270]
mov ecx, 4
xor dl, al
imul edx, edx, 0x1000193
shr eax, 8
loop 0x401ae1
mov ecx, dword [0x410270]
mov byte [0x4104a0], 3
or byte [0x4104a3], 1
or byte [0x4104a4], 1
call fcn.00401884
mov edi, dword [0x410268]
ret
Function at 0x4031e4
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov eax, dword [edx + 4]
sub eax, ecx
jb 0x4031f1
cmp edi, eax
ja 0x4031f1
clc
ret
add ecx, edi
jb 0x40323a
sub ecx, dword [edx]
push ecx
bsr eax, ecx
xchg ecx, eax
dec cl
shr eax, cl
inc eax
shl eax, cl
mov ecx, eax
pop eax
cmp ecx, eax
jbe 0x40323a
cmp edi, dword [edx]
je 0x403224
mov eax, dword [edx]
sub edi, eax
push edx
call fcn.004010e1
pop edx
mov dword [edx], eax
add edi, eax
add eax, ecx
mov dword [edx + 4], eax
stc
ret
push edx
push ecx
xor eax, eax
xchg dword [edx], eax
call fcn.004010fa
pop ecx
call fcn.004010ad
pop edx
xor edi, edi
jmp 0x403219

Function at 0x40323f
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
jmp fcn.00401418
push ecx
bsr edx, ecx
xchg edx, ecx
sub cl, 2
shr edx, cl
inc edx
shl edx, cl
mov ecx, edx
pop edx
cmp ecx, edx
jbe 0x40323a
call fcn.004010e1
ret

Function at 0x403b4a
Capabilities:
Hash data using fnv

Disassembly:
mov byte [0x4104a7], dl
xor ecx, ecx
call fcn.00403838
jae 0x403b8d
ret
Function at 0x403e5f
Capabilities:
Hash data using fnv

Disassembly:
mov edx, dword [0x410248]
test edi, edi
jne fcn.00403e6d
test edx, edx
jne 0x403ecd

Function at 0x403e6d
Capabilities:
Hash data using fnv

Disassembly:
push ecx
push esi
mov esi, dword [0x4101f8]
mov eax, edi
mov dword [esi], eax
mov edx, 0x811c9dc5
xor ecx, ecx
test eax, eax
je 0x403e92
xor dl, al
imul edx, edx, 0x1000193
inc ecx
shr eax, 8
jmp 0x403e80
or byte [0x4104a1], 1
and dword [0x41024c], 0
mov byte [0x4104a0], 2
mov byte [0x4104a2], 0
or byte [0x4104a3], 1
or byte [0x4104a4], 1
test ebx, ebx
jne 0x403ec6
mov ebx, dword [0x410244]
call fcn.00401884
pop esi
pop ecx
mov ebx, dword [edx + 0xc]
ret

Function at 0x40c34f
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor ecx, ecx
call fcn.00403838
jb 0x40c36f
cmp al, 0x1a
je 0x40c371
cmp al, 0x30
je 0x40c448
cmp al, 0x23
jne 0x40c36f
call fcn.0040401d
jae fcn.0040c34f
stc
ret
inc esi
lodsd eax, dword [esi]
mov ebx, eax
mov ecx, dword [ebx]
mov eax, dword [ebx + ecx + 4]
mov dword [0x410250], eax
mov eax, dword [ebx + ecx + 8]
mov dword [0x410254], eax
xor ecx, ecx
call fcn.00403838
jb 0x40c3ac
cmp al, 0x23
jne 0x40c3ac
call fcn.0040401d
jb 0x40c3ac
call fcn.00403838
jb 0x40c3ac
cmp al, 0x1a
je 0x40c3d3
cmp al, 0x30
je 0x40c3d3
mov dword [0x41027c], ebx
cmp ebx, dword [0x4101f0]
je 0x40c3c3
mov byte [0x4104a1], 0
clc
ret
sub edi, ebx
sub edi, 4
mov dword [ebx], edi
mov byte [0x4104a1], 1
clc
ret
mov edx, 0x4101f0
cmp ebx, dword [edx]
je 0x40c3f3
mov edi, dword [edx]
add edi, 4
mov ecx, dword [ebx]
call fcn.004031e4
xchg esi, ebx
lodsd eax, dword [esi]
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
mov esi, ebx
mov ebx, dword [edx]
lodsb al, byte [esi]
cmp al, 0x30
je 0x40c461
lodsd eax, dword [esi]
push ebx
push esi
mov esi, eax
mov ecx, dword [esi]
mov edx, 0x4101f0
call fcn.004031e4
lodsd eax, dword [esi]
lea ebx, [esi + eax]
mov ecx, dword [0x410250]
mov edx, dword [0x410254]
xor eax, eax
lodsb al, byte [esi]
xor cl, al
xor dl, byte [eax + section..bss]
imul ecx, ecx, 0x1000193
imul edx, edx, 0x1000193
stosb byte es:[edi], al
cmp esi, ebx
jne 0x40c41b
mov dword [0x410250], ecx
mov dword [0x410254], edx
pop esi
pop ebx
jmp 0x40c389
inc esi
mov ebx, dword [0x4101f0]
lea edi, [ebx + 4]
mov eax, 0x811c9dc5
mov dword [0x410250], eax
mov dword [0x410254], eax
mov edx, esi
mov ecx, dword [edx]
lea esi, [esi + ecx + 4]
push ebx
push esi
push edi
call fcn.00404793
pop edi
mov eax, edx
jmp 0x40c3fb

Function at 0x40eb25
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, 0x811c9dc5
jecxz 0x40eb3e
mov eax, ecx
xor dl, byte [esi]
inc esi
imul edx, edx, 0x1000193
loop 0x40eb2e
mov ecx, eax
sub esi, ecx
ret
inc ecx
lodsb al, byte [esi]
xor dl, al
imul edx, edx, 0x1000193
test al, al
jne 0x40eb3e
sub esi, ecx
ret
Function at 0x40eb4f
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov ebx, dword [0x41014c]
xor ecx, ecx
call fcn.0040ea19
jb 0x40eb68
cmp eax, 0xffffffff
je 0x40ec0a
ret
mov edx, esi
call fcn.0040111a
jb 0x40ebe8
xor eax, eax
mov edx, eax
mov cl, 2
call fcn.004011a0
jb 0x40ebfa
test edx, edx
jne fcn.00401418
push eax
xor eax, eax
mov edx, eax
mov cl, al
call fcn.004011a0
jb 0x40ebfa
pop ecx
inc ecx
mov dword [0x410400], ecx
call fcn.004010ad
mov dword [0x4103fc], eax
mov edx, eax
mov ecx, dword [0x410400]
dec ecx
mov byte [edx + ecx], 0
call fcn.00401178
jb 0x40ebfa
call fcn.00401198
push esi
call fcn.0040ec6a
mov eax, dword [0x4103fc]
call fcn.004010fa
pop esi
mov eax, dword [0x410404]
xor ecx, ecx
mov ebx, dword [0x41014c]
call fcn.0040ea5e
mov eax, dword [0x410404]
ret
xor eax, eax
xor ecx, ecx
mov ebx, dword [0x41014c]
call fcn.0040ea5e
xor eax, eax
ret
or eax, 0xffffffff
xor ecx, ecx
mov ebx, dword [0x41014c]
call fcn.0040ea5e
mov ebx, esi
mov edx, str.error_reading_file__s
call fcn.0040e825
mov eax, 0x411f77
ret