joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412540
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x43c060]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x20c]
call fcn.0040e7a0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412622
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
mov dword [ebp - method.CProfileIni.virtual_0], vtable.CProfileIni.0
call sub.MSVCR110.dll_memset
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0x18
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4125f1
xor ecx, ecx
cmp ecx, 1
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041db86
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x414]
push eax
push 0
push str.silence
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
xor eax, eax
cmp ecx, 1
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041db86
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
call fcn.0041db86
mov esp, ebp
pop ebp
ret
Function at 0x415af0
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x420846
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x43c060]
xor eax, esp
mov dword [esp + 0x144], eax
push esi
push edi
mov eax, dword [0x43c060]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415c51
push 0x430ec0
lea eax, [esp + 0x14]
push esi
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCR110.dll__wfopen_s]
mov esi, dword [esp + 0x1c]
add esp, 0xc
test esi, esi
je 0x415c51
push 0x103
lea eax, [esp + 0x49]
push 0
push eax
mov byte [esp + 0x50], 0
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x44]
push esi
push 0x104
push 1
push eax
call dword [sym.imp.MSVCR110.dll_fread]
push dword [esp + 0x20]
mov esi, eax
call dword [sym.imp.MSVCR110.dll_fclose]
add esp, 0x14
test esi, esi
je 0x415c51
lea ecx, [esp + 0x44]
call fcn.0041d060
mov esi, eax
test esi, esi
je 0x415c51
push esi
lea ecx, [esp + 0x30]
call fcn.00403cb0
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
mov dword [esp + 0x160], 0
call fcn.0041cf60
lea ecx, [esp + 0x2c]
mov byte [esp + 0x160], 2
call fcn.00403240
push esi
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void__]
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0
call fcn.0040da30
push eax
lea ecx, [esp + 0x10]
call fcn.00415970
lea ecx, [esp + 0x14]
test al, al
je 0x415c41
call fcn.0040da30
push eax
mov eax, dword [ebp + 0x10]
add eax, eax
push eax
push edi
call fcn.00407ee0
lea ecx, [esp + 0x14]
call fcn.0040a2a0
mov al, 1
jmp 0x415c64
mov dword [esp + 0x160], 0xffffffff
call fcn.0040a2a0
mov eax, dword [ebp + 0x10]
push str.0.0.0
add eax, eax
push eax
push edi
call fcn.00407ee0
xor al, al
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0041db86
mov esp, ebp
pop ebp
ret 0xc
Function at 0x415dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x80
mov eax, dword [0x43c060]
xor eax, esp
mov dword [esp + 0x7c], eax
push esi
push edi
push ecx
lea eax, [esp + 0x1c]
push eax
mov esi, 0x409
mov dword [esp + 0x10], 0
call fcn.00415760
mov ecx, eax
call fcn.00415900
lea ecx, [esp + 8]
push ecx
mov ecx, eax
call fcn.0040da30
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push eax
push 0x80000002
call edi
lea ecx, [esp + 0x18]
call fcn.0040a2a0
mov eax, dword [esp + 8]
test eax, eax
je 0x415ec0
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x18]
push ecx
push 0
push str.language
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 4
mov dword [esp + 0x24], 4
call edi
test eax, eax
jne 0x415e6b
mov esi, dword [esp + 0x14]
jmp 0x415f33
xor eax, eax
push 0x4e
push eax
mov word [esp + 0x38], ax
lea eax, [esp + 0x3a]
push eax
mov dword [esp + 0x18], 0x28
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push str.language
push dword [esp + 0x1c]
call edi
test eax, eax
jne 0x415f33
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.MSVCR110.dll__wtoi]
add esp, 4
mov esi, eax
jmp 0x415f33
push ecx
lea eax, [esp + 0x1c]
push eax
call fcn.00415760
mov ecx, eax
call fcn.00415900
lea ecx, [esp + 8]
push ecx
mov ecx, eax
call fcn.0040da30
push eax
push 0x80000001
call edi
lea ecx, [esp + 0x18]
call fcn.0040a2a0
mov eax, dword [esp + 8]
test eax, eax
je 0x415f3d
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
push ecx
push 0
push str.language
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 4
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
cmove esi, dword [esp + 0x10]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x84]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0041db86
mov esp, ebp
pop ebp
ret

Function at 0x415f60
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0xffffffff
jne 0x415f75
call fcn.00415dc0
mov esi, eax
mov edi, 0x42a0c4
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
movzx ebx, ax
xor eax, eax
mov ecx, 0x42a0c0
lea ebx, [ebx]
mov edx, dword [ecx]
cmp edx, ebx
jne 0x415f99
lea edi, [ecx + 4]
cmp edx, esi
je 0x415fb2
add ecx, 0x54
inc eax
cmp ecx, 0x42e500
jl 0x415f90
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
imul eax, eax, 0x54
pop edi
pop esi
add eax, 0x42a0c4
pop ebx
pop ebp
ret 4
Function at 0x415fd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
push 0x208
lea edi, [esi + 4]
push 0
push edi
mov dword [esi], vtable.CProfileIni.0
call sub.MSVCR110.dll_memset
push dword [ebp + 8]
push 0x104
push edi
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0x18
cmp byte [ebp + 0xc], 0
je 0x41602a
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41602a
push eax
push eax
push 1
push eax
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x41602a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x416070
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x43c060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [ecx + 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4160ad
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041db86
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0x10]
xor eax, eax
xorps xmm0, xmm0
push 0x4310f8
mov word [ebp - 0x2c], ax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x2c]
push 0x28
push eax
movq qword [ebp - 0x2a], xmm0
movq qword [ebp - 0x22], xmm0
movq qword [ebp - 0x1a], xmm0
movq qword [ebp - 0x12], xmm0
call fcn.00407f30
add esp, 0x10
lea eax, [ebp - 0x2c]
push esi
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041db86
mov esp, ebp
pop ebp
ret 0xc

Function at 0x416140
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x43c060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [ecx + 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41617d
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041db86
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp + 0x14]
xor eax, eax
push dword [ebp + 0x10]
xorps xmm0, xmm0
push str._I64d
mov word [ebp - 0x2c], ax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x2c]
push 0x28
push eax
movq qword [ebp - 0x2a], xmm0
movq qword [ebp - 0x22], xmm0
movq qword [ebp - 0x1a], xmm0
movq qword [ebp - 0x12], xmm0
call fcn.00407f30
add esp, 0x14
lea eax, [ebp - 0x2c]
push esi
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041db86
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4161e0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x43c060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [ecx + 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41621f
pop edi
or eax, 0xffffffff
pop esi
or edx, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041db86
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
push 0x4e
push eax
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x52]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x54]
push esi
push 0x50
push eax
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 0xffffffff
je 0x416281
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416250
sub ecx, edx
sar ecx, 1
je 0x416281
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.MSVCR110.dll__wtoi64]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041db86
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041db86
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4162a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 0x10]
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.00416070

Function at 0x416830
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x416861
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 8], esi
call fcn.0041f490
mov dword [esp + 0xc], eax
test esi, esi
jne 0x416869
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x4312e0
lea ecx, [esp + 8]
call fcn.004166c0
int3
Function at 0x416a60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420aa0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x43c060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_class_std::exception_const__]
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea eax, [edi + 0x14]
push eax
lea ecx, [esi + 0x14]
call fcn.00402850
mov dword [ebp - 4], 1
mov dword [esi + 0x2c], vtable.boost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x416ad6
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov dword [esi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x417690
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420ac8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x43c060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_class_std::exception_const__]
mov dword [ebp - 4], 0
mov dword [edi], vtable.boost::system::system_error.0
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push eax
lea ecx, [edi + 0x14]
call fcn.00402850
mov dword [edi + 0x2c], vtable.boost::exception.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41d130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
push esi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
test eax, eax
je 0x41d209
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x41d209
push edi
push 0x100
call fcn.0041d9f2
mov edx, dword [ebp + 0xc]
mov edi, eax
push edi
call fcn.0041d210
add esp, 8
test eax, eax
jne 0x41d175
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
push ebx
xor ebx, ebx
xor ecx, ecx
test eax, eax
jle 0x41d1ed
sub dword [ebp - 4], esi
mov dword [ebp - 8], eax
inc ebx
and ebx, 0x800000ff
jns 0x41d198
dec ebx
or ebx, 0xffffff00
inc ebx
mov dl, byte [ebx + edi]
movzx eax, dl
add ecx, eax
and ecx, 0x800000ff
jns 0x41d1b0
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, byte [ecx + edi]
mov byte [ebx + edi], al
mov dword [ebp - 0x10], ecx
mov byte [ecx + edi], dl
movzx ecx, byte [ebx + edi]
movzx eax, dl
add ecx, eax
and ecx, 0x800000ff
jns 0x41d1d6
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, byte [ecx + edi]
mov ecx, dword [ebp - 4]
inc esi
xor al, byte [ecx + esi - 1]
dec dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov byte [esi - 1], al
jne 0x41d187
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0xc]
push edi
mov dword [eax], edx
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void__]
add esp, 4
or eax, 0xffffffff
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41d210
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov ecx, edx
xor eax, eax
mov dword [ebp - 8], ecx
test esi, esi
je 0x41d284
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x41d225
push ebx
push edi
mov dword [ebp - 4], 0
xor edi, edi
jmp 0x41d240
mov eax, edi
cdq
idiv ecx
mov bl, byte [edi + esi]
movzx ecx, bl
movzx eax, byte [edx + str._______UDPARC4KEYFORHARDKORE1.0.0PACKET1234567890Talkwithfriends_family_orteammatesoverafastandclearconnectionAbilitytousetextchatforanyonewithoutamicrophoneNativeclientandserversupportforall3majorplatformsAutomaticmicrophonevolumenormalizationAd]
add eax, dword [ebp - 4]
add ecx, eax
and ecx, 0x800000ff
jns 0x41d267
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov dword [ebp - 4], ecx
mov byte [ecx + esi], bl
mov ecx, dword [ebp - 8]
cmp edi, 0x100
jl 0x41d240
pop edi
or eax, 0xffffffff
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401340
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x5e6ea9af
push esi
push edi
mov edi, edx
movzx esi, cx
mul ebx
shr ecx, 0x10
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebx
mov dword [ebp - 0xc], ecx
sub edx, eax
mov dword [ebp - 4], edx
test edi, edi
jne 0x40137c
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x401497
xor ebx, ebx
cmp edx, 7
jbe 0x4013e6
mov eax, 7
sub eax, edi
mov dword [ebp - 0x10], eax
movzx eax, byte [edi]
add ebx, 8
add esi, eax
movzx eax, byte [edi + 1]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 2]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 3]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 4]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 5]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 6]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 7]
add ecx, esi
add edi, 8
add esi, eax
mov eax, dword [ebp - 0x10]
add eax, edi
add ecx, esi
cmp eax, edx
jb 0x401395
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 0x10], 0
cmp ebx, eax
jae 0x401459
sub eax, ebx
cmp eax, 2
jb 0x401445
mov edx, dword [ebp - 4]
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea eax, [ebx + edx*2]
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, ebx
movzx eax, byte [edi]
add esi, eax
movzx eax, byte [edi + 1]
add ebx, esi
add edi, 2
add esi, eax
add ecx, esi
sub edx, 1
jne 0x401413
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jae 0x401451
movzx eax, byte [edi]
mov edx, dword [ebp - 8]
add esi, eax
add ecx, esi
inc edi
jmp 0x401454
movzx eax, byte [edi]
mov ebx, edx
add esi, eax
add ecx, esi
inc edi
jmp 0x401454
mov edx, dword [ebp - 8]
lea eax, [edx + ebx]
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, 0x15b0
add ecx, eax
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov dword [ebp + 8], eax
mov dword [ebp - 4], edx
jne 0x401384
shl ecx, 0x10
pop edi
lea eax, [esi + ecx]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4014b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 4
jb 0x40151b
push edi
mov edi, esi
shr edi, 2
movzx eax, byte [edx]
sub esi, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x482940]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x482940]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x482940]
movzx eax, byte [edx + 3]
add edx, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x482940]
sub edi, 1
jne 0x4014c4
pop edi
test esi, esi
je 0x40153a
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x482940]
sub esi, 1
jne 0x401520
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x424490
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x4244bb
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4244a4
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x428520
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471899
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x490004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], 2
lea edi, [esi + 8]
push 0
mov ecx, edi
mov dword [ebp - 0x2c], edi
call fcn.004104e0
mov byte [ebp - 4], 4
lea ebx, [esi + 0x18]
push 0
mov ecx, ebx
mov dword [ebp - 0x30], ebx
call fcn.004104e0
mov byte [ebp - 4], 6
lea ecx, [esi + 0x28]
push 0
mov dword [ebp - 0x34], ecx
call fcn.004104e0
mov byte [ebp - 4], 8
lea ecx, [esi + 0x38]
push 0
mov dword [ebp - 0x38], ecx
call fcn.004104e0
mov byte [ebp - 4], 0xa
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040fa10
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0xc
mov cl, byte [edi]
movzx eax, byte [ebp - 0x1c]
mov byte [edi], al
mov edx, dword [edi + 8]
mov esi, dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
mov byte [ebp - 0x1c], cl
mov ecx, dword [ebp - 0x10]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00410aa0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040fa10
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0xf
mov cl, byte [ebx]
movzx eax, byte [ebp - 0x1c]
mov byte [ebx], al
mov edx, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov eax, dword [ebp - 0x14]
mov byte [ebp - 0x1c], cl
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00410aa0
lea eax, [ebp + 0x28]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040fa10
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0x12
mov edi, dword [ebp - 0x20]
movzx eax, byte [ebp - 0x1c]
mov cl, byte [edi + 0x28]
mov byte [edi + 0x28], al
mov edx, dword [edi + 0x30]
mov esi, dword [edi + 0x34]
mov eax, dword [ebp - 0x14]
mov byte [ebp - 0x1c], cl
mov ecx, dword [ebp - 0x10]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.00410aa0
mov ecx, edi
call fcn.00428250
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
push dword [ebp + 8]
call fcn.00410aa0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x20]
push dword [ebp + 0x18]
call fcn.00410aa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x30]
push dword [ebp + 0x28]
call fcn.00410aa0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x4298c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471a0f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x490004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.0042f8e3
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x429971
push eax
push esi
call fcn.004334e4
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.0042f6da
int3