joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40da90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4278a8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x432620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x40dbb1
cmp byte [edi + 0x49], bl
je 0x40dbb1
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x40dba5
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x40db05
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x40db1d
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x40db46
dec eax
je 0x40db4a
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x40dba0
jmp 0x40dbac
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x40db5a
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x40db83
cmp ebx, 0x10
jae 0x40db69
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0041628f
add esp, 0x10
cmp esi, eax
jne 0x40db9d
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x40dba9
test esi, esi
jne 0x40db11
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00403320
jmp 0x40db0b
lea ecx, [ebp - 0x2c]
call fcn.00402630
xor al, al
jmp 0x40dbb3
lea ecx, [ebp - 0x2c]
call fcn.00402630
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00414e6f
mov esp, ebp
pop ebp
ret
Function at 0x40f9c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427cb7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x432620]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], eax
je 0x40fa0e
mov dword [ebx], 0x42a464
mov dword [ebx + 0x60], 0x4296f0
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], 0x4296e8
mov edx, dword [ebx]
mov edi, dword [edx + 4]
add edi, ebx
mov ecx, edi
call fcn.00407ba0
lea esi, [ebx + 4]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], 0
call fcn.00408120
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x40fa5a
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push 0
push eax
mov ecx, edi
call fcn.004020b0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], 0x42a460
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.00407fd0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
mov dword [esi], 0x429fec
mov byte [esi + 0x50], 0
mov byte [esi + 0x49], 0
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov dword [eax], ecx
mov edx, dword [esi + 0x34]
mov dword [edx], ecx
mov eax, dword [esi + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
mov dword [esi + 0x54], ecx
mov edx, dword [0x433990]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42f37d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x444084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea ebx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x6573736d
mov dword [ebp - 0xc], 0x2e736563
mov dword [ebp - 8], 0x657865
call fcn.0042f17b
test eax, eax
je 0x42f3e9
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x7263694d
mov dword [ebp - 0x28], 0x666f736f
mov dword [ebp - 0x24], 0x65532074
mov dword [ebp - 0x20], 0x69727563
mov dword [ebp - 0x1c], 0x43207974
mov dword [ebp - 0x18], 0x6e65696c
mov word [ebp - 0x14], 0x74
call fcn.0042f214
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0044b87a
leave
ret

Function at 0x42f9a2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x444084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x34]
xor ebx, ebx
push eax
xor esi, esi
mov dword [ebp - 0x34], ebx
call dword [fcn.00438148]
push eax
call dword [fcn.0043806c]
cmp dword [ebp - 0x34], 1
jne 0x42f9d7
mov esi, 0x100
lea eax, [ebp - 0x2c]
push eax
or esi, 0x20019
push esi
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x80000002
mov dword [ebp - 0x28], 0x54464f53
mov dword [ebp - 0x24], 0x45524157
mov dword [ebp - 0x20], 0x63694d5c
mov dword [ebp - 0x1c], 0x6f736f72
mov dword [ebp - 0x18], 0x575c7466
mov dword [ebp - 0x14], 0x6f646e69
mov dword [ebp - 0x10], 0x44207377
mov dword [ebp - 0xc], 0x6e656665
mov dword [ebp - 8], 0x726564
call dword [0x438030]
test eax, eax
je 0x42fa39
xor al, al
jmp 0x42fa70
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push 0x43e31c
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], 4
call dword [0x438038]
test eax, eax
jne 0x42fa65
cmp dword [ebp - 0x30], 1
je 0x42fa35
push dword [ebp - 0x2c]
call dword [0x438028]
mov al, 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044b87a
leave
ret

Function at 0x43123d
Capabilities:
Write file on windows

Disassembly:
push 0x10
push 0x441560
call fcn.0044eea0
xor edi, edi
mov dword [ebp - 0x1c], edi
push 0x43e7bc
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.0044c2e5
add esp, 0xc
cmp dword [ebp - 0x1c], edi
jne 0x43126e
xor al, al
jmp 0x4312fa
mov dword [ebp - 4], edi
push 0x43e7c0
push 0x67
push edi
call dword [0x4380a0]
mov ebx, eax
cmp ebx, edi
jne 0x43129a
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x444084
call fcn.0044fa90
add esp, 0xc
jmp 0x431267
push ebx
push edi
call dword [0x4380a4]
cmp eax, edi
je 0x431285
push eax
call dword [0x4380b4]
mov esi, eax
push ebx
push edi
call dword [0x4380a8]
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp eax, ebx
jae 0x4312ec
lea edi, [eax + 0x400]
push dword [ebp - 0x1c]
push 1
cmp edi, ebx
jae 0x4312d8
push 0x400
jmp 0x4312dd
mov ecx, ebx
sub ecx, eax
push ecx
add eax, esi
push eax
call fcn.0044c48e
add esp, 0x10
mov eax, edi
jmp 0x4312bb
mov dword [ebp - 4], 0xfffffffe
call fcn.00431300
mov al, 1
call fcn.0044eee5
ret
Function at 0x43478c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x444084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x10
xor ebx, ebx
push 1
push ebx
mov dword [ebp - 0x20], eax
mov esi, ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], 0x720050
mov dword [ebp - 0x18], 0x760069
mov dword [ebp - 0x14], 0x740061
mov dword [ebp - 0x10], 0x420065
mov dword [ebp - 0xc], 0x690075
mov dword [ebp - 8], 0x64006c
call dword [0x4380a0]
mov edi, eax
cmp edi, ebx
jne 0x434817
call dword [fcn.004380ac]
cmp esi, ebx
je 0x4347f3
mov dword [esi], eax
cmp dword [ebp - 0x20], ebx
je 0x434810
push eax
push 0x43eb88
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x20]
call fcn.0044bf9d
add esp, 0x14
xor eax, eax
jmp 0x434901
push edi
push ebx
call dword [0x4380a4]
cmp eax, ebx
jne 0x43483c
call dword [fcn.004380ac]
cmp esi, ebx
je 0x43482f
mov dword [esi], eax
cmp dword [ebp - 0x20], ebx
je 0x434810
push eax
push 0x43eb90
jmp 0x4347fe
push eax
call dword [0x4380b4]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x434863
call dword [fcn.004380ac]
cmp esi, ebx
je 0x434856
mov dword [esi], eax
cmp dword [ebp - 0x20], ebx
je 0x434810
push eax
push 0x43eb98
jmp 0x4347fe
push edi
push ebx
call dword [0x4380a8]
cmp eax, ebx
jne 0x43488b
call dword [fcn.004380ac]
cmp esi, ebx
je 0x43487b
mov dword [esi], eax
cmp dword [ebp - 0x20], ebx
je 0x434810
push eax
push 0x43eba0
jmp 0x4347fe
add eax, 0xffffffdd
cmp eax, ebx
jbe 0x4348e2
mov edx, dword [ebp - 0x24]
push 0x18
lea esi, [eax + edx]
pop ecx
lea edi, [ebp - 0x1c]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4348a9
sbb edx, edx
sbb edx, 0xffffffff
cmp edx, ebx
je 0x4348b2
dec eax
jne 0x434892
jmp 0x4348e2
mov ecx, dword [ebp - 0x24]
push 5
lea esi, [eax + ecx]
call fcn.0044beff
pop ecx
mov ecx, eax
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosb byte es:[edi], al
xor edi, edi
lea eax, [esi + 0x1a]
mov dl, byte [eax]
mov byte [edi + ecx], dl
inc edi
add eax, 2
cmp edi, 4
jb 0x4348cd
mov dword [ebp - 0x28], ecx
cmp ecx, ebx
jne 0x4348fe
cmp dword [ebp - 0x20], ebx
je 0x4348fe
push 0x43eba8
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x20]
call fcn.0044bf9d
add esp, 0x10
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044b87a
leave
ret
Function at 0x437c6f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x436780
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x444084]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x30], esi
cmp dword [eax + 0x14], 0x10
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], esi
jb 0x437cbe
mov eax, dword [eax]
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x14]
lea ecx, [esp + 0x18]
call fcn.00438591
pop ecx
pop ecx
test al, al
je 0x437d02
cmp dword [esp + 0xc], 1
jne 0x437d02
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp byte [eax + ecx], 0x31
je 0x437cf3
cmp eax, esi
je 0x437d12
push eax
jmp 0x437d0c
cmp eax, esi
je 0x437cfe
push eax
call fcn.0044be17
pop ecx
mov al, 1
jmp 0x437d14
cmp dword [esp + 0x14], esi
je 0x437d12
push dword [esp + 0x14]
call fcn.0044be17
pop ecx
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x447160
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, eax
xor esi, esi
push ebx
mov dword [ebp - 4], esi
call fcn.00447260
add esp, 4
cmp eax, 0x64
jl 0x44718a
cmp eax, 0xc8
jl 0x44720e
cmp eax, 0xcc
je 0x44720e
cmp eax, 0x130
je 0x44720e
cmp eax, 0xcd
je 0x44720e
cmp ebx, 4
jbe 0x4471d7
lea ecx, [ebx - 4]
mov eax, 4
mov edx, 0xa0d0a0d
jmp 0x4471b6
mov edi, dword [ebp + 8]
test esi, esi
jne 0x447204
cmp dword [edi + eax - 4], edx
jne 0x4471c8
mov dword [ebp - 4], eax
mov esi, 1
inc eax
lea edi, [eax - 4]
cmp edi, ecx
jbe 0x4471b3
test esi, esi
jne 0x447204
mov edi, dword [ebp + 8]
cmp ebx, 2
jbe 0x447204
add ebx, 0xfffffffe
mov eax, 2
test esi, esi
jne 0x447204
mov ecx, 0xa0a
cmp cx, word [edi + eax - 2]
jne 0x4471fc
mov dword [ebp - 4], eax
mov esi, 1
inc eax
lea edx, [eax - 2]
cmp edx, ebx
jbe 0x4471e4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 2
jbe 0x44724a
lea ecx, [ebx - 2]
mov eax, 4
jmp 0x447220
test esi, esi
jne 0x447204
mov edx, 0xa0d
cmp dx, word [eax + edi - 4]
jne 0x447238
mov dword [ebp - 4], eax
mov esi, 1
inc eax
lea edx, [eax - 4]
cmp edx, ecx
jbe 0x447220
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448ce0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436bc9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x444084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
xor edi, edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], 1
cmp dword [ebp + 0x10], ebx
je 0x448e61
mov eax, dword [ebp + 0xc]
mov cl, byte [eax]
dec dword [ebp + 0x10]
mov byte [ebp + edi - 0x10], cl
inc edi
inc eax
mov dword [ebp + 0xc], eax
cmp edi, 3
jne 0x448dab
mov al, byte [ebp - 0x10]
mov dl, al
and al, 3
shl al, 4
shr dl, 2
mov cl, al
mov al, byte [ebp - 0xf]
mov byte [ebp - 0x14], dl
mov dl, al
and al, 0xf
add al, al
shr dl, 4
add cl, dl
mov byte [ebp - 0x13], cl
lea ecx, [eax + eax]
mov al, byte [ebp - 0xe]
mov dl, al
shr dl, 6
and al, 0x3f
mov byte [ebp - 0x11], al
add ecx, edx
mov byte [ebp - 0x12], cl
xor edi, edi
cmp dword [0x445034], 0x10
mov eax, dword [0x445020]
jae 0x448d94
mov eax, 0x445020
movzx ecx, byte [ebp + edi - 0x14]
mov bl, byte [ecx + eax]
call fcn.004491c0
inc edi
cmp edi, 4
jl 0x448d81
xor edi, edi
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
jne 0x448d31
cmp edi, ebx
je 0x448e61
cmp edi, 3
jge 0x448dd3
mov edx, 3
sub edx, edi
push edx
lea eax, [ebp + edi - 0x10]
push ebx
push eax
call fcn.00451f20
add esp, 0xc
mov al, byte [ebp - 0x10]
mov cl, al
and al, 3
shl al, 4
mov dl, al
mov al, byte [ebp - 0xf]
shr cl, 2
mov byte [ebp - 0x14], cl
mov cl, al
and al, 0xf
add al, al
shr cl, 4
add dl, cl
mov byte [ebp - 0x13], dl
mov dword [ebp + 0x10], ebx
lea edx, [eax + eax]
mov al, byte [ebp - 0xe]
mov cl, al
shr cl, 6
and al, 0x3f
mov byte [ebp - 0x11], al
lea eax, [edi + 1]
add edx, ecx
mov byte [ebp - 0x12], dl
cmp eax, ebx
jle 0x448e46
cmp dword [0x445034], 0x10
mov eax, dword [0x445020]
jae 0x448e28
mov eax, 0x445020
mov edx, dword [ebp + 0x10]
movzx ecx, byte [ebp + edx - 0x14]
mov bl, byte [ecx + eax]
call fcn.004491c0
mov eax, dword [ebp + 0x10]
inc eax
lea ecx, [edi + 1]
mov dword [ebp + 0x10], eax
cmp eax, ecx
jl 0x448e15
cmp edi, 3
jge 0x448e61
mov eax, 3
sub eax, edi
mov dword [ebp + 0x10], eax
mov bl, 0x3d
call fcn.004491c0
dec dword [ebp + 0x10]
jne 0x448e55
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, edx
jb 0x456d49
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00450570
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x456d20
sub eax, ebx
jmp 0x456d22
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x456d11
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x456d3f
sub eax, ebx
jmp 0x456d41
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x456d30
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x456e1b
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, esi
add edx, dword [edi + 0x38]
mov esi, eax
push edx
call fcn.00456bd0
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x456d93
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx eax, byte [esi]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x456da7
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x456cd5
mov eax, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp eax, ecx
jae 0x456e1b
mov esi, dword [edi + 0x6c]
add esi, edx
cmp eax, esi
jae 0x456dea
sub ecx, esi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x456dce
mov ebx, 0x102
mov ecx, dword [edi + 0x38]
push ebx
add ecx, esi
push 0
push ecx
call fcn.00451f20
add esp, 0xc
add ebx, esi
pop esi
mov dword [edi + 0x16c0], ebx
pop ebx
ret
lea edx, [esi + 0x102]
cmp eax, edx
jae 0x456e1b
sub esi, eax
add esi, 0x102
sub ecx, eax
cmp esi, ecx
jbe 0x456e04
mov esi, ecx
mov ecx, dword [edi + 0x38]
push esi
add ecx, eax
push 0
push ecx
call fcn.00451f20
add esp, 0xc
add dword [edi + 0x16c0], esi
pop esi
pop ebx
ret
Function at 0x458a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x458a85
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x458a9d
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x458acc
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x458b0e
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x458be2
sub edx, 0x10000
js 0x458be2
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x458af4
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x458af4
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x458b65
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x458b62
add edx, 8
jne 0x458b49
jmp 0x458bd3
add edx, 4
test eax, 0xffff
jne 0x458b72
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x458bd3
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x458ba6
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x458af4
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x458be2
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x458af4
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x458bf3
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40d0cb
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x40d0ec
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x40d0e3
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x40d0db
mov eax, ebx
leave
ret

Function at 0x40d112
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x40d171
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x40d19e
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40d18d
xor ecx, eax
xor edx, ebx
dec edi
jne 0x40d17e
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x40d1c4
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x40d165
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x40da04
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword ds:[ebp - 0x20], 0xff8bff8b
mov dword ds:[ebp - 0x14], 0xff8bff8b
mov dword ds:[ebp - 0x1c], 0xff8bff8b
push 0x7fc
push dword [ebp - 0x20]
call fcn.0040d091
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ebx, eax
pop ecx
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x40dbe3
push dword [ebp - 4]
call fcn.0040d075
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40dad4
jmp 0x40dbe3
push dword [ebp - 4]
call fcn.0040d075
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], eax
jne 0x40db28
lea eax, [ebp - 4]
push eax
call fcn.0040d9ea
mov dword [ebp - 0x28], eax
push 0
push 4
push dword [ebp - 0x28]
push dword [ebp - 4]
push 0xffffffff
push dword [ebp - 0x14]
call fcn.0040d29c
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x40db28
mov eax, 1
jmp 0x40db2a
xor eax, eax
test eax, eax
je 0x40dbd8
push ebx
push esi
push edx
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov eax, dword [eax]
add eax, ebx
lea eax, [eax + 0x78]
mov eax, dword [eax]
lea esi, [eax + ebx]
mov dword [ebp - 0x10], esi
lea edx, [esi + 0x20]
mov edx, dword [edx]
add edx, ebx
mov edx, dword [edx]
add edx, ebx
mov dword [ebp - 0x18], edx
lea eax, [esi + 0x18]
mov eax, dword [eax]
dec eax
mov dword [ebp - 4], eax
pop ebx
pop esi
pop edx
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x40dbd0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [ebp - 0x1c]
call fcn.0040d807
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x40dbbf
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
lea eax, [eax + edi*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop edi
leave
ret 8
push dword [ebp - 0xc]
call fcn.0040d9c3
add dword [ebp - 8], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x40db72
add esp, 0xc
jmp 0x40dbe3
pop ebx
pop ecx
pop edx
add ecx, 4
jmp 0x40daad
add esp, 0xc
mov edi, edi
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 0
jmp 0x40dc04
mov esp, ebp
pop ebp
ret 8