joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47628a
Capabilities:
Check http status code

Disassembly:
push 0xa4
mov eax, 0x4a1e7b
call fcn.0049fa2f
mov edi, ecx
mov ebx, dword [ebp + 8]
xor eax, eax
push eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xac], 4
push eax
push 0x20000013
push dword [edi + 8]
call dword [sym.imp.wininet.dll_HttpQueryInfoW]
test eax, eax
je 0x4764e8
cmp dword [ebp - 0xa8], 0xc8
jne 0x4764e8
push 0
lea eax, [ebp - 0xa4]
push eax
push 0
push 0x16
push dword [edi + 8]
call dword [sym.imp.wininet.dll_HttpQueryInfoW]
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x4764e8
xor ecx, ecx
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00460be7
mov ecx, dword [ebp - 0xa4]
mov esi, eax
lea ecx, [ecx*2 + 2]
push ecx
push 0
push esi
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0x10
lea eax, [ebp - 0xa4]
push 0
push eax
push esi
push 0x16
push dword [edi + 8]
call dword [sym.imp.wininet.dll_HttpQueryInfoW]
test eax, eax
je 0x4764e8
push esi
lea ecx, [ebp - 0x28]
call fcn.00460be7
and dword [ebp - 4], 0
push esi
call fcn.0048844b
mov esi, 0x4b9420
lea ecx, [ebp - 0x28]
push esi
call fcn.00460be7
or edi, 0xffffffff
jmp 0x4764d4
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00460be7
push eax
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00460be7
push ecx
push 0x4b9428
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00460be7
cmp eax, edi
je 0x476477
push ecx
mov esi, 0x4b9428
lea ecx, [ebp - 0x40]
push esi
call fcn.00460be7
push eax
push 0
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x40]
call fcn.00460be7
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.00460be7
push edi
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.00460be7
inc eax
lea ecx, [ebp - 0x40]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00460be7
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.00460be7
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x88]
call fcn.0046ee68
mov esi, eax
lea edx, [ebp - 0x70]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa0]
call fcn.0046ee68
push eax
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 5
push eax
mov ecx, ebx
call fcn.00460be7
push esi
mov ecx, dword [eax]
add ecx, 0x28
call fcn.00460be7
lea ecx, [ebp - 0xa0]
call fcn.0046a23d
lea ecx, [ebp - 0x88]
call fcn.0046a23d
lea ecx, [ebp - 0x58]
call fcn.0046d98d
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.0046d98d
mov esi, 0x4b9420
push edi
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00460be7
add eax, 2
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00460be7
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x4764ae
mov ecx, eax
call fcn.0046d98d
push esi
lea ecx, [ebp - 0x28]
call fcn.00460be7
lea ecx, [ebp - 0x88]
call fcn.0046d98d
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.0046d98d
push ecx
mov esi, 0x4b9420
lea ecx, [ebp - 0x28]
push esi
call fcn.00460be7
cmp eax, edi
jne 0x476386
lea ecx, [ebp - 0x28]
call fcn.0046d98d
mov al, 1
jmp 0x4764ea
xor al, al
call fcn.0049f9de
ret 4
Function at 0x477ae3
Capabilities:
Get common file path

Disassembly:
push 0x86c
mov eax, 0x4a224c
call fcn.0049fa2f
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x878], esi
push 0x802
xor ebx, ebx
mov dword [ebp - 0x878], esi
lea eax, [ebp - 0x814]
push ebx
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
push ebx
push ebx
push 0x801a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x477c46
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x844]
call fcn.00460be7
mov edx, edi
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x85c]
call fcn.0046ef25
push eax
mov edx, str.AdobeHeadlightsCCHLLog_
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x874]
call fcn.00460be7
mov byte [ebp - 4], 5
mov ecx, eax
mov dword [esp], 0x4b9560
call fcn.00460be7
push eax
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 0x818], ebx
call fcn.00460be7
mov byte [ebp - 4], 6
lea eax, [ebp - 0x82c]
cmp dword [ebp - 0x818], 8
lea ecx, [ebp - 0x844]
push dword [ebp - 0x81c]
cmovae eax, dword [ebp - 0x82c]
push eax
call fcn.00472323
lea ecx, [ebp - 0x82c]
call fcn.0046d98d
lea ecx, [ebp - 0x874]
call fcn.0046d98d
lea ecx, [ebp - 0x85c]
mov byte [ebp - 4], bl
call fcn.0046d98d
lea edx, [ebp - 0x844]
lea ecx, [ebp - 0x85c]
call fcn.004711e9
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.004708e3
lea ecx, [ebp - 0x85c]
mov byte [ebp - 4], 0
mov bl, al
call fcn.0046d98d
test bl, bl
je 0x477c37
lea edx, [ebp - 0x844]
mov ecx, esi
call fcn.0046ee68
lea ecx, [ebp - 0x844]
call fcn.0046d98d
jmp 0x477c52
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x844]
call fcn.0046d98d
push 0x4adacc
mov ecx, esi
call fcn.00460be7
mov eax, esi
call fcn.0049f9de
ret

Function at 0x477c5a
Capabilities:
Get common file path

Disassembly:
push 0x83c
mov eax, 0x4a229b
call fcn.0049fa2f
mov esi, ecx
mov dword [ebp - 0x848], esi
push 0x802
xor ebx, ebx
mov dword [ebp - 0x848], esi
lea eax, [ebp - 0x814]
push ebx
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
push ebx
push ebx
push 0x801a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x477d2d
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x82c]
call fcn.00460be7
push 0x20
push str.AdobeRTTransferRTDebugLog.txt
lea ecx, [ebp - 0x82c]
mov dword [ebp - 4], ebx
call fcn.00472323
lea edx, [ebp - 0x82c]
lea ecx, [ebp - 0x844]
call fcn.004711e9
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004708e3
lea ecx, [ebp - 0x844]
mov byte [ebp - 4], 0
mov bl, al
call fcn.0046d98d
test bl, bl
je 0x477d1e
lea edx, [ebp - 0x82c]
mov ecx, esi
call fcn.0046ee68
lea ecx, [ebp - 0x82c]
call fcn.0046d98d
jmp 0x477d39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x82c]
call fcn.0046d98d
push 0x4adacc
mov ecx, esi
call fcn.00460be7
mov eax, esi
call fcn.0049f9de
ret
Function at 0x47f3f2
Capabilities:
Get common file path

Disassembly:
push 0x278
mov eax, 0x4a3862
call fcn.0049fa2f
mov ebx, ecx
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x284], ebx
mov eax, dword fs:[0x2c]
xor esi, esi
mov dword [ebp - 0x284], ebx
mov edi, 0x4cb43c
mov ecx, dword [eax]
mov eax, dword [0x4cb438]
cmp eax, dword [ecx + 4]
jle 0x47f46f
push 0x4cb438
call fcn.00460be7
cmp dword [0x4cb438], 0xffffffff
pop ecx
jne 0x47f46f
push 0x4b9024
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.00460be7
push 0x4a6690
call fcn.00460be7
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x4cb438
call fcn.00460be7
pop ecx
cmp dword [0x4cb44c], 0
jne 0x47f590
push 0x20a
lea eax, [ebp - 0x21c]
push esi
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
call fcn.00460be7
test al, al
je 0x47f563
push str.LogSession
lea ecx, [ebp - 0x24c]
call fcn.00460be7
lea ecx, [ebp - 0x24c]
mov dword [ebp - 4], 1
call fcn.00477e85
mov ebx, eax
lea ecx, [ebp - 0x264]
push 0x4adacc
mov eax, dword [ebx]
mov edi, dword [eax + 0x40]
call fcn.00460be7
mov esi, eax
push str.IE_is_protected_mode_
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 2
call fcn.00460be7
push esi
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call dword [0x4a75c0]
mov ecx, ebx
call edi
lea ecx, [ebp - 0x234]
call fcn.0046a23d
lea ecx, [ebp - 0x264]
call fcn.0046a23d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.0046a23d
lea ecx, [ebp - 0x27c]
call fcn.00474779
mov esi, eax
mov edi, 0x4cb43c
cmp esi, edi
je 0x47f550
mov ecx, edi
call fcn.0046d98d
push esi
mov ecx, edi
call fcn.00460be7
lea ecx, [ebp - 0x27c]
call fcn.0046d98d
mov ebx, dword [ebp - 0x280]
jmp 0x47f590
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push 0x801a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
lea ecx, [ebp - 0x21c]
mov eax, 0x4b9024
cmovne ecx, eax
push ecx
mov ecx, edi
call fcn.00460be7
push edi
mov ecx, ebx
call fcn.004723ba
mov eax, ebx
call fcn.0049f9de
ret

Function at 0x47f7a8
Capabilities:
Get session user name

Disassembly:
push 0x254
mov eax, 0x4a38b6
call fcn.0049fa2f
mov esi, ecx
mov dword [ebp - 0x260], esi
xor eax, eax
mov dword [ebp - 0x260], esi
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x260], 0x100
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x25c]
call fcn.00460be7
and dword [ebp - 4], 0
lea edx, [ebp - 0x25c]
lea ecx, [ebp - 0x22c]
call fcn.0046ee68
push str.AdobeHeadlights
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.00460be7
mov byte [ebp - 4], 2
lea eax, [ebp - 0x22c]
cmp dword [ebp - 0x218], 0x10
lea ecx, [ebp - 0x244]
push dword [ebp - 0x21c]
cmovae eax, dword [ebp - 0x22c]
push eax
call fcn.0046a372
push eax
mov ecx, esi
call fcn.00469e2b
lea ecx, [ebp - 0x244]
call fcn.0046a23d
lea ecx, [ebp - 0x22c]
call fcn.0046a23d
lea ecx, [ebp - 0x25c]
call fcn.0046d98d
mov eax, esi
call fcn.0049f9de
ret
Function at 0x47fe6f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xf4
mov eax, 0x4a39c0
call fcn.0049fa2f
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x48], eax
cmp dword [ecx], ebx
jne 0x47fe97
xor al, al
jmp 0x47ff75
push 0x802
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x4c], 0x400
call fcn.00460be7
mov dword [esp], 0x802
mov edi, eax
push ebx
push edi
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x47fec9
mov eax, dword [esi]
lea ecx, [ebp - 0x4c]
push ecx
push edi
lea ecx, [ebp - 0x44]
push ecx
push ebx
push eax
mov eax, dword [ebp - 0x50]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cdq
cmp eax, ebx
jne 0x47ff55
cmp edx, ebx
jne 0x47ff55
cmp dword [ebp - 0x44], 4
jne 0x47ff48
mov esi, dword [edi]
push ecx
lea ecx, [ebp - 0x100]
call fcn.0048014f
push esi
lea ecx, [ebp - 0xf0]
mov dword [ebp - 4], ebx
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0047276e
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x28]
push eax
call fcn.00460be7
lea ecx, [ebp - 0x28]
call fcn.0046d98d
lea ecx, [ebp - 0x98]
call fcn.0048011f
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
jmp 0x47ff51
mov ecx, dword [ebp - 0x48]
push edi
call fcn.00460be7
mov bl, 1
jmp 0x47ff6c
push esi
mov edx, str.Query_registry_value_with_key:
lea ecx, [ebp - 0x40]
call fcn.00460be7
pop ecx
lea ecx, [ebp - 0x40]
call fcn.0046d98d
push edi
call fcn.0048844b
pop ecx
mov al, bl
call fcn.0049f9de
ret 8

Function at 0x48ab60
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
push esi
xor esi, esi
cmp ecx, edx
je 0x48ab95
nop
movsx eax, byte [ecx]
inc ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
cmp ecx, edx
jne 0x48ab70
mov eax, 3
mov ecx, esi
mul esi
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1e
imul ecx, ecx, 0x7fffffff
sub esi, ecx
or esi, 0x40000000
mov eax, esi
pop esi
ret
Function at 0x403960
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x4039be
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x4039a2
cmp edi, 2
jb 0x4039a2
cmp byte [esi], cl
jne 0x4039a2
cmp byte [esi + 1], cl
jne 0x4039a2
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4def10]
jmp 0x403973
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4def10]
test edi, edi
jne 0x403973
pop edi
pop esi
not eax
pop ebx
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x4039ed
cmp cl, 0x23
jne 0x4039d4
cmp byte [esi], cl
jne 0x4039d4
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4def10]
test cl, cl
jne 0x4039c5
pop edi
pop esi
not eax
pop ebx
ret

Function at 0x403b00
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
test ebx, ebx
je 0x403b12
mov dword [ebx], 0
mov edx, 0x4de9bc
call fcn.00403a00
mov esi, eax
test esi, esi
je 0x403bf0
mov ebp, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebp
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x403be6
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403be6
push esi
call ebp
mov ebp, eax
add esp, 4
cmp ebp, 0xffffffff
je 0x403be6
push 0
push edi
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403be6
mov eax, dword [0x4f0690]
test eax, eax
je 0x403b84
inc dword [eax + 0x370]
push ebp
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x403be6
push esi
push ebp
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebp
je 0x403bd0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x4f0690]
add esp, 4
test eax, eax
je 0x403bbf
dec dword [eax + 0x370]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x403bdf
mov dword [ebx], ebp
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x406940
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0xc
mov eax, dword [0x4ef400]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [ecx + 0xf8]
lea edx, [esp + 4]
push ebx
mov ebx, dword [ecx + 0x100]
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [esp + 0x10], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4def10]
sub esi, 1
jne 0x406974
mov eax, dword [0x4f0690]
not ebx
cmp dword [eax + 0x1c88], ebx
jne 0x4069a3
mov dword [eax + 0x1c8c], ebx
cmp dword [eax + 0x1cc4], ebx
jne 0x4069b2
mov byte [eax + 0x1cc8], 1
cmp dword [eax + 0x1c70], ebx
jne 0x4069cb
push ecx
push edi
mov edx, 4
mov ecx, ebx
call fcn.00422df0
add esp, 8
mov ecx, dword [esp + 0x14]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ca5c5
add esp, 0xc
ret 4
Function at 0x412360
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0xc
mov eax, dword [0x4ef400]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [0x4f0690]
lea edx, [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax + 0x1c4c]
mov ebp, ecx
mov dword [esp + 0x14], ebp
mov esi, 4
mov eax, dword [edi + 0xf8]
mov ebx, dword [edi + 0x100]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4def10]
sub esi, 1
jne 0x4123a0
mov eax, dword [0x4f0690]
not ebx
cmp dword [eax + 0x1c70], ebx
jne 0x4123d8
push ecx
push ebp
lea edx, [esi + 4]
mov ecx, ebx
call fcn.00422df0
add esp, 8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
lea ecx, [edi + 0xf8]
call fcn.00422fc0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ca5c5
add esp, 0xc
ret
Function at 0x417e80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x30ec], 0
lea esi, [edi + 0x30f0]
je 0x417f02
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x417ebc
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00423ca0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.004040c0
mov edx, dword [esi]
mov ecx, 0x4f068c
push dword [edi + 0x30ec]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x30f8]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.004040c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4182d0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push ebp
mov ebp, ecx
or eax, 0xffffffff
push esi
push edi
mov bl, byte [ebp]
lea esi, [ebp + 1]
test bl, bl
je 0x41830e
or edi, 0xffffffff
cmp bl, 0x23
jne 0x4182f5
cmp byte [esi], bl
jne 0x4182f5
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x4def10]
test bl, bl
jne 0x4182e6
mov ebx, dword [0x4f0690]
not eax
mov edi, dword [ebx + 0x30c4]
mov esi, edi
neg esi
sbb esi, esi
lea ecx, [edi + 4]
and esi, ecx
je 0x41834f
nop dword [eax]
cmp dword [esi], eax
je 0x41835a
mov edx, dword [esi - 4]
mov ecx, dword [ebx + 0x30bc]
add edx, esi
add ecx, 4
xor esi, esi
add ecx, edi
cmp edx, ecx
cmovne esi, edx
test esi, esi
jne 0x418330
pop edi
pop esi
mov ecx, ebp
pop ebp
pop ebx
jmp fcn.004181f0
test esi, esi
je 0x41834f
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x42c4f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x42c52a
mov eax, dword [0x4f0690]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x42c51d
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x42c55b
mov eax, dword [0x4f0690]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x42c54e
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x42c58c
mov eax, dword [0x4f0690]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x42c57f
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x42c5d9
mov eax, dword [0x4f0690]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x42c5cc
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x42c60a
mov eax, dword [0x4f0690]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x42c5fd
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x42c63b
mov eax, dword [0x4f0690]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x42c62e
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.0042ee70
Function at 0x42fd30
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x174
push ebx
push ebp
push esi
mov esi, dword [esp + 0x184]
push edi
movss dword [esp + 0x10], xmm3
mov dword [esp + 0x14], ecx
movzx ebx, byte [esi + 8]
movzx eax, byte [esi + 9]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xa]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xb]
shl ebx, 8
add ebx, eax
mov eax, dword [0x4f0690]
test eax, eax
je 0x42fd79
inc dword [eax + 0x370]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movzx edx, byte [esi]
add esp, 4
movzx ecx, byte [esi + 1]
mov ebp, eax
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
add edx, ecx
cmp edx, 0x57bc0000
jne 0x42fe28
movzx ecx, byte [esi + 4]
movzx eax, byte [esi + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 6]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 7]
shl ecx, 8
add ecx, eax
jne 0x42fe28
movzx ecx, byte [esi + 8]
movzx eax, byte [esi + 9]
movzx edi, byte [esi + 0xb]
shl ecx, 8
add ecx, eax
mov dword [0x4f0774], esi
movzx eax, byte [esi + 0xa]
add esi, 0x10
shl ecx, 8
add ecx, eax
mov dword [0x4f09f0], ebp
shl ecx, 8
add ecx, ebp
mov dword [0x4f09f4], ebp
add edi, ecx
mov ecx, esi
mov dword [0x4f07c4], edi
call fcn.00433c90
cmp eax, esi
je 0x42fe28
cmp dword [0x4f09f4], edi
ja 0x42fe28
mov ecx, eax
mov esi, eax
call fcn.00433c90
cmp eax, esi
jne 0x42fe13
mov esi, dword [esp + 0x190]
test esi, esi
jne 0x42fe76
push 0x78
lea eax, [esp + 0x1c]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0xffff
mov byte [esp + 0x2c], 1
add esp, 0xc
mov dword [esp + 0x2c], 3
mov dword [esp + 0x30], 1
lea esi, [esp + 0x18]
mov dword [esp + 0x50], 0x7f7fffff
mov dword [esp + 0x5c], 0x3f800000
mov word [esp + 0x60], ax
movss xmm0, dword [esp + 0x10]
lea edi, [esp + 0x90]
comiss xmm0, dword [0x4e6890]
mov ecx, 0x1e
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x1e
lea esi, [esp + 0x90]
lea edi, [esp + 0x108]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x1e
mov byte [esp + 0x110], 1
lea esi, [esp + 0x108]
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebx
jbe 0x42fed0
movss dword [esp + 0x28], xmm0
mov eax, dword [esp + 0x194]
test eax, eax
mov ecx, dword [esp + 0x48]
cmovne ecx, eax
lea eax, [esp + 0x18]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x14]
push eax
call fcn.0042fb40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x174
ret 0x10
Function at 0x430050
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
cmp esi, 8
ja 0x43015f
test byte [edi], 2
jne 0x43015f
mov eax, dword [edi + 0x460]
lea esi, [esi + esi*2]
mov ecx, dword [edi + 0x48]
movss xmm2, dword [esi*8 + 0x4ef568]
movss xmm4, dword [esi*8 + 0x4ef56c]
lea edx, [eax*8]
sub edx, eax
movzx eax, word [ecx + edx*4 + 4]
movd xmm5, eax
movzx eax, word [ecx + edx*4 + 6]
cvtdq2ps xmm5, xmm5
movd xmm3, eax
addss xmm5, dword [esi*8 + 0x4ef560]
mov eax, dword [esp + 0x14]
cvtdq2ps xmm3, xmm3
movaps xmm1, xmm5
addss xmm3, dword [esi*8 + 0x4ef564]
movss dword [eax + 4], xmm4
movss dword [eax], xmm2
mov ecx, dword [esi*8 + 0x4ef570]
mov edx, dword [esi*8 + 0x4ef574]
mov eax, dword [esp + 0x10]
addss xmm4, xmm3
movaps xmm0, xmm3
mov dword [eax], ecx
mov dword [eax + 4], edx
mulss xmm1, dword [edi + 0x24]
mov eax, dword [esp + 0x18]
mulss xmm0, dword [edi + 0x28]
movss dword [eax], xmm1
movaps xmm1, xmm2
movss dword [eax + 4], xmm0
addss xmm1, xmm5
addss xmm5, dword [0x4e6a0c]
movaps xmm0, xmm4
mulss xmm0, dword [edi + 0x28]
mulss xmm1, dword [edi + 0x24]
movss dword [eax + 0xc], xmm0
movaps xmm0, xmm5
addss xmm5, xmm2
movss dword [eax + 8], xmm1
mov eax, dword [esp + 0x1c]
mulss xmm0, dword [edi + 0x24]
mulss xmm3, dword [edi + 0x28]
movss dword [eax], xmm0
movss dword [eax + 4], xmm3
mulss xmm5, dword [edi + 0x24]
mulss xmm4, dword [edi + 0x28]
movss dword [eax + 8], xmm5
movss dword [eax + 0xc], xmm4
mov al, 1
pop edi
pop esi
ret 0x14
pop edi
xor al, al
pop esi
ret 0x14