joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3330
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c53ba
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4fb304]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], str.QQPCRTP
push 0x4d4a40
push 0x4d4a58
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x18]
push eax
call fcn.004c3240
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
call fcn.00406fcc
movzx ecx, al
test ecx, ecx
je 0x4c33a5
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00408077
jmp 0x4c3417
lea eax, [ebp - 0x18]
call fcn.004689f0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4c33c9
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00408077
jmp 0x4c3417
mov dword [ebp - 0x1c], 0
jmp 0x4c33db
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 1
jae 0x4c3400
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x10]
push ecx
call fcn.004089ac
add esp, 4
test eax, eax
je 0x4c33fe
mov dword [ebp - 0x14], 1
jmp 0x4c3400
jmp 0x4c33d2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00408077
xor edx, edx
jne 0x4c3363
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4c4100
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5e3e
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4fb304]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x20]
call fcn.004bba40
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x4c414b
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x4c4150
jmp 0x4c420b
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4c4163
jmp 0x4c420b
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.004ba240
test eax, eax
jne 0x4c4178
jmp 0x4c420b
lea ecx, [ebp - 0x34]
call fcn.00475d90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x20]
call fcn.004bc470
test eax, eax
jne 0x4c41a2
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00475ea0
jmp 0x4c420b
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x3c], esp
lea edx, [ebp - 0x34]
push edx
call fcn.00475dc0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x38]
push eax
call fcn.004c3f60
add esp, 0x14
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x38]
call fcn.004095b5
push eax
lea eax, [ebp - 0x38]
call fcn.004689f0
push eax
push 0x100
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0048471f
add esp, 0x10
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x38]
call fcn.00408077
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00475ea0
xor edx, edx
jne 0x4c413b
lea ecx, [ebp - 0x20]
call fcn.004b9850
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004b9a60
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40144a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push eax
pop eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push edx
pop edx
push eax
pop eax
mov eax, dword [eax + 0x78]
add eax, dword [ebp + 8]
push edx
pop edx
mov esi, eax
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0x20]
add eax, dword [ebp + 8]
mov ebx, eax
xor edx, edx
push edx
pop edx
push edx
pop edx
push ecx
push esi
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, eax
push edx
pop edx
mov ecx, dword [ebp + 0x10]
cld
repe cmpsb byte [esi], byte es:[edi]
pop esi
je 0x40149c
inc edx
add ebx, 4
mov eax, ebx
push edx
pop edx
pop ecx
loop 0x40147a
add esp, 4
mov ebx, esi
mov ebx, dword [ebx + 0x24]
add ebx, dword [ebp + 8]
push edx
pop edx
shl edx, 1
xor ecx, ecx
mov cx, word [ebx + edx]
push edx
pop edx
mov eax, esi
push edx
pop edx
mov eax, dword [eax + 0x1c]
add eax, dword [ebp + 8]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4014cc
Capabilities:
Access peb ldr_data

Disassembly:
push edx
pop edx
push esi
xor ecx, ecx
mov esi, dword fs:[ecx + 0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x20]
mov esi, dword [esi]
cmp word [edi + 0x18], cx
jne 0x4014db
pop esi
ret

Function at 0x41fc70
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041faaa

Function at 0x421bfd
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042144f

Function at 0x421c08
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042168a
Function at 0x427a3e
Capabilities:
Clear file content

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 1
push esi
push esi
push edi
push esi
pop ebx
mov dword [ebp - 8], esi
call fcn.0041f2cf
push edx
pop ecx
mov dword [ebp - 0x18], eax
and eax, ecx
add esp, 0x10
mov dword [ebp - 0x14], ecx
cmp eax, 0xffffffff
je 0x427ac6
push 2
push esi
push esi
push edi
call fcn.0041f2cf
push eax
pop ecx
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x427ac6
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub esi, ecx
sbb eax, edx
mov dword [ebp - 4], eax
js 0x427b5d
jg 0x427aa0
or esi, esi
je 0x427b5d
push 0x1000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
or eax, eax
jne 0x427ad2
call fcn.00416b81
mov dword [eax], 0xc
call fcn.00416b81
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push edi
call fcn.00427c1c
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
pop ecx
or eax, eax
jl 0x427afa
jg 0x427af3
cmp esi, 0x1000
jb 0x427afa
mov eax, 0x1000
jmp 0x427afc
push esi
pop eax
push eax
push dword [ebp - 0xc]
push edi
call fcn.0041c714
add esp, 0xc
cmp eax, 0xffffffff
je 0x427b23
cdq
sub esi, eax
mov eax, dword [ebp - 4]
sbb eax, edx
mov dword [ebp - 4], eax
js 0x427b3e
jg 0x427ae5
test esi, esi
je 0x427b3e
jmp 0x427ae5
call fcn.00416b4d
cmp dword [eax], 5
jne 0x427b38
call fcn.00416b81
mov dword [eax], 0xd
or ebx, 0xffffffff
or dword [ebp - 8], ebx
push dword [ebp - 0x10]
push edi
call fcn.00427c1c
pop ecx
pop ecx
push dword [ebp - 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x427bc3
test eax, eax
jg 0x427bcf
jl 0x427b67
or esi, esi
jae 0x427bcf
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0041f2cf
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x427ac6
push edi
call fcn.00424a9e
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
push eax
pop ebx
push edx
pop eax
mov ecx, ebx
and ecx, eax
mov dword [ebp - 8], eax
cmp ecx, 0xffffffff
jne 0x427bcf
call fcn.00416b81
mov dword [eax], 0xd
call fcn.00416b4d
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
and ebx, dword [ebp - 8]
cmp ebx, 0xffffffff
je 0x427ac6
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call fcn.0041f2cf
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x427ac6
xor eax, eax
jmp 0x427acd

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x438caa
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x438a14
add edx, 0x39610bb3
and eax, eax
add eax, 0x5008f077
call fcn.00438cf9
or edx, edx
add eax, eax
inc edx
xor dword [esi], ebx
or edx, eax
add esi, 1
dec edx
push 0xd2f9c121
mov eax, dword [esp]
add esp, 4
cmp esi, ecx
jne fcn.00438caa
mov eax, 0x3140049c
sub eax, 0x75f5695e
ret
Function at 0x10007680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [0x1016c09c]
add edi, 0xffffff53
mov dword [0x1016c0a0], edi
mov dword [0x1016c0a4], 0
mov dword [0x1016c0a8], 0
mov dword [0x1016c0b4], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x100077fa
xor eax, eax
mov ecx, eax
mov edx, eax
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], eax
jmp 0x100076f6
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
mov edi, 0x100
add ecx, 0xffffd933
mov dword [0x1016c09c], ecx
add edx, 1
mov dword [ebp - 0x34], eax
mov eax, edx
cdq
idiv edi
mov dword [0x1016c0a4], edx
mov dword [0x1016c0a0], 0xc3d
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x1016c0a8], edx
mov dword [0x1016c09c], 0x1c64
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x1016c0ac], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x1016c09c], 0x475
mov cl, byte [0x1016c0ac]
mov edx, dword [0x1016c0a8]
mov byte [edi + edx], cl
mov edx, dword [0x1016c0a4]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1016c0a8]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1016c0b4], ebx
mov dword [0x1016c0a0], 0x158c
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x34]
xor cl, byte [edx + ebx]
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], cl
add ebx, 1
mov ecx, dword [ebp - 0x10]
cmp ebx, ecx
mov dword [ebp - 0x3c], ebx
je 0x100077f8
mov eax, dword [0x1016c0a0]
mov dword [ebp - 0x40], eax
mov eax, dword [0x1016c0a4]
mov ecx, dword [0x1016c0a8]
mov edx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x30], esi
jmp 0x100076f6
jmp 0x100077fa
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10007eb0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1016c0a8], 0
mov byte [0x1016c0ac], 0
mov dword [0x1016c09c], 0x6f0
mov dword [0x1016c0a4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1016c09c], 0x129a
mov eax, dword [0x1016c0a4]
add eax, 1
mov dword [0x1016c0a4], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10007ef5
jmp 0x10007fea
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x1016c0b0], 0
mov edx, dword [0x1016c0a8]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x1016c0b0], edi
mov dword [0x1016c09c], 0x13ab
mov eax, edi
cdq
idiv ecx
mov dword [0x1016c0a8], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x1016c0ac], cl
mov dword [0x1016c09c], 0x169d
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x1016c0ac]
mov edx, dword [0x1016c0a8]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x1016c0a0]
mov ecx, edx
add ecx, 0xffffef20
mov dword [0x1016c09c], ecx
mov ecx, dword [0x1016c0a4]
add ecx, 1
mov dword [0x1016c0a4], ecx
cmp ecx, 0x100
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], edx
jl 0x10007f2a
jmp 0x10008010
xor eax, eax
mov ecx, dword [0x1016c0a0]
add ecx, 0xfffffc12
mov dword [0x1016c0a0], ecx
mov dword [0x1016c0a4], 0
mov dword [ebp - 0x20], eax
jmp 0x10007f2a
mov eax, dword [ebp - 0x28]
add eax, 0x12d7
mov dword [0x1016c0a0], eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10008030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
mov eax, dword [ebp + 8]
mov dword [0x1016c09c], 0x198f
mov dword [ebp - 0x10], eax
call fcn.10007b70
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x10008076
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x1016c0a0], 0xd34
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov dword [0x1016c09c], 0xfb8
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x100081c0
jmp 0x100080e1
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edx
jmp 0x100080ff
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x100081c0
mov eax, dword [ebp - 0x24]
add eax, 0x24
mov dword [ebp - 0x4c], eax
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x4c]
add ecx, dword [ecx + edx]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], eax
jmp 0x100080bb
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov bl, cl
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x51], bh
mov byte [ebp - 0x52], cl
mov byte [ebp - 0x53], bl
je 0x1000815c
mov al, byte [ebp - 0x51]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x50]
add edx, 1
mov ah, byte [ebp - 0x52]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov cl, byte [ebp - 0x52]
mov dword [ebp - 0x48], edx
mov byte [ebp - 0x53], cl
jne 0x100080ff
mov al, byte [ebp - 0x53]
test al, 1
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x58], ecx
jne 0x100081a7
mov eax, dword [ebp - 0x3c]
add eax, 1
mov ecx, dword [ebp - 0x40]
add ecx, 2
mov edx, dword [ebp - 0x2c]
cmp eax, edx
setb bl
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], ecx
mov byte [ebp - 0x61], bl
mov al, byte [ebp - 0x61]
test al, 1
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
jne 0x100080bb
jmp 0x100080d7
mov eax, dword [ebp - 0x58]
movzx eax, word [eax]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x1c]
mov esi, dword [ebp - 0x1c]
add esi, dword [ecx + eax*4]
mov dword [ebp - 0x30], esi
mov eax, dword [ebp - 0x30]
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10008fc0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov edx, dword [0x1016c0a0]
mov esi, edx
add esi, 0xfffff527
mov dword [0x1016c09c], esi
add edx, 0x1b04
mov dword [0x1016c0a0], edx
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10008c30
lea ecx, [0x100078c0]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x48], edx
mov dword [esp + 0x7c], 0x129600
mov edx, dword [0x1016c088]
mov dword [esp + 0x70], edx
mov edx, dword [0x1016c08c]
mov dword [esp + 0x4c], edx
mov edx, dword [0x1016c090]
mov dword [esp + 0x78], edx
mov edx, dword [0x1016c094]
mov dword [esp + 0x44], edx
mov edx, dword [0x1016c09c]
mov esi, edx
add esi, 0xfffff229
mov dword [0x1016c09c], esi
mov esi, dword [0x1016c098]
mov dword [esp + 0x84], esi
add edx, 0xffffe8f1
mov dword [0x1016c0a0], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x10009080
mov eax, dword [esp + 0x18]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
jne 0x100090b7
mov eax, dword [esp + 0x14]
add eax, 0x3c
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [esp + 0x14]
cmp dword [edx + ecx], 0x4550
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
je 0x100090cb
mov eax, dword [esp + 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x10009080
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x38], ecx
mov dword [0x1016c09c], 0x163f
mov eax, dword [ecx + eax + 0x50]
mov dword [esp + 0x40], eax
call fcn.10008240
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], ecx
jne 0x10009076
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10008960
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x1016c09c], 0x1176
mov dword [esp + 0x18], eax
jmp 0x10009076
Function at 0x4346d0
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
lea ebx, [ecx + edx]
mov edx, edi
imul edx, esi
add edx, edx
add esi, esi
or eax, 0xffffffff
add edx, edx
add esi, esi
lea edi, [ecx + edi*4]
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edi
mov esi, ecx
movzx ebp, byte [ecx + 2]
add ecx, 2
mov edi, eax
and edi, 0xff
xor edi, ebp
movzx ebp, byte [ecx - 1]
shr eax, 8
xor eax, dword [edi*4 + 0x491dc8]
dec ecx
mov edi, eax
and edi, 0xff
xor edi, ebp
movzx ebp, byte [ecx - 1]
shr eax, 8
xor eax, dword [edi*4 + 0x491dc8]
dec ecx
mov edi, eax
and edi, 0xff
xor edi, ebp
shr eax, 8
xor eax, dword [edi*4 + 0x491dc8]
add ecx, edx
cmp ecx, ebx
jb 0x43475d
add esi, dword [esp + 0x20]
mov ecx, esi
cmp esi, dword [esp + 0x1c]
jb 0x434704
not eax
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
test eax, eax
jge 0x434777
fadd qword [0x48c528]
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x435152
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x464]
test eax, eax
je 0x435168
cmp eax, 0x10000
jne 0x43518c
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x45c]
push eax
push 0x10000
push 1
push ecx
call fcn.004151b0
add esp, 0x10
mov dword [esi + 0x464], 0
mov ecx, dword [esi + 0x464]
mov edx, dword [esi + 0x45c]
mov al, byte [ecx + edx]
inc ecx
mov dword [esi + 0x464], ecx
pop esi
ret 4

Function at 0x4351a6
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x460]
test eax, eax
je 0x4351d5
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x458]
push ecx
push eax
push 1
push edx
call fcn.004146ce
add esp, 0x10
mov dword [esi + 0x460], 0
pop esi
ret 4

Function at 0x4351d9
Capabilities:
Write file on windows

Disassembly:
mov dl, byte [esp + 8]
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x458]
mov ecx, dword [esi + 0x460]
mov byte [eax + ecx], dl
inc dword [esi + 0x460]
mov eax, dword [esi + 0x460]
cmp eax, 0x10000
jne 0x435228
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x458]
push eax
push 0x10000
push 1
push ecx
call fcn.004146ce
add esp, 0x10
mov dword [esi + 0x460], 0
pop esi
ret 8

Function at 0x4352d1
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
cmp dword [esi + 0x14], 1
jne 0x4352f7
mov eax, dword [esi + 0xc]
add eax, dword [esi + 4]
push 8
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00410f70
add esp, 0xc
jmp 0x43530c
mov edx, dword [esi + 0x1c]
push edx
push 8
lea eax, [esp + 0xc]
push 1
push eax
call fcn.004151b0
add esp, 0x10
movzx ecx, byte [esp + 8]
movzx edx, byte [esp + 9]
movzx eax, byte [esp + 0xa]
add dword [esi + 0xc], 8
shl ecx, 8
or ecx, edx
movzx edx, byte [esp + 0xb]
shl ecx, 8
or ecx, eax
mov eax, dword [esp + 0x14]
shl ecx, 8
or ecx, edx
mov dword [eax], ecx
lea ecx, [esp + 4]
push 0x4876d8
push ecx
mov byte [esp + 0x10], 0
call fcn.004151d0
add esp, 8
neg eax
sbb eax, eax
neg eax
pop esi
add esp, 8
ret 8
Function at 0x4353b4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x4a72e8], eax
mov edx, 1
mov eax, 0x4a72e8
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x4a7ca4
jl 0x4353c8
mov dword [0x49223c], 1
mov dword [0x4a7cb8], 1
pop edi
ret