joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
movzx eax, byte [edi + 0x15]
mov byte [esi + 0x15], al
mov ecx, dword [edi + 0x18]
mov dword [esi + 0x18], ecx
mov edx, dword [edi + 0x1c]
mov dword [esi + 0x1c], edx
movzx eax, byte [edi + 0x20]
mov byte [esi + 0x20], al
movzx ecx, byte [edi + 0x21]
mov byte [esi + 0x21], cl
movzx edx, byte [edi + 0x22]
mov byte [esi + 0x22], dl
movzx eax, byte [edi + 0x23]
mov byte [esi + 0x23], al
movzx ecx, byte [edi + 0x24]
mov byte [esi + 0x24], cl
movzx edx, byte [edi + 0x25]
lea ecx, [edi + 0x2c]
mov byte [esi + 0x25], dl
mov eax, dword [edi + 0x28]
push ecx
lea ecx, [esi + 0x2c]
mov dword [esi + 0x28], eax
call fcn.004375a0
mov edx, dword [edi + 0x34]
mov dword [esi + 0x34], edx
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov ecx, dword [edi + 0x3c]
mov dword [esi + 0x3c], ecx
mov edx, dword [edi + 0x40]
mov dword [esi + 0x40], edx
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov ecx, dword [edi + 0x48]
mov dword [esi + 0x48], ecx
mov edx, dword [edi + 0x4c]
mov dword [esi + 0x4c], edx
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov ecx, dword [edi + 0x54]
mov dword [esi + 0x54], ecx
mov edx, dword [edi + 0x58]
mov dword [esi + 0x58], edx
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov ecx, dword [edi + 0x60]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0x64]
mov dword [esi + 0x64], edx
mov eax, dword [edi + 0x68]
mov dword [esi + 0x68], eax
movzx ecx, byte [edi + 0x6c]
mov byte [esi + 0x6c], cl
movzx edx, byte [edi + 0x6d]
mov byte [esi + 0x6d], dl
movzx eax, byte [edi + 0x6e]
mov byte [esi + 0x6e], al
movzx ecx, byte [edi + 0x6f]
mov byte [esi + 0x6f], cl
movzx edx, byte [edi + 0x70]
mov byte [esi + 0x70], dl
movzx eax, byte [edi + 0x71]
mov byte [esi + 0x71], al
movzx ecx, byte [edi + 0x72]
mov byte [esi + 0x72], cl
movzx edx, byte [edi + 0x73]
mov byte [esi + 0x73], dl
movzx eax, byte [edi + 0x74]
mov byte [esi + 0x74], al
movzx ecx, byte [edi + 0x75]
mov byte [esi + 0x75], cl
movzx edx, byte [edi + 0x76]
mov byte [esi + 0x76], dl
movzx eax, byte [edi + 0x77]
mov byte [esi + 0x77], al
movzx ecx, byte [edi + 0x78]
mov byte [esi + 0x78], cl
mov edx, dword [edi + 0x7c]
mov dword [esi + 0x7c], edx
movzx eax, byte [edi + 0x80]
mov byte [esi + 0x80], al
movzx ecx, byte [edi + 0x81]
mov byte [esi + 0x81], cl
movzx edx, byte [edi + 0x82]
mov byte [esi + 0x82], dl
movzx eax, byte [edi + 0x83]
mov byte [esi + 0x83], al
movzx ecx, byte [edi + 0x84]
mov byte [esi + 0x84], cl
mov edx, dword [edi + 0x88]
mov dword [esi + 0x88], edx
mov eax, dword [edi + 0x94]
mov dword [esi + 0x94], eax
pop edi
mov eax, esi
pop esi
ret 4
Function at 0x4119e0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x47e660
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a1824]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 4]
mov ecx, edi
call fcn.00436ee0
cmp byte [esi], 0
mov byte [esi + 0x14], 0
je 0x411b7f
push 0x48561c
lea eax, [esp + 0x2c]
push str.menu.inf
push eax
call fcn.00417cd0
push ecx
mov esi, esp
mov dword [esp + 0x2c], esp
push 0
mov ecx, eax
mov dword [esp + 0x4c], 0
call fcn.0041ed20
push eax
mov ecx, esi
call fcn.00437760
lea ecx, [esp + 0x30]
push ecx
call fcn.00437ef0
add esp, 0x10
mov ecx, eax
mov byte [esp + 0x3c], 1
call fcn.0041ed20
push eax
call fcn.00453b0a
mov ebx, eax
add esp, 8
test ebx, ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
setne byte [esp + 0x17]
mov byte [esp + 0x38], 0
call fcn.004374b0
lea ecx, [esp + 0x28]
mov dword [esp + 0x38], 0xffffffff
call fcn.004374b0
cmp byte [esp + 0x17], 0
je 0x411b69
push 2
push 0
push ebx
call fcn.004525e2
push ebx
call fcn.00452148
push 0
push 0
push ebx
mov ebp, eax
call fcn.004525e2
push ebp
call fcn.0041a3b0
mov esi, eax
add esp, 0x20
test esi, esi
mov dword [esp + 0x1c], esi
je 0x411b60
push ebx
push ebp
push 1
push esi
call fcn.00452540
add esp, 0x10
push 0x481c74
push ebp
push esi
mov ecx, edi
call fcn.00436af0
mov ecx, edi
xor ebp, ebp
call fcn.0041ed20
test eax, eax
jle 0x411b57
push ebp
mov ecx, edi
xor esi, esi
call fcn.00436a70
test eax, eax
jle 0x411b45
push ebp
mov ecx, edi
call fcn.00436a90
mov edx, dword [eax + 4]
lea ebx, [edx + esi*8]
mov ecx, ebx
call fcn.00438180
mov ecx, ebx
call fcn.00437c90
push ebp
mov ecx, edi
add esi, 1
call fcn.00436a70
cmp esi, eax
jl 0x411b16
mov ebx, dword [esp + 0x18]
mov ecx, edi
add ebp, 1
call fcn.0041ed20
cmp ebp, eax
jl 0x411b08
mov esi, dword [esp + 0x1c]
push esi
call fcn.0041a3c0
add esp, 4
push ebx
call fcn.00452228
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x411ba0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x47e690
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a1824]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x14], 0
je 0x411db7
add edi, 4
xor ebp, ebp
mov ecx, edi
mov dword [esp + 0x18], ebp
xor ebx, ebx
call fcn.0041ed20
test eax, eax
jle 0x411db7
push ebp
mov ecx, edi
xor esi, esi
call fcn.00436a70
test eax, eax
jle 0x411c2b
jmp 0x411c00
cmp esi, 2
jge 0x411c2b
push ebp
mov ecx, edi
call fcn.00436a90
mov eax, dword [eax + 4]
lea ecx, [eax + esi*8]
call fcn.00437590
add dword [esp + 0x18], eax
push ebp
mov ecx, edi
add esi, 1
call fcn.00436a70
cmp esi, eax
jl 0x411c00
add dword [esp + 0x18], 3
mov ecx, edi
add ebp, 1
call fcn.0041ed20
cmp ebp, eax
jl 0x411bed
mov eax, dword [esp + 0x18]
test eax, eax
jle 0x411db7
push eax
call fcn.0041a3b0
mov ebp, eax
add esp, 4
test ebp, ebp
mov dword [esp + 0x1c], ebp
je 0x411db7
xor esi, esi
mov ecx, edi
mov dword [esp + 0x18], esi
call fcn.0041ed20
test eax, eax
jle 0x411d16
push esi
mov ecx, edi
xor ebp, ebp
call fcn.00436a70
test eax, eax
jle 0x411cfc
cmp ebp, 2
jge 0x411cfc
push esi
mov ecx, edi
call fcn.00436a90
mov eax, dword [eax + 4]
lea esi, [eax + ebp*8]
mov ecx, esi
call fcn.00437590
push eax
mov ecx, esi
call fcn.0041ed20
push eax
mov eax, dword [esp + 0x24]
add eax, ebx
push eax
call fcn.00453b20
add esp, 0xc
mov ecx, esi
call fcn.00437590
add ebx, eax
mov eax, ebp
sub eax, 0
je 0x411cda
sub eax, 1
jne 0x411ce5
mov ecx, dword [esp + 0x1c]
mov word [ecx + ebx], 0xa0d
add ebx, 2
jmp 0x411ce5
mov edx, dword [esp + 0x1c]
mov byte [edx + ebx], 0x3d
add ebx, 1
mov eax, dword [esp + 0x18]
push eax
mov ecx, edi
add ebp, 1
call fcn.00436a70
cmp ebp, eax
mov esi, dword [esp + 0x18]
jl 0x411c84
add esi, 1
mov ecx, edi
mov dword [esp + 0x18], esi
call fcn.0041ed20
cmp esi, eax
jl 0x411c76
mov ebp, dword [esp + 0x1c]
push 0x48560c
lea ecx, [esp + 0x2c]
push str.menu.inf
push ecx
call fcn.00417cd0
push ecx
mov esi, esp
mov dword [esp + 0x2c], esp
push 0
mov ecx, eax
mov dword [esp + 0x4c], 0
call fcn.0041ed20
push eax
mov ecx, esi
call fcn.00437760
lea edx, [esp + 0x30]
push edx
call fcn.00437ef0
add esp, 0x10
mov ecx, eax
mov byte [esp + 0x3c], 1
call fcn.0041ed20
push eax
call fcn.00453b0a
mov esi, eax
add esp, 8
test esi, esi
lea ecx, [esp + 0x20]
setne byte [esp + 0x17]
mov byte [esp + 0x38], 0
call fcn.004374b0
lea ecx, [esp + 0x28]
mov dword [esp + 0x38], 0xffffffff
call fcn.004374b0
cmp byte [esp + 0x17], 0
je 0x411dae
push esi
push ebx
push 1
push ebp
call fcn.004538ad
push esi
call fcn.00452228
add esp, 0x14
push ebp
call fcn.0041a3c0
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x416150
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xd4
mov eax, dword [0x4a1824]
xor eax, esp
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0xd8]
push ebx
mov ebx, edx
cdq
push ebp
and edx, 3
push esi
add eax, edx
push edi
sar eax, 2
mov edi, ecx
mov dword [esp + 0x14], ebx
xor esi, esi
xor edx, edx
mov ecx, edi
mov dword [esp + 0x10], 0x10
mov edi, edi
mov ebp, ecx
shr ebp, 1
xor ebp, ecx
shr dx, 1
shl ebp, 0xf
or bp, dx
shr ecx, 2
sub dword [esp + 0x10], 1
movzx edx, bp
jne 0x416190
mov dword [esp + esi*4 + 0x20], edi
mov word [esp + esi*2 + 0xa0], dx
add esi, 1
rol edi, 1
cmp esi, 0x20
jl 0x416182
xor ebp, ebp
test eax, eax
mov dword [esp + 0x18], ebp
je 0x416269
mov esi, dword [ebx]
sub eax, 1
mov dword [esp + 0xe8], eax
movzx eax, word [esp + ebp*2 + 0xa0]
xor edi, edi
mov dword [esp + 0x10], eax
lea ebx, [edi + 3]
lea ecx, [edi + 2]
lea edx, [edi + 1]
mov dword [esp + 0x1c], 0x10
jmp 0x416200
test byte [esp + 0x10], 1
je 0x41621f
mov eax, ecx
mov ebp, esi
shr ebp, 1
shr eax, 1
and eax, ebp
mov ebp, edx
and ebp, esi
add ebp, ebp
or eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x416223
mov eax, ebx
and eax, esi
shr word [esp + 0x10], 1
add ebx, ebx
add ecx, ecx
add edx, edx
or edi, eax
add ebx, ebx
add ecx, ecx
add edx, edx
sub dword [esp + 0x1c], 1
jne 0x416200
mov ecx, dword [esp + ebp*4 + 0x20]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0xe8]
xor ecx, edi
add ebp, 1
mov dword [ebx], ecx
add ebx, 4
and ebp, 0x1f
test eax, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
jne 0x4161d0
mov ecx, dword [esp + 0xe0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00452be3
add esp, 0xd4
ret
Function at 0x418370
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47ed38
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4a1824]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x10]
xor edi, edi
push edi
push eax
lea ecx, [esp + 0x24]
call fcn.00437760
cmp byte [ebx + 0xc], 0
mov dword [esp + 0x30], edi
je 0x4183c1
lea ecx, [esp + 0x1c]
call fcn.004372a0
lea ecx, [esp + 0x1c]
call fcn.00437590
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x10]
cmp eax, edi
mov dword [esp + 0x14], eax
jle 0x418423
lea esp, [esp]
sub eax, edi
cdq
sub eax, edx
mov edx, dword [ebx + 0x14]
mov esi, eax
sar esi, 1
add esi, edi
lea ecx, [esi + esi*2]
mov eax, dword [edx + ecx*4]
mov ecx, dword [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x24]
push edx
mov ecx, ebx
call fcn.004182b0
test eax, eax
jle 0x41840f
lea edi, [esi + 1]
jmp 0x418415
jge 0x418421
mov dword [esp + 0x14], esi
cmp edi, dword [esp + 0x14]
jge 0x418423
mov eax, dword [esp + 0x14]
jmp 0x4183e0
mov edi, esi
cmp edi, dword [ebx + 0x10]
jge 0x418496
mov eax, dword [ebx + 0x14]
mov edx, dword [esp + 0x18]
lea edi, [edi + edi*2]
add edi, edi
add edi, edi
mov ecx, dword [edi + eax]
push ecx
push edx
lea eax, [esp + 0x24]
push eax
mov ecx, ebx
call fcn.004182b0
test eax, eax
jne 0x418496
mov eax, dword [ebp + 8]
test eax, eax
je 0x41845e
mov ecx, dword [ebx + 0x14]
mov edx, dword [edi + ecx + 4]
add edx, dword [ebx + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41846e
mov ecx, dword [ebx + 0x14]
mov edx, dword [edi + ecx + 8]
mov dword [eax], edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.004374b0
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
test eax, eax
je 0x4184a3
mov dword [eax], 0xffffffff
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4184b0
mov dword [eax], 0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.004374b0
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x429880
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xd4
mov eax, dword [0x4a1824]
xor eax, esp
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0xdc]
push ebx
mov ebx, dword [esp + 0xdc]
cdq
push ebp
and edx, 3
push esi
add eax, edx
push edi
sar eax, 2
mov edi, ecx
mov dword [esp + 0x14], ebx
xor esi, esi
jmp 0x4298c0
xor edx, edx
mov ecx, edi
mov dword [esp + 0x10], 0x10
lea esp, [esp]
mov ebp, ecx
shr ebp, 1
xor ebp, ecx
shr dx, 1
shl ebp, 0xf
or bp, dx
shr ecx, 2
sub dword [esp + 0x10], 1
movzx edx, bp
jne 0x4298d0
mov dword [esp + esi*4 + 0x20], edi
mov word [esp + esi*2 + 0xa0], dx
add esi, 1
rol edi, 1
cmp esi, 0x20
jl 0x4298c0
xor ebp, ebp
test eax, eax
mov dword [esp + 0x18], ebp
je 0x4299a9
mov esi, dword [ebx]
sub eax, 1
mov dword [esp + 0xec], eax
movzx eax, word [esp + ebp*2 + 0xa0]
xor edi, edi
mov dword [esp + 0x10], eax
lea ebx, [edi + 3]
lea ecx, [edi + 2]
lea edx, [edi + 1]
mov dword [esp + 0x1c], 0x10
jmp 0x429940
test byte [esp + 0x10], 1
je 0x42995f
mov eax, ecx
mov ebp, esi
shr ebp, 1
shr eax, 1
and eax, ebp
mov ebp, edx
and ebp, esi
add ebp, ebp
or eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x429963
mov eax, ebx
and eax, esi
shr word [esp + 0x10], 1
add ebx, ebx
add ecx, ecx
add edx, edx
or edi, eax
add ebx, ebx
add ecx, ecx
add edx, edx
sub dword [esp + 0x1c], 1
jne 0x429940
mov ecx, dword [esp + ebp*4 + 0x20]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0xec]
xor ecx, edi
add ebp, 1
mov dword [ebx], ecx
add ebx, 4
and ebp, 0x1f
test eax, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
jne 0x429910
mov ecx, dword [esp + 0xe0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00452be3
add esp, 0xd4
ret
Function at 0x432240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47faf8
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x4a1824]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
push edi
mov eax, dword [0x4a1824]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x24], ebx
call fcn.00436920
test al, al
je 0x43243e
mov eax, dword [ebp + 8]
cmp eax, dword [ebx + 0x14]
jge 0x43243e
mov eax, dword [ebx + 0xc]
lea edx, [esp + 0x64]
lea ecx, [esp + 0x28]
push edx
xor esi, esi
mov dword [esp + 0x78], ecx
mov edi, 4
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x6c], 0x24
mov dword [esp + 0x70], 0x18188
mov dword [esp + 0x74], 0x8000
mov dword [esp + 0x78], esi
mov word [esp + 0x30], 1
mov word [esp + 0x32], 2
mov dword [esp + 0x34], 0x5622
mov dword [esp + 0x38], 0x15888
mov word [esp + 0x3c], di
mov word [esp + 0x3e], 0x10
mov word [esp + 0x40], si
call fcn.00436890
push 0x8000
mov dword [esp + 0x9c], esi
call fcn.0045397e
add esp, 4
lea ecx, [esp + 0x5c]
push ecx
mov ebx, eax
call dword [0x481080]
mov dword [esp + 0x18], edi
mov edi, dword [0x48107c]
lea edx, [esp + 0x3c]
push edx
call edi
push 0
push ebx
push 0x8000
push 0
lea ecx, [esp + 0x54]
call fcn.004365f0
lea eax, [esp + 0x4c]
push eax
call edi
mov ecx, dword [esp + 0x4c]
sub ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x50]
sbb edx, dword [esp + 0x40]
test esi, esi
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], edx
fild qword [esp + 0x54]
mov dword [esp + 0x1c], esi
fmul qword [0x486100]
fild qword [esp + 0x5c]
fdivp st(1)
fild dword [esp + 0x1c]
jge 0x432391
fadd qword [0x485e00]
fnstcw word [esp + 0x16]
movzx eax, word [esp + 0x16]
faddp st(1)
or eax, 0xc00
sub dword [esp + 0x18], 1
mov dword [esp + 0x1c], eax
fldcw word [esp + 0x1c]
fistp qword [esp + 0x1c]
mov esi, dword [esp + 0x1c]
fldcw word [esp + 0x16]
jne 0x432336
push ebx
shr esi, 2
call fcn.004536c0
mov edi, dword [esp + 0x28]
mov ecx, dword [edi + 8]
add esp, 4
cmp ecx, 1
jle 0x4323e1
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
jmp 0x4323e6
mov eax, 1
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x1c]
push edx
shl eax, 0x10
push eax
mov eax, dword [ebp + 0x18]
push eax
mov edx, 0x2bc
cmp edx, esi
sbb eax, eax
mov edx, dword [ebp + 0xc]
and eax, 0x7000
add eax, 0x7000
imul eax, ecx
mov ecx, dword [ebp + 0x10]
push eax
mov eax, dword [edi + 0xc]
push ecx
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x3c8
add ecx, dword [edi + 0x18]
push edx
push eax
call fcn.00435d50
lea ecx, [esp + 0x44]
mov dword [esp + 0x98], 0xffffffff
call fcn.004368d0
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00452be3
mov esp, ebp
pop ebp
ret 0x18
Function at 0x437ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47ff59
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x4a1824]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x28]
push eax
mov ecx, esi
mov dword [esp + 0x20], 1
call fcn.00437780
mov ecx, dword [esp + 0x30]
push 0
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], 1
call fcn.00437760
lea edx, [esp + 0xc]
push edx
mov ecx, esi
mov byte [esp + 0x20], 2
call fcn.004375e0
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call fcn.004374b0
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call fcn.004374b0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret
Function at 0x43d240
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
shr eax, 1
test dl, 1
je 0x43d250
xor eax, 0xedb88320
test al, 1
je 0x43d25d
shr eax, 1
xor eax, 0xedb88320
jmp 0x43d25f
shr eax, 1
test al, 1
je 0x43d26c
shr eax, 1
xor eax, 0xedb88320
jmp 0x43d26e
shr eax, 1
test al, 1
je 0x43d27b
shr eax, 1
xor eax, 0xedb88320
jmp 0x43d27d
shr eax, 1
test al, 1
je 0x43d28a
shr eax, 1
xor eax, 0xedb88320
jmp 0x43d28c
shr eax, 1
test al, 1
je 0x43d299
shr eax, 1
xor eax, 0xedb88320
jmp 0x43d29b
shr eax, 1
test al, 1
je 0x43d2a8
shr eax, 1
xor eax, 0xedb88320
jmp 0x43d2aa
shr eax, 1
test al, 1
je 0x43d2b7
shr eax, 1
xor eax, 0xedb88320
jmp 0x43d2b9
shr eax, 1
mov dword [ecx + edx*4], eax
add edx, 1
cmp edx, 0x100
jl 0x43d242
ret

Function at 0x43d2d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
or eax, 0xffffffff
test edx, edx
push edi
mov edi, ecx
je 0x43d2fe
movzx ecx, byte [esi]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [edi + ecx*4]
sub edx, 1
add esi, 1
test edx, edx
jne 0x43d2e3
pop edi
not eax
pop esi
ret 8
Function at 0x446b50
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x446b80
push esi
call fcn.00449c80
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x446b79
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x446c03
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x446bef
mov eax, dword [esi + 8]
test eax, eax
je 0x446ba4
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x446beb
cmp eax, 2
je 0x446bef
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x446b97
cmp eax, 3
je 0x446bca
cmp eax, 1
jne 0x446b97
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x446b97
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x446b97
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.00446c30
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x446c23
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.00446c30
add esp, 4
pop esi
ret

Function at 0x4478f0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 0xc]
cmp ecx, 0xc
jb 0x4479aa
mov eax, dword [esp + 8]
cmp byte [eax], 0x41
jne 0x4479aa
cmp byte [eax + 1], 0x64
jne 0x4479aa
cmp byte [eax + 2], 0x6f
jne 0x4479aa
cmp byte [eax + 3], 0x62
jne 0x4479aa
cmp byte [eax + 4], 0x65
jne 0x4479aa
push ebx
xor ecx, ecx
mov cl, byte [eax + 7]
push ebp
push esi
push edi
mov edi, ecx
xor edx, edx
mov dl, byte [eax + 8]
xor ecx, ecx
mov cl, byte [eax + 9]
mov esi, dword [esp + 0x14]
shl edi, 8
add edi, edx
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov dl, byte [eax + 0xa]
mov cl, byte [eax + 0xb]
shl ebp, 8
add ebp, edx
xor edx, edx
mov dl, byte [eax + 5]
xor ebx, ebx
mov bl, byte [eax + 6]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi]
mov dword [ecx + 0x1c], edi
shl edx, 8
add ecx, 0x18
add edx, ebx
mov ebx, dword [esp + 0x1c]
push 1
mov dword [ecx], edx
mov dword [ecx + 8], ebp
mov dword [ecx + 0xc], ebx
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x4c
mov ecx, dword [esi]
call dword [ecx + 4]
add esp, 8
mov byte [esi + 0x108], 1
mov byte [esi + 0x109], bl
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 4]
push 1
push eax
mov edx, dword [eax]
mov dword [edx + 0x14], 0x4e
mov edx, dword [esp + 0x18]
add ecx, edx
mov edx, dword [eax]
mov dword [edx + 0x18], ecx
mov ecx, dword [eax]
call dword [ecx + 4]
add esp, 8
ret
Function at 0x4522a4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4522e1
cmp dword [ebp + 0x14], edi
je 0x4522e1
cmp ecx, edi
jne 0x4522e8
call fcn.00455b32
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00456618
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4522fc
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x45231d
cmp ebx, 0xffffffff
je 0x45230c
push ebx
push edi
push ecx
call fcn.00453e90
add esp, 0xc
cmp esi, edi
je 0x4522c9
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4522c9
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x452339
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x452340
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x452431
test word [esi + 0xc], 0x10c
je 0x452394
mov eax, dword [esi + 4]
test eax, eax
je 0x452394
jl 0x452492
cmp ebx, eax
mov edi, ebx
jb 0x452365
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x452439
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004574c8
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x452429
cmp ebx, dword [ebp - 0xc]
jb 0x452401
cmp dword [ebp - 0xc], 0
je 0x4523be
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x4523b3
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4523ba
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4523c9
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x4523c9
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x452465
push eax
push dword [ebp - 8]
push esi
call fcn.004564e5
pop ecx
push eax
call fcn.004573cb
add esp, 0xc
test eax, eax
je 0x4524a4
cmp eax, 0xffffffff
je 0x452492
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x452429
push esi
call fcn.00456cea
cmp eax, 0xffffffff
pop ecx
je 0x452496
cmp dword [ebp - 4], 0
je 0x452465
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x452348
mov eax, dword [ebp + 0x14]
jmp 0x4522e3
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x452450
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00453e90
add esp, 0xc
call fcn.00455b32
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4522d9
cmp dword [ebp + 0xc], 0xffffffff
je 0x45247b
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00453e90
add esp, 0xc
call fcn.00455b32
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4522d9
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4522e3
or dword [esi + 0xc], 0x10
jmp 0x452496