joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bfa10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cdc25
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100e4040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100bf9a0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100bfa9a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100bfbe0
cmp dword [ebx + 8], 0xfffffff
jne 0x100bfaae
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100c207a
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100d84e0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100d84e0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100bfb93
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100c3420
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100bfb75
cmp eax, 0x200
jae 0x100bfb73
shl eax, 3
cmp eax, ecx
jae 0x100bfb75
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10088200
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100bf9a0
mov edx, dword [eax]
jmp 0x100bfb96
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100bfbc1
mov dword [ecx + eax*8], esi
jmp 0x100bfbd3
cmp ebx, edx
jne 0x100bfbca
mov dword [ecx + eax*8], esi
jmp 0x100bfbd7
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100bfbd7
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100c0080
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cdc25
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100e4040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100bf9a0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100c010a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100c0252
cmp dword [ebx + 8], 0xfffffff
jne 0x100c011e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100c207a
mov edx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100d84e0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100d84e0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100c0205
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100c3420
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100c01e7
cmp eax, 0x200
jae 0x100c01e5
shl eax, 3
cmp eax, ecx
jae 0x100c01e7
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10088200
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100bf9a0
mov edx, dword [eax]
jmp 0x100c0208
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100c0233
mov dword [ecx + eax*8], esi
jmp 0x100c0245
cmp ebx, edx
jne 0x100c023c
mov dword [ecx + eax*8], esi
jmp 0x100c0249
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100c0249
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x408800
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0xc], ecx
push edi
xor ebp, ebp
mov dword [esp + 0x14], ebx
xor edi, edi
push 1
push 0xa
call dword [sym.imp.KERNEL32.dll_SleepEx]
mov esi, 8
cmp esi, 0xa2
je 0x4088be
cmp esi, 0xa3
je 0x4088be
cmp esi, 0xa4
je 0x4088be
cmp esi, 0xa5
je 0x4088be
cmp esi, 0xa0
je 0x4088be
cmp esi, 0xa1
je 0x4088be
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x40888e
cmp esi, 0x1b
je 0x4088df
cmp esi, 0x11
jne 0x408878
lea ebx, [esi - 0x10]
inc esi
jmp 0x408824
cmp esi, 0x10
jne 0x408883
lea ebp, [esi - 0xf]
inc esi
jmp 0x408824
cmp esi, 0x12
jne 0x4088e9
lea edi, [esi - 0x11]
inc esi
jmp 0x408824
cmp esi, 0x11
jne 0x40889e
test ebx, ebx
jne 0x408930
inc esi
jmp 0x408824
cmp esi, 0x10
jne 0x4088b1
test ebp, ebp
jne 0x40895d
inc esi
jmp 0x408824
cmp esi, 0x12
jne 0x4088be
test edi, edi
jne 0x40898a
inc esi
cmp esi, 0xfe
jl 0x408824
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x1f4
jl 0x408815
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
mov dword [ebx + 0x18], esi
call ebp
xor ecx, ecx
test ax, ax
push 0x11
setne cl
mov dword [ebx + 0x20], ecx
call ebp
xor ecx, ecx
test ax, ax
push 0x12
setne cl
mov dword [ebx + 0x1c], ecx
call ebp
xor ecx, ecx
test ax, ax
pop edi
pop esi
setne cl
mov eax, 1
pop ebp
mov dword [ebx + 0x24], ecx
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax + 0x18], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x1c], 1
mov dword [eax + 0x24], 0
mov eax, 1
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax + 0x18], 0
mov dword [eax + 0x20], 1
mov dword [eax + 0x1c], 0
mov dword [eax + 0x24], 0
mov eax, 1
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax + 0x18], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x24], 1
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x4251a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b895
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x56a040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
call fcn.004d7c03
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [eax], 0x424c10
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x4262a0
push 0
push 0
call fcn.004e4926
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x425234
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 1
call fcn.0041f360
cmp dword [ebp - 0x18], 0
jne 0x42522f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d7bf5
mov esp, ebp
pop ebp
ret
call fcn.004e49b7
push 6
mov dword [ebp - 0x18], 0
call fcn.004d9ded
int3

Function at 0x42ad80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c2b0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x56a040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.004d7c03
mov esi, eax
vpxor xmm0, xmm0, xmm0
vmovq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004d9b1a
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.0042af80
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x432b50
Capabilities:
Create thread
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x3c
mov eax, dword [0x56a040]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
lea eax, [esp + 0x10]
push eax
push dword [0x67355c]
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [esp + 0x18], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [ebp + 8]
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x10]
vpxor xmm0, xmm0, xmm0
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
mov dword [esi + 4], eax
mov eax, dword [0x67353c]
vmovdqu xmmword [esp + 0x20], xmm0
test eax, eax
je 0x432bb7
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 0x2c]
mov eax, esi
sub ecx, dword [esp + 0x24]
sub dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x3c]
pop esi
xor ecx, esp
call fcn.004d7bf5
mov esp, ebp
pop ebp
ret
Function at 0x43f831
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov ecx, dword [0x67d5d4]
push ebx
push esi
push edi
lea eax, [ecx - 0x8000000]
cmp eax, 0xffff
ja 0x43f8fe
cmp dword [0x673568], 1
je 0x43f8c5
push 0
push 0
push dword [0x22c3224]
call fcn.004e014e
push dword [0x22c3224]
push 0x8000
push 1
push 0x673580
call fcn.004e3264
mov esi, dword [0x67d5d8]
add esp, 0x1c
and esi, 0xffffff
mov edx, 0
add esi, 1
je 0x43f88d
mov edi, dword [0x67d5d4]
mov ebx, dword [0x67d5d0]
add edi, 0xf8000000
nop dword [eax + eax]
lea eax, [ebx + edx]
xor eax, 3
lea ecx, [edi + edx]
xor ecx, 3
inc edx
mov al, byte [eax + 0x8bdfc0]
mov byte [ecx + 0x673580], al
cmp edx, esi
jb 0x43f870
push 0
push 0
push dword [0x22c3224]
call fcn.004e014e
push dword [0x22c3224]
push 0x8000
push 1
push 0x673580
call fcn.004e3051
add esp, 0x1c
mov dword [0x673568], 0xffffffff
jmp 0x43f9f7
mov ecx, dword [0x27d6f90]
mov eax, ecx
sub eax, 2
je 0x43f8ef
push ecx
push str.unknown_dma_read_flashram:_x_n
call fcn.00403a40
add esp, 8
mov dword [0x22c318c], 1
jmp 0x43f9f7
mov eax, dword [0x67d5d0]
mov dword [0x27d61dc], eax
jmp 0x43f9f7
cmp dword [0x27d6e64], 0
je 0x43f9ea
mov esi, dword [0x67d5d8]
lea edx, [ecx - 0x1ffe0000]
and esi, 0xffffff
inc esi
cmp edx, 0xffff
ja 0x43f984
test esi, esi
je 0x43f966
mov edi, dword [0x67d5d0]
mov ebx, 0x1ffe0000
sub ebx, ecx
cmp edi, 0x7fffff
ja 0x43f966
cmp edx, 0x1fff
ja 0x43f966
mov eax, edi
mov ecx, edx
xor eax, 3
xor ecx, 3
inc edx
inc edi
mov al, byte [eax + 0x8bdfc0]
mov byte [ecx + 0x22c0b80], al
lea eax, [ebx + edx]
cmp eax, esi
jb 0x43f937
or dword [0x67d5e0], 1
shr esi, 3
call fcn.00464810
pop edi
mov edx, esi
mov ecx, 0x10
pop esi
pop ebx
jmp fcn.004555f0
lea eax, [ecx - 0x10000000]
cmp eax, 0x3ffffff
ja 0x43f966
cmp byte [0x22c2b90], 0
je 0x43f966
xor edx, edx
test esi, esi
je 0x43f966
mov edi, dword [0x27c3c80]
nop word [eax + eax]
mov eax, dword [0x67d5d0]
add ecx, 0xf0000000
add eax, edx
add ecx, edx
cmp eax, 0x7fffff
ja 0x43f966
cmp ecx, 0x3ffffff
ja 0x43f966
xor eax, 3
xor ecx, 3
inc edx
mov al, byte [eax + 0x8bdfc0]
mov byte [ecx + edi], al
cmp edx, esi
jae 0x43f966
mov ecx, dword [0x67d5d4]
jmp 0x43f9b0
push str.unknown_dma_read_n
call fcn.00403a40
add esp, 4
or dword [0x67d5e0], 1
mov esi, 0x1000
call fcn.00464810
pop edi
mov edx, esi
mov ecx, 0x10
pop esi
pop ebx
jmp fcn.004555f0
Function at 0x44024a
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ecx
mov ecx, dword [0x81df08]
mov eax, ecx
and eax, 0xff000000
cmp eax, 0xb4000000
ja 0x4401b6
je 0x4401aa
cmp eax, 0x4b000000
je 0x44019d
cmp eax, 0x78000000
je 0x44017d
cmp eax, 0xa5000000
jne 0x4401cb
movzx eax, cx
shl eax, 7
mov dword [0x27d61d8], eax
mov dword [0x27d6f88], 0xc20000
mov dword [0x27d6f8c], 0x11118004
pop ecx
ret
mov dword [0x27d6f90], 1
mov dword [0x27d6f88], 0xc20000
mov dword [0x27d6f8c], 0x11118008
pop ecx
ret
movzx eax, cx
shl eax, 7
mov dword [0x27d61d8], eax
pop ecx
ret
mov dword [0x27d6f90], 2
pop ecx
ret
cmp eax, 0xd2000000
je 0x44021b
cmp eax, 0xe1000000
je 0x4401fb
cmp eax, 0xf0000000
je 0x4401db
push ecx
push str.unknown_flashram_command:_x_n
call fcn.00403a40
add esp, 8
pop ecx
ret
mov dword [0x27d6f90], 3
mov dword [0x27d6f88], 0xf0000000
mov dword [0x27d6f8c], 0x11118004
pop ecx
ret
mov dword [0x27d6f90], 4
mov dword [0x27d6f88], 0xc20000
mov dword [0x27d6f8c], 0x11118001
pop ecx
ret
mov eax, dword [0x27d6f90]
cmp eax, 4
ja case.0x440229.3
jmp dword [eax*4 + 0x44033c]
push 0
push 0
push dword [0x22c3224]
call fcn.004e014e
push dword [0x22c3224]
push 0x20000
push 1
push 0x67d640
call fcn.004e3264
mov ecx, dword [0x27d61d8]
add esp, 0x1c
lea edx, [ecx + 0x80]
cmp ecx, edx
jae 0x440281
nop dword [eax]
mov eax, ecx
inc ecx
xor eax, 3
mov byte [eax + 0x67d640], 0xff
cmp ecx, edx
jb 0x440270
push 0
push 0
push dword [0x22c3224]
call fcn.004e014e
push dword [0x22c3224]
push 0x20000
push 1
push 0x67d640
call fcn.004e3051
add esp, 0x1c
mov dword [0x27d6f90], 0
pop ecx
ret
push esi
push edi
push 0
push 0
push dword [0x22c3224]
call fcn.004e014e
push dword [0x22c3224]
push 0x20000
push 1
push 0x67d640
call fcn.004e3264
mov edi, dword [0x27d61dc]
add esp, 0x1c
mov edx, dword [0x27d61d8]
mov esi, 0x80
sub edi, edx
lea eax, [edi + edx]
mov ecx, edx
xor eax, 3
xor ecx, 3
inc edx
mov al, byte [eax + 0x8bdfc0]
mov byte [ecx + 0x67d640], al
sub esi, 1
jne 0x4402f4
pop edi
pop esi
jmp 0x440281
push eax
push str.unknown_flashram_command_with_mode:_x_n
call fcn.00403a40
add esp, 8
mov dword [0x22c318c], 1
mov dword [0x27d6f90], 0
pop ecx
ret
Function at 0x4402d2
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ecx
mov ecx, dword [0x81df08]
mov eax, ecx
and eax, 0xff000000
cmp eax, 0xb4000000
ja 0x4401b6
je 0x4401aa
cmp eax, 0x4b000000
je 0x44019d
cmp eax, 0x78000000
je 0x44017d
cmp eax, 0xa5000000
jne 0x4401cb
movzx eax, cx
shl eax, 7
mov dword [0x27d61d8], eax
mov dword [0x27d6f88], 0xc20000
mov dword [0x27d6f8c], 0x11118004
pop ecx
ret
mov dword [0x27d6f90], 1
mov dword [0x27d6f88], 0xc20000
mov dword [0x27d6f8c], 0x11118008
pop ecx
ret
movzx eax, cx
shl eax, 7
mov dword [0x27d61d8], eax
pop ecx
ret
mov dword [0x27d6f90], 2
pop ecx
ret
cmp eax, 0xd2000000
je 0x44021b
cmp eax, 0xe1000000
je 0x4401fb
cmp eax, 0xf0000000
je 0x4401db
push ecx
push str.unknown_flashram_command:_x_n
call fcn.00403a40
add esp, 8
pop ecx
ret
mov dword [0x27d6f90], 3
mov dword [0x27d6f88], 0xf0000000
mov dword [0x27d6f8c], 0x11118004
pop ecx
ret
mov dword [0x27d6f90], 4
mov dword [0x27d6f88], 0xc20000
mov dword [0x27d6f8c], 0x11118001
pop ecx
ret
mov eax, dword [0x27d6f90]
cmp eax, 4
ja case.0x440229.3
jmp dword [eax*4 + 0x44033c]
push 0
push 0
push dword [0x22c3224]
call fcn.004e014e
push dword [0x22c3224]
push 0x20000
push 1
push 0x67d640
call fcn.004e3264
mov ecx, dword [0x27d61d8]
add esp, 0x1c
lea edx, [ecx + 0x80]
cmp ecx, edx
jae 0x440281
nop dword [eax]
mov eax, ecx
inc ecx
xor eax, 3
mov byte [eax + 0x67d640], 0xff
cmp ecx, edx
jb 0x440270
push 0
push 0
push dword [0x22c3224]
call fcn.004e014e
push dword [0x22c3224]
push 0x20000
push 1
push 0x67d640
call fcn.004e3051
add esp, 0x1c
mov dword [0x27d6f90], 0
pop ecx
ret
push esi
push edi
push 0
push 0
push dword [0x22c3224]
call fcn.004e014e
push dword [0x22c3224]
push 0x20000
push 1
push 0x67d640
call fcn.004e3264
mov edi, dword [0x27d61dc]
add esp, 0x1c
mov edx, dword [0x27d61d8]
mov esi, 0x80
sub edi, edx
lea eax, [edi + edx]
mov ecx, edx
xor eax, 3
xor ecx, 3
inc edx
mov al, byte [eax + 0x8bdfc0]
mov byte [ecx + 0x67d640], al
sub esi, 1
jne 0x4402f4
pop edi
pop esi
jmp 0x440281
push eax
push str.unknown_flashram_command_with_mode:_x_n
call fcn.00403a40
add esp, 8
mov dword [0x22c318c], 1
mov dword [0x27d6f90], 0
pop ecx
ret

Function at 0x447210
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
vpxor xmm0, xmm0, xmm0
vmovdqu ymmword [ecx], ymm0
vmovq qword [ecx + 0x20], xmm0
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, ecx
mov dword [ecx + 0x24], 0x56d258
vzeroupper
ret 4
Function at 0x44b2b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d785
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
push esi
push edi
mov eax, dword [0x56a040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x56cfd0], 0xf
mov edx, 0x56cfbc
mov edi, dword [ebx + 8]
mov esi, 0x811c9dc5
cmova edx, dword [0x56cfbc]
xor ecx, ecx
mov dword [ebp - 0x1c], edi
cmp dword [0x56cfcc], ecx
jbe 0x44b328
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [0x56cfcc]
jb 0x44b313
push esi
push 0x56cfbc
lea eax, [ebp - 0x24]
push eax
call fcn.0044b850
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x44b34b
mov dword [edi], eax
mov eax, edi
mov byte [edi + 4], 0
jmp 0x44b4c2
cmp dword [0x2a97808], 0x5d1745d
je 0x44b4d8
mov dword [ebp - 0x2c], 0x2a97804
mov dword [ebp - 4], 0
push 0x2c
mov dword [ebp - 0x28], 0
call fcn.004d7c03
mov edi, eax
add esp, 4
mov dword [ebp - 0x28], edi
lea ecx, [edi + 8]
push 0x56cfbc
call fcn.00407fb0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [ebp - 4], 1
mov edx, dword [0x2a97808]
mov ecx, dword [0x2a9781c]
vxorps xmm0, xmm0, xmm0
mov dword [ebp - 0x14], ecx
lea eax, [edx + 1]
vcvtsi2sd xmm0, xmm0, eax
mov dword [ebp - 0x18], eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x55dd60]
vcvtsd2ss xmm1, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, ecx
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, ecx
vaddsd xmm0, xmm0, qword [eax*8 + 0x55dd60]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm1, xmm0
vmovss xmm1, dword [0x2a97800]
vcomiss xmm0, xmm1
seta al
test al, al
je 0x44b46e
mov eax, dword [ebp - 0x18]
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x55dd60]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm0, xmm1
call fcn.00447df0
call fcn.004d8410
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebp - 0x14]
cmp eax, ecx
jae 0x44b450
cmp eax, 0x200
jae 0x44b44e
shl eax, 3
cmp eax, ecx
jae 0x44b450
mov eax, ecx
push eax
call fcn.0044b640
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0044b850
mov edx, dword [0x2a97808]
mov ecx, dword [eax]
jmp 0x44b471
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 4]
inc edx
mov dword [0x2a97808], edx
mov dword [edi], ecx
mov dword [edi + 4], eax
mov dword [eax], edi
mov dword [ecx + 4], edi
and esi, dword [0x2a97818]
mov dword [ebp - 0x14], eax
mov eax, dword [0x2a9780c]
mov edx, dword [eax + esi*8]
cmp edx, dword [0x2a97804]
jne 0x44b4a3
mov dword [eax + esi*8], edi
jmp 0x44b4b5
cmp edx, ecx
jne 0x44b4ac
mov dword [eax + esi*8], edi
jmp 0x44b4b9
mov ecx, dword [ebp - 0x14]
cmp dword [eax + esi*8 + 4], ecx
jne 0x44b4b9
mov dword [eax + esi*8 + 4], edi
mov eax, dword [ebp - 0x1c]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
push str.unordered_map_set_too_long
call fcn.004d9574
int3
Function at 0x44bd40
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
push 2
push 0xfffffe00
push ebx
mov dword [esp + 0x1c], edx
mov esi, ecx
mov edi, 0x80
call fcn.004e014e
push ebx
push 0x200
push 1
push esi
call fcn.004e3264
push 0
push 0
push ebx
call fcn.004e014e
mov ebx, dword [esi + 0x28]
add esp, 0x28
mov esi, dword [esi + 0x2c]
bswap ebx
bswap esi
shrd esi, ebx, 9
shr ebx, 9
test ebx, ebx
jne 0x44bd95
test esi, esi
je 0x44bdde
mov ebp, dword [esp + 0x1c]
nop dword [eax]
xor eax, eax
cmp eax, ebx
jb 0x44bdae
ja 0x44bdac
cmp edi, esi
jbe 0x44bdae
mov edi, esi
push dword [esp + 0x18]
push 0x200
push edi
push ebp
call fcn.004e3264
push dword [esp + 0x20]
push 0x200
push edi
push ebp
call fcn.004e3051
add esp, 0x20
sub esi, edi
sbb ebx, 0
jne 0x44bda0
jb 0x44bdde
test esi, esi
jne 0x44bda0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x44bfc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20c
mov eax, dword [0x56a040]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
mov ebp, dword [0x22c2b88]
mov ebx, ecx
push esi
push edi
mov edi, dword [0x22c2b8c]
mov esi, edx
push 2
push 0xfffffe00
push ebx
call fcn.004e014e
add esp, 0xc
test eax, eax
je 0x44c016
cmp dword [0x27d6f38], 0
jne 0x44c0e4
push 0x40
push esi
push str.Seek_1__error.
jmp 0x44c0d8
push ebx
push 0x200
lea eax, [esp + 0x18]
push 1
push eax
call fcn.004e3264
add esp, 0x10
cmp eax, 0x200
je 0x44c04c
cmp dword [0x27d6f38], 0
jne 0x44c0e4
push 0x40
push esi
push str.Read_error.
jmp 0x44c0d8
lea eax, [esp + 0x10]
cmp dword [eax], 0x656e6f63
jne 0x44c0c7
cmp dword [eax + 4], 0x78697463
jne 0x44c0c7
mov eax, dword [esp + 0x4c]
bswap eax
cmp eax, 2
je 0x44c07f
cmp dword [0x27d6f38], 0
jne 0x44c0e4
push 0x40
push esi
push str.Invalid_VHD_type:_must_be_a_fixed_disk.
jmp 0x44c0d8
mov ecx, dword [esp + 0x38]
xor eax, eax
mov edx, dword [esp + 0x3c]
bswap ecx
bswap edx
shrd edx, ecx, 9
shr ecx, 9
add ebp, edi
adc eax, eax
cmp eax, ecx
jb 0x44c0a2
ja 0x44c0e4
cmp ebp, edx
ja 0x44c0e4
push 0
shl edi, 9
push edi
push ebx
call fcn.004e014e
add esp, 0xc
test eax, eax
je 0x44c0c3
mov edx, esi
mov ecx, str.Seek_2__error.
call fcn.0044bfa0
jmp 0x44c0e7
xor eax, eax
jmp 0x44c0e7
cmp dword [0x27d6f38], 0
jne 0x44c0e4
push 0x40
push esi
push str.Invalid_VHD_file.
push dword [0x67355c]
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004d7bf5
add esp, 0x20c
ret