joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c740
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x78
mov eax, dword [0x42c400]
xor eax, esp
mov dword [esp + 0x70], eax
xor eax, eax
push ebp
mov ebp, dword [esp + 0x84]
push esi
push edi
mov dword [esp + 0x6d], eax
mov dword [esp + 0x71], eax
mov dword [esp + 0x75], eax
mov word [esp + 0x79], ax
mov byte [esp + 0x7b], al
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x88]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x70], 0
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.0040c5c0
add esp, 4
lea esi, [esp + 0x10]
lea ecx, [esp + 0x6c]
call fcn.0040c660
xor edi, edi
xor esi, esi
cmp edi, 0x10
jge 0x40c7e8
movzx eax, byte [esp + edi + 0x6c]
push eax
lea ecx, [esi + ebp]
push str._02x
push ecx
call fcn.00413567
add esi, 2
add esp, 0xc
add edi, 1
cmp esi, 0x22
jle 0x40c7c1
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0041310b
add esp, 0x78
ret

Function at 0x40e500
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x40e507
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.0040e510
Function at 0x40e510
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x40e542
lea esp, [esp]
test cl, 3
je 0x40e542
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x427aa8]
add ecx, 1
sub esi, 1
jne 0x40e520
cmp esi, 0x20
push ebx
push edi
jb 0x40e72c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x427ea8]
xor edx, dword [ebx*4 + 0x4282a8]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x427aa8]
add ecx, 4
xor edx, dword [eax*4 + 0x4286a8]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x427ea8]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4282a8]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x427aa8]
add ecx, 4
xor eax, dword [edx*4 + 0x4286a8]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x427ea8]
xor edx, dword [ebx*4 + 0x4282a8]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x427aa8]
xor edx, dword [eax*4 + 0x4286a8]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x427ea8]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4282a8]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x427aa8]
xor eax, dword [edx*4 + 0x4286a8]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x427ea8]
xor edx, dword [ebx*4 + 0x4282a8]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x427aa8]
xor edx, dword [eax*4 + 0x4286a8]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x427ea8]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4282a8]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x427aa8]
and edx, 0xff
xor eax, dword [edx*4 + 0x4286a8]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x427ea8]
xor edx, dword [ebx*4 + 0x4282a8]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x427aa8]
add ecx, 4
xor edx, dword [eax*4 + 0x4286a8]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x427ea8]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4282a8]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x427aa8]
and edx, 0xff
xor eax, dword [edx*4 + 0x4286a8]
sub edi, 1
jne 0x40e552
cmp esi, 4
jb 0x40e779
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x427ea8]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x4282a8]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x427aa8]
and eax, 0xff
xor edi, dword [eax*4 + 0x4286a8]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x40e736
test esi, esi
pop edi
pop ebx
je 0x40e79d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x427aa8]
add ecx, 1
sub esi, 1
jne 0x40e780
not eax
pop esi
ret
Function at 0x41310b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c400]
jne 0x413115
repz ret
jmp fcn.004164f9
Function at 0x414a1d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x414a5a
cmp dword [ebp + 0x14], edi
je 0x414a5a
cmp ecx, edi
jne 0x414a61
call fcn.00415939
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00417448
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x414a75
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x414a96
cmp ebx, 0xffffffff
je 0x414a85
push ebx
push edi
push ecx
call fcn.0041c150
add esp, 0xc
cmp esi, edi
je 0x414a42
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x414a42
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x414ab2
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x414ab9
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x414baa
test word [esi + 0xc], 0x10c
je 0x414b0d
mov eax, dword [esi + 4]
test eax, eax
je 0x414b0d
jl 0x414c0b
cmp ebx, eax
mov edi, ebx
jb 0x414ade
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x414bb2
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0041c9a8
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x414ba2
cmp ebx, dword [ebp - 0xc]
jb 0x414b7a
cmp dword [ebp - 0xc], 0
je 0x414b37
mov ecx, closesocket
xor edx, edx
cmp ebx, ecx
jbe 0x414b2c
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x414b33
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x414b42
mov eax, closesocket
cmp ebx, eax
ja 0x414b42
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x414bde
push eax
push dword [ebp - 8]
push esi
call fcn.0041ab90
pop ecx
push eax
call fcn.0041c8ab
add esp, 0xc
test eax, eax
je 0x414c1d
cmp eax, 0xffffffff
je 0x414c0b
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x414ba2
push esi
call fcn.0041c1ca
cmp eax, 0xffffffff
pop ecx
je 0x414c0f
cmp dword [ebp - 4], 0
je 0x414bde
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x414ac1
mov eax, dword [ebp + 0x14]
jmp 0x414a5c
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x414bc9
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0041c150
add esp, 0xc
call fcn.00415939
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x414a52
cmp dword [ebp + 0xc], 0xffffffff
je 0x414bf4
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0041c150
add esp, 0xc
call fcn.00415939
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x414a52
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x414a5c
or dword [esi + 0xc], 0x10
jmp 0x414c0f
Function at 0x41994a
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x42c540]
je 0x419965
inc edi
cmp edi, 0x17
jb 0x419956
cmp edi, 0x17
jae 0x419ae5
push ebp
push 3
call fcn.0041f9b3
cmp eax, 1
pop ecx
je 0x419ab1
push 3
call fcn.0041f9b3
test eax, eax
pop ecx
jne 0x419999
cmp dword [section..data], 1
je 0x419ab1
cmp ebx, 0xfc
je 0x419ae4
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x42d9e8
push ebp
call fcn.00417039
add esp, 0xc
test eax, eax
je 0x4199cf
push esi
push esi
push esi
push esi
push esi
call fcn.0041734c
add esp, 0x14
push 0x104
mov esi, 0x42da01
push esi
push 0
mov byte [0x42db05], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x419a13
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00417039
add esp, 0xc
test eax, eax
je 0x419a13
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0041734c
add esp, 0x14
push esi
call fcn.004171d0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x419a58
push esi
call fcn.004171d0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x42dcfc
push 0x4239cc
sub ecx, eax
push ecx
push eax
call fcn.00413fbc
add esp, 0x14
test eax, eax
je 0x419a58
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0041734c
add esp, 0x14
jmp 0x419a5a
xor esi, esi
push 0x4239c8
push ebx
push ebp
call fcn.0041f942
add esp, 0xc
test eax, eax
je 0x419a7a
push esi
push esi
push esi
push esi
push esi
call fcn.0041734c
add esp, 0x14
push dword [edi*8 + 0x42c544]
push ebx
push ebp
call fcn.0041f942
add esp, 0xc
test eax, eax
je 0x419a9c
push esi
push esi
push esi
push esi
push esi
call fcn.0041734c
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0041f785
add esp, 0xc
jmp 0x419ae4
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x419ae4
cmp ebp, 0xffffffff
je 0x419ae4
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x42c544]
push dword [esi]
call fcn.004171d0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x41f785
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0041a4b6
xor ebx, ebx
cmp dword [0x42dea0], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x41f85b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x41f93b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x423ecc
push edi
call esi
cmp eax, ebx
je 0x41f93b
push eax
call fcn.0041a448
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42dea0], eax
call esi
push eax
call fcn.0041a448
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42dea4], eax
call esi
push eax
call fcn.0041a448
mov dword [0x42dea8], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00416ad0
test eax, eax
pop ecx
pop ecx
je 0x41f829
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041734c
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x41f85b
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0041a448
cmp eax, ebx
pop ecx
mov dword [0x42deb0], eax
je 0x41f85b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041a448
pop ecx
mov dword [0x42deac], eax
mov eax, dword [0x42deac]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x41f8e0
cmp dword [0x42deb0], ecx
je 0x41f8e0
push eax
call fcn.0041a4bf
push dword [0x42deb0]
mov esi, eax
call fcn.0041a4bf
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x41f8e0
cmp edi, ebx
je 0x41f8e0
call esi
cmp eax, ebx
je 0x41f8ad
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41f8ad
test byte [ebp - 0x18], 1
jne 0x41f8e0
lea eax, [ebp - 0x10]
push eax
call fcn.00416b07
test eax, eax
pop ecx
je 0x41f8c8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041734c
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x41f8d7
or dword [ebp + 0x10], 0x200000
jmp 0x41f91b
or dword [ebp + 0x10], 0x40000
jmp 0x41f91b
mov eax, dword [0x42dea4]
cmp eax, dword [ebp - 8]
je 0x41f91b
push eax
call fcn.0041a4bf
cmp eax, ebx
pop ecx
je 0x41f91b
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x41f91b
mov eax, dword [0x42dea8]
cmp eax, dword [ebp - 8]
je 0x41f91b
push eax
call fcn.0041a4bf
cmp eax, ebx
pop ecx
je 0x41f91b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42dea0]
call fcn.0041a4bf
cmp eax, ebx
pop ecx
je 0x41f93b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41f93d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x151a59ad
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0xa731334
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x403870
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x4038bc
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x40389f
cmp edi, 2
jb 0x40389f
cmp byte [esi], cl
jne 0x40389f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4ab778]
test edi, edi
jne 0x403885
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x4038eb
cmp cl, 0x23
jne 0x4038d2
cmp byte [esi], cl
jne 0x4038d2
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4ab778]
test cl, cl
jne 0x4038c3
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x403a00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
test eax, eax
je 0x403a14
mov dword [eax], 0
mov edx, 0x4ab488
call fcn.00403900
mov edi, eax
test edi, edi
je 0x403ae1
push edi
call fcn.004629d1
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x403ad8
push 2
push 0
push edi
call fcn.0046331b
add esp, 0xc
test eax, eax
jne 0x403ad8
push edi
call fcn.004629d1
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x403ad8
push 0
push esi
push edi
call fcn.0046331b
add esp, 0xc
test eax, eax
jne 0x403ad8
cmp ebx, 0xffffffff
je 0x403ad8
mov eax, dword [0x4d3fd8]
test eax, eax
je 0x403a85
inc dword [eax + 0xa8]
push dword [0x4d3fd0]
push ebx
call fcn.004030c0
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x403ad8
push edi
push ebx
push 1
push eax
call fcn.00465aa4
push edi
mov esi, eax
call fcn.00462fc0
add esp, 0x14
cmp esi, ebx
je 0x403ac5
mov ecx, dword [ebp - 4]
call fcn.004057f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test eax, eax
je 0x403ace
mov dword [eax], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.00462fc0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a060
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x40a09d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x40a083
cmp byte [esi], bl
jne 0x40a083
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x4ab778]
test bl, bl
jne 0x40a074
pop edi
pop esi
not ecx
pop ebx
jmp fcn.00409ff0
Function at 0x4143d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5254], 0
lea esi, [edi + 0x5258]
je 0x414451
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x41440c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00416120
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00403d20
mov edx, dword [esi]
mov ecx, 0x4d3fd4
push dword [edi + 0x5254]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5260]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call fcn.00465773
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00403d20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414880
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x4d3fd8]
test bl, bl
je 0x4148c6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x4148a7
cmp byte [esi], bl
jne 0x4148a7
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x4ab778]
test bl, bl
jne 0x414898
mov edi, dword [0x4d3fd8]
mov esi, dword [edi + 0x5218]
xor ecx, ecx
not eax
test esi, esi
jle 0x4148ec
mov edi, dword [edi + 0x5220]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x4148f2
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x4148e0
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret

Function at 0x414b30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4d3fd8]
push esi
mov esi, ecx
push edi
mov dword [eax + 0x5208], 0
test esi, esi
je 0x414b83
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.00414b90
mov edx, 0x4ab48c
mov ecx, esi
mov edi, eax
call fcn.00403900
mov esi, eax
test esi, esi
je 0x414b83
push esi
push dword [ebp - 4]
push 1
push edi
call fcn.00465773
push esi
call fcn.00462fc0
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41e2a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41e2dc
mov eax, dword [0x4d3fd8]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x41e2c6
dec dword [eax + 0xa8]
push dword [0x4d3fd0]
push ecx
call fcn.004030d0
add esp, 8
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x41e316
mov eax, dword [0x4d3fd8]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x41e300
dec dword [eax + 0xa8]
push dword [0x4d3fd0]
push ecx
call fcn.004030d0
add esp, 8
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x41e350
mov eax, dword [0x4d3fd8]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x41e33a
dec dword [eax + 0xa8]
push dword [0x4d3fd0]
push ecx
call fcn.004030d0
add esp, 8
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x41e3a6
mov eax, dword [0x4d3fd8]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x41e390
dec dword [eax + 0xa8]
push dword [0x4d3fd0]
push ecx
call fcn.004030d0
add esp, 8
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x41e3e0
mov eax, dword [0x4d3fd8]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x41e3ca
dec dword [eax + 0xa8]
push dword [0x4d3fd0]
push ecx
call fcn.004030d0
add esp, 8
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x41e41a
mov eax, dword [0x4d3fd8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x41e404
dec dword [eax + 0xa8]
push dword [0x4d3fd0]
push ecx
call fcn.004030d0
add esp, 8
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00420d00
Function at 0x450d50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4ba00c]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x4b06a0]
xor eax, eax
movups xmmword [ebp - 0x44], xmm0
push ebx
movaps xmm0, xmmword [0x4b05a0]
push esi
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0x65646b6a
mov word [ebp - 0x20], 0x66
mov cl, byte [ebp - 0x44]
xor byte [ebp + eax - 0x43], cl
inc eax
cmp eax, 0x24
jb 0x450d87
lea ecx, [ebp - 0x43]
mov byte [ebp - 0x1f], 0
mov dword [ebp - 0xc], 0
lea edx, [ecx + 1]
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x450db0
sub ecx, edx
lea eax, [ebp - 0x43]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.00458480
call fcn.0046a820
xor edx, edx
mov esi, dword [ebp - 8]
mov ecx, 0x18
div ecx
mov ecx, 0x17
mov eax, edx
xor edx, edx
div ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x1c]
cmp esi, 0x10
cmovae eax, ecx
mov bl, byte [eax + edx + 1]
jb 0x450e1b
lea edx, [esi + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x450e11
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x450e2d
push edx
push ecx
call fcn.0045a290
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0045a181
mov esp, ebp
pop ebp
ret
call fcn.0046b0d3
int3
Function at 0x457bb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x457bd2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x457bc0
mov byte [esi + 9], 0
pop esi
ret

Function at 0x457be0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x457c02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 5
jb 0x457bf0
mov byte [esi + 6], 0
pop esi
ret

Function at 0x457c10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x457c32
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x457c20
mov byte [esi + 8], 0
pop esi
ret

Function at 0x457d30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x457d52
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x457d40
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x457d60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x457d82
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0x457d70
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x457d90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x457db2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0x457da0
mov byte [esi + 7], 0
pop esi
ret

Function at 0x457dc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x457de2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x457dd0
mov byte [esi + 0x12], 0
pop esi
ret

Function at 0x457df0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x457e12
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x457e00
mov byte [esi + 0x14], 0
pop esi
ret

Function at 0x457e20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x457e42
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0x457e30
mov byte [esi + 0xd], 0
pop esi
ret

Function at 0x457e50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x457e72
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xd
jb 0x457e60
mov byte [esi + 0xe], 0
pop esi
ret