joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x40]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea esi, [eax*4 + 4]
mov dword [esp], esi
call fcn.0042d7a0
mov dword [esp + 0x14], eax
test eax, eax
je 0x438022
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebx]
mov ecx, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov dword [ecx], eax
movzx edx, byte [ebx + 2]
movzx ecx, byte [ebx + 3]
movzx eax, byte [ebx + 1]
add esi, ebx
add ebx, 4
shl edx, 8
mov dword [esp + 0x18], esi
add ecx, edx
shl eax, 0x10
lea edx, [ecx + eax]
movzx eax, byte [ebx - 4]
mov ecx, dword [esp + 0x48]
shl eax, 0x18
add ecx, 4
add eax, edx
cmp esi, ebx
jbe 0x438010
mov edi, dword [esp + 0x4c]
sub edi, 1
mov dword [esp + 0x1c], edi
jmp 0x437f3a
movzx ebx, byte [ebx]
cmp bl, 0xf2
je 0x437f90
shl eax, 8
mov byte [ecx], bl
add ecx, 1
or eax, ebx
mov ebx, edx
cmp edx, dword [esp + 0x18]
jae 0x437f74
mov edx, eax
mov esi, eax
mov edi, dword [esp + 0x14]
shr edx, 0xf
shr esi, 3
xor edx, esi
xor edx, eax
and edx, dword [esp + 0x50]
lea edx, [edi + edx*4]
mov ebp, dword [edx]
mov dword [edx], ecx
lea edx, [ebx + 1]
test ebp, ebp
jne 0x437f20
movzx ebx, byte [ebx]
shl eax, 8
add ecx, 1
mov byte [ecx - 1], bl
or eax, ebx
mov ebx, edx
cmp edx, dword [esp + 0x18]
jb 0x437f3a
sub ecx, dword [esp + 0x48]
mov ebx, ecx
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042d920
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
xor edi, edi
mov esi, eax
lea esi, [esi]
movzx eax, byte [edx]
add edx, 1
mov ebx, eax
xor ebx, 0xc
movzx ebx, bl
add edi, ebx
cmp al, 0xf3
je 0x437f98
mov eax, esi
test edi, edi
jne 0x437fc8
shl eax, 8
mov byte [ecx], 0xf2
mov ebx, edx
add ecx, 1
or al, 0xf2
jmp 0x437f34
add edi, dword [esp + 0x1c]
je 0x43801a
add edi, ecx
movzx eax, byte [ebp]
add ecx, 1
add ebp, 1
mov byte [ecx - 1], al
cmp ecx, edi
jne 0x437fd0
movzx ecx, byte [edi - 2]
shl ecx, 8
lea ebx, [ecx + eax]
movzx eax, byte [edi - 3]
shl eax, 0x10
lea ecx, [ebx + eax]
movzx eax, byte [edi - 4]
mov ebx, edx
shl eax, 0x18
add eax, ecx
mov ecx, edi
jmp 0x437f34
mov ebx, 4
jmp 0x437f7a
movzx eax, byte [ecx - 1]
mov edi, ecx
jmp 0x437fe1
mov ebx, 0xffffffff
jmp 0x437f86
Function at 0x43bca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
xor ebp, ebp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x28]
cmp eax, 4
jbe 0x43bd99
mov ebx, dword [esp + 0x30]
mov edx, 0xffffffff
mov ebx, dword [ebx]
mov edi, ebx
mov dword [esp], ebx
mov ebx, dword [esp + 0x2c]
and edi, 7
add ebx, 5
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x24]
lea esi, [ebx + eax - 4]
xor eax, eax
add eax, dword [esp + 0x24]
cmp eax, esi
jb 0x43bcfb
jmp 0x43bd73
add eax, 1
cmp eax, esi
je 0x43bd78
movzx ecx, byte [eax]
and ecx, 0xfffffffe
cmp cl, 0xe8
jne 0x43bcf0
mov ebx, eax
sub ebx, dword [esp + 0x24]
mov ecx, ebx
mov dword [esp], ebx
sub ecx, edx
cmp eax, esi
jae 0x43be3c
cmp ecx, 3
ja 0x43bda8
sub ecx, 1
shl edi, cl
and edi, 7
je 0x43bd4e
movzx ecx, byte [edi + 0x5a5e18]
mov edx, eax
sub edx, ecx
cmp byte [edi + 0x5a5e20], 0
movzx edx, byte [edx + 4]
je 0x43bd5a
sub edx, 1
cmp dl, 0xfd
ja 0x43bd5a
movzx ebx, byte [eax + 4]
lea edx, [ebx - 1]
cmp dl, 0xfd
ja 0x43bdb6
mov eax, dword [esp]
add edi, edi
and edi, 6
or edi, 1
add eax, 1
add eax, dword [esp + 0x24]
mov edx, dword [esp]
cmp eax, esi
jb 0x43bcfb
mov esi, eax
lea esi, [esi]
sub esi, dword [esp + 0x24]
mov ebp, esi
mov ecx, ebp
xor eax, eax
sub ecx, edx
cmp ecx, 3
ja 0x43bd93
sub ecx, 1
mov eax, edi
shl eax, cl
and eax, 7
mov ebx, dword [esp + 0x30]
mov dword [ebx], eax
add esp, 0x10
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, byte [eax + 4]
xor edi, edi
lea edx, [ebx - 1]
cmp dl, 0xfd
jbe 0x43bd5a
mov ebp, dword [esp + 0xc]
mov edx, dword [eax + 1]
mov dword [esp + 4], eax
mov ebx, dword [esp + 0x34]
add ebp, dword [esp]
mov dword [esp + 8], esi
jmp 0x43be02
movzx eax, byte [edi + 0x5a5e18]
mov ecx, 0x18
mov esi, edx
shl eax, 3
sub ecx, eax
shr esi, cl
mov ecx, esi
sub ecx, 1
cmp cl, 0xfd
jbe 0x43be10
mov ecx, 0x20
sub ecx, eax
mov eax, 1
shl eax, cl
sub eax, 1
xor edx, eax
lea ecx, [edx + ebp]
sub edx, ebp
test ebx, ebx
cmovne edx, ecx
test edi, edi
jne 0x43bdd0
mov ecx, edx
mov eax, dword [esp + 4]
mov esi, dword [esp + 8]
shr ecx, 0x18
and ecx, 1
mov word [eax + 1], dx
neg ecx
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 3], cl
mov eax, dword [esp]
add eax, 5
jmp 0x43bd68
mov ebp, dword [esp]
jmp 0x43bd7e
Function at 0x441c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
test edx, edx
jle 0x441dd5
mov edi, dword [esp + 0x28]
mov dword [esp + 8], 0
lea edi, [eax + edi*4]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x28]
lea eax, [eax + edi*8]
mov dword [esp], eax
mov eax, edi
neg eax
shl eax, 2
mov dword [esp + 4], eax
nop
mov eax, dword [esp + 0x28]
test eax, eax
jle 0x441dc2
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
lea edi, [eax*4]
lea esi, [esi]
nop
mov eax, dword [ebx]
mov ecx, dword [eax + edi]
mov eax, dword [esp + 4]
mov esi, dword [ebx + eax]
mov eax, ecx
sar eax, 0x1f
mov edx, eax
add esi, edi
xor edx, ecx
sub edx, eax
sub edx, 1
mov eax, edx
shl eax, 0xf
movzx ebp, ax
mov eax, edx
shl eax, 0xd
and eax, 0x4000
or eax, ebp
mov ebp, edx
shl ebp, 0xb
and ebp, 0x2000
or eax, ebp
mov ebp, edx
shl ebp, 9
and ebp, 0x1000
or eax, ebp
mov ebp, edx
shl ebp, 7
and ebp, 0x800
or eax, ebp
mov ebp, edx
shl ebp, 5
and ebp, 0x400
or eax, ebp
lea ebp, [edx*8]
and ebp, 0x200
or eax, ebp
lea ebp, [edx + edx]
and ebp, 0x100
or eax, ebp
mov ebp, edx
shr ebp, 1
and ebp, 0x80
or eax, ebp
mov ebp, edx
shr ebp, 3
and ebp, 0x40
or eax, ebp
mov ebp, edx
shr ebp, 5
and ebp, 0x20
and ecx, 0x80000000
add ebx, 4
or eax, ebp
mov ebp, edx
shr ebp, 7
and ebp, 0x10
or eax, ebp
mov ebp, edx
shr ebp, 9
and ebp, 8
or eax, ebp
mov ebp, edx
shr ebp, 0xb
and ebp, 4
or eax, ebp
mov ebp, edx
shr edx, 0xf
shr ebp, 0xd
and ebp, 2
or eax, ebp
mov ebp, edx
and ebp, 1
or ebp, eax
mov eax, dword [esi]
add eax, 0x3f80
shl eax, 0x10
or ecx, eax
or ebp, ecx
mov dword [esi], ebp
cmp ebx, dword [esp]
jne 0x441cd0
add dword [esp + 8], 1
mov eax, dword [esp + 8]
cmp dword [esp + 0x24], eax
jne 0x441cb0
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4497a0
Capabilities:
Get memory capacity

Disassembly:
push ebx
sub esp, 0x48
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x20
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
sub esp, 4
lea ecx, [esp + 0x18]
call fcn.00449310
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x1c]
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
cmp edx, eax
lea ebx, [eax - 0x500000]
mov eax, dword [esp + 0x18]
lea ecx, [edx - 0x500000]
cmovb ebx, ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebx
sub esp, 0xc
add esp, 0x48
pop ebx
ret

Function at 0x449810
Capabilities:
Get memory capacity

Disassembly:
push ebx
sub esp, 0x48
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x20
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
sub esp, 4
lea ecx, [esp + 0x18]
call fcn.00449310
lea ecx, [esp + 0x18]
call fcn.004493a0
mov edx, eax
mov eax, dword [esp + 0x34]
lea ebx, [eax - 0x500000]
cmp eax, edx
ja 0x449878
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebx
sub esp, 0xc
add esp, 0x48
pop ebx
ret
lea ecx, [esp + 0x18]
call fcn.004493a0
lea ebx, [eax - 0x500000]
jmp 0x44984e
Function at 0x44b190
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x4c]
mov esi, dword [esp + 0x44]
mov ebx, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [ecx]
mov dword [esp], eax
call sub.msvcrt.dll_free
lea eax, [edi + 8]
mov dword [esp], eax
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_malloc
mov dword [ebp], eax
test eax, eax
je 0x44b367
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], 0
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.msvcrt.dll__lseeki64
xor eax, esi
xor edx, ebx
or edx, eax
je 0x44b288
mov ecx, dword [0x677e60]
test ecx, ecx
jne 0x44b270
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x44b3a1
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x44b3a1
mov dword [esp + 4], str.ERROR:_file_seek_operation_failed
mov dword [esp], esi
call fcn.004bf1f0
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.0042e7f0
mov dword [esp + 4], ebx
mov dword [esp], 0x5a6d2c
call fcn.004bf160
mov dword [esp], 2
call sub.msvcrt.dll_exit
lea esi, [esi]
mov dword [esp + 4], 1
mov dword [esp], 0x677e20
call dword [sym.imp.msvcrt.dll_longjmp]
lea esi, [esi]
mov eax, dword [ebp]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebx, eax
test eax, eax
js 0x44b320
mov ecx, dword [esp + 0x18]
cdq
xor ebx, edi
xor ecx, edx
mov eax, ecx
or eax, ebx
je 0x44b308
mov eax, dword [0x677e60]
test eax, eax
jne 0x44b270
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x44b3a1
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x44b3a1
mov dword [esp + 8], edi
mov dword [esp + 4], str.ERROR:_cant_read__lu_bytes
mov dword [esp], esi
call fcn.004bf1f0
jmp 0x44b242
mov eax, dword [ebp]
mov dword [ebp + 8], eax
add eax, edi
mov dword [ebp + 4], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
mov edx, dword [0x677e60]
test edx, edx
jne 0x44b270
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x44b3a1
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x44b3a1
mov dword [esp + 4], str.ERROR:_file_read_operation_failed
mov dword [esp], esi
call fcn.004bf1f0
jmp 0x44b242
cmp dword [0x677e60], 0
jne 0x44b270
mov eax, 0x40000
call fcn.0044b100
mov esi, eax
mov eax, 0x40000
call fcn.0044b100
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.ERROR:_cant_alloc__lu_memory_bytes
jmp 0x44b2f8
cmp dword [0x677e60], 0
jne 0x44b270
mov eax, 0x40000
call fcn.0044b100
mov esi, eax
mov eax, 0x40000
call fcn.0044b100
mov dword [esp + 8], 0x40000
mov ebx, eax
jmp 0x44b394
Function at 0x44b6f0
Capabilities:
Create thread

Disassembly:
sub esp, 0x3c
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp], 0
mov dword [esp + 8], eax
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov edx, dword [esp + 0x40]
mov dword [edx], eax
xor edx, edx
test eax, eax
je 0x44b740
mov eax, edx
add esp, 0x3c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 1
test eax, eax
cmovne edx, eax
add esp, 0x3c
mov eax, edx
ret
Function at 0x44ea90
Capabilities:
Delete file

Disassembly:
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x10
mov eax, dword [ecx]
mov dword [eax + 0x40068], 0
mov eax, dword [ecx + 0x80]
test eax, eax
jns 0x44eb88
mov eax, dword [ebx + 0x1c]
test eax, eax
jns 0x44eaf8
call fcn.00432370
mov ecx, dword [ebx + 4]
mov edx, dword [esp + 0x24]
mov eax, dword [ecx]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 4], edx
mov edx, dword [ebx]
mov dword [esp], edx
call dword [eax + 0x3c]
mov eax, dword [ebx]
sub esp, 0xc
mov eax, dword [eax + 0x40068]
test eax, eax
setne al
add esp, 0x10
pop ebx
pop esi
pop edi
ret 8
mov dword [esp], eax
call sub.msvcrt.dll__close
test eax, eax
je 0x44ebf8
mov edx, dword [0x677e60]
test edx, edx
jne 0x44ec08
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov edi, eax
test eax, eax
je 0x44ec1d
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x44ec1d
mov eax, dword [ebx + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], str.ERROR:_cant_close_file__s
mov dword [esp], edi
call fcn.004bf1f0
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.0042e7f0
mov dword [esp + 4], esi
mov dword [esp], 0x5a6d2c
call fcn.004bf160
mov dword [esp], 2
call sub.msvcrt.dll_exit
lea esi, [esi]
mov dword [esp], eax
call sub.msvcrt.dll__close
test eax, eax
je 0x44ebd0
mov ecx, dword [0x677e60]
test ecx, ecx
jne 0x44ec08
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov edi, eax
test eax, eax
je 0x44ec1d
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x44ec1d
mov eax, dword [ebx + 0x88]
jmp 0x44eb45
mov dword [ebx + 0x80], 0xffffffff
mov eax, dword [ebx + 0x84]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wremove]
mov dword [ebx + 0x70], 0
jmp 0x44eab2
mov dword [ebx + 0x1c], 0xffffffff
jmp 0x44eab9
mov dword [esp + 4], 1
mov dword [esp], 0x677e20
call dword [sym.imp.msvcrt.dll_longjmp]
cmp dword [0x677e60], 0
jne 0x44ec08
mov eax, 0x40000
call fcn.0044b100
mov esi, eax
mov eax, 0x40000
call fcn.0044b100
mov dword [esp + 8], 0x40000
mov dword [esp + 4], str.ERROR:_cant_alloc__lu_memory_bytes
mov ebx, eax
mov dword [esp], esi
call fcn.004bf1f0
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.0042e7f0
mov dword [esp + 4], ebx
mov dword [esp], 0x5a6d2c
call fcn.004bf160
mov dword [esp], 2
call sub.msvcrt.dll_exit
nop
Function at 0x451239
Capabilities:
Create thread
Resume thread

Disassembly:
lea eax, [esi + 4]
push eax
push 4
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x451287
mov ecx, dword [0x59bcfc]
test ecx, ecx
je 0x451269
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
cmp dword [esp + 0xc], 0
je 0x45127c
push dword [esp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
inc eax
ret 0xc
Function at 0x452d01
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.WINMM.DLL_timeGetTime]
mov edi, eax
sub eax, dword [esi + 0xb8]
cmp eax, 3
jae 0x452d32
mov eax, dword [esi + 0xc0]
or eax, dword [esi + 0xc4]
jne 0x452d84
mov eax, dword [esi + 0x98]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x18]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
jns 0x452d4e
fldz
jmp 0x452ead
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov dword [esi + 0xc0], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0xc4], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], ecx
mov dword [esi + 0xb8], edi
jmp 0x452d87
mov eax, dword [ebp - 8]
mov ecx, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], ecx
mov ebx, 0x7fffffff
and ecx, ebx
mov dword [ebp - 0x14], ecx
mov ecx, dword [esi + 0xa4]
mov dword [ebp - 0x18], edx
fild qword [ebp - 0x18]
mov edx, dword [esi + 0xa0]
mov edi, 0x80000000
and dword [ebp - 0xc], edi
fild qword [ebp - 0x10]
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], ecx
and dword [ebp - 0xc], edi
fchs
and ecx, ebx
or eax, dword [ebp - 4]
faddp st(1)
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
fild qword [ebp - 0x18]
fild qword [ebp - 0x10]
fchs
faddp st(1)
fdivp st(1)
fstp qword [ebp - 0x18]
jne 0x452e2f
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [esi + 0xc8]
mov eax, dword [ebp - 4]
sbb eax, dword [esi + 0xcc]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
and dword [ebp - 0xc], edi
and eax, ebx
and dword [ebp - 0x10], 0
mov dword [ebp - 4], eax
fild qword [ebp - 8]
fild qword [ebp - 0x10]
fchs
faddp st(1)
fmul qword [0x59a3a4]
fadd qword [ebp - 0x18]
fstp qword [ebp - 0x18]
mov eax, dword [esi + 0x8c]
fild dword [esi + 0x8c]
test eax, eax
jns 0x452e45
fadd qword [0x5c3998]
fmul qword [ebp - 0x18]
call fcn.0047d082
mov ecx, dword [esi + 0xac]
cmp edx, ecx
jb 0x452e69
ja 0x452e61
cmp eax, dword [esi + 0xa8]
jbe 0x452e69
mov eax, dword [esi + 0xa8]
mov edx, ecx
mov ecx, dword [esi + 0xd4]
cmp edx, ecx
ja 0x452e85
jb 0x452e7d
cmp eax, dword [esi + 0xd0]
jae 0x452e85
mov eax, dword [esi + 0xd0]
mov edx, ecx
mov dword [ebp - 0xc], edx
and dword [ebp - 0xc], edi
mov dword [esi + 0xd4], edx
and edx, ebx
and dword [ebp - 0x10], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
fild qword [ebp - 0x18]
fild qword [ebp - 0x10]
mov dword [esi + 0xd0], eax
fchs
faddp st(1)
pop edi
pop ebx
leave
ret
Function at 0x45c1a8
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push ebx
push esi
xor esi, esi
push edi
xor edx, edx
mov dword [eax + 0x16], esi
movzx edi, byte [eax + esi]
mov ebx, edx
shr ebx, 0x18
xor edi, ebx
shl edx, 8
xor edx, dword [edi*4 + 0x59ac6c]
inc esi
cmp esi, ecx
jl 0x45c1b7
pop edi
pop esi
mov dword [eax + 0x16], edx
pop ebx
ret

Function at 0x460e6a
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
fld1
mov eax, 0x598620
fst dword [eax]
sub eax, 4
fmul qword [0x5c3a30]
cmp eax, 0x598224
jge 0x460e76
fstp st(0)
xor ecx, ecx
mov eax, ecx
push 8
shl eax, 0x18
pop edx
test eax, eax
jns 0x460ea1
add eax, eax
xor eax, 0x4c11db7
jmp 0x460ea3
add eax, eax
dec edx
jne 0x460e94
mov dword [ecx*4 + 0x59ac6c], eax
inc ecx
cmp ecx, 0x100
jl 0x460e8c
fld qword [0x5c39f8]
mov edx, 0x58e03c
fld qword [0x5c39e8]
xor ecx, ecx
and dword [ebp - 4], 0
push 0x20
pop eax
shl eax, cl
mov dword [ecx*4 + 0x598200], edx
mov dword [ebp - 8], eax
test eax, eax
jle 0x460f0d
fild dword [ebp - 8]
fild dword [ebp - 4]
fadd dword [0x5c3990]
fdiv st(1)
fmul st(3)
fmul st(2)
fsin
fld st(0)
fmulp st(1)
fmul st(3)
fmul st(2)
fsin
fstp dword [edx]
add edx, 4
inc dword [ebp - 4]
cmp dword [ebp - 4], eax
jl 0x460ee3
fstp st(0)
inc ecx
cmp ecx, 8
jl 0x460ec9
fstp st(1)
fstp st(0)
leave
ret

Function at 0x4668e6
Capabilities:
Enumerate pe sections

Disassembly:
mov dl, byte [ecx]
push esi
mov esi, eax
xor eax, eax
test dl, 0x40
je 0x4668fc
and dl, 0xbf
mov byte [ecx], dl
jmp 0x4669b4
test dl, 8
jne 0x4669b4
test dl, 1
je 0x4669b8
push ebx
mov bl, dl
and bl, 2
push edi
je 0x466924
mov edi, dword [esp + 0x10]
cmp dword [edi + 0x4c], eax
jne 0x466989
test dl, dl
js 0x466989
cmp bl, al
je 0x46696f
mov ebx, dword [ecx + 4]
and dl, 0xfd
mov byte [ecx], dl
movzx edx, word [esi + ebx*4 + 6]
mov dword [ecx + 0xc], edx
movzx edi, word [esi + ebx*4 + 0xa]
mov dword [ecx + 0x10], edi
cmp edi, edx
jle 0x466959
movzx edx, word [esi + ebx*4 + 8]
movzx eax, word [esi + ebx*4 + 0xc]
sub edi, dword [ecx + 0xc]
sub eax, edx
shl eax, 0x10
cdq
idiv edi
mov dword [ecx + 0x18], eax
movzx eax, word [esi + ebx*4 + 8]
shl eax, 0x10
mov dword [ecx + 0x14], eax
mov eax, dword [ecx + 0xc]
mov dword [ecx + 8], eax
jmp 0x466989
mov edi, dword [ecx + 0x18]
add dword [ecx + 0x14], edi
mov edi, dword [ecx + 0x14]
js 0x466983
mov eax, 0x400000
cmp edi, eax
jle 0x466986
mov dword [ecx + 0x14], eax
inc dword [ecx + 8]
test byte [ecx], 2
pop edi
pop ebx
jne 0x4669b4
mov eax, dword [ecx + 4]
movzx edx, word [esi + eax*4 + 0xa]
cmp dword [ecx + 8], edx
jne 0x4669b4
movzx edx, byte [esi + 1]
inc eax
cmp eax, edx
jge 0x4669b4
push dword [esp + 8]
mov edx, 0x10000
call fcn.00466769
movsx eax, word [ecx + 0x16]
pop esi
ret 4
Function at 0x46c7fc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi]
xor ebx, ebx
cmp edi, ebx
je 0x46c9c1
cmp dword [edi + 8], ebx
jne 0x46c9c1
mov eax, dword [edi]
test al, 0x20
jne 0x46c9c1
push ebx
push dword [ebp + 0x10]
push esi
call fcn.00456148
test eax, eax
je 0x46c9c1
mov eax, dword [edi + 0x60]
cmp eax, ebx
je 0x46c84c
push dword [edi + 0x64]
push dword [edi + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x70], eax
fild dword [0x57da68]
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jns 0x46c86a
fadd dword [0x5c39a4]
fmulp st(1)
fmul dword [0x5c3bcc]
call fcn.0047d082
mov dword [edi + 0x14], eax
mov eax, dword [edi]
test eax, 0x100000
mov eax, dword [edi + 0x10]
cdq
mov dword [edi + 0x20], 0x32
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
je 0x46c8f9
mov eax, dword [edi + 0x10]
sub dword [edi + 0xc], eax
mov edx, dword [edi + 0xc]
je 0x46c8b2
mov ecx, dword [edi + 4]
push edx
add eax, ecx
push eax
push ecx
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
jmp 0x46c8b5
or dword [edi], 4
mov ecx, dword [edi + 0x14]
mov edx, dword [edi + 0xc]
mov dword [edi + 0x10], ebx
cmp ecx, edx
ja 0x46c8c4
mov ecx, edx
mov dword [edi + 8], ecx
mov eax, dword [esi + 0x78]
cmp eax, ebx
je 0x46c8e3
cmp dword [eax + 0xc], fcn.00454904
jne 0x46c8e3
mov eax, 0x4000
cmp ecx, eax
jge 0x46c8e3
mov dword [edi + 8], eax
cmp edx, dword [edi + 8]
jne 0x46c8eb
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x10]
mov dword [edi + 0x68], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x6c], eax
jmp 0x46c8ff
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
push dword [edi + 8]
push dword [edi + 4]
call fcn.00450fff
mov dword [edi + 4], eax
cmp eax, ebx
je 0x46c9c1
mov eax, dword [edi]
test al, 8
jne 0x46c9ae
mov eax, dword [edi + 0x14]
imul eax, dword [0x57da70]
push 0x64
xor edx, edx
pop ecx
div ecx
mov dword [edi + 0x18], eax
call fcn.0045616a
mov ecx, dword [edi + 0x18]
sub ecx, eax
cmp ecx, ebx
jg 0x46c943
xor ecx, ecx
mov eax, dword [edi]
mov dword [edi + 0x1c], ecx
test al, 0x40
jne 0x46c9bc
push ebx
push edi
push 0x46c715
lea esi, [edi + 0x44]
call fcn.00451239
cmp dword [0x59bcd0], ebx
je 0x46c9bc
call fcn.004555e9
mov ebx, dword [eax + 0x1c]
test ebx, ebx
jne 0x46c9a6
mov ebx, dword [0x59bccc]
jmp 0x46c9a6
call fcn.00455700
test eax, eax
jne 0x46c9bc
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x3c], 0
je 0x46c9a6
mov esi, ebx
test ebx, ebx
jne 0x46c999
mov esi, 0x7d0
call dword [sym.imp.WINMM.DLL_timeGetTime]
sub eax, dword [edi + 0x3c]
cmp eax, esi
jae 0x46c9bc
cmp dword [edi + 0x1c], 0
jne 0x46c977
jmp 0x46c9bc
mov eax, dword [edi + 0x60]
cmp eax, ebx
je 0x46c9bc
push dword [edi + 0x64]
push ebx
push ebx
call eax
xor eax, eax
inc eax
jmp 0x46c9c3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc