joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d044
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0042440d
xor ebx, ebx
cmp dword [0x4462dc], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x42d119
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x42d084
xor eax, eax
jmp 0x42d1dd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x438dbc
push edi
call esi
cmp eax, ebx
je 0x42d07d
push eax
call fcn.004243aa
mov dword [esp], 0x438dac
push edi
mov dword [0x4462dc], eax
call esi
push eax
call fcn.004243aa
mov dword [esp], 0x438d98
push edi
mov dword [0x4462e0], eax
call esi
push eax
call fcn.004243aa
mov dword [0x4462e4], eax
lea eax, [ebp - 8]
push eax
call fcn.004200e7
test eax, eax
pop ecx
pop ecx
je 0x42d0e7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0042358f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x42d119
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004243aa
cmp eax, ebx
pop ecx
mov dword [0x4462ec], eax
je 0x42d119
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004243aa
pop ecx
mov dword [0x4462e8], eax
mov eax, dword [0x4462e8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x42d192
cmp dword [0x4462ec], esi
je 0x42d192
push eax
call fcn.00424416
pop ecx
call eax
cmp eax, ebx
je 0x42d15f
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4462ec]
call fcn.00424416
pop ecx
call eax
test eax, eax
je 0x42d15f
test byte [ebp - 0x18], 1
jne 0x42d192
lea eax, [ebp - 0xc]
push eax
call fcn.0042011e
test eax, eax
pop ecx
je 0x42d17a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0042358f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x42d189
or dword [ebp + 0x10], 0x200000
jmp 0x42d1c3
or dword [ebp + 0x10], 0x40000
jmp 0x42d1c3
mov eax, dword [0x4462e0]
cmp eax, esi
je 0x42d1c3
push eax
call fcn.00424416
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x42d1c3
mov eax, dword [0x4462e4]
cmp eax, esi
je 0x42d1c3
push dword [ebp - 4]
push eax
call fcn.00424416
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4462dc]
call fcn.00424416
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431496
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x442504]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0043142b
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0041e710
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4314e5
cmp dword [ebp - 0x1c], 5
jb 0x4314fd
jmp 0x4314f9
cmp dword [ebp - 0x10], 1
jne 0x4314fd
cmp dword [ebp - 0x1c], 4
ja 0x4314f9
jne 0x4314fd
cmp dword [ebp - 0x18], 0
jbe 0x4314fd
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4395fc
call fcn.0043131c
test eax, eax
jge 0x43151e
mov byte [0x4439f0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041e6f8
add ebp, 0x78
leave
ret
Function at 0x4609e1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00454623
and dword [ebp - 4], 0
cmp dword [0x4943b8], 0
mov ebx, eax
jne 0x460a92
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x460b43
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x460b43
push eax
call fcn.004545b1
mov dword [esp], 0x47b5d4
push edi
mov dword [0x4943b8], eax
call esi
push eax
call fcn.004545b1
mov dword [esp], 0x47b5c0
push edi
mov dword [0x4943bc], eax
call esi
push eax
call fcn.004545b1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4943c0], eax
call esi
push eax
call fcn.004545b1
pop ecx
mov dword [0x4943c8], eax
test eax, eax
je 0x460a92
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004545b1
pop ecx
mov dword [0x4943c4], eax
mov eax, dword [0x4943c4]
cmp eax, ebx
je 0x460aea
cmp dword [0x4943c8], ebx
je 0x460aea
push eax
call fcn.0045462c
push dword [0x4943c8]
mov esi, eax
call fcn.0045462c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x460aea
test edi, edi
je 0x460aea
call esi
test eax, eax
je 0x460ae1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x460ae1
test byte [ebp - 0xc], 1
jne 0x460aea
or dword [ebp + 0x10], 0x200000
jmp 0x460b23
mov eax, dword [0x4943bc]
cmp eax, ebx
je 0x460b23
push eax
call fcn.0045462c
pop ecx
test eax, eax
je 0x460b23
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x460b23
mov eax, dword [0x4943c0]
cmp eax, ebx
je 0x460b23
push eax
call fcn.0045462c
pop ecx
test eax, eax
je 0x460b23
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4943b8]
call fcn.0045462c
pop ecx
test eax, eax
je 0x460b43
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x460b45
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41c860
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
jmp 0x41c87a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41c881
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41c870
mov eax, 1
add ebx, ebx
jne 0x41c893
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41c888
jne 0x41c8a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c888
xor ecx, ecx
sub eax, 3
jb 0x41c8b8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41c92a
mov ebp, eax
add ebx, ebx
jne 0x41c8c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41c8d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41c8f4
inc ecx
add ebx, ebx
jne 0x41c8e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41c8d5
jne 0x41c8f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c8d5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41c914
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41c905
jmp 0x41c876
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41c914
add edi, ecx
jmp 0x41c876
pop esi
mov edi, esi
mov ecx, 0x641
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41c932
cmp byte [edi], 0xb
jne 0x41c932
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41c937
lea edi, [esi + 0x18000]
mov eax, dword [edi]
or eax, eax
je 0x41c9af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1cdc0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1ced8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41c964
mov ecx, edi
jns 0x41c993
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1cedc]
or eax, eax
je 0x41c9a9
mov dword [ebx], eax
add ebx, 4
jmp 0x41c981
call dword [esi + 0x1ceec]
mov ebp, dword [esi + 0x1cee0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41c9e3
sub esp, 0xffffff80
jmp 0x40fd88
Function at 0x4011b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov byte [ebp - 2], 0
jmp 0x4011c3
mov al, byte [ebp - 2]
add al, 1
mov byte [ebp - 2], al
movzx ecx, byte [ebp - 2]
cmp ecx, 4
jge 0x401229
mov byte [ebp - 1], 0
jmp 0x4011db
mov dl, byte [ebp - 1]
add dl, 1
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
cmp eax, 4
jge 0x401227
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*4]
movzx ecx, byte [ebp - 1]
movzx edx, byte [ebp + 8]
shl edx, 2
movzx esi, byte [ebp - 2]
shl esi, 2
lea edx, [esi + edx*4]
movzx esi, byte [ebp - 1]
add esi, dword [ebp + 0x10]
movzx edx, byte [esi + edx]
movzx eax, byte [eax + ecx]
xor eax, edx
movzx ecx, byte [ebp - 1]
movzx edx, byte [ebp - 2]
mov esi, dword [ebp + 0xc]
lea edx, [esi + edx*4]
mov byte [edx + ecx], al
jmp 0x4011d2
jmp 0x4011bb
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404340
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x405b40
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov eax, dword [ecx]
movzx ecx, word [eax + 0x14]
lea edx, [edx + ecx + 0x18]
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], 0
jmp 0x405b88
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x14], edx
jge 0x405cae
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x405c1b
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
jle 0x405c16
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x34]
push edx
push 4
push 0x1000
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x405bef
xor eax, eax
jmp 0x405cb3
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
call fcn.00450af7
add esp, 0xc
jmp 0x405b76
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
call fcn.00405b10
test eax, eax
jne 0x405c3c
xor eax, eax
jmp 0x405cb3
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x34]
push eax
push 4
push 0x1000
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x1c]
call ecx
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x405c77
xor eax, eax
jmp 0x405cb3
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00450af1
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
jmp 0x405b76
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408ae0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul ecx, eax, 0
movsx edx, byte [ebp + 0xc]
mov eax, dword [ebp + 8]
xor edx, dword [eax + ecx]
and edx, 0xff
mov ecx, 4
imul eax, ecx, 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax]
shr eax, 8
xor eax, dword [edx*4 + 0x459538]
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + edx], eax
mov edx, 4
shl edx, 0
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + ecx]
and ecx, 0xff
mov eax, dword [ebp + 8]
add ecx, dword [eax + edx]
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], ecx
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
imul eax, dword [edx + ecx], 0x8088405
add eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
mov eax, 4
shl eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov ecx, dword [edx + ecx]
shr ecx, 0x18
mov edx, dword [ebp + 8]
xor ecx, dword [edx + eax]
and ecx, 0xff
mov eax, 4
shl eax, 1
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax]
shr eax, 8
xor eax, dword [ecx*4 + 0x459538]
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
pop ebp
ret
Function at 0x40d6f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x40d700
xor eax, eax
jmp 0x40d89d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x40d85e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x459538]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x459538]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x459538]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x459538]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x459538]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x459538]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x459538]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x459538]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x40d709
cmp dword [ebp + 0x10], 0
je 0x40d897
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x459538]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x40d864
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x411d20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x411d30
xor eax, eax
jmp 0x411ecd
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x411e8e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x45a0d8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x45a0d8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x45a0d8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x45a0d8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x45a0d8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x45a0d8]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x45a0d8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x45a0d8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x411d39
cmp dword [ebp + 0x10], 0
je 0x411ec7
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x45a0d8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x411e94
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x413ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 1
jl 0x413ee8
cmp dword [ebp + 0xc], 8
jg 0x413ee8
mov byte [ebp - 1], 1
jmp 0x413eec
mov byte [ebp - 1], 0
push str.bad_pack_level
movzx eax, byte [ebp - 1]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004103c0
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af78], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x6af70], 0
jne 0x413f35
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af78], 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af70], 0x10000
mov eax, 4
imul ecx, eax, 0x7fff
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x4af70], 0
push 0x1fffc
push 0
mov eax, dword [ebp + 8]
add eax, 0x4af70
push eax
call fcn.00450af7
add esp, 0xc
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx*8 + 0x45a08a]
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af98], edx
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx*8 + 0x45a088]
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af9c], edx
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx*8 + 0x45a08c]
mov eax, dword [ebp + 8]
mov dword [eax + 0x6afa0], edx
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx*8 + 0x45a08e]
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af94], edx
cmp dword [ebp + 0xc], 2
jg 0x413fcd
mov ecx, dword [ebp + 0x10]
movzx edx, word [ecx]
or edx, 4
mov eax, dword [ebp + 0x10]
mov word [eax], dx
jmp 0x413fe2
cmp dword [ebp + 0xc], 8
jl 0x413fe2
mov ecx, dword [ebp + 0x10]
movzx edx, word [ecx]
or edx, 2
mov eax, dword [ebp + 0x10]
mov word [eax], dx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af84], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af74], 0
mov dword [ebp - 8], 0x8000
mov eax, dword [ebp - 8]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x1af70
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af90], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x6af90], 0
je 0x414049
mov eax, dword [ebp + 8]
cmp dword [eax + 0x6af90], 0xffffffff
jne 0x414065
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af8c], 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af90], 0
jmp 0x4140dd
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af8c], 0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x6af90], 0x106
jae 0x41408d
mov edx, dword [ebp + 8]
push edx
call fcn.00413090
add esp, 4
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af7c], 0
mov dword [ebp - 8], 0
jmp 0x4140ac
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 2
jae 0x4140dd
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x6af7c]
shl eax, 5
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movzx edx, byte [ecx + 0x1af70]
xor eax, edx
and eax, 0x7fff
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af7c], eax
jmp 0x4140a3
mov esp, ebp
pop ebp
ret
Function at 0x416420
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul ecx, eax, 0
movsx edx, byte [ebp + 0xc]
mov eax, dword [ebp + 8]
xor edx, dword [eax + ecx]
and edx, 0xff
mov ecx, 4
imul eax, ecx, 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax]
shr eax, 8
xor eax, dword [edx*4 + 0x45a0d8]
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + edx], eax
mov edx, 4
shl edx, 0
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + ecx]
and ecx, 0xff
mov eax, dword [ebp + 8]
add ecx, dword [eax + edx]
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], ecx
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
imul eax, dword [edx + ecx], 0x8088405
add eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
mov eax, 4
shl eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov ecx, dword [edx + ecx]
shr ecx, 0x18
mov edx, dword [ebp + 8]
xor ecx, dword [edx + eax]
and ecx, 0xff
mov eax, 4
shl eax, 1
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax]
shr eax, 8
xor eax, dword [ecx*4 + 0x45a0d8]
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
pop ebp
ret
Function at 0x4284e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x4284fe
mov ecx, dword [ebp - 8]
call fcn.0042b490
jmp 0x428511
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x428511
mov ecx, dword [ebp - 8]
call fcn.0042b310
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
shr eax, 0xb
mov ecx, dword [ebp - 8]
and eax, dword [ecx + 0x1384]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
shl edx, 7
and edx, 0x9d2c5680
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0x12
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret