joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406915
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x8e00d0
sub esp, 0x54
push ebx
push ebp
mov ebp, dword [esp + 0x64]
mov ebx, ecx
push esi
mov esi, dword [esp + 0x6c]
mov dword [esp + 0xc], ebp
push edi
test esi, esi
jne 0x8e00ed
xor edi, edi
jmp 0x8e0102
push 1
push esi
call fcn.00410af5
push esi
mov edi, eax
push ebp
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov al, byte [esp + 0x68]
lea ecx, [ebx + 0xf0]
mov byte [esp + 0x24], al
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x70], edi
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x78], esi
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], esi
call fcn.00401875
cmp byte [esp + 0x20], 0
je 0x8e0203
push ebx
push 0x40
call fcn.0040a579
mov esi, eax
add esp, 8
test esi, esi
je 0x8e01e4
mov eax, dword [esp + 0x74]
lea edx, [esp + 0x3c]
xor edi, edi
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 5
cmp dword [eax + 4], edi
je 0x8e018d
push eax
lea ecx, [esp + 0x34]
call fcn.00402068
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov dword [esi + 4], ecx
lea ecx, [esi + 8]
mov dword [esi], eax
lea eax, [ecx + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov dword [ecx + 8], 5
test edi, edi
je 0x8e01c2
lea eax, [esp + 0x30]
push eax
call fcn.0040ae02
mov edx, dword [esp + 0x30]
mov al, byte [esp + 0x68]
mov byte [esi + 0x3c], al
mov al, byte [esp + 0x78]
mov byte [esi + 0x3d], al
lea eax, [esp + 0x3c]
cmp edx, eax
je 0x8e01e6
push edx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x8e01e6
xor esi, esi
call fcn.00405146
test al, al
mov eax, dword [esp + 0x18]
je 0x8e01f6
add eax, 0xfffffff0
mov dword [eax + 0xc], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 0x14
mov eax, dword [esp + 0x74]
mov edi, dword [eax]
mov eax, dword [eax + 4]
lea eax, [edi + eax*8]
mov dword [esp + 0x74], eax
cmp edi, eax
je 0x8e0272
call fcn.00405146
mov ebx, dword [esp + 0x18]
mov byte [esp + 0x68], al
test al, al
lea eax, [ebx - 0x10]
jne 0x8e022d
mov eax, ebx
mov esi, dword [eax + 0xc]
mov ecx, dword [edi + 4]
mov ebp, dword [edi]
mov dword [esp + 0x78], ecx
mov ecx, dword [esi + 0xc]
cmp ecx, dword [esi + 0x10]
jb 0x8e0254
push 8
push 0
lea eax, [esi + 0x14]
push eax
lea ecx, [esi + 8]
call fcn.00405e1b
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 8]
add edi, 8
mov edx, dword [esp + 0x78]
mov dword [eax + ecx*8], ebp
mov dword [eax + ecx*8 + 4], edx
inc dword [esi + 0xc]
mov al, byte [esp + 0x68]
cmp edi, dword [esp + 0x74]
jne 0x8e0224
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 0x14
Function at 0x406ece
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
jmp 0x580990
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x811c9dc5
test esi, esi
je 0x5809b7
push edi
mov edi, dword [esp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x5809a5
pop edi
mov eax, edx
pop esi
ret
Function at 0x407991
Capabilities:
Parse credit card information

Disassembly:
jmp 0x6e5200
sub esp, 0x14
push ebx
mov ebx, ecx
lea ecx, [esp + 0x1c]
push esi
call fcn.00403148
lea ecx, [esp + 0x20]
test al, al
je 0x6e524d
lea eax, [esp + 0xc]
push eax
call fcn.0040bfe6
mov esi, eax
lea ecx, [esp + 0x20]
lea eax, [esp + 0x14]
push eax
call fcn.0040bb8b
push dword [esi + 4]
mov ecx, ebx
push dword [esi]
push dword [eax + 4]
push dword [eax]
call fcn.0040fdf3
pop esi
mov eax, ebx
pop ebx
add esp, 0x14
ret 4
push edi
call fcn.0040927d
mov ecx, eax
xor edx, edx
shr ecx, 6
xor esi, esi
lea edi, [ebx + ecx*8]
mov ecx, eax
and ecx, 0x3f
bts edx, ecx
cmp ecx, 0x20
cmovae esi, edx
xor edx, esi
cmp ecx, 0x40
cmovae esi, edx
or dword [edi], edx
or dword [edi + 4], esi
pop edi
cmp eax, 0x40
jne 0x6e529f
lea eax, [esp + 0xa]
push eax
lea ecx, [esp + 0x24]
call fcn.0040efa7
pop esi
mov ax, word [eax]
mov word [ebx + 0x18], ax
mov eax, ebx
pop ebx
add esp, 0x14
ret 4
cmp eax, 0x44
jne 0x6e52c3
lea eax, [esp + 0xa]
push eax
lea ecx, [esp + 0x24]
call fcn.00404895
pop esi
mov ax, word [eax]
mov word [ebx + 0x1a], ax
mov eax, ebx
pop ebx
add esp, 0x14
ret 4
cmp eax, 0x3e
jne 0x6e52de
lea ecx, [esp + 0x20]
call fcn.0041137e
mov dword [ebx + 0x38], eax
mov eax, ebx
pop esi
pop ebx
add esp, 0x14
ret 4
cmp eax, 0x3f
jne 0x6e52f9
lea ecx, [esp + 0x20]
call fcn.0041137e
mov dword [ebx + 0x3c], eax
mov eax, ebx
pop esi
pop ebx
add esp, 0x14
ret 4
cmp eax, 0x42
jne 0x6e5317
lea ecx, [esp + 0x20]
call fcn.0040f560
mov dword [ebx + 0x20], eax
mov eax, ebx
pop esi
mov dword [ebx + 0x24], edx
pop ebx
add esp, 0x14
ret 4
cmp eax, 0x43
jne 0x6e5335
lea ecx, [esp + 0x20]
call fcn.0040808a
mov dword [ebx + 0x28], eax
mov eax, ebx
pop esi
mov dword [ebx + 0x2c], edx
pop ebx
add esp, 0x14
ret 4
cmp eax, 0x41
jne 0x6e5349
lea ecx, [esp + 0x20]
call fcn.00409052
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], edx
pop esi
mov eax, ebx
pop ebx
add esp, 0x14
ret 4
Function at 0x4087ab
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x4c2c90
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx]
jmp fcn.00409962
Function at 0x408b84
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x5730b0
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x78], 0
je 0x5730c3
mov eax, dword [esi + 0x74]
jmp 0x5730d6
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x5731ef
mov eax, dword [ecx]
call dword [eax + 0x10]
sub eax, dword [esi + 0x70]
test eax, eax
je 0x5731ef
sub esp, 0x18
mov edx, esp
mov dword [edx], 0
mov dword [edx + 4], 0
mov eax, dword [esi + 0x68]
test eax, eax
je 0x5730fb
lock inc dword [eax + 4]
mov eax, dword [esi + 0x64]
mov dword [edx], eax
mov eax, dword [esi + 0x68]
mov dword [edx + 4], eax
mov eax, dword [esi + 0x6c]
mov dword [edx + 8], eax
mov eax, dword [esi + 0x70]
mov dword [edx + 0xc], eax
mov ecx, dword [esi + 0x78]
mov eax, dword [esi + 0x74]
mov dword [edx + 0x14], ecx
lea ecx, [esp + 0x30]
mov dword [edx + 0x10], eax
call fcn.00410e2e
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], 0
push eax
lea ecx, [esp + 0x24]
call fcn.00406979
mov eax, dword [esp + 0xc]
test eax, eax
je 0x573196
mov ebx, dword [esp + 0x3c]
mov esi, dword [esp + 0x20]
mov dword [esp + 0x18], 0x937f60
mov dword [ebx], eax
test esi, esi
je 0x57318b
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x57318b
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x57318b
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 4
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
movzx eax, word [eax]
push eax
lea eax, [esi + 0x1ec]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00404737
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x3c]
test ecx, ecx
je 0x5731d5
mov dword [esi], ecx
lea ecx, [esp + 0x18]
call fcn.0040dab7
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 4
lea ecx, [esp + 0x18]
mov dword [esi], 0
call fcn.0040dab7
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 4
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
mov dword [eax], 0
add esp, 0x2c
ret 4
Function at 0x408f49
Capabilities:
Terminate process

Disassembly:
jmp 0x6c1860
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, ecx
mov eax, dword [ebx + 4]
cmp eax, 9
jl 0x6c1878
cmp eax, 0xe
jle 0x6c1880
add eax, 0xfffffff1
cmp eax, 2
ja 0x6c1895
test ebx, ebx
je 0x6c1895
call fcn.00409a1b
test eax, eax
je 0x6c1895
push ebx
mov ecx, eax
call fcn.00412ae4
mov eax, dword [esi]
cmp dword [eax + 0x30], 0
je 0x6c18c5
cmp byte [eax + 0x34], 0
je 0x6c18b0
push ebx
call fcn.006c20f0
add esp, 4
test al, al
je 0x6c18c5
mov eax, dword [esi]
push ebx
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x6c19b4
push ebx
call fcn.006c20f0
add esp, 4
test al, al
je 0x6c19b4
push ebp
push edi
call fcn.0040e79b
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 8]
push eax
mov dword [esp + 0x14], 0x956ba4
call fcn.00404c14
add esp, 4
mov ebp, eax
call fcn.0040e79b
mov edi, eax
test ebp, ebp
je 0x6c1913
mov esi, ebp
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x6c1908
sub esi, ecx
jmp 0x6c1915
xor esi, esi
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0xc]
sub eax, ecx
cmp esi, eax
jbe 0x6c192e
push esi
push ebp
mov ecx, edi
call fcn.0041214d
mov edi, eax
jmp 0x6c1940
test esi, esi
je 0x6c1940
push esi
push ebp
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [edi + 0xc], esi
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0xc]
sub eax, ecx
cmp eax, 2
jae 0x6c195d
push 2
push 0x924068
mov ecx, edi
call fcn.0041214d
jmp 0x6c196a
mov ax, word [0x924068]
mov word [ecx], ax
add dword [edi + 0xc], 2
mov eax, dword [ebx]
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call dword [eax + 8]
call fcn.0040e79b
mov edx, eax
pop edi
pop ebp
mov ecx, dword [edx + 8]
mov esi, dword [edx + 0xc]
sub ecx, esi
cmp ecx, 1
jae 0x6c199c
push 1
push 0x92406c
mov ecx, edx
call fcn.0041214d
jmp 0x6c19a6
mov al, byte [0x92406c]
mov byte [esi], al
inc dword [edx + 0xc]
cmp byte [ebx + 8], 0
jne 0x6c19b4
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop esi
pop ebx
add esp, 8
ret 4
Function at 0x4091c9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x5614b0
sub esp, 0xa8
mov eax, dword [0xa0b130]
xor eax, esp
mov dword [esp + 0xa4], eax
mov edx, dword [esp + 0xb0]
xor eax, eax
push ebx
push ebp
mov ebp, ecx
mov word [esp + 0x16], ax
mov ecx, dword [esp + 0xbc]
xorps xmm0, xmm0
mov dword [esp + 0x1a], eax
mov dword [esp + 0x30], eax
push esi
push edi
movups xmmword [esp + 0x28], xmm0
cmp ecx, 4
jb 0x5614f8
movzx eax, word [edx + 2]
add ecx, 0xfffffffc
mov word [esp + 0x1c], ax
push ecx
lea eax, [edx + 4]
push eax
lea ecx, [esp + 0x44]
call fcn.00407784
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x74]
call fcn.0040e55c
mov esi, dword [esp + 0x10]
test esi, esi
je 0x561580
mov eax, dword [esp + 0x7c]
lea ecx, [esp + 0x88]
mov dword [esp + 0x10], 0
cmp eax, ecx
je 0x56154d
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov edi, dword [esp + 0x54]
mov dword [esp + 0x4c], 0x937f60
test edi, edi
je 0x5615d2
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x5615d2
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], ebx
dec ebx
jne 0x5615d2
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
jmp 0x5615d2
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0xc4]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x78]
call fcn.0040e322
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x5615c1
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x74]
call fcn.00404bc9
mov esi, dword [esp + 0x10]
test esi, esi
je 0x5615f4
lea ecx, [esp + 0x3c]
mov dword [esp + 0x10], 0
call fcn.004079e6
test esi, esi
je 0x5615fd
lea eax, [esp + 0x17]
mov byte [esp + 0x17], 0
push eax
push ecx
mov eax, esp
mov dword [eax], esi
call fcn.0040fe9d
add esp, 8
xor eax, eax
jmp 0x561681
lea ecx, [esp + 0x3c]
call fcn.004079e6
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0x1c]
sub ebx, dword [ebp + 8]
push eax
lea eax, [esp + 0xc0]
sar ebx, 2
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
push dword [ebp]
lea eax, [esp + 0x28]
push eax
call fcn.0040222a
add esp, 0x14
mov edi, dword [eax]
mov dword [eax], 0
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x561642
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0xc], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], edi
cmp eax, dword [ebp + 0x10]
je 0x561659
mov dword [eax], edi
add dword [ebp + 0xc], 4
jmp 0x561675
lea ecx, [esp + 0x10]
push ecx
push eax
lea ecx, [ebp + 8]
call fcn.004106a9
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x561675
mov edx, dword [ecx]
push 1
call dword [edx]
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x2cc]
mov eax, ebx
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004087b5
add esp, 0xa8
ret 0xc
Function at 0x409340
Capabilities:
Encode data using xor

Disassembly:
jmp 0x454260
sub esp, 0x28
mov eax, dword [0xa0b130]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov ebx, dword [esp + 0x34]
xorps xmm0, xmm0
push ebp
push esi
push edi
mov ebp, ecx
xor edi, edi
mov dword [esp + 0x10], ebp
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
test ebx, ebx
je 0x4542c9
mov ebp, dword [esp + 0x3c]
movzx edx, byte [edi + ebp]
lea esi, [esp + 0x14]
mov eax, edx
xor ecx, ecx
shr eax, 6
and edx, 0x3f
lea esi, [esi + eax*8]
xor eax, eax
bts eax, edx
cmp edx, 0x20
cmovae ecx, eax
xor eax, ecx
cmp edx, 0x40
cmovae ecx, eax
or dword [esi], eax
or dword [esi + 4], ecx
inc edi
cmp edi, ebx
jne 0x454293
mov ebp, dword [esp + 0x10]
mov ebx, dword [ebp + 4]
mov eax, dword [esp + 0x44]
cmp ebx, eax
cmovb eax, ebx
cmp eax, ebx
je 0x454312
mov ebp, dword [ebp]
nop dword [eax]
movzx edi, byte [eax + ebp]
xor esi, esi
mov ecx, edi
xor edx, edx
and ecx, 0x3f
bts esi, ecx
cmp ecx, 0x20
cmovae edx, esi
xor esi, edx
cmp ecx, 0x40
cmovae edx, esi
shr edi, 6
and esi, dword [esp + edi*8 + 0x14]
and edx, dword [esp + edi*8 + 0x18]
or esi, edx
jne 0x454315
inc eax
cmp eax, ebx
jne 0x4542e0
or eax, 0xffffffff
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004087b5
add esp, 0x28
ret 0xc
Function at 0x40a542
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x45c4f0
sub esp, 0x118
mov eax, dword [0xa0b130]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x14]
push esi
mov esi, dword [esp + 0x120]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0xc]
push 0x104
push ecx
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], 0
push eax
mov dword [esp + 0x24], 0x80
call fcn.004095cf
mov ecx, dword [esp + 0x14]
add esp, 0x10
test ecx, ecx
je 0x45c563
mov eax, dword [esp + 8]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x45c5da
push eax
jmp 0x45c5d1
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45c59b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x45c58e
cmp eax, 3
je 0x45c58e
push eax
push esi
call fcn.00409de0
add esp, 8
jmp 0x45c554
call fcn.00415dfc
mov dword [esi], 2
jmp 0x45c551
cmp dword [esp + 0x128], 1
jne 0x45c5b6
test al, 1
je 0x45c5b6
call fcn.00415dfc
mov dword [esi], 0xd
jmp 0x45c551
mov dword [esi], 0
call fcn.0040ab32
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x18]
cmp ecx, eax
je 0x45c5da
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [esp + 0x118]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004087b5
add esp, 0x118
ret

Function at 0x40a6ff
Capabilities:
Get system information on windows

Disassembly:
jmp 0x45c640
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x1c]
add esp, 0x24
ret
Function at 0x40a9a7
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4dbea0
sub esp, 0x34
mov ecx, dword [esp + 0x3c]
mov eax, 0x2aaaaaab
push ebx
push ebp
mov ebp, dword [esp + 0x40]
sub ecx, ebp
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
mov dword [esp + 8], eax
mov ebx, edx
sar ebx, 1
test ebx, ebx
jle 0x4dc04b
lea eax, [edx - 1]
mov ecx, eax
mov dword [esp + 0xc], eax
lea eax, [ebx + ebx*2]
sar ecx, 1
lea eax, [eax*8]
mov dword [esp + 0x40], ecx
push esi
add eax, ebp
push edi
nop
movups xmm0, xmmword [eax - 0x18]
sub eax, 0x18
dec ebx
mov dword [esp + 0x4c], ebx
mov edi, ebx
mov dword [esp + 0x18], eax
mov esi, ebx
movups xmmword [esp + 0x1c], xmm0
movups xmmword [esp + 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esp + 0x3c], xmm0
cmp ebx, ecx
jge 0x4dbf80
mov ebx, dword [esp + 0x48]
add esi, esi
lea ecx, [ebp + 0x30]
lea eax, [esi + esi*2]
lea ecx, [ecx + eax*8]
lea eax, [ecx - 0x18]
push eax
push ecx
call fcn.0040ce0f
movzx eax, al
add esp, 8
xor eax, 1
inc eax
add esi, eax
lea eax, [esi + esi*2]
lea ecx, [eax*8]
lea eax, [edi + edi*2]
mov edi, esi
lea edx, [eax*8]
movups xmm0, xmmword [ecx + ebp]
movups xmmword [edx + ebp], xmm0
mov eax, dword [ecx + ebp + 0x10]
mov ecx, dword [ecx + ebp + 0x14]
mov dword [edx + ebp + 0x10], eax
mov dword [edx + ebp + 0x14], ecx
cmp esi, ebx
jl 0x4dbf21
mov ebx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x10]
cmp edi, ecx
jne 0x4dbfba
test dl, 1
jne 0x4dbfba
lea eax, [edx + edx*2]
lea ecx, [eax*8]
movups xmm0, xmmword [ecx + ebp - 0x18]
lea eax, [edi + edi*2]
mov edi, dword [esp + 0x14]
lea edx, [eax*8]
movups xmmword [edx + ebp], xmm0
mov eax, dword [ecx + ebp - 8]
mov ecx, dword [ecx + ebp - 4]
mov dword [edx + ebp + 0x10], eax
mov dword [edx + ebp + 0x14], ecx
cmp ebx, edi
jge 0x4dc012
nop
lea esi, [edi - 1]
sar esi, 1
lea eax, [esi + esi*2]
lea ebx, [eax*8]
lea eax, [esp + 0x2c]
add ebx, ebp
push eax
push ebx
call fcn.0040ce0f
add esp, 8
test al, al
je 0x4dc00e
movups xmm0, xmmword [ebx]
lea eax, [edi + edi*2]
mov edi, esi
lea edx, [eax*8]
movups xmmword [edx + ebp], xmm0
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
mov ebx, dword [esp + 0x4c]
mov dword [edx + ebp + 0x10], eax
mov dword [edx + ebp + 0x14], ecx
cmp ebx, esi
jl 0x4dbfc0
jmp 0x4dc012
mov ebx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x40]
lea eax, [edi + edi*2]
lea edx, [eax*8]
mov eax, dword [esp + 0x3c]
mov dword [edx + ebp + 0x10], eax
mov eax, dword [esp + 0x18]
mov dword [edx + ebp + 0x14], ecx
mov ecx, dword [esp + 0x48]
movups xmm0, xmmword [esp + 0x1c]
movups xmmword [edx + ebp], xmm0
mov edx, dword [esp + 0x10]
test ebx, ebx
jg 0x4dbef0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x40aee8
Capabilities:
Read file on windows

Disassembly:
jmp 0x462ab0
sub esp, 0x10
push dword [esp + 0x24]
or ecx, 0xffffffff
mov dword [esp + 4], 0
cmp dword [esp + 0x24], 0xffffffff
lea eax, [esp + 4]
push eax
cmovb ecx, dword [esp + 0x28]
push ecx
push dword [esp + 0x28]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x462b23
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x462b23
cmp eax, 0x26
je 0x462b23
push eax
lea eax, [esp + 0xc]
push eax
call fcn.00409de0
push dword [eax + 4]
push dword [eax]
lea eax, [esp + 0x14]
push eax
call fcn.0040dd73
mov eax, dword [esp + 0x28]
add esp, 0x14
mov ecx, dword [esp + 4]
or byte [eax + 4], 1
mov dword [eax], ecx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp]
and byte [eax + 4], 0xfe
mov dword [eax], ecx
add esp, 0x10
ret
Function at 0x40bb22
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x624240
sub esp, 0x60
push ebx
push esi
mov dword [esp + 8], 0
mov esi, dword [esp + 0x70]
push edi
movzx ecx, word [esi + 0xe]
cmp ecx, 0xffff
jne 0x62438d
sub esi, dword [esp + 0x78]
mov eax, dword [esp + 0x84]
sar esi, 4
cmp esi, eax
jb 0x624310
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x74]
mov dword [esp + 0x24], ecx
push eax
lea eax, [esp + 0x34]
mov word [esp + 0x48], 0x103
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x44], str.__is_past_the_end_of_the_SHT_SYMTAB_SHNDX_section_of_size
lea ecx, [esp + 0x2c]
mov word [esp + 0x58], 0x103
push eax
mov dword [esp + 0x54], str.extended_symbol_index__
mov word [esp + 0x68], 0x109
mov word [esp + 0x74], 0x109
mov dword [esp + 0x24], str.extended_symbol_index__
mov dword [esp + 0x28], esi
mov word [esp + 0x2c], 0x903
mov dword [esp + 0x34], str.__is_past_the_end_of_the_SHT_SYMTAB_SHNDX_section_of_size
mov word [esp + 0x38], 0x302
mov dword [esp + 0x3c], ecx
mov word [esp + 0x44], 0x902
mov dword [esp + 0x80], 3
call fcn.00402b1c
mov bl, byte [esp + 0x20]
add esp, 0xc
mov esi, dword [esp + 0xc]
or bl, 1
jmp 0x624321
mov eax, dword [esp + 0x80]
mov bl, byte [esp + 0x14]
and bl, 0xfe
mov esi, dword [eax + esi*4]
mov al, bl
not al
test al, 1
jne 0x624367
and bl, 1
je 0x624336
mov dword [esp + 0x74], esi
xor esi, esi
jmp 0x62433c
xor eax, eax
mov dword [esp + 0x74], eax
mov edi, dword [esp + 0x70]
xor ecx, ecx
mov eax, dword [esp + 0x74]
or byte [edi + 4], 1
mov dword [edi], eax
test bl, bl
je 0x624382
test esi, esi
je 0x624382
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x60
ret 0x18
mov edi, dword [esp + 0x70]
and byte [edi + 4], 0xfe
mov dword [edi], esi
test bl, 1
je 0x624382
test esi, esi
je 0x624382
mov edx, dword [esi]
mov ecx, esi
push 1
call dword [edx]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x60
ret 0x18
test ecx, ecx
je 0x6243ac
cmp ecx, 0xff00
jae 0x6243ac
mov eax, dword [esp + 0x70]
and byte [eax + 4], 0xfe
mov dword [eax], ecx
pop edi
pop esi
pop ebx
add esp, 0x60
ret 0x18
mov eax, dword [esp + 0x70]
pop edi
pop esi
pop ebx
and byte [eax + 4], 0xfe
mov dword [eax], 0
add esp, 0x60
ret 0x18
Function at 0x40c5e0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x454160
sub esp, 0x28
mov eax, dword [0xa0b130]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov ebx, dword [esp + 0x34]
xorps xmm0, xmm0
push ebp
push esi
push edi
mov ebp, ecx
xor edi, edi
mov dword [esp + 0x10], ebp
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
test ebx, ebx
je 0x4541c9
mov ebp, dword [esp + 0x3c]
movzx edx, byte [edi + ebp]
lea esi, [esp + 0x14]
mov eax, edx
xor ecx, ecx
shr eax, 6
and edx, 0x3f
lea esi, [esi + eax*8]
xor eax, eax
bts eax, edx
cmp edx, 0x20
cmovae ecx, eax
xor eax, ecx
cmp edx, 0x40
cmovae ecx, eax
or dword [esi], eax
or dword [esi + 4], ecx
inc edi
cmp edi, ebx
jne 0x454193
mov ebp, dword [esp + 0x10]
mov ebx, dword [ebp + 4]
mov eax, dword [esp + 0x44]
cmp ebx, eax
cmovb eax, ebx
cmp eax, ebx
je 0x454212
mov ebp, dword [ebp]
nop dword [eax]
movzx edi, byte [eax + ebp]
xor esi, esi
mov ecx, edi
xor edx, edx
and ecx, 0x3f
bts esi, ecx
cmp ecx, 0x20
cmovae edx, esi
xor esi, edx
cmp ecx, 0x40
cmovae edx, esi
shr edi, 6
and esi, dword [esp + edi*8 + 0x14]
and edx, dword [esp + edi*8 + 0x18]
or esi, edx
je 0x454215
inc eax
cmp eax, ebx
jne 0x4541e0
or eax, 0xffffffff
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004087b5
add esp, 0x28
ret 0xc