joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412ce0
Capabilities:
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
push str.Superman
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0xf
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.00412010
call fcn.00412600
mov edi, eax
call fcn.00412790
mov edx, eax
call fcn.00412c60
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, al
cmp eax, 0x31
jne 0x412d7a
push str._____Loading_method_:_1_n
call fcn.0041a300
add esp, 4
mov ecx, edi
call fcn.00410df0
cmp eax, 4
jne 0x412d59
push str.____Cheat_already_loaded_n
call fcn.0041a300
add esp, 4
push 0x7d0
call esi
jmp 0x412dcb
cmp eax, 5
jne 0x412d74
push str._____Failed_to_create_driver_buffer_n
call fcn.0041a300
add esp, 4
push 0x7d0
call esi
jmp 0x412dcb
test eax, eax
je 0x412dbe
jmp 0x412dcb
cmp eax, 0x32
jne 0x412dcb
push str._____Loading_method_:_2_n
call fcn.0041a300
add esp, 4
mov ecx, edi
call fcn.00411700
cmp eax, 0xffffffff
jne 0x412dae
push str._____Failed_to_inject_the_cheat_n
call fcn.0041a300
add esp, 4
push 0x7d0
call esi
jmp 0x412dcb
cmp eax, 4
jne 0x412dba
push str.____Cheat_already_loaded_n
jmp 0x412dc3
test eax, eax
jne 0x412dcb
push str.____Cheat_loaded_successfully_n
call fcn.0041a300
add esp, 4
push 0xbb8
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x412de0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x4c], 0
je 0x412e02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x49]
inc eax
xor byte [edx], cl
cmp eax, 0x4b
jb 0x412df0
mov byte [esi + 0x4c], 0
pop esi
ret

Function at 0x412e10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x6e], 0
je 0x412e32
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x49]
inc eax
xor byte [edx], cl
cmp eax, 0x6d
jb 0x412e20
mov byte [esi + 0x6e], 0
pop esi
ret

Function at 0x412e40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x58], 0
je 0x412e62
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x49]
inc eax
xor byte [edx], cl
cmp eax, 0x57
jb 0x412e50
mov byte [esi + 0x58], 0
pop esi
ret

Function at 0x412e70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x72], 0
je 0x412e92
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x49]
inc eax
xor byte [edx], cl
cmp eax, 0x71
jb 0x412e80
mov byte [esi + 0x72], 0
pop esi
ret

Function at 0x412ea0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x62], 0
je 0x412ec2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x49]
inc eax
xor byte [edx], cl
cmp eax, 0x61
jb 0x412eb0
mov byte [esi + 0x62], 0
pop esi
ret
Function at 0x412ed0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x74], 0
je 0x412ef2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x49]
inc eax
xor byte [edx], cl
cmp eax, 0x73
jb 0x412ee0
mov byte [esi + 0x74], 0
pop esi
ret

Function at 0x412f00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x60], 0
je 0x412f22
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x49]
inc eax
xor byte [edx], cl
cmp eax, 0x5f
jb 0x412f10
mov byte [esi + 0x60], 0
pop esi
ret

Function at 0x412f30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x76], 0
je 0x412f52
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x49]
inc eax
xor byte [edx], cl
cmp eax, 0x75
jb 0x412f40
mov byte [esi + 0x76], 0
pop esi
ret

Function at 0x412f60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5c], 0
je 0x412f82
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x49]
inc eax
xor byte [edx], cl
cmp eax, 0x5b
jb 0x412f70
mov byte [esi + 0x5c], 0
pop esi
ret

Function at 0x412f90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x7a], 0
je 0x412fb2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x49]
inc eax
xor byte [edx], cl
cmp eax, 0x79
jb 0x412fa0
mov byte [esi + 0x7a], 0
pop esi
ret

Function at 0x412fc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x53], 0
je 0x412fe2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x49]
inc eax
xor byte [edx], cl
cmp eax, 0x52
jb 0x412fd0
mov byte [esi + 0x53], 0
pop esi
ret

Function at 0x412ff0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x75], 0
je 0x413012
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x49]
inc eax
xor byte [edx], cl
cmp eax, 0x74
jb 0x413000
mov byte [esi + 0x75], 0
pop esi
ret
Function at 0x414230
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a6b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x1c
push esi
mov esi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x2c]
push 0x40
movups xmmword [ebp - 0x2c], xmm0
call fcn.00406230
movups xmm0, xmmword [str.BufferedTransformation:_this_object_doesnt_allow_input]
mov edx, eax
mov dword [ebp - 0x1c], 0x37
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x18], 0x3f
movups xmmword [edx], xmm0
movups xmm0, xmmword [0x449a50]
movups xmmword [edx + 0x10], xmm0
movups xmm0, xmmword [0x449a60]
movups xmmword [edx + 0x20], xmm0
mov eax, dword [0x449a70]
mov dword [edx + 0x30], eax
mov ax, word [0x449a74]
mov word [edx + 0x34], ax
mov al, byte [0x449a76]
mov byte [edx + 0x36], al
mov byte [edx + 0x37], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 0
call fcn.0041ad80
mov ecx, dword [ebp - 0x18]
mov dword [esi], vtable.CryptoPP::NotImplemented.0
cmp ecx, 0x10
jb 0x41432f
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x414325
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x414325
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00438d0e
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi], vtable.CryptoPP::InputRejecting_class_CryptoPP::BufferedTransformation_::InputRejected.0
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x414350
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a6b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x1c
push esi
mov esi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x2c]
push 0x40
movups xmmword [ebp - 0x2c], xmm0
call fcn.00406230
movups xmm0, xmmword [str.BufferedTransformation:_this_object_doesnt_allow_input]
mov edx, eax
mov dword [ebp - 0x1c], 0x37
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x18], 0x3f
movups xmmword [edx], xmm0
movups xmm0, xmmword [0x449a50]
movups xmmword [edx + 0x10], xmm0
movups xmm0, xmmword [0x449a60]
movups xmmword [edx + 0x20], xmm0
mov eax, dword [0x449a70]
mov dword [edx + 0x30], eax
mov ax, word [0x449a74]
mov word [edx + 0x34], ax
mov al, byte [0x449a76]
mov byte [edx + 0x36], al
mov byte [edx + 0x37], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 0
call fcn.0041ad80
mov ecx, dword [ebp - 0x18]
mov dword [esi], vtable.CryptoPP::NotImplemented.0
cmp ecx, 0x10
jb 0x41444f
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x414445
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x414445
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00438d0e
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi], vtable.CryptoPP::InputRejecting_class_CryptoPP::Filter_::InputRejected.0
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x41bbd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ecx]
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x41bc2e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x41bbf0
mov eax, dword [edi]
jmp 0x41bd19
cmp eax, 0x4e0
jb 0x41bd19
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x41bc50
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x41bca0
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41cc70
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xorps xmm0, xmm0
push 0x44851c
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
movups xmmword [esi + 0x24], xmm0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
je 0x41cdba
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationProcess
push ebx
call edi
push str.NtQuerySystemInformation
push ebx
mov dword [esi + 0x18], eax
call edi
push str.NtQueryInformationThread
push ebx
mov dword [esi + 0x1c], eax
call edi
cmp dword [esi + 0x18], 0
mov dword [esi + 0x20], eax
je 0x41cdb1
cmp dword [esi + 0x1c], 0
je 0x41cdb1
test eax, eax
je 0x41cdb1
xor ecx, ecx
mov dword [esi + 0xc], 0x10000
mov dword [esi + 4], 0
call fcn.00404260
cmp eax, 0x3d
mov edx, 0x15
mov ecx, 0xc
push str.NtDelayExecution
cmove ecx, edx
push ebx
mov dword [ebp - 4], ecx
call edi
add eax, dword [ebp - 4]
push str.NtWaitForSingleObject
push ebx
mov dword [esi + 0x24], eax
call edi
add eax, dword [ebp - 4]
push str.NtWaitForMultipleObjects
push ebx
mov dword [esi + 0x28], eax
call edi
add eax, dword [ebp - 4]
push str.NtSignalAndWaitForSingleObject
push ebx
mov dword [esi + 0x2c], eax
call edi
mov ebx, dword [ebp - 4]
add eax, ebx
cmp dword [0x459a14], 0x3839
mov dword [esi + 0x30], eax
jb 0x41cdb1
push str.win32u.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x38], eax
test eax, eax
je 0x41cdb1
push str.NtUserMsgWaitForMultipleObjectsEx
push eax
call edi
add eax, ebx
mov dword [esi + 0x34], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d120
Capabilities:
Check os version
Get number of processors

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x459a18]
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
test edx, edx
jne 0x41d17c
mov ecx, dword fs:[0x30]
test ecx, ecx
je 0x41d20a
mov edx, dword [ecx + 0xa8]
mov esi, dword [ecx + 0xa4]
cmp edx, 0xa
jb 0x41d164
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x41d155
lea eax, [esi + esi*4]
lea edx, [edx + eax*2]
movzx eax, word [ecx + 0xac]
mov dword [0x459a18], edx
mov dword [0x459a14], eax
cmp edx, 0x64
jb 0x41d20a
mov eax, dword [ebx + 8]
test eax, eax
je 0x41d20a
push dword [eax + 0x24]
push 0
push 0x840
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x41d20a
mov ecx, dword [ebx + 0x20]
lea eax, [ebp - 0x20]
push 0
push 0x1c
push eax
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push 0
push edi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call ecx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
js 0x41d20a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41d20a
push 0
push 2
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
add eax, 0xfca
push eax
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x41d20a
mov eax, dword [ebp - 4]
pop edi
shr eax, 0xd
pop esi
and al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423110
Capabilities:
Check os version

Disassembly:
mov ecx, dword [0x459a18]
mov byte [0x455178], 1
push esi
test ecx, ecx
jne 0x423167
mov esi, dword fs:[0x30]
test esi, esi
je 0x42317e
mov edx, dword [esi + 0xa8]
mov ecx, dword [esi + 0xa4]
cmp edx, 0xa
jb 0x42314f
nop
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x423140
lea eax, [ecx + ecx*4]
lea ecx, [edx + eax*2]
movzx eax, word [esi + 0xac]
mov dword [0x459a18], ecx
mov dword [0x459a14], eax
movzx eax, byte [0x4551d8]
cmp ecx, 0x3d
mov edx, 1
cmove eax, edx
mov byte [0x4551d8], al
pop esi
ret

Function at 0x423180
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x455158]
sub esp, 0x18
mov byte [0x45515c], 1
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x4231ae
push eax
call edi
test eax, eax
jne 0x4231ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x459a18]
test ecx, ecx
jne 0x4231fb
mov esi, dword fs:[0x30]
test esi, esi
je 0x42321d
mov edx, dword [esi + 0xa8]
mov ecx, dword [esi + 0xa4]
cmp edx, 0xa
jb 0x4231e3
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x4231d4
lea eax, [ecx + ecx*4]
lea ecx, [edx + eax*2]
movzx eax, word [esi + 0xac]
mov dword [0x459a18], ecx
mov dword [0x459a14], eax
cmp ecx, 0x3d
jne 0x42321d
mov eax, dword [0x4551b8]
mov byte [0x4551bc], 1
test eax, eax
je 0x42321d
push eax
call edi
test eax, eax
jne 0x42321d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x459a1c]
call edi
mov dword [esp + 8], 0x32
mov dword [esp + 0xc], 0
nop word [eax + eax]
mov ecx, dword [0x459e84]
test ecx, ecx
je 0x42333d
cmp byte [0x459e88], 0
je 0x423261
cmp byte [ecx + 0x6c], 0
jne 0x42333d
lea eax, [esp + 8]
push eax
call fcn.00405e30
test eax, eax
jne 0x423240
mov ecx, dword [0x459a18]
test ecx, ecx
jne 0x4232bc
mov esi, dword fs:[0x30]
test esi, esi
je 0x4232f8
mov edx, dword [esi + 0xa8]
mov ecx, dword [esi + 0xa4]
cmp edx, 0xa
jb 0x4232a4
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x423295
lea eax, [ecx + ecx*4]
lea ecx, [edx + eax*2]
movzx eax, word [esi + 0xac]
mov dword [0x459a18], ecx
mov dword [0x459a14], eax
cmp ecx, 0x3d
jne 0x4232f8
mov dword [esp + 0x10], 0x32
mov dword [esp + 0x14], 0
mov ecx, dword [0x459e8c]
test ecx, ecx
je 0x42333d
cmp byte [0x459e90], 0
je 0x4232ea
cmp byte [ecx + 0x6c], 0
jne 0x42333d
lea eax, [esp + 0x10]
push eax
call fcn.00405e30
test eax, eax
jne 0x4232d1
mov dword [esp + 0x18], 0x32
mov dword [esp + 0x1c], 0
nop dword [eax + eax]
mov ecx, dword [0x459ea8]
test ecx, ecx
je 0x42333d
cmp byte [0x459eac], 0
je 0x423329
cmp byte [ecx + 0x6c], 0
jne 0x42333d
lea eax, [esp + 0x18]
push eax
call fcn.00405e30
test eax, eax
jne 0x423310
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 4
call fcn.00406660
int3

Function at 0x428750
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x4583f8], 0
jne 0x42875e
call fcn.00437690
cmp byte [0x458401], 0
je 0x42877c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00437a20
add esp, 0x10
ret
jmp fcn.00426b00
Function at 0x4386b1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0043868d
pop esi
leave
ret 8

Function at 0x439570
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4395af
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4395af
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4395af
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4395af
cmp dword [ecx + 0x74], 0xe
jbe 0x4395af
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x403ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x403af9
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + section..data]
inc esi
xor eax, edx
dec ecx
jne 0x403ae4
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x401010
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, dword fs:[0x30]
nop
mov ecx, ecx
mov eax, dword [eax + 0xc]
nop
mov ecx, ecx
mov eax, dword [eax + 0x1c]
mov esi, dword [eax + 8]
nop
mov ecx, ecx
mov ebx, dword [eax + 0x20]
nop
mov ecx, ecx
mov eax, dword [eax]
nop
mov ecx, ecx
cmp dword [ebx + 0xc], 0x320033
nop
mov ecx, ecx
jne 0x401028
nop
mov ecx, ecx
mov dword [ebp - 4], esi
nop
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401b76
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401bb5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401bb5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401bb5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401bb5
cmp dword [ecx + 0x74], 0xe
jbe 0x401bb5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4acac0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4aca86
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4acaa4
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4acb02
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4acae9
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4acaf2
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4acafc
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4acade
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4aca68
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4acb4f
dec eax
je 0x4acb46
sub eax, 3
je 0x4acb3d
mov dword [ebp - 4], 0x40
jmp 0x4acb6c
mov dword [ebp - 4], 4
jmp 0x4acb52
mov dword [ebp - 4], 0x20
jmp 0x4acb52
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4acb9e
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4acb1e
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004ac3af
cmpsd dword [esi], dword es:[edi]
mov byte [0x75ff3ae6], al
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x4acbaa
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4ae630
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x4ae661
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4ae650
pop edi
mov eax, edx
pop esi
pop ebp
ret 8