joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bf72
Capabilities:
Get disk information

Disassembly:
push 0x244
mov eax, 0x47d92e
call fcn.00478470
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x41
mov dword [ebp - 0x18], esi
pop edi
push 0x3a
pop eax
mov word [ebp - 0x16], ax
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x220]
push eax
mov word [ebp - 0x18], di
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x104
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x41bfe1
push 0
lea eax, [ebp - 0x220]
mov ecx, ebx
push eax
call fcn.00417b59
test eax, eax
je 0x41bffe
inc edi
cmp di, 0x5a
jbe 0x41bf8d
push 0x48090c
mov ecx, esi
call fcn.004019d1
mov eax, esi
call fcn.0047842b
ret 8
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
and dword [ebp - 0x228], 0
xor ecx, ecx
push 0xffffffffffffffff
push eax
mov word [ebp - 0x238], cx
lea ecx, [ebp - 0x238]
push ebx
mov dword [ebp - 0x224], 7
call fcn.00405cf6
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x250]
call fcn.004019d1
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 1
push ecx
push eax
push esi
call fcn.00402a77
add esp, 0xc
lea ecx, [ebp - 0x250]
call fcn.00401ef9
lea ecx, [ebp - 0x238]
call fcn.00401ef9
jmp 0x41bff4
Function at 0x41c63f
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47da69
mov eax, dword fs:[0]
push eax
mov eax, 0x204c
call fcn.00478630
mov eax, dword [0x4dbf24]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x204c], ecx
mov esi, dword [ebp + 0xc]
mov eax, esi
mov edi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x41c686
mov eax, dword [esi]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x41c78b
and dword [ebp - 0x2044], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x41c6a7
mov eax, dword [esi]
lea ecx, [ebp - 0x2044]
push ecx
push 0xf003f
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
test eax, eax
je 0x41c738
cmp eax, 2
cmove eax, ecx
jmp 0x41c78b
push 0x480c70
lea eax, [ebp - 0x2040]
push esi
push eax
call fcn.00402ae9
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2010]
push ecx
push eax
lea eax, [ebp - 0x2028]
push eax
call fcn.00402ac2
add esp, 0x18
mov ecx, dword [ebp - 0x204c]
push eax
push edi
mov byte [ebp - 4], 1
call fcn.0041c63f
lea ecx, [ebp - 0x2028]
mov dword [ebp - 0x2050], eax
call fcn.00401ef9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2040]
call fcn.00401ef9
mov eax, dword [ebp - 0x2050]
test eax, eax
jne 0x41c78b
xor ecx, ecx
lea eax, [ebp - 0x2058]
mov dword [ebp - 0x2048], 0x1000
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x2048]
push eax
lea eax, [ebp - 0x2010]
push eax
push ecx
push dword [ebp - 0x2044]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x41c6ce
push dword [ebp - 0x2044]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi + 0x14], 8
jb 0x41c783
mov esi, dword [esi]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00478405
leave
ret 8
Function at 0x41df51
Capabilities:
Set environment variable

Disassembly:
push 0xc8
mov eax, 0x47df1b
call fcn.00478470
mov edi, ecx
mov dword [ebp - 0xbc], edi
call fcn.0041c3cc
mov ecx, eax
call fcn.0041d315
push eax
lea ecx, [ebp - 0x7c]
call fcn.004019d1
and dword [ebp - 4], 0
lea eax, [ebp - 0x94]
push eax
call fcn.0041c3cc
mov ecx, eax
call fcn.0041df29
mov eax, dword [edi + 4]
mov ebx, dword [edi]
mov byte [ebp - 4], 1
mov dword [ebp - 0xc4], eax
jmp 0x41e05b
mov esi, ebx
lea edi, [ebp - 0xd4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0xcc], 0
mov edi, dword [ebp - 0xbc]
je 0x41e058
push dword [ebp - 0xcc]
lea eax, [ebp - 0x7c]
mov ecx, edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041dc61
xor ecx, ecx
mov byte [ebp - 0xc0], cl
push dword [ebp - 0xc0]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x58]
push eax
call fcn.004039fa
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00401ef9
push dword [ebp - 0xc8]
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
and dword [ebp - 0x2c], 0
call fcn.00403ca0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x58]
call fcn.0040dc7c
test al, al
jne 0x41e03e
mov ecx, dword [ebp - 0xc8]
lea eax, [ebp - 0x58]
push eax
call fcn.0040a649
lea ecx, [ebp - 0x40]
call fcn.00401ef9
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00401ef9
mov eax, dword [ebp - 0xc4]
add ebx, 0x10
cmp ebx, eax
jne 0x41dfa8
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call fcn.0041dc3d
push eax
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.00405963
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 5
push ecx
mov ecx, eax
call fcn.00405d97
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
push ecx
mov ecx, eax
call fcn.0040609e
cmp dword [eax + 0x14], 8
jb 0x41e0a4
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push eax
push str.USERPROFILE
call esi
lea ecx, [ebp - 0x28]
call fcn.00401ef9
lea ecx, [ebp - 0x4c]
call fcn.00403e8f
lea ecx, [ebp - 0x64]
call fcn.00401ef9
lea ecx, [ebp - 0xa0]
call fcn.00403e8f
lea ecx, [ebp - 0xb8]
call fcn.00401ef9
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00401ef9
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.0040f716
cmp dword [eax + 0x14], 8
jb 0x41e0ff
mov eax, dword [eax]
push eax
push str.LOCALAPPDATA
call esi
lea ecx, [ebp - 0x28]
call fcn.00401ef9
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.004155a9
cmp dword [eax + 0x14], 8
jb 0x41e122
mov eax, dword [eax]
push eax
push str.APPDATA
call esi
lea ecx, [ebp - 0x28]
call fcn.00401ef9
lea ecx, [ebp - 0x94]
call fcn.00401ef9
lea ecx, [ebp - 0x7c]
call fcn.00401ef9
call fcn.0047842b
ret
Function at 0x41e18c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4dbf24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [ebp - 0x114]
pop esi
cmp ecx, 0xa
jb 0x41e1db
push 3
pop eax
jmp 0x41e200
cmp ecx, 6
jb 0x41e1f5
push 2
pop eax
cmp dword [ebp - 0x110], eax
jae 0x41e200
cmp ecx, 6
jne 0x41e1f5
xor eax, eax
inc eax
jmp 0x41e200
xor eax, eax
xor edx, edx
inc eax
cmp ecx, 5
cmove eax, edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478405
leave
ret

Function at 0x41e763
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 8]
push eax
xor eax, eax
push eax
push esi
push 0x41e788
push eax
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
setne al
pop esi
ret

Function at 0x4242de
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jge 0x424300
push str.in_Json::Value::operator___int_index_:_index_cannot_be_negative
push 0x29a
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
pop ecx
pop ecx
push 0x7b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop ebp
jmp fcn.00424306

Function at 0x424906
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
movsx eax, byte [esi + 8]
sub eax, 0
je 0x424875
sub eax, 1
je 0x42486e
sub eax, 1
je 0x42485e
sub eax, 1
je 0x42480f
dec eax
sub eax, 1
jne 0x424875
cmp byte [esi], al
setne al
jmp 0x424877
mov edx, 0x80000000
xor ecx, ecx
call fcn.00478e30
movsd xmm1, qword [esi]
comisd xmm1, xmm0
jb 0x424845
mov edx, 0x7fffffff
or ecx, 0xffffffff
call fcn.00478e30
movsd xmm1, qword [esi]
comisd xmm0, xmm1
jb 0x424845
movaps xmm0, xmm1
pop esi
jmp fcn.00478cdf
push str.double_out_of_Int64_range
push 0x29a
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
pop ecx
pop ecx
push 0x7b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.00424cf6
test al, al
jne 0x42486e
push str.LargestUInt_out_of_Int64_range
jmp 0x42484a
mov eax, dword [esi]
mov edx, dword [esi + 4]
pop esi
ret
xor eax, eax
xor edx, edx
pop esi
ret
jmp 0x4247e3
Function at 0x42490b
Capabilities:
Terminate process

Disassembly:
jmp 0x42499f
push esi
mov esi, ecx
movsx eax, byte [esi + 8]
sub eax, 0
je 0x424a1f
sub eax, 1
je 0x424a08
sub eax, 1
je 0x424a18
sub eax, 1
je 0x4249c7
dec eax
sub eax, 1
jne 0x424a1f
cmp byte [esi], al
setne al
jmp 0x424a21
movsd xmm0, qword [esi]
comisd xmm0, xmmword [0x484988]
jb 0x4249ef
or ecx, 0xffffffff
mov edx, ecx
call fcn.00478df0
comisd xmm0, xmmword [esi]
jb 0x4249ef
movsd xmm0, qword [esi]
pop esi
jmp fcn.00478cd0
push str.double_out_of_UInt64_range
push 0x29a
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
pop ecx
pop ecx
push 0x7b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.00424e05
test al, al
jne 0x424a18
push str.LargestInt_out_of_UInt64_range
jmp 0x4249f4
mov eax, dword [esi]
mov edx, dword [esi + 4]
pop esi
ret
xor eax, eax
xor edx, edx
pop esi
ret

Function at 0x424ab3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp esi, 0xffffffff
jne 0x424acb
push dword [ebp + 8]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
mov esi, eax
mov eax, 0x7ffffffe
cmp esi, 0x7fffffff
cmovae esi, eax
lea ecx, [esi + 1]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
jne 0x424b03
push str.in_Json::Value::duplicateStringValue__:_Failed_to_allocate_string_value_buffer
push 0x29a
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
pop ecx
pop ecx
push 0x7b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push esi
push dword [ebp + 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [edi + esi], 0
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x45c71a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0x14
and dword [edi], 0
call fcn.00453ca0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x45c73b
push 7
pop eax
jmp 0x45c7b2
cmp dword [0x4db414], 0
push ebx
mov ebx, dword [ebp + 0x10]
je 0x45c789
mov eax, dword [0x4db518]
test eax, eax
je 0x45c75b
push 0xc8
call eax
pop ecx
jmp 0x45c75d
xor eax, eax
test eax, eax
jne 0x45c789
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x45c80d
push 0
push 0
mov dword [esi + 0xc], ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x45c796
push 0x14
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [esi + 8], 0
jne 0x45c7ad
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp + 0xc]
pop ecx
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x475516
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
mov edx, dword [esi + 8]
test edi, edi
jle 0x475546
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi]
mov al, byte [ebx + eax]
xor byte [ecx + edx], al
lea eax, [edx + 1]
xor edx, edx
cmp eax, dword [esi + 4]
cmovl edx, eax
inc ebx
cmp ebx, edi
jl 0x47552b
add dword [esi + 0xc], edi
pop edi
mov dword [esi + 8], edx
pop esi
pop ebx
pop ebp
ret
Function at 0x401e70
Capabilities:
Terminate process

Disassembly:
sub esp, 0x124
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0
push 0
call fcn.004050d0
mov esi, eax
add esp, 0xc
cmp esi, 2
je 0x401ee6
cmp esi, 1
mov byte [esp + 0x28], 0
jne 0x401ebc
push pe_nt_image_headers32
lea eax, [esp + 0x2c]
push eax
push 0x1389
call fcn.00405730
mov al, byte [esp + 0x34]
add esp, 0xc
test al, al
jne 0x401ed0
push esi
call fcn.00404e30
add esp, 4
test eax, eax
jne 0x401ed4
mov eax, str.Failed_to_initialize_language_library._n
jmp 0x401ed4
lea eax, [esp + 0x28]
push 1
push eax
call fcn.00403710
add esp, 8
push 3
call fcn.0042a94f
push 1
call fcn.00403010
add esp, 4
test eax, eax
jne 0x401efb
push 3
call fcn.0042a94f
mov ecx, dword [esp + 0x130]
mov edx, dword [esp + 0x12c]
push ecx
push edx
call fcn.004033e0
add esp, 8
test eax, eax
jne 0x401f1e
push 3
call fcn.0042a94f
push edi
xor eax, eax
mov ecx, 9
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x2c], 4
call fcn.00402910
add esp, 4
mov esi, eax
test esi, esi
pop edi
jne 0x401f56
call fcn.00401dc0
test eax, eax
jne 0x401f56
mov esi, 3
call fcn.00403360
cmp esi, 3
jne 0x401f83
push pe_nt_image_headers32
lea ecx, [esp + 0x2c]
push ecx
push 0x187f
call fcn.00405730
lea edx, [esp + 0x34]
push 1
push edx
call fcn.004036b0
add esp, 0x14
call fcn.00405070
mov eax, esi
pop esi
add esp, 0x124
ret
Function at 0x407830
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xd0
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
mov ebx, 0x4478bc
jmp 0x407850
mov ecx, 0xa
mov esi, str.SoftwareSybaseAdaptive_Server_Anywhere
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407866
mov ax, word [0x439f30]
mov word [edi], ax
mov eax, dword [esp + 0xe4]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407880
lea edi, [esp + 0x18]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x407890
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebx]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push eax
call ebp
test eax, eax
jne 0x40790a
mov edx, dword [esp + 0xec]
lea ecx, [esp + 0xf0]
push ecx
mov ecx, dword [esp + 0xec]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40790a
mov ecx, dword [esp + 0xf4]
cmp dword [esp + 0x14], ecx
je 0x407926
add ebx, 4
cmp ebx, 0x4478c4
jl 0x407850
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xd0
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd0
ret

Function at 0x408490
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
mov eax, str.Unknown_error
je 0x4084a0
mov eax, esi
push 0
push str.SQLAnywhere_Fatal_Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
test esi, esi
je 0x4084bd
push esi
call fcn.0042bde6
add esp, 4
push 1
call fcn.0042a94f
pop esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x414db0
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
xor ebp, ebp
push esi
push edi
test ebx, ebx
jne 0x414dc8
pop edi
pop esi
pop ebp
mov eax, 0xe105
pop ebx
ret
mov eax, dword [esp + 0x14]
mov dword [ebx], 0
cmp eax, 0x14
je 0x414de1
pop edi
pop esi
pop ebp
mov eax, 0xe901
pop ebx
ret
mov edi, dword [esp + 0x20]
push edi
push 0x64
call fcn.0040ff80
mov esi, eax
add esp, 8
test esi, esi
jne 0x414e00
pop edi
pop esi
pop ebp
mov eax, 0xf001
pop ebx
ret
push edi
push 0x64
push 0
push esi
call fcn.00410020
push esi
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
mov dword [esi + 0x14], 0xc3d2e1f0
mov dword [esi], 0x4001
call fcn.0041a9c0
push edi
push esi
call fcn.0040ff50
add esp, 0x1c
mov dword [ebx], eax
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x418860
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
xor ebp, ebp
push esi
push edi
test ebx, ebx
jne 0x418878
pop edi
pop esi
pop ebp
mov eax, 0xe105
pop ebx
ret
mov eax, dword [esp + 0x14]
mov dword [ebx], 0
cmp eax, 0x10
je 0x418891
pop edi
pop esi
pop ebp
mov eax, 0xe901
pop ebx
ret
mov edi, dword [esp + 0x20]
push edi
push 0x60
call fcn.0040ff80
mov esi, eax
add esp, 8
test esi, esi
jne 0x4188b0
pop edi
pop esi
pop ebp
mov eax, 0xf001
pop ebx
ret
push edi
push 0x60
push 0
push esi
call fcn.00410020
push esi
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
mov dword [esi], 0x4101
call fcn.0041d3f0
push edi
push esi
call fcn.0040ff50
add esp, 0x1c
mov dword [ebx], eax
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x41d013
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
mov ebx, edx
sub ebx, 0x20
jb 0x41d023
shl ax, 8
sahf
jmp 0x41d047
mov ebx, eax
mov eax, 0x20
sub eax, edx
lea edx, [eax*4 + 0x41d047]
lea edx, [edx + eax*2]
shl eax, 2
sub esi, eax
sub edi, eax
mov ah, bl
sahf
mov ebx, 0
jmp edx
nop
nop
mov eax, dword [esi]
sbb dword [edi], eax
mov eax, dword [esi + 4]
sbb dword [edi + 4], eax
mov eax, dword [esi + 8]
sbb dword [edi + 8], eax
mov eax, dword [esi + 0xc]
sbb dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
sbb dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
sbb dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
sbb dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
sbb dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
sbb dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
sbb dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
sbb dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
sbb dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
sbb dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
sbb dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
sbb dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
sbb dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
sbb dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
sbb dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
sbb dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
sbb dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
sbb dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
sbb dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
sbb dword [edi + 0x58], eax
mov eax, dword [esi + 0x5c]
sbb dword [edi + 0x5c], eax
mov eax, dword [esi + 0x60]
sbb dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
sbb dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
sbb dword [edi + 0x68], eax
mov eax, dword [esi + 0x6c]
sbb dword [edi + 0x6c], eax
mov eax, dword [esi + 0x70]
sbb dword [edi + 0x70], eax
mov eax, dword [esi + 0x74]
sbb dword [edi + 0x74], eax
mov eax, dword [esi + 0x78]
sbb dword [edi + 0x78], eax
mov eax, dword [esi + 0x7c]
sbb dword [edi + 0x7c], eax
mov eax, 0
setb al
cmp ebx, 0
je 0x41d127
add esi, 0x80
add edi, 0x80
mov edx, ebx
jmp 0x41d017
ret
Function at 0x41d1c3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
mov ebx, edx
sub ebx, 0x20
jb 0x41d1d3
shl ax, 8
sahf
jmp 0x41d1f7
mov ebx, eax
mov eax, 0x20
sub eax, edx
lea edx, [eax*4 + 0x41d1f7]
lea edx, [edx + eax*2]
shl eax, 2
sub esi, eax
sub edi, eax
mov ah, bl
sahf
mov ebx, 0
jmp edx
nop
nop
mov eax, dword [esi]
adc dword [edi], eax
mov eax, dword [esi + 4]
adc dword [edi + 4], eax
mov eax, dword [esi + 8]
adc dword [edi + 8], eax
mov eax, dword [esi + 0xc]
adc dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
adc dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
adc dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
adc dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
adc dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
adc dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
adc dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
adc dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
adc dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
adc dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
adc dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
adc dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
adc dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
adc dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
adc dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
adc dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
adc dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
adc dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
adc dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
adc dword [edi + 0x58], eax
mov eax, dword [esi + 0x5c]
adc dword [edi + 0x5c], eax
mov eax, dword [esi + 0x60]
adc dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
adc dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
adc dword [edi + 0x68], eax
mov eax, dword [esi + 0x6c]
adc dword [edi + 0x6c], eax
mov eax, dword [esi + 0x70]
adc dword [edi + 0x70], eax
mov eax, dword [esi + 0x74]
adc dword [edi + 0x74], eax
mov eax, dword [esi + 0x78]
adc dword [edi + 0x78], eax
mov eax, dword [esi + 0x7c]
adc dword [edi + 0x7c], eax
mov eax, 0
setb al
cmp ebx, 0
je 0x41d2d7
add esi, 0x80
add edi, 0x80
mov edx, ebx
jmp 0x41d1c7
ret
Function at 0x41d740
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x44
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
push esi
push edi
push ebx
push 0x40
lea eax, [esp + 0x1c]
push 0
push eax
mov dword [esp + 0x20], 0
call fcn.00410020
mov ebp, dword [esp + 0x68]
mov edi, dword [esp + 0x74]
add esp, 0x10
cmp ebp, 0x40
push ebx
jbe 0x41d7ca
mov edx, dword [esp + 0x64]
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
call dword [edi + 0x10]
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x41d863
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x10]
push ebx
push ecx
push ebp
push edx
call dword [edi + 0x14]
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x41d863
lea eax, [esp + 0x14]
push ebx
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [edi + 0x18]
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x41d863
jmp 0x41d7dd
mov edx, dword [esp + 0x60]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.0040ffe0
add esp, 0x10
mov ecx, dword [esp + 0x60]
mov edx, dword [edi + 0xc]
lea ebp, [edi + 4]
push ebx
push ebp
push ecx
push edx
call dword [edi + 0x10]
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x41d863
mov cl, byte [esp + eax + 0x14]
xor cl, 0x36
mov byte [esp + eax + 0x14], cl
inc eax
cmp eax, 0x40
jl 0x41d7f7
mov ecx, dword [ebp]
lea eax, [esp + 0x14]
push ebx
push eax
push 0x40
push ecx
call dword [edi + 0x14]
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x41d863
mov edx, dword [esp + 0x60]
mov eax, dword [edi + 0xc]
lea ebp, [edi + 8]
push ebx
push ebp
push edx
push eax
call dword [edi + 0x10]
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x41d863
mov cl, byte [esp + eax + 0x14]
xor cl, 0x6a
mov byte [esp + eax + 0x14], cl
inc eax
cmp eax, 0x40
jl 0x41d83a
mov edx, dword [ebp]
lea ecx, [esp + 0x14]
push ebx
push ecx
push 0x40
push edx
call dword [edi + 0x14]
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41d8a4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41d87c
lea eax, [esp + 0x14]
push ebx
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [edi + 0x18]
add esp, 0xc
mov ecx, dword [edi + 4]
lea eax, [edi + 4]
test ecx, ecx
je 0x41d890
push ebx
push 0
push eax
call dword [edi + 0x18]
add esp, 0xc
mov ecx, dword [edi + 8]
lea eax, [edi + 8]
test ecx, ecx
je 0x41d8a4
push ebx
push 0
push eax
call dword [edi + 0x18]
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret