joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463200
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x4632e8
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x4901d4], 1
jae 0x4632da
xor eax, eax
mov dword [0x48fde0], eax
xor eax, eax
mov dword [0x48fde8], eax
xor eax, eax
mov dword [0x48fdec], eax
mov byte [0x48fdf2], 2
mov byte [0x48fdf3], 2
mov byte [0x48fdf4], 3
mov word [0x49019c], 0
mov word [0x4901ac], 1
mov word [0x4901bc], 0xa
mov dword [0x4901c4], 0x80020004
mov dword [0x490190], 0x4623ec
mov dword [0x490194], 0x4623e4
mov dword [0x490198], 0x4623ec
call fcn.00460914
test al, al
je 0x463299
call fcn.00460944
call fcn.00460a08
mov eax, 0x48fdf8
mov edx, 0x4632f4
call fcn.0045e0e6
mov eax, 0x48ffc4
mov edx, 0x4632f4
call fcn.0045e0e6
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x48fdd8], eax
call fcn.0045f04c
mov dword [0x48fdd4], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x48fdcc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4632ef
ret

Function at 0x464ee8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x464f04
call fcn.0046626c
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x464f20
test bl, 1
je 0x464f20
call fcn.00469ca0
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x465104
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00465e08
test byte [ebp + 0xd], 0xc0
jne 0x465128
mov eax, dword [0x48a250]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x465135
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x465162
je 0x465174
sub ecx, 0x100
je 0x465182
sub ecx, 0x100
je 0x465189
sub ecx, 0x100
je 0x46517b
jmp 0x465190
sub ecx, 0x600
je 0x465189
sub ecx, 0x100
je 0x465174
jmp 0x465190
mov edi, 1
jmp 0x465195
mov edi, 2
jmp 0x465195
mov edi, 4
jmp 0x465195
mov edi, 5
jmp 0x465195
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4651bc
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x489cc8]
test al, 0x80
je 0x4651b5
mov ebx, 0x80
jmp 0x4651ce
mov ebx, 1
jmp 0x4651ce
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4651ce
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4651e0
je 0x4651e9
dec eax
je 0x4651f2
jmp 0x4651fb
mov dword [ebp - 4], 0x80000000
jmp 0x46520a
mov dword [ebp - 4], 0x40000000
jmp 0x46520a
mov dword [ebp - 4], 0xc0000000
jmp 0x46520a
push 1
call fcn.00466200
pop ecx
mov ebx, eax
jmp 0x4652fa
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x465226
sub eax, 0x10
je 0x46522d
sub eax, 0x10
je 0x465236
sub eax, 0x10
je 0x46523f
jmp 0x46523f
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x465246
mov dword [ebp - 8], 1
jmp 0x465246
mov dword [ebp - 8], 2
jmp 0x465246
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4652b3
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4652a8
test byte [ebp + 0xd], 1
je 0x4652a3
mov ebx, 0x50
jmp 0x4652a8
mov ebx, 2
push ebx
call fcn.00466200
pop ecx
mov ebx, eax
jmp 0x4652fa
mov edi, esi
push edi
call fcn.00465068
pop ecx
test eax, eax
je 0x4652c7
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4652d3
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00465f28
add esp, 8
mov ebx, eax
inc eax
jne 0x4652fa
push 4
call fcn.00466200
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00465e3c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x469c38
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x469c9a
call fcn.00469be8
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00463de0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00463de0
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x469d18
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x48b0f0], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x469df2
cmp dword [0x48b0ec], 0
jne 0x469df2
cmp dword [0x48b2d0], 0
je 0x469dac
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00469ae8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x469d92
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00469ae8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x469d92
lea ebx, [ebp - 0x84]
jmp 0x469d93
inc ebx
call fcn.00469cd4
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x469e2d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x48b0f4
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00463de0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x48b0f7
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x469e2d
cmp dword [0x48b0ec], 0
je 0x469e0c
cmp dword [0x48b0ec], 0xffffffff
je 0x469e2d
push esi
call dword [0x48b0ec]
pop ecx
mov eax, dword [0x48b0f0]
test eax, eax
je 0x469e2d
cmp dword [0x48b0f0], 0xffffffff
je 0x469e2d
cmp byte [eax], 0
je 0x469e2d
push esi
push eax
call fcn.00469c38
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a5c4
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x490adc], 0
jne 0x46a645
cmp dword [0x490afc], 0
jne 0x46a5f4
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x490afc], eax
test eax, eax
jne 0x46a5f4
push str.GetEnvironmentStrings_failed
call fcn.00469e44
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x490afc]
jmp 0x46a608
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00463de0
pop ecx
mov edi, eax
test eax, eax
jne 0x46a600
lea edi, [ebp + 1]
push edi
call fcn.00463820
pop ecx
mov ebx, eax
mov dword [0x490ae0], ebx
test ebx, ebx
jne 0x46a632
xor eax, eax
jmp 0x46a708
push edi
mov edx, dword [0x490afc]
push edx
push ebx
call fcn.00463c90
add esp, 0xc
jmp 0x46a665
xor esi, esi
mov ebx, dword [0x490adc]
jmp 0x46a65f
push eax
call fcn.00463de0
pop ecx
test eax, eax
jne 0x46a65b
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x46a64f
lea ebx, [esi + 4]
push 4
mov dword [0x490ae4], ebx
inc ebx
push ebx
call fcn.004632f8
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x46a688
xor eax, eax
jmp 0x46a708
cmp dword [0x490adc], 0
jne 0x46a6b9
xor esi, esi
mov ebx, dword [0x490ae0]
mov eax, dword [esp]
mov ebp, eax
jmp 0x46a6aa
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00463de0
pop ecx
mov edi, eax
test eax, eax
jne 0x46a6a0
jmp 0x46a6ea
xor esi, esi
mov ebx, dword [0x490adc]
mov eax, dword [esp]
mov edi, eax
jmp 0x46a6e4
push eax
call fcn.00463de0
pop ecx
test eax, eax
je 0x46a6d9
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x46a6dd
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x46a6c8
mov eax, dword [0x490adc]
test eax, eax
je 0x46a6fa
push eax
call fcn.00463830
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x490adc], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x470bac
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x470bda
mov eax, ebx
call fcn.00471650
cmp dword [ebx + 0x3c], 0
je 0x470bd3
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x470c4b
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x470c3d
cmp dword [ebx + 8], 0
je 0x470bfc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x470c0e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x470c3d
cmp dword [ebx + 8], 0
je 0x470bef
cmp eax, 3
je 0x470c21
dec eax
jne 0x470bef
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x470bef
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x470bef
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x470c69
cmp dword [ebx + 0x10], 0xcc
je 0x470c69
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00470c74
pop ebx
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1181781c
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5c7c327c
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4012d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [0x40ae40], 0x44
mov dword [0x40aad0], 0x1003f
push 0x4254
push 0x2957
push 0
call dword [0x40a9b8]
mov eax, dword [ebp + 8]
push eax
call fcn.00401150
add esp, 4
push 0x54d2
push 0x53b
call fcn.00401090
add esp, 8
mov dword [ebp - 4], 0
jmp 0x40132f
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [0x40a9ac]
xor eax, eax
mov ax, word [edx + 6]
cmp dword [ebp - 4], eax
jge 0x4013ad
mov ecx, dword [0x46db40]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
imul eax, eax, 0x28
add eax, dword [ebp + 8]
lea ecx, [eax + edx + 0xf8]
mov dword [0x40a9a8], ecx
push 0x80
lea edx, [ebp - 0x20c]
push edx
call dword [0x40adec]
push 0
mov eax, dword [0x40a9a8]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [0x40a9a8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [0x40a9ac]
mov edx, dword [ecx + 0x34]
mov eax, dword [0x40a9a8]
add edx, dword [eax + 0xc]
push edx
mov ecx, dword [0x40a998]
push ecx
call dword [0x46c924]
jmp 0x401326
push 0x5fae
push 0x2a1f
call fcn.00401090
add esp, 8
call fcn.00401240
mov esp, ebp
pop ebp
ret
Function at 0x402880
Capabilities:
Hash data using rshash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0x5c6b7
mov dword [ebp - 4], 0xf8c9
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xc], 0
jmp 0x4028bd
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x4028de
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jmp 0x4028ab
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4035f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [0x5599f4]
mov ebx, dword [ebp + 8]
mov esi, ecx
xor eax, ebp
cmp ebx, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x403753
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x403636
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
test ecx, ecx
jle 0x403636
dec ecx
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
lea edx, [ecx + 1]
mov dword [eax], edx
mov byte [ecx], bl
jmp 0x403791
cmp dword [esi + 0x4c], 0
je 0x403757
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0x3c]
cmp dword [eax], ecx
jne 0x40365e
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
cmp dword [esi + 0x38], 0
je 0x40375c
lea eax, [ebp - 0x28]
lea edi, [ebp - 0x28]
mov byte [eax - 1], bl
xor eax, eax
mov dword [edi + 0x14], 0xf
mov ecx, edi
mov dword [edi + 0x10], eax
mov byte [edi], 0
push eax
push 8
call fcn.00404264
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], eax
jmp 0x4036ec
mov ebx, dword [ebp - 0x34]
cmp dword [ebp - 0x14], 0xf
mov eax, esi
mov edi, esi
jbe 0x4036a5
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x38]
sub ebx, eax
je 0x4036c3
push dword [esi + 0x4c]
push ebx
push 1
push eax
call fcn.004e168c
add esp, 0x10
cmp ebx, eax
jne 0x403781
mov byte [esi + 0x3d], 1
lea eax, [ebp - 0x29]
cmp dword [ebp - 0x30], eax
jne 0x403786
test ebx, ebx
jne 0x4036ec
cmp dword [ebp - 0x18], 0x1f
ja 0x403781
mov ecx, edi
push 0
push 8
call fcn.004041de
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov ecx, dword [esi + 0x38]
cmp dword [ebp - 0x14], 0xf
mov esi, edi
lea ebx, [eax + edx]
lea edx, [ebp + edx - 0x28]
cmovbe eax, edi
lea edi, [ebp - 0x34]
cmova edx, ebx
mov ebx, dword [ecx]
push edi
push edx
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x29]
push eax
push dword [ebp - 0x3c]
call dword [ebx + 0x1c]
cmp eax, 2
jb 0x403695
cmp eax, 3
mov ebx, 0xffffffff
jne 0x403789
mov ecx, dword [ebp - 0x38]
movsx eax, byte [ebp - 0x29]
push dword [ecx + 0x4c]
push eax
call fcn.004e171a
add esp, 8
mov ebx, dword [ebp + 8]
cmp eax, 0xffffffff
cmove ebx, eax
jmp 0x403789
xor ebx, ebx
jmp 0x403791
xor ebx, ebx
dec ebx
jmp 0x403791
movsx eax, bl
push dword [esi + 0x4c]
push eax
call fcn.004e171a
add esp, 8
mov ecx, dword [ebp - 0x10]
mov esi, eax
cmp esi, 0xffffffff
cmovne esi, ebx
xor ecx, ebp
call fcn.004d4bc8
mov eax, esi
jmp 0x40379d
xor ebx, ebx
dec ebx
jmp 0x403789
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.00401ae0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d4bc8
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x404010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x5599f4]
mov bl, 1
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx + 0x38], 0
je 0x4040fd
cmp byte [ecx + 0x3d], 0
je 0x4040fd
mov eax, dword [ecx]
xor edi, edi
mov esi, ecx
dec edi
push edi
call dword [eax + 0xc]
xor ebx, ebx
cmp eax, edi
je 0x4040fd
lea ecx, [ebp - 0x28]
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
push ebx
mov ebx, ecx
push 8
call fcn.00404264
lea eax, [esi + 0x40]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], eax
jmp 0x4040bb
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x2c]
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
jbe 0x404086
mov eax, dword [ebp - 0x28]
sub edi, eax
je 0x4040a0
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004e168c
mov esi, dword [ebp - 0x30]
add esp, 0x10
cmp edi, eax
jne 0x4040f3
cmp byte [esi + 0x3d], 0
je 0x4040f5
test edi, edi
lea ebx, [ebp - 0x28]
jne 0x4040bb
mov ecx, ebx
push 0
push 8
call fcn.004041de
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov ecx, dword [esi + 0x38]
cmp dword [ebp - 0x14], 0xf
lea edi, [eax + edx]
lea edx, [ebp + edx - 0x28]
cmovbe eax, ebx
lea ebx, [ebp - 0x2c]
cmova edx, edi
mov edi, dword [ecx]
push ebx
push edx
push eax
push dword [ebp - 0x34]
call dword [edi + 0x20]
mov bl, 1
test eax, eax
je 0x404073
cmp eax, 1
je 0x404077
cmp eax, 3
je 0x4040f5
xor ebx, ebx
lea ecx, [ebp - 0x28]
call fcn.00401ae0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d4bc8
mov eax, ebx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405390
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
movd xmm0, dword [esp + 0x18]
mov edi, 0x40
movdqu xmm3, xmmword [esi]
movdqu xmm4, xmmword [esi + 0x10]
movdqu xmm2, xmmword [esi + 0x20]
movdqu xmm1, xmmword [esi + 0x30]
lea eax, [edx - 0x40]
lea ecx, [esi + 0x40]
cmp eax, edi
pxor xmm0, xmm3
jb 0x40548a
add edx, 0xffffff80
movdqa xmm5, xmmword [0x50f020]
mov edi, edx
and edi, 0xffffffc0
mov ebx, edi
sub ebx, 0xffffff80
movdqa xmm3, xmmword [0x50f010]
movdqa xmm6, xmm0
movdqa xmm7, xmm0
movdqu xmm0, xmmword [ecx]
add eax, 0xffffffc0
pclmulqdq xmm7, xmm5, 0x11
pclmulqdq xmm6, xmm3, 0
pxor xmm0, xmm6
movdqa xmm6, xmm4
pclmulqdq xmm6, xmm3, 0
movdqa xmm3, xmm4
movdqu xmm4, xmmword [ecx + 0x10]
pxor xmm0, xmm7
movdqa xmm7, xmm2
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm7, xmm5, 0x11
pxor xmm4, xmm6
movdqa xmm6, xmm2
movdqu xmm2, xmmword [ecx + 0x20]
pclmulqdq xmm6, xmmword [0x50f010], 0
pxor xmm4, xmm3
movdqa xmm3, xmm1
pclmulqdq xmm3, xmmword [0x50f010], 0
pxor xmm2, xmm6
movdqa xmm6, xmm1
movdqu xmm1, xmmword [ecx + 0x30]
add ecx, 0x40
cmp eax, 0x3f
pclmulqdq xmm6, xmm5, 0x11
pxor xmm2, xmm7
pxor xmm1, xmm3
pxor xmm1, xmm6
ja 0x4053e0
sub edx, edi
add esi, ebx
mov eax, edx
mov ecx, esi
movdqa xmm5, xmmword [0x50f040]
movdqa xmm3, xmmword [0x50f030]
movdqa xmm6, xmm0
cmp eax, 0x10
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm6, xmm3, 0
pxor xmm0, xmm4
pxor xmm0, xmm6
movdqa xmm4, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm4, xmm3, 0
pxor xmm0, xmm2
pxor xmm0, xmm4
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm2, xmm3, 0
pxor xmm0, xmm1
pxor xmm0, xmm2
jb 0x40550e
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
add eax, 0xfffffff0
add ecx, 0x10
pclmulqdq xmm2, xmm3, 0
cmp eax, 0xf
pxor xmm0, xmm1
pxor xmm0, xmm2
ja 0x4054e7
movdqa xmm1, xmmword [0x50f040]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pmovzxdq xmm1, xmm0
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x50f050], 0
pxor xmm1, xmm0
pmovzxdq xmm0, xmm1
pclmulqdq xmm0, xmmword [0x50f060], 0x10
pmovzxdq xmm0, xmm0
pclmulqdq xmm0, xmmword [0x50f070], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop esi
pop edi
pop ebx
ret
Function at 0x412ec0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x5599f4]
xorpd xmm0, xmm0
xor eax, ebp
mov dword [esp + 0x30], eax
movsd xmm1, qword [0x55aa78]
ucomisd xmm1, xmm0
jne 0x41303e
jp 0x41303e
mov edi, dword [0x50d128]
call edi
push eax
call dword [0x50d12c]
mov dword [esp + 0xc], eax
call edi
push 2
push eax
call dword [0x50d130]
mov eax, dword [0x55aa88]
mov ecx, dword [0x55c508]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 8]
jg 0x413063
mov eax, dword [0x55aa98]
mov ecx, dword [0x55c508]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 8]
jg 0x41309d
rdtsc
lea esi, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 8], eax
mov dword [esp + 4], edx
push esi
call dword [0x50d120]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
call dword [0x50d128]
push dword [esp + 0xc]
push eax
call dword [0x50d130]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push esi
call dword [0x50d11c]
sub edi, dword [0x55aa90]
movsd xmm2, qword [0x50ff58]
sbb ebx, dword [0x55aa94]
movd xmm1, edi
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movd xmm0, ebx
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x50ff30]
subpd xmm1, xmmword [0x50ff40]
pshufd xmm0, xmm1, 0x4e
addpd xmm0, xmm1
xorpd xmm1, xmm1
divsd xmm0, qword [esp + 0x20]
ucomisd xmm2, xmm0
ja 0x41303e
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub eax, dword [0x55aa80]
sbb ecx, dword [0x55aa84]
movd xmm2, eax
movd xmm1, ecx
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x50ff30]
subpd xmm2, xmmword [0x50ff40]
pshufd xmm1, xmm2, 0x4e
addpd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x55aa78], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.004d4bc8
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x55aa88
call fcn.004d51fb
add esp, 4
mov eax, dword [0x55aa88]
cmp eax, 0xffffffff
jne 0x412f32
rdtsc
mov dword [0x55aa84], edx
mov dword [0x55aa80], eax
push 0x55aa88
call fcn.004d51bc
add esp, 4
jmp 0x412f32
push 0x55aa98
call fcn.004d51fb
add esp, 4
mov eax, dword [0x55aa98]
cmp eax, 0xffffffff
jne 0x412f53
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push eax
call dword [0x50d120]
movsd xmm0, qword [esp + 0x28]
movsd qword [0x55aa90], xmm0
push 0x55aa98
call fcn.004d51bc
add esp, 4
jmp 0x412f53
Function at 0x414000
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
movzx eax, byte [esi]
movzx edx, byte [esi + 1]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 2]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 3]
mov esi, dword [esi]
xor edx, eax
imul eax, edx, 0x1000193
mov edx, dword [ecx + 0xc]
and eax, dword [ecx + 0x18]
mov ebx, dword [edx + eax*8]
lea eax, [eax + eax + 1]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 4]
mov ecx, ebx
jmp 0x414062
mov ecx, dword [ecx]
cmp ebx, eax
mov edi, ebx
je 0x414070
mov edi, dword [ebp - 0x14]
mov edi, dword [edx + edi*4]
mov edi, dword [edi]
cmp edi, ecx
je 0x414088
cmp dword [ecx + 8], esi
jne 0x414060
cmp ecx, eax
je 0x414088
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
jmp 0x4140e5
mov edi, dword [eax]
mov esi, dword [edi + 4]
push 0x24
call fcn.004d4bd9
add esp, 4
mov ebx, eax
test edi, edi
mov eax, edi
cmove eax, ebx
lea ecx, [ebx + 0xc]
mov dword [ebx], eax
mov eax, esi
cmove eax, ebx
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebx + 8], eax
call fcn.004103c0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
cmp eax, 0x71c71c6
je 0x4140ef
inc eax
mov dword [ecx + 8], eax
mov dword [edi + 4], ebx
mov dword [esi], ebx
mov eax, dword [ecx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
mov esi, dword [ebp + 8]
push esi
call fcn.00414100
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
push str.list_T__too_long
call fcn.004d601c
int3