joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c49d4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6af0f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.005ab8b5
and dword [ebp - 0x14], 0
cmp dword [0x6b6c50], 0
mov dword [ebp - 0x18], eax
jne 0x5c4a87
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x5c4b2f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x5c4b2f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x625da8
push ebx
mov dword [0x6b6c50], eax
call edi
push eax
call esi
push 0x625d94
push ebx
mov dword [0x6b6c54], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x6b6c58], eax
call edi
push eax
call esi
mov dword [0x6b6c60], eax
test eax, eax
je 0x5c4a87
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x6b6c5c], eax
mov eax, dword [0x6b6c5c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x5c4ae0
cmp dword [0x6b6c60], ecx
je 0x5c4ae0
push eax
call esi
push dword [0x6b6c60]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x5c4ae0
test ebx, ebx
je 0x5c4ae0
call edi
test eax, eax
je 0x5c4ad7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x5c4ad7
test byte [ebp - 8], 1
jne 0x5c4ae0
or dword [ebp + 0x10], 0x200000
jmp 0x5c4b13
mov eax, dword [0x6b6c54]
cmp eax, dword [ebp - 0x18]
je 0x5c4b13
push eax
call esi
test eax, eax
je 0x5c4b13
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x5c4b13
mov eax, dword [0x6b6c58]
cmp eax, dword [ebp - 0x18]
je 0x5c4b13
push eax
call esi
test eax, eax
je 0x5c4b13
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x6b6c50]
call esi
test eax, eax
je 0x5c4b2f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x5c4b31
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005a1303
leave
ret
Function at 0x401aa0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401adf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401adf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401adf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401adf
cmp dword [ecx + 0x74], 0xe
jbe 0x401adf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4030cd
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x403108
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4030ef
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x403100
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40310a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4030e5
xor eax, eax
pop edi
pop esi
ret
Function at 0x402966
Capabilities:
Get common file path
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1400
call reloc.KERNEL32.dll_GetACP
mov eax, dword [0x2e7f000]
mov ecx, dword [0x2e7df50]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x402a43
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x2e7f000], 0x959
jne 0x402a31
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
lea eax, [ebp - 0x1400]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call fcn.0040276e
add edi, 8
dec ebx
jne 0x402992
pop edi
pop ebx
pop esi
leave
ret
Function at 0x406fe9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80a9f0]
jne 0x406ff3
repz ret
jmp fcn.004087d5

Function at 0x40714b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403854
and dword [ebp - 4], 0
cmp dword [0x80b8cc], 0
mov ebx, eax
jne 0x4071fc
push 0x4019c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4072ad
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4019b8
push edi
call esi
test eax, eax
je 0x4072ad
push eax
call fcn.004037e2
mov dword [esp], 0x4019a8
push edi
mov dword [0x80b8cc], eax
call esi
push eax
call fcn.004037e2
mov dword [esp], 0x401994
push edi
mov dword [0x80b8d0], eax
call esi
push eax
call fcn.004037e2
mov dword [esp], 0x401978
push edi
mov dword [0x80b8d4], eax
call esi
push eax
call fcn.004037e2
pop ecx
mov dword [0x80b8dc], eax
test eax, eax
je 0x4071fc
push 0x401960
push edi
call esi
push eax
call fcn.004037e2
pop ecx
mov dword [0x80b8d8], eax
mov eax, dword [0x80b8d8]
cmp eax, ebx
je 0x407254
cmp dword [0x80b8dc], ebx
je 0x407254
push eax
call fcn.0040385d
push dword [0x80b8dc]
mov esi, eax
call fcn.0040385d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407254
test edi, edi
je 0x407254
call esi
test eax, eax
je 0x40724b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40724b
test byte [ebp - 0xc], 1
jne 0x407254
or dword [ebp + 0x10], 0x200000
jmp 0x40728d
mov eax, dword [0x80b8d0]
cmp eax, ebx
je 0x40728d
push eax
call fcn.0040385d
pop ecx
test eax, eax
je 0x40728d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40728d
mov eax, dword [0x80b8d4]
cmp eax, ebx
je 0x40728d
push eax
call fcn.0040385d
pop ecx
test eax, eax
je 0x40728d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x80b8cc]
call fcn.0040385d
pop ecx
test eax, eax
je 0x4072ad
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4072af
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..pdata
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x72a67bb4
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x798c6bb3
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
or esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
push edx
pop edi
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
push esi
pop eax
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
push eax
pop esi
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..pdata
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x163f2cec
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0xf744e5c
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40324c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x86c658]
mov ecx, dword [0x86b5a8]
sub esp, 0x400
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4032ef
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x86c658], 0x959
jne 0x4032e1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
lea eax, [ebp - 0x400]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapLock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
call fcn.004030a8
add edi, 8
dec ebx
jne 0x403274
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40420c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44c168]
jne 0x404216
repz ret
jmp fcn.00407fcc

Function at 0x40970c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040687e
and dword [ebp - 4], 0
cmp dword [0x44e310], 0
mov ebx, eax
jne 0x4097bd
push 0x40248c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40986e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402480
push edi
call esi
test eax, eax
je 0x40986e
push eax
call fcn.0040680c
mov dword [esp], 0x402470
push edi
mov dword [0x44e310], eax
call esi
push eax
call fcn.0040680c
mov dword [esp], 0x40245c
push edi
mov dword [0x44e314], eax
call esi
push eax
call fcn.0040680c
mov dword [esp], 0x402440
push edi
mov dword [0x44e318], eax
call esi
push eax
call fcn.0040680c
pop ecx
mov dword [0x44e320], eax
test eax, eax
je 0x4097bd
push 0x402428
push edi
call esi
push eax
call fcn.0040680c
pop ecx
mov dword [0x44e31c], eax
mov eax, dword [0x44e31c]
cmp eax, ebx
je 0x409815
cmp dword [0x44e320], ebx
je 0x409815
push eax
call fcn.00406887
push dword [0x44e320]
mov esi, eax
call fcn.00406887
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409815
test edi, edi
je 0x409815
call esi
test eax, eax
je 0x40980c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40980c
test byte [ebp - 0xc], 1
jne 0x409815
or dword [ebp + 0x10], 0x200000
jmp 0x40984e
mov eax, dword [0x44e314]
cmp eax, ebx
je 0x40984e
push eax
call fcn.00406887
pop ecx
test eax, eax
je 0x40984e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40984e
mov eax, dword [0x44e318]
cmp eax, ebx
je 0x40984e
push eax
call fcn.00406887
pop ecx
test eax, eax
je 0x40984e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44e310]
call fcn.00406887
pop ecx
test eax, eax
je 0x40986e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409870
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
jne 0x40100f
xor eax, eax
ret
mov eax, 1
ret

Function at 0x406180
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
push 0x40
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x4061a3
mov eax, 1
jmp 0x4062ae
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x4061b9
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x3c], 0
jne 0x4061c3
mov eax, 2
jmp 0x4062ae
mov edx, dword [ebp + 0x10]
push edx
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x40
push edx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x4061ee
mov eax, 1
jmp 0x4062ae
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0x4550
jne 0x406214
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x58]
cmp edx, 0x10b
jne 0x406214
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x46]
test ecx, ecx
jne 0x40621e
mov eax, 2
jmp 0x4062ae
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x46]
imul eax, eax, 0x28
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x140], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x140]
push eax
call fcn.00415320
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x138], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x138], 0
jne 0x40625f
mov eax, 3
jmp 0x4062ae
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x54]
lea ecx, [ecx + eax + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx + 0x13c], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x140]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x13c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
push eax
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x4062ac
mov eax, 1
jmp 0x4062ae
xor eax, eax
pop ebp
ret
Function at 0x410f00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x410f10
xor eax, eax
jmp 0x4110ad
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x41106e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x425d20]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x425d20]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x425d20]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x425d20]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x425d20]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x425d20]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x425d20]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x425d20]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x410f19
cmp dword [ebp + 0x10], 0
je 0x4110a7
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x425d20]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x411074
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x4110b0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, dword [ecx]
and eax, 0xff
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
shr ecx, 8
xor ecx, dword [eax*4 + 0x425d20]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0xff
mov edx, dword [ebp + 8]
add ecx, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
imul edx, edx, 0x8088405
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shr edx, 0x18
mov eax, dword [ebp + 8]
xor edx, dword [eax + 8]
and edx, 0xff
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x425d20]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret

Function at 0x415e60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x415e90
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x415ea3
xor eax, eax
jmp 0x415f61
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x415ebe
xor eax, eax
jmp 0x415f61
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x4550
je 0x415edc
xor eax, eax
jmp 0x415f61
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], 0
jmp 0x415f1e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax + 0x18]
jae 0x415f5f
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
push edx
call fcn.00415430
add esp, 8
test eax, eax
jne 0x415f5d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x415f61
jmp 0x415f15
xor eax, eax
mov esp, ebp
pop ebp
ret