joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476e60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x480748
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
mov eax, dword [0x4a4368]
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0xc]
mov dword [esp + 0x1a4], eax
mov dword [esp + 0x10], esi
mov dword [esi], 0x49747c
call fcn.00477950
lea edi, [esi + 0x48]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x1b0], ebx
call fcn.004753a0
lea ebp, [esi + 0x4c]
mov ecx, ebp
mov byte [esp + 0x1b0], 1
call fcn.004753a0
mov eax, 5
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], eax
lea eax, [esi + 0x80]
push eax
call dword [0x4810f4]
lea eax, [esi + 0x98]
push eax
call dword [0x4810f4]
lea eax, [esi + 0x20]
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xffffffff
mov byte [esi + 0x30], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
xor ecx, ecx
mov edx, eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov word [eax], 2
lea eax, [esp + 0x14]
push eax
push 0x202
mov byte [esp + 0x1b8], 6
call dword [0x481dd8]
push ebx
push 1
mov ecx, edi
call fcn.004450b0
push ebx
push 1
mov ecx, ebp
call fcn.004450b0
mov ecx, dword [esp + 0x1a8]
pop edi
mov dword [esi + 0x44], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x194]
call fcn.0044afa5
add esp, 0x1a4
ret
Function at 0x426520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5e6d1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 0x370]
mov dword [esp + 0x18], 0x27
call fcn.005e2954
lea ecx, [esi + 0x36c]
mov byte [esp + 0x18], 0x26
call fcn.005e2954
lea ecx, [esi + 0x368]
mov byte [esp + 0x18], 0x25
call fcn.005e2954
lea ecx, [esi + 0x350]
mov byte [esp + 0x18], 0x24
call fcn.005e2954
lea ecx, [esi + 0x340]
mov byte [esp + 0x18], 0x23
call fcn.005e2954
lea ecx, [esi + 0x330]
mov byte [esp + 0x18], 0x22
call fcn.005e2954
lea ecx, [esi + 0x32c]
mov byte [esp + 0x18], 0x21
call fcn.005e2954
lea ecx, [esi + 0x328]
mov byte [esp + 0x18], 0x20
call fcn.005e2954
lea ecx, [esi + 0x314]
mov byte [esp + 0x18], 0x1f
call fcn.005e2954
lea ecx, [esi + 0x310]
mov byte [esp + 0x18], 0x1e
call fcn.005e2954
lea ecx, [esi + 0x30c]
mov byte [esp + 0x18], 0x1d
call fcn.005e2954
lea ecx, [esi + 0x308]
mov byte [esp + 0x18], 0x1c
call fcn.005e2954
mov byte [esp + 0x18], 0x1b
lea ecx, [esi + 0x304]
call fcn.005e2954
lea ecx, [esi + 0x300]
mov byte [esp + 0x18], 0x1a
call fcn.005e2954
lea ecx, [esi + 0x2fc]
mov byte [esp + 0x18], 0x19
call fcn.005e2954
lea ecx, [esi + 0x2f8]
mov byte [esp + 0x18], 0x18
call fcn.005e2954
lea ecx, [esi + 0x2f4]
mov byte [esp + 0x18], 0x17
call fcn.005e2954
lea ecx, [esi + 0x2f0]
mov byte [esp + 0x18], 0x16
call fcn.005e2954
lea ecx, [esi + 0x2ec]
mov byte [esp + 0x18], 0x15
call fcn.005e2954
lea ecx, [esi + 0x2e8]
mov byte [esp + 0x18], 0x14
call fcn.005e2954
lea ecx, [esi + 0x2e4]
mov byte [esp + 0x18], 0x13
call fcn.005e2954
lea ecx, [esi + 0x2e0]
mov byte [esp + 0x18], 0x12
call fcn.005e2954
lea ecx, [esi + 0x2dc]
mov byte [esp + 0x18], 0x11
call fcn.005e2954
lea ecx, [esi + 0x2d8]
mov byte [esp + 0x18], 0x10
call fcn.005e2954
lea ecx, [esi + 0x154]
mov byte [esp + 0x18], 0xf
call fcn.005e2a20
lea ecx, [esi + 0x114]
mov byte [esp + 0x18], 0xe
call fcn.005e2a20
lea ecx, [esi + 0x108]
mov byte [esp + 0x18], 0xd
call fcn.005e2954
lea ecx, [esi + 0x104]
mov byte [esp + 0x18], 0xc
call fcn.005e2954
lea ecx, [esi + 0x100]
mov byte [esp + 0x18], 0xb
call fcn.005e2954
lea ecx, [esi + 0xfc]
mov byte [esp + 0x18], 0xa
call fcn.005e2954
lea ecx, [esi + 0xf8]
mov byte [esp + 0x18], 9
call fcn.005e2954
lea ecx, [esi + 0xf4]
mov byte [esp + 0x18], 8
call fcn.005e2954
lea ecx, [esi + 0xf0]
mov byte [esp + 0x18], 7
call fcn.005e2954
lea ecx, [esi + 0xec]
mov byte [esp + 0x18], 6
call fcn.005e2954
lea ecx, [esi + 0xe8]
mov byte [esp + 0x18], 5
call fcn.005e2954
lea ecx, [esi + 0xe4]
mov byte [esp + 0x18], 4
call fcn.005e2954
lea ecx, [esi + 0xe0]
mov byte [esp + 0x18], 3
call fcn.005e2954
lea ecx, [esi + 0xdc]
mov byte [esp + 0x18], 2
call fcn.005e2954
lea ecx, [esi + 0xd8]
mov byte [esp + 0x18], 1
call fcn.005e2954
lea edi, [esi + 0x60]
mov dword [esp + 0xc], edi
mov dword [edi], 0x602928
mov ecx, edi
mov byte [esp + 0x18], 0x28
call fcn.005e2d14
mov ecx, esi
mov dword [edi], 0x602914
mov dword [esp + 0x18], 0xffffffff
call fcn.005e293c
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x460670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ea038
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
call fcn.005e2960
xor ebp, ebp
lea ecx, [esp + 0xc]
mov dword [esp + 0x70], ebp
call fcn.005e2960
lea eax, [esp + 0x2c]
push 0x1d
push eax
lea ecx, [esi + 0x9c70]
mov byte [esp + 0x78], 1
call fcn.005e2d4a
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.005e2bf4
call fcn.00543c70
fmul qword [0x6031b8]
add esp, 4
call fcn.005e35c0
fld qword [esp + 0x78]
fcomp qword [0x6018b0]
mov edi, eax
fnstsw ax
test ah, 0x41
jne 0x46070e
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebp
fild qword [esp + 0x1c]
fcomp qword [esp + 0x78]
fnstsw ax
test ah, 1
je 0x460805
push edi
lea eax, [esp + 0x30]
push 0x62d424
push eax
call dword [0x600a58]
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x10]
call fcn.005e2a4a
push 0xc6
lea ecx, [esp + 0x14]
call fcn.005e295a
cmp dword [0x64078c], ebp
jne 0x4607bd
lea edx, [esp + 0x10]
push 0x62f280
lea eax, [esp + 0x20]
push edx
push eax
call fcn.005e2a32
lea ecx, [esp + 0xc]
lea edx, [esp + 0x18]
push ecx
push eax
push edx
mov byte [esp + 0x7c], 2
call fcn.005e2a2c
push 0x62f278
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x78], 3
push eax
call fcn.005e2a32
mov eax, dword [eax]
push ebp
push ebp
push eax
mov byte [esp + 0x7c], 4
call fcn.005e2b22
lea ecx, [esp + 0x14]
mov byte [esp + 0x70], 3
call fcn.005e2954
lea ecx, [esp + 0x18]
mov byte [esp + 0x70], 2
call fcn.005e2954
lea ecx, [esp + 0x1c]
mov byte [esp + 0x70], 1
call fcn.005e2954
fld qword [esp + 0x78]
fcomp qword [0x6018b0]
fnstsw ax
test ah, 0x41
je 0x4607de
push 0x62d2ec
lea ecx, [esi + 0x9a70]
call fcn.005e2a3e
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebp
fild qword [esp + 0x24]
fcomp qword [esp + 0x78]
fnstsw ax
test ah, 1
je 0x460805
mov ecx, dword [esp + 0xc]
push ecx
lea ecx, [esi + 0x9a70]
call fcn.005e2a3e
fld qword [esp + 0x78]
fsub qword [0x6018a8]
dec edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], edi
fmul qword [0x601ad8]
fild qword [esp + 0x24]
fdivp st(1)
fsubr qword [0x601ad8]
call fcn.005e35c0
push ebp
mov ecx, esi
mov dword [esi + 0x9cb4], eax
call fcn.005e2972
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x7c]
mov dword [esi + 0x30c8], edx
mov ecx, esi
mov dword [esi + 0x30cc], eax
call fcn.00469c60
lea ecx, [esp + 0xc]
mov byte [esp + 0x70], 0
call fcn.005e2954
lea ecx, [esp + 0x10]
mov dword [esp + 0x70], 0xffffffff
call fcn.005e2954
mov ecx, dword [esp + 0x68]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x68
ret 0xc
Function at 0x475de0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ea96b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x606750
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x475e70
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x475e37
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [0x6000a0]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x475e61
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.005e2e1c
jmp 0x475e76
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.005e2e1c
jmp 0x475e76
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x602928
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.005e2d14
mov ecx, esi
mov dword [edi], 0x602914
mov dword [esp + 0x1c], 0xffffffff
call fcn.005e2de6
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4a9de0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ed560
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.005e2960
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0
call fcn.005e2960
push 0x631960
lea eax, [esp + 0x10]
push 0x6405a8
push eax
mov byte [esp + 0x30], 1
call fcn.005e2a32
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x28], 2
call fcn.005e2a44
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 1
call fcn.005e2954
mov eax, dword [0x6409b0]
cmp eax, 1
jle 0x4a9ee4
dec eax
lea ecx, [esp + 8]
push eax
push 0x62d424
push ecx
call fcn.005e2b16
add esp, 0xc
lea edx, [esp + 0x14]
push 0x631948
push 0x6405a8
push edx
call fcn.005e2a32
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
push eax
push edx
mov byte [esp + 0x30], 3
call fcn.005e2a2c
push 0x63193c
push eax
lea eax, [esp + 0x14]
mov byte [esp + 0x2c], 4
push eax
call fcn.005e2a32
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x28], 5
call fcn.005e2a44
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 4
call fcn.005e2954
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 3
call fcn.005e2954
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call fcn.005e2954
push ecx
lea edx, [esp + 8]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.005e2b04
mov ecx, esi
call fcn.0049ac20
lea ecx, [esp + 8]
mov byte [esp + 0x24], 0
call fcn.005e2954
lea ecx, [esp + 4]
mov dword [esp + 0x24], 0xffffffff
call fcn.005e2954
mov ecx, dword [esp + 0x1c]
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x5255f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f5558
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
lea ecx, [esp + 4]
call fcn.005e2960
mov eax, dword [esp + 0x28]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x1c], 0
call fcn.005e2a44
push 0x639818
push 0x636aa4
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x62d274
push 0x62d5f0
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x62d274
push 0x62e880
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a98
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a90
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a88
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a80
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a78
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a70
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a68
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a60
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a58
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a50
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a48
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a40
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a38
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a30
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a28
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a20
lea ecx, [esp + 0xc]
call fcn.005e2d26
push 0x636aa0
push 0x636a18
lea ecx, [esp + 0xc]
call fcn.005e2d26
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 4]
push ecx
call dword [0x600030]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 4]
mov dword [esi], edx
mov dword [esi + 4], eax
mov dword [esp + 0x18], 0xffffffff
call fcn.005e2954
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x525eb0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, 0xffff
mov dx, cx
add ecx, eax
test dx, dx
je 0x525ef5
mov edx, dword [esp + 4]
and ecx, eax
push ebx
inc ecx
push esi
mov esi, ecx
mov cl, byte [edx]
xor ebx, ebx
xor cl, al
mov bl, ah
mov byte [esp + 0x10], cl
inc edx
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov ax, word [ecx*2 + 0x60e148]
xor ax, bx
dec esi
jne 0x525ece
pop esi
pop ebx
ret
Function at 0x5440d0
Capabilities:
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x5f6bf7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.005e2960
fld qword [esp + 0x24]
fcom qword [0x6018b0]
mov ebx, 1
xor esi, esi
mov dword [esp + 0x18], ebx
fnstsw ax
test ah, 0x40
je 0x544140
push 0x62d274
lea ecx, [esp + 0xc]
fstp st(0)
call fcn.005e2a4a
mov esi, dword [esp + 0x20]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.005e2b04
mov dword [esp + 0xc], ebx
jmp 0x544272
fcom qword [0x6018b0]
push edi
fnstsw ax
test ah, 1
je 0x544158
fchs
fst qword [esp + 0x28]
xor edi, edi
jmp 0x54415a
mov edi, ebx
fcom qword [0x6018a8]
fnstsw ax
test ah, 1
je 0x544181
fmul qword [0x602940]
sub esi, 3
fcom qword [0x6018a8]
fnstsw ax
test ah, 1
jne 0x544167
fst qword [esp + 0x28]
fcom qword [0x602940]
fnstsw ax
test ah, 1
jne 0x5441df
fmul qword [0x602948]
add esi, 3
fcom qword [0x602940]
fnstsw ax
test ah, 1
je 0x54418e
fstp qword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
push edx
lea eax, [esp + 0x14]
push 0x62d5e8
push eax
call fcn.005e2b16
lea eax, [esi + 0x18]
add esp, 0x10
cmp eax, 0x30
ja case.0x5441d4.8
xor ecx, ecx
mov cl, byte [eax + 0x5442d8]
jmp dword [ecx*4 + 0x544294]
push 0x79
jmp 0x544220
fstp st(0)
jmp 0x5441a8
push 0x7a
jmp 0x544220
push 0x61
jmp 0x544220
push 0x66
jmp 0x544220
push 0x70
jmp 0x544220
push 0x6e
jmp 0x544220
push 0xb5
jmp 0x544220
push 0x6d
jmp 0x544220
push 0x6b
jmp 0x544220
push 0x4d
jmp 0x544220
push 0x47
jmp 0x544220
push 0x54
jmp 0x544220
push 0x50
jmp 0x544220
push 0x45
jmp 0x544220
push 0x5a
jmp 0x544220
push 0x59
lea ecx, [esp + 0x10]
call fcn.005e2b0a
test edi, edi
pop edi
jne 0x54425e
lea edx, [esp + 8]
lea eax, [esp + 0x24]
push edx
push 0x62e880
push eax
call fcn.005e2a38
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call fcn.005e2a44
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], bl
call fcn.005e2954
mov esi, dword [esp + 0x20]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.005e2b04
mov dword [esp + 0xc], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.005e2954
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x545010
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f6d67
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov dword [esp + 0x1c], 0
lea ecx, [esp + 8]
mov dword [esp + 0x28], 1
call fcn.005e2960
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 2
call fcn.005e2960
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 3
call fcn.005e2960
lea eax, [esp + 0x34]
lea ecx, [esp + 8]
push eax
mov byte [esp + 0x2c], 4
call fcn.005e2a44
push 0x2e
lea ecx, [esp + 0xc]
call fcn.005e2dc2
mov esi, eax
test esi, esi
jle 0x5450e6
lea ecx, [esp + 0x14]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.005e2b34
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 5
call fcn.005e2a44
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 4
call fcn.005e2954
mov edx, dword [esp + 8]
lea ecx, [esp + 8]
mov eax, dword [edx - 8]
sub eax, esi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.005e2b58
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 6
call fcn.005e2a44
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 4
call fcn.005e2954
jmp 0x545102
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x10]
call fcn.005e2a44
push 0x639818
lea ecx, [esp + 0x14]
call fcn.005e2a4a
mov eax, dword [esp + 0xc]
or edi, 0xffffffff
xor ecx, ecx
mov esi, dword [eax - 8]
test esi, esi
jle 0x545161
lea edx, [eax + esi*2 - 2]
mov ax, word [edx]
cmp ax, 0x30
je 0x545155
cmp ax, 0x31
je 0x545155
cmp ax, 0x32
je 0x545155
cmp ax, 0x33
je 0x545155
cmp ax, 0x34
je 0x545155
cmp ax, 0x35
je 0x545155
cmp ax, 0x36
je 0x545155
cmp ax, 0x37
je 0x545155
cmp ax, 0x38
je 0x545155
cmp ax, 0x39
jne 0x54515f
inc ecx
sub edx, 2
cmp ecx, esi
jl 0x545116
jmp 0x545161
mov edi, ecx
lea edx, [esp + 0x14]
push edi
push edx
lea ecx, [esp + 0x14]
call fcn.005e2b58
mov eax, dword [eax]
mov byte [esp + 0x28], 7
push eax
call dword [0x600a78]
add eax, dword [esp + 0x3c]
push eax
lea eax, [esp + 0x10]
push 0x62d424
push eax
call fcn.005e2b16
add esp, 0x10
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 4
call fcn.005e2954
sub esi, edi
lea ecx, [esp + 0x18]
push esi
push ecx
lea ecx, [esp + 0x14]
call fcn.005e2b34
lea edx, [esp + 8]
mov byte [esp + 0x28], 8
push edx
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.005e2a2c
lea ecx, [esp + 0x10]
lea edx, [esp + 0x38]
push ecx
push eax
push edx
mov byte [esp + 0x34], 9
call fcn.005e2a2c
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0xa
call fcn.005e2a44
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 9
call fcn.005e2954
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 8
call fcn.005e2954
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 4
call fcn.005e2954
mov esi, dword [esp + 0x30]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.005e2b04
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 3
call fcn.005e2954
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 2
call fcn.005e2954
lea ecx, [esp + 8]
mov byte [esp + 0x28], 1
call fcn.005e2954
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 0
call fcn.005e2954
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x545490
Capabilities:
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x5f6dbf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
push edi
mov dword [esp + 0xc], 0
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x18], 1
mov esi, dword [ebp - 8]
lea edi, [esi - 1]
mov ecx, edi
test ecx, ecx
jl 0x545514
lea edx, [ebp + ecx*2]
mov ax, word [edx]
cmp ax, 0x30
je 0x545514
cmp ax, 0x31
je 0x545514
cmp ax, 0x32
je 0x545514
cmp ax, 0x33
je 0x545514
cmp ax, 0x34
je 0x545514
cmp ax, 0x35
je 0x545514
cmp ax, 0x36
je 0x545514
cmp ax, 0x37
je 0x545514
cmp ax, 0x38
je 0x545514
cmp ax, 0x39
je 0x545514
dec ecx
sub edx, 2
test ecx, ecx
jge 0x5454cd
cmp ecx, edi
jge 0x54557e
mov ax, word [ebp + ecx*2 + 2]
cmp ax, 0x79
je 0x54557d
cmp ax, 0x7a
je 0x54557d
cmp ax, 0x61
je 0x54557d
cmp ax, 0x66
je 0x54557d
cmp ax, 0x70
je 0x54557d
cmp ax, 0x6e
je 0x54557d
cmp ax, 0xb5
je 0x54557d
cmp ax, 0x6d
je 0x54557d
cmp ax, 0x6b
je 0x54557d
cmp ax, 0x4d
je 0x54557d
cmp ax, 0x47
je 0x54557d
cmp ax, 0x54
je 0x54557d
cmp ax, 0x50
je 0x54557d
cmp ax, 0x45
je 0x54557d
cmp ax, 0x5a
je 0x54557d
cmp ax, 0x59
jne 0x54557e
inc ecx
sub esi, ecx
lea ecx, [esp + 0x24]
dec esi
push esi
mov esi, dword [esp + 0x24]
push esi
call fcn.005e2b58
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], 0
call fcn.005e2954
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x404230
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40428b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40428b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40427a
cmp esi, edx
jae 0x40428b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x404268
cmp esi, edx
jae 0x40428b
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4074e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
push esi
push edi
mov edi, ecx
mov esi, 1
bsr ecx, eax
mov eax, esi
mov dword [ebp - 4], edi
shl eax, cl
cmp edx, eax
ja 0x40762c
mov ebx, dword [edi + 4]
lea eax, [edx - 1]
or eax, esi
mov dword [ebp - 8], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.004068e0
mov ecx, dword [edi + 4]
lea eax, [esi - 1]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], esi
mov ecx, dword [ecx]
cmp ecx, ebx
je 0x407607
mov eax, ecx
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
movzx edx, byte [eax + 0xb]
imul esi, esi, 0x1000193
xor esi, edx
imul edx, esi, 0x1000193
mov esi, dword [edi + 0x18]
and esi, edx
mov edx, dword [edi + 0xc]
lea ebx, [edx + esi*8]
mov esi, dword [ebx]
mov dword [ebp + 8], ebx
cmp esi, dword [ebp - 8]
jne 0x407594
mov dword [ebx], eax
mov dword [ebx + 4], eax
jmp 0x4075fc
mov edx, dword [ebx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x4075cb
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x4075c6
mov edi, dword [eax + 4]
mov ebx, dword [ebp - 0xc]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov ebx, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
mov dword [ebx + 4], eax
jmp 0x4075f9
cmp esi, edx
je 0x4075dc
nop
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x407610
cmp esi, edx
jne 0x4075d0
mov ebx, dword [eax + 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov dword [edx + 4], edi
mov edx, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], esi
mov dword [edx], eax
mov edi, dword [ebp - 4]
mov eax, ecx
cmp ecx, dword [ebp - 8]
jne 0x407542
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [eax + 4]
mov ebx, dword [edx]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
jmp 0x4075f9
push str.invalid_hash_bucket_count
call fcn.00443d09
int3