joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c280
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x14
mov edx, dword [0x4b13e8]
mov eax, dword [esp + 0x20]
test edx, edx
mov dword [esp], eax
jne 0x41c2c0
call fcn.00444640
mov dword [esp], eax
call sub.msvcrt.dll_getenv
mov dword [esp], eax
call fcn.00446a60
mov dword [esp], eax
mov ebx, eax
call fcn.0043e6a0
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
call fcn.00444690
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wgetenv]
mov dword [esp], eax
call fcn.00446af0
mov dword [esp], esi
mov ebx, eax
call fcn.0043e6a0
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x41c510
Capabilities:
Create directory

Disassembly:
push esi
push ebx
sub esp, 0x14
mov edx, dword [0x4b13e8]
mov eax, dword [esp + 0x20]
test edx, edx
mov dword [esp], eax
jne 0x41c550
call fcn.00444640
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__mkdir]
mov dword [esp], esi
mov ebx, eax
call fcn.0043e6a0
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
call fcn.00444690
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wmkdir]
mov dword [esp], esi
mov ebx, eax
call fcn.0043e6a0
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x41c580
Capabilities:
Delete directory

Disassembly:
push esi
push ebx
sub esp, 0x14
mov edx, dword [0x4b13e8]
mov eax, dword [esp + 0x20]
test edx, edx
mov dword [esp], eax
jne 0x41c5c0
call fcn.00444640
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__rmdir]
mov dword [esp], esi
mov ebx, eax
call fcn.0043e6a0
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
call fcn.00444690
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wrmdir]
mov dword [esp], esi
mov ebx, eax
call fcn.0043e6a0
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x41c670
Capabilities:
Delete file

Disassembly:
push esi
push ebx
sub esp, 0x14
mov edx, dword [0x4b13e8]
mov esi, dword [esp + 0x20]
test edx, edx
mov dword [esp], esi
jne 0x41c6f0
call fcn.00444640
mov dword [esp + 4], 0x1b6
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__chmod]
mov dword [esp], ebx
call fcn.0043e6a0
mov eax, dword [0x4b13e8]
mov dword [esp], esi
test eax, eax
je 0x41c6d0
call fcn.00444690
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wremove]
mov dword [esp + 0x20], ebx
add esp, 0x14
pop ebx
pop esi
jmp fcn.0043e6a0
call fcn.00444640
mov dword [esp], eax
mov ebx, eax
call sub.msvcrt.dll_remove
mov dword [esp + 0x20], ebx
add esp, 0x14
pop ebx
pop esi
jmp fcn.0043e6a0
call fcn.00444690
mov dword [esp + 4], 0x1b6
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wchmod]
mov dword [esp], ebx
call fcn.0043e6a0
jmp 0x41c6a6
Function at 0x41c910
Capabilities:
Create process on windows

Disassembly:
push edi
xor eax, eax
mov ecx, 0x10
push ebx
sub esp, 0x94
mov ebx, dword [0x4b13e8]
mov edx, dword [esp + 0xa0]
lea edi, [esp + 0x50]
mov dword [esp + 0x3c], 0
test ebx, ebx
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
rep stosd dword es:[edi], eax
mov dword [esp + 0x4c], 0x44
mov dword [esp], edx
je 0x41c9e0
call fcn.00444690
mov dword [esp + 0x1c], 0
mov ebx, eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
jne 0x41ca3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x38], eax
mov dword [esp], ebx
call fcn.0043e6a0
mov eax, dword [esp + 0x38]
add esp, 0x94
pop ebx
pop edi
ret
call fcn.00444640
mov dword [esp + 0x1c], 0
mov ebx, eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
test eax, eax
je 0x41c9c0
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, eax
sub esp, 8
mov eax, 0xffffffff
test edx, edx
je 0x41ca7e
mov eax, dword [esp + 0x38]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x3c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call edi
sub esp, 4
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call edi
sub esp, 4
jmp 0x41c9ca
Function at 0x41ceb0
Capabilities:
Resolve dns

Disassembly:
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov dword [esp], eax
call fcn.004446e0
mov esi, eax
cmp ebx, 0x486200
je 0x41cedc
mov dword [esp], ebx
call fcn.004446e0
mov edi, eax
lea eax, [esp + 0x1c]
mov dword [esp + 4], edi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp], esi
mov dword [esp + 8], eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
sub esp, 0x10
mov ebx, eax
mov dword [esp], edi
mov edi, 0x486340
call fcn.0043e6a0
mov dword [esp], esi
call fcn.0043e6a0
test ebx, ebx
jne 0x41cf75
mov eax, dword [esp + 0x1c]
xor edx, edx
test eax, eax
je 0x41cf32
lea esi, [esi]
mov eax, dword [eax + 0x1c]
add edx, 1
test eax, eax
jne 0x41cf28
mov dword [esp], edx
call fcn.0041bd70
mov esi, dword [esp + 0x1c]
mov edi, eax
test esi, esi
je 0x41cf75
lea esi, [esi]
xor eax, eax
test ebx, ebx
mov dword [esp], esi
sete al
mov dword [esp + 4], eax
call fcn.0041bcf0
mov dword [esp + 8], ebx
add ebx, 1
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0041bc20
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x41cf48
add esp, 0x20
mov eax, edi
pop ebx
pop esi
pop edi
ret

Function at 0x41d010
Capabilities:
Connect socket

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 0x10]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
add esp, 0x1c
ret
Function at 0x41d6b0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
add esp, 0x2c
ret

Function at 0x41d920
Capabilities:
Resolve dns

Disassembly:
push ebx
sub esp, 0x128
mov edx, dword [esp + 0x134]
mov ecx, dword [esp + 0x130]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, edx
mov dword [esp + 0xc], 0x100
and eax, 1
shl eax, 4
mov ebx, eax
or ebx, 4
test dl, 2
cmovne eax, ebx
mov ebx, eax
or ebx, 1
test dl, 4
cmovne eax, ebx
mov ebx, eax
or ebx, 2
test dl, 8
cmovne eax, ebx
mov ebx, eax
or ebx, 8
and edx, 0x10
cmovne eax, ebx
lea ebx, [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x18]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getnameinfo]
mov edx, eax
sub esp, 0x1c
mov eax, 0x486200
test edx, edx
jne 0x41d9b6
mov dword [esp], ebx
call fcn.00447650
add esp, 0x128
pop ebx
ret

Function at 0x41dac0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push esi
push ebx
sub esp, 0x1a4
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], pe_nt_image_headers32
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1b0]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getsockname]
sub esp, 0xc
mov ebx, eax
test eax, eax
js 0x41db6a
movzx eax, word [esp + 0x22]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ntohs]
sub esp, 4
movzx eax, ax
mov edx, dword [esp + 0x1b4]
mov dword [edx], eax
mov dword [esp], str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
cmp word [esp + 0x20], 2
je 0x41db78
mov dword [esp + 4], str.RtlIpv6AddressToStringW
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
lea esi, [esp + 0xa0]
lea edx, [esp + 0x28]
mov dword [esp + 4], esi
mov dword [esp], edx
call eax
sub esp, 8
mov dword [esp], esi
call fcn.00446af0
mov edx, dword [esp + 0x1b8]
mov dword [edx], eax
add esp, 0x1a4
mov eax, ebx
pop ebx
pop esi
ret
mov dword [esp + 4], str.RtlIpv4AddressToStringW
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
lea esi, [esp + 0xa0]
lea edx, [esp + 0x24]
mov dword [esp + 4], esi
mov dword [esp], edx
call eax
sub esp, 8
jmp 0x41db59

Function at 0x41dca0
Capabilities:
Initialize winsock library

Disassembly:
push ebx
sub esp, 0x1a8
lea eax, [esp + 0x10]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
mov dword [esp], 0x41c160
call fcn.004014a0
mov ebx, dword [fcn.0047a4b0]
mov dword [esp], 0
call ebx
mov dword [esp], 1
mov dword [0x4af0f4], eax
call ebx
mov dword [esp], 2
mov dword [0x4af0f0], eax
call ebx
mov dword [0x4af0ec], eax
add esp, 0x1a8
pop ebx
ret
Function at 0x424410
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
movsx edx, byte [esi]
test dl, dl
jne 0x424438
mov edi, dword [ebp]
add esp, 0x3c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x424520
lea edi, [esi + 1]
mov ebx, 0x1505
lea esi, [esi]
nop
mov eax, ebx
add edi, 1
shl eax, 5
add ebx, eax
xor ebx, edx
movsx edx, byte [edi - 1]
test dl, dl
jne 0x424450
mov eax, ebx
xor edx, edx
div dword [ebp + 8]
lea eax, [edx*4]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 4]
mov edi, dword [eax + edx*4]
test edi, edi
je 0x424500
xor ebx, ebx
test ecx, ecx
jne 0x42449b
jmp 0x4244e3
mov eax, dword [edi + 4]
mov ebx, edi
test eax, eax
je 0x424500
mov edi, eax
mov dword [esp + 4], esi
mov eax, dword [edi]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x424490
test ebx, ebx
je 0x424429
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov ebx, dword [esp + 0x1c]
add ebx, dword [ebp + 4]
mov eax, dword [ebx]
mov dword [edi + 4], eax
mov eax, edi
mov dword [ebx], edi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 4]
mov ebx, edi
test eax, eax
je 0x424500
mov edi, eax
mov dword [esp + 4], esi
mov eax, dword [edi]
mov dword [esp], eax
call sym.makedocs.exe_PHYSFS_utf8stricmp
test eax, eax
jne 0x4244d8
jmp 0x4244ad
mov eax, 0xb
xor edi, edi
call fcn.0041ec80
add esp, 0x3c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x424570
lea edi, [esi + 1]
mov ebx, 0x1505
jmp 0x424553
shl eax, 5
add eax, ebx
lea ebx, [edx + 0x20]
movzx ebx, bl
movzx edx, byte [edi]
add edi, 1
xor ebx, eax
test dl, dl
je 0x424464
lea eax, [edx - 0x41]
cmp al, 0x19
mov eax, ebx
jbe 0x424538
shl eax, 5
add eax, ebx
movsx ebx, dl
jmp 0x424543
mov dword [esp + 0x20], esi
mov ebx, 0x1505
lea edi, [esp + 0x24]
mov dword [esp + 0x1c], ecx
lea esi, [esi]
lea eax, [esp + 0x20]
mov dword [esp], eax
call fcn.00439ee0
test eax, eax
je 0x4245d0
mov dword [esp + 4], edi
mov dword [esp], eax
call sym.makedocs.exe_PHYSFS_caseFold
lea edx, [eax*4]
test edx, edx
jle 0x424588
add edx, edi
mov eax, edi
lea esi, [esi]
nop
mov ecx, ebx
add eax, 1
shl ecx, 5
add ebx, ecx
movsx ecx, byte [eax - 1]
xor ebx, ecx
cmp eax, edx
jne 0x4245b8
jmp 0x424588
mov ecx, dword [esp + 0x1c]
jmp 0x424464
Function at 0x4245e0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00424410
mov ebx, eax
test eax, eax
je 0x424610
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ecx, dword [esi + 0xc]
mov edi, dword [esi]
mov dword [esp + 4], 0x2f
lea ebp, [ecx + eax + 1]
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call sub.msvcrt.dll_strrchr
test eax, eax
je 0x424750
mov byte [eax], 0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00424410
mov ecx, dword [esp + 0x1c]
test eax, eax
mov edi, eax
je 0x424724
mov byte [ecx], 0x2f
mov eax, dword [eax + 0x10]
test eax, eax
je 0x42481d
mov dword [esp], ebp
mov dword [esp + 4], 0
call dword [0x4af104]
mov ebp, eax
test eax, eax
je 0x42480e
mov eax, dword [esi + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebp
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0xc]
mov edx, dword [esp + 0x54]
add eax, ebp
mov dword [ebp], eax
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov ecx, dword [esi + 0x10]
mov eax, dword [esp + 0x54]
test ecx, ecx
je 0x424760
movsx edx, byte [eax]
lea ecx, [eax + 1]
mov ebx, 0x1505
test dl, dl
je 0x4246f4
lea esi, [esi]
mov eax, ebx
add ecx, 1
shl eax, 5
add ebx, eax
xor ebx, edx
movsx edx, byte [ecx - 1]
test dl, dl
jne 0x4246e0
mov eax, ebx
xor edx, edx
mov ebx, ebp
div dword [esi + 8]
mov eax, dword [esi + 4]
lea eax, [eax + edx*4]
mov edx, dword [eax]
mov dword [ebp + 4], edx
mov dword [eax], ebp
mov eax, dword [edi + 8]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [ebp + 0x10], eax
mov eax, ebx
mov dword [edi + 8], ebp
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x54]
mov dword [esp + 8], 1
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 0x1c], ecx
call fcn.004245e0
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov byte [ecx], 0x2f
lea esi, [esi]
test edi, edi
jne 0x424674
jmp 0x424601
mov edx, dword [esi + 0x14]
test edx, edx
je 0x4247b0
movzx edx, byte [eax]
lea ecx, [eax + 1]
mov ebx, 0x1505
test dl, dl
jne 0x42479b
jmp 0x4246f4
shl eax, 5
add eax, ebx
lea ebx, [edx + 0x20]
movzx ebx, bl
movzx edx, byte [ecx]
add ecx, 1
xor ebx, eax
test dl, dl
je 0x4246f4
lea eax, [edx - 0x41]
cmp al, 0x19
mov eax, ebx
jbe 0x424780
shl eax, 5
add eax, ebx
movsx ebx, dl
jmp 0x42478b
mov dword [esp + 0x20], eax
mov ebx, 0x1505
lea esi, [esi]
lea eax, [esp + 0x20]
mov dword [esp], eax
call fcn.00439ee0
test eax, eax
je 0x4246f4
lea edx, [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym.makedocs.exe_PHYSFS_caseFold
lea edx, [eax*4]
test edx, edx
jle 0x4247c0
lea eax, [esp + 0x24]
add edx, eax
lea esi, [esi]
mov ecx, ebx
add eax, 1
shl ecx, 5
add ebx, ecx
movsx ecx, byte [eax - 1]
xor ebx, ecx
cmp eax, edx
jne 0x4247f8
jmp 0x4247c0
mov eax, 2
call fcn.0041ec80
jmp 0x424601
mov eax, 0x12
call fcn.0041ec80
jmp 0x424601
Function at 0x42d470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x5c
mov ebp, dword [esp + 0x7c]
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x30]
mov esi, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x20]
mov dword [esp + 8], eax
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0042bc80
test eax, eax
jne 0x42d65e
mov edx, dword [ebp + 4]
mov eax, 0x10
test edx, edx
je 0x42d65e
mov eax, 4
cmp dword [esp + 0x70], edx
jb 0x42d65e
add esi, dword [esp + 0x20]
adc edi, dword [esp + 0x24]
mov dword [ebx], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [ebx + 4], 0
cmp edx, 1
je 0x42d588
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
cmp edx, 2
je 0x42d588
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
cmp edx, 3
je 0x42d588
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
cmp edx, 4
je 0x42d588
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
cmp edx, 5
je 0x42d588
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
cmp edx, 6
je 0x42d588
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp edx, 8
jne 0x42d588
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov dword [esp + 0x18], edx
xor esi, esi
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x24]
movzx eax, byte [eax + esi]
add eax, dword [edx + esi*4]
mov edi, dword [ecx + eax*8]
mov eax, dword [ecx + eax*8 + 4]
test eax, eax
jne 0x42d680
mov dword [ebx + esi*8 + 4], 0
test edi, edi
je 0x42d670
mov dword [esp + 4], edi
mov dword [esp], 0x484ea4
call dword [0x484ea4]
mov dword [ebx + esi*8], eax
test eax, eax
je 0x42d680
mov dword [ebx + esi*8 + 4], edi
add esi, 1
cmp dword [esp + 0x18], esi
jne 0x42d58e
mov dword [esp + 0x7c], ebp
xor esi, esi
mov ebp, dword [esp + 0x1c]
lea edi, [esp + 0x28]
jmp 0x42d638
mov eax, dword [ebx + esi*8 + 4]
mov edx, dword [esp + 0x14]
mov ecx, ebp
mov dword [esp + 0xc], eax
mov eax, dword [ebx + esi*8]
mov dword [esp + 4], edx
mov edx, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0x7c]
call fcn.00428e20
test eax, eax
jne 0x42d65e
add esi, 1
cmp dword [esp + 0x18], esi
je 0x42d65e
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov dword [esp], ebp
call dword [ebp + 0xc]
test eax, eax
je 0x42d600
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebx + esi*8], 0
jmp 0x42d5dd
add esp, 0x5c
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42f060
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [0x4af160]
test eax, eax
je 0x42f06a
ret
mov dword [0x4af160], 1
xor edx, edx
lea esi, [esi]
lea esi, [esi]
mov eax, edx
mov ecx, edx
and eax, 1
shr ecx, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and eax, 1
neg eax
shr ecx, 1
and eax, 0xedb88320
xor ecx, eax
mov eax, ecx
and ecx, 1
neg ecx
shr eax, 1
and ecx, 0xedb88320
xor eax, ecx
mov ecx, eax
and eax, 1
neg eax
shr ecx, 1
and eax, 0xedb88320
xor ecx, eax
mov eax, ecx
and ecx, 1
neg ecx
shr eax, 1
and ecx, 0xedb88320
xor eax, ecx
mov ecx, eax
and eax, 1
neg eax
shr ecx, 1
and eax, 0xedb88320
xor ecx, eax
mov eax, ecx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor eax, ecx
mov ecx, eax
and eax, 1
neg eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
mov dword [edx*4 + 0x4af180], eax
add edx, 1
cmp edx, 0x100
jne 0x42f080
lea esi, [esi]
nop
mov eax, dword [edx*4 + 0x4aed80]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4af180]
mov dword [edx*4 + 0x4af180], eax
add edx, 1
cmp edx, 0x800
jne 0x42f120
mov dword [0x4b1180], 0x424950
mov ecx, 0x40000
pushfd
pop eax
mov edx, eax
xor eax, ecx
push eax
popfd
pushfd
pop eax
xor eax, edx
push edx
popfd
and ecx, eax
test ecx, ecx
je 0x42f069
mov ecx, 0x200000
pushfd
pop eax
mov edx, eax
xor eax, ecx
push eax
popfd
pushfd
pop eax
xor eax, edx
push edx
popfd
and ecx, eax
test ecx, ecx
je 0x42f069
push ebp
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x20
cpuid
mov eax, 1
mov edi, edx
mov ebp, ecx
mov esi, ebx
cpuid
mov ecx, eax
mov edx, eax
shr ecx, 0x10
shr edx, 8
and edx, 0xf
and ecx, 0xff0
or ecx, edx
mov edx, eax
shr eax, 4
shr edx, 0xc
and eax, 0xf
and edx, 0xf0
or edx, eax
cmp esi, 0x756e6547
je 0x42f1ea
cmp esi, 0x68747541
jne 0x42f220
cmp edi, 0x69746e65
je 0x42f259
add esp, 0x20
pop ebx
pop esi
pop edi
pop ebp
ret
cmp edi, 0x49656e69
jne 0x42f1e2
cmp ebp, 0x6c65746e
jne 0x42f1e2
cmp ecx, 5
jbe 0x42f1e2
cmp ecx, 6
jne 0x42f247
sub edx, 0x1c
cmp edx, 0x1a
ja 0x42f247
mov eax, 0x6000c01
bt eax, edx
jae 0x42f247
jmp 0x42f1e2
cmp esi, 0x746e6543
jne 0x42f1e2
cmp edi, 0x48727561
jne 0x42f1e2
cmp ebp, 0x736c7561
jne 0x42f1e2
cmp ecx, 5
jbe 0x42f1e2
cmp ecx, 6
jne 0x42f247
cmp edx, 0xe
jbe 0x42f1e2
mov dword [0x4b1180], 0x424a40
add esp, 0x20
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ebp, 0x444d4163
jne 0x42f1e2
cmp ecx, 4
jbe 0x42f1e2
cmp ecx, 5
jne 0x42f247
cmp edx, 5
jbe 0x42f1e2
cmp edx, 0xa
jne 0x42f247
jmp 0x42f1e2
Function at 0x432140
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, eax
push esi
movzx edx, dl
push ebx
mov eax, dword [eax]
xor edx, eax
mov ebx, edx
shr ebx, 1
and ebx, 0x7f
mov esi, ebx
xor esi, 0xedb88320
and edx, 1
cmovne ebx, esi
mov esi, ebx
shr esi, 1
mov edx, esi
xor edx, 0xedb88320
and ebx, 1
cmovne esi, edx
mov edx, esi
shr edx, 1
mov ebx, edx
xor ebx, 0xedb88320
and esi, 1
cmovne edx, ebx
mov ebx, edx
shr ebx, 1
mov esi, ebx
xor esi, 0xedb88320
and edx, 1
cmovne ebx, esi
mov edx, ebx
shr edx, 1
mov esi, edx
xor esi, 0xedb88320
and ebx, 1
cmovne edx, esi
mov ebx, edx
shr ebx, 1
mov esi, ebx
xor esi, 0xedb88320
and edx, 1
cmovne ebx, esi
mov edx, ebx
shr edx, 1
mov esi, edx
xor esi, 0xedb88320
and ebx, 1
cmovne edx, esi
mov ebx, edx
shr ebx, 1
mov esi, ebx
xor esi, 0xedb88320
and edx, 1
cmovne ebx, esi
shr eax, 8
xor eax, ebx
mov ebx, dword [ecx + 8]
mov dword [ecx], eax
movzx eax, al
add eax, dword [ecx + 4]
imul eax, eax, 0x8088405
add eax, 1
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, ebx
mov edx, eax
shr edx, 1
and edx, 0x7f
mov esi, edx
xor esi, 0xedb88320
test al, 1
cmovne edx, esi
mov esi, edx
shr esi, 1
mov eax, esi
xor eax, 0xedb88320
and edx, 1
cmovne esi, eax
mov eax, esi
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
and esi, 1
cmovne eax, edx
mov edx, eax
shr edx, 1
mov esi, edx
xor esi, 0xedb88320
test al, 1
cmovne edx, esi
mov eax, edx
shr eax, 1
mov esi, eax
xor esi, 0xedb88320
and edx, 1
cmovne eax, esi
mov edx, eax
shr edx, 1
mov esi, edx
xor esi, 0xedb88320
test al, 1
cmovne edx, esi
mov eax, edx
shr eax, 1
mov esi, eax
xor esi, 0xedb88320
and edx, 1
cmovne eax, esi
mov edx, eax
shr edx, 1
mov esi, edx
xor esi, 0xedb88320
test al, 1
cmovne edx, esi
shr ebx, 8
xor ebx, edx
mov dword [ecx + 8], ebx
pop ebx
pop esi
ret