joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e970
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.00413d80
sub esp, 0x10
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x42e9a9
jmp 0x42eaf4
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x42e9e5
jmp 0x42eaec
mov dword [ebp - 0x1c], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.00422be0
add esp, 4
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x42ea19
jmp 0x42eadd
mov dword [ebp - 0x18], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.00407fa0
sub esp, 8
mov dword [ebp - 0x14], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00408e40
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov word [edi], 0x2190
mov word [edi + 2], 0x2dcd
mov word [edi + 4], 0x22b7
mov word [edi + 6], 0x2fb7
mov word [edi + 8], 0xe3b3
mov word [edi + 0xa], 0x15dc
mov word [edi + 0xc], 0x9ddd
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, 7
jae 0x42eaad
movzx edx, word [edi + eax*2]
mov esi, eax
add esi, 0x3033350b
xor esi, edx
mov edx, esi
shl edx, 1
and edx, 0xaf4e
xor esi, 0x57a7
add esi, edx
add si, 1
mov word [edi + eax*2], si
add eax, 1
jmp 0x42ea7b
sub esp, 0xc
mov dword [esp], edi
mov esi, dword [ebp - 0x14]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
call fcn.00408fb0
mov bl, al
and bl, 1
jmp 0x42eacd
sub esp, 4
mov dword [esp], esi
call fcn.00407fb0
add esp, 4
jmp 0x42eadd
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42eaf4
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x4360c0
xor eax, eax
cmp dword [ecx], 0
jne 0x43610f
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x7f897f8a
xor eax, eax
mov bl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + eax*2]
lea edi, [eax + 0x134b8ed]
mov ebp, 0x4712
sub ebp, eax
mov edx, 0x40cb4712
sub edx, eax
and edx, 0x40c80212
and edi, 0x12430cd
or edi, edx
xor edi, 0x7ed88a32
or edi, esi
not esi
or esi, ebp
and esi, edi
mov edi, esi
and edi, 0x6583895
mov edx, esi
and edx, 2
mov ebp, edx
xor ebp, 2
imul ebp, edi
or edi, 2
imul edi, edx
add edi, ebp
xor esi, 0x65a3897
mov edx, edi
and edx, esi
xor edi, esi
lea edx, [edi + edx*2]
and esi, 1
or edx, 1
add edx, esi
mov word [esp + eax*2], dx
mov eax, 1
test bl, 1
mov ebx, 0
jne 0x436020
mov eax, dword [esp]
mov esi, dword [0x4452ac]
test esi, esi
je 0x43610f
xor edi, edi
mov ebx, dword [0x4452b0]
cmp dword [ebx + edi*8], 0xf62c6d34
je 0x436119
inc edi
cmp esi, edi
jne 0x4360b0
jmp 0x43610f
mov dword [esp + 4], 0x6201a208
xor eax, eax
mov cl, 1
nop
nop
nop
nop
movzx edx, word [esp + eax*2 + 4]
mov esi, eax
or esi, 0x3200
mov edi, edx
not edi
and esi, edi
mov ebx, 0xcdff
sub ebx, eax
or ebx, edi
add edx, ebx
inc edx
or edx, esi
add edx, 0x7000
mov word [esp + eax*2 + 4], dx
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x4360d0
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43610f
lea eax, [esp + 0x1c]
lea edx, [esp + 4]
push eax
push edx
push dword [esp + 0x40]
push ecx
push 0x10
push esi
push dword [0x4452b4]
call fcn.00437870
add esp, 0x1c
jmp 0x43610f
Function at 0x436150
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43623e
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], 0x7f897f8a
xor edx, edx
mov bl, 1
movzx esi, word [esp + edx*2]
lea edi, [edx + 0x134b8ed]
mov ebp, 0x4712
sub ebp, edx
mov eax, 0x40cb4712
sub eax, edx
and eax, 0x40c80212
and edi, 0x12430cd
or edi, eax
xor edi, 0x7ed88a32
or edi, esi
not esi
or esi, ebp
and esi, edi
mov edi, esi
and edi, 0x6583895
mov eax, esi
and eax, 2
mov ebp, eax
xor ebp, 2
imul ebp, edi
or edi, 2
imul edi, eax
add edi, ebp
xor esi, 0x65a3897
mov eax, edi
and eax, esi
xor edi, esi
lea eax, [edi + eax*2]
and esi, 1
or eax, 1
add eax, esi
mov word [esp + edx*2], ax
mov edx, 1
test bl, 1
mov ebx, 0
jne 0x436170
mov edx, dword [0x4452ac]
test edx, edx
je 0x436231
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x4452b0]
nop
cmp dword [ebx + edi*8], 0xb430e561
je 0x436210
inc edi
cmp edx, edi
jne 0x436200
jmp 0x436231
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x436231
push dword [esp + 4]
push 4
push edx
push dword [0x4452b4]
mov esi, ecx
call fcn.00437870
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, 0xc0000008
mov dword [esp + 8], ecx
cmp dword [ecx + 8], 0
je 0x436481
mov ecx, dword [esp + 8]
mov ecx, dword [ecx]
test ecx, ecx
je 0x436481
mov dword [esp + 4], ecx
mov dword [esp + 0x10], 0x7f897f8a
xor eax, eax
mov cl, 1
nop
nop
nop
movzx edi, word [esp + eax*2 + 0x10]
lea esi, [eax + 0x134b8ed]
mov edx, 0x40cb4712
sub edx, eax
and edx, 0x40c80212
and esi, 0x12430cd
or esi, edx
mov edx, 0x4712
sub edx, eax
xor esi, 0x7ed88a32
or esi, edi
not edi
or edi, edx
and edi, esi
mov esi, edi
and esi, 0x6583895
mov ebx, edi
and ebx, 2
mov edx, ebx
xor edx, 2
imul edx, esi
or esi, 2
imul esi, ebx
add esi, edx
xor edi, 0x65a3897
mov edx, esi
and edx, edi
xor esi, edi
lea edx, [esi + edx*2]
and edi, 1
or edx, 1
add edx, edi
mov word [esp + eax*2 + 0x10], dx
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x436280
mov eax, dword [esp + 0x10]
mov esi, dword [0x4452ac]
test esi, esi
je 0x436350
xor edi, edi
mov ebx, dword [0x4452b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xddb7c3f3
je 0x436330
inc edi
cmp esi, edi
jne 0x436320
jmp 0x436350
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x436350
push dword [ebp + 8]
push dword [esp + 8]
push 8
push esi
push dword [0x4452b4]
call fcn.00437870
add esp, 0x14
cmp dword [ebp + 0xc], 0
je 0x436470
cmp eax, 0xc000010a
jne 0x436470
mov ecx, 0xffffd8f0
mov esi, dword [ebp + 0xc]
mov eax, esi
mul ecx
sub edx, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 8]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x7f897f8a
xor eax, eax
mov bl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [esp + eax*2 + 0xc]
lea esi, [eax + 0x134b8ed]
mov ecx, 0x40cb4712
sub ecx, eax
and ecx, 0x40c80212
and esi, 0x12430cd
or esi, ecx
mov ecx, 0x4712
sub ecx, eax
xor esi, 0x7ed88a32
or esi, edi
not edi
or edi, ecx
and edi, esi
mov esi, edi
and esi, 0x6583895
mov ecx, edi
and ecx, 2
mov edx, ecx
xor edx, 2
imul edx, esi
or esi, 2
imul esi, ecx
add esi, edx
xor edi, 0x65a3897
mov ecx, esi
and ecx, edi
xor esi, edi
lea ecx, [esi + ecx*2]
and edi, 1
or ecx, 1
add ecx, edi
mov word [esp + eax*2 + 0xc], cx
mov eax, 1
xor edi, edi
test bl, 1
mov ebx, 0
jne 0x4363a0
cmp dword [ebp + 0xc], 0xffffffff
je 0x436429
lea edi, [esp + 0x10]
mov eax, dword [esp + 0xc]
mov esi, dword [0x4452ac]
test esi, esi
je 0x436470
xor ebx, ebx
mov edx, dword [0x4452b0]
nop
cmp dword [edx + ebx*8], 0xa67d73aa
je 0x436450
inc ebx
cmp esi, ebx
jne 0x436440
jmp 0x436470
mov edx, dword [edx + ebx*8 + 4]
cmp edx, eax
je 0x436470
push edi
push 0
push dword [esp + 0xc]
push 0xc
push edx
push dword [0x4452b4]
call fcn.00437870
add esp, 0x18
test eax, eax
js 0x436481
mov ecx, dword [esp + 8]
mov esi, eax
call fcn.00436150
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x436490
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ecx, dword [ecx]
mov dword [esp], 0x7f897f8a
xor eax, eax
mov dl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + eax*2]
lea edi, [eax + 0x134b8ed]
mov ebx, 0x4712
sub ebx, eax
mov ebp, 0x40cb4712
sub ebp, eax
and ebp, 0x40c80212
and edi, 0x12430cd
or edi, ebp
xor edi, 0x7ed88a32
or edi, esi
not esi
or esi, ebx
and esi, edi
mov edi, esi
and edi, 0x6583895
mov ebx, esi
and ebx, 2
mov ebp, ebx
xor ebp, 2
imul ebp, edi
or edi, 2
imul edi, ebx
add edi, ebp
xor esi, 0x65a3897
mov ebx, edi
and ebx, esi
xor edi, esi
lea edi, [edi + ebx*2]
and esi, 1
or edi, 1
add edi, esi
mov word [esp + eax*2], di
mov eax, 1
test dl, 1
mov edx, 0
jne 0x4364b0
mov eax, dword [esp]
mov edx, dword [0x4452ac]
test edx, edx
je 0x436558
xor esi, esi
mov edi, dword [0x4452b0]
cmp dword [edi + esi*8], 0xe095b21b
je 0x436550
inc esi
cmp edx, esi
jne 0x436540
jmp 0x436558
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x436562
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ecx
push 0x18
push edx
push dword [0x4452b4]
call fcn.00437870
add esp, 0x28
jmp 0x43655b

Function at 0x436590
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov eax, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp], 0x7f897f8a
xor eax, eax
mov dl, 1
nop
nop
nop
nop
movzx ebp, word [esp + eax*2]
lea esi, [eax + 0x134b8ed]
mov edi, 0x4712
sub edi, eax
mov ecx, 0x40cb4712
sub ecx, eax
and ecx, 0x40c80212
and esi, 0x12430cd
or esi, ecx
xor esi, 0x7ed88a32
or esi, ebp
not ebp
or ebp, edi
and ebp, esi
mov esi, ebp
and esi, 0x6583895
mov ecx, ebp
and ecx, 2
mov edi, ecx
xor edi, 2
imul edi, esi
or esi, 2
imul esi, ecx
add esi, edi
xor ebp, 0x65a3897
mov ecx, esi
and ecx, ebp
xor esi, ebp
lea ecx, [esi + ecx*2]
and ebp, 1
or ecx, 1
add ecx, ebp
mov word [esp + eax*2], cx
mov eax, 1
test dl, 1
mov edx, 0
jne 0x4365b0
test ebx, ebx
jne 0x436633
lea ebx, [esp + 8]
mov eax, dword [esp]
mov edx, dword [0x4452ac]
test edx, edx
je 0x43668a
xor esi, esi
mov edi, dword [0x4452b0]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xa99f3325
je 0x436660
inc esi
cmp edx, esi
jne 0x436650
jmp 0x43668a
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x43668a
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x14]
push 0x14
push edx
push dword [0x4452b4]
call fcn.00437870
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x4384c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
movzx eax, word [ebp]
mov dword [esp + 0x18], 0xe2205992
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
lea edx, [ecx + 0x5697]
xor dx, word [esp + ecx*2 + 0x18]
add edx, 0x4b48
mov word [esp + ecx*2 + 0x18], dx
lea ecx, [ecx + ecx*2]
xor ecx, 1
cmp ecx, 2
jb 0x4384e0
xor ecx, ecx
cmp dword [esp + 0x18], eax
setne cl
mov eax, dword [ecx*4 + 0x4425cc]
mov ecx, 0x7ba253f4
xor ecx, dword [0x4425d4]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx

Function at 0x438c70
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
mov dword [esp], 0x67ed671c
xor eax, eax
mov cl, 1
nop
nop
nop
movzx edx, word [esp + eax*2]
mov esi, eax
or esi, 0xd105bb8c
xor esi, edx
add esi, 0x77d2239f
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov word [esp + eax*2], dx
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x438c80
mov eax, dword [esp]
mov eax, dword fs:[eax]
add esp, 4
pop esi
ret

Function at 0x438cc0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
call fcn.00438c70
xor ecx, ecx
cmp dword [esp + 0x1c], 0
sete cl
jmp dword [ecx*4 + 0x442a04]

Function at 0x438ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
call fcn.00438c70
xor ecx, ecx
test esi, esi
sete cl
jmp dword [ecx*4 + 0x442a54]

Function at 0x438f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
call fcn.00438c70
xor ecx, ecx
test esi, esi
sete cl
jmp dword [ecx*4 + 0x442a84]
Function at 0x8662b8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x8662c2
pushal
call 0x8662c8
pop ebp
sub ebp, 0x10
sub ebp, 0x4662b8
jmp 0x8662de
mov eax, 0x4662b8
add eax, ebp
add eax, 0x4c
mov ecx, 0x60b
mov edx, 0x70b63d5d
xor byte [eax], dl
inc eax
dec ecx
jne 0x8662f5
jmp 0x866308
salc
nop
salc
aam 0x61
pop ebp
pop ebp
pop ebp
fcomp qword [ebp + 0x5e5d5d5d]
nop
in eax, 0x59
pop ebp
pop ebp
pop ebp
out 0x75, eax
pop ebp
pop ebp
pop ebp
stosb byte es:[edi], al
mov edi, 0xdcd6955e
push ecx
pop ebp
pop ebp
pop ebp
pop esi
cwde
or eax, 0xa17939d0
aam 0x59
jns 0x86636c
xor eax, 0x355d53f3
or eax, 0x5c5d6ae9
jno 0x8663bc
xor eax, 0x86fc1550
mov ch, 0x58
pop ebp
pop ebp
pop ebp
cld
xchg byte [ebp + 0x5d5d5d58], dh
mov ah, 0x77
pop ebp
pop ebp
pop ebp
or al, dl
xor dword [ecx + 0x5d], edi
salc
fcom dword [ebp + 0x5d]
pop ebp
pop ebp
salc
enter 0x5d51, 0x5d
pop ebp
salc
ror byte [ebp + 0x5d], 1
pop ebp
pop ebp
pushfd
mov ah, 0x5f
insb byte es:[edi], dx
pop edi
ficomp word [edi - 0x27adeba7]
test eax, 0xa2a2a2
lahf
push ecx
pop ebp
salc
sar dword [ecx + 0x59], 1
pop ebp
pop ebp
pop ebp
xor eax, 0x5d53f335
xor eax, 0x5d6ae90d
pop esp
jno 0x866409
sar byte [ecx], 1
jns 0x866335
aam 0x51
jns 0x86634d
pop eax
pop ebp
pop ebp
pop ebp
mov ah, 0x10
pop edi
pop ebp
pop ebp
sar byte [ecx], 1
jns 0x866346
aam 0x71
jns 0x866379
xor dword [ecx + 0x5d], edi
mov byte [0x28a25128], al
push ebp
mov ch, 0x25
pop ebp
pop ebp
pop ebp
salc
and eax, 0xd65d5d5d
loopne 0x86640f
pop ebp
pop ebp
pop ebp
fsubr qword [esi + eax - 0x23455bb5]
lodsb al, byte [esi]
push es
dec ebx
movsb byte es:[edi], byte [esi]
mov edx, 0x8f6e946e
fidiv word [ebp - 0x26adeaa8]
adc ebx, dword [ebp + 0x5d]
pop ebp
push edx
aad 0x15
pop ebp
pop ebp
pop ebp
cmp edx, esi
inc ecx
frstor dword fs:[esi + 0x47d952b5]
pop ebp
pop ebp
pop ebp
frstor dword [esi + 0x4cd952b4]
pop ebp
pop ebp
pop ebp
cmp ebx, esp
cmpsb byte [esi], byte es:[edi]
mov byte [0x48d95278], al
pop ebp
pop ebp
pop ebp
sbb al, 0xb4
xchg ecx, eax
mov byte [0x1174a2a2], al
pop esp
ficomp word [eax + ebx*2 - 0x4ba64a22]
invalid
pushfd
pop eax
fidiv word [ebp - 0x5d1f4ba7]
loopne 0x8663b3
mov byte [0x640974a2], al
pop edi
ficomp word [ebx + ebx*2 - 0x21a64822]
mov ch, 0x58
mov ah, 0xf6
mov byte [0x71d6a2a2], al
jns 0x8663f9
cmp dword [ecx + 0x59], edi
lahf
push ecx
pop ebp
or dh, dl
mov cl, 0xb
or cl, byte [eax]
salc
sub byte [ecx - 0x2a], dl
and byte [ebp - 0x5f], dl
out dx, eax
fst st(7)
pop ebx
fcomp qword [ebx + 0x5d5d5d5c]
aad 0x5a
fcomp qword [edx + 0x5d5d5d5c]
out 0x5f, al
pop ebp
pop ebp
pop ebp
pop edi
invalid
Function at 0x408932
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0x4085d8
pop ecx
or edi, edi
call fcn.00408965
add edi, 0x5b80c788
xor dword [ebx], ecx
sub edi, 0x9968f24d
inc ebx
mov edi, 0x4aa6b6f5
cmp ebx, eax
jne fcn.00408932
ret
Function at 0x404f0b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
adc al, 0
jne 0x43d9cd
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004255e2
add esp, 0x10
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 8]
pop edi
pop esi
jmp 0x404f0f
Function at 0x409ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
add byte [eax], al
mov eax, dword [0x4c6480]
mov dword [esp + 4], ecx
push esi
push edi
test al, 1
je 0x40b3d6
mov edi, dword [ebp + 0x10]
xor eax, eax
push 8
mov word [esp + 0x5c], 1
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], 1
call fcn.00420db6
mov edx, eax
mov dword [esp + 0x20], eax
add esp, 4
test edx, edx
je 0x40b52a
mov dword [edx], 0x14
mov esi, dword [ebp + 0xc]
mov dword [edx + 4], 0
mov dword [esp + 0x54], edx
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [esp + 0x50], 1
mov dword [esp + 0x10], 0x17
mov eax, dword [edx + 4]
mov eax, dword [eax + ecx*4]
movsx eax, word [eax + 0xa]
mov dword [esp + 0x5c], eax
jmp 0x409faa
push esp
and al, 0x1c
add byte [eax], al
inc byte [ecx]
dec dword [ebx - 0x2fc4fbaf]
dec dword [ebx - 0x3dc4fbaf]
adc byte [ecx - 0x16f7dbbc], cl
or edi, esp
invalid
and al, 0x24
add byte [eax], al
add byte [eax], al
inc ecx
add dword [esi + 1], edi
add byte [ebx + 0x4c483f0], cl
add eax, dword [eax]
add bh, al
push es
add dword [eax], eax
add byte [eax], al
add eax, dword [eax]
add bh, al
inc esi
and byte [eax], al
add byte [eax], al
add byte [eax - 0x74fff288], al
inc eax
or byte [edi], cl
test dword [ebx + 8], esp
add byte [eax], al
and al, 0x24
or al, 4
add byte [eax], al
add al, ch
rcr byte [esi + 1], cl
add byte [ebx + 0x4c483d0], cl
mov eax, 0xfd
add byte [edi], cl
test dword [esp + ecx*2], ebp
add eax, dword [eax]
test dword [edx - 0x7ffffcaa], ebx
jl 0x40b18f
pop eax
add byte [edi], cl
test byte [edx - 0x39fffcaa], ch
add dh, al
inc esp
and al, 0x59
add edi, edi
dec esp
and al, 0x50
add al, ch
cmp bh, ah
invalid
push ebp
or cl, ch
pop ss
out dx, al
invalid
dec dword [ebx - 0xad81630]
invalid
or eax, 1
mov dword [0x4c6488], 0
push 0x43b5ec
mov dword [0x4c6480], eax
mov dword [0x4c6490], 0
mov dword [0x4c6494], 1
call fcn.00422d40
add esp, 4
jmp 0x409ebf
xor edx, edx
mov dword [esp + 0x1c], edx
jmp 0x409f04
add bh, bh
push dword [ebx + esi + 0x54]
and al, 0x10
or byte [ebx - 0x37ccf7b8], cl
call 0xa143c600
push eax
in eax, dx
push 0xc70ff18
push dword [eax + 0x10]
push dword [eax + 0x14]
mov byte [ecx + 0x4c], al
add byte [eax], al
add byte [ebp + 0x24545d0c], al
adc byte [eax], cl
mov edx, dword [esp + 0x10]
mov dword [edx], eax
mov eax, 0xff0003
inc ebx
mov eax, dword [esi + 0x4c]
adc byte [eax], cl
mov ebp, dword [ecx]
push dword [ecx + 0x1c]
push dword [ecx + 0x18]
push dword [ecx + 0x28]
invalid
invalid
Function at 0x409eaa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
add byte [eax], al
mov eax, dword [0x4c6480]
mov dword [esp + 4], ecx
push esi
push edi
test al, 1
je 0x40b3d6
mov edi, dword [ebp + 0x10]
xor eax, eax
push 8
mov word [esp + 0x5c], 1
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], 1
call fcn.00420db6
mov edx, eax
mov dword [esp + 0x20], eax
add esp, 4
test edx, edx
je 0x40b52a
mov dword [edx], 0x14
mov esi, dword [ebp + 0xc]
mov dword [edx + 4], 0
mov dword [esp + 0x54], edx
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [esp + 0x50], 1
mov dword [esp + 0x10], 0x17
mov eax, dword [edx + 4]
mov eax, dword [eax + ecx*4]
movsx eax, word [eax + 0xa]
mov dword [esp + 0x5c], eax
jmp 0x409faa
push esp
and al, 0x1c
add byte [eax], al
inc byte [ecx]
dec dword [ebx - 0x2fc4fbaf]
dec dword [ebx - 0x3dc4fbaf]
adc byte [ecx - 0x16f7dbbc], cl
or edi, esp
invalid
and al, 0x24
add byte [eax], al
add byte [eax], al
inc ecx
add dword [esi + 1], edi
add byte [ebx + 0x4c483f0], cl
add eax, dword [eax]
add bh, al
push es
add dword [eax], eax
add byte [eax], al
add eax, dword [eax]
add bh, al
inc esi
and byte [eax], al
add byte [eax], al
add byte [eax - 0x74fff288], al
inc eax
or byte [edi], cl
test dword [ebx + 8], esp
add byte [eax], al
and al, 0x24
or al, 4
add byte [eax], al
add al, ch
rcr byte [esi + 1], cl
add byte [ebx + 0x4c483d0], cl
mov eax, 0xfd
add byte [edi], cl
test dword [esp + ecx*2], ebp
add eax, dword [eax]
test dword [edx - 0x7ffffcaa], ebx
jl 0x40b18f
pop eax
add byte [edi], cl
test byte [edx - 0x39fffcaa], ch
add dh, al
inc esp
and al, 0x59
add edi, edi
dec esp
and al, 0x50
add al, ch
cmp bh, ah
invalid
push ebp
or cl, ch
pop ss
out dx, al
invalid
dec dword [ebx - 0xad81630]
invalid
or eax, 1
mov dword [0x4c6488], 0
push 0x43b5ec
mov dword [0x4c6480], eax
mov dword [0x4c6490], 0
mov dword [0x4c6494], 1
call fcn.00422d40
add esp, 4
jmp 0x409ebf
xor edx, edx
mov dword [esp + 0x1c], edx
jmp 0x409f04
add bh, bh
push dword [ebx + esi + 0x54]
and al, 0x10
or byte [ebx - 0x37ccf7b8], cl
call 0xa143c600
push eax
in eax, dx
push 0xc70ff18
push dword [eax + 0x10]
push dword [eax + 0x14]
mov byte [ecx + 0x4c], al
add byte [eax], al
add byte [ebp + 0x24545d0c], al
adc byte [eax], cl
mov edx, dword [esp + 0x10]
mov dword [edx], eax
mov eax, 0xff0003
inc ebx
mov eax, dword [esi + 0x4c]
adc byte [eax], cl
mov ebp, dword [ecx]
push dword [ecx + 0x1c]
push dword [ecx + 0x18]
push dword [ecx + 0x28]
invalid
invalid
Function at 0x40fcea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0x10]
sub esp, 0x10
mov dword [esp + 0x28], ebx
mov eax, dword [esi + 4]
mov dword [esp + 0x30], 3
mov edx, dword [edi]
mov eax, dword [eax + edx*4]
mov edx, esp
movsx ecx, word [eax + 0xa]
mov dword [esp + 0x4c], ecx
mov ecx, dword [eax]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
lea ecx, [ebx + 0x134]
mov dword [edx + 0xc], eax
inc dword [eax]
call fcn.00408180
mov dword [esp + 0x44], eax
test eax, eax

Function at 0x415cf8
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x415d20
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x415d12
pop edi
pop esi
pop ebp
ret 4
Function at 0x4351f6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or al, 0x57
xor edx, dword [ebp - 0x5b]
je 0x4351c0
push 0xffffffffffffffe0
xor edx, edx
pop eax
div esi
cmp eax, dword [ebp + 0x10]
jae 0x4351c0
call 0x45ce8b32
add byte [ebx + 0x2cec830c], al
xor eax, eax
jmp 0x4351fc
imul esi, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
out dx, al
sbb byte [ecx + ecx + 0x53], dh
call 0x14287ae
add byte [ebx - 0x17aca908], cl
adc bh, bh
push dword [edi + ebx + 0x56]
call 0x745c40cb
adc eax, 0x1173fe3b
sub esi, edi
lea eax, [edi + ebx]
push esi
or al, 0xff
push eax
call 0x2422dea
add byte [ebp + 0x5bc38b0c], al
pop edi
jne 0x43519d
or al, 0x16
call 0xe8cf510e
mov fs, word [ebp + 0x6a1b742e]
loopne 0x435241
rcr byte [eax - 9], cl
idiv byte [ebx]
inc ebp
or al, 0x73
psubsb mm2, qword [esi]
cmp dword [ebx + 0xc830045], ecx
sub esp, 0x2c

Function at 0x435270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or dword [ebx + eax*4], 0xffffffec
sub al, 0x8b
rcr dword [esi + 0x5d], 0xc3
pop ebp
ret

Function at 0x435278
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or dword [ebx + eax*4], 0xffffffec
sub al, 0x8b
rcr dword [esi + 0x5d], 0xc3
pop ebp
ret