joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4103d2
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x24], 0x39c0947c
mov eax, 0x39c0947c
cmp eax, 0xed35f763
jg 0x410419
cmp eax, 0xad3225e7
jg 0x410451
cmp eax, 0x95a43c8a
jg 0x4104a2
cmp eax, 0x81aacd54
je 0x410561
cmp eax, 0x83db9c68
jne 0x4103e7
mov eax, 0x79fe424b
jmp 0x4103e7
cmp eax, 0x39c0947b
jg 0x41047c
cmp eax, 0x3206c629
jg 0x4104bd
cmp eax, 0xed35f764
je 0x41056f
cmp eax, 0xc252d93
jne 0x4103e7
mov eax, dword [ebp - 0x20]
cmp byte [eax], 0xcc
mov eax, 0xa42e8fd6
je 0x4103e7
mov eax, 0x5e69fb01
jmp 0x4103e7
cmp eax, 0xbe8dfb6b
jg 0x410515
cmp eax, 0xad3225e8
je 0x410595
cmp eax, 0xb9ce6b7e
jne 0x4103e7
mov eax, 0x389c77e9
jmp 0x4103e7
cmp eax, 0x5e69fb00
jg 0x41053b
cmp eax, 0x39c0947c
je 0x4105a7
cmp eax, 0x55681dea
je 0x410605
jmp 0x4103e7
cmp eax, 0x95a43c8b
je 0x4105bf
cmp eax, 0xa42e8fd6
je 0x4105f8
jmp 0x4103e7
cmp eax, 0x3206c62a
je 0x41061e
cmp eax, 0x389c77e9
jne 0x4103e7
push 0x465df6
push 0x8e2e05fe
call fcn.0044041c
add esp, 8
push 5
push 0x18
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push eax
call fcn.0044ec34
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, 0xad3225e8
jmp 0x4103e7
cmp eax, 0xbe8dfb6c
je 0x4105e1
cmp eax, 0xd6ff24ad
jne 0x4103e7
mov eax, dword [ebp + 4]
mov dword [ebp - 0x20], eax
mov eax, 0xc252d93
jmp 0x4103e7
cmp eax, 0x5e69fb01
jne 0x41064d
imul eax, dword [ebp - 0x10], 0x170000
shr eax, 1
or eax, 0x96
mov dword [ebp - 0x10], eax
mov eax, 0xbe8dfb6c
jmp 0x4103e7
shl dword [ebp - 0x10], 0x11
mov eax, 0xb9ce6b7e
jmp 0x4103e7
push 1
push 8
call fcn.0044e041
add esp, 8
mov dword [ebp - 0x18], eax
push 0x18
call fcn.0044ec34
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, 0x81aacd54
jmp 0x4103e7
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, 0xd6ff24ad
jmp 0x4103e7
push dword [ebp + 8]
call fcn.0040f7e0
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, 0xed35f764
jmp 0x4103e7
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
push ecx
push ecx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x18]
push ecx
push ecx
push ecx
push dword [ebp - 0x14]
call eax
mov eax, 0x83db9c68
jmp 0x4103e7
mov eax, dword [ebp - 0x20]
movzx eax, word [eax]
cmp eax, 0xcd03
je 0x410605
movzx eax, ax
cmp eax, 0xf0b
jne 0x41061e
popal
jmp 0x4105f9
imul eax, dword [ebp - 0x10], 0x39e80
add eax, 0xfec69440
mov dword [ebp - 0x10], eax
mov eax, 0xa42e8fd6
jmp 0x4103e7
push 0x465df6
push 0x7c6afafe
call fcn.0044041c
add esp, 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, 0x95a43c8b
jmp 0x4103e7
cmp eax, 0x79fe424b
jne 0x4103e7
mov dword [ebp - 0x24], eax
push 0x465df6
push 0xee81f141
call fcn.0044041c
add esp, 8
push dword [ebp - 0x14]
call eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4142d4
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x4143d3
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4143cc
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebp, esi
sub ebp, eax
xor edx, edx
cmp ebp, 8
mov dword [esp], esi
jb 0x41437d
xor esi, esi
mov eax, esi
movzx edx, byte [ebx + esi]
add edx, edi
add ecx, edx
movzx esi, byte [ebx + esi + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebx + eax + 7]
add edi, edx
add ecx, edi
lea esi, [eax + 8]
add eax, 0xf
cmp eax, ebp
jb 0x41431d
mov edx, ebp
and edx, 0x1ff8
add ebx, esi
mov esi, dword [esp]
mov eax, ebp
sub eax, edx
jbe 0x414397
xor edx, edx
movzx esi, byte [ebx + edx]
add edi, esi
add ecx, edi
inc edx
cmp eax, edx
jne 0x414385
add ebx, eax
mov esi, dword [esp]
mov eax, edi
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov eax, ecx
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, ebp
mov ebp, 0x15b0
jne 0x414311
shl ecx, 0x10
or ecx, edi
jmp 0x4143d6
xor ecx, ecx
inc ecx
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4143e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
not ebx
cmp ecx, 4
jb 0x414455
mov eax, 0xff
mov esi, ebx
shr esi, 8
movzx edi, byte [edx]
and ebx, eax
xor ebx, edi
xor esi, dword [ebx*4 + 0x465e20]
mov edi, esi
shr edi, 8
movzx ebx, byte [edx + 1]
and esi, eax
xor esi, ebx
xor edi, dword [esi*4 + 0x465e20]
mov esi, edi
shr esi, 8
movzx ebx, byte [edx + 2]
and edi, eax
xor edi, ebx
xor esi, dword [edi*4 + 0x465e20]
mov ebx, esi
shr ebx, 8
movzx edi, byte [edx + 3]
and esi, eax
xor esi, edi
xor ebx, dword [esi*4 + 0x465e20]
add edx, 4
add ecx, 0xfffffffc
cmp ecx, 3
ja 0x4143fb
test ecx, ecx
je 0x414479
xor esi, esi
mov eax, ebx
shr eax, 8
movzx edi, byte [edx + esi]
movzx ebx, bl
xor ebx, edi
xor eax, dword [ebx*4 + 0x465e20]
inc esi
mov ebx, eax
cmp ecx, esi
jne 0x41445d
jmp 0x41447b
mov eax, ebx
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x41ec1b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x468
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41ed21
mov esi, dword [ebp + 0xc]
mov eax, 0xfffffff6
cmp dword [ebx + 0x10], esi
jbe 0x41ed39
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx]
test eax, eax
je 0x41ed26
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + esi*4]
lea edi, [eax + ecx]
add edi, 0x2e
movzx edx, word [edi - 0x12]
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x41ec82
push eax
mov dword [esp + 8], edx
call fcn.0044e887
mov edx, dword [esp + 8]
add esp, 4
mov dword [ebx + 0x5c], 0
mov ecx, edi
call fcn.0041ed41
mov dword [ebx + 0x5c], eax
test eax, eax
je 0x41ed2d
lea eax, [esp + 8]
push eax
push esi
push ebx
call fcn.004198f6
add esp, 0xc
test eax, eax
je 0x41ed34
mov dword [ebx + 0x58], esi
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [ebx + 0x6c], ecx
mov dword [ebx + 0x68], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov dword [ebx + 0x60], ecx
mov dword [ebx + 0x64], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x70], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x78], ecx
mov dword [ebx + 0x7c], eax
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [ebx + 0xa4], ecx
mov dword [ebx + 0xa0], eax
movzx eax, word [esp + 0x1e]
mov word [ebx + 0xa8], ax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x44]
mov dword [ebx + 0x4e008], ecx
mov ecx, dword [esp + 0x20]
mov dword [ebx + 0x4e014], eax
mov dword [ebx + 0x4e010], ecx
xor eax, eax
jmp 0x41ed39
xor eax, eax
dec eax
jmp 0x41ed39
mov eax, 0xfffffff5
jmp 0x41ed39
mov eax, 0xfffffffe
jmp 0x41ed39
mov eax, 0xfffffffd
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4202d8
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], 0xefcdf2fd
mov dword [ebp - 0x14], 0x89b37696
cmp dword [ebp + 0x14], 0
je 0x4202fc
mov dword [ebp - 0x14], 0x722db304
mov eax, 0xefcdf2fd
cmp eax, 0xefcdf2fc
jg 0x42035b
cmp eax, 0xbfc74543
jle 0x420389
cmp eax, 0xdb9d56bf
jg 0x4203eb
cmp eax, 0xbfc74544
je 0x4204db
cmp eax, 0xc2e8cd3f
jne 0x420301
imul eax, dword [ebp - 0x10], 0xad
lea ecx, [eax - 0xae]
imul ecx, ecx
lea eax, [eax*4 - 0x2b8]
imul edx, ecx, 0x1af9
dec edx
mov dword [ebp - 0x10], eax
mov eax, 0x982e66d2
cmp ecx, edx
je 0x420301
jmp 0x4204d1
cmp eax, 0x2484cf46
jle 0x4203c5
cmp eax, 0x6415a1b7
jg 0x42041a
cmp eax, 0x2484cf47
je 0x420455
cmp eax, 0x4e7a164c
jne 0x420301
mov eax, 0x9d4c25ed
jmp 0x420301
cmp eax, 0x9d4c25ec
jle 0x42043a
cmp eax, 0x9d4c25ed
je 0x42046b
cmp eax, 0xa5cfc3af
jne 0x420301
mov eax, dword [ebp - 0x18]
cmp byte [eax], 0xcc
mov eax, 0xc2e8cd3f
je 0x420301
mov eax, 0xde2d6170
jmp 0x420301
cmp eax, 0xefcdf2fd
je 0x42049f
cmp eax, 0xf8ccc30b
je 0x4204c0
cmp eax, 0x9c7456f
je 0x4204cd
jmp 0x420301
cmp eax, 0xdb9d56c0
je 0x4204a9
cmp eax, 0xde2d6170
jne 0x420301
imul eax, dword [ebp - 0x10], 0x1480
add eax, 0xffede7bf
mov dword [ebp - 0x10], eax
mov eax, 0xdb9d56c0
jmp 0x420301
cmp eax, 0x6415a1b8
je 0x4204fa
cmp eax, 0x722db304
jne 0x420301
mov eax, 0x982e66d2
jmp 0x420301
cmp eax, 0x982e66d2
jne 0x420531
mov eax, dword [ebp + 4]
mov dword [ebp - 0x18], eax
mov eax, 0xa5cfc3af
jmp 0x420301
push dword [ebp + 0xc]
call fcn.0041f888
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
jmp 0x420301
push dword [ebp - 0x20]
mov esi, dword [ebp + 8]
push dword [esi]
call fcn.0041e7c6
add esp, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [esi]
call fcn.0041efa9
add esp, 0xc
push dword [esi]
call fcn.0041ed7a
add esp, 4
mov eax, 0x6415a1b8
jmp 0x420301
mov eax, 0x2484cf47
jmp 0x420301
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
cmp eax, 0xcd03
je 0x4204cd
movzx eax, ax
cmp eax, 0xf0b
jne 0x4204db
popal
jmp 0x4204c1
shl dword [ebp - 0x10], 0x18
mov eax, 0xf8ccc30b
jmp 0x420301
mov eax, dword [ebp - 0x10]
lea eax, [eax*8 - 0x180]
shr eax, 6
add eax, 0xffffff03
mov dword [ebp - 0x10], eax
mov eax, 0x4e7a164c
jmp 0x420301
mov ecx, dword [ebp - 0x10]
mov eax, 0xde
add ecx, eax
imul eax, ecx, 0x1840
imul ecx, ecx
imul edx, ecx, 0x39d
dec edx
shr eax, 8
mov dword [ebp - 0x10], eax
mov eax, 0x982e66d2
cmp ecx, edx
je 0x420301
mov eax, 0x89b37696
jmp 0x420301
cmp eax, 0x89b37696
jne 0x420301
mov dword [ebp - 0x1c], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x425c6c
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x20]
mov eax, 0xffffffe6
cmp ebx, 0x1000
ja 0x425cac
mov edi, edx
mov esi, ecx
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
push ecx
call fcn.0044b885
add esp, 0x10
mov ebp, 0xffffffe5
test eax, eax
je 0x425cb1
push esi
call fcn.0044e04c
add esp, 4
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
push ebx
push 1
push dword [esp + 0x30]
call fcn.0044e684
add esp, 0x10
cmp eax, ebx
jne 0x425cf8
push 0
push dword [esp + 0x18]
push edi
push esi
call fcn.0044b885
add esp, 0x10
test eax, eax
jne 0x425ca1
push esi
push ebx
push 1
push dword [esp + 0x30]
call fcn.0044e8a2
add esp, 0x10
mov ecx, eax
mov ebp, 0xffffffe3
mov eax, ebx
cmp ecx, ebx
jne 0x425ca1
jmp 0x425cac
mov eax, ebx
jmp 0x425cac

Function at 0x425fb1
Capabilities:
Create directory

Disassembly:
push edi
push esi
call fcn.0042551b
mov esi, eax
push eax
call fcn.0044d6c0
add esp, 4
mov edi, eax
push esi
call fcn.0044e887
add esp, 4
mov eax, edi
pop esi
pop edi
ret
Function at 0x42a91f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov ebp, dword [eax + 8]
push 0x92d66e1f
push 0x74ec8bbf
push ebp
call fcn.0042ea0c
mov edi, eax
push 0xc5b1ad71
push 0x53cd3e2f
push ebp
call fcn.0042ea0c
mov esi, eax
lea eax, [esp + 4]
mov dword [eax], 0x18
xor ebx, ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ecx, esp
push ebx
push eax
push 0x1f000f
push ecx
call edi
test eax, eax
js 0x42a9cd
push 0x98ef17af
push 0x1423832d
push ebp
call fcn.0042ea0c
mov ebx, eax
mov ebp, 0x160
push ebp
call fcn.0044ec34
add esp, 4
mov edi, eax
push 0
push ebp
push eax
push 2
push dword [esp + 0x10]
call ebx
xor ebx, ebx
test eax, eax
js 0x42a9bf
cmp dword [edi + 8], 1
setne bl
push edi
call fcn.0044e887
add esp, 4
push dword [esp]
call esi
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42cce1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword fs:[0x30]
mov esi, dword [eax + 8]
mov edi, dword [esi + 0x3c]
movzx ebx, word [esi + edi + 6]
movzx eax, word [esi + edi + 0x14]
mov dword [esp], eax
lea ebp, [ebx*8]
push ebp
call fcn.0044ec34
add esp, 4
mov dword [0x471b34], eax
mov dword [0x471b38], 0
test ebx, ebx
je 0x42cd90
add esi, edi
mov eax, dword [esp]
add eax, esi
add eax, 0x20
lea ecx, [ebp*4]
add ecx, ebp
xor edx, edx
xor edi, edi
test byte [eax + edx + 0x1f], 0x20
je 0x42cd89
mov ebx, dword [eax + edx + 4]
add ebx, dword [esi + 0x34]
mov ebp, dword [0x471b34]
mov dword [ebp + edi*8], ebx
mov edi, dword [esi + 0x34]
add edi, dword [eax + edx + 4]
mov ebx, dword [esi + 0x38]
add edi, dword [eax + edx]
add edi, ebx
add edi, 0xffffefff
neg ebx
and ebx, edi
mov edi, dword [0x471b34]
mov ebp, dword [0x471b38]
mov dword [edi + ebp*8 + 4], ebx
mov edi, dword [0x471b38]
inc edi
mov dword [0x471b38], edi
add edx, 0x28
cmp ecx, edx
jne 0x42cd3b
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0x56169c13
push 0xd5ead6c4
push dword [eax + 8]
call fcn.0042ea0c
mov ebx, eax
xor eax, eax
lea ebp, [esp + 8]
mov dword [ebp], eax
mov esi, 0x400
push esi
call fcn.0044ec34
add esp, 4
mov edi, eax
push ebp
push esi
push eax
push 1
mov dword [esp + 0x10], 0
xor eax, eax
push eax
push 0xffffffffffffffff
call ebx
cmp eax, 0xc0000004
jne 0x42cdfb
add esi, esi
push esi
push edi
call fcn.0044ef5e
add esp, 8
mov edi, eax
push ebp
push esi
push eax
push 1
push 0
jmp 0x42cdd9
test eax, eax
js 0x42ce57
mov eax, dword [edi]
mov dword [esp + 4], eax
test eax, eax
je 0x42ce57
add edi, 4
mov ecx, dword [0x471b38]
xor edx, edx
mov esi, dword [0x471b34]
xor eax, eax
inc eax
mov dword [esp], eax
test ecx, ecx
je 0x42ce46
mov ebx, dword [edi]
mov ebp, ebx
and ebp, 0xfffff000
xor eax, eax
cmp ebp, dword [esi + eax*8]
jb 0x42ce41
bt ebx, 8
jb 0x42ce41
cmp ebp, dword [esi + eax*8 + 4]
jbe 0x42ce57
inc eax
cmp ecx, eax
jne 0x42ce30
add edi, 4
inc edx
cmp edx, dword [esp + 4]
jne 0x42ce20
mov dword [esp], 0
push dword [0x471b34]
call fcn.0044e887
add esp, 4
mov eax, dword [esp]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42ce70
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x8c
lea esi, [ebp - 0x1c]
mov dword [esi - 8], esp
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 8], str.ldexp
mov dword [esi + 4], 0x4439e0
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
mov eax, dword fs:[0x30]
mov cl, byte [eax + 2]
mov byte [ebp - 0x25], cl
mov dword [ebp - 0x2c], eax
mov byte [eax + 2], 1
xor ebx, ebx
lea edi, [ebp - 0x98]
push 0x68
push ebx
push edi
call fcn.00446ad0
add esp, 0xc
mov eax, 0x40000000
mov dword [edi + 0xc], eax
mov dword [edi + 0x40], eax
mov dword [esi + 0xc], ebx
push edi
call dword [0x46f164]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x2c]
mov cl, byte [ebp - 0x25]
mov byte [eax + 2], cl
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword fs:[0], eax
mov eax, edx
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x42cf39
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push edi
push esi
sub esp, 0x404
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
lea edi, [esp + 2]
push 0x200
push edi
push dword [eax + 8]
call dword [0x46f124]
xor esi, esi
push esi
push esi
push 3
push esi
push esi
push 0x80000000
push edi
call dword [0x46f088]
cmp eax, 0xffffffff
je 0x42cf82
push eax
call dword [0x46f07c]
jmp 0x42cf85
xor esi, esi
inc esi
mov eax, esi
add esp, 0x404
pop esi
pop edi
ret
Function at 0x42e8ea
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0xa5b5aa68
push 0xf9f77cc3
push dword [eax + 8]
call fcn.0042ea0c
push 0
push 0xffffffffffffffff
call eax
ret

Function at 0x42e948
Capabilities:
Access peb ldr_data
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 4]
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc]
mov edx, dword [ecx + 0xc]
mov ecx, dword [edx + 0x18]
mov edx, dword [edx + 0x20]
add edx, ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], esp
mov esi, dword [ebp - 0x10]
sub eax, esi
add eax, 0xfffffff8
cmp eax, 4
jae 0x42e9e7
mov eax, dword fs:[0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
lea ecx, [eax + edx]
movzx esi, word [eax + edx + 0x14]
add ecx, esi
add ecx, 0x18
movzx edx, word [eax + edx + 6]
test edx, edx
je 0x42e9bf
lea esi, [edx + edx*4]
lea esi, [ecx + esi*8]
test byte [ecx + 0x27], 0x20
jne 0x42e9bf
add ecx, 0x28
dec edx
jne 0x42e9b1
mov ecx, esi
add eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 0x10]
add ecx, eax
push ecx
push eax
call fcn.004302f7
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
sub esp, 0xa0
jmp edx
shr eax, 2
dec eax
xor edi, edi
mov ebx, dword [esi + edi*4]
cmp ebx, ecx
jbe 0x42e9ff
cmp ebx, edx
ja 0x42e9ff
mov dword [esi + edi*4], 0
cmp eax, edi
je 0x42e989
mov esi, dword [ebp - 0x10]
inc edi
jmp 0x42e9ed

Function at 0x42ea0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x20]
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + esi + 0x78]
cmp dword [edi + esi + 0x18], 0
je 0x42ea7c
mov eax, dword [edi + esi + 0x1c]
add eax, esi
mov dword [esp + 8], eax
mov ebp, dword [edi + esi + 0x20]
add ebp, esi
mov eax, dword [edi + esi + 0x24]
add eax, esi
mov dword [esp + 4], eax
xor ebx, ebx
mov eax, dword [ebp + ebx*4]
add eax, esi
xor ecx, ecx
dec ecx
cmp byte [eax + ecx + 1], 0
lea ecx, [ecx + 1]
jne 0x42ea4a
mov dword [esp], 0
mov edx, esp
push edx
push dword [esp + 0x2c]
push ecx
push eax
call fcn.0042ea9c
add esp, 0x10
mov eax, dword [esp + 0x24]
cmp dword [esp], eax
je 0x42ea80
inc ebx
cmp ebx, dword [esi + edi + 0x18]
jb 0x42ea41
xor esi, esi
jmp 0x42ea8f
mov eax, dword [esp + 4]
movzx eax, word [eax + ebx*2]
mov ecx, dword [esp + 8]
add esi, dword [ecx + eax*4]
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x42fac2
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, eax
sar edx, 0x1f
shr edx, 0x1c
add edx, eax
add eax, 0xf
cmp eax, 0x1f
mov dword [esp], edx
jae 0x42faf7
mov edi, ebx
mov ebp, ebx
mov esi, ebx
mov edx, ebx
jmp 0x42fbda
mov eax, edx
sar eax, 4
mov edx, ebx
lea ebx, [ecx + 0xc]
mov esi, edx
mov ebp, edx
mov edi, edx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov eax, dword [ebx - 0xc]
imul edi, eax, 0x239b961b
imul eax, eax, 0xcb0d8000
shr edi, 0x11
or edi, eax
mov eax, dword [ebx - 8]
imul ebp, edi, 0xab0e9789
xor ebp, edx
imul edi, eax, 0xab0e9789
imul eax, eax, 0x97890000
shr edi, 0x10
or edi, eax
mov eax, dword [ebx - 4]
rol ebp, 0x13
add ebp, esi
imul edi, edi, 0x38b34ae5
xor edi, esi
imul esi, eax, 0x38b34ae5
imul eax, eax, 0x95ca0000
shr esi, 0xf
or esi, eax
mov ecx, dword [ebx]
rol edi, 0x11
mov edx, dword [esp + 8]
add edi, edx
imul eax, esi, 0xa1e38b93
xor eax, edx
imul esi, ecx, 0xa1e38b93
imul ecx, ecx, 0x2e4c0000
shr esi, 0xe
or esi, ecx
rol eax, 0xf
mov edx, dword [esp + 0xc]
add eax, edx
imul ecx, esi, 0x239b961b
xor ecx, edx
rol ecx, 0xd
lea esi, [ebp*4]
add esi, ebp
lea ecx, [ecx + esi + 0x561ccd1b]
lea edx, [ebp + ebp*4 + 0x561ccd1b]
lea esi, [edi + edi*4 + 0xbcaa747]
lea ebp, [eax + eax*4]
add ebp, 0x96cd1c35
mov eax, dword [esp + 4]
lea edi, [ecx + ecx*4]
add edi, 0x32ac3b17
add ebx, 0x10
dec eax
jne 0x42fb07
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x28]
and ebx, 0xf
dec ebx
cmp ebx, 0xe
ja 0x42fde4
mov eax, dword [esp]
and eax, 0xfffffff0
xor edx, edx
mov ecx, dword [esp + 0x24]
mov dword [esp], eax
jmp dword [ebx*4 + 0x467680]
mov eax, dword [esp + 0x28]
xor ecx, eax
xor esi, eax
xor ebp, eax
xor edi, eax
lea eax, [edi + ebp]
add eax, esi
add eax, ecx
add esi, eax
add ebp, eax
add edi, eax
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
imul eax, ecx, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae35
mov edx, eax
shr edx, 0x10
xor edx, eax
mov eax, esi
shr eax, 0x10
xor eax, esi
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae35
mov esi, eax
shr esi, 0x10
xor esi, eax
mov eax, ebp
shr eax, 0x10
xor eax, ebp
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, edi
shr eax, 0x10
xor eax, edi
imul eax, eax, 0x85ebca6b
mov edi, eax
shr edi, 0xd
xor edi, eax
imul edi, edi, 0xc2b2ae35
mov eax, edi
shr eax, 0x10
xor eax, edi
add edx, esi
add edx, ecx
add edx, eax
add esi, edx
add ecx, edx
add eax, edx
mov edi, dword [esp + 0x30]
mov dword [edi], edx
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 4]
jmp 0x42fd24
Function at 0x430289
Capabilities:
Access peb ldr_data

Disassembly:
cmp byte [0x471b4c], 0
jne 0x4302c3
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0x67b0735f
push 0x80d4b146
push dword [eax + 8]
call fcn.0042ea0c
mov dword [0x471b54], eax
rdtsc
mov dword [0x471b50], eax
mov byte [0x471b4c], 1
push 0x471b50
call dword [0x471b54]
xor dword [0x471b50], eax
ret
Function at 0x435a3e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 8]
ret