joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455dbc
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x455dd3
add esp, 0xfffffff0
call fcn.004035f0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b540
mov eax, dword [0x48d014]
cmp word [eax + 2], 0
jne 0x455dfb
mov eax, dword [0x48d014]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045753c
mov eax, dword [0x48d134]
cmp word [eax + 2], 0
jne 0x455e15
mov eax, dword [0x48d134]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00457734
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4122fc]
call fcn.0040329c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4122fc]
call fcn.0040329c
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41da8c]
call fcn.004250c4
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x455f9c
mov eax, dword [0x48ceb8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00425494
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x457ce4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x48ceb8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ccc8
test eax, eax
je 0x455f0a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408d10
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ccf0
test eax, eax
je 0x455f1e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404330
mov eax, dword [0x48ccc0]
cmp byte [eax], 0
jne 0x455f52
mov eax, ebx
call fcn.004560c4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00457ec0
mov eax, ebx
call fcn.00458884
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x455f92
call fcn.00403648
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456344
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48ebe0]
cmp dword [eax + 0x30], 0
je 0x4563ee
cmp dword [ebx + 0x94], 0
jne 0x4563e8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4562d4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4563e8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4563ae
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4563e8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414990
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4563bd
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x456f50
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x456f85
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004041b0
jmp 0x456f92
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404114
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45809c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4580dd
mov eax, esi
call fcn.0043e840
test al, al
je 0x4580dd
mov eax, dword [ebx + 0x84]
call fcn.0043e53c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4580dd
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043e53c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x459da8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45a008
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x459e0b
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00459870
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040c7fc
cmp al, 1
jne 0x459e0b
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00459b88
test al, al
je 0x459f97
cmp dword [ebp - 8], 0
jge 0x459e29
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00459870
mov eax, dword [ebp - 0x210]
call fcn.00404380
cmp ebx, eax
jge 0x459e73
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00459870
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x48d314]
and eax, 0xff
bt dword [edx], eax
jae 0x459e73
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x459e87
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00459d84
cmp ebx, dword [ebp - 8]
je 0x459f89
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x459eb3
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004034c8
and eax, 0x7f
movzx eax, word [eax*2 + 0x48bec0]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x459f76
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004034c8
and eax, 0x7f
movzx eax, word [eax*2 + 0x48bec0]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0043e53c
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004034c8
and eax, 0x7f
movzx eax, word [eax*2 + 0x48bec0]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0043e53c
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459f7d
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x459fea
cmp dword [ebp - 8], 0
jge 0x459fa2
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00459870
mov eax, dword [ebp - 0x218]
call fcn.00404380
cmp eax, dword [ebp - 8]
jg 0x459fdc
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00459870
mov eax, dword [ebp - 0x21c]
call fcn.00404380
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00459d84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a00f
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004040e4
ret
Function at 0x48533c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x485396
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0048532c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00483000
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00482b18
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48539d
lea eax, [ebp - 4]
call fcn.004040c0
ret
Function at 0x406953
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 2
mov edi, eax
call fcn.00406aca
xor esi, esi
cmp edi, esi
mov dword [ebp - 8], esi
je 0x4069c8
push ebx
lea eax, [edi - 0x834]
xor ebx, ebx
cmp eax, 0x383
mov dword [ebp - 4], 0x1300
ja 0x40699f
push 2
push esi
push str.netmsg.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
je 0x40699f
mov dword [ebp - 4], 0x1b00
push esi
push esi
push esi
push esi
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x4069bc
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 1
cmp ebx, esi
je 0x4069c7
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
push 0x40a504
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
cmp edi, esi
je 0x4069f8
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 8]
push esi
push dword [ebp + 8]
push esi
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
leave
ret 4

Function at 0x40747c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, 0x68f74111
mov bh, bl
mov eax, eax
mov dl, 0xd9
fsin
iretd
imul esi, edx, 0x256eb5d3
movsx ebp, si
mov bl, 0x89
cmp edx, 0xd92bd203
dec esi
mov ch, dh
test ecx, 0xe800a2e9
cmp ebx, esi
lea edx, [0xa48d021c]
dec ebp
push 0x850
lea edx, [0x1bedaea2]
imul esi, ecx, 0x1492dcc3
mov esi, esi
pop eax
jae 0x4073f3
inc ebx
mov dl, ch
imul ecx, ebx, 0x20bff6b2
lea edi, [eax]
cmp ch, cl
imul esi, eax, 0xe59e24c4
adc bl, ch
mov esi, 0x9a1cc33d
mov ch, cl
and al, 0x68
dec ebp
adc eax, 0x7263da87
mov cl, al
sub edi, 0x163
sub eax, 0x3cc32724
add edi, 0x162
imul ebp, edx
mov bh, dh
xchg esi, ebp
jb 0x40743c
mov esi, 0x31330cad
mov ebp, esi
dec eax
mov edx, ebx
cmp edi, 0x3dc
jne 0x407407
jmp 0x407455
push esi
mov ah, 0x16
mov ecx, ecx
call 0x40747c
add ah, ch
test cl, 0x95
dec ebp
xor ch, bh
test dh, bl
mov edx, 0xa4f6e619
test al, bl
imul ecx, edi
cmp ebx, 0x4353
pop esi
imul ebx, edx
xchg eax, ecx
and bh, 0x45
adc eax, 0xf2be770d
mov ah, 0xfd
imul ecx, edi, 0x28d99ef1
imul edx, ebx
inc eax
cmp edx, 0x6828
js 0x4074a5
mov al, 0xd7
mov bh, dl
adc edi, eax
cmp ebp, ebp
sbb eax, edx
movzx ecx, bh
mov ch, dl
inc ebx
and ch, bh
mov ch, cl
imul edx, ebx, 0xbbe056c1
loopne 0x407477
test bh, bh
mov ebx, ebp

Function at 0x4074c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jbe 0x4074cc
mov ecx, 0x11e6f3d1
mov ch, bl
add ebp, ecx
test edx, ebp
add esi, 0x9a13
movzx ebp, cl
movzx ecx, bp
imul ecx, esi, 0x1f73cb0
push esi
push ebp
imul eax, eax, 0x7b35ac64
sub cl, dh
movzx ecx, cx
movzx ebx, bh
sub dh, 0x54
adc edi, ebp
test cl, 0x22
movzx ebp, cx
push esi
lea edx, [0x4068957e]
test bh, al
Function at 0x79d99c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x79d9a2
pop ebp
sub ebp, 6
sub ebp, 0x39d99c
jmp 0x79da00
lcall 0x4561, 0x704f9c94
test al, 0xba
scasb al, byte es:[edi]
xchg edx, eax
pop edi
add dword [eax], eax
add byte [eax], al
jb 0x79da4d
sub ah, byte [edx + 0x200f4e81]
fist dword [ebp + 0x6a56d85a]
mov ebx, dword [esi + 0x486ebe51]
fisub word [edx]
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
shl dword [edi - 0x17], 1
add al, 0
add byte [eax], al
mov al, byte [0xb84eb36f]
pushfd
fnstcw word [ecx]
add byte [ebx], al
lds eax, [ecx + 0x93c0]
add byte [ecx + 0x635], bh
jmp 0x79da09
mov eax, 0x39d99c
add eax, ebp
add eax, 0x93
mov ecx, 0x635
mov edx, 0x1f8492be
xor byte [eax], dl
inc eax
dec ecx
jne 0x79da20
jmp 0x79da33
aam 0xfe
salc
mov esi, 0xd6bebeae
mov esi, 0x3fbe9272
dec esi
mov ebp, 0x3f8bdd97
dec esi
mov ebp, 0x8d8bdd97
jle 0x79da3c
jb 0x79d9d0
mov esi, 0x97bd4e3f
fisttp qword [ebx - 0x6842b1c1]
fisttp qword [ebx + 0x41ee7e8d]
out dx, al
inc ecx
sub edi, dword [edx + 0x1e]
invalid

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
nop
mov ecx, 0x72e633ac
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x567f1528
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40288e
pop dword [ebp - 0xc]
mov eax, 0x40288e
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xfc51943c
add dword [ebp - 0x1c], 0x5200b10f
mov dword [ebp - 0x18], 0xe280d250
sub dword [ebp - 0x18], 0xb04d860b
mov dword [ebp - 0x14], 0x9e7196a6
sub dword [ebp - 0x14], 0x52255278
mov dword [ebp - 0x10], 0xa6c1207c
add dword [ebp - 0x10], 0x593edf84
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xee4abadb
add eax, 0x11f5b589
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x783ef02b
sub dword [ebp - 0x1c], 0x3cc86d5
mov dword [ebp - 0x18], 0xe05462f7
add dword [ebp - 0x18], 0x6117fe7e
mov dword [ebp - 0x14], 0x1929cbe7
sub dword [ebp - 0x14], 0xb5ba5f7b
mov dword [ebp - 0x10], 0x72a0c68b
sub dword [ebp - 0x10], 0x72a0c68b
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x60791887
add eax, 0x9fc75821
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x35e12
push 0
call eax
mov ecx, 0x49630265
add ecx, 0xb69d42bd
mov edi, eax
mov edx, 0x410000
add edx, dword [ebp - 0xc]
mov esi, 0xe7e4aec9
xor dword [ebp - 4], 0xb40ab1f8
mov ebx, dword [edx]
add dword [ebp - 8], esi
sub ebx, esi
mov dword [ebp - 8], 0xfa221f9a
mov dword [edi], ebx
xor dword [ebp - 8], 0x7b3d1f31
add edi, 0x1a73f72e
sub edi, 0x1a73f72a
add edx, 4
loop 0x40299f
add eax, 0xa9bf2125
add eax, 0x5641e636
mov ebx, eax
add eax, 0x16443182
sub eax, 0x1644317d
mov ecx, 0x96c143bf
sub ecx, 0x968143bf
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Hide graphical window
Set console window title

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x431278
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call fcn.00401030
xor eax, eax
ret

Function at 0x403c80
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x403ce1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x403cc4
cmp edi, 2
jb 0x403cc4
cmp byte [esi], cl
jne 0x403cc4
cmp byte [esi + 1], cl
jne 0x403cc4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4313d8]
jmp 0x403c95
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4313d8]
test edi, edi
jne 0x403c95
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x403d10
cmp cl, 0x23
jne 0x403cf7
cmp byte [esi], cl
jne 0x403cf7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4313d8]
test cl, cl
jne 0x403ce8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x403df0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x403e04
mov dword [ebx], 0
mov edx, 0x435610
call fcn.00403d20
mov esi, eax
test esi, esi
je 0x403ef2
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x403ee8
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403ee8
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x403ee8
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403ee8
mov eax, dword [0x43acf0]
test eax, eax
je 0x403e7c
inc dword [eax + 0x370]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x403ee8
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x403ecd
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x43acf0]
add esp, 4
test eax, eax
je 0x403eba
dec dword [eax + 0x370]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x403edf
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4099e0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x409a1d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x409a03
cmp byte [esi], bl
jne 0x409a03
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x4313d8]
test bl, bl
jne 0x4099f4
pop edi
pop esi
not ecx
pop ebx
jmp fcn.00409980
Function at 0x4133b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x2f28], 0
lea esi, [edi + 0x2f2c]
je 0x413432
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x4133ec
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00414b50
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00404200
mov edx, dword [esi]
mov ecx, 0x43acec
push dword [edi + 0x2f28]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x2f34]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00404200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41e33a
mov eax, dword [0x43acf0]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x41e32d
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x41e36b
mov eax, dword [0x43acf0]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x41e35e
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x41e39c
mov eax, dword [0x43acf0]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x41e38f
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x41e3e9
mov eax, dword [0x43acf0]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x41e3dc
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x41e41a
mov eax, dword [0x43acf0]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x41e40d
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x41e44b
mov eax, dword [0x43acf0]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x41e43e
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00420c80