joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4228d6
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x42290a
call fcn.004180de
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x422972
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x4229a0
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jl 0x422a3b
cmp dword [esp + 0x14], ebx
je 0x422a3b
jmp 0x4229dd
push 0x10
call fcn.00422697
cmp eax, ebx
je 0x4229b6
mov ecx, eax
call fcn.004228cd
mov esi, eax
jmp 0x4229b8
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ebx, [edi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
push ebx
mov dword [edi + 0x14], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x4229f4
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x422a04
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
mov dword [esi + 0xc], eax
jne 0x422a10
call fcn.004180de
mov eax, dword [esi + 8]
mov ecx, dword [edi + 0xc]
sub ecx, eax
shl ecx, 2
push ecx
mov ecx, dword [esi + 0xc]
lea eax, [ecx + eax*4]
push ebx
push eax
call fcn.0040d200
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
pop edi
pop esi
mov dword [eax + edx*4], ecx
pop ebx
ret 8

Function at 0x422b01
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x422b2f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x422b4d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00422a6b
jmp 0x422b4d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x422b4d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00422a6b
test edi, edi
mov eax, edi
jne 0x422b37
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x433cac]
test ecx, ecx
je 0x422c00
jmp 0x422b00
ret 8
Function at 0x79254a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
jmp 0x7925b0
bswap ecx
mov ch, byte [esp]
not ch
seto ch
mov ecx, dword [esp]
setne cl
jmp 0x79258f
seto ch
call 0x792574
xchg ch, cl
call fcn.007925cd
add dword [eax], reloc.WINMM.dll_midiStreamOut
cmp dword [ebp + reloc.WINMM.dll_midiStreamOut], edi
or al, 0x9f
out 0x11, al
nop
adc ecx, dword [edi + reloc.WINMM.dll_midiStreamOut]
push dword [esp + 0x13]
pop dword [esp + 2]
push word [esp + 0x13]
mov word [esp], di
push word [esp + 0x13]
mov word [esp + 0x18], bx
mov dword [esp + 3], ecx
jmp 0x79254d

Function at 0x7925cd
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, dword [esp + 1]
mov byte [esp + 2], ch
xchg dword [esp], edi
mov dword [esp], eax
jmp 0x79264e
pop eax
pushal
xchg di, cx
mov cx, word [esp + 0xe]
xchg cl, ch
pop dword [esp + 0x16]
jmp 0x792623
mov ecx, dword [esp]
pushal
mov ch, 0xb4
lea ecx, [ecx*4]
pushal
xchg cl, ch
jmp 0x7926a4
mov ch, byte [esp]
lea ecx, [esi + 0x3d]
mov ecx, 0x13373b6e
mov ch, bh
bswap ecx
mov di, 0x1fe1
jmp 0x7925e5
pop cx
mov byte [esp + 6], dh
mov di, word [esp]
xchg cx, di
lea esp, [esp + 2]
mov edi, dword [esp + 0x1a]
jmp 0x7925f7
mov di, 0x8fd3
mov al, 0x5c
lea edi, [ebx + ebx]
mov al, byte [esp]
mov edi, 0x30616f34
not edi
jmp 0x79260e
mov ecx, dword [esp + 0x5f]
lea esp, [esp + 0x7c]
push esp
lea esp, [esp + 4]
jmp fcn.00779e81

Function at 0x7adb32
Capabilities:
Encode data using xor

Disassembly:
and al, 4
mov byte [esp + 0xb], bh
push dword [esp + 0xc]
call 0x7adb32
je 0x7ada99
jns 0x7adaca
jmp 0x7adb0d
pushal
pop word [esp + 9]
inc esp
and al, 9
pop dword [esp + 0x12]
lea esp, [esp + 2]
jmp 0x7add6b
ror dword [edx - 0x1b], cl
adc al, 0x87
mov dword [esp + 7], esi
mov dword [esp + 0x1f], eax
call fcn.007adae3
push cs
dec dword [esi]
lodsb al, byte [esi]
and al, byte [ebp - 0x4c]
xor edi, dword [ecx]
mov ecx, 0xbbb4829
sbb dword [edx + 0x2a9a6f08], ebx
jnp 0x7adb1e
fimul word [ebp - 0x74f7db9c]
push esp
and al, 4
push esp
mov eax, ecx
jmp 0x7adbab
je 0x7adac7
call fcn.007adb6f
mov al, byte [0x2adfb82a]
out dx, al
ret 0xdf4f
lea esp, [esp + 4]
test edx, edx
pushal
lea esp, [esp + 0x20]
jmp 0x7adb8f
ret
lea esp, [esp + 0x18]
dec dword [esp + 4]
push edx
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x7add0a

Function at 0x7af474
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
push esp
mov word [esp], bx
mov dword [esp], esi
lea esp, [esp + 4]
jmp 0x7af455
lea esp, [esp + 0x1c]
jne 0x7af280
mov edi, dword [esp]
jmp 0x7b0b6a
test edx, edx
pushal
pop word [esp + 7]
lea esp, [esp + 2]
jmp 0x7af419
lea esp, [esp + 8]
jmp 0x7af40a
xor edi, edi
jmp 0x7af2ee
mov di, word [esp]
lea eax, [ebx*4]
xor eax, eax
lea edi, [eax + edi]
mov edi, 0x62fa0f3a
jmp 0x7b0b43

Function at 0x7b09c4
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ebx, eax
push esp
mov dx, 0x8073
mov dh, bh
mov byte [esp], ch
jmp 0x7b0844
lea esp, [esp + 1]
jmp 0x7b0864
Function at 0x915c63
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror esi, 0x19
mov eax, dword [esp + 0x12]
rdtsc
mov word [esp + 7], bx
rdtsc
jmp 0x915cdd
pop bp
pop ax
sub esp, 0x14
jmp 0x915c4a
xchg edi, ebx
pop si
xchg dword [esp + 8], ebx
rdtsc
xchg word [esp + 0x11], dx
lea eax, [esi*4]
lea ecx, [ebp + 0x2f]
neg bh
jmp 0x915cae

Function at 0x916f15
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edx
mov edi, ecx
pop ebx
lea edi, [edx*4]
btr ecx, esp
lea esp, [esp + 0x15]
jmp 0x916f60
mov bl, bh
cmc
sub si, 0x7bb8
push dword [esp + 0x12]
push dword [esp + 5]
xchg word [esp + 0x18], bx
jmp 0x916ecf
rdtsc
add edi, ebp
mov al, 0xbe
jmp 0x916ef4
xchg word [esp + 0x1c], ax
popal
pop esi
add esp, 0
xchg byte [esp + 4], cl
rcr ah, 1
jmp 0x916f98
add esp, 1
sub esp, 0x1e
xchg byte [esp + 0x12], dl
push dword [esp + 9]
mov edi, dword [esp + 0xd]
stc
jmp 0x916f1d
neg dh
sub esp, 8
setg ah
xchg dword [esp], edi
lea ecx, [edx*4]
xchg ecx, eax
jmp 0x916f3e
shl di, cl
lea edi, [edx + ebp]
pop word [esp + 2]
mov ch, byte [esp]
not ax
xchg bh, cl
jmp 0x916fdd
xchg dword [esp], ecx
btc ebx, edi
mov si, 0x8e77
lea edx, reloc.WINMM.dll_midiStreamOut
mov dl, dh
jmp 0x916f75
mov word [esp + 1], bx
sub bl, ah
xchg ah, bl
xchg dword [esp], edi
mov eax, dword [esp]
rdtsc
jmp 0x916fbf

Function at 0x917006
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
setne bh
mov byte [esp + 0x27], ch
push word [esp + 0x1d]
jmp 0x91703b
sub esp, 0x1c
xchg bx, bp
jmp 0x916ff0
neg ah
mov bl, 0x40
bsr ax, cx
mov eax, 0x72a52b26
mov bl, bh
cmc
jmp 0x917069
btc esi, ebx
lea esi, [ecx - 0x63]
xchg edx, eax
bswap ecx
lea eax, [edx + ebx]
setae ch
jmp 0x91700e
bsr si, cx
mov ch, byte [esp + 9]
btr edi, esp
mov bh, byte [esp + 0x2c]
sub esp, 0x14
lea esp, [esp + 0x43]
jmp 0x917024
mov eax, ecx
mov ebx, dword [esp]
mov al, ah
bswap edi
sub bl, ah
btr eax, esp
jmp 0x917146
bsr dx, cx
xchg ebx, ebp
lea eax, reloc.WINMM.dll_midiStreamOut
neg edx
cpuid
mov dl, dh
jmp 0x917053
mov dx, sp
sub esp, 0x1c
lea ebp, reloc.WINMM.dll_midiStreamOut
add esp, 0x13
xchg dword [esp + 3], ebp
sub esp, 6
jmp 0x917096
btr edi, esp
inc dx
push edx
xchg di, dx
mov byte [esp + 5], dh
xchg di, ax
jmp 0x9170ae
sub esp, 0x12
not eax
mov cl, 0x42
pop edx
pop word [esp + 1]
lea ebp, [edi*4]
jmp 0x9170cc
mov edi, 0xfe47771a
not si
rdtsc
bsf bx, ax
xchg bp, ax
lea ecx, [ebx + edi]
jmp 0x9170fd
Function at 0x9172ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xc], sp
sub esp, 0xe
lea ebx, [ecx + edx]
cmc
sub esp, 0x16
jmp 0x9172f3
lea eax, [ecx*4]
clc
mov eax, dword [esp]
mov edi, dword [esp]
rdtsc
jmp 0x91735a
lea esp, [esp + 0x47]
mov di, 0x6817
mov bx, word [esp]
ror ebp, 0x1f
rol bp, cl
jmp 0x9172dc
not ax
stc
mov dl, dh
mov bx, dx
ror ebp, 0x17
bsr si, cx
jmp 0x9179cd
bswap esi
xchg bh, cl
xchg esi, eax
bsr ax, cx
setns dh
mov bl, byte [esp]
jmp 0x917323
and edi, ecx
mov cl, ch
not edx
mov bl, byte [esp]
mov eax, dword [esp]
mov dx, bx
jmp 0x917340
sub esp, 8
call fcn.00917389
pop bx
sub esp, 0xc
btr edx, esp
lea esi, [esi*4]
jmp 0x9176b1
xchg edx, eax
rcr edi, 0x1f
lea edx, [ecx + edx]
lea eax, [esp + ebx]
bswap ebp
lea ecx, [esp + edx]
jmp 0x9173a3
mov bx, 0x4b2b
btc ebx, ebx
rdtsc
lea ebx, [esi*4]
mov ax, word [esp]
xchg dx, di
jmp 0x9173c4
push word [esp + 1]
call 0x9174e0
xor bp, 0xe58c
pop dword [esp + 4]
push dword [esp + 0xa]
pop cx
setl ch
mov esi, 0x3978b8a0
jmp 0x917570
lea ebp, reloc.WINMM.dll_midiStreamOut
cld
pop word [esp + 0x2f]
jmp 0x917585
mov edx, dword [esp + 0x2e]
push word [esp + 0x30]
xchg di, si
jmp 0x917543
mov di, 0x6275
mov si, sp
mov ch, byte [esp + 0x14]
bswap edx
sub esp, 0x18
setl bh
jmp 0x917559
push word [esp + 0x21]
pop eax
mov byte [esp + 0x15], bh
call 0x917595
sub al, 0x66
push dword [esp + 0x1c]
mov al, ah
xchg edx, ecx
jmp 0x9175de
rdtsc
setns ah
ror ch, 5
neg ax
mov bp, word [esp]
mov esi, ebp
jmp 0x917691
neg esi
pop dword [esp + 0x29]
mov dh, byte [esp + 0xb]
sub esp, 0x10
lea esp, [esp + 0x47]
jmp 0x9175c3
add di, 0xdbae
setp ch
mov dx, di
add dx, 0xabbe
sub esp, 2
setbe ch
jmp 0x9174fd
mov si, dx
lea eax, [edi + edi]
call fcn.00917658
pop eax
rol dword [ecx + 0x20], 1
sal dword [esi - 0x26], cl
push edx
shl byte [edi - 0x28a779ae], 0x47
and dl, cl
xor dl, cl
xchg esp, eax
mov di, word [esp + 0x14]
pop word [esp + 0x11]
pop word [esp + 0xb]
xchg dword [esp + 0xa], eax
mov al, 0x26
bsr di, cx
jmp 0x9175f6
lea ebp, [edx*4]
mov cl, 0x2a
xchg ch, dl
rdtsc
mov bl, bh
rcr esi, 0x17
jmp 0x9173e4
Function at 0x917658
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x1f
add esp, 1
mov bp, 0x733b
stc
lea ebx, [eax + ebx]
xchg bh, cl
jmp 0x917666
lea esp, [esp + 3]
xchg dh, al
lea edi, [ebx + esi]
sub esp, 0x1a
inc dl
mov dword [esp + 0x1a], eax
jmp 0x917611
cpuid
not bp
xchg ch, dl
xchg si, bp
bswap esi
rdtsc
jmp 0x917627
sete dh
mov dword [esp], esi
sub esp, 6
lea esi, [ecx - 0x53]
jmp 0x91763f
add edi, ebp
xchg ebp, eax
inc dx
bswap eax
xchg dx, ax
xchg bh, cl
jmp 0x917679
pushal
bswap eax
neg ax
sub esp, 0x14
xchg word [esp + 0x10], bx
cpuid
jmp 0x9178ef
mov byte [esp + 1], ch
lea ebp, [ebp*4]
mov cx, 0x887d
mov byte [esp + 1], dh
jmp 0x9176fb
not bx
mov edi, dword [esp + 0xd]
setae ah
cpuid
setl ch
sub bl, ah
jmp 0x9176cf
xchg byte [esp + 2], bl
lea ebx, [edx + esi]
xchg ah, bl
lea ebp, [esi*4]
pop cx
jmp 0x91776b
mov cx, di
sub di, 0x2f90
neg di
rdtsc
bsf di, si
lea esp, [esp + 0x1e]
jmp 0x9176e8
sub esp, 0x12
rcl dx, cl
xchg dword [esp + 0x12], ebx
bswap edi
mov al, 0x86
mov ebx, ecx
jmp 0x9177c4
mov si, word [esp + 0xc]
mov dl, 0x8c
lea esi, [esi + 0xa5]
mov ebx, dword [esp + 0xc]
jmp 0x91772b
push dword [esp]
mov bl, bh
pop ax
push esp
pop edx
mov word [esp], dx
jmp 0x917753
shr edx, 0xb
mov bl, bh
xchg edx, ecx
sub esp, 0x16
rol di, cl
push dword [esp + 1]
jmp 0x91783e
mov ebx, 0xa3101cec
mov byte [esp], ch
lea edi, [ebx*4]
btr esi, edx
mov dl, dh
jmp 0x91777a
mov di, 0x3ed1
bswap ecx
inc bl
mov esi, dword [esp]
sub di, 0x17a8
jmp 0x917791
lea edx, [ebp - 0xe7]
mov bx, 0x862d
xor si, 0x4084
mov edx, 0x8012ca88
popal
mov dl, 0xcc
jmp 0x9177ab
mov dl, dh
inc edx
pop ecx
cpuid
rcr dh, 7
cpuid
jmp 0x917714
shr ah, 1
cpuid
call fcn.00917827
mov byte [esp], bh
not bh
xchg cx, ax
xchg dh, al
push esp
xchg byte [esp], al
jmp 0x91785a
push dword [esp + 2]
mov byte [esp + 3], ah
mov byte [esp + 1], dh
mov bl, bh
ror dh, 7
jmp 0x9178a7
bsr ax, cx
pop word [esp + 2]
mov esi, ebp
mov byte [esp + 1], ah
mov si, 0xae6d
mov al, 0xd6
jmp 0x917983
mov ax, word [esp + 0x27]
pop ebx
inc al
btc ebp, edi
mov ebx, dword [esp + 0xb]
setg bh
jmp 0x9177ea
xchg word [esp + 0xd], si
mov dl, dh
mov cx, word [esp + 0x17]
add esp, 1
jmp 0x917964
lea edx, [eax*4]
lea edx, [ebx*4]
jmp 0x917906
xchg dword [esp + 0x11], eax
push word [esp]
lea edi, [ebx + ebx]
mov cl, 0xc2
jmp 0x91791d
xchg ebx, eax
mov eax, 0xd542487e
sub esp, 0xc
shl dx, cl
clc
lea eax, reloc.WINMM.dll_midiStreamOut
jmp 0x917935
mov di, 0x7ff3
mov ebx, 0xe3839b8
mov byte [esp], bh
mov bx, 0xf9f7
mov byte [esp + 0x10], ah
jmp 0x9179b6
mov ax, 0xff77
mov cl, ch
mov word [esp + 1], di
push dword [esp + 2]
mov bl, 0x58
xchg bx, dx
jmp 0x91794e
lea esp, [esp + 0xd]
not bh
call fcn.00917a2d
loop 0x917a22
adc dh, byte [ebp - 0x7c]
add ecx, ecx
dec ecx
fnstcw word [eax - 0x749762b5]
and bl, byte [ebp - 0x54]
mov edi, 0x9d0c8d
add byte [eax], al
add byte [esi - 0x47], ah
movsd dword es:[edi], dword [esi]
xchg edi, eax
lea ecx, [ebx*4]
mov cx, 0x97a5
bswap edi
shr dh, 7
cld
jmp 0x917999
in eax, 0x8a
fucompi st(3)
sub eax, 0xf8990ee7
invalid
Function at 0x917d01
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x913040
call fcn.00913045
call 0x9171a0
jmp 0x917d91
movzx ebx, word [eax + 0x3c]
jmp 0x917e0d
lea esp, [esp + 4]
call 0x917bbd
pushal
push edx
push edx
pop word [esp + 2]
mov word [esp + 4], sp
mov byte [esp + 3], ch
jmp 0x917c69
lea esp, [esp + 0x1e]
push edx
lea esp, [esp + 1]
mov dword [esp + 0x48], edx
call fcn.00917c52
jl 0x917ccc
salc
inc ecx
ret
fdiv qword [edx + 0x15]
in al, 0x4d
mov edi, 0x2bd8b929
lahf
enter 0xffffffffffffff6b, 0x74
and al, 0x15
lea esp, [esp + 6]
call fcn.00917c9b
xchg ebp, eax
add byte [esi + 0x25a900f1], dl
mov ebp, 0x7ac7342d
or al, 0x9f
push dword [esp + 2]
mov dword [esp + 5], eax
mov dword [esp + 5], ebp
push dword [esp + 4]
mov byte [esp + 0xd], bh
jmp 0x917d57
lea esp, [esp + 3]
mov dword [esp + 0x78], esi
push esp
mov byte [esp + 1], ch
call fcn.00917d3d
lea esp, [esp + 5]
mov byte [esp], ch
lea esp, [esp]
lea esp, [esp]
push esp
push word [esp]
jmp 0x917ec7
pop eax
mov ebx, 0x24648d92
lea esp, [esp + 2]
lea esp, [esp + 4]
popfd
jmp 0x917bee
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0x9171f0
jne 0x917dd6
or eax, 0x97641d8d
inc ecx
popfd
push ds
mov ebx, gs
shr bh, 0xf6
loope 0x917dd2
arpl word [ebx + 0x8408b00], cx
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x91719b
dec ecx
call 0xbf1fe3
add byte [ecx], al
add bl, ch
mov eax, 0x94cd5dd8
test dword [bp + si], ebp
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 0x58
cmp bl, al
push ebx
lds ebp, ss:[edx]
push cs
test byte [edx], bl
jge 0x917d80
sub eax, 0x10000
jmp 0x917d95
outsb dx, byte [esi]
mov eax, 0x33c0a131
xchg esi, eax
mov edx, 0x32c7a032
out 0xb8, al
aaa
cmpsd dword [esi], dword es:[edi]
ret 0xd031
add ebx, eax
cmp word [ebx], 0x4550
je 0x912983
invalid
jne 0x917dd6
je 0x917e18
push 0x5614fa0f
fisttp word [edi + 0x2a]
fld dword [0xc1a630bc]
xor bl, bl
mov byte [0x37c4bd2d], al
salc
lodsb al, byte [esi]
lodsb al, byte ds:[esi]
retf
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x917db3
push word [esp + 6]
mov word [esp + 1], dx
lea esp, [esp + 1]
mov dword [esp + 0x7c], edi
lea esp, [esp + 0x7c]
jmp 0x917ea4

Function at 0x917d3d
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
pop word [esp + 3]
mov byte [esp + 2], ah
jmp 0x917d69
Function at 0x40d803
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x40d824
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x40d81b
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x40d813
mov eax, ebx
leave
ret

Function at 0x40d84a
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x40d8a9
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x40d8d6
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40d8c5
xor ecx, eax
xor edx, ebx
dec edi
jne 0x40d8b6
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x40d8fc
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x40d89d
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x40df7b
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x40df8b
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jle 0x40e099
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cwde
call fcn.0040e0a9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5a4d
jne 0x40e099
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call fcn.0040e0a9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4550
jne 0x40e099
pop eax
push eax
mov eax, dword [eax + 0x7c]
call fcn.0040e0a9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40e099
pop eax
mov eax, dword [eax + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push eax
mov eax, dword [eax + 0x20]
add eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
pop eax
mov eax, dword [eax + 0x18]
dec eax
mov dword [ebp - 4], eax
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x40e096
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.0040e0bc
test eax, eax
je 0x40e085
push ecx
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop ecx
leave
ret 8
push dword [ebp - 8]
call fcn.0040e0f0
add dword [ebp - 0xc], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x40e040
add esp, 0xc
mov eax, 0
jmp 0x40e0a3
mov esp, ebp
pop ebp
ret 8
Function at 0x45eb20
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4f602b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004ea466
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x45eba2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004e7d3d
mov eax, dword [eax]
push 0x5f7d4c
push eax
call fcn.004c7db4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004ea6f1
test bl, bl
je 0x45eba2
push 0x5f7d4c
lea ecx, [esp + 0xc]
call fcn.004eaa81
push 0x5f7d58
lea ecx, [esp + 0xc]
call fcn.004eaa81
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x45ebde
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004ea6f1
jmp 0x45eca9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x45ec62
lea edx, [esp + 0x7c]
push 0x5f7d54
push edx
call fcn.004c7db4
add esp, 8
test eax, eax
je 0x45ec62
lea eax, [esp + 0x7c]
push 0x5f7d50
push eax
call fcn.004c7db4
add esp, 8
test eax, eax
je 0x45ec62
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x45ebf2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004ea6f1
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x45f4b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x45f512
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc