joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4062eb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4f4aa8]
jne 0x4062f5
repz ret
jmp fcn.0040a8ec

Function at 0x40cfbb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407c4e
and dword [ebp - 4], 0
cmp dword [0x4f6138], 0
mov ebx, eax
jne 0x40d06c
push 0x402ca4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d11d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402c98
push edi
call esi
test eax, eax
je 0x40d11d
push eax
call fcn.00407bdc
mov dword [esp], 0x402c88
push edi
mov dword [0x4f6138], eax
call esi
push eax
call fcn.00407bdc
mov dword [esp], 0x402c74
push edi
mov dword [0x4f613c], eax
call esi
push eax
call fcn.00407bdc
mov dword [esp], 0x402c58
push edi
mov dword [0x4f6140], eax
call esi
push eax
call fcn.00407bdc
pop ecx
mov dword [0x4f6148], eax
test eax, eax
je 0x40d06c
push 0x402c40
push edi
call esi
push eax
call fcn.00407bdc
pop ecx
mov dword [0x4f6144], eax
mov eax, dword [0x4f6144]
cmp eax, ebx
je 0x40d0c4
cmp dword [0x4f6148], ebx
je 0x40d0c4
push eax
call fcn.00407c57
push dword [0x4f6148]
mov esi, eax
call fcn.00407c57
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d0c4
test edi, edi
je 0x40d0c4
call esi
test eax, eax
je 0x40d0bb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d0bb
test byte [ebp - 0xc], 1
jne 0x40d0c4
or dword [ebp + 0x10], 0x200000
jmp 0x40d0fd
mov eax, dword [0x4f613c]
cmp eax, ebx
je 0x40d0fd
push eax
call fcn.00407c57
pop ecx
test eax, eax
je 0x40d0fd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d0fd
mov eax, dword [0x4f6140]
cmp eax, ebx
je 0x40d0fd
push eax
call fcn.00407c57
pop ecx
test eax, eax
je 0x40d0fd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4f6138]
call fcn.00407c57
pop ecx
test eax, eax
je 0x40d11d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d11f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x64f880
Capabilities:
Encode data using xor

Disassembly:
push ecx
pcmpeqw mm6, mm6
pxor mm7, mm7
push edx
psllw mm6, 0xf
push edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
movq mm1, qword [edx]
sub eax, 4
movq mm0, mm1
psrlq mm1, 0x20
jl 0x64f964
jmp 0x64f8c0
movq mm3, qword [edx + 8]
add edi, 8
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pcmpeqd mm7, mm7
psubd mm5, mm3
pslld mm7, 0x12
movq mm2, mm6
paddd mm4, mm7
psrld mm2, 0x1c
paddd mm5, mm7
movq mm3, mm2
psrld mm7, 0x1e
pand mm2, mm4
paddd mm4, mm7
psrld mm2, 3
pand mm3, mm5
paddd mm5, mm7
psrld mm3, 3
paddd mm4, mm2
paddd mm5, mm3
psrad mm4, 3
add edx, 0x10
psrad mm5, 3
add ecx, 8
packssdw mm4, mm5
movq mm0, mm1
pxor mm7, mm7
psrlq mm1, 0x20
sub eax, 4
movq qword [edi - 8], mm4
jge 0x64f8c0
add eax, 4
jle 0x64fa05
movq mm3, qword [edx + 8]
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
pcmpeqd mm7, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pslld mm7, 0x12
psubd mm5, mm3
psrld mm6, 0x1c
paddd mm4, mm7
movq mm0, mm6
paddd mm5, mm7
psrld mm7, 0x1e
pand mm6, mm4
paddd mm4, mm7
psrld mm6, 3
pand mm0, mm5
paddd mm5, mm7
psrld mm0, 3
paddd mm4, mm6
paddd mm5, mm0
psrad mm4, 3
psrad mm5, 3
packssdw mm4, mm5
cmp eax, 2
jl 0x64f9ff
movd dword [edi], mm4
je 0x64fa05
psrlq mm4, 0x20
add edi, 4
movd edx, mm4
mov word [edi], dx
emms
pop edi
pop edx
pop ecx
ret
Function at 0x6500a570
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6501ab80
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6501ab80
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6500a5d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6512e054]
test esi, esi
jle 0x6500a6f0
mov eax, dword [0x6512e058]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x6500a604
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6500a687
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6500a5f0
mov dword [esp], ebx
call fcn.6500ad30
mov edi, eax
test eax, eax
je 0x6500a717
mov eax, dword [0x6512e058]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6500ae70
mov edx, dword [0x6512e058]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6500a6f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6500a680
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6500a690
add dword [0x6512e054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6512e058]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6500a680
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6500a570
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6500a60e
mov eax, dword [0x6512e058]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6500a570
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6500a570
lea esi, [esi]
nop
Function at 0x6500a9b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6512e064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6512e05c]
sub esp, 4
test ebx, ebx
je 0x6500aa05
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6500a9fe
test esi, esi
je 0x6500a9fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6500a9e0
mov dword [esp], 0x6512e064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6500ad30
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x65000000], 0x5a4d
jne 0x6500ad55
mov ecx, dword [0x6500003c]
cmp dword [ecx + 0x65000000], 0x4550
lea edx, [ecx + 0x65000000]
je 0x6500ad60
ret
cmp word [ecx + 0x65000018], 0x10b
jne 0x6500ad55
push esi
movzx eax, word [ecx + 0x65000014]
push ebx
movzx esi, word [ecx + 0x65000006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x65000000
test esi, esi
je 0x6500ada8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6500ad9e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6500adaa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6500ad90
xor eax, eax
pop ebx
pop esi
ret

Function at 0x6500b320
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x6512e060]
test eax, eax
jne 0x6500aa30
ret
push ebx
sub esp, 0x18
mov dword [esp + 4], 0xc
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x6500aa90
mov eax, dword [esp + 0x20]
mov dword [esp], 0x6512e064
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x6512e05c]
mov dword [0x6512e05c], ebx
sub esp, 4
mov dword [ebx + 8], eax
mov dword [esp], 0x6512e064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
or eax, 0xffffffff
jmp 0x6500aa8b
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x6500b350
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp 0x6501ad80
add esp, 4
pop ebx
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 8]
test eax, eax
jne 0x6501ad90
xor eax, eax
ret
jmp 0x6500aa20

Function at 0x6500b390
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x6500b3d0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x6500b3f8
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x6501b0d0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x5c
mov eax, dword [esp + 0x60]
mov dword [esp + 0x1c], eax
mov eax, dword [0x6512e02c]
mov dword [esp + 0x4c], eax
xor eax, eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x6501b138
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.65069c00
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x650e8432
mov ecx, eax
call fcn.650a6e20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.65069c30
jmp 0x6501b2a8
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_OpenClipboard]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x6501b18a
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.65069c00
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x650e8432
mov ecx, eax
call fcn.650a6e20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.65069c30
jmp 0x6501b2a8
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetClipboardData]
call eax
sub esp, 4
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
jne 0x6501b1e5
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.65069c00
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x650e8432
mov ecx, eax
call fcn.650a6e20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.65069c30
jmp 0x6501b2a8
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalLock]
call eax
sub esp, 4
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
jne 0x6501b23d
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.65069c00
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x650e8432
mov ecx, eax
call fcn.650a6e20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.65069c30
jmp 0x6501b2a8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.65069c00
lea eax, [esp + 0x34]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x30]
mov dword [esp], edx
mov ecx, eax
call fcn.650a6e20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.65069c30
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call eax
sub esp, 4
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x34]
mov dword [esp], edx
mov ecx, eax
call fcn.650a6d50
sub esp, 4
lea eax, [esp + 0x34]
mov ecx, eax
call fcn.650a7940
mov eax, dword [esp + 0x4c]
sub eax, dword [0x6512e02c]
je 0x6501b2b9
call fcn.650015c0
mov eax, dword [esp + 0x1c]
add esp, 0x5c
ret
Function at 0x6501f890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x650e9e11
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x650e9e75]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.6500b010
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.650deaf0
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x650e726c], 0
jne 0x6501f9b6
mov byte [0x650e726c], 1
call fcn.650dced0
test eax, eax
je 0x6501f984
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.6500a220
mov dword [esp], 2
mov esi, dword [fcn.6501ab80]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x6501f974
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x650ea555
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x650df370
jmp 0x650df368
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x6501f93a
mov dword [esp], 2
call dword [0x650e6178]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x650df363
mov dword [esp], 2
call dword [0x650e6178]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x650ea504
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov dword [esp], edi
call fcn.6501a428
call fcn.650dd2a0
call fcn.650dcdb0
call fcn.650dcf20
jmp 0x650df363
Function at 0x65030ed4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x68
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x14], eax
mov eax, edx
mov byte [esp + 0x10], al
mov eax, dword [0x6512e02c]
mov dword [esp + 0x5c], eax
xor eax, eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.650d87f0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.650a71e0
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x14]
je 0x65030f78
mov eax, dword [esp + 0x18]
movzx eax, byte [eax]
movsx edx, al
mov eax, dword [esp + 0x28]
mov dword [esp], edx
mov ecx, eax
call fcn.6502a40c
sub esp, 4
movsx edx, al
mov eax, dword [esp + 0x28]
mov dword [esp + 4], 0
mov dword [esp], edx
mov ecx, eax
call fcn.6502a2f0
sub esp, 8
movsx edx, al
lea eax, [esp + 0x44]
mov dword [esp], edx
mov ecx, eax
call fcn.650a7d60
sub esp, 4
add dword [esp + 0x18], 1
jmp 0x65030f1c
mov dword [esp + 0x2c], str.dwsmaklthrtter
mov dword [esp + 0x24], 0x650f2ec0
mov dword [esp + 0x30], 0x650f2f38
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x30]
je 0x65031080
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
mov dword [esp + 4], eax
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.650d9374
test al, al
je 0x65031076
cmp byte [esp + 0x10], 0
je 0x65031041
lea eax, [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, eax
call fcn.650ab830
sub esp, 8
lea eax, [esp + 0x38]
mov dword [esp + 4], 0
mov dword [esp], 3
mov ecx, eax
call fcn.650ab830
sub esp, 8
mov eax, dword [esp + 0x34]
add eax, 4
mov edx, dword [esp + 0x38]
mov dword [esp], edx
mov ecx, eax
call fcn.65030d40
sub esp, 4
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov dword [esp], edx
mov ecx, eax
call fcn.65030e18
sub esp, 4
test al, al
je 0x65031041
mov eax, 1
jmp 0x65031046
mov eax, 0
test al, al
je 0x6503106d
lea eax, [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], 4
mov ecx, eax
call fcn.650ab830
sub esp, 8
mov ebx, dword [esp + 0x40]
jmp 0x650310a1
mov eax, dword [esp + 0x34]
mov ebx, dword [eax + 4]
jmp 0x650310a1
add dword [esp + 0x24], 8
jmp 0x65030f90
lea eax, [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, eax
call fcn.650ab830
sub esp, 8
mov ebx, dword [esp + 0x40]
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.650a7940
mov eax, ebx
mov ebx, dword [esp + 0x5c]
sub ebx, dword [0x6512e02c]
je 0x650310bf
call fcn.650015c0
add esp, 0x68
pop ebx
ret 0xc
Function at 0x65031240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [0x6512e02c]
mov dword [esp + 0x5c], eax
xor eax, eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.650d87f0
mov dword [esp + 0x34], eax
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.650a71e0
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x10]
je 0x650312cd
mov eax, dword [esp + 0x14]
movzx eax, byte [eax]
movsx edx, al
mov eax, dword [esp + 0x34]
mov dword [esp + 4], 0
mov dword [esp], edx
mov ecx, eax
call fcn.6502a2f0
sub esp, 8
movsx edx, al
lea eax, [esp + 0x44]
mov dword [esp], edx
mov ecx, eax
call fcn.650a7d60
sub esp, 4
add dword [esp + 0x14], 1
jmp 0x65031285
mov dword [esp + 0x38], 0x650e7280
mov dword [esp + 0x30], 0x650e7280
mov dword [esp + 0x3c], 0x650e7480
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x3c]
je 0x6503137b
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
mov dword [esp + 4], eax
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.650d9374
test al, al
je 0x65031371
lea eax, [esp + 0x2f]
mov ecx, eax
call fcn.65069c00
mov eax, dword [esp + 0x40]
sub eax, 0x650e7280
sar eax, 2
movsx edx, al
mov eax, dword [esp + 0x34]
mov dword [esp], edx
mov ecx, eax
call fcn.6502a220
sub esp, 4
movsx edx, al
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x2f]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], 1
mov ecx, eax
call fcn.650a7140
sub esp, 0xc
lea eax, [esp + 0x2f]
mov ecx, eax
call fcn.65069c30
jmp 0x65031386
add dword [esp + 0x30], 4
jmp 0x650312e5
mov eax, dword [esp + 0x1c]
mov ecx, eax
call fcn.650a71e0
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.650a7940
mov eax, dword [esp + 0x5c]
sub eax, dword [0x6512e02c]
je 0x650313a2
call fcn.650015c0
mov eax, dword [esp + 0x1c]
add esp, 0x6c
ret 0xc
Function at 0x402e51
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x402e65
shr eax, 1
xor eax, 0xedb88320
jmp 0x402e67
shr eax, 1
dec edx
jne 0x402e58
mov dword [ecx*4 + 0x4161c0], eax
mov dword [ecx*4 + 0x4181c0], eax
inc ecx
cmp ecx, 0x100
jb 0x402e53
push ebx
push esi
push edi
mov ecx, 0x4165c0
mov edi, 0x101
mov eax, dword [ecx - 0x400]
push 7
mov edx, ecx
pop esi
movzx ebx, al
shr eax, 8
xor eax, dword [ebx*4 + 0x4161c0]
mov dword [edx], eax
add edx, 0x400
dec esi
jne 0x402e99
add ecx, 4
dec edi
jne 0x402e8e
pop edi
pop esi
pop ebx
ret

Function at 0x402ebb
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4181c4], 0
jne 0x402ec9
call fcn.00402e51
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402ef6
test cl, 7
je 0x402ef6
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4161c0]
dec esi
inc ecx
jmp 0x402ed7
cmp esi, 8
jb 0x402f89
mov edi, esi
shr edi, 3
push ebx
xor eax, dword [ecx]
sub esi, 8
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x4171c0]
xor edx, dword [ebx*4 + 0x4175c0]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4179c0]
movzx ebx, byte [ecx + 6]
xor edx, dword [ebx*4 + 0x4165c0]
movzx ebx, byte [ecx + 5]
xor edx, dword [ebx*4 + 0x4169c0]
movzx ebx, byte [ecx + 4]
xor edx, dword [ebx*4 + 0x416dc0]
movzx ebx, byte [ecx + 7]
xor edx, dword [ebx*4 + 0x4161c0]
movzx eax, al
xor edx, dword [eax*4 + 0x417dc0]
add ecx, 8
dec edi
mov eax, edx
jne 0x402f05
pop ebx
jmp 0x402f89
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4161c0]
dec esi
inc ecx
test esi, esi
ja 0x402f75
pop edi
pop esi
ret 0xc

Function at 0x40a850
Capabilities:
Encode data using xor

Disassembly:
clc
invalid
inc esp
jne 0x40a7dd
and bl, byte [edi - 0x4cac91ca]
mov dh, 0xfb
fnstenv [ecx - 0x28]
pop esp
dec esp
adc al, 0x35
mov ah, byte [ebx]
adc eax, 0xc31ba0d7
dec ebp
mov ebx, 0x79978e4
mov eax, 0x8c01dc94
add eax, 0x9778cba
mov bh, 0xda
mov ch, 0xac
ret
and ch, byte [esi + 0x58]
cmp eax, 0x18a478f5
cli
salc
xchg byte [esi], dl
out 0xdd, al
mov dword gs:[ebx + 0x5c], ebx
popfd
cmpsb byte [esi], byte es:[edi]
insd dword es:[edi], dx
wait
je 0x40a872
invalid
and dword [ebp - 0x28], edx
push cs
push ebp
fmul dword [esi]
dec esp
mov dh, 0x35
in al, dx
loope 0x40a7ee
outsd dx, dword [esi]
sbb eax, 0xe469e6ac
dec esp
mov ah, byte [esi - 0x30]
add ecx, dword [eax]
test eax, 0x84d8360
inc ecx
cdq
jne 0x40a89b
jne 0x40a839
insd dword es:[edi], dx
dec ecx
push ds
pop ecx
mov edx, 0xc7cd09fd
pushfd
inc esi
and dword [ecx], edi
invalid
popal

Function at 0x40a9ea
Capabilities:
Encode data using xor

Disassembly:
cld
xchg edx, eax
invalid
imul esp, esp, 0xffffffc5
xor dword [eax], ecx
xor eax, 0x15dac69
in al, dx
xchg edi, eax
jnp 0x40a9a9
and byte [esi], 0x3a
push ss
lodsb al, byte [esi]
cmp ah, byte [ecx - 0x46]
mov dword [eax + 4], eax
rcr dword [edx + 0x5d39cad6], 0x80
xchg edi, eax
cmp esp, esi
sub word [edi - 0xa0518a8], bp