joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f300
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi], 0
mov dword [esi + 4], 0x4a
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x46e1e4
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0x4b
call edi
mov ebx, dword [ebp + 8]
xor edx, edx
cmp ebx, eax
mov ecx, ebx
cmove ecx, edx
push ecx
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov cl, byte [ebp + 0x14]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 0
mov byte [esi + 0x31], cl
cmp eax, 0xffffffff
je 0x40f464
test ebx, ebx
je 0x40f38c
call edi
mov byte [ebp + 0x17], 0
cmp ebx, eax
jne 0x40f390
mov byte [ebp + 0x17], 1
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x1c
push eax
push dword [esi + 0x28]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x40f424
cmp dword [ebp - 0x1c], 0x10
jb 0x40f40d
cmp dword [ebp - 0x10], ebx
jne 0x40f40d
push dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
push 0
or eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x40f40d
cmp byte [ebp + 0x17], 0
je 0x40f3db
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x14], eax
je 0x40f40d
mov ebx, dword [esi + 8]
mov eax, dword [esi + 0xc]
shr eax, 1
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x40f3f4
mov ecx, esi
call fcn.00407b10
lea ecx, [ebx + 1]
mov eax, dword [esi]
mov dword [esi + 8], ecx
lea ecx, [esi + 0x10]
mov dword [eax + ebx*4], edi
lea eax, [ebp - 0x14]
push eax
call fcn.0040f690
mov ebx, dword [ebp + 8]
mov dword [eax], edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x1c
push eax
push dword [esi + 0x28]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x40f3a7
cmp byte [ebp + 0x10], 0
je 0x40f464
cmp dword [esi + 0x28], 0xffffffff
je 0x40f464
cmp byte [esi + 0x30], 0
jne 0x40f464
mov edi, dword [esi]
mov eax, dword [esi + 8]
lea eax, [edi + eax*4]
cmp edi, eax
je 0x40f464
mov ebx, dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [edi]
call ebx
cmp eax, 0xffffffff
setne al
add edi, 4
or byte [esi + 0x30], al
mov ecx, dword [esi + 8]
mov eax, dword [esi]
lea eax, [eax + ecx*4]
cmp edi, eax
jne 0x40f448
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40f550
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x28], 0xffffffff
je 0x40f5d0
mov dl, byte [esi + 0x30]
push ebx
push edi
test dl, dl
je 0x40f5a4
cmp byte [esi + 0x31], 0
je 0x40f5a4
mov edi, dword [esi]
mov eax, dword [esi + 8]
lea eax, [edi + eax*4]
cmp edi, eax
je 0x40f5a1
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
nop word [eax + eax]
push dword [edi]
call ebx
mov dl, byte [esi + 0x30]
cmp eax, 0xffffffff
sete al
add edi, 4
or dl, al
mov byte [esi + 0x30], dl
mov ecx, dword [esi + 8]
mov eax, dword [esi]
lea eax, [eax + ecx*4]
cmp edi, eax
jne 0x40f580
mov byte [esi + 0x31], dl
mov edi, dword [esi]
mov eax, dword [esi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi + eax*4]
cmp edi, eax
je 0x40f5c9
push dword [edi]
call ebx
mov ecx, dword [esi + 8]
add edi, 4
mov eax, dword [esi]
lea eax, [eax + ecx*4]
cmp edi, eax
jne 0x40f5b6
push dword [esi + 0x28]
call ebx
pop edi
pop ebx
mov eax, dword [esi + 0x10]
cmp eax, 0x46e1e4
je 0x40f5f0
push 0x2d7
push str.C:_buildslaveunity_buildRuntime_Core_Containers_hash_set.h
push dword [esi + 0x24]
push eax
call fcn.00401ce0
add esp, 0x10
mov ecx, esi
pop esi
jmp fcn.00406db0

Function at 0x40fc70
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
push esi
push edi
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x18], 0
jne 0x40fd23
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 0x14], eax
jne 0x40fcd1
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2d4]
push eax
call fcn.00438690
add esp, 0xc
mov dword [ebp - 0x2d4], 0x10007
lea ecx, [ebp - 0x2d4]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x40fd21
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
jmp 0x40fdb0
mov ecx, 0xb3
mov esi, dword [ebp + 0x18]
lea edi, [ebp - 0x2d4]
rep movsd dword es:[edi], dword [esi]
Function at 0x410d20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a8
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ecx
call fcn.004405c7
push dword [ebp + 0x10]
mov edi, eax
call fcn.004405c7
add esp, 8
mov esi, eax
xor ebx, ebx
mov dword [ebp - 0x1c], esi
test edi, edi
je 0x410d78
test esi, esi
je 0x410d78
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 4]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov eax, dword [ecx + 0x30]
push esi
push edi
push ebx
push dword [ebp + 8]
call eax
or eax, edx
jne 0x410d7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x410d7d
mov ebx, 8
mov eax, dword [ebp - 4]
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
mov eax, dword [eax]
test eax, eax
je 0x410ec4
test edi, edi
je 0x410ed1
test byte [eax + 0x18], 8
je 0x410e19
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], 0
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
test eax, eax
je 0x410e19
push eax
call fcn.0044063a
mov esi, eax
add esp, 4
test esi, esi
je 0x410e19
push esi
push dword [ebp - 8]
push dword [ebp - 0x18]
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x410e10
mov eax, 0x5c
mov word [ebp - 8], ax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x410dfc
mov dword [ebp - 0xc], eax
jmp 0x410e10
mov eax, dword [ebp - 0xc]
xor edx, edx
add edx, dword [eax + 0xc]
mov ecx, dword [eax + 8]
adc ecx, 0
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
push esi
call fcn.0044061d
add esp, 4
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x6a8]
push eax
push dword [ebp + 0x18]
mov esi, 0x46e7a4
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00410000
test eax, eax
je case.default.0x410e45
mov eax, dword [ebp - 0x688]
cmp eax, 8
ja case.default.0x410e45
jmp dword [eax*4 + 0x410eec]
mov esi, str._nosymbols_
jmp case.default.0x410e45
mov esi, str.COFF
jmp case.default.0x410e45
mov esi, 0x46e7c4
jmp case.default.0x410e45
mov esi, 0x46e7c8
jmp case.default.0x410e45
mov esi, str._exported_
jmp case.default.0x410e45
mov esi, str._deferred_
jmp case.default.0x410e45
mov esi, 0x46e7e4
jmp case.default.0x410e45
mov esi, 0x46e7e8
jmp case.default.0x410e45
mov esi, str.Virtual
push dword [ebp - 0x10]
cmp byte [ebp - 0x464], 0
lea ecx, [ebp - 0x564]
push dword [ebp - 0x14]
lea eax, [ebp - 0x464]
cmove eax, ecx
mov ecx, dword [ebp - 4]
push eax
push esi
push ebx
push dword [ebp + 0x1c]
mov ecx, dword [ecx]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov edx, dword [ecx]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [edx + 8]
mov esi, dword [ebp - 0x1c]
test edi, edi
je 0x410ed1
push edi
call fcn.0044061d
add esp, 4
test esi, esi
je 0x410ede
push esi
call fcn.0044061d
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x411db0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xe0], 0
push dword [ebp + 8]
mov dword [ebp - 0xdc], 0
push eax
mov dword [ebp - 0xd8], 0x67452301
mov dword [ebp - 0xd4], 0xefcdab89
mov dword [ebp - 0xd0], 0x98badcfe
mov dword [ebp - 0xcc], 0x10325476
call fcn.00412730
mov eax, dword [ebp - 0xdc]
mov esi, dword [ebp - 0xe0]
lea edx, [eax*8]
mov eax, esi
shr eax, 0x1d
lea ecx, [esi*8]
or edx, eax
mov byte [ebp - 8], cl
mov eax, ecx
mov byte [ebp - 4], dl
shr eax, 8
and esi, 0x3f
mov byte [ebp - 7], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 6], al
mov eax, edx
shr eax, 8
mov byte [ebp - 3], al
mov eax, edx
shr eax, 0x10
shr ecx, 0x18
mov byte [ebp - 2], al
mov eax, 0x38
mov byte [ebp - 5], cl
sub eax, esi
shr edx, 0x18
mov ecx, 0x78
sub ecx, esi
mov byte [ebp - 1], dl
cmp esi, 0x38
cmovae eax, ecx
push eax
lea eax, [ebp - 0xe0]
push 0x46eb90
push eax
call fcn.00412730
push 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.00412730
mov edx, dword [ebp + 0x10]
add esp, 0x24
mov ecx, dword [ebp - 0xd8]
mov eax, ecx
shr eax, 8
mov byte [edx + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [edx], cl
shr ecx, 0x18
mov byte [edx + 2], al
mov byte [edx + 3], cl
mov ecx, dword [ebp - 0xd4]
mov eax, ecx
shr eax, 8
mov byte [edx + 5], al
mov eax, ecx
mov byte [edx + 4], cl
shr ecx, 0x18
shr eax, 0x10
mov byte [edx + 6], al
mov byte [edx + 7], cl
mov ecx, dword [ebp - 0xd0]
mov eax, ecx
mov byte [edx + 8], cl
shr eax, 8
mov byte [edx + 9], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [edx + 0xa], al
mov byte [edx + 0xb], cl
mov ecx, dword [ebp - 0xcc]
mov eax, ecx
shr eax, 8
mov byte [edx + 0xd], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 0xc], cl
shr ecx, 0x18
mov byte [edx + 0xe], al
mov byte [edx + 0xf], cl
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4193c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 0x20c]
push esi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
xor eax, eax
lea edx, [ecx + 2]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419400
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00423110
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a2d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp + 0xc]
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x20]
cmp edi, 8
cmovae ecx, ebx
lea eax, [ecx + eax*2]
lea ecx, [ebp + 0xc]
mov esi, eax
cmovae ecx, ebx
xor edx, edx
sub esi, ecx
inc esi
shr esi, 1
cmp ecx, eax
cmova esi, edx
test esi, esi
je 0x41a327
lea eax, [edx + 0x5c]
nop dword [eax]
cmp word [ecx], 0x2f
jne 0x41a319
mov word [ecx], ax
inc edx
add ecx, 2
cmp edx, esi
jne 0x41a310
mov edi, dword [ebp + 0x20]
mov ebx, dword [ebp + 0xc]
cmp edi, 8
lea esi, [ebp + 0xc]
push 0x5c
cmovae esi, ebx
push esi
call fcn.00438cfb
add esp, 8
test eax, eax
je 0x41a344
add eax, 2
jmp 0x41a346
mov eax, esi
push eax
push 0x46e454
push dword [ebp + 0x24]
lea eax, [ebp - 0x1c]
push eax
call fcn.00412b10
mov esi, dword [ebp + 8]
add esp, 0xc
push eax
push esi
call fcn.00412aa0
mov edx, dword [ebp - 8]
add esp, 0xc
cmp edx, 8
jb 0x41a39e
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a394
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a400
push edx
push ecx
call fcn.00433c65
add esp, 8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41a3a8
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41a3c1
test al, 0x10
jne 0x41a3c1
push esi
call fcn.0041a410
add esp, 4
mov edx, dword [ebp + 0x20]
cmp edx, 8
jb 0x41a3f7
mov ecx, dword [ebp + 0xc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a3ed
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a405
push edx
push ecx
call fcn.00433c65
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043fb4a
call fcn.0043fb4a
int3
Function at 0x41aac0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41ab4b
test esi, esi
je 0x41ab4b
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
jne 0x41ab4b
mov edi, dword [ebp + 0xc]
mov ecx, edi
push edi
mov ebx, dword [edi + 4]
sub ebx, dword [edi]
add eax, ebx
push eax
call fcn.004149a0
mov eax, dword [edi]
lea ecx, [ebp - 8]
push 0
push ecx
push dword [ebp - 0xc]
add eax, ebx
mov dword [ebp - 8], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41ab66
mov eax, dword [ebp - 8]
mov ecx, edi
push edi
add eax, ebx
push eax
call fcn.004149a0
xor bl, bl
cmp esi, 0xffffffff
je 0x41ab5d
test esi, esi
je 0x41ab5d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, 1
jmp 0x41ab4d
Function at 0x41ccb0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x41cec5
push ebx
push edi
cmp eax, 0x7c
je 0x41cec3
cmp eax, 0x29
jne 0x41ccf1
cmp dword [esi + 0x10], 0
jne 0x41cec3
cmp eax, eax
jne 0x41ccf1
test dword [esi + 0x50], 0x10000000
je 0x41ced2
jmp 0x41ce7c
cmp eax, 0x2e
jne 0x41cd4b
push 5
lea ecx, [esi + 0x24]
call fcn.00421de0
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x41cd3f
cmp byte [eax], 0x5c
jne 0x41cd3c
lea ecx, [eax + 1]
cmp ecx, edx
je 0x41cd3c
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x41cd29
mov bl, byte [ecx]
cmp bl, 0x28
je 0x41cd3a
cmp bl, 0x29
je 0x41cd3a
test dl, 0x10
jne 0x41cd3c
mov dl, byte [ecx]
cmp dl, 0x7b
je 0x41cd3a
cmp dl, 0x7d
jne 0x41cd3c
mov eax, ecx
inc eax
mov dword [esi], eax
mov ecx, esi
call fcn.00422850
jmp 0x41ceae
cmp eax, 0x5c
jne 0x41cda7
mov ecx, esi
call fcn.00421e50
test byte [esi + 0x50], 0x80
je 0x41cd9b
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x41cd7a
push 4
lea ecx, [esi + 0x24]
call fcn.00421de0
mov ecx, esi
call fcn.00421e50
jmp 0x41ceb5
cmp al, 0x42
jne 0x41cd9b
push 4
lea ecx, [esi + 0x24]
call fcn.00421de0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00421e50
jmp 0x41ceb5
mov ecx, esi
call fcn.0041d180
jmp 0x41ceae
cmp eax, 0x5b
jne 0x41ce08
mov ecx, esi
call fcn.00421e50
lea ecx, [esi + 0x24]
call fcn.0041bb30
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x41cdd4
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00421e50
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x41cdf2
cmp eax, 0x5d
jne 0x41cdf2
push eax
lea ecx, [esi + 0x24]
call fcn.0041ba40
mov ecx, esi
call fcn.00421e50
mov ecx, esi
call fcn.0041e3f0
cmp dword [esi + 0x4c], 0x5d
jne 0x41cedb
jmp 0x41cea7
cmp eax, 0x28
jne 0x41ce38
mov ecx, esi
call fcn.00421e50
mov ecx, esi
call fcn.00422c90
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x41ced2
mov ecx, esi
call fcn.00421e50
test bl, bl
je 0x41ceb5
jmp 0x41ceae
cmp eax, 0x5e
jne 0x41ce50
push 2
lea ecx, [esi + 0x24]
call fcn.00421de0
mov ecx, esi
call fcn.00421e50
jmp 0x41ceb5
cmp eax, 0x24
jne 0x41ce68
push 3
lea ecx, [esi + 0x24]
call fcn.00421de0
mov ecx, esi
call fcn.00421e50
jmp 0x41ceb5
cmp eax, 0x2a
je 0x41cec9
cmp eax, 0x2b
je 0x41cec9
cmp eax, 0x3f
je 0x41cec9
cmp eax, 0x7b
je 0x41cec9
cmp eax, 0x7d
jne 0x41ce8c
test dword [esi + 0x50], 0x10000000
je 0x41cee4
jmp 0x41ce9a
cmp eax, 0x5d
jne 0x41ce9a
test dword [esi + 0x50], 0x10000000
je 0x41cedb
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0041b7a0
mov ecx, esi
call fcn.00421e50
mov ecx, esi
call fcn.00421fa0
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x41ccc3
pop edi
pop ebx
mov al, cl
pop esi
ret
push 0xa
mov ecx, esi
call fcn.00420dd0
push 5
mov ecx, esi
call fcn.00420dd0
push 4
mov ecx, esi
call fcn.00420dd0
push 6
mov ecx, esi
call fcn.00420dd0
int3
Function at 0x4234a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x4234d1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4234c0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x4234e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x423511
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x423500
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x426de0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x426dfc
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x426e18
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x426e07
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebp - 0xc], eax
nop word [eax + eax]
cmp edx, ebx
jne 0x426e48
mov eax, ebx
jmp 0x426e4c
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x426ebd
cmp dword [edi + 0x14], 0x10
lea eax, [esi + 8]
mov ecx, edi
jb 0x426e5d
mov ecx, dword [edi]
mov edi, dword [eax + 0x14]
cmp edi, 0x10
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
jb 0x426e73
mov eax, dword [eax]
push dword [edi + 0x10]
push ecx
push edx
push eax
call fcn.00415300
add esp, 0x10
test al, al
jne 0x426e8f
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x426e40
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x426e9a
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x426ea4
mov ecx, dword [edi]
push dword [ebp - 0x14]
push eax
push dword [edi + 0x10]
push ecx
call fcn.00415300
add esp, 0x10
mov ecx, ebx
test al, al
cmovne ecx, esi
jmp 0x426ebf
mov ecx, ebx
cmp ecx, ebx
jne 0x426f1f
mov esi, dword [ebx]
lea eax, [ebp + 0xf]
mov ebx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 4]
push eax
push 0x46e1ec
push edi
push esi
lea ecx, [ebx + 4]
call fcn.00425670
mov edx, eax
mov ecx, 0x4924923
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x426f31
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.00425fc0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.0043504d
int3
Function at 0x427080
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x42709c
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x4270b8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x4270a7
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x4270f1
cmp eax, edi
jne 0x4270e9
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x4270f9
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4270f9
cmp eax, edi
jne 0x4270f9
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.00416a10
push 0x38
push edi
call fcn.00433c65
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x427600
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
lea eax, [esi + 0xc]
mov dword [esi + 4], 0
push eax
mov byte [esi + 0x24], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push esi
push 0x428650
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x427a20
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x427a43
push eax
call ebx
mov dword [edi], 0xffffffff
or eax, 0xffffffff
cmp dword [edi + 4], 0xffffffff
je 0x427b35
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [edi]
mov byte [edi + 0x24], 1
call ebx
push str.Kernel32.dll
mov dword [edi], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.CancelSynchronousIo
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x427ada
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [eax + eax]
push dword [edi + 4]
call ebx
test eax, eax
jne 0x427abd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x427abd
push 0
push dword [edi + 4]
call esi
cmp eax, 0x102
jne 0x427abd
push 0x3e8
push dword [edi + 4]
call esi
jmp 0x427a90
push 0xffffffffffffffff
push dword [edi + 4]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x427b1b
push 0x3e8
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x427aff
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
jmp 0x427b1e
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0xffffffff
pop esi
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret