joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433930
Capabilities:
Create directory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll_wcschr
mov ebx, eax
jmp 0x433967
movzx eax, word [ebx]
mov dword [esp], 0x5a79b6
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcschr
test eax, eax
jne 0x433978
sub ebx, 2
cmp esi, ebx
jbe 0x433950
add esp, 0x10
pop ebx
pop esi
pop edi
ret
xor eax, eax
movzx edi, word [ebx]
mov word [ebx], ax
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__waccess]
test eax, eax
jne 0x4339a0
mov word [ebx], di
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], esi
call fcn.00433930
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__wmkdir]
mov word [ebx], di
jmp 0x433998
Function at 0x4368f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
jmp fcn.00436140

Function at 0x436a60
Capabilities:
Set console window title

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [0x678bd0]
sub esi, 1
js 0x433a8b
mov ebx, dword [esi*4 + 0x678a40]
mov eax, dword [ebx + 8]
test eax, eax
jns 0x433a98
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
sub esi, 1
jae 0x433a71
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], eax
call sub.msvcrt.dll__close
test eax, eax
je 0x433b50
mov eax, dword [0x678a20]
test eax, eax
jne 0x433b70
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov edi, eax
test eax, eax
je 0x433b85
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x433b85
mov eax, dword [ebx + 0x10]
mov dword [esp + 4], 0x5a79bc
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.004c1a60
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x433b63
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00432bc0
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_CharToOemW]
sub esp, 8
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov dword [esp + 4], esi
mov dword [esp], 0x5a799c
call fcn.004c19d0
mov dword [esp], 2
call sub.msvcrt.dll_exit
lea esi, [esi]
mov dword [ebx + 8], 0xffffffff
mov ebx, dword [esi*4 + 0x678a40]
jmp 0x433a7f
cmp dword [0x678a20], 0
je 0x433b85
lea esi, [esi]
mov dword [esp + 4], 1
mov dword [esp], 0x6789e0
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, 0x40000
call fcn.00432cc0
nop
sub esp, 0x1c
cmp byte [0x6581e1], 0
jne 0x433ba5
cmp byte [0x6581e0], 0
je 0x433bc0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
sub esp, 4
add esp, 0x1c
ret
mov dword [esp + 4], 0x103e8
mov dword [esp], 0x658200
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
mov byte [0x6581e1], 1
sub esp, 8
jmp 0x433ba5
jmp 0x433a60

Function at 0x436d90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
lea esi, [esi]
nop
mov eax, ebx
mov edx, 8
nop
mov ecx, eax
and eax, 1
neg eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
sub edx, 1
jne 0x436da0
mov dword [ebx*4 + 0x678c00], eax
add ebx, 1
cmp ebx, 0x100
jne 0x436d98
lea esi, [esi]
nop
mov eax, dword [ebx*4 + 0x678800]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x678c00]
mov dword [ebx*4 + 0x678c00], eax
add ebx, 1
cmp ebx, 0x800
jne 0x436dd0
pop ebx
ret
Function at 0x436e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x67abfc]
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
test eax, eax
je 0x436e50
movzx eax, byte [0x67eac8]
test al, al
je 0x436e60
mov eax, dword [0x67ead0]
test eax, eax
je 0x436ea0
mov dword [esp + 0xc], 0x678c00
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], edi
call eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00436d90
movzx eax, byte [0x67eac8]
test al, al
jne 0x436e27
mov dword [esp], 0x67eac8
call fcn.00570cf0
test eax, eax
je 0x436e27
mov dword [esp + 4], 0
mov dword [esp], str.CrcUpdate
call fcn.00436910
mov dword [esp], 0x67eac8
mov dword [0x67ead0], eax
call fcn.00570dc0
mov eax, dword [0x67ead0]
test eax, eax
jne 0x436e30
nop
test esi, esi
jne 0x436ed1
jmp 0x436f60
mov edx, edi
xor dl, byte [ebx]
mov eax, edi
add ebx, 1
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x678c00]
mov edi, eax
sub esi, 1
je 0x436f60
test bl, 3
jne 0x436eb0
mov eax, edi
mov edx, ebx
cmp esi, 3
jbe 0x436f33
lea eax, [esi - 4]
shr eax, 2
lea edx, [ebx + eax*4 + 4]
mov eax, edi
lea esi, [esi]
nop
xor eax, dword [ebx]
add ebx, 4
mov ecx, eax
mov ebp, eax
movzx edi, al
movzx eax, ah
shr ecx, 0x10
shr ebp, 0x18
mov edi, dword [edi*4 + 0x679800]
movzx ecx, cl
xor edi, dword [ebp*4 + 0x678c00]
xor edi, dword [eax*4 + 0x679400]
mov eax, dword [ecx*4 + 0x679000]
xor eax, edi
cmp ebx, edx
jne 0x436ef0
and esi, 3
je 0x436e45
add esi, edx
movzx ecx, byte [edx]
add edx, 1
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x678c00]
cmp edx, esi
jne 0x436f35
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x43c650
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x40]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea esi, [eax*4 + 4]
mov dword [esp], esi
call fcn.00431f70
mov dword [esp + 0x14], eax
test eax, eax
je 0x43c7ea
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebx]
mov edi, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov dword [edi], eax
movzx edx, byte [ebx + 2]
movzx eax, byte [ebx + 3]
add esi, ebx
add ebx, 4
shl edx, 8
mov dword [esp + 0x18], esi
add edx, eax
movzx eax, byte [ebx - 3]
shl eax, 0x10
add edx, eax
movzx eax, byte [ebx - 4]
shl eax, 0x18
add edx, eax
mov eax, edi
add eax, 4
cmp esi, ebx
jbe 0x43c7d8
mov esi, dword [esp + 0x4c]
lea edi, [esi - 1]
mov dword [esp + 0x1c], edi
jmp 0x43c70a
movzx ebx, byte [ebx]
cmp bl, 0xf2
je 0x43c760
shl edx, 8
mov byte [eax], bl
add eax, 1
or edx, ebx
mov ebx, ecx
cmp ecx, dword [esp + 0x18]
jae 0x43c744
mov ecx, edx
mov esi, edx
mov edi, dword [esp + 0x14]
shr ecx, 0xf
shr esi, 3
xor ecx, esi
xor ecx, edx
and ecx, dword [esp + 0x50]
lea ecx, [edi + ecx*4]
mov ebp, dword [ecx]
mov dword [ecx], eax
lea ecx, [ebx + 1]
test ebp, ebp
jne 0x43c6f0
movzx ebx, byte [ebx]
shl edx, 8
add eax, 1
mov byte [eax - 1], bl
or edx, ebx
mov ebx, ecx
cmp ecx, dword [esp + 0x18]
jb 0x43c70a
sub eax, dword [esp + 0x48]
mov ebx, eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.004320e0
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
xor edi, edi
mov esi, eax
lea esi, [esi]
movzx eax, byte [ecx]
add ecx, 1
mov ebx, eax
xor ebx, 0xc
movzx ebx, bl
add edi, ebx
cmp al, 0xf3
je 0x43c768
mov eax, esi
test edi, edi
jne 0x43c798
shl edx, 8
mov byte [esi], 0xf2
add eax, 1
mov ebx, ecx
or dl, 0xf2
jmp 0x43c704
add edi, dword [esp + 0x1c]
je 0x43c7e2
add edi, esi
movzx edx, byte [ebp]
add eax, 1
add ebp, 1
mov byte [eax - 1], dl
cmp eax, edi
jne 0x43c7a0
movzx eax, byte [edi - 2]
mov ebx, ecx
shl eax, 8
add edx, eax
movzx eax, byte [edi - 3]
shl eax, 0x10
add edx, eax
movzx eax, byte [edi - 4]
shl eax, 0x18
add edx, eax
mov eax, edi
jmp 0x43c704
mov ebx, 4
jmp 0x43c74a
movzx edx, byte [esi - 1]
mov edi, esi
jmp 0x43c7b1
mov ebx, 0xffffffff
jmp 0x43c756
Function at 0x440530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
xor ebp, ebp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x28]
cmp eax, 4
jbe 0x440629
mov ebx, dword [esp + 0x30]
mov edx, 0xffffffff
mov ebx, dword [ebx]
mov edi, ebx
mov dword [esp], ebx
mov ebx, dword [esp + 0x2c]
and edi, 7
add ebx, 5
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x24]
lea esi, [ebx + eax - 4]
xor eax, eax
add eax, dword [esp + 0x24]
cmp eax, esi
jb 0x44058b
jmp 0x440603
add eax, 1
cmp eax, esi
je 0x440608
movzx ecx, byte [eax]
and ecx, 0xfffffffe
cmp cl, 0xe8
jne 0x440580
mov ebx, eax
sub ebx, dword [esp + 0x24]
mov ecx, ebx
mov dword [esp], ebx
sub ecx, edx
cmp eax, esi
jae 0x4406d4
cmp ecx, 3
ja 0x440638
sub ecx, 1
shl edi, cl
and edi, 7
je 0x4405de
cmp byte [edi + 0x5a8060], 0
je 0x4405ea
movzx ecx, byte [edi + 0x5a8058]
mov edx, eax
sub edx, ecx
movzx edx, byte [edx + 4]
sub edx, 1
cmp dl, 0xfd
ja 0x4405ea
movzx ebx, byte [eax + 4]
lea edx, [ebx - 1]
cmp dl, 0xfd
ja 0x440646
mov eax, dword [esp]
add edi, edi
and edi, 6
or edi, 1
add eax, 1
add eax, dword [esp + 0x24]
mov edx, dword [esp]
cmp eax, esi
jb 0x44058b
mov esi, eax
lea esi, [esi]
sub esi, dword [esp + 0x24]
mov ebp, esi
mov ecx, ebp
xor eax, eax
sub ecx, edx
cmp ecx, 3
ja 0x440623
sub ecx, 1
mov eax, edi
shl eax, cl
and eax, 7
mov ebx, dword [esp + 0x30]
mov dword [ebx], eax
add esp, 0x10
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, byte [eax + 4]
xor edi, edi
lea edx, [ebx - 1]
cmp dl, 0xfd
jbe 0x4405ea
mov ebx, dword [esp + 0xc]
mov edx, dword [eax + 1]
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov dword [esp + 8], esi
mov eax, edx
lea ebp, [ebx + ecx]
mov ebx, dword [esp + 0x34]
jmp 0x44069a
movzx eax, byte [edi + 0x5a8058]
mov ecx, 0x18
mov esi, edx
shl eax, 3
sub ecx, eax
shr esi, cl
mov ecx, esi
sub ecx, 1
cmp cl, 0xfd
jbe 0x4406a8
mov ecx, 0x20
sub ecx, eax
mov eax, 1
shl eax, cl
sub eax, 1
xor eax, edx
lea edx, [eax + ebp]
sub eax, ebp
test ebx, ebx
cmove edx, eax
test edi, edi
jne 0x440668
mov ecx, edx
mov eax, dword [esp + 4]
mov esi, dword [esp + 8]
shr ecx, 0x18
and ecx, 1
mov word [eax + 1], dx
neg ecx
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 3], cl
mov eax, dword [esp]
add eax, 5
jmp 0x4405f8
mov ebp, dword [esp]
jmp 0x44060e
Function at 0x44dd00
Capabilities:
Get memory capacity

Disassembly:
push ebx
sub esp, 0x48
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x20
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
sub esp, 4
lea ecx, [esp + 0x18]
call fcn.0044d870
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x1c]
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
cmp edx, eax
lea ebx, [eax - 0x500000]
mov eax, dword [esp + 0x18]
lea ecx, [edx - 0x500000]
cmovb ebx, ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebx
sub esp, 0xc
add esp, 0x48
pop ebx
ret

Function at 0x44dd70
Capabilities:
Get memory capacity

Disassembly:
push ebx
sub esp, 0x48
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x20
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
sub esp, 4
lea ecx, [esp + 0x18]
call fcn.0044d870
lea ecx, [esp + 0x18]
call fcn.0044d900
mov edx, eax
mov eax, dword [esp + 0x34]
lea ebx, [eax - 0x500000]
cmp eax, edx
ja 0x44ddd8
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebx
sub esp, 0xc
add esp, 0x48
pop ebx
ret
lea ecx, [esp + 0x18]
call fcn.0044d900
lea ebx, [eax - 0x500000]
jmp 0x44ddae
Function at 0x44f6d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x4c]
mov esi, dword [esp + 0x44]
mov ebx, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [ecx]
mov dword [esp], eax
call sub.msvcrt.dll_free
lea eax, [edi + 8]
mov dword [esp], eax
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_malloc
mov dword [ebp], eax
test eax, eax
je 0x44f8a7
mov eax, dword [esp + 0x40]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 4], esi
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.msvcrt.dll__lseeki64
xor eax, esi
xor ebx, edx
or ebx, eax
je 0x44f7c8
mov ecx, dword [0x678a20]
test ecx, ecx
jne 0x44f7b0
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x44f8e1
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x44f8e1
mov dword [esp + 4], str.ERROR:_file_seek_operation_failed
mov dword [esp], esi
call fcn.004c1a60
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00432f50
mov dword [esp + 4], ebx
mov dword [esp], 0x5a8fcc
call fcn.004c19d0
mov dword [esp], 2
call sub.msvcrt.dll_exit
lea esi, [esi]
mov dword [esp + 4], 1
mov dword [esp], 0x6789e0
call dword [sym.imp.msvcrt.dll_longjmp]
lea esi, [esi]
mov eax, dword [ebp]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebx, eax
test eax, eax
js 0x44f860
mov ecx, dword [esp + 0x18]
cdq
xor ebx, edi
xor ecx, edx
mov eax, ecx
or eax, ebx
je 0x44f848
mov eax, dword [0x678a20]
test eax, eax
jne 0x44f7b0
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x44f8e1
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x44f8e1
mov dword [esp + 8], edi
mov dword [esp + 4], str.ERROR:_cant_read__lu_bytes
mov dword [esp], esi
call fcn.004c1a60
jmp 0x44f782
mov eax, dword [ebp]
mov dword [ebp + 8], eax
add eax, edi
mov dword [ebp + 4], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
mov edx, dword [0x678a20]
test edx, edx
jne 0x44f7b0
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x44f8e1
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x44f8e1
mov dword [esp + 4], str.ERROR:_file_read_operation_failed
mov dword [esp], esi
call fcn.004c1a60
jmp 0x44f782
cmp dword [0x678a20], 0
jne 0x44f7b0
mov eax, 0x40000
call fcn.0044f640
mov esi, eax
mov eax, 0x40000
call fcn.0044f640
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.ERROR:_cant_alloc__lu_memory_bytes
jmp 0x44f838
cmp dword [0x678a20], 0
jne 0x44f7b0
mov eax, 0x40000
call fcn.0044f640
mov esi, eax
mov eax, 0x40000
call fcn.0044f640
mov dword [esp + 8], 0x40000
mov ebx, eax
jmp 0x44f8d4
Function at 0x44fc30
Capabilities:
Create thread

Disassembly:
sub esp, 0x3c
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp], 0
mov dword [esp + 8], eax
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov edx, dword [esp + 0x40]
mov dword [edx], eax
xor edx, edx
test eax, eax
je 0x44fc80
mov eax, edx
add esp, 0x3c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 1
test eax, eax
cmovne edx, eax
add esp, 0x3c
mov eax, edx
ret
Function at 0x452f40
Capabilities:
Delete file

Disassembly:
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x10
mov eax, dword [ecx]
mov dword [eax + 0x40068], 0
mov eax, dword [ecx + 0x80]
test eax, eax
jns 0x453038
mov eax, dword [ebx + 0x1c]
test eax, eax
jns 0x452fa8
call fcn.00436a60
mov ecx, dword [ebx + 4]
mov edx, dword [esp + 0x24]
mov eax, dword [ecx]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 4], edx
mov edx, dword [ebx]
mov dword [esp], edx
call dword [eax + 0x3c]
mov eax, dword [ebx]
sub esp, 0xc
mov eax, dword [eax + 0x40068]
test eax, eax
setne al
add esp, 0x10
pop ebx
pop esi
pop edi
ret 8
mov dword [esp], eax
call sub.msvcrt.dll__close
test eax, eax
je 0x4530a8
mov edx, dword [0x678a20]
test edx, edx
jne 0x4530b8
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov edi, eax
test eax, eax
je 0x4530cd
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x4530cd
mov eax, dword [ebx + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], str.ERROR:_cant_close_file__s
mov dword [esp], edi
call fcn.004c1a60
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00432f50
mov dword [esp + 4], esi
mov dword [esp], 0x5a8fcc
call fcn.004c19d0
mov dword [esp], 2
call sub.msvcrt.dll_exit
lea esi, [esi]
mov dword [esp], eax
call sub.msvcrt.dll__close
test eax, eax
je 0x453080
mov ecx, dword [0x678a20]
test ecx, ecx
jne 0x4530b8
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov edi, eax
test eax, eax
je 0x4530cd
mov dword [esp], 0x40000
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x4530cd
mov eax, dword [ebx + 0x88]
jmp 0x452ff5
mov dword [ebx + 0x80], 0xffffffff
mov eax, dword [ebx + 0x84]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wremove]
mov dword [ebx + 0x70], 0
jmp 0x452f62
mov dword [ebx + 0x1c], 0xffffffff
jmp 0x452f69
mov dword [esp + 4], 1
mov dword [esp], 0x6789e0
call dword [sym.imp.msvcrt.dll_longjmp]
cmp dword [0x678a20], 0
jne 0x4530b8
mov eax, 0x40000
call fcn.0044f640
mov esi, eax
mov eax, 0x40000
call fcn.0044f640
mov dword [esp + 8], 0x40000
mov dword [esp + 4], str.ERROR:_cant_alloc__lu_memory_bytes
mov ebx, eax
mov dword [esp], esi
call fcn.004c1a60
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00432f50
mov dword [esp + 4], ebx
mov dword [esp], 0x5a8fcc
call fcn.004c19d0
mov dword [esp], 2
call sub.msvcrt.dll_exit
nop
Function at 0x455709
Capabilities:
Create thread
Resume thread

Disassembly:
lea eax, [esi + 4]
push eax
push 4
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x455757
mov ecx, dword [0x59dde4]
test ecx, ecx
je 0x455739
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
cmp dword [esp + 0xc], 0
je 0x45574c
push dword [esp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
inc eax
ret 0xc
Function at 0x4571d1
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.WINMM.DLL_timeGetTime]
mov edi, eax
sub eax, dword [esi + 0xb8]
cmp eax, 3
jae 0x457202
mov eax, dword [esi + 0xc0]
or eax, dword [esi + 0xc4]
jne 0x457254
mov eax, dword [esi + 0x98]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x18]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
jns 0x45721e
fldz
jmp 0x45737d
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov dword [esi + 0xc0], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0xc4], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], ecx
mov dword [esi + 0xb8], edi
jmp 0x457257
mov eax, dword [ebp - 8]
mov ecx, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], ecx
mov ebx, 0x7fffffff
and ecx, ebx
mov dword [ebp - 0x14], ecx
mov ecx, dword [esi + 0xa4]
mov dword [ebp - 0x18], edx
fild qword [ebp - 0x18]
mov edx, dword [esi + 0xa0]
mov edi, 0x80000000
and dword [ebp - 0xc], edi
fild qword [ebp - 0x10]
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], ecx
and dword [ebp - 0xc], edi
fchs
and ecx, ebx
or eax, dword [ebp - 4]
faddp st(1)
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
fild qword [ebp - 0x18]
fild qword [ebp - 0x10]
fchs
faddp st(1)
fdivp st(1)
fstp qword [ebp - 0x18]
jne 0x4572ff
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [esi + 0xc8]
mov eax, dword [ebp - 4]
sbb eax, dword [esi + 0xcc]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
and dword [ebp - 0xc], edi
and eax, ebx
and dword [ebp - 0x10], 0
mov dword [ebp - 4], eax
fild qword [ebp - 8]
fild qword [ebp - 0x10]
fchs
faddp st(1)
fmul qword [0x59c48c]
fadd qword [ebp - 0x18]
fstp qword [ebp - 0x18]
mov eax, dword [esi + 0x8c]
fild dword [esi + 0x8c]
test eax, eax
jns 0x457315
fadd qword [0x5c5c38]
fmul qword [ebp - 0x18]
call fcn.00481552
mov ecx, dword [esi + 0xac]
cmp edx, ecx
jb 0x457339
ja 0x457331
cmp eax, dword [esi + 0xa8]
jbe 0x457339
mov eax, dword [esi + 0xa8]
mov edx, ecx
mov ecx, dword [esi + 0xd4]
cmp edx, ecx
ja 0x457355
jb 0x45734d
cmp eax, dword [esi + 0xd0]
jae 0x457355
mov eax, dword [esi + 0xd0]
mov edx, ecx
mov dword [ebp - 0xc], edx
and dword [ebp - 0xc], edi
mov dword [esi + 0xd4], edx
and edx, ebx
and dword [ebp - 0x10], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
fild qword [ebp - 0x18]
fild qword [ebp - 0x10]
mov dword [esi + 0xd0], eax
fchs
faddp st(1)
pop edi
pop ebx
leave
ret
Function at 0x460678
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push ebx
push esi
xor esi, esi
push edi
xor edx, edx
mov dword [eax + 0x16], esi
movzx edi, byte [eax + esi]
mov ebx, edx
shr ebx, 0x18
xor edi, ebx
shl edx, 8
xor edx, dword [edi*4 + 0x59cd54]
inc esi
cmp esi, ecx
jl 0x460687
pop edi
pop esi
mov dword [eax + 0x16], edx
pop ebx
ret

Function at 0x46533a
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
fld1
mov eax, 0x59a708
fst dword [eax]
sub eax, 4
fmul qword [0x5c5cd0]
cmp eax, 0x59a30c
jge 0x465346
fstp st(0)
xor ecx, ecx
mov eax, ecx
push 8
shl eax, 0x18
pop edx
test eax, eax
jns 0x465371
add eax, eax
xor eax, 0x4c11db7
jmp 0x465373
add eax, eax
dec edx
jne 0x465364
mov dword [ecx*4 + 0x59cd54], eax
inc ecx
cmp ecx, 0x100
jl 0x46535c
fld qword [0x5c5c98]
mov edx, 0x590124
fld qword [0x5c5c88]
xor ecx, ecx
and dword [ebp - 4], 0
push 0x20
pop eax
shl eax, cl
mov dword [ecx*4 + 0x59a2e8], edx
mov dword [ebp - 8], eax
test eax, eax
jle 0x4653dd
fild dword [ebp - 8]
fild dword [ebp - 4]
fadd dword [0x5c5c30]
fdiv st(1)
fmul st(3)
fmul st(2)
fsin
fld st(0)
fmulp st(1)
fmul st(3)
fmul st(2)
fsin
fstp dword [edx]
add edx, 4
inc dword [ebp - 4]
cmp dword [ebp - 4], eax
jl 0x4653b3
fstp st(0)
inc ecx
cmp ecx, 8
jl 0x465399
fstp st(1)
fstp st(0)
leave
ret

Function at 0x46adb6
Capabilities:
Enumerate pe sections

Disassembly:
mov dl, byte [ecx]
push esi
mov esi, eax
xor eax, eax
test dl, 0x40
je 0x46adcc
and dl, 0xbf
mov byte [ecx], dl
jmp 0x46ae84
test dl, 8
jne 0x46ae84
test dl, 1
je 0x46ae88
push ebx
mov bl, dl
and bl, 2
push edi
je 0x46adf4
mov edi, dword [esp + 0x10]
cmp dword [edi + 0x4c], eax
jne 0x46ae59
test dl, dl
js 0x46ae59
cmp bl, al
je 0x46ae3f
mov ebx, dword [ecx + 4]
and dl, 0xfd
mov byte [ecx], dl
movzx edx, word [esi + ebx*4 + 6]
mov dword [ecx + 0xc], edx
movzx edi, word [esi + ebx*4 + 0xa]
mov dword [ecx + 0x10], edi
cmp edi, edx
jle 0x46ae29
movzx edx, word [esi + ebx*4 + 8]
movzx eax, word [esi + ebx*4 + 0xc]
sub edi, dword [ecx + 0xc]
sub eax, edx
shl eax, 0x10
cdq
idiv edi
mov dword [ecx + 0x18], eax
movzx eax, word [esi + ebx*4 + 8]
shl eax, 0x10
mov dword [ecx + 0x14], eax
mov eax, dword [ecx + 0xc]
mov dword [ecx + 8], eax
jmp 0x46ae59
mov edi, dword [ecx + 0x18]
add dword [ecx + 0x14], edi
mov edi, dword [ecx + 0x14]
js 0x46ae53
mov eax, 0x400000
cmp edi, eax
jle 0x46ae56
mov dword [ecx + 0x14], eax
inc dword [ecx + 8]
test byte [ecx], 2
pop edi
pop ebx
jne 0x46ae84
mov eax, dword [ecx + 4]
movzx edx, word [esi + eax*4 + 0xa]
cmp dword [ecx + 8], edx
jne 0x46ae84
movzx edx, byte [esi + 1]
inc eax
cmp eax, edx
jge 0x46ae84
push dword [esp + 8]
mov edx, 0x10000
call fcn.0046ac39
movsx eax, word [ecx + 0x16]
pop esi
ret 4