joyce8/EMBER2024-capa huggingface dataset:
Function at 0x720eb0
Capabilities:
Hash data using murmur3

Disassembly:
xor dword [0xf0fa25], ecx
add edi, 0x27c3fc24
neg eax
add eax, dword [0xf0fcfd]
or dword [0xf0f7e1], ecx
xor dword [0xf0f702], edx
neg eax
sub edi, 0x27c3fc24
or dword [0xf0f998], eax
call fcn.006586f0
add eax, ecx
call fcn.0062123d
call fcn.00478666
and dword [0xf0f7d9], edx
xchg eax, esi
mov edi, 0x6e22e4ee
call fcn.0060a2ff
xor ebx, 0x7f0589e4
sub eax, dword [0xf0ff8f]
xor dword [0xf0f7e5], edi
or dword [0xf0fa82], edx
xor ecx, esp
xor eax, ebp
inc esi
sub ebx, dword [0xf0fe90]
xchg ebx, edx
xor esi, 0xde400611
xor edi, eax
xor eax, dword [0xf0fc27]
neg esi
add ecx, edx
neg esi
ror edi, 0x1f
sub edx, esp
add edx, esp
rol edi, 0x1f
neg esi
sub ecx, edx
neg esi
xor edi, eax
xor esi, 0xde400611
xchg ebx, edx
dec esi
xor eax, ebp
xor ecx, esp
mov dword [0xf0f70e], ebx
add dword [0xf0f8aa], ecx
xor ebx, 0x7f0589e4
sub edi, 0xfdf9c019
or dword [0xf0f800], edi
dec eax
xor ebx, 0xda2b4a2a
sub ebx, edi
not ecx
or ebx, dword [0xf0fbc2]
rol edx, 0x17
sub dword [0xf0f73e], ecx
inc eax
dec edx
sub edx, 0xa55e9c1b
add edx, dword [0xf0fcbd]
sub ecx, esp
not esi
xchg ebx, esi
add esi, 0x1292b97
xchg esi, edx
mov dword [0xf0fb0e], edi
call fcn.0042077b
call fcn.0060d053
xchg esi, edx
sub esi, 0x1292b97
xchg ebx, esi
not esi
add ecx, esp
add edx, 0xa55e9c1b
inc edx
dec eax
xor dword [0xf0fb25], ebx
ror edx, 0x17
not ecx
add ebx, edi
xor ebx, 0xda2b4a2a
inc eax
xor dword [0xf0fa1a], ecx
xor edi, 0x702924d5
mov dword [0xf0fb27], esi
add ecx, dword [0xf0fe5a]
sub eax, dword [0xf0feb3]
not edx
sub dword [0xf0fa6c], esi
sub eax, edi
dec ecx
add ebx, dword [0xf0ff4b]
not ecx
rol edi, 1
mov dword [0xf0fb4f], 0xb9b43e64
neg edi
xor ebx, dword [0xf0fc9e]
xor edi, edx
ror edx, 6
sub ebx, 0x2c0c574e
call fcn.0042e02f
add ebx, 0x2c0c574e
rol edx, 6
xor edi, edx
neg edi
ror edi, 1
iretd
add edi, esi
rol dword [ecx + 3], 1
invalid
and dword [0xf0f97d], edi
not edx
xor dword [0xf0f976], edi
push edi
add eax, esp
add dword [0xf0f730], eax
not edi
xor eax, dword [0xf0fbbc]
sub dword [0xf0f7b3], ebx
call fcn.004cfdb7
mov dword [0xf0f973], eax
xchg ebx, eax
not eax
add esi, edx
xor dword [0xf0f9be], esi
add ebx, dword [0xf0fdaa]
or dword [0xf0fa41], edx
neg ecx
xor eax, edi
sub eax, 0x752935de
call fcn.005994b9
add eax, 0x752935de
fidiv word [0xc7337529]
neg ecx
sub dword [0xf0f90e], edx
sub esi, edx
not eax
xchg ebx, eax
add dword [0xf0f987], eax
add eax, 0xf0f987
not edi
sub eax, esp
call eax
or ecx, dword [0xf0fbc7]
sub eax, 0xe00b25d7

Function at 0x720edc
Capabilities:
Hash data using murmur3

Disassembly:
neg ebx
xor dword [0xf0f8fc], ebx
and dword [0xf0faad], ebx
xor edi, dword [0xf0fc7c]
xor dword [0xf0f97c], edi
add byte [ebx], ch
sbb eax, 0xf0fc44
call fcn.0049d081
xor ecx, ebp
inc edx
sub esi, dword [0xf0fc4c]
mov dword [0xf0f826], ebx
call fcn.00438fac
xor edi, ebp
neg esi
xor esi, dword [0xf0ff91]
add ecx, esi
call fcn.0063e498
call fcn.005be2d3
sub ecx, esi
neg esi
xor edi, ebp
dec edx
xor ecx, ebp
call fcn.00485071
inc dword [ecx]
or eax, 0xf0f79e
neg ebx
add eax, 0xe00b25d7
lea esi, [0x1020edc]
ror esi, 0x1b
neg edx
xchg esi, edx
xor esi, 0xf87ff060
and dword [0xf0f8f3], ebx
Function at 0x721040
Capabilities:
Hash data using murmur3

Disassembly:
into
sbb esi, edi
fiadd dword [edi + 0x60f681d6]
invalid
sbb eax, 0xf0f8f3
not ecx
rol esi, 2
dec ebx
call fcn.004d1816
and dword [0xf0f9a2], esi
sub esi, 0x3de17ab9
or edi, dword [0xf0fdc5]
not eax
inc edi
xchg esi, eax
sub ecx, 0xb14c213
rol ecx, 0x1d
sub ecx, eax
call fcn.00478e0d
xor edi, ebp
xor ecx, dword [0xf0fc1a]
xor edi, ebp
call fcn.005e4e9e
add ecx, eax
ror ecx, 0x1d
add ecx, 0xb14c213
xchg esi, eax
dec edi
not eax
add esi, 0x3de17ab9
add dword [0xf0f819], eax
call fcn.00643faa
inc ebx
ror esi, 2
not ecx
xor dword [0xf0f79f], esi
xor esi, 0xf87ff060
xchg esi, edx
neg edx
rol esi, 0x1b
or esi, 0x1600
inc ecx
xor ebx, 0x2ffa3319
xor dword [0xf0fa8f], edx
or eax, dword [0xf0fec8]
add esi, edx
xor dword [0xf0f82b], ecx
add edx, 0xdb1af74f
ror edx, 2
mov dword [0xf0f92b], ecx
ror edx, 0xf
xor eax, 0xcc614902
neg edi
xor ecx, edi
sub dword [0xf0fb4d], ecx
not esi
call fcn.00686ade
not esi
or dword [0xf0fb2b], ebx
xor ecx, edi
neg edi
xor eax, 0xcc614902
rol edx, 0xf
or dword [0xf0faa0], esi
rol edx, 2
sub edx, 0xdb1af74f
or dword [0xf0f90a], eax
sub esi, edx
sub dword [0xf0f808], ecx
push edx
wait
fnstcw word [esp]
je 0x72807c
cmp word [esp], 0x27f
je 0x72803d
fldcw word [0xccd508]
fptan
wait
fnstsw ax
sahf
jp 0x728064
fstp st(0)
cmp dword [0xefc08c], 0
jne 0x720f4e
mov edx, 0x20
lea ecx, [0xed9db0]
jmp 0x720f5b
fld xword [0xccd50a]
fxch st(1)
fprem1
wait
fnstsw ax
sahf
jp 0x72806c
fstp st(1)
fptan
fstp st(0)
jmp 0x728047
test eax, 0xfffff
jne 0x7280b4
cmp dword [esp + 8], 0
jne 0x7280b4
fstp st(0)
fld xword [0xccd4c0]
mov eax, 1
cmp dword [0xefc08c], 0
jne 0x720f4e
mov edx, 0x20
lea ecx, [0xed9db0]
call fcn.00721057
pop edx
ret
Function at 0x722780
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x7227ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x7227ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x72777f
Capabilities:
Hash data using murmur3

Disassembly:
lea edx, [esp + 4]
call fcn.00720ef5

Function at 0x727a7f
Capabilities:
Hash data using murmur3

Disassembly:
lea edx, [esp + 4]
call fcn.00720ef5

Function at 0x727bbf
Capabilities:
Hash data using murmur3

Disassembly:
lea edx, [esp + 4]
call fcn.00720ef5

Function at 0x727cd4
Capabilities:
Hash data using murmur3

Disassembly:
lea edx, [esp + 0xc]
call fcn.00720ef5

Function at 0x727f1f
Capabilities:
Hash data using murmur3

Disassembly:
lea edx, [esp + 4]
call fcn.00720ef5

Function at 0x727fc0
Capabilities:
Hash data using murmur3

Disassembly:
lea edx, [esp + 4]
call fcn.00720ef5
jmp fcn.00727684

Function at 0x72801f
Capabilities:
Hash data using murmur3

Disassembly:
lea edx, [esp + 4]
call fcn.00720ef5
Function at 0x411e20
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
jne 0x411f56
mov eax, dword [esp + 0xc]
cmp eax, 0xe
ja case.default.0x411e39
jmp dword [eax*4 + 0x411fd8]
push dword [esp + 8]
mov ecx, dword [esp + 8]
call fcn.004143b0
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
mov eax, dword [eax + 4]
push dword [eax]
call fcn.00413470
ret
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
push dword [eax]
mov eax, dword [ecx + 4]
mov ecx, dword [esp + 8]
push dword [eax]
call fcn.004134a0
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
mov eax, dword [eax + 4]
push dword [eax]
call fcn.00413410
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
mov eax, dword [eax + 4]
push dword [eax]
call fcn.00413440
ret
mov eax, dword [esp + 0x10]
push dword [esp + 8]
mov ecx, dword [esp + 8]
mov eax, dword [eax + 4]
push dword [eax]
call fcn.004143e0
ret
push dword [esp + 8]
mov ecx, dword [esp + 8]
call fcn.00413a70
ret
push dword [esp + 8]
mov ecx, dword [esp + 8]
call fcn.00413a40
ret
mov ecx, dword [esp + 4]
mov ecx, dword [ecx + 4]
jmp 0x45df50
mov ecx, dword [esp + 4]
mov ecx, dword [ecx + 4]
jmp fcn.0045c060
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
lea eax, [ecx + 0xc0]
push eax
call fcn.00414570
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
test ecx, ecx
je case.default.0x411e39
mov byte [ecx], al
ret
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
lea eax, [ecx + 0xe0]
jmp 0x411ef7
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
call fcn.004129e0
jmp 0x411efd
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
call fcn.00412ca0
jmp 0x411efd
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
call fcn.00412a70
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
test ecx, ecx
je case.default.0x411e39
mov byte [ecx], al
ret
cmp eax, 0xa
jne case.default.0x411e39
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov eax, dword [eax]
cmp eax, fcn.004143b0
jne 0x411f74
mov dword [ecx], 0
ret
cmp eax, fcn.00413470
jne 0x411f82
mov dword [ecx], 1
ret
cmp eax, fcn.004134a0
jne 0x411f90
mov dword [ecx], 2
ret
cmp eax, fcn.00413410
jne 0x411f9e
mov dword [ecx], 3
ret
cmp eax, fcn.00413440
jne 0x411fac
mov dword [ecx], 4
ret
cmp eax, fcn.004143e0
jne 0x411fba
mov dword [ecx], 5
ret
cmp eax, fcn.00413a70
jne 0x411fc8
mov dword [ecx], 6
ret
cmp eax, fcn.00413a40
jne case.default.0x411e39
mov dword [ecx], 7
ret
push esi
mov esi, ecx
mov eax, dword [esi + 0x94]
test eax, eax
je 0x45df80
push dword [eax + 8]
push 0x45d270
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esi + 0x94]
push 0
push 0
push 0x10
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
pop esi
ret
Function at 0x411ed2
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
jne 0x411f56
mov eax, dword [esp + 0xc]
cmp eax, 0xe
ja case.default.0x411e39
jmp dword [eax*4 + 0x411fd8]
push dword [esp + 8]
mov ecx, dword [esp + 8]
call fcn.004143b0
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
mov eax, dword [eax + 4]
push dword [eax]
call fcn.00413470
ret
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
push dword [eax]
mov eax, dword [ecx + 4]
mov ecx, dword [esp + 8]
push dword [eax]
call fcn.004134a0
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
mov eax, dword [eax + 4]
push dword [eax]
call fcn.00413410
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
mov eax, dword [eax + 4]
push dword [eax]
call fcn.00413440
ret
mov eax, dword [esp + 0x10]
push dword [esp + 8]
mov ecx, dword [esp + 8]
mov eax, dword [eax + 4]
push dword [eax]
call fcn.004143e0
ret
push dword [esp + 8]
mov ecx, dword [esp + 8]
call fcn.00413a70
ret
push dword [esp + 8]
mov ecx, dword [esp + 8]
call fcn.00413a40
ret
mov ecx, dword [esp + 4]
mov ecx, dword [ecx + 4]
jmp 0x45df50
mov ecx, dword [esp + 4]
mov ecx, dword [ecx + 4]
jmp fcn.0045c060
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
lea eax, [ecx + 0xc0]
push eax
call fcn.00414570
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
test ecx, ecx
je case.default.0x411e39
mov byte [ecx], al
ret
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
lea eax, [ecx + 0xe0]
jmp 0x411ef7
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
call fcn.004129e0
jmp 0x411efd
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
call fcn.00412ca0
jmp 0x411efd
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
call fcn.00412a70
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
test ecx, ecx
je case.default.0x411e39
mov byte [ecx], al
ret
cmp eax, 0xa
jne case.default.0x411e39
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov eax, dword [eax]
cmp eax, fcn.004143b0
jne 0x411f74
mov dword [ecx], 0
ret
cmp eax, fcn.00413470
jne 0x411f82
mov dword [ecx], 1
ret
cmp eax, fcn.004134a0
jne 0x411f90
mov dword [ecx], 2
ret
cmp eax, fcn.00413410
jne 0x411f9e
mov dword [ecx], 3
ret
cmp eax, fcn.00413440
jne 0x411fac
mov dword [ecx], 4
ret
cmp eax, fcn.004143e0
jne 0x411fba
mov dword [ecx], 5
ret
cmp eax, fcn.00413a70
jne 0x411fc8
mov dword [ecx], 6
ret
cmp eax, fcn.00413a40
jne case.default.0x411e39
mov dword [ecx], 7
ret
push esi
mov esi, ecx
mov eax, dword [esi + 0x94]
test eax, eax
je 0x45df80
push dword [eax + 8]
push 0x45d270
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esi + 0x94]
push 0
push 0
push 0x10
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
pop esi
ret
Function at 0x418840
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x58
mov eax, dword [0x8870bc]
xor eax, esp
mov dword [esp + 0x54], eax
push edi
mov edi, dword [esp + 0x60]
lea eax, [esp + 4]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftCryptography
mov dword [esp + 0x18], edi
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4188de
push esi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x4a
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push str.MachineGuid
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4188de
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
dec eax
push ecx
shr eax, 1
push eax
push edi
call fcn.00405c00
add esp, 0xc
mov eax, edi
pop edi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.00520afb
add esp, 0x58
ret
mov ecx, dword [esp + 0x58]
mov eax, edi
mov dword [edi], 0x6f6ba0
pop edi
xor ecx, esp
call fcn.00520afb
add esp, 0x58
ret

Function at 0x41c390
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545798
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x8870bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 2
push 2
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 0x888bf4
push eax
push 0x888bf4
mov dword [ebp - 0x10], 0
call fcn.00419e00
add esp, 0x14
test eax, eax
jne 0x41c3eb
mov ecx, 0x888bf4
call fcn.00460090
mov byte [ebp - 0x14], 1
cmp dword [ebp + 8], 0x7ffe
mov dword [ebp - 4], 0
jg 0x41c40a
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x41c47b
push 0xfffe
call fcn.00521324
mov esi, dword [ebp + 8]
add esp, 4
xor edi, edi
mov ebx, eax
test esi, esi
jle 0x41c472
mov ecx, 0x7ffe
nop word [eax + eax]
mov eax, dword [ebp + 0xc]
sub esi, edi
cmp esi, 0x7ffe
cmovg esi, ecx
lea ecx, [eax + edi*2]
test ecx, ecx
je 0x41c453
lea eax, [esi + esi]
push eax
push ecx
push ebx
call fcn.005229c0
add esp, 0xc
xor eax, eax
push ebx
mov word [ebx + esi*2], ax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, dword [ebp + 8]
add edi, 0x7ffe
mov ecx, 0x7ffe
cmp edi, esi
jl 0x41c430
push ebx
call fcn.0052132d
add esp, 4
push 0
push 3
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push eax
push 0x888bf4
call fcn.00419e00
add esp, 0x14
test eax, eax
jne 0x41c4a7
mov ecx, 0x888bf4
call fcn.00460570
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4205c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545bf6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8870bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0x6f6ba0
mov dword [ebp - 4], 0
mov dword [edi + 8], 0x6f6ba0
mov dword [edi + 0x14], 0x6f6ba0
mov dword [edi + 0x20], 0x6f6ba0
mov dword [edi + 0x24], 0x6f6ba0
mov dword [edi + 0x28], 0x6f6ba0
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dword [edi + 0x30], eax
cmp dword [esi + 4], 3
sete al
mov byte [edi + 0x34], al
cmp dword [esi + 4], 5
sete al
mov byte [edi + 0x35], al
mov dword [edi + 0x48], 0x6f6ba0
mov dword [edi + 0x50], 0x6f6ba0
mov dword [edi + 0x68], 0
mov dword [edi + 0x74], 0x6f6ba0
mov byte [ebp - 4], 9
call fcn.00429000
push dword [esi + 4]
lea eax, [ebp + 8]
push esi
push eax
call fcn.00428540
add esp, 0xc
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0xa
mov ecx, dword [eax + 0xc]
mov esi, dword [eax + 4]
add ecx, eax
push esi
push ecx
mov ecx, edi
call fcn.00426f20
cmp eax, esi
sete al
mov byte [edi + 0x2e], al
test al, al
jne 0x4206b3
mov byte [edi + 0x2d], al
mov eax, dword [edi + 0x74]
cmp dword [eax + 4], 0
jne 0x4206b3
push str.missing_left_delim
push 0x12
lea ecx, [edi + 0x74]
call fcn.00403500
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
je 0x4206d5
cmp eax, 0xffffffff
je 0x4206e4
mov eax, dword [ebp + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
cmp ecx, 1
setne al
test al, al
jne 0x4206e4
push 4
push 2
push dword [ebp + 8]
call fcn.004016c0
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x436dc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5473d7
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x8870bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
push 8
mov dword [ebp - 4], 0
call fcn.00520ff7
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push dword [ebp + 8]
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0048c280
mov esi, eax
mov byte [ebp - 4], 0
push 1
mov ecx, esi
call fcn.0043d5f0
mov edx, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
call dword [edx + 0x30]
mov dword [edi + 4], esi
mov eax, edi
mov word [edi + 8], 1
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0x13
mov dword [edi + 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x43a7f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x14]
xor eax, eax
cmp edi, 0x20
jb 0x43a865
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], edx
sub dword [esp + 0x14], ecx
mov dword [esp + 8], 0x10
lea esi, [ecx + 0x10]
sub dword [esp + 8], ecx
nop dword [eax]
movups xmm1, xmmword [eax + edx]
mov ecx, dword [esp + 0x14]
add eax, 0x20
movaps xmm0, xmm1
psrlw xmm1, 8
psllw xmm0, 8
movups xmm2, xmmword [ecx + esi]
mov ecx, dword [esp + 8]
pxor xmm0, xmm1
movups xmmword [esi - 0x10], xmm0
movaps xmm0, xmm2
psrlw xmm2, 8
psllw xmm0, 8
pxor xmm0, xmm2
movups xmmword [esi], xmm0
add esi, 0x20
add ecx, esi
cmp ecx, edi
jbe 0x43a820
mov ecx, dword [esp + 0x10]
lea esi, [eax + 0x10]
mov edx, dword [esp + 0x18]
cmp esi, edi
ja 0x43a88f
movups xmm1, xmmword [eax + ecx]
movaps xmm0, xmm1
psrlw xmm1, 8
psllw xmm0, 8
pxor xmm0, xmm1
movups xmmword [eax + edx], xmm0
mov eax, esi
xor esi, esi
cmp eax, edi
jae 0x43a8c1
add edx, eax
sub ecx, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
nop
cmp esi, 0x10
jae 0x43a8c1
mov cx, word [edx + ecx]
add eax, 2
rol cx, 8
add esi, 2
mov word [edx], cx
add edx, 2
mov ecx, dword [esp + 0x10]
cmp eax, edi
jb 0x43a8a0
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x451c60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549210
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x8870bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0x10]
mov esi, dword [ecx + 0xc]
mov dword [ebp - 0x18], esi
test eax, eax
jl 0x451e05
mov ebx, dword [ebp + 0xc]
jg 0x451e05
test ebx, ebx
jb 0x451e05
test eax, eax
jne 0x451e05
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
cmp dword [ecx + 0x60], eax
je 0x451d66
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov byte [ebp - 0xd], 1
push dword [ecx + 0x60]
mov eax, dword [ebp + 8]
sub ebx, esi
push ebx
add eax, esi
push 1
push eax
call fcn.0052d0c8
mov ebx, eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x60]
call fcn.0052cde8
add esp, 0x14
test eax, eax
setne al
cmp byte [ebp - 0xd], 0
mov byte [ebp - 0xe], al
je 0x451d2d
test al, al
je 0x451d2d
test ebx, ebx
jne 0x451d2d
mov eax, dword [ebp - 0x14]
push dword [eax + 0x60]
call fcn.00526979
push ebx
push edx
push eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x60]
call fcn.0052d4bf
mov al, byte [ebp - 0xe]
add esp, 0x14
mov byte [ebp - 0xd], bl
jmp 0x451d32
add esi, ebx
adc edi, 0
test al, al
jne 0x451ded
test ebx, ebx
jne 0x451d50
call fcn.0052c6d9
cmp dword [eax], 4
jne 0x451dbb
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
jmp 0x451cd0
cmp edi, dword [ebp + 0x10]
jg 0x451dbb
jl 0x451d48
mov ebx, dword [ebp + 0xc]
cmp esi, ebx
jae 0x451dbb
mov ecx, dword [ebp - 0x14]
jmp 0x451cd0
cmp dword [ecx + 0x78], 0xffffffff
je 0x451dc1
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov ecx, ebx
mov edx, 0x7fffffff
sub ecx, esi
sbb eax, edi
test eax, eax
ja 0x451d89
jb 0x451d87
cmp ecx, edx
jae 0x451d89
mov edx, ecx
mov eax, dword [ebp + 8]
push edx
add eax, esi
push eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x78]
call fcn.0052dde6
mov ecx, eax
add esp, 0xc
test ecx, ecx
jle 0x451db6
cdq
add esi, eax
mov eax, dword [ebp + 0x10]
adc edi, edx
cmp edi, eax
jl 0x451d72
jg 0x451db6
cmp esi, ebx
jb 0x451d72
cmp ecx, 0xffffffff
jne 0x451ded
mov eax, esi
or eax, edi
jne 0x451ded
or esi, 0xffffffff
lea eax, [ebp + 0x10]
push esi
push eax
or edi, esi
call fcn.00448390
add esp, 8
mov ecx, dword [ebp - 0x18]
push eax
push 1
mov dword [ebp - 4], 1
call fcn.004492c0
lea ecx, [ebp + 0x10]
call fcn.004011e0
mov eax, esi
mov edx, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp + 8]
push 0x16
push eax
call fcn.00448390
add esp, 8
push eax
push 1
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004492c0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
je 0x451e46
cmp eax, 0xffffffff
je 0x451e55
mov eax, dword [ebp + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
cmp ecx, 1
setne al
test al, al
jne 0x451e55
push 4
push 2
push dword [ebp + 8]
call fcn.004016c0
add esp, 0xc
or eax, 0xffffffff
or edx, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x452410
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5492e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x8870bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x10]
mov ebx, dword [ecx + 0xc]
mov dword [ebp - 0x14], ebx
test edx, edx
jl 0x45258d
mov esi, dword [ebp + 0xc]
jg 0x45258d
test esi, esi
jb 0x45258d
test edx, edx
jne 0x45258d
xorps xmm0, xmm0
mov eax, esi
or eax, edx
movlpd qword [ebp - 0x1c], xmm0
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
je 0x45256e
cmp dword [ecx + 0x60], edx
je 0x4524c2
push dword [ecx + 0x60]
mov eax, esi
sub eax, edi
push eax
mov eax, dword [ebp + 8]
add eax, edi
push 1
push eax
call fcn.0052d6f9
add esp, 0x10
add edi, eax
adc ebx, 0
test eax, eax
jne 0x4524b2
call fcn.0052c6d9
mov ecx, dword [ebp - 0x10]
cmp dword [eax], 4
jne 0x45250f
jmp 0x452482
cmp ebx, dword [ebp + 0x10]
jg 0x45250c
jl 0x4524bd
cmp edi, esi
jae 0x45250c
mov ecx, dword [ebp - 0x10]
jmp 0x452482
cmp dword [ecx + 0x78], 0xffffffff
je 0x45250f
mov ecx, esi
mov eax, edx
sub ecx, edi
mov edx, 0x7fffffff
sbb eax, ebx
test eax, eax
ja 0x4524e1
jb 0x4524df
cmp ecx, edx
jae 0x4524e1
mov edx, ecx
mov eax, dword [ebp + 8]
push edx
add eax, edi
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 0x78]
call fcn.0052ea28
add esp, 0xc
test eax, eax
jle 0x45250c
cdq
add edi, eax
adc ebx, edx
mov edx, dword [ebp + 0x10]
cmp ebx, edx
jl 0x4524c8
jg 0x45250c
cmp edi, esi
jb 0x4524c8
mov ecx, dword [ebp - 0x10]
mov eax, edi
or eax, ebx
jne 0x45256e
or edi, 0xffffffff
lea eax, [ebp + 0x10]
push edi
push eax
or ebx, edi
call fcn.00448390
add esp, 8
mov esi, eax
mov dword [ebp - 4], 1
call fcn.0052c6d9
mov ecx, dword [ebp - 0x14]
xor edx, edx
push esi
cmp dword [eax], 0x1c
sete dl
lea edx, [edx*2 + 2]
push edx
call fcn.004492c0
lea ecx, [ebp + 0x10]
call fcn.004011e0
mov eax, edi
mov edx, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
and dword [ecx + 0x28], 0xffdfffff
mov eax, edi
mov edx, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp + 8]
push 0x16
push eax
call fcn.00448390
add esp, 8
push eax
push 2
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.004492c0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
je 0x4525ce
cmp eax, 0xffffffff
je 0x4525dd
mov eax, dword [ebp + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
cmp ecx, 1
setne al
test al, al
jne 0x4525dd
push 4
push 2
push dword [ebp + 8]
call fcn.004016c0
add esp, 0xc
or eax, 0xffffffff
or edx, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc