joyce8/EMBER2024-capa huggingface dataset:
Function at 0x666948
Capabilities:
Execute anti-debugging instructions

Disassembly:
int1
xchg edx, eax
mov dl, 0xc3
jne 0x4c6a4d
retf 0xa84e
jmp fcn.006029dc
jmp 0x4d92ea
sbb al, byte [ebp + 0x4887e9ff]
invalid
test dl, bh
adc al, byte [eax]
mov dword [esp + 0x14], edi
cmovb cx, sp
movzx ecx, cx
mov dword [esp + 0x10], 0x10161f7c
xchg ecx, ecx
mov ecx, edi
movsx cx, bh
push eax
mov ch, bh
movsx ecx, cx
lea ecx, [esp + 0x14]
jmp 0x6651d5
je 0x5e4d0d
mov eax, 2
ret
shr eax, 0x11
test bl, 0x6d
cmp edi, 0x74f4181c
and eax, 1
jmp 0x507fc7
test ah, 0x80
jmp 0x5e022b
jne 0x4fc848
mov al, byte [ebp + 0x14]
stc
clc
mov byte [edx], al
cmc
mov eax, dword [ebx]
test ax, si
stc
cmp edx, eax
ja 0x4fc82d
cmp esi, eax
jmp 0x4c6a8f
sbb al, byte [eax]
add byte [eax], al
aam 0xd8
or eax, 0x1b10
add dl, ah
fmul dword [0x1c10]
add al, dh
fmul dword [0x1d10]
add dh, bh
fmul dword [0x1e10]
add byte [ecx + ebx*8], cl
or eax, 0x58e95710
fdiv st(7), st(0)
inc dword [ebp - 0x39c4060c]
jae 0x643d4c
cmp byte [eax], 0
jmp fcn.004a61c2
mov eax, dword [ecx]
test eax, 0x10000
je 0x5f40b5
mov eax, 3
jmp fcn.00502540

Function at 0x667236
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
sbb al, 0
bswap eax
mov ebp, esp
or ah, bl
movzx ax, ch
and ah, 0x22
push ecx
push ecx
sar al, cl
push ebx
push esi
mov esi, ecx
test ah, 0x7e
shr bl, cl
not cl
mov eax, dword [ebp + 8]
ror ebx, cl
btc cx, 0xde
movzx ebx, di
push edi
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x28]
mov bx, 0x5d8
adc ebx, ecx
lea ebx, [esi + 0x28]
test esi, 0x554242b8
clc
cmc
sub edi, ecx
lea eax, [eax + edi]
cmp sp, 0x2afd
cmp dword [esi + 8], 0
jmp 0x4b528f
Function at 0xff2c74
Capabilities:
Encode data using xor

Disassembly:
jmp 0xff2c7e
pushal
call 0xff2c84
pop ebp
sub ebp, 0x10
sub ebp, 0xbf2c74
jmp 0xff2c9a
mov eax, 0xbf2c74
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ca
mov edx, 0x273c7f6f
xor byte [eax], dl
inc eax
dec ecx
jne 0xff2cb1
jmp 0xff2cc4
in al, 0xa2
in al, 0xe6
push ebx
outsd dx, dword [esi]
outsd dx, dword [esi]
outsd dx, dword [esi]
out dx, al
scasb al, byte es:[edi]
xchg edi, eax
outsd dx, dword [esi]
outsd dx, dword [esi]
outsd dx, dword [esi]
insb byte es:[edi], dx
mov byte [0x6f6f6bd7], al
outsd dx, dword [esi]
aad 0x47
outsd dx, dword [esi]
outsd dx, dword [esi]
outsd dx, dword [esi]
cwde
lea ebp, [edi - 0x1c]
out dx, al
arpl word [edi + 0x6f], bp
outsd dx, dword [esi]
insb byte es:[edi], dx
stosb byte es:[edi], al
loop 0xff2cf7
dec ebx
xchg ebx, eax
out 0x6b, al
dec ebx
aas
pop es
invalid
pop es
cmpsb byte [esi], byte es:[edi]
or al, 0xf2
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ebx
dec ebx
pop es
invalid
Function at 0x130b470
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0xe1b015
lea edi, [esi - 0xa1a015]
push edi
or ebp, 0xffffffff
jmp 0x130b492
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x130b499
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x130b488
mov eax, 1
add ebx, ebx
jne 0x130b4ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x130b4bc
jne 0x130b4db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x130b4db
dec eax
add ebx, ebx
jne 0x130b4c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x130b4a0
add ebx, ebx
jne 0x130b4d7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x130b52d
xor ecx, ecx
sub eax, 3
jb 0x130b4f3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x130b562
sar eax, 1
mov ebp, eax
jmp 0x130b4fe
add ebx, ebx
jne 0x130b4fe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x130b4cc
inc ecx
add ebx, ebx
jne 0x130b50c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x130b4cc
add ebx, ebx
jne 0x130b519
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x130b50e
jne 0x130b52a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x130b50e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x130b54c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x130b53e
jmp 0x130b48e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x130b54c
add edi, ecx
jmp 0x130b48e
pop esi
mov edi, esi
mov ecx, 0x27050
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x130b56a
cmp byte [edi], 0x57
jne 0x130b56a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x130b56f
lea edi, [esi + 0xee6000]
mov eax, dword [edi]
or eax, eax
je 0x130b5de
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf0b000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf0b028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x130b59c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf0b030]
or eax, eax
je 0x130b5d8
mov dword [ebx], eax
add ebx, 4
jmp 0x130b5b9
call dword [esi + 0xf0b02c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x130b618
cmp al, 0xef
ja 0x130b602
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x130b5e4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
or eax, eax
jne 0x130b5f1
mov eax, dword [edi]
add edi, 4
jmp 0x130b5f1
mov ebp, dword [esi + 0xf0b034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x130b64c
sub esp, 0xffffff80
jmp 0x459150
Function at 0x41b0d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [ebp + 4]
xor eax, dword [0x66d060]
mov dword [ebp - 4], eax
add esp, 0xfffffff4
lea eax, [ebp - 0x40]
mov dword [esp], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.005c46dd
add esp, 0xc
add esp, 0xfffffff4
lea eax, [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.005c46dd
add esp, 0xc
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
jae 0x41b161
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + eax]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + edx]
xor eax, edx
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x20], al
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
jb 0x41b139
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x12
jae 0x41b1c6
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
cmp eax, 0x30
jae 0x41b1af
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x40]
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx + str._.C]
xor eax, edx
movzx eax, al
mov edx, dword [ebp - 8]
mov byte [ebp + edx - 0x40], al
movzx eax, al
mov dword [ebp - 0xc], eax
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, 0x30
jb 0x41b180
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
movzx eax, al
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 0x12
jb 0x41b171
add esp, 0xfffffff4
mov eax, dword [ebp + 8]
mov dword [esp], eax
lea eax, [ebp - 0x40]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x10
call fcn.005c46dd
add esp, 0xc
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 0xf]
movzx eax, al
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
jae 0x41b242
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + eax]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + edx]
movzx edx, dl
xor edx, dword [ebp - 0xc]
movzx edx, byte [edx + str._.C]
xor eax, edx
movzx eax, al
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [ecx + edx], al
movzx eax, al
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
jb 0x41b202
add esp, 0xfffffff4
lea eax, [ebp - 0x40]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x30
call fcn.005c46e7
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [ebp + 4]
xor eax, dword [ebp - 4]
mov ecx, eax
call fcn.0055337c
leave
ret
Function at 0x41b278
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x18], eax
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x67452301
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0x10325476
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
call fcn.00437582
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, 0x17
jne 0x41b2db
mov eax, dword [ebp + 8]
mov dword [eax], 0x41b618
jmp 0x41b2e4
mov eax, dword [ebp + 8]
mov dword [eax], 0x4378e0
leave
ret
Function at 0x41d2c0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x6a09e667
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xbb67ae85
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x3c6ef372
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xa54ff53a
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x510e527f
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x9b05688c
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0x1f83d9ab
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0x5be0cd19
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x20], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x68], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x6c], fcn.0041dae6
leave
ret
Function at 0x41fc84
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov edx, dword [ebp + 8]
mov dword [edx + 0xd0], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0xcc], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0xc8], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0xc4], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0xc0], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0xcbbb9d5d
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xc1059ed8
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x629a292a
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x367cd507
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x9159015a
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x3070dd17
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0x152fecd8
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0xf70e5939
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0x67332667
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], 0xffc00b31
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0x8eb44a87
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0x68581511
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], 0xdb0c2e0d
mov eax, dword [ebp + 8]
mov dword [eax + 0x34], 0x64f98fa7
mov eax, dword [ebp + 8]
mov dword [eax + 0x38], 0x47b5481d
mov eax, dword [ebp + 8]
mov dword [eax + 0x3c], 0xbefa4fa4
leave
ret

Function at 0x41fdd8
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov edx, dword [ebp + 8]
mov dword [edx + 0xd0], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0xcc], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0xc8], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0xc4], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0xc0], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0x6a09e667
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xf3bcc908
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0xbb67ae85
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x84caa73b
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x3c6ef372
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0xfe94f82b
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0xa54ff53a
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0x5f1d36f1
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0x510e527f
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], 0xade682d1
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0x9b05688c
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0x2b3e6c1f
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], 0x1f83d9ab
mov eax, dword [ebp + 8]
mov dword [eax + 0x34], 0xfb41bd6b
mov eax, dword [ebp + 8]
mov dword [eax + 0x38], 0x5be0cd19
mov eax, dword [ebp + 8]
mov dword [eax + 0x3c], 0x137e2179
leave
ret
Function at 0x426aec
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 4]
xor eax, dword [0x66d060]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x58], 0
mov eax, dword [ebp + 0xc]
add eax, eax
add eax, eax
add eax, eax
mov dword [ebp - 0x54], eax
add esp, 0xffffffe8
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [ebp - 0x54]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x50]
mov dword [esp + 0x14], eax
call fcn.00426e72
add esp, 0x18
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x426c5e
add esp, 0xffffffe8
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [ebp - 0x54]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x38]
mov dword [esp + 0x14], eax
call fcn.00426e72
add esp, 0x18
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x426c5e
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
cmp eax, 0x14
jae 0x426bd2
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x50]
mov edx, dword [ebp - 0x24]
movzx edx, byte [ebp + edx - 0x38]
xor eax, edx
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x50], al
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, 0x14
jb 0x426bae
movzx eax, byte [ebp - 0x50]
or eax, 0xffffff80
mov byte [ebp - 0x50], al
movzx eax, byte [ebp - 0x3d]
or eax, 0xffffff01
mov byte [ebp - 0x3d], al
add esp, 0xfffffff4
lea eax, [ebp - 0x50]
mov dword [esp], eax
mov dword [esp + 4], 0x14
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
call fcn.0043f738
add esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x426c5e
add esp, 0xffffffec
mov dword [esp], 1
mov dword [esp + 4], 0x28
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
lea eax, [ebp - 0x58]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], eax
call fcn.00440ea4
add esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x10]
cmp eax, edx
je 0x426c5e
xor eax, eax
test eax, eax
jne 0x426b11
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x426c80
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + 4]
xor eax, dword [ebp - 0x20]
mov ecx, eax
call fcn.0055337c
mov eax, dword [ebp - 8]
leave
ret
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x426c90
mov dword [ebp - 0xc], 0
jmp 0x426c97
mov dword [ebp - 0xc], 8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + 4]
xor eax, dword [ebp - 0x20]
mov ecx, eax
call fcn.0055337c
mov eax, dword [ebp - 4]
leave
ret
Function at 0x42da80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42daa9
mov eax, 0x801
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, 0x80
je 0x42dabc
mov byte [ebp - 0xc], 0xff
jmp 0x42dac0
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
cmp eax, 1
jbe 0x42db13
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movzx eax, al
movzx edx, byte [ebp - 0xc]
movzx edx, dl
cmp eax, edx
jne 0x42db13
movzx eax, byte [ebp - 0xc]
movzx eax, al
xor edx, edx
cmp eax, 0xff
sete dl
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 1]
test eax, 0x80
mov eax, 0
setne al
xor edx, eax
jne 0x42db13
dec dword [ebp - 0x10]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp eax, 1
ja 0x42dac8
mov eax, dword [ebp - 0x10]
cmp eax, 4
jbe 0x42db25
mov eax, 0x801
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
cmp eax, edx
jae 0x42db71
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + edx]
movzx edx, dl
mov ecx, dword [ebp - 8]
neg ecx
mov ebx, dword [ebp - 0x10]
lea ecx, [ebx + ecx - 1]
add ecx, ecx
add ecx, ecx
add ecx, ecx
shl edx, cl
or edx, dword [eax]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
cmp eax, edx
jb 0x42db39
mov eax, dword [ebp - 8]
cmp eax, 4
jae 0x42dba0
mov eax, dword [ebp + 0xc]
movzx edx, byte [ebp - 0xc]
movzx edx, dl
mov ecx, dword [ebp - 8]
add ecx, ecx
add ecx, ecx
add ecx, ecx
shl edx, cl
or edx, dword [eax]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, 4
jb 0x42db79
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x438f00
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00437582
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp eax, 3
je 0x438f41
mov eax, dword [ebp - 4]
cmp eax, 6
jb 0x438f2f
mov eax, dword [ebp - 4]
cmp eax, 7
jbe 0x438f4d
mov eax, dword [ebp - 4]
cmp eax, 0x17
je 0x438f59
mov eax, dword [ebp - 4]
cmp eax, 0x28
je 0x438f59
jmp 0x438f65
mov eax, dword [ebp + 8]
mov dword [eax + 0x5c], 0x445d90
jmp 0x438f6f
mov eax, dword [ebp + 8]
mov dword [eax + 0x5c], 0x447020
jmp 0x438f6f
mov eax, dword [ebp + 8]
mov dword [eax + 0x5c], 0x4393ee
jmp 0x438f6f
mov eax, dword [ebp + 8]
mov dword [eax + 0x5c], 0x4480d0
xor eax, eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x18], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0xc3d2e1f0
leave
ret
Function at 0x45c990
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ef068
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x66d060]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x66d060]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.0045f9d0
push dword [ebp + 0xc]
lea eax, [esp + 0x2c]
push dword [ebp + 8]
push eax
call fcn.0045c8b0
add esp, 0x24
mov dword [esp + 0x38], 0
cmp dword [eax + 0x14], 0x10
jb 0x45ca0d
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, esi
lea eax, [esp + 0xc]
push eax
call fcn.0055342f
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x45ca36
push dword [esp + 0x10]
call fcn.00496180
add esp, 4
mov ecx, dword [ebp + 8]
mov eax, esi
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi], vtable.std::_System_error.0
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0055337c
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45ffa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ef5e0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x66d060]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 0xc]
add ecx, esi
and eax, 0xfffffffe
cmp dword [ecx + 0x38], 0
jne 0x45ffe3
or eax, 4
push 0
push eax
call fcn.0045cce0
mov eax, dword [esi]
mov dword [esp + 0xc], esi
mov eax, dword [eax + 4]
mov ecx, dword [eax + esi + 0x38]
test ecx, ecx
je 0x460001
mov eax, dword [ecx]
call dword [eax + 4]
push 1
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0045fcd0
mov byte [esp + 0x10], al
mov dword [esp + 0x38], 1
mov eax, dword [esi]
mov eax, dword [eax + 4]
test byte [eax + esi + 0xc], 6
jne 0x460082
mov ecx, dword [eax + esi + 0x38]
lea edx, [esp + 0x14]
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ecx]
push dword [ebp + 8]
push edx
call dword [eax + 0x28]
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
adc ecx, dword [esp + 0x20]
cmp eax, dword [0x621e68]
jne 0x460082
cmp ecx, dword [0x621e6c]
jne 0x460082
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 0xc]
add ecx, esi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x46007a
or eax, 4
push 0
push eax
call fcn.0045cce0
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov ecx, dword [eax + esi + 0x38]
test ecx, ecx
je 0x46009c
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc