joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006ae0
Capabilities:
Encode data using xor

Disassembly:
push ebx
movzx ebx, word [esp + 0xc]
mov eax, ebx
imul eax, ebx
push esi
mov esi, dword [esp + 0xc]
push edi
sub dword [esi + 0x164], eax
mov eax, ebx
mov ecx, dword [esi + 0x2c]
xor eax, 0x31b0
add dword [esi + 0x24], eax
mov eax, dword [esi + 8]
add dword [esi + 0xc], 0x3524
add eax, 0x2ff7
mov edi, dword [esi + 0xa8]
add dword [ecx + 0x18c], eax
cmp dword [esi + 0x40], 0x3451
jae 0x10006b32
mov dword [esi + 0x160], 0x2dad
test edi, edi
je 0x10006bef
mov eax, dword [esi + 0x178]
mov ecx, dword [eax + 0x1e8]
mov eax, dword [esi + 0x38]
add ecx, 0x1d7
mov eax, dword [eax + 0x1e8]
xor eax, 0x25a
cmp ecx, eax
jbe 0x10006b68
or dword [esi + 0x124], 0xa506cc0
mov ecx, dword [esi + 0x60]
mov eax, dword [esi + 0x124]
imul eax, ecx
mov dword [esi + 0x124], eax
lea eax, [ecx + 1]
mov ecx, dword [esi + 0x1c4]
add ecx, 0x3ac
mov dword [esi + 0x60], eax
cmp ecx, 0x355c
jb 0x10006bb0
mov eax, dword [esi + 0x98]
add ecx, 0xffffcaa5
xor eax, 0x5fbc
sub ecx, 1
jne 0x10006ba0
mov dword [esi + 0x98], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ecx, dword [esi + 0x38]
mov edx, eax
mov ecx, dword [ecx + 0x120]
sub ecx, ebx
xor dword [esi + 0x98], ecx
cmp dword [esi + 0xc], 0x355c
jbe 0x10006be1
mov ecx, dword [esi + 0x178]
lea eax, [esi + 0xac]
add dword [ecx + 0x30], eax
test edx, edx
je 0x10006bef
push edi
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
ret

Function at 0x10006e00
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov ecx, dword [eax + 0x38]
push edi
xor edi, edi
mov ecx, dword [ecx + 0x1c4]
sub ecx, 0x30b2
cmp dword [eax + 0x228], ecx
jbe 0x10006e8b
mov ecx, dword [eax + 0xa4]
mov esi, dword [eax + 0x228]
mov edx, dword [eax + 0x224]
imul ecx, ebx
xor dword [eax + 0x18c], ecx
mov ecx, dword [eax + 0x204]
mov cl, byte [esi + ecx]
mov byte [edx], cl
mov edx, dword [eax + 0x228]
mov ecx, dword [eax + 0x200]
inc dword [eax + 0x224]
mov esi, dword [ecx + edx*4]
mov ecx, edi
mov edx, dword [eax + 0x1e8]
inc edi
sub edx, 0x1ff9
mov dword [eax + 0x228], esi
cmp ecx, edx
jae 0x10006ee6
mov ecx, dword [eax + 0x38]
mov ecx, dword [ecx + 0x1c4]
sub ecx, 0x30b2
cmp esi, ecx
ja 0x10006e24
mov edx, dword [eax + 0x108]
mov ecx, dword [edx + 0x84]
add ecx, 0x49c
cmp ecx, 0x2ff7
ja 0x10006ebb
mov ecx, dword [eax + 0x2c]
mov ecx, dword [ecx + 0x1a4]
xor ecx, 0x2d89
imul ecx, dword [edx + 0x4c]
mov dword [edx + 0x4c], ecx
mov edx, dword [eax + 0x224]
or dword [eax + 0x7c], 0x1001d5f6
imul ecx, ebx, 0x31b0
pop edi
pop esi
pop ebx
or dword [eax + 0x134], ecx
mov cl, byte [eax + 0x228]
mov byte [edx], cl
mov eax, dword [eax + 0x224]
ret
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10007c70
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x40]
add dword [esp + 0x2c], 0x362
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [ecx + 0x565]
push edi
mov edi, dword [esp + 0x28]
add ebx, 0xfffffb31
mov dword [esp + 0x28], eax
add edi, 0x5d5
mov eax, dword [esp + 0x10]
add ebp, 0xfffffae3
add eax, 0xffffcd36
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
lea eax, [edi - 0x1c2]
cmp ecx, eax
jge 0x10007e34
lea eax, [ecx + 0x45a]
push esi
mov esi, dword [esp + 0x30]
cmp ebp, eax
jg 0x10007d9e
push 0x3451
push esi
call fcn.10006ae0
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
add eax, 0xffffff81
push eax
mov edi, dword [esp + 0x28]
push esi
push ebx
mov ecx, dword [esp + 0x54]
lea eax, [edx + 0x2efc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebx + 0x3f0]
push eax
lea eax, [edi + 0x139]
push eax
mov eax, dword [esp + 0x74]
add eax, 0xfffffdb6
push eax
lea eax, [edx + 0x3451]
push eax
lea eax, [edi - 0x6b]
push eax
mov eax, dword [esp + 0x6c]
add eax, 0x44d
push eax
lea eax, [edi - 0x2b7]
push eax
lea eax, [ecx - 0x24]
push eax
lea eax, [ecx + 0x5c5]
push eax
push edi
call fcn.10001d40
mov eax, dword [esi + 0x170]
add esp, 0x44
push 0
push 1
push dword [esi + 0x48]
call eax
mov dword [esi + 0x168], eax
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x120]
or eax, 0x3233
or dword [ecx + 0x4c], eax
mov eax, dword [esi + 0x1b8]
cmp eax, dword [esi + 0xe8]
je 0x10007e33
mov eax, dword [esi + 0xc]
or eax, 0x3524
sub dword [esi + 0x14c], eax
lea eax, [ebx + 0x4cf]
pop esi
pop edi
pop ebp
pop ebx
ret
mov edx, dword [esi + 0x1e8]
mov ecx, edi
imul edx, dword [esp + 0x2c]
cmp edi, edx
jb 0x10007dc7
mov ebx, dword [esi + 0xc]
inc ebx
imul edi, ebx
add ecx, 2
add edi, dword [esi + 0x1e8]
cmp ecx, edx
jae 0x10007db3
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
add ecx, 0xfffffcc3
imul eax, ecx
and eax, dword [esp + 0x3c]
or ebp, eax
imul eax, dword [esi + 0x120], 0x2dad
cmp edi, eax
jbe 0x10007e33
nop dword [eax]
mov eax, dword [esi + 0x134]
xor eax, dword [esi + 0x1e8]
add eax, dword [esi + 0x74]
xor ebx, eax
mov eax, ebx
sub eax, ebp
xor eax, 0x3372
or dword [esi + 0x30], eax
mov eax, dword [esi + 0x58]
add eax, 0x2d89
xor eax, dword [esi + 0xe8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
imul eax, dword [esi + 0x120], 0x2dad
add edi, 3
cmp edi, eax
ja 0x10007df0
pop esi
pop edi
pop ebp
lea eax, [ebx + 0x4cf]
pop ebx
ret
Function at 0x10009e40
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x24]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
lea eax, [ecx - 0x3239]
mov dword [esp + 0x24], eax
lea ebx, [edx - 0x3233]
mov eax, dword [esp + 0x14]
lea ebp, [edx + 6]
push edi
mov edi, dword [esp + 0x30]
add ecx, 0xfffffb74
add edi, 0xfffffa26
mov dword [esp + 0x34], ecx
add eax, 0xffffcf15
mov dword [esp + 0x1c], edi
add esi, 0x52d
cmp ecx, eax
je 0x1000a024
lea eax, [ebp - 0x2b7]
cmp dword [esp + 0x28], eax
je 0x10009ffd
mov edi, dword [esp + 0x44]
push 0x1001d830
push 0x6c
push 0xe0
mov eax, dword [edi + 0x10c]
imul eax, dword [eax + 0x1e8], 0xc3da0e38
push eax
push 0x960
push edi
push 0x2d9d
push 0x31b0
push 0x3451
push 0x3233
call fcn.10007570
mov ecx, dword [esp + 0x44]
add esi, 0xfffffee6
mov dword [edi + 0x100], eax
lea eax, [ebx + 0x3372]
push eax
push dword [esp + 0x70]
mov eax, dword [esp + 0x64]
lea edi, [ebx + 0x31ce]
add eax, 0x777
push eax
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebx + 0x3239]
push eax
lea eax, [ecx + 0x2b7]
push eax
push edi
lea eax, [ecx - 0x1e5]
push eax
lea eax, [ebp + 0x323]
push eax
mov eax, dword [esp + 0x74]
add eax, 0x310f
push esi
push eax
lea eax, [ecx - 0x86]
push eax
lea eax, [ecx + 0x348]
push eax
call fcn.10005800
mov ebx, dword [esp + 0xa0]
add esp, 0x5c
mov ecx, dword [ebx + 0x100]
mov dword [ebx + 0xa8], ecx
mov ecx, dword [ebx + 0x140]
add ecx, 0x2efc
mov dword [ebx + 0x68], ecx
mov ecx, dword [ebx + 0x174]
mov edx, ecx
or edx, 0x3524
add edx, ecx
mov dword [ebx + 0x174], edx
cmp eax, edi
jl 0x1000a07c
mov eax, dword [ebx + 0x10c]
push str.G__2_EGE6B68E11.EB9__E___2__:w_3BF
push 0x4b
push 0xfd
mov eax, dword [eax + 0x84]
sub eax, 0x2d98
push eax
push 0x53a0
push ebx
push 0x31ce
push 0x2dad
push 0x3524
push 0x2d89
call fcn.10007570
mov dword [ebx + 0x100], eax
add esp, 0x28
mov eax, dword [ebx + 0x7c]
cmp eax, dword [ebx + 0x60]
jbe 0x1000a07c
mov eax, dword [ebx + 8]
pop edi
xor eax, 0x355c
mov dword [ebx + 0x14c], eax
lea eax, [ebp + 0x91]
pop esi
pop ebp
pop ebx
ret
or ebx, 0x31b0
cmp esi, ebx
jne 0x1000a07c
xor edi, 0x2d89
nop dword [eax]
add esi, 4
add ebp, edi
cmp esi, ebx
je 0x1000a010
pop edi
pop esi
lea eax, [ebp + 0x91]
pop ebp
pop ebx
ret
mov edi, dword [esp + 0x44]
mov eax, dword [edi + 0xa4]
add eax, dword [edi + 0x40]
cmp esi, eax
ja 0x1000a07c
mov eax, dword [edi + 0x15c]
xor eax, dword [edi + 0x1c4]
and eax, 0x2d9d
push eax
lea eax, [ebx + 0x2efc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [edi + 0x34]
or eax, dword [esp + 0x28]
or dword [edi + 0x7c], eax
mov eax, dword [edi + 0x1c4]
xor eax, 0xfffff77e
and eax, 0x2d9d
cmp dword [edi + 0x7c], eax
jne 0x1000a07c
xor ebx, 0x31ce
sub dword [edi + 0x60], ebx
pop edi
pop esi
lea eax, [ebp + 0x91]
pop ebp
pop ebx
ret
Function at 0x1000b6e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x10]
add dword [esp + 0x30], 0xffffcd36
add edx, 0x1b2
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
add ebx, 0xfffffeb1
add ebp, 0xffffcbaf
mov dword [esp + 0x18], ebp
push esi
lea esi, [eax - 0x5a2]
cmp ebp, eax
jg 0x1000b843
mov ecx, dword [esp + 0x14]
lea eax, [ebp + 0x2d89]
add ecx, 0xffffd104
cmp ecx, eax
jg 0x1000b784
mov esi, dword [esp + 0x24]
push 0x2ff7
push 0x3524
push 0x31b0
push esi
push 0x31b0
push 0x3372
call fcn.1000c360
mov dword [esi + 0x204], eax
add esp, 0x18
mov eax, dword [esi + 0x84]
add eax, 0x1ceb9
mov dword [esi + 0xa8], eax
lea eax, [ebp + 0x2dad]
add dword [esi + 0x94], 0xd3
pop esi
pop ebp
pop ebx
ret
push edi
mov edi, dword [esp + 0x28]
mov eax, ebx
or eax, 0x355c
cmp dword [edi + 0x50], eax
jae 0x1000b7ef
mov eax, dword [edi + 0xd8]
add eax, 0x32ca
cmp edx, eax
je 0x1000b7d7
add esi, 0x34dd
cmp edx, esi
jl 0x1000b842
mov ecx, dword [edi + 0xe8]
mov eax, dword [edi + 0x60]
and ecx, ebx
add ecx, dword [edi + 8]
add edx, 4
xor eax, ecx
cmp edx, esi
jge 0x1000b7c0
mov dword [edi + 0x60], eax
lea eax, [ebp + 0x2dad]
pop edi
pop esi
pop ebp
pop ebx
ret
xor esi, 0x2d89
lea eax, [ebp + 0x2dad]
imul esi, dword [edi + 0x58]
sub dword [edi + 8], esi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ebx, dword [edi + 0xd8]
mov ebp, ebx
or ebp, dword [esp + 0x20]
mov eax, dword [edi + 0x108]
cmp eax, ebp
ja 0x1000b83e
sub ebx, esi
sub ebp, eax
and ebx, dword [edi + 0xc]
inc ebp
nop dword [eax]
mov eax, dword [edi + 0x140]
cmp eax, ebx
jb 0x1000b839
mov esi, dword [edi + 0x44]
xor esi, dword [esp + 0x40]
mov edx, dword [edi + 0x108]
lea ecx, [esi + edx]
add eax, 4
xor edx, ecx
cmp eax, ebx
jae 0x1000b827
mov dword [edi + 0x108], edx
sub ebp, 1
jne 0x1000b810
mov ebp, dword [esp + 0x20]
pop edi
pop esi
lea eax, [ebp + 0x2dad]
pop ebp
pop ebx
ret
Function at 0x1000c360
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov eax, dword [esi + 0x10c]
mov edi, dword [esi + 0xa8]
mov eax, dword [eax + 0x58]
sub eax, 0x3451
cmp edi, eax
jne 0x1000c391
mov eax, dword [esi + 0x38]
movzx ecx, word [esp + 0x20]
pop edi
sub ecx, dword [eax + 0x6c]
add dword [esi + 8], ecx
xor eax, eax
pop esi
ret
push ebx
push ebp
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, eax
mov edx, 0x2efc
mov eax, dword [esi + 0x108]
mov eax, dword [eax + 0x1c4]
xor eax, 0x1f4c
cmp eax, edx
jb 0x1000c3ec
nop word [eax + eax]
mov eax, dword [esi + 0x108]
inc edx
mov ecx, dword [esi + 0x38]
imul eax, dword [eax + 0x124], 0x3524
xor dword [ecx + 0x7c], eax
mov eax, dword [esi + 0x108]
mov eax, dword [eax + 0x1c4]
xor eax, 0x1f4c
cmp edx, eax
jbe 0x1000c3c0
test ebx, ebx
je 0x1000c457
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [esi + 0x2c]
mov edx, 0x355c
mov ebp, eax
imul ecx, dword [ecx + 0x58], 0xa037a94d
cmp ecx, edx
je 0x1000c431
nop
mov ecx, dword [esi + 0x108]
inc edx
mov eax, dword [ecx + 0xc]
add dword [esi + 0x94], eax
inc dword [ecx + 0xc]
mov eax, dword [esi + 0x2c]
imul eax, dword [eax + 0x58], 0xa037a94d
cmp edx, eax
jne 0x1000c410
mov eax, dword [esi + 0x38]
push edi
add dword [eax + 0x140], 0xf6ae080e
mov eax, dword [esi + 0x38]
mov eax, dword [eax + 0x84]
sub eax, 0x2d9d
push eax
push ebp
call fcn.10007e6b
add esp, 0xc
mov ecx, dword [esi + 0xc]
cmp dword [esi + 0x1c4], ecx
jne 0x1000c473
mov eax, dword [esi + 0x1b4]
add eax, 0x31ce
xor dword [esi + 0x1a4], eax
lea eax, [ecx - 0x2f82]
mov dword [esi + 0xc], eax
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x1000d9a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x18]
add edx, 0xffffd104
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x3c]
push edi
mov edi, dword [esp + 0x18]
lea eax, [ebp - 0x18d]
cmp edx, eax
jg 0x1000da0b
cmp edx, edi
jg 0x1000da0b
lea eax, [ebx - 6]
push eax
lea ecx, [ebp - 0x213]
push ecx
lea eax, [ebx + 0x91]
push eax
lea eax, [ebx + 0x2a4]
push eax
lea eax, [ebp + 0x342]
push eax
push ecx
push esi
lea eax, [edi - 0x337]
push eax
lea eax, [edx + 0x31ce]
push eax
lea eax, [ebx + 0x91]
push eax
call fcn.10006810
add esp, 0x28
mov ebx, dword [esp + 0x30]
lea eax, [edi - 0x23c]
cmp ebx, eax
jg 0x1000dae6
mov ebp, dword fs:[0]
mov eax, dword [esi + 0x84]
xor eax, 0x21f
mov dword [esi + 0x1f4], ebp
cmp eax, 0x31ce
jae 0x1000da50
mov eax, dword [esi + 0x108]
mov eax, dword [eax + 0x124]
sub eax, 0x310f
mov dword [esi + 8], eax
mov edi, dword [esi + 0x2c]
mov edx, 0x2efc
mov eax, dword [edi + 0x1c4]
xor eax, 0x1f4d
cmp eax, edx
jb 0x1000da8c
mov ecx, dword [esi + 0x160]
nop dword [eax]
xor ecx, 0xffffff77
inc edx
mov dword [esi + 0x160], ecx
mov eax, dword [edi + 0x1c4]
xor eax, 0x1f4d
cmp edx, eax
jbe 0x1000da70
mov ecx, dword [esi + 0x1a8]
cmp dword [ebp + 4], ecx
jb 0x1000dacf
mov edx, dword [esi + 0x1f0]
add edx, ecx
nop
mov eax, dword [esi + 0x1f4]
cmp dword [eax + 4], edx
jae 0x1000dacf
mov eax, dword [esi + 0x194]
sub eax, 0x34dd
xor dword [esi + 0xd8], eax
mov eax, dword [esi + 0x1f4]
mov eax, dword [eax]
mov dword [esi + 0x1f4], eax
cmp dword [eax + 4], ecx
jae 0x1000daa0
mov eax, dword [esi + 0xf0]
mov ecx, eax
xor ecx, 0x31b0
imul ecx, eax
mov dword [esi + 0xf0], ecx
pop edi
pop esi
pop ebp
lea eax, [ebx + 0x386]
pop ebx
ret
Function at 0x4095f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push eax
push ecx
nop
push edx
push ebx
push esp
push ebp
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x64
push ebx

Function at 0x409600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, 7
mov dword [ebp - 0xc], 0xa
mov esi, 0xe
mov dword [ebp - 8], 9
mov eax, esi
add eax, dword [ebp - 8]
sub eax, 0x17
mov dword [ebp - 0x24], eax
and dword [ebp - 0x28], 0
jmp 0x409695
add dword [ebp - 0x28], 0x7ef
mov dword [ebp - 0x20], 0x4f213076
mov dword [ebp - 0x24], 0x10b1
jmp 0x40969e
dec dword [ebp - 0x20]
mov eax, dword [ebp - 8]
sub eax, 9
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], 0x490000
mov dword [ebp - 0x2c], 0x46c6c0
mov eax, edi
add eax, esi
sub eax, 0x12
mov dword [ebp - 0x10], eax
jmp 0x40967c
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x28]
movzx edx, byte [eax]
movzx ecx, byte [ebp - 0x20]
xor edx, ecx
mov byte [eax], dl
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x10], eax
jb 0x409668
jmp 0x4096ea
mov eax, dword [ebp - 8]
add eax, esi
sub eax, 0x14
cmp eax, dword [ebp - 0x44]
jbe 0x4096a7
jmp 0x40964e
mov dword [ebp - 0x28], 0x46bad1
jmp 0x40962b
add dword [ebp - 0x24], 0x2294f
jmp 0x409642
mov eax, esi
inc dword [ebp - 0x44]
jmp 0x409809
mov eax, esi
add eax, dword [ebp - 0xc]
sub eax, 0x16
cmp eax, dword [ebp - 0x44]
jne 0x409686
inc dword [ebp - 0x20]
jmp 0x409686

Function at 0x409984
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40f110
call fcn.00409cd8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x4099e4
cmp eax, 0xffffffff
je 0x4099e4
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x4099dd
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x4099dd
cmp edx, 0x10000000
jae 0x4099dd
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x4099da
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.00409d1d
ret 4

Function at 0x409a40
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x409a7e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x409a76
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x409a80
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x409a66
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x409b50
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x409b66
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x409b81
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x46c650
Capabilities:
Authenticate hmac

Disassembly:
jbe 0x46c60b
jbe 0x46c60d
jbe 0x46c60f
jbe 0x46c611
jbe 0x46c613
jbe 0x46c615
jbe 0x46c617
jbe 0x46c619
jbe 0x46c61b
jbe 0x46c61d
jbe 0x46c61f
jbe 0x46c621
jbe 0x46c623
jbe 0x46c625
jbe 0x46c627
jbe 0x46c629
jbe 0x46c62b
jbe 0x46c62d
jbe 0x46c62f
jbe 0x46c631
jbe 0x46c633
jbe 0x46c635
jbe 0x46c637
jbe 0x46c639
jbe 0x46c63b
jbe 0x46c63d
jbe 0x46c63f
jbe 0x46c641
jbe 0x46c643
jbe 0x46c645
jbe 0x46c647
jbe 0x46c649
jbe 0x46c64b
jbe 0x46c64d
jbe 0x46c64f
jbe 0x46c651
jbe 0x46c653
jbe 0x46c655
jbe 0x46c657
jbe 0x46c659
jbe 0x46c65b
jbe 0x46c65d
jbe 0x46c65f
jbe 0x46c661
jbe 0x46c663
jbe 0x46c665
jbe 0x46c667
jbe 0x46c669
jbe 0x46c66b
jbe 0x46c66d
jbe 0x46c66f
jbe 0x46c671
jbe 0x46c673
jbe 0x46c675
jbe 0x46c677
jbe 0x46c679
jbe 0x46c67b
jbe 0x46c67d
jbe 0x46c67f
jbe 0x46c681
jbe 0x46c683
jbe 0x46c685
jbe 0x46c687
jbe 0x46c689
jbe 0x46c68b
jbe 0x46c68d
jbe 0x46c68f
jbe 0x46c691
jbe 0x46c693
jbe 0x46c695
jbe 0x46c697
jbe 0x46c699
jbe 0x46c69b
jbe 0x46c69d
jbe 0x46c69f
jbe 0x46c6a1
jbe 0x46c6a3
jbe 0x46c6a5
jbe 0x46c6a7
jbe 0x46c6a9
jbe 0x46c6ab
jbe 0x46c6ad
jbe 0x46c6af
jbe 0x46c6b1
jbe 0x46c6b3
jbe 0x46c6b5
jbe 0x46c6b7
jbe 0x46c6b9
jbe 0x46c6bb
jbe 0x46c6bd
jbe 0x46c6bf
jbe 0x46c6c1
jbe 0x46c6c3
jbe 0x46c6c5
jbe 0x46c6c7
jbe 0x46c6c9
jbe 0x46c6cb
jbe 0x46c6cd
jbe 0x46c6cf
jbe 0x46c6d1
jbe 0x46c6d3
jbe 0x46c6d5
jbe 0x46c6d7
jbe 0x46c6d9
jbe 0x46c6db
jbe 0x46c6dd
jbe 0x46c6df
jbe 0x46c6e1
jbe 0x46c6e3
jbe 0x46c6e5
jbe 0x46c6e7
jbe 0x46c6e9
jbe 0x46c6eb
jbe 0x46c6ed
jbe 0x46c6ef
jbe 0x46c6f1
jbe 0x46c6f3
jbe 0x46c6f5
jbe 0x46c6f7
jbe 0x46c6f9
jbe 0x46c6fb
jbe 0x46c6c1
jbe 0x46c69f
push 0x16f1a476
sbb esi, ebp
shl byte [ebx + 0x4b], 1
dec ebx
ror byte [ebx + 0x27f7df76], 0x76
fcompi st(7)
daa
mov dl, 0x5d
arpl word [ebx], si
jbe 0x46c70f
dec ebx
cmp al, 0x76
mov ebx, 0x76294d2f
xlatb
scasb al, byte es:[edi]
jbe 0x46c6cf
Function at 0x46c6d6
Capabilities:
Authenticate hmac

Disassembly:
jbe 0x46c60b
jbe 0x46c60d
jbe 0x46c60f
jbe 0x46c611
jbe 0x46c613
jbe 0x46c615
jbe 0x46c617
jbe 0x46c619
jbe 0x46c61b
jbe 0x46c61d
jbe 0x46c61f
jbe 0x46c621
jbe 0x46c623
jbe 0x46c625
jbe 0x46c627
jbe 0x46c629
jbe 0x46c62b
jbe 0x46c62d
jbe 0x46c62f
jbe 0x46c631
jbe 0x46c633
jbe 0x46c635
jbe 0x46c637
jbe 0x46c639
jbe 0x46c63b
jbe 0x46c63d
jbe 0x46c63f
jbe 0x46c641
jbe 0x46c643
jbe 0x46c645
jbe 0x46c647
jbe 0x46c649
jbe 0x46c64b
jbe 0x46c64d
jbe 0x46c64f
jbe 0x46c651
jbe 0x46c653
jbe 0x46c655
jbe 0x46c657
jbe 0x46c659
jbe 0x46c65b
jbe 0x46c65d
jbe 0x46c65f
jbe 0x46c661
jbe 0x46c663
jbe 0x46c665
jbe 0x46c667
jbe 0x46c669
jbe 0x46c66b
jbe 0x46c66d
jbe 0x46c66f
jbe 0x46c671
jbe 0x46c673
jbe 0x46c675
jbe 0x46c677
jbe 0x46c679
jbe 0x46c67b
jbe 0x46c67d
jbe 0x46c67f
jbe 0x46c681
jbe 0x46c683
jbe 0x46c685
jbe 0x46c687
jbe 0x46c689
jbe 0x46c68b
jbe 0x46c68d
jbe 0x46c68f
jbe 0x46c691
jbe 0x46c693
jbe 0x46c695
jbe 0x46c697
jbe 0x46c699
jbe 0x46c69b
jbe 0x46c69d
jbe 0x46c69f
jbe 0x46c6a1
jbe 0x46c6a3
jbe 0x46c6a5
jbe 0x46c6a7
jbe 0x46c6a9
jbe 0x46c6ab
jbe 0x46c6ad
jbe 0x46c6af
jbe 0x46c6b1
jbe 0x46c6b3
jbe 0x46c6b5
jbe 0x46c6b7
jbe 0x46c6b9
jbe 0x46c6bb
jbe 0x46c6bd
jbe 0x46c6bf
jbe 0x46c6c1
jbe 0x46c6c3
jbe 0x46c6c5
jbe 0x46c6c7
jbe 0x46c6c9
jbe 0x46c6cb
jbe 0x46c6cd
jbe 0x46c6cf
jbe 0x46c6d1
jbe 0x46c6d3
jbe 0x46c6d5
jbe 0x46c6d7
jbe 0x46c6d9
jbe 0x46c6db
jbe 0x46c6dd
jbe 0x46c6df
jbe 0x46c6e1
jbe 0x46c6e3
jbe 0x46c6e5
jbe 0x46c6e7
jbe 0x46c6e9
jbe 0x46c6eb
jbe 0x46c6ed
jbe 0x46c6ef
jbe 0x46c6f1
jbe 0x46c6f3
jbe 0x46c6f5
jbe 0x46c6f7
jbe 0x46c6f9
jbe 0x46c6fb
jbe 0x46c6c1
jbe 0x46c69f
push 0x16f1a476
sbb esi, ebp
shl byte [ebx + 0x4b], 1
dec ebx
ror byte [ebx + 0x27f7df76], 0x76
fcompi st(7)
daa
mov dl, 0x5d
arpl word [ebx], si
jbe 0x46c70f
dec ebx
cmp al, 0x76
mov ebx, 0x76294d2f
xlatb
scasb al, byte es:[edi]
jbe 0x46c6cf
Function at 0x46c6dc
Capabilities:
Authenticate hmac

Disassembly:
jbe 0x46c60b
jbe 0x46c60d
jbe 0x46c60f
jbe 0x46c611
jbe 0x46c613
jbe 0x46c615
jbe 0x46c617
jbe 0x46c619
jbe 0x46c61b
jbe 0x46c61d
jbe 0x46c61f
jbe 0x46c621
jbe 0x46c623
jbe 0x46c625
jbe 0x46c627
jbe 0x46c629
jbe 0x46c62b
jbe 0x46c62d
jbe 0x46c62f
jbe 0x46c631
jbe 0x46c633
jbe 0x46c635
jbe 0x46c637
jbe 0x46c639
jbe 0x46c63b
jbe 0x46c63d
jbe 0x46c63f
jbe 0x46c641
jbe 0x46c643
jbe 0x46c645
jbe 0x46c647
jbe 0x46c649
jbe 0x46c64b
jbe 0x46c64d
jbe 0x46c64f
jbe 0x46c651
jbe 0x46c653
jbe 0x46c655
jbe 0x46c657
jbe 0x46c659
jbe 0x46c65b
jbe 0x46c65d
jbe 0x46c65f
jbe 0x46c661
jbe 0x46c663
jbe 0x46c665
jbe 0x46c667
jbe 0x46c669
jbe 0x46c66b
jbe 0x46c66d
jbe 0x46c66f
jbe 0x46c671
jbe 0x46c673
jbe 0x46c675
jbe 0x46c677
jbe 0x46c679
jbe 0x46c67b
jbe 0x46c67d
jbe 0x46c67f
jbe 0x46c681
jbe 0x46c683
jbe 0x46c685
jbe 0x46c687
jbe 0x46c689
jbe 0x46c68b
jbe 0x46c68d
jbe 0x46c68f
jbe 0x46c691
jbe 0x46c693
jbe 0x46c695
jbe 0x46c697
jbe 0x46c699
jbe 0x46c69b
jbe 0x46c69d
jbe 0x46c69f
jbe 0x46c6a1
jbe 0x46c6a3
jbe 0x46c6a5
jbe 0x46c6a7
jbe 0x46c6a9
jbe 0x46c6ab
jbe 0x46c6ad
jbe 0x46c6af
jbe 0x46c6b1
jbe 0x46c6b3
jbe 0x46c6b5
jbe 0x46c6b7
jbe 0x46c6b9
jbe 0x46c6bb
jbe 0x46c6bd
jbe 0x46c6bf
jbe 0x46c6c1
jbe 0x46c6c3
jbe 0x46c6c5
jbe 0x46c6c7
jbe 0x46c6c9
jbe 0x46c6cb
jbe 0x46c6cd
jbe 0x46c6cf
jbe 0x46c6d1
jbe 0x46c6d3
jbe 0x46c6d5
jbe 0x46c6d7
jbe 0x46c6d9
jbe 0x46c6db
jbe 0x46c6dd
jbe 0x46c6df
jbe 0x46c6e1
jbe 0x46c6e3
jbe 0x46c6e5
jbe 0x46c6e7
jbe 0x46c6e9
jbe 0x46c6eb
jbe 0x46c6ed
jbe 0x46c6ef
jbe 0x46c6f1
jbe 0x46c6f3
jbe 0x46c6f5
jbe 0x46c6f7
jbe 0x46c6f9
jbe 0x46c6fb
jbe 0x46c6c1
jbe 0x46c69f
push 0x16f1a476
sbb esi, ebp
shl byte [ebx + 0x4b], 1
dec ebx
ror byte [ebx + 0x27f7df76], 0x76
fcompi st(7)
daa
mov dl, 0x5d
arpl word [ebx], si
jbe 0x46c70f
dec ebx
cmp al, 0x76
mov ebx, 0x76294d2f
xlatb
scasb al, byte es:[edi]
jbe 0x46c6cf
Function at 0x46c6e2
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
jbe 0x46c60b
jbe 0x46c60d
jbe 0x46c60f
jbe 0x46c611
jbe 0x46c613
jbe 0x46c615
jbe 0x46c617
jbe 0x46c619
jbe 0x46c61b
jbe 0x46c61d
jbe 0x46c61f
jbe 0x46c621
jbe 0x46c623
jbe 0x46c625
jbe 0x46c627
jbe 0x46c629
jbe 0x46c62b
jbe 0x46c62d
jbe 0x46c62f
jbe 0x46c631
jbe 0x46c633
jbe 0x46c635
jbe 0x46c637
jbe 0x46c639
jbe 0x46c63b
jbe 0x46c63d
jbe 0x46c63f
jbe 0x46c641
jbe 0x46c643
jbe 0x46c645
jbe 0x46c647
jbe 0x46c649
jbe 0x46c64b
jbe 0x46c64d
jbe 0x46c64f
jbe 0x46c651
jbe 0x46c653
jbe 0x46c655
jbe 0x46c657
jbe 0x46c659
jbe 0x46c65b
jbe 0x46c65d
jbe 0x46c65f
jbe 0x46c661
jbe 0x46c663
jbe 0x46c665
jbe 0x46c667
jbe 0x46c669
jbe 0x46c66b
jbe 0x46c66d
jbe 0x46c66f
jbe 0x46c671
jbe 0x46c673
jbe 0x46c675
jbe 0x46c677
jbe 0x46c679
jbe 0x46c67b
jbe 0x46c67d
jbe 0x46c67f
jbe 0x46c681
jbe 0x46c683
jbe 0x46c685
jbe 0x46c687
jbe 0x46c689
jbe 0x46c68b
jbe 0x46c68d
jbe 0x46c68f
jbe 0x46c691
jbe 0x46c693
jbe 0x46c695
jbe 0x46c697
jbe 0x46c699
jbe 0x46c69b
jbe 0x46c69d
jbe 0x46c69f
jbe 0x46c6a1
jbe 0x46c6a3
jbe 0x46c6a5
jbe 0x46c6a7
jbe 0x46c6a9
jbe 0x46c6ab
jbe 0x46c6ad
jbe 0x46c6af
jbe 0x46c6b1
jbe 0x46c6b3
jbe 0x46c6b5
jbe 0x46c6b7
jbe 0x46c6b9
jbe 0x46c6bb
jbe 0x46c6bd
jbe 0x46c6bf
jbe 0x46c6c1
jbe 0x46c6c3
jbe 0x46c6c5
jbe 0x46c6c7
jbe 0x46c6c9
jbe 0x46c6cb
jbe 0x46c6cd
jbe 0x46c6cf
jbe 0x46c6d1
jbe 0x46c6d3
jbe 0x46c6d5
jbe 0x46c6d7
jbe 0x46c6d9
jbe 0x46c6db
jbe 0x46c6dd
jbe 0x46c6df
jbe 0x46c6e1
jbe 0x46c6e3
jbe 0x46c6e5
jbe 0x46c6e7
jbe 0x46c6e9
jbe 0x46c6eb
jbe 0x46c6ed
jbe 0x46c6ef
jbe 0x46c6f1
jbe 0x46c6f3
jbe 0x46c6f5
jbe 0x46c6f7
jbe 0x46c6f9
jbe 0x46c6fb
jbe 0x46c6c1
jbe 0x46c69f
push 0x16f1a476
sbb esi, ebp
shl byte [ebx + 0x4b], 1
dec ebx
ror byte [ebx + 0x27f7df76], 0x76
fcompi st(7)
daa
mov dl, 0x5d
arpl word [ebx], si
jbe 0x46c70f
dec ebx
cmp al, 0x76
mov ebx, 0x76294d2f
xlatb
scasb al, byte es:[edi]
jbe 0x46c6cf