joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001230
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x1000124f
mov eax, 1
jmp 0x10001251
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10019f30
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x2c], 0x10019b70
mov esi, dword [ebp - 0x2c]
mov al, byte [esi]
cmp al, 0xcc
je 0x10019fb2
mov dword [ebp - 0x10], 0x10017500
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0xcc
je 0x10019fb2
mov dword [ebp - 0x18], 0x1001a1b0
mov esi, dword [ebp - 0x18]
mov al, byte [esi]
cmp al, 0xcc
je 0x10019fb2
mov dword [ebp - 0x24], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x30], 0x20
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
test eax, eax
jle 0x1001a018
mov edx, dword [ebp - 8]
sub edx, 0x61c88647
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x28]
shl eax, 4
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 8]
xor eax, ecx
mov edx, dword [ebp - 0x28]
shr edx, 5
add edx, dword [ebp - 0xc]
xor eax, edx
mov ecx, dword [ebp - 0x20]
add ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
shl edx, 4
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x1c]
xor edx, ecx
mov eax, dword [ebp - 0x28]
add eax, edx
mov dword [ebp - 0x28], eax
jmp 0x10019fb2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a030
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x2c], 0x10019b70
mov esi, dword [ebp - 0x2c]
mov al, byte [esi]
cmp al, 0xcc
je 0x1001a0b2
mov dword [ebp - 0x10], 0x10017500
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0xcc
je 0x1001a0b2
mov dword [ebp - 0x18], fcn.1001a030
mov esi, dword [ebp - 0x18]
mov al, byte [esi]
cmp al, 0xcc
je 0x1001a0b2
mov dword [ebp - 0x24], 0x9e3779b9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], 0xc6ef3720
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x30], 0x20
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
test eax, eax
jle 0x1001a117
mov edx, dword [ebp - 0x20]
shl edx, 4
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 8]
xor edx, eax
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x1c]
xor edx, ecx
mov eax, dword [ebp - 0x28]
sub eax, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
shl ecx, 4
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 8]
xor ecx, edx
mov eax, dword [ebp - 0x28]
shr eax, 5
add eax, dword [ebp - 0xc]
xor ecx, eax
mov edx, dword [ebp - 0x20]
sub edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
add eax, 0x61c88647
mov dword [ebp - 8], eax
jmp 0x1001a0b2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001a320
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
jbe 0x1001a33e
mov ecx, dword [esp + 4]
push ebx
mov bl, byte [eax + ecx]
xor bl, 0xf5
mov byte [eax + ecx], bl
inc eax
cmp eax, edx
jb 0x1001a32f
pop ebx
ret
Function at 0x1002c430
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x1002c516
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp edi, 3
jl 0x1002c4a3
xor edx, edx
xor eax, eax
mov dh, byte [esi]
mov al, byte [esi + 2]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x1002c4fa
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x1002c4b6
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
jne 0x1002c4e6
mov ebx, 0x3d
jmp 0x1002c4f4
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x1002c44a
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop edi
pop ebp
mov byte [ecx], 0
ret

Function at 0x1002ddb0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov eax, 1
ret
Function at 0x10033f00
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x1c
mov eax, 1
ret

Function at 0x10033f60
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x20
mov eax, 1
ret
Function at 0x10035f10
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
mov eax, 1
ret

Function at 0x10035fb0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
mov eax, 1
ret
Function at 0x10047450
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x18
call fcn.1004bf10
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
lea esi, [eax - 1]
push edi
mov edi, dword [esp + 0x38]
lea ecx, [esi - 0x29]
cmp edi, ecx
jle 0x1004748f
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.10023330
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
cmp esi, 0x29
jge 0x100474b3
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.10023330
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
lea eax, [esi - 0x14]
push 0x37
push str..crypto_rsa_rsa_oaep.c
push eax
mov dword [esp + 0x1c], eax
call fcn.100247b0
add esp, 0xc
mov dword [esp + 0x30], eax
test eax, eax
jne 0x100474f1
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.10023330
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov ebx, dword [esp + 0x2c]
push 0
mov byte [ebx], 0
lea ebp, [ebx + 1]
add ebx, 0x15
call fcn.10020590
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push 0
push ebx
push edx
push eax
call fcn.10020360
mov ecx, esi
xor eax, eax
sub ecx, edi
lea edi, [ebx + 0x14]
sub ecx, 0x29
push 0x14
mov edx, ecx
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x58]
mov eax, ebx
sub eax, ecx
mov edx, ecx
add eax, esi
mov esi, dword [esp + 0x54]
shr ecx, 2
lea edi, [eax - 0x14]
mov byte [eax - 0x15], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.1001ef40
add esp, 0x20
test eax, eax
jg 0x1004756e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
call fcn.10020590
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x30]
push eax
push 0x14
push ebp
push edi
push esi
call fcn.100477d0
add esp, 0x14
test edi, edi
jle 0x100475a0
mov eax, ebx
sub esi, ebx
mov ecx, edi
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x10047593
mov esi, dword [esp + 0x30]
call fcn.10020590
push eax
push edi
push ebx
lea eax, [esp + 0x20]
push 0x14
push eax
call fcn.100477d0
lea eax, [esp + 0x28]
add esp, 0x14
sub eax, ebp
mov ecx, 0x14
mov dl, byte [eax + ebp]
mov bl, byte [ebp]
xor bl, dl
mov byte [ebp], bl
inc ebp
dec ecx
jne 0x100475c2
push esi
call fcn.10024a30
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x100475f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2c
call fcn.1004bf10
mov eax, dword [esp + 0x40]
push ebx
xor ebx, ebx
dec eax
push ebp
push esi
cmp eax, 0x29
push edi
mov dword [esp + 0x10], ebx
jl 0x10047794
mov ecx, dword [esp + 0x4c]
mov edi, eax
sub edi, ecx
jns 0x10047626
mov dword [esp + 0x10], 1
xor edi, edi
mov esi, dword [esp + 0x48]
lea ebp, [eax - 0x14]
push 0x7a
sub esi, edi
push str..crypto_rsa_rsa_oaep.c
push ebp
add esi, 0x14
call fcn.100247b0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x10047668
push 0x7d
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x7a
push 4
call fcn.10023330
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
call fcn.10020590
push eax
push ebp
push esi
lea eax, [esp + 0x20]
push 0x14
push eax
call fcn.100477d0
add esp, 0x14
cmp edi, 0x14
mov eax, edi
jge 0x100476a1
mov edx, dword [esp + 0x48]
mov ecx, eax
sub ecx, edi
mov cl, byte [ecx + edx]
mov dl, byte [esp + eax + 0x14]
xor dl, cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x14
jl 0x10047686
call fcn.10020590
push eax
lea edx, [esp + 0x18]
push 0x14
push edx
push ebp
push ebx
call fcn.100477d0
add esp, 0x14
test ebp, ebp
jle 0x100476cf
mov eax, ebx
sub esi, ebx
mov edi, ebp
mov cl, byte [esi + eax]
mov dl, byte [eax]
xor dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x100476c2
push 0
call fcn.10020590
mov ecx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x30]
push 0
push edx
push eax
push ecx
call fcn.10020360
add esp, 0x18
mov ecx, 5
lea edi, [esp + 0x28]
mov esi, ebx
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x10047794
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10047794
mov eax, 0x14
cmp ebp, eax
jle 0x10047725
cmp byte [eax + ebx], 0
jne 0x10047725
inc eax
cmp eax, ebp
jl 0x1004771a
cmp byte [eax + ebx], 1
jne 0x10047794
mov ecx, eax
inc eax
cmp ecx, ebp
jge 0x10047794
mov ecx, dword [esp + 0x44]
sub ebp, eax
cmp ecx, ebp
jge 0x1004776a
push 0x9b
push str..crypto_rsa_rsa_oaep.c
push 0x6d
push 0x7a
push 4
call fcn.10023330
add esp, 0x14
or ebp, 0xffffffff
push ebx
call fcn.10024a30
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov edi, dword [esp + 0x40]
mov ecx, ebp
mov edx, ecx
lea esi, [eax + ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10024a30
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push 0xa8
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call fcn.10023330
add esp, 0x14
test ebx, ebx
je 0x100477b9
push ebx
call fcn.10024a30
add esp, 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2c
ret
Function at 0x10047c80
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, edx
push esi
jne 0x10047d55
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x10047ca3
cmp al, 0x6b
jne 0x10047d55
cmp al, 0x6b
lea esi, [ecx + 1]
jne 0x10047d11
lea eax, [edx - 3]
xor edx, edx
test eax, eax
jle 0x10047cc5
mov cl, byte [esi]
inc esi
cmp cl, 0xba
je 0x10047cc5
cmp cl, 0xbb
jne 0x10047cee
inc edx
cmp edx, eax
jl 0x10047cb3
sub eax, edx
test edx, edx
jne 0x10047d14
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.10023330
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.10023330
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
lea eax, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x10047d3d
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.10023330
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov ecx, eax
push edi
mov edi, dword [esp + 0xc]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.10023330
add esp, 0x14
or eax, 0xffffffff
pop esi
ret

Function at 0x10048490
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x1004a830
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov ecx, dword [eax + 4]
push edi
cmp ecx, dword [ebx + 4]
jge 0x1004a849
mov edi, ebx
mov ebx, eax
jmp 0x1004a84b
mov edi, eax
mov esi, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, dword [esi + 8]
jle 0x1004a861
push eax
push esi
call fcn.1001e080
add esp, 8
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
jle 0x1004a885
push ebp
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
mov ebp, dword [ecx + eax*4]
mov ecx, dword [esi]
xor edx, ebp
mov dword [ecx + eax*4], edx
mov ecx, dword [ebx + 4]
inc eax
cmp eax, ecx
jl 0x1004a86b
pop ebp
cmp eax, dword [edi + 4]
jge 0x1004a89c
mov edx, dword [edi]
mov ecx, dword [esi]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
mov ecx, dword [edi + 4]
inc eax
cmp eax, ecx
jl 0x1004a88a
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x1004a8c2
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
mov ecx, dword [eax]
sub eax, 4
test ecx, ecx
jne 0x1004a8c2
mov edx, dword [esi + 4]
dec edx
mov ecx, edx
mov dword [esi + 4], edx
test ecx, ecx
jg 0x1004a8ac
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x102b12c2
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x14]
je 0x102b233c
pushfd
lea ebx, [ecx + 0x38a54bf4]
mov ebx, eax
not eax
push ecx
lea eax, [ebp - 8]
jmp 0x102b2de8
pushfd
call 0x102af9e0
push edi
push ebp
sub ch, byte [esi]
push ecx
mov cl, 0x42
xchg edx, eax
in eax, 0xdc
or al, 0xeb
inc eax
arpl word [edx + 0x66a88a00], si
or ah, ah
pop es
je 0x102af5a4
loopne 0x102af54b
sub esi, dword [ecx - 0x5f]
push cs
add eax, 0xa5c5cc7e
mov ebx, 0x6e24d8fe
cmp esp, ebp
push ss
cmp eax, 0xb24635c4
sbb dword [edx], 0xbe66c18d
leave
and al, 0xae
sbb al, 0x8e
sti
dec eax
sahf
mov al, 0x1a
and edi, dword [eax - 0x730e70b]
sub dword [edx + 0x422e846e], ecx
push ebp
or eax, 0x3409629
leave
xor ebx, dword [edi - 0x75c89988]
salc
jne 0x102af5a3
dec edx
fnstenv [edi]
inc edx
adc al, 0x90
sub ecx, ebp
fsubr dword [esi - 0xad913bd]
push ss
loope 0x102af5a0
stosb byte es:[edi], al
xchg ah, ch
xchg ecx, eax
popfd
scasb al, byte es:[edi]
fiadd dword [eax + 0x13600a0f]
invalid
adc esp, dword [esi - 0xa]
push ds
neg byte [esi]
enter 0xf43, 0xfffffffffffffff2
jmp 0x155ea3e5
mov word [esp], 0xe2c
lea eax, [ebp*8 - 0x398907e7]
push dword [ebp - 4]
pop dword [esp + 0x20]
push dword [esp + 4]
lea eax, [edi - 0x706db277]
movzx ax, dl
call fcn.102b0a61
pushfd
jmp 0x102aec97
jbe 0x102af522
cmp ah, 0x37
clc
xor eax, eax
xchg dword [esp + 4], eax
pushal
jmp 0x102b0688
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x4070a0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x4070a4]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call fcn.00402a94
jmp 0x4011d3
mov eax, dword [0x4070a4]
test eax, eax
jne 0x4011c9
mov dword [0x4070a4], 1
mov dword [esp + 4], 0x40a014
mov dword [esp], 0x40a00c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x4011d3
mov dword [0x40701c], 1
mov eax, dword [0x4070a4]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x40a008
mov dword [esp], section..CRT
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x4070a4], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x4070a0
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call fcn.00401f71
mov dword [esp], 0x40208c
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x407074], eax
mov dword [esp], section..text
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.00401910
mov eax, dword [0x407004]
mov dword [esp + 4], 0x407008
mov dword [esp], eax
call fcn.004013c8
call fcn.0040174c
mov eax, dword [0x404014]
mov edx, dword [0x40700c]
mov dword [eax], edx
mov ecx, dword [0x40700c]
mov edx, dword [0x407008]
mov eax, dword [0x407004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00403810
mov dword [0x407014], eax
mov eax, dword [0x407018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x407014]
mov dword [esp], eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x40701c]
test eax, eax
jne 0x4012de
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x407014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x40704c], 1
mov dword [0x407050], 1
mov dword [0x407054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret

Function at 0x401918
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00402904
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort

Function at 0x4024ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40250b
mov eax, 0
jmp 0x40254f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40252e
mov eax, 0
jmp 0x40254f
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40254a
mov eax, 0
jmp 0x40254f
mov eax, 1
leave
ret