joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48fbd6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
inc dword [0x4e53a0]
push esi
mov esi, dword [0x4e53b8]
push edi
mov edi, edx
test esi, esi
je 0x48fce8
test edi, edi
js 0x48fce8
cmp edi, 0x1f
jae 0x48fce8
test edi, edi
jne 0x48fc2d
mov ecx, dword [esi + 0x48600]
mov eax, dword [esi + 0x43fc]
xor eax, ecx
and eax, 1
xor dword [esi + 0x43fc], eax
xor eax, eax
test ecx, ecx
sete al
mov dword [esi + 0x48600], eax
add edi, edi
xor ecx, ecx
mov eax, dword [esi + edi*8 + 0x420c]
and eax, 0xffff0425
mov dword [esi + edi*8 + 0x4208], 0xfb0
or eax, 0x424
mov dword [esi + edi*8 + 0x420c], eax
xor eax, eax
mov word [esi + edi*8 + 0x420e], ax
lea eax, [ebp - 4]
lock or dword [eax], ecx
push 1
call dword [0x4e5420]
mov eax, dword [esi + 0x48600]
xor eax, dword [esi + edi*8 + 0x420c]
and eax, 1
xor dword [esi + edi*8 + 0x420c], eax
mov eax, dword [esi + 0x484dc]
push pe_nt_image_headers32
add eax, 4
push eax
call dword [0x4e5470]
mov esi, dword [0x4e53f8]
inc esi
cmp dword [0x4e5480], 0
mov dword [0x4e53f8], esi
je 0x48fd41
cmp dword [0x4e52b8], 0
je 0x48fd41
mov ecx, dword [0x4e547c]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x4e547c], ecx
mov ecx, dword [0x4e5488]
cmp ecx, 1
jbe 0x48fce0
xor edx, edx
div ecx
push esi
push 0x6fb
jmp 0x48fd2e
mov esi, dword [0x4e53d4]
inc esi
cmp dword [0x4e5480], 0
mov dword [0x4e53d4], esi
je 0x48fd41
cmp dword [0x4e52b8], 0
je 0x48fd41
mov ecx, dword [0x4e547c]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x4e547c], ecx
mov ecx, dword [0x4e5488]
cmp ecx, 1
jbe 0x48fd28
xor edx, edx
div ecx
push esi
push 0x6c0
push 0x4a9dda
push eax
push 0x4a9626
call fcn.0048dfa4
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49048e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor ebx, ebx
mov eax, dword [edi + 0x484dc]
add eax, 0x28
push eax
call dword [0x4e5464]
mov ecx, eax
test cl, 1
jne 0x4904ee
mov eax, dword [esi]
test eax, eax
je 0x4905c2
push 0xa
call dword [0x4e5420]
mov eax, dword [edi + 0x484dc]
add eax, 0x28
push eax
call dword [0x4e5464]
mov ecx, eax
mov eax, dword [esi]
cmp eax, 0xa
jae 0x4904e4
push 0xa
mov dword [esi], 0xa
pop eax
add eax, 0xfffffff6
mov dword [esi], eax
test cl, 1
je 0x4904b2
mov eax, dword [edi + 0x484dc]
add eax, 0x20
push eax
call dword [0x4e5464]
mov ecx, eax
test cl, 1
jne 0x490543
mov eax, dword [esi]
test eax, eax
je 0x490613
push 0xa
call dword [0x4e5420]
mov eax, dword [edi + 0x484dc]
add eax, 0x20
push eax
call dword [0x4e5464]
mov ecx, eax
mov eax, dword [esi]
cmp eax, 0xa
jae 0x490539
push 0xa
mov dword [esi], 0xa
pop eax
add eax, 0xfffffff6
mov dword [esi], eax
test cl, 1
je 0x490507
test cl, 0x10
je 0x4905a7
cmp dword [0x4e5480], ebx
je 0x490592
cmp dword [0x4e52b8], ebx
je 0x490592
mov esi, dword [0x4e5488]
rdtsc
mov edx, dword [0x4e547c]
sub eax, edx
add edx, eax
mov dword [0x4e547c], edx
cmp esi, 1
jbe 0x490579
xor edx, edx
div esi
push ecx
push 0x8d4
push 0x4a9e88
push eax
push 0x4a9626
call fcn.0048dfa4
add esp, 0x14
mov eax, dword [edi + 0x484dc]
push 0x80000012
add eax, 0x20
push eax
call dword [0x4e5470]
mov ecx, dword [edi + 0x484dc]
push pe_nt_image_headers32
add ecx, 4
push ecx
call dword [0x4e5470]
pop edi
pop esi
mov eax, ebx
pop ebx
ret
cmp dword [0x4e5480], ebx
je 0x49060c
cmp dword [0x4e52b8], ebx
je 0x49060c
mov esi, dword [0x4e5488]
rdtsc
mov edx, dword [0x4e547c]
sub eax, edx
add edx, eax
mov dword [0x4e547c], edx
cmp esi, 1
jbe 0x4905f3
xor edx, edx
div esi
push ecx
push 0x8a1
push 0x4a9e88
push eax
push 0x4a9626
call fcn.0048dfa4
add esp, 0x14
mov ebx, 0xc0000037
jmp 0x4905bc
cmp dword [0x4e5480], ebx
je 0x49060c
cmp dword [0x4e52b8], ebx
je 0x49060c
mov esi, dword [0x4e5488]
rdtsc
mov edx, dword [0x4e547c]
sub eax, edx
add edx, eax
mov dword [0x4e547c], edx
cmp esi, 1
jbe 0x490644
xor edx, edx
div esi
push ecx
push 0x8bb
jmp 0x4905f9
Function at 0x49064c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [0x4e53b8]
mov esi, 0xc0000001
xor ecx, ecx
mov ebx, dword [edi + 0x486f4]
lea eax, [ebx + 0x14]
cmp byte [eax + 1], 0
je 0x49067d
cmp byte [eax], 3
jne 0x49067d
mov edx, dword [eax + 4]
test edx, edx
jne 0x49068b
inc ecx
add eax, 0xc
cmp ecx, 6
jb 0x49066b
jmp 0x49071f
imul eax, ecx, 0xc
mov ecx, edi
mov dword [edi + 0x486ec], edx
mov eax, dword [eax + ebx + 0x1c]
mov dword [edi + 0x486f0], eax
call fcn.0048fd48
mov esi, eax
test esi, esi
js 0x49071f
mov ecx, edi
call fcn.0048fe14
mov esi, eax
test esi, esi
js 0x49071f
mov ebx, 0x16e360
lea edx, [ebp - 4]
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0049048e
cmp dword [0x4e5480], 0
mov esi, eax
je 0x49076b
cmp dword [0x4e52b8], 0
je 0x49071f
mov ecx, dword [0x4e547c]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x4e547c], ecx
mov ecx, dword [0x4e5488]
cmp ecx, 1
jbe 0x490703
xor edx, edx
div ecx
sub ebx, dword [ebp - 4]
push ebx
push 0x946
push 0x4a9ea4
push eax
push 0x4a9626
call fcn.0048dfa4
add esp, 0x14
cmp dword [0x4e5480], 0
je 0x49076b
cmp dword [0x4e52b8], 0
je 0x49076b
mov ecx, dword [0x4e547c]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x4e547c], ecx
mov ecx, dword [0x4e5488]
cmp ecx, 1
jbe 0x490752
xor edx, edx
div ecx
push esi
push 0x949
push 0x4a9ea4
push eax
push 0x4a9626
call fcn.0048dfa4
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x490774
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [0x4e53b8]
mov byte [ebp - 1], 0
lea ebx, [edi + 0x484c0]
mov eax, dword [ebx + 0x1c]
add eax, 0x20
push eax
call dword [0x4e5464]
mov ecx, eax
test ecx, ecx
js 0x49083f
inc dword [0x4e53a4]
cmp dword [0x4e5480], 0
je 0x4907f7
cmp dword [0x4e52b8], 0
je 0x4907f7
mov esi, dword [0x4e5488]
rdtsc
mov edx, dword [0x4e547c]
sub eax, edx
add edx, eax
mov dword [0x4e547c], edx
cmp esi, 1
jbe 0x4907de
xor edx, edx
div esi
push ecx
push 0x9a8
push 0x4a9ec4
push eax
push 0x4a9626
call fcn.0048dfa4
add esp, 0x14
lea edx, [ebp - 1]
mov ecx, ebx
call fcn.0048f010
mov esi, eax
test esi, esi
jns 0x49080f
inc dword [0x4e53c0]
jmp 0x49084f
mov ecx, edi
call fcn.0048fe14
test eax, eax
js 0x490820
inc dword [0x4e53f4]
lea edx, [ebp - 8]
mov dword [ebp - 8], 0x16e360
mov ecx, edi
call fcn.0049048e
mov esi, eax
test esi, esi
js 0x490853
inc dword [0x4e53e4]
jmp 0x49084f
and dword [ebp - 8], 0
lea edx, [ebp - 8]
mov ecx, edi
call fcn.0049048e
mov esi, eax
test esi, esi
jns 0x49089f
cmp dword [0x4e5480], 0
je 0x49089f
cmp dword [0x4e52b8], 0
je 0x49089f
mov ecx, dword [0x4e547c]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x4e547c], ecx
mov ecx, dword [0x4e5488]
cmp ecx, 1
jbe 0x490886
xor edx, edx
div ecx
push esi
push 0x9c7
push 0x4a9ec4
push eax
push 0x4a9626
call fcn.0048dfa4
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x490a66
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
inc ebx
cmp dword [0x4e5480], 0
push edi
mov edi, 0x4a9642
je 0x490abf
cmp dword [0x4e52b8], 0
je 0x490abf
mov ecx, dword [0x4e547c]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x4e547c], ecx
mov ecx, dword [0x4e5488]
cmp ecx, ebx
jbe 0x490aab
xor edx, edx
div ecx
push 0xa72
push 0x4a9ef4
push eax
push edi
call fcn.0048dfa4
add esp, 0x10
call fcn.00490774
mov esi, eax
test esi, esi
jns 0x490b1d
cmp dword [0x4e5480], 0
je 0x490c2b
cmp dword [0x4e52b8], 0
je 0x490c2b
mov ecx, dword [0x4e547c]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x4e547c], ecx
mov ecx, dword [0x4e5488]
cmp ecx, ebx
jbe 0x490b04
xor edx, edx
div ecx
push 0xa75
push 0x4a9ef4
push eax
push edi
call fcn.0048dfa4
add esp, 0x10
jmp 0x490c2b
lea edx, [ebp - 8]
call fcn.0048f4ec
mov esi, eax
test esi, esi
jns 0x490b7e
cmp dword [0x4e5480], 0
je 0x490c7c
cmp dword [0x4e52b8], 0
je 0x490c31
mov ecx, dword [0x4e547c]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x4e547c], ecx
mov ecx, dword [0x4e5488]
cmp ecx, ebx
jbe 0x490b65
xor edx, edx
div ecx
push 0xa83
push 0x4a9ef4
push eax
push edi
call fcn.0048dfa4
add esp, 0x10
jmp 0x490c31
mov ecx, dword [0x4e53b8]
mov edi, dword [ebp - 8]
test ecx, ecx
je 0x490bba
test edi, edi
js 0x490ba2
mov eax, dword [ecx + edi*4 + 0x48580]
shl eax, 0xc
add eax, 0x25400
add eax, ecx
jmp 0x490bbc
mov eax, edi
and eax, 0x7fffffff
mov eax, dword [ecx + eax*4 + 0x48508]
shl eax, 0xc
add eax, 0x4400
jmp 0x490b9e
xor eax, eax
xor esi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
jbe 0x490c0c
mov ebx, dword [ebp + 8]
mov edx, 0xfb0
add ebx, 4
mov edi, eax
mov ecx, dword [ebx]
cmp ecx, edx
ja 0x490be0
lea eax, [ecx + esi]
cmp eax, edx
jbe 0x490be6
mov ecx, edx
sub ecx, esi
mov dword [ebx], ecx
push ecx
push dword [ebx - 4]
lea eax, [esi + edi]
push eax
call fcn.004a78b0
add esi, dword [ebx]
add esp, 0xc
add ebx, 8
mov edx, 0xfb0
sub dword [ebp + 0xc], 1
jne 0x490bd3
mov edi, dword [ebp - 8]
xor ebx, ebx
inc ebx
push esi
mov edx, edi
call fcn.0048f882
mov esi, eax
test esi, esi
js 0x490c23
and dword [0x4ebc4c], 0
jmp 0x490c31
cmp esi, 0xc00000b5
jne 0x490c31
mov dword [0x4ebc4c], ebx
cmp dword [0x4e5480], 0
je 0x490c7c
cmp dword [0x4e52b8], 0
je 0x490c7c
mov ecx, dword [0x4e547c]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x4e547c], ecx
mov ecx, dword [0x4e5488]
cmp ecx, ebx
jbe 0x490c63
xor edx, edx
div ecx
push esi
push 0xab3
push 0x4a9ef4
push eax
push 0x4a9626
call fcn.0048dfa4
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x492b6e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, 0x4a9fae
mov byte [ebp - 1], bl
cmp dword [0x4e5480], ebx
je 0x492bca
cmp dword [0x4e52b8], ebx
je 0x492bca
mov esi, dword [0x4e5488]
rdtsc
mov ecx, eax
mov eax, dword [0x4e547c]
sub ecx, eax
add eax, ecx
mov dword [0x4e547c], eax
cmp esi, 1
jbe 0x492bb6
mov eax, ecx
xor edx, edx
div esi
mov ecx, eax
push 0x3a8
push edi
push ecx
push 0x4a9642
call fcn.0048dfa4
add esp, 0x10
mov dword [0x4e7b4c], ebx
lea edx, [ebp - 1]
xor cl, cl
call fcn.00492df2
inc dword [0x4e7b4c]
mov byte [ebp - 2], al
test al, al
jne 0x492cae
mov ecx, 0x1f4
call fcn.0049283e
test al, al
je 0x492c5c
cmp byte [ebp - 1], 0
jne 0x492c08
cmp dword [0x4e7b4c], 5
ja 0x492c13
inc ebx
cmp ebx, 0x14
jb 0x492bd0
jmp 0x492cf9
cmp dword [0x4e5480], 0
je 0x492cf9
cmp dword [0x4e52b8], 0
je 0x492cf9
mov esi, dword [0x4e5488]
rdtsc
mov ecx, eax
mov eax, dword [0x4e547c]
sub ecx, eax
add eax, ecx
mov dword [0x4e547c], eax
cmp esi, 1
jbe 0x492c52
mov eax, ecx
xor edx, edx
div esi
mov ecx, eax
push 0x3c4
jmp 0x492cea
cmp dword [0x4e5480], 0
je 0x492ca7
cmp dword [0x4e52b8], 0
je 0x492ca7
mov esi, dword [0x4e5488]
rdtsc
mov ecx, eax
mov eax, dword [0x4e547c]
sub ecx, eax
add eax, ecx
mov dword [0x4e547c], eax
cmp esi, 1
jbe 0x492c93
mov eax, ecx
xor edx, edx
div esi
mov ecx, eax
push 0x3bb
push edi
push ecx
push 0x4a9642
call fcn.0048dfa4
add esp, 0x10
xor al, al
jmp 0x492deb
cmp dword [0x4e5480], 0
je 0x492cf9
cmp dword [0x4e52b8], 0
je 0x492cf9
mov esi, dword [0x4e5488]
rdtsc
mov ecx, eax
mov eax, dword [0x4e547c]
sub ecx, eax
add eax, ecx
mov dword [0x4e547c], eax
cmp esi, 1
jbe 0x492ce5
mov eax, ecx
xor edx, edx
div esi
mov ecx, eax
push 0x3b5
push edi
push ecx
push 0x4a9642
call fcn.0048dfa4
add esp, 0x10
call fcn.004924be
test al, al
jne 0x492d43
cmp dword [0x4e5480], 0
je 0x492ca7
cmp dword [0x4e52b8], 0
je 0x492ca7
mov esi, dword [0x4e5488]
rdtsc
mov ecx, eax
mov eax, dword [0x4e547c]
sub ecx, eax
add eax, ecx
mov dword [0x4e547c], eax
cmp esi, 1
jbe 0x492d39
mov eax, ecx
xor edx, edx
div esi
mov ecx, eax
push 0x3d0
jmp 0x492c98
cmp byte [ebp - 2], 0
je 0x492d91
cmp dword [0x4e5480], 0
je 0x492de9
cmp dword [0x4e52b8], 0
je 0x492de9
mov esi, dword [0x4e5488]
rdtsc
mov ecx, eax
mov eax, dword [0x4e547c]
sub ecx, eax
add eax, ecx
mov dword [0x4e547c], eax
cmp esi, 1
jbe 0x492d88
mov eax, ecx
xor edx, edx
div esi
mov ecx, eax
push 0x3d6
push edi
push ecx
jmp 0x492ddc
cmp dword [0x4e5480], 0
mov dword [0x4ebc4c], 1
mov byte [0x4e8b2d], 1
je 0x492de9
cmp dword [0x4e52b8], 0
je 0x492de9
mov ecx, dword [0x4e547c]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x4e547c], ecx
mov ecx, dword [0x4e5488]
cmp ecx, 1
jbe 0x492dd5
xor edx, edx
div ecx
push 0x3e4
push edi
push eax
push 0x4a9642
call fcn.0048dfa4
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x493626
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x4e5480], 0
push ebx
push esi
push edi
mov edi, 0x4a9fe0
mov ebx, 0x4a9642
je 0x493682
cmp dword [0x4e52b8], 0
je 0x493682
mov esi, dword [0x4e5488]
rdtsc
mov ecx, eax
mov eax, dword [0x4e547c]
sub ecx, eax
add eax, ecx
mov dword [0x4e547c], eax
cmp esi, 1
jbe 0x493672
mov eax, ecx
xor edx, edx
div esi
mov ecx, eax
push 0x4ca
push edi
push ecx
push ebx
call fcn.0048dfa4
add esp, 0x10
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
xor esi, esi
push 6
pop eax
push 4
mov byte [ebp - 0xf], al
pop eax
mov byte [0x4e7b56], 0xc3
mov byte [0x4e7b58], 0xc3
mov byte [ebp - 0x10], 0x80
mov byte [ebp - 0xd], 0xa
mov word [ebp - 0xa], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0049384e
push 4
test al, al
pop eax
je 0x4936ce
cmp dword [ebp - 4], eax
je 0x493720
inc esi
cmp esi, 3
jb 0x4936af
cmp dword [0x4e5480], 0
je 0x493717
cmp dword [0x4e52b8], 0
je 0x493717
mov ecx, dword [0x4e547c]
rdtsc
sub eax, ecx
add ecx, eax
mov dword [0x4e547c], ecx
mov ecx, dword [0x4e5488]
cmp ecx, 1
jbe 0x493707
xor edx, edx
div ecx
push 0x4ef
push edi
push eax
push ebx
call fcn.0048dfa4
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 6]
lea edx, [ebp - 0x10]
mov byte [0x4e7b55], al
xor esi, esi
mov al, byte [ebp - 5]
push 0x7f
mov byte [0x4e7b57], al
pop eax
push ecx
mov dword [ebp - 0x10], esi
push ecx
xor cl, cl
mov byte [0x4e7b54], al
mov dword [ebp - 0xc], esi
mov byte [ebp - 0xf], 5
mov word [ebp - 0xe], ax
call fcn.0049401e
test al, al
jne 0x493799
cmp dword [0x4e5480], esi
je 0x493717
cmp dword [0x4e52b8], esi
je 0x493717
mov esi, dword [0x4e5488]
rdtsc
mov ecx, eax
mov eax, dword [0x4e547c]
sub ecx, eax
add eax, ecx
mov dword [0x4e547c], eax
cmp esi, 1
jbe 0x49378d
mov eax, ecx
xor edx, edx
div esi
mov ecx, eax
push 0x504
push edi
push ecx
jmp 0x49370e
push 6
pop eax
push ecx
mov dword [ebp - 0x10], esi
lea edx, [ebp - 0x10]
push ecx
mov cl, byte [0x4e7b54]
mov dword [ebp - 0xc], esi
mov byte [ebp - 0xf], 3
mov word [ebp - 0xe], ax
call fcn.0049401e
test al, al
jne 0x493802
cmp dword [0x4e5480], esi
je 0x493717
cmp dword [0x4e52b8], esi
je 0x493717
mov esi, dword [0x4e5488]
rdtsc
mov ecx, eax
mov eax, dword [0x4e547c]
sub ecx, eax
add eax, ecx
mov dword [0x4e547c], eax
cmp esi, 1
jbe 0x4937fb
mov eax, ecx
xor edx, edx
div esi
mov ecx, eax
push 0x519
jmp 0x493792
cmp dword [0x4e5480], esi
je 0x493847
cmp dword [0x4e52b8], esi
je 0x493847
mov esi, dword [0x4e5488]
rdtsc
mov ecx, eax
mov eax, dword [0x4e547c]
sub ecx, eax
add eax, ecx
mov dword [0x4e547c], eax
cmp esi, 1
jbe 0x493837
mov eax, ecx
xor edx, edx
div esi
mov ecx, eax
push 0x51d
push edi
push ecx
push ebx
call fcn.0048dfa4
add esp, 0x10
mov al, 1
jmp 0x493719
Function at 0x497510
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x4e52e0], 0
push ebx
push esi
mov esi, ecx
jne 0x497592
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
xor eax, eax
xor ebx, 0x756e6547
sete al
xor ebx, ebx
xor ecx, 0x6c65746e
sete bl
and eax, ebx
xor ecx, ecx
xor edx, 0x49656e69
sete cl
and eax, ecx
mov dword [ebp - 4], eax
mov eax, 1
cpuid
xor ecx, ecx
xor edx, edx
mov ebx, 0xff0
and ebx, eax
mov dword [ebp - 8], ebx
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 4], 0
mov ecx, 1
je 0x497586
cmp dword [ebp - 8], 0x660
sbb eax, eax
not eax
and ecx, eax
mov eax, dword [ecx*4 + 0x4b0470]
mov dword [0x4e52e0], eax
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x40], 0x67452301
mov dword [esi + 0x44], 0xefcdab89
mov dword [esi + 0x48], 0x98badcfe
mov dword [esi + 0x4c], 0x10325476
mov dword [esi + 0x50], 0xc3d2e1f0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x499a32
Capabilities:
Hash data using sha512

Disassembly:
mov edi, edi
push esi
push edi
xor eax, eax
lea edi, [ecx + 0x98]
push 0x10
mov dword [ecx + 0x10], eax
mov esi, 0x4bdec8
mov dword [ecx + 0x14], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx], eax
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret

Function at 0x499a5a
Capabilities:
Hash data using sha384

Disassembly:
mov edi, edi
push esi
push edi
xor eax, eax
lea edi, [ecx + 0x98]
push 0x10
mov dword [ecx + 0x10], eax
mov esi, 0x4bde48
mov dword [ecx + 0x14], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx], eax
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret

Function at 0x499b5a
Capabilities:
Hash data using sha512

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, ecx
mov dword [esp + 0xc], edx
push esi
push edi
mov eax, dword [ebx]
mov byte [eax + ebx + 0x18], 0x80
inc eax
cmp eax, 0x70
jbe 0x499ba6
mov edx, 0x80
lea ecx, [ebx + 0x18]
sub edx, eax
add ecx, eax
call fcn.004a6900
lea eax, [esp + 0x10]
push eax
push 0x80
lea edx, [ebx + 0x18]
lea ecx, [ebx + 0x98]
call fcn.004a0c10
xor eax, eax
mov edx, 0x80
lea ecx, [ebx + 0x18]
sub edx, eax
add ecx, eax
call fcn.004a6900
mov edi, dword [ebx + 0x10]
mov cl, 0x3d
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
shld esi, edi, 3
shl edi, 3
call fcn.004a7f80
add edi, eax
bswap edi
adc esi, edx
mov dword [ebx + 0x8c], edi
bswap esi
mov dword [ebx + 0x88], esi
lea edi, [ebx + 0x98]
mov ecx, dword [ebx + 8]
lea edx, [ebx + 0x18]
mov eax, dword [ebx + 0xc]
shld eax, ecx, 3
bswap eax
shl ecx, 3
mov dword [ebx + 0x90], eax
lea eax, [esp + 0x10]
bswap ecx
push eax
mov dword [ebx + 0x94], ecx
mov ecx, edi
push 0x80
call fcn.004a0c10
mov edx, dword [esp + 0x14]
mov esi, edi
push 8
pop edi
mov ecx, dword [esi]
lea esi, [esi + 8]
mov eax, dword [esi - 4]
bswap ecx
mov dword [edx + 4], ecx
bswap eax
mov dword [edx], eax
lea edx, [edx + 8]
sub edi, 1
jne 0x499c25
mov edx, 0xd8
mov ecx, ebx
call fcn.004a6900
push 0x10
pop ecx
lea edi, [ebx + 0x98]
mov esi, 0x4bdec8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a2e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x4a3d50
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004a3971
push eax
push esi
push dword [ebp + 8]
call fcn.004a3926
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f

Function at 0x4a3d9e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004a3971
push eax
push esi
push dword [ebp + 8]
call fcn.004a3926
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004a3961
pop ss
mov byte [0x9d882bab], al
jl 0x4a3de6
invalid
invalid
Function at 0x4a69b0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebx
push ebp
push esi
push edi
sub esp, 8
mov eax, dword [edx]
mov ebx, dword [edx + 4]
mov ebp, dword [edx + 0xc]
mov edx, dword [edx + 8]
mov esi, dword [ecx + 0x1d0]
mov dword [esp + 4], esi
xor eax, dword [ecx]
xor ebx, dword [ecx + 4]
xor edx, dword [ecx + 8]
xor ebp, dword [ecx + 0xc]
lea ecx, [ecx + 0x10]
mov dword [esp], ecx
lea esp, [esp]
jmp 0x4a69eb
push ebp
movzx ecx, al
mov ecx, dword [ecx*4 + 0x4ba400]
movzx esi, ah
shr eax, 0x10
mov ebp, dword [esi*4 + 0x4ba800]
movzx edi, ah
mov edi, dword [edi*4 + 0x4bb000]
movzx eax, al
mov eax, dword [eax*4 + 0x4bac00]
movzx esi, bl
xor edi, dword [esi*4 + 0x4ba400]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [esi*4 + 0x4ba800]
movzx esi, bl
xor ebp, dword [esi*4 + 0x4bac00]
movzx ebx, bh
xor eax, dword [ebx*4 + 0x4bb000]
pop ebx
movzx esi, dl
xor eax, dword [esi*4 + 0x4ba400]
movzx esi, dh
xor edi, dword [esi*4 + 0x4ba800]
shr edx, 0x10
movzx esi, dl
xor ecx, dword [esi*4 + 0x4bac00]
movzx edx, dh
xor ebp, dword [edx*4 + 0x4bb000]
mov esi, dword [esp]
movzx edx, bl
xor ebp, dword [edx*4 + 0x4ba400]
movzx edx, bh
xor eax, dword [edx*4 + 0x4ba800]
shr ebx, 0x10
movzx edx, bl
xor edi, dword [edx*4 + 0x4bac00]
movzx ebx, bh
xor ecx, dword [ebx*4 + 0x4bb000]
mov edx, dword [esi + 8]
xor edx, eax
mov eax, dword [esi]
xor eax, ecx
xor ebp, dword [esi + 0xc]
mov ebx, dword [esi + 4]
xor ebx, edi
add esi, 0x10
cmp esi, dword [esp + 4]
mov dword [esp], esi
jb 0x4a69eb
push ebp
movzx ecx, al
movzx ecx, byte [ecx*4 + 0x4ba401]
movzx esi, ah
shr eax, 0x10
movzx ebp, byte [esi*4 + 0x4ba401]
movzx edi, ah
shl ebp, 8
movzx edi, byte [edi*4 + 0x4ba401]
movzx eax, al
shl edi, 0x18
movzx eax, byte [eax*4 + 0x4ba401]
shl eax, 0x10
movzx esi, bl
movzx esi, byte [esi*4 + 0x4ba401]
or edi, esi
movzx esi, bh
shr ebx, 0x10
movzx esi, byte [esi*4 + 0x4ba401]
shl esi, 8
or ecx, esi
movzx esi, bl
movzx esi, byte [esi*4 + 0x4ba401]
movzx ebx, bh
shl esi, 0x10
movzx ebx, byte [ebx*4 + 0x4ba401]
or ebp, esi
shl ebx, 0x18
or eax, ebx
movzx esi, dl
movzx esi, byte [esi*4 + 0x4ba401]
movzx ebx, dh
shr edx, 0x10
movzx ebx, byte [ebx*4 + 0x4ba401]
or eax, esi
shl ebx, 8
movzx esi, dl
movzx esi, byte [esi*4 + 0x4ba401]
or edi, ebx
pop ebx
movzx edx, dh
movzx edx, byte [edx*4 + 0x4ba401]
shl esi, 0x10
or ecx, esi
shl edx, 0x18
or ebp, edx
movzx esi, bl
movzx esi, byte [esi*4 + 0x4ba401]
movzx edx, bh
shr ebx, 0x10
movzx edx, byte [edx*4 + 0x4ba401]
or ebp, esi
shl edx, 8
or eax, edx
mov edx, dword [esp]
movzx esi, bl
movzx esi, byte [esi*4 + 0x4ba401]
movzx ebx, bh
movzx ebx, byte [ebx*4 + 0x4ba401]
shl esi, 0x10
shl ebx, 0x18
or edi, esi
mov esi, dword [esp + 0x1c]
or ecx, ebx
xor ecx, dword [edx]
xor edi, dword [edx + 4]
xor eax, dword [edx + 8]
xor ebp, dword [edx + 0xc]
mov dword [esi], ecx
mov dword [esi + 4], edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebp
mov dword [esp - 8], esp
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret 4