joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044dd
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00408e10
mov eax, dword [0x42f180]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
push esi
push edi
push dword [0x43292c]
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
push ebp
lea eax, [esp + 0x18]
push eax
mov ebx, 0x425524
push ebx
push str.title
mov esi, 0x425f40
push esi
call edi
push 0x50
pop ecx
lea eax, [esp + 0x10]
mov edx, 0x431140
call fcn.00407350
push dword [0x43292c]
lea eax, [esp + 0x14]
push ebp
push eax
push ebx
push str.info
push esi
call edi
mov ecx, ebp
lea eax, [esp + 0x10]
mov edx, 0x431580
call fcn.00407350
push dword [0x43292c]
push 0x50
push 0x4327c0
push ebx
push str.build_info
push esi
call edi
push dword [0x43292c]
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x43292c]
mov dword [0x431194], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x43292c]
mov dword [0x431190], eax
push 0xa
push 0x432590
push ebx
push str.target_version
push esi
call edi
push dword [0x43292c]
push 0x50
push 0x4312c0
push ebx
push str.name
push str.metadata
call edi
push dword [0x43292c]
push 0x104
push 0x4311a0
push ebx
push str.install_script
push esi
call edi
push dword [0x43292c]
mov ebp, 0x431550
push 0xa
push ebp
push ebx
push str.user_access_control
push esi
call edi
push 6
mov edi, str.force
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40462b
call fcn.00407350
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.00407350
jmp 0x4046cb
push 5
mov edi, str.auto
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x404658
call fcn.00407350
test eax, eax
je 0x404688
call fcn.00403547
test eax, eax
jne 0x404688
call fcn.00407350
test eax, eax
je 0x404688
jmp 0x404621
cmp byte [0x431550], al
je 0x404688
push 5
mov edi, str.none
mov esi, ebp
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x404688
push eax
push str.oops
push str.Bad_user_access_control_value
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x431140
call fcn.00402766
push eax
mov dword [0x432580], eax
call fcn.00407350
pop ecx
pop ecx
push dword [0x432814]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [0x43292c]
test eax, eax
je 0x4046bb
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [0x432930]
test eax, eax
je 0x4046cb
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00407875
add esp, 0x1004
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7

Function at 0xefd520
Capabilities:
Encode data using xor

Disassembly:
jmp 0xefd52a
pushal
call 0xefd530
pop ebp
sub ebp, 0x10
sub ebp, 0xafd520
jmp 0xefd546
mov eax, 0xafd520
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d6
mov edx, 0xf4cf197b
xor byte [eax], dl
inc eax
dec ecx
jne 0xefd55d
jmp 0xefd570
invalid
Function at 0x414370
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x475258
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x495278]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
call fcn.00413f10
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4143c4
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x14]
call fcn.00413e40
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
mov ecx, esi
mov word [esi + 4], di
call fcn.00413f10
cmp dword [esp + 0x24], 8
jb 0x41440a
mov eax, dword [esp + 0x10]
push eax
call fcn.00454f10
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret

Function at 0x414a60
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x178
mov eax, dword [0x495278]
xor eax, esp
mov dword [esp + 0x174], eax
push ebx
push ebp
mov ebp, dword [esp + 0x184]
push esi
push edi
mov ebx, ecx
push ebp
call fcn.00414990
add esp, 4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ebx
call dword [0x4792ac]
mov esi, eax
cmp esi, 0xffffffff
jne 0x414ab5
call dword [0x4792b4]
jmp 0x414bc3
mov ebx, dword [0x47927c]
push 0
lea eax, [esp + 0x18]
push eax
push 0x40
lea ecx, [esp + 0x14c]
push ecx
push esi
mov edi, 0xb
call ebx
test eax, eax
je 0x414bc1
cmp dword [esp + 0x14], 0x40
jne 0x414bc1
cmp word [esp + 0x140], 0x5a4d
jne 0x414bc1
mov edx, dword [esp + 0x17c]
push 0
push 0
push edx
push esi
call dword [0x4792c4]
push 0
lea eax, [esp + 0x18]
push eax
push 0xf8
lea ecx, [esp + 0x54]
push ecx
push esi
call ebx
test eax, eax
je 0x414bc1
cmp dword [esp + 0x14], 0xf8
jne 0x414bc1
cmp dword [esp + 0x48], 0x4550
jne 0x414bc1
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414b47
sub eax, edx
mov edx, dword [esp + 0x50]
sar eax, 1
mov ebx, eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], 0
call fcn.0045580a
mov esi, eax
mov ecx, 9
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x48]
push ecx
add edx, 1
push edx
add eax, 0x76c
push eax
mov ecx, 0x7e
push 0x4893e4
sub ecx, ebx
push ecx
lea edx, [ebp + ebx*2]
push edx
call fcn.0045695b
add esp, 0x28
xor edi, edi
mov eax, edi
mov ecx, dword [esp + 0x184]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00454f15
add esp, 0x178
ret
Function at 0x415400
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x17c
mov eax, dword [0x495278]
xor eax, esp
mov dword [esp + 0x178], eax
mov eax, dword [esp + 0x180]
push ebp
lea edx, [esp + 8]
push edx
push 0x40
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x140]
push eax
push ebx
push esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], 0
call edi
cmp dword [esp + 8], 0x40
jne 0x415515
cmp word [esp + 0x138], 0x5a4d
jne 0x415515
mov ecx, dword [esp + 0x174]
lea edx, [esp + 8]
push edx
push 0xf8
lea eax, [esp + 0x20]
push eax
lea ebp, [ebx + ecx]
push ebp
push esi
mov dword [esp + 0x1c], 0
call edi
cmp dword [esp + 8], 0xf8
jne 0x415515
cmp dword [esp + 0x18], 0x4550
jne 0x415515
cmp word [esp + 0x1c], 0x14c
jne 0x415515
cmp word [esp + 0x30], 0x10b
jne 0x415515
add ebp, 0xf8
cmp word [esp + 0x1e], 0
mov dword [esp + 0xc], 0
jbe 0x415515
lea ecx, [esp + 8]
push ecx
push 0x28
lea edx, [esp + 0x118]
push edx
push ebp
push esi
mov dword [esp + 0x1c], 0
call edi
cmp dword [esp + 8], 0x28
jne 0x415515
mov eax, dword [esp + 0x11c]
test eax, eax
je 0x415515
mov ecx, dword [esp + 0x134]
and ecx, 0x20000020
cmp ecx, 0x20000020
je 0x41552d
mov eax, dword [esp + 0xc]
movzx edx, word [esp + 0x1e]
add eax, 1
cmp eax, edx
mov dword [esp + 0xc], eax
jb 0x4154bf
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x178]
xor ecx, esp
call fcn.00454f15
add esp, 0x17c
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x120]
add eax, ebx
mov dword [ecx], eax
mov ecx, dword [esp + 0x10]
add eax, edx
mov dword [ecx], eax
mov ecx, dword [esp + 0x17c]
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00454f15
add esp, 0x17c
ret
Function at 0x423150
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x476c0e
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x495278]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [0x49d9ac]
mov edx, dword [eax + 0xc]
mov ecx, 0x49d9ac
call edx
add eax, 0x10
mov dword [esi], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov ecx, 0xa
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ecx
cmp edi, eax
mov byte [esp + 0x14], 2
mov byte [esi + 0x34], al
mov byte [esi + 0x35], al
je 0x4231e1
mov ecx, edi
lea ebx, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
cmp dx, ax
jne 0x4231d0
sub ecx, ebx
sar ecx, 1
mov eax, ecx
mov ebx, eax
push edi
mov eax, esi
call fcn.004033a0
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jle 0x4231fc
mov ecx, edi
mov edx, esi
call fcn.004232d0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x423b60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x475dc8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x495278]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [0x49d9ac]
mov edx, dword [eax + 0xc]
mov ecx, 0x49d9ac
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x24], esi
call fcn.00423a30
cmp eax, esi
mov edi, dword [esp + 0xc]
je 0x423bd2
push 0xa
lea edx, [esp + 0x14]
push edx
push edi
call fcn.00457d8a
add esp, 0xc
mov esi, eax
lea eax, [edi - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x423bf6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0xc
Function at 0x427420
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x474528
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x495278]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [0x4a09d8]
xor ebx, ebx
mov dword [esp + 0xc], esi
mov byte [esp + 0x10], bl
push ebx
push esi
mov dword [esp + 0x40], ebx
call dword [0x4792d4]
cmp eax, ebx
je 0x42746c
cmp eax, 0x80
jne 0x4274bc
mov ecx, dword [0x4a09b0]
cmp ecx, ebx
mov byte [esp + 0x10], 1
je 0x4274b5
mov eax, dword [ecx + 8]
cmp eax, ebx
je 0x4274b5
cmp byte [eax + 0x18], bl
je 0x4274b5
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x18], eax
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
mov byte [esp + 0x31], bl
mov byte [esp + 0x30], bl
mov byte [esp + 0x33], bl
call fcn.00428240
push esi
call dword [0x479128]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret 8

Function at 0x438e40
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
mov eax, 0x4e67c6a7
jbe 0x438e6d
push esi
push edi
jmp 0x438e50
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 2
add esi, edi
movzx edi, byte [ecx]
add esi, edi
xor eax, esi
add ecx, 1
sub edx, 1
jne 0x438e50
pop edi
pop esi
and eax, 0x7fffffff
ret
Function at 0x44aa20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x477138
mov eax, dword fs:[0]
push eax
sub esp, 8
push edi
mov eax, dword [0x495278]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
xor ecx, ecx
mov dword [esp + 0x18], ecx
sub esp, 0x18
mov eax, esp
mov byte [esp + 0x20], cl
mov edx, dword [esp + 0x20]
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x24], esp
push edx
mov edx, dword [esp + 0x40]
mov dword [eax + 0x14], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push eax
push ecx
push edx
mov edx, dword [esp + 0x48]
call fcn.0044ade0
add esp, 0x28
lea edi, [esp + 0x30]
call fcn.0044a220
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x14
ret

Function at 0x44b4a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x477138
mov eax, dword fs:[0]
push eax
sub esp, 8
push edi
mov eax, dword [0x495278]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
xor ecx, ecx
mov dword [esp + 8], ecx
mov dword [esp + 0x18], ecx
sub esp, 0x18
mov eax, esp
mov byte [esp + 0x20], cl
mov edx, dword [esp + 0x20]
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x24], esp
push edx
mov edx, dword [esp + 0x44]
mov dword [eax + 0x14], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x48]
push eax
push ecx
mov ecx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x48]
push esi
call fcn.0044b5f0
add esp, 0x2c
lea edi, [esp + 0x30]
call fcn.0044a220
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x14
ret

Function at 0x4512c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x473db3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x495278]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
push ebx
call fcn.00450e20
lea ecx, [esi + 0x34]
mov dword [esi], 0x47967c
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x49d920
or eax, 0xffffffff
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x48a55c
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.004521c0
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x454ffa
Capabilities:
Encode data using xor

Disassembly:
adc bh, bh
jne 0x454ff4
add byte [ebx - 0x3fccf33c], al
push dword [esp + 8]
and al, 8
push 0
xchg esp, eax
sbb eax, ecx
add byte [edx + edx + 0x690000c1], dl
rol dword [ecx], 0
cdq
rol dword [ecx], 0
rol word [ecx], 0
outsd dx, dword [esi]
rol dword [ecx], 0
lcall 0x1c1, 0x630001c1
add byte [ebx - 0x3f], bh
add dword [eax], eax
jl 0x454fe8
add dword [eax], eax
ja 0x454fec
add dword [eax], eax
jo 0x454ff0
add dword [eax], eax
jp 0x454ff4
add dword [eax], eax
cmpsd dword [esi], dword es:[edi]
rol dword [ecx], 0
jbe 0x454ffc
add dword [eax], eax
je 0x455000
add dword [eax], eax
popfd
rol dword [ecx], 0
xchg esi, eax
rol dword [ecx], 0
wait
rol dword [ecx], 0
pushfd
rol dword [ecx], 0
mov byte [0xa10001c1], al
rol dword [ecx], 0
sahf
rol dword [ecx], 0
js 0x455020
add dword [eax], eax
rol dword [bx + di], 0
invalid

Function at 0x4572e9
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
and cl, byte [edx - 0x7a]
clc
jecxz 0x457322
invalid
adc byte [edi + 0x6c88a7a], dh
xchg dword [ebx - 0x7c6aa98], ebp
and eax, 0xa3fd7c8f
push es
fcomp st(6)
push es
push 0xfffffffffffffff2
or dh, byte [edx + eax*4 - 0x74c8dfb4]
dec edx
cmc
sbb al, 0x5d
push ds
mov ebp, 0x4dd48861
mov al, 0x48
sub bl, 0xda
salc
xor bh, dh
sub byte [ecx + 0x7ae09265], 0x1d
invalid

Function at 0x46bffe
Capabilities:
Encode data using xor

Disassembly:
nop
fsin
inc dword [ebx + 0x4eb0cc4]
and dword [ebp - 0xc], 0
push ebx
call 0x45588c
pop ecx
push dword [ebp - 8]
call 0x45588c
push ebp
mov eax, dword [eax]
add byte [ebp + 5], ah
xchg esp, eax
adc al, cl
add byte [eax], al
jle 0x46bfcc

Function at 0x46c2e2
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x26
add byte [edi], cl
add byte [eax], al
add byte [ebx - 0x10], ch
add byte [eax], al
push cs
imul esi, eax, 0
add byte [esi], cl
xlatb
das
and al, 0xc8
and byte [edi], al
pop edx
add byte [eax], al
add dword [eax], eax
add byte [eax], dh
xor byte [ebp + esi + 0x36], al
add byte [esi + 0x42], al
inc edx
xor esi, dword [edi]
push edi
push ebp
push eax
push ecx
imul esi, eax, 0
add bl, bl
add byte [eax], 0
add byte [eax], al
sldt word [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jbe 0x46c2ec
invalid
Function at 0x46dd9a
Capabilities:
Encode data using xor

Disassembly:
inc eax
jmp 0x46ddbf
or dword [eax + 0x78755c4f], 0xafe2a4be
mov eax, 0xcbe1612a
adc al, 0xb4
div dword [esi - 0x4d]
mov edx, 0x5776b9a9
push esi
or dword [ebp + 0x5a], 0x1c
pop esp
sbb al, 0x5c
jo 0x46de51
into
outsb dx, byte [esi]
loop 0x46de44
sbb al, 0xfc
aaa
cmp ecx, dword [ecx + 0x4d]
cmp al, 0xc3
loopne 0x46de34
scasd eax, dword es:[edi]
mov esp, 0xfeaa3b5
into
out dx, al
lea edi, [ebx + 0x16]
loop 0x46dddd
pushfd
sbb byte [edi + 0x7b], ah
stosd dword es:[edi], eax
jne 0x46de3d
lds edi, [ebx]
test eax, 0x6e76e35d
test al, 0xda
fcmovnu st(0), st(3)
and dword [edx + 0x56], ebx
invalid
mov esp, 0x9b19a8ea
jnp 0x46de9b
int1
push sp
push esp
sahf
mov cl, 6
wait
fcmovnu st(0), st(7)
popfd
clc
dec edi
push cs
push edx
mov bl, byte [edx]
mov ebx, dword [edx - 0x2263a63e]
xchg ebp, eax
push ss
mov dh, 0xe8
mov dh, 0xa1
jae 0x46de97
fst qword [ebp - 0x491749ea]
mov eax, dword [0xc5ed3d73]
fiadd dword [ebp + 0x2c4adba6]
inc eax
xor byte [ebp - 0x21757011], cl
fistp word [ecx + 0x7c05ac2c]
sub al, 0xe0
in eax, dx
invalid
and esi, dword [edx - 0x548edb21]
shr dword [ebx + 0x1b37074a], cl
invalid
insb byte es:[edi], dx
add dword [esi + 0xa], ebx
loopne 0x46def2
sbb byte [esi - 0xf226fec], 0xee
inc esp
cli
lahf
invalid
jecxz 0x46de71
mov cl, 0xef
xchg esi, eax
sub eax, 0xd29f4447
pop ecx
cmp al, 0x5d
and dword [edx - 0x6a], 0x29
or al, 0x53
sub dword [ebx + edx*2], ecx
push esp
aas
jno 0x46dee2
fdivr dword [ebx + 0x2a]
fild word [ebx - 0x60b83cac]
ja 0x46df0c
jmp 0x46df40
retf 0x32d1
add bl, byte [ebx - 0x540c8ef3]
call 0x455bfb39
jno 0x46dfb9
ret 0x4a8a
lea eax, [ebp + 0xf76f852]
sbb dword [eax - 0x50080e3c], eax
push ds
mov esp, 0xe0f2fc8a
idiv byte [ecx + 0x9ccda33]
xchg edi, eax
lodsb al, byte [esi]
dec ebp
push eax
xor dword [ebx - 0x43aa37d8], esi
mov bh, 0x87
dec edx
dec esi
insd dword es:[edi], dx
std
add eax, 0x2bc3b2e0
cmp al, 0x9a
aaa
movsd dword es:[edi], dword [esi]
test eax, 0xc5661985
xor cl, byte [ecx]
mov ecx, 0xca29a44d
adc byte [edi], cl
adc eax, 0xb72819a0
dec ecx
xor dl, dl
mov edx, ebp
inc ebp
push es
mov ebp, 0x5bc5fd25
retf 0x5adc
Function at 0x4029a0
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x1c
mov eax, dword [ecx]
push ebx
push ebp
mov ebp, dword [ecx + 0xc]
xor bl, bl
push esi
mov esi, dword [ecx + 4]
push edi
mov edi, dword [ecx + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x28], ecx
xor ecx, ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
cmp ecx, 0x3c
ja case.0x4029dd.1
movzx eax, byte [ecx + 0x402ae4]
jmp dword [eax*4 + 0x402ad0]
mov dword [esp + 0x10], 0x5a827999
jmp case.0x4029dd.1
mov dword [esp + 0x10], 0x6ed9eba1
jmp case.0x4029dd.1
mov dword [esp + 0x10], 0x8f1bbcdc
jmp case.0x4029dd.1
mov dword [esp + 0x10], 0xca62c1d6
mov al, bl
and al, 0xf
movzx edx, al
cmp bl, 0xf
jbe 0x402a60
mov esi, dword [esp + 0x14]
lea ecx, [edx - 8]
and ecx, 0xf
lea eax, [edx - 3]
and eax, 0xf
mov ecx, dword [esi + ecx*4]
xor ecx, dword [esi + eax*4]
lea eax, [edx + 2]
and eax, 0xf
xor ecx, dword [esi + eax*4]
mov eax, esi
mov esi, dword [esp + 0x18]
xor ecx, dword [eax + edx*4]
rol ecx, 1
mov dword [eax + edx*4], ecx
cmp bl, 0x14
jb 0x402a60
cmp bl, 0x28
jae 0x402a55
mov eax, ebp
xor eax, edi
xor eax, esi
jmp 0x402a6c
cmp bl, 0x3c
jae 0x402a4d
mov eax, edi
or eax, esi
jmp 0x402a64
mov eax, esi
not eax
mov ecx, edi
and eax, ebp
and ecx, esi
or eax, ecx
mov esi, dword [esp + 0x14]
inc bl
mov ecx, dword [esp + 0x1c]
rol ecx, 5
add ecx, dword [esi + edx*4]
mov edx, ebp
add ecx, dword [esp + 0x10]
mov ebp, edi
add ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
add eax, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
inc ecx
ror edi, 2
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], ecx
cmp bl, 0x50
jb 0x4029d1
mov ecx, dword [esp + 0x28]
add dword [ecx + 8], edi
add dword [ecx + 4], esi
add dword [ecx + 0xc], ebp
add dword [ecx], eax
add dword [ecx + 0x10], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4037f0
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, edx
mov dword [esp + 0xc], ecx
push edi
movzx ebp, byte [esi]
movzx eax, byte [esi + 1]
shl ebp, 8
xor ebp, eax
movzx eax, byte [esi + 2]
shl ebp, 8
xor ebp, eax
movzx eax, byte [esi + 3]
shl ebp, 8
xor ebp, eax
mov dword [ecx], ebp
movzx ebx, byte [esi + 4]
movzx eax, byte [esi + 5]
shl ebx, 8
xor ebx, eax
movzx eax, byte [esi + 6]
shl ebx, 8
xor ebx, eax
movzx eax, byte [esi + 7]
shl ebx, 8
xor ebx, eax
mov dword [ecx + 4], ebx
movzx edi, byte [esi + 8]
movzx eax, byte [esi + 9]
shl edi, 8
xor edi, eax
movzx eax, byte [esi + 0xa]
shl edi, 8
xor edi, eax
movzx eax, byte [esi + 0xb]
shl edi, 8
xor edi, eax
mov dword [ecx + 8], edi
movzx edx, byte [esi + 0xc]
movzx eax, byte [esi + 0xd]
shl edx, 8
xor edx, eax
movzx eax, byte [esi + 0xe]
shl edx, 8
xor edx, eax
movzx eax, byte [esi + 0xf]
shl edx, 8
xor edx, eax
mov esi, dword [esp + 0x10]
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
movzx eax, al
mov ecx, dword [eax*4 + str.ccccwwww]
mov eax, edx
shr eax, 8
xor ecx, 0x1000000
movzx eax, al
and ecx, 0xff000000
mov eax, dword [eax*4 + str.ccccwwww]
and eax, 0xff0000
xor ecx, eax
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, eax
movzx eax, dl
mov eax, dword [eax*4 + str.ccccwwww]
and eax, 0xff00
xor ecx, eax
lea eax, [esi + 0x10]
xor ecx, ebp
xor ebx, ecx
mov dword [eax], ecx
xor edi, ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], edi
xor edi, edx
mov dword [esi + 0x1c], edi
mov edi, 0x4679c4
mov ebx, dword [eax + 0xc]
mov esi, eax
add eax, 0x10
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
mov edx, dword [ecx*4 + str.ccccwwww]
mov ecx, ebx
shr ecx, 0x10
and edx, 0xff0000
movzx ecx, cl
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff000000
xor edx, ecx
mov ecx, ebx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + str.ccccwwww]
xor edx, ecx
movzx ecx, bl
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff00
xor edx, ecx
xor edx, dword [edi]
add edi, 4
xor edx, dword [esi]
mov dword [eax], edx
mov ecx, dword [eax - 0xc]
xor ecx, edx
mov dword [eax + 4], ecx
mov edx, dword [eax - 8]
xor edx, ecx
mov dword [eax + 8], edx
xor edx, ebx
mov dword [eax + 0xc], edx
cmp edi, 0x4679e8
jne 0x4038f1
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
pop ecx
ret