joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418dab
Capabilities:
Encode data using xor

Disassembly:
cmp byte [edi + esi], dh
cmp dword [eax], edi
aaa
cmp dword [edx], esi
xor esi, dword [eax]
xor dword [eax], edi
xor al, 0x30
aaa
xor dword [ebx], esi
xor dh, byte [edi]
xor al, 0x39
cmp byte [eax], dh
xor bh, byte [ecx]
xor byte [eax], bh
xor al, 0x37
xor edi, dword [ecx]
xor dh, byte [eax]
xor dword [eax], edi
aaa
cmp dword [eax + edi], esi
xor dh, byte [eax]
cmp dword [eax], edi
xor al, 0x33
aaa
cmp dword [eax], edi
xor esi, dword [edx]
aaa
xor dword [ecx + edi], esi
cmp byte [eax], dh
xor dword [edi], esi
xor dh, byte [ebx]
cmp dword [eax], edi
xor al, 0x37
cmp byte [ecx], bh
xor dh, byte [ebx]
cmp dword [eax], esi
cmp byte [0x39303336], dh
xor eax, 0x30393638
cmp byte [ebx], dh
xor dh, byte [esi]
xor eax, 0x36303933
xor eax, 0x35363933
aaa
xor al, 0x37
xor eax, 0x35393836
xor dword ss:[eax + edi], esi
cmp dword [ebx], esi
xor byte [eax], bh
cmp dword [ecx + edi], esi
xor dh, byte [edi + esi]
xor byte [ebx], dh
xor dh, byte [edi]
xor al, 0x38
cmp dword [ebx], esi
xor bh, byte [eax]
xor al, 0x39
xor esi, dword [edi]
xor dh, byte [ecx]
cmp dword [eax], esi
xor al, 0x37
xor dword [edx], esi
cmp dword [eax], edi
xor al, 0x30
cmp byte [ecx], bh
xor dh, byte [ebx]
xor eax, 0x38393330
xor eax, 0x39303336
xor esi, dword [edx]
cmp byte [esi], dh
xor eax, 0x32383039
xor dword [ebx], esi
xor al, 0x37
xor dh, byte [ebx]
xor dword [eax], edi
aaa
xor byte [eax + esi], dh
cmp dword [eax], edi
mov al, 0xff
dec dword [ebp + 0x5051f34d]
lea eax, [ebp - 0x93e0]
mov ecx, esi
push eax
call fcn.00418f0e
test al, al
jne 0x418e59
lea ecx, [ebp - 0x93e0]
call fcn.00411289
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41b90d
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
or bh, bh
xor eax, eax
mov word [ecx + 0x32], ax
mov byte [ecx + 0xc], al
mov dword [ecx + 0x10], eax
mov word [ecx + 0x14], ax
mov dword [ecx + 0x1034], eax
xor dword [eax + edx], 0x41880000
xor byte [esi - 0x77], ah
inc ecx
and al, 0x89
inc ecx
sbb byte [ecx + 0x41892841], cl
sub al, 0x8b
rol edi, 1
or byte [ecx + 0x43], cl
add byte [esi - 0x39], ah
inc ecx
sbb al, 0
add esi, eax
inc ecx
push ds
add edi, eax
inc ecx
and byte [eax], al
add dword [eax], eax
add bl, al
Function at 0x420790
Capabilities:
Encode data using xor

Disassembly:
xor dword [edi], esi
xor dh, byte [ebx]
cmp dword [eax], edi
xor al, 0x37
cmp byte [ecx], bh
xor dh, byte [ebx]
cmp dword [eax], esi
cmp byte [0x39303336], dh
xor eax, 0x30393638
cmp byte [ebx], dh
xor dh, byte [esi]
xor eax, 0x36303933
xor eax, 0x35363933
aaa
xor al, 0x37
xor edi, dword [ecx]
xor eax, 0x37343637
xor eax, 0x35393836
xor dword ss:[eax + edi], esi
cmp dword [ebx], esi
xor byte [eax], bh
cmp dword [ecx + edi], esi
xor dh, byte [edi + esi]
xor byte [ebx], dh
xor dh, byte [edi]
xor al, 0x38
cmp dword [ebx], esi
xor bh, byte [eax]
xor al, 0x39
xor esi, dword [edi]
xor dh, byte [ecx]
cmp dword [eax], esi
xor al, 0x37
xor dword [edx], esi
cmp dword [eax], edi
xor al, 0x30
cmp byte [ecx], bh
xor dh, byte [ebx]
xor eax, 0x38393330
xor eax, 0x39303336
xor esi, dword [edx]
cmp byte [esi], dh
xor eax, 0x32383039
xor dword [ebx], esi
xor al, 0x37
xor dh, byte [ebx]
xor dword [eax], edi
aaa
xor byte [eax + esi], dh
cmp dword [eax], edi
inc edx
inc ebx
add byte [ebx - 0x74af1bbb], cl
or byte [ebx - 0x3174f78f], cl
call dword [0x434278]
call esi
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4207b3
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x434278]
call esi
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x434278]
call esi
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x434278]
call esi
mov al, bl
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x422ef5
Capabilities:
Encode data using xor

Disassembly:
xor byte [eax], bh
xor esi, dword [edi]
xor dh, byte [eax]
xor dword [ebx], esi
cmp dword [eax + edi], esi
aaa
xor bh, byte [eax]
xor edi, dword [ecx]
xor byte [edi], dh
xor edi, dword [eax]
cmp dword [eax], esi
xor al, 0x39
xor bh, byte [eax]
xor esi, dword [ecx]
xor byte [esi], dh
xor eax, 0x33313230
cmp byte [ecx], bh
xor byte ss:[0x36393332], dh
xor eax, 0x33393834
xor dh, byte [0x33393236]
cmp byte [ecx], dh
xor eax, 0x32383039
xor esi, dword [esi]
xor eax, 0x32383931
xor edi, dword [ecx]
cmp byte [edi + esi], dh
cmp dword [eax], edi
aaa
cmp dword [edx], esi
xor esi, dword [eax]
xor dword [eax], edi
xor al, 0x30
aaa
xor dword [ebx], esi
xor dh, byte [edi]
xor al, 0x39
cmp byte [eax], dh
xor bh, byte [ecx]
xor byte [eax], bh
xor al, 0x37
xor edi, dword [ecx]
xor dh, byte [eax]
xor dword [eax], edi
aaa
cmp dword [eax + edi], esi
xor dh, byte [eax]
cmp dword [eax], edi
xor al, 0x33
aaa
cmp dword [eax], edi
xor esi, dword [edx]
aaa
xor dword [ecx + edi], esi
cmp byte [eax], dh
xor dword [edi], esi
xor dh, byte [ebx]
cmp dword [eax], edi
xor al, 0x37
cmp byte [ecx], bh
xor dh, byte [ebx]
cmp dword [eax], esi
cmp byte [0x39303336], dh
xor eax, 0x30393638
cmp byte [ebx], dh
xor dh, byte [esi]
xor eax, 0x36303933
xor eax, 0x35363933
aaa
xor al, 0x37
xor eax, 0x35393836
xor dword ss:[eax + edi], esi
xor al, 0x38
cmp dword [ebx], esi
xor byte [eax], bh
cmp dword [ecx + edi], esi
xor dh, byte [edi + esi]
xor byte [ebx], dh
xor dh, byte [edi]
xor al, 0x38
cmp dword [ebx], esi
xor bh, byte [eax]
xor al, 0x39
xor esi, dword [edi]
xor dh, byte [ecx]
cmp dword [eax], esi
xor al, 0x37
xor dword [edx], esi
cmp dword [eax], edi
xor al, 0x30
cmp byte [ecx], bh
xor dh, byte [ebx]
xor eax, 0x38393330
xor eax, 0x39303336
xor esi, dword [edx]
cmp byte [esi], dh
xor eax, 0x32383039
xor dword [ebx], esi
xor al, 0x37
xor dh, byte [ebx]
xor dword [eax], edi
cmp byte [edi], dh
xor byte [eax + esi], dh
cmp dword [eax], edi
add byte [eax], al
cmp word [esi], 0x2e
jne 0x422eb0
movzx eax, word [esi + 2]
push eax
call fcn.0042300e
test al, al
je 0x422eb0
add esi, 4
jmp 0x422eb0
Function at 0x424123
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
push ebx
push ebp
push esi
mov esi, ecx
push edi
sub eax, 1
je 0x4245fe
sub eax, 1
je 0x4245fe
sub eax, 1
je 0x424538
sub eax, 1
je 0x4243e2
sub eax, 1
je 0x4241ca
sub eax, 1
mov ecx, dword [esi + 0x14]
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov dword [esp + 0x30], edx
add edx, ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], edx
cmp ecx, 0x20000
ja 0x42466d
cmp eax, 0x80
ja 0x42466d
test eax, eax
je 0x42466d
xor edi, edi
mov dword [esp + 0x3c], edi
test eax, eax
je 0x424669
and dword [esp + 0x24], 0
lea eax, [esp + 0x44]
and dword [esp + 0x20], 0
xor esi, esi
and dword [esp + 0x1c], 0
xor ebx, ebx
and dword [esp + 0x18], 0
xor ebp, ebp
push 0x1c
push esi
push eax
mov dword [esp + 0x20], esi
call 0x437a97
and dword [esp + 0x38], ebx
add esp, 0xc
mov dword [esp + 0x28], edi
cmp edi, dword [esp + 0x34]
jae 0x4243cc
mov ecx, dword [esp + 0x20]
mov eax, ecx
sub eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], ecx
mov ecx, edi
imul ecx, esi
mov esi, dword [esp + 0x40]
mov dl, byte [eax]
inc eax
mov dword [esp + 0x30], eax
Function at 0x4244b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x32333836
xor eax, 0x33303839
xor dh, byte [ecx]
xor eax, 0x36383934
xor edi, dword [ecx]
xor bh, byte [eax]
xor eax, 0x39333236
xor dword [eax], edi
xor byte [esi], dh
xor eax, 0x32383039
xor esi, dword [esi]
xor eax, 0x32333839
xor dword [esi], esi
xor eax, 0x32333830
xor dword [esi], esi
cmp dword ss:[0x32333830], esi
xor eax, 0x36383039
cmp dword [eax], edi
xor byte [esi], dh
xor eax, 0x32383039
xor esi, dword [esi]
cmp dword [0x33323638], esi
cmp dword [eax], edi
xor byte [ecx], dh
xor eax, 0x33323836
xor dword [esi], esi
xor dword [eax], esi
xor eax, 0x36333839
xor eax, 0x30323338
cmp dword [0x38333638], esi
cmp dword [edx], esi
cmp dword ss:[esi + 0x39333830], esi
cmp byte [ecx], dh
xor al, 0x31
aaa
xor esi, dword [edx]
cmp dword [eax + edi], esi
aaa
cmp dword [eax], edi
xor al, 0x37
xor bh, byte [ecx]
cmp byte [edi + esi], dh
cmp dword [eax], esi
xor bh, byte [eax]
xor dword [edi], esi
xor al, 0x39
xor byte [eax], bh
aaa
xor al, 0x39
xor byte [eax], bh
xor esi, dword [edi]
xor dh, byte [eax]
xor dword [ebx], esi
cmp dword [eax + edi], esi
aaa
xor bh, byte [eax]
xor edi, dword [ecx]
xor byte [edi], dh
xor edi, dword [eax]
cmp dword [eax], esi
xor al, 0x39
xor bh, byte [eax]
xor esi, dword [ecx]
xor byte [esi], dh
xor eax, 0x33313230
cmp byte [ecx], bh
xor byte ss:[0x36393332], dh
xor eax, 0x33393834
xor dh, byte [0x33393236]
cmp byte [ecx], dh
xor eax, 0x32383039
xor esi, dword [esi]
xor eax, 0x32383931
xor edi, dword [ecx]

Function at 0x4244cf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x32333836
xor eax, 0x33303839
xor dh, byte [ecx]
xor eax, 0x36383934
xor edi, dword [ecx]
xor bh, byte [eax]
xor eax, 0x39333236
xor dword [eax], edi
xor byte [esi], dh
xor eax, 0x32383039
xor esi, dword [esi]
xor eax, 0x32333839
xor dword [esi], esi
xor eax, 0x32333830
xor dword [esi], esi
cmp dword ss:[0x32333830], esi
xor eax, 0x36383039
cmp dword [eax], edi
xor byte [esi], dh
xor eax, 0x32383039
xor esi, dword [esi]
cmp dword [0x33323638], esi
cmp dword [eax], edi
xor byte [ecx], dh
xor eax, 0x33323836
xor dword [esi], esi
xor dword [eax], esi
xor eax, 0x36333839
xor eax, 0x30323338
cmp dword [0x38333638], esi
cmp dword [edx], esi
cmp dword ss:[esi + 0x39333830], esi
cmp byte [ecx], dh
xor al, 0x31
aaa
xor esi, dword [edx]
cmp dword [eax + edi], esi
aaa
cmp dword [eax], edi
xor al, 0x37
xor bh, byte [ecx]
cmp byte [edi + esi], dh
cmp dword [eax], esi
xor bh, byte [eax]
xor dword [edi], esi
xor al, 0x39
xor byte [eax], bh
aaa
xor al, 0x39
xor byte [eax], bh
xor esi, dword [edi]
xor dh, byte [eax]
xor dword [ebx], esi
cmp dword [eax + edi], esi
aaa
xor bh, byte [eax]
xor edi, dword [ecx]
xor byte [edi], dh
xor edi, dword [eax]
cmp dword [eax], esi
xor al, 0x39
xor bh, byte [eax]
xor esi, dword [ecx]
xor byte [esi], dh
xor eax, 0x33313230
cmp byte [ecx], bh
xor byte ss:[0x36393332], dh
xor eax, 0x33393834
xor dh, byte [0x33393236]
cmp byte [ecx], dh
xor eax, 0x32383039
xor esi, dword [esi]
xor eax, 0x32383931
xor edi, dword [ecx]
Function at 0x4244e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x32333836
xor eax, 0x33303839
xor dh, byte [ecx]
xor eax, 0x36383934
xor edi, dword [ecx]
xor bh, byte [eax]
xor eax, 0x39333236
xor dword [eax], edi
xor byte [esi], dh
xor eax, 0x32383039
xor esi, dword [esi]
xor eax, 0x32333839
xor dword [esi], esi
xor eax, 0x32333830
xor dword [esi], esi
cmp dword ss:[0x32333830], esi
xor eax, 0x36383039
cmp dword [eax], edi
xor byte [esi], dh
xor eax, 0x32383039
xor esi, dword [esi]
cmp dword [0x33323638], esi
cmp dword [eax], edi
xor byte [ecx], dh
xor eax, 0x33323836
xor dword [esi], esi
xor dword [eax], esi
xor eax, 0x36333839
xor eax, 0x30323338
cmp dword [0x38333638], esi
cmp dword [edx], esi
cmp dword ss:[esi + 0x39333830], esi
cmp byte [ecx], dh
xor al, 0x31
aaa
xor esi, dword [edx]
cmp dword [eax + edi], esi
aaa
cmp dword [eax], edi
xor al, 0x37
xor bh, byte [ecx]
cmp byte [edi + esi], dh
cmp dword [eax], esi
xor bh, byte [eax]
xor dword [edi], esi
xor al, 0x39
xor byte [eax], bh
aaa
xor al, 0x39
xor byte [eax], bh
xor esi, dword [edi]
xor dh, byte [eax]
xor dword [ebx], esi
cmp dword [eax + edi], esi
aaa
xor bh, byte [eax]
xor edi, dword [ecx]
xor byte [edi], dh
xor edi, dword [eax]
cmp dword [eax], esi
xor al, 0x39
xor bh, byte [eax]
xor esi, dword [ecx]
xor byte [esi], dh
xor eax, 0x33313230
cmp byte [ecx], bh
xor byte ss:[0x36393332], dh
xor eax, 0x33393834
xor dh, byte [0x33393236]
cmp byte [ecx], dh
xor eax, 0x32383039
xor esi, dword [esi]
xor eax, 0x32383931
xor edi, dword [ecx]
Function at 0x42c0e2
Capabilities:
Encode data using xor

Disassembly:
xor byte [edx], dh
xor edi, dword [eax]
cmp dword [ecx], esi
xor byte [edi + esi], dh

Function at 0x42da4c
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [esp + esi*4 + 0x1d]
mov cl, byte [esp + 0x20]
xor cl, byte [eax + 0x440098]
mov byte [esp + 0x20], cl
movzx eax, byte [esp + esi*4 + 0x1e]
mov al, byte [eax + 0x440098]
xor byte [esp + 0x21], al
movzx eax, byte [esp + esi*4 + 0x1f]
mov al, byte [eax + 0x440098]
xor byte [esp + 0x22], al
movzx eax, byte [esp + esi*4 + 0x1c]
mov al, byte [eax + 0x440098]
xor byte [esp + 0x23], al
mov al, byte [edi]
xor al, cl
inc edi
mov byte [esp + 0x20], al
mov dword [esp + 0x1c], edi
cmp esi, 8
je 0x42d98e
cmp esi, 1
jle 0x42d982
lea eax, [esi - 1]
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], eax
push 4
pop edi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x42d970
sub dword [esp + 0x14], 1
jne 0x42d96d
xor edi, edi
test esi, esi
jle 0x42da54
jmp 0x42da0c
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 3
push 4
pop edi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x42d99d
sub dword [esp + 0x14], 1
jne 0x42d99a
movzx eax, byte [esp + 0x2c]
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], 3
mov al, byte [eax + 0x440098]
xor byte [esp + 0x30], al
movzx eax, byte [esp + 0x2d]
mov al, byte [eax + 0x440098]
xor byte [esp + 0x31], al
movzx eax, byte [esp + 0x2e]
mov al, byte [eax + 0x440098]
xor byte [esp + 0x32], al
movzx eax, byte [esp + 0x2f]
mov al, byte [eax + 0x440098]
xor byte [esp + 0x33], al
push 4
pop edi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x42d9fa
sub dword [esp + 0x14], 1
jne 0x42d9f7
cmp ebx, dword [ebp + 4]
jg 0x42da57
cmp edi, esi
jge 0x42da41
lea ebp, [esp + 0x20]
lea ebp, [ebp + edi*4]
cmp edx, 4
jge 0x42da3d
mov esi, dword [esp + 0x10]
lea ecx, [edx + ebx*4]
mov eax, dword [ebp]
inc edi
add ebp, 4
inc edx
mov dword [esi + ecx*4 + 0x18], eax
mov esi, dword [esp + 0x18]
cmp edi, esi
jl 0x42da1d
mov ebp, dword [esp + 0x10]
cmp edx, 4
jne 0x42da47
inc ebx
lea eax, [edx - 4]
neg eax
sbb eax, eax
and edx, eax
cmp edi, esi
jl 0x42da0c
cmp ebx, dword [ebp + 4]
mov edi, dword [esp + 0x1c]
jle 0x42d90b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 4
Function at 0x42fc18
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ebx], dh
xor eax, 0x31383139
xor dh, byte [ebx]
xor eax, 0x38333239
cmp byte [ecx], dh
xor eax, 0x36333132
cmp byte [0x33323839], dh
cmp dword [ecx], esi
xor eax, 0x33323938
xor eax, 0x33323139
cmp byte ss:[ecx], bh
xor eax, 0x31323336
cmp dword [eax], esi
xor eax, 0x32383936
xor esi, dword [ecx]
xor eax, 0x36303839
xor dword [edx], esi
xor esi, dword [eax]
cmp dword [eax], edi
xor eax, 0x38393036
xor dh, byte [ecx]
xor esi, dword [0x32383936]
xor esi, dword [esi]
xor eax, 0x33323839
cmp dword ss:[eax], edi
xor al, 0x37
xor dword [ecx + edi], esi
cmp byte [ebx], dh
aaa
cmp dword [eax], edi
xor al, 0x31
aaa
xor dh, byte [ecx]
xor edi, dword [ecx]
cmp byte [edi], dh
xor al, 0x39
cmp byte [edx], dh
xor dword [ebx], esi
aaa
xor al, 0x39
cmp byte [ebx], dh
xor dh, byte [ecx]
xor eax, 0x33393635
cmp byte [edx], dh
xor eax, 0x38313936
xor dh, byte [ebx]
xor eax, 0x32333836
xor eax, 0x33303839
xor dh, byte [ecx]
xor eax, 0x36383934
xor edi, dword [ecx]
xor bh, byte [eax]
xor eax, 0x39333236
xor dword [eax], edi
xor byte [esi], dh
xor eax, 0x32383039
xor esi, dword [esi]
xor eax, 0x32333839
xor dword [esi], esi
xor eax, 0x32333830
xor dword [esi], esi
cmp dword [0x32333830], esi
xor eax, 0x36383039
cmp dword [eax], edi
xor byte [esi], dh
xor eax, 0x32383039
xor byte [eax], bh
xor dh, byte [ebx]
cmp dword ss:[0x33323638], esi
cmp dword [eax], edi
xor byte [ecx], dh
xor eax, 0x33323836
xor dword [esi], esi
xor dword [eax], esi
xor eax, 0x36333839
xor eax, 0x30323338
cmp dword [0x38333638], esi
cmp dword [edx], esi
cmp dword ss:[esi + 0x39333830], esi
cmp byte [ecx], dh
xor al, 0x31
aaa
xor esi, dword [edx]
cmp dword [eax + edi], esi
aaa
cmp dword [eax], edi
xor al, 0x37
xor bh, byte [ecx]
cmp byte [edi + esi], dh
cmp dword [eax], esi
xor bh, byte [eax]
xor dword [edi], esi
xor al, 0x39
xor byte [eax], bh
aaa
xor al, 0x39
xor byte [eax], bh
xor esi, dword [edi]
xor dh, byte [eax]
xor dword [ebx], esi
Function at 0x432341
Capabilities:
Encode data using xor

Disassembly:
xor byte [eax], bh
aaa
xor al, 0x39
xor byte [eax], bh
xor esi, dword [edi]
xor dh, byte [eax]
xor dword [ebx], esi
cmp dword [eax + edi], esi
aaa
xor bh, byte [eax]
xor edi, dword [ecx]
xor byte [edi], dh
xor edi, dword [eax]
cmp dword [eax], esi
xor al, 0x39
xor bh, byte [eax]
xor esi, dword [ecx]
xor byte [esi], dh
xor eax, 0x33313230
cmp byte [ecx], bh
xor byte ss:[0x36393332], dh
xor eax, 0x33393834
xor dh, byte [0x33393236]
cmp byte [ecx], dh
xor eax, 0x32383039
xor esi, dword [esi]
xor eax, 0x32383931
xor edi, dword [ecx]
cmp byte [edi + esi], dh
cmp dword [eax], edi
aaa
cmp dword [edx], esi
xor esi, dword [eax]
xor dword [eax], edi
xor al, 0x30
aaa
xor dword [ebx], esi
xor dh, byte [edi]
xor al, 0x39
cmp byte [eax], dh
xor bh, byte [ecx]
xor byte [eax], bh
xor al, 0x37
xor edi, dword [ecx]
xor dh, byte [eax]
xor dword [eax], edi
aaa
cmp dword [eax + edi], esi
xor dh, byte [eax]
cmp dword [eax], edi
xor al, 0x33
aaa
cmp dword [eax], edi
xor esi, dword [edx]
aaa
xor dword [ecx + edi], esi
cmp byte [eax], dh
xor dword [edi], esi
xor dh, byte [ebx]
cmp dword [eax], edi
xor al, 0x37
cmp byte [ecx], bh
xor dh, byte [ebx]
cmp dword [eax], esi
cmp byte [0x39303336], dh
xor eax, 0x30393638
cmp byte [ebx], dh
xor dh, byte [esi]
xor eax, 0x36303933
xor eax, 0x35363933
aaa
xor al, 0x37
xor eax, 0x35393836
xor dword ss:[eax + edi], esi
cmp dword [ebx], esi
xor byte [eax], bh
cmp dword [ecx + edi], esi
xor dh, byte [edi + esi]
xor byte [ebx], dh
xor dh, byte [edi]
xor al, 0x38
cmp dword [ebx], esi
xor bh, byte [eax]
xor al, 0x39
xor esi, dword [edi]
xor dh, byte [ecx]
cmp dword [eax], esi
xor al, 0x37
xor dword [edx], esi
cmp dword [eax], edi
xor al, 0x30
cmp byte [ecx], bh
xor dh, byte [ebx]
xor eax, 0x38393330
xor eax, 0x39303336
xor esi, dword [edx]
cmp byte [esi], dh
xor eax, 0x32383039
xor dword [ebx], esi
xor al, 0x37
xor dh, byte [ebx]
xor dword [eax], edi
aaa
xor byte [eax + esi], dh
cmp dword [eax], edi
and eax, 0xf
mov edx, dword [ebx + ecx*4]
xor edx, dword [ebx + eax*4]
mov eax, edi
xor edx, dword [ebx + esi*4]
xor edx, dword [ebx + ebp*4]

Function at 0x4328fb
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x1c], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4
Function at 0x401c00
Capabilities:
Read file on windows

Disassembly:
xor eax, eax
cmp dword [0x471388], 0
je 0x401c0c
ret
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [0x47171c]
call fcn.0040cc90
add esp, 0x10
test edx, edx
js 0x401c42
push dword [esp + 0x10]
push dword [esp + 8]
push dword [0x47171c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
sar eax, 0x1f
ret
mov eax, 0xffffffff
ret
Function at 0x404520
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
push dword [esp + 0x14]
call fcn.0040cf80
add esp, 4
cmp dword [esp + 0x18], 0
je 0x404598
test esi, esi
je 0x404598
mov ebp, eax
push 0x104
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x404585
mov ebx, eax
mov eax, dword [ebp + 4]
push 0x104
push ebx
push esi
push edi
push ebp
call dword [eax]
add esp, 0x14
test eax, eax
js 0x40458f
mov ecx, ebx
mov edx, eax
call fcn.004045b0
mov esi, eax
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, esi
jmp 0x40458a
mov eax, 0xfffffff4
pop esi
pop edi
pop ebx
pop ebp
ret
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov ecx, edi
mov edx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004045b0
Function at 0x4049c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ecx, ecx
je 0x404a6c
mov edx, dword [esp + 0x14]
xor esi, esi
movdqa xmm0, xmmword [0x452d60]
movdqa xmm1, xmmword [0x452d70]
nop dword [eax]
movzx edi, byte [edx + esi]
xor edi, eax
mov ebx, edi
shr ebx, 1
mov eax, edi
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ebx
mov ebx, eax
shr ebx, 1
movd xmm2, edi
shl edi, 0x1e
sar edi, 0x1f
and edi, 0xedb88320
xor edi, ebx
mov ebx, edi
shr ebx, 6
pshufd xmm2, xmm2, 0
pand xmm2, xmm0
pcmpeqd xmm2, xmm0
pand xmm2, xmm1
shl eax, 0x1a
sar eax, 0x1f
and eax, 0x76dc4190
shl edi, 0x1a
sar edi, 0x1f
and edi, 0xedb88320
xor edi, ebx
xor edi, eax
pshufd xmm3, xmm2, 0xee
pxor xmm3, xmm2
pshufd xmm2, xmm3, 0x55
pxor xmm2, xmm3
movd eax, xmm2
xor eax, edi
inc esi
cmp ecx, esi
jne 0x4049f0
pop esi
pop edi
pop ebx
ret
Function at 0x4052c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0xa4]
mov eax, 0xf2f52010
test edx, edx
je 0x405378
xor esi, esi
movdqa xmm0, xmmword [0x452dc0]
movdqa xmm1, xmmword [0x452dd0]
nop dword [eax]
movzx edi, byte [ecx + esi]
xor edi, eax
mov ebx, edi
shr ebx, 1
mov eax, edi
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ebx
mov ebx, eax
shr ebx, 1
movd xmm2, edi
shl edi, 0x1e
sar edi, 0x1f
and edi, 0xedb88320
xor edi, ebx
mov ebx, edi
shr ebx, 6
pshufd xmm2, xmm2, 0
pand xmm2, xmm0
pcmpeqd xmm2, xmm0
pand xmm2, xmm1
shl eax, 0x1a
sar eax, 0x1f
and eax, 0x76dc4190
shl edi, 0x1a
sar edi, 0x1f
and edi, 0xedb88320
xor edi, ebx
xor edi, eax
pshufd xmm3, xmm2, 0xee
pxor xmm3, xmm2
pshufd xmm2, xmm3, 0x55
pxor xmm2, xmm3
movd eax, xmm2
xor eax, edi
inc esi
cmp edx, esi
jne 0x4052f0
cmp edx, 0xffb
ja 0x405415
movdqa xmm0, xmmword [0x452dc0]
movdqa xmm1, xmmword [0x452dd0]
nop dword [eax + eax]
movzx esi, byte [ecx + edx + 4]
xor esi, eax
mov edi, esi
shr edi, 1
mov eax, esi
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edi
mov edi, eax
shr edi, 1
movd xmm2, esi
shl esi, 0x1e
sar esi, 0x1f
and esi, 0xedb88320
xor esi, edi
mov edi, esi
shr edi, 6
pshufd xmm2, xmm2, 0
pand xmm2, xmm0
pcmpeqd xmm2, xmm0
pand xmm2, xmm1
shl eax, 0x1a
sar eax, 0x1f
and eax, 0x76dc4190
shl esi, 0x1a
sar esi, 0x1f
and esi, 0xedb88320
xor esi, edi
xor esi, eax
pshufd xmm3, xmm2, 0xee
pxor xmm3, xmm2
pshufd xmm2, xmm3, 0x55
pxor xmm2, xmm3
movd eax, xmm2
xor eax, esi
inc edx
cmp edx, 0xffc
jne 0x405390
pop esi
pop edi
pop ebx
ret