joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416fd0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x90
mov al, byte [0x42052c]
push ebx
push esi
mov ebx, ecx
push edi
mov byte [esp + 0x18], al
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x19]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xa4]
push ecx
push 1
push edx
mov ecx, ebx
call fcn.004178b0
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea eax, [esp + 0x18]
push 0x41fbac
push eax
call esi
test eax, eax
jne 0x417060
push 8
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
lea ecx, [esp + 0x18]
push 0x41fbac
push ecx
call esi
test eax, eax
jne 0x41704b
pop edi
pop esi
pop ebx
add esp, 0x90
ret 8
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea edx, [esp + 0x18]
push 0x41fbac
push edx
call esi
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x1c]
push 0x80
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
lea ecx, [esp + 0x18]
push 0x80
push ecx
mov ecx, ebx
call fcn.00417830
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 0x800000
push eax
push 0x6801
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4170d7
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [esp + 0x10], 0
mov edx, dword [0x41fb7c]
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x14]
push edx
push 0x41fb7c
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41710b
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41711c
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x90
ret 8
Function at 0x4176d0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Print debug messages

Disassembly:
sub esp, 0x90
mov al, byte [0x42052c]
push ebx
push esi
mov ebx, ecx
push edi
mov byte [esp + 0x18], al
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x19]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xa4]
push ecx
push 1
push edx
mov ecx, ebx
call fcn.004178b0
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea eax, [esp + 0x18]
push 0x41fbac
push eax
call esi
test eax, eax
jne 0x41776d
push 8
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
lea ecx, [esp + 0x18]
push 0x41fbac
push ecx
call esi
test eax, eax
jne 0x417758
push 0x41fc2c
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x90
ret 8
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea edx, [esp + 0x18]
push 0x41fbac
push edx
call esi
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x1c]
push 0x80
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
lea ecx, [esp + 0x18]
push 0x80
push ecx
mov ecx, ebx
call fcn.00417830
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 0x800000
push eax
push 0x6801
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x14]
push 0x41fb7c
push eax
push 0
push 0
push 0
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41780d
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41781e
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x90
ret 8
Function at 0x417b00
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x800
lea eax, [esp + 0x808]
lea edx, [esp]
push eax
push ecx
push 0x800
push edx
call dword [sym.imp.MSVCRT.dll__vsnprintf]
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
add esp, 0x800
ret
Function at 0x418120
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
lea ecx, [esp + 4]
mov dword [esp + 8], eax
lea edx, [esp + 0x14]
mov dword [esp + 0xc], eax
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x2c], eax
push eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], 0x44
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
pop edi
jne 0x41816f
add esp, 0x54
ret
mov ecx, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push 0xa
push ecx
call esi
test eax, eax
je 0x418195
call fcn.00415f20
mov edx, dword [esp + 4]
push 0xa
push edx
call esi
test eax, eax
jne 0x418183
mov eax, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov eax, 1
pop esi
add esp, 0x54
ret

Function at 0x418480
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x204
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
push 0x1fe
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x210]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xd]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x418520
mov dl, 0x22
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 8], dl
mov dword [esp + 4], eax
repne scasb al, byte es:[edi]
mov eax, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionRun]
not ecx
dec ecx
mov byte [esp + ecx + 8], dl
lea edx, [esp + 4]
push edx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x418520
lea edi, [esp + 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov edx, dword [0x41fefc]
dec ecx
push ecx
lea ecx, [esp + 0xc]
push ecx
push 1
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
add esp, 0x204
ret
Function at 0x4185d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x800
or ecx, 0xffffffff
xor eax, eax
push esi
push edi
mov edi, 0x42a10c
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4186a2
mov ecx, 0xff
lea edi, [esp + 9]
mov byte [esp + 8], al
push str.ishare_user.ini
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x400
push eax
push 0x42052c
push str.HTMLMSG
push str.Text
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jae 0x418656
push 0x69
call fcn.004047d0
add esp, 4
lea ecx, [esp + 8]
push eax
push str._table_style_TABLE_LAYOUT:_fixed__width_100______border_0__cellspacing_0__cellpadding_7__bgcolor_f7f7f7___tr__td__font_colorRED_size6em__CENTER__s__CENTER___font___td___tr__tr__td_style_LEFT:_0px__WIDTH:_100______WORD_WRAP:_break_word___font_colorBLACK_size4em___s__font___td___tr___table_
push ecx
call esi
add esp, 0xc
lea edx, [esp + 8]
push 0x42a10c
lea eax, [esp + 0x40c]
push edx
push eax
call esi
add esp, 0xc
push 0x42a10c
push str.Leave_g_szMessage_section_____s_
call fcn.00417b00
call fcn.004185b0
mov edx, dword [esp + 0x814]
lea ecx, [esp + 0x410]
push ecx
push edx
call fcn.00416500
add esp, 0x10
pop edi
pop esi
add esp, 0x800
ret
mov edi, 0x429d0c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x408]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x429d0c
mov eax, ecx
mov esi, edi
mov edi, edx
push str.Leave_g_szURL_section_____s_
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00417b00
call fcn.004185b0
mov ecx, dword [esp + 0x814]
push 0x429d0c
push ecx
call fcn.00416690
add esp, 0x10
pop edi
pop esi
add esp, 0x800
ret
Function at 0x418900
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x900
push ebx
push ebp
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x511]
mov byte [esp + 0x510], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
mov esi, dword [esp + 0x914]
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
push esi
mov dword [0x42a314], esi
stosb byte es:[edi], al
call fcn.0040a2d0
lea eax, [esp + 0x51c]
push eax
call fcn.00404bd0
add esp, 0x10
push eax
push 0x67
call fcn.004047d0
add esp, 4
lea ecx, [esp + 0x114]
push eax
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x110]
push edx
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x6a
call fcn.004047d0
add esp, 4
push eax
push 1
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x3f0
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
test byte [0x42868c], 0x10
je 0x418aa4
mov eax, dword [0x42a30c]
test eax, eax
jne 0x418aa4
mov eax, dword [0x428a50]
test eax, eax
jg 0x4189e6
mov eax, 0x1e
mov dword [0x429d08], eax
lea eax, [eax + eax*4]
mov ebp, dword [sym.imp.USER32.dll_SetTimer]
push 0
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
push eax
push 0x385
push esi
call ebp
push 0
push 0x3e8
push 0x386
push esi
call ebp
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x429d08]
stosw word es:[edi], ax
push ecx
push 0xffffffffffffffeb
push 0x3f0
push esi
stosb byte es:[edi], al
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, dword [0x429d08]
push edx
push 0x68
call fcn.004047d0
add esp, 4
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x3f0
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
push 1
push 0xf1
push 0x3f0
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 5
push 0x3f0
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x418ac3
mov ebp, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x2bf20
push 0x385
push esi
mov dword [0x429d08], 0xb4
call ebp
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 3
push 0
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0x64
push 0x387
push esi
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x900
ret
Function at 0x418ba0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x420150]
push esi
test eax, eax
jne 0x418bb8
mov eax, dword [0x42a314]
test eax, eax
je 0x418bb8
or eax, 0xffffffff
pop esi
ret
push ebx
push edi
call fcn.00418560
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
test esi, esi
mov dword [0x42a30c], eax
je 0x418ca9
mov edi, str.DRCOMWEBMSG:
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [sym.imp.MSVCRT.dll__strnicmp]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.DRCOMWEBMSG:
push esi
call ebx
add esp, 0xc
test eax, eax
jne 0x418c2d
mov ecx, 0x100
mov edi, 0x429d0c
rep stosd dword es:[edi], eax
mov ecx, 0x80
mov edi, 0x42a10c
rep stosd dword es:[edi], eax
mov edi, str.DRCOMWEBMSG:
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x200
add ecx, esi
push ecx
push 0x429d0c
jmp 0x418ca0
mov edi, str.POPUP
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.POPUP
push esi
call ebx
add esp, 0xc
test eax, eax
jne 0x418c7b
mov ecx, 0x100
mov edi, 0x429d0c
rep stosd dword es:[edi], eax
mov ecx, 0x80
mov edi, 0x42a10c
rep stosd dword es:[edi], eax
mov edi, str.POPUP
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x200
add ecx, esi
push ecx
jmp 0x418c9b
mov ecx, 0x80
xor eax, eax
mov edi, 0x42a10c
push 0x200
rep stosd dword es:[edi], eax
mov ecx, 0x100
mov edi, 0x429d0c
rep stosd dword es:[edi], eax
push esi
push 0x42a10c
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov eax, dword [0x420150]
pop edi
test eax, eax
pop ebx
je 0x418d03
cmp dword [0x42a318], 5
jle 0x418cc6
call fcn.004185b0
xor eax, eax
pop esi
ret
mov ecx, dword [esp + 8]
mov edx, dword [0x428e68]
push 0
push 0x418b00
push ecx
push 0x94
push edx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov esi, dword [0x42a318]
push 5
inc esi
push eax
mov dword [0x42a314], eax
mov dword [0x42a318], esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret
mov eax, dword [esp + 8]
mov ecx, dword [0x428e68]
push 0
push 0x418b00
push eax
push 0x94
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov dword [0x42a314], 0
xor eax, eax
pop esi
ret

Function at 0x418ee0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa4
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x9c
push eax
call esi
test eax, eax
jne 0x418f1d
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x94
push ecx
call esi
mov eax, dword [esp + 0x14]
pop edi
cmp eax, 5
pop esi
jb 0x418f47
lea edx, [esp]
mov dword [esp], 8
push edx
mov dword [esp + 8], 0x404
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
jne 0x418f4d
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
add esp, 0xa4
ret
Function at 0x4194a0
Capabilities:
Find taskbar

Disassembly:
sub esp, 8
push esi
push 0
push str.Shell_TrayWnd
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x41950d
mov esi, dword [sym.imp.USER32.dll_EnumChildWindows]
lea ecx, [esp + 4]
push ecx
push 0x4193e0
push eax
call esi
mov eax, dword [esp + 4]
test eax, eax
je 0x41950f
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x419504
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x419440
push eax
mov dword [esp + 0x14], 0
call esi
mov eax, dword [esp + 8]
test eax, eax
jne 0x41950f
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret
xor eax, eax
pop esi
add esp, 8
ret

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x44a6a0
Capabilities:
Accept command line arguments

Disassembly:
xor dword [ebp - 0x75], edx
in al, dx
push ecx
push ecx
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
movzx ecx, word [edi]
movzx edx, cx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
cmp ax, cx
jne 0x44a6c5
mov eax, dword [ebp + 8]
jmp 0x44a8fc
cmp dword [0x41cc70], 1
push esi
jle 0x44a7c4
mov eax, edi
and eax, 0xfff
push 2
pop esi
cmp eax, 0xff0
ja 0x44a6e9
movups xmm0, xmmword [edi]
jmp 0x44a717
movaps xmm0, xmmword [0x414310]
push 8
movzx edx, cx
pop ecx
movzx eax, dx
psrldq xmm0, 2
pinsrw xmm0, eax, 7
xor eax, eax
cmp ax, dx
je 0x44a70f
add edi, esi
movzx edx, word [edi]
sub ecx, 1
jne 0x44a6f6
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov eax, edx
and eax, 0xfff
cmp eax, 0xff0
ja 0x44a787
pcmpistri xmm0, xmmword [edx], 0xd
jbe 0x44a738
add edx, 0x10
mov ecx, dword [ebp - 8]
jmp 0x44a71a
jae 0x44a8f9
pcmpistri xmm0, xmmword [edx], 0xd
lea edx, [edx + ecx*2]
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov eax, edi
mov dword [ebp - 4], ecx
and eax, 0xfff
cmp eax, 0xff0
ja 0x44a7a1
mov eax, ecx
and eax, 0xfff
cmp eax, 0xff0
ja 0x44a7a1
movups xmm1, xmmword [ecx]
pcmpistri xmm1, xmmword [edi], 0xd
jno 0x44a7bd
js 0x44a8ff
mov ecx, dword [ebp - 4]
add edi, 0x10
add ecx, 0x10
jmp 0x44a74c
movzx eax, word [edx]
xor edi, edi
cmp di, ax
je 0x44a8f9
cmp ax, cx
je 0x44a747
add edx, esi
jmp 0x44a71a
movzx eax, word [ecx]
and dword [ebp - 4], 0
cmp word [ebp - 4], ax
je 0x44a8ff
cmp word [edi], ax
jne 0x44a7bd
add edi, esi
add ecx, esi
jmp 0x44a74c
add edx, esi
jmp 0x44a733
jne 0x44a8ad
movaps xmm3, xmmword [0x414310]
movzx eax, cx
mov ecx, dword [ebp + 8]
push 2
pop esi
movd xmm0, eax
pshuflw xmm0, xmm0, 0
pshufd xmm4, xmm0, 0
mov eax, ecx
and eax, 0xfff
cmp eax, 0xff0
ja 0x44a81d
movups xmm1, xmmword [ecx]
movaps xmm0, xmm3
pcmpeqw xmm0, xmm1
int3
add byte gs:[edx], ch
shld dword [eax], eax, cl
mov eax, dword [0x850f78]
test dword [eax], eax
cmp eax, edi
je 0x44a90e
push eax
call esi
mov dword [0x850f78], edi
mov eax, dword [0xa50f80]
cmp eax, edi
je 0x44a920
push eax
call esi
mov dword [0xa50f80], edi
mov eax, dword [0xa50f7c]
cmp eax, edi
je 0x44a932
push eax
call esi
mov dword [0xa50f7c], edi
pop edi
mov al, 1
pop esi
ret
Function at 0x44a6a1
Capabilities:
Accept command line arguments

Disassembly:
xor dword [ebp - 0x75], edx
in al, dx
push ecx
push ecx
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
movzx ecx, word [edi]
movzx edx, cx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
cmp ax, cx
jne 0x44a6c5
mov eax, dword [ebp + 8]
jmp 0x44a8fc
cmp dword [0x41cc70], 1
push esi
jle 0x44a7c4
mov eax, edi
and eax, 0xfff
push 2
pop esi
cmp eax, 0xff0
ja 0x44a6e9
movups xmm0, xmmword [edi]
jmp 0x44a717
movaps xmm0, xmmword [0x414310]
push 8
movzx edx, cx
pop ecx
movzx eax, dx
psrldq xmm0, 2
pinsrw xmm0, eax, 7
xor eax, eax
cmp ax, dx
je 0x44a70f
add edi, esi
movzx edx, word [edi]
sub ecx, 1
jne 0x44a6f6
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov eax, edx
and eax, 0xfff
cmp eax, 0xff0
ja 0x44a787
pcmpistri xmm0, xmmword [edx], 0xd
jbe 0x44a738
add edx, 0x10
mov ecx, dword [ebp - 8]
jmp 0x44a71a
jae 0x44a8f9
pcmpistri xmm0, xmmword [edx], 0xd
lea edx, [edx + ecx*2]
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov eax, edi
mov dword [ebp - 4], ecx
and eax, 0xfff
cmp eax, 0xff0
ja 0x44a7a1
mov eax, ecx
and eax, 0xfff
cmp eax, 0xff0
ja 0x44a7a1
movups xmm1, xmmword [ecx]
pcmpistri xmm1, xmmword [edi], 0xd
jno 0x44a7bd
js 0x44a8ff
mov ecx, dword [ebp - 4]
add edi, 0x10
add ecx, 0x10
jmp 0x44a74c
movzx eax, word [edx]
xor edi, edi
cmp di, ax
je 0x44a8f9
cmp ax, cx
je 0x44a747
add edx, esi
jmp 0x44a71a
movzx eax, word [ecx]
and dword [ebp - 4], 0
cmp word [ebp - 4], ax
je 0x44a8ff
cmp word [edi], ax
jne 0x44a7bd
add edi, esi
add ecx, esi
jmp 0x44a74c
add edx, esi
jmp 0x44a733
jne 0x44a8ad
movaps xmm3, xmmword [0x414310]
movzx eax, cx
mov ecx, dword [ebp + 8]
push 2
pop esi
movd xmm0, eax
pshuflw xmm0, xmm0, 0
pshufd xmm4, xmm0, 0
mov eax, ecx
and eax, 0xfff
cmp eax, 0xff0
ja 0x44a81d
movups xmm1, xmmword [ecx]
movaps xmm0, xmm3
pcmpeqw xmm0, xmm1
int3
add byte gs:[edx], ch
shld dword [eax], eax, cl
mov eax, dword [0x850f78]
test dword [eax], eax
cmp eax, edi
je 0x44a90e
push eax
call esi
mov dword [0x850f78], edi
mov eax, dword [0xa50f80]
cmp eax, edi
je 0x44a920
push eax
call esi
mov dword [0xa50f80], edi
mov eax, dword [0xa50f7c]
cmp eax, edi
je 0x44a932
push eax
call esi
mov dword [0xa50f7c], edi
pop edi
mov al, 1
pop esi
ret
Function at 0x48a302
Capabilities:
Authenticate hmac

Disassembly:
sar ecx, 1
add eax, dword [ebx + 8]
xor al, 0x4d
aaa
pop ebp
test eax, 0xea98bf6c
lodsd eax, dword [esi]
pushfd
mov al, 0x8c
mov dh, 0xfc
mov bh, 0xec
out dx, eax
lodsb al, byte [esi]
lahf
mov edi, 0x2c38381f
adc eax, 0xc83b5a1c
imul ebp, dword [edi - 0x46], 0xffffffbd
jl 0x48a2d0
add al, 0x36
mov eax, 0xd397cd3
mov byte gs:[0xc9f6c8bd], al
in eax, dx
and dword [ebx - 0x62e71073], ebp
cmp dword [ecx + edi], ebp
sbb al, 0x69
or al, 0x11
pop edi
insd dword es:[edi], dx
cmp edi, dword [eax - 0x66]
or ecx, dword [ebp + edi*4 - 0x33]
mov byte [edx - 0x39], dh
mov dl, 0xe9
mov ch, byte [ecx + 0x7d]
cmp byte [edx - 0x4e1bbdfe], dl
ficomp dword [ebx]
clc
or eax, 0x9915ecb9
pop ecx
adc eax, 0x4bb9b35d
mov ah, 0x85
pop esi
pop ds
pop ecx
cmp ebp, edi
jne 0x48a2a5
and dword [edi + edx*2 - 0x2f], esi
salc
cwde
imul edx, edx, 9
ror byte [ecx], cl
sub eax, 0x41f52da5
test cl, 0x9e
jns 0x48a374
sub byte [ecx + 0x5d], dh
xor dword [eax], eax
xchg ebp, eax
jb 0x48a2b4
loopne 0x48a36e
cdq
out 0xa8, al
imul ebp, dword [esi], 0x287e1fcf
inc ebp
or al, 0x19
jecxz 0x48a38f
out dx, eax
cmp al, 0xc2
cmp eax, 0xb47d8230
loope 0x48a3ca
xchg esi, eax
mov ch, 0x49
mov ebp, 0x39a9c629
fimul word [ebp - 0x23]
fist word [ebx + edi*4 - 0x3674f3d]
dec esi
sub edx, dword [ecx]
lds edx, [ebp + 0x31]
xor ebp, dword [0x5a328cfc]
pop edx
xchg edx, eax
sti
cld
push es
inc ebx
lodsd eax, dword [esi]
sti
aam 0x95
pop eax
mov esp, 0x34c18d8b
mov ch, 0xb5
add byte [esi + ecx*4 + 0x7c35fd5c], dh
invalid
mov cl, 0xb5
loope 0x48a31f
std
jl 0x48a336
jns 0x48a3e1
cdq
mov eax, dword [0xc332d12]
test eax, 0x4b7f9a8f
jmp 0x48a3a3
mov dword [0x8f7c1dad], ebp
xchg edi, eax
add ecx, dword [ebx + 0x214c79a1]
out 0x19, al
std
jecxz 0x48a36a
sbb ebx, ebx
cmpsb byte [esi], byte es:[edi]
int 0x5c
pop eax
insd dword es:[edi], dx
fnstenv [ebp + 0x55697def]
mov eax, 0x4d382921
cwde
movsd dword es:[edi], dword [esi]
fild dword [ecx + ebp*2 - 3]
in al, 0x4f
dec ebp
mov ah, bh
fistp dword [ecx + 0x1addc919]
int 0x85
xchg edx, eax
jne 0x48a42c
fdiv qword [edx]
cmp al, 0x11
fcom dword [ebx]
dec ecx
int1
les edx, [edi + esi*8]
add dword [ecx + 0x75], eax
sbb dword [ecx + 0x5ff679e8], 0x2d89bde4
int1
sbb byte [ebx - 0x13315fef], 0xe8
add dword [ebx], 0x48
sbb eax, 0xf3eaa677
add eax, 0xcbd3bc42
sub esi, dword [ecx]
xor edx, dword [esi - 0x63]
mov eax, dword [0x6fadee13]
out dx, eax
not dword [ecx - 0x5c2e4404]
sbb ch, byte [edi - 0x1a]
dec ebp
sbb dh, byte [esp + esi + 0x2a888b9d]
pop eax
test dword [edx + 0x3b9db8de], 0xb706ad65
and byte [ebx + ecx*8 + 5], bh
ret 0xfc9a