joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435a30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
xor ecx, ecx
test edx, edx
jbe 0x435a61
push esi
mov esi, dword [esp + 8]
push edi
movzx edi, byte [ecx + esi]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x522100]
inc ecx
cmp ecx, edx
jb 0x435a44
pop edi
pop esi
ret
Function at 0x43c720
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
push ebx
push esi
push edi
push eax
push ecx
mov ebx, 1
xor esi, esi
mov dword [ebp - 8], esi
push ebx
call fcn.00443e80
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add esp, 0xc
test edx, edx
je 0x43c8d2
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, 0xf4240
mov dword [ecx + 0x290], eax
mov dword [edx + 0x294], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push 0x40
push 0x47f0a8
push ecx
mov dword [eax + 0x298], esi
call fcn.0043f4e0
push esi
push eax
call fcn.0047f15c
add esp, 0x14
test eax, eax
je 0x43c797
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [ebp + 0x20]
mov edx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push esi
push edx
push edi
push eax
call fcn.00443f50
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 4]
push edx
push eax
push ecx
call fcn.0043f530
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
push edx
push eax
call fcn.0043ef00
add esp, 0x28
test eax, eax
jne 0x43c7d8
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x43c81a
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [edx + 0xb4], 0x2000
mov ecx, dword [eax + 0xb4]
mov edx, dword [ebp - 4]
push ecx
push edx
call fcn.00444000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
add esp, 8
mov dword [ecx + 0xb0], eax
cmp dword [edx + 0xb0], 0
jne 0x43c81a
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov dword [eax + 0x98], 0x43dd50
mov eax, dword [ebp - 4]
mov dword [ecx + 0x9c], fcn.0043dda0
mov ecx, dword [ebp - 8]
mov dword [eax + 0xa0], edx
test ecx, ecx
jne case.0x43c865.0
mov edx, dword [ebp - 4]
push 0x38
add edx, 0x78
push str.1.2.5
push edx
call fcn.00495da0
add eax, 6
add esp, 0xc
cmp eax, 6
ja case.0x43c865.5
jmp dword [eax*4 + 0x43c91c]
push str.zlib_memory_error
jmp 0x43c88e
mov ecx, dword [ebp - 4]
push str.zlib_stream_error
push ecx
jmp 0x43c892
mov edx, dword [ebp - 4]
push str.zlib_version_error
push edx
jmp 0x43c892
push str.Unknown_zlib_error
mov eax, dword [ebp - 4]
push eax
call fcn.0043f550
mov dword [ebp - 8], ebx
add esp, 8
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x43c8db
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xb0]
mov ecx, dword [ebp - 4]
push eax
push ecx
call fcn.00443fd0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
push edi
push esi
push eax
mov dword [edx + 0xb0], 0
call fcn.00443f00
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0xb0]
mov eax, dword [ebp - 4]
mov dword [ecx + 0x84], edx
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0xb4]
mov eax, dword [ebp - 4]
push 0
push 0
push eax
mov dword [ecx + 0x88], edx
call fcn.00443e30
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f500
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x43f51a
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x43f51a
mov edx, dword [esp + 8]
push edx
push ecx
call eax
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x440af0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x10
push ebx
mov bl, byte [edx + 8]
cmp bl, 3
je 0x440c9a
mov ecx, dword [esp + 0x20]
push ebp
mov ebp, dword [edx]
push esi
xor esi, esi
push edi
mov dword [esp + 0x24], esi
test bl, 2
je 0x440b48
movzx eax, byte [edx + 9]
movzx esi, byte [ecx]
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 1]
mov dword [esp + 0x10], edi
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 2]
sub eax, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov edi, 3
jmp 0x440b5b
movzx eax, byte [ecx + 3]
movzx edi, byte [edx + 9]
sub edi, eax
mov dword [esp + 0x10], edi
mov edi, 1
test bl, 4
je 0x440b6f
movzx ecx, byte [ecx + 4]
movzx eax, byte [edx + 9]
sub eax, ecx
mov dword [esp + edi*4 + 0x10], eax
inc edi
xor ecx, ecx
xor eax, eax
cmp edi, ecx
jle case.0x440bb6.3
jmp 0x440b80
cmp dword [esp + eax*4 + 0x10], ecx
jg 0x440b8c
mov dword [esp + eax*4 + 0x10], ecx
jmp 0x440b91
mov esi, 1
inc eax
cmp eax, edi
jl 0x440b80
cmp si, cx
je case.0x440bb6.3
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x440bb6.3
movzx eax, byte [eax + 0x440cb4]
jmp dword [eax*4 + 0x440ca0]
mov edx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp edx, ecx
jbe case.0x440bb6.3
lea esp, [esp]
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x440bd0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [edx + 4]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov ecx, edx
mov eax, pe_nt_image_headers32
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x440bb6.3
mov edi, edi
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x440c10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x440bb6.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [esp + edx*4 + 0x10]
shr byte [esi - 1], cl
cmp ebx, ebp
jb 0x440c36
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x440bb6.3
mov edi, edi
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, 0x100
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [esp + edx*4 + 0x10]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, ebp
jb 0x440c60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x449f20
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
add ecx, 0x24
mov eax, edx
shr eax, 1
test dl, 1
je 0x449f33
xor eax, 0xedb88320
test al, 1
je 0x449f40
shr eax, 1
xor eax, 0xedb88320
jmp 0x449f42
shr eax, 1
test al, 1
je 0x449f4f
shr eax, 1
xor eax, 0xedb88320
jmp 0x449f51
shr eax, 1
test al, 1
je 0x449f5e
shr eax, 1
xor eax, 0xedb88320
jmp 0x449f60
shr eax, 1
test al, 1
je 0x449f6d
shr eax, 1
xor eax, 0xedb88320
jmp 0x449f6f
shr eax, 1
test al, 1
je 0x449f7c
shr eax, 1
xor eax, 0xedb88320
jmp 0x449f7e
shr eax, 1
test al, 1
je 0x449f8b
shr eax, 1
xor eax, 0xedb88320
jmp 0x449f8d
shr eax, 1
test al, 1
je 0x449f9a
shr eax, 1
xor eax, 0xedb88320
jmp 0x449f9c
shr eax, 1
mov dword [ecx], eax
inc edx
add ecx, 4
cmp edx, 0x100
jb 0x449f25
ret

Function at 0x449fb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test edx, edx
jbe 0x449fdd
push ebx
push ebp
movzx ebx, byte [esi]
movzx ebp, al
xor ebx, ebp
shr eax, 8
xor eax, dword [ecx + ebx*4 + 0x24]
dec edx
inc esi
test edx, edx
ja 0x449fc6
pop ebp
pop ebx
mov dword [edi], eax
pop edi
pop esi
ret 0xc
Function at 0x462fc7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x46300e
call fcn.004646c7
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x46300e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x46302a
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00462b3f
mov esi, eax
test edi, edi
je 0x463028
test ebx, ebx
je 0x463028
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4639ea
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x463a0e
cmp dword [edi + 0x54], 0
jne 0x463a0e
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.004646c7
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004639ab
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x465e73
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x4e5801
call fcn.0047fab2
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x465e98
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x465ede
lea ecx, [ebp - 0x10]
call fcn.00401c70
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00463b82
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004011a0
mov eax, esi
call fcn.0047fb8a
ret 8
Function at 0x4672b1
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x525080]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x467349
push 0x4f4d24
push 4
push eax
call fcn.0047ea27
push eax
call fcn.00401040
add esp, 0x10
push ebx
push edi
call fcn.0047fa4f
mov edi, dword [eax]
call fcn.0047fa4f
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0047bdcb
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.0047fa4f
cmp dword [eax], ebx
je 0x467360
call fcn.0047fa4f
push dword [eax]
call fcn.00416f80
pop ecx
jmp 0x467367
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4672f4
jmp 0x4673ee
call fcn.0047fa4f
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x4673ea
cmp dword [ebp - 0x234], esi
jae 0x4673ea
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.0047a4b0
add esp, 0xc
push 0x4f411c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x4673d9
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4673d9
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x4673d9
push ebx
push ebx
push esi
jmp 0x4673e2
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x4673ec
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0047f73b
leave
ret

Function at 0x468f09
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x468f51
call fcn.004646c7
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x468f51
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x468f94
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x468f7d
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x468f7d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x468f91
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x47f73b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x525080]
jne 0x47f745
repz ret
jmp fcn.0048ec3b
Function at 0x490163
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00482b0f
and dword [ebp - 4], 0
cmp dword [0x536e80], 0
mov ebx, eax
jne 0x490214
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4902c5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4fad98
push edi
call esi
test eax, eax
je 0x4902c5
push eax
call fcn.00482a9d
mov dword [esp], 0x4fad88
push edi
mov dword [0x536e80], eax
call esi
push eax
call fcn.00482a9d
mov dword [esp], 0x4fad74
push edi
mov dword [0x536e84], eax
call esi
push eax
call fcn.00482a9d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x536e88], eax
call esi
push eax
call fcn.00482a9d
pop ecx
mov dword [0x536e90], eax
test eax, eax
je 0x490214
push 0x4fad40
push edi
call esi
push eax
call fcn.00482a9d
pop ecx
mov dword [0x536e8c], eax
mov eax, dword [0x536e8c]
cmp eax, ebx
je 0x49026c
cmp dword [0x536e90], ebx
je 0x49026c
push eax
call fcn.00482b18
push dword [0x536e90]
mov esi, eax
call fcn.00482b18
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x49026c
test edi, edi
je 0x49026c
call esi
test eax, eax
je 0x490263
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x490263
test byte [ebp - 0xc], 1
jne 0x49026c
or dword [ebp + 0x10], 0x200000
jmp 0x4902a5
mov eax, dword [0x536e84]
cmp eax, ebx
je 0x4902a5
push eax
call fcn.00482b18
pop ecx
test eax, eax
je 0x4902a5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4902a5
mov eax, dword [0x536e88]
cmp eax, ebx
je 0x4902a5
push eax
call fcn.00482b18
pop ecx
test eax, eax
je 0x4902a5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x536e80]
call fcn.00482b18
pop ecx
test eax, eax
je 0x4902c5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4902c7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x499100
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.0047af40
mov eax, dword [0x525080]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x499165
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x499165
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.0047f586
add eax, 0x40
push eax
call fcn.0048eb7d
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047f73b
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.004d7070
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4991f4
call fcn.00499020
test eax, eax
je 0x4991f4
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047f73b
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047f73b
add esp, 0x108
ret
Function at 0x4a4540
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.0047af40
mov eax, dword [0x525080]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
mov ebx, dword [esp + 0xa0]
push ebp
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebx, ebx
je 0x4a458f
mov eax, 1
mov dword [esi], ebx
jmp 0x4a4591
mov ebx, dword [esi]
test ecx, ecx
je 0x4a4658
push ebx
call fcn.004a4110
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x4a45c0
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.00499220
add esp, 0xc
mov ebp, dword [esp + 0xa8]
cmp edi, ebp
jge 0x4a45f9
mov ecx, dword [esp + 0x10]
push ecx
lea edi, [esi + 4]
push ebx
push edi
call fcn.004a3940
mov edx, dword [esp + 0x20]
push ebp
push edx
push edi
call fcn.004a39d0
lea ebp, [esi + 0x34]
push ebp
lea eax, [esi + 0x38]
push eax
push edi
call fcn.004a39e0
add esp, 0x24
jmp 0x4a4634
cmp ebp, 0x80
jbe 0x4a4615
push str.len_0__len__int_sizeof_ctx__key_
push 0x5e
push str..cryptohmachmac.c
call fcn.00499220
add esp, 0xc
mov ecx, dword [esp + 0x14]
push ebp
push ecx
lea edx, [esi + 0x38]
push edx
call fcn.0047b980
mov eax, dword [esp + 0xb4]
lea ebp, [esi + 0x34]
add esp, 0xc
mov dword [ebp], eax
mov ebp, dword [ebp]
cmp ebp, 0x80
je 0x4a465c
mov ecx, 0x80
sub ecx, ebp
push ecx
lea edx, [esi + ebp + 0x38]
push 0
push edx
call fcn.0047a4b0
add esp, 0xc
jmp 0x4a465c
test eax, eax
je 0x4a46d3
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x4a4660
mov ebp, dword [esp + 0x10]
push ebp
lea edi, [esi + 0x14]
push ebx
push edi
call fcn.004a3940
push ebx
call fcn.004a4110
push eax
lea edx, [esp + 0x2c]
push edx
push edi
call fcn.004a39d0
add esp, 0x1c
xor eax, eax
lea esp, [esp]
mov cl, byte [esi + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x4a46a0
push ebp
lea edi, [esi + 0x24]
push ebx
push edi
call fcn.004a3940
push ebx
call fcn.004a4110
push eax
lea edx, [esp + 0x2c]
push edx
push edi
call fcn.004a39d0
add esp, 0x1c
lea eax, [esi + 0x14]
push eax
add esi, 4
push esi
call fcn.004a3ad0
mov ecx, dword [esp + 0xa0]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047f73b
add esp, 0x8c
ret
Function at 0x4d1dc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x4d1dd9
mov edi, ebx
mov ebx, eax
jmp 0x4d1ddb
mov edi, eax
mov eax, dword [edi + 4]
mov esi, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jle 0x4d1df1
push eax
push esi
call fcn.004a2860
add esp, 8
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x4d1e0d
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 4]
jl 0x4d1df8
cmp eax, dword [edi + 4]
jge 0x4d1e22
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x4d1e12
mov edi, dword [edi + 4]
mov dword [esi + 4], edi
test edi, edi
jle 0x4d1e46
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
or ecx, 0xffffffff
mov edx, dword [eax]
sub eax, 4
test edx, edx
jne 0x4d1e46
add dword [esi + 4], ecx
cmp dword [esi + 4], edx
jg 0x4d1e35
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x2876884
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmc
cmp di, 0xdc66
bswap ecx
mov ecx, dword [edx + 0x18]
cmp si, 0x1e1d
bt dx, cx
pushfd
cmp ecx, dword [ebp - 8]
pushfd
mov word [esp], bp
lea esp, [esp + 8]
jnp 0x2876818
pushfd
lea esp, [esp + 4]
jbe fcn.025dfc74
xor esi, 0x54f8141f
and di, sp
sbb si, 0xcc02
sub ecx, 1
adc edi, edx
bswap di
bsr si, sp
mov dword [ebp - 4], ecx
xchg si, cx
call fcn.02874fa0
push ebx
mov word [esp], bp
pushfd
pushal
lea esp, [esp + 0x28]
jbe fcn.025dfc74
or si, cx
shr di, cl
bsf di, bx
bswap di
sub ecx, 1
or si, 0x4c5
push 0xfc33680a
mov dword [ebp - 4], ecx
bsf dx, cx
mov esi, dword [eax + 0x3c]
rol dx, cl
lea edx, [edx*4 - 0x2b10a087]
add esi, eax
mov dl, 0x67
bsf dx, si
bsf dx, si
mov edx, dword [esi + 0x78]
add esp, 4
jnp 0x2889b05
bt di, 0xe
test edx, edx
call fcn.025d9c27
sbb byte [eax + ebp], bl
xor byte [ebx], ah
pop eax
ja 0x2876898
invalid
jmp 0x2889dd8
pushfd
pushfd
pushal
test bl, ah
test edx, edx
pushfd
jmp 0x2889b00
lea esp, [esp + 0x2c]
je fcn.025dfc74
not ch
add edx, eax
mov cl, 0x49
bsr cx, bx
bt edx, 0x14
mov ecx, dword [esi + 0x7c]
push esi
cmc
clc
add ecx, edx
test ch, 0xf8
clc
stc
mov dword [ebp - 0x10], ecx
inc cl
mov ecx, dword [ebp + 0xc]
push 0x9700299b
bt ecx, edx
cmp ecx, 0xffff
push 0x1663867a
pushfd
lea esp, [esp + 0x10]
jbe 0x28766c0
ror cx, cl
movsx bx, dl
mov edi, dword [edx + 0x24]
bts ebx, 0x1c
mov cx, sp
add edi, eax
clc
bsf bx, bp
shr cl, cl
xadd cx, bx
mov ebx, dword [edx + 0x20]
sar ch, 5
btc ecx, 0x19
inc cx
add ebx, eax
bts ecx, 0x12
lea ecx, [eax - 0x506df209]
mov dword [ebp - 8], 0
jmp 0x25dd007
Function at 0x288f7d5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor bl, al
call fcn.0288fb52
lea esp, [esp + 0x30]
ja fcn.0288ff05
movsx cx, al
shrd edx, esi, cl
mov edx, esp
setno ah
lea ecx, [edi + 0x40]
xadd eax, edi
daa
sub ecx, edx
rol di, cl
test al, dl
btc di, 1
lea eax, [ebp - 0x80]
lea edi, [edi*2 - 0x76aa3eea]
and al, 0xfc
rcl edi, cl
cmp ch, al
cmc
sub eax, ecx
jmp 0x2890413
not esi
lea esi, [ebp + 0x475dad1e]
mov esi, edx
mov edi, 0x15cd1979
lea edi, [ecx + eax - 0x40]
push 0x25c8d3b1
jmp 0x2891808
push dword [esp]
jmp 0x2891d99
pushal
lea edi, [eax*2 - 0x7ad621b5]
pushfd
mov esp, eax
mov di, 0x5f52
mov di, 0x98e1
pushal
pushfd
pop dword [esp + 0x1c]
pushal
std
mov word [esp], 0x3828
xchg dword [esp + 0x38], esi
lea esp, [esp + 0x38]
jnp 0x288ff85
cld
not si
lea edi, [ebp*8 + 0x7c8c3ef5]
mov esi, edx
pushal
jmp 0x28918c6
test ch, 0x35
push 0x36337420
jmp 0x2891c22
std
push ebx
mov byte [esp], ah
mov word [esp], si
cld
push 0xe20dd8f3
pushal
pushfd
mov byte [esp + 0xc], al
rep movsb byte es:[edi], byte [esi]
add si, 0x60b5
shr di, 0xd
cld
rcl edi, cl
mov edi, dword [esp + 0x2c]
xor si, bp
mov esi, dword [esp + 0x30]
call fcn.02890122
pushfd
mov dword [esp + 0x28], edx
call fcn.0288fcfd
push 0xfee24d1a
push edx
sar al, 1
mov al, byte [esi]
bt bx, 0xd
stc
cmp bh, al
xor al, bl
sub esp, 0xfffffff8
jle 0x28922ed
neg al
jmp 0x289113e
push ebx
cwde
push dword [esp]
pushfd
bt ebx, ecx
sub ebp, 4
jmp 0x28900ee
pushal
mov byte [esp + 0xc], bl
xchg dword [esp + 0x20], edi
not di
jmp 0x2891cea
lea edi, [ecx + eax - 0x40]
pushal
pushfd
mov dword [esp + 0x40], edi
push 0xaae8fb42
movzx di, cl
mov edi, eax
lea esp, [esp + 0x44]
jno 0x2891730
pushal
cld
jmp 0x2891b8f
rep movsb byte es:[edi], byte [esi]
rcl di, cl
mov edi, dword [esp + 0x20]
and si, sp
bswap si
sar si, 2
call fcn.02891a75
pushal
mov dword [esp], 0xc25423a9
jmp fcn.0288face
not al
clc
stc
cmp cl, 0xd8
pushfd
add al, 0xf4
pushfd
bt bx, 6
push 0xae31cc42
mov byte [esp], ah
xor bl, al
stc
cbw
stc
sub esi, 0xffffffff
jmp 0x2891797
stc
pushal
pushal
not al
push ebx
mov word [esp], si
push ecx
add al, 0xf4
test eax, esp
stc
pushfd
jmp 0x288f7ce
mov edi, eax
mov byte [esp], al
pushal
cld
pushfd
rep movsb byte es:[edi], byte [esi]
btr esi, 6
std
mov edi, dword [esp + 0x44]
sbb esi, 0xf53474a9
cmc
mov esi, dword [esp + 0x48]
call fcn.0289019a
mov dword [esp + 0x28], edi
push edx
push ecx
push 0xe9abe4b3
push dword [esp]
lea esp, [esp + 0x38]
jmp fcn.028920df
mov dword [ebp], eax
mov byte [esp], 0x62
mov byte [esp], 0x7a
mov byte [esp + 0xc], 0xdf
mov word [esp], sp
lea esp, [esp + 0x20]
jmp 0x2890a79
bt sp, sp
stc
pushfd
neg al
jmp 0x2891cb8