joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3a287a35
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x42c
mov eax, 0x3a28b1b0
call fcn.3a28a102
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
call dword [0x3a28e770]
xor ebx, ebx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x3a287af5
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x42c]
push eax
call fcn.3a289b2c
add esp, 0xc
test eax, eax
jl 0x3a287af5
mov edi, dword [ebp - 0x42c]
cmp edi, 0x400
jg 0x3a287ad7
push edi
call fcn.3a282e50
test al, al
pop ecx
je 0x3a287ad7
mov eax, edi
call fcn.3a28a1e1
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x3a287ae3
push edi
lea ecx, [ebp - 0x428]
call fcn.3a289b2c
push dword [ebp - 0x424]
push edi
push esi
push eax
call fcn.3a289b2c
cmp eax, ebx
jne 0x3a287b2c
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x3a287b0e
lea ecx, [ebp - 0x418]
call fcn.3a284831
lea ecx, [ebp - 0x428]
call fcn.3a282d72
mov eax, 0x8007000e
lea esp, [ebp - 0x448]
call fcn.3a28a15b
ret 0x10
push 2
push ebx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x424], edi
jne 0x3a287b4e
call fcn.3a283f4e
mov esi, eax
jmp 0x3a287c4c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x3a287b71
call fcn.3a283f4e
jmp 0x3a287c3e
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x41c], eax
je 0x3a287b67
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x420], esi
jae 0x3a287bca
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x3a287bb3
lea ecx, [ebp - 0x418]
call fcn.3a284831
mov esi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.3a282d72
mov eax, esi
jmp 0x3a287b1e
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.3a289b2c
mov dword [ebp - 4], 1
jmp 0x3a287bfc
cmp dword [ebp - 0x418], ebx
jne 0x3a287c0b
mov esi, 0x8007000e
jmp 0x3a287c40
push esi
push dword [ebp - 0x41c]
push esi
push dword [ebp - 0x418]
call fcn.3a289b2c
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x434]
call fcn.3a289b2c
mov esi, eax
push dword [ebp - 0x424]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x3a287bb8
lea ecx, [ebp - 0x418]
call fcn.3a284831
jmp 0x3a287bb8
Function at 0x3a289a70
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3a281bf8]
jne 0x3a28a781
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x3a28eb18], eax
mov dword [0x3a28eb14], ecx
mov dword [0x3a28eb10], edx
mov dword [0x3a28eb0c], ebx
mov dword [0x3a28eb08], esi
mov dword [0x3a28eb04], edi
mov word [0x3a28eb30], ss
mov word [0x3a28eb24], cs
mov word [0x3a28eb00], ds
mov word [0x3a28eafc], es
mov word [0x3a28eaf8], fs
mov word [0x3a28eaf4], gs
pushfd
pop dword [0x3a28eb28]
mov eax, dword [ebp]
mov dword [0x3a28eb1c], eax
mov eax, dword [ebp + 4]
mov dword [0x3a28eb20], eax
lea eax, [ebp + 8]
mov dword [0x3a28eb2c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x3a28ea68], 0x10001
mov eax, dword [0x3a28eb20]
mov dword [0x3a28ea1c], eax
mov dword [0x3a28ea10], 0xc0000409
mov dword [0x3a28ea14], 1
mov eax, dword [0x3a281bf8]
mov dword [ebp - 0x328], eax
mov eax, dword [0x3a28e774]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x3a28ea60], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x3a281f78
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x3a28ea60], 0
jne 0x3a28a871
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x3a289a7d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x3a281c44
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3a289ad5
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0
push 0
push 0x3a281c3c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x3a289ad5
mov al, 1
jmp 0x3a289ad7
xor al, al
leave
ret 8
Function at 0x3a289b2c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x3a289b3b
pop dword [ebp - 0x28]
mov eax, 0x65067cb0
add eax, 0xd5221e8b
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x2a9d4a70
add dword [ebp - 0x38], 0x23b4fadb
mov dword [ebp - 0x34], 0x52edbf4e
add dword [ebp - 0x34], 0xdf458cf7
mov dword [ebp - 0x30], 0x86bfdbc9
sub dword [ebp - 0x30], 0x3a73979b
mov dword [ebp - 0x2c], 0xb59b5d72
add dword [ebp - 0x2c], 0x4a64a28e
lea eax, [ebp - 0x38]
push eax
mov eax, 0x8d72b73c
add eax, 0xacb55908
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x8487c47d
sub dword [ebp - 0x38], 0x10155b27
mov dword [ebp - 0x34], 0x46cfb6c2
add dword [ebp - 0x34], 0xfa9caab3
mov dword [ebp - 0x30], 0x9a1e68eb
add dword [ebp - 0x30], 0xc9510381
mov dword [ebp - 0x2c], 0x8385ea24
add dword [ebp - 0x2c], 0x7c7a15dc
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3991a
push 0
call eax
mov ecx, 0x775ad9fc
add ecx, 0x88a5739f
xor edi, edi
add edi, eax
mov edx, 0x7203e380
add edx, 0xc8254a80
add edx, dword [ebp - 0x28]
mov esi, 0xf1d8d683
xor dword [ebp - 0x24], 0xc6b97a54
mov ebx, dword [edx]
xor dword [ebp - 0xc], 0xb855e551
sub ebx, esi
mov dword [ebp - 0x10], 0x85a99467
mov dword [edi], ebx
mov dword [ebp - 0x10], 0x600c963
add edi, 0x6cf83f1e
add edi, 0x9307c0e6
add edx, 4
loop 0x3a289c54
add eax, 0x1293f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xb9c2dde6
add ecx, 0x8065221a
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401d66
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
jmp 0x401e48
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._IsExist
xor eax, 1
test al, al
je 0x401e3f
mov dword [esp], 0xc
call sym._malloc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call sym._min
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov byte [eax], dl
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], 1
mov eax, dword [ebp - 0x1c]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
jmp 0x401e1c
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call sym._min
mov edx, eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp dl, al
jne 0x401e13
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x401de7
cmp dword [ebp - 0xc], 0
jne 0x401e30
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
jmp 0x401e39
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401d7e
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401c66
pop dword [ebp - 0x44]
mov eax, 0x401c66
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xb15973c2
add dword [ebp - 0x54], 0x9cf8d189
mov dword [ebp - 0x50], 0x9c31e5fe
add dword [ebp - 0x50], 0x96016647
mov dword [ebp - 0x4c], 0xa92ffa52
sub dword [ebp - 0x4c], 0x5ce3b624
mov dword [ebp - 0x48], 0xe0b070ab
sub dword [ebp - 0x48], 0xe0b070ab
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x3ec6ad1c
add dword [ebp - 0x54], 0x35abbc3a
mov dword [ebp - 0x50], 0xb74c4115
sub dword [ebp - 0x50], 0x75dfdfa0
mov dword [ebp - 0x4c], 0xa0865024
add dword [ebp - 0x4c], 0xc2e91c48
mov dword [ebp - 0x48], 0x50cf3437
add dword [ebp - 0x48], 0xaf30cbc9
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xf4802485
sub eax, 0xf43ff459
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x37612
push 0
call eax
mov ecx, 0x3b8edf2a
sub ecx, 0x3b8e9392
mov esi, eax
mov edx, 0x407000
add edx, dword [ebp - 0x44]
mov ebx, 0x483fe1a6
mov dword [ebp - 0x1c], 0x646b4a74
mov edi, dword [edx]
sub dword [ebp - 0x20], eax
xor edi, ebx
xor dword [ebp - 0x2c], edi
mov dword [esi], edi
xor dword [ebp - 8], 0x51d523e3
add esi, 0x3d521918
add esi, 0xc2ade6ec
add edx, 4
loop 0x401d72
add eax, 0x12133
xor ebx, ebx
add ebx, eax
add eax, 0x13346a8a
sub eax, 0x13346a85
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x17da7247
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x2fbc67ae
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x404806
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xchg ebp, eax
inc dword [edi + 0x40]
add byte [edi], bl
dec eax
inc eax
add byte [eax + ecx*2], ah
inc eax
add byte [0x35004048], ah
dec eax
inc eax
add byte [ebx + 0x48], al
inc eax
add byte [0x25004048], dh
dec eax
inc eax
add byte [ebp + 0x48], cl
inc eax
add cl, ch
clc
xor dword [eax], eax
add bl, al
push eax
call fcn.00407c8f
neg eax
mov edx, eax
pop eax
jmp 0x407e2d
sti
add dword [edx + 0x6c], esi
movzx eax, di
cmp bx, word [esi + eax*2 - 2]
ja 0x407e9d
movzx eax, di
dec eax
test eax, eax
jle 0x407e51
mov ecx, 1
add bx, word [esi + ecx*2 - 2]
inc ecx
dec eax
jne 0x407e48
movzx ecx, word [ebp - 2]
dec ecx
mov eax, ecx
mov esi, 0x64
cdq
idiv esi
imul esi, ecx, 0x16d
mov edx, ecx
test edx, edx
jns 0x407e6f
add edx, 3
invalid

Function at 0x41cddf
Capabilities:
Packed with generic packer

Disassembly:
dec ebp
outsd dx, dword [esi]
add byte gs:[eax], dl
inc eax
add byte [eax], bh
add byte [eax], al
dec esp
fmul dword [ebx]
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax + 1], al
adc al, byte [eax]
pop es
inc ebp
outsb dx, byte [esi]
popal
bound ebp, qword [ebp + 0x64]
or al, 0xb7
dec ebx
add byte [ecx + ebx*8], dh
dec ebx
add byte [ecx + ebx*8 + 0x4b], ah
add byte [ecx], al
add byte [eax], al
add byte [eax], al

Function at 0x41ce14
Capabilities:
Packed with generic packer

Disassembly:
dec ebp
outsd dx, dword [esi]
add byte gs:[eax], dl
inc eax
add byte [eax], bh
add byte [eax], al
dec esp
fmul dword [ebx]
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax + 1], al
adc al, byte [eax]
pop es
inc ebp
outsb dx, byte [esi]
popal
bound ebp, qword [ebp + 0x64]
or al, 0xb7
dec ebx
add byte [ecx + ebx*8], dh
dec ebx
add byte [ecx + ebx*8 + 0x4b], ah
add byte [ecx], al
add byte [eax], al
add byte [eax], al

Function at 0x41ce5d
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
adc byte [0x74430500], 0x6c
xor eax, dword [eax + edx + 0x63]
dec esp
add byte [eax + eax], al
inc dword [eax]
fimul dword [ebx]
or al, 0xda
dec ebx
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x46040016], al
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x41ce88
adc byte [eax], al
sub al, byte [ecx]
add bh, bh
sub al, byte [ecx]
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
Function at 0x41cfa1
Capabilities:
Packed with generic packer

Disassembly:
push ds
add byte [eax], cl
push esp
popal
bound ecx, qword [edi + 0x72]
jb 0x41cfad
adc byte [eax], al
fadd qword [eax]
add bh, bh
add al, 0x15
dec esp
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax], al
pop ds
add byte [edi], al
push esp
popal
bound edx, qword [ebx + 0x74]
outsd dx, dword [esi]
jo 0x41cfcf
adc byte [eax], al
aaa
add byte [eax], al
call dword [eax + 0x1004bd8]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], 0
add byte [eax], al
and byte [eax], al
pop es
push esi
imul esi, dword [ebx + 0x69], 0x90656c62
scasd eax, dword es:[edi]
inc eax
add byte [eax - 0x57010000], ch
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f070021], al
outsb dx, byte [esi]
inc ebx
insb byte es:[edi], dx

Function at 0x41d12b
Capabilities:
Packed with generic packer

Disassembly:
dec ebp
outsd dx, dword [esi]
jne 0x41d1a2
dec ebp
outsd dx, dword [esi]
jbe 0x41d199
Function at 0x421020
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov esi, dword [eax]
mov edi, esi
shl edi, 0x18
mov ebp, esi
and ebp, 0xff00
shl ebp, 8
or edi, ebp
mov ebp, esi
and ebp, 0xff0000
in eax, 0
add bh, bh
add cl, al
in eax, dx
or byte [ebx], cl
std
in eax, 0
add bh, bh
add cl, al
in eax, dx
or byte [ebx], cl
std
shr esi, 0x18
or edi, esi
mov dword [ebx], edi
add ebx, 4
add eax, 4
dec ecx
jne 0x421009
mov ecx, 0x40
mov edx, dword [esp + 4]
add edx, 0x34
mov esi, dword [edx]
xor esi, dword [edx - 0x14]
xor esi, dword [edx - 0x2c]
xor esi, dword [edx - 0x34]
mov eax, esi
add eax, eax
shr esi, 0x1f
out dx, al
pop ds
or eax, esi
mov dword [edx + 0xc], eax
add edx, 4
dec ecx
jne 0x421046

Function at 0x421063
Capabilities:
Hash data using sha1

Disassembly:
mov ebx, dword [esp]
mov ebx, dword [ebx]
mov edx, dword [esp]
mov edx, dword [edx + 4]
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov dword [esp + 8], eax
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov ecx, dword [esp]
mov ecx, dword [ecx + 0x10]
mov dword [esp + 0xc], ecx
mov ecx, 0x14
mov esi, dword [esp + 4]
mov dword [esp + 0x10], esi
and al, 0x10
mov esi, ebx
shl esi, 5
mov edi, ebx
shr edi, 0x1b
or esi, edi
mov edi, dword [esp + 8]
or byte [ebx], dh
clc
and edi, edx
xor edi, eax
add esi, edi
add esi, dword [esp + 0xc]
je 0x4210d4
or al, 0x8b
jl 0x4210d8
adc byte [ebx], al
aaa
add esi, 0x5a827999
mov dword [esp + 0xc], eax
inc esp
and al, 0xc
mov eax, dword [esp + 8]
mov edi, edx
shl edi, 0x1e
push ds
shr edx, 2
or edi, edx
mov dword [esp + 8], edi
mov edx, ebx
mov ebx, esi
add dword [esp + 0x10], 4
dec ecx
jne 0x421095
mov ecx, 0x14
mov esi, dword [esp + 4]
add esi, 0x50
push eax
mov dword [esp + 0x14], esi
mov esi, ebx
shl esi, 5
mov edi, ebx
shr edi, 0x1b
or esi, edi
mov edi, dword [esp + 8]
xor edi, edx
xor edi, eax
add esi, edi
add esi, dword [esp + 0xc]

Function at 0x421093
Capabilities:
Hash data using sha1

Disassembly:
mov ebx, dword [esp]
mov ebx, dword [ebx]
mov edx, dword [esp]
mov edx, dword [edx + 4]
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov dword [esp + 8], eax
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov ecx, dword [esp]
mov ecx, dword [ecx + 0x10]
mov dword [esp + 0xc], ecx
mov ecx, 0x14
mov esi, dword [esp + 4]
mov dword [esp + 0x10], esi
and al, 0x10
mov esi, ebx
shl esi, 5
mov edi, ebx
shr edi, 0x1b
or esi, edi
mov edi, dword [esp + 8]
or byte [ebx], dh
clc
and edi, edx
xor edi, eax
add esi, edi
add esi, dword [esp + 0xc]
je 0x4210d4
or al, 0x8b
jl 0x4210d8
adc byte [ebx], al
aaa
add esi, 0x5a827999
mov dword [esp + 0xc], eax
inc esp
and al, 0xc
mov eax, dword [esp + 8]
mov edi, edx
shl edi, 0x1e
push ds
shr edx, 2
or edi, edx
mov dword [esp + 8], edi
mov edx, ebx
mov ebx, esi
add dword [esp + 0x10], 4
dec ecx
jne 0x421095
mov ecx, 0x14
mov esi, dword [esp + 4]
add esi, 0x50
push eax
mov dword [esp + 0x14], esi
mov esi, ebx
shl esi, 5
mov edi, ebx
shr edi, 0x1b
or esi, edi
mov edi, dword [esp + 8]
xor edi, edx
xor edi, eax
add esi, edi
add esi, dword [esp + 0xc]
Function at 0x421109
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [esp + 0x14]
add esi, dword [edi]
add esi, 0x6ed9eba1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov edi, edx
shl edi, 0x1e
shr edx, 2
or edi, edx
mov dword [esp + 8], edi
mov edx, ebx
mov ebx, esi
add dword [esp + 0x14], 4
dec ecx
jne 0x4210ef
invalid
adc al, 0
invalid

Function at 0x421153
Capabilities:
Encode data using xor

Disassembly:
sbb ecx, dword [ebx]
test dword [ebx + 0x2308247c], 0x23e88bfa

Function at 0x4606ed
Capabilities:
Hash data with crc32

Disassembly:
or al, 0
add byte [eax], al
pushfd
inc eax
add ah, dh
sub al, 0x40
add byte [eax - 0x2fffbfd5], ch
sub eax, dword [eax]
shr byte [ebx], 1
inc eax
add byte [esp + ebp], dl
inc eax
add byte [esi], cl
inc ebp
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
rol byte [0xc0046], 0
add byte [ebp + eax + 0x46], bh
inc esi
add ah, dh
sub al, 0x40
add byte [eax - 0x2fffbfd5], ch
sub eax, dword [eax]
adc al, 0x2c
inc eax
add byte [edx], dl
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x4607b5
jae 0x4607b9
inc esp
popal
je 0x4607ab
inc ebp
jb 0x4607bf
outsd dx, dword [esi]
jb 0x4606e0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or byte [esi], al
inc esi
add byte [eax + eax], cl
add byte [eax], al
jl 0x460777
inc esi
add ah, dh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 6], ah
add byte [eax], al
add ah, ch
add ah, dh
sub al, 0x40
add byte [eax - 0x2fffbfd5], ch
sub eax, dword [eax]
adc al, 0x2c
inc eax
add byte [eax + ecx + 0x46], bh
add byte [esi + eax + 0x46], dh
inc esi
add byte [esi + eax + 0x46], bh
inc esi
add byte [ebx], dl
push esp
inc ebx
jne 0x460854
je 0x460852
insd dword es:[edi], dx
inc esp
arpl word gs:[edi + 0x6d], bp
jo 0x46085d
jae 0x460861
outsd dx, dword [esi]
jb 0x4607da
add al, 0x1d
add byte [eax], al
lea eax, [eax]
jmp 0x462501
invalid
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or al, 7
test al, al
jne 0x46250c
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x462564
xor eax, eax
push ebp
push 0x4623d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.00465125
push eax
mov eax, esi
call fcn.0046512d
push eax
call fcn.004671f7
mov dword [ebp - 4], eax
call fcn.00467327
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4623d7
lea eax, [ebp - 0xc]
call fcn.004c3b97
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4606fa
Capabilities:
Hash data with crc32

Disassembly:
mov dword fs:[eax], edx
push 0x460534
lea eax, [ebp - 4]
call 0x462f70
ret
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x460771
jae 0x460775
inc ebp
jb 0x460777
outsd dx, dword [esi]
jb 0x460698
hlt
add eax, 0x2cf40046
inc eax
sub al, 0x40
add byte [eax - 0x2fffbfd5], ch
sub eax, dword [eax]
inc eax
add byte [esp + ebp], dl
inc eax
add byte [esi], dl
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x4607fd
jae 0x460801
dec ecx
outsb dx, byte [esi]
je 0x4607f7
jb 0x460802
popal
insb byte es:[edi], dx
inc ebp
jb 0x46080b
outsd dx, dword [esi]
jb 0x46072c
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
pushal
push es
inc esi
add byte [eax + eax], cl
add byte [eax], al
in al, dx
adc byte [eax], al
hlt
add cl, ch
add al, 0x1d
invalid
add byte [eax], al
lea eax, [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
les eax, [esi]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add ah, al
push es
inc esi
add byte [eax + eax], cl
add byte [eax], al
push esp
push es
inc esi
add ah, dh
sub al, 0x40
add byte [eax - 0x2fffbfd5], ch
add al, dl
sub eax, dword [eax]
adc al, 0x2c
inc eax
add byte [eax + ecx + 0x46], bh
add byte [eax + ecx + 0x9240046], bh
inc esi
add byte [ebx], dl
push esp
push ebx
je 0x4608b4
jb 0x4608ac
inc esp
arpl word gs:[edi + 0x6d], bp
jo 0x4608c1
jae 0x4608c5
outsd dx, dword [esi]
jb 0x460855
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi + eax], cl
inc esi
add byte [eax + edx], bl
add byte [eax], al
in al, dx
adc byte [eax], al
hlt
mov eax, esi
mov edx, 8
add byte [eax], al
add byte [eax - 0x2ef68bff], ch
test al, 1
je 0x4608bc
shr eax, 1
xor eax, 0xedb88320
call 0xb8c928ee
in eax, dx
jmp 0x4608be
shr eax, 1
dec edx
jne 0x4608af
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
rol dword [ecx + eax*4], 0xfe
add byte [ecx], al
add byte [eax], al
jne 0x4608a8
pop esi
ret

Function at 0x460708
Capabilities:
Hash data with crc32

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al