joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4102f1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x478dab
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push edi
mov eax, dword [0x49b0c4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [0x49d98c]
mov ecx, 0x49d98c
xor ebx, ebx
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x18], edi
push dword [ebp + 0xc]
and dword [esp + 0x3c], ebx
or dword [esp + 0x18], 0xffffffff
lea eax, [esp + 0x20]
push eax
call fcn.0040b894
and dword [esp + 0x10], ebx
mov byte [esp + 0x38], 1
cmp dword [esi + 0xc8], ebx
jle 0x41039d
cmp dword [esp + 0x20], 0
jne 0x410376
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.004107fe
jmp 0x410387
push dword [ebp + 8]
lea ebx, [esp + 0x18]
push esi
lea ecx, [esp + 0x24]
call fcn.00410896
mov ebx, eax
test ebx, ebx
jne 0x41039d
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0xc8]
jl 0x410359
lea ecx, [esp + 0x1c]
call fcn.0040b8d6
lea eax, [edi - 0x10]
call fcn.004090d8
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x415188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x4151a1
mov eax, dword [ebp - 4]
jmp 0x41527b
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x415256
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x48a538]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x48a538]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x48a538]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x48a538]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x48a538]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x48a538]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x48a538]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x48a538]
dec ebp
jne 0x4151c0
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x415272
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x48a538]
dec ecx
jne 0x415260
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x415280
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x422fec
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x477402
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x49b0c4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x10]
push eax
mov dword [esp + 0x14], eax
call dword [fcn.0047d2e0]
and dword [esp + 0x30], 0
lea edi, [esi + 4]
mov eax, dword [edi + 4]
mov esi, dword [eax]
mov ebx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
test ebx, ebx
mov eax, dword [edi + 4]
mov dword [esp + 0x20], eax
je 0x42304e
cmp ebx, edi
je 0x423053
call fcn.00445145
cmp esi, dword [esp + 0x20]
je 0x42308f
test ebx, ebx
jne 0x423062
call fcn.00445145
cmp esi, dword [ebx + 4]
jne 0x42306c
call fcn.00445145
push dword [ebp + 0x10]
mov ecx, dword [esi + 8]
push dword [ebp + 0xc]
mov eax, dword [ecx]
push dword [ebp + 8]
call dword [eax]
lea esi, [esp + 0x14]
call fcn.004138ae
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
jmp 0x42303f
push dword [esp + 0x10]
call dword [fcn.0047d2d8]
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43edf4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ecx, ecx
cmp dword [ebp + 8], ecx
push esi
push edi
je 0x43ee49
cmp dword [ebp + 0xc], ecx
je 0x43ee49
mov eax, dword [ebp + 0x10]
xor esi, esi
cmp dword [ebp + 0xc], ecx
jbe 0x43ee49
push 0x5851f42d
push 0x4c957f2d
push ecx
push eax
call fcn.00459290
add eax, 1
adc edx, 0
mov ecx, edx
mov ebx, eax
mov edi, ecx
shrd ebx, edi, 0x13
mov edx, esi
and edx, 3
xor bl, byte [ebp + edx + 0x10]
shr edi, 0x13
mov edi, dword [ebp + 8]
xor byte [esi + edi], bl
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x43ee10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x442130
Capabilities:
Compute adler32 checksum

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
movzx ecx, di
shr edi, 0x10
test esi, esi
mov ebx, eax
jne 0x44214a
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
ret
test ebx, ebx
jbe 0x44224c
push ebp
cmp ebx, 0x15b0
mov eax, ebx
jb 0x442162
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x44220b
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x442180
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x442180
test eax, eax
je 0x44221f
nop
movzx edx, byte [esi]
add ecx, edx
add esi, 1
add edi, ecx
sub eax, 1
jne 0x442210
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x442153
pop ebp
mov eax, edi
pop edi
shl eax, 0x10
pop esi
or eax, ecx
pop ebx
ret
Function at 0x442730
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x442762
lea esp, [esp]
test cl, 3
je 0x442762
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x486038]
add ecx, 1
sub esi, 1
jne 0x442740
cmp esi, 0x20
push ebx
push edi
jb 0x44294c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x486438]
xor edx, dword [ebx*4 + 0x486838]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x486038]
add ecx, 4
xor edx, dword [eax*4 + 0x486c38]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x486438]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x486838]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x486038]
add ecx, 4
xor eax, dword [edx*4 + 0x486c38]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x486438]
xor edx, dword [ebx*4 + 0x486838]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x486038]
xor edx, dword [eax*4 + 0x486c38]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x486438]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x486838]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x486038]
xor eax, dword [edx*4 + 0x486c38]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x486438]
xor edx, dword [ebx*4 + 0x486838]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x486038]
xor edx, dword [eax*4 + 0x486c38]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x486438]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x486838]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x486038]
and edx, 0xff
xor eax, dword [edx*4 + 0x486c38]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x486438]
xor edx, dword [ebx*4 + 0x486838]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x486038]
add ecx, 4
xor edx, dword [eax*4 + 0x486c38]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x486438]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x486838]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x486038]
and edx, 0xff
xor eax, dword [edx*4 + 0x486c38]
sub edi, 1
jne 0x442772
cmp esi, 4
jb 0x442999
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x486438]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x486838]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x486038]
and eax, 0xff
xor edi, dword [eax*4 + 0x486c38]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x442956
test esi, esi
pop edi
pop ebx
je 0x4429bd
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x486038]
add ecx, 1
sub esi, 1
jne 0x4429a0
not eax
pop esi
ret
Function at 0x445893
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4458d0
cmp dword [ebp + 0x14], edi
je 0x4458d0
cmp ecx, edi
jne 0x4458d7
call fcn.0044bfca
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00445121
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4458eb
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x44590c
cmp ebx, 0xffffffff
je 0x4458fb
push ebx
push edi
push ecx
call fcn.00443bf0
add esp, 0xc
cmp esi, edi
je 0x4458b8
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4458b8
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x445928
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x44592f
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x445a20
test word [esi + 0xc], 0x10c
je 0x445983
mov eax, dword [esi + 4]
test eax, eax
je 0x445983
jl 0x445a81
cmp ebx, eax
mov edi, ebx
jb 0x445954
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x445a28
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0044399e
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x445a18
cmp ebx, dword [ebp - 0xc]
jb 0x4459f0
cmp dword [ebp - 0xc], 0
je 0x4459ad
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x4459a2
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4459a9
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4459b8
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x4459b8
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x445a54
push eax
push dword [ebp - 8]
push esi
call fcn.00451831
pop ecx
push eax
call fcn.00451734
add esp, 0xc
test eax, eax
je 0x445a93
cmp eax, 0xffffffff
je 0x445a81
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x445a18
push esi
call fcn.00451053
cmp eax, 0xffffffff
pop ecx
je 0x445a85
cmp dword [ebp - 4], 0
je 0x445a54
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x445937
mov eax, dword [ebp + 0x14]
jmp 0x4458d2
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x445a3f
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00443bf0
add esp, 0xc
call fcn.0044bfca
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4458c8
cmp dword [ebp + 0xc], 0xffffffff
je 0x445a6a
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00443bf0
add esp, 0xc
call fcn.0044bfca
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4458c8
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4458d2
or dword [esi + 0xc], 0x10
jmp 0x445a85
Function at 0x469f40
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x140]
test ecx, ecx
je 0x469f5b
mov edx, dword [esi + 0xe4]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
jl 0x469f8f
cmp eax, 2
jg 0x469f8f
mov ecx, dword [esi + 0xe0]
push ecx
push 1
lea edx, [eax + eax*2 + 0x480e48]
push 2
push edx
call fcn.00445d97
mov eax, dword [esi + 0xe0]
push eax
push 1
push edi
push ebx
call fcn.00445d97
add esp, 0x20
xor eax, eax
ret

Function at 0x46c7c0
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebx
push esi
push 1
push 0x24
call dword [0x49c590]
xor ebx, ebx
mov esi, eax
add esp, 8
cmp esi, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
jne 0x46c7f2
push 0xc
call dword [fcn.0047d12c]
pop esi
xor al, al
pop ebx
add esp, 0xc
ret
mov eax, dword [edi + 0x2bc]
push ebp
lea ebp, [edi + 0x2bc]
push eax
mov dword [esp + 0x10], ebp
call fcn.004612e0
mov ecx, dword [esp + 0x20]
push ecx
call dword [0x49c58c]
add esp, 8
cmp eax, ebx
mov dword [ebp], eax
jne 0x46c839
push esi
call dword [0x49c584]
add esp, 4
push 0xc
call dword [fcn.0047d12c]
pop ebp
pop esi
xor al, al
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x20]
push ebx
push 1
mov dword [edi + 0x2c0], edx
mov byte [edi + 0x2c8], bl
mov dword [edi + 0x2cc], ebx
mov dword [edi + 0x2c4], ebx
mov dword [edi + 0x2d0], esi
push ebx
mov dword [esi + 0xc], 0xffffffff
call dword [fcn.0047d334]
cmp eax, ebx
mov dword [esi + 0x10], eax
jne 0x46c876
push ebp
jmp 0x46c8c9
mov ebp, dword [0x47d290]
push ebx
push ebx
push 1
push ebx
call ebp
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x46c8c4
push ebx
push ebx
push ebx
call dword [fcn.0047d334]
cmp eax, ebx
mov dword [esi + 0x1c], eax
jne 0x46c8a1
mov ecx, dword [esp + 0xc]
push ecx
jmp 0x46c8c9
push ebx
push ebx
push 1
push ebx
call ebp
cmp eax, ebx
mov dword [esi + 0x20], eax
jne 0x46c8b6
mov edx, dword [esp + 0xc]
push edx
jmp 0x46c8c9
push ebx
push ebx
push 1
push ebx
call ebp
cmp eax, ebx
mov dword [esi + 0x18], eax
jne 0x46c8e2
mov eax, dword [esp + 0xc]
push eax
call fcn.0046c6e0
add esp, 4
push 0xb
call dword [fcn.0047d12c]
pop ebp
pop esi
xor al, al
pop ebx
add esp, 0xc
ret
lea ecx, [esi + 4]
push ecx
push ebx
push edi
push 0x46c610
push ebx
push ebx
call fcn.004492a2
add esp, 0x18
cmp eax, ebx
mov dword [esi], eax
jne 0x46c921
call fcn.0044bfca
mov edx, dword [eax]
push edx
call dword [fcn.0047d12c]
mov eax, dword [esp + 0xc]
push eax
call fcn.0046c6e0
add esp, 4
pop ebp
pop esi
xor al, al
pop ebx
add esp, 0xc
ret
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov ecx, dword [esi + 0x18]
push edx
push 2
mov dword [esp + 0x24], ecx
call dword [fcn.0047d1d8]
push ebx
push 2
push 2
call dword [fcn.0047d55c]
pop ebp
mov dword [esi + 0xc], eax
pop esi
mov al, 1
pop ebx
add esp, 0xc
ret
Function at 0x4722d0
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x4722df
jmp dword [ecx*4 + 0x472334]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
Function at 0x18e6c4d
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0x680000c7
frstor dword [ebp + 0x25]
outsd dx, dword [esi]
push 0x6f2565dd
imul edx, edx, 0xa
clc
cmp al, 0xa8
call fcn.013e0444
xor al, 0x76
mov byte [0xb0ce0666], al
xor esp, dword [eax + ecx*2 - 0x1d]
mov edi, 0xf31b5393
jecxz 0x18e6c49
mov dword [0xa3c7ffc7], eax
dec edi
sti
sub dl, dl
add dword [edx + 0x18], ecx
cld
or eax, 0xd5e2429c
xchg edi, eax
outsb dx, byte [esi]
dec ebp
inc ebp
aam 0x74
scasb al, byte es:[edi]
jle 0x18e6cdb
dec edx
sbb bl, bh
fisub dword [ecx]
aam 0x5c
sub esp, 0xadf1ec50
mov ebp, 0xc023a912
inc ebp
mov edx, dword [ebx + 0x37a14f3f]
aad 0xcd
fisttp dword [edx + 0x70]
inc dword [esp]
dec edx
fist word [edi + 0x43]
outsb dx, byte [esi]
inc eax
iretd
xchg edx, eax
stosd dword es:[edi], eax
xchg edi, eax
jp 0x18e6d07
xor al, 0xe6
aas
add ah, byte [edx - 0x11099f56]
pop ds
mov ebx, 0x378f477f
inc edi
stosd dword es:[edi], eax
add edx, dword [ecx - 0x85cf75d]
mov bl, 0xff
push edi
xchg edi, eax
out 0x9f, eax
imul edx, dword [ebx - 0x39]
and ecx, edi
jns 0x18e6ce1
pop ebx
fidiv dword ss:[ebp + 0x61]
jb 0x18e6d40
pop esi
stosb byte es:[edi], al
mov edx, 0xceeeb30b
mov dl, 0x41
jns 0x18e6d82
lea ecx, [ebp + 0x11]
cmp dword [0x496d4569], ebp
mov ecx, ebx
adc ebx, dword [ebx - 0x79]
sbb al, 0xb7
invalid
jmp 0x18e6dac
clc
or byte [eax + ebp*8], dh
inc ecx
inc esi
xchg byte [eax + 0x62edf930], ah
invalid
sub cl, byte [esi - 0xe]
mov eax, dword ds:[0xe18ac364]
jo 0x18e6dc5
mov al, cl
cmp al, 0x90
add byte [eax + 0x448840fc], ah
in al, dx
inc esp
in al, dx
jns 0x18e6d76
pop ebx
cmp ah, bl
js 0x18e6e01
jle 0x18e6de1
pop esi
add ch, byte [0x3d52c88e]
and dword [eax + 0x8e810d8], esi
rcr byte [eax + ecx*8 + 0x42cf404], 1
fcom dword [eax]
call 0xca2b3dbb
add al, 0xf4
sub al, 4
inc esp
test byte [ebx + 0x1b310af3], dh
pop esi
in eax, dx
jl 0x18e6e1a
pushfd
xchg ebp, eax
scasd eax, dword es:[edi]
mov es, word [edi]
dec dword [esi - 0x2f0be722]
or dh, byte [ecx]
sbb ebp, dword [eax - 0x51]
xchg esp, eax
je 0x18e6d75
jp 0x18e6dd7
invalid
dec dword [edi + 0x7a]
rsm
xchg ebp, eax
in eax, 0xeb
aas
outsb dx, byte [esi]
or dword [esi], ecx
adc byte [edx + 0x977be24], 0xc
push ebx
aaa
fucom st(2)
xchg edi, eax
ljmp 0x8838
lcall 0x4ee, 0xcc241ff3
mov dl, byte [ecx - 0x4d25cbb6]
or dh, byte [edx - 0x144fa23]
cmc
retf 0xc070
push eax
or byte [esp + edi*4 + 4], cl
pushal
sbb al, 0x68
mov esp, 0x5ada7960
invalid
Function at 0x405ef7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a1274], 0
push esi
jne 0x405f2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f08
mov dword [ecx*4 + 0x7a1270], eax
inc ecx
cmp ecx, 0x100
jl 0x405f03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a1270]
xor eax, esi
inc ecx
dec edx
jne 0x405f41
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x4045d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
push edi
mov dword [esi + 0xdc], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0xe0], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x44], eax
mov al, byte [esp + 0x24]
mov dword [esi + 0x48], ecx
xor cl, cl
test al, al
mov dword [esi + 0x40], edx
mov byte [esi + 0x4c], al
mov byte [esp + 0xc], cl
jbe 0x404634
mov eax, dword [esp + 0xc]
and eax, 0xff
inc cl
mov byte [esp + 0xc], cl
mov edx, dword [esp + eax*8 + 0x28]
mov dword [esi + eax*8 + 0x50], edx
mov edx, dword [esp + eax*8 + 0x2c]
mov dword [esi + eax*8 + 0x54], edx
mov al, byte [esi + 0x4c]
cmp cl, al
jb 0x40460e
mov eax, dword [esi + 0x48]
mov ecx, dword [esp + 0x14]
inc eax
cmp ecx, eax
jae 0x404648
mov dword [esi + 0x104], ecx
jmp 0x40464e
mov dword [esi + 0x104], eax
mov edi, dword [esi + 0x104]
mov ecx, dword [esi + 0x11c]
mov eax, edi
xor edx, edx
div ecx
mov dword [esi + 0x108], edi
test edx, edx
je 0x40467a
mov eax, edi
xor edx, edx
div ecx
inc eax
imul eax, ecx
mov dword [esi + 0x104], eax
mov eax, dword [esi + 0x44]
xor edx, edx
div ecx
imul eax, ecx
cmp dword [esi + 0xd4], eax
jae 0x404692
mov dword [esi + 0xd4], eax
mov eax, dword [esi + 0x104]
mov edi, 1
cmp eax, 0x100000
mov dword [esi + 0x10c], edi
ja 0x4046b2
mov dword [esi + 0xd8], edi
jmp 0x40471b
cmp eax, 0x200000
ja 0x4046c5
mov dword [esi + 0xd8], 2
jmp 0x40471b
cmp eax, 0x400000
ja 0x4046d8
mov dword [esi + 0xd8], 4
jmp 0x40471b
cmp eax, 0x800000
ja 0x4046eb
mov dword [esi + 0xd8], 8
jmp 0x40471b
cmp eax, 0x1000000
ja 0x4046fe
mov dword [esi + 0xd8], 0x10
jmp 0x40471b
cmp eax, 0x2000000
ja 0x404711
mov dword [esi + 0xd8], 0x20
jmp 0x40471b
mov dword [esi + 0xd8], 0x40
mov eax, dword [esi + 0x124]
test eax, eax
jne 0x40473b
mov ecx, esi
call fcn.00405510
mov eax, dword [esi + 0x20]
push edi
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop esi
ret 0x9c

Function at 0x407600
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x40d7c0
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [0x4161d0]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x40d813
push str.PRf48PInfFile
push 0x838
push 0
push 4
push 0
push 0xffffffffffffffff
call esi
test eax, eax
mov dword [0x4161d0], eax
jne 0x40d800
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret
push 0x838
push 0
push 0
push 6
push eax
call edi
mov dword [0x4160dc], eax
mov eax, dword [0x4161cc]
test eax, eax
jne 0x40d85d
push str.PRf48PBufFile
push 0x1000000
push 0
push 4
push 0
push 0xffffffffffffffff
call esi
test eax, eax
mov dword [0x4161cc], eax
jne 0x40d845
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret
push 0x1000000
push 0
push 0
push 6
push eax
call edi
mov dword [0x4160e4], eax
mov dword [0x4160e0], eax
pop edi
mov eax, 1
pop esi
ret