joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003f425
Capabilities:
Encode data using xor

Disassembly:
shl cl, 0x65
sar byte [esp + ecx*8 - 0x3b3f7], 0x21
bswap edx
shl cl, 0xc5
call fcn.100f6f83
bswap eax
xor eax, 0x2cba43be
sar dl, 2
shl edx, 0xe
inc eax
xor ebx, eax
add edi, eax
or dl, 0xb3
sar dl, 0xc4
mov ecx, dword [ebp + edx - 0x3800fb]
movsx eax, dl
mov eax, dword [ebp + edx - 0x3800f7]
lea ebp, [ebp + edx - 0x3800f3]
call fcn.1007a112
mov edx, 0x369f5d23
shr dx, 0xe2
lea esi, [edx + esi - 0x369f174c]
movsx ecx, dx
adc ecx, 0x6297c91c
mov eax, dword [edx + esi - 0x369f1748]
rol ecx, 0xb5
ror cl, 0x63
xor edx, edx
xor eax, ebx
sar dl, 0x63
xor edx, 0x53ec38b
sal edx, cl
ror eax, 1
rol edx, 0xc8
jae 0x1003f43a
neg dx
sub cl, al
sal ecx, 0x90
not dx
dec dx
dec cx
add dword [esp + 8], 0x8aabb083
neg dx
jmp 0x1012836c
pop edx
xor bl, al
lea eax, [esp + eax + 0xc]
and edx, ecx
mov cx, word [eax]
add edx, 0x319b1582
mov word [ebp + 0xe], cx
sbb ebp, 0xfffffff2
movsx ecx, dl
pop eax
pop edx
pop edx
jmp esi
mov di, word [edi + eax*2 - 0x102156e]
jp 0x100d228e
shl ecx, 0x94
sub eax, 0x3f316c94
jne fcn.10133f89
xor cl, 0xab
inc byte [esp + 0x1a]
not cl
inc cl
mov eax, 0xa316d298
xor cl, 0x93
xor bl, cl
ror eax, 0x78
push eax
lea ecx, [esp + ecx + 0x20]
mov dword [ecx + eax - 0x16d298a3], edx
movzx edx, al
mov eax, dword [eax + edi - 0x16d2988b]
movsx ecx, dx
mov dl, byte [edx + esi - 0xa8]
shl byte [esp + ecx*4 - 0x285], cl
xor dl, bl
xadd dword [esp + ecx - 0x87], ecx
not dl
xadd dword [esp + 9], ecx
rol dl, 1
call fcn.10068053
mov eax, dword [esp + 0xa]
not edx
mov ecx, eax
ror dword [esp + eax - 0xb459], cl
mov cl, byte [edi + eax - 0xb460]
pop eax
adc eax, 0x2231b
jmp eax
shl dword [esp + 8], cl
inc dx
shr eax, 0x66
xor bx, dx
mov word [eax + ebp - 0x28c1196], dx
movzx eax, byte [edi + eax*2 - 0x518235a]
sub edi, 0xe
mov edx, dword [esp + 5]
xor al, bl
dec al
add dword [esp + edx - 0x51], ecx
adc word [esp + edx - 0x4e], 0xfcac
push ecx
neg al
sar edx, cl
seta dl
shl dword [esp + edx*8 + 6], 0xd2
inc al
mov dword [esp + edx + 2], ecx
lea ecx, [ecx + ecx + 0x63b90d3b]
inc ecx
not al
jp 0x1008cdb5
bswap edx
xor ax, cx
lea edx, [edx + eax*2 + 0x258c914f]
sal al, 0x41
not ecx
sub cl, 0x82
xor ebx, edx
add ebp, edx
movsx edx, cl
shr ax, 0x43
jae 0x100bccef
jmp 0x10100f02

Function at 0x10070874
Capabilities:
Hash data using murmur3

Disassembly:
rol edx, 0x38
shr ax, cl
mov dword [esp], 0x76a67c8c
mov word [edi], ax
mov eax, 0x44361d1b
dec ax
call fcn.1004f01d
Function at 0x100846d0
Capabilities:
Manually build aes constants

Disassembly:
xor ebx, ecx
not edx
add ebp, ecx
lea ecx, [edx + eax*2 - 0x6edf07cd]
movzx cx, byte [edi]
sar eax, 0xa8
mov al, byte [edi + 2]
sal dl, 0xa3
add word [esp + 1], dx
add edi, 2
ror word [esp], 8
and cl, al
bswap edx
jmp 0x100ffca7
mov dword [esp + ecx - 0xff], ebp
ret
sub ebp, 6
xor ecx, ebx
not ecx
shl dl, 0x82
sbb ecx, 0xd631b81c
xor ecx, 0xf7390533
rol ecx, 1
not ecx
xchg dx, ax
add byte [esp + 8], 0x22
js 0x1003db8d
xor ebx, ecx
mov dword [esp], edx
push eax
add esi, ecx
shr dl, 5
jne 0x100c8c9f
not dl
pop edx
pop edx
pop eax
pop ecx
pop ecx
jae fcn.1003c6ca
jmp 0x1004f5b9
dec dword [esp]
xor cl, dl
mov word [edi], cx
sub word [esp], dx
movzx ecx, dl
jno 0x10065cd2

Function at 0x100f06dd
Capabilities:
Hash data using murmur3

Disassembly:
xor bl, cl
sal ax, 0x4c
sal eax, 0xfc
lea ecx, [esp + ecx + 0x1c]
sal eax, 0xce
add eax, dword [ecx + eax]
mov dword [ebp + 0x18], eax
lea edx, [edx + edx + 0x4492b4ae]
or edx, edx
jae 0x10100383

Function at 0x100f5ab6
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [esp + eax - 0xb], al
movzx ecx, byte [eax + ebp - 0x15]
setl byte [esp + eax - 1]
and ax, 0xd61f
lea ebp, [ebp + eax - 0x15]
dec al
xor cl, bl
rol cl, 1
call fcn.1008dda2
sub ebp, 4
mov ecx, 0xa4b0eaa9
jmp 0x10069aa0
mov eax, dword [ebp]
add cx, cx
xor eax, ebx
inc eax
ror eax, 2
call fcn.100c1eb5
mov edx, 0x2ea99b31
push edx
push edx
movzx cx, byte [ebp + edx*2 - 0x5d533662]
call fcn.100a29a0
not dl
or al, ah
shl dword [esp + eax - 2], 0x1c
and cl, dl
neg byte [esp + eax - 4]
mov word [edi + eax*2 - 0x1e], cx
jb 0x10025de9
neg dl
sbb al, 0x9f
mov dword [esp + ecx*2 - 0xfc264], 0x42119701
sar ecx, 0xa6
not al
sal ecx, 0xf0
xor ecx, ecx
dec dl
inc al
xchg ecx, edx
rol al, 1
sub dword [esp + edx*4], ecx
xor bl, al
call fcn.10100dc2
mov dl, byte [edi + edx - 0x7a320003]
and ax, ax
rol al, 0x67
shr eax, 0x8b
not cl
ja 0x100707e0
Function at 0x4054a0
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
movzx eax, si
shr esi, 0x10
mov dword [ebp + 8], eax
xor eax, eax
mov bx, word [ebp + 8]
push edi
mov dword [ebp - 4], esi
mov di, si
mov dword [ebp - 8], 0x40
sub eax, 0x61c88647
movzx edx, ax
mov dword [ebp - 0xc], eax
mov ax, di
shr ax, 5
lea ecx, [edx + esi]
shl esi, 4
xor cx, ax
xor cx, si
add bx, cx
mov word [ebp + 8], bx
mov ax, bx
mov ecx, dword [ebp + 8]
add edx, ecx
shr ax, 5
xor dx, ax
shl ecx, 4
xor dx, cx
add di, dx
sub dword [ebp - 8], 1
mov word [ebp - 4], di
je 0x405517
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
jmp 0x4054c8
mov al, byte [ebp + 8]
pop edi
pop esi
and al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405a00
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x1505
jmp 0x405a16
imul eax, eax, 0x21
inc edx
movzx ecx, cl
add eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x405a0d
pop ebp
ret

Function at 0x405a1e
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x1505
jmp 0x405a36
imul eax, eax, 0x21
lea edx, [edx + 2]
movzx ecx, cx
add eax, ecx
movzx ecx, word [edx]
test cx, cx
jne 0x405a2b
pop ebp
ret

Function at 0x40631e
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x20
push esi
call fcn.00406563
pop ecx
pop ecx
test eax, eax
je 0x406343
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
xor eax, eax
inc eax
pop esi
pop ebp
ret

Function at 0x40635c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov eax, esi
mov byte [eax + edi], al
inc eax
cmp eax, 0x100
jb 0x40636a
mov ecx, esi
mov dword [ebp - 4], esi
mov eax, ecx
mov bl, byte [ecx + edi]
xor edx, edx
movzx ecx, bl
div dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
movzx eax, byte [edx + eax]
add eax, esi
add ecx, eax
movzx esi, cl
mov ecx, dword [ebp - 4]
mov al, byte [esi + edi]
mov byte [ecx + edi], al
inc ecx
mov byte [esi + edi], bl
mov dword [ebp - 4], ecx
cmp ecx, 0x100
jb 0x40637a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4063b4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
mov eax, esi
test edi, edi
je 0x406420
push ebx
mov ebx, dword [ebp + 0x14]
sub dword [ebp + 0xc], ebx
mov edx, dword [ebp + 8]
inc eax
movzx ecx, al
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], ecx
mov ebx, dword [ebp + 0x10]
mov cl, byte [ecx + eax]
movzx eax, cl
add eax, esi
movzx esi, al
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
mov byte [ebx + edx], al
mov eax, edx
mov edx, ebx
mov ebx, dword [ebp + 0x14]
mov byte [esi + eax], cl
movzx eax, byte [edx + eax]
mov edx, dword [ebp + 0xc]
movzx ecx, cl
add ecx, eax
movzx eax, cl
mov ecx, dword [ebp + 8]
mov al, byte [eax + ecx]
xor al, byte [edx + ebx]
mov byte [ebx], al
inc ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x14], ebx
sub edi, 1
jne 0x4063cb
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x4064b7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
not ecx
test edx, edx
je 0x4064f1
push esi
mov esi, dword [ebp + 0xc]
push edi
movzx eax, byte [esi]
dec edx
push 8
xor ecx, eax
inc esi
pop edi
mov eax, ecx
shr ecx, 1
and eax, 1
not eax
inc eax
and eax, 0xedb88320
xor ecx, eax
sub edi, 1
jne 0x4064d5
test edx, edx
jne 0x4064cb
pop edi
pop esi
not ecx
mov eax, ecx
pop ebp
ret

Function at 0x406645
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x406667
push edi
mov edi, dword [ebp + 0xc]
mov edx, eax
sub edi, eax
mov cl, byte [edi + edx]
xor byte [edx], cl
inc edx
sub esi, 1
jne 0x40665b
pop edi
pop esi
pop ebp
ret
Function at 0x406af6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 0x5ca
push ebx
push esi
mov esi, dword [ebp + 8]
xor esi, 0x4bdd
shl esi, 0x10
xor esi, dword [ebp + 8]
xor esi, 0xe96
mov eax, esi
shr eax, 0x15
push edi
cmp eax, ecx
ja 0x406b90
je 0x406b89
cmp eax, 0xb4
je 0x406b82
cmp eax, 0x137
je 0x406b7b
cmp eax, 0x1f6
je 0x406b74
cmp eax, 0x29a
je 0x406b6d
cmp eax, 0x34e
je 0x406b66
cmp eax, 0x3e3
je 0x406b5f
cmp eax, 0x532
jne 0x406bb9
mov eax, 0x406c8b
jmp 0x406bdf
mov eax, 0x40694f
jmp 0x406bdf
mov eax, 0x406cfd
jmp 0x406bdf
mov eax, 0x4069cc
jmp 0x406bdf
mov eax, 0x4068dd
jmp 0x406bdf
mov eax, 0x406994
jmp 0x406bdf
mov eax, 0x406a42
jmp 0x406bdf
mov eax, 0x406d36
jmp 0x406bdf
sub eax, 0x601
je 0x406bda
sub eax, 0x68
je 0x406bd3
sub eax, 0x16
je 0x406bcc
sub eax, 0x7c
je 0x406bc5
sub eax, 0x82
je 0x406bbe
sub eax, 0x54
jne 0x406bb9
mov eax, 0x406cc4
jmp 0x406bdf
mov eax, dword [ebp + 8]
jmp 0x406bdf
mov eax, 0x406988
jmp 0x406bdf
mov eax, 0x406c52
jmp 0x406bdf
mov eax, 0x406916
jmp 0x406bdf
mov eax, 0x406a05
jmp 0x406bdf
mov eax, fcn.00406a11
call eax
mov edi, eax
test edi, edi
je 0x406c38
mov ecx, dword [edi + 0x3c]
and esi, 0x1fffff
xor ebx, ebx
mov ecx, dword [ecx + edi + 0x78]
add ecx, edi
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
add eax, edi
mov dword [ebp - 8], eax
add edx, edi
mov eax, dword [ecx + 0x1c]
add eax, edi
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp + 8], eax
test eax, eax
je 0x406c38
mov eax, dword [edx + ebx*4]
add eax, edi
push eax
call fcn.00406782
and eax, 0x1fffff
pop ecx
cmp eax, esi
je 0x406c41
mov edx, dword [ebp - 4]
inc ebx
cmp ebx, dword [ebp + 8]
jb 0x406c1a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ebx*2]
mov eax, dword [ecx + eax*4]
add eax, edi
jmp 0x406c3a
Function at 0x407760
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
lea eax, [ebp - 0x24]
push eax
push 0x18
push 5
push 0x370
push 0x416488
call fcn.00405a40
xor eax, eax
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x24]
push eax
call fcn.00404f13
add esp, 0x18
push eax
push 0
push 0x2000000
call dword [0x4176f8]
mov esi, eax
test esi, esi
jne 0x4077ab
xor eax, eax
jmp 0x40783c
lea eax, [ebp - 4]
push eax
push 0xf01ff
push esi
call dword [0x417670]
test eax, eax
jne 0x4077c8
push esi
call fcn.00404aeb
pop ecx
jmp 0x4077a4
push 0
push 4
call dword [0x4176f4]
mov esi, eax
mov dword [ebp - 0x40], 0x1c
lea eax, [ebp - 0x40]
push eax
push esi
call sub.KERNEL32.DLL_Thread32First
test eax, eax
je 0x4077bf
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov ebx, eax
cmp dword [ebp - 0x34], edi
jne 0x407825
cmp dword [ebp - 0x38], ebx
je 0x407825
push dword [ebp - 0x38]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.DLL_OpenThread]
push dword [ebp - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
lea eax, [ebp - 0x40]
push eax
push esi
call sub.KERNEL32.DLL_Thread32Next
test eax, eax
jne 0x4077fb
push esi
call fcn.00404aeb
pop ecx
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x407ef9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x407f9d
push ebx
mov ebx, dword [ebp + 0x10]
lea ecx, [ebp - 0x44]
mov eax, ebx
sub eax, ecx
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
sub eax, ecx
push edi
mov dword [ebp - 4], eax
push dword [ebp + 8]
lea eax, [ebp - 0x44]
xor edi, edi
push eax
call fcn.0040802f
mov eax, dword [ebp + 8]
pop ecx
pop ecx
add dword [eax + 0x20], 1
jne 0x407f3e
inc dword [eax + 0x24]
cmp esi, 0x40
jbe 0x407f75
mov ebx, dword [ebp - 4]
mov edx, edi
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x44]
add ecx, edx
push 0x40
mov al, byte [ebx + ecx]
xor al, byte [ecx]
inc edx
mov byte [edi + ecx], al
pop eax
cmp edx, eax
jb 0x407f4b
mov ebx, dword [ebp + 0x10]
sub esi, eax
add dword [ebp + 0x14], eax
add ebx, eax
add dword [ebp + 0xc], eax
add dword [ebp - 4], eax
mov dword [ebp + 0x10], ebx
jmp 0x407f22
test esi, esi
je 0x407f9b
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x44]
sub eax, ecx
sub ebx, ecx
mov dword [ebp + 0xc], eax
lea ecx, [ebp - 0x44]
add ecx, edi
mov al, byte [eax + ecx]
xor al, byte [ecx]
inc edi
mov byte [ebx + ecx], al
mov eax, dword [ebp + 0xc]
cmp edi, esi
jb 0x407f86
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407fc0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0x100
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
mov eax, dword [ecx]
mov dword [edx + 4], eax
mov eax, dword [ecx + 4]
mov dword [edx + 8], eax
mov eax, dword [ecx + 8]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0x10], eax
jne 0x407ff4
add ecx, 0x10
mov esi, str.expand_32_byte_kexpand_16_byte_k
jmp 0x407ff9
mov esi, 0x40d38c
mov eax, dword [ecx]
mov dword [edx + 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [edx + 0x30], eax
mov eax, dword [ecx + 8]
mov dword [edx + 0x34], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0x38], eax
mov eax, dword [esi]
mov dword [edx], eax
mov eax, dword [esi + 4]
mov dword [edx + 0x14], eax
mov eax, dword [esi + 8]
mov dword [edx + 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [0x418294], esi
mov dword [edx + 0x3c], eax
pop esi
pop ebp
ret
Function at 0x409210
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push 0x20
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
call fcn.004048f2
mov al, byte [ebp - 1]
push dword [ebp + 0x10]
and byte [ebp - 0x20], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 1], al
lea eax, [ebp - 0x70]
push eax
call fcn.0040956c
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00408c32
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00408e41
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00409a86
lea eax, [ebp - 0xc8]
push eax
push dword [ebp + 8]
call fcn.0040929b
add esp, 0x40
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40a644
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
neg ebx
push edi
mov edi, dword [ebp + 8]
sub edi, esi
mov dword [ebp + 0x14], 0xa
mov eax, dword [edi + esi]
mov ecx, dword [esi]
xor ecx, eax
and ecx, ebx
xor eax, ecx
cdq
mov dword [edi + esi], eax
mov dword [edi + esi + 4], edx
mov eax, dword [esi]
xor eax, ecx
sub dword [ebp + 0x14], 1
cdq
mov dword [esi], eax
lea esi, [esi + 8]
mov dword [esi - 4], edx
jne 0x40a65e
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40a689
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x40a7bb
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
test ebx, ebx
jne 0x40a6b1
test edi, edi
jne 0x40a7bb
mov esi, dword [ebp + 0x18]
mov eax, 0xc8
cmp esi, eax
jae 0x40a7bb
push eax
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.00404917
add esp, 0xc
cmp edi, esi
jb 0x40a71d
mov eax, ebx
lea ecx, [ebp - 0xcc]
sub eax, ecx
mov dword [ebp - 4], eax
xor edx, edx
test esi, esi
je 0x40a702
mov edi, dword [ebp - 4]
lea ecx, [ebp - 0xcc]
add ecx, edx
mov al, byte [edi + ecx]
xor byte [ecx], al
inc edx
cmp edx, esi
jb 0x40a6ed
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 0xcc]
push eax
call fcn.0040a7c5
add dword [ebp - 4], esi
sub edi, esi
add ebx, esi
mov dword [ebp + 0x14], edi
pop ecx
cmp edi, esi
jae 0x40a6e4
mov al, byte [ebp + 0x1c]
xor byte [ebp + edi - 0xcc], al
xor byte [ebp + esi - 0xcd], 0x80
test edi, edi
je 0x40a74f
lea eax, [ebp - 0xcc]
sub ebx, eax
xor edx, edx
lea ecx, [ebp - 0xcc]
add ecx, edx
mov al, byte [ebx + ecx]
xor byte [ecx], al
inc edx
cmp edx, edi
jb 0x40a73d
lea eax, [ebp - 0xcc]
push eax
call fcn.0040a7c5
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
pop ecx
cmp edi, esi
jb 0x40a793
test esi, esi
je 0x40a77b
push esi
lea ecx, [ebp - 0xcc]
push ecx
push eax
call fcn.004048f2
add esp, 0xc
lea eax, [ebp - 0xcc]
push eax
call fcn.0040a7c5
mov eax, dword [ebp + 8]
add eax, esi
sub edi, esi
mov dword [ebp + 8], eax
jmp 0x40a761
test edi, edi
je 0x40a7a8
push edi
lea edx, [ebp - 0xcc]
push edx
push eax
call fcn.004048f2
add esp, 0xc
xor al, al
lea edi, [ebp - 0xcc]
mov ecx, 0xc8
rep stosb byte es:[edi], al
xor eax, eax
jmp 0x40a7be
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b363
Capabilities:
Encode data using xor

Disassembly:
sub bh, bh
or dword [edi - 0x23], eax
in eax, 0x20
cld
push ds
pop ds
fbstp tbyte [ebx + 0x5e]
in eax, dx
xor al, 0x34
sub al, byte [eax]
or al, 0xc4
sub al, 0x4c
mov edx, 0xe87299ad
stosb byte es:[edi], al
dec eax
xchg ecx, eax
add bl, byte [ecx + edx]
pushfd
add byte [ebx + 4], al
inc ebp
iretd
jne 0x40b2a6
xor edi, dword [edx + 0x49]
sub bl, 0x5a
or ebp, dword [edi + 0x72]
fcmove st(0), st(2)
dec edx
lds edx, [edx]
les ebx, [ecx + 0x2b]
paddusb mm5, qword [ecx - 0x615726f2]
mov bh, 0x7c
xchg esp, eax
salc
push 0xffffffffffffffd8
fadd st(7)
xchg esp, eax
cmp al, 0x74
mov ah, 0xba
mov fs, word [0x37bcd2c8]
mov bh, 0x75
dec esp
xor cl, ah
adc al, 0x99
int3
jl 0x40b301
sbb cl, byte [edx + 0x7a]
pop ecx
sub cl, byte [edx - 0x14]
js 0x40b3da
mov dword [eax], eax
lea esp, [edi + 0x5f5f137c]
ja 0x40b3bd
mov eax, dword ss:[0xc474983d]
dec edi
nop
invalid
jbe 0x40b419
movsd dword es:[edi], dword [esi]
sbb bh, byte [esi + 0x20]
jmp 0x40b3c4
inc dword [ecx]
sub dh, byte [eax]
mov ebp, 0x4878c137
retf
dec ecx
call 0xa8ffbf9e
mov bh, 0xd8
sub dword [ecx - 0x5d1246a7], ebx
salc
mov ecx, 0x3019d603
Function at 0x47f8bb
Capabilities:
Authenticate hmac

Disassembly:
jb 0x47f8c9
jb 0x47f8cb
fstp dword [0xd343836b]
out dx, eax
int3
arpl word es:[edx + 0x28], si
mov esi, 0xef5e8f38
test al, 0xf2
jg 0x47f8ce
jg 0x47f865
lds esp, [ebx - 0x8d9cb6]
mov dword [0xff72634a], eax
outsd dx, dword [esi]
in al, 0xf5
add esi, edx
jg 0x47f89e
bnd jg 0x47f89e
jg 0x47f8d5
inc ebx
out 0xb9, al
jb 0x47f8a9
arpl word [ebx], sp
fiadd word [0x62f370b3]
out dx, eax
jg 0x47f8cd
jg 0x47f911
loop 0x47f8a5
loop 0x47f933
sub dword [edi - 1], ebp
arpl bx, dx
jmp dword [ebx - 0x2d]
xor bh, byte [ebx + esi*8 + 0x7f]
jg 0x47f8c0
bnd jg 0x47f907
jg 0x47f907
aaa
ljmp 0x63be:0xf870a3b5
mov esi, 0xf2a37a63
and edx, ecx
je 0x47f891
jg 0x47f8c6
das
outsd dx, dword [esi]
mov eax, dword [0xa15329bc]
bound esp, qword [ebx - 0x65]
push ecx
jecxz 0x47f8cf
sar byte [edi + 0x39], 1
bound eax, qword [ebx + 0x799dbc00]
and eax, ecx
out dx, eax
into
dec ebp
daa
mov eax, dword [0xe0127334]
xchg edx, eax
loopne 0x47f89f
loop 0x47f985
loop 0x47f96b
arpl word [ebx - 0x1d], si
jae 0x47f8ed
pop edi
out dx, eax
jg 0x47f91a
loop 0x47f953
dec ebx
cmp esp, dword [edx - 0x35]
outsd dx, dword [esi]
inc esp
imul esp, dword [edx - 0x1e], 0xffffffa7
retf
cmpsd dword [esi], dword es:[edi]
aam 0x73
mov esi, 0xf3a727f2
xor edx, 0xffffff92
add edi, dword [0xdfa9cda2]
cmp eax, 0xdfa9cda2
in al, dx
mov byte [edx + 0x21b032d], al
add dh, byte [edx - 0xe]
jb 0x47f927
xchg edx, eax
loopne 0x47f96a
loope 0x47f94d
imul ebp, dword [ebx], 0x2d
into
pop edi
hlt
bound edx, qword [ebx]
jp 0x47f932
adc edi, dword [edx - 0x1e]
scasb al, byte es:[edi]
mov edi, 0xbded9202
inc byte [ebx - 0x78]
mov dl, 0x2b
xchg edx, eax
in eax, dx
mov ebp, 0xf28843fe
mov dl, 0x2b
cmp cl, bh
add dword [edx + eax], esi
xor al, 2
xor ah, byte [ecx + 0x34935c6f]
jae 0x47f991
aas
mov byte [0x238ea523], al
dec esi
add bl, byte [edx + 0x26df2dd]
and esp, dword [ebp + 0x24e238e]
pushfd
and bl, ch
repne insd dword es:[edi], dx
add dl, byte [ebx + 0x366a1271]
xchg ebx, eax
jno 0x47f98c
push 0x36
jg 0x47f95f
jg 0x47f961
and eax, 0x3a7d221c
lodsd eax, dword [esi]
or byte gs:[ebx], 0x83
jb 0x47f9de
je 0x47f977
jne 0x47f974
out 0x94, al
xchg esp, eax
and dh, byte [ecx - 0x5a53bdfe]
ja 0x47f94c
inc esi
lodsd eax, dword [esi]
or dh, ch
je 0x47f95e
xchg edx, eax
mov byte [0xa2aecec8], al
pop esp
mov byte [0xde4eae74], al
dec edi
invalid
pushal
test byte [eax + 0x7caff030], 0x5c
sbb eax, 0x24fb1caf
std
sbb al, 0x3f
jecxz 0x47f9ce
inc eax
mov bl, 0x13
sub al, 0x1e
cmp byte [ecx + 0x3a], dl
and cl, 0x43
frstor dword [ebp + 0x3a]
popal
cmp dword ds:[ecx + 8], edx
sub cl, byte [edx + ecx*4 - 0x1768e19f]
inc edx
movsb byte es:[edi], byte [esi]
push eax
int3
Function at 0x4ae55b
Capabilities:
Encode data using xor

Disassembly:
invalid
add dh, byte [eax + edx*2 - 0xd3799b6]
pop ds
out 0xd5, al
and dword [ecx - 0x6a882b1a], edx
jne 0x4ae589
sbb al, 0x11
dec eax
pushal
adc dword [eax + 0x60], ecx
enter 0xffffffffffffcb28, 0x21
in al, 0x41
enter 0xfffffffffffff523, 0x4b
inc esi
mov ah, 0x3c
and dword [ebx + 0x60], ecx
enter 0x7e2a, 0x2f
cmpsd dword [esi], dword es:[edi]
aam 0xd5
sub dh, bh
movsd dword es:[edi], dword [esi]
xor byte [ecx + 0x109531dc], ah
test byte [edi - 0x21], cl
loope 0x4ae58a
loopne 0x4ae56c
loope 0x4ae52b
retf

Function at 0x4ba8f1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33d8
cmp edx, dword [eax]
je 0x4ba913
add eax, 8
inc ecx
cmp eax, 0x4c3468
jl 0x4ba904
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33d8]
jne 0x4baa41
mov eax, dword [0x4c7d88]
cmp eax, 1
je 0x4baa1b
test eax, eax
jne 0x4ba944
cmp dword [0x4c3300], 1
je 0x4baa1b
cmp edx, 0xfc
je 0x4baa41
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba97b
lea eax, [ebp - 0x1a4]
push 0x4bfb50
push eax
call fcn.004bb2d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb760
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba9be
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb760
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfb4c
push edi
call fcn.004bd630
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bfb30
push eax
call fcn.004bb2d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb2e0
lea eax, [ebp - 0xa0]
push 0x4bfb2c
push eax
call fcn.004bb2e0
push dword [esi + 0x4c33dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb2e0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bfb04
push eax
call fcn.004bd5a4
add esp, 0x2c
pop edi
jmp 0x4baa41
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33dc]
push 0
push eax
push dword [esi]
call fcn.004bb760
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret