joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb6cf90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0xb6cffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xb6d035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.00b6ce00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0xb6cfc5
mov edi, 0xb878b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xb6d035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00b6ce00
add edi, 4
add esp, 0xc
cmp edi, 0xb878c0
jb 0xb6d000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0xb6d070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.00b73082
mov esi, eax
add esp, 8
test esi, esi
je 0xb6d107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0xb6d102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00b72946
add esp, 8
test eax, eax
je 0xb6d0e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0xb6d0e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00b72946
add esp, 8
test eax, eax
jne 0xb6d0c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0xb6d102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0xb6df10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xb829fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xb6e002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00b71dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xb6e002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00b696e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00b7220b
push 0x10
call fcn.00b721d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xb6dfc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00b5e1c0
jmp 0xb6dfc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00b6db80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xb6dff0
mov ecx, edi
call fcn.00b5e2c0
push edi
call fcn.00b721c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xb6e021
inc ebx
cmp ebx, 0x20
jb 0xb6df3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xb6f250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb83808
push 0xb73288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xb6f329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xb6f329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00b721d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xb6f329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xb6f329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xb6f32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00b6f351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb6fd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb6fd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xb6fd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb6fd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xb6fd94
push eax
push esi
call fcn.00b7220b
add esp, 8
pop esi
ret 0x10

Function at 0xb6fda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb6fe22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xb6fe15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xb88320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00b71dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xb6fdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xb6fe30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb6fec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xb6feb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xb88320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00b71dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xb6feab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xb6fe6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xb70000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xb70131
push esi
call fcn.00b73145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00b62080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xb70131
push 0
push ebp
call fcn.00b623a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00b62260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xb7008b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00b622f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xb70121
push 0xb88918
push edi
call fcn.00b713f0
push eax
push ebx
push esi
call fcn.00b6ff60
push 0xb888f8
push edi
call fcn.00b713f0
push eax
push ebx
push esi
call fcn.00b6ff60
push 0xb888d8
push edi
call fcn.00b713f0
push eax
push ebx
push esi
call fcn.00b6ff60
push 0xb888c0
push edi
call fcn.00b713f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00b6ff60
push 0xb888a0
push edi
call fcn.00b713f0
push eax
push ebx
push esi
call fcn.00b6ff60
push 0xb88888
push edi
call fcn.00b713f0
push eax
push ebx
push esi
call fcn.00b6ff60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xb711b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00b71140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00b71140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00b71140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00b71140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xb71bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb71c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xb8387c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xb71c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xb71c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4028a5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x1c], ebp
seta dl
bswap dx
mov byte [esp], 0xde
xchg dword [esp + 0x18], esi
not edx
jmp 0x402907
movsx si, al
lea esi, [ebp - 0x5ebd9bc2]
mov dword [esp + 0x14], ecx
xchg bx, si
bswap edx
pop esi
movsx si, cl
xchg dword [esp + 0xc], ebp
pushal
mov dword [esp + 0x28], eax
setge bl
jmp 0x40422b
movsx si, al
mov dword [esp + 0x24], edi
xchg bp, bx
xchg ebp, esi
xchg ebp, esi
movzx si, bl
pushfd
pop dword [esp + 0x20]
add esp, 0x20

Function at 0x403b30
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + 0x14]
add eax, dword [ebp + 0xc]
add eax, 0x18
xor ecx, ecx
jmp 0x403b64
mov edx, dword [eax + 8]
test edx, edx
jne 0x403b53
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0xc]
cmp ebx, esi
jb 0x403b60
add edx, esi
cmp ebx, edx
jb 0x403b71
inc ecx
add eax, 0x28
mov edx, dword [ebp + 0xc]
movzx edx, word [edx + 6]
cmp ecx, edx
jb 0x403b49
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x403bac
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
je 0x403bc6
xor eax, eax
jmp 0x403d46
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x403bda
xor eax, eax
jmp 0x403d46
cmp word [ebx + 0x14], 0xe0
jne 0x403bea
cmp word [ebx + 0x18], 0x10b
je 0x403bf1
xor eax, eax
jmp 0x403d46
mov dword [0x4aa0a4], edi
mov ebx, dword [edi + 0x3c]
mov esi, edi
add ebx, esi
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x18], eax
push ebx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00403b30
add esp, 8
test eax, eax
jne 0x403c1c
xor eax, eax
jmp 0x403d46
mov edx, dword [0x4aa0a4]
push edx
push ebx
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00403b78
add esp, 0xc
mov ebx, dword [ebx + 0x78]
test ebx, ebx
jne 0x403c4e
push 0x10
push 0
push str.Error_in_GetProcAddressDirectly__
push 0
call fcn.0044160e
xor eax, eax
jmp 0x403d46
add ebx, esi
mov edx, dword [ebx + 0x24]
add edx, esi
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 0x20]
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 0x10
test cx, cx
je 0x403d18
xor esi, esi
mov eax, dword [ebp - 8]
mov edx, eax
mov dword [ebp - 0x28], edx
jmp 0x403d0a
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
test eax, eax
je 0x403d05
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x28]
mov eax, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0xc]
mov ecx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov edx, eax
mov dword [ebp - 0x1c], edx
jmp 0x403cfc
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp esi, eax
jne 0x403cf1
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x403cf1
test cl, cl
je 0x403ce6
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x403cf1
add eax, 2
add edx, 2
test cl, cl
jne 0x403cca
jne 0x403cf1
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, edi
jmp 0x403d46
inc dword [ebp - 0x14]
add dword [ebp - 0x20], 4
add dword [ebp - 0x1c], 2
mov edx, dword [ebx + 0x18]
dec edx
cmp edx, dword [ebp - 0x14]
jae 0x403cb0
inc esi
add dword [ebp - 0x28], 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x403c88
jmp 0x403d44
xor esi, esi
mov eax, dword [ebp - 8]
jmp 0x403d3c
mov ecx, dword [ebx + 0x10]
add ecx, esi
cmp edx, ecx
jne 0x403d38
cmp dword [eax], 0
je 0x403d38
mov edx, dword [eax]
shl edx, 6
add edi, edx
mov eax, edi
jmp 0x403d46
inc esi
add eax, 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x403d1f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403f34
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.00401dc0
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403fe7
mov eax, 0x401a14
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403fe7
mov eax, 0x404164
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403fe7
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
xor ebx, ebx
mov edi, 0x20
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403fe7
add ebx, 0x9e3779b9
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
add edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
add ecx, eax
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403faf
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404004
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.00401dc0
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x4040ba
mov eax, 0x401a14
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x4040ba
mov eax, fcn.00404004
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x4040ba
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x4040ba
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x404082
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4042a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 8]
cmp ecx, edx
jbe 0x4042c0
xor byte [eax], 0xf5
inc edx
inc eax
cmp ecx, edx
ja 0x4042b7
pop ebp
ret

Function at 0x412b2c
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], ecx
xor edx, edx
mov dword [eax + 0x5c], edx
mov eax, 1
pop ebp
ret
Function at 0x4165c0
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], ecx
xor edx, edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], 0x1c
mov eax, 1
pop ebp
ret

Function at 0x41661c
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], ecx
xor edx, edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], 0x20
mov eax, 1
pop ebp
ret

Function at 0x418f60
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], edx
mov dword [eax + 0xd4], 0x30
mov eax, 1
pop ebp
ret

Function at 0x41900c
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], edx
mov dword [eax + 0xd4], 0x40
mov eax, 1
pop ebp
ret
Function at 0x42ad60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
dec ebx
mov edi, dword [ebp + 8]
lea eax, [ebx - 0x29]
cmp esi, eax
jle 0x42ad96
push 0x2d
push 0x497294
push 0x6e
push 0x79
push 4
call fcn.0043531c
add esp, 0x14
xor eax, eax
jmp 0x42aed8
cmp ebx, 0x29
jge 0x42adb7
push 0x33
push 0x4972ac
push 0x78
push 0x79
push 4
call fcn.0043531c
add esp, 0x14
xor eax, eax
jmp 0x42aed8
push 0x37
push 0x4972c4
lea edx, [ebx - 0x14]
push edx
call fcn.00410fb4
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42adef
push 0x3a
push 0x4972dc
push 0x41
push 0x79
push 4
call fcn.0043531c
add esp, 0x14
xor eax, eax
jmp 0x42aed8
mov byte [edi], 0
lea edx, [edi + 1]
mov dword [ebp - 8], edx
add edi, 0x15
mov dword [ebp - 4], edi
push 0
call fcn.004371cc
push eax
push 0
mov eax, dword [ebp - 4]
push eax
mov edx, dword [ebp + 0x1c]
push edx
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.0043707c
add esp, 0x18
mov edi, ebx
sub edi, esi
mov eax, edi
add eax, 0xffffffd7
push eax
push 0
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
call fcn.0040609c
add esp, 0xc
mov ecx, dword [ebp - 4]
mov byte [ecx + edi - 0x15], 1
push esi
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp - 4]
add edx, ebx
sub edx, esi
add edx, 0xffffffec
push edx
call fcn.0040602c
add esp, 0xc
push 0x14
mov ecx, dword [ebp - 8]
push ecx
call fcn.00434144
add esp, 8
test eax, eax
jg 0x42ae6d
xor eax, eax
jmp 0x42aed8
push 0x14
lea ecx, [ebx - 0x14]
mov edx, dword [ebp - 8]
push edx
push ecx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042b178
mov edx, dword [ebp - 4]
add esp, 0x10
mov esi, edx
mov edx, dword [ebp - 0xc]
xor eax, eax
jmp 0x42ae96
mov cl, byte [edx]
inc eax
xor byte [esi], cl
inc esi
inc edx
lea ecx, [ebx - 0x14]
cmp eax, ecx
jl 0x42ae8f
add ebx, 0xffffffec
lea edx, [ebp - 0x20]
push ebx
mov eax, dword [ebp - 4]
push eax
push 0x14
push edx
call fcn.0042b178
mov edx, dword [ebp - 8]
add esp, 0x10
mov ecx, edx
lea edx, [ebp - 0x20]
xor eax, eax
mov bl, byte [edx]
xor byte [ecx], bl
inc eax
inc ecx
inc edx
cmp eax, 0x14
jl 0x42aebd
mov eax, dword [ebp - 0xc]
push eax
call fcn.00411174
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret