joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4059bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40fba0
cmp edx, dword [eax]
je 0x4059df
add eax, 8
inc ecx
cmp eax, 0x40fc30
jl 0x4059d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40fba0]
jne 0x405b0d
mov eax, dword [0x41f1f0]
cmp eax, 1
je 0x405ae7
test eax, eax
jne 0x405a10
cmp dword [0x40faec], 1
je 0x405ae7
cmp edx, 0xfc
je 0x405b0d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405a47
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004067c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405e80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x405a8a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405e80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40841c
push edi
call fcn.00406940
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004067c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004067d0
lea eax, [ebp - 0xa0]
push 0x4083fc
push eax
call fcn.004067d0
push dword [esi + 0x40fba4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004067d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004068b0
add esp, 0x2c
pop edi
jmp 0x405b0d
lea eax, [ebp + 8]
lea esi, [esi + 0x40fba4]
push 0
push eax
push dword [esi]
call fcn.00405e80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x401984
Capabilities:
Hide graphical window

Disassembly:
push ebp
sub esp, 0x40
push esp
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
add esp, 0x40
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
loop 0x40199b
push esp
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4040b0], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0x4016e2
mov dword [ebp - 4], str.risiliency
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040b0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.ebsement
push str.risiliency
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040b8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a36
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a1d
pop ebp
ret 0x10
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x8d7188f
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1d0a3947
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp int.00401219
Function at 0x29a051e9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x29a051f8
pop dword [ebp - 0x18]
mov eax, 0x36aa6626
add eax, 0xf2f5ebd2
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xe654672e
add dword [ebp - 0x28], 0x67fdde1d
mov dword [ebp - 0x24], 0xbdea8086
add dword [ebp - 0x24], 0x7448cbbf
mov dword [ebp - 0x20], 0xb077081e
sub dword [ebp - 0x20], 0x642ac3f0
mov dword [ebp - 0x1c], 0xbe53dfe8
add dword [ebp - 0x1c], 0x41ac2018
lea eax, [ebp - 0x28]
push eax
mov eax, 0xd49af8ef
add eax, 0x5506479d
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x3ba91e6f
add dword [ebp - 0x28], 0x38c94ae7
mov dword [ebp - 0x24], 0x27c7c7fc
add dword [ebp - 0x24], 0x19a49979
mov dword [ebp - 0x20], 0xbe633333
add dword [ebp - 0x20], 0xa50c3939
mov dword [ebp - 0x1c], 0x975033bf
sub dword [ebp - 0x1c], 0x975033bf
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xbd4ca63d
sub eax, 0x93ab65f9
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3cea4
push 0
call eax
mov ecx, 0xbf8ee722
sub ecx, 0xbf8e94e7
mov edx, eax
mov edi, 0x29a22000
add edi, dword [ebp - 0x18]
mov esi, 0x6bf7f1af
sub esi, 0x756bdaa1
xor dword [ebp - 0x10], ecx
mov ebx, dword [edi]
mov dword [ebp - 0x14], 0x2f2ca9f6
sub ebx, esi
xor dword [ebp - 0x14], 0x9a996ef7
mov dword [edx], ebx
xor dword [ebp - 0x14], 0xf8070524
add edx, 4
add edi, 4
loop 0x29a05314
add eax, 0x70b36c74
add eax, 0x8f4dcf4b
mov ebx, eax
add eax, 5
mov ecx, 0x29a00000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x73d3097
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x62f211c5
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6a
nop
sub eax, 0x403d10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x701c6444
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x30305e37
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x7e1b9d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07d2fb0
jmp 0x7e1bda
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x7e1e86
mov edi, dword [esp + 0x2c]
bts dx, ax
jo 0x7e1ccf
mov ecx, esp
jmp 0x7e1c17
mov eax, 0x544ba8e5
cpuid
lea ebx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
xchg cl, al
jmp 0x7e1bc4
sub esp, 0xc0
mov esi, esp
mov ecx, ebp
seto cl
jmp 0x7e1bfe
bswap edx
mov edx, eax
mov ebx, edi
rdtsc
lea eax, [ecx + esi]
rdtsc
jmp 0x7e1c3e
lea ebp, [esp]
mov dx, 0xb3b9
bswap ebx
setae al
mov ch, byte [esp]
jmp 0x7e1beb
mov ch, dh
call fcn.007e1c8d
bswap eax
dec edx
jae 0x7e1c28
mov ch, dh
jmp 0x7e1c2a
mov ecx, esp
jmp 0x7e1c17
pushfd
jmp 0x7e1ab3

Function at 0x7f94f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0xd3cb411
jmp 0x7f982d
add edx, 0x57d7653e
jmp 0x7f9511
dec edi
cmc
jp 0x7f9541
xchg dl, dh
not ch
not dh
lea edx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x7f96f2
not ch
not dh
lea edx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x7f972b
xchg dl, dh
jmp 0x7f952b
stc
jbe 0x7f958b
push esi
mov cl, byte [esp + 2]
not ch
jmp 0x7f9574
mov dh, byte [esp]
mov ch, 0xb2
jmp 0x7f96b6
mov ecx, 0x8314fa35
jmp 0x7f95f2
push esi
mov cl, byte [esp + 2]
call fcn.007f95c8
inc esi
mov dx, si
lea ebx, [ebx - 0x2f]
setl dh
jmp 0x7f95ae
mov dx, 0x751
mov ecx, 0xfbe29a70
mov dh, ah
xchg dword [esp + 4], ebx
sete dh
jmp 0x7f9634
lea esp, [esp + 4]
neg al
call fcn.007f95dc
mov ecx, dword [esp]
inc edx
ror cx, 5
push dword [esp + 4]
ret 8
rcl dl, 0
lea ecx, [ebx*4]
inc cx
jmp 0x7f955c
rcl dl, 0
lea ecx, [ebx*4]
inc cx
mov dh, byte [esp]
mov ch, 0xb2
sub al, 0xb0
lea edx, [ebp*4]
jmp 0x7f9545
or cx, 0xa3b6
jmp 0x7f9730
or cx, 0xa3b6
ror al, 0
cmc
jge 0x7f96a5
jl 0x7f9661
shr ecx, 6
shl edx, 2
jmp 0x7f97fb
lea esp, [esp + 4]
lea ecx, [ecx + esi]
mov cl, 0x38
jmp 0x7f984b
jmp 0x7f7b2a
mov cx, word [esp]
inc ch
jbe 0x7f986f
neg ecx
not cx
jmp 0x7f9871
bsf ecx, ebp
rol cx, 1
jo 0x7f9828
jno 0x7f7b2a
neg ecx
not cx
jmp 0x7f9871
jmp 0x7f9859
mov edx, dword [edx - reloc.IPHLPAPI.DLL_GetInterfaceInfo]
lea ecx, [ecx*4]
inc cl
jmp 0x7f98ea
neg ecx
jmp 0x7f7b7a
ja 0x7f9886
neg ecx
jmp 0x7f7b7a

Function at 0x7f9643
Capabilities:
Execute anti-debugging instructions

Disassembly:
setp ch
pop edx
sub esp, 5
jmp 0x7f9672
jbe 0x7f9688
lea esp, [esp + 1]
jmp 0x7f968c
lea esp, [esp + 1]
rol al, 0
jg 0x7f96da
lea ecx, [ecx*4]
mov dx, 0x5f28
jmp 0x7f96dc
lea ecx, [ecx*4]
mov dx, 0x5f28
mov cx, word [esp]
jmp 0x7f970f
jmp 0x7f96c4
mov cx, word [esp]
mov edx, ebx
jmp 0x7f9711
bswap ecx
jmp 0x7f9769
mov edx, ebx
mov edx, eax
bswap ecx
push ebx
jmp 0x7f96f9
sub esp, 4
jbe 0x7f9740
shr ecx, 6
call 0x7f978d
xor eax, dword [edi - reloc.IPHLPAPI.DLL_GetInterfaceInfo]
or al, 0x8d
add byte [eax], al
add byte [eax], al
mov cx, 0xe88c
jmp 0x7f97b9
pop word [esp + 1]
lea esp, [esp + 1]
xchg dword [esp + 0x20], edx
jmp 0x7f9811
bt ecx, edi
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
lea edx, [edx - 0x2a]
sub esp, 0xb
mov cl, ah
jmp 0x7f97a3
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
adc cx, si
mov cx, 0x5fa2
lea ecx, [ecx + edx]
push dword [esp + 0x20]
ret 0x24
Function at 0x815bb4
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 4]
mov dword [eax + 8], 0x67452301
jmp 0x815b9e

Function at 0x89e28f
Capabilities:
Access peb ldr_data

Disassembly:
call 0x89e093
jmp 0x89e2d8
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], esi
jmp 0x89e283
push bp
mov word [esp], sp
call 0x89e28f
add al, 0x66
push dword [esp + 4]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x89e36e
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x89e08e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x89e308
Function at 0x4012a4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0040a2b3
mov dword [esp + 0x28], 0
test esi, esi
jne 0x4012ea
xor eax, eax
jmp 0x4012ed
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call int.0040a8e8
lea eax, [edi + 0x7c]
test eax, eax
je 0x401308
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0040ac4d
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x401346
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0040ac4d
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.00409fcd
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0040a969
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d144
Capabilities:
Authenticate hmac

Disassembly:
salc
jno 0x40d10f
insd dword es:[edi], dx
mov dword [0xa3b9ccf0], eax
pushfd
aad 0xd9
xor dword [esi + 0x450aa333], 5
xchg byte [edx + 0x16], bh
invalid
mov bl, byte [edx]
aaa
out dx, eax
mov dl, 0x32
or al, 0x8a
ror dword [edx + edx*8], 0x28
ficomp dword [ebx - 0x4e481429]
loope 0x40d09f
stosb byte es:[edi], al
dec dword [esi + 0x642318b]
sahf
sub dword [edi], edx
mov eax, dword [0x31253e1b]
std
jecxz 0x40d184
ja 0x40d0a1
in al, dx
stosb byte es:[edi], al
mov cs, word [esi - 0x494c91ae]
outsb dx, byte [esi]
mov bl, 0xb6
push edx
out 0x79, al
xor dword [edi - 0x55940bc7], esi
idiv ebx
movsb byte es:[edi], byte [esi]
loope 0x40d0e3
imul esp, dword [0x9d75f224], 0x6d6f0227
xchg ebx, eax
cld
pushal
and bl, byte [esi + 0x659f38e4]
or eax, 0x8fe606bd
fiadd word [ebx]
pop esi
mov al, 0x86
adc dl, byte [ebx - 0x189328fc]
frstor dword cs:[ebx]
mov ss, word [esi]
fcom dword [edi]
inc ecx
pop ecx
dec edi
push ecx
jl 0x40d0ef
invalid
pop es
and esp, dword [esi]
scasd eax, dword es:[edi]
mov ch, 0x5c
mov bl, 0xd6
mov byte cs:[0x79a7c095], al
mov esi, 0xd172f7bd
push ss
or al, 0xb6
mov dword [0x2872e751], eax
inc ebp
push ss
cli
mov byte [ebx - 0x68e83f2c], dl
mov byte [eax], al
xchg edi, eax
inc edx
and esi, edx
test al, 0xd0
pop edi
sub eax, 0x1117b26a
dec eax
pop esp
cmp al, 0xd6
rcl ah, 0xe8
inc ecx
fsub qword [ebx]
push es
push ebp
rcr byte [ecx + 0x2a], 0xa1
inc esp
adc ecx, dword [eax - 0x66fbe206]
push 0x36
sbb esp, 0x52
xchg esi, eax
sub al, 0xe2
stosb byte es:[edi], al
sub dword [ebp - 0x44a2b3e1], esp
inc edx
hlt

Function at 0x458439
Capabilities:
Check for software breakpoints

Disassembly:
ja 0x45848e
mov al, 0x58
pop dword [esi + 0x22]
sbb ch, byte [0xcac85c43]
xchg esp, eax
cdq
dec ecx
invalid
adc dword [edx - 0xc], esi
aad 0x39
in eax, 0xff
je 0x4584fe
cmp ebp, esp
push dword [edi - 0x1f]
stc
loope 0x458492
loope 0x458492
dec eax
push ds
push es
lcall 0x9313, 0xda284502
invalid
pushal
fidivr word [esi]
lodsd eax, dword [esi]
int3
jge 0x458496
or dword [eax], 0x9b9cb9bc
cmp eax, 0x8efb2c79
cmp dword [0xdb23c02], esp
into
inc esi
pop esp
in al, dx
jg 0x4584c1
cmp eax, dword [edx - 0x19d52380]
sbb al, al
dec edx
hlt
bound esp, qword [esi + 0x48]
ja 0x45854e
push ss
cmp dword [ebx - 0x58], ecx
stosb byte es:[edi], al
pop eax
jne 0x4584ca
sbb eax, 0xc4fadcc
sbb eax, 0xc4fadcc
mov dh, 0xce
sbb ebx, dword [edx + 0x3975ee28]
cld
sbb eax, 0xa5d5ccd3
lodsb al, byte [esi]
cmp al, 0xcc
outsb dx, byte [esi]
push esi
jl 0x458564
cmp eax, 0x527a8864
insb byte es:[edi], dx
pop edi
ret
idiv dword [ecx + edi]
and al, 0x9b
inc edx
sub eax, 0x406039ae
lea esi, [ebp + 0x3771697c]
pop ebp
cmp ebp, edi
out dx, al
lodsb al, byte [esi]
push esi
daa
lcall 0xb86b, 0x447e7f32
in al, dx
dec eax
mov gs, word [edx - 0x14ada5c4]
invalid
iretd
rcr dword [ebx + 0x5ccd67cd], 0xb2
loop 0x4584f0
mov byte ss:[edx], bh
push 0x2b947eb2
cmpsd dword [esi], dword es:[edi]
rcr byte [edx + 0x6d14e62d], 1
lcall 0xaeb8, 0x1bea23e0
rcr byte [ebx + 0x64], cl
mov edi, 0x3a9ce600
sbb eax, 0xb5af04b3
sub dh, 0x91
pop esi
leave
out dx, eax
inc esi
imul esp, dword [eax], 0x7a
js 0x458521
adc al, 0xa0
sbb al, 0xfd
invalid
Function at 0x4a03db
Capabilities:
Encode data using xor

Disassembly:
sub byte [ebp + 0x7b], cl
inc eax
xor ah, ch
inc edi
out 0xb2, al
rcr esp, cl
invalid

Function at 0x4a1469
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xef6caef1
push ebx
inc ebx
ja 0x4a14aa
out dx, eax
mov bl, 0xa1
mov es, word [ecx + 0x71d63ec8]
and dword [ebp - 0x49b1f4df], edi
dec byte [esi + 0x61849195]
jo 0x4a1451
push 0x51
push eax
fldcw word [ebx + 0x3c]
inc esi
in al, 0x45
imul edi, dword [esi + eax*2], 0xffffffe4
inc ebp
loope 0x4a1452
xor al, 0x40
dec esi
cmpsb byte [esi], byte es:[edi]
mov bh, 0xaf
sbb al, bl
fidiv word [esi + 0x55df4b98]
scasb al, byte es:[edi]
add dword [eax + ebp*4 + 0x784b5b11], ebp
loop 0x4a14d1
dec ebx
js 0x4a14b6
cld
adc ah, ch
xchg ecx, eax
xor dword [eax], ecx
and eax, 0x9edbef6e
invalid

Function at 0x4a2b16
Capabilities:
Encode data using xor

Disassembly:
aas
jge 0x4a2b29
into
cli
mov bh, 0xd5
aad 0xbb
xor eax, 0xeb592430
lodsd eax, dword [esi]
and bh, 0x10
sub eax, dword [ebx]
out dx, al
sbb al, 0xfa
xor byte [edi + 0x14], dh
mov bh, 0x7c
mov dword gs:[0x3ed301ae], eax
jl 0x4a2b82
test eax, 0x5e5ebd12
inc esp
mov ch, byte [eax]
adc al, 0x5e
and al, 0xd4
in eax, dx
mov al, byte [0x95b857c9]
movsd dword es:[edi], dword [esi]
mov dl, 0x46
out 0x6b, al
loope 0x4a2ba0
add byte [ecx - 2], 0xb9
and eax, 0xd3d6d9d1
sbb bl, byte [eax]
mov esp, 0xf81ff02f
sub eax, 0xbb81dc05
sub eax, 0xafa8ac93
fadd qword [ecx - 0x536cd245]
test al, 0xaf
clc
stosb byte es:[edi], al
cmp dword [ebx + esi*8], 0xd
xor byte [ebx], al
aad 0xbc
cmp dword [eax + eax - 0x44ea30d1], edx
mov eax, dword [0xb1b5c02]
sbb ecx, dword [ebx]
inc eax
fisttp dword [edi]
xor ecx, ebp
mov edi, 0x9e7ed6ac
loope 0x4a2b66
inc edi
sub dh, byte [ecx + 0x1e]
inc esp
ficom word [edx + ebx*2 + 0x3b]
fnsave dword [eax]
scasb al, byte es:[edi]
rol byte fs:[ebx - 0x61], 1
cmp ebx, ebp
xor byte [esi - 0x60bc2f9c], ch
jg 0x4a2bd5
xor dh, ch
int 0x7f
enter 0xffffffffffffcd8f, 0xffffffffffffff9c
adc ch, dh
rcl dword [ebp - 0x6b], cl
mov ebx, 0x7702224a
cmp eax, 0xa44ff6f8
int3
mov dl, 0x68
jle 0x4a2c0a
or al, 0x2d
insd dword es:[edi], dx
sub dword [esp], edi
rcl dh, 0xde
rcr dword [esi + 0x14], 0x90
push 0x61
scasd eax, dword es:[edi]
outsd dx, dword [esi]
ror byte [esi + 0x5e925022], 0xf7
sbb al, 0x6e
neg dword [esi + ebp*2]
rcr dword [esi + 0x63], cl
salc
imul edx, dword [esi - 0x18f1ee9d], 0x5b
jp 0x4a2b98
shl byte [ebp + 0x2f], 0xf1
sar dword [esi], cl
outsb dx, byte [esi]
loop 0x4a2bf1
out 0xbf, al
pop edx
stosb byte es:[edi], al
invalid
mov edi, 0x2afeaa5a
xlatb
mov edx, 0x5b76644a
jbe 0x4a2c71
Function at 0x4a64ea
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
fnsave dword [edi + 0x7c]
in eax, dx
inc edx
pop ebp
add al, 0xc2
sar dword [ebp - 0x7d34378c], 1
in eax, 0x74
enter 0xffffffffffff82cb, 0x20
inc ebx
invalid
popal
jl 0x4a6515
in eax, 0x74
enter 0xffffffffffff82cb, 0x20
inc ebx
mov eax, 0x4e207c61
dec esi
inc ecx
inc eax
lodsb al, byte [esi]
sar byte [edx + esi*2 - 0x45d1f50c], cl
adc dh, cl
in eax, dx
nop
loope 0x4a6571
dec edi
xor dword [edi + 0x14a9deca], edi
jno 0x4a650c
adc al, 0x71
std
sub al, 0xff
mov eax, 0x61507671
popal
js 0x4a64df
sbb eax, 0xf910210f
invalid
invalid
inc ebp
xor bh, byte [eax]
inc esp
jp 0x4a6572
jg 0x4a65ba
or eax, 0x349ed0da
mov gs, word [esi - 0x25]
fcom st(7)
push cs
loop 0x4a656a
invalid
invalid
invalid
scasd eax, dword es:[edi]

Function at 0x4bf729
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
pop ds
add byte [ebx + 0x5d], 0x44
push cs
fidiv dword [ecx + 0x5feb5f70]
inc eax
wait
mov eax, dword [0xa1baf0e3]
mov edx, 0x10c507a1
mov edx, 0x10c507a1
mov al, byte [0xac7abbee]
and al, 0x90
cmp al, 0x5d
sbb eax, 0xd455324d
movsd dword es:[edi], dword [esi]
jl 0x4bf778
add byte [eax - 7], al
inc ecx
cmp al, 0x7d
in al, dx
pushal
mov dl, byte [edx]
pop esp
scasd eax, dword es:[edi]
mov ch, 0x8d
mov edi, 0x44dc7148
inc esp
mov bh, dl
sal byte [ecx - 0x738b350e], 1
push 0xc276581d
ljmp 0xb0
fcomp qword [esi]
push 0x10d36378
mov esi, 0x61652c90
popal
out 0x5b, eax
xor cl, 0x12
push cs
xchg esi, eax
sub byte [edi - 0x34], 0x9b
jno 0x4bf783
pop eax
ja 0x4bf717
loope 0x4bf751
sub bl, byte ds:[edx - 0x51]
pushal
fsub st(1), st(0)
scasb al, byte es:[edi]
sbb ebx, dword [esi]
push ds
sahf
invalid