joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410cc5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040fd58
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040fd0d
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040fd48
jecxz 0x410db4
invalid
push dword [ebp + 0x14]
call fcn.0040fd0d
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x410df4
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
clc
pop esp
jne 0x410e14
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x410e31
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x104
jge 0x410e98
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
and eax, 0x80
test eax, eax
je 0x410e63
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
jmp 0x410e96
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
cmp eax, 0x5c
jne 0x410e82
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
test eax, eax
jne 0x410e96
jmp 0x410e98
jmp 0x410e24
mov eax, dword [ebp - 0x670]
add eax, dword [ebp - 0x384]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0040fcb9
add esp, 0xc
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
and dword [ebp - 4], 0
and dword [ebp - 0x3a0], 0
and dword [ebp - 0x37c], 0
and dword [ebp - 0x388], 0
and dword [ebp - 0x374], 0
mov al, byte [ebp - 8]
add al, byte [ebp - 0x670]
mov byte [ebp - 8], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
mov ecx, dword [ebp - 0x548]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x53c], ecx
mov eax, dword [ebp - 0x53c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x3a8], ecx
mov al, byte [ebp - 0x24]
sub al, byte [ebp - 0x670]
mov byte [ebp - 0x24], al
call fcn.0040fd26
mov edx, 0x4a580a9
cld
invalid
Function at 0x4053e0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ecx
push esi
push edi
sub esp, 8
mov esi, eax
mov edi, edx
xor edx, edx
mov ecx, eax
inc eax
cmp byte [ecx], 0
je 0x4053f7
inc edx
jmp 0x4053ec
push 0
lea eax, [esp + 4]
push eax
push edx
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea eax, [esp + 4]
push eax
push 2
lea eax, [esp + 0x10]
push eax
push 0xfffffffffffffff4
mov word [esp + 0x18], 0xa0d
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, edi
jmp 0x402390

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000aed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
xor ebp, ebp
cmp dword [esi + 4], ebp
jne 0x1000aee5
pop esi
mov eax, 0x271f
pop ebp
ret
push ebx
mov ebx, dword [esp + 0x14]
push edi
test ebx, ebx
je 0x1000af51
push dword [esi + 8]
push 0
push dword [esi]
call sub.MSVCR120.dll_memset
mov edi, dword [esp + 0x28]
add esp, 0xc
cmp edi, dword [esi + 8]
jbe 0x1000af28
push dword [esi + 4]
call fcn.1000a1e0
push edi
push ebx
push dword [esi + 4]
call fcn.1000a210
push dword [esi]
push dword [esi + 4]
call fcn.1000a240
add esp, 0x18
jmp 0x1000af36
push edi
push ebx
push edi
push dword [esi]
call dword [sym.imp.MSVCR120.dll_memcpy_s]
add esp, 0x10
xor ecx, ecx
cmp dword [esi + 8], ecx
jbe 0x1000af51
lea ecx, [ecx]
mov eax, dword [esi]
xor dword [eax + ecx], 0x36363636
add ecx, 4
cmp ecx, dword [esi + 8]
jb 0x1000af40
push dword [esi + 4]
call fcn.1000a1e0
push dword [esi + 8]
push dword [esi]
push dword [esi + 4]
call fcn.1000a210
add esp, 0x10
test ebx, ebx
jne 0x1000af76
cmp dword [esi + 0x10], ebp
jne 0x1000b02e
mov ecx, dword [esi + 4]
push 0
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
shr eax, 1
and eax, 1
mov dword [esi + 0x20], eax
lea eax, [esp + 0x18]
push eax
push 0
push ecx
je 0x1000af9a
call fcn.10019a00
jmp 0x1000af9f
call fcn.10009e70
mov ebx, dword [esp + 0x30]
lea edi, [esi + 0x10]
add esp, 0x10
push ebx
push dword [edi]
call fcn.10003e90
lea ebp, [esi + 0x14]
push ebx
push dword [ebp]
call fcn.1003a6a0
mov eax, dword [esp + 0x24]
push 0
add eax, 7
mov dword [edi], 0
and eax, 0xfffffff8
mov dword [ebp], 0
push ebx
push eax
push edi
mov dword [esp + 0x34], eax
call fcn.1003a690
add esp, 0x20
test eax, eax
jne 0x1000b0a3
push eax
push ebx
push dword [esp + 0x1c]
push ebp
call fcn.1003a690
add esp, 0x10
test eax, eax
jne 0x1000b0a3
cmp dword [esi + 0x20], 0
mov eax, dword [esp + 0x14]
push eax
push 0
push dword [edi]
mov dword [esi + 0x18], eax
push dword [esi + 4]
je 0x1000b020
call fcn.10019a00
jmp 0x1000b025
call fcn.10009e70
mov ebp, eax
add esp, 0x10
test ebp, ebp
jne 0x1000b0a1
xor ecx, ecx
cmp dword [esi + 8], ecx
jbe 0x1000b051
jmp 0x1000b040
mov eax, dword [esi]
xor dword [eax + ecx], 0x6a6a6a6a
add ecx, 4
cmp ecx, dword [esi + 8]
jb 0x1000b040
push dword [esi + 4]
call fcn.1000a1e0
push dword [esi + 8]
push dword [esi]
push dword [esi + 4]
call fcn.1000a210
add esp, 0x10
cmp dword [esi + 0x20], 0
push dword [esi + 0x18]
push 0
push dword [esi + 0x14]
push dword [esi + 4]
je 0x1000b081
call fcn.10019a00
jmp 0x1000b086
call fcn.10009e70
xor ecx, ecx
add esp, 0x10
cmp dword [esi + 8], ecx
jbe 0x1000b0a1
mov eax, dword [esi]
xor dword [eax + ecx], 0x5c5c5c5c
add ecx, 4
cmp ecx, dword [esi + 8]
jb 0x1000b090
mov eax, ebp
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x1000e520
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x44
mov eax, dword [0x1005fe78]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x54]
xor ebp, ebp
push edi
mov edi, dword [esp + 0x5c]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0
test edi, edi
je 0x1000e67b
lea eax, [esp + 0x10]
push eax
push 0x400
push dword [esi + 0x1c]
call fcn.1003a010
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x1000e661
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.MSVCR120.dll__stat64i32]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
push 0x30
push eax
push esi
call fcn.1003bb30
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x1000e661
lea ebp, [eax + 0x30]
cmp dword [esp + 0x18], eax
jge 0x1000e5ac
mov ebx, 0x2711
jmp 0x1000e661
mov esi, dword [esp + 0x60]
test esi, esi
jle 0x1000e65d
push 0x1004e33c
push edi
call dword [sym.imp.MSVCR120.dll_fopen]
add esp, 8
mov dword [esp + 0x18], eax
test eax, eax
je 0x1000e65d
mov edi, 0x400
cmp esi, edi
push eax
cmovl edi, esi
push edi
push 1
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR120.dll_fread]
add esp, 0x10
mov dword [esp + 0x1c], eax
test eax, eax
jle 0x1000e63d
push edi
push dword [esp + 0x14]
push dword [esp + 0x1c]
call fcn.1003bb30
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x1000e650
add ebp, dword [esp + 0x1c]
sub esi, edi
test esi, esi
jle 0x1000e63d
push dword [esp + 0x18]
mov edi, 0x400
cmp esi, edi
cmovl edi, esi
push edi
push 1
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR120.dll_fread]
add esp, 0x10
mov dword [esp + 0x1c], eax
test eax, eax
jg 0x1000e5f6
push 0x400
push 0
push dword [esp + 0x18]
call fcn.10003e90
add esp, 0xc
push dword [esp + 0x18]
call dword [sym.imp.MSVCR120.dll_fclose]
add esp, 4
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000e675
push eax
push dword [esi + 0x1c]
call fcn.10039ff0
add esp, 8
mov eax, ebx
test ebp, ebp
jne 0x1000e680
mov eax, 0x2711
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004475d
add esp, 0x44
ret
Function at 0x100309b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x1005fe78]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov ebx, dword [eax + 8]
push esi
mov esi, dword [eax + 0xc]
cmp dword [ebx + 0x84], 3
je 0x100309ef
pop esi
pop ebp
mov eax, 0x2732
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1004475d
add esp, 0x14
ret
mov eax, dword [esp + 0x2c]
cmp eax, dword [esi + 8]
jae 0x10030a0f
pop esi
pop ebp
mov eax, 0x271b
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10003e90
add esp, 0x14
ret
lea eax, [esp + 0xc]
push eax
push dword [ebx + 0x38]
call fcn.1000a240
xor edx, edx
add esp, 8
cmp dword [esi + 8], edx
jbe 0x10030a43
push edi
lea edi, [esp + 0x10]
sub edi, ebp
lea ecx, [ecx]
lea ecx, [edx + ebp]
mov al, byte [edi + ecx]
xor al, byte [ebx + edx + 0x40]
inc edx
mov byte [ecx], al
cmp edx, dword [esi + 8]
jb 0x10030a30
pop edi
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop esi
pop ebp
mov dword [ebx + 0x84], 0
pop ebx
xor ecx, esp
call fcn.1004475d
add esp, 0x14
ret

Function at 0x10032250
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x20]
shr ebp, 3
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
test ebp, ebp
je 0x100322d3
mov eax, dword [esp + 0x18]
push ebx
push esi
mov esi, dword [esp + 0x24]
sub eax, esi
push edi
mov dword [esp + 0x24], eax
mov edi, dword [eax + esi]
mov ebx, dword [eax + esi + 4]
lea eax, [esp + 0x18]
push dword [esp + 0x30]
mov dword [esp + 0x1c], edi
push eax
mov dword [esp + 0x24], ebx
call dword [esp + 0x40]
mov ecx, dword [esp + 0x20]
lea esi, [esi + 8]
xor ecx, dword [esp + 0x18]
add esp, 8
mov eax, dword [esp + 0x1c]
mov edx, ebx
xor eax, dword [esp + 0x14]
mov dword [esi - 8], ecx
mov ecx, edi
mov dword [esi - 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edx
dec ebp
jne 0x10032281
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop ebp
add esp, 0x10
ret

Function at 0x100322e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x1c]
shr edi, 3
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
test edi, edi
je 0x10032345
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
sub ebx, esi
jmp 0x10032310
xor eax, dword [ebx + esi]
push dword [esp + 0x28]
xor ecx, dword [ebx + esi + 4]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], ecx
call dword [esp + 0x38]
mov eax, dword [esp + 0x18]
lea esi, [esi + 8]
mov ecx, dword [esp + 0x1c]
add esp, 8
mov dword [esi - 8], eax
mov dword [esi - 4], ecx
dec edi
jne 0x10032310
pop esi
pop ebx
mov dword [ebp], eax
xor eax, eax
pop edi
mov dword [ebp + 4], ecx
pop ebp
add esp, 8
ret
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x71893c26
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x29080bfb
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4192dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
jne 0x4192f3
xor bl, bl
jmp 0x419447
and dword [ebp - 0xc], 0
lea eax, [ebp - 4]
mov esi, dword [sym.imp.system.dll_public:_static_class_Ref_class_String____cdecl_String::create_void_]
lea edi, [ebp - 0x18]
push eax
mov dword [ebp - 0x16], 0x87f772d5
mov word [ebp - 0x18], 0x54bd
mov word [ebp - 0x12], 0xe01e
call esi
mov bl, 0x64
mov bh, 0xd9
pop ecx
mov byte [ebp - 8], bl
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x10]
push dword [ebp - 8]
push edx
mov eax, dword [ecx]
call dword [eax + 0x2c]
push eax
lea ecx, [ebp - 4]
call fcn.00413128
lea ecx, [ebp - 0x10]
call fcn.00401cfa
add bh, bl
inc edi
mov bl, byte [edi]
xor bl, bh
mov byte [ebp - 8], bl
jne 0x419321
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
call fcn.00413128
lea ecx, [ebp - 4]
call fcn.00401cfa
and dword [ebp - 0x10], 0
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x1f], 0xf86e041
lea edi, [ebp - 0x20]
mov word [ebp - 0x1a], 0xac50
mov byte [ebp - 0x20], 0xa5
mov byte [ebp - 0x1b], 0xa0
call esi
mov bl, 0x65
mov bh, 0xc0
pop ecx
mov byte [ebp - 8], bl
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x14]
push dword [ebp - 8]
push edx
mov eax, dword [ecx]
call dword [eax + 0x2c]
push eax
lea ecx, [ebp - 4]
call fcn.00413128
lea ecx, [ebp - 0x14]
call fcn.00401cfa
add bh, bl
inc edi
mov bl, byte [edi]
xor bl, bh
mov byte [ebp - 8], bl
jne 0x41938b
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
call fcn.00413128
lea ecx, [ebp - 4]
call fcn.00401cfa
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp + 8]
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x4193ea
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
add ecx, 4
add ecx, esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x10]
push ecx
mov eax, esp
mov dword [eax], edi
test edi, edi
je 0x419406
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
add ecx, 4
add ecx, edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, ebx
call dword [eax + 4]
lea ecx, [ebp - 0x14]
cmp dword [eax], 0
setne bl
call fcn.00401cfa
test edi, edi
je 0x419433
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
add ecx, 4
add ecx, edi
mov eax, dword [ecx]
call dword [eax + 8]
test esi, esi
je 0x419447
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 4]
add ecx, 4
add ecx, esi
mov edx, dword [ecx]
call dword [edx + 8]
lea ecx, [ebp + 8]
call fcn.00401cfa
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x41f6f5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 0x23], 0x67cc53bd
xor edi, edi
mov dword [ebp - 0x1f], 0xb42a8fe6
push eax
mov dword [ebp - 0x14], edi
lea esi, [ebp - 0x24]
mov byte [ebp - 0x24], 0x1c
call dword [sym.imp.system.dll_public:_static_class_Ref_class_String____cdecl_String::create_void_]
mov bl, 0x6c
mov bh, 0x70
pop ecx
mov byte [ebp - 0x10], bl
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x18]
push dword [ebp - 0x10]
push edx
mov eax, dword [ecx]
call dword [eax + 0x2c]
push eax
lea ecx, [ebp - 4]
call fcn.00413128
lea ecx, [ebp - 0x18]
call fcn.00401cfa
add bh, bl
inc esi
mov bl, byte [esi]
xor bl, bh
mov byte [ebp - 0x10], bl
jne 0x41f72a
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
call fcn.00413128
lea ecx, [ebp - 4]
call fcn.00401cfa
lea edx, [ebp - 8]
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 6], 0x55a30c9e
mov word [ebp - 8], 0xfd59
mov word [ebp - 2], 0xecc
call fcn.0041dc46
push eax
lea ecx, [ebp - 0x10]
call fcn.00413128
lea ecx, [ebp - 0x18]
call fcn.00401cfa
lea edx, [ebp - 0x24]
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x18]
mov word [ebp - 0x20], 0xe8f
mov word [ebp - 0x1d], 0x9c52
mov dword [ebp - 0x24], 0xf44ba534
mov byte [ebp - 0x1e], 0xb7
call fcn.004207b8
push eax
lea ecx, [ebp - 4]
call fcn.00413128
lea ecx, [ebp - 0x18]
call fcn.00401cfa
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
push ecx
mov eax, esp
mov dword [eax], edi
test edi, edi
je 0x41f7f1
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
add ecx, 4
add ecx, edi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x14]
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x41f80d
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
add ecx, 4
add ecx, esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, ebx
call dword [eax + 4]
cmp dword [ebp - 0xc], 0
jne 0x41f85f
mov ebx, dword [ebp + 8]
push ecx
mov eax, esp
push ecx
mov ecx, esp
and dword [eax], 0
mov eax, dword [ebp - 4]
mov dword [ecx], eax
test eax, eax
je 0x41f843
mov ecx, dword [eax + 4]
add eax, 4
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
lea ecx, [ebp - 0x18]
push ecx
mov ecx, ebx
call dword [eax + 4]
push eax
lea ecx, [ebp - 4]
call fcn.00413128
lea ecx, [ebp - 0x18]
call fcn.00401cfa
push ecx
lea eax, [ebp - 0xc]
mov ecx, esp
push eax
call fcn.00401d12
call fcn.0041f63b
pop ecx
lea ecx, [ebp - 0xc]
mov bl, al
call fcn.00401cfa
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x41f890
mov edx, dword [ecx + 4]
add ecx, 4
add ecx, dword [edx + 4]
mov eax, dword [ecx]
call dword [eax + 8]
test edi, edi
je 0x41f8a4
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
add ecx, 4
add ecx, edi
mov eax, dword [ecx]
call dword [eax + 8]
test esi, esi
je 0x41f8b8
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
add ecx, 4
add ecx, esi
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [ebp + 8]
call fcn.00401cfa
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x426123
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x4261ab
xor ecx, ecx
mov dword [eax + 8], 0xf3bcc908
mov dword [eax + 0x48], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0xc], 0x6a09e667
mov dword [eax + 0x10], 0x84caa73b
mov dword [eax + 0x14], 0xbb67ae85
mov dword [eax + 0x18], 0xfe94f82b
mov dword [eax + 0x1c], 0x3c6ef372
mov dword [eax + 0x20], 0x5f1d36f1
mov dword [eax + 0x24], 0xa54ff53a
mov dword [eax + 0x28], 0xade682d1
mov dword [eax + 0x2c], 0x510e527f
mov dword [eax + 0x30], 0x2b3e6c1f
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x38], 0xfb41bd6b
mov dword [eax + 0x3c], 0x1f83d9ab
mov dword [eax + 0x40], 0x137e2179
mov dword [eax + 0x44], 0x5be0cd19
xor eax, eax
pop ebp
ret
push 0xb1
mov ecx, str.md___NULL
call fcn.0042be94
int3
Function at 0x427dce
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x427e1e
xor ecx, ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret
push 0xd0
mov ecx, str.md___NULL
call fcn.0042be94
int3
Function at 0x42848e
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x4284c9
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
pop ebp
ret
push 0xa7
mov ecx, str.md___NULL
call fcn.0042be94
int3

Function at 0x428d83
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x428db7
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
pop ebp
ret
push 0xeb
mov ecx, str.md___NULL
call fcn.0042be94
int3
Function at 0x4324fd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.lib.stdc.dll_fopen]
mov ebx, edx
push 0x454bd4
push str._dev_urandom
mov dword [ebp - 4], ecx
call edi
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x432537
push 0x454bd4
push str._dev_random
call edi
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x432567
xor edi, edi
push edi
push 3
push edi
push esi
call dword [sym.imp.lib.stdc.dll_setvbuf]
add esp, 0x10
test eax, eax
jne 0x43255d
push esi
push ebx
push 1
push dword [ebp - 4]
call dword [sym.imp.lib.stdc.dll_fread]
add esp, 0x10
mov edi, eax
push esi
call dword [sym.imp.lib.stdc.dll_fclose]
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43256c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [sym.imp.lib.stdc.dll_clockTicks]
push edi
mov edi, edx
mov dword [ebp - 0x10], ecx
call esi
cmp eax, 0x64
jl 0x432624
call esi
cmp eax, 0x2710
jg 0x432624
and dword [ebp - 8], 0
mov eax, edi
and dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
test edi, edi
je 0x432626
mov esi, dword [sym.imp.lib.stdc.dll_clock]
push ebx
dec edi
xor ebx, ebx
push 8
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 4]
pop eax
mov dword [ebp - 0xc], ebx
dec eax
mov dword [ebp - 0x18], eax
call esi
mov dword [ebp - 0x14], eax
call esi
mov ebx, dword [ebp - 0x14]
cmp ebx, eax
jne 0x4325dc
xor edi, 1
call esi
cmp ebx, eax
je 0x4325d0
mov dword [ebp - 4], edi
call esi
mov ebx, eax
call esi
cmp ebx, eax
jne 0x4325f8
mov edi, dword [ebp - 8]
xor edi, 1
call esi
cmp ebx, eax
je 0x4325e9
mov dword [ebp - 8], edi
mov edi, dword [ebp - 4]
cmp edi, dword [ebp - 8]
je 0x4325c2
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
add ebx, ebx
or ebx, edi
mov dword [ebp - 0xc], ebx
test eax, eax
jne 0x4325be
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x1c]
mov byte [eax], bl
inc eax
mov dword [ebp - 0x10], eax
test edi, edi
jne 0x4325af
mov eax, dword [ebp - 0x20]
pop ebx
jmp 0x432626
xor eax, eax
pop edi
pop esi
leave
ret