joyce8/EMBER2024-capa huggingface dataset:
Function at 0x124baa0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x1203c20]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.01260b10
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0x124bb6f
mov eax, 0x11feae0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x124bae5
sub eax, edx
sar eax, 1
je 0x124bb6f
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [fcn.011f9234]
push 0x11feae0
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.0125e73a
push 0x11feb14
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.0125ec8b
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x124bb6f
push eax
push 1
push 0x200
push esi
call fcn.0125ef7e
mov eax, dword [esp + 0x14]
push eax
call fcn.0125f012
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0125e72b
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0125e72b
add esp, 0x214
ret

Function at 0x124bb90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x1203c20]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.01260b10
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0x124bc95
mov eax, 0x11feafc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x124bbd5
sub eax, edx
sar eax, 1
je 0x124bc95
cmp dword [0x1204fbc], 3
jne 0x124bc1c
push 0x104
lea edx, [esp + 0x10]
push edx
call dword [fcn.011f9214]
push 0x11feb1c
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.0125e73a
add esp, 0xc
jmp 0x124bc2c
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [fcn.011f9234]
push 0x11feafc
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.0125e73a
push 0x11feb20
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0125ec8b
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x124bc95
push eax
push 1
push 0x200
push esi
call fcn.0125ef7e
mov edx, dword [esp + 0x14]
push edx
call fcn.0125f012
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0125e72b
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0125e72b
add esp, 0x214
ret
Function at 0x124c390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
or eax, 0xffffffff
push ebx
mov ebx, 1
push ebp
push esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x74], eax
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
call fcn.0125e838
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0x11fef60]
fadd qword [0x11fef78]
call fcn.01262830
mov ebp, eax
xor esi, esi
xor edi, edi
test ebp, ebp
jle 0x124c4b0
call fcn.0125e838
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0x11fef60]
fmul qword [0x11fef70]
fadd qword [0x11fef68]
call fcn.01262830
mov ecx, eax
mov eax, dword [esp + ecx*4 + 0x18]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jle 0x124c498
lea esp, [esp]
add ecx, ebx
cmp ecx, 0x1a
jne 0x124c489
xor ecx, ecx
mov eax, dword [esp + ecx*4 + 0x18]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jg 0x124c480
add esi, dword [esp + ecx*4 + 0x18]
mov eax, dword [esp + 0x84]
add ecx, 0x61
mov word [eax + edi*2], cx
add edi, ebx
cmp edi, ebp
jl 0x124c447
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret

Function at 0x124c550
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x1203c20]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push 0x206
xor esi, esi
lea ecx, [esp + 0x12]
xor eax, eax
push esi
push ecx
mov word [esp + 0x18], ax
call fcn.01260b10
add esp, 0xc
cmp edi, esi
je 0x124c638
mov eax, 0x11febb4
mov dword [esp + 4], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x124c595
sub eax, edx
sar eax, 1
je 0x124c5bf
push 0x11febb8
lea edx, [esp + 8]
push 0x11febb4
push edx
call fcn.0125ec8b
add esp, 0xc
jmp 0x124c5fa
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [fcn.011f9234]
push 0x11febc0
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.0125e73a
push 0x11febdc
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0125ec8b
add esp, 0x18
mov eax, dword [esp + 4]
cmp eax, esi
je 0x124c61d
push eax
push 1
push 0x200
push edi
call fcn.0125f251
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0125f012
add esp, 0x14
mov eax, 1
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0125e72b
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0125e72b
add esp, 0x214
ret
Function at 0x124c650
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push 0x11febe4
push eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0
call fcn.0125ec8b
add esp, 0xc
test eax, eax
je 0x124c674
xor eax, eax
pop ecx
ret
mov edx, dword [esp]
push ebx
push ebp
push esi
push edi
push 2
push 0
push edx
call fcn.0125f35d
mov eax, dword [esp + 0x1c]
push eax
call fcn.0125f57f
mov ecx, dword [esp + 0x20]
push 0
push 0
push ecx
mov esi, eax
call fcn.0125f35d
lea ebp, [esi + 0x32]
push ebp
call fcn.0125f63c
mov edx, dword [esp + 0x30]
push edx
push 1
mov edi, eax
push esi
push edi
call fcn.0125ef7e
mov eax, dword [esp + 0x40]
push eax
call fcn.0125f012
lea ebx, [edi + esi]
mov eax, 0x32
call fcn.0124c720
mov ecx, dword [esp + 0x4c]
push 0x11febec
push ecx
lea edx, [esp + 0x4c]
push edx
call fcn.0125ec8b
add esp, 0x40
test eax, eax
je 0x124c6f2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x10]
push eax
push 1
push ebp
push edi
call fcn.0125f251
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0125f012
add esp, 0x14
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x124e340
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x100c
call fcn.01262fc0
mov eax, dword [0x1203c20]
xor eax, esp
mov dword [esp + 0x1008], eax
mov edx, dword [edi]
mov eax, dword [esp + 0x1010]
push ebx
push ebp
mov ebp, dword [0x11f93f4]
xor ebx, ebx
push ebx
push 4
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x1c], eax
call ebp
cmp eax, 4
je 0x124e398
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.0125e72b
add esp, 0x100c
ret
cmp dword [esp + 8], ebx
jbe 0x124e3d7
push esi
nop
mov ecx, dword [edi]
push 0
push 0x1000
lea eax, [esp + 0x1c]
push eax
push ecx
call ebp
mov esi, eax
test esi, esi
je 0x124e3d6
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push eax
push esi
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.0125f251
add ebx, esi
add esp, 0x10
cmp ebx, dword [esp + 0xc]
jb 0x124e3a0
pop esi
mov edx, dword [esp + 0xc]
mov eax, dword [edx]
push eax
call fcn.0125f012
mov ecx, dword [esp + 0x1014]
add esp, 4
cmp ebx, dword [esp + 8]
pop ebp
sbb eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.0125e72b
add esp, 0x100c
ret
Function at 0x1250000
Capabilities:
Hash data using sha1
Read file on windows

Disassembly:
mov eax, 0x1068
call fcn.01262fc0
mov eax, dword [0x1203c20]
xor eax, esp
mov dword [esp + 0x1064], eax
mov eax, dword [esp + 0x106c]
push ebx
push ebp
push 0x11fe980
push eax
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x14], ebx
xor ebp, ebp
call fcn.0125ec8b
mov eax, dword [esp + 0x14]
add esp, 0xc
cmp eax, ebx
jne 0x125006b
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
pop ebp
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
pop ebx
mov ecx, dword [esp + 0x1064]
xor ecx, esp
call fcn.0125e72b
add esp, 0x1068
ret
push esi
push 2
push ebx
push eax
call fcn.0125f35d
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0125f57f
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push edx
mov dword [esp + 0x2c], eax
call fcn.0125f35d
mov eax, dword [esp + 0x28]
push eax
push 0x1000
lea ecx, [esp + 0x94]
push 1
push ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], 0x67452301
mov dword [esp + 0x4c], 0xefcdab89
mov dword [esp + 0x50], 0x98badcfe
mov dword [esp + 0x54], 0x10325476
mov dword [esp + 0x58], 0xc3d2e1f0
call fcn.0125ef7e
mov esi, eax
add esp, 0x2c
cmp esi, ebx
jbe 0x1250116
lea edx, [esp + 0x70]
push esi
push edx
lea ebx, [esp + 0x1c]
call fcn.0124fe70
mov eax, dword [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x80]
push 1
push ecx
add ebp, esi
call fcn.0125ef7e
mov esi, eax
add esp, 0x18
test esi, esi
ja 0x12500e1
xor ebx, ebx
push edi
lea esi, [esp + 0x18]
call fcn.0124ff10
mov edx, dword [esp + 0x10]
push edx
call fcn.0125f012
add esp, 8
pop esi
cmp ebp, dword [esp + 0xc]
jb 0x1250044
mov ecx, dword [esp + 0x106c]
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0125e72b
add esp, 0x1068
ret

Function at 0x1251ed0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0x1251ed7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x1251fb4
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x11fdde0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x11fdde0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x11fdde0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x11fdde0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x11fdde0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x11fdde0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x11fdde0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x11fdde0]
inc ecx
sub edx, 8
sub esi, 1
jne 0x1251ef0
pop edi
test edx, edx
je 0x1251fdb
jmp 0x1251fc0
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x11fdde0]
inc ecx
sub edx, 1
jne 0x1251fc0
not eax
pop esi
ret
Function at 0x1251fe0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x11fdde0]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x11fdde0]
mov dword [edx + 8], ecx
ret

Function at 0x1252030
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x11fdde0]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x11fdde0]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret
Function at 0x1253430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x125344e
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x1253442
cmp dword [edi + 0x7c], ebx
je 0x125345d
call fcn.01253810
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.012531a0
add esp, 0xc
test eax, eax
je 0x1253484
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x7e
call fcn.0125f63c
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x12534c2
push 0x4000
call fcn.0125f63c
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0x12534cf
push esi
call fcn.0125fb97
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x1253517
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.012522f0
test eax, eax
jne 0x1253517
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x125353e
mov cl, byte [edi + 0x39]
mov byte [esi + 0x7d], cl
jmp 0x1253544
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x7d], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x6d]
mov dword [esi + 0x79], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x71], 0x23456789
mov dword [esi + 0x75], 0x34567890
cmp ebp, ebx
je 0x1253581
lea ecx, [ecx]
mov cl, byte [ebp]
cmp cl, bl
je 0x1253581
call fcn.01251fe0
add ebp, 1
jne 0x1253570
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x8de15c
Capabilities:
Encode data using xor

Disassembly:
push eax
xlatb
wait
pop eax
inc esp
push ss
mov al, byte [0xf00bc811]
add al, 0xe8
pop es
xor eax, 0xa0cc207
add dword [ebp + 0x5b], edi
add byte [eax], al
pushal
call 0x8de162
pop ebp
sub ebp, 6
sub ebp, 0x4de15c
jmp 0x8de1c0
mov ebx, dword [esi + 0x486ebe51]
fisub word [edx]
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
ja 0x8de144
jle 0x8de1ae
shl dword [edi - 0x17], 1
add al, 0
add byte [eax], al
mov ecx, 0xb80c8f9d
pop esp
loope 0x8de21a
jmp 0x8de1c9
mov eax, 0x4de15c
add eax, ebp
add eax, 0x93
mov ecx, 0x636
add byte [ebx], al
lds eax, [ecx + 0x93c0]
add byte [ecx + 0x636], bh
mov edx, 0xf515fb2f
cmc
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de1e0
jmp 0x8de1f3
inc ebp
outsd dx, dword [esi]
inc edi
das
aas
das
das
inc edi
das
jecxz 0x8de201
das
scasb al, byte es:[edi]
fcompi st(7)
pop ss
not dword [edi]
or edx, edi
scasb al, byte es:[edi]
fcompi st(7)
pop ss
or edx, edi
sbb al, 0xef
jg 0x8de1df
mov edx, 0x2f6b0e13
jg 0x8de1ba
loop 0x8de1bc
cmpsb byte [esi], byte es:[edi]
adc ebp, dword [edi]
das
das
das
scasb al, byte es:[edi]
out dx, al
xlatb
das
das
das
sub al, 0xe2
xchg edi, eax
sub dword [edi], ebp
das
das
xchg ebp, eax
pop es
das
das
das
fmul st(5)
sub al, 0xe7
movsb byte es:[edi], byte [esi]
scasb al, byte es:[edi]
and ebp, dword [edi]
das
das
sub al, 0xea
jg 0x8de284
jl 0x8de257
das
inc edi
test dword es:[ebx + 0x2f], ebp
add ecx, dword cs:[ebx]
inc edi
das
das
das
das
invalid
das
jp 0x8de1fe
ret
daa
das
das
das
movsb byte es:[edi], byte [esi]
mov edx, 0x2f2f2f23
movsb byte es:[edi], byte [esi]
mov byte [0x2f2f2f3f], al
out dx, al
invalid
das
das
das
inc edi
jl 0x8de2a2
das
inc edi
test dword es:[ebx + 0x2f], ebp
add ecx, dword cs:[ebx]
jle 0x8de25d
sub ch, byte [edi]
das
das
invalid
or ebp, dword [edi]
rcr byte [edx + 0x23], 1
rcr byte [edx + 0x27], 1
invalid
Function at 0x425343
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4253c1
pop es
aaa
push ss
jecxz 0x42542a
sbb dword [esi + 0x62], esi
ja 0x425444
retf 0x26a9
jmp 0x5d78551d
cmp eax, 0xbec44d5d
cmp ah, byte [edi]
jne 0x425481
jmp 0xdf8bc4
cwde
cmpsd dword [esi], dword es:[edi]
lcall 0xe855, 0x7a585890
xor eax, 0xc431cd1d
jae 0x425461
add eax, 0x74bbc0d7
sub eax, 0x566ba066
mov bh, 0x9d
daa
lahf
pop edx
adc ebp, dword fs:[ecx + edx*2]
std
outsb dx, byte [esi]
push cs
pop edi
cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
pushal
mov bh, 0x4f
inc ebp
sahf
sbb dh, bl
test al, 0x2a
dec eax
xchg dword [edi + 0x48], edx
or dword [eax - 0x78], esp
nop
inc esp
stc
test al, 0x66
push eax
mov dword [0xcd07fd0b], eax
inc ebp
inc eax
push esi
jge 0x425461
mov ch, 0x5a
lodsd eax, dword [esi]
in al, dx
mov bl, 0x6f
adc byte [0xd084908b], 0xea
mov edx, 0x16917bf0
int3
Function at 0x445f4a
Capabilities:
Encode data using xor

Disassembly:
fld dword [eax - 0x1b]
fld st(2)
sub eax, 0xc282e9e5
pop ds
arpl word [edi], dx
xor al, 0xd0
mov bl, 0xe5
lcall 0x50c7, 0x2611bc6e
sub dword es:[ecx], eax
mov esi, 0x5eed6641
or eax, 0xc8b6af2c
inc ecx
xor al, bl
arpl word [ebp + 0x533486fe], di
daa
mov ebx, 0xd70c80f2
mov cl, 0xf5
or byte [edi + edx*8], 0xb1
cmc
add dword [ecx + 0x68], ecx
jae 0x445ec1
dec edx
wait
add eax, 0xac906f7f
mov eax, 0x802ac640
cdq
adc dword [eax + esi - 0x52], ecx
inc esp
adc al, 0xb7
inc esp
pop ecx
adc cl, dl
pop esp
jg 0x445f31
sal byte [ebx], 1
ja 0x445ef3
dec edi
xchg edi, eax
sub eax, 0x3208b3b2
xchg esp, eax
rcl dh, cl
out 0x10, eax
les edx, [edi]
ljmp 0xd62
push ecx
bound ecx, qword [0x48289815]
jmp 0xf1f15152
fisubr dword [esi - 0x5b]
movsd dword es:[edi], dword [esi]
arpl word [0xd27c0d99], bp
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0x9ba92cb6]
dec edi
xor eax, 0x4bce1aff
lodsb al, byte [esi]
dec ecx
mov cl, 0xdb
arpl word [esi + 0x168cfafd], dx
dec esp
jnp 0x445eff
jl 0x445f4c
mov esi, 0xf4ee0fd
jecxz 0x445fba
in eax, dx
cmpsd dword [esi], dword es:[edi]
sub al, 0xd1
in eax, 0x1b
shr byte [esi - 0x3a], cl
and byte [edx + esi*4 - 0x729374ca], ch
add al, 0xb2
xlatb
adc ah, byte [ebx - 0x3ecc01de]
fistp word [edi + esi*4 - 0x1d44c6a2]
mov esi, 0x607349e1
cdq
jg 0x445f2b
pop ebx
sub al, 0xdd
salc
mov fs, ebp
sub dword [edx + 0x65], edx
sub eax, 0x5fcf427d
shr dword [ebp + edx*2 + 0x58b1e29e], cl
sti
pop ecx
push bx
xchg ebp, eax
stc
out dx, al
jns 0x445fef
sahf
sbb dh, al
outsb dx, byte [esi]
jne 0x446002
jno 0x445fd4
call 0x6fa7b7fa
arpl word [edi + 0x7c], bp
cld
jl 0x445fc9
ret
lodsb al, byte [esi]
popal
add ebx, dword [edi + 0x1a]
daa
ja 0x446022
mov dh, 0x4e
push ds
mov ebp, 0x8a54492d
cmp dword [eax], ebp
sub esi, dword [ecx + 0x3a]
mov esi, dword [eax - 0x62785dca]
and dword [eax], esi
lds eax, [esi + 0x11]
cli
mov al, pe_nt_image_headers32
inc edx
mov dword [ecx], ecx
invalid
arpl word [ebx - 0x38], sp
xor dl, bl
or byte [esi + 0x38], 0x5a
jno 0x445fcb
xchg byte [ebp + 0x1c9b4e61], dl
inc ebx
add bl, bh
mov dh, byte [ecx]
pop ds
inc ebp
and ch, 0x96
push eax
mov al, 0x93
sbb bh, byte [esi + 0x69]
jle 0x44608d
sub al, 0xd2
add dword [edx - 0x6e], ecx
mov ecx, 0x87a2da4e
mov gs, edx
cwde
ret
adc byte [eax], dh
mov ch, 0x7d
fdivrp st(4)
push 0x83cf7bcf
invalid
dec esi
and dl, byte [ebp - 0x5fbdfe26]
das
jnp 0x4460b1
sbb cl, dh
push ecx
inc eax
jb 0x44606f
hlt
in al, 0x63
xlatb
inc esi
out dx, eax
mov bh, 0x17
add dword [ecx + 0x70875124], eax
invalid
Function at 0x4a08f4
Capabilities:
Encode data using xor

Disassembly:
dec ebp
out dx, eax
inc esi
invalid
and eax, 0xefae4a5c
pop ebx
cwde
nop
adc dword [ebx + 0x66531427], 0xffffff96
cmp byte [eax - 0x3e], ch
nop
cdq
jo 0x4a0877
pop esp
mov es, word [ebx]
rol byte [ecx - 0x744d931b], 1
xchg edx, eax
test eax, 0x1e4fbe26
pop ecx
je 0x4a0877
jae 0x4a0905
push ecx
and ecx, dword [ebp + ebp*4 - 0x72]
xchg ecx, eax
adc al, 0x61
imul ecx, dword [edx - 0x41], 0xfbfaa655
dec edx
mov edi, 0xfbfaa655
dec edx
mov edi, 0xfbfaa655
loop 0x4a08c0
xor ch, byte [edi + 0x445d349e]
cwde
pop edi
cmp eax, 0x40d4d29e
cmp eax, 0x40d4d29e
push ecx
inc ebx
and esp, edx
pop ebp
inc edx
call 0xf2df9571
xor al, 0xc0
inc eax
mov eax, dword [0x45396c4]
mov esi, 0x8f641aaf
mov byte [ecx], 0x8e
push eax
cwde
invalid
Function at 0x1e010fb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [ecx + 0x9c8], 0x270
jl 0x1e01106e
xor edx, edx
push esi
mov eax, dword [ecx + edx*4 + 0xc]
xor eax, dword [ecx + edx*4 + 8]
inc edx
and eax, 0x7fffffff
xor eax, dword [ecx + edx*4 + 4]
mov esi, eax
shr eax, 1
and esi, 1
xor eax, dword [esi*4 + 0x1e265820]
xor eax, dword [ecx + edx*4 + 0x638]
cmp edx, 0xe3
mov dword [ecx + edx*4 + 4], eax
jl 0x1e010fc3
cmp edx, 0x26f
jge 0x1e011033
mov edi, edi
mov eax, dword [ecx + edx*4 + 0xc]
xor eax, dword [ecx + edx*4 + 8]
inc edx
and eax, 0x7fffffff
xor eax, dword [ecx + edx*4 + 4]
mov esi, eax
shr eax, 1
and esi, 1
xor eax, dword [esi*4 + 0x1e265820]
xor eax, dword [ecx + edx*4 - 0x388]
cmp edx, 0x26f
mov dword [ecx + edx*4 + 4], eax
jl 0x1e011000
mov eax, dword [ecx + 0x9c4]
xor eax, dword [ecx + 8]
pop esi
and eax, 0x7fffffff
xor eax, dword [ecx + 0x9c4]
mov edx, eax
and edx, 1
mov edx, dword [edx*4 + 0x1e265820]
xor edx, dword [ecx + 0x638]
shr eax, 1
xor edx, eax
mov dword [ecx + 0x9c4], edx
mov dword [ecx + 0x9c8], 0
mov eax, dword [ecx + 0x9c8]
mov edx, dword [ecx + eax*4 + 8]
inc eax
mov dword [ecx + 0x9c8], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov ecx, edx
and ecx, 0xff3a58ad
shl ecx, 7
xor edx, ecx
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret

Function at 0x1e011140
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea ecx, [esi + 8]
mov dword [ecx], eax
mov eax, 1
push edi
jmp 0x1e011150
mov edx, dword [ecx]
mov edi, edx
shr edi, 0x1e
xor edi, edx
imul edi, edi, 0x6c078965
add edi, eax
mov dword [ecx + 4], edi
inc eax
add ecx, 4
cmp eax, 0x270
jl 0x1e011150
mov dword [esi + 0x9c8], eax
pop edi
ret

Function at 0x1e0457f0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [0x1e259830]
push eax
call fcn.1e0c5980
add esp, 4
test eax, eax
jne 0x1e045809
call fcn.1e11d280
jmp 0x1e045816
mov dword [eax + 4], 0x1e259820
mov dword [eax], 1
test eax, eax
jne 0x1e04581b
ret
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 0x10], 0x67452301
mov dword [eax + 0x14], 0xefcdab89
mov dword [eax + 0x18], 0x98badcfe
mov dword [eax + 0x1c], 0x10325476
ret

Function at 0x1e048e10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], eax
push edi
mov edi, ecx
mov ecx, dword [ebp - 8]
xor eax, eax
cmp edx, ecx
jne 0x1e048e2d
mov eax, dword [ebp + 8]
xor cl, cl
jmp 0x1e048e30
mov cl, byte [ebp - 1]
mov esi, dword [ebp - 8]
cmp edx, esi
je 0x1e048e3b
mov eax, edi
mov cl, 1
mov edx, dword [ebp - 8]
xor esi, esi
test edx, edx
jle 0x1e048e58
push ebx
mov dl, byte [edi]
mov bl, byte [eax]
xor dl, bl
or cl, dl
mov edx, dword [ebp - 8]
inc esi
inc edi
inc eax
cmp esi, edx
jl 0x1e048e45
pop ebx
xor eax, eax
test cl, cl
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret