joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fcb0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x42fdaa
cmp dword [esp + 0x14], 0
mov esi, dword [esp + 0x18]
jne 0x42fcd1
test esi, esi
jne 0x42fdaa
cmp edx, 3
je 0x42fd07
cmp edx, 4
je 0x42fd07
cmp edx, 5
je 0x42fd07
cmp edx, 6
je 0x42fd07
cmp edx, 7
je 0x42fd07
cmp edx, 8
je 0x42fd07
cmp edx, 0xa
je 0x42fd07
cmp edx, 0xb
je 0x42fd07
cmp edx, 0xc
je 0x42fd07
cmp edx, 0xd
jne 0x42fdaa
xor ebx, ebx
mov byte [edi + 0x114], dl
push ecx
mov byte [edi + 0x115], bl
call fcn.0042fc93
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x42fdaf
cmp byte [edi + 0x114], 6
lea ecx, [edi + 0x70]
jne 0x42fdaa
cmp esi, 0x40
ja 0x42fd4d
cmp dword [esp + 0x14], ebx
je 0x42fd76
push esi
push dword [esp + 0x18]
push ecx
call fcn.00437460
add esp, 0xc
jmp 0x42fd73
mov edx, dword [esp + 0x14]
mov ecx, edi
push esi
call fcn.00434b92
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x42fda6
lea edx, [edi + 0x70]
mov ecx, edi
call fcn.00434c6d
mov ebp, eax
test ebp, ebp
jne 0x42fda6
push 0x20
pop esi
lea ecx, [edi + 0x70]
cmp esi, 0x40
jae 0x42fd8e
push 0x40
pop eax
sub eax, esi
push eax
lea eax, [ecx + esi]
push ebx
push eax
call fcn.004379e0
add esp, 0xc
mov al, byte [ebx + edi + 0x70]
xor al, 0x5c
mov byte [edi + ebx + 0xb0], al
xor byte [ebx + edi + 0x70], 0x36
inc ebx
cmp ebx, 0x40
jb 0x42fd8e
mov eax, ebp
jmp 0x42fdaf
mov eax, 0xffffff53
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x433c2e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd4
push ebx
push ebp
push esi
xor ebx, ebx
xor esi, esi
push edi
inc ebx
inc esi
cmp dword [esp + 0xe8], 0
mov edi, ecx
push 0
cmovne ebx, dword [esp + 0xec]
mov ebp, edx
pop ecx
test bl, 0x1f
mov eax, ebx
push 0x37
push dword [esp + 0xf0]
setne cl
shr eax, 5
add eax, ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x44]
push eax
call fcn.00437460
and dword [esp + 0x20], 0
add esp, 0xc
cmp dword [esp + 0x10], 0
jbe 0x433d6c
lea ecx, [esp + 0x74]
call fcn.00434cac
mov esi, eax
test esi, esi
jne 0x433d6c
push 0x37
lea edx, [esp + 0x40]
lea ecx, [esp + 0x78]
call fcn.00434b92
mov esi, eax
pop ecx
test esi, esi
jne 0x433d6c
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x74]
call fcn.00434c6d
mov esi, eax
test esi, esi
jne 0x433d6c
push 4
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00437460
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp dword [edi], 1
jbe 0x433d17
cmp eax, dword [edi + 4]
jne 0x433d17
cmp byte [edi + 0x76], 1
je 0x433d8a
mov edx, dword [esp + 0x10]
mov byte [edi + 0x76], 1
lea eax, [edx - 1]
cmp dword [esp + 0x14], eax
lea ecx, [edx + 1]
cmovne ecx, edx
mov dword [esp + 0x10], ecx
jmp 0x433d1e
mov byte [edi + 0x76], 0
mov dword [edi + 4], eax
test ebp, ebp
je 0x433d59
test ebx, ebx
je 0x433d59
lea eax, [esp + 0x1c]
cmp ebx, 0x20
jb 0x433d4c
push 0x20
push eax
push ebp
call fcn.00437460
add esp, 0xc
lea ecx, [esp + 0x3c]
sub ebx, 0x20
add ebp, 0x20
call fcn.00433c1f
jmp 0x433d59
push ebx
push eax
push ebp
call fcn.00437460
add esp, 0xc
xor ebx, ebx
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x10]
jl 0x433c8c
push 0x37
pop edx
lea ecx, [esp + 0x3c]
call fcn.0041e1e0
xor eax, eax
test esi, esi
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret
push 3
pop eax
jmp 0x433d7f

Function at 0x434486
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x434432
mov eax, 0xffffff53
pop esi
ret
push edi
push 0x20
xor edi, edi
push edi
push esi
call fcn.004379e0
add esp, 0xc
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
xor eax, eax
mov dword [esi + 0x68], edi
mov dword [esi], 0x6a09e667
pop edi
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
ret
test ecx, ecx
jne 0x434490
mov eax, 0xffffff53
ret
mov dword [ecx + 0x6c], edx
jmp 0x434424
Function at 0x434bb1
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
jne 0x434bbf
mov eax, 0xffffff53
pop ebx
ret
mov eax, dword [ebx + 0x60]
push ebp
push esi
push edi
push 0x40
pop edi
lea ebp, [ebx + 0x20]
mov byte [eax + ebp], 0x80
inc dword [ebx + 0x60]
mov ecx, dword [ebx + 0x60]
push 0x38
pop esi
cmp ecx, esi
jbe 0x434c0c
mov eax, edi
sub eax, ecx
push eax
lea eax, [ecx + ebp]
push 0
push eax
call fcn.004379e0
push edi
mov edx, ebp
mov dword [ebx + 0x60], edi
mov ecx, ebp
call fcn.004343fa
add esp, 0x10
mov edx, ebp
mov ecx, ebx
call fcn.00434498
test eax, eax
jne 0x434c68
and dword [ebx + 0x60], eax
mov eax, dword [ebx + 0x60]
sub esi, eax
push esi
add eax, ebp
push 0
push eax
call fcn.004379e0
lea edi, [ebx + 0x64]
mov edx, ebp
mov ecx, dword [edi]
lea esi, [ebx + 0x68]
mov eax, dword [esi]
shr ecx, 0x1d
push 0x40
lea eax, [ecx + eax*8]
mov ecx, ebp
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 3
mov dword [edi], eax
call fcn.004343fa
push 4
lea eax, [ebp + 0x38]
push esi
push eax
call fcn.00437460
push 4
lea eax, [ebp + 0x3c]
push edi
push eax
call fcn.00437460
add esp, 0x28
mov edx, ebp
mov ecx, ebx
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.00434498
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x434c6d
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x434ca4
test edi, edi
je 0x434ca4
call fcn.00434bb1
test eax, eax
jne 0x434ca9
push 0x20
mov edx, esi
mov ecx, esi
call fcn.004343fa
push 0x20
push esi
push edi
call fcn.00437460
add esp, 0x10
mov ecx, esi
pop edi
pop esi
jmp 0x434424
mov eax, 0xffffff53
pop edi
pop esi
ret

Function at 0x434d5c
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov eax, edx
mov ebp, ecx
neg eax
mov dword [esp + 8], eax
test ebp, ebp
je 0x434df6
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x434df6
mov edx, dword [ebp]
mov ecx, ebx
inc edx
call fcn.0043043f
mov dword [esp + 0xc], eax
test eax, eax
jne 0x434dfb
xor edx, edx
push esi
push edi
cmp dword [ebp], edx
jle 0x434dbc
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00434d46
mov ecx, ebx
mov esi, eax
call fcn.00434d46
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebp]
jl 0x434d96
jmp 0x434de1
mov ecx, dword [esp + 0x10]
jmp 0x434de1
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00434d46
mov ecx, ebx
mov esi, eax
call fcn.00434d46
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebx]
jl 0x434dc2
mov eax, dword [ebp]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
jmp 0x434dfb
mov eax, 0xffffff53
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x44cbb6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044ca35
Function at 0x4ae80e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5bdd90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004a7ba2
mov dword [ebp - 0x14], eax
cmp dword [0x5bfcb8], edi
jne 0x4ae8ff
push 0x800
push edi
push 0x402d08
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4ae88c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x57
jne 0x4ae9df
push 0x402d08
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4ae9df
push 0x402d20
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x4ae9df
push eax
call ebx
push 0x402d2c
push esi
mov dword [0x5bfcb8], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
push 0x402d3c
push esi
mov dword [0x5bfcbc], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
push 0x402d50
push esi
mov dword [0x5bfcc0], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
mov dword [0x5bfcc8], eax
test eax, eax
je 0x4ae8fc
push 0x402d6c
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
mov dword [0x5bfcc4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
test eax, eax
je 0x4ae924
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4ae917
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4ae939
push 4
pop eax
jmp 0x4ae9e1
cmp dword [ebp - 0x14], edi
je 0x4ae939
push dword [0x5bfcb8]
call dword [sym.imp.KERNEL32.DLL_DecodePointer]
push 3
jmp 0x4ae91e
mov eax, dword [0x5bfcc4]
mov ebx, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, esi
je 0x4ae997
cmp dword [0x5bfcc8], esi
je 0x4ae997
push eax
call ebx
push dword [0x5bfcc8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4ae997
test eax, eax
je 0x4ae997
call ecx
test eax, eax
je 0x4ae98c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4ae98c
test byte [ebp - 8], 1
jne 0x4ae997
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4ae9c7
mov eax, dword [0x5bfcbc]
cmp eax, esi
je 0x4ae9c4
push eax
call ebx
test eax, eax
je 0x4ae9c4
call eax
mov edi, eax
test edi, edi
je 0x4ae9c4
mov eax, dword [0x5bfcc0]
cmp eax, esi
je 0x4ae9c4
push eax
call ebx
test eax, eax
je 0x4ae9c4
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x5bfcb8]
call ebx
test eax, eax
je 0x4ae9df
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4ae9e1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a3b5a
leave
ret
Function at 0x410df3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419510]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040ae96
and dword [ebp - 0x14], 0
cmp dword [0x4306d0], 0
mov dword [ebp - 0x18], eax
jne 0x410ea6
push 0x4038cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x410f4e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4038c0
push ebx
call edi
test eax, eax
je 0x410f4e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4038b0
push ebx
mov dword [0x4306d0], eax
call edi
push eax
call esi
push 0x40389c
push ebx
mov dword [0x4306d4], eax
call edi
push eax
call esi
push 0x403880
push ebx
mov dword [0x4306d8], eax
call edi
push eax
call esi
mov dword [0x4306e0], eax
test eax, eax
je 0x410ea6
push 0x403868
push ebx
call edi
push eax
call esi
mov dword [0x4306dc], eax
mov eax, dword [0x4306dc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x410eff
cmp dword [0x4306e0], ecx
je 0x410eff
push eax
call esi
push dword [0x4306e0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x410eff
test ebx, ebx
je 0x410eff
call edi
test eax, eax
je 0x410ef6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x410ef6
test byte [ebp - 8], 1
jne 0x410eff
or dword [ebp + 0x10], 0x200000
jmp 0x410f32
mov eax, dword [0x4306d4]
cmp eax, dword [ebp - 0x18]
je 0x410f32
push eax
call esi
test eax, eax
je 0x410f32
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x410f32
mov eax, dword [0x4306d8]
cmp eax, dword [ebp - 0x18]
je 0x410f32
push eax
call esi
test eax, eax
je 0x410f32
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4306d0]
call esi
test eax, eax
je 0x410f4e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x410f50
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408ad1
leave
ret
Function at 0x413570
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x100c
call fcn.00411960
cmp dword [0x7b446c], 0x37
jne 0x41360a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea eax, [esp + 0x810]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov ecx, dword [0x7b5460]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x4354bc]
mov byte [ecx + esi], al
add esp, 0x100c
ret
Function at 0x413890
Capabilities:
Accept command line arguments
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7b446c]
sub esp, 0x974
push ebx
push ebp
push esi
mov esi, dword [0x4354bc]
push edi
shr eax, 3
xor edi, edi
cmp eax, edi
jbe 0x413a8f
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
jmp 0x4138c6
mov esi, dword [esp + 0x20]
xor edi, edi
cmp dword [0x7b446c], 0x1c
jne 0x4138dd
lea eax, [esp + 0x38]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [0x42c338]
mov ebx, dword [0x42c340]
mov ebp, dword [0x42c344]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x42c33c]
mov dword [esp + 0x18], eax
mov esi, 0xc6ef3720
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 0x20
jmp 0x413926
mov eax, dword [esp + 0x18]
xor edi, edi
mov edx, eax
shr edx, 5
add edx, ebp
mov ecx, eax
shl ecx, 4
mov dword [esp + 0x1c], edx
add ecx, ebx
lea edx, [esi + eax]
xor ecx, edx
mov dword [esp + 0x10], ecx
mov dword [0x7b43dc], edi
mov eax, dword [esp + 0x1c]
add dword [0x7b43dc], eax
mov eax, dword [0x7b43dc]
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x34]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
sub dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
shl edx, 4
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x30]
add dword [esp + 0x10], eax
cmp dword [0x7b446c], 0x1be
mov eax, dword [esp + 0x14]
lea edi, [esi + eax]
jne 0x4139bd
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x2c]
cmp dword [0x7b446c], 0x979
mov dword [0x7b43e0], 0xff6b3619
mov dword [0x7b43e4], 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x413a07
push 0
lea ecx, [esp + 0x184]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
lea edx, [esp + 0x40]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor dword [esp + 0x10], edi
mov eax, dword [esp + 0x1c]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x18], eax
mov eax, dword [0x7b446c]
cmp eax, 0x93
je 0x413a2d
add esi, 0x61c88647
dec dword [esp + 0x28]
jne 0x413920
cmp eax, 0x8d4
jne 0x413a44
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
cmp dword [0x7b446c], 0x17
jne 0x413a7e
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea edx, [esp + 0x40]
push edx
push 0x404070
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x20], esi
jne 0x4138c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x974
ret
Function at 0x40ed6b
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x40eae0
pop ebx
or edx, edx
sub edx, eax
call fcn.0040ed9a
xor dword [ecx], ebx
mov eax, edx
inc ecx
add edx, 0x3b975e60
push edx
pop edx
cmp ecx, esi
jne fcn.0040ed6b
inc eax
ret

Function at 0x4a7250
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ecx, dword [eax + 0x3c]
add ecx, eax
push esi
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
xor edx, edx
add eax, ecx
push edi
or ebx, ebx
je 0x4a728c
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4a7284
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4a728e
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4a7274
sub eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a7360
Capabilities:
Parse pe header

Disassembly:
push ebp
push esp
pop ebp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4a7374
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
sub eax, eax
cmp dword [ecx], 0x4550
jne 0x4a738f
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x429540
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
je 0x4295c1
jne 0x4295c1
push dword [0x46c018]
mov dword [esi], 0xde3614
mov eax, dword [0x11541eb8]
mov ecx, dword [0xd026d0]
mov esi, dword [ecx + 0xc4]
mov dword [0x69977568], esi
dec dword [ecx - 0x23]
stc
mov ebx, ebx
iretd
pop ebp
ret
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
je 0x42969b
jne 0x42969b
add dword [ebx + 0x31], edx
push 0x100e6904
cmp byte [ebp - 0x11], bl
jmp dword [0x104b55fc]
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
jmp 0x429655
mov dword [eax + 0x24], 0x5be0cd19
jmp 0x429581
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
je 0x429618
jne 0x429618
push 0x92
mov dword [ebp - 0xf0], ecx
mov dword [0xe6bf88], 0
mov dword [esi], 0x9d24f4
mov eax, dword [0xde83b4]
mov dword [0x109d59c], ebx
mov dword [0x11540d10], eax
add dword [ebx + 0x11540d10], esp
mov bh, 0xc1
push es
jl 0x4296e1
in eax, dx
or eax, 0xe955c105
push ebp
jmp 0x429a9a
mov edi, 0x69a30440
cmp dword [0xddbe24], eax
push 0x4481c4
mov dword [esi + 0xc], 0x1117f770
mov eax, 0xa9e40c
push 0x1007e8d0
push 0xaaa530
mov ecx, 0xb0577c
mov eax, 0x101b0bd4
mov dword [ecx + 8], 0
lds edi, [edi + 0x3e9ca9e]
add byte [eax], al
add byte [ebx - 0x17cf383], cl
inc eax
jb 0x429a52
mov ebx, esi
shr ebx, 6
push edi
push ecx
call fcn.00418db0
mov ecx, dword [ebp + 8]
add esp, 8
sub esi, 0x40
push 0x429a48
ret
add esp, 0xc
pop edi
pop ebx
test esi, esi
je 0x429900
mov eax, dword [ebp + 0x10]
add eax, 0x28
add eax, dword [ebp + 8]
push esi
push edi
push eax
call fcn.00468720
jmp 0x4298fd

Function at 0x447630
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
je 0x4476e1
jne 0x4476e1
push 0x697bf7b4
call dword [0xa7e864]
sub ecx, dword [0x46cf60]
mov dword [0x1153f224], eax
push 0x59e9c0
or edx, dword [ebp - 0x5f5f370a]
mov dword [eax + 0x14], 0x10325476
pop ebp
je 0x4476b3
jne 0x4476b3
push 0x114685b0
mov eax, 0x1054327c
mov dword [esi], 0x697acee4
cmp dword [edx], 0x7a8320
add byte [eax + 0x72], al
push 0x452918
mov eax, 0xfa9670
cmp dword [0xe2b900], 0xffffffff
mov dword [esi + 0x492], 0xffffffff
xchg edi, eax
sbb ch, byte [eax - 0x18]
pop ebx
cwde
rol ebx, 1
mov eax, 0x53fdbc
push 0x9f7264
push 0x1148f984
lea ecx, [eax + 0x1f4]
push 0x114c9a54
mov dword [0x433880], ebx
mov dword [ebp - 8], 0xaa07a8
rcr byte [ecx + 0x52], cl
out dx, al
out dx, al
push ds
ret
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
je 0x447663
jne 0x447663
mov eax, dword [ebp + 0x524]
push 0x93e
push 0x7d
add eax, 0x3e680000
or dword [eax], eax
add byte [edx + 0x7d], ch
push dword [eax*4 + 0x43309c]
mov bl, byte [edi + 0x454120]
add byte [eax - 0x67ffbed5], dh
push 0x1153be40
push 0x4f5dc0
add dh, byte [ebp + 0x7c]
jae 0x447712
xchg esp, eax
mov al, byte [0xcccce4c6]
int3
Function at 0x408936
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
call main
add edx, 0x1eb6ee2a
add edx, 0x851809f5
xor dword [esi], edi
inc esi
sub ecx, edx
dec ecx
cmp esi, eax
jne fcn.00408936
ret
Function at 0x401160
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
xor esi, esi
nop word [eax + eax]
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x22
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x16
push 0
push 0
push 0
call edi
sub byte [esi + section..BsS], 0x80
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x17
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x4d
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x3c
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 4
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x69
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x48
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x55
push 0
push 0
push 0
call edi
inc byte [esi + section..BsS]
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x5a
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x5e
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x8d
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0xb9
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xdf
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x61
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x6f
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x52
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0xad
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x49
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x2f
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x5b
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x5b
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xd5
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x89
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x87
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xe9
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xe5
inc esi
cmp esi, 0x2d200
jb 0x401170
pop edi
pop esi
ret
Function at 0x40339c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40b02c], 0x8088405
inc edx
mov dword [0x40b02c], edx
mul edx
mov eax, edx
ret

Function at 0x4081c4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40b55c
mov eax, esi
mov edx, 8
test al, 1
je 0x4081e0
shr eax, 1
xor eax, 0xedb88320
jmp 0x4081e2
shr eax, 1
dec edx
jne 0x4081d3
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4081cc
pop esi
ret

Function at 0x40820f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40b558], 0
jne 0x40821b
call fcn.004081c4
push 1
push 0x40b558
call fcn.00404ffc
mov eax, edi
test esi, esi
je 0x408246
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40b55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x408221
mov eax, ebx
pop edi
pop esi
pop ebx
ret