joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f862
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
movzx edx, byte [eax + 0x10]
movzx ecx, cl
xor ecx, edx
mov ecx, dword [ecx*4 + 0x45a078]
mov edx, dword [eax + 0x10]
shr edx, 8
xor ecx, edx
movzx edx, byte [eax + 0x18]
mov dword [eax + 0x10], ecx
movzx ecx, cl
add ecx, dword [eax + 0x14]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [eax + 0x14], ecx
shr ecx, 0x18
xor ecx, edx
mov edx, dword [eax + 0x18]
shr edx, 8
xor edx, dword [ecx*4 + 0x45a078]
mov dword [eax + 0x18], edx
ret

Function at 0x42ff70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
cmp dword [ebp + 0xc], esi
jbe 0x42ff9c
mov eax, ebx
call fcn.0042ff56
xor byte [esi + edi], al
mov cl, byte [esi + edi]
mov eax, ebx
call fcn.00430061
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x42ff82
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x42ffa5
mov dword [eax], edi
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x42ffd1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov eax, edi
push dword [ebp + 8]
call fcn.0043002c
push dword [ebp + 0x18]
lea eax, [edi + 8]
push dword [ebp + 0x14]
push 0xc
push eax
call fcn.0043d7b3
xor esi, esi
add esp, 0x10
cmp dword [ebp + 0x18], esi
jbe 0x430021
push ebx
mov eax, edi
call fcn.0042ff56
mov bl, al
mov eax, dword [ebp + 0x14]
xor bl, byte [esi + eax]
mov eax, edi
mov cl, bl
call fcn.00430061
mov byte [edi + esi + 8], bl
inc esi
cmp esi, dword [ebp + 0x18]
jb 0x42fffe
pop ebx
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x20], eax
pop esi
pop ebp
ret 0x14

Function at 0x430061
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
movzx edx, byte [eax + 0x14]
movzx ecx, cl
xor ecx, edx
mov ecx, dword [ecx*4 + 0x459c78]
mov edx, dword [eax + 0x14]
shr edx, 8
xor ecx, edx
movzx edx, byte [eax + 0x1c]
mov dword [eax + 0x14], ecx
movzx ecx, cl
add ecx, dword [eax + 0x18]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [eax + 0x18], ecx
shr ecx, 0x18
xor ecx, edx
mov edx, dword [eax + 0x1c]
shr edx, 8
xor edx, dword [ecx*4 + 0x459c78]
mov dword [eax + 0x1c], edx
ret

Function at 0x430dfd
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push edi
mov edi, 0x104
push edi
lea ebx, [esi + 0x104]
push esi
push ebx
xor ebp, ebp
call fcn.0043f100
add esp, 0xc
mov eax, edi
sub eax, ebp
push eax
lea eax, [esi + ebp]
push eax
call dword [esi + 0x20c]
add ebp, eax
pop ecx
pop ecx
cmp ebp, edi
jb 0x430e18
xor eax, eax
mov cl, byte [ebx + eax]
not cl
xor byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x430e31
push esi
call fcn.00430d6c
push ebx
call fcn.00430d6c
pop ecx
pop ecx
pop edi
pop ebp
pop ebx
ret
Function at 0x431767
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 0x9c]
push edi
cmp eax, 0xffffffff
je 0x4317d6
cmp eax, 0x40
jbe 0x431793
push esi
lea esi, [ebx + 0x40]
push ebx
call fcn.00433689
pop ecx
mov dword [ebx + 0x9c], 0x14
pop esi
mov eax, dword [ebx + 0x9c]
push 0x40
pop ecx
sub ecx, eax
push ecx
add eax, ebx
push 0
push eax
call fcn.0043dae0
add esp, 0xc
xor eax, eax
xor dword [ebx + eax*4], 0x36363636
inc eax
cmp eax, 0x10
jb 0x4317ae
lea eax, [ebx + 0x40]
call fcn.004335f8
push 0x40
mov edi, eax
mov ecx, ebx
call fcn.00433623
or dword [ebx + 0x9c], 0xffffffff
pop ecx
cmp dword [esp + 0x10], 0
je 0x4317ee
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
lea edi, [ebx + 0x40]
call fcn.00433623
pop ecx
pop edi
pop ebx
ret

Function at 0x4317f1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4691c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
cmp dword [ebx + 0x9c], 0xffffffff
push esi
push edi
mov dword [ebp - 0x1c], eax
je 0x431823
push ebx
push 0
push 0
call fcn.00431767
add esp, 0xc
lea eax, [ebp - 0x18]
lea esi, [ebx + 0x40]
push eax
call fcn.00433689
pop ecx
xor eax, eax
xor dword [ebx + eax*4], 0x6a6a6a6a
inc eax
cmp eax, 0x10
jb 0x431832
mov eax, esi
call fcn.004335f8
push 0x40
mov edi, esi
mov ecx, ebx
call fcn.00433623
push 0x14
lea ecx, [ebp - 0x18]
call fcn.00433623
lea eax, [ebp - 0x18]
push eax
call fcn.00433689
add esp, 0xc
cmp dword [ebp + 0xc], 0
pop edi
pop esi
pop ebx
jbe 0x431882
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call fcn.0043f100
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d493
leave
ret
Function at 0x43188e
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x64]
sub esp, 0x220
mov eax, dword [0x4691c0]
xor eax, ebp
mov dword [ebp + 0x60], eax
mov eax, dword [ebp + 0x78]
push ebx
mov ebx, dword [ebp + 0x70]
push esi
mov dword [ebp - 0x1bc], eax
lea eax, [ebp - 0x108]
push edi
push eax
mov esi, ecx
call fcn.004316ee
push dword [ebp + 0x6c]
push esi
lea esi, [ebp - 0x108]
call fcn.00431702
mov edi, 0xa0
push edi
mov eax, esi
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.0043f100
lea eax, [ebp - 0x1a8]
push eax
push dword [ebp + 0x74]
push ebx
call fcn.00431767
mov eax, dword [ebp + 0x7c]
add esp, 0x24
push 0x14
dec eax
xor edx, edx
pop ecx
div ecx
mov esi, eax
inc esi
je 0x431a13
and dword [ebp - 0x1b0], 0
xor ebx, ebx
lea eax, [ebp + 0x38]
inc ebx
mov dword [ebp - 0x1b4], eax
push 0x14
lea eax, [ebp + 0x38]
push 0
push eax
call fcn.0043dae0
push edi
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0043f100
mov eax, ebx
shr eax, 0x18
mov byte [ebp + 0x4c], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp + 0x4d], al
mov eax, ebx
add esp, 0x18
shr eax, 8
mov byte [ebp + 0x4e], al
mov byte [ebp + 0x4f], bl
mov dword [ebp - 0x1ac], 4
mov dword [ebp - 0x1b8], 0x3e8
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x1ac]
lea eax, [ebp + 0x4c]
push eax
call fcn.00431767
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x4c]
push 0x14
push eax
call fcn.004317f1
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax + 0x4c]
xor byte [ebp + eax + 0x38], cl
inc eax
cmp eax, 0x14
jb 0x431995
mov dword [ebp - 0x1ac], eax
push edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0043f100
add esp, 0xc
dec dword [ebp - 0x1b8]
jne 0x43196e
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp + 0x7c]
jae 0x4319f9
mov ecx, dword [ebp - 0x1b4]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 0x1bc]
inc dword [ebp - 0x1ac]
mov byte [eax + edx], cl
inc eax
cmp dword [ebp - 0x1ac], 0x14
jb 0x4319d2
add dword [ebp - 0x1b0], 0x14
sub dword [ebp - 0x1b4], 0x14
inc ebx
lea eax, [ebx - 1]
cmp eax, esi
jb 0x43191e
mov ecx, dword [ebp + 0x60]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043d493
add ebp, 0x64
leave
ret
Function at 0x43344b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
push edi
xor esi, esi
lea edx, [eax + 0x1c]
mov ecx, dword [edx]
mov edi, ecx
ror edi, 8
and edi, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or edi, ecx
mov dword [ebp + esi*4 - 0x150], edi
inc esi
add edx, 4
cmp esi, 0x10
jb 0x43345c
push 0x40
lea ecx, [ebp - 0x148]
pop edx
mov esi, dword [ecx + 0x2c]
xor esi, dword [ecx + 0x18]
xor esi, dword [ecx - 8]
xor esi, dword [ecx]
add ecx, 4
dec edx
rol esi, 1
mov dword [ecx + 0x34], esi
jne 0x43348d
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
and dword [ebp - 4], 0
mov dword [ebp - 8], edi
mov edi, dword [eax + 0x18]
mov dword [ebp - 0x10], edi
mov edi, esi
not edi
and edi, dword [ebp - 8]
mov dword [ebp - 0xc], edx
mov ebx, ecx
and ebx, esi
xor edi, ebx
rol edx, 5
add edx, edi
mov edi, dword [ebp - 4]
add edx, dword [ebp + edi*4 - 0x150]
mov edi, dword [ebp - 0x10]
inc dword [ebp - 4]
ror esi, 2
cmp dword [ebp - 4], 0x14
lea edx, [edx + edi + 0x5a827999]
mov edi, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov ecx, esi
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x10], edi
jb 0x4334bc
mov dword [ebp - 4], 0x14
mov ebx, dword [ebp - 8]
xor ebx, ecx
mov dword [ebp - 0xc], edx
xor ebx, esi
rol edx, 5
add edx, ebx
mov ebx, dword [ebp - 4]
add edx, dword [ebp + ebx*4 - 0x150]
inc dword [ebp - 4]
ror esi, 2
cmp dword [ebp - 4], 0x28
lea edx, [edx + edi + 0x6ed9eba1]
mov edi, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov ecx, esi
mov esi, dword [ebp - 0xc]
jb 0x433506
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0x28
mov edi, ecx
xor edi, esi
and edi, dword [ebp - 8]
mov ebx, ecx
and ebx, esi
xor edi, ebx
mov ebx, dword [ebp - 4]
add edi, dword [ebp + ebx*4 - 0x150]
mov dword [ebp - 0xc], edx
rol edx, 5
add edx, dword [ebp - 0x10]
inc dword [ebp - 4]
lea edx, [edi + edx - 0x70e44324]
mov edi, dword [ebp - 8]
ror esi, 2
push 0x3c
mov dword [ebp - 0x10], edi
pop edi
mov dword [ebp - 8], ecx
mov ecx, esi
mov esi, dword [ebp - 0xc]
cmp dword [ebp - 4], edi
jb 0x433547
mov dword [ebp - 4], edi
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
xor edi, ecx
mov dword [ebp - 0xc], edx
xor edi, esi
add edi, dword [ebp + ebx*4 - 0x150]
mov ebx, dword [ebp - 8]
rol edx, 5
add edx, dword [ebp - 0x10]
inc dword [ebp - 4]
ror esi, 2
cmp dword [ebp - 4], 0x50
mov dword [ebp - 8], ecx
mov ecx, esi
mov esi, dword [ebp - 0xc]
lea edx, [edi + edx - 0x359d3e2a]
mov dword [ebp - 0x10], ebx
jb 0x43358d
mov edi, dword [eax + 8]
add edi, edx
mov edx, dword [eax + 0xc]
add edx, esi
mov dword [eax + 0xc], edx
mov edx, dword [eax + 0x10]
add edx, ecx
mov ecx, dword [eax + 0x14]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 8]
add ecx, edx
mov dword [eax + 0x14], ecx
mov ecx, dword [eax + 0x18]
mov dword [eax + 8], edi
pop edi
add ecx, ebx
pop esi
mov dword [eax + 0x18], ecx
pop ebx
leave
ret
Function at 0x4335f8
Capabilities:
Hash data using sha1

Disassembly:
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret

Function at 0x433da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00433cb6

Function at 0x43a3d6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043a165
Function at 0x43b6b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4691c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
push 0x10
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0043f100
push 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [esi + 0x800]
push eax
call fcn.0043f100
add esp, 0x18
push 0x40
pop edi
mov al, byte [ebp - 6]
mov dl, byte [ebp - 5]
shr dl, 1
mov cl, al
shl cl, 7
or cl, dl
mov byte [ebp - 5], cl
mov cl, byte [ebp - 7]
mov dl, cl
shl dl, 7
shr al, 1
or dl, al
mov al, byte [ebp - 8]
mov byte [ebp - 6], dl
mov dl, al
shl dl, 7
shr cl, 1
or dl, cl
mov cl, byte [ebp - 9]
mov byte [ebp - 7], dl
mov dl, cl
shl dl, 7
shr al, 1
or dl, al
mov al, byte [ebp - 0xa]
mov byte [ebp - 8], dl
mov dl, al
shl dl, 7
shr cl, 1
or dl, cl
mov cl, byte [ebp - 0xb]
mov byte [ebp - 9], dl
mov dl, cl
shl dl, 7
shr al, 1
or dl, al
mov al, byte [ebp - 0xc]
mov byte [ebp - 0xa], dl
mov dl, al
shl dl, 7
shr cl, 1
or dl, cl
mov cl, byte [ebp - 0xd]
mov byte [ebp - 0xb], dl
mov dl, cl
shl dl, 7
shr al, 1
or dl, al
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xc], dl
mov dl, al
shl dl, 7
shr cl, 1
or dl, cl
mov cl, byte [ebp - 0xf]
mov byte [ebp - 0xd], dl
mov dl, cl
shl dl, 7
shr al, 1
or dl, al
mov al, byte [ebp - 0x10]
mov byte [ebp - 0xe], dl
mov dl, al
shl dl, 7
shr cl, 1
or dl, cl
mov cl, byte [ebp - 0x11]
mov byte [ebp - 0xf], dl
mov dl, cl
shl dl, 7
shr al, 1
or dl, al
mov al, byte [ebp - 0x12]
mov byte [ebp - 0x10], dl
mov dl, al
shl dl, 7
shr cl, 1
or dl, cl
mov cl, byte [ebp - 0x13]
mov byte [ebp - 0x11], dl
mov dl, cl
shr al, 1
shl dl, 7
or dl, al
mov al, byte [ebp - 0x14]
shr byte [ebp - 0x14], 1
shl al, 7
shr cl, 1
or al, cl
mov byte [ebp - 0x13], al
mov eax, edi
shl eax, 5
test byte [eax + esi + 0xf], 1
mov byte [ebp - 0x12], dl
je 0x43b7e3
xor byte [ebp - 0x14], 0xe1
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, edi
shl eax, 4
add eax, esi
push eax
call fcn.0043f100
shr edi, 1
add esp, 0xc
cmp edi, 1
jae 0x43b6ee
push 2
pop edi
cmp edi, 1
jbe 0x43b84b
mov eax, edi
shl eax, 4
add eax, esi
lea ebx, [edi - 1]
lea ecx, [esi + 0x18]
lea edx, [eax + 0x18]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ecx - 8]
xor ebx, dword [eax]
mov dword [edx - 8], ebx
mov ebx, dword [ecx - 4]
xor ebx, dword [eax + 4]
mov dword [edx - 4], ebx
mov ebx, dword [eax + 8]
xor ebx, dword [ecx]
add ecx, 0x10
mov dword [edx], ebx
mov ebx, dword [ecx - 0xc]
xor ebx, dword [eax + 0xc]
add edx, 0x10
dec dword [ebp - 0x18]
mov dword [edx - 0xc], ebx
jne 0x43b81f
add edi, edi
cmp edi, 0x100
jb 0x43b807
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0043d493
leave
ret
Function at 0x43b863
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4691c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
push 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0043dae0
add esp, 0xc
push 0xf
pop esi
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + esi]
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
shl eax, 4
add eax, ecx
mov ecx, dword [ebp - 0x14]
xor ecx, dword [eax]
mov dword [ebp - 0x14], ecx
xor edi, dword [eax + 4]
shr ecx, 0x18
mov dword [ebp - 0x10], edi
xor edx, dword [eax + 8]
mov dword [ebp - 0xc], edx
xor ebx, dword [eax + 0xc]
shr edx, 0x18
mov dword [ebp - 8], ebx
mov eax, ebx
mov bl, byte [ebp - 6]
mov byte [ebp - 5], bl
mov bl, byte [ebp - 7]
mov byte [ebp - 6], bl
mov bl, byte [ebp - 8]
mov byte [ebp - 8], dl
mov dl, byte [ebp - 0xa]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 0xb]
mov byte [ebp - 0xa], dl
mov dl, byte [ebp - 0xc]
mov byte [ebp - 0xb], dl
mov edx, edi
shr edx, 0x18
mov byte [ebp - 0xc], dl
mov dl, byte [ebp - 0xe]
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 0xf]
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0x10]
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0x12]
shr eax, 0x18
mov byte [ebp - 0x11], cl
mov cl, byte [ebp - 0x13]
movzx eax, al
add eax, eax
mov byte [ebp - 0x12], cl
mov cl, byte [ebp - 0x14]
xor cl, byte [eax + 0x4564c9]
mov byte [ebp - 0xf], dl
mov dl, byte [eax + 0x4564c8]
dec esi
mov byte [ebp - 7], bl
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], cl
test esi, esi
jg 0x43b89b
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + esi]
mov ecx, dword [ebp - 0x18]
shl eax, 4
add eax, ecx
mov ecx, dword [eax]
xor dword [ebp - 0x14], ecx
mov ecx, dword [eax + 4]
xor dword [ebp - 0x10], ecx
mov ecx, dword [eax + 8]
xor dword [ebp - 0xc], ecx
mov eax, dword [eax + 0xc]
xor dword [ebp - 8], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
call fcn.0043f100
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043d493
leave
ret
Function at 0x43b991
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4691c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov byte [ebp - 0x14], 0
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x10
stosb byte es:[edi], al
pop edi
push edi
push ecx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x20], ecx
mov esi, edx
call fcn.0043f100
add esp, 0xc
cmp ebx, edi
jb 0x43ba0e
mov eax, ebx
shr eax, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
xor dword [ebp - 0x14], eax
mov eax, dword [esi + 4]
xor dword [ebp - 0x10], eax
mov eax, dword [esi + 8]
xor dword [ebp - 0xc], eax
mov eax, dword [esi + 0xc]
xor dword [ebp - 8], eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push eax
call fcn.0043b863
add esp, 0xc
sub ebx, edi
add esi, edi
dec dword [ebp - 0x1c]
jne 0x43b9de
test ebx, ebx
je 0x43ba3b
xor ecx, ecx
test ebx, ebx
jbe 0x43ba2b
lea eax, [ebp - 0x14]
sub esi, eax
lea eax, [ebp + ecx - 0x14]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, ebx
jb 0x43ba1d
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push eax
call fcn.0043b863
add esp, 0xc
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
call fcn.0043f100
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043d493
leave
ret

Function at 0x43d493
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4691c0]
jne 0x43d49d
repz ret
jmp fcn.00441c49

Function at 0x43dc56
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x43dc87
call fcn.0043f8f0
mov dword [eax], esi
call fcn.0043f8dd
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0043d772
add esp, 0x14
push 0x16
pop eax
jmp 0x43dcdc
test dword [ebp + 0xc], 0xfffffff9
jne 0x43dc63
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43dcb4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.0043f903
pop ecx
call fcn.0043f8dd
mov eax, dword [eax]
jmp 0x43dcdc
test al, 0x10
jne 0x43dcda
test al, 1
je 0x43dcda
test byte [ebp + 0xc], 2
je 0x43dcda
call fcn.0043f8f0
mov dword [eax], 5
call fcn.0043f8dd
mov dword [eax], 0xd
jmp 0x43dcab
xor eax, eax
pop esi
pop ebp
ret
Function at 0x44b30d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00442197
and dword [ebp - 4], 0
cmp dword [0x46c304], 0
mov ebx, eax
jne 0x44b3be
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44b46f
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x44b46f
push eax
call fcn.00442125
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x46c304], eax
call esi
push eax
call fcn.00442125
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x46c308], eax
call esi
push eax
call fcn.00442125
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x46c30c], eax
call esi
push eax
call fcn.00442125
pop ecx
mov dword [0x46c314], eax
test eax, eax
je 0x44b3be
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00442125
pop ecx
mov dword [0x46c310], eax
mov eax, dword [0x46c310]
cmp eax, ebx
je 0x44b416
cmp dword [0x46c314], ebx
je 0x44b416
push eax
call fcn.004421a0
push dword [0x46c314]
mov esi, eax
call fcn.004421a0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44b416
test edi, edi
je 0x44b416
call esi
test eax, eax
je 0x44b40d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44b40d
test byte [ebp - 0xc], 1
jne 0x44b416
or dword [ebp + 0x10], 0x200000
jmp 0x44b44f
mov eax, dword [0x46c308]
cmp eax, ebx
je 0x44b44f
push eax
call fcn.004421a0
pop ecx
test eax, eax
je 0x44b44f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44b44f
mov eax, dword [0x46c30c]
cmp eax, ebx
je 0x44b44f
push eax
call fcn.004421a0
pop ecx
test eax, eax
je 0x44b44f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46c304]
call fcn.004421a0
pop ecx
test eax, eax
je 0x44b46f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44b471
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404967
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x450700], 2
push esi
push edi
mov edi, eax
mov esi, ecx
jl 0x40497b
call fcn.004037f4
mov ecx, esi
call fcn.00404944
xor eax, eax
mov edx, dword [eax + 0x42b340]
mov ecx, dword [esi + 0xf4]
mov dword [eax + ecx], edx
add eax, 4
cmp eax, 0x20
jl 0x404984
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov eax, dword [esi + 0xf4]
mov ecx, dword [esp + 0xc]
xor dword [eax + 8], ecx
mov esi, dword [esi + 0xf4]
or edi, 0x2000
shl edi, 0x10
xor dword [esi + 0xc], edi
pop edi
pop esi
ret 4
Function at 0x405650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x40567d
test cl, 7
je 0x40567d
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x432720]
dec esi
inc ecx
jmp 0x40565e
cmp esi, 8
jb 0x405720
mov edx, esi
shr edx, 3
mov dword [ebp + 8], edx
push ebx
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx edi, bl
mov edi, dword [edi*4 + 0x432b20]
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x432720]
mov ebx, edx
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x432f20]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x433720]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edi, dword [ebx*4 + 0x433b20]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x433f20]
movzx edx, dl
xor edi, dword [edx*4 + 0x433320]
movzx eax, al
xor edi, dword [eax*4 + 0x434320]
sub esi, 8
add ecx, 8
dec dword [ebp + 8]
mov eax, edi
jne 0x40568f
pop ebx
jmp 0x405720
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x432720]
dec esi
inc ecx
test esi, esi
ja 0x40570c
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4059e1
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0x40
pop ebx
cmp esi, ebx
jbe 0x405a2b
lea eax, [ebp - 0x1d0]
push eax
call fcn.0041069e
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1d0]
push eax
call fcn.004109a0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.00410a19
lea eax, [ebp - 0x80]
push 0x20
mov dword [ebp + 8], eax
pop esi
xor ecx, ecx
push edi
test esi, esi
jbe 0x405a4b
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x36
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x405a3a
cmp esi, ebx
jae 0x405a63
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x36
push eax
call fcn.0041b160
add esp, 0xc
lea eax, [ebp - 0xf0]
push eax
call fcn.0041069e
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.004109a0
push dword [ebp + 0x14]
lea eax, [ebp - 0xf0]
push dword [ebp + 0x10]
push eax
call fcn.004109a0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00410a19
lea eax, [ebp - 0x160]
push eax
call fcn.0041069e
xor ecx, ecx
test esi, esi
jbe 0x405acd
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x5c
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x405abc
pop edi
cmp esi, ebx
jae 0x405ae6
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x5c
push eax
call fcn.0041b160
add esp, 0xc
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.004109a0
push 0x20
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.004109a0
push dword [ebp + 0x18]
lea eax, [ebp - 0x160]
push eax
call fcn.00410a19
pop esi
pop ebx
leave
ret 0x14