joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ce80
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x42d0b3
sub esp, 0x2c
mov eax, dword [esp + 0x30]
lea ecx, [eax + 0x980]
mov edx, dword [eax + 0x978]
mov dword [eax + 0x978], 0
sub edx, ecx
shr edx, 2
mov dword [esp + 0x24], edx
movzx ecx, byte [0x638210]
test cl, cl
jne 0x42cecd
xor ecx, ecx
xor ebx, ebx
jmp 0x42cf09
xor ecx, ecx
jmp 0x42cef3
mov dword [esp + 0x28], ecx
mov edx, dword [eax + ecx*4 + 0x980]
mov dword [esp], edx
call fcn.0041b730
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
cmp ecx, edx
jl 0x42ced1
add eax, 0x978
mov dword [esp], eax
call fcn.0042cd70
add esp, 0x2c
ret
inc ecx
cmp ecx, edx
jge 0x42d07a
mov ebp, dword [eax + ecx*4 + 0x980]
cmp ebp, 0x1000
jb 0x42cf08
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp], ebp
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.0040f8a0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
test ecx, ecx
jne 0x42cf62
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x42cf08
mov dword [esp + 0x20], ecx
mov ebx, dword [eax + 0x2c]
test byte [ebx], al
nop
mov ebp, edx
shr edx, 3
movzx esi, byte [ebx + edx]
and ebp, 7
mov ecx, ebp
mov edi, 1
shl edi, cl
add edx, ebx
xchg esi, eax
xchg edi, ebx
test bl, al
xchg edi, ebx
xchg esi, eax
je 0x42cfa2
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x42cf08
mov dword [esp + 0x18], eax
nop
mov dword [esp], edx
xchg edi, eax
mov byte [esp + 4], al
xchg edi, eax
call fcn.00402190
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xc]
mov edx, dword [0x61833c]
mov ebx, ecx
shr ecx, 0x16
mov ecx, dword [edx + ecx*4]
test byte [ecx], al
test byte [edx], al
nop
nop
mov edx, ebx
shr ebx, 0x10
and ebx, 0x3f
movzx ebp, byte [ecx + ebx + 0x21840]
lea ecx, [ecx + ebx + 0x21840]
nop
shr edx, 0xd
and edx, 7
mov ebx, ecx
mov ecx, edx
mov esi, 1
shl esi, cl
xchg ebp, eax
xchg esi, ebx
test bl, al
xchg esi, ebx
xchg ebp, eax
jne 0x42d015
mov dword [esp], ebx
xchg esi, eax
mov byte [esp + 4], al
xchg esi, eax
call fcn.00402190
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 0x3a]
test cl, 1
je 0x42d055
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0x964]
mov ebp, dword [ecx + 0x968]
mov eax, dword [eax + 0x40]
add edx, eax
adc ebp, 0
mov dword [ecx + 0x964], edx
mov dword [ecx + 0x968], ebp
mov eax, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x42cf08
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
mov dword [edx + eax*4 + 0x980], ecx
lea ebx, [eax + 1]
mov eax, edx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
jmp 0x42cf08
lea ecx, [eax + 0x95c]
mov dword [esp], ecx
lea ecx, [eax + 0x980]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0x200
call fcn.00422d80
mov eax, dword [esp + 0x30]
add eax, 0x978
mov dword [esp], eax
call fcn.0042cd70
add esp, 0x2c
ret
call fcn.0045ab50
jmp fcn.0042ce80
Function at 0x4509e0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x450ae0
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00451250
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x4f0840]
mov dword [esp], ecx
call fcn.0040aa30
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x61c8f0]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.004502f0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.0044f8d0
add esp, 0x28
ret
call fcn.0045c000
jmp fcn.004509e0
Function at 0x45d2c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x638600]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45ba8b
je 0x45bade
cmp ebx, 0x20
jbe 0x45bae4
cmp ebx, 0x40
jbe 0x45bb2a
jmp 0x45bbcb
test ebx, ebx
je 0x45bad4
add eax, 0x10
test ax, 0xff0
je 0x45bac0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x53f2c0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x53f4c0]
jmp 0x45baa8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45baa8
pxor xmm1, xmmword [0x638610]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x638610]
pxor xmm2, xmmword [0x638620]
pxor xmm3, xmmword [0x638630]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x638610]
pxor xmm2, xmmword [0x638620]
pxor xmm3, xmmword [0x638630]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45bc2a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x63820f], 0
je 0x45d2da
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45ba50
jmp fcn.004075e0
Function at 0x45d2e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4027be
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004075e0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0045c000
jmp 0x402780
cmp byte [0x63820f], 0
je 0x45d2fb
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45ba50
jmp 0x402780
Function at 0x4abcc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4abe7e
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.0045d507
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4abcfa
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x4abd23
lea eax, [0x4f2e80]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.004461d0
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x38]
mov ebx, eax
xor eax, eax
call fcn.0045d507
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x54], ecx
movzx ecx, word [esp + 0x6c]
movzx edx, word [esp + 0x70]
shl edx, 0xb
movzx ebx, word [esp + 0x78]
or ebx, edx
movzx edx, byte [esp + 0x75]
test dl, dl
je 0x4abd6b
or ebx, 0x80
movzx eax, byte [esp + 0x74]
test al, al
je 0x4abd7a
or ebx, 0x100
movzx eax, byte [esp + 0x73]
test al, al
je 0x4abd89
or ebx, 0x200
movzx eax, byte [esp + 0x72]
test al, al
je 0x4abd98
or ebx, 0x400
movzx eax, byte [esp + 0x6e]
test al, al
je 0x4abda7
or ebx, 0xffff8000
movzx eax, byte [esp + 0x76]
test al, al
je 0x4abdb3
or ebx, 0x20
movzx eax, byte [esp + 0x77]
test al, al
je 0x4abdbf
or ebx, 0x10
mov word [esp + 0x46], cx
mov word [esp + 0x48], bx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x3c]
lea ecx, [eax + 0xc]
mov edx, dword [esp + 0x40]
mov ebx, dword [esp + 0x38]
cmp edx, ecx
jae 0x4abe2a
mov dword [esp + 0x24], eax
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0xc
lea eax, [0x4f2e80]
mov dword [esp + 0x10], eax
call fcn.00446290
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
add eax, ebx
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.0045dc00
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x38]
call fcn.0045d9c6
add esp, 0x5c
ret
call fcn.0045c000
jmp fcn.004abcc0
Function at 0x4c0350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c04c3
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x4c03e9
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x4c0388
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4c03f5
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4c03b3
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4c03f5
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4c03f5
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.004c0150
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.004c68d0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call fcn.0045c000
jmp fcn.004c0350
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x5e5567b0
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x18e21a1a
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.00401be0
test al, al
jne 0x401c73
mov esp, ebp
pop ebp
ret
push ebx
xor eax, eax
push esi
mov dword [ebp - 8], eax
push edi
jmp 0x401c80
movzx edx, byte [eax + 0x4aaad8]
mov al, dl
and al, 0xf1
mov cl, al
shr al, 4
and cl, 0xf
xor cl, al
mov al, cl
shr al, 2
and cl, 3
xor al, cl
mov byte [ebp - 4], al
mov al, dl
and al, 0xe3
mov cl, al
shr al, 4
and cl, 0xf
xor cl, al
mov al, cl
shr al, 2
and cl, 3
xor al, cl
mov byte [ebp - 3], al
mov al, dl
and al, 0xc7
mov cl, al
shr al, 4
and cl, 0xf
xor cl, al
mov al, cl
and cl, 3
shr al, 2
xor al, cl
mov byte [ebp - 2], al
mov al, dl
and al, 0x8f
mov cl, al
and cl, 0xf
shr al, 4
xor cl, al
mov al, cl
and cl, 3
shr al, 2
xor al, cl
mov byte [ebp - 1], al
mov al, dl
and al, 0x1f
mov cl, al
and cl, 0xf
shr al, 4
xor cl, al
mov bh, cl
and cl, 3
mov al, dl
and al, 0x3e
shr bh, 2
xor bh, cl
mov cl, al
and cl, 0xf
shr al, 4
xor cl, al
mov bl, cl
and cl, 3
mov al, dl
and al, 0x7c
shr bl, 2
xor bl, cl
mov cl, al
and cl, 0xf
shr al, 4
xor cl, al
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov dl, cl
and cl, 3
shr dl, 2
xor dl, cl
and al, 0xf8
mov cl, al
and cl, 0xf
shr al, 4
xor cl, al
mov al, cl
shr al, 2
and cl, 3
xor al, cl
movzx eax, al
movzx esi, bh
movzx ecx, dl
movzx edx, bl
movzx ebx, byte [ebp - 2]
mov dword [ebp - 0x10], ebx
movzx ebx, byte [ebp - 3]
mov dword [ebp - 0x14], ebx
movzx ebx, byte [ebp - 4]
mov dword [ebp - 0x18], ebx
mov ebx, eax
and ebx, 1
add ebx, ebx
xor ebx, eax
mov eax, ecx
and eax, 1
add eax, eax
xor eax, ecx
and eax, 0xfffffffe
movzx edi, byte [ebp - 1]
and ebx, 0xfffffffe
add ebx, ebx
or ebx, eax
mov eax, edx
and eax, 1
add eax, eax
xor eax, edx
and eax, 0xfffffffe
add ebx, ebx
or ebx, eax
mov eax, esi
and eax, 1
add eax, eax
xor eax, esi
and eax, 0xfffffffe
add ebx, ebx
or ebx, eax
mov eax, dword [ebp - 0x10]
and eax, 1
add eax, eax
xor eax, dword [ebp - 0x10]
mov ecx, edi
and ecx, 1
add ecx, ecx
xor ecx, edi
and eax, 0xfffffffe
and ecx, 0xfffffffe
add ecx, ecx
or ecx, eax
mov eax, dword [ebp - 0x14]
and eax, 1
add eax, eax
xor eax, dword [ebp - 0x14]
add ecx, ecx
or ecx, eax
mov dword [ebp - 0xc], edx
shl ebx, 3
and ecx, 0xfffffffe
mov edx, ebx
or edx, ecx
mov ecx, dword [ebp - 0x18]
mov eax, ecx
shr eax, 1
and ecx, 1
xor eax, ecx
or edx, eax
mov eax, dword [ebp - 8]
xor edx, 0x63
mov byte [eax + 0x4a90e0], dl
inc eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
cmp eax, 0xff
jbe 0x401c80
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4079d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x468198
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4a5590]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x4a5590]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x407b1b
cmp byte [edi + 0x45], 0
je 0x407b1b
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x407a30
xor al, al
jmp 0x407b1d
mov ecx, 0xf
xor eax, eax
mov byte [esp + 0x18], 0
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 8
cmp ecx, 0x10
jae 0x407a59
lea eax, [esp + 0x18]
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
cmp dword [esp + 0x2c], 0x10
mov ebx, dword [esp + 0x18]
jae 0x407aa0
lea ebx, [esp + 0x18]
mov esi, ebx
mov ecx, dword [edi + 0x40]
lea eax, [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x2c]
add eax, ebx
push eax
push esi
lea eax, [edi + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x407aa6
dec eax
je 0x407aaa
sub eax, 2
je 0x407b02
xor bl, bl
jmp 0x407b04
mov esi, dword [esp + 0x18]
jmp 0x407a76
mov byte [edi + 0x45], 0
cmp dword [esp + 0x2c], 0x10
mov eax, dword [esp + 0x18]
jae 0x407ab9
lea eax, [esp + 0x18]
mov esi, dword [esp + 0x14]
sub esi, eax
je 0x407ae3
cmp dword [esp + 0x2c], 0x10
mov eax, dword [esp + 0x18]
jae 0x407ad0
lea eax, [esp + 0x18]
push dword [edi + 0x50]
push esi
push 1
push eax
call fcn.0044d9e4
add esp, 0x10
cmp esi, eax
jne 0x407a9c
cmp byte [edi + 0x45], 0
je 0x407b02
test esi, esi
jne 0x407a65
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.00407650
jmp 0x407a65
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x407b17
push dword [esp + 0x18]
call fcn.0044d5f9
add esp, 4
mov al, bl
jmp 0x407b1d
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0044c2ed
mov esp, ebp
pop ebp
ret
Function at 0x40a4c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 0x130], 0
mov dword [ebp - 4], 0
jbe 0x40a50b
mov esi, dword [ebp + 8]
xor eax, eax
push 0xffffffffffffffff
push eax
lea ecx, [ebx + 0x120]
push ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
call fcn.00409d90
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [ebx + 8], 0
jne 0x40a529
mov ecx, dword [ebp + 8]
push 0x47ac50
call fcn.0040a200
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
movzx eax, word [0x47acac]
neg eax
push edi
sbb eax, eax
and eax, 3
push eax
lea edi, [ebx + 0x120]
push 0x47acac
mov ecx, edi
call fcn.0040a100
mov eax, dword [ebx + 8]
sub eax, 5
je 0x40a5db
dec eax
jne case.default.0x40a56a
mov eax, dword [ebx + 0xc]
cmp eax, 3
ja case.default.0x40a56a
jmp dword [eax*4 + 0x40a64c]
cmp byte [ebx + 0x11e], 1
mov ecx, edi
jne 0x40a586
push 0x47ac7c
jmp 0x40a618
push 0x47ac6c
jmp 0x40a618
cmp byte [ebx + 0x11e], 1
mov ecx, edi
jne 0x40a5a2
push 0x47ac84
jmp 0x40a618
push 0x47ac74
jmp 0x40a618
cmp byte [ebx + 0x11e], 1
mov ecx, edi
jne 0x40a5bb
push 0x47ac8c
jmp 0x40a618
push 0x47ac94
jmp 0x40a618
cmp byte [ebx + 0x11e], 1
mov ecx, edi
jne 0x40a5d4
push 0x47ac9c
jmp 0x40a618
push 0x47aca4
jmp 0x40a618
mov eax, dword [ebx + 0xc]
sub eax, 0
je 0x40a611
dec eax
je 0x40a603
dec eax
jne case.default.0x40a56a
cmp byte [ebx + 0x11e], 1
jne 0x40a60a
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x28], 9
jne case.default.0x40a56a
push 0x47ac5c
jmp 0x40a616
push 0x47ac64
jmp 0x40a616
push 0x47ac54
mov ecx, edi
call fcn.00409260
mov esi, dword [ebp + 8]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push edi
mov ecx, esi
mov word [esi], ax
call fcn.00409d90
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b1a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4694f9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4a5590]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
xor ebx, ebx
mov edi, 0x107d
mov ecx, 0xff
lea ecx, [ecx]
mov eax, edi
cdq
idiv ecx
mov ecx, esi
xor dl, byte [ebx + str._v.k]
movsx ax, dl
movzx eax, ax
push eax
push 1
call fcn.00409430
add edi, 0x3f
lea ebx, [ebx + 1]
mov ecx, 0xff
cmp edi, 0x20bb
jl 0x40b200
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b7c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
push ebx
push esi
push edi
jmp 0x40b7d0
mov edx, eax
and edx, 1
dec edx
not edx
and edx, 0xedb88320
mov ecx, eax
shr ecx, 1
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov edx, ecx
and edx, 1
dec edx
shr ecx, 1
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov edx, ecx
and edx, 1
dec edx
shr ecx, 1
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov edx, ecx
and edx, 1
dec edx
shr ecx, 1
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr edx, 1
xor ecx, edx
mov dword [eax*4 + 0x4adec0], ecx
inc eax
cmp eax, 0x100
jb 0x40b7d0
cmp eax, 0x800
jae 0x40b8a3
lea esp, [esp]
mov edx, dword [eax*4 + 0x4adac0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x4adec0]
inc eax
mov dword [eax*4 + 0x4adebc], edx
cmp eax, 0x800
jb 0x40b880
lea ecx, [ebp - 0x20]
mov dword [0x4acdbc], 0x40b960
call fcn.0040f5e0
test eax, eax
je 0x40b958
mov edi, dword [ebp - 0x10]
mov esi, edi
shr esi, 8
shr edi, 4
and esi, 0xff00f
and edi, 0xf00f
xor ecx, ecx
mov eax, 0x4a6a70
xor edx, edx
lea ecx, [ecx]
mov ebx, dword [ebp - 0x1c]
cmp dword [eax - 8], ebx
jne 0x40b8f7
mov ebx, dword [ebp - 0x18]
cmp dword [eax - 4], ebx
mov ebx, dword [ebp - 0x14]
jne 0x40b8f7
cmp dword [eax], ebx
je 0x40b906
add edx, 0xc
inc ecx
add eax, 0xc
cmp edx, 0x24
jb 0x40b8e0
or ecx, 0xffffffff
sub ecx, 0
je 0x40b93f
dec ecx
je 0x40b92e
dec ecx
jne 0x40b958
cmp esi, 6
jb 0x40b958
jne 0x40b94e
cmp edi, 0xf
jb 0x40b958
mov dword [0x4acdbc], 0x40ba00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 5
jb 0x40b958
jne 0x40b94e
cmp edi, 6
jb 0x40b958
cmp edi, 0xa
jmp 0x40b94c
cmp esi, 6
jb 0x40b958
jne 0x40b94e
cmp edi, 0x100c
je 0x40b958
mov dword [0x4acdbc], 0x40ba00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c4c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov esi, dword [edi]
mov dword [ebp - 4], ecx
test esi, esi
je 0x40c51e
mov dword [edi], 0
jmp 0x40c4e0
mov eax, 0x400000
cmp esi, 0x400000
ja 0x40c4ef
mov eax, esi
push 0
lea edx, [ebp + 8]
push edx
push eax
push ebx
push dword [ecx]
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x40c527
test ecx, ecx
je 0x40c51e
mov ecx, dword [ebp - 4]
test esi, esi
jne 0x40c4e0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret