joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x580824]
push ebx
xor eax, eax
xor ebx, ebx
push esi
mov esi, dword [0x5ce364]
mov dword [ebp - 4], eax
mov dword [0x59e308], 2
test ecx, ecx
je 0x47c875
push edi
mov edi, dword [0x58082c]
jmp 0x47c6ed
mov eax, dword [ebp - 4]
mov ecx, dword [0x580824]
cmp ecx, 3
jb 0x47c72d
movzx eax, byte [esi + 0x5ae342]
shl edi, 5
xor edi, eax
and edi, 0x7fff
movzx eax, word [edi*2 + 0x59e320]
mov edx, esi
and edx, 0x7fff
mov dword [0x58082c], edi
mov dword [ebp - 4], eax
mov word [edx*2 + 0x5be360], ax
mov word [edi*2 + 0x59e320], si
test eax, eax
je 0x47c75d
mov edx, esi
sub edx, eax
cmp edx, 0x7efa
ja 0x47c75d
cmp dword [0x5ce368], ecx
jbe 0x47c74b
mov dword [0x5ce368], ecx
call fcn.0047c3f0
mov ebx, eax
mov eax, dword [0x580824]
cmp ebx, eax
jbe 0x47c75d
mov ebx, eax
cmp ebx, 3
jb 0x47c7f8
mov eax, esi
sub eax, dword [0x59e310]
lea ecx, [ebx - 3]
call fcn.00480160
sub dword [0x580824], ebx
cmp ebx, dword [0x580828]
ja 0x47c7d1
cmp dword [0x580824], 3
jb 0x47c7d1
dec ebx
mov edi, edi
movzx ecx, byte [esi + 0x5ae343]
inc esi
shl edi, 5
xor edi, ecx
and edi, 0x7fff
movzx ecx, word [edi*2 + 0x59e320]
mov edx, esi
and edx, 0x7fff
dec ebx
mov dword [ebp - 4], ecx
mov word [edx*2 + 0x5be360], cx
mov word [edi*2 + 0x59e320], si
jne 0x47c790
mov dword [0x58082c], edi
jmp 0x47c80c
movzx edi, byte [esi + ebx + 0x5ae340]
movzx ecx, byte [esi + ebx + 0x5ae341]
add esi, ebx
shl edi, 5
xor edi, ecx
xor ebx, ebx
and edi, 0x7fff
mov dword [0x58082c], edi
jmp 0x47c80d
movzx ecx, byte [esi + 0x5ae340]
xor eax, eax
call fcn.00480160
dec dword [0x580824]
inc esi
mov dword [0x5ce364], esi
test eax, eax
je 0x47c84a
mov ecx, dword [0x5ce360]
test ecx, ecx
js 0x47c829
lea eax, [ecx + 0x5ae340]
jmp 0x47c82b
xor eax, eax
push 0
sub esi, ecx
push eax
call fcn.0047ff60
mov esi, dword [0x5ce364]
mov edi, dword [0x58082c]
add esp, 8
mov dword [0x5ce360], esi
cmp dword [0x580824], 0x106
jae 0x47c867
call fcn.0047c550
mov edi, dword [0x58082c]
mov esi, dword [0x5ce364]
cmp dword [0x580824], 0
jne 0x47c6e4
pop edi
mov ecx, dword [0x5ce360]
test ecx, ecx
js 0x47c898
lea eax, [ecx + 0x5ae340]
push 1
sub esi, ecx
push eax
call fcn.0047ff60
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
push 1
sub esi, ecx
push eax
call fcn.0047ff60
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47ef30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x59c1f0]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test eax, eax
jne 0x47ef6e
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x58084c]
push eax
push esi
push ecx
call fcn.004b6a37
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x47f04e
test edi, edi
jne 0x47f01b
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 1
mov eax, dword [ebp + 0xc]
jne 0x47efba
mov edx, dword [0x58084c]
shr eax, 1
push eax
lea ebx, [esi + eax]
push ebx
push edx
call fcn.004b6a37
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x47f04e
test edi, edi
je 0x47f04e
mov al, byte [ebx]
mov byte [esi], al
inc esi
inc ebx
cmp al, 0xa
jne 0x47efb3
mov word [esi - 1], 0xa0d
inc esi
inc edi
dec ecx
jne 0x47efa1
sub esi, edi
jmp 0x47f01b
mov ecx, dword [0x58084c]
dec eax
push eax
push esi
push ecx
mov ebx, esi
call fcn.004b6a37
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x47f04e
test edi, edi
je 0x47f04e
mov byte [edi + esi], 0xa
nop
mov al, byte [ebx]
mov byte [esi], al
inc esi
inc ebx
cmp al, 0xd
jne 0x47eff1
cmp byte [ebx], 0xa
jne 0x47eff1
dec esi
dec edi
dec ecx
jne 0x47efe0
test edi, edi
jne 0x47f011
mov edx, dword [0x58084c]
push 1
push esi
push edx
call fcn.004b6a37
add esp, 0xc
mov edi, 1
jmp 0x47f01b
sub esi, edi
cmp byte [edi + esi - 1], 0x1a
jne 0x47f01b
dec edi
mov eax, dword [0x580848]
push edi
push esi
push eax
call fcn.004b9940
mov dword [0x580848], eax
mov eax, dword [0x580844]
add eax, edi
add esp, 0xc
mov dword [0x580844], eax
cmp eax, edi
jae 0x47f04c
push 6
mov eax, 0x549c00
call fcn.00475c50
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x480e90
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
mov edi, eax
mov eax, 0x12345678
mov edx, 0x23456789
mov esi, 0x34567890
mov dword [0x59bae4], eax
mov dword [0x59bae8], edx
mov dword [0x59baec], esi
mov cl, byte [edi]
test cl, cl
je 0x480f0a
push ebx
mov ebx, dword [0x5cea80]
movsx ecx, cl
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ebx + ecx*4]
inc edi
movzx ecx, al
add edx, ecx
imul edx, edx, 0x8088405
inc edx
mov ecx, edx
shr ecx, 0x18
xor ecx, esi
and ecx, 0xff
shr esi, 8
mov dword [0x59bae4], eax
mov dword [0x59bae8], edx
xor esi, dword [ebx + ecx*4]
mov dword [0x59baec], esi
mov cl, byte [edi]
test cl, cl
jne 0x480ec1
pop ebx
pop edi
pop esi
ret
Function at 0x4811b0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x59c208], 0
mov eax, dword [ebp + 0xc]
je 0x481252
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
test eax, eax
je 0x481251
push ebx
mov ebx, dword [0x5cea80]
push esi
jmp 0x4811e0
movsx eax, byte [edi]
mov esi, dword [0x59bae4]
xor eax, esi
and eax, 0xff
mov ecx, dword [0x59baec]
shr esi, 8
xor esi, dword [ebx + eax*4]
mov edx, ecx
mov eax, esi
mov dword [0x59bae4], eax
movzx eax, al
add eax, dword [0x59bae8]
and edx, 0xfffd
imul eax, eax, 0x8088405
inc eax
mov dword [0x59bae8], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [ebx + eax*4]
or edx, 2
mov dword [0x59baec], ecx
mov ecx, edx
xor ecx, 1
imul ecx, edx
shr ecx, 8
xor byte [edi], cl
inc edi
dec dword [ebp - 4]
jne 0x4811e0
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
pop edi
mov edx, dword [ebp + 0x10]
push edx
push eax
mov eax, dword [ebp + 8]
push 1
push eax
call fcn.004eeb9c
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x483a30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push edi
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x483ab9
nop
cmp dword [esi + 0x108ec], 0
jg 0x483a86
mov eax, dword [esi + 0x108e4]
mov ecx, dword [esi + 0x10908]
push 0x2000
push eax
push ecx
call fcn.004b6a37
add esp, 0xc
mov dword [esi + 0x108ec], eax
test eax, eax
je 0x483ac2
js 0x483acd
mov edx, dword [esi + 0x108e4]
add dword [esi + 0x10910], 0x2000
mov dword [esi + 0x108e8], edx
mov edi, dword [esi + 0x108ec]
cmp ebx, edi
jae 0x483a92
mov edi, ebx
mov eax, dword [esi + 0x108e8]
mov ecx, dword [ebp + 8]
push edi
push eax
push ecx
call fcn.004b1070
add dword [ebp + 8], edi
add dword [esi + 0x108e8], edi
sub dword [esi + 0x108ec], edi
add esp, 0xc
sub ebx, edi
jne 0x483a40
mov eax, dword [ebp - 4]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
pop edi
sub eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x10b54]
push 0x401
push 0x1b
push 0x53a79c
push esi
call edx
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x483af0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Read file on windows

Disassembly:
push edi
xor edi, edi
cmp dword [esi + 0x109b0], edi
jne 0x483b12
mov eax, dword [esi + 0x90]
cmp eax, edi
jg 0x483b17
dec eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x108ec], edi
or eax, 0xffffffff
pop edi
ret
cmp dword [esi + 0x108ec], edi
jg 0x483b84
mov eax, dword [esi + 0x108e4]
mov ecx, dword [esi + 0x10908]
push 0x2000
push eax
push ecx
call fcn.004b6a37
add esp, 0xc
mov dword [esi + 0x108ec], eax
cmp eax, edi
je 0x483b0c
jge 0x483b67
mov edx, dword [esi + 0x10b54]
push 0x401
push 0x1b
push 0x53a79c
push esi
call edx
push 1
push 0x59e140
call fcn.004eded0
mov eax, dword [esi + 0x108e4]
add dword [esi + 0x10910], 0x2000
mov dword [esi + 0x108e8], eax
mov eax, esi
call fcn.004839c0
mov ecx, dword [esi + 0x8d8]
test byte [ecx + 0x18], 1
je 0x483c27
mov edx, dword [esi + 0x108e8]
push ebx
mov ebx, dword [esi + 0x108ec]
cmp ebx, edi
je 0x483c26
lea esp, [esp]
mov eax, dword [esi + 0x10b04]
and eax, 0xfffd
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor byte [edx], cl
movzx ecx, byte [edx]
mov eax, dword [esi + 0x10afc]
mov edi, dword [esi + 0x108dc]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [edi + ecx*4]
xor ecx, eax
movzx eax, cl
add eax, dword [esi + 0x10b00]
mov dword [esi + 0x10afc], ecx
mov ecx, dword [esi + 0x10b04]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x10b00], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [edi + eax*4]
inc edx
dec ebx
mov dword [esi + 0x10b04], ecx
jne 0x483bb0
pop ebx
mov eax, dword [esi + 0x108e8]
dec dword [esi + 0x108ec]
mov cl, byte [eax]
inc eax
mov dword [esi + 0x108e8], eax
movzx eax, cl
pop edi
ret
Function at 0x483c50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x10914]
add eax, dword [ebp + 8]
push edi
mov edi, eax
and edi, 0x80001fff
jns 0x483c6f
dec edi
or edi, 0xffffe000
inc edi
mov ecx, eax
sub ecx, edi
test eax, eax
jns 0x483cac
mov eax, dword [esi + 0x10904]
push 1
push 0x53b1a8
push eax
lea edi, [esi + 0x8dc]
push 0x53ad84
push edi
call fcn.00494428
mov ecx, dword [esi + 0x10b54]
add esp, 0x10
push eax
push edi
push esi
call ecx
mov eax, 3
pop edi
pop ebp
ret
cmp ecx, dword [esi + 0x10910]
je 0x483d11
mov edx, dword [esi + 0x10908]
push 0
push ecx
push edx
call fcn.004b6ba2
mov ecx, dword [esi + 0x10908]
mov dword [esi + 0x10910], eax
mov eax, dword [esi + 0x108e4]
push 0x2000
push eax
push ecx
call fcn.004b6a37
add esp, 0x18
mov dword [esi + 0x108ec], eax
test eax, eax
jg 0x483cf6
mov eax, 0x33
pop edi
pop ebp
ret
mov edx, dword [esi + 0x108e4]
sub eax, edi
add edx, edi
mov dword [esi + 0x108ec], eax
mov dword [esi + 0x108e8], edx
xor eax, eax
pop edi
pop ebp
ret
mov eax, dword [esi + 0x108e4]
mov ecx, dword [esi + 0x108e8]
sub ecx, eax
sub ecx, edi
add dword [esi + 0x108ec], ecx
add eax, edi
mov dword [esi + 0x108e8], eax
xor eax, eax
pop edi
pop ebp
ret
Function at 0x4907f0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ecx + 0x10afc], 0x12345678
mov dword [ecx + 0x10b00], 0x23456789
mov dword [ecx + 0x10b04], 0x34567890
mov dl, byte [eax]
test dl, dl
je 0x490886
mov eax, dword [ecx + 0x10afc]
push ebx
mov ebx, dword [ecx + 0x108dc]
push esi
mov esi, dword [ecx + 0x10b00]
push edi
mov edi, 0x34567890
movsx edx, dl
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [ebx + edx*4]
movzx edx, al
add esi, edx
imul esi, esi, 0x8088405
inc esi
mov edx, esi
shr edx, 0x18
xor edx, edi
and edx, 0xff
shr edi, 8
mov dword [ecx + 0x10afc], eax
mov dword [ecx + 0x10b00], esi
xor edi, dword [ebx + edx*4]
mov edx, dword [ebp + 8]
inc edx
mov dword [ecx + 0x10b04], edi
mov dword [ebp + 8], edx
mov dl, byte [edx]
test dl, dl
jne 0x490834
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x491680
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x108ec]
xor ebx, ebx
lea ecx, [eax - 1]
push edi
mov dword [esi + 0x108ec], ecx
cmp eax, ebx
jle 0x4916b2
mov ecx, dword [esi + 0x108e8]
movzx eax, byte [ecx]
inc ecx
mov dword [esi + 0x108e8], ecx
jmp 0x4916b7
call fcn.00483af0
inc eax
xor edi, edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x108ec]
lea ecx, [eax - 1]
mov dword [esi + 0x108ec], ecx
cmp eax, ebx
jle 0x4916e8
mov ecx, dword [esi + 0x108e8]
movzx eax, byte [ecx]
inc ecx
mov dword [esi + 0x108e8], ecx
jmp 0x491822
cmp dword [esi + 0x109b0], ebx
je 0x4916f8
or eax, 0xffffffff
jmp 0x491822
mov eax, dword [esi + 0x90]
cmp eax, ebx
jg 0x491717
dec eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x108ec], ebx
or eax, 0xffffffff
jmp 0x491822
cmp ecx, ebx
jg 0x491771
mov edx, dword [esi + 0x108e4]
mov eax, dword [esi + 0x10908]
push 0x2000
push edx
push eax
call fcn.004b6a37
add esp, 0xc
mov dword [esi + 0x108ec], eax
cmp eax, ebx
jne 0x49174e
mov dword [esi + 0x108ec], ebx
or eax, 0xffffffff
jmp 0x491822
jl 0x491859
mov ecx, dword [esi + 0x108e4]
add dword [esi + 0x10910], 0x2000
mov eax, esi
mov dword [esi + 0x108e8], ecx
call fcn.004839c0
mov edx, dword [esi + 0x8d8]
test byte [edx + 0x18], 1
je 0x49180a
mov ebx, dword [esi + 0x108ec]
mov edx, dword [esi + 0x108e8]
test ebx, ebx
je 0x49180a
mov eax, dword [esi + 0x10b04]
and eax, 0xfffd
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor byte [edx], cl
movzx ecx, byte [edx]
mov eax, dword [esi + 0x10afc]
mov edi, dword [esi + 0x108dc]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [edi + ecx*4]
xor ecx, eax
movzx eax, cl
add eax, dword [esi + 0x10b00]
mov dword [esi + 0x10afc], ecx
mov ecx, dword [esi + 0x10b04]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x10b00], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [edi + eax*4]
inc edx
dec ebx
mov dword [esi + 0x10b04], ecx
jne 0x491791
mov edi, dword [ebp - 4]
mov eax, dword [esi + 0x108e8]
dec dword [esi + 0x108ec]
mov cl, byte [eax]
inc eax
mov dword [esi + 0x108e8], eax
movzx eax, cl
mov edx, dword [ebp + 0xc]
mov ecx, eax
shr eax, 4
and eax, 0xf
inc eax
and ecx, 0xf
lea ebx, [eax + edi]
inc ecx
cmp ebx, edx
ja 0x49187a
lea esp, [esp]
mov ebx, dword [ebp + 8]
mov dword [ebx + edi*4], ecx
inc edi
dec eax
jne 0x491840
dec dword [ebp - 8]
mov dword [ebp - 4], edi
je 0x491886
xor ebx, ebx
jmp 0x4916c0
mov edx, dword [esi + 0x10b54]
push 0x401
push 0x1b
push 0x53a79c
push esi
call edx
push 1
push 0x59e140
call fcn.004eded0
pop edi
pop esi
mov eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
sub eax, edx
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ba630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, edx
jb 0x4ba6a9
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.004b1070
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x4ba680
sub eax, ebx
jmp 0x4ba682
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x4ba671
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x4ba69f
sub eax, ebx
jmp 0x4ba6a1
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x4ba690
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x4ba77b
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, esi
add edx, dword [edi + 0x38]
mov esi, eax
push edx
call fcn.004ba3d0
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x4ba6f3
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx eax, byte [esi]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x4ba707
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4ba635
mov eax, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp eax, ecx
jae 0x4ba77b
mov esi, dword [edi + 0x6c]
add esi, edx
cmp eax, esi
jae 0x4ba74a
sub ecx, esi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x4ba72e
mov ebx, 0x102
mov ecx, dword [edi + 0x38]
push ebx
add ecx, esi
push 0
push ecx
call fcn.004a52a0
add esp, 0xc
add ebx, esi
pop esi
mov dword [edi + 0x16c0], ebx
pop ebx
ret
lea edx, [esi + 0x102]
cmp eax, edx
jae 0x4ba77b
sub esi, eax
add esi, 0x102
sub ecx, eax
cmp esi, ecx
jbe 0x4ba764
mov esi, ecx
mov ecx, dword [edi + 0x38]
push esi
add ecx, eax
push 0
push ecx
call fcn.004a52a0
add esp, 0xc
add dword [edi + 0x16c0], esi
pop esi
pop ebx
ret
Function at 0x4e2060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4e21e2
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4e21e2
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov edi, dword [edi]
push eax
push edi
push esi
mov esi, dword [esi]
mov edi, dword [edi]
test eax, 0x1f
je 0x4e2098
mov dl, byte [esi + eax - 1]
mov byte [esi + eax], dl
vpxor ymm0, ymm0, ymm0
vpcmpeqb xmm7, xmm7, xmm7
vpsrldq xmm7, xmm7, 0xf
vpand ymm7, ymm7, ymmword [esi]
add eax, 0x1f
and eax, 0xffffffe0
cmp eax, 0x20
ja 0x4e20d0
vpcmpeqb xmm6, xmm6, xmm6
vpslldq xmm6, xmm6, 0xf
vperm2i128 ymm6, ymm6, ymm6, 1
vpand ymm6, ymm6, ymmword [esi]
jmp 0x4e20e0
vmovdqu ymm6, ymmword [esi + 0x20]
vperm2i128 ymm6, ymm0, ymm6, 0x20
vpslldq ymm6, ymm6, 0xf
vmovdqu ymm1, ymmword [esi]
vperm2i128 ymm2, ymm0, ymm1, 0x20
vpalignr ymm2, ymm1, ymm2, 0xf
vperm2i128 ymm4, ymm0, ymm1, 3
vpalignr ymm3, ymm4, ymm1, 1
vpor ymm2, ymm2, ymm7
vpor ymm3, ymm3, ymm6
vpsrldq ymm7, ymm4, 0xf
vpunpckhbw ymm4, ymm1, ymm0
vpunpcklbw ymm5, ymm1, ymm0
vperm2i128 ymm1, ymm5, ymm4, 0x20
vperm2i128 ymm4, ymm5, ymm4, 0x31
vpunpckhbw ymm5, ymm2, ymm0
vpunpcklbw ymm6, ymm2, ymm0
vperm2i128 ymm2, ymm6, ymm5, 0x20
vperm2i128 ymm5, ymm6, ymm5, 0x31
vpunpckhbw ymm6, ymm3, ymm0
vpunpcklbw ymm0, ymm3, ymm0
vperm2i128 ymm3, ymm0, ymm6, 0x20
vperm2i128 ymm6, ymm0, ymm6, 0x31
vpxor ymm0, ymm0, ymm0
vpmullw ymm1, ymm1, ymmword [0x526f40]
vpmullw ymm4, ymm4, ymmword [0x526f40]
vpaddw ymm2, ymm2, ymmword [0x526f00]
vpaddw ymm5, ymm5, ymmword [0x526f00]
vpaddw ymm3, ymm3, ymmword [0x526f20]
vpaddw ymm6, ymm6, ymmword [0x526f20]
vpaddw ymm2, ymm2, ymm1
vpaddw ymm5, ymm5, ymm4
vpsrlw ymm2, ymm2, 2
vpsrlw ymm5, ymm5, 2
vpaddw ymm3, ymm3, ymm1
vpaddw ymm6, ymm6, ymm4
vpsrlw ymm3, ymm3, 2
vpsrlw ymm6, ymm6, 2
vpsllw ymm3, ymm3, 8
vpsllw ymm6, ymm6, 8
vpor ymm2, ymm2, ymm3
vpor ymm5, ymm5, ymm6
vmovdqu ymmword [edi], ymm2
vmovdqu ymmword [edi + 0x20], ymm5
sub eax, 0x20
add esi, 0x20
add edi, 0x40
cmp eax, 0x20
ja 0x4e20d0
test eax, eax
jne 0x4e20b4
pop esi
pop edi
pop eax
add esi, 4
add edi, 4
dec ecx
jg 0x4e2083
vzeroupper
pop edi
pop esi
pop ebp
ret
Function at 0x405eb3
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x405ed6
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405d43
pop ecx
pop ecx
inc dword [0x4247d0]
ret 8

Function at 0x405fbb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
mov dword [ebp - 4], 0x400
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405f5a
mov esi, dword [ebp + 0x14]
test eax, eax
jne 0x40602a
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp + 0xc]
push esi
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x18]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and byte [esi + 0x3ff], 0
test edi, edi
pop edi
jne 0x40602a
cmp dword [ebp + 0xc], 1
je 0x40602d
cmp dword [ebp + 0xc], 2
je 0x40602d
and byte [esi], 0
pop esi
leave
ret 0x14
Function at 0x401320
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
push 0
push 0
push 0x8003
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x401356
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._FAIL__Hash_object_not_created.__n
call fcn.004016e0
add esp, 8
xor eax, eax
jmp 0x4013cf
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x40138f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._FAIL__Password_not_hashed.__n
call fcn.004016e0
add esp, 8
xor eax, eax
jmp 0x4013cf
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x14]
or ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x1c]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x4013ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._FAIL__Derive_key_failed.__n
call fcn.004016e0
add esp, 8
xor eax, eax
jmp 0x4013cf
mov eax, 1
pop ebp
ret

Function at 0x401530
Capabilities:
Encrypt or decrypt via wincrypt
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, 0x3e8
xor edx, edx
div dword [ebp + 0x14]
mov eax, 0x3e8
sub eax, edx
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0x14], 1
jbe 0x40155b
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
jmp 0x401561
mov edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
call fcn.00401a99
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x40159e
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x4015d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._FAIL__Failed_encrypting_data__n
call fcn.004016e0
add esp, 8
xor eax, eax
jmp 0x401607
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x14], 0
je 0x401577
mov eax, dword [ebp - 0xc]
push eax
call fcn.00401a5f
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x401fb8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c290]
jne 0x401fc2
repz ret
jmp fcn.004048f2