joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f320
Capabilities:
Encrypt data using aes via x86 extensions
Hash data using murmur3

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x9f0fe0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45d99b
je 0x45d9ea
cmp ebx, 0x20
jbe 0x45d9f0
cmp ebx, 0x40
jbe 0x45da2e
jmp 0x45dabf
test ebx, ebx
je 0x45d9e0
add eax, 0x10
test ax, 0xff0
je 0x45d9cc
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x7f21e0]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x7f22e0]
jmp 0x45d9b8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45d9b8
pxor xmm1, xmmword [0x9f0ff0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x9f0ff0]
pxor xmm2, xmmword [0x9f1000]
pxor xmm3, xmmword [0x9f1010]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x9f0ff0]
pxor xmm2, xmmword [0x9f1000]
pxor xmm3, xmmword [0x9f1010]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45db1e
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x9f0b81], 0
je 0x45f33a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45d960
jmp fcn.00408250
Function at 0x45f3a0
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x408510
mov eax, dword [0x9f0ed0]
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov ebx, dword [esp + 8]
lea eax, [ebx + eax*8]
xor edx, eax
imul eax, edx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor ecx, eax
imul eax, ecx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0xc], eax
ret
call fcn.0045df10
jmp 0x4084a0
cmp byte [0x9f0b81], 0
je 0x45f3db
mov eax, dword [esp + 4]
movq xmm0, qword [eax]
pinsrd xmm0, dword [esp + 8], 2
aesenc xmm0, xmmword [0x9f0fe0]
aesenc xmm0, xmmword [0x9f0ff0]
aesenc xmm0, xmmword [0x9f1000]
movd dword [esp + 0xc], xmm0
ret
jmp 0x4084a0

Function at 0x460140
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.0045f2a0
call fcn.00437ab0
ret

Function at 0x460260
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x22c
mov dword [esp], esp
mov dword [esp + 4], 0x22c
call fcn.0045fc40
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.0045fc40
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xba0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4b79d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b7b3a
sub esp, 0x40
mov eax, dword [esp + 0x70]
cmp eax, 4
jne 0x4b7b31
mov ecx, dword [esp + 0x6c]
cmp dword [ecx], 0x6c616964
je 0x4b7ad6
mov edx, dword [esp + 0x5c]
mov ebx, dword [esp + 0x60]
mov dword [esp + 0x60], ebx
mov dword [esp + 0x5c], edx
mov ebp, dword [esp + 0x4c]
mov dword [esp], ebp
mov esi, dword [esp + 0x50]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x54]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x58]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.004b77a0
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x54]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x30], eax
call fcn.004bc460
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], edx
add esp, 0x40
ret
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x60]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4b7afc
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
jmp 0x4b7a06
mov eax, dword [esp + 0x5c]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x60]
mov dword [esp], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x50]
mov dword [esp + 8], edx
call eax
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
jmp 0x4b7a0e
mov ecx, dword [esp + 0x6c]
jmp 0x4b7a06
call fcn.0045df10
jmp fcn.004b79d0
Function at 0x4ec970
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ec9a8
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
xor ebx, ebx
jmp 0x4ec99f
movzx ebp, byte [eax + ebx]
inc ebx
imul edx, edx, 0x1000193
xor edx, ebp
cmp ecx, ebx
jg 0x4ec992
mov dword [esp + 0x14], edx
ret
call fcn.0045df10
jmp fcn.004ec970
Function at 0x537e60
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x538015
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x537e89
mov byte [esp + 0xc], 0
ret
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x537e83
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x537e83
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x538007
cmp al, 0x2c
ja 0x537fe4
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x537ebd
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x537eb7
cmp al, 0x26
jae 0x537eb7
cmp al, 0x2f
ja 0x537faa
cmp al, 0x26
ja 0x537f82
cmp al, 0x24
jne 0x537f77
cmp ecx, 2
jg 0x537f3b
cmp ecx, 1
je 0x537f30
cmp ecx, 2
jne 0x537f12
cmp al, 0x2f
jne 0x537f00
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
je 0x537ef6
cmp al, 0x2c
je 0x537ef6
cmp al, 0x3f
sete al
jmp 0x537efb
cmp ecx, 7
jne 0x537f2a
cmp al, 0x21
jne 0x537f22
mov byte [esp + 0xc], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x537f1c
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x537f61
cmp al, 0x40
jne 0x537f4f
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
je 0x537f45
cmp al, 0x3f
je 0x537f45
cmp al, 0x3a
sete al
jmp 0x537f4a
cmp ecx, 6
je 0x537f71
cmp ecx, 7
jne 0x537f12
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x537ee2
jmp 0x537f12
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x537ee2
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x537f9c
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x537ee2
jmp 0x537f12
cmp al, 0x3d
ja 0x537fc9
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x537ee2
cmp al, 0x3d
je 0x537ee2
jmp 0x537f12
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x537ee2
cmp al, 0x5f
je 0x537f96
cmp al, 0x7e
je 0x537f96
jmp 0x537f12
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x537eb7
cmp al, 0x5b
je 0x537eb7
cmp al, 0x5d
je 0x537eb7
jmp 0x537ec7
cmp ecx, 4
je 0x537ea6
jmp 0x537ec7
call fcn.0045df10
jmp fcn.00537e60
Function at 0x5ce300
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ce51d
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x5ce3b7
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x5ce430
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x5ce398
cmp ecx, 0xf
jne 0x5ce4a9
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x5ce398
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x5ce398
call fcn.0045df10
jmp fcn.005ce300
Function at 0x6070d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6072d7
sub esp, 0x50
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x64]
cmp ecx, edx
jne 0x60726d
test ecx, ecx
jbe 0x6072cf
mov eax, dword [esp + 0x54]
mov edx, dword [eax + 4]
mov ebx, dword [esp + 0x60]
add edx, dword [ebx + 4]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.00606830
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x20], edx
xor ebx, ebx
mov ebp, dword [esp + 0x54]
jmp 0x607227
xchg esi, eax
mov byte [ebp + edx], al
xchg esi, eax
inc edx
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x4c]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
cmp edx, esi
jge 0x607187
lea ebp, [ebx + ebx*2]
mov esi, dword [edi + ebp*4]
mov edi, dword [edi + ebp*4 + 4]
cmp edx, edi
jae 0x6072c6
movzx esi, byte [esi + edx]
cmp ebx, ecx
jae 0x6072bf
mov edi, dword [eax + ebp*4 + 4]
mov ebp, dword [eax + ebp*4]
cmp edx, edi
jb 0x607136
jmp 0x6072b6
mov dword [esp + 0x24], ebx
mov edx, dword [edi + 4]
mov dword [esp + 0x38], edx
mov esi, dword [esp + 0x60]
mov edi, dword [esi + 4]
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], eax
xor eax, eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x3c]
jmp 0x6071cf
mov byte [edi + ebx], dl
lea edx, [ebp + 1]
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x60]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x38]
mov ebp, dword [esp + 0x4c]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x38]
mov ebp, dword [esp + 0x28]
cmp edi, ebp
jle 0x60720f
add edx, ebp
mov dword [esp + 0x30], edx
lea edi, [ebx + ebx*2]
mov edx, dword [esi + edi*4 + 4]
mov esi, dword [esi + edi*4]
cmp edx, ebp
jbe 0x6072ad
movzx edx, byte [esi + ebp]
cmp ebx, ecx
jae 0x6072a6
mov esi, dword [eax + edi*4 + 4]
mov edi, dword [eax + edi*4]
mov ebx, dword [esp + 0x30]
cmp esi, ebx
ja 0x6071ad
jmp 0x60729d
lea edx, [ebx + 1]
mov ebx, dword [esp + 0x58]
cmp ebx, edx
jle 0x607249
mov edi, dword [esp + 0x4c]
lea ebp, [edi + 0xc]
mov ebx, edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x4c], ebp
mov esi, dword [ebp + 4]
mov dword [esp + 0x1c], esi
mov edi, dword [esp + 0x54]
mov dword [esp + 0x44], eax
xor eax, eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x44]
jmp 0x607151
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x50
ret
mov eax, dword [0x9d31b8]
mov ecx, dword [0x9d31bc]
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
add esp, 0x50
ret
mov eax, ebx
mov ecx, esi
call fcn.0045f4f0
mov eax, ebx
call fcn.0045f4f0
mov eax, ebp
mov ecx, edx
call fcn.0045f4f0
mov eax, edx
mov ecx, edi
call fcn.0045f4f0
mov eax, ebx
call fcn.0045f4f0
mov eax, edx
mov ecx, edi
call fcn.0045f4f0
xor eax, eax
call fcn.0045f4f0
nop
call fcn.0045df10
jmp fcn.006070d0
Function at 0x6d60d7d5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d616878]
jne 0x6d60d7df
repz ret
jmp fcn.6d60de74

Function at 0x6d60e202
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x6d60e211
pop dword [ebp - 0x1c]
mov eax, 0x6d60e211
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x8318231c
add dword [ebp - 0x2c], 0xcb3a222f
mov dword [ebp - 0x28], 0xc90840cc
sub dword [ebp - 0x28], 0x96d4f487
mov dword [ebp - 0x24], 0xe66db137
add dword [ebp - 0x24], 0x65de92f7
mov dword [ebp - 0x20], 0x4024d4d3
sub dword [ebp - 0x20], 0x4024d4d3
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xe667d45e
sub eax, 0x7906e43a
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x83e7c337
add dword [ebp - 0x2c], 0xf08aa61f
mov dword [ebp - 0x28], 0x145deab
sub dword [ebp - 0x28], 0xbfd97d36
mov dword [ebp - 0x24], 0xcbbdea56
sub dword [ebp - 0x24], 0x684e7dea
mov dword [ebp - 0x20], 0xde0e55f8
add dword [ebp - 0x20], 0x21f1aa08
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xea02627b
add eax, 0x835e8da5
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x34828
push 0
call eax
mov ecx, 0x6ab78583
sub ecx, 0x6ab748eb
mov esi, eax
mov edx, 0x3db0cf24
add edx, 0x2fb0ccdc
add edx, dword [ebp - 0x1c]
mov edi, 0x67d42ff2
add edi, 0x478be508
xor dword [ebp - 4], ebx
mov ebx, dword [edx]
sub dword [ebp - 8], 0xc82ba224
sub ebx, edi
xor dword [ebp - 0x14], 0x5494865f
mov dword [esi], ebx
xor dword [ebp - 0x10], eax
add esi, 0x7e281a5b
add esi, 0x81d7e5a9
add edx, 4
loop 0x6d60e32e
add eax, 0xf49ca36a
add eax, 0xb6441c9
xor ebx, ebx
add ebx, eax
add eax, 0x708b38
add eax, 0xff8f74cd
mov ecx, 0x47a161ae
sub ecx, 0xda4161ae
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x42fd10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1b000]
push edi
or ebp, 0xffffffff
jmp 0x42fd32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42fd39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42fd28
mov eax, 1
add ebx, ebx
jne 0x42fd4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42fd40
jne 0x42fd5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42fd40
xor ecx, ecx
sub eax, 3
jb 0x42fd70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42fde2
mov ebp, eax
add ebx, ebx
jne 0x42fd7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42fd88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42fdac
inc ecx
add ebx, ebx
jne 0x42fd98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42fd8d
jne 0x42fda9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42fd8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42fdcc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42fdbd
jmp 0x42fd2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42fdcc
add edi, ecx
jmp 0x42fd2e
pop esi
mov edi, esi
mov ecx, 0x582
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42fdea
cmp byte [edi], 7
jne 0x42fdea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42fdef
lea edi, [esi + 0x2d000]
mov eax, dword [edi]
or eax, eax
je 0x42fe5e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2fba4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2fc30]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42fe1c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2fc34]
or eax, eax
je 0x42fe58
mov dword [ebx], eax
add ebx, 4
jmp 0x42fe39
call dword [esi + 0x2fc44]
mov ebp, dword [esi + 0x2fc38]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42fe92
sub esp, 0xffffff80
jmp 0x415edd
Function at 0x402b98
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404774
test esi, esi
jne 0x402bce
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404864
jmp 0x402bec
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402aac
mov edi, eax
test esi, esi
je 0x402bec
cmp dword [ebx], 0
je 0x402bec
dec esi
jmp 0x402bd5
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4031d8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4e4008], 0x8088405
inc edx
mov dword [ebx + 0x4e4008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4037f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4e4024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403888
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403868
xor eax, eax
push ebp
push 0x403861
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4038a4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403868
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4e4024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4e4024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404554
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4e804c], 0
je 0x4045b5
cmp word [0x4e8220], 0xd7b2
jne 0x40457d
cmp dword [0x4e8228], 0
jbe 0x40457d
mov eax, 0x4e821c
call dword [0x4e8238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4e4074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4045dc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4e4034], 0
jne 0x4045d1
push 0
push 0x4e406c
push 0x4e4074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404728
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402838
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4e804d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4046f0
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc