joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4375c1
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push esi
pop esi
push ebp
mov ebp, esp
js 0x40c7ea
mov di, di
jns 0x4375d7
stosd dword es:[edi], eax
add eax, 0xf8b5d20
mov dword [0x25fffd52], ecx
in eax, 0x8b
inc esi
add al, 0x8b
pop esi
or byte [ebx + 0xf000544], cl
test dword [ecx], edx
bound eax, qword [eax]
add byte [ebp + eax - 0x7d], dh
cmp al, 0x22
out dx, eax
jns 0x40c7ea
and eax, 0x4468be5

Function at 0x437619
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
pop dword [esp - 4]
js 0x4451eb
jns 0x437627
jns 0x4451eb
mov eax, dword [esi + 4]
mov eax, eax
mov eax, dword [ebp + eax]
shr di, 0x40
mov ebx, dword [esi + 8]
mov eax, dword [eax]
lea esi, [esi + 0xc]
mov dword [ebp + ebx], eax
jmp dword [esi]

Function at 0x43c04f
Capabilities:
Get file size

Disassembly:
mov eax, eax
push ebp
shr edi, 0x40
mov ebp, esp
mov ecx, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xchg ecx, eax
xchg ecx, eax
mov ecx, dword [ebp + 8]
test eax, 0xb30c5415
test ecx, ecx
jb 0x42679d
je 0x43c08d
jne 0x43c082
mov cs, word [esp + ebx + 0xd]
or eax, 0xffffffff
jb 0x4267b6
pop ebp
ret

Function at 0x441bf0
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push str.HLW32Proc
push 0
xchg bh, ch
xchg ch, bh
push str.API_1LNM.DLL
push 0
call dword [0x475f38]
pop dword [esp - 4]
push 0x475f3c
je 0x441c1f
jne 0x441c04
push 0x475f46
mov esi, esi
push 0
shr edi, 0x40
ja 0x42e807
jbe 0x441c2a
xor bh, byte [edx - 0x51]
jbe 0x42e807
and eax, 0xc4d8b2b
Function at 0x441cf7
Capabilities:
Authenticate hmac
Check os version
Encode data using base64
Encode data using xor
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
call fcn.00420db8
mov ebx, dword [ebp + 0x38]
adc dword [ebx], eax
push 0x42eec5
ret
mov dx, dx
mov si, si
shl al, 0x20
mov dword [ebp - 8], 0x81
mov edi, edi
mov eax, dword [esi + 4]
cmp bh, bh
add esi, 0xc
popfd
lea edi, [ebp + eax]
mov ebp, ebp
jmp dword [esi - 4]
mov word [ebp - 8], dx
jne 0x404ed8
xchg si, ax
xchg dl, ah
xchg ah, dl
shr ch, 0x40
shr dh, 0x40
xchg si, ax
mov dl, dl
je 0x42f935
push eax
or ah, byte [ecx + 0xf]
test byte [ebp - 0x7d0002ab], bl
cmp dword [ebx + 0x5e8b0446], ecx
je 0x404ed8
cmp byte [ecx], 0x8b
inc esi
add al, 0x8b
pop esi
or byte [esi - 0x75], ah
add byte [edi - 0x722c7826], al
jbe 0x42f959
sub word [ebp + ebx], ax
mov ebp, ebp
jmp dword [esi]
inc esi
add al, 0x8b
pop esi
mov esi, dword [ebp + 8]
mov al, byte [ebx + 6]
lea ecx, [ecx]
push edi
mov ecx, dword [esi + 0x14]
mov edi, dword [ebx]
mov byte [ebp - 4], al
xor eax, eax
jb 0x406438
call fcn.00410f37
xor al, 0xb8
pop dword [esp - 4]
shr ax, 0x40
mov ah, ah
jne 0x420dc8
xchg dx, di
shl ah, 0x20
xchg di, dx
je 0x4307b0
bound esp, qword [eax + 0x4b]
mov dx, word [esi + 6]
jno 0x42f916
shl dx, 0x20
jo 0x4307c6
sub byte [ebx + 0x62], cl
cld
sar byte [ecx + 0xf], 0x80
dec edx
int1
invalid
jo 0x42f916
fisubr dword [eax]
mov eax, dword [ebp + eax]
lea esi, [esi]
mov ebx, dword [ebp + ebx]
lea esi, [esi + 0xc]
jno 0x41f614
jo 0x4307e8
cmp byte [edi + eax - 0x68], cl
jae 0x4307f8
jo 0x41f614
and byte [esi], 0xee
invalid
ja 0x40d737
mov dx, dx
jbe 0x4307ff
push es
and ecx, dword [ebp + ebp*4 + 0xf08ff7d]
xchg byte [edx], dh
iretd
jbe 0x40d737
fld st(5)
mov ebx, dword [esi + 8]
mov bx, bx
mov ax, word [eax + edx]
lea esi, [esi + 0xc]
mov bp, bp
mov word [ebp + ebx], ax
jne 0x425e48
je 0x430826
aam 0x75
je 0x425e48
xor al, 0xdd
inc edi
cmp eax, ecx
mov dword [ebp - 0x18], eax
jb 0x431a7a
jae 0x43083f
aam 0x22
iretd
xor edi, edi
jb 0x432298
mov ecx, dword [esi]
test ecx, 0x2000
jb 0x41f612
shl bp, 0x20
jne 0x4295a1
je 0x43707b
inc eax
aam 0x65
shl ebp, 0x20
ja 0x4248f7
jbe 0x43708c
push ebp
mov word [edx + 0xf92825d], ds
xchg byte [ebp - 0x28], ah
invalid
jbe 0x4248f7
lea esp, [esp + 4]
mov ebx, dword [ebp + 0xc]
push esi
jne 0x430771
je 0x441d0c
nop
cpuid
ret 0x840f
je 0x430771
xor ch, 0xf
test dword [edx], esi
xchg ebx, eax
std
dec dword [eax + 0x280474d2]
fisttp qword [ebx + 0x24]
mov ax, ax
jmp 0x437056
Function at 0x447df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push ebp
xor ebp, ebp
test eax, eax
jle 0x447e7f
mov eax, dword [esp + 0x10]
push ebx
push esi
push edi
xor ecx, ecx
xor esi, esi
xor edi, edi
lea esp, [esp]
inc ecx
and ecx, 0x800000ff
jns 0x447e21
dec ecx
or ecx, 0xffffff00
inc ecx
movzx ecx, cl
movzx edx, byte [ecx + eax]
add edx, esi
and edx, 0x800000ff
jns 0x447e3a
dec edx
or edx, 0xffffff00
inc edx
movzx esi, dl
mov bl, byte [esi + eax]
mov dl, byte [ecx + eax]
mov byte [ecx + eax], bl
mov byte [esi + eax], dl
movzx edx, byte [ecx + eax]
movzx ebx, byte [esi + eax]
add edx, ebx
and edx, 0x800000ff
jns 0x447e63
dec edx
or edx, 0xffffff00
inc edx
movzx edx, dl
mov bl, byte [edx + eax]
mov edx, dword [esp + 0x14]
xor byte [edi + edx], bl
mov edx, dword [esp + 0x18]
inc ebp
movsx edi, bp
cmp edi, edx
jl 0x447e10
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x447e90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor eax, eax
mov ecx, edi
lea esp, [esp]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x447ea0
xor dl, dl
xor ecx, ecx
mov esi, edi
mov ebp, 0x100
mov eax, dword [esp + 0x14]
movzx ebx, byte [esi]
movzx edx, dl
movzx eax, byte [edx + eax]
sub eax, ebx
add eax, ecx
and eax, 0x800000ff
jns 0x447ed5
dec eax
or eax, 0xffffff00
inc eax
movzx ecx, al
mov al, byte [esi]
mov bl, byte [ecx + edi]
mov byte [esi], bl
mov byte [ecx + edi], al
lea eax, [edx + 1]
cdq
idiv dword [esp + 0x18]
inc esi
dec ebp
jne 0x447eb5
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4487f0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
test edi, edi
jbe 0x448848
push ebx
push esi
mov esi, dword [esp + 0x10]
movzx edx, byte [esi]
mov ecx, eax
and ecx, 0xf
movzx ecx, word [ecx*4 + 0x4765d0]
shr ax, 4
mov ebx, edx
and ebx, 0xf
xor cx, word [ebx*4 + 0x4765d0]
shr edx, 4
xor ecx, eax
mov eax, ecx
and eax, 0xf
movzx eax, word [eax*4 + 0x4765d0]
xor ax, word [edx*4 + 0x4765d0]
shr cx, 4
xor eax, ecx
inc esi
dec edi
jne 0x448801
pop esi
pop ebx
pop edi
ret

Function at 0x448c30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
xor ecx, ecx
test esi, esi
jbe 0x448c5f
push ebx
lea ebx, [ebx]
xor edx, edx
mov dl, byte [ecx + edi]
xor edx, eax
and edx, 0xff
mov ebx, dword [edx*4 + 0x476690]
shr eax, 8
xor eax, ebx
inc ecx
cmp ecx, esi
jb 0x448c40
pop ebx
not eax
ret

Function at 0x449260
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
push esi
xor ebx, ebx
mov esi, dword [esp + 0xc]
mov ecx, 4
mov al, byte [esi + 2]
mov bl, byte [eax + str._.C]
mov eax, dword [esp + 0x10]
cmp eax, ecx
jle 0x449298
mov edx, ebx
inc ecx
and edx, 0xff
inc ebx
mov dl, byte [edx + str._.C]
xor byte [esi + ecx - 1], dl
cmp ecx, eax
jl 0x449280
pop esi
pop ebx
ret

Function at 0x449560
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [esp + 8]
push ebx
and ax, 0x8000
push esi
mov dx, word [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ax, 1
sbb eax, eax
add dx, dx
inc eax
or ax, dx
mov word [esp + 0x10], ax
xor byte [esp + 0x11], al
mov ax, word [esp + 0x10]
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
mov esi, 0x55
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
mov eax, 0x58
mov dl, byte [esp + 0x10]
mov bl, byte [esp + 0x10]
and dl, 0x80
add bl, bl
shr dl, 7
add ecx, 2
or dl, bl
mov byte [esp + 0x10], dl
mov dl, byte [esp + 0x11]
and dl, 1
mov bl, byte [esp + 0x11]
shl dl, 7
shr bl, 1
or dl, bl
mov byte [esp + 0x11], dl
mov bl, byte [esp + 0x10]
xor byte [esp + 0x11], bl
mov dx, word [esp + 0x10]
not dx
mov word [esp + 0x10], dx
xor word [ecx - 2], dx
add word [esp + 0x10], si
dec eax
jne 0x4495e3
pop esi
pop ebx
ret
Function at 0x44b2a0
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
sub esp, 8
mov al, byte [esp + 0xc]
push ebx
and ax, 0xf
push esi
mov word [esp + 0xa], ax
push edi
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
lea ecx, [eax + ebp - 1]
mov dword [esp + 0x14], ecx
xor cl, cl
mov edi, dword [esp + 0x14]
test bp, bp
lea esi, [ebp - 1]
je 0x44b2f1
mov bl, byte [edi]
mov eax, edi
dec edi
mov dl, cl
mov cl, bl
add bl, bl
shr cl, 7
or bl, dl
mov byte [eax], bl
mov ax, si
dec si
test ax, ax
jne 0x44b2d5
test cl, cl
je 0x44b2fc
mov eax, dword [esp + 0x14]
or byte [eax], 1
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x44b2c7
xor si, si
test ebp, ebp
je 0x44b329
mov dl, byte [esp + 0x1c]
mov eax, dword [esp + 0x20]
movzx ecx, si
inc si
xor byte [ecx + eax], dl
movzx ecx, si
cmp ecx, ebp
jb 0x44b312
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x44b850
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
push ebx
push esi
mov si, word [esp + 0x14]
push edi
test si, si
mov ebx, dword [esp + 0x14]
je 0x44b8bc
mov di, 0x10
mov eax, dword [ebx + 4]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
and eax, 0xf
push eax
push ecx
call fcn.0044b8d0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x24]
xor dword [esp + 0x14], ecx
add esp, 8
mov edx, dword [ebx]
push 2
xor dword [esp + 0x10], edx
push eax
call fcn.0044b900
add esp, 8
mov ecx, dword [ebx + 4]
dec di
mov dword [ebx], ecx
mov edx, dword [esp + 0xc]
mov dword [ebx + 4], edx
jne 0x44b868
add ebx, 8
inc dword [esp + 0x1c]
dec si
jne 0x44b864
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x44bbd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov cl, byte [esp + 8]
push ebx
mov edx, dword [esp + 0x10]
push esi
xor si, si
push edi
cmp dword [esp + 0x1c], 0
push ebp
je 0x44bbfa
movzx eax, si
inc si
xor byte [eax + edx], cl
movzx ebx, si
cmp ebx, dword [esp + 0x20]
jb 0x44bbe9
xor ax, ax
mov al, cl
and ax, 0xf
mov word [esp + 0x12], ax
mov di, word [esp + 0x20]
xor cl, cl
dec di
mov esi, edx
cmp word [esp + 0x20], 0
je 0x44bc3c
mov bl, byte [esi]
mov ebp, esi
inc esi
mov al, cl
shl al, 7
mov cl, bl
shr bl, 1
and cl, 1
or al, bl
mov byte [ebp], al
mov bp, di
dec di
test bp, bp
jne 0x44bc1b
test cl, cl
je 0x44bc43
or byte [edx], 0x80
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x44bc08
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x4510a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x88
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov esi, dword [esp + 0x98]
push ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
jne 0x4510d0
mov dword [esp + 0x18], 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x24], eax
je 0x4511c2
mov eax, dword [esp + 0x10]
xor dword [esi], eax
mov ecx, dword [esp + 0x14]
xor dword [esi + 4], ecx
cmp dword [esp + 0x20], 0
jne 0x451192
cmp dword [esp + 0x1c], 2
push 0
jbe 0x451173
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.00451270
add esp, 0xc
cmp dword [0x476ddc], 0
jne 0x45125d
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x30]
mov edi, 0x19
mov dword [esp + 0x30], eax
mov eax, dword [ebx]
mov cl, 0x20
add eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [ebx + 4], eax
add ebx, 4
mov eax, dword [esp + 0x28]
mov edx, dword [ebx - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x34], eax
dec edi
jne 0x451144
jmp 0x4511a0
push 0
push esi
call fcn.00451270
add esp, 0xc
cmp dword [0x476ddc], 0
je 0x4511a0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
lea eax, [esp + 0x30]
push eax
push esi
call fcn.00451320
add esp, 8
mov eax, dword [esi]
add esi, 8
mov dword [esp + 0x10], eax
inc dword [esp + 0x20]
mov ecx, dword [esi - 4]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
cmp eax, dword [esp + 0x24]
jb 0x4510f7
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x4511d8
mov cl, byte [eax + esi]
xor byte [esp + eax + 0x10], cl
inc eax
cmp dword [esp + 0x18], eax
ja 0x4511ca
cmp dword [esp + 0x1c], 2
jbe 0x4511f3
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00451320
add esp, 8
jmp 0x451218
cmp dword [esp + 0x1c], 1
jne 0x451207
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x10]
push 0
push 0
push eax
call fcn.00451270
add esp, 0xc
cmp dword [esp + 0x1c], 1
jbe 0x451250
xor ecx, ecx
cmp dword [esp + 0x18], ecx
je 0x451237
mov dl, byte [ecx + esi - 8]
lea eax, [ecx + esi]
inc ecx
mov byte [eax], dl
cmp dword [esp + 0x18], ecx
ja 0x451227
mov eax, dword [esp + 0x10]
mov dword [esi - 8], eax
mov ecx, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi - 4], ecx
pop esi
pop ebx
add esp, 0x88
ret
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
Function at 0x451320
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
push ebp
mov eax, dword [esi]
add esi, 8
mov ebp, 0xc
add dword [edx + 4], eax
mov ecx, dword [esi - 4]
add dword [edx], ecx
mov ebx, dword [edx]
mov edi, dword [edx + 4]
xor edi, ebx
mov cl, 0x20
shr ebx, 4
mov eax, edi
and bl, 0x1f
add esi, 8
sub cl, bl
shr eax, cl
mov cl, bl
shl edi, cl
or eax, edi
mov cl, 0x20
sub eax, dword [esi - 8]
mov dword [edx + 4], eax
mov edi, dword [edx]
xor edi, eax
shr eax, 7
mov ebx, edi
and al, 0x1f
sub cl, al
shr ebx, cl
mov cl, al
shl edi, cl
or ebx, edi
add ebx, dword [esi - 4]
dec ebp
mov dword [edx], ebx
jne 0x45133e
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x451390
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x90
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov ebx, dword [esp + 0xa0]
push ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jne 0x4513c0
mov dword [esp + 0x10], 8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
cmp dword [esp + 0x14], 1
jbe 0x4514b5
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x14]
sub eax, 2
mov dword [esp + 0x2c], eax
je 0x4514b5
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x28], 0
jne 0x451475
lea eax, [esp + 0x30]
push 0
push eax
push ebx
call fcn.00451270
add esp, 0xc
cmp dword [0x476ddc], 0
jne 0x4515b2
mov eax, dword [esp + 0x30]
lea edi, [esp + 0x38]
mov esi, 0x19
mov dword [esp + 0x38], eax
mov eax, dword [edi]
mov cl, 0x20
add eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov dword [edi + 4], eax
add edi, 4
mov eax, dword [esp + 0x30]
mov edx, dword [edi - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x3c], eax
dec esi
jne 0x451446
jmp 0x451483
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.004515c0
add esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor dword [ebx], eax
mov edx, dword [esp + 0x20]
xor dword [ebx + 4], ecx
mov eax, dword [esp + 0x24]
add ebx, 8
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
inc dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x2c]
jb 0x451404
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x10], eax
je 0x4514de
mov eax, dword [esp + 0x10]
lea esi, [ebx + 8]
lea edi, [esp + 0x18]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x14], 1
jne 0x451506
push 0
push 0
push ebx
call fcn.00451270
add esp, 0xc
cmp dword [0x476ddc], 0
je 0x45153c
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
cmp dword [esp + 0x14], 2
jne 0x45152e
push 0
push 0
push ebx
call fcn.00451270
add esp, 0xc
cmp dword [0x476ddc], 0
je 0x45153c
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.004515c0
add esp, 8
cmp dword [esp + 0x14], 1
jbe 0x4515a5
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
xor dword [esp + 0x18], eax
xor dword [esp + 0x1c], ecx
xor ecx, ecx
cmp dword [esp + 0x10], ecx
je 0x45156f
mov dl, byte [ecx + ebx + 8]
lea eax, [ecx + ebx]
inc ecx
mov byte [eax], dl
cmp dword [esp + 0x10], ecx
mov dl, byte [esp + ecx + 0x17]
mov byte [eax + 8], dl
ja 0x451558
cmp dword [esp + 0x14], 2
jne 0x451597
push 0
push 0
push ebx
call fcn.00451270
add esp, 0xc
cmp dword [0x476ddc], 0
je 0x4515a5
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.004515c0
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
xor dword [ebx], eax
xor dword [ebx + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
Function at 0x4515c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0xc
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
push ebp
add edi, 0x64
mov ebp, dword [esi]
mov eax, dword [esi + 4]
sub ebp, dword [edi]
mov edx, eax
shr edx, 7
mov ebx, ebp
and dl, 0x1f
mov cl, 0x20
sub cl, dl
sub edi, 8
shl ebx, cl
mov cl, dl
shr ebp, cl
or ebx, ebp
mov cl, 0x20
xor ebx, eax
mov eax, ebx
mov dword [esi], ebx
shr eax, 4
mov edx, dword [edi + 4]
add edx, dword [esi + 4]
and al, 0x1f
mov ebp, edx
sub cl, al
shl ebp, cl
mov cl, al
shr edx, cl
or ebp, edx
xor ebp, ebx
dec dword [esp + 0x10]
mov dword [esi + 4], ebp
jne 0x4515da
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
mov ecx, dword [eax + 4]
sub dword [esi], ecx
mov edx, dword [eax]
sub dword [esi + 4], edx
pop esi
pop ebx
add esp, 4
ret

Function at 0x452b80
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push 0
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x452ba9
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 4
ret
inc esi
push esi
call fcn.00448fa0
mov dword [esp + 0x10], eax
add esp, 4
test eax, eax
jne 0x452bc4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [esp + 0xc]
push esi
push eax
push ebx
call edi
test eax, eax
jne 0x452bda
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x454c50
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x455770
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.00454bd0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
pop esi
ret

Function at 0x455800
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, eax
mov eax, dword [0x47de20]
and eax, 0xff00
cmp eax, 0x5000
je 0x45584d
shr edi, 2
xor edx, edx
test edi, edi
jle 0x45584d
push ebx
mov edi, edi
mov ecx, dword [esi + edx*4]
mov eax, ecx
shl ecx, 0x10
shr eax, 0x10
or eax, ecx
mov ecx, eax
shr ecx, 8
mov ebx, eax
shl ebx, 8
xor ecx, ebx
and ecx, 0xff00ff
shl eax, 8
xor ecx, eax
mov dword [esi + edx*4], ecx
inc edx
cmp edx, edi
jl 0x455820
pop ebx
pop edi
ret
Function at 0x45a8a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x5c
cmp eax, 0x13d
push esi
jne 0x45a8d0
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x64]
sub ecx, eax
mov edx, 0xa
mov edi, edi
mov esi, dword [ecx + eax]
mov dword [eax], esi
add eax, 4
dec edx
jne 0x45a8c0
pop esi
add esp, 0x5c
ret
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
push ebx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
mov ebx, eax
shr ebx, 5
mov dword [esp + 0x58], ecx
mov edx, 0x14
and eax, 0x1f
push ebp
mov dword [esp + 0x60], ecx
sub edx, ebx
test ax, ax
push edi
mov dword [esp + 0x68], ecx
mov dword [esp + 0x14], ebx
je 0x45a9a2
mov edi, dword [esp + 0x70]
mov ecx, 0x20
sub ecx, eax
movsx eax, ax
mov dword [esp + 0x74], eax
movsx eax, dx
movsx ecx, cx
lea eax, [esp + eax*4 + 0x18]
mov dword [esp + 0x10], ecx
add edi, 0x24
mov ebx, 0xa
lea esp, [esp]
mov esi, dword [edi]
mov ecx, dword [esp + 0x74]
mov ebp, esi
shl ebp, cl
mov ecx, dword [eax]
sub edi, 4
or ecx, ebp
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
dec edx
movsx eax, dx
mov ebp, dword [esp + eax*4 + 0x18]
shr esi, cl
lea eax, [esp + eax*4 + 0x18]
or ebp, esi
dec ebx
mov dword [eax], ebp
jne 0x45a970
mov ebx, dword [esp + 0x14]
jmp 0x45a9cc
mov esi, dword [esp + 0x70]
lea eax, [ebx + edx - 0xb]
lea ebx, [ebx]
movsx ecx, dx
mov ebp, dword [esp + ecx*4 + 0x18]
movsx edi, ax
mov edi, dword [esi + edi*4]
lea ecx, [esp + ecx*4 + 0x18]
or ebp, edi
dec edx
dec eax
test ax, ax
mov dword [ecx], ebp
jge 0x45a9b0
mov edi, 0x14
movsx eax, bx
mov edx, edi
sub edx, eax
cmp edx, edi
mov esi, 0xb
ja 0x45aa1e
lea ecx, [esp + 0x44]
mov eax, edi
jmp 0x45a9f0
mov ecx, dword [ecx]
mov ebx, dword [esp + eax*4 + 0x18]
lea eax, [esp + eax*4 + 0x18]
shr ecx, 0x1d
or ebx, ecx
dec esi
movsx ecx, si
mov dword [eax], ebx
mov ebx, dword [esp + ecx*4 + 0x18]
mov ebp, dword [eax]
lea ecx, [esp + ecx*4 + 0x18]
shl ebx, 3
or ebp, ebx
dec edi
mov dword [eax], ebp
movsx eax, di
cmp eax, edx
jae 0x45a9f0
mov eax, dword [esp + 0x44]
mov edi, dword [esp + 0x78]
and eax, 0x10000000
neg eax
lea edx, [esp + 0x44]
sbb eax, eax
mov ecx, edi
sub edx, edi
mov esi, 0xa
lea esp, [esp]
mov ebx, dword [edx + ecx]
xor ebx, eax
mov dword [ecx], ebx
add ecx, 4
dec esi
jne 0x45aa40
and dword [edi], 0xfffffff
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x5c
ret
Function at 0x45b200
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, eax
mov eax, dword [0x47ee78]
and eax, 0xff00
cmp eax, 0x2300
je 0x45b24d
shr edi, 2
xor edx, edx
test edi, edi
jle 0x45b24d
push ebx
mov edi, edi
mov ecx, dword [esi + edx*4]
mov eax, ecx
shl ecx, 0x10
shr eax, 0x10
or eax, ecx
mov ecx, eax
shr ecx, 8
mov ebx, eax
shl ebx, 8
xor ecx, ebx
and ecx, 0xff00ff
shl eax, 8
xor ecx, eax
mov dword [esi + edx*4], ecx
inc edx
cmp edx, edi
jl 0x45b220
pop ebx
pop edi
ret