joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447590
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63ac50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 0xc]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 4]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
mov dword [ebp + 0xc], ecx
mov eax, dword [esi + ecx]
cmp eax, edx
jne 0x44760e
mov esi, edx
jmp 0x447614
mov esi, dword [esi + ecx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x44763e
mov esi, dword [esi + 4]
mov ecx, dword [edi]
cmp ecx, dword [esi + 8]
jne 0x447614
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edx]
push edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 4]
push ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebx + 4]
push eax
call fcn.00447190
mov edx, eax
mov ecx, 0xaaaaaa9
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x44773e
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov edx, dword [ebx + 4]
mov edi, dword [edx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x4476b1
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebx + 4]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp eax, edx
jne 0x4476cb
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x4476ee
cmp eax, esi
jne 0x4476d3
mov dword [ecx], edi
jmp 0x4476ee
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x4476ee
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.004481e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.004b1853
int3
Function at 0x447920
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x447991
cmp ecx, eax
jne 0x447989
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x447999
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x447999
cmp ecx, eax
jne 0x447999
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [edi + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.00448270
mov eax, dword [esp + 0xc]
mov dword [eax], edi
pop edi
pop esi
ret 8

Function at 0x448040
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63ada0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push dword [edi + 0x38]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
lea ebx, [edi + 0x60]
test esi, esi
jne 0x448137
mov ecx, ebx
call fcn.0044bc10
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [edi + 4]
call fcn.00448590
mov ecx, ebx
call fcn.0044bd00
mov esi, dword [ebp - 0x18]
cmp esi, dword [edi + 8]
jne 0x44812a
mov ecx, ebx
call fcn.0044bc00
lea eax, [ebp - 0xd]
push eax
push dword [edi + 0x3c]
lea ecx, [ebp - 0x2c]
call fcn.004479c0
mov edx, eax
mov ecx, dword [edx]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x38], ecx
mov ecx, dword [edx + 4]
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], eax
mov dword [edx + 8], 0
push dword [ebp + 8]
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [edi + 4]
call fcn.00447590
lea ecx, [ebp - 0x3c]
mov esi, dword [eax]
call fcn.00447ce0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040fe60
mov ecx, ebx
call fcn.0044bcf0
add esi, 0xc
push esi
push dword [edi + 0x38]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 4]
sub eax, dword [esi]
sar eax, 2
cmp eax, dword [edi + 0x3c]
jae 0x44815d
mov ecx, ebx
call fcn.0044bc10
push esi
push dword [edi + 0x3c]
mov ecx, esi
call fcn.00447750
mov ecx, ebx
call fcn.0044bd00
mov ecx, dword [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x448590
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, ecx
mov ebx, dword [esp + 0x14]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
lea eax, [ecx*8]
mov ebp, dword [eax + edx]
mov ecx, ebp
add edx, eax
lea esp, [esp]
cmp ebp, esi
jne 0x4485f8
mov eax, esi
jmp 0x4485fd
mov eax, dword [edx + 4]
mov eax, dword [eax]
cmp ecx, eax
je 0x448617
mov eax, dword [ecx + 8]
cmp eax, dword [edi]
je 0x44860c
mov ecx, dword [ecx]
jmp 0x4485f0
pop edi
pop esi
pop ebp
mov dword [ebx], ecx
mov eax, ebx
pop ebx
ret 8
pop edi
mov dword [ebx], esi
mov eax, ebx
pop esi
pop ebp
pop ebx
ret 8

Function at 0x449eb0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, ecx
mov dword [ebx], 0
mov ecx, dword [esi + 8]
mov dword [esp + 8], ecx
test ecx, ecx
je 0x449ff4
cmp dword [ecx + 0x20], 0xffffffff
je 0x449ff4
test byte [ecx + 0x24], 1
jne 0x449ee9
pop esi
mov eax, 0x8202000a
pop ebx
pop ecx
ret 0xc
push ebp
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x449fea
mov ebp, 0x40000000
mov dword [esp + 0x20], 0
lea edx, [esi + 0x18]
cmp edi, ebp
jae 0x449f0d
mov ebp, edi
mov eax, dword [esi + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x14]
push edx
mov dword [esi + 0x24], eax
lea eax, [esp + 0x24]
push eax
push ebp
push dword [esp + 0x24]
push dword [ecx + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x449f6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
js 0x449f49
je 0x449fc9
movzx eax, ax
or eax, 0x83ff0000
cmp eax, 0x83ff03e5
jne 0x449fcb
push 1
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x18]
push eax
mov eax, dword [esp + 0x1c]
push dword [eax + 0x20]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x449f90
mov eax, dword [esp + 0x20]
add dword [esp + 0x18], eax
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
sub edi, eax
add dword [ebx], eax
cmp eax, ebp
jb 0x449fd9
test edi, edi
je 0x449fea
mov ecx, dword [esp + 0x10]
jmp 0x449ef7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
test ecx, ecx
js 0x449fb9
jne 0x449fb0
mov eax, dword [esp + 0x20]
xor ecx, ecx
add dword [ebx], eax
mov eax, ecx
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret 0xc
movzx ecx, cx
or ecx, 0x83ff0000
mov eax, dword [esp + 0x20]
add dword [ebx], eax
mov eax, ecx
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret 0xc
xor eax, eax
mov ecx, dword [esp + 0x20]
add dword [ebx], ecx
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret 0xc
test eax, eax
jne 0x449fea
pop edi
pop ebp
pop esi
mov eax, 0x8202001b
pop ebx
pop ecx
ret 0xc
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
pop esi
mov eax, 0x82020010
pop ebx
pop ecx
ret 0xc
Function at 0x44a835
Capabilities:
Get system information on windows

Disassembly:
push 0x90
push 0
push 0x6f559c
call fcn.004b40a0
add esp, 0xc
mov dword [0x6f5598], 0x94
push 0x6f5598
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
push 0x6f5570
mov dword [0x6f5570], eax
mov dword [0x6f5574], eax
mov dword [0x6f5578], eax
mov dword [0x6f557c], eax
mov dword [0x6f5580], eax
mov dword [0x6f5584], eax
mov dword [0x6f5588], eax
mov dword [0x6f558c], eax
mov dword [0x6f5590], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
ret

Function at 0x44ab01
Capabilities:
Get geographical location

Disassembly:
sub esp, 0xc8
push ebx
mov ebx, dword [esp + 0xd0]
xor eax, eax
push ebp
push esi
mov esi, ecx
mov word [esp + 0xc], ax
xor ecx, ecx
mov word [esi + 0x28], ax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea ebp, [esi + 0x28]
mov word [esi], ax
lea eax, [esi + 0x3c]
mov word [esi + 0x14], cx
mov dword [eax], ecx
push 2
mov dword [eax + 4], ecx
push eax
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
push 0x20000011
mov dword [eax + 0x10], ecx
push ebx
mov dword [eax + 0x14], ecx
call edi
push 2
lea eax, [esi + 0x50]
push eax
push 0x20001010
push ebx
call edi
push 2
lea eax, [esi + 0x40]
push eax
push 0x20000012
push ebx
call edi
push 0xa
lea eax, [esi + 0x14]
push eax
push 0xf
push ebx
call edi
push 0xa
push esi
push 0xe
push ebx
call edi
push 0xa
push ebp
push 0x51
push ebx
call edi
lea eax, [esi + 0x14]
mov dword [esi + 0x48], esi
push 0x64
mov dword [esi + 0x4c], eax
lea eax, [esp + 0x14]
push eax
push 0x10
push ebx
call edi
mov ax, word [esp + 0x10]
lea edi, [esp + 0x10]
test ax, ax
je 0x44abe1
movzx edx, ax
lea esp, [esp]
lea eax, [edx - 0x31]
cmp ax, 8
ja 0x44abbb
mov eax, dword [esi + 0x44]
lea ecx, [eax + eax*4]
movzx eax, dx
lea eax, [eax + ecx*2]
add eax, 0xffffffd0
mov dword [esi + 0x44], eax
cmp dx, 0x30
je 0x44abd3
cmp word [edi + 2], 0
jne 0x44abd3
mov eax, dword [esi + 0x44]
lea eax, [eax + eax*4]
add eax, eax
mov dword [esi + 0x44], eax
movzx eax, word [edi + 2]
add edi, 2
mov edx, eax
test ax, ax
jne 0x44aba0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc8
ret 4
Function at 0x44aec0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63ae80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 0xc]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 4]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
mov dword [ebp + 0xc], ecx
mov eax, dword [esi + ecx]
cmp eax, edx
jne 0x44af3e
mov esi, edx
jmp 0x44af44
mov esi, dword [esi + ecx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x44af6e
mov esi, dword [esi + 4]
mov ecx, dword [edi]
cmp ecx, dword [esi + 8]
jne 0x44af44
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edx]
push edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 4]
push ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebx + 4]
push eax
call fcn.0044aea0
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x44b06e
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x44afe1
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x44affb
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x44b01e
cmp eax, esi
jne 0x44b003
mov dword [edx], edi
jmp 0x44b01e
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x44b01e
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.0044b4d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.004b1853
int3
Function at 0x44b080
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63ae90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x44b14e
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x44b14e
mov esi, dword [esi + 4]
mov ecx, dword [edi]
cmp ecx, dword [esi + 8]
jne 0x44b104
mov edx, dword [ebp + 0x10]
push 0xc
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.004b22a2
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x44b17e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x44b195
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x44b1b7
cmp eax, esi
jne 0x44b19d
mov dword [ecx], edi
jmp 0x44b1b7
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x44b1b7
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.0044b4d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44d6d0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x20c
push ebp
mov ebp, ecx
mov dword [esp + 0xc], ebp
cmp dword [ebp + 0x2838], 0
jne 0x44d8c7
push ebx
push esi
push edi
xor ebx, ebx
mov dl, 1
movzx eax, dl
mov cl, dl
sar cl, 7
and cl, 0x1b
mov byte [esp + ebx + 0x11c], dl
mov byte [esp + eax + 0x1c], bl
mov al, dl
add al, al
inc ebx
xor cl, al
xor dl, cl
cmp ebx, 0x100
jl 0x44d6f1
mov cl, 1
lea edx, [ebp + 0x2810]
mov esi, 0xa
movzx eax, cl
lea edx, [edx + 4]
shl eax, 0x18
mov dword [edx - 4], eax
mov al, cl
sar al, 7
add cl, cl
and al, 0x1b
xor cl, al
sub esi, 1
jne 0x44d725
mov dword [ebp + 0x159c], esi
lea edi, [ebp + 0x14]
mov dword [ebp + 0x10], 0x63
mov esi, 1
jmp 0x44d760
movzx eax, byte [esp + esi + 0x1c]
lea ecx, [esp + 0x21b]
sub ecx, eax
lea edi, [edi + 4]
mov dl, byte [ecx]
mov cl, dl
rol cl, 1
xor dl, cl
rol cl, 1
xor dl, cl
rol cl, 1
mov al, cl
rol al, 1
xor al, cl
xor al, dl
xor al, 0x63
movzx eax, al
mov dword [edi - 4], eax
mov dword [ebp + eax*4 + 0x1410], esi
inc esi
cmp esi, 0x100
jl 0x44d760
lea edi, [ebp + 0x410]
mov dword [esp + 0x14], 0x100
mov ebp, 0xff
mov dl, byte [edi - 0x400]
mov cl, dl
mov al, dl
add al, al
sar cl, 7
and cl, 0x1b
xor cl, al
movzx eax, dl
movzx esi, cl
shl esi, 8
xor esi, eax
shl esi, 8
xor esi, eax
movzx eax, cl
shl esi, 8
xor esi, eax
movzx eax, dl
xor esi, eax
mov al, byte [edi + 0x1000]
mov dword [edi], esi
ror esi, 8
mov dword [edi + 0x400], esi
ror esi, 8
mov dword [edi + 0x800], esi
ror esi, 8
mov dword [edi + 0xc00], esi
test al, al
je 0x44d86c
movzx eax, al
xor edx, edx
movzx ecx, byte [esp + eax + 0x1c]
mov eax, dword [esp + 0x27]
movzx eax, al
add eax, ecx
div ebp
mov eax, dword [esp + 0x29]
movzx eax, al
add eax, ecx
movzx esi, byte [esp + edx + 0x11c]
xor edx, edx
div ebp
mov eax, dword [esp + 0x25]
movzx eax, al
add eax, ecx
movzx ebx, byte [esp + edx + 0x11c]
xor edx, edx
div ebp
movzx eax, byte [esp + edx + 0x11c]
xor edx, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2a]
movzx eax, al
add eax, ecx
div ebp
movzx eax, byte [esp + edx + 0x11c]
jmp 0x44d876
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x10], ebx
xor eax, eax
shl eax, 8
xor eax, dword [esp + 0x10]
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, esi
mov dword [edi + 0x1400], eax
ror eax, 8
mov dword [edi + 0x1800], eax
ror eax, 8
mov dword [edi + 0x1c00], eax
ror eax, 8
mov dword [edi + 0x2000], eax
add edi, 4
sub dword [esp + 0x14], 1
jne 0x44d7b2
mov ebp, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword [ebp + 0x2838], 1
pop ebp
add esp, 0x20c
ret
Function at 0x44ef30
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx], fcn.0044fc40
mov eax, ecx
mov dword [ecx + 8], 0
mov dword [ecx + 4], 0
mov dword [ecx + 0xc], 0x6a09e667
mov dword [ecx + 0x10], 0xbb67ae85
mov dword [ecx + 0x14], 0x3c6ef372
mov dword [ecx + 0x18], 0xa54ff53a
mov dword [ecx + 0x1c], 0x510e527f
mov dword [ecx + 0x20], 0x9b05688c
mov dword [ecx + 0x24], 0x1f83d9ab
mov dword [ecx + 0x28], 0x5be0cd19
ret

Function at 0x44ef80
Capabilities:
Hash data using sha384

Disassembly:
mov eax, ecx
mov ecx, 0x10
push esi
push edi
mov esi, 0x658a80
mov dword [eax], 0x6586e8
lea edi, [eax + 0x18]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret

Function at 0x44efc0
Capabilities:
Hash data using sha512

Disassembly:
mov eax, ecx
mov ecx, 0x10
push esi
push edi
mov esi, 0x658ac0
mov dword [eax], 0x6586f4
lea edi, [eax + 0x18]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret

Function at 0x44fc40
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx + 8], 0
mov dword [ecx + 4], 0
mov dword [ecx + 0xc], 0x6a09e667
mov dword [ecx + 0x10], 0xbb67ae85
mov dword [ecx + 0x14], 0x3c6ef372
mov dword [ecx + 0x18], 0xa54ff53a
mov dword [ecx + 0x1c], 0x510e527f
mov dword [ecx + 0x20], 0x9b05688c
mov dword [ecx + 0x24], 0x1f83d9ab
mov dword [ecx + 0x28], 0x5be0cd19
ret

Function at 0x452360
Capabilities:
Hash data with md5

Disassembly:
push esi
push 0x40
mov esi, ecx
push 0
push esi
call fcn.004b40a0
add esp, 0xc
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x48], 0x67452301
mov dword [esi + 0x4c], 0xefcdab89
mov dword [esi + 0x50], 0x98badcfe
mov dword [esi + 0x54], 0x10325476
pop esi
ret

Function at 0x452480
Capabilities:
Hash data with md5

Disassembly:
push esi
push 0x40
mov esi, ecx
push 0
push esi
call fcn.004b40a0
add esp, 0xc
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x48], 0x67452301
mov dword [esi + 0x4c], 0xefcdab89
mov dword [esi + 0x50], 0x98badcfe
mov dword [esi + 0x54], 0x10325476
pop esi
ret
Function at 0x4561d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63af7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov eax, dword [ebp + 8]
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x70], eax
and eax, 1
push 0x3c
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x34]
push 0
push eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x74], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.004b40a0
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x459df0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
test edx, edx
jne 0x459e01
xor eax, eax
pop esi
ret
mov eax, dword [esp + 8]
not eax
cmp esi, 8
jb 0x459ebd
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x659100]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x659100]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x659100]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x659100]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x659100]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x659100]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x659100]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x659100]
sub edi, 1
jne 0x459e16
pop edi
test esi, esi
je 0x459edb
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x659100]
sub esi, 1
jne 0x459ec1
not eax
pop esi
ret

Function at 0x45a5b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63b1cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0x659608
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x24], 0
mov eax, ecx
mov dword [ecx + 0x30], 0xfffffffe
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov word [ecx + 0xc], 0xff00
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret