joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e7e0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x47e8cc
push edi
mov edi, dword [esp + 0x14]
inc edi
lea ebx, [ebx]
movzx edx, byte [edi - 1]
cmp esi, 3
jl 0x47e85e
movzx ecx, byte [edi]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 6
and ecx, 0x3f
and edx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], cl
jmp 0x47e8af
shl edx, 0x10
cmp esi, 2
jne 0x47e86e
movzx ecx, byte [edi]
shl ecx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
cmp esi, 1
jne 0x47e89b
lea ecx, [esi + 0x3c]
jmp 0x47e8a8
shr edx, 6
and edx, 0x3f
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
sub esi, 3
add eax, 4
add ebx, 4
add edi, 3
test esi, esi
jg 0x47e800
pop edi
mov byte [eax], 0
mov eax, ebx
pop esi
pop ebx
ret
mov byte [eax], bl
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x48fc00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x6c
call fcn.0042f7c0
mov eax, dword [0x50ad20]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push ebx
mov dword [esp + 4], eax
xor ebx, ebx
mov eax, dword [esp + 0x7c]
push ebp
mov ebp, dword [esp + 0x78]
push esi
mov dword [esp + 0x14], eax
xor esi, esi
mov dword [eax], ebx
lea eax, [esp + 0x1c]
push edi
mov edi, dword [esp + 0x8c]
push eax
call fcn.00480ad0
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.00480930
add esp, 0xc
test eax, eax
je 0x48fd02
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00480620
add esp, 0xc
test eax, eax
je 0x48fd02
lea eax, [esp + 0x20]
push eax
call fcn.00480870
mov esi, dword [ebp]
add esp, 4
test byte [esi + 0xc], 4
je 0x48fd20
push edi
call fcn.0045df60
push ebx
push edi
mov dword [esp + 0x28], eax
call fcn.004910a0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x48fd02
push esi
call fcn.00491d60
add esp, 4
test eax, eax
jle 0x48fd02
push dword [ebp]
push ebx
push 1
push 0xf8
push 0xffffffffffffffff
push esi
call fcn.00490d20
add esp, 0x18
test eax, eax
jle 0x48fd02
push dword [esp + 0x14]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
push esi
call fcn.00491c80
add esp, 0x14
test eax, eax
jle 0x48fd02
mov ecx, dword [esp + 0x18]
mov ebx, 1
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
push esi
call fcn.00490ff0
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0042a77e
add esp, 0x6c
ret
xor eax, eax
lea ecx, [esi + 0x2c]
mov edx, dword [ecx]
test edx, edx
je 0x48fd38
cmp dword [edi], edx
je 0x48fd62
inc eax
add ecx, 4
cmp eax, 4
jl 0x48fd25
push 0x7f
push str..cryptoevpp_sign.c
push 0x6e
push 0x6b
push 6
call fcn.004512d0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0042a77e
add esp, 0x6c
ret
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x48fd96
push 0x85
push str..cryptoevpp_sign.c
push 0x68
push 0x6b
push 6
call fcn.004512d0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0042a77e
add esp, 0x6c
ret
push dword [edi + 0x14]
mov ecx, dword [esp + 0x1c]
push ecx
push dword [esp + 0x18]
lea ecx, [esp + 0x44]
push dword [esp + 0x20]
push ecx
push dword [esi]
call eax
mov ecx, dword [esp + 0x90]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042a77e
add esp, 0x6c
ret
Function at 0x4a3460
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x4a3472
xor eax, eax
pop edi
ret
push ebp
push esi
push edi
call fcn.0047cc60
mov ecx, dword [esp + 0x1c]
add esp, 4
mov ebp, dword [esp + 0x14]
mov esi, eax
mov dword [ecx], esi
test ebp, ebp
je 0x4a3529
mov ecx, dword [edi + 0x10c]
push ebx
cmp ecx, esi
jne 0x4a34c4
test esi, esi
jle 0x4a3508
mov edx, ebp
lea ecx, [edi + 0x8c]
mov ebx, esi
lea ebx, [ebx]
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
dec ebx
jne 0x4a34b0
jmp 0x4a3508
sub eax, ecx
mov byte [ecx + edi + 0xec], 0x80
cmp eax, 1
jle 0x4a34e8
dec eax
push eax
lea eax, [edi + 0xed]
add eax, ecx
push 0
push eax
call fcn.0042b420
add esp, 0xc
test esi, esi
jle 0x4a3508
mov edx, ebp
lea ecx, [edi + 0xac]
mov ebx, esi
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
dec ebx
jne 0x4a34f6
push esi
push ebp
push ebp
push edi
call fcn.0047d0d0
add esp, 0x10
pop ebx
test eax, eax
jne 0x4a3529
push esi
push ebp
call fcn.004012d0
add esp, 8
xor eax, eax
pop esi
pop ebp
pop edi
ret
pop esi
pop ebp
mov eax, 1
pop edi
ret

Function at 0x4a63d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov eax, dword [ebp + 4]
cmp eax, dword [ecx + 4]
jge 0x4a63e7
mov edi, ecx
jmp 0x4a63eb
mov edi, ebp
mov ebp, ecx
mov ebx, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, dword [ebx + 8]
jg 0x4a63fb
mov eax, ebx
jmp 0x4a6405
push eax
push ebx
call fcn.00458a50
add esp, 8
test eax, eax
jne 0x4a640d
pop edi
pop ebp
pop ebx
ret
push esi
xor esi, esi
cmp dword [ebp + 4], esi
jle 0x4a642b
mov eax, dword [edi]
mov ecx, dword [ebp]
mov edx, dword [eax + esi*4]
mov eax, dword [ebx]
xor edx, dword [ecx + esi*4]
mov dword [eax + esi*4], edx
inc esi
cmp esi, dword [ebp + 4]
jl 0x4a6415
cmp esi, dword [edi + 4]
jge 0x4a6440
mov eax, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [eax + esi*4]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [edi + 4]
jl 0x4a6430
mov ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
pop esi
test ecx, ecx
jle 0x4a6464
mov edx, dword [ebx]
add edx, 0xfffffffc
lea edx, [edx + ecx*4]
mov eax, dword [edx]
lea edx, [edx - 4]
test eax, eax
jne 0x4a6461
dec ecx
test ecx, ecx
jg 0x4a6453
mov dword [ebx + 4], ecx
pop edi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x4bd350
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x90
call fcn.0042f7c0
mov eax, dword [0x50ad20]
xor eax, esp
mov dword [esp + 0x8c], eax
mov edx, dword [esp + 0xa4]
xor eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0xa0]
push esi
mov esi, dword [esp + 0xa0]
push edi
mov edi, dword [esp + 0xb0]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], edx
test edi, edi
je 0x4bd39f
mov eax, 1
mov dword [esi], edi
jmp 0x4bd3a1
mov edi, dword [esi]
test ebp, ebp
je 0x4bd529
push edi
call fcn.0047d120
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x4bd3d5
push str.j____int_sizeof_ctx__key_
push 0x68
push str..cryptohmachmac.c
call fcn.00454c00
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ebx, dword [esp + 0xac]
cmp eax, ebx
jge 0x4bd42d
push dword [esp + 0x10]
lea ebp, [esi + 4]
push edi
push ebp
call fcn.004806c0
add esp, 0xc
test eax, eax
je 0x4bd525
push ebx
push dword [esp + 0x1c]
push ebp
call fcn.00480860
add esp, 0xc
test eax, eax
je 0x4bd525
lea ebp, [esi + 0x4c]
push ebp
lea eax, [esi + 0x50]
push eax
lea eax, [esi + 4]
push eax
call fcn.00480620
add esp, 0xc
test eax, eax
je 0x4bd525
jmp 0x4bd461
test ebx, ebx
js 0x4bd439
cmp ebx, 0x80
jle 0x4bd44d
push str.len_0__len__int_sizeof_ctx__key_
push 0x75
push str..cryptohmachmac.c
call fcn.00454c00
add esp, 0xc
push ebx
lea eax, [esi + 0x50]
push ebp
push eax
call fcn.0042d8d0
lea ebp, [esi + 0x4c]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x4bd484
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x50]
add eax, ecx
push 0
push eax
call fcn.0042b420
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
lea ebx, [ebx]
mov al, byte [esi + ecx + 0x50]
xor al, 0x36
mov byte [esp + ecx + 0x1c], al
inc ecx
cmp ecx, 0x80
jl 0x4bd490
push edx
lea ebx, [esi + 0x1c]
push edi
push ebx
call fcn.004806c0
add esp, 0xc
test eax, eax
je 0x4bd525
push edi
call fcn.0047d120
push eax
lea eax, [esp + 0x24]
push eax
push ebx
call fcn.00480860
add esp, 0x10
test eax, eax
je 0x4bd525
xor ecx, ecx
mov al, byte [esi + ecx + 0x50]
xor al, 0x5c
mov byte [esp + ecx + 0x1c], al
inc ecx
cmp ecx, 0x80
jl 0x4bd4d0
push dword [esp + 0x10]
lea ebx, [esi + 0x34]
push edi
push ebx
call fcn.004806c0
add esp, 0xc
test eax, eax
je 0x4bd525
push edi
call fcn.0047d120
push eax
lea eax, [esp + 0x24]
push eax
push ebx
call fcn.00480860
add esp, 0x10
test eax, eax
je 0x4bd525
lea eax, [esi + 0x1c]
push eax
lea eax, [esi + 4]
push eax
call fcn.00480930
add esp, 8
test eax, eax
jne 0x4bd532
xor eax, eax
jmp 0x4bd537
test eax, eax
je 0x4bd511
jmp 0x4bd488
mov eax, 1
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042a77e
add esp, 0x90
ret
Function at 0x10280110
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x102802ee
pushal
mov esi, section.UPX1
lea edi, [esi - 0xce000]
push edi
or ebp, 0xffffffff
jmp 0x1028013a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10280141
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10280130
mov eax, 1
add ebx, ebx
jne 0x10280153
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10280164
jne 0x10280183
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10280183
dec eax
add ebx, ebx
jne 0x10280170
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10280148
add ebx, ebx
jne 0x1028017f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x102801d5
xor ecx, ecx
sub eax, 3
jb 0x1028019b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1028020a
sar eax, 1
mov ebp, eax
jmp 0x102801a6
add ebx, ebx
jne 0x102801a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10280174
inc ecx
add ebx, ebx
jne 0x102801b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10280174
add ebx, ebx
jne 0x102801c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x102801b6
jne 0x102801d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x102801b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x102801f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x102801e6
jmp 0x10280136
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x102801f4
add edi, ecx
jmp 0x10280136
pop esi
mov edi, esi
mov ecx, 0xe2d4d
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x1028022f
cmp byte [edi], 0x13
jne 0x10280214
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x10280212
lea edi, [esi + 0x277000]
mov eax, dword [edi]
or eax, eax
je 0x10280280
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x29200c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x292138]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10280235
mov ecx, edi
jns 0x10280264
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x29213c]
or eax, eax
je 0x1028027a
mov dword [ebx], eax
add ebx, 4
jmp 0x10280252
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x102802b1
cmp al, 0xef
ja 0x102802a4
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10280286
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10280293
mov ebp, dword [esi + 0x292140]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x102802e5
sub esp, 0xffffff80
jmp 0x100ad535
Function at 0x40bc50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movsx eax, word [0x436a12]
xor eax, 0x2bed860a
or dword [0x4365a8], eax
or dword [0x435e70], 0xdd3fbf9f
and dword [0x435f48], 0x55e2d949
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
test esi, esi
jle 0x40bde7
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
sub ebx, eax
mov ecx, dword [0x435a90]
mov edx, dword [0x4350d0]
imul ecx, ecx, 0xfef7a35
and edx, ecx
and edx, 0x65e36bea
mov dword [0x4350d0], edx
cmp dword [eax], edi
movzx ecx, word [0x436b84]
sbb edx, edx
imul ecx, ecx, 0x511702c6
neg edx
mov word [0x436b84], cx
sub dword [eax], edi
mov dword [0x435a1c], 0x61c5a46a
mov ecx, dword [eax]
cmp ecx, dword [ebx + eax]
movzx ecx, word [0x436c98]
sbb edi, edi
add ecx, 0x400c80a
mov word [0x436c98], cx
neg edi
mov ecx, dword [ebx + eax]
add edi, edx
sub dword [eax], ecx
add eax, 4
add dword [0x4352e0], 0xf5dd77bc
dec esi
jne 0x40bc91
pop ebx
test edi, edi
je 0x40bde7
jmp 0x40bd20
movzx ecx, word [0x4370be]
lea eax, [eax + 4]
sub ecx, 0x7d39af29
mov word [0x4370be], cx
mov ecx, dword [0x436564]
cmp dword [eax - 4], edi
mov edx, dword [0x436554]
sbb esi, esi
add ecx, 0x89eb465e
xor edx, ecx
neg esi
mov ecx, dword [0x435994]
imul ecx, edx
mov dword [0x435994], ecx
dec dword [0x436554]
sub dword [eax - 4], edi
mov edi, esi
inc dword [0x436184]
mov ecx, dword [0x436184]
add ecx, 0xf61d2e4
mov dword [0x4361b8], ecx
mov ecx, dword [0x435180]
movzx edx, word [0x436c28]
shl ecx, 9
add ecx, 0x9f6cd402
and edx, ecx
mov word [0x436c28], dx
movsx ecx, word [0x43692a]
shl ecx, 9
add ecx, 0x7b59a672
xor ecx, 0x90fc39ce
and dword [0x435054], ecx
movzx ecx, word [0x436838]
movsx edx, cx
movzx ecx, word [0x43708e]
add ecx, 0xa0b2f1dd
add ecx, edx
mov word [0x43708e], cx
test esi, esi
jne 0x40bd20
inc word [0x436880]
mov ax, word [0x436880]
cwde
xor eax, 0xd5123fa4
imul eax, dword [0x435358]
pop edi
pop esi
mov dword [0x435358], eax
pop ebp
ret
Function at 0x429ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x435e8c]
or eax, 0x328c865f
cmp eax, 0xff924b54
jle 0x429f13
imul eax, dword [0x4359b4], 0xbffbffff
mov dword [0x4359b4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00408ea0
mov ecx, edi
mov esi, eax
call fcn.00407200
cmp esi, eax
je 0x429f76
lea esp, [esp]
mov ecx, dword [0x435068]
movsx edx, word [0x4368fe]
not ecx
movzx eax, word [0x43711a]
add ecx, 0x58c36dce
xor edx, ecx
mov ecx, edi
or eax, edx
mov word [0x43711a], ax
dec word [0x4368fe]
mov byte [esi], 0
inc esi
mov dword [0x436194], 0x146fb31b
call fcn.00407200
cmp esi, eax
jne 0x429f30
mov eax, dword [0x436458]
sar eax, 0xa
or eax, 0xe1f86a81
sub dword [0x4356fc], eax
pop edi
pop esi
pop ebp
ret

Function at 0x42aaf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, word [0x437034]
mov edx, dword [ebp + 8]
imul eax, eax, 0xfc037524
or eax, 0x45d5fbaa
xor dword [0x435fc4], eax
mov eax, dword [0x4363e8]
sar eax, 1
mov dword [0x435498], eax
add dword [0x4353d8], 0x18000222
inc dword [0x43601c]
mov eax, dword [0x43601c]
cmp eax, 0xfbbeffff
jge 0x42ab60
dec dword [0x435e70]
mov eax, dword [0x435e70]
xor eax, 0x8f4b58f4
cmp eax, 0x9040d2bc
jle 0x42ab5a
add dword [0x4350b8], 0xebe4f7b0
jmp 0x42ab60
inc dword [0x4352b4]
mov eax, dword [ebp + 0xc]
add dword [0x436674], 0xd95f17f2
push esi
lea esi, [edx + eax*4]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
dec dword [0x4358c8]
mov eax, dword [0x4358c8]
movzx ecx, word [0x43695e]
and ecx, eax
mov word [0x43695e], cx
cmp edx, esi
je 0x42ac26
lea ebx, [ebx]
mov ecx, dword [0x43521c]
mov eax, dword [0x4366c0]
not eax
shl ecx, 5
add eax, 0x9b40c23c
add eax, ecx
xor dword [0x4357c4], eax
mov eax, dword [ebp - 4]
xor dword [edx], eax
add edx, 4
mov eax, dword [0x4351a4]
add eax, 0xbf2fbef1
or dword [0x436498], eax
mov eax, dword [0x4350b4]
ror dword [ebp - 4], 2
not eax
and eax, 0xf5870bb2
add dword [0x43585c], eax
add dword [0x435a20], 0x22142083
mov eax, dword [ebp - 4]
shr eax, 8
add al, byte [ebp - 4]
mov byte [ebp - 3], al
xor dword [0x435b88], 0x397f4937
mov al, byte [ebp - 3]
add byte [ebp - 4], al
mov ax, word [0x436ae6]
cwde
sub dword [0x4363dc], eax
cmp edx, esi
jne 0x42aba0
inc dword [0x435524]
mov eax, dword [0x435524]
imul ecx, eax, 0x72bed699
mov eax, dword [0x435820]
inc eax
pop esi
add eax, ecx
and dword [0x435300], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x42e7a0
Capabilities:
Hash data with md5

Disassembly:
inc dword [0x435790]
mov edx, dword [0x435790]
movzx eax, word [0x43696e]
add edx, 0xc3cf149f
imul edx, eax
push esi
mov esi, ecx
mov word [0x43696e], dx
mov dword [esi], 0
movsx eax, word [0x436d78]
sar eax, 0xa
add eax, 0x273cadc6
xor eax, 0x80e3d701
and dword [0x435980], eax
mov dword [esi + 4], 0
movzx eax, word [0x436fd0]
mov ecx, dword [0x436278]
cwde
and ecx, eax
mov eax, dword [0x435d98]
xor ecx, 0x51f9fa8f
imul eax, ecx
mov dword [0x435d98], eax
dec word [0x436fd0]
mov dword [esi + 8], 0x67452301
mov eax, dword [0x436090]
mov ecx, dword [0x435cc4]
xor eax, 0x15eb2efd
or ecx, eax
mov eax, dword [0x4355fc]
inc dword [0x435cc4]
xor eax, 0x305c9e70
inc dword [0x436090]
cmp ecx, eax
je 0x42e85b
imul eax, dword [0x436060], 0xcb1d7e91
mov dword [0x436060], eax
jmp 0x42e86d
movzx eax, word [0x436876]
xor eax, 0x89520b2d
mov word [0x436876], ax
mov dword [esi + 0xc], 0xefcdab89
mov eax, dword [0x4361c0]
movsx ecx, word [0x436a3a]
add eax, 0x5bbb15c5
xor ecx, eax
cmp ecx, 0xfffb32fe
jne 0x42e8a4
mov eax, dword [0x4359e8]
xor eax, dword [0x4351f0]
xor eax, 0x16a32744
mov dword [0x4351f0], eax
mov dword [esi + 0x10], 0x98badcfe
and dword [0x43584c], 0x2fb7feff
mov dword [esi + 0x14], 0x10325476
mov eax, dword [0x435d90]
sub eax, 0x94f05c9
or eax, 0xbd2060ad
xor dword [0x4357c0], eax
pop esi
ret
Function at 0x407741
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
xor edx, edx
mov ecx, 0x41c4c0
push 8
mov eax, edx
pop esi
mov edi, eax
and edi, 1
dec edi
not edi
and edi, 0xedb88320
shr eax, 1
xor eax, edi
dec esi
jne 0x40774f
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x41c8c0
jb 0x40774a
pop edi
pop esi
ret
Function at 0x1001f25
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address
Get number of processors

Disassembly:
mov eax, 0x100e064
call fcn.010084d8
push ecx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x24]
mov dword [ebp - 0x10], esi
call sub.framedyn.dll_public:_void___thiscall_CHString::constructor_void_
xor edi, edi
mov dword [ebp - 4], edi
lea ecx, [esi + 0x28]
call sub.framedyn.dll_public:_void___thiscall_CHString::constructor_void_
mov byte [ebp - 4], 1
lea ecx, [esi + 0x2c]
call sub.framedyn.dll_public:_void___thiscall_CHString::constructor_void_
mov byte [ebp - 4], 2
lea ecx, [esi + 0x30]
call sub.framedyn.dll_public:_void___thiscall_CHString::constructor_void_
mov byte [ebp - 4], 3
lea ecx, [esi + 0x58]
call sub.framedyn.dll_public:_void___thiscall_CHString::constructor_void_
mov byte [ebp - 4], 4
lea ecx, [esi + 0x60]
call sub.framedyn.dll_public:_void___thiscall_CHString::constructor_void_
mov byte [ebp - 4], 5
lea ecx, [esi + 0x64]
call sub.framedyn.dll_public:_void___thiscall_CHString::constructor_void_
mov byte [ebp - 4], 6
lea ecx, [esi + 0x70]
call sub.framedyn.dll_public:_void___thiscall_CHString::constructor_void_
mov byte [ebp - 4], 7
lea ecx, [esi + 0x74]
call sub.framedyn.dll_public:_void___thiscall_CHString::constructor_void_
mov byte [ebp - 4], 8
mov dword [esi], edi
mov dword [esi + 8], edi
mov dword [esi + 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xd0], edi
mov dword [esi + 0xd4], edi
mov dword [esi + 0xd8], edi
mov dword [esi + 0xdc], 1
mov dword [esi + 0xa0], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1002071
Capabilities:
Acquire debug privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push 0x28
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100209f
call fcn.01008ae2
xor eax, eax
jmp 0x10020f6
push esi
lea eax, [ebp - 0xc]
push eax
push 0x1001300
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x10020e3
mov eax, dword [ebp - 0xc]
push edi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push edi
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 4]
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x10020ea
call fcn.01008ae2
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
leave
ret