joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e1f4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp], edx
mov esi, eax
mov dl, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
mov al, byte [esi + 1]
xor ecx, ecx
mov cl, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
mov dl, byte [esi + 2]
xor ecx, ecx
mov cl, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
mov al, byte [esi + 3]
xor ecx, ecx
mov cl, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
xor edx, edx
mov dl, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
mov al, byte [esi + 4]
shl eax, 3
and al, 0xff
xor edx, edx
mov dl, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
mov al, byte [esi + 5]
shl eax, 2
and al, 0xff
xor edx, edx
mov dl, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
mov al, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov edi, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
xor ebx, ebx
mov bl, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x45e2a0
mov dl, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x45e29b
mov eax, ebp
mov edx, 8
call fcn.00404cb4
push 1
mov eax, ebp
call fcn.00404b80
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.0045a9b4
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45fe84
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x45fe8d
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x46003d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004601cc
xor eax, eax
push ebp
push 0x46001b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x45fedc
call fcn.004040ac
jmp 0x460022
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x45ffaa
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x45ff30
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x45ff30
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0045fe38
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004049e8
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x45ff69
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0045fe38
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004049e8
mov eax, dword [ebp - 0x14]
call fcn.00404b28
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x460005
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0045fe38
push dword [ebp - 0x20]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
push 0x460058
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004049e8
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0045fe58
jmp 0x460005
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x45ffcc
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x45ffcc
push ebx
mov edi, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x45ffe2
mov eax, ebx
call fcn.00404b28
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x460005
lea eax, [ebp - 0x24]
mov ecx, 0x460058
mov edx, ebx
call fcn.00404974
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.0045fe58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460022
mov eax, dword [ebp - 4]
call fcn.004601d8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460044
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.0040468c
ret

Function at 0x460b34
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00461600
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x474824
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 2
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, 4
mov ecx, esi
xor eax, eax
call fcn.00404d18
cmp byte [ebp - 1], 0
jne 0x474882
mov eax, esi
call fcn.00404b80
mov dl, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov al, byte [ebp - 1]
sub al, 1
jb 0x47489b
sub al, 2
jb 0x4748a2
jmp 0x4748a7
mov ebx, 2
jmp 0x4748a7
mov ebx, 1
mov eax, esi
call fcn.00404b80
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x474989
test edi, edi
jle 0x474903
mov eax, esi
call fcn.00404b80
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.00404b80
mov byte [eax + ebx - 1], 0
jmp 0x47497d
test edi, edi
jge 0x474949
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.00404b80
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x47497d
mov eax, esi
call fcn.00404b80
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dl, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
mov cl, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.00404b80
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4748bf
mov al, byte [ebp - 1]
sub al, 1
jb 0x474999
sub al, 2
jb 0x4749d2
jmp 0x474a19
cmp edi, 2
jne 0x47499f
dec ebx
mov eax, ebx
sub eax, 2
jl 0x474a19
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.00404b80
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x479324]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4749af
jmp 0x474a19
cmp edi, 2
jne 0x4749d8
dec ebx
test ebx, ebx
jle 0x474a14
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.00404b80
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x479328]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4749e4
jmp 0x474a14
inc ebx
mov eax, esi
call fcn.00404b80
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x474a07
mov eax, esi
mov edx, ebx
call fcn.00404cb4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x475638
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x14], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b18
xor eax, eax
push ebp
push 0x47580c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x400
call fcn.004085d8
mov esi, eax
mov eax, 0x400
call fcn.004085d8
mov ebx, eax
mov dword [ebp - 0x64], 0xc
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], 0xffffffff
push 0
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_CreatePipe
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4757e1
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.004030f4
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 0x101
mov word [ebp - 0x28], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00409264
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push esi
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x475725
mov eax, ebx
call fcn.0040275c
mov eax, esi
call fcn.0040275c
jmp 0x4757e1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 1
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_PeekNamedPipe
test eax, eax
je 0x47579a
cmp dword [ebp - 0x10], 0
je 0x47578b
push 0
lea eax, [ebp - 0x10]
push eax
push 0x200
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x47579a
mov eax, dword [ebp - 0x10]
mov byte [ebx + eax], 0
lea eax, [ebp - 0x78]
mov edx, ebx
call fcn.00404860
mov edx, dword [ebp - 0x78]
lea ecx, [ebp - 0x14]
mov eax, dword [edi]
call fcn.004755ec
jmp 0x47572e
push 0
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x47572e
mov eax, dword [ebp - 0x10]
mov byte [ebx + eax], 0
lea eax, [ebp - 0x7c]
mov edx, ebx
call fcn.00404860
mov edx, dword [ebp - 0x7c]
lea ecx, [ebp - 0x14]
mov eax, dword [edi]
call fcn.004755ec
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
call fcn.0040275c
mov eax, esi
call fcn.0040275c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475813
lea eax, [ebp - 0x7c]
mov edx, 2
call fcn.0040468c
lea eax, [ebp - 0x14]
call fcn.00404668
lea eax, [ebp - 4]
call fcn.00404668
ret
Function at 0x476198
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b18
xor eax, eax
push ebp
push 0x4762e3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.00404b28
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.0040273c
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x4762c6
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x476250
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push ebx
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4762f4
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 8]
shr ebx, 0x10
mov si, word [eax + 8]
and si, 0xffff
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 0xa], dx
mov di, word [eax + 0xc]
and di, 0xffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47626e
mov eax, dword [ebp - 8]
push eax
movzx eax, bx
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
movzx eax, si
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
movzx eax, word [ebp - 0xa]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, di
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x40]
mov ecx, 3
mov eax, 0x476300
call fcn.004098d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4762cd
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.0040275c
ret
Function at 0x477464
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b18
xor eax, eax
push ebp
push 0x4775af
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.00404b28
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.0040273c
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x477592
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x47751c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push ebx
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4775c0
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 8]
shr ebx, 0x10
mov si, word [eax + 8]
and si, 0xffff
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 0xa], dx
mov di, word [eax + 0xc]
and di, 0xffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47753a
mov eax, dword [ebp - 8]
push eax
movzx eax, bx
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
movzx eax, si
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
movzx eax, word [ebp - 0xa]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, di
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x40]
mov ecx, 3
mov eax, 0x4775cc
call fcn.004098d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477599
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.0040275c
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x419b00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret
Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
test ecx, ecx
jne 0x401012
lea ecx, [edi + 0x20]
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x34], eax
lea eax, [edi + 0x18]
pushal
pushfd
mov dword [0x4588da], ebx
add ebx, edx
mov esi, eax
mov esi, dword [0x439730]
shl eax, 0xc
rol esi, 0x15
xchg edx, eax
or esi, edi
mov esi, eax
and esi, 0x28de17d0
sub esi, 0x13b0f82e
rol eax, 0x15
not edx
rol esi, 0xb
xor edi, eax
xchg esi, eax

Function at 0x4010a7
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call fcn.0041c87e
and esi, edi
add ecx, 0x7341acc
and esi, edi
test eax, 0x2302a1c8
jb 0x4010be
dec eax
or eax, 0x3af2e9ec
sub ecx, dword [0x43903c]
not esi
add edx, 0x28e330f
sub ecx, dword [0x4393b2]
add byte [esi - 0x75], cl
lds ecx, [ecx]
invalid
mov ecx, 0xea8f48
inc esi
ror esi, 0xa
xor dword [0x458a92], ecx
xchg esi, eax
test ebp, esp
jo 0x401057
inc esi
shr eax, 0xb
call fcn.00421711
sub esi, dword [0x439bc4]
test ecx, edx
jb 0x4010dc
loop 0x401093
shr eax, 1
add eax, edi
xor esi, eax
or esi, edi
test eax, edx
jo 0x4010f8
invalid
shl esi, 0x1e
dec ecx
mov edx, 0x280ad3e8
and eax, 0x34f358
call fcn.00421711
mov edi, eax
neg esi
add ebx, eax
fiadd word [ebx]
fdiv st(7)
neg eax
mov ecx, 0x613eba
jmp 0x401112

Function at 0x4010df
Capabilities:
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call fcn.0041c87e
and esi, edi
add ecx, 0x7341acc
and esi, edi
test eax, 0x2302a1c8
jb 0x4010be
dec eax
or eax, 0x3af2e9ec
sub ecx, dword [0x43903c]
not esi
add edx, 0x28e330f
sub ecx, dword [0x4393b2]
add byte [esi - 0x75], cl
lds ecx, [ecx]
invalid
mov ecx, 0xea8f48
inc esi
ror esi, 0xa
xor dword [0x458a92], ecx
xchg esi, eax
test ebp, esp
jo 0x401057
inc esi
shr eax, 0xb
call fcn.00421711
sub esi, dword [0x439bc4]
test ecx, edx
jb 0x4010dc
loop 0x401093
shr eax, 1
add eax, edi
xor esi, eax
or esi, edi
test eax, edx
jo 0x4010f8
invalid
shl esi, 0x1e
dec ecx
mov edx, 0x280ad3e8
and eax, 0x34f358
call fcn.00421711
mov edi, eax
neg esi
add ebx, eax
fiadd word [ebx]
fdiv st(7)
neg eax
mov ecx, 0x613eba
jmp 0x401112

Function at 0x40119b
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
ret 0xfe21
jb 0x401177
xor esi, dword [0x439119]
add edx, ebx
mov edi, edi
inc eax
xor edi, esp
Function at 0x4014c3
Capabilities:
Hash data using murmur3

Disassembly:
inc ebp
add ah, dh
lodsd eax, dword [esi]
test dword [ecx], 0x18cce8
add cl, al
rcl byte [ecx], 0xe8
and eax, dword es:[eax]
add byte [ebx], ch
or eax, 0x458d36

Function at 0x4014e1
Capabilities:
Hash data using murmur3

Disassembly:
sbb byte [eax], al
add bh, al
add eax, 0x458979
fbstp tbyte [esi + 0x2b480ec1]
aam 0xf7
ror byte [eax + 0x6a], 1
add cl, al
into
sbb byte [ebx], ch
xor eax, 0x458ee6

Function at 0x401546
Capabilities:
Hash data using murmur3

Disassembly:
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x458a7d35], cx
add byte [edi + 0x2b], al
fdiv dword [ebx]
cld
Function at 0x4054c8
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x441494], 2
jl 0x4054ed
movaps xmm0, xmmword [0x42f400]
movaps xmmword [0x439bb0], xmm0
movaps xmm0, xmmword [0x42f3f0]
movaps xmmword [0x439bc0], xmm0
push esi
mov esi, dword [esp + 8]
mov ecx, esi
call fcn.00405893
xor edx, edx
mov ecx, dword [esi + 0xf4]
mov eax, dword [edx + 0x42f3c8]
mov dword [edx + ecx], eax
add edx, 4
cmp edx, 0x20
jl 0x4054fb
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0xc]
xor dword [ecx + 8], eax
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0x10]
or eax, 0x2000
shl eax, 0x10
xor dword [ecx + 0xc], eax
pop esi
ret 0xc

Function at 0x405c44
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x405c76
test dl, 7
je 0x405c76
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x439bd8]
inc edx
mov dword [ebp + 0xc], edx
sub esi, 1
jne 0x405c56
cmp esi, 8
jb 0x405d06
push edi
mov edi, esi
shr edi, 3
xor ebx, dword [edx]
sub esi, 8
mov edx, dword [edx + 4]
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
movzx eax, al
mov ecx, dword [ecx*4 + 0x439bd8]
xor ecx, dword [eax*4 + 0x439fd8]
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43a3d8]
mov eax, ebx
ret
shr eax, 0x18
xor ecx, dword [eax*4 + 0x43abd8]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x43afd8]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43b3d8]
movzx eax, dl
mov edx, dword [ebp + 0xc]
add edx, 8
mov dword [ebp + 0xc], edx
xor ecx, dword [eax*4 + 0x43a7d8]
movzx eax, bl
xor ecx, dword [eax*4 + 0x43b7d8]
mov ebx, ecx
sub edi, 1
jne 0x405c85
pop edi
test esi, esi
je 0x405d22
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x439bd8]
inc edx
sub esi, 1
jne 0x405d0a
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x405e8f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x20
pop ebx
cmp dword [esi], 2
jne 0x405edd
mov eax, dword [esi + 4]
push edi
mov dword [ebp + 8], eax
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0xc]
call fcn.00406543
xor edx, edx
mov dword [esi + 4], edx
mov edi, edx
movzx eax, byte [ebp + edx - 0x20]
mov ecx, edx
and ecx, 3
shl ecx, 3
shl eax, cl
xor edi, eax
inc edx
cmp edx, ebx
jb 0x405ec3
mov dword [esi + 4], edi
pop edi
cmp dword [esi], 3
jne 0x405f02
lea eax, [ebp - 0x20]
add esi, 4
push eax
push ebx
push esi
push ebx
push dword [ebp + 0xc]
call fcn.00406543
push ebx
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0041ee90
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8