joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459b36
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov dl, byte [0x460a68]
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x20f]
mov byte [ebp - 0x210], dl
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.0044906a
pop ecx
lea eax, [ebp - 0x210]
pop ecx
push esi
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
or ebx, 0xffffffff
lea edi, [ebp - 0x210]
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, 0x411228
sub esi, ecx
mov edi, edx
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jbe 0x459c00
mov edi, edx
mov ecx, ebx
repne scasb al, byte es:[edi]
lea esi, [ebp - 0x210]
not ecx
mov eax, esi
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, eax
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x210]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edi, edi
cmp dword [0x5361d8], edi
je 0x459c21
mov ecx, dword [ebp - 4]
push 1
push edi
push edi
lea eax, [ebp - 0x10c]
push edi
push eax
push edi
call fcn.00458f52
jmp 0x459c73
lea eax, [ebp - 0x10c]
test eax, eax
jne 0x459c2f
xor ebx, ebx
jmp 0x459c64
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.0045e9a0
mov ebx, esp
push esi
push ebx
lea eax, [ebp - 0x10c]
push 0xffffffffffffffff
push eax
push edi
push edi
mov word [ebx], di
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 4]
push 1
push edi
push edi
push edi
push ebx
push edi
call fcn.0045948f
lea esp, [ebp - 0x21c]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x459ea5
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xc]
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 1
push eax
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x10], 0x454
mov dword [ebp - 6], 0x460a68
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb eax, eax
pop edi
inc eax
leave
ret 8
Function at 0x45d0bd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe60
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x3e8
mov ebx, ecx
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x18]
push eax
push edi
call esi
lea eax, [ebp - 0x10]
push eax
push edi
call esi
mov eax, dword [ebp - 0xc]
xor esi, esi
sub eax, dword [ebp - 0x14]
push esi
push dword [0x536190]
push 0x7000
push edi
push eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x52010a44
push esi
push 0x40a91c
push 0x60010
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x1c], edi
jne 0x45d142
xor eax, eax
jmp 0x45d28d
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x477d24]
push 0x30
push edi
call esi
push 0
push 0xfffffffffffffffc
push 4
push edi
call fcn.0044a1b3
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
movzx eax, ax
mov ecx, eax
shl ecx, 0x10
or ecx, eax
push ecx
push 0
push 0x43b
push edi
call esi
push 0
push 0x14
push 0x41e
push edi
call esi
push dword [ebx + 0xe0]
push 0
push 0x430
push edi
call esi
push 0xc0002
push 0
push 0x457
push edi
call esi
push 0
push 0
push 0x420
push edi
call esi
mov eax, 0xffffff
mov dword [ebp - 0x28], 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x2002
push edi
call esi
and dword [ebp - 8], 0
cmp dword [ebx + 0xa8], 0
jle 0x45d25b
lea eax, [ebp - 0xe60]
lea edi, [ebp - 0x11c]
mov dword [ebp + 8], eax
lea eax, [ebx + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push 0x104
push dword [ebp + 8]
mov dword [edi - 0x10], eax
mov eax, dword [ebp - 4]
push dword [eax]
push dword [0x536190]
call dword [sym.imp.USER32.dll_LoadStringA]
mov eax, dword [ebp + 8]
add dword [ebp - 4], 4
mov dword [edi], eax
mov eax, dword [ebp - 8]
add dword [ebp + 8], 0x104
add edi, 0x14
lea ecx, [eax + 0x7000]
mov dword [edi - 0x20], ecx
mov byte [edi - 0x1c], 4
mov byte [edi - 0x1b], 0x40
and dword [edi - 0x18], 0
inc eax
cmp eax, dword [ebx + 0xa8]
mov dword [ebp - 8], eax
jl 0x45d202
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x12c]
push eax
push dword [ebx + 0xa8]
push 0x414
push edi
call esi
push 0
push 0
push 0x421
push edi
call esi
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebx + 0xe8], edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x45d2bb
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, dword [esi + edi*4 + 0x74]
test eax, eax
je 0x45d2df
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x45d36a
push ebx
push 0x3e9
push dword [esi + 0xe4]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0xe4]
call ebx
lea eax, [ebp - 8]
push eax
push dword [esi + 0xe4]
call ebx
movzx eax, word [esi + edi*4 + 0x40]
push esi
push dword [esi + edi*4 + 0xac]
push dword [esi + 0xe4]
push eax
push dword [0x536190]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
sub edx, ecx
sub edx, 4
push 4
push edx
mov edx, dword [ebp - 0x10]
sub ebx, edx
add ecx, 2
sub ebx, 4
add edx, 2
push ebx
push ecx
push edx
push 0
push eax
mov dword [esi + edi*4 + 0x74], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop ebx
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [esi + edi*4 + 0x74]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 0xc]
lea eax, [edi + 0x7000]
push eax
push 0x402
push dword [esi + 0xe8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp + 0xc], 0
je 0x45d3ae
mov dword [esi + 0xec], edi
mov dword [0x476678], edi
jmp 0x45d3b5
or dword [esi + 0xec], 0xffffffff
pop edi
pop esi
leave
ret 8

Function at 0x45d620
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0x40
push eax
push 0x53aa70
call fcn.0045d960
push 0x40
push 0x4031d0
push 0x53aa70
push 0x53aa70
call fcn.0045d880
mov al, byte [esp + 0x3c]
add esp, 0x1c
test al, al
jne 0x45d6ab
mov ebx, dword [esp + 0x1c]
mov ebp, 0x10
mov eax, dword [0x4114a4]
mov ecx, 8
mov esi, eax
mov edi, 0x53aab0
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0045d7c0
mov ecx, dword [0x4114a0]
mov edx, dword [0x4114a4]
push 0x20
push ecx
push edx
call fcn.0045d8d0
mov edi, dword [0x4114a0]
add esp, 0x14
mov ecx, 8
mov esi, 0x53aab0
add ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x45d65f
jmp 0x45d704
mov eax, dword [esp + 0x1c]
mov ebp, 0x10
lea ebx, [eax + 0x2d0]
mov eax, dword [0x4114a0]
mov ecx, 8
mov esi, eax
mov edi, 0x53aab0
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0045d7c0
mov ecx, dword [0x4114a4]
mov edx, dword [0x4114a0]
push 0x20
push ecx
push edx
call fcn.0045d8d0
mov edi, dword [0x4114a4]
add esp, 0x14
mov ecx, 8
mov esi, 0x53aab0
sub ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x45d6ba
push 0x40
push 0x403210
push 0x53aa70
push 0x53aa70
call fcn.0045d880
mov eax, dword [esp + 0x24]
push 0x40
push 0x53aa70
push eax
call fcn.0045d9a0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x45d740
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0x40
push eax
push 0x53ab20
call fcn.0045d960
push 0x38
push str.91__
push 0x53ab20
push 0x53ab20
call fcn.0045d880
mov edi, dword [esp + 0x28]
add esp, 0x1c
xor esi, esi
movsx ecx, byte [esi + 0x403308]
mov edx, dword [0x4114a8]
push ecx
push 0x1c
push edx
call fcn.0045d900
movsx eax, byte [esi + 0x403308]
mov ecx, dword [0x4114ac]
push eax
push 0x1c
push ecx
call fcn.0045d900
push 0x30
push 0x4032d8
push 0x53ab20
push edi
call fcn.0045d880
add esp, 0x28
inc esi
add edi, 0x30
cmp esi, 0x10
jl 0x45d772
pop edi
pop esi
ret

Function at 0x45d7c0
Capabilities:
Encrypt data using des

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x30
push 0x403250
push esi
push 0x53aad0
call fcn.0045d880
mov eax, dword [esp + 0x1c]
push 0x30
push eax
push 0x53aad0
call fcn.0045d8d0
push 0x53aad0
push esi
call fcn.0045d810
push 0x20
push 0x403280
push esi
push esi
call fcn.0045d880
add esp, 0x34
pop esi
ret

Function at 0x45d8d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x45d8f2
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x45d8e4
pop ebx
pop esi
ret

Function at 0x45da6f
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.0045daa5
test eax, eax
je 0x45da86
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x4023be
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x41d5dc
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x410
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 4], ebx
jne 0x4023e8
xor eax, eax
jmp 0x4023eb
mov eax, dword [edi + 0x20]
push dword [0x429614]
push eax
lea eax, [ebp - 0x14]
push str.handle_dmessage_dparentQQDownload
push eax
call sub.MFC42.DLL_CString::Format
push 0x400
lea eax, [ebp - 0x41c]
push ebx
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x41c]
push ebx
push eax
call fcn.00408b6b
add esp, 0x24
lea eax, [ebp - 0x41c]
lea ecx, [ebp - 0x18]
push eax
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x18]
push str.QQDeskUpdate.exe
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 1
call sub.MFC42.DLL_operator
mov eax, dword [eax]
push 4
push ebx
push dword [ebp - 0x14]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00410848
cmp esi, 0x20
jle 0x40247c
push ebx
push 0x64
push 2
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
cmp esi, 0x20
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
setg byte [ebp - 0xd]
call fcn.00410848
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00410848
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40639c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov ecx, dword [ebp + 8]
push ebx
mov dword [ebp - 8], 4
push dword [eax]
xor ebx, ebx
mov byte [ebp - 1], bl
push ebx
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_int__unsigned_int_]
mov ecx, dword [ebp + 8]
push 0x10
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_int_]
lea eax, [ebp - 0xc]
push eax
push str.metnsdclsid
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x406442
push esi
lea eax, [ebp - 8]
push edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push ebx
mov edi, str.SequenceID
push ebx
push edi
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x406437
cmp dword [ebp - 8], 0x10
jne 0x406437
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], ebx
je 0x40641d
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Freeze_void_]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
jmp 0x406422
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [ebp - 8]
push ecx
push eax
push ebx
push ebx
push edi
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x406437
mov byte [ebp - 1], 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, byte [ebp - 1]
pop ebx
leave
ret 4
Function at 0x409fcd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
push esi
push 0x64
lea eax, [ebp - 0x70]
push 0
push eax
call sub.MSVCRT.dll_memset
movzx eax, byte [ebp + 0x14]
movzx ecx, byte [ebp + 0x15]
shl eax, 8
or eax, ecx
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
movzx ecx, byte [ebp + 0x16]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp + 0x17]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp + 0x13]
push eax
movzx eax, byte [ebp + 0x12]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp + 0x11]
push eax
movzx eax, byte [ebp + 0x10]
shl eax, 8
or eax, ecx
push eax
movzx eax, word [ebp + 0xe]
push eax
movzx eax, word [ebp + 0xc]
push eax
lea eax, [ebp - 0x70]
push dword [ebp + 8]
push str._X__X__X__X__X_X
push eax
call esi
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x174]
push str.CLSID_sLocalServer32
push eax
call esi
add esp, 0x38
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x174]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x40a071
xor eax, eax
jmp 0x40a0a7
push 1
lea eax, [ebp - 0xc]
pop esi
mov dword [ebp - 0xc], 0x104
push eax
lea eax, [ebp - 8]
push dword [ebp + 0x18]
mov dword [ebp - 8], esi
push eax
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40a09c
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0x14

Function at 0x40c2f4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41e5d0
call sub.MSVCRT.dll__EH_prolog
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
or dword [esi + 8], 0xffffffff
or dword [esi + 4], 0xffffffff
mov dword [esi], 0x420a70
mov al, byte [ebp + 0xb]
xor edi, edi
lea ecx, [esi + 0x1c]
push edi
mov dword [ebp - 4], edi
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi], 0x420a54
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40de32
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41e878
call sub.MSVCRT.dll__EH_prolog
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
or dword [esi + 8], 0xffffffff
or dword [esi + 4], 0xffffffff
mov dword [esi], 0x420a70
mov al, byte [ebp - 0xd]
xor edi, edi
lea ecx, [esi + 0x10]
push edi
mov dword [ebp - 4], edi
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x20]
push edi
mov byte [ebp - 4], 1
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0xc], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi], 0x420af0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40de99
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41e8a4
call sub.MSVCRT.dll__EH_prolog
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
or dword [esi + 8], 0xffffffff
or dword [esi + 4], 0xffffffff
mov dword [esi], 0x420a70
mov al, byte [ebp + 0xb]
and dword [ebp - 4], 0
lea edi, [esi + 0x10]
push 0
mov ecx, edi
mov byte [edi], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp + 0xb]
lea ebx, [esi + 0x20]
push 0
mov ecx, ebx
mov byte [ebp - 4], 1
mov byte [ebx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push dword [ebp + 8]
mov byte [ebp - 4], 2
mov dword [esi], 0x420af0
call sub.MSVCRT.dll_strlen
pop ecx
push eax
mov ecx, edi
push dword [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
pop ecx
push eax
mov ecx, ebx
push dword [ebp + 0xc]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40f651
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
ret
Function at 0x41037d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
test edx, edx
je 0x4104a0
mov esi, dword [ebp + 0x10]
test esi, esi
jle 0x4104a0
mov eax, dword [ebp + 8]
push ebx
cmp esi, 8
push edi
not eax
mov ecx, 0xff
jl 0x41047d
mov edi, esi
shr edi, 3
mov ebx, edi
neg ebx
lea esi, [esi + ebx*8]
mov dword [ebp + 0x10], esi
movzx ebx, byte [edx]
mov esi, eax
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x420b1c]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x420b1c]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x420b1c]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x420b1c]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x420b1c]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x420b1c]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x420b1c]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x420b1c]
xor eax, esi
inc edx
dec edi
jne 0x4103bb
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x41049a
movzx ebx, byte [edx]
mov edi, eax
and edi, ecx
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x420b1c]
xor eax, edi
inc edx
dec esi
jne 0x410481
pop edi
pop ebx
not eax
jmp 0x4104a3
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x410f52
Capabilities:
Terminate process

Disassembly:
push edi
call fcn.00410f4c
mov edi, eax
cmp dword [edi + 0x22c], 0
je 0x410f6f
mov eax, dword [esp + 8]
mov dword [edi + 0x230], eax
pop edi
ret
push ebx
push ebp
push esi
push str._nMIRACL_error_from_routine
call 0x43bedb
pop ecx
mov eax, dword [edi + 0x20]
mov ebp, 0x42941c
cmp eax, 0x18
jge 0x410f97
mov eax, dword [edi + eax*4 + 0x24]
push dword [eax*4 + 0x428904]
jmp 0x410f98
push ebp
call fcn.00411131
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov ebx, dword [sym.imp.MSVCRT.dll_fputc]
pop ecx
add eax, 0x20
push eax
push 0xa
call ebx
mov esi, dword [edi + 0x20]
pop ecx
dec esi
pop ecx
js 0x410ff6
lea edi, [edi + esi*4 + 0x24]
push str.______________called_from
call fcn.00411131
cmp esi, 0x18
pop ecx
jge 0x410fd8
mov eax, dword [edi]
push dword [eax*4 + 0x428904]
jmp 0x410fd9
push ebp
call fcn.00411131
mov eax, dword [sym.imp.MSVCRT.dll__iob]
pop ecx
add eax, 0x20
push eax
push 0xa
call ebx
dec esi
pop ecx
sub edi, 4
pop ecx
test esi, esi
jge 0x410fbd
mov eax, dword [esp + 0x14]
pop esi
dec eax
pop ebp
cmp eax, 0x17
pop ebx
ja case.default.0x411007
jmp dword [eax*4 + 0x4110d1]
push str.Number_base_too_big_for_representation_n
jmp 0x4110c3
push str.Division_by_zero_attempted_n
jmp 0x4110c3
push str.Overflow___Number_too_big_n
jmp 0x4110c3
push str.Internal_result_is_negative_n
jmp 0x4110c3
push str.Input_format_error_n
jmp 0x4110c3
push str.Illegal_number_base_n
jmp 0x4110c3
push str.Illegal_parameter_usage_n
jmp 0x4110c3
push str.Out_of_space_n
jmp 0x4110c3
push str.Even_root_of_a_negative_number_n
jmp 0x4110c3
push str.Raising_integer_to_negative_power_n
jmp 0x4110c3
push str.Attempt_to_take_illegal_root_n
jmp 0x4110c3
push str.Integer_operation_attempted_on_Flash_number_n
jmp 0x4110c3
push str.Flash_overflow_n
jmp 0x4110c3
push str.Numbers_too_big_n
jmp 0x4110c3
push str.Log_of_a_non_positive_number_n
jmp 0x4110c3
push str.Flash_to_double_conversation_failure_n
jmp 0x4110c3
push str.I_O_buffer_overflow_n
jmp 0x4110c3
push str.MIRACL_not_initialised___no_call_to_mirsys___n
jmp 0x4110c3
push str.Illegal_modulus__n
jmp 0x4110c3
push str.No_modulus_defined_n
jmp 0x4110c3
push str.Exponent_too_big_n
jmp 0x4110c3
push str.Number_Base_must_be_power_of_2_n
jmp 0x4110c3
push str.Specified_double_length_type_isnt_double_length_n
jmp 0x4110c3
push str.Specified_basis_is_NOT_irreducible_n
call fcn.00411131
pop ecx
push 0
call dword [sym.imp.MSVCRT.dll_exit]
push cs
adc byte [ecx], al
sbb byte [eax], dl
inc ecx
add byte [edx], ah
adc byte [ecx], al
sub al, 0x10
inc ecx
add byte [esi], dh
adc byte [ecx], al
inc eax
adc byte [ecx], al
inc edi
adc byte [ecx], al
dec esi
adc byte [ecx], al
push ebp
adc byte [ecx], al
pop esp
adc byte [ecx], al
arpl word [eax], dx
inc ecx
add byte [edx + 0x10], ch
inc ecx
add byte [ecx + 0x10], dh
inc ecx
add byte [eax + 0x10], bh
inc ecx
add byte [edi + 0x10], bh
inc ecx
add byte [esi - 0x72ffbef0], al
adc byte [ecx], al
xchg esp, eax
adc byte [ecx], al
wait
adc byte [ecx], al
mov byte [0xa9004110], al
adc byte [ecx], al
mov al, 0x10
inc ecx
add byte [edi - 0x41ffbef0], dh
adc byte [ecx], al