joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011651
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10171b0]
push esi
mov esi, ecx
cmp dword [esi + 0x44], 0
mov dword [ebp - 4], eax
push edi
je 0x10116dc
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x430
push dword [esi + 0x40]
call edi
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
lea edx, [ebp - 0x210]
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
je 0x10116a7
xor eax, eax
jmp 0x10116df
lea eax, [ebp - 0x210]
push eax
push 0xff3
push dword [esi + 0x40]
call edi
push eax
call fcn.010110ec
lea eax, [ebp - 0x210]
push eax
push 0
push 0x478
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.010120d7
leave
ret

Function at 0x10118af
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x20
push ebp
push esi
push 1
xor ebp, ebp
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, ebp
jne 0x10118d1
pop esi
pop ebp
add esp, 0x20
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push edi
push 0x14
push 0x1002174
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
mov edi, eax
call ebx
cmp edi, ebp
jne 0x10118fd
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x101191d
push edi
call ebx
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x18], 4
jne 0x101192e
push edi
call ebx
xor eax, eax
jmp 0x10119e1
push ebp
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x101194b
push edi
call ebx
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
xor ebp, ebp
add esi, 0x15f90
inc ebp
mov dword [esp + 0x10], 0x435
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10119d0
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x10119c8
cmp eax, 3
je 0x10119c8
cmp eax, 4
je 0x10119c3
cmp eax, 5
jbe 0x1011991
cmp eax, 7
jbe 0x10119c8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, esi
jae 0x10119c8
mov eax, dword [esp + 0x2c]
push 0xa
xor edx, edx
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jb 0x10119b8
mov ecx, 0x2710
cmp eax, ecx
jbe 0x10119ba
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10119ca
and dword [esp + 0x10], 0
xor ebp, ebp
test ebp, ebp
jne 0x1011964
jmp 0x10119da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
push edi
call ebx
mov eax, dword [esp + 0x10]
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20
ret
Function at 0x10120d7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10171b0]
jne 0x10120e0
ret
jmp 0x10120e5
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x10171b0]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x1017304]
test eax, eax
je 0x1012109
call eax
cmp dword [0x1017308], 0
je 0x1012150
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x1017308]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.010120d7
add ebp, 0x2a8
leave
ret
Function at 0x101218d
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xb0
mov eax, dword [0x10171b0]
and word [ebp - 0x34], 0
push ebx
push esi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
and dword [ebp - 0x40], 0
push 0x27
pop ecx
mov dword [ebp + 0x6c], eax
xor eax, eax
lea edi, [ebp - 0x32]
rep stosd dword es:[edi], eax
push 0x50
pop ebx
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x23
mov edi, 0x400
push edi
call esi
test eax, eax
je 0x1012261
xor eax, eax
cmp word [ebp - 0x34], 0x30
sete al
test eax, eax
mov dword [ebp - 0x38], eax
je 0x1012207
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x1005
push edi
call esi
test eax, eax
je 0x1012261
xor eax, eax
cmp word [ebp - 0x34], 0x31
sete al
mov dword [ebp - 0x40], eax
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x25
push edi
call esi
test eax, eax
je 0x1012261
xor eax, eax
cmp word [ebp - 0x34], 0x31
push ebx
sete al
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x34]
push eax
push 0x1e
push edi
call esi
xor esi, esi
cmp eax, esi
je 0x1012261
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [ebp + 0x7c]
xor ecx, ecx
cmp dword [ebp - 0x3c], esi
setne cl
add eax, ecx
mov ecx, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
and ecx, 3
lea eax, [eax + ecx + 4]
cmp eax, ebx
jbe 0x101225d
xor eax, eax
cmp eax, esi
jne 0x1012274
push dword [ebp + 0x7c]
push 0x100276c
push dword [ebp + 0x78]
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x10122e2
cmp dword [ebp - 0x38], esi
mov edi, dword [ebp + 0x78]
mov word [edi], si
je 0x1012299
cmp dword [ebp - 0x40], esi
je 0x1012291
push ebx
push 0x1002764
push edi
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push ebx
mov ebx, 0x1002760
jmp 0x101229f
push ebx
mov ebx, 0x100275c
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push ebx
push edi
call esi
cmp dword [ebp - 0x3c], 0
je 0x10122b6
push dword [ebp + 0x7c]
push ebx
push edi
call esi
push dword [ebp + 0x7c]
lea eax, [ebp - 0x34]
push eax
push edi
call esi
push dword [ebp + 0x7c]
push 0x1002754
push edi
call esi
cmp dword [ebp - 0x38], 0
je 0x10122e2
cmp dword [ebp - 0x40], 0
jne 0x10122e2
push dword [ebp + 0x7c]
push 0x100274c
push edi
call esi
mov ecx, dword [ebp + 0x6c]
pop edi
pop esi
pop ebx
call fcn.010120d7
add ebp, 0x70
leave
ret 8
Function at 0x41f2fb
Capabilities:
Encode data using xor

Disassembly:
arpl di, cx
cmpsd dword [esi], dword es:[edi]
xor dword [esi + 0x23], ecx
or ecx, dword [edx]
dec ebx
ror byte [0xc7319029], 0x6d
out 0xe0, eax
shr byte [ebp - 0x39], cl
rol dword [esi + 0x50a3eea5], 1
cmp eax, 0xd0f9d40a
inc eax
adc dword [ebp - 0x4c1eab4d], ecx
sbb eax, 0xfa7463f4
stosd dword es:[edi], eax
invalid
Function at 0x4dc43b
Capabilities:
Encode data using xor

Disassembly:
inc esi
out dx, eax
mov esp, 0x66bc6cbe
mov bh, 0x5b
retf
adc bh, byte [ecx]
sal dword [eax - 0x73018d1e], 0xbf
or ebx, esp
xor al, 0x2a
push edi
shrd dword [ebx + ebx*4 - 0x67], eax, cl
pop esp
stosd dword es:[edi], eax
std
sbb eax, edx
mov edi, ebp
rcl byte [eax - 0x7f], cl
insd dword es:[edi], dx
xor eax, 0x20fbe5dd
stmxcsr dword [ebx + 0x5b8c1b91]
cmp cl, byte [edi + esi*8]
movsd dword es:[edi], dword [esi]
mov eax, 0x693c5f7b
sub ah, dl
push edi
mov esi, 0xdae13de
inc ebx
jo 0x4dc4bf
movsd dword es:[edi], dword ds:[esi]
dec edx
jl 0x4dc431
dec ebx
sbb eax, 0xef62a07e
rcr dl, 0x49
sbb edx, ebp
cmp ebp, dword [ebx + 0x1d9913a6]
lodsb al, byte [esi]
adc eax, 0xf4c81dfd
lcall 0xd8ed, 0x39ab84cb
jecxz 0x4dc4bf
std
sbb eax, 0xcb9af4c8
test byte [ebx - 0x1c2712c7], ch
and dword [0xe69296ab], edi
cmp eax, 0xe69296ab
ja 0x4dc502
fmul dword [edi - 0x2358ecb7]
pop esi
jmp 0x4dc491
pop eax
dec esi
push ds
add ah, ch
invalid
and ch, ah
dec ebp
aam 0x18
ja 0x4dc55c
aaa
or byte [esi + 0x23], cl
mov esi, 0x35bcdd1e
clc
test byte [eax - 0x32478557], dh
or ch, byte [edi - 0x4b8357d9]
movsd dword es:[edi], dword [esi]
mov eax, dword [0xddc71321]
mov eax, 0x985fff32
sub eax, 0x19f5e886
bound ebp, qword [eax + ecx*2 + 0x34]
jl 0x4dc573
mov ebx, 0xd2be48a5
add byte [ebx - 0xe], bl
pop esi
xchg byte [eax], bh
pop ds
insb byte es:[edi], dx
or edx, esi
fisub word [edi]
dec eax
push ecx
sbb eax, 0xde75941c
push ds
ficomp word [esi]
xor dh, byte [ebp + 0x20dd90f9]
ficom word [esi + 0x45]
dec ebx
push ecx
sti
shr dword [ebx], 0x5b
pop ebx
out 0x66, eax
pop edi
jns 0x4dc54c
cmp al, 0xac
push ebp
fsub dword [esi]
ficomp word [edx]
mov byte [esi], bl
shr byte [ecx], 1
insb byte es:[edi], dx
sal dword [ebx + 0x3e], cl
scasd eax, dword es:[edi]
sub byte [ecx - 0x39], cl
push 0x788d9554
arpl word [ebp*2 - 0x250701fa], bp
sub byte [esi], ch
call 0x5bea806d
imul ecx, dword [ebx + 0x321ad8bb], 0x70c538ee
dec sp
dec ecx
invalid
out dx, al
cmp ch, al
jo 0x4dc5f9
dec esp
fsubr dword [eax - 0x32]
movhps qword [eax + 0x23], xmm7
inc ecx
int 0xf2
cwde
mov ecx, 0xbc32dfa2
cmp eax, 0x41cb493e
xchg ebx, eax
cmp al, 0xe5
retf
sbb eax, 0xedc8cd83
xchg esi, eax
ficomp word [eax - 0x50ee5b24]
in al, 0x50
imul ebp, dword [ecx*8 + 0x19c862b1], 0xffffffb3
jge 0x4dc58e
sbb eax, 0xf38e3502
invalid
xchg esi, eax
fsubrp st(6)
mov ah, al
insd dword es:[edi], dx
cmp eax, 0xedeeb1e5
jge 0x4dc652
xor al, 0x7b
or edx, dword [eax + 0x721fa28b]
cmp dword [ebp - 0x32], ebp
jb 0x4dc61f
insd dword es:[edi], dx
into
fnsave dword [edx - 0x1ab736cb]
jecxz 0x4dc5ac
mov eax, dword [0x80a8cdf2]
cmpsd dword [esi], dword es:[edi]
cmp eax, 0xae3df017
sub al, 0x9b
pop ds
cmp eax, 0x1f9b2cae
cmp ebx, dword [esi + 0x7e]
mov eax, 0x8ea39e36
loop 0x4dc62a
jnp 0x4dc5d0
jb 0x4dc5a7
js 0x4dc5db
cmpsd dword gs:[esi], dword es:[edi]
jmp 0x4dc68e
jmp 0xceba9461
popfd
xchg esi, eax
or byte [ebx + 0x34], bl
mov ecx, 0x8c7d7abe
mov edx, 0x72499263
insd dword es:[edi], dx
retf 0x1de9
int1
push ebp
pop edi
or ah, dl
inc esi
pop esp
pop ebx
ror dword [esi - 0x24], 0xb2
jmp 0x4dc5e4
push cs
invalid
Function at 0x5a89db
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx], edi
adc bl, byte [0x9296ba8]
cmp edx, dword [edx]
sbb eax, 0x9296ba8
cmp dword [esi - 0x1d], edi
xor al, 0x31
mov ah, 0x68
mov esi, 0xe86bf5d7
rcl dword [ecx + ecx*2]
pushal
push es
imul edx, dword cs:[eax], 0xeadf0b12
imul edx, dword [eax], 0xeadf0b12
idiv dword [eax]
xchg byte [eax + 0x12], al
arpl bp, bx
lds esp, [eax - 0x29]
lahf
lodsb al, byte [esi]
or dword [eax - 3], eax
xor dword [ecx], 0x66abf6e7
salc
xchg esi, eax
add byte [eax + 0x7a], dh
inc eax
jb 0x5a89f4
jge 0x5a89da
hlt

Function at 0x62afdb
Capabilities:
Encode data using xor

Disassembly:
mov ah, 0x83
mov bl, 0x73
jg 0x62b059
lahf
iretd
in eax, 0xc
lcall 0x5264, 0x97417485
test byte [eax + 0x34], ah
sub dh, byte [ebp + 0x37c824d0]
out 0x34, eax
rcl dword [0x157f2535], 0xc5
pop ecx
and eax, 0x59c5157f
in eax, 0xaa
jg 0x62b077
movsd dword es:[edi], dword [esi]
je 0x62b072
mov edi, 0x45945a94
xlatb
push edi
pop eax
mov esp, 0x96b6bb4a
push cs
cmpsd dword [esi], dword es:[edi]
invalid
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x402ee4
pop dword [ebp - 0x34]
mov eax, 0xff6a0c1c
add eax, 0xd622c8
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x3c8ff67a
add dword [ebp - 0x44], 0x11c24ed1
mov dword [ebp - 0x40], 0x9471e346
sub dword [ebp - 0x40], 0x623e9701
mov dword [ebp - 0x3c], 0x8da0479e
add dword [ebp - 0x3c], 0xbeabfc90
mov dword [ebp - 0x38], 0x4fb97385
add dword [ebp - 0x38], 0xb0468c7b
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xc46d738e
add dword [ebp - 0x44], 0xb004f5c8
mov dword [ebp - 0x40], 0x4e250f6
add dword [ebp - 0x40], 0x3c8a107f
mov dword [ebp - 0x3c], 0xdea85b1d
sub dword [ebp - 0x3c], 0x7b38eeb1
mov dword [ebp - 0x38], 0xebe6766c
sub dword [ebp - 0x38], 0xebe6766c
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xa04b637a
sub eax, 0xa00ae27a
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3a9cf
push 0
call eax
mov ecx, 0xa83d6af3
sub ecx, 0xa83d14a4
xor edi, edi
add edi, eax
mov ebx, 0xaf5d19c4
sub ebx, 0xaf1635c4
add ebx, dword [ebp - 0x34]
mov esi, 0xd103a2ce
xor dword [ebp - 0x20], 0xdfc9ab7c
mov edx, dword [ebx]
add dword [ebp - 4], edx
add edx, esi
xor dword [ebp - 0x1c], 0xc65e3fda
mov dword [edi], edx
xor dword [ebp - 0x2c], 0xc07dd92
add edi, 4
add ebx, 0x64519afc
add ebx, 0x9bae6508
loop 0x402ffd
add eax, 0x5a1c3edd
add eax, 0xa5e50d32
xor ebx, ebx
add ebx, eax
add eax, 0xee3c3491
sub eax, 0xee3c348c
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40673a
pop dword [ebp - 0x34]
mov eax, 0xed3ab203
sub eax, 0xecfa4ac9
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x2c237118
add dword [ebp - 0x44], 0x222ed433
mov dword [ebp - 0x40], 0x1338b5d6
sub dword [ebp - 0x40], 0xe1056991
mov dword [ebp - 0x3c], 0x9841b06
add dword [ebp - 0x3c], 0x42c82928
mov dword [ebp - 0x38], 0xb757da8f
add dword [ebp - 0x38], 0x48a82571
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x3d04262
sub dword [ebp - 0x44], 0x8f5dd90c
mov dword [ebp - 0x40], 0x3fbdcad2
sub dword [ebp - 0x40], 0xfe51695d
mov dword [ebp - 0x3c], 0x7001564
add dword [ebp - 0x3c], 0x5c6f5708
mov dword [ebp - 0x38], 0x912d055a
add dword [ebp - 0x38], 0x6ed2faa6
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x3c18cd7
sub eax, 0x3810bd7
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x37eb1
push 0
call eax
mov ecx, 0x5b030044
sub ecx, 0x5b02b6a8
mov edi, eax
mov ebx, 0x618a4523
sub ebx, 0x61436123
add ebx, dword [ebp - 0x34]
mov edx, 0x835454e3
xor dword [ebp - 4], ecx
mov esi, dword [ebx]
add dword [ebp - 0x28], 0xf91cd8f8
sub esi, edx
mov dword [edi], esi
sub dword [ebp - 0x24], ecx
add edi, 4
add ebx, 4
loop 0x406851
add eax, 0x11943
mov ebx, eax
add eax, 5
mov ecx, 0xe0c74071
sub ecx, 0xe0874071
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x44b800
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4d2774]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
jg 0x44b82a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004789cb
mov esp, ebp
pop ebp
ret
mov ecx, 1
mov dword [ebp - 0x84], 0xedb88320
mov eax, ecx
nop dword [eax + eax]
mov dword [ebp + eax*4 - 0x84], ecx
inc eax
add ecx, ecx
cmp eax, 0x20
jl 0x44b840
push ebx
push esi
xor esi, esi
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ebp + esi - 0x84]
lea ecx, [ebp - 0x84]
xor edx, edx
test eax, eax
je 0x44b880
test al, 1
je 0x44b879
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x44b873
mov dword [ebp + esi - 0x104], edx
add esi, 4
cmp esi, 0x80
jl 0x44b860
xor esi, esi
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [ebp + esi - 0x104]
lea ecx, [ebp - 0x104]
xor edx, edx
test eax, eax
je 0x44b8c0
test al, 1
je 0x44b8b9
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x44b8b3
mov dword [ebp + esi - 0x84], edx
add esi, 4
cmp esi, 0x80
jl 0x44b8a0
mov ebx, dword [ebp + 8]
nop word [eax + eax]
xor esi, esi
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ebp + esi - 0x84]
lea ecx, [ebp - 0x84]
xor edx, edx
test eax, eax
je 0x44b910
test al, 1
je 0x44b909
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x44b903
mov dword [ebp + esi - 0x104], edx
add esi, 4
cmp esi, 0x80
jl 0x44b8f0
mov edx, dword [ebp + 0x10]
test dl, 1
je 0x44b946
xor ecx, ecx
lea eax, [ebp - 0x104]
test ebx, ebx
je 0x44b944
test bl, 1
je 0x44b93d
xor ecx, dword [eax]
add eax, 4
shr ebx, 1
jne 0x44b936
mov ebx, ecx
sar edx, 1
mov dword [ebp + 0x10], edx
je 0x44b9b1
xor esi, esi
nop
mov eax, dword [ebp + esi - 0x104]
lea ecx, [ebp - 0x104]
xor edx, edx
test eax, eax
je 0x44b970
test al, 1
je 0x44b969
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x44b963
mov dword [ebp + esi - 0x84], edx
add esi, 4
cmp esi, 0x80
jl 0x44b950
mov edx, dword [ebp + 0x10]
test dl, 1
je 0x44b9a6
xor ecx, ecx
lea eax, [ebp - 0x84]
test ebx, ebx
je 0x44b9a4
test bl, 1
je 0x44b99d
xor ecx, dword [eax]
add eax, 4
shr ebx, 1
jne 0x44b996
mov ebx, ecx
sar edx, 1
mov dword [ebp + 0x10], edx
jne 0x44b8e0
xor ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.004789cb
mov esp, ebp
pop ebp
ret
Function at 0x44c430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
nop dword [eax]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp + 8], edx
cmp dword [edi + 0x6c], eax
jb 0x44c4bf
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.00481040
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x44c48f
sub eax, esi
jmp 0x44c491
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x44c480
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x44c4b0
sub eax, esi
jmp 0x44c4b2
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x44c4a1
mov edx, dword [ebp + 8]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x44c5f0
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x44c4ec
xor eax, eax
jmp 0x44c53c
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x44c509
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.00446d70
jmp 0x44c521
cmp eax, 2
jne 0x44c524
mov eax, dword [ebx]
test eax, eax
je 0x44c521
push ecx
push eax
push dword [ebx + 0x30]
call fcn.0044b9d0
add esp, 0xc
mov dword [ebx + 0x30], eax
push dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
call fcn.00481040
mov eax, dword [ebp + 8]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x44c564
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x44c578
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x44c440
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x44c5f0
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x44c5c0
sub ecx, esi
mov eax, 0x102
cmp ecx, eax
cmova ecx, eax
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
mov dword [ebp + 8], ecx
push 0
push eax
call fcn.004815c0
mov eax, dword [ebp + 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x44c5f0
mov eax, dword [edi + 0x38]
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
cmova esi, ecx
add eax, edx
push esi
push 0
push eax
call fcn.004815c0
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458bf0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
mov byte [eax + esi + 0x20], 0x80
inc dword [esi + 0x1c]
cmp eax, 0x37
mov eax, dword [esi + 0x1c]
jle 0x458c43
cmp eax, 0x40
jge 0x458c20
nop dword [eax + eax]
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x1c]
mov eax, dword [esi + 0x1c]
cmp eax, 0x40
jl 0x458c10
call fcn.00458cb0
cmp dword [esi + 0x1c], 0x38
jge 0x458c60
nop dword [eax + eax]
mov eax, dword [esi + 0x1c]
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x1c]
cmp dword [esi + 0x1c], 0x38
jl 0x458c30
jmp 0x458c60
cmp eax, 0x38
jge 0x458c60
nop dword [eax + eax]
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x1c]
mov eax, dword [esi + 0x1c]
cmp eax, 0x38
jl 0x458c50
movzx eax, byte [esi + 0x1b]
mov ecx, esi
mov byte [esi + 0x58], al
movzx eax, byte [esi + 0x1a]
mov byte [esi + 0x59], al
mov eax, dword [esi + 0x18]
shr eax, 8
mov byte [esi + 0x5a], al
movzx eax, byte [esi + 0x18]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 0x17]
mov byte [esi + 0x5c], al
movzx eax, byte [esi + 0x16]
mov byte [esi + 0x5d], al
mov eax, dword [esi + 0x14]
shr eax, 8
mov byte [esi + 0x5e], al
movzx eax, byte [esi + 0x14]
mov byte [esi + 0x5f], al
pop esi
jmp fcn.00458cb0
Function at 0x458f00
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x64], 0
ret