joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10066cd5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10070750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10058698
mov dword [ebp - 0x14], eax
cmp dword [0x1065d1c0], esi
jne 0x10066dc8
push 0x800
push esi
push 0x100075f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10066d55
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10066ea8
push esi
push esi
push 0x100075f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10066ea8
push 0x10007608
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10066ea8
push eax
call ebx
push 0x10007614
push edi
mov dword [0x1065d1c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007624
push edi
mov dword [0x1065d1c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007638
push edi
mov dword [0x1065d1c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065d1d0], eax
test eax, eax
je 0x10066dc5
push 0x10007654
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065d1cc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10066ded
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10066de0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10066e02
push 4
pop eax
jmp 0x10066eaa
cmp dword [ebp - 0x14], esi
je 0x10066e02
push dword [0x1065d1c0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10066de7
mov eax, dword [0x1065d1cc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10066e60
cmp dword [0x1065d1d0], edi
je 0x10066e60
push eax
call ebx
push dword [0x1065d1d0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10066e60
test eax, eax
je 0x10066e60
call ecx
test eax, eax
je 0x10066e55
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10066e55
test byte [ebp - 8], 1
jne 0x10066e60
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10066e90
mov eax, dword [0x1065d1c4]
cmp eax, edi
je 0x10066e8d
push eax
call ebx
test eax, eax
je 0x10066e8d
call eax
mov esi, eax
test esi, esi
je 0x10066e8d
mov eax, dword [0x1065d1c8]
cmp eax, edi
je 0x10066e8d
push eax
call ebx
test eax, eax
je 0x10066e8d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1065d1c0]
call ebx
test eax, eax
je 0x10066ea8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10066eaa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10055d09
mov esp, ebp
pop ebp
ret
Function at 0x402cd0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
fild dword [ebp + 0x10]
push ebx
sub esp, 8
fdiv qword [0x43d728]
fstp qword [esp]
call fcn.00426650
fmul qword [0x43d720]
add esp, 8
call fcn.004267f0
mov ebx, dword [ebp + 0x14]
cmp eax, dword [ebx]
mov dword [ebx], eax
jle 0x402d04
xor al, al
pop ebx
pop ebp
ret
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
jle 0x402d9f
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp esi, edi
jge 0x402d24
movzx eax, byte [esi + ebx]
inc esi
jmp 0x402d26
xor eax, eax
cmp esi, edi
jge 0x402d34
movzx edx, byte [esi + ebx]
mov dword [ebp + 0x10], edx
inc esi
jmp 0x402d3b
mov dword [ebp + 0x10], 0
cmp esi, edi
jge 0x402d46
movzx edx, byte [esi + ebx]
inc esi
jmp 0x402d48
xor edx, edx
shl eax, 8
add eax, dword [ebp + 0x10]
add ecx, 4
shl eax, 8
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x44a090]
mov byte [ecx - 4], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + 0x44a090]
mov byte [ecx - 3], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x44a090]
mov byte [ecx - 2], dl
and eax, 0x3f
mov al, byte [eax + 0x44a090]
mov byte [ecx - 1], al
cmp esi, edi
jl 0x402d1d
mov ebx, dword [ebp + 0x14]
mov eax, 0x55555556
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*2]
sub edi, edx
xor ecx, ecx
cmp dword [edi*4 + 0x44a0d0], ecx
lea edi, [edi*4 + 0x44a0d0]
jle 0x402dd6
mov al, 0x3d
mov edx, dword [ebx]
mov esi, dword [ebp + 0xc]
sub edx, ecx
inc ecx
mov byte [edx + esi - 1], al
cmp ecx, dword [edi]
jl 0x402dc6
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret

Function at 0x410850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44b518]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x44a068], 8
mov eax, dword [0x44a054]
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
jae 0x41087d
mov eax, 0x44a054
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0x43e8b8
push eax
call dword [0x44ce1c]
lea edx, [ebp - 0x20c]
push edx
call dword [0x44cdc8]
lea eax, [ebp - 0x20c]
add eax, 0xfffffffe
jmp 0x4108b0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4108b0
mov ecx, dword [str..ico]
mov edx, dword [0x43e8b0]
mov dword [eax], ecx
mov cx, word [0x43e8b4]
push esi
mov dword [eax + 4], edx
lea edx, [ebp - 0x20c]
push 0x43d700
push edx
mov word [eax + 8], cx
call fcn.004264fa
mov esi, eax
mov eax, dword [ebp + 0xc]
push esi
push eax
push 1
push edi
call fcn.004263c2
push esi
call fcn.00425c86
add esp, 0x1c
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
pop esi
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410910
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebx + 0x88]
call fcn.00401ff0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004260de
mov esp, ebp
pop ebp
ret 8
Function at 0x41e660
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x44fd61
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49cf34]
jne 0x44fd6b
repz ret
jmp fcn.004537df

Function at 0x458f41
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49cf34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00452dd7
and dword [ebp - 0x14], 0
cmp dword [0x49ecb4], 0
mov dword [ebp - 0x18], eax
jne 0x458ff4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x45909c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x45909c
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x49ecb4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x49ecb8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x49ecbc], eax
call edi
push eax
call esi
mov dword [0x49ecc4], eax
test eax, eax
je 0x458ff4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x49ecc0], eax
mov eax, dword [0x49ecc0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x45904d
cmp dword [0x49ecc4], ecx
je 0x45904d
push eax
call esi
push dword [0x49ecc4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x45904d
test ebx, ebx
je 0x45904d
call edi
test eax, eax
je 0x459044
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x459044
test byte [ebp - 8], 1
jne 0x45904d
or dword [ebp + 0x10], 0x200000
jmp 0x459080
mov eax, dword [0x49ecb8]
cmp eax, dword [ebp - 0x18]
je 0x459080
push eax
call esi
test eax, eax
je 0x459080
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x459080
mov eax, dword [0x49ecbc]
cmp eax, dword [ebp - 0x18]
je 0x459080
push eax
call esi
test eax, eax
je 0x459080
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x49ecb4]
call esi
test eax, eax
je 0x45909c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x45909e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fd61
leave
ret
Function at 0x402a36
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov eax, dword [esp + 0x10]
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 0xc]
shr esi, 2
mov edx, dword [ebp + 8]
mov ecx, esi
dec esi
test ecx, ecx
jle 0x402a77
movzx edi, byte [edx]
inc edx
movzx ecx, byte [edx]
shl ecx, 8
inc edx
or edi, ecx
movzx ecx, byte [edx]
shl ecx, 0x10
inc edx
or edi, ecx
movzx ecx, byte [edx]
shl ecx, 0x18
inc edx
or edi, ecx
mov ecx, esi
xor eax, edi
dec esi
test ecx, ecx
jg 0x402a4f
xor esi, esi
mov ecx, dword [ebp + 0xc]
and ecx, 3
cmp ecx, 1
je 0x402a9e
cmp ecx, 2
je 0x402a95
cmp ecx, 3
jne 0x402aa3
movzx esi, byte [edx]
shl esi, 0x10
inc edx
movzx ecx, byte [edx]
shl ecx, 8
inc edx
or esi, ecx
movzx ecx, byte [edx]
or esi, ecx
xor eax, esi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4028ae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jg 0x442a44
cmp dword [ebp + 0xc], 0
jne 0x442a6f
cmp dword [ebp + 0x10], 0
jne 0x402900
cmp dword [ebp + 0x14], 0
jne 0x442a8e
cmp dword [ebp + 0x18], 0
jne 0x442a97
cmp dword [ebp + 0x1c], 0
jne 0x442aa0
cmp dword [ebp + 0x20], 0
jne 0x402909
cmp dword [ebp + 0x24], 0
jne 0x442a78
xor eax, eax
pop ebp
ret 0x20
push 0xffffffffffffffff
push 0x77
jmp 0x442a7c
push 0xffffffffffffffff
push 0x73
jmp 0x442a7c
dec edx
fsub qword [edi]
add al, 0xd1
dec edx
mov eax, dword [0x8866718]
or esi, dword [ecx + 0x30]
js 0x4429ea
popfd
adc dword [eax - 0x7c], ebp
je 0x4429fb
dec esi
enter 0xfffffffffffff66b, 0xffffffffffffffc2
push edi
div dword [eax]
out dx, eax
aaa
sub eax, 0x1dc763dc
inc edi
test dword [eax], esi
mov edx, 0x79b7465e
pop ecx
or byte [ebx + edi*4 - 0x14281ea6], 0xfc
xchg byte [esi + esi*4 - 0x55ae5159], al
test byte [esi - 0x55ae5159], dh
push ecx
stosb byte es:[edi], al
push ecx
mov ebx, 0x7b6f08ba
sbb esi, dword [ebx]
push ebp
mov eax, 0x7c3d2ca6
sub eax, 0xa5569415
xchg esp, eax
ret 0x784e

Function at 0x403743
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
push esi
push edi
xor esi, esi
mov dword [ebp - 8], eax
mov edi, dword [eax + 4]
mov dword [ebp - 0x10], edi
lea edx, [edi - 1]
test edi, edi
je 0x4037ab
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [ebp - 4], eax
xor ebx, ebx
xor ecx, ecx
test ax, ax
je 0x4037a2
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov eax, dword [eax]
movzx eax, word [eax + edx*2]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, ax
cmp word [ebp - 0xc], ax
je 0x4037b0
inc ebx
movzx eax, word [edi + ebx*2]
test ax, ax
jne 0x403787
mov edi, dword [ebp - 0x10]
test ecx, ecx
jne 0x4432c3
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret 4
or eax, 0xffffffff
jmp 0x4037a4
inc ecx
jmp 0x40378d
dec ebx
mov edx, 0x621dcc3c
dec esi
sbb byte ds:[ecx + edi - 0x69], al
jp 0x4432b4
stosd dword es:[edi], eax
mov ebp, 0xe768364f
inc ecx
push ds
retf 0x1dd2
xchg edi, eax
push ecx
mov eax, dword [0xb8673e61]
inc ebx
inc eax
cmp edi, dword [ebp + 0x59]
retf
ret 0x7682
out dx, al
jl 0x4432fe
sbb ch, byte [ebx]
push ebp
mov dh, 0x8a
add eax, 0x1b82b641
lodsd eax, dword [esi]
loopne 0x443263
imul edx, dword [esi], 0xffffffb3
int 0xea
fcomp st(2)
mov eax, 0x4d71024
cmpsd dword [esi], dword es:[edi]
mov ebx, 0x58348c4b
jb 0x4432fd
jno 0x443285
ret 0x444f
stosd dword es:[edi], eax
add al, 0x36
xor edx, dword [ebx + 0x2d37ce31]
pop edx
inc edi
mov ebp, 0xf7b24b4e
int1
cmp byte [ebx - 0x29], cl
outsb dx, byte [esi]
mov ch, 0xe1
xchg dword [ecx + esi*4 - 0x1b32bd05], ecx
xor ebx, dword [eax + 0xfa1fa3b]
add edi, dword [esi - 0xf]
fidivr word [ebx]
and dword [edi*2 + 0x38edda5b], 0x7b
mov esi, 0x51194c4b
push ss
hlt
Function at 0x404939
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
inc esi
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx]
cmp eax, esi
jg 0x443b35
mov eax, dword [edi + 4]
push 2
pop esi
add eax, esi
cmp dword [edi + 8], eax
jb 0x404981
mov edx, dword [edi + 4]
mov ecx, dword [edi]
mov ax, word [ebp + 8]
mov word [ecx + edx*2], ax
inc dword [edi + 4]
xor edx, edx
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
leave
ret 4
cmp eax, 0x41c2
jae 0x443b88
add eax, eax
test eax, eax
je 0x4049d5
add eax, 7
and eax, 0xfffffff8
xor ecx, ecx
mov dword [edi + 8], eax
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041fd87
cmp dword [edi], 0
mov esi, eax
pop ecx
je 0x4049d1
mov ecx, dword [edi + 4]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi]
push esi
call fcn.00420d9c
push dword [edi]
call fcn.0041fd90
add esp, 0x10
mov dword [edi], esi
jmp 0x40495e
push 8
pop eax
jmp 0x404998
movsb byte es:[edi], byte [esi]
arpl cx, ax
adc eax, 0x21fb30be
pop ecx
mov bl, 0x95
push es
outsb dx, byte [esi]
push esp

Function at 0x4068b8
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x4068e0
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x4068d2
pop edi
pop esi
pop ebp
ret 4
Function at 0x40ebbc
Capabilities:
Encode data using xor

Disassembly:
ficom dword [ebx - 0x33d4bab3]
push ebx
inc esp
dec esp
std
pop ecx
out 4, eax
movsb byte es:[edi], byte [esi]
fmul dword [esi]
aaa
mov es, esp
push 0x49
sahf
push 0x1a
mov ecx, 0x5d68aad2
push esp
or byte [ebx], al
sub dword [esi + 0x79ed348b], ebx
and al, 0x44
add ebp, dword [ecx]
sahf
mov esi, dword [ebp*8 + 0x7b442479]
sub eax, dword [ebx - 3]
in eax, dx
jns 0x40ebe9
inc esp
jnp 0x40ebf3
inc ebx
std
pop edi
out dx, eax
aam 0xab
add esp, 0x7e
push 0x35
xor dword [ecx + 9], eax
cdq
ja 0x40ebbd
loope 0x40ebf2
pop dword [ebp + 0x76f833e6]
or bh, dl
sahf
pop es
hlt
stosb byte es:[edi], al
enter 0xffffffffffffb19b, 0x26
scasb al, byte es:[edi]
inc esi
mov edx, 0x7a725489
push esp
jb 0x40ec6f
cmp eax, 0x6e39323b
popal
mov ebx, 0x7ee2272d
outsb dx, byte [esi]
leave
add al, 0xd7
in al, dx
jle 0x40eb9b
or ebp, dword [ebx - 0x78]
das
jg 0x40ec0f
mov eax, dword [ebx + 0x71]
mov cl, 0xdf
inc esp
mov ch, byte [ebp + 0x1f]
jno 0x40ebc2
fild word [esi - 0x76]
insd dword es:[edi], dx
pop ds
in eax, 0xde
idiv ah
dec edx
sbb byte [eax + ebx*2 - 0x63e2cd8], al
mov bl, byte [esi + edi + 0x4c]
or byte [ebx], 4
sbb edx, dword [edx*2 - 0x4a5ecaaf]
sub eax, dword [ebp - 0x3b3ce68b]
jle 0x40ec9f
xor dword [ebx], edi
push eax
sub eax, 0x53ecf4df
jbe 0x40ec7e
pop ss
cmc
mov esi, edx
dec edi
movsb byte es:[edi], byte [esi]
je 0x40ec9d
sub ecx, esi
cwde
salc
cdq
salc
adc cl, dl
xor eax, 0xeaf49987
xchg ebp, eax
dec ebp
invalid
out dx, al
xchg esi, eax
sbb eax, 0x6c043977
test byte [ebx], 0xb0
stosd dword es:[edi], eax
add edi, dword [ecx]
sub dword [0x12118b5a], 0x25
jo 0x40ec8a
mov edx, dword [ecx]
adc ah, byte [0xb3f21570]
sbb ecx, ebx
xchg edx, eax
xchg esi, eax
retf 0xffd2
mov bl, 0x19
fst dword [edx - 0x2d356a]
xchg esp, eax
lahf
in al, 0xac
pushal
mov ecx, 0x7cb52bce
das
mov byte [0x52482e61], al
popal
dec eax
push edx
js 0x40ec5f
adc bx, cx
pop ebx
sub byte cs:[edi + 0x20], dl
adc al, 0xde
sub al, 0xe9
fucom st(4)
dec edi
sub eax, 0x843ba98e
cmp ch, byte [ecx]
push edi
xor byte [esi - 0x14], dh
mov dh, 0xf0
invalid

Function at 0x41005c
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0x74
xor al, 0x2f
or dword [edx], ebx
xchg byte [ebx], bh
pop edx
dec ebx
dec ebx
adc ebp, ebx
push es
ljmp 0x5718
push 0xaf387b0e
push ebx
or al, 0x3b
in al, 0x43
mov ebx, 0x3bb142ff
movsb byte es:[edi], byte [esi]
dec ecx
inc ebp
and eax, 0x553a6654
push eax
fnstenv [edx]
and bh, ah
sub edx, dword [eax - 0x4235f276]
mov byte [0x25f396e0], al
mov bl, 0xcb
mov dword [edx], ebp
and byte [ecx], cl
xor bl, dl
call 0x6b101e85
dec cx
aam 0x95
outsb dx, byte [esi]
inc esp
mov ch, 0xe0
imul ebp, dword [0x6b396fa4], 0xffffffa6
add al, 0x86
jns 0x40ffff
test byte [edx], bh
pop eax
jbe 0x410035
cmp eax, 0x3b3549fc
shr byte [ecx + 0x16acdb74], 0xd5
jno 0x41010d
and dword [esi + 0x27], 0xc3ab9fa8
xchg esi, eax
retf
loope 0x41011b
dec ebx
jmp 0x89f56300
push ds
push es
neg byte [ebx + 0x49195b39]
invalid
Function at 0x44bbce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jg 0x48bd64
cmp dword [ebp + 0xc], 0
jne 0x48bd8f
cmp dword [ebp + 0x10], 0
jne 0x44bc20
cmp dword [ebp + 0x14], 0
jne 0x48bdae
cmp dword [ebp + 0x18], 0
jne 0x48bdb7
cmp dword [ebp + 0x1c], 0
jne 0x48bdc0
cmp dword [ebp + 0x20], 0
jne 0x44bc29
cmp dword [ebp + 0x24], 0
jne 0x48bd98
xor eax, eax
pop ebp
ret 0x20
push 0xffffffffffffffff
push 0x77
jmp fcn.0048bd9c
push 0xffffffffffffffff
push 0x73
jmp fcn.0048bd9c
sal ecx, cl
sar dword [edx + 0x16d26f80], 0x7c
jmp 0x48bdc7
push edi
dec edi
Function at 0x44ca63
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
push esi
push edi
xor esi, esi
mov dword [ebp - 8], eax
mov edi, dword [eax + 4]
mov dword [ebp - 0x10], edi
lea edx, [edi - 1]
test edi, edi
je 0x44cacb
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [ebp - 4], eax
xor ebx, ebx
xor ecx, ecx
test ax, ax
je 0x44cac2
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov eax, dword [eax]
movzx eax, word [eax + edx*2]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, ax
cmp word [ebp - 0xc], ax
je 0x44cad0
inc ebx
movzx eax, word [edi + ebx*2]
test ax, ax
jne 0x44caa7
mov edi, dword [ebp - 0x10]
test ecx, ecx
jne 0x48c5e3
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret 4
or eax, 0xffffffff
jmp 0x44cac4
inc ecx
jmp 0x44caad
arpl ax, si
fcomp qword [ebx - 0x32]
leave
mov edx, ebx
cmp bh, byte [esi]
movsd dword es:[edi], dword [esi]
invalid

Function at 0x44fbd8
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x44fc00
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x44fbf2
pop edi
pop esi
pop ebp
ret 4

Function at 0x454803
Capabilities:
Encode data using xor

Disassembly:
mov dword [edx + edx*4 - 0x6b6b27cc], 0x53b0d230
xchg esp, eax
xor dl, dl
mov al, 0x53
dec eax
cmpsd dword [esi], dword es:[edi]
shr byte [ebx + esi*8], 1
xchg edi, eax
sbb byte [ecx + 0x22], bh
salc
aam 0x9b
xor ecx, edx
sti
outsd dx, dword [esi]
pop es
inc ebp
loopne 0x4547fd
dec ebp
add byte [ebx], cl
das
lodsb al, byte [esi]
sbb dword [esi + eax*8 + 0x3f], esp
add dword [ecx + esi*2], 0x1ba32eb0
xchg esp, eax
mov ch, 0x6f
retf 0x1754

Function at 0x468aaa
Capabilities:
Encode data using xor

Disassembly:
pushal
add word [edi + 0x39183def], 0xc4c8
loopne 0x468afe
aam 0xdb
push eax
cmp ecx, dword [ebp - 0x29]
mov eax, dword [0x9f8b6fc5]
push edi
bound edi, qword [eax + 0x1e0f2553]
test dword [edi - 0x578f9930], edx
sub al, 0xa7
push ebp
xchg esi, eax
sub al, 0x2a
xchg edi, eax
das
enter 0xffffffffffffe70d, 0xffffffffffffff91
ret
bound ebp, qword [edx]
xchg ecx, eax
sbb edx, ebp
mov byte [ebp + 0x3148985f], dl
mov al, byte [0xd1c6f2a1]
mov cl, byte [ebx + 0x5232adfc]
dec edi
sbb al, 0xd4
invalid
Function at 0x497009
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
inc esi
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx]
cmp eax, esi
jg 0x4d6205
mov eax, dword [edi + 4]
push 2
pop esi
add eax, esi
cmp dword [edi + 8], eax
jb 0x497051
mov edx, dword [edi + 4]
mov ecx, dword [edi]
mov ax, word [ebp + 8]
mov word [ecx + edx*2], ax
inc dword [edi + 4]
xor edx, edx
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
leave
ret 4
cmp eax, 0x41c2
jae 0x4d6258
add eax, eax
test eax, eax
je 0x4970a5
add eax, 7
and eax, 0xfffffff8
xor ecx, ecx
mov dword [edi + 8], eax
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004b2457
cmp dword [edi], 0
mov esi, eax
pop ecx
je 0x4970a1
mov ecx, dword [edi + 4]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi]
push esi
call fcn.004b346c
push dword [edi]
call fcn.004b2460
add esp, 0x10
mov dword [edi], esi
jmp 0x49702e
push 8
pop eax
jmp 0x497068
jl 0x4d6216
pop edi
pandn mm4, mm4
and eax, 0x34d3d22d
sbb al, 0x2a
cld
aaa
fst qword [edx - 0x51c313da]
jmp [esi - 0x5d]
invalid
inc esi
fidiv word [ebx + ebp*8 + 3]
add byte [ebx - 0x4f], dh
add eax, dword [eax]
jae 0x4d61ba
outsd dx, dword [esi]
add al, 0x67
pop esp
fbld tbyte [esi - 0x3a]
cwde
jl 0x4d61f1
adc eax, 0x3feb859f
lahf
test ebx, ebp
aas
out dx, al
jns 0x4d6215
dec ebx
and dword [edi], edx
jle 0x4d6201
dec ecx
stosd dword es:[edi], eax
add eax, dword ss:[edi]
rcr dword [esi], cl
xchg edi, eax
xchg ebp, eax
sti
mov esp, dword [ebp + 0x437d6f51]
movsd dword es:[edi], dword [esi]
push ecx
outsd dx, dword [esi]
jge 0x4d6274
wait
push edx
mov ecx, 0x4e62b443
adc eax, dword [ebx + 0x7bb3ff03]
cmp cl, byte [ecx]
xor byte [ebp + 0x7410fd63], ch
xchg ebp, eax
sbb al, 0xd4
mov ebp, 0x209d2d62
mov ebx, 0xf1ded467
scasd eax, dword es:[edi]
out 0x93, al
pop ss
jne 0x4d622c
shr dword [ebx - 0x6c], cl
cli
sbb edi, ecx
push ebx
in al, 0x25
imul edx, dword [edx + edi*8 - 0x1bac30e7], 0x25
mov word [edi + 0x33], es
rol byte [edx + 0x1eb1cf91], 0x8e
stosd dword es:[edi], eax
push 0x678865de
mov eax, 0xbed3e153
sar dword [esi - 0x201339ce], cl
jns 0x4d6276
xor al, dh
in al, dx
fistp qword [ecx - 6]
shr byte [edx], 1
or esi, dword [esi - 0xc2ccd8b]
out 0x4d, eax
xchg ebx, eax
adc al, 0x63
out dx, eax
pop esi
insb byte es:[edi], dx
cmp eax, 0xad9eeaa1
jbe 0x4d62c3
push edx
mov esi, 0xee1aaeba

Function at 0x498f88
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x498fb0
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x498fa2
pop edi
pop esi
pop ebp
ret 4