joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436f29
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push esi
mov dword [ebp - 4], eax
push str.Winamp.ini
lea eax, [ebp - 0x104]
push 0x100
push eax
push 0x450890
push str.Stats
push str.WinampReg
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor esi, esi
lea eax, [ebp - 4]
push 0x10
push eax
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_strtol]
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 4]
cmp byte [eax], 0
je 0x436f8d
inc dword [ebp - 4]
inc esi
cmp esi, 7
jl 0x436f64
pop esi
leave
ret

Function at 0x436f90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push str.Winamp.ini
push 0x80
push esi
mov ebp, 0x44ea04
push 0x450890
mov ebx, str.WinampReg
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esi], 0
jne 0x437005
lea eax, [esp + 0xc]
push edi
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
and byte [esi], 0
xor edi, edi
movzx eax, byte [esp + edi + 0x10]
push eax
push str._02X
push esi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
inc edi
cmp edi, 0x10
jb 0x436fd2
push str.Winamp.ini
push esi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x4371cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
cmp dword [0x459564], 0
mov dword [0x459550], eax
mov eax, dword [esp + 8]
mov dword [0x45954c], eax
mov eax, dword [esp + 0xc]
mov dword [0x459568], eax
mov eax, dword [esp + 0x10]
mov dword [0x459580], eax
jne 0x437273
call fcn.00438a6b
test eax, eax
jne 0x437278
call fcn.00438e12
test eax, eax
jne 0x437278
call fcn.00438f8f
test eax, eax
jne 0x437278
call fcn.004391d7
test eax, eax
jne 0x437278
cmp dword [0x459564], eax
jne 0x437273
push edi
call fcn.00437279
mov edi, eax
call fcn.004375f8
add edi, eax
call fcn.00438a21
add edi, eax
call fcn.00438966
add edi, eax
call fcn.004388c5
add edi, eax
call fcn.004386b6
add edi, eax
call fcn.00438824
add edi, eax
call fcn.004385fd
add edi, eax
pop edi
jne 0x437278
cmp dword [0x459564], 0
jne 0x437273
call fcn.0043836d
test eax, eax
jne 0x437278
jmp fcn.00437801
ret
Function at 0x43975c
Capabilities:
Create process on windows

Disassembly:
push 0
push 0x44ad84
push 0
push dword [esp + 0x14]
push str.open
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x43993f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
push ebx
push esi
push edi
mov edi, 0x45e580
push edi
push 0x10
mov esi, 0x44d6f4
push str.NumRecentURLs
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push dword [ebp + 0xc]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x84]
push str.RecentURL_s1
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x188]
push edi
push 0x104
push eax
lea eax, [ebp - 0x84]
push 0x450890
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
lea eax, [ebp - 0x84]
push dword [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push dword [ebp + 8]
lea eax, [ebp - 0x188]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x439a5d
xor eax, eax
inc eax
cmp dword [ebp - 4], eax
jle 0x439a5d
inc eax
push eax
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x84]
push str.RecentURL_s_d
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x28c]
push edi
push 0x104
push eax
lea eax, [ebp - 0x84]
push 0x450890
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x188]
push edi
push eax
lea eax, [ebp - 0x84]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push dword [ebp + 8]
lea eax, [ebp - 0x28c]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x439a5d
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x188]
push eax
call sub.MSVCRT.dll_strcpy
mov eax, dword [ebp - 8]
pop ecx
cmp eax, dword [ebp - 4]
pop ecx
jl 0x4399d8
pop edi
pop esi
pop ebx
leave
ret

Function at 0x439c6b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
push 6
xor ebx, ebx
pop ecx
xor eax, eax
cmp dword [0x44aec0], ebx
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [0x44aec4]
setne al
neg ecx
sbb ecx, ecx
and ecx, 2
or eax, ecx
test al, 3
mov dword [0x4599a8], eax
je 0x439d36
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push dword [0x44d7f4]
mov esi, 0x4599b0
push str._update_latest_version.jhtml_v_s
push esi
call edi
add esp, 0xc
test byte [0x4599a8], 2
je 0x439d1b
lea eax, [ebp - 0x20]
push eax
call fcn.00436f29
mov dword [esp], str.ID
push esi
call sub.MSVCRT.dll_strcat
push esi
call sub.MSVCRT.dll_strlen
add eax, esi
push eax
call fcn.00436f90
add esp, 0x10
xor eax, eax
push dword [ebp + eax*4 - 0x20]
lea ebx, [eax + 1]
push ebx
push str.st_d_d
push esi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, esi
push eax
call edi
mov eax, ebx
add esp, 0x10
cmp eax, 7
jl 0x439cf6
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x439d3a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebx
leave
ret
Function at 0x43e2b0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x54
mov eax, dword [esp + 0x58]
push ebx
push esi
push edi
mov ebx, ecx
mov ecx, dword [eax + 0xc]
xor edi, edi
push str.user32.dll
mov dword [esp + 0x14], ecx
mov dword [ebx + 0x20c], edi
mov dword [ebx + 0x204], edi
mov dword [ebx + 0x208], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
je 0x43e3db
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
push str.MonitorFromPoint
push esi
call edi
push str.MonitorFromRect
push esi
mov ebp, eax
call edi
push str.MonitorFromWindow
push esi
mov dword [esp + 0x70], eax
call edi
push str.GetMonitorInfoA
push esi
mov dword [esp + 0x18], eax
call edi
test ebp, ebp
mov dword [esp + 0x18], eax
je 0x43e3d3
mov ecx, dword [esp + 0x68]
test ecx, ecx
je 0x43e3d3
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x43e3d3
test eax, eax
je 0x43e3d3
mov edx, dword [esp + 0x14]
push 0
push edx
call ecx
mov ebp, eax
test ebp, ebp
je 0x43e3d3
push str.ddraw.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esp + 0x68], eax
je 0x43e3d3
push str.DirectDrawEnumerateExA
push eax
call edi
test eax, eax
je 0x43e3c8
push 5
push ebx
push 0x43e3f0
mov dword [ebx + 0x220], ebp
call eax
mov eax, dword [ebx + 0x20c]
test eax, eax
je 0x43e3c8
mov ecx, 0x12
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x48
push eax
push ebp
call dword [esp + 0x20]
test eax, eax
je 0x43e3c8
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [ebx + 0x204], ecx
mov dword [ebx + 0x208], edx
mov eax, dword [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x54
ret 4
Function at 0x440b90
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
mov eax, dword [0x45c0b4]
push esi
test eax, eax
push edi
je 0x440ca8
mov eax, dword [0x4528b0]
test eax, eax
je 0x440ca8
mov edi, dword [0x450e9c]
xor eax, eax
test edi, edi
sete al
push eax
push 3
call fcn.00423bb0
mov eax, dword [0x450e9c]
add esp, 8
test eax, eax
jne 0x440c09
mov ecx, dword [0x45bf14]
push 8
push 0x9d88
push ecx
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov edx, dword [0x45c0b4]
push 8
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov dword [0x450e9c], 1
pop esi
mov dword [esp + 4], 1
jmp fcn.004346b8
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
mov ecx, dword [0x45c0b4]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, ecx
je 0x440c34
call edi
push eax
mov eax, dword [0x45c0b4]
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x440c49
mov ecx, dword [0x45b980]
push 0
push 0x9c7f
push 0x111
push ecx
call esi
mov edx, dword [0x45bf14]
push 0
push 0x9d88
push edx
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [0x45c0b4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x44aeec]
mov dword [0x450e9c], 0
test eax, eax
je 0x440ca8
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
js 0x440ca8
call fcn.004418a0
test eax, eax
je 0x440ca8
mov ecx, dword [0x45b980]
push 0
push 0x9c6f
push 0x111
push ecx
call esi
pop edi
pop esi
ret

Function at 0x4418f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ecx, dword [0x459fc4]
test ecx, ecx
je 0x44190d
call fcn.0043fe70
test eax, eax
jne 0x441908
jmp fcn.0043fbb0
jmp fcn.0043fcd0
ret
Function at 0x441dd0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x45abdc]
sub esp, 0x104
test eax, eax
jne 0x441f08
call fcn.00441f40
call fcn.00442600
mov al, byte [0x45e100]
test al, al
je 0x441f08
mov eax, dword [esp + 0x10c]
mov dword [0x45a904], 0
test eax, eax
je 0x441eab
cmp byte [eax], 0
je 0x441eab
lea edx, [esp]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x441e22
push esi
mov esi, dword [sym.imp.MSVCRT.dll__mbsstr]
lea eax, [esp + 4]
push 0x44eeec
push eax
call esi
add esp, 8
test eax, eax
je 0x441e5b
mov byte [eax], 0
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov dword [0x45a928], eax
jmp 0x441e65
mov dword [0x45a928], 0
lea ecx, [esp + 4]
push 0x44ad50
push ecx
call esi
add esp, 8
test eax, eax
pop esi
jne 0x441e98
lea edx, [esp]
push edx
push 0x45dc80
push str._s_s
push 0x45a938
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x441ed4
xor eax, eax
mov cl, byte [esp + eax]
mov byte [eax + 0x45a938], cl
inc eax
test cl, cl
jne 0x441e9a
jmp 0x441ed4
push 0x45e100
push 0x45dc80
push str._s_s
push 0x45a938
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
xor eax, eax
mov al, byte [0x45eb0a]
mov dword [0x45a928], eax
push 0x45a924
push 0
push 0
push 0x442090
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [0x45a92c], eax
mov cl, byte [0x44adc0]
mov edx, dword [ecx*4 + 0x44eed8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
add esp, 0x104
ret
Function at 0x443460
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x44346b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x44356e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x447b88]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x447b88]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x447b88]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x447b88]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x447b88]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x447b88]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x447b88]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x447b88]
xor eax, edx
inc ecx
dec edi
jne 0x443486
pop edi
test esi, esi
je 0x443590
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x447b88]
xor eax, edx
inc ecx
dec esi
jne 0x443572
pop esi
pop ebx
not eax
ret
Function at 0x445f90
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
push 1
lea eax, [esp + 0x10]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x445fc1
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
and ecx, 0xff
xor eax, eax
mov dword [edx], ecx
pop esi
ret
mov al, byte [esi + 0xc]
pop esi
and al, 0x20
neg al
sbb eax, eax
ret

Function at 0x446060
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push 2
mov ebp, 0xffff
push 0
push esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
test eax, eax
je 0x446096
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
mov edi, eax
add esp, 4
cmp edi, 0xffff
mov dword [esp + 0x14], edi
jae 0x4460b4
mov dword [esp + 0xc], edi
mov ebp, eax
push 0x404
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x4460ce
pop edi
pop esi
pop ebp
add esp, 0xc
ret
push ebx
mov ebx, 4
cmp ebp, ebx
jbe 0x446176
jmp 0x4460e6
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
lea eax, [ebx + 0x400]
mov ebx, ebp
cmp eax, ebp
ja 0x4460f4
mov ebx, eax
mov ebp, edi
mov eax, edi
sub ebp, ebx
mov edi, 0x404
sub eax, ebp
cmp eax, 0x404
ja 0x44610a
mov edi, eax
mov eax, dword [esp + 0x20]
push 0
push ebp
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x446176
mov ecx, dword [esp + 0x20]
push ecx
push 1
push edi
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x446176
lea eax, [edi - 3]
test eax, eax
jle 0x44616c
mov cl, byte [eax + esi - 1]
dec eax
cmp cl, 0x50
jne 0x44615c
cmp byte [eax + esi + 1], 0x4b
jne 0x44615c
cmp byte [eax + esi + 2], 5
jne 0x44615c
cmp byte [eax + esi + 3], 6
je 0x446162
test eax, eax
jg 0x44613d
jmp 0x44616c
add eax, ebp
test eax, eax
mov dword [esp + 0x14], eax
jne 0x446176
cmp ebx, dword [esp + 0x10]
jb 0x4460de
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x14]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x40b810
Capabilities:
Encode data using xor

Disassembly:
imul ebp, dword [ebx + 5], 0x15
arpl word [ebx - 0x70b728b5], ax
invalid

Function at 0x40f860
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.00412800
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x4102f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
lea eax, [ebp - 4]
push eax
call dword [0x486484]
test eax, eax
jne 0x429fff
push esi
lea ecx, [ebp - 8]
push ecx
xor esi, esi
call dword [0x486480]
test eax, eax
jne 0x4103ab
push 0x104
lea edx, [ebp - 0x21c]
push ebx
push edx
call fcn.00413024
add esp, 0xc
push esi
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x10]
push edx
xor eax, eax
lea edx, [ebp - 0x21c]
push edx
mov word [ebp - 0x14], ax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push esi
push esi
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x4103a0
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 0x428]
push ecx
push edx
call dword [0x48647c]
mov esi, eax
test esi, esi
je 0x410391
push 0x104
lea eax, [ebp - 0x428]
push eax
push edi
call fcn.00413024
add esp, 0xc
xor ecx, ecx
mov word [edi + 0x208], cx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax]
mov edx, dword [edx + 0x14]
push ecx
push eax
call edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test esi, esi
pop esi
je 0x429fff
mov al, 1
mov esp, ebp
pop ebp
ret
sal ch, 1
int1
iretd
jecxz 0x42a008
xor ecx, dword [eax - 0x24]
cmp dl, 0xc1
cdq
jo 0x42a067
pushal
sti
loopne 0x429fd1
push edi
xor ah, byte [eax + 0x6d]
hlt
pushfd
adc eax, 0xa1bcc463
inc ebp
frstor dword [esi + 0x5c]
push esi
or al, 0xa1
loop 0x42a057
loope 0x42a072
sti
mov dword [0x7bad74c1], edi
push eax
outsb dx, byte [esi]
mul dword [eax + 0x512634b3]
mul esp
out 0x24, al
pushfd
sar esi, 1
xor dl, ch
in eax, dx
test al, 0x52
xor bh, al
mov al, byte [0x4017a318]
jae 0x42a075
aas
inc ebp
push 0xb0f5d3ed
int1

Function at 0x41be7c
Capabilities:
Encode data using xor

Disassembly:
push ebx
int 3
or al, 0xe5
add ebx, dword [edi]
enter 0x608, 9
int 0x16
mul ch
fsubp st(6)
cmp al, 0xf
cmpsb byte [esi], byte es:[edi]
dec edx
xor eax, ebx
sub bh, dh
movsd dword es:[edi], dword [esi]
xchg edi, eax
and edi, dword [esi + 0x40]
add dword [ebx], edi
movsd dword es:[edi], dword [esi]
add al, 0x2f
sub ch, byte [eax + 0x4faa6c24]
insb byte es:[edi], dx
stosb byte es:[edi], al
dec edi
and byte [edi + 0x1b80d381], dl
in eax, 0xcc
xor cl, byte [ebp - 0x20]
pop edx
xchg dword [edx], edi
or esi, ebp
aam 0xab
dec esi
mov ah, byte [ebx + 0x38dfa551]
mov ch, 0x13
xchg esp, eax
test cl, al
xchg ebx, eax
mov dword [0x6882911d], 0x3bacab36
xchg esi, eax
mov word [edi - 0x4b08e185], ds
fcomp qword [eax + ecx*4 + 0x3f87e8a2]
dec ecx
adc byte [0x90472877], dl
xchg esp, eax
jb 0x41be83
sbb byte [ebx], 0xe5
int3
hlt
Function at 0x4354ab
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
lea ebx, [ecx + edx]
mov edx, edi
imul edx, esi
add edx, edx
add esi, esi
or eax, 0xffffffff
add edx, edx
lea edi, [ecx + edi*4]
add esi, esi
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], ecx
movzx edi, byte [ecx + 2]
mov esi, eax
and esi, 0xff
xor esi, edi
movzx edi, byte [ecx + 1]
shr eax, 8
xor eax, dword [esi*4 + 0x4a1c88]
mov esi, eax
and esi, 0xff
xor esi, edi
movzx edi, byte [ecx]
shr eax, 8
xor eax, dword [esi*4 + 0x4a1c88]
add ecx, edx
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x4a1c88]
mov esi, dword [ebp + 0x14]
cmp ecx, ebx
jb 0x435534
add esi, dword [ebp + 0x10]
mov dword [ebp + 0x14], esi
mov ecx, esi
cmp esi, dword [ebp + 8]
jb 0x4354dc
not eax
mov dword [ebp + 0x14], eax
fild dword [ebp + 0x14]
test eax, eax
jns 0x43554b
fadd qword [0x49c838]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x4392ef
Capabilities:
Encode data using xor

Disassembly:
xor dword [esi - 4], ebx
frstor dword [edi + 8]
push cs
or byte [esi], cl
out dx, al
enter 0xffffffffffffde11, 0
mov al, cl
xor byte [edi + 9], dl
test dl, dh
mov dword [edx + 0x6d], edi
or al, byte [edx + edx*8]
sub dword [0x9e6a9287], ebp
inc ebx
js 0x4392f4
or eax, 0xa6e555a5
and eax, 0x386bac5f
lds ebx, [edx + 0x53]
test byte [esi - 0x76], bh
mov word [ebx + eax*8 + 0x23], ss
sbb al, 0x65
dec edx
adc byte [edi + 0x60], bl
and byte [esi + 0x2a00ece0], bh
xor eax, 0x7da6f6e3
ljmp 0xba55

Function at 0x43ad28
Capabilities:
Encode data using xor

Disassembly:
fsubr st(4), st(0)
push ss
pop eax
lodsd eax, dword [esi]
rcl byte [edi - 0x1dcdc0], cl
pop ebp
ja 0x43acff
test al, 0x40
sub al, 0xa1
sbb byte [edi + 0x1b], bh
inc esi
invalid
Function at 0x448f5f
Capabilities:
Encode data using xor

Disassembly:
ja 0x448f74
dec edi
or ebp, dword [edx - 0x5adf6e10]
imul eax, dword [ebp + 0x21ef89a0], 0x102dbd7e
pushal
sbb al, 0x12
adc eax, 0x3979ce21
jbe 0x448f1b
call 0xcea23c63
inc dword [esi + eax*4 + 0x2f514088]
das
fldz
out dx, al
scasd eax, dword es:[edi]
lahf
inc edx
test al, 0xba
jbe 0x448fb1
ret 0xdb5a
mov eax, dword [0x20449a23]
lahf
test byte [edx], 0xd6
les eax, [edi - 0x3ffb04a7]
xchg dword [ecx - 5], ebx
add al, 0xc0
sub byte [ebx + 0x33], bh
js 0x449023
push esp
or byte [ebx], 0x29
or ebp, dword [ecx]
fstp qword [eax + edi*8 + 0x5e0554d1]
sub edx, dword [esi]
xchg byte [edx], bl
xchg edi, eax
push ebx
cmpsd dword [esi], dword es:[edi]
jg 0x448f9e
add eax, 0x86162b5e
sbb dl, byte [edi - 0x1d8058ad]
jo 0x449020
insb byte es:[edi], dx
shr esi, cl
dec ebx
jg 0x448f94
cld
sal dword [esi - 0x54a13339], 0xe5
mov edi, 0xb9c574c2
loop 0x449053
fimul word [edx]
pop ecx
inc ebp
les ecx, [ecx - 0x24]
or ah, bl
in al, 0x45
div dword [ebx + 0x777d9749]
dec ecx
xchg edi, eax
jge 0x44905c
cmp dword [edx - 0x4cfb1fae], 0xffffff90
aas
adc byte [edx + 0xb], al
std
invalid
xchg edi, eax
cmpsd dword [esi], dword es:[edi]
ja 0x449052
jl 0x448fe1
mov ebx, 0x99789d22
test eax, 0x84d7d58c
jmp 0xa63d2393
lcall 0x45eb, 0x16acf51d
sbb eax, 0xeb16acf5
inc ebp
mov ebx, 0x9c9be448
wait
pushfd
add edi, esp
jecxz 0x4490c0
rcr dword [ebx - 0x7a2235ad], 1
sbb eax, 0x310e5a47
test dword [ebx], edi
pop ecx
shr byte [ebp + 0x4d], 0x53
inc edx
scasb al, byte es:[edi]
sar dword [esi - 0x34bb4753], 1
loope 0x4490f8
inc eax
fsub st(3)
imul dword [ebx + 0x36]
mov bl, 0xfb
pop eax
or byte cs:[ebp + ebx + 0x5cb2fab8], dl
sbb eax, 0x5cb2fab8
push es
add byte [esi + 0x5abafbab], dl
or al, 0xcf
cmp dl, byte es:[ecx]
fmulp st(5)
pop edi
mov dh, 0xb7
xlatb
cmp edx, dword [ecx]
sub ebx, 0x7c
or dl, bl
pop ds
add byte [esi], cl
int1
jns 0x4490d0
ror dword [ecx + 0x5dd35b9a], 0x62
sbb eax, 0xc87ddbd6
aad 0x67
xchg esp, eax
ja 0x4490da
nop
pop es
cld
bound ecx, qword [ecx - 0x3f5110d9]
sbb eax, dword [ebx + 0x25e6e7e6]
sbb cl, 0xd9
fstpnce st(1), st(0)
sub al, 0xb2
lock or byte [esp + eax*4 - 0x61], bl
fsub qword [eax]
fisttp qword [eax - 0x51]
and ch, bl
dec eax
scasd eax, dword es:[edi]
dec edx
dec edi
jg 0x44908a
sub byte [edx + 0x60], bl
or byte [ecx], ah
out dx, al
insb byte es:[edi], dx
sti
int1
sub esi, esp
mov edi, 0xc2b9583
rcr byte [0xab0d3795], cl
or ah, byte [edx + 0x3a]
into
jb 0x449146
mov eax, 0x88966df5
pop edx
adc al, 0xa3
dec esp
leave
pop ebx
int3
mov byte [edx + 0x14], bl
mov dword [0xcc5bc94c], eax
in al, dx
mov bh, 0x5a
xlatb
adc cl, cl
adc dl, byte [edi]
sar byte [edi], cl
into
and dword [edi], 0x109e9fdb
cmp eax, 0xc8719ac4
rol dword [edi + 1], 0xda
movsb byte es:[edi], byte [esi]
xchg ebx, eax
int1
mov al, byte [0xe0e4179e]
sbb esp, dword [edi + eax*2]
pop es
pop ecx
add byte [edx + edi], 0x95
retf 0xd26f
inc ebp
inc ebp
jne 0x449103
push esi
invalid