joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446113
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x446132
cmp dword [ebp + 0x10], 0
jne 0x44613c
mov eax, 0x10d
jmp 0x4462f4
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
jne 0x44614a
cmp dword [ebp + 0xc], 0
jne 0x446154
mov eax, 0x103
jmp 0x4462f4
mov eax, dword [ebp + 0xc]
shl eax, 2
xor edx, edx
mov ecx, 3
div ecx
add eax, 0x10
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfa000
jbe 0x44617c
mov eax, 0x103
jmp 0x4462f4
mov edx, dword [ebp - 0x54]
push edx
push ebp
call 0x4e4c05
add esp, 4
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jne 0x4461a0
mov eax, 0x122
jmp 0x4462f4
lea eax, [ebp - 0x48]
push eax
call fcn.00446040
add esp, 4
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x50], 0
mov ecx, dword [ebp - 0x58]
cmp ecx, dword [ebp + 0xc]
jae 0x4462e6
mov dword [ebp - 4], 0
mov dword [ebp - 0x4c], 0
jmp 0x4461df
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], 3
jae 0x446213
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp + 0xc]
jae 0x446213
mov ecx, dword [ebp - 4]
shl ecx, 8
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x58]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp - 4]
add ecx, eax
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x58]
add edx, 1
mov dword [ebp - 0x58], edx
jmp 0x4461d6
cmp dword [ebp - 0x4c], 3
jae 0x44622c
mov ecx, 3
sub ecx, dword [ebp - 0x4c]
shl ecx, 3
mov eax, dword [ebp - 4]
shl eax, cl
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0x12
and ecx, 0x3f
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov edx, dword [ebp - 0x50]
mov cl, byte [ebp + ecx - 0x48]
mov byte [eax + edx], cl
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 4]
shr eax, 0xc
and eax, 0x3f
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov al, byte [ebp + eax - 0x48]
mov byte [edx + ecx], al
mov ecx, dword [ebp - 0x50]
add ecx, 1
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x4c], 1
jne 0x44627d
mov dword [ebp - 0x5c], 0x3d
jmp 0x44628f
mov edx, dword [ebp - 4]
shr edx, 6
and edx, 0x3f
xor eax, eax
mov al, byte [ebp + edx - 0x48]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x50]
mov cl, byte [ebp - 0x5c]
mov byte [edx + eax], cl
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
cmp dword [ebp - 0x4c], 1
je 0x4462c3
cmp dword [ebp - 0x4c], 2
je 0x4462c3
mov eax, dword [ebp - 4]
and eax, 0x3f
xor ecx, ecx
mov cl, byte [ebp + eax - 0x48]
mov dword [ebp - 0x60], ecx
jmp 0x4462ca
mov dword [ebp - 0x60], 0x3d
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x50]
mov dl, byte [ebp - 0x60]
mov byte [eax + ecx], dl
mov eax, dword [ebp - 0x50]
add eax, 1
mov dword [ebp - 0x50], eax
jmp 0x4461ba
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x50]
mov byte [edx + eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x462b69
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0xc3d2e1f0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
push 0x40
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
call fcn.0041bafc
add esp, 0xc
pop ebp
ret 4
Function at 0x47ece3
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x47ed14
mov eax, dword [ebp + 0x14]
add eax, 2
cdq
mov ecx, 3
idiv ecx
lea edx, [eax*4 + 1]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0046fbdf
add esp, 8
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x47ed21
xor eax, eax
jmp 0x47ee9c
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
mov byte [edx], 0
cmp dword [ebp + 0xc], 0
jne 0x47ed3b
mov eax, dword [ebp - 4]
jmp 0x47ee9c
jmp 0x47ed4f
mov eax, dword [ebp + 0x14]
sub eax, 3
mov dword [ebp + 0x14], eax
mov ecx, dword [ebp + 0xc]
add ecx, 3
mov dword [ebp + 0xc], ecx
cmp dword [ebp + 0x14], 2
jle 0x47edca
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 1]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 2]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
jmp 0x47ed97
mov ecx, dword [ebp - 0xc]
shr ecx, 6
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], 0
jle 0x47edbc
mov edx, dword [ebp - 0xc]
and edx, 0x3f
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 8]
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x47ed8e
mov eax, dword [ebp + 0x10]
add eax, 4
mov dword [ebp + 0x10], eax
jmp 0x47ed3d
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 0
cmp dword [ebp + 0x14], 0
jle 0x47ee99
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
jmp 0x47edf3
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x14]
jge 0x47ee18
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
jmp 0x47edea
jmp 0x47ee23
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 3
jge 0x47ee34
mov eax, dword [ebp - 0xc]
shl eax, 8
mov dword [ebp - 0xc], eax
jmp 0x47ee1a
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x47ee48
mov edx, dword [ebp - 0xc]
shr edx, 6
mov dword [ebp - 0xc], edx
cmp dword [ebp - 8], 0
jle 0x47ee6d
mov eax, dword [ebp - 0xc]
and eax, 0x3f
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 8]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
jmp 0x47ee3f
mov dword [ebp - 8], 3
jmp 0x47ee7f
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x14]
jle 0x47ee92
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 8]
mov byte [eax], 0x3d
jmp 0x47ee76
mov ecx, dword [ebp + 0x10]
mov byte [ecx + 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x47ed51
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x47ed14
mov eax, dword [ebp + 0x14]
add eax, 2
cdq
mov ecx, 3
idiv ecx
lea edx, [eax*4 + 1]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0046fbdf
add esp, 8
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x47ed21
xor eax, eax
jmp 0x47ee9c
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
mov byte [edx], 0
cmp dword [ebp + 0xc], 0
jne 0x47ed3b
mov eax, dword [ebp - 4]
jmp 0x47ee9c
jmp 0x47ed4f
mov eax, dword [ebp + 0x14]
sub eax, 3
mov dword [ebp + 0x14], eax
mov ecx, dword [ebp + 0xc]
add ecx, 3
mov dword [ebp + 0xc], ecx
cmp dword [ebp + 0x14], 2
jle 0x47edca
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 1]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 2]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
jmp 0x47ed97
mov ecx, dword [ebp - 0xc]
shr ecx, 6
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], 0
jle 0x47edbc
mov edx, dword [ebp - 0xc]
and edx, 0x3f
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 8]
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x47ed8e
mov eax, dword [ebp + 0x10]
add eax, 4
mov dword [ebp + 0x10], eax
jmp 0x47ed3d
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 0
cmp dword [ebp + 0x14], 0
jle 0x47ee99
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
jmp 0x47edf3
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x14]
jge 0x47ee18
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
jmp 0x47edea
jmp 0x47ee23
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 3
jge 0x47ee34
mov eax, dword [ebp - 0xc]
shl eax, 8
mov dword [ebp - 0xc], eax
jmp 0x47ee1a
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x47ee48
mov edx, dword [ebp - 0xc]
shr edx, 6
mov dword [ebp - 0xc], edx
cmp dword [ebp - 8], 0
jle 0x47ee6d
mov eax, dword [ebp - 0xc]
and eax, 0x3f
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 8]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
jmp 0x47ee3f
mov dword [ebp - 8], 3
jmp 0x47ee7f
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x14]
jle 0x47ee92
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 8]
mov byte [eax], 0x3d
jmp 0x47ee76
mov ecx, dword [ebp + 0x10]
mov byte [ecx + 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4b7fb0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, eax
mov ebx, ecx
jne 0x4b7fd9
push esi
call fcn.004b7920
test al, al
jne 0x4b7fd9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x48]
push eax
push ecx
call fcn.004b2150
mov edi, eax
call fcn.004b2510
add esp, 4
push eax
mov eax, 0x40
call fcn.004b5fc0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc0]
push edx
push eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 4], 0x40
call fcn.004b4560
mov ecx, dword [ebp - 4]
add esp, 0x10
xor eax, eax
push 4
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x7c], eax
mov byte [ebp - 0x80], al
push 0x10
mov eax, esi
mov byte [ebp + ecx - 0xc0], 0
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
mov dword [ebp - 0x20], 0xc3d2e1f0
call fcn.004b42d0
test al, al
je 0x4b806b
mov edi, dword [ebp - 4]
jmp 0x4b806e
or edi, 0xffffffff
push 4
lea eax, [ebp - 4]
push eax
push 0xc
mov eax, esi
call fcn.004b42d0
test al, al
je 0x4b8086
mov eax, dword [ebp - 4]
jmp 0x4b8089
or eax, 0xffffffff
push edi
push eax
push esi
lea esi, [ebp - 0x80]
call fcn.004b47e0
cmp byte [ebp - 0x80], 0
mov dword [ebp - 4], 0x40
jne 0x4b80aa
call fcn.004b4d10
mov byte [ebp - 0x80], 1
xor eax, eax
lea esp, [esp]
mov ecx, dword [ebp + eax*4 - 0x30]
bswap ecx
mov dword [ebp + eax*4 - 0x1c], ecx
inc eax
cmp eax, 5
jb 0x4b80b0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x1c]
push 0x14
push ecx
call fcn.004b4560
mov edx, dword [ebp - 4]
add esp, 0x10
cmp byte [ebp + 0xc], 0
mov byte [ebp + edx - 0x100], 0
mov eax, 0x4d03dc
jne 0x4b80f4
mov eax, 0x4d03f4
push 0
push eax
mov edi, ebx
call fcn.004b7e30
mov eax, dword [ebp + 8]
push 1
push eax
call fcn.004b7e30
push 0
push 0x4d040c
call fcn.004b7e30
push 1
lea ecx, [ebp - 0xc0]
push ecx
call fcn.004b7e30
push 0
push 0x4d0414
call fcn.004b7e30
push 1
lea edx, [ebp - 0x100]
push edx
call fcn.004b7e30
cmp byte [ebp + 0xc], 0
je 0x4b8148
call fcn.004b7f10
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b8350
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
jne 0x4b836f
mov ebx, dword [ebp + 8]
push eax
call fcn.004b7920
test al, al
je 0x4b83a9
mov ebx, dword [ebp + 0xc]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b8377
sub eax, edx
mov esi, eax
push esi
mov dword [ebp + 0xc], esi
call fcn.004bed64
lea ecx, [ebp + 0xc]
push ecx
mov edi, eax
push edi
push esi
push ebx
call fcn.004b4680
add esp, 0x14
test al, al
jne 0x4b83b4
push edi
call fcn.004bf454
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
xor ebx, ebx
push edx
push edi
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x2c], 0x67452301
mov dword [ebp - 0x28], 0xefcdab89
mov dword [ebp - 0x24], 0x98badcfe
mov dword [ebp - 0x20], 0x10325476
mov dword [ebp - 0x1c], 0xc3d2e1f0
mov byte [ebp - 0x7c], bl
call fcn.004b4790
mov dword [ebp + 0xc], 0x40
cmp byte [ebp - 0x7c], bl
jne 0x4b8407
call fcn.004b4d10
mov byte [ebp - 0x7c], 1
xor eax, eax
lea esp, [esp]
mov ecx, dword [ebp + eax*4 - 0x2c]
bswap ecx
mov dword [ebp + eax*4 - 0x18], ecx
inc eax
cmp eax, 5
jb 0x4b8410
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x18]
push 0x14
push ecx
call fcn.004b4560
mov edx, dword [ebp + 0xc]
push edi
mov byte [ebp + edx - 0xbc], bl
call fcn.004bf454
mov bl, byte [ebp + 0x10]
add esp, 0x14
mov eax, 0x4d0438
test bl, bl
jne 0x4b845a
mov eax, 0x4d0450
mov edi, dword [ebp + 8]
push 0
push eax
call fcn.004b7e30
push 1
lea eax, [ebp - 0xbc]
push eax
call fcn.004b7e30
test bl, bl
je 0x4b847c
call fcn.004b7f10
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b8388
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
jne 0x4b836f
mov ebx, dword [ebp + 8]
push eax
call fcn.004b7920
test al, al
je 0x4b83a9
mov ebx, dword [ebp + 0xc]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b8377
sub eax, edx
mov esi, eax
push esi
mov dword [ebp + 0xc], esi
call fcn.004bed64
lea ecx, [ebp + 0xc]
push ecx
mov edi, eax
push edi
push esi
push ebx
call fcn.004b4680
add esp, 0x14
test al, al
jne 0x4b83b4
push edi
call fcn.004bf454
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
xor ebx, ebx
push edx
push edi
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x2c], 0x67452301
mov dword [ebp - 0x28], 0xefcdab89
mov dword [ebp - 0x24], 0x98badcfe
mov dword [ebp - 0x20], 0x10325476
mov dword [ebp - 0x1c], 0xc3d2e1f0
mov byte [ebp - 0x7c], bl
call fcn.004b4790
mov dword [ebp + 0xc], 0x40
cmp byte [ebp - 0x7c], bl
jne 0x4b8407
call fcn.004b4d10
mov byte [ebp - 0x7c], 1
xor eax, eax
lea esp, [esp]
mov ecx, dword [ebp + eax*4 - 0x2c]
bswap ecx
mov dword [ebp + eax*4 - 0x18], ecx
inc eax
cmp eax, 5
jb 0x4b8410
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x18]
push 0x14
push ecx
call fcn.004b4560
mov edx, dword [ebp + 0xc]
push edi
mov byte [ebp + edx - 0xbc], bl
call fcn.004bf454
mov bl, byte [ebp + 0x10]
add esp, 0x14
mov eax, 0x4d0438
test bl, bl
jne 0x4b845a
mov eax, 0x4d0450
mov edi, dword [ebp + 8]
push 0
push eax
call fcn.004b7e30
push 1
lea eax, [ebp - 0xbc]
push eax
call fcn.004b7e30
test bl, bl
je 0x4b847c
call fcn.004b7f10
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4021d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x4021e1
jmp dword [eax*4 + 0x403368]
cmp dword [0x404088], 0
je 0x4022f0
push 0x40408c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4040a4]
test edi, edi
je 0x4022e5
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40222b
mov edi, dword [edi + 8]
test edi, edi
je 0x4022e5
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x402220
test esi, esi
je 0x402220
mov ecx, dword [edi + 4]
call dword [0x403434]
push esi
call ecx
add esp, 4
jmp 0x402220
call fcn.00401b40
jmp case.default.0x4021e1
cmp dword [0x404088], 0
je case.default.0x4021e1
push 0x40408c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4040a4]
test edi, edi
je 0x4022d8
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x402297
mov edi, dword [edi + 8]
test edi, edi
je 0x4022d8
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x402290
test esi, esi
je 0x402290
mov ecx, dword [edi + 4]
call dword [0x403434]
push esi
call ecx
add esp, 4
jmp 0x402290
cmp dword [0x404088], 0
jne 0x4022cc
push 0x40408c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x404088], 1
jmp case.default.0x4021e1
push 0x40408c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x4021e1
push 0x40408c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x404088]
cmp eax, 1
jne case.default.0x4021e1
mov eax, dword [0x4040a4]
test eax, eax
je 0x402322
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x402310
mov dword [0x4040a4], 0
mov dword [0x404088], 0
push 0x40408c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402470
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x403004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x4024d6
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x4024d6
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x4024d6
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x4024d6
mov edx, dword [esp + 0xc]
sub edx, dword [0x403004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x4024c6
add esi, 0x28
dec ecx
je 0x4024d6
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x4024c0
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x4024c0
mov eax, esi
pop esi
pop edi
ret
Function at 0x4ee572
Capabilities:
Encode data using xor

Disassembly:
test dword [ecx], eax
invalid
in eax, dx
cmp dword [edx], 0x2410c90b
popal
push esi
mov dl, 0x5b
scasb al, byte es:[edi]
sahf
push ebx
aam 0x36
insb byte es:[edi], dx
mov edi, 0xc1aa21b7
mov dword [ebx], esp
loop 0x4ee502
cwde
or dword [ebx], 0x62c74c19
sbb byte [edx], dh
xor ch, byte [ecx]
sbb dword [edi + 0x61d0dc91], edi
outsd dx, dword [esi]
sub byte [esi - 0x17e2cb2], al
test al, 0x5a
cmpsd dword [esi], dword es:[edi]
dec esi
sbb dword [esi + 0x481b7f60], edi
movsb byte es:[edi], byte [esi]
dec esi
pop ebx
std
mov al, byte [0xf2aed0f4]
mov esp, 0xa808a12d
invalid
invalid
test al, 0x43
jge 0x4ee615
pop edi
add al, 0x16
pushal
mov ebx, 0x8b6e1e84
sbb esi, dword [ecx - 0x70]
mov edi, 0xb23e60aa
ret 0x4af
pop eax
mov eax, 0xb3d97e44
out dx, al
pop eax
nop
mov byte [0x4013838d], al
clc
xchg edx, eax
wait
ror dword [esp + ebp*2], cl
or al, 0x6c
das
xor dword [esi + 0x54], eax
push esp
aad 0x7e
jb 0x4ee5bc
int3
mov byte [0x46160869], al
outsb dx, byte [esi]
sub eax, 0xb0e59f13
jbe 0x4ee5d0
test eax, 0x90b63eb
pop eax
hlt

Function at 0x54367e
Capabilities:
Encode data using xor

Disassembly:
jnp 0x543623
push ds
das
mov ch, 0x79
scasb al, byte es:[edi]
pop es
and dword [esi + ebx*2], esp
or byte [esi - 0x30af7448], cl
sbb esi, esp
sbb edi, 0x892e2d28
out dx, al
sbb esp, eax
xor dword [ebx*4 + 0x1453c924], edx
lahf
int3
sbb bl, cl
bound ecx, qword [ecx + ebp*4 + 0x4c]
dec eax
inc eax
sar dword [esi - 0x2b], cl
scasb al, byte es:[edi]
in eax, 0x12
mov ecx, 0x4e8381f
ret 0xe7ca
out 0x77, eax
inc ebx
or eax, 0x37131f7e
and al, 0xf1
fisubr dword [edx - 0x13]
cli
jp 0x5435a9
aas
mov ah, 0x9a
in eax, dx
test esi, 0xb072e3ac
sbb eax, 0x7f4b229c
adc eax, 0x43e78f79
jecxz 0x54363f
clc
mov bl, 0x1c
xor byte [eax], bl
imul esi, dword [eax + 1], 0x64
jo fcn.00543626
add bl, byte fs:[edx]
inc eax
jp 0x5435e2
mov bh, 0xd5
std
aad 0xfd
outsb dx, byte [esi]
outsb dx, byte [esi]
ficom word [edi - 0x3c70f1a3]
mov esi, 0x9c753f4f
add byte [ebp - 0x271ea3d0], al
wait
add eax, 0x3a18dcd0
stosd dword es:[edi], eax
xor cl, byte [edx + 0x7a]
jae 0x54362a
fcomp dword [ebx + 0x18dcd005]
cmp ch, byte [ebx + 0x737a4a32]
fsubrp st(0)
mov ebp, 0x6850a2ee
retf
loopne 0x54360b
out dx, al
mov byte [0x2ccb6850], al
or edi, dword [ecx + ebx + 0x2c6a0e1c]
jp 0x5436ad
mov fs, word [esi + 0x592757ce]
xor al, 0xc3
xor bl, byte [esi]
sahf
leave
inc ecx
jb 0x5435f7
mov ebp, 0x2a01cf94
loop 0x543677
pop esi
sub al, 0xae
push edx
nop
insd dword es:[edi], dx
insd dword es:[edi], dx
mov dl, 0xd8
cmc
invalid

Function at 0x57fc72
Capabilities:
Encode data using xor

Disassembly:
arpl word [edx], bp
sal dword [edi - 0x31], cl
push ds
sbb dword [edi], edx
fisub word [esi]
cmp dword [esi - 0x7467d137], ecx
add dword [eax + 0x4d], esi
or al, 0x71
adc ebx, dword [eax - 0x8cad48a]
mov esi, 0x22d61b04
cmpsb byte [esi], byte es:[edi]
das
mov ah, 0x75
cmp dword [ebx - 0x72], 0x77
or dl, byte [ebx + 0x341d93e]
invalid
Function at 0x5840a2
Capabilities:
Encode data using xor

Disassembly:
and al, 0x40
lodsd eax, dword [esi]
mov ebx, 0x4333660
sub al, al
pushal
mov eax, 0xd8dd642c
xor eax, dword [edx + ebp]
shl byte [eax - 0x48], 0x2c
fstp st(0)
push esi
pop esi
mov ebp, 0x8c299b50
cli
mov ebp, dword cs:[ebp - 0x66]
les esp, [0x838c32eb]
outsb dx, byte [esi]
sar dword [ebx + 0x25], 0x9e
loop 0x5840a8
sub eax, 0x809ada2d
movsd dword es:[edi], dword [esi]
enter 0xffffffffffffb8cf, 0xffffffffffffffe4
paddw mm7, qword [esi - 0x65]
inc edi
bnd jb 0x58410c
xor byte [edi + ebx*2 - 6], bh
jnp 0x5840d9
push ebx
lea eax, [edx + 0x66faf23c]
cmp eax, 0xf9183d0
push edi
cdq
fcomp dword [esp + eax*4 - 0x4c]
inc eax
fldenv [ecx - 0x6cc3a3d7]
xor al, 0x9d
adc al, 0x3e
xlatb
hlt
invalid

Function at 0x623c16
Capabilities:
Encode data using xor

Disassembly:
invalid
mov ecx, 0xba99a72d
js 0x623bfa
xor byte [ebp + 0x6b], ch
inc edx
inc edx
sub ch, byte [edi + 0x3a]
ror bh, cl
in eax, 0x81
add dh, 0x57
xor dword [esi + 0x7f], esp
dec ebx
sub eax, 0x63eb562
sahf
xor eax, edx
movsd dword es:[edi], dword [esi]
jle 0x623c21
cmp esi, ecx
adc eax, 0xe75fc727
and eax, 0x4710496
sbb edx, edi
sbb bh, al
test byte [eax], bh
movsb byte es:[edi], byte [esi]
das
das
fiadd dword [edi]
pop ecx
xor bl, byte [0x5d6b2465]
and al, 0x6b
pop ebp
aam 0x4d
push ss
mov ebp, 0x886f64a6
movsd dword es:[edi], dword [esi]
add edi, dword [eax - 0x3439d81f]
aam 0xb1
leave
push ebp
mov ah, 0x35
aam 0xc9
clc
cmp byte [eax - 0x37], 0xc2
add eax, 0x8b11c66c
mov esi, 0xa4af58fc
push ebx
jne 0x623c53
js 0x623c75
mov ah, 0x12
aaa
jbe 0x623cda
mov ah, 0xaa
add byte [ebp - 0x1a], 0xaa
mov dh, 0x6c
retf 0x6df5
cmp byte [eax - 0x28], al
mov ecx, dword [ebx]
in al, dx
jg 0x623c50
invalid
stosb byte es:[edi], al
mov edx, 0x5b81b5cb
jnp 0x623d19
mov edi, 0xe63c08bc
or dword [esi + esi*2 - 0x2c], ebx
sub byte [ebx - 1], cl
salc
stosb byte es:[edi], al
push ebx
mov eax, 0x9a8596d5
dec ebp
cwde
add byte [ebx + 0x57], ch
add ebx, ebp
retf
cdq
scasd eax, dword es:[edi]
dec ecx
xlatb
les edi, [edx]
jne 0x623d62
xchg esp, eax
or edx, dword [ebp - 0x6a6b8bdd]
sub ebx, dword [ebp + 0x35]
fsubp st(5)
dec ebx
aas
imul ebx, dword [edx - 0x60], 0x411d406d
rcr byte [ebx - 0x5e], 1
in eax, dx
xor ah, bh
jmp 0x623cbf
and eax, 0x4b4fdc3b
imul edi, dword [ecx + 6], 0xd6c9e411
inc esi
mov ah, 0xd2
stc
pop eax
push esi
mov ebx, 0x3664bcf5
sub eax, 0x8fdfa55e
pop esi
movsd dword es:[edi], dword [esi]
invalid
invalid
movsd dword es:[edi], dword [esi]
ret