joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020adc
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10020b8b
call fcn.1001d6c0
mov ecx, dword [0x10064ce0]
cmp ecx, 2
je 0x10020b0a
xor eax, eax
cmp ecx, 1
sete al
jmp 0x10020c05
push 0x10064a20
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
push ecx
push ecx
call fcn.1001dd8a
call fcn.1001a689
sub esp, 0xc
call fcn.1001d100
mov eax, dword [ebp + 8]
push 0x10008cdc
mov dword [0x10064cf4], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x10008b0c
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x10008aa4
mov dword [0x10064cec], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x10008ad4
mov dword [0x10064cf0], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x10008d18
mov dword [0x10064ce8], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x10064ce4], eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
mov dword [0x100645a4], eax
mov cl, 1
jmp 0x10020b92
cmp eax, 2
jne 0x10020b99
xor cl, cl
call fcn.1001478b
jmp 0x10020c02
cmp eax, 3
jne 0x10020bb1
call fcn.1001d7e2
xor cl, cl
call fcn.10013a9f
call fcn.1001d880
jmp 0x10020c02
test eax, eax
jne 0x10020c02
mov ecx, dword [0x10064ce0]
cmp ecx, 2
jne 0x10020afd
mov cl, 1
call fcn.10013a9f
call fcn.1001d7e2
call fcn.1001d880
mov eax, dword [0x100645a4]
cmp eax, 0xffffffff
je 0x10020bed
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
or dword [0x100645a4], 0xffffffff
call fcn.1001ddb5
push 0x10064a20
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
call fcn.1001cf6c
xor eax, eax
inc eax
pop ebp
ret 0xc

Function at 0x10024ca8
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x10024ce3
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10024cca
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x10024cdb
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x10024ce5
inc edi
add eax, 0x28
cmp edi, esi
jb 0x10024cc0
xor eax, eax
pop edi
pop esi
ret
Function at 0x404060
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x408
mov eax, dword [0x41f004]
xor eax, esp
mov dword [esp + 0x404], eax
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [esp + 0xc]
push 0xffffffffffffffff
push 0x400
push eax
call fcn.00401000
push dword [eax + 4]
push dword [eax]
call fcn.00407ae7
add esp, 0x20
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004040bd
mov esp, ebp
pop ebp
ret

Function at 0x40d36c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040d00e

Function at 0x4110e3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc esp
add ebx, esp
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.0040fc70
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x41110c
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x411155
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x4110ff
call fcn.0040fcff
mov ch, 0xae
add ebx, dword [edi]
and byte [ebp - 0x72c], 0
Function at 0x4ec670
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8f000]
mov dword [edi + 0xcf740], 0xb204d659
push edi
jmp 0x4ec69a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ec6a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ec690
mov eax, 1
add ebx, ebx
jne 0x4ec6b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ec6c4
jne 0x4ec6e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ec6e3
dec eax
add ebx, ebx
jne 0x4ec6d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4ec6a8
add ebx, ebx
jne 0x4ec6df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4ec735
xor ecx, ecx
sub eax, 3
jb 0x4ec6fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ec76a
sar eax, 1
mov ebp, eax
jmp 0x4ec706
add ebx, ebx
jne 0x4ec706
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ec6d4
inc ecx
add ebx, ebx
jne 0x4ec714
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ec6d4
add ebx, ebx
jne 0x4ec721
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ec716
jne 0x4ec732
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ec716
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ec754
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ec746
jmp 0x4ec696
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ec754
add edi, ecx
jmp 0x4ec696
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ec772
cmp byte [edi], 0x11
jne 0x4ec772
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ec777
lea edi, [esi + 0xe5000]
mov eax, dword [edi]
or eax, eax
je 0x4ec7ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf3664]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf37e0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4ec7a4
mov ecx, edi
jns 0x4ec7d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf37e4]
or eax, eax
je 0x4ec7e9
mov dword [ebx], eax
add ebx, 4
jmp 0x4ec7c1
call dword [esi + 0xf37f4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4ec820
cmp al, 0xef
ja 0x4ec813
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4ec7f5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4ec802
mov ebp, dword [esi + 0xf37e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ec854
sub esp, 0xffffff80
jmp 0x420577
Function at 0x43b65e
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
sub edx, 0x77e083cc
or ecx, edx
call fcn.0043b6a5
add ecx, edx
xor dword [ebx], edi
sub edx, 0x36fadaf7
add ecx, 0x978e513
add edx, 0xae901b81
inc ebx
add edx, 0x5c3cdaff
and ecx, edx
add edx, ecx
cmp ebx, eax
jne fcn.0043b65e
dec edx
push 0xd426d232
pop ecx
or edx, edx
ret

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0xcd3a80
Capabilities:
Encode data using xor

Disassembly:
div byte [ebx]
mov ch, 0x8b
nop
das
fisub word [edx - 0x18]
sbb ecx, eax
mov word [ecx + ecx*8 + 0x6c], ss
cld
inc eax
pop eax
inc ebp
add dword [ebp + 0x56], 0x6a
add byte [eax], 0
jmp 0xcd3a8a
pushal
call 0xcd3a90
pop ebp
sub ebp, 0x10
sub ebp, 0x8d3a80
jmp 0xcd3aa6
mov eax, 0x8d3a80
add eax, ebp
add eax, 0x4c
mov ecx, 0x584
mov edx, 0x67ae7d8a
xor byte [eax], dl
inc eax
dec ecx
jne 0xcd3abd
invalid
jmp 0xcd3ad0
add dword [edi + 1], eax
add esi, dword [esi + 0xb8a8a8a]
dec ebx
jb 0xcd3a66
mov cl, byte [edx - 0x73cdb877]
mov cl, byte [edx - 0x755dcf76]
mov cl, byte [edx + 0x4289687d]
add dword [ebx], ecx
xchg byte [edx + 0x4f898a8a], cl
fcmovu st(0), st(2)
loop 0xcd3ac4
adc byte [edx + ecx*4 - 0x1a454b1e], 0x8a
mov esp, dword [esi + 0x3370e2ae]
or byte [eax], 0x62
invalid

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2d3e68e7
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..rsrc
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x455a72ff
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0xad9174
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov ebx, ecx
test ebx, ebx
jle 0xad91df
mov ecx, 1
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, ecx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
sub eax, 1
sbb edx, 0
mov al, byte [eax]
push eax
mov eax, edi
xor edx, edx
push edx
push eax
mov eax, ecx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
sub eax, 1
sbb edx, 0
pop edx
xor dl, byte [eax]
push edx
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, ecx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
sub eax, 1
sbb edx, 0
pop edx
mov byte [eax], dl
inc ecx
dec ebx
jne 0xad9186
pop edi
pop esi
pop ebx
ret
Function at 0xada8d4
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, eax
mov ebx, 0xb651e8
jmp fcn.017bb3ee
Function at 0xadb404
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0xb659e8
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0xadb4c8
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0xadb43c
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0xadb4df
dec edx
je 0xadb520
jmp 0xadb57d
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0xadb57d
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xadb5e0
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0xadb5fd
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0xadb70f
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0xadb630
je 0xadb67c
sub ecx, 0x2b
je 0xadb672
sub ecx, 4
je 0xadb677
dec ecx
sub ecx, 0xa
jb 0xadb661
jmp 0xadb67f
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0xadb642
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0xadb650
jmp 0xadb67f
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0xadb67f
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0xadb67f
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0xadb67f
mov byte [eax], 0x3e
jmp 0xadb67f
mov byte [eax], 0x3f
jmp 0xadb67f
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0xadb60f
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0xadb6cf
cmp byte [esp + 3], 0xff
jne 0xadb6cf
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0xadb707
cmp dl, 0xff
je 0xadb707
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0xadb608
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0xadc690
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00a183d4
ret
Function at 0xadc860
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00a15288
xor eax, eax
push ebp
push 0xadc9ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.00adc690
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00a15298
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0xadc98d
xor eax, eax
push ebp
push 0xadc986
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0xadc96f
xor eax, eax
push ebp
push 0xadc968
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0xadc951
xor eax, eax
push ebp
push 0xadc94a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.00adc6c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xadc951
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xadc96f
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xadc98d
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.00adc744
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xadc9b5
lea eax, [ebp - 4]
call fcn.00a14dc8
ret

Function at 0xae4f1c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0xb75cd0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0xae4f3e
shr eax, 1
xor eax, 0xedb88320
jmp 0xae4f40
shr eax, 1
dec edx
jne 0xae4f2c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0xae4f25
mov byte [0xb760d0], 1
pop esi
pop ebx
ret

Function at 0xae4f5c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0xb760d0], 0
jne 0xae4f73
call fcn.00ae4f1c
mov eax, edi
dec eax
test eax, eax
jl 0xae4f9c
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0xb75cd0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0xae4f7d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0xae75bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0xae75ed
dec al
je 0xae7629
dec al
je 0xae766d
dec al
je 0xae76d8
jmp 0xae7762
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0xae7762
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0xae75fd
jmp 0xae7762
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0xae7762
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0xae7639
jmp 0xae7762
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0xae7762
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0xae769b
xor ebp, ebp
jmp 0xae76ac
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0xae76b5
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0xae767d
jmp 0xae7762
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0xae7762
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0xae7730
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00ae4fa4
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0xae76ec
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret