joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1018cb0d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x102028dc], 0
mov dword [0x102028e0], 0
mov dword [0x102028ec], 0
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x1018cb81
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x102028e0]
mov ecx, dword [0x102028dc]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add edx, 1
mov edi, eax
add edi, 1
mov dword [0x102028d4], 0x1117
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv esi
mov dword [0x102028dc], edx
mov ebx, dword [ebp - 0x20]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x102028e0], edx
mov dword [0x102028d8], 0x1d4a
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x102028e4], cl
mov dword [0x102028d8], 0xde
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov edx, dword [0x102028d4]
add edx, 0xfffff139
mov dword [0x102028d4], edx
mov cl, byte [0x102028e4]
mov edx, dword [0x102028e0]
mov byte [ebx + edx], cl
mov edx, dword [0x102028dc]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x102028e0]
movzx ecx, byte [ebx + ecx]
add ecx, edx
mov edx, dword [0x102028d8]
mov esi, edx
add esi, 0xffffed9e
mov dword [0x102028d4], esi
and ecx, 0xff
mov dword [0x102028ec], ecx
add edx, 0xffffd6c7
mov dword [0x102028d8], edx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x102028d4], 0x1c45
xor ch, cl
mov byte [0x102028f0], ch
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], ch
mov dword [0x102028d8], 0x1677
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x2c], edi
je 0x1018cb62
jmp 0x1018cb6a
Function at 0x1018cc9c
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov edx, dword [0x102028d4]
add edx, 0x25b9
mov dword [0x102028d4], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1018c178
lea ecx, [0x1018c461]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x60], edx
mov dword [esp + 0x30], 0x12c400
mov dword [0x102028d8], 0xae6
mov edx, dword [0x102028c0]
mov dword [esp + 0x64], edx
mov edx, dword [0x102028c4]
mov dword [esp + 0x50], edx
mov edx, dword [0x102028c8]
mov dword [esp + 0x78], edx
mov edx, dword [0x102028cc]
mov dword [esp + 0x68], edx
mov edx, dword [0x102028d0]
mov dword [esp + 0x5c], edx
mov dword [0x102028d4], 0x6f5
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
je 0x1018cd75
jmp 0x1018cd89
mov eax, dword [esp + 0x10]
mov dword [esp + 0x74], eax
mov dword [0x102028d8], 0x2594
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x70], edx
call fcn.1018bf12
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
je 0x1018cda7
jmp 0x1018cde3
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x1018cd43
mov dword [0x102028d8], 0x3ad
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1018cd32
lea eax, [esp + 0x30]
mov ecx, dword [0x102028d4]
add ecx, 0x20eb
mov dword [0x102028d4], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1018bba4
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x406128
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40614d
mov dword [0x40a0f4], eax
add esp, 0xfffffff8
push 0x4060ec
push eax
call fcn.00407c20
jmp 0x406152
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x406168
mov dword [0x409054], 0x40624c
jmp 0x406172
mov dword [0x409054], 0x406200
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4b8e70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x76000]
push edi
jmp 0x4b8e8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b8e91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b8e80
mov eax, 1
add ebx, ebx
jne 0x4b8ea3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b8eb4
jne 0x4b8ed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b8ed3
dec eax
add ebx, ebx
jne 0x4b8ec0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b8e98
add ebx, ebx
jne 0x4b8ecf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b8f25
xor ecx, ecx
sub eax, 3
jb 0x4b8eeb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b8f5a
sar eax, 1
mov ebp, eax
jmp 0x4b8ef6
add ebx, ebx
jne 0x4b8ef6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b8ec4
inc ecx
add ebx, ebx
jne 0x4b8f04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b8ec4
add ebx, ebx
jne 0x4b8f11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b8f06
jne 0x4b8f22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b8f06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b8f44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b8f36
jmp 0x4b8e86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b8f44
add edi, ecx
jmp 0x4b8e86
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b8f62
cmp byte [edi], 0x13
jne 0x4b8f62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b8f67
lea edi, [esi + 0xb4000]
mov eax, dword [edi]
or eax, eax
je 0x4b8fdf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc0038]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc018c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b8f94
mov ecx, edi
jns 0x4b8fc3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc0190]
or eax, eax
je 0x4b8fd9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b8fb1
call dword [esi + 0xc01a0]
mov ebp, dword [esi + 0xc0194]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b9013
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x5e9763
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa61cec
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x5e97e3
arpl word [edx + esi], si
inc byte [edx + 0x5f5f2194]
ja entry0
xchg esp, eax
iretd
aas
mov ss, word [eax + 0x40971438]
imul ebp, dword [eax], 0xffffffa4
fadd dword [esi]
pop edi
in eax, 0x60
mov dword [edx - 0x1e], edi
lahf
popfd
inc esp
jne 0x5e985d
push es
out dx, eax
invalid
xor eax, 0x3dfd7a62
mov ebp, esp
mov edx, dword [ecx + 0x75]
std
outsd dx, dword ss:[esi]
mov al, byte [0x3597997f]
sub dword [eax + ebx - 0x41], esp
cmp eax, 0x886e1119
mov eax, dword [0xbb535f4]
mov byte [ecx + 0xbb535f4], ah
mov ch, 0xb
pop edx
mov dword [0x6ad0c928], eax
xchg dword [edi + 0x73], eax
mov esi, 0x2c15799b
arpl bx, ax
push ds
xor eax, edx
xlatb
sbb esp, eax
out 0x18, eax
scasd eax, dword es:[edi]
dec ebp
push eax
rol dword [edi + 0x68d0da9d], cl
insb byte es:[edi], dx
fisub word [edx - 0x3f731e6d]
push ds
pop ebx
stc
outsb dx, byte [esi]
je 0x5e987c
mov bl, 0x83
pop es
jge 0x5e9878
sub dh, dh
sbb dword [eax - 0x62], edx
adc dword [eax - 0x37349d5a], 0xffffffc4
inc ecx
and edi, eax
dec esp
fsubr qword [esi - 0x47]
pop es
mov ss, ecx
xor dword [0x1a3d5845], eax
xor byte [ebx - 0x10], bl
invalid

Function at 0x405630
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
adc dword [0x698e0c11], ecx
xor bl, al
sub esi, dword [edi]
pop es
adc dword [esi + ecx*4], ecx
imul esi, dword [edx], 0x7372bd8
jb 0x405632
push es
add byte [eax + 0x6f], dh
jo 0x4056b0
xor al, byte [eax]
add byte [edx], cl
sub al, 0x28
pop es
jb 0x40563f
push es
add byte [eax + 0x6f], dh
add byte cs:[eax], al
or bl, byte [eax]
outsd dx, dword [esi]
xor eax, dword [eax]
add byte [edx], cl
adc ecx, dword [ecx]
add bh, byte [ebx + 0xa]
add byte [eax], al
add al, 0x11
or dword [esi], edx
lcall 0x346f, 0x9a170911
add byte [eax], al
or ch, byte [ebx]
add dl, byte [esi]
sub al, byte [esi]
pop ss
pop eax
or al, byte [esi]
add ecx, dword [esi - 0x29ac097]
invalid
add byte [eax + 0x28], dh
sbb byte [eax], al
add byte [edx], cl
jge 0x4056c6
add byte [eax], al
add al, 2
jnp 0x4056cc
add byte [eax], al
add al, 0x28
xor eax, 0x2d0a0000
or al, 2
jnp 0x4056d9
or ch, byte [0xd7b020c]
add byte [eax], al
add al, 0x28
add byte ss:[eax], al
or ah, byte [esi]
add bh, byte [ebx + 6]
add byte [eax], al
add al, 0x28
add byte [eax + ebp], al
and al, byte [eax]
add byte [edx], cl
sub eax, 0x77b0229
add byte [eax], al
add al, 0x6f
aaa
add byte [eax], al
or bl, byte [edi]
rdmsr
sbb al, byte [edx]
jnp 0x4056fd
add byte [eax], al
add al, 0x6f
cmp byte [eax], al
add byte [edx], cl
sub al, 0xd
add bh, byte [ebx + 8]
add byte [eax], al
add al, 0x6f
or eax, 0x87b02
add byte [edi + ebp*2], al
cmp byte [eax], al
add byte [edx], cl
sub eax, 0x22a1602
jnp 0x405719
add byte [eax], al
add al, 0x72
sysret
cmp dword [eax], eax
add byte [edx], cl
sub eax, 0x97b0211
add byte [eax], al
add al, 0x72
sysret
Function at 0x404510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
xor dl, dl
mov dword [ebp - 4], ecx
xor edi, edi
test esi, esi
je 0x4045d1
cmp esi, 0x20
jb 0x4045b6
mov eax, esi
mov ecx, esi
and eax, 0x1f
xorps xmm3, xmm3
sub ecx, eax
mov edx, ebx
mov eax, dword [ebp - 4]
movaps xmm2, xmm3
sub edx, eax
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [edx + eax - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ecx
jb 0x404550
mov ecx, dword [ebp - 4]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd edx, xmm2
cmp edi, esi
jae 0x4045d1
sub ebx, ecx
lea eax, [edi + ecx]
sub esi, edi
mov cl, byte [eax + ebx]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x4045c1
pop edi
pop esi
movzx eax, dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409d90
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
xor edx, edx
mov eax, dword [esi + 0x3c]
add eax, 0x20c
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov eax, dword [esi + 0x3c]
add eax, 0x264
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov ecx, dword [esi + 0x3c]
add ecx, 0x2c0
call fcn.00415e10
mov ecx, dword [esi + 0x3c]
mov edx, 1
add ecx, 0x330
pop esi
jmp fcn.00411160

Function at 0x40aa20
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push esi
push edi
push 0x898
mov ebx, ecx
push 0
push ebx
call fcn.004d64c0
push 0x58
lea esi, [ebx + 0x20c]
push 0
push esi
call fcn.004d64c0
push 0x5c
lea edi, [ebx + 0x264]
push 0
push edi
call fcn.004d64c0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
lea esi, [ebx + 0x2c0]
push 0x6c
push 0
push esi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0x67452301
mov dword [edi + 0xc], 0xefcdab89
mov dword [edi + 0x10], 0x98badcfe
mov dword [edi + 0x14], 0x10325476
mov dword [edi + 0x18], 0xc3d2e1f0
call fcn.004d64c0
xor edx, edx
mov ecx, esi
call fcn.00415e10
push 0xd8
push edx
lea esi, [ebx + 0x330]
push esi
call fcn.004d64c0
mov edx, 1
mov ecx, esi
call fcn.00411160
push 0x1b0
lea eax, [ebx + 8]
mov dword [ebx + 0x408], 0x409e20
push 0
push eax
mov dword [ebx], 2
call fcn.004d64c0
add esp, 0x48
mov dword [ebx + 0x1c8], 3
pop edi
pop esi
pop ebx
ret
Function at 0x40c480
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x1c8
mov eax, dword [0x541a34]
xor eax, esp
mov dword [esp + 0x1c4], eax
cmp dword [0x546448], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
jne 0x40c4cd
lea eax, [esp + 0x38]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x40c536
mov dword [0x546448], 1
mov ecx, dword [ebp + 0x14]
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
mov edx, 0x11
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x14], 0
lea eax, [ecx - 1]
neg eax
sbb eax, eax
add eax, 2
cmp ecx, 1
mov dword [esp + 0x18], eax
mov eax, 6
cmove eax, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x40c54f
mov eax, 0xffffffae
pop edi
pop esi
mov ecx, dword [esp + 0x1c4]
xor ecx, esp
call fcn.004d1fac
mov esp, ebp
pop ebp
ret
mov eax, 0xffffffbe
pop edi
pop esi
mov ecx, dword [esp + 0x1c4]
xor ecx, esp
call fcn.004d1fac
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 8]
mov edi, 0xffffffae
test esi, esi
je 0x40c5ad
nop dword [eax]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edi, dword [esp + 0xc]
mov dword [edi], eax
test eax, eax
jns 0x40c580
mov edi, 0xffffffbe
jmp 0x40c59e
push dword [esi + 0x10]
push dword [esi + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x40c5a7
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
mov edi, 0xffffffbc
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x40c560
jmp 0x40c5a9
xor edi, edi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [esp + 0x1cc]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004d1fac
mov esp, ebp
pop ebp
ret
Function at 0x40cbe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x338
mov eax, dword [0x541a34]
xor eax, esp
mov dword [esp + 0x334], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
push esi
mov esi, edx
push edi
cmp eax, 0x180
jbe 0x40cc29
mov eax, 0xffffffc8
pop edi
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004d1fac
mov esp, ebp
pop ebp
ret
push 0x1a0
lea eax, [esp + 0x19c]
push 0
push eax
call fcn.004d64c0
push 0x118
lea eax, [esp + 0x28]
push 0
push eax
call fcn.004d64c0
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x1c0], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x1c1], al
mov eax, ecx
shr eax, 8
push ecx
mov byte [esp + 0x1c6], al
lea eax, [esp + 0x1cc]
push esi
push eax
mov byte [esp + 0x1cf], cl
mov byte [esp + 0x1d3], 0x30
call fcn.004d5f40
mov eax, dword [esp + 0x30]
add esp, 0x24
lea esi, [eax + 0x19]
mov byte [esp + eax + 0x1b0], 0x80
mov dword [esp + 0x14], esi
xor eax, eax
nop dword [eax]
mov byte [esp + eax + 0x178], al
inc eax
cmp eax, 0x20
jl 0x40ccb0
push 0x100
lea edx, [esp + 0x17c]
lea ecx, [esp + 0x1c]
call fcn.00426ee0
mov cl, byte [esp + 0x19f]
add esp, 4
xor eax, eax
mov dword [esp + 0xc], eax
xorps xmm0, xmm0
mov edi, esi
movaps xmmword [esp + 0x130], xmm0
test esi, esi
je 0x40cd5c
lea esi, [esp + 0x198]
lea eax, [esp + 0x130]
sub esi, eax
xor eax, eax
lea edx, [esp + 0x130]
add edx, eax
inc eax
mov cl, byte [esi + edx]
xor byte [edx], cl
cmp eax, 0x10
jl 0x40cd05
add esi, 0x10
mov eax, edi
cmp edi, 0x10
mov ecx, 0x10
cmovae eax, ecx
lea ecx, [esp + 0x18]
sub edi, eax
lea eax, [esp + 0x130]
push eax
mov edx, eax
call fcn.00427fb0
add esp, 4
test edi, edi
jne 0x40cd03
movaps xmm0, xmmword [esp + 0x130]
mov eax, dword [esp + 0xc]
mov cl, byte [esp + 0x19b]
mov esi, dword [esp + 0x14]
movups xmmword [esp + eax + 0x148], xmm0
add eax, 0x10
inc cl
mov byte [esp + 0x19b], cl
mov dword [esp + 0xc], eax
cmp eax, 0x30
jl 0x40cce2
push 0x100
lea edx, [esp + 0x14c]
lea ecx, [esp + 0x1c]
call fcn.00426ee0
add esp, 4
mov esi, 3
nop word [eax + eax]
lea eax, [esp + 0x168]
push eax
mov edx, eax
lea ecx, [esp + 0x1c]
call fcn.00427fb0
mov eax, dword [esp + 0x14]
add esp, 4
movups xmm0, xmmword [esp + 0x168]
movups xmmword [eax], xmm0
add eax, 0x10
mov dword [esp + 0x10], eax
sub esi, 1
jne 0x40cda0
mov eax, 0x118
lea ecx, [esp + 0x18]
nop word [eax + eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x40cde0
mov ecx, dword [esp + 0x33c]
pop edi
pop esi
xor ecx, esp
call fcn.004d1fac
mov esp, ebp
pop ebp
ret
Function at 0x40ce00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x541a34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x30
lea edi, [ebp - 0x34]
mov dword [ebp - 0x3c], edx
mov eax, edi
mov dword [ebp - 0x38], ecx
push 0
push eax
call fcn.004d64c0
mov edx, dword [ebp - 0x38]
mov esi, 1
add esp, 0xc
mov ebx, 3
sub esi, edx
lea eax, [edx + 0x20]
lea ecx, [edx + 0xf]
mov dword [ebp - 0x40], eax
mov eax, ecx
add byte [eax], 1
jne 0x40ce52
dec eax
lea ecx, [esi + eax]
test ecx, ecx
jg 0x40ce45
mov ecx, dword [ebp - 0x40]
push edi
call fcn.00427fb0
mov edx, dword [ebp - 0x38]
add esp, 4
add edi, 0x10
lea ecx, [edx + 0xf]
sub ebx, 1
jne 0x40ce43
mov eax, dword [ebp - 0x3c]
mov edx, 0x20
movups xmm0, xmmword [ebp - 0x34]
pop edi
pop esi
movups xmm1, xmmword [eax]
pop ebx
pxor xmm1, xmm0
movups xmm0, xmmword [ebp - 0x24]
movups xmmword [ebp - 0x34], xmm1
movups xmm1, xmmword [eax + 0x10]
pxor xmm1, xmm0
movups xmmword [ebp - 0x24], xmm1
mov al, byte [edx + eax]
xor byte [ebp + edx - 0x34], al
inc edx
mov eax, dword [ebp - 0x3c]
cmp edx, 0x30
jl 0x40ce96
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x34]
push 0x100
call fcn.00426ee0
mov ecx, dword [ebp - 0x38]
add esp, 4
movups xmm0, xmmword [ebp - 0x14]
xor eax, eax
movups xmmword [ecx], xmm0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d1fac
mov esp, ebp
pop ebp
ret
Function at 0x410520
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
mov dword [ebp - 4], eax
push edi
mov edi, 0x520fb0
mov edx, edi
test eax, eax
je 0x4105ba
cmp dword [0x520fb0], 0
push ebx
push esi
je 0x4105a8
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x41059e
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x410569
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x41056e
add edx, 4
add eax, 4
sub esi, 4
jae 0x410558
cmp esi, 0xfffffffc
je 0x4105b1
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x41059b
cmp esi, 0xfffffffd
je 0x4105b1
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x41059b
cmp esi, 0xfffffffe
je 0x4105b1
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x41059b
cmp esi, 0xffffffff
je 0x4105b1
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x4105b1
mov eax, dword [ebp - 4]
add edi, 0x18
mov edx, edi
cmp dword [edi], 0
jne 0x410547
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4105d0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
mov dword [ebp - 4], eax
push edi
mov edi, 0x521100
mov edx, edi
test eax, eax
je 0x41066a
cmp dword [0x521100], 0
push ebx
push esi
je 0x410658
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x41064e
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x410619
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x41061e
add edx, 4
add eax, 4
sub esi, 4
jae 0x410608
cmp esi, 0xfffffffc
je 0x410661
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x41064b
cmp esi, 0xfffffffd
je 0x410661
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x41064b
cmp esi, 0xfffffffe
je 0x410661
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x41064b
cmp esi, 0xffffffff
je 0x410661
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x410661
mov eax, dword [ebp - 4]
add edi, 0x14
mov edx, edi
cmp dword [edi], 0
jne 0x4105f7
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x411160
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0xd0], edx
test edx, edx
jne 0x4111f6
mov dword [ecx + 0x10], 0xf3bcc908
mov dword [ecx + 0x14], 0x6a09e667
mov dword [ecx + 0x18], 0x84caa73b
mov dword [ecx + 0x1c], 0xbb67ae85
mov dword [ecx + 0x20], 0xfe94f82b
mov dword [ecx + 0x24], 0x3c6ef372
mov dword [ecx + 0x28], 0x5f1d36f1
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0xade682d1
mov dword [ecx + 0x34], 0x510e527f
mov dword [ecx + 0x38], 0x2b3e6c1f
mov dword [ecx + 0x3c], 0x9b05688c
mov dword [ecx + 0x40], 0xfb41bd6b
mov dword [ecx + 0x44], 0x1f83d9ab
mov dword [ecx + 0x48], 0x137e2179
mov dword [ecx + 0x4c], 0x5be0cd19
ret
mov dword [ecx + 0x10], 0xc1059ed8
mov dword [ecx + 0x14], 0xcbbb9d5d
mov dword [ecx + 0x18], 0x367cd507
mov dword [ecx + 0x1c], 0x629a292a
mov dword [ecx + 0x20], 0x3070dd17
mov dword [ecx + 0x24], 0x9159015a
mov dword [ecx + 0x28], 0xf70e5939
mov dword [ecx + 0x2c], 0x152fecd8
mov dword [ecx + 0x30], 0xffc00b31
mov dword [ecx + 0x34], 0x67332667
mov dword [ecx + 0x38], 0x68581511
mov dword [ecx + 0x3c], 0x8eb44a87
mov dword [ecx + 0x40], 0x64f98fa7
mov dword [ecx + 0x44], 0xdb0c2e0d
mov dword [ecx + 0x48], 0xbefa4fa4
mov dword [ecx + 0x4c], 0x47b5481d
ret