joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a68d
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
cld
push esi
push edi
push ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x50]
mov ebx, eax
and ebx, 0x3f
mov edx, dword [edi + 0x54]
add eax, eax
adc edx, edx
add eax, eax
adc edx, edx
add eax, eax
adc edx, edx
cmp ebx, 0x38
jb 0x40a724
mov ecx, 0x40
sub ecx, ebx
add edi, 0x10
add edi, ebx
mov esi, 0x40a781
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov esi, edi
add edi, 0x10
call fcn.0040a1b3
mov ebx, edi
mov dword [edi + 0x38], eax
xor eax, eax
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov dword [edi + 4], edx
mov edi, ebx
call fcn.0040a1b3
mov ecx, 4
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
add edi, 0x50
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ebx
pop edi
pop esi
leave
ret 8
mov ecx, 0x38
sub ecx, ebx
mov esi, 0x40a781
add edi, 0x10
add edi, ebx
rep movsb byte es:[edi], byte [esi]
stosd dword es:[edi], eax
mov eax, edx
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
mov esi, edi
add edi, 0x10
call fcn.0040a1b3
mov ecx, 4
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
add edi, 0x50
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x40a9a0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
mov dword [edi + 0x10], 0xc3d2e1f0
add edi, 0x54
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
leave
ret 4
Function at 0x40b942
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
cld
push esi
push edi
push ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x54]
mov ebx, eax
and ebx, 0x3f
mov edx, dword [edi + 0x58]
add eax, eax
adc edx, edx
add eax, eax
adc edx, edx
add eax, eax
adc edx, edx
cmp ebx, 0x38
jb 0x40b9f3
mov ecx, 0x40
sub ecx, ebx
add edi, 0x14
add edi, ebx
mov esi, 0x40ba66
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov esi, edi
add edi, 0x14
call fcn.0040a9da
mov ebx, edi
bswap edx
bswap eax
xchg edx, eax
mov dword [edi + 0x38], eax
xor eax, eax
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov dword [edi + 4], edx
mov edi, ebx
call fcn.0040a9da
mov edi, dword [ebp + 0xc]
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
mov dword [edi + 0x10], 0xc3d2e1f0
add edi, 0x54
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ebx
pop edi
pop esi
leave
ret 8
mov ecx, 0x38
sub ecx, ebx
mov esi, 0x40ba66
add edi, 0x14
add edi, ebx
rep movsb byte es:[edi], byte [esi]
xchg edx, eax
bswap eax
bswap edx
stosd dword es:[edi], eax
mov eax, edx
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
mov esi, edi
add edi, 0x14
call fcn.0040a9da
mov edi, dword [ebp + 0xc]
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
mov dword [edi + 0x10], 0xc3d2e1f0
add edi, 0x54
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x40bae0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov dword [edi], 0x6a09e667
mov dword [edi + 4], 0xbb67ae85
mov dword [edi + 8], 0x3c6ef372
mov dword [edi + 0xc], 0xa54ff53a
mov dword [edi + 0x10], 0x510e527f
mov dword [edi + 0x14], 0x9b05688c
mov dword [edi + 0x18], 0x1f83d9ab
mov dword [edi + 0x1c], 0x5be0cd19
add edi, 0x60
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
leave
ret 4
Function at 0x40df54
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
cld
push esi
push edi
push ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x60]
mov ebx, eax
and ebx, 0x3f
mov edx, dword [edi + 0x64]
add eax, eax
adc edx, edx
add eax, eax
adc edx, edx
add eax, eax
adc edx, edx
cmp ebx, 0x38
jb 0x40e026
mov ecx, 0x40
sub ecx, ebx
add edi, 0x20
add edi, ebx
mov esi, 0x40e0ba
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov esi, edi
add edi, 0x20
call fcn.0040bb2f
mov ebx, edi
bswap edx
bswap eax
xchg edx, eax
mov dword [edi + 0x38], eax
xor eax, eax
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov dword [edi + 4], edx
mov edi, ebx
call fcn.0040bb2f
mov edi, dword [ebp + 0xc]
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
mov dword [edi], 0x6a09e667
mov dword [edi + 4], 0xbb67ae85
mov dword [edi + 8], 0x3c6ef372
mov dword [edi + 0xc], 0xa54ff53a
mov dword [edi + 0x10], 0x510e527f
mov dword [edi + 0x14], 0x9b05688c
mov dword [edi + 0x18], 0x1f83d9ab
mov dword [edi + 0x1c], 0x5be0cd19
add edi, 0x60
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ebx
pop edi
pop esi
leave
ret 8
mov ecx, 0x38
sub ecx, ebx
mov esi, 0x40e0ba
add edi, 0x20
add edi, ebx
rep movsb byte es:[edi], byte [esi]
xchg edx, eax
bswap eax
bswap edx
stosd dword es:[edi], eax
mov eax, edx
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
mov esi, edi
add edi, 0x20
call fcn.0040bb2f
mov edi, dword [ebp + 0xc]
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
mov dword [edi], 0x6a09e667
mov dword [edi + 4], 0xbb67ae85
mov dword [edi + 8], 0x3c6ef372
mov dword [edi + 0xc], 0xa54ff53a
mov dword [edi + 0x10], 0x510e527f
mov dword [edi + 0x14], 0x9b05688c
mov dword [edi + 0x18], 0x1f83d9ab
mov dword [edi + 0x1c], 0x5be0cd19
add edi, 0x60
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x40e230
Capabilities:
Hash data using sha384

Disassembly:
push ebp
mov ebp, esp
cld
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, 0x40e25e
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
add edi, 0x80
mov cx, 4
xor eax, eax
rep stosd dword es:[edi], eax
pop esi
pop edi
leave
ret 4
Function at 0x40e29e
Capabilities:
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
cld
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, 0x40e2cc
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
add edi, 0x80
mov cx, 4
xor eax, eax
rep stosd dword es:[edi], eax
pop esi
pop edi
leave
ret 4
Function at 0x42a5d2
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 0xc], 0x4c
jae 0x42a5ed
mov eax, dword [ebp + 0xc]
imul eax, eax, 0x24
cmp dword [eax + 0x442c54], 8
jae 0x42a5f4
xor eax, eax
jmp 0x42a715
mov ecx, dword [ebp + 0xc]
imul ecx, ecx, 0x24
add ecx, 0x442c50
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
add ecx, 4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, dword [edx + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x14]
cmp edx, dword [ecx + 4]
ja 0x42a669
cmp dword [ebp + 0x10], 0
je 0x42a65d
cmp dword [ebp + 0x14], 0
jbe 0x42a65d
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00436460
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
call dword [ecx + 0xc]
jmp 0x42a69b
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
call dword [eax + 0xc]
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
call dword [ecx + 0x10]
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
call dword [ecx + 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ebp + 0x14], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp + 0x14]
push edx
call fcn.00437100
add esp, 0xc
mov byte [ebp - 0x18], 0x36
mov byte [ebp - 8], 0x5c
mov dword [ebp - 0x14], 0
jmp 0x42a6cd
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jae 0x42a6fe
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
xor eax, eax
mov al, byte [edx]
xor eax, 0x5c
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov byte [ecx], al
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
mov al, byte [edx]
xor al, 0x36
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x14]
mov byte [ecx], al
jmp 0x42a6c4
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
call dword [edx + 0x10]
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4319d0
Capabilities:
Hash data using ripemd256

Disassembly:
push ebp
mov ebp, esp
cld
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, 0x4319fb
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
add edi, 0x40
mov cx, 2
xor eax, eax
rep stosd dword es:[edi], eax
pop esi
pop edi
leave
ret 4
Function at 0x4325d6
Capabilities:
Hash data using ripemd256

Disassembly:
push ebp
mov ebp, esp
cld
push esi
push edi
push ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x60]
mov ebx, eax
and ebx, 0x3f
cmp ebx, 0x38
jb 0x432660
mov ecx, 0x40
sub ecx, ebx
add edi, 0x20
add edi, ebx
mov esi, 0x4326c1
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov esi, edi
add edi, 0x20
call fcn.00431a1b
mov ebx, edi
xor eax, eax
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov edi, ebx
mov eax, dword [esi + 0x60]
mov edx, dword [esi + 0x64]
shld edx, eax, 3
shl eax, 3
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], edx
call fcn.00431a1b
mov esi, dword [ebp + 8]
mov ecx, 8
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov esi, 0x4319fb
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
add edi, 0x40
mov cx, 2
xor eax, eax
rep stosd dword es:[edi], eax
pop ebx
pop edi
pop esi
leave
ret 8
mov ecx, 0x38
sub ecx, ebx
mov esi, 0x4326c1
add edi, 0x20
add edi, ebx
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov esi, edi
add edi, 0x20
mov eax, dword [esi + 0x60]
mov edx, dword [esi + 0x64]
shld edx, eax, 3
shl eax, 3
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], edx
call fcn.00431a1b
mov esi, dword [ebp + 8]
mov ecx, 8
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov esi, 0x4319fb
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
add edi, 0x40
mov cx, 2
xor eax, eax
rep stosd dword es:[edi], eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x432740
Capabilities:
Hash data using ripemd320

Disassembly:
push ebp
mov ebp, esp
cld
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, 0x43276b
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
add edi, 0x40
mov cx, 2
xor eax, eax
rep stosd dword es:[edi], eax
pop esi
pop edi
leave
ret 4
Function at 0x433a4e
Capabilities:
Hash data using ripemd320

Disassembly:
push ebp
mov ebp, esp
cld
push esi
push edi
push ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x68]
mov ebx, eax
and ebx, 0x3f
cmp ebx, 0x38
jb 0x433ad8
mov ecx, 0x40
sub ecx, ebx
add edi, 0x28
add edi, ebx
mov esi, 0x433b39
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov esi, edi
add edi, 0x28
call fcn.00432793
mov ebx, edi
xor eax, eax
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov edi, ebx
mov eax, dword [esi + 0x68]
mov edx, dword [esi + 0x6c]
shld edx, eax, 3
shl eax, 3
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], edx
call fcn.00432793
mov esi, dword [ebp + 8]
mov ecx, 0xa
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov esi, 0x43276b
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
add edi, 0x40
mov cx, 2
xor eax, eax
rep stosd dword es:[edi], eax
pop ebx
pop edi
pop esi
leave
ret 8
mov ecx, 0x38
sub ecx, ebx
mov esi, 0x433b39
add edi, 0x28
add edi, ebx
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov esi, edi
add edi, 0x28
mov eax, dword [esi + 0x68]
mov edx, dword [esi + 0x6c]
shld edx, eax, 3
shl eax, 3
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], edx
call fcn.00432793
mov esi, dword [ebp + 8]
mov ecx, 0xa
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov esi, 0x43276b
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
add edi, 0x40
mov cx, 2
xor eax, eax
rep stosd dword es:[edi], eax
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x43a825
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x444030
cmp edx, dword [eax]
je 0x43a847
add eax, 8
inc ecx
cmp eax, 0x4440c0
jl 0x43a838
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x444030]
jne 0x43a975
mov eax, dword [0x446980]
cmp eax, 1
je 0x43a94f
test eax, eax
jne 0x43a878
cmp dword [0x443d44], 1
je 0x43a94f
cmp edx, 0xfc
je 0x43a975
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43a8af
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00437400
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00436350
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x43a8f2
lea eax, [ebp - 0x1a4]
push eax
call fcn.00436350
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x43f994
push edi
call fcn.0043d760
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00437400
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00437410
lea eax, [ebp - 0xa0]
push 0x43f974
push eax
call fcn.00437410
push dword [esi + 0x444034]
lea eax, [ebp - 0xa0]
push eax
call fcn.00437410
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0043d6c8
add esp, 0x2c
pop edi
jmp 0x43a975
lea eax, [ebp + 8]
lea esi, [esi + 0x444034]
push 0
push eax
push dword [esi]
call fcn.00436350
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401000
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4142bb
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x41b024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x70], edi
mov dword [0x41cf60], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [edi + 0x3c]
mov dword [edi], 0x4172c8
mov dword [edi + 4], 0x4172d4
mov dword [edi + 8], 0x4172e4
mov dword [edi + 0xc], 0x4172f4
mov dword [edi + 0x10], 0x417300
mov dword [edi + 0x2c], 0xa
mov word [edi + 0x30], bx
mov byte [edi + 0x32], bl
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], eax
mov byte [eax], bl
mov byte [ebp - 4], 1
push 0xa0
mov dword [edi + 0x7c], 0x1010101
mov dword [edi + 0x80], ebx
mov dword [edi + 0x84], ebx
call 0x40822a
add esp, 4
mov dword [ebp - 0x6c], eax
mov byte [ebp - 4], 2
cmp eax, ebx
je 0x4010aa
push eax
call fcn.00402c10
jmp 0x4010ac
xor eax, eax
lea esi, [ebp - 0x58]
mov dword [edi + 0x34], eax
call fcn.00401110
lea esi, [edi + 0x38]
call fcn.004025d0
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
cmp eax, ecx
je 0x4010d2
push eax
call fcn.004087c1
add esp, 4
push ebx
lea edx, [ebp - 0x68]
push edx
lea eax, [edi + 0x14]
push eax
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
call dword [0x415254]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040805e
mov esp, ebp
pop ebp
ret

Function at 0x408c54
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movzx edi, byte [ecx]
xor edi, eax
clc
clc
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
add ecx, 8
sub edx, 8
dec esi
jne 0x408c50
pop edi
test edx, edx
je 0x408d2a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4189f0]
inc ecx
dec edx
jne 0x408d11
not eax
pop esi
ret
Function at 0x40ac30
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0x40ac37
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x40ad0d
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4189f0]
add ecx, 8
sub edx, 8
dec esi
jne 0x40ac50
pop edi
test edx, edx
je 0x40ad2a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4189f0]
inc ecx
dec edx
jne 0x40ad11
not eax
pop esi
ret
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10007c2e
pop dword [ebp - 0x40]
mov eax, 0x10007c2e
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x5622ab4
add dword [ebp - 0x50], 0x48f01a97
mov dword [ebp - 0x4c], 0x4572790a
sub dword [ebp - 0x4c], 0x133f2cc5
mov dword [ebp - 0x48], 0xcb73e544
sub dword [ebp - 0x48], 0x7f27a116
mov dword [ebp - 0x44], 0x94664163
sub dword [ebp - 0x44], 0x94664163
lea eax, [ebp - 0x50]
push eax
mov eax, 0x5e640449
sub eax, 0x4e6383f5
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xcef22562
add dword [ebp - 0x50], 0xa58043f4
mov dword [ebp - 0x4c], 0xf16d3019
add dword [ebp - 0x4c], 0x4fff315c
mov dword [ebp - 0x48], 0xe4ac7d30
sub dword [ebp - 0x48], 0x813d10c4
mov dword [ebp - 0x44], 0x32dd4bd2
add dword [ebp - 0x44], 0xcd22b42e
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x4a7cbb23
add eax, 0xc583c52d
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x32452
push 0
call eax
mov ecx, 0x3669
mov edi, eax
mov edx, 0x7c3fa56d
add edx, 0x93c15493
add edx, dword [ebp - 0x40]
mov esi, 0x7aa0d15d
add esi, 0x6f50265e
add dword [ebp - 4], 0x3e2c88f0
mov ebx, dword [edx]
xor dword [ebp - 0x14], 0xbb5fa72f
xor ebx, esi
sub dword [ebp - 8], 0x75ccf314
mov dword [edi], ebx
add dword [ebp - 0x2c], esi
add edi, 4
add edx, 4
loop 0x10007d45
add eax, 0xcc77
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x40611c
pop dword [ebp - 4]
mov eax, 0xd7a762a6
sub eax, 0xd767018a
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x31374496
add dword [ebp - 0x14], 0x1d1b00b5
mov dword [ebp - 0x10], 0xcdc8e33d
add dword [ebp - 0x10], 0x646a6908
mov dword [ebp - 0xc], 0x6d9d8f9
add dword [ebp - 0xc], 0x45726b35
mov dword [ebp - 8], 0x70d21649
add dword [ebp - 8], 0x8f2de9b7
lea eax, [ebp - 0x14]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xbe7b0d44
add dword [ebp - 0x14], 0xb5f75c12
mov dword [ebp - 0x10], 0x80d61adf
sub dword [ebp - 0x10], 0x3f69b96a
mov dword [ebp - 0xc], 0xdf9a5204
add dword [ebp - 0xc], 0x83d51a68
mov dword [ebp - 8], 0xe9cdb5d6
add dword [ebp - 8], 0x16324a2a
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0xf0031cf1
sub eax, 0xefc2abf1
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x37e23
push 0
call eax
mov ecx, 0x4d1a
mov esi, eax
mov edx, 0x410000
add edx, dword [ebp - 4]
mov edi, 0x43b44f24
mov ebx, dword [edx]
xor ebx, edi
mov dword [esi], ebx
add esi, 4
add edx, 4
loop 0x406227
add eax, 0x3c6c135b
add eax, 0xc39513e0
mov ebx, eax
add eax, 5
mov ecx, 0x949c4bc
add ecx, 0xf6f63b44
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941