joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e8b3c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x5e8b8d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x5e8b74
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x5e8b64
jmp 0x5e8b8d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x5e8b75
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5fa760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.00409114
cmp ax, 0xffff
jne 0x5fa781
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
push 6
push eax
push edi
call sub.KERNEL32.DLL_FindResourceA
test eax, eax
je 0x5fa80d
push eax
push edi
call sub.KERNEL32.DLL_LoadResource
mov edi, eax
test edi, edi
je 0x5fa80d
push edi
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 8], eax
mov eax, ebx
dec eax
test eax, eax
jl 0x5fa7ce
inc eax
mov edx, dword [ebp - 8]
movzx edx, word [edx]
add edx, edx
add edx, dword [ebp - 8]
add edx, 2
mov dword [ebp - 8], edx
dec eax
jne 0x5fa7ba
mov eax, dword [ebp - 8]
movzx esi, word [eax]
add dword [ebp - 8], 2
cmp dword [ebp - 4], 0
je 0x5fa80d
cmp dword [ebp + 8], 0
jle 0x5fa80d
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.0043a5dc
mov esi, eax
test esi, esi
jle 0x5fa804
mov ecx, esi
add ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409128
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x5fb48c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x5fb4f0
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00405a90
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.0040c9b0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fb4f7
lea eax, [ebp - 0xc]
call fcn.00405820
ret
Function at 0x5fb554
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x5fb5b0
push esp
push 0x40
push 6
push ebx
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
jne 0x5fb57f
call fcn.00412114
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00403618
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
jne 0x5fb5b0
call fcn.00412114
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x602898
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x63ec08]
cmp byte [eax], 0
jne 0x6028c6
mov ecx, 0xaf
mov edx, 0x602914
mov eax, 0x602960
call fcn.00405750
mov eax, ebx
call fcn.00405f48
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x602905
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.004060dc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x602974
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x63ec08]
cmp byte [eax], 0
jne 0x602997
mov ecx, 0xbd
mov edx, 0x6029d8
mov eax, 0x602a24
call fcn.00405750
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x6029ca
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x6029ca
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x6029ca
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x60a940
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x60aac4
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x2be]
sub al, 2
jb 0x60aaa9
cmp byte [ebx + 0x2b0], 0
je 0x60aaa9
mov eax, dword [ebp - 4]
call fcn.00604d3c
mov word [ebp - 6], ax
xor eax, eax
push ebp
push 0x60aaa2
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp - 6]
sub ax, 8
je 0x60a9e6
dec ax
je 0x60a9bc
sub ax, 0x12
jne 0x60aa00
call fcn.00405218
jmp 0x60aaa9
cmp byte [ebx + 0x2b1], 0
je 0x60aa88
mov eax, ebx
call fcn.004466b0
test al, al
je 0x60aa88
xor edx, edx
mov eax, ebx
call fcn.004466d4
jmp 0x60aa88
mov eax, dword [esi]
call fcn.00406184
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00406370
jmp 0x60aa88
cmp byte [ebx + 0x2b1], 0
je 0x60aa1d
mov eax, ebx
call fcn.004466b0
test al, al
jne 0x60aa1d
mov dl, 1
mov eax, ebx
call fcn.004466d4
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp + 8]
sub eax, dword [edx]
cmp eax, 0x4e2
jb 0x60aa35
mov eax, esi
call fcn.00405f48
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
push 1
lea eax, [ebp - 0x10]
mov dx, word [ebp - 6]
call fcn.00406060
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi]
lea eax, [ebp - 0xc]
call fcn.004061f0
mov ecx, dword [ebp - 0xc]
mov edx, edi
mov eax, ebx
call fcn.0060a770
test al, al
je 0x60aa88
lea eax, [ebp - 0x14]
mov dx, word [ebp - 6]
call fcn.00406060
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00406190
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60aaa9
mov eax, dword [ebp - 4]
mov dx, word [ebp - 6]
call fcn.00604d70
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60aacb
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405f60
ret
Function at 0x60df18
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x60df47
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x60dfc6
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0060bf4c
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x60df94
mov cx, word [esp]
sub cx, si
jmp 0x60df96
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x60df7d
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x60dfbc
mov cx, word [esp]
sub cx, si
jmp 0x60dfbe
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x60dfa5
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x60e0a7
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.0060dc8c
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x60e012
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
mov eax, dword [ebx + 0x74]
cmp eax, 0x106
jae 0x60e028
mov edx, dword [ebx]
cmp dword [edx + 4], 0
jne 0x60df22
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ebx + 0x16c0]
cmp ecx, edx
jbe 0x60e0a7
mov esi, dword [ebx + 0x6c]
add esi, eax
cmp esi, edx
jbe 0x60e06a
mov edi, ecx
sub edi, esi
cmp edi, 0x102
jbe 0x60e04f
mov edi, 0x102
push edi
push 0
mov eax, dword [ebx + 0x38]
add eax, esi
push eax
call fcn.0060bf34
add esp, 0xc
add edi, esi
mov dword [ebx + 0x16c0], edi
jmp 0x60e0a7
lea edx, [esi + 0x102]
mov eax, dword [ebx + 0x16c0]
cmp edx, eax
jbe 0x60e0a7
mov edi, edx
mov edx, dword [ebx + 0x3c]
sub edx, eax
sub edi, eax
cmp edi, edx
jbe 0x60e090
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x16c0]
push edi
push 0
mov edx, dword [ebx + 0x38]
add edx, eax
push edx
call fcn.0060bf34
add esp, 0xc
add dword [ebx + 0x16c0], edi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x6142a4
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x64611c
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x6142c6
shr eax, 1
xor eax, 0xedb88320
jmp 0x6142c8
shr eax, 1
dec edx
jne 0x6142b4
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x6142ad
mov byte [0x64651c], 1
pop esi
pop ebx
ret
Function at 0x6142e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x64651c], 0
jne 0x6142fb
call fcn.006142a4
mov eax, edi
dec eax
test eax, eax
jl 0x614324
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x64611c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x614305
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x616e40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x616e71
dec al
je 0x616ead
dec al
je 0x616ef1
dec al
je 0x616f5c
jmp 0x616fe6
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x616fe6
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x616e81
jmp 0x616fe6
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x616fe6
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x616ebd
jmp 0x616fe6
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x616fe6
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x616f1f
xor ebp, ebp
jmp 0x616f30
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x616f39
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x616f01
jmp 0x616fe6
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x616fe6
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x616fb4
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0061432c
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x616f70
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x61cfa4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov edi, eax
or ebx, 0xffffffff
mov eax, edi
call fcn.00405afc
dec eax
test eax, eax
jl 0x61cfd8
inc eax
xor esi, esi
mov dl, byte [edi + esi]
xor dl, bl
and edx, 0xff
mov edx, dword [edx*4 + 0x63e62c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
inc esi
dec eax
jne 0x61cfbb
xor ebx, 0xffffffff
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x61d164
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov esi, edx
lea edi, [esp + 0xc]
push ecx
mov ecx, 0x3e
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, ecx
mov dword [esp], eax
lea ebp, [esp + 8]
mov eax, dword [esi]
push eax
call fcn.0061d0fc
mov dword [ebp], eax
mov eax, dword [esi]
movzx ebx, word [eax + 6]
dec ebx
test ebx, ebx
jl 0x61d262
inc ebx
mov eax, dword [ebp]
cmp dword [eax + 0x10], 0
jne 0x61d1f8
mov edi, dword [esp + 0x44]
test edi, edi
jle 0x61d1eb
push 0x40
push 0x1000
push edi
mov eax, dword [ebp]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esi + 4]
call fcn.0061d04c
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov edx, dword [ebp]
mov dword [edx + 8], eax
mov edx, edi
mov eax, dword [esp + 4]
call fcn.0040913c
push 0
push 0x28
mov eax, ebp
call fcn.0061d01c
jmp 0x61d25b
push 0x40
push 0x1000
mov eax, dword [ebp]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esi + 4]
call fcn.0061d04c
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [esp + 4], eax
mov eax, dword [ebp]
mov eax, dword [eax + 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 8]
call fcn.0061d04c
mov edx, eax
mov eax, dword [ebp]
mov ecx, dword [eax + 0x10]
mov eax, dword [esp + 4]
call fcn.00409128
mov eax, dword [esp + 4]
mov edx, dword [ebp]
mov dword [edx + 8], eax
push 0
push 0x28
mov eax, ebp
call fcn.0061d01c
dec ebx
jne 0x61d1a1
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x61d668
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x61d67d
or edx, 0x200
test eax, 0x20000000
je 0x61d6b0
test eax, 0x40000000
je 0x61d69c
test eax, 0x80000000
je 0x61d697
or edx, 0x40
jmp 0x61d6d7
or edx, 0x20
jmp 0x61d6d7
test eax, 0x80000000
je 0x61d6ab
or edx, 0x80
jmp 0x61d6d7
or edx, 0x10
jmp 0x61d6d7
test eax, 0x40000000
je 0x61d6c8
test eax, 0x80000000
je 0x61d6c3
or edx, 4
jmp 0x61d6d7
or edx, 2
jmp 0x61d6d7
test eax, 0x80000000
je 0x61d6d4
or edx, 8
jmp 0x61d6d7
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x6233b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x62344b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
je 0x6233ed
mov eax, esi
call fcn.00405820
jmp 0x623435
lea eax, [ebp - 8]
push eax
push ebx
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00420450
test al, al
je 0x623435
mov eax, 0x104
call fcn.00403320
mov ebx, eax
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, esi
mov edx, ebx
call fcn.00405a18
mov eax, ebx
call fcn.0040333c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x623452
lea eax, [ebp - 4]
call fcn.004077e0
ret
Function at 0x625a74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x625b60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi]
call fcn.00405afc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00405afc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jg 0x625b4a
mov edi, dword [ebp - 0xc]
test edi, edi
jle 0x625ad5
mov ebx, 1
mov eax, dword [esi]
mov al, byte [eax + ebx - 1]
mov edx, dword [ebp - 4]
cmp al, byte [edx + ebx - 1]
jne 0x625b4a
inc ebx
dec edi
jne 0x625ac2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov edx, 1
call fcn.00405d9c
mov eax, dword [ebp - 0xc]
sub dword [ebp - 8], eax
mov ebx, 0x777
cmp ebx, dword [ebp - 8]
jge 0x625b23
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi]
mov ecx, 7
mov edx, ebx
call fcn.00405d5c
mov eax, esi
mov ecx, 7
mov edx, ebx
call fcn.00405d9c
sub dword [ebp - 8], 7
add ebx, 0x777
cmp ebx, dword [ebp - 8]
jl 0x625af4
mov edi, dword [ebp - 8]
test edi, edi
jle 0x625b4a
mov ebx, 1
mov eax, esi
call fcn.00405d54
mov edx, dword [esi]
movzx edx, byte [edx + ebx - 1]
xor edx, ebx
xor edx, dword [ebp - 8]
mov byte [eax + ebx - 1], dl
inc ebx
dec edi
jne 0x625b2f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625b67
lea eax, [ebp - 0x10]
call fcn.00405820
ret
Function at 0x40606e
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x44d190], 2
jl 0x406093
movaps xmm0, xmmword [0x438800]
movaps xmmword [0x443fd0], xmm0
movaps xmm0, xmmword [0x4387f0]
movaps xmmword [0x443fe0], xmm0
push esi
mov esi, dword [esp + 8]
mov ecx, esi
call fcn.0040645c
xor edx, edx
mov ecx, dword [esi + 0xf4]
mov eax, dword [edx + 0x4387c8]
mov dword [edx + ecx], eax
add edx, 4
cmp edx, 0x20
jl 0x4060a1
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0xc]
xor dword [ecx + 8], eax
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0x10]
or eax, 0x2000
shl eax, 0x10
xor dword [ecx + 0xc], eax
pop esi
ret 0xc

Function at 0x4067da
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x406804
movzx ecx, byte [edi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x443ff0]
inc edi
sub esi, 1
jne 0x4067ec
pop edi
mov eax, edx
pop esi
ret 0xc

Function at 0x4069e3
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x443620]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov ebx, dword [esp + 0x34]
push ebp
push esi
push edi
mov edi, dword [esp + 0x3c]
xor ebp, ebp
cmp dword [edi], 2
lea esi, [edi + 4]
jne 0x406a44
mov eax, dword [esi]
push ebp
push ebp
push ebp
push ebp
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
push 4
lea eax, [esp + 0x28]
push eax
push 0x20
push ebx
call fcn.004071e1
mov edx, ebp
movzx eax, byte [esp + edx + 0x14]
mov ecx, edx
and ecx, 3
shl ecx, 3
shl eax, cl
xor eax, ebp
inc edx
mov ebp, eax
cmp edx, 0x20
jb 0x406a27
mov dword [esi], eax
xor ebp, ebp
cmp dword [edi], 3
jne 0x406a6d
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x24]
push eax
push 0x20
push esi
push 0x20
push ebx
call fcn.004071e1
push 0x20
lea eax, [esp + 0x18]
push eax
push esi
call fcn.00423ab0
add esp, 0xc
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00420983
add esp, 0x28
ret 8
Function at 0x4071e1
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x1d4
mov eax, dword [0x443620]
xor eax, esp
mov dword [esp + 0x1d0], eax
mov eax, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1f0]
push ebx
mov ebx, dword [esp + 0x1e0]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1ec]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1f8]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1fc]
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
push ebp
mov ebp, dword [esp + 0x1e0]
push esi
push edi
mov edi, dword [esp + 0x1fc]
mov dword [esp + 0x1c], edi
cmp ebx, 0x40
jbe 0x40728d
lea eax, [esp + 0xf8]
push eax
call fcn.00411dd4
push ebx
push ebp
lea eax, [esp + 0x100]
push eax
call fcn.00411e1a
lea eax, [esp + 0x1a0]
push eax
lea eax, [esp + 0xfc]
push eax
call fcn.00411cf1
mov edx, dword [esp + 0x10]
lea ebp, [esp + 0x1a0]
push 0x20
pop ebx
test edi, edi
je 0x4072a7
cmp byte [edx], 0
je 0x4072a7
mov esi, edi
lea edi, [esp + 0x28]
push 0x1a
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x1c]
jmp 0x407312
xor edx, edx
test ebx, ebx
je 0x4072cd
mov esi, ebp
lea eax, [esp + 0x160]
sub esi, eax
lea ecx, [esp + 0x160]
add ecx, edx
mov al, byte [esi + ecx]
xor al, 0x36
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x4072b8
cmp ebx, 0x40
jae 0x4072ec
push 0x40
pop eax
sub eax, ebx
lea ecx, [esp + 0x160]
push eax
add ecx, ebx
push 0x36
push ecx
call fcn.00421ea0
add esp, 0xc
lea eax, [esp + 0x28]
push eax
call fcn.00411dd4
push 0x40
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00411e1a
test edi, edi
je 0x407323
mov edx, dword [esp + 0x10]
cmp byte [edx], 0
jne 0x407323
push 0x1a
pop ecx
lea esi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov byte [edx], 1
push dword [esp + 0x1f4]
lea eax, [esp + 0x2c]
push dword [esp + 0x24]
push eax
call fcn.00411e1a
lea eax, [esp + 0x1c0]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00411cf1
mov edi, dword [esp + 0x14]
test edi, edi
je 0x40736f
mov eax, dword [esp + 0x18]
cmp byte [eax], 0
je 0x40736f
mov esi, edi
lea edi, [esp + 0x90]
push 0x1a
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
jmp 0x4073de
test ebx, ebx
je 0x407393
lea eax, [esp + 0x160]
sub ebp, eax
xor edx, edx
lea ecx, [esp + 0x160]
add ecx, edx
mov al, byte [ecx + ebp]
xor al, 0x5c
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x40737e
cmp ebx, 0x40
jae 0x4073b2
push 0x40
pop eax
sub eax, ebx
lea ecx, [esp + 0x160]
push eax
add ecx, ebx
push 0x5c
push ecx
call fcn.00421ea0
add esp, 0xc
lea eax, [esp + 0x90]
push eax
call fcn.00411dd4
push 0x40
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x98]
push eax
call fcn.00411e1a
test edi, edi
je 0x4073f2
mov eax, dword [esp + 0x18]
cmp byte [eax], 0
jne 0x4073f2
push 0x1a
pop ecx
lea esi, [esp + 0x90]
rep movsd dword es:[edi], dword [esi]
mov byte [eax], 1
push 0x20
lea eax, [esp + 0x1c4]
push eax
lea eax, [esp + 0x98]
push eax
call fcn.00411e1a
push dword [esp + 0x24]
lea eax, [esp + 0x94]
push eax
call fcn.00411cf1
mov ecx, dword [esp + 0x1e0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00420983
add esp, 0x1d4
ret 0x24