joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410b2b
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
call fcn.00410bc8
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x410bbe
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
je 0x410bb7
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [esi + 0xc], edx
test edx, edx
je 0x410bae
push 6
pop ecx
mov dword [ebp - 0x1c], edi
xor eax, eax
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x410bae
mov ecx, dword [ebp - 0x10]
mov al, 1
mov dword [esi + 0x10], ecx
jmp 0x410bc0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.00410bc8
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x410c6c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
test eax, eax
jne 0x410c7d
xor al, al
jmp 0x410ce6
mov ecx, 0x5a4d
push esi
cmp word [eax], cx
jne 0x410ce3
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x410ce3
mov edx, dword [ecx + eax + 0x98]
xor ecx, ecx
lea esi, [edx + eax]
test edx, edx
jne 0x410ca6
mov esi, ecx
test esi, esi
je 0x410ce3
lea eax, [esi + 8]
test eax, eax
je 0x410ce3
cmp byte [eax], 0x30
lea edx, [eax + 1]
jne 0x410cd5
mov al, byte [edx]
cmp al, 0x82
jne 0x410cd5
movzx ecx, byte [edx + 1]
movzx eax, byte [edx + 2]
shl ecx, 8
add ecx, 0x13
add ecx, eax
and ecx, 0xffffff8
test ecx, ecx
je 0x410ce3
mov dword [edi + 0x14], ecx
mov al, 1
mov dword [edi + 0x18], esi
jmp 0x410ce5
xor al, al
pop esi
pop edi
pop ebp
ret 4
Function at 0x410df8
Capabilities:
Get file version info

Disassembly:
push 0xf4
mov eax, 0x4373dd
call fcn.00413d31
mov esi, ecx
mov dword [ebp - 0xf4], esi
xor edi, edi
mov dword [ebp - 0xf8], edi
mov dword [ebp - 4], edi
lea ecx, [ebp - 0xfc]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
jne 0x410e51
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x444a3c
mov ecx, esi
call fcn.00405b1d
push edi
jmp 0x410f3f
push ebx
call fcn.00413865
mov edi, eax
pop ecx
test edi, edi
jne 0x410e6f
push 0x444a3c
mov ecx, esi
call fcn.00405b1d
jmp 0x410f3d
xor ecx, ecx
mov dword [ebp - 0xdc], 7
xor eax, eax
mov dword [ebp - 0xe0], ecx
mov word [ebp - 0xf0], ax
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push edi
cmovae eax, dword [ebp + 8]
push ebx
push ecx
push eax
mov dword [ebp - 0xf4], ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x410f19
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0x445a18
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ecx, dword [ebp - 0xf4]
test ecx, ecx
je 0x410f19
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0xd8]
push 0x446428
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xd8]
push eax
call fcn.004013b6
add esp, 0x1c
lea ecx, [ebp - 0xf0]
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.00407f54
push edi
call fcn.00413376
pop ecx
lea eax, [ebp - 0xf0]
mov ecx, esi
push eax
call fcn.00405af8
push 0
push 1
lea ecx, [ebp - 0xf0]
call fcn.00407cbb
push 0
push 1
lea ecx, [ebp + 8]
call fcn.00407cbb
mov eax, esi
call fcn.00413cdb
ret
Function at 0x429128
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00428fa7

Function at 0x42e72f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042e3dd

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x1edb6de4
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0xf8871a0
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x405160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov eax, dword [0x48f230]
add eax, 0x258f361f
mov dword [0x48f230], eax
mov eax, dword [0x4937dc]
xor eax, 0xf7ac0333
mov dword [0x4937dc], eax
mov eax, dword [0x49c738]
imul eax, eax, 0xebbfdf41
mov dword [0x49c738], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [0x49e0d4]
add eax, 0xffbdf8e0
mov dword [0x49e0d4], eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
lea eax, [eax + ecx*4]
mov dword [esp + 4], eax
mov eax, dword [0x490b98]
dec eax
mov dword [0x490b98], eax
mov si, ax
mov word [0x4a7ede], si
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [0x48eeb0]
and eax, 0xb4dc935f
mov dword [0x48eeb0], eax
mov eax, dword [esp + 8]
cmp eax, dword [esp + 4]
je 0x405331
mov eax, 0x5084000
mov ecx, dword [0x49aa30]
add ecx, 0x34fc9763
mov dword [0x49aa30], ecx
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov esi, dword [edx]
xor esi, ecx
mov dword [edx], esi
mov ecx, dword [0x499834]
not ecx
mov edx, dword [0x49a330]
imul edx, edx, 0x179b8ad9
or ecx, edx
cmp eax, ecx
jl 0x4052ae
mov eax, 0x99afbdbb
mov ecx, dword [0x498b38]
inc ecx
mov dword [0x498b38], ecx
imul ecx, ecx, 0x6bfe4736
and ecx, 0x4350eb5f
cmp eax, ecx
je 0x4052a9
mov ax, word [0x4a18ac]
mov cx, ax
inc ecx
mov dx, cx
mov word [0x4a18ac], dx
movsx ecx, ax
imul ecx, ecx, 0xdf21ddc4
cmp ecx, 0x6a9bca6d
jge 0x40529f
jmp 0x4052a4
jmp 0x4052a4
jmp 0x4052a9
jmp 0x4052ae
mov eax, dword [esp]
rol eax, 0x1d
mov dword [esp], eax
mov eax, dword [0x491dc8]
or eax, 0x8200a240
mov ecx, dword [0x4998cc]
add ecx, 0x91375484
or ecx, 0x120fae43
cmp eax, ecx
jle 0x4052e4
mov word [0x4a80c8], 0x1f7e
movzx eax, byte [esp + 1]
movzx ecx, byte [esp + 2]
add ecx, eax
mov dl, cl
mov byte [esp + 2], dl
mov dword [0x49c650], 0x1583e456
movzx eax, byte [esp + 2]
movzx ecx, byte [esp + 1]
add ecx, eax
mov dl, cl
mov byte [esp + 1], dl
mov eax, dword [0x48f350]
add eax, 0x777f1357
mov dword [0x48f350], eax
mov eax, dword [esp + 8]
add eax, 4
mov dword [esp + 8], eax
jmp 0x4051fb
mov ax, word [0x4a4cbc]
mov cx, ax
add ecx, 0xd0b7217a
mov ax, cx
mov word [0x4a4cbc], ax
mov eax, dword [esp]
add esp, 0x18
pop esi
ret
Function at 0x413ef0
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov cx, word [0x4a493e]
mov ax, cx
add eax, 0xba89f3d2
mov cx, ax
mov word [0x4a493e], cx
mov eax, dword [0x4aa798]
mov edx, esp
mov dword [edx], eax
call fcn.00413a80
mov edx, dword [0x496458]
mov esi, dword [0x49efbc]
inc esi
mov dword [0x49efbc], esi
sub edx, esi
mov cx, word [0x4a28d4]
movsx esi, cx
cmp edx, esi
mov byte [esp + 0xb], al
jge 0x413f92
mov eax, dword [0x492a58]
imul eax, eax, 0xdc2bcc39
xor eax, 0xf6bf1386
cmp eax, 0xbf73f5f7
jg 0x413f8d
mov ax, word [0x4a2dd0]
mov cx, ax
or ecx, 0xd1eb
mov ax, word [0x4a91a4]
mov dx, ax
imul edx, ecx
mov ax, dx
mov word [0x4a91a4], ax
jmp 0x413f92
mov eax, 1
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.0045c2ab
int3
Function at 0x436f40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x491098]
mov ecx, dword [0x49a51c]
imul eax, ecx
imul eax, eax, 0xbdfc2652
mov ecx, dword [0x491f74]
sub ecx, eax
mov dword [0x491f74], ecx
mov dx, word [0x4a8d60]
mov ax, dx
shl eax, 3
mov ecx, 0xa3b3adce
sub ecx, eax
mov dx, word [0x4a463a]
mov ax, dx
or ecx, eax
or ecx, 0xae5
mov dx, cx
mov word [0x4a463a], dx
push ebp
pop ebx
sub al, 0x39
xor eax, dword [edx + edi*2]
invalid

Function at 0x4393c0
Capabilities:
Hash data with md5

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, 0x90866c1b
mov dword [esp + 4], ecx
mov edx, dword [0x4a0108]
mov esi, dword [0x49c730]
and esi, 0xcc856471
or edx, esi
cmp eax, edx
mov dword [esp], ecx
jle 0x4393fd
mov eax, dword [0x4a0e48]
and eax, 0xb5331f6b
mov dword [0x4a0e48], eax
mov eax, 0x71db4a74
mov ecx, dword [esp]
mov dword [ecx], 0
mov dx, word [0x4a64f4]
movsx esi, dx
xor esi, 0x85002a00
mov edi, dword [0x495e60]
or esi, edi
or esi, 0x189ec4ef
mov dword [0x495e60], esi
mov dword [ecx + 4], 0
mov esi, dword [0x496ce8]
and esi, 0x3206184b
mov dword [0x496ce8], esi
mov dword [ecx + 8], 0x67452301
mov dword [0x49b50c], 0x3340370f
mov dword [ecx + 0xc], 0xefcdab89
mov dx, word [0x4a66ae]
mov si, dx
inc esi
mov bx, si
mov word [0x4a66ae], bx
movsx esi, dx
imul esi, esi, 0x1b119606
imul esi, esi, 0x176fe7b7
cmp eax, esi
je 0x4394a9
mov eax, dword [0x4989b8]
add eax, 0x263b6cad
mov ecx, dword [0x4a10c8]
xor ecx, eax
mov dword [0x4a10c8], ecx
jmp 0x4394c1
mov ax, word [0x4a8870]
mov cx, ax
or ecx, 0xe62
mov ax, cx
mov word [0x4a8870], ax
mov eax, dword [esp]
mov dword [eax + 0x10], 0x98badcfe
mov cx, word [0x4aa4ea]
mov dx, cx
imul edx, edx, 0xfd866d2d
mov cx, dx
mov word [0x4aa4ea], cx
mov dword [eax + 0x14], 0x10325476
mov edx, dword [0x499c04]
add edx, 0xefdbafbe
mov dword [0x499c04], edx
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x46fe55
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48d850]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0046da02
mov dword [ebp - 0x14], eax
cmp dword [0x4abc7c], esi
jne 0x46ff48
push 0x800
push esi
push 0x482ef0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x46fed5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x470028
push esi
push esi
push 0x482ef0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x470028
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x470028
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4abc7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4abc80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4abc84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4abc8c], eax
test eax, eax
je 0x46ff45
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4abc88], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x46ff6d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46ff60
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x46ff82
push 4
pop eax
jmp 0x47002a
cmp dword [ebp - 0x14], esi
je 0x46ff82
push dword [0x4abc7c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x46ff67
mov eax, dword [0x4abc88]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x46ffe0
cmp dword [0x4abc8c], edi
je 0x46ffe0
push eax
call ebx
push dword [0x4abc8c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x46ffe0
test eax, eax
je 0x46ffe0
call ecx
test eax, eax
je 0x46ffd5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x46ffd5
test byte [ebp - 8], 1
jne 0x46ffe0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x470010
mov eax, dword [0x4abc80]
cmp eax, edi
je 0x47000d
push eax
call ebx
test eax, eax
je 0x47000d
call eax
mov esi, eax
test esi, esi
je 0x47000d
mov eax, dword [0x4abc84]
cmp eax, edi
je 0x47000d
push eax
call ebx
test eax, eax
je 0x47000d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4abc7c]
call ebx
test eax, eax
je 0x470028
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x47002a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00463c9c
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434004]
jne 0x40100a
repz ret
jmp fcn.00401728

Function at 0x4064a8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402451
and dword [ebp - 4], 0
cmp dword [0x435de4], 0
mov ebx, eax
jne 0x406559
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40660a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40660a
push eax
call fcn.004023df
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x435de4], eax
call esi
push eax
call fcn.004023df
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x435de8], eax
call esi
push eax
call fcn.004023df
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435dec], eax
call esi
push eax
call fcn.004023df
pop ecx
mov dword [0x435df4], eax
test eax, eax
je 0x406559
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004023df
pop ecx
mov dword [0x435df0], eax
mov eax, dword [0x435df0]
cmp eax, ebx
je 0x4065b1
cmp dword [0x435df4], ebx
je 0x4065b1
push eax
call fcn.0040245a
push dword [0x435df4]
mov esi, eax
call fcn.0040245a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4065b1
test edi, edi
je 0x4065b1
call esi
test eax, eax
je 0x4065a8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4065a8
test byte [ebp - 0xc], 1
jne 0x4065b1
or dword [ebp + 0x10], 0x200000
jmp 0x4065ea
mov eax, dword [0x435de8]
cmp eax, ebx
je 0x4065ea
push eax
call fcn.0040245a
pop ecx
test eax, eax
je 0x4065ea
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4065ea
mov eax, dword [0x435dec]
cmp eax, ebx
je 0x4065ea
push eax
call fcn.0040245a
pop ecx
test eax, eax
je 0x4065ea
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435de4]
call fcn.0040245a
pop ecx
test eax, eax
je 0x40660a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40660c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430450
Capabilities:
Get hostname

Disassembly:
sub esp, 0x42c
mov eax, dword [0x434004]
xor eax, esp
mov dword [esp + 0x428], eax
cmp edi, 0x182
jne 0x43047e
lea eax, [esp + 0xc]
push eax
push str.tuzudinuyodawiz_xivizevobikotuletife
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
jmp 0x4304b2
cmp edi, 0x19f
jne 0x4304b2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push str.wofoyamev_wexededukocoh
push str.vazew_xajinoguwumofeforupatetonaxoc_vasufadogenanajeyu_wiwarerimefozenodav
push str.besudufawocugiforacir_nawiyay_yirideculaxabafulewasu_seyihet_zazadubavoxuyucawitiwituzunacare
push str.bemoxaxoyuguxejoxipavav_damilagorifoki_meyogupusosojezogayihasawuzerebu_moyeta
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push esi
xor esi, esi
test edi, edi
jle 0x430522
lea esp, [esp]
lea ecx, [esp + 8]
mov dword [esp + 4], 5
mov dword [esp + 8], 0
call fcn.00430440
mov eax, dword [esp + 8]
add eax, 0x46
mov dword [esp + 4], eax
sub dword [esp + 4], 0x46
mov cl, byte [esp + 4]
xor byte [ebx + esi], cl
cmp edi, 0xf
jne 0x43051d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
inc esi
cmp esi, edi
jl 0x4304c0
pop esi
cmp edi, 0x2d
jne 0x43053c
mov dword [0x2b34000], 0xa62e7790
mov dword [0x2b34004], 0xffffffff
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00401000
add esp, 0x42c
ret
Function at 0x404af5
Capabilities:
Hash data using sha256

Disassembly:
push esi
push edi
mov edi, eax
mov esi, ecx
call fcn.00404a8a
xor eax, eax
mov edx, dword [eax + 0x42a478]
mov ecx, dword [esi + 0xf4]
mov dword [eax + ecx], edx
add eax, 4
cmp eax, 0x20
jl 0x404b02
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov eax, dword [esi + 0xf4]
mov ecx, dword [esp + 0xc]
xor dword [eax + 8], ecx
mov esi, dword [esi + 0xf4]
or edi, 0x2000
shl edi, 0x10
xor dword [esi + 0xc], edi
pop edi
pop esi
ret 4
Function at 0x4057ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x4057fb
test cl, 7
je 0x4057fb
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4305c8]
dec esi
inc ecx
jmp 0x4057dc
cmp esi, 8
jb 0x40589e
mov edx, esi
shr edx, 3
mov dword [ebp + 8], edx
push ebx
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx edi, bl
mov edi, dword [edi*4 + 0x4309c8]
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4305c8]
mov ebx, edx
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x430dc8]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4315c8]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edi, dword [ebx*4 + 0x4319c8]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x431dc8]
movzx edx, dl
xor edi, dword [edx*4 + 0x4311c8]
movzx eax, al
xor edi, dword [eax*4 + 0x4321c8]
sub esi, 8
add ecx, 8
dec dword [ebp + 8]
mov eax, edi
jne 0x40580d
pop ebx
jmp 0x40589e
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4305c8]
dec esi
inc ecx
test esi, esi
ja 0x40588a
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x405bc5
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0x40
pop ebx
cmp esi, ebx
jbe 0x405c0f
lea eax, [ebp - 0x1d0]
push eax
call fcn.0041048b
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1d0]
push eax
call fcn.0041078d
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.00410806
lea eax, [ebp - 0x80]
push 0x20
mov dword [ebp + 8], eax
pop esi
xor ecx, ecx
push edi
test esi, esi
jbe 0x405c2f
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x36
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x405c1e
cmp esi, ebx
jae 0x405c47
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x36
push eax
call fcn.0041a650
add esp, 0xc
lea eax, [ebp - 0xf0]
push eax
call fcn.0041048b
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.0041078d
push dword [ebp + 0x14]
lea eax, [ebp - 0xf0]
push dword [ebp + 0x10]
push eax
call fcn.0041078d
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00410806
lea eax, [ebp - 0x160]
push eax
call fcn.0041048b
xor ecx, ecx
test esi, esi
jbe 0x405cb1
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x5c
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x405ca0
pop edi
cmp esi, ebx
jae 0x405cca
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x5c
push eax
call fcn.0041a650
add esp, 0xc
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.0041078d
push 0x20
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.0041078d
push dword [ebp + 0x18]
lea eax, [ebp - 0x160]
push eax
call fcn.00410806
pop esi
pop ebx
leave
ret 0x14
Function at 0x405d02
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0xbc
push esi
mov esi, dword [ebp + 0x6c]
push edi
push 0x40
pop eax
cmp esi, eax
jae 0x405d1b
mov eax, esi
push eax
push dword [ebp + 0x68]
lea eax, [ebp - 0x44]
push eax
call fcn.0041c0c0
add esp, 0xc
lea eax, [ebp + 0x20]
push eax
mov byte [ebp + esi - 0x44], 0
mov byte [ebp + esi - 0x43], 0
mov byte [ebp + esi - 0x42], 0
mov byte [ebp + esi - 0x41], 1
add esi, 4
push esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.00405bc5
push 0x20
pop esi
push esi
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp]
push eax
call fcn.0041c0c0
mov eax, dword [ebp + 0x7c]
add esp, 0xc
dec eax
mov dword [ebp + 0x4c], eax
push 0x10
pop eax
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x70]
mov dword [ebp + 0x40], eax
mov eax, dword [ebp + 0x74]
mov dword [ebp + 0x44], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x48], eax
xor edi, edi
mov eax, dword [ebp + edi + 0x4c]
test eax, eax
jbe 0x405dd2
mov dword [ebp + 0x6c], eax
lea eax, [ebp - 0x64]
push eax
push esi
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.00405bc5
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0041c0c0
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax + 0x20]
xor byte [ebp + eax], cl
inc eax
cmp eax, esi
jb 0x405dc0
dec dword [ebp + 0x6c]
jne 0x405d99
push esi
lea eax, [ebp]
push eax
push dword [ebp + edi + 0x40]
call fcn.0041c0c0
add edi, 4
add esp, 0xc
cmp edi, 0xc
jb 0x405d8e
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.0040ce3e
push esi
lea eax, [ebp]
push eax
call fcn.0040ce3e
push esi
lea eax, [ebp + 0x20]
push eax
call fcn.0040ce3e
push esi
lea eax, [ebp - 0x64]
push eax
call fcn.0040ce3e
pop edi
pop esi
add ebp, 0x58
leave
ret 0x20