joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bf08
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp al, byte [ebp + eax*2 + 0x3a]
add esp, 4
pop ecx
push edi
sub edi, 0x13882
pop edi
cmp dword [ebp - 0x1680], 0
jne 0x40bf30
mov dword [ebp - 0x2fc], 0
jmp 0x40c1d7
mov edx, dword [ebp - 0x1680]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xce0], ecx
push ebx
push edi
add esp, 4
or ebx, 0x12e2d
and ebx, 0xbc90
pop ebx
push ebx
call 0x40bf64
add byte [ecx + 0x4c], al
cmp dword [edi], edi
inc edi
dec ebp
dec ecx
inc eax
aaa
add esp, 4
or ebx, 0xb7c2
xor ebx, 0x15a47
pop ebx
cmp dword [ebp - 0xce0], 0
jne 0x40bf8c
mov dword [ebp - 0x2fc], 0
jmp 0x40c1d7
mov edx, dword [ebp - 0xce0]
mov dword [ebp - 0x51c], edx
push esi
xor esi, 0x13e54
pop esi
push edi
push ebx
add esp, 4
add edi, 0x33d9
xor edi, 0x7801
test dword [ecx], 0x81000078
mov esp, 0x5f00008c
push ebx
push edx
add esp, 4
and ebx, 0x9f4
sub ebx, 0x11bd6
pop ebx
lea eax, [ebp - 0x173c]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ecx
push edx
add esp, 4
sub ecx, 0x3d40
call 0x40c00e
add byte [edi], dh
dec edx
cmp dword [ebx + 0x4f], eax
cmp eax, dword ss:[ebp + 0x50]
add esp, 4
pop ecx
push ebx
add ebx, 0x3bd5
or ebx, 0x105d2
sub ebx, 0x410c
add byte [ebx - 0x75], bl
xchg ebp, eax
sub bl, dh
invalid
jmp dword [esi - 0x75]
add ah, byte [esi - 0x77]
test dword [edx - 0x74000011], edi
lea ebp, [eax]
invalid
invalid
inc dword [ebx - 0x7276fd3f]
sub bl, dh
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
mov edx, 0x66ffffef
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push ebx
push ecx
add esp, 4
sub ebx, 0x6116
pop ebx
push ecx
push eax
add esp, 4
or ecx, 0x4676
pop ecx
push edi
and edi, 0x3def
or edi, 0x18153
or edi, 0x16a33
or edi, 0x168b5
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x40c0cc
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1688], edx
jmp 0x40c126
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x40bff4
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x40bff4
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x40c110
mov dword [ebp - 0x1684], 0xffffffff
jmp 0x40c11a
mov dword [ebp - 0x1684], 1
mov ecx, dword [ebp - 0x1684]
mov dword [ebp - 0x1688], ecx
cmp dword [ebp - 0x1688], 0
jne 0x40c16f
push edx
push eax
add esp, 4
add edx, 0x159c6
add edx, 0x103de
push ecx
push edx
add esp, 4
xor ecx, 0x13a4
xor ecx, 0x150
or ecx, 0x15d52
pop ecx
push edi
push eax
add esp, 4
or edi, 0xa166
and edi, 0x134f4
jmp 0x40c1a0
pop edi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x40c1cd
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x40bf98
mov dword [ebp - 0x2fc], 0
Function at 0x40bf0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp al, byte [ebp + eax*2 + 0x3a]
add esp, 4
pop ecx
push edi
sub edi, 0x13882
pop edi
cmp dword [ebp - 0x1680], 0
jne 0x40bf30
mov dword [ebp - 0x2fc], 0
jmp 0x40c1d7
mov edx, dword [ebp - 0x1680]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xce0], ecx
push ebx
push edi
add esp, 4
or ebx, 0x12e2d
and ebx, 0xbc90
pop ebx
push ebx
call 0x40bf64
add byte [ecx + 0x4c], al
cmp dword [edi], edi
inc edi
dec ebp
dec ecx
inc eax
aaa
add esp, 4
or ebx, 0xb7c2
xor ebx, 0x15a47
pop ebx
cmp dword [ebp - 0xce0], 0
jne 0x40bf8c
mov dword [ebp - 0x2fc], 0
jmp 0x40c1d7
mov edx, dword [ebp - 0xce0]
mov dword [ebp - 0x51c], edx
push esi
xor esi, 0x13e54
pop esi
push edi
push ebx
add esp, 4
add edi, 0x33d9
xor edi, 0x7801
test dword [ecx], 0x81000078
mov esp, 0x5f00008c
push ebx
push edx
add esp, 4
and ebx, 0x9f4
sub ebx, 0x11bd6
pop ebx
lea eax, [ebp - 0x173c]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ecx
push edx
add esp, 4
sub ecx, 0x3d40
call 0x40c00e
add byte [edi], dh
dec edx
cmp dword [ebx + 0x4f], eax
cmp eax, dword ss:[ebp + 0x50]
add esp, 4
pop ecx
push ebx
add ebx, 0x3bd5
or ebx, 0x105d2
sub ebx, 0x410c
add byte [ebx - 0x75], bl
xchg ebp, eax
sub bl, dh
invalid
jmp dword [esi - 0x75]
add ah, byte [esi - 0x77]
test dword [edx - 0x74000011], edi
lea ebp, [eax]
invalid
invalid
inc dword [ebx - 0x7276fd3f]
sub bl, dh
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
mov edx, 0x66ffffef
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push ebx
push ecx
add esp, 4
sub ebx, 0x6116
pop ebx
push ecx
push eax
add esp, 4
or ecx, 0x4676
pop ecx
push edi
and edi, 0x3def
or edi, 0x18153
or edi, 0x16a33
or edi, 0x168b5
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x40c0cc
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1688], edx
jmp 0x40c126
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x40bff4
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x40bff4
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x40c110
mov dword [ebp - 0x1684], 0xffffffff
jmp 0x40c11a
mov dword [ebp - 0x1684], 1
mov ecx, dword [ebp - 0x1684]
mov dword [ebp - 0x1688], ecx
cmp dword [ebp - 0x1688], 0
jne 0x40c16f
push edx
push eax
add esp, 4
add edx, 0x159c6
add edx, 0x103de
push ecx
push edx
add esp, 4
xor ecx, 0x13a4
xor ecx, 0x150
or ecx, 0x15d52
pop ecx
push edi
push eax
add esp, 4
or edi, 0xa166
and edi, 0x134f4
jmp 0x40c1a0
pop edi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x40c1cd
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x40bf98
mov dword [ebp - 0x2fc], 0
Function at 0x40bf64
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp al, byte [ebp + eax*2 + 0x3a]
add esp, 4
pop ecx
push edi
sub edi, 0x13882
pop edi
cmp dword [ebp - 0x1680], 0
jne 0x40bf30
mov dword [ebp - 0x2fc], 0
jmp 0x40c1d7
mov edx, dword [ebp - 0x1680]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xce0], ecx
push ebx
push edi
add esp, 4
or ebx, 0x12e2d
and ebx, 0xbc90
pop ebx
push ebx
call 0x40bf64
add byte [ecx + 0x4c], al
cmp dword [edi], edi
inc edi
dec ebp
dec ecx
inc eax
aaa
add esp, 4
or ebx, 0xb7c2
xor ebx, 0x15a47
pop ebx
cmp dword [ebp - 0xce0], 0
jne 0x40bf8c
mov dword [ebp - 0x2fc], 0
jmp 0x40c1d7
mov edx, dword [ebp - 0xce0]
mov dword [ebp - 0x51c], edx
push esi
xor esi, 0x13e54
pop esi
push edi
push ebx
add esp, 4
add edi, 0x33d9
xor edi, 0x7801
test dword [ecx], 0x81000078
mov esp, 0x5f00008c
push ebx
push edx
add esp, 4
and ebx, 0x9f4
sub ebx, 0x11bd6
pop ebx
lea eax, [ebp - 0x173c]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ecx
push edx
add esp, 4
sub ecx, 0x3d40
call 0x40c00e
add byte [edi], dh
dec edx
cmp dword [ebx + 0x4f], eax
cmp eax, dword ss:[ebp + 0x50]
add esp, 4
pop ecx
push ebx
add ebx, 0x3bd5
or ebx, 0x105d2
sub ebx, 0x410c
add byte [ebx - 0x75], bl
xchg ebp, eax
sub bl, dh
invalid
jmp dword [esi - 0x75]
add ah, byte [esi - 0x77]
test dword [edx - 0x74000011], edi
lea ebp, [eax]
invalid
invalid
inc dword [ebx - 0x7276fd3f]
sub bl, dh
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
mov edx, 0x66ffffef
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push ebx
push ecx
add esp, 4
sub ebx, 0x6116
pop ebx
push ecx
push eax
add esp, 4
or ecx, 0x4676
pop ecx
push edi
and edi, 0x3def
or edi, 0x18153
or edi, 0x16a33
or edi, 0x168b5
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x40c0cc
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1688], edx
jmp 0x40c126
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x40bff4
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x40bff4
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x40c110
mov dword [ebp - 0x1684], 0xffffffff
jmp 0x40c11a
mov dword [ebp - 0x1684], 1
mov ecx, dword [ebp - 0x1684]
mov dword [ebp - 0x1688], ecx
cmp dword [ebp - 0x1688], 0
jne 0x40c16f
push edx
push eax
add esp, 4
add edx, 0x159c6
add edx, 0x103de
push ecx
push edx
add esp, 4
xor ecx, 0x13a4
xor ecx, 0x150
or ecx, 0x15d52
pop ecx
push edi
push eax
add esp, 4
or edi, 0xa166
and edi, 0x134f4
jmp 0x40c1a0
pop edi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x40c1cd
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x40bf98
mov dword [ebp - 0x2fc], 0
Function at 0x40bfac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dword [ecx], 0x81000078
mov esp, 0x5f00008c
Function at 0x40c00e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp al, byte [ebp + eax*2 + 0x3a]
add esp, 4
pop ecx
push edi
sub edi, 0x13882
pop edi
cmp dword [ebp - 0x1680], 0
jne 0x40bf30
mov dword [ebp - 0x2fc], 0
jmp 0x40c1d7
mov edx, dword [ebp - 0x1680]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xce0], ecx
push ebx
push edi
add esp, 4
or ebx, 0x12e2d
and ebx, 0xbc90
pop ebx
push ebx
call 0x40bf64
add byte [ecx + 0x4c], al
cmp dword [edi], edi
inc edi
dec ebp
dec ecx
inc eax
aaa
add esp, 4
or ebx, 0xb7c2
xor ebx, 0x15a47
pop ebx
cmp dword [ebp - 0xce0], 0
jne 0x40bf8c
mov dword [ebp - 0x2fc], 0
jmp 0x40c1d7
mov edx, dword [ebp - 0xce0]
mov dword [ebp - 0x51c], edx
push esi
xor esi, 0x13e54
pop esi
push edi
push ebx
add esp, 4
add edi, 0x33d9
xor edi, 0x7801
test dword [ecx], 0x81000078
mov esp, 0x5f00008c
push ebx
push edx
add esp, 4
and ebx, 0x9f4
sub ebx, 0x11bd6
pop ebx
lea eax, [ebp - 0x173c]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ecx
push edx
add esp, 4
sub ecx, 0x3d40
call 0x40c00e
add byte [edi], dh
dec edx
cmp dword [ebx + 0x4f], eax
cmp eax, dword ss:[ebp + 0x50]
add esp, 4
pop ecx
push ebx
add ebx, 0x3bd5
or ebx, 0x105d2
sub ebx, 0x410c
add byte [ebx - 0x75], bl
xchg ebp, eax
sub bl, dh
invalid
jmp dword [esi - 0x75]
add ah, byte [esi - 0x77]
test dword [edx - 0x74000011], edi
lea ebp, [eax]
invalid
invalid
inc dword [ebx - 0x7276fd3f]
sub bl, dh
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
mov edx, 0x66ffffef
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push ebx
push ecx
add esp, 4
sub ebx, 0x6116
pop ebx
push ecx
push eax
add esp, 4
or ecx, 0x4676
pop ecx
push edi
and edi, 0x3def
or edi, 0x18153
or edi, 0x16a33
or edi, 0x168b5
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x40c0cc
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1688], edx
jmp 0x40c126
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x40bff4
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x40bff4
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x40c110
mov dword [ebp - 0x1684], 0xffffffff
jmp 0x40c11a
mov dword [ebp - 0x1684], 1
mov ecx, dword [ebp - 0x1684]
mov dword [ebp - 0x1688], ecx
cmp dword [ebp - 0x1688], 0
jne 0x40c16f
push edx
push eax
add esp, 4
add edx, 0x159c6
add edx, 0x103de
push ecx
push edx
add esp, 4
xor ecx, 0x13a4
xor ecx, 0x150
or ecx, 0x15d52
pop ecx
push edi
push eax
add esp, 4
or edi, 0xa166
and edi, 0x134f4
jmp 0x40c1a0
pop edi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x40c1cd
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x40bf98
mov dword [ebp - 0x2fc], 0
Function at 0x40c140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edx, 0xd568
pop edx
push esi
add esi, 0x95c8
xor esi, 0xee19
or esi, 0xa065
sub esi, 0xd1e8
pop esi
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x40c1d7
push ecx
xor ecx, 0xe2a1
or ecx, 0xe7d4
sub ecx, 0xa315
pop ecx
push edi
push edx
add esp, 4
sub edi, 0x7cb2
and edi, 0x176eb
sub edi, 0x14148
add edi, 0xba7c
pop edi
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push eax
push ecx
add esp, 4
sub eax, 0xa75b
sub eax, 0x14e3d
and eax, 0x3897
pop eax
push edx
xor edx, 0x116a2
and edx, 0xfaad
pop edx
push ecx
push esi
add esp, 4
or ecx, 0x9578
pop ecx
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x168c], eax
cmp dword [ebp - 0x168c], 0
jne 0x40c27a
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x40c56b
add byte [eax], al

Function at 0x42af28
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040a6c4
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00410394
mov edi, eax
cmp edi, 0x104
jbe 0x42aed3
mov eax, edi
add eax, eax
call fcn.00406f0c
mov esi, eax
jmp 0x42aed5
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00410394
push esi
call fcn.00414720
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42af0e
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x42aef8
mov eax, esp
cmp esi, eax
je 0x42af1b
mov eax, esi
call fcn.00406f28
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x42af54
cmp bl, 0
je 0x42af50
cmp bl, 0x41
jl 0x42af4b
cmp bl, 0x5a
jg 0x42af4b
or bl, 0x20
xor al, bl
inc esi
jmp 0x42af2f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x42ae94
Function at 0x42c788
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42c7a7
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42c7b7
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42c8d9
test ebx, ebx
jl 0x42c8d9
test esi, esi
jle 0x42c8d9
mov eax, dword [ebp - 8]
call fcn.0040b278
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040b278
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42c876
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42c8d9
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42c85b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42c82a
inc dword [ebp - 0x14]
jmp 0x42c83a
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42c83a
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42c845
or eax, 0xffffffff
jmp 0x42c85b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42c858
inc eax
jmp 0x42c85b
or eax, 0xffffffff
test eax, eax
jl 0x42c863
cmp esi, eax
jg 0x42c818
cmp esi, eax
jg 0x42c86e
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42c8dc
inc edx
dec dword [ebp - 0x1c]
jne 0x42c814
jmp 0x42c8d9
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42c8d9
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42c8c0
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42c89f
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42c8aa
or eax, 0xffffffff
jmp 0x42c8c0
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42c8bd
inc eax
jmp 0x42c8c0
or eax, 0xffffffff
test eax, eax
jl 0x42c8c8
cmp esi, eax
jg 0x42c888
cmp esi, eax
jg 0x42c8d3
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42c8dc
inc edx
dec dword [ebp - 0x1c]
jne 0x42c884
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c6478
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x4c6480
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4ed6cc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4ed6d2
ret

Function at 0x501d80
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x6ca35c
test edx, edx
jne 0x501d9f
xor eax, eax
jmp 0x501ebd
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x501dbc
push esi
push edx
push eax
call fcn.00501ee0
add esp, 0xc
jmp 0x501ebd
push esi
push edx
push eax
call fcn.005021a0
add esp, 0xc
jmp 0x501ebd
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5c99b0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret

Function at 0x5cce10
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x6d5828
mov eax, esi
mov edx, 8
test al, 1
je 0x5cce2c
shr eax, 1
xor eax, 0xedb88320
jmp 0x5cce2e
shr eax, 1
dec edx
jne 0x5cce1f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5cce18
pop esi
ret

Function at 0x5cce44
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x6d5824], 0
jne 0x5cce6e
call fcn.005cce10
mov dword [esp], 0x6d5824
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x5cce98
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x6d5828]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x5cce74
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x5ead6c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5eade9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.005d78a0
mov eax, dword [ebp - 4]
call fcn.005d7210
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x30]
mov ebx, dword [eax + 0xc]
dec ebx
cmp ebx, 0
jl 0x5eadd0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 4]
mov esi, dword [eax + ebx*4]
mov eax, dword [esi + 4]
cmp eax, dword [ebp - 8]
jne 0x5eadca
mov eax, dword [esi]
mov edx, dword [ebp - 4]
call fcn.0040abf0
je 0x5eadd3
dec ebx
cmp ebx, 0xffffffff
jne 0x5eadad
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eadf0
lea eax, [ebp - 4]
call fcn.0040a1ec
ret

Function at 0x60544c
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
push 0x200
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.0040b278
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x60548c
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.0040b318
jmp 0x605493
mov eax, ebx
call fcn.0040a1c8
add esp, 0x2b4
pop esi
pop ebx
ret

Function at 0x60549c
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6ccf50]
or eax, 0x4001
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.0040b278
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x6054db
mov eax, dword [esp + 4]
jmp 0x6054dd
xor eax, eax
add esp, 0x2b4
pop esi
pop ebx
ret
Function at 0x6054e8
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6ccf58]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x60552c
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x605521
mov eax, dword [esp + 4]
jmp 0x605523
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x60550b
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6ccf58]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x60552c
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x605521
mov eax, dword [esp + 4]
jmp 0x605523
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x60aba4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret