joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473850
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x647f70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0x14], eax
mov eax, dword [0x625270]
push esi
mov dword [ebp - 0xc], eax
mov eax, dword [0x625274]
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
test edi, edi
jne 0x47389f
lea eax, [edi - 0x17]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059df39
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor esi, esi
mov eax, 1
mov ecx, esi
shl eax, cl
test edi, eax
je 0x4738df
add word [ebp - 0xc], si
lea eax, [ebp - 0xc]
push eax
call ebx
cmp eax, 3
jne 0x4738df
push dword [ebp - 0x14]
xor edx, edx
push dword [ebp - 0x10]
push 0
push 0
push ecx
lea ecx, [ebp - 0xc]
call fcn.00473590
add esp, 0x14
test eax, eax
jne 0x4738fb
inc esi
cmp esi, 0x20
jl 0x4738a7
mov eax, 0x17
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059df39
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059df39
mov esp, ebp
pop ebp
ret
Function at 0x474010
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push ebx
mov ebx, edx
push edi
mov edi, 0xc0000004
mov eax, dword [ebx]
test eax, eax
je 0x47402f
push 0
push 0
push eax
push 5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
pop edi
pop ebx
ret
push esi
mov esi, 0x1000
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebx], eax
test eax, eax
je 0x474068
push 0
push esi
push eax
push 5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
test edi, edi
jns 0x47405e
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
add esi, esi
cmp edi, 0xc0000004
je 0x474035
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x4743d0
Capabilities:
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
lea ebx, [esi + 0xc]
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x474433
push esi
push dword [ebp + 8]
lea eax, [edi + 0xc]
mov dword [edi], 0x208
push eax
mov dword [edi + 4], 0x660e
mov dword [edi + 8], esi
call fcn.0059fc20
add esp, 0xc
push dword [ebp + 0x14]
push 0
push 0
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x647f70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x3fc
lea eax, [ebp - 0x404]
mov dword [ebp - 0x408], 0
xorps xmm0, xmm0
lea esi, [ecx + 1]
push 0
push eax
movsd qword [ebp - 0x410], xmm0
call fcn.0059fb90
add esp, 0xc
mov ecx, 0x20
jmp 0x4746c0
movzx eax, byte [esi - 1]
lea esi, [esi + 4]
inc dword [ebp + eax*4 - 0x408]
movzx eax, byte [esi - 4]
inc dword [ebp + eax*4 - 0x408]
movzx eax, byte [esi - 3]
inc dword [ebp + eax*4 - 0x408]
movzx eax, byte [esi - 2]
inc dword [ebp + eax*4 - 0x408]
dec ecx
jne 0x4746c0
xor esi, esi
mov eax, dword [ebp + esi*4 - 0x408]
test eax, eax
je 0x474742
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x625ff0]
mulsd xmm0, qword [0x625fd0]
movsd qword [ebp - 0x418], xmm0
call fcn.005bc560
mulsd xmm0, qword [ebp - 0x418]
addsd xmm0, qword [ebp - 0x410]
movsd qword [ebp - 0x410], xmm0
jmp 0x47474a
movsd xmm0, qword [ebp - 0x410]
inc esi
cmp esi, 0x100
jb 0x4746f4
xorps xmm1, xmm1
ucomisd xmm0, xmm1
lahf
test ah, 0x44
jnp 0x474781
movsd xmm0, qword [0x625fe0]
call fcn.005bc560
movsd xmm1, qword [ebp - 0x410]
divsd xmm1, xmm0
xorpd xmm1, xmmword [0x626000]
mov ecx, dword [ebp - 4]
movapd xmm0, xmm1
xor ecx, ebp
pop esi
call fcn.0059df39
mov esp, ebp
pop ebp
ret

Function at 0x47a49a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0047ddb7
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x47a4d1
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0047a4f2
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x480cfa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x480d3f
call fcn.0047ddb7
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x480d3f
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x480d5b
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0047c286
mov ebx, eax
test edi, edi
je 0x480d59
test esi, esi
je 0x480d59
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c0683
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00485489
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x4c06bf
call fcn.004c08a2
mov dword [esi + 0xc], 1
jmp 0x4c06c4
call fcn.004c08a2
cmp dword [esi], 0
je 0x4c070d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x4c06e7
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00475128
jmp 0x4c06f8
push 0xff
mov ecx, esi
call fcn.00471770
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00473250
jmp 0x4c0731
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x4c0731
push dword [esi]
push dword [ebp - 4]
call fcn.004871a7
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4c07f7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.004c08a2
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4c083f
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00475128
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00473250
jmp 0x4c084a
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004871a7
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4c833f
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00547fad
call fcn.0047de0b
cmp dword [eax + 0x14], 0
jne 0x4c835a
mov ecx, esi
pop esi
jmp fcn.004c7718
pop esi
ret

Function at 0x545407
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.0046fc60
call fcn.0047de0b
cmp dword [eax + 0x14], 0
jne 0x545422
mov ecx, esi
pop esi
jmp fcn.00544cf0
pop esi
ret
Function at 0x5b6558
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x647f70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.005a9313
mov dword [ebp - 0x14], eax
cmp dword [0x655cc0], esi
jne 0x5b664b
push 0x800
push esi
push 0x61eb50
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x5b65d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x5b672b
push esi
push esi
push 0x61eb50
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x5b672b
push 0x61eb68
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5b672b
push eax
call ebx
push 0x61eb74
push edi
mov dword [0x655cc0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x61eb84
push edi
mov dword [0x655cc4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x61eb98
push edi
mov dword [0x655cc8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x655cd0], eax
test eax, eax
je 0x5b6648
push 0x61ebb4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x655ccc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5b6670
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5b6663
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x5b6685
push 4
pop eax
jmp 0x5b672d
cmp dword [ebp - 0x14], esi
je 0x5b6685
push dword [0x655cc0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x5b666a
mov eax, dword [0x655ccc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x5b66e3
cmp dword [0x655cd0], edi
je 0x5b66e3
push eax
call ebx
push dword [0x655cd0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x5b66e3
test eax, eax
je 0x5b66e3
call ecx
test eax, eax
je 0x5b66d8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x5b66d8
test byte [ebp - 8], 1
jne 0x5b66e3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x5b6713
mov eax, dword [0x655cc4]
cmp eax, edi
je 0x5b6710
push eax
call ebx
test eax, eax
je 0x5b6710
call eax
mov esi, eax
test esi, esi
je 0x5b6710
mov eax, dword [0x655cc8]
cmp eax, edi
je 0x5b6710
push eax
call ebx
test eax, eax
je 0x5b6710
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x655cc0]
call ebx
test eax, eax
je 0x5b672b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x5b672d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059df39
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov edx, 1
push ebx
push esi
push edi
xor esi, esi
mov eax, edx
mov dword [ebp + esi*4 - 0x808], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x408], esi
movsx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor edx, ecx
and edx, 0xff
cmp esi, 0x100
jl 0x401013
mov esi, 1
mov edx, 0x40fe30
nop
mov eax, esi
mov dword [edx], esi
and al, 0x80
movsx ecx, al
neg ecx
sbb ecx, ecx
add esi, esi
and ecx, 0x1b
add edx, 4
xor esi, ecx
and esi, 0xff
cmp edx, 0x40fe58
jl 0x401050
mov eax, 1
mov byte [0x410660], 0x63
mov byte [0x40e593], 0
mov dword [ebp - 4], eax
jmp 0x401090
mov ecx, dword [ebp + eax*4 - 0x408]
lea eax, [ebp - 0x40c]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
and ecx, 0xff
mov edx, ecx
xor ebx, ecx
sar edx, 7
lea eax, [ecx + ecx]
or edx, eax
and edx, 0xff
mov esi, edx
xor ebx, edx
sar esi, 7
lea eax, [edx + edx]
or esi, eax
and esi, 0xff
mov ecx, esi
sar ecx, 7
lea eax, [esi + esi]
or ecx, eax
mov eax, dword [ebp - 4]
xor ecx, 0x63
and ecx, 0xff
xor ecx, esi
xor ebx, ecx
mov byte [eax + 0x410660], bl
mov byte [ebx + 0x40e530], al
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x100
jl 0x401090
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 8], ebx
movzx edx, byte [esi + 0x410660]
mov eax, edx
and al, 0x80
movsx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
and ecx, 0xff
mov eax, ecx
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, ecx
movzx ecx, byte [esi + 0x40e530]
mov dword [esi*4 + 0x40e630], eax
rol eax, 8
mov dword [esi*4 + 0x40ea30], eax
rol eax, 8
mov dword [esi*4 + 0x40ee30], eax
rol eax, 8
mov dword [esi*4 + 0x40f230], eax
test ecx, ecx
je 0x4011d0
mov ecx, dword [ebp + ecx*4 - 0x408]
mov eax, dword [ebp - 0x3d0]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e4]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x808]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d4]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x808]
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp + edx*4 - 0x808]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3dc]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x808]
jmp 0x4011d9
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 4]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x40f630], eax
rol eax, 8
mov dword [esi*4 + 0x40fa30], eax
rol eax, 8
mov dword [esi*4 + 0x40fe60], eax
rol eax, 8
mov dword [esi*4 + 0x410260], eax
inc esi
cmp esi, 0x100
jl 0x401113
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4020b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov edi, ecx
push ecx
lea ecx, [ebp - 0x124]
lea esi, [edi + 8]
mov dword [edi], 0xa
mov dword [edi + 4], esi
call fcn.00401240
add esp, 4
test eax, eax
jne 0x402271
mov eax, dword [ebp - 0x124]
shl eax, 4
add eax, dword [ebp - 0x120]
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 0xc]
sub eax, 0x10
mov dword [esi + 0xc], ecx
add esi, 0x10
mov edi, dword [edi]
dec edi
test edi, edi
jle 0x402259
movzx ecx, byte [eax + 3]
dec edi
movzx edx, byte [ecx + 0x410660]
movzx ecx, byte [eax + 2]
mov edx, dword [edx*4 + 0x410260]
movzx ecx, byte [ecx + 0x410660]
xor edx, dword [ecx*4 + 0x40fe60]
movzx ecx, byte [eax + 1]
movzx ecx, byte [ecx + 0x410660]
xor edx, dword [ecx*4 + 0x40fa30]
movzx ecx, byte [eax]
movzx ecx, byte [ecx + 0x410660]
xor edx, dword [ecx*4 + 0x40f630]
mov dword [esi], edx
movzx ecx, byte [eax + 4]
movzx edx, byte [ecx + 0x410660]
movzx ecx, byte [eax + 7]
mov edx, dword [edx*4 + 0x40f630]
movzx ecx, byte [ecx + 0x410660]
xor edx, dword [ecx*4 + 0x410260]
movzx ecx, byte [eax + 6]
movzx ecx, byte [ecx + 0x410660]
xor edx, dword [ecx*4 + 0x40fe60]
movzx ecx, byte [eax + 5]
movzx ecx, byte [ecx + 0x410660]
xor edx, dword [ecx*4 + 0x40fa30]
mov dword [esi + 4], edx
movzx ecx, byte [eax + 8]
movzx edx, byte [ecx + 0x410660]
movzx ecx, byte [eax + 0xb]
mov edx, dword [edx*4 + 0x40f630]
movzx ecx, byte [ecx + 0x410660]
xor edx, dword [ecx*4 + 0x410260]
movzx ecx, byte [eax + 0xa]
movzx ecx, byte [ecx + 0x410660]
xor edx, dword [ecx*4 + 0x40fe60]
movzx ecx, byte [eax + 9]
movzx ecx, byte [ecx + 0x410660]
xor edx, dword [ecx*4 + 0x40fa30]
mov dword [esi + 8], edx
movzx ecx, byte [eax + 0xc]
movzx edx, byte [ecx + 0x410660]
movzx ecx, byte [eax + 0xf]
mov edx, dword [edx*4 + 0x40f630]
movzx ecx, byte [ecx + 0x410660]
xor edx, dword [ecx*4 + 0x410260]
movzx ecx, byte [eax + 0xe]
movzx ecx, byte [ecx + 0x410660]
xor edx, dword [ecx*4 + 0x40fe60]
movzx ecx, byte [eax + 0xd]
sub eax, 0x10
movzx ecx, byte [ecx + 0x410660]
xor edx, dword [ecx*4 + 0x40fa30]
mov dword [esi + 0xc], edx
add esi, 0x10
test edi, edi
jg 0x402120
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [esi + 0xc], eax
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.0040abe5
mov esp, ebp
pop ebp
ret
Function at 0x402d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], ecx
test al, 0xf
je 0x402d4c
mov eax, 0xffffffde
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
test edx, edx
jne 0x402dee
test eax, eax
je 0x402ea3
mov ecx, dword [ebp + 0xc]
dec eax
mov esi, dword [ebp + 0x14]
mov edi, ecx
mov ebx, dword [ebp + 0x10]
sub edi, esi
shr eax, 4
lea edx, [ecx + 0xf]
inc eax
mov dword [ebp - 0xc], edx
mov dword [ebp + 8], eax
lea ebx, [ebx]
mov ecx, dword [ebp - 4]
xor edx, edx
movdqu xmm2, xmmword [ebx]
push esi
push ebx
call fcn.00402290
add esp, 8
cmp esi, dword [ebp - 0xc]
ja 0x402dc0
lea eax, [esi + 0xf]
cmp eax, dword [ebp + 0xc]
jb 0x402dc0
mov ecx, esi
mov edx, 0x10
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
dec edx
jne 0x402da7
mov eax, dword [ebp + 0xc]
jmp 0x402dd3
mov eax, dword [ebp + 0xc]
movdqu xmm0, xmmword [esi]
movdqu xmm1, xmmword [eax]
pxor xmm1, xmm0
movdqu xmmword [esi], xmm1
add esi, 0x10
add ebx, 0x10
sub edi, 0x10
dec dword [ebp + 8]
movdqu xmmword [eax], xmm2
jne 0x402d80
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x402ea3
mov ecx, dword [ebp + 0xc]
lea edx, [eax - 1]
mov edi, dword [ebp + 0x10]
mov ebx, ecx
mov esi, dword [ebp + 0x14]
sub ebx, edi
shr edx, 4
inc edx
mov dword [ebp + 8], ebx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], esi
lea eax, [edi + 0xf]
cmp esi, eax
ja 0x402e21
lea eax, [esi + 0xf]
cmp eax, edi
jae 0x402e2f
lea eax, [ecx + 0xf]
cmp esi, eax
ja 0x402e60
lea eax, [esi + 0xf]
cmp eax, ecx
jb 0x402e60
mov ebx, esi
mov eax, edi
mov esi, dword [ebp + 8]
sub ebx, edi
mov edx, 0x10
lea ecx, [ecx]
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [ebx + eax - 1], cl
dec edx
jne 0x402e40
mov esi, dword [ebp - 8]
mov ebx, dword [ebp + 8]
jmp 0x402e70
movdqu xmm1, xmmword [ecx]
movdqu xmm0, xmmword [edi]
pxor xmm1, xmm0
movdqu xmmword [esi], xmm1
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
push esi
push esi
call fcn.00402290
movdqu xmm0, xmmword [esi]
mov ecx, dword [ebp + 0xc]
sub ebx, 0x10
add esi, 0x10
mov dword [ebp + 8], ebx
add esp, 8
mov dword [ebp - 8], esi
add edi, 0x10
dec dword [ebp - 0xc]
movdqu xmmword [ecx], xmm0
jne 0x402e13
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov esi, edx
push edi
mov edi, dword [ebp + 8]
cmp eax, 0x10
jae 0x403076
mov byte [ebp + eax - 0x14], 0
inc eax
cmp eax, 0x10
jl 0x402f3d
lea eax, [ebp - 0x24]
mov edx, 1
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00402290
add esp, 8
lea ecx, [ebp - 0x24]
test byte [ebp - 0x24], 0x80
mov ebx, 0x40e020
jne 0x402f7a
mov edx, esi
call fcn.00402eb0
jmp 0x402fe1
lea edx, [ebp - 0x14]
call fcn.00402eb0
lea edx, [ebp - 5]
xor ecx, ecx
lea eax, [esi + 0xf]
cmp esi, edx
ja 0x402f95
lea edx, [ebp - 0x14]
cmp eax, edx
jae 0x402fb0
cmp esi, 0x40e02f
ja 0x402fd0
cmp eax, 0x40e020
jb 0x402fd0
jmp 0x402fb0
mov al, byte [ecx + 0x40e020]
xor al, byte [ebp + ecx - 0x14]
mov byte [ecx + esi], al
inc ecx
cmp ecx, 0x10
jl 0x402fb0
jmp 0x402fe1
movdqu xmm1, xmmword [ebx]
movdqu xmm0, xmmword [ebp - 0x14]
pxor xmm1, xmm0
movdqu xmmword [esi], xmm1
test byte [esi], 0x80
mov ecx, esi
jne 0x403000
mov edx, edi
call fcn.00402eb0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040abe5
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x14]
call fcn.00402eb0
lea edx, [ebp - 5]
xor ecx, ecx
lea eax, [edi + 0xf]
cmp edi, edx
ja 0x40301b
lea edx, [ebp - 0x14]
cmp eax, edx
jae 0x403030
cmp edi, 0x40e02f
ja 0x403054
cmp eax, 0x40e020
jb 0x403054
lea ebx, [ebx]
mov al, byte [ecx + 0x40e020]
xor al, byte [ebp + ecx - 0x14]
mov byte [ecx + edi], al
inc ecx
cmp ecx, 0x10
jl 0x403030
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040abe5
mov esp, ebp
pop ebp
ret
movdqu xmm1, xmmword [ebx]
mov ecx, dword [ebp - 4]
movdqu xmm0, xmmword [ebp - 0x14]
xor ecx, ebp
pxor xmm1, xmm0
movdqu xmmword [edi], xmm1
pop edi
pop esi
pop ebx
call fcn.0040abe5
mov esp, ebp
pop ebp
ret
call fcn.0040ad2c
int3
Function at 0x403080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x34], ecx
mov esi, edx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x30], eax
push edi
push ecx
lea edx, [ebp - 0x2c]
mov ecx, eax
call fcn.00402f20
lea eax, [esi + 0xf]
add esp, 4
cdq
and edx, 0xf
lea edi, [edx + eax]
sar edi, 4
test edi, edi
jne 0x4030f1
mov edi, 1
and esi, 0x8000000f
jns 0x4030d4
dec esi
or esi, 0xfffffff0
inc esi
mov ebx, dword [ebp + 8]
xor ecx, ecx
lea esp, [esp]
cmp ecx, esi
jge 0x403153
mov eax, edi
shl eax, 4
add eax, ecx
mov al, byte [eax + ebx - 0x10]
jmp 0x40315a
mov eax, esi
and eax, 0x8000000f
jns 0x4030ff
dec eax
or eax, 0xfffffff0
inc eax
jne 0x4030c7
mov ebx, dword [ebp + 8]
mov edx, edi
shl edx, 4
xor ecx, ecx
add edx, ebx
lea ecx, [ecx]
movzx eax, byte [edx + ecx - 0x10]
xor al, byte [ebp + ecx - 0x2c]
mov byte [ebp + ecx - 0x18], al
movzx eax, byte [edx + ecx - 0xf]
xor al, byte [ebp + ecx - 0x2b]
mov byte [ebp + ecx - 0x17], al
movzx eax, byte [edx + ecx - 0xe]
xor al, byte [ebp + ecx - 0x2a]
mov byte [ebp + ecx - 0x16], al
movzx eax, byte [edx + ecx - 0xd]
xor al, byte [ebp + ecx - 0x29]
mov byte [ebp + ecx - 0x15], al
add ecx, 4
cmp ecx, 0x10
jl 0x403110
movdqu xmm1, xmmword [ebp - 0x18]
jmp 0x403180
setne al
dec al
and al, 0x80
mov byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 0x10
jl 0x4030e0
movdqu xmm1, xmmword [ebp - 0x2c]
movdqu xmm0, xmmword [ebp - 0x18]
pxor xmm1, xmm0
jmp 0x403180
xor eax, eax
cmp eax, 0x10
jae 0x403242
mov byte [ebp + eax - 0x18], 0
inc eax
cmp eax, 0x10
jl 0x403185
dec edi
test edi, edi
jle 0x4031fd
lea esi, [ebx + 1]
mov ebx, dword [ebp - 0x30]
xor eax, eax
movzx ecx, byte [esi + eax - 1]
xor cl, byte [ebp + eax - 0x18]
mov byte [ebp + eax - 0x2c], cl
movzx ecx, byte [esi + eax]
xor cl, byte [ebp + eax - 0x17]
mov byte [ebp + eax - 0x2b], cl
movzx ecx, byte [esi + eax + 1]
xor cl, byte [ebp + eax - 0x16]
mov byte [ebp + eax - 0x2a], cl
movzx ecx, byte [esi + eax + 2]
xor cl, byte [ebp + eax - 0x15]
mov byte [ebp + eax - 0x29], cl
add eax, 4
cmp eax, 0x10
jl 0x4031a3
lea eax, [ebp - 0x18]
mov edx, 1
push eax
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.00402290
add esp, 8
add esi, 0x10
dec edi
jne 0x4031a1
jmp 0x403200
mov ebx, dword [ebp - 0x30]
movdqu xmm0, xmmword [ebp - 0x18]
lea eax, [ebp - 0x18]
mov edx, 1
push eax
lea eax, [ebp - 0x2c]
pxor xmm1, xmm0
push eax
mov ecx, ebx
movdqu xmmword [ebp - 0x2c], xmm1
call fcn.00402290
mov eax, dword [ebp - 0x34]
add esp, 8
movdqu xmm0, xmmword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
pop esi
movdqu xmmword [eax], xmm0
pop ebx
call fcn.0040abe5
mov esp, ebp
pop ebp
ret
call fcn.0040ad2c
int3