joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b670
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebx + eax*8 + 0x6b], ecx
cmpsb byte [esi], byte es:[edi]
pop ebx
xchg ecx, eax
mov dword [edx], ebp
jnp 0x1001b63c
test byte [ebp + 0x255f01bc], dl
fsubr qword [ecx - 0xe226e61]
xor byte [edx + edx*2 - 0x3af682ae], 0x3b
hlt
insd dword es:[edi], dx
jle 0x1001b6a5
add edi, dword [ebp + 0x14]
nop
mov byte [0x4624e2c4], al
mov dword [edi + 0x1f049d05], esi
pop edi
and eax, dword [edi + 0x70]
cld
inc esi
mov edx, 0x3cb3feba
and eax, 0xc51025a
inc esp
add dword [eax - 0x2a], ebx
mov edi, 0xe64bfa0b
cld
or edi, edx
dec ebx
out 0xfc, al
mov ebx, 0x45872fc9
cld
add al, 0xe1
loope 0x1001b605
loope 0x1001b605
test dh, dh
mov byte gs:[esi + 0x647058e2], ch
xor bl, bh
xchg edi, eax
invalid
sahf
stosd dword es:[edi], eax
stc
inc ecx
adc byte [edx + 0x6069c87d], ch
hlt
jge 0x1001b663
imul esp, dword [eax - 0xc], 0x887e9922
xchg esi, eax
lea ecx, [eax - 0x19f27af0]
mov esi, 0x14be1ad8
inc ebp
fld qword [eax - 0x50f33b95]
adc byte [ebp - 0x274119f3], al
sbb bh, byte [esi - 0x7f22baec]
imul eax, esp, 0xc
scasd eax, dword es:[edi]
loopne 0x1001b699
out dx, al
or eax, 0x4b82894e
ja 0x1001b693
invalid

Function at 0x1001bb60
Capabilities:
Encode data using xor

Disassembly:
pop ds
xor byte [ebx + 0x6f], ch
invalid
js 0x1001ba83
sar byte [ecx - 0x10], 1
mov al, byte [0xd3986b25]
xchg esp, eax
pop ss
mov al, byte [0xfc4fbb4b]
xchg ecx, eax
invalid
adc eax, 0x3a197ae1
call 0xf5d30045
and byte [edx - 0x5e17e70e], dh
fbld tbyte [ebp + 5]
fiadd dword [ebx]
sbb al, 0xd0
scasb al, byte es:[edi]
cmc
xchg ebx, eax
loope 0x1001bb86
jp 0x1001bb2e
jnp 0x1001bae5
add bl, byte [edi]
sbb al, 0x1b
push eax
out dx, al
jns 0x1001baf1
xor eax, 0x7f525803
sbb edi, esp
pushfd
adc dl, al
jnp 0x1001bb45
sbb dh, byte [eax]
cmp byte [ecx - 0x6386e188], al
mov edx, 0xb231b2fd
jnp 0x1001bb76
or word [edi - 0x174208d8], bp
sbb edi, dword [eax + 0x41]
mov ebp, 0x41781be8
add eax, eax
cwde
js 0x1001bb82
inc edi
dec ecx
adc cl, byte [ecx + ebx - 0x3d95bf69]
xchg edi, eax
inc eax
push 0xffffffffffffffc2
xor eax, dword [edi + 0x5e]
mov eax, dword [0xdcfda0cd]
mov dh, 5
push edx
outsd dx, dword [esi]
and ch, byte [eax]
std
or dword [ebp - 0x3c5acf4c], eax
push esi
in eax, 0xd0
pop edi
inc edi
or byte [ecx - 0xd], dl
sub edi, dword [eax]
or bh, dh
push eax
sbb dh, 0xe4
js 0x1001bbe5
sbb ch, byte [edx + 0x12ba3237]
movsb byte es:[edi], byte [esi]
xchg edi, eax
pop eax
invalid
cmp eax, 0x9f937742
sub eax, esp
notrack jmp 0x8bf792fc
or al, 0x37
cmpsd dword [esi], dword es:[edi]
pop ebx
or eax, 0x8dd1c6fc
lea edi, [edi - 0x2ff89c7a]
mov edi, 0xd0076386
loope 0x1001bbc5
xor byte [ecx], al
inc edi
dec esi
scasb al, byte es:[edi]
fsubr qword [edi + 0x199766da]
dec edx
ror byte [eax + ebx*2 - 0x68], 0xaa
cwde
push 0x14cf0e1a
pop ecx
sal byte [ecx], cl
jge 0x1001bbef
inc edx
retf 0x66a0
Function at 0x1001e430
Capabilities:
Encode data using xor

Disassembly:
inc ebx
push esp
neg byte [edx - 0x27]
pop esi
dec edi
and byte [eax + 0x138df4ba], bh
mov edi, 0xfd315add
invalid
xor byte [ebx - 0x61], dl
das
inc esi
test bl, al
invalid
mov dword [0xbb4020da], eax
add byte [ebp + 0x36], ch
adc al, 0xbc
lds edi, [eax + eax*8]
jo 0x1001e4ad
js 0x1001e3ce
inc ecx
push edi
cwde
in al, dx
mov ebx, 0x889f5f58
adc dword [eax - 0x68], 0xfffffff4
scasd eax, dword es:[edi]
adc al, 0xea
adc eax, 0x15fa1bf2
imul esi, dword [ecx], 0x48256019
pop esp
pop esi
leave
test al, 0x31
mov al, 0x45
mov dh, byte [ebx - 0x2e11aa9a]
cld
loopne 0x1001e498
sub al, 0x47
inc edi
fnstcw word [edx]
fdivr dword [eax]
les eax, [eax + 0x3a]
inc esi
aam 0x8b
sal dword [edx + edx + 6], 1
fisttp dword [ebp - 0x67c3d84]
jo 0x1001e4c9
aad 0x28
add edi, edi
sbb dword [esi - 0x3c2f0c88], esi
out 0x49, al
jne 0x1001e415
retf 0x4e04
jae 0x1001e43f
adc dh, ch
mov dword [0x72fb4e76], eax
push eax
pop es
push ds
push 0x6b6adf52
dec edx
pushal
aas
push edi
movups xmm1, xmm2
cvttps2pi mm4, qword [ebp + 0x5bda7b2a]
mov ch, 0x70
add byte [esi], al
mov eax, 0x5f465a8c
inc esi
pop edi
jl 0x1001e51c
inc edx
mov esi, 0x1b0cbeb3
push eax
fdivrp st(0)
invalid
out 0x3e, al
mov word [eax], cs
push eax
loope 0x1001e46b
mov dh, byte [edx]
cmp al, byte [ebx - 0x49b1d75]
je 0x1001e4be
popal
dec eax
adc edx, dword [ebp + 0x47688738]
invalid
mov ch, 0x54
mov cl, 0x9c
ffreep st(4)
stosd dword es:[edi], eax
inc esi
lea esi, [ebx + 0x40]
jb 0x1001e4d6
imul ebp, dword [edi + esi*4 - 8], 0xffffffd0
loopne 0x1001e4e9
push eax
and byte [eax - 0x72], 0xf5
iretd
or edx, dword [ecx - 3]
xlatb
adc dh, byte [edx]
xlatb
mov byte gs:[ebp - 0x52c04b1], bh
push edx
jo 0x1001e50c
dec ebp
jo 0x1001e59e
xlatb
fmul qword [ecx + 0x4a]
adc cl, bh
sub byte [edx - 0x717ed758], cl
xchg esi, eax
div byte [ebx + eax*4 - 0x57]
push ss
das
fcomp st(1)
jno 0x1001e4fa
and al, 0x62
dec esi
xor eax, 0x1202f4b7
invalid
in al, dx
out dx, al
mov esi, ds
fsincos
leave
invalid

Function at 0x10022b70
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
xor dword [esi], ebp
adc edi, dword [edi + 0x6c35dcb8]
add eax, 0xd497c5d7
add byte [ebx], ah
outsd dx, dword [esi]
sub al, 0x78
push es
xchg ecx, eax
mov eax, dword [0xb2b20321]
loop 0x10022b8d
dec esi
adc al, 0xd1
and esi, dword [esi + ebp*4 + 0x643e155d]
cmp dword [edi + 0x75165b50], ecx
ja 0x10022b9e
push eax
pop ebx
push ss
jne 0x10022c14
add byte [eax], bl
xor dword [edi], ebx
sbb byte [ecx], dh
pop ds
stosb byte es:[edi], al
daa
sub ebp, esi
jne 0x10022bb6
lodsb al, byte [esi]
and edx, dword [ebp + 0x32]
cmp dword [ebx + 0x6ea05a10], ecx
pop ebp
jo 0x10022b98
sbb byte [eax + 0x36], 0x5b
pop ebx
test eax, 0x3b616243
mov byte [0x78716929], al
or eax, 0x75fce5c5
mov ebp, 0x818d748e
Function at 0x10098d50
Capabilities:
Encode data using xor

Disassembly:
adc al, al
lcall 0xa8a2, 0xeb2728
invalid
rol byte [eax - 0xe224f5b], 0x46
and cl, byte [eax]
pop eax
mov ebx, 0xc85954fc
pushfd
mov byte [0x80a42a34], al
cmp bl, bl
fcomp dword [edx - 0x16]
push edx
jno 0x10098d09
inc esp
adc byte [ecx], bl
stosb byte es:[edi], al
dec eax
mov edx, 0xfae40bbe
fmul st(0), st(0)
popal
add dl, dh
jp 0x10098df2
adc dword cs:[eax], eax
pushfd
add dword [edi - 0x64b6cf44], eax
mov byte [0x853f4069], al
and dword [ebp + 0x20], 0x22f132a2
mov al, 0x4f
sub eax, 0xbe0f0a18
and al, 0xc8
lea edx, [edi + ebp]
pop edx
out dx, eax

Function at 0x1009b8f0
Capabilities:
Encode data using xor

Disassembly:
push eax
jnp 0x1009b951
jp 0x1009b925
xchg esp, eax
or ah, byte [edi + 0x60]
sub al, 0x9c
fsub st(5), st(0)
xchg esi, ebx
xor al, dl
push es
mov ebx, 0x3739d08b
or byte [esi + 0xe3b5f4], dh
and eax, 0xbb4ca5fa
mov byte [0xa9e39ceb], al
cld
pop esi
ljmp 0x8a50
mov ch, 0x55
xbegin 0xc03c9ca9
aam 0xf6
mov byte [ebp - 0xd], bh
dec esi
push ebp
xchg esp, eax
jl 0x1009b948
sar byte [bx + di], 0x2c
pushfd
test al, 0x74
inc ebx
sti
mov al, byte [0xe0fbac07]
pop ds
xchg dword [ecx + 0x2667482], esi
mov byte [0x3622efec], ch
xor byte [esi + 2], 0x88
sub eax, 0x3622efec
jae 0x1009b993
jae 0x1009b993
add byte [edi + 0x4ea84a00], bl
hlt
cmpsb byte [esi], byte es:[edi]
and al, 7
nop
xchg ebp, eax
das
inc edx
cld
test al, 0xb0
add al, 0x4d
pop ecx
popfd
pop eax
or ah, byte [ebx]
test al, 0xd
mov byte [0x9b3cfb20], al
and ebp, dword [eax - 0x4df5df3]
cmp al, 0x9b
xor edx, dword [eax]
les esp, [eax + 0x21]
clc
aas
jb 0x1009b980
ret
Function at 0x1009c7c0
Capabilities:
Check for software breakpoints

Disassembly:
dec edx
movsb byte es:[edi], byte [esi]
ror byte [edi + 0x4d], 0xae
cmp edx, dword [ebp + 0x48]
sal dh, cl
inc eax
fsub st(5), st(0)
xchg ebx, eax
sahf
jae 0x1009c755
call 0xab2a6add
mov edi, 0xa88227a1
invalid
test al, 0x8f
int3
mov byte [esi - 0x48], dl
mov edi, 0x1a1cf392
jg 0x1009c761
mov eax, 0xa0d86f11
cmp dword [edi], edi
add bl, byte [ecx - 0x6d]
fsub dword [eax + 0x59023f39]
xchg ebx, eax
bound edx, qword fs:[ecx]
xchg esp, eax
jno 0x1009c7fa
adc dword [edx + esi*2 - 0x32d0072c], esp
cmp al, 0xcd
pop ds
movsb byte es:[edi], byte [esi]
jb 0x1009c770
clc
das
int 0x3c
int 0x1f
dec esi
pop esi
sub al, 0xc2
ret
xchg al, bl
salc
pushfd
sahf
sub eax, dword [edi]
cmp dword [eax - 0x6ceca96d], ebx
js 0x1009c799
fsubr dword [ebx + ecx*4 + 0x58ad22ee]
in eax, 0xce
jns 0x1009c77e
push eax
into
pushfd
mov bh, 6
leave
jno 0x1009c78b
and al, cl
mov esp, 0x6b98389c
or bh, byte [ecx]
cmp eax, 0x903b5c7f
bound edi, qword [edx + 0x3d]
fstp qword [esi + 0x64]
invalid
and bh, ah
mov eax, 0x828ccf5a
pop ecx
add cl, byte [edi + 0x12f393bc]
mov ebp, 0xbed8e878
mov ebp, edx
and bh, byte [edi + 0x79d8f558]
stosd dword es:[edi], eax
push eax
fcomp dword [esi - 0x6d8e2afa]
and ah, dl
mov esp, 0x9e980db1
or cl, byte [edi]
cmp eax, 0x80a2c056
inc esp
out 0x5e, eax
shl dword [esp + ebx*4 - 0x72], 0x13
push 0xa0f513a6
mov dh, 0x13
jecxz 0x1009c88e
mov fs, word [edx]
int1
sbb eax, 0x93817d02
jp 0x1009c85a
div byte [ebp - 0x7a]
inc esi
int1
adc esp, dword [eax]
and dword [esp + edi*4 + 0x53dc9a32], edi
nop
pop edx
jp 0x1009c865
or bl, ch
fstp qword [edi + 0x44]
pop edi
inc esp
enter 0x641e, 0xffffffffffffffa4
dec edi
fst qword [eax + ecx*4 - 0x39]
mov bh, al
adc dh, dl
cld
and dh, ah
mov eax, 0x425fbae0
in al, 6
adc eax, 0x195fc074
jns 0x1009c8ae
rcl byte [ebx]
int1
mov al, byte [0x918b463e]
jb 0x1009c85c
sahf
mov esp, dword [edx]
and ebx, dword [eax + 0x79f73658]
push esp
push eax
neg byte [eax + edi*4 - 0x538ec4fa]
and byte [eax], ch
mov esp, 0x2c984294
or dl, byte [edx + edi + 0x19]
add bh, cl
adc byte [eax], ah
mov ebx, dword [edi + 0x1c]
xchg edx, eax
aam 0x4f
sub al, 0x9c
rol byte [esi], 0xf2
jno 0x1009c8e2
push es
bnd jno 0x1009c8e2
and dword [ebp - 0x670bdf44], ecx
hlt
invalid
and byte [ecx - 0x44], dl
or dword [edx - 0x65], ebp
loop 0x1009c8f4
jp 0x1009c928
jecxz 0x1009c93b
invalid
dec ecx

Function at 0x104481f1
Capabilities:
Encode data using xor

Disassembly:
mov edi, eax
mov esi, edx
mov eax, 0x41363233
xor al, byte [esi]
call fcn.10448228
mov ebx, eax
xor ah, byte [esi]
call fcn.10448228
shr ecx, 2
mov edx, ecx
xor dword [edi], eax
mov cl, al
add edi, 4
rol ebx, cl
xor eax, ebx
mov cl, bh
ror eax, cl
add ebx, eax
dec edx
jne 0x1044820f
ret

Function at 0x10448228
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edx
xor edx, edx
dec esi
inc esi
xor ah, byte [esi]
xor al, dl
add eax, 0x6e203cc5
add eax, 0x21424a6
mov cl, al
ror eax, cl
xor eax, 0x8372a5a7
dec dx
jne 0x10448231
cmp byte [esi], 0
jne 0x1044822e
pop edx
pop esi
pop ecx
ret
Function at 0x10448279
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
add edx, 0x89421025
bswap edx
mov eax, dword [esi]
sub eax, edx
xor eax, ebx
mov ebx, dword [esi]
mov dword [edi], eax
add esi, 4
add edi, 4
dec ecx
jne 0x1044828d
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x1044a4bf
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
pushal
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [edi]
mov ecx, dword [edi + 4]
imul eax, dword [ebp + 0x10], 0x9e3779b9
cmp dword [ebp + 0x10], 0
jbe 0x1044a51f
mov edx, ebx
shl edx, 4
sub ecx, edx
mov edx, dword [esi + 8]
xor edx, ebx
sub ecx, edx
mov edx, ebx
shr edx, 5
xor edx, eax
sub ecx, edx
sub ecx, dword [esi + 0xc]
mov edx, ecx
shl edx, 4
sub ebx, edx
mov edx, dword [esi]
xor edx, ecx
sub ebx, edx
mov edx, ecx
shr edx, 5
xor edx, eax
sub ebx, edx
sub ebx, dword [esi + 4]
sub eax, 0x9e3779b9
dec dword [ebp + 0x10]
jmp 0x1044a4d5
mov dword [edi], ebx
mov dword [edi + 4], ecx
popal
leave
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4073b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72c
mov eax, dword [0x6d28d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x728], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x724], ebx
push esi
mov esi, ecx
test eax, eax
jne 0x4073f1
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00597574
mov esp, ebp
pop ebp
ret 0x10
test ebx, ebx
je 0x4073dd
push eax
push 1
lea eax, [ebp - 0x71d]
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
push 0x200
lea eax, [ebp - 0x604]
push 0
push eax
call sub.MSVCR120.dll_memset
lea edx, [esi + 0x10]
add esp, 0x1c
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407425
push edi
sub ecx, esi
lea eax, [ebp - 0x604]
push ecx
push edx
push eax
call sub.MSVCR120.dll_memcpy
push 0x100
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x71c]
push eax
call fcn.004083d0
xor esi, esi
add esp, 0x18
mov dword [ebp - 0x72c], esi
cmp dword [ebp + 0x10], esi
jle 0x40759b
mov edi, ebx
jmp 0x407470
push dword [ebp - 0x728]
lea eax, [ebp - 0x404]
push 0x10
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
add esp, 0x10
cmp eax, 0x10
jne 0x4075e0
lea eax, [ebp - 0x404]
push eax
push eax
lea eax, [ebp - 0x71c]
push 0
push eax
call fcn.004076e0
lea ecx, [esi + 0xf]
add esp, 0x10
lea edx, [ebp - 0x3f5]
xor eax, eax
add ecx, ebx
cmp edi, edx
ja 0x4074c7
lea edx, [ebp - 0x404]
cmp ecx, edx
jae 0x40751e
movdqu xmm0, xmmword [ebp - 0x404]
mov eax, 0x10
xorps xmm1, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm2, xmmword [edi]
paddb xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
paddb xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
paddb xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 2
paddb xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 1
paddb xmm2, xmm0
movd ecx, xmm2
add byte [ebp + 0x14], cl
xor bl, bl
xor dl, dl
cmp eax, 0x10
jge 0x407580
mov ecx, 0x10
sub ecx, eax
cmp ecx, 2
jl 0x407554
mov cl, byte [ebp + eax - 0x404]
mov byte [edi + eax], cl
add bl, cl
mov cl, byte [ebp + eax - 0x403]
mov byte [edi + eax + 1], cl
add dl, cl
add eax, 2
cmp eax, 0xf
jl 0x407533
cmp eax, 0x10
jge 0x407576
mov cl, byte [ebp + eax - 0x404]
add eax, dword [ebp - 0x724]
mov esi, dword [ebp - 0x72c]
mov byte [eax + esi], cl
mov eax, dword [ebp + 0x14]
add al, cl
jmp 0x407579
mov eax, dword [ebp + 0x14]
add dl, bl
add al, dl
mov dword [ebp + 0x14], eax
mov ebx, dword [ebp - 0x724]
add esi, 0x10
add edi, 0x10
mov dword [ebp - 0x72c], esi
cmp esi, dword [ebp + 0x10]
jl 0x407470
push dword [ebp - 0x728]
lea eax, [ebp - 0x71e]
push 1
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
mov al, byte [ebp - 0x71d]
add esp, 0x10
cmp al, byte [ebp - 0x71e]
jne 0x4075e0
cmp al, byte [ebp + 0x14]
jne 0x4075e0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00597574
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00597574
mov esp, ebp
pop ebp
ret 0x10
Function at 0x408170
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x6d28d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edx, 1
lea ecx, [ecx]
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movsx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor edx, ecx
and edx, 0xff
cmp esi, 0x100
jl 0x408190
mov esi, 1
mov edx, 0x6da1b0
lea esp, [esp]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movsx ecx, al
neg ecx
sbb ecx, ecx
add esi, esi
and ecx, 0x1b
add edx, 4
xor esi, ecx
and esi, 0xff
cmp edx, 0x6da1d8
jl 0x4081d0
mov eax, 1
mov byte [0x6d7fb0], 0x63
mov byte [0x6d9113], 0
mov dword [ebp - 0x808], eax
mov edi, edi
mov ecx, dword [ebp + eax*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
and ecx, 0xff
mov edx, ecx
xor ebx, ecx
sar edx, 7
lea eax, [ecx + ecx]
or edx, eax
and edx, 0xff
mov esi, edx
xor ebx, edx
sar esi, 7
lea eax, [edx + edx]
or esi, eax
and esi, 0xff
mov ecx, esi
sar ecx, 7
lea eax, [esi + esi]
or ecx, eax
mov eax, dword [ebp - 0x808]
xor ecx, 0x63
and ecx, 0xff
xor ecx, esi
xor ebx, ecx
mov byte [eax + 0x6d7fb0], bl
mov byte [ebx + 0x6d90b0], al
inc eax
mov dword [ebp - 0x808], eax
cmp eax, 0x100
jl 0x408210
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 0x80c], ebx
lea esp, [esp]
movzx edx, byte [esi + 0x6d7fb0]
mov eax, edx
and al, 0x80
movsx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
and ecx, 0xff
mov eax, ecx
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, ecx
movzx ecx, byte [esi + 0x6d90b0]
mov dword [esi*4 + 0x6d80b0], eax
rol eax, 8
mov dword [esi*4 + 0x6d84b0], eax
rol eax, 8
mov dword [esi*4 + 0x6d88b0], eax
rol eax, 8
mov dword [esi*4 + 0x6d8cb0], eax
test ecx, ecx
je 0x408363
mov ecx, dword [ebp + ecx*4 - 0x404]
mov eax, dword [ebp - 0x3cc]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e0]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d0]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x80c]
mov eax, dword [ebp + edx*4 - 0x804]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x3d8]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x40836f
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x808], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 0x808]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x6d91b0], eax
rol eax, 8
mov dword [esi*4 + 0x6d95b0], eax
rol eax, 8
mov dword [esi*4 + 0x6d99b0], eax
rol eax, 8
mov dword [esi*4 + 0x6d9db0], eax
inc esi
cmp esi, 0x100
jl 0x4082a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00597574
mov esp, ebp
pop ebp
ret
Function at 0x4083d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x6d28d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, ecx
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
sub eax, 0x80
je 0x408414
sub eax, 0x40
je 0x40840c
sub eax, 0x40
jne 0x4085c0
mov dword [edi], 0xe
jmp 0x40841a
mov dword [edi], 0xc
jmp 0x40841a
mov dword [edi], 0xa
push esi
push ecx
push edx
lea eax, [ebp - 0x11c]
lea esi, [edi + 8]
push eax
mov dword [edi + 4], esi
call fcn.004085d0
mov eax, dword [ebp - 0x11c]
add esp, 0xc
shl eax, 4
add eax, dword [ebp - 0x118]
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 0xc]
sub eax, 0x10
mov dword [esi + 0xc], ecx
add esi, 0x10
mov edi, dword [edi]
dec edi
test edi, edi
jle 0x4085a9
jmp 0x408470
movzx ecx, byte [eax + 3]
dec edi
movzx edx, byte [ecx + 0x6d7fb0]
movzx ecx, byte [eax + 2]
mov edx, dword [edx*4 + 0x6d9db0]
movzx ecx, byte [ecx + 0x6d7fb0]
xor edx, dword [ecx*4 + 0x6d99b0]
movzx ecx, byte [eax + 1]
movzx ecx, byte [ecx + 0x6d7fb0]
xor edx, dword [ecx*4 + 0x6d95b0]
movzx ecx, byte [eax]
movzx ecx, byte [ecx + 0x6d7fb0]
xor edx, dword [ecx*4 + 0x6d91b0]
mov dword [esi], edx
movzx ecx, byte [eax + 4]
movzx edx, byte [ecx + 0x6d7fb0]
movzx ecx, byte [eax + 7]
mov edx, dword [edx*4 + 0x6d91b0]
movzx ecx, byte [ecx + 0x6d7fb0]
xor edx, dword [ecx*4 + 0x6d9db0]
movzx ecx, byte [eax + 6]
movzx ecx, byte [ecx + 0x6d7fb0]
xor edx, dword [ecx*4 + 0x6d99b0]
movzx ecx, byte [eax + 5]
movzx ecx, byte [ecx + 0x6d7fb0]
xor edx, dword [ecx*4 + 0x6d95b0]
mov dword [esi + 4], edx
movzx ecx, byte [eax + 8]
movzx edx, byte [ecx + 0x6d7fb0]
movzx ecx, byte [eax + 0xb]
mov edx, dword [edx*4 + 0x6d91b0]
movzx ecx, byte [ecx + 0x6d7fb0]
xor edx, dword [ecx*4 + 0x6d9db0]
movzx ecx, byte [eax + 0xa]
movzx ecx, byte [ecx + 0x6d7fb0]
xor edx, dword [ecx*4 + 0x6d99b0]
movzx ecx, byte [eax + 9]
movzx ecx, byte [ecx + 0x6d7fb0]
xor edx, dword [ecx*4 + 0x6d95b0]
mov dword [esi + 8], edx
movzx ecx, byte [eax + 0xc]
movzx edx, byte [ecx + 0x6d7fb0]
movzx ecx, byte [eax + 0xf]
mov edx, dword [edx*4 + 0x6d91b0]
movzx ecx, byte [ecx + 0x6d7fb0]
xor edx, dword [ecx*4 + 0x6d9db0]
movzx ecx, byte [eax + 0xe]
movzx ecx, byte [ecx + 0x6d7fb0]
xor edx, dword [ecx*4 + 0x6d99b0]
movzx ecx, byte [eax + 0xd]
sub eax, 0x10
movzx ecx, byte [ecx + 0x6d7fb0]
xor edx, dword [ecx*4 + 0x6d95b0]
mov dword [esi + 0xc], edx
add esi, 0x10
test edi, edi
jg 0x408470
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [esi + 0xc], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00597574
mov esp, ebp
pop ebp
ret
Function at 0x409a10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x598758
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6d28d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x409b3d
cmp byte [edi + 0x45], 0
je 0x409b3d
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x409a64
xor al, al
jmp 0x409b3f
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x48]
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmp ebx, 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
push esi
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x409ad1
dec eax
je 0x409ad5
sub eax, 2
je 0x409b26
xor bl, bl
jmp 0x409b28
mov byte [edi + 0x45], 0
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp ebx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, ecx
sub esi, eax
je 0x409b08
push dword [edi + 0x50]
cmp ebx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x409acd
cmp byte [edi + 0x45], 0
je 0x409b26
test esi, esi
lea esi, [edi + 0x48]
jne 0x409a97
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00409d00
jmp 0x409a94
mov bl, 1
cmp dword [ebp - 0x14], 0x10
jb 0x409b39
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
jmp 0x409b3f
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00597574
mov esp, ebp
pop ebp
ret