joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b1b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x47], 0
je 0x40b344
movaps xmm5, xmmword [0x48f610]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [0x48f640]
mov edx, 0x7e
movups xmm4, xmmword [0x48f6d0]
mov dword [ebp - 8], ecx
sub edx, ebx
push esi
mov ecx, 0x7c
mov dword [ebp - 4], 0x77
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0x7b
sub edi, ebx
mov esi, 0x7d
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0x73
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x40
jb 0x40b224
mov ebx, dword [ebp - 0x20]
pop edi
pop esi
cmp eax, 0x46
jae 0x40b340
lea edx, [ebx + eax]
lea ecx, [eax + 0x77]
inc eax
xor byte [edx], cl
cmp eax, 0x46
jb 0x40b332
mov byte [ebx + 0x47], 0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cfad
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x496400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 7], 0
je 0x40b3a2
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx + 0x77]
inc edx
xor byte [ecx], al
cmp edx, 6
jb 0x40b390
mov byte [esi + 7], 0
push ecx
lea eax, [esi + 6]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00416550
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x40b3c2
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.00418ee0
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x40b43b
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b431
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40b431
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047b1a1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40b530
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 9], 0
je 0x40b5a9
movups xmm4, xmmword [0x48f6d0]
mov esi, 0x7a
push ebx
lea ebx, [esi - 0x78]
nop
lea eax, [esi - 1]
movd xmm2, esi
lea edx, [esi - 3]
movd xmm0, eax
movd xmm3, edx
lea ecx, [esi - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + esi - 0x7a]
punpcklbw xmm0, xmm0
movd xmm1, ecx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + esi - 0x7a], xmm3
add esi, 4
sub ebx, 1
jne 0x40b550
pop ebx
mov byte [edi + 9], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edi + 8]
push eax
push edi
call fcn.00416550
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40b5d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cfad
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x496400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0xa], 0
je 0x40b622
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx + 0x77]
inc edx
xor byte [ecx], al
cmp edx, 9
jb 0x40b610
mov byte [esi + 0xa], 0
push ecx
lea eax, [esi + 9]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00416550
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x40b642
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.00418ee0
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x40b6bb
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b6b1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40b6b1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047b1a1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b6d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x32], 0
je 0x40b864
movaps xmm5, xmmword [0x48f610]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [0x48f640]
mov edx, 0x7e
movups xmm4, xmmword [0x48f6d0]
mov dword [ebp - 8], ecx
sub edx, ebx
push esi
mov ecx, 0x7c
mov dword [ebp - 4], 0x77
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0x7b
sub edi, ebx
mov esi, 0x7d
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0x73
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x30
jb 0x40b744
mov ebx, dword [ebp - 0x20]
pop edi
pop esi
cmp eax, 0x31
jae 0x40b860
lea edx, [ebx + eax]
lea ecx, [eax + 0x77]
inc eax
xor byte [edx], cl
cmp eax, 0x31
jb 0x40b852
mov byte [ebx + 0x32], 0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x10], 0
je 0x40b9ea
movups xmm4, xmmword [0x48f6d0]
push ebx
mov ebx, 0x7a
lea eax, [ebx - 0x6e]
nop
lea ecx, [ebx - 1]
movd xmm2, ebx
lea esi, [ebx - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [ebx - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + ebx - 0x7a]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + ebx - 0x7a], xmm3
add ebx, 4
cmp ebx, 0x86
jb 0x40b980
pop ebx
lea edx, [edi + eax]
lea ecx, [eax + 0x77]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x40b9d8
mov byte [edi + 0x10], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edi + 0xf]
push eax
push edi
call fcn.00416550
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40ba10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x44], 0
je 0x40bba4
movaps xmm5, xmmword [0x48f610]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [0x48f640]
mov edx, 0x7e
movups xmm4, xmmword [0x48f6d0]
mov dword [ebp - 8], ecx
sub edx, ebx
push esi
mov ecx, 0x7c
mov dword [ebp - 4], 0x77
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0x7b
sub edi, ebx
mov esi, 0x7d
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0x73
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x40
jb 0x40ba84
mov ebx, dword [ebp - 0x20]
pop edi
pop esi
cmp eax, 0x43
jae 0x40bba0
lea edx, [ebx + eax]
lea ecx, [eax + 0x77]
inc eax
xor byte [edx], cl
cmp eax, 0x43
jb 0x40bb92
mov byte [ebx + 0x44], 0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bbb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x136], 0
je 0x40bd59
movaps xmm5, xmmword [0x48f610]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [0x48f640]
mov edx, 0x7e
movups xmm4, xmmword [0x48f6d0]
mov dword [ebp - 8], ecx
sub edx, ebx
push esi
mov ecx, 0x7c
mov dword [ebp - 4], 0x77
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0x7b
sub edi, ebx
mov esi, 0x7d
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0x73
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
nop word [eax + eax]
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x130
jb 0x40bc30
mov ebx, dword [ebp - 0x20]
pop edi
pop esi
cmp eax, 0x135
jae 0x40bd52
lea edx, [ebx + eax]
lea ecx, [eax + 0x77]
inc eax
xor byte [edx], cl
cmp eax, 0x135
jb 0x40bd42
mov byte [ebx + 0x136], 0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d0b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d1a5
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x496400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
cmp byte [edi + 0xb], 0
je 0x40d102
xor edx, edx
nop dword [eax]
lea ecx, [edi + edx]
lea eax, [edx + 0x77]
inc edx
xor byte [ecx], al
cmp edx, 0xa
jb 0x40d0f0
mov byte [edi + 0xb], 0
push ecx
lea eax, [edi + 0xa]
push eax
push edi
lea ecx, [ebp - 0x44]
call fcn.00416550
mov dword [ebp - 4], 0
cmp byte [esi + 0xb], 0
je 0x40d132
xor edx, edx
nop
lea ecx, [esi + edx]
lea eax, [edx + 0x77]
inc edx
xor byte [ecx], al
cmp edx, 0xa
jb 0x40d120
mov byte [esi + 0xb], 0
push ecx
lea eax, [esi + 0xa]
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.00416550
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
push dword [ebp - 0x10]
call fcn.00418040
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x40d186
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40d17c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d1ac
push ecx
push edx
call fcn.0047b1a1
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 0xf
jbe 0x40d1bc
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40d1b2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40d1b2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047b1a1
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d1d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cfad
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x496400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0xc], 0
je 0x40d222
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx + 0x77]
inc edx
xor byte [ecx], al
cmp edx, 0xb
jb 0x40d210
mov byte [esi + 0xc], 0
push ecx
lea eax, [esi + 0xb]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00416550
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x40d242
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.00418ee0
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x40d2bb
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40d2b1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40d2b1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047b1a1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d2d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cfad
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x496400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 8], 0
je 0x40d322
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx + 0x77]
inc edx
xor byte [ecx], al
cmp edx, 7
jb 0x40d310
mov byte [esi + 8], 0
push ecx
lea eax, [esi + 7]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00416550
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x40d342
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.00418ee0
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x40d3bb
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40d3b1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40d3b1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047b1a1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cfad
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x496400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 6], 0
je 0x40e782
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx + 0x77]
inc edx
xor byte [ecx], al
cmp edx, 5
jb 0x40e770
mov byte [esi + 6], 0
push ecx
lea eax, [esi + 5]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00416550
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x40e7a2
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.00418ee0
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x40e81b
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40e811
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40e811
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047b1a1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40edf0
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d3d5
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x496400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, accept
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 0x2d
jb 0x40ef39
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
push ecx
cmova eax, dword [ebp + 8]
push eax
push 0x2d
push str.start_cmd__C__color_b__title_Error__echo
push ecx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40]
call fcn.00418220
push str.__timeout__t_5_
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00416010
add esp, 4
cmp dword [eax + 0x14], 0xf
jbe 0x40ee6e
mov eax, dword [eax]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x14]
add esp, 4
cmp ecx, 0xf
jbe 0x40eea8
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ee9e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40eee0
push ecx
push edx
call fcn.0047b1a1
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0xf
jbe 0x40eef0
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40eee6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40eee6
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047b1a1
add esp, 8
xor ecx, ecx
int 0x29
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x40ef2a
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ef20
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40ef20
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047b1a1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
call fcn.00401bc0
int3