joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4090a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x338
mov eax, dword [0x7c6ee4]
xor eax, esp
mov dword [esp + 0x334], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
push esi
mov esi, edx
push edi
cmp eax, 0x180
jbe 0x4090e9
mov eax, 0xffffffc8
pop edi
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.0050b38b
mov esp, ebp
pop ebp
ret
push 0x1a0
lea eax, [esp + 0x19c]
push 0
push eax
call fcn.0050c5b0
push 0x118
lea eax, [esp + 0x28]
push 0
push eax
call fcn.0050c5b0
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x1c0], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x1c1], al
mov eax, ecx
shr eax, 8
push ecx
mov byte [esp + 0x1c6], al
lea eax, [esp + 0x1cc]
push esi
push eax
mov byte [esp + 0x1cf], cl
mov byte [esp + 0x1d3], 0x30
call fcn.0050c59e
mov eax, dword [esp + 0x30]
add esp, 0x24
lea esi, [eax + 0x19]
mov byte [esp + eax + 0x1b0], pe_nt_image_headers32
mov dword [esp + 0x14], esi
xor eax, eax
nop dword [eax]
mov byte [esp + eax + 0x178], al
inc eax
cmp eax, 0x20
jl 0x409170
push 0x100
lea edx, [esp + 0x17c]
lea ecx, [esp + 0x1c]
call fcn.0040d210
mov cl, byte [esp + 0x19f]
add esp, 4
xor eax, eax
mov dword [esp + 0xc], eax
xorps xmm0, xmm0
mov edi, esi
movaps xmmword [esp + 0x130], xmm0
test esi, esi
je 0x40921c
lea esi, [esp + 0x198]
lea eax, [esp + 0x130]
sub esi, eax
xor eax, eax
lea edx, [esp + 0x130]
add edx, eax
inc eax
mov cl, byte [esi + edx]
xor byte [edx], cl
cmp eax, 0x10
jl 0x4091c5
add esi, 0x10
mov eax, edi
cmp edi, 0x10
mov ecx, 0x10
cmovae eax, ecx
lea ecx, [esp + 0x18]
sub edi, eax
lea eax, [esp + 0x130]
push eax
mov edx, eax
call fcn.0040e2f0
add esp, 4
test edi, edi
jne 0x4091c3
movaps xmm0, xmmword [esp + 0x130]
mov eax, dword [esp + 0xc]
mov cl, byte [esp + 0x19b]
mov esi, dword [esp + 0x14]
movups xmmword [esp + eax + 0x148], xmm0
add eax, 0x10
inc cl
mov byte [esp + 0x19b], cl
mov dword [esp + 0xc], eax
cmp eax, 0x30
jl 0x4091a2
push 0x100
lea edx, [esp + 0x14c]
lea ecx, [esp + 0x1c]
call fcn.0040d210
add esp, 4
mov esi, 3
nop word [eax + eax]
lea eax, [esp + 0x168]
push eax
mov edx, eax
lea ecx, [esp + 0x1c]
call fcn.0040e2f0
mov eax, dword [esp + 0x14]
add esp, 4
movups xmm0, xmmword [esp + 0x168]
movups xmmword [eax], xmm0
add eax, 0x10
mov dword [esp + 0x10], eax
sub esi, 1
jne 0x409260
mov eax, 0x118
lea ecx, [esp + 0x18]
nop word [eax + eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x4092a0
mov ecx, dword [esp + 0x33c]
pop edi
pop esi
xor ecx, esp
call fcn.0050b38b
mov esp, ebp
pop ebp
ret
Function at 0x4092c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x7c6ee4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x30
lea edi, [ebp - 0x34]
mov dword [ebp - 0x3c], edx
mov eax, edi
mov dword [ebp - 0x38], ecx
push 0
push eax
call fcn.0050c5b0
mov edx, dword [ebp - 0x38]
mov esi, 1
add esp, 0xc
mov ebx, 3
sub esi, edx
lea eax, [edx + 0x20]
lea ecx, [edx + 0xf]
mov dword [ebp - 0x40], eax
mov eax, ecx
add byte [eax], 1
jne 0x409312
dec eax
lea ecx, [esi + eax]
test ecx, ecx
jg 0x409305
mov ecx, dword [ebp - 0x40]
push edi
call fcn.0040e2f0
mov edx, dword [ebp - 0x38]
add esp, 4
add edi, 0x10
lea ecx, [edx + 0xf]
sub ebx, 1
jne 0x409303
mov eax, dword [ebp - 0x3c]
mov edx, 0x20
movups xmm0, xmmword [ebp - 0x34]
pop edi
pop esi
movups xmm1, xmmword [eax]
pop ebx
pxor xmm1, xmm0
movups xmm0, xmmword [ebp - 0x24]
movups xmmword [ebp - 0x34], xmm1
movups xmm1, xmmword [eax + 0x10]
pxor xmm1, xmm0
movups xmmword [ebp - 0x24], xmm1
mov al, byte [edx + eax]
xor byte [ebp + edx - 0x34], al
inc edx
mov eax, dword [ebp - 0x3c]
cmp edx, 0x30
jl 0x409356
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x34]
push 0x100
call fcn.0040d210
mov ecx, dword [ebp - 0x38]
add esp, 4
movups xmm0, xmmword [ebp - 0x14]
xor eax, eax
movups xmmword [ecx], xmm0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050b38b
mov esp, ebp
pop ebp
ret

Function at 0x4095e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret
Function at 0x40bb80
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0xd0], edx
test edx, edx
jne 0x40bc16
mov dword [ecx + 0x10], 0xf3bcc908
mov dword [ecx + 0x14], 0x6a09e667
mov dword [ecx + 0x18], 0x84caa73b
mov dword [ecx + 0x1c], 0xbb67ae85
mov dword [ecx + 0x20], 0xfe94f82b
mov dword [ecx + 0x24], 0x3c6ef372
mov dword [ecx + 0x28], 0x5f1d36f1
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0xade682d1
mov dword [ecx + 0x34], 0x510e527f
mov dword [ecx + 0x38], 0x2b3e6c1f
mov dword [ecx + 0x3c], 0x9b05688c
mov dword [ecx + 0x40], 0xfb41bd6b
mov dword [ecx + 0x44], 0x1f83d9ab
mov dword [ecx + 0x48], 0x137e2179
mov dword [ecx + 0x4c], 0x5be0cd19
ret
mov dword [ecx + 0x10], 0xc1059ed8
mov dword [ecx + 0x14], 0xcbbb9d5d
mov dword [ecx + 0x18], 0x367cd507
mov dword [ecx + 0x1c], 0x629a292a
mov dword [ecx + 0x20], 0x3070dd17
mov dword [ecx + 0x24], 0x9159015a
mov dword [ecx + 0x28], 0xf70e5939
mov dword [ecx + 0x2c], 0x152fecd8
mov dword [ecx + 0x30], 0xffc00b31
mov dword [ecx + 0x34], 0x67332667
mov dword [ecx + 0x38], 0x68581511
mov dword [ecx + 0x3c], 0x8eb44a87
mov dword [ecx + 0x40], 0x64f98fa7
mov dword [ecx + 0x44], 0xdb0c2e0d
mov dword [ecx + 0x48], 0xbefa4fa4
mov dword [ecx + 0x4c], 0x47b5481d
ret
Function at 0x40cfc0
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x7c6ee4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edx, 1
nop dword [eax]
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
movzx edx, cl
cmp esi, 0x100
jl 0x40cfe0
mov esi, 1
mov edx, 0x7c9e60
nop dword [eax]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movzx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0x7c9e88
jl 0x40d020
mov eax, 1
mov byte [0x7c9860], 0x63
mov byte [0x7c9dc3], 0
mov dword [ebp - 0x808], eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
add eax, eax
shr ecx, 7
or ecx, eax
movzx edx, cl
mov ecx, edx
shr ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 0x808]
mov byte [eax + 0x7c9860], bl
mov byte [ebx + 0x7c9d60], al
inc eax
mov dword [ebp - 0x808], eax
cmp eax, 0x100
jl 0x40d060
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 0x80c], ebx
nop
movzx edx, byte [esi + 0x7c9860]
mov eax, edx
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0x7cb290], ecx
rol ecx, 8
mov dword [esi*4 + 0x7cae90], ecx
rol ecx, 8
mov dword [esi*4 + 0x7ca290], ecx
rol ecx, 8
mov dword [esi*4 + 0x7c9e90], ecx
movzx ecx, byte [esi + 0x7c9d60]
test ecx, ecx
je 0x40d1a0
mov ecx, dword [ebp + ecx*4 - 0x404]
mov eax, dword [ebp - 0x3cc]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e0]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d0]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x80c]
mov eax, dword [ebp + edx*4 - 0x804]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x3d8]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x40d1ac
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x808], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 0x808]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x7caa90], eax
rol eax, 8
mov dword [esi*4 + 0x7ca690], eax
rol eax, 8
mov dword [esi*4 + 0x7cb690], eax
rol eax, 8
mov dword [esi*4 + 0x7c9960], eax
inc esi
cmp esi, 0x100
jl 0x40d0e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050b38b
mov esp, ebp
pop ebp
ret
Function at 0x40e0d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x7c6ee4]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
push 0x118
lea eax, [esp + 0x14]
mov esi, edx
push 0
push eax
mov ebx, ecx
call fcn.0050c5b0
push dword [ebp + 8]
lea edi, [ebx + 8]
mov edx, esi
lea ecx, [esp + 0x20]
mov dword [ebx + 4], edi
call fcn.0040d210
mov edx, eax
add esp, 0x10
mov dword [esp + 0xc], edx
test edx, edx
jne 0x40e2b3
mov ecx, dword [esp + 0x10]
mov dword [ebx], ecx
shl ecx, 4
add ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [edi + 0xc], eax
add edi, 0x10
mov esi, dword [ebx]
dec esi
test esi, esi
jle 0x40e29d
nop dword [eax + eax]
movzx eax, byte [ecx + 3]
dec esi
movzx edx, byte [eax + 0x7c9860]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x7c9960]
movzx eax, byte [eax + 0x7c9860]
xor edx, dword [eax*4 + 0x7cb690]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x7c9860]
xor edx, dword [eax*4 + 0x7ca690]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x7c9860]
xor edx, dword [eax*4 + 0x7caa90]
mov dword [edi], edx
movzx eax, byte [ecx + 4]
movzx edx, byte [eax + 0x7c9860]
movzx eax, byte [ecx + 7]
mov edx, dword [edx*4 + 0x7caa90]
movzx eax, byte [eax + 0x7c9860]
xor edx, dword [eax*4 + 0x7c9960]
movzx eax, byte [ecx + 6]
movzx eax, byte [eax + 0x7c9860]
xor edx, dword [eax*4 + 0x7cb690]
movzx eax, byte [ecx + 5]
movzx eax, byte [eax + 0x7c9860]
xor edx, dword [eax*4 + 0x7ca690]
mov dword [edi + 4], edx
movzx eax, byte [ecx + 8]
movzx edx, byte [eax + 0x7c9860]
movzx eax, byte [ecx + 0xb]
mov edx, dword [edx*4 + 0x7caa90]
movzx eax, byte [eax + 0x7c9860]
xor edx, dword [eax*4 + 0x7c9960]
movzx eax, byte [ecx + 0xa]
movzx eax, byte [eax + 0x7c9860]
xor edx, dword [eax*4 + 0x7cb690]
movzx eax, byte [ecx + 9]
movzx eax, byte [eax + 0x7c9860]
xor edx, dword [eax*4 + 0x7ca690]
mov dword [edi + 8], edx
movzx eax, byte [ecx + 0xc]
movzx edx, byte [eax + 0x7c9860]
movzx eax, byte [ecx + 0xf]
mov edx, dword [edx*4 + 0x7caa90]
movzx eax, byte [eax + 0x7c9860]
xor edx, dword [eax*4 + 0x7c9960]
movzx eax, byte [ecx + 0xe]
movzx eax, byte [eax + 0x7c9860]
xor edx, dword [eax*4 + 0x7cb690]
movzx eax, byte [ecx + 0xd]
sub ecx, 0x10
movzx eax, byte [eax + 0x7c9860]
xor edx, dword [eax*4 + 0x7ca690]
mov dword [edi + 0xc], edx
add edi, 0x10
test esi, esi
jg 0x40e160
mov edx, dword [esp + 0xc]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0xc], eax
mov eax, 0x118
lea ecx, [esp + 0x10]
nop dword [eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x40e2c0
mov ecx, dword [esp + 0x12c]
mov eax, edx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0050b38b
mov esp, ebp
pop ebp
ret
Function at 0x40ee10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], ecx
test al, 0xf
je 0x40ee2c
mov eax, 0xffffffde
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
test edx, edx
jne 0x40eebe
test eax, eax
je 0x40ef7a
mov ebx, dword [ebp + 0xc]
dec eax
mov esi, dword [ebp + 0x14]
mov edi, ebx
mov ecx, dword [ebp + 0x10]
sub edi, esi
shr eax, 4
inc eax
mov dword [ebp + 8], ecx
mov dword [ebp - 8], eax
movups xmm2, xmmword [ecx]
mov edx, ecx
mov ecx, dword [ebp - 4]
push esi
call fcn.0040e880
lea eax, [ebx + 0xf]
add esp, 4
cmp esi, eax
ja 0x40ee90
lea eax, [esi + 0xf]
cmp eax, ebx
jb 0x40ee90
mov ecx, esi
mov edx, 0x10
nop dword [eax]
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x40ee80
jmp 0x40ee9d
movups xmm1, xmmword [ebx]
movups xmm0, xmmword [esi]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
mov ecx, dword [ebp + 8]
add esi, 0x10
add ecx, 0x10
sub edi, 0x10
sub dword [ebp - 8], 1
movups xmmword [ebx], xmm2
mov dword [ebp + 8], ecx
jne 0x40ee57
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x40ef7a
mov ecx, dword [ebp + 0xc]
lea edx, [eax - 1]
mov edi, dword [ebp + 0x10]
mov ebx, ecx
mov esi, dword [ebp + 0x14]
sub ebx, edi
shr edx, 4
inc edx
mov dword [ebp + 8], ebx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], esi
lea eax, [edi + 0xf]
cmp esi, eax
ja 0x40eef1
lea eax, [esi + 0xf]
cmp eax, edi
jae 0x40eeff
lea eax, [ecx + 0xf]
cmp esi, eax
ja 0x40ef30
lea eax, [esi + 0xf]
cmp eax, ecx
jb 0x40ef30
mov ebx, esi
mov ecx, edi
mov esi, dword [ebp + 8]
sub ebx, edi
mov edx, 0x10
nop dword [eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub edx, 1
jne 0x40ef10
mov esi, dword [ebp - 8]
mov ebx, dword [ebp + 8]
jmp 0x40ef3d
movups xmm1, xmmword [ecx]
movups xmm0, xmmword [edi]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
cmp dword [ebp - 0x10], 1
mov edx, esi
mov ecx, dword [ebp - 4]
push esi
jne 0x40ef50
call fcn.0040e2f0
jmp 0x40ef55
call fcn.0040e880
movups xmm0, xmmword [esi]
mov ecx, dword [ebp + 0xc]
sub ebx, 0x10
add esi, 0x10
mov dword [ebp + 8], ebx
add esp, 4
mov dword [ebp - 8], esi
add edi, 0x10
sub dword [ebp - 0xc], 1
movups xmmword [ecx], xmm0
jne 0x40eee3
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
lea eax, [esi + 1]
push eax
push 0
push ebx
call fcn.0050c5b0
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x411b4b
movzx eax, byte [ebp + 8]
mov dword [ebp - 0xc], eax
xor edi, edi
test eax, eax
je 0x411b43
mov eax, dword [ebp + 0xc]
lea edx, [ecx + ebx]
mov bl, byte [edx]
mov esi, ecx
mov dword [ebp - 0x18], edx
mov eax, dword [eax + 4]
shl eax, 5
mov dword [ebp - 0x14], eax
nop
cmp eax, esi
ja 0x411b08
xor eax, eax
jmp 0x411b20
mov eax, dword [ebp + 0xc]
mov edx, esi
shr edx, 5
mov ecx, esi
and ecx, 0x1f
mov eax, dword [eax + 8]
mov eax, dword [eax + edx*4]
shr eax, cl
and eax, 1
add esi, dword [ebp - 8]
mov ecx, edi
shl al, cl
inc edi
or bl, al
mov eax, dword [ebp - 0x14]
cmp edi, dword [ebp - 0xc]
jb 0x411b00
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov byte [eax], bl
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, esi
jb 0x411ae2
mov edi, 1
xor al, al
cmp esi, edi
jb 0x411b99
mov bh, byte [edi + ebx]
mov bl, 1
mov ecx, dword [ebp - 4]
mov dh, bh
mov esi, dword [ebp - 4]
xor bh, al
and dh, al
mov al, bh
and al, 1
mov dl, byte [edi + ecx - 1]
sub bl, al
mov byte [edi + ecx], bh
movzx eax, bl
movzx ecx, dl
imul ecx, eax
shl bl, 7
or bl, dl
xor byte [edi + esi], cl
mov al, cl
mov ecx, esi
and al, bh
or al, dh
mov byte [edi + ecx - 1], bl
inc edi
mov ebx, ecx
cmp edi, dword [ebp - 8]
jbe 0x411b56
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418d60
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], edx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xc], esi
push edi
mov edi, dword [esi]
lea ecx, [esi + 8]
mov ebx, dword [esi + 4]
mov dword [ebp - 4], ecx
test edx, edx
je 0x418dc6
mov edx, dword [ebp + 0xc]
sub dword [ebp + 8], edx
mov esi, dword [ebp - 4]
lea eax, [edi + 1]
movzx edi, al
lea edx, [edx + 1]
movzx ecx, byte [ecx + edi]
lea eax, [ecx + ebx]
movzx ebx, al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
mov byte [esi + edi], al
mov byte [esi + ebx], cl
add cl, al
movzx eax, cl
mov ecx, esi
mov esi, dword [ebp + 8]
mov al, byte [eax + ecx]
xor al, byte [esi + edx - 1]
sub dword [ebp - 8], 1
mov byte [edx - 1], al
jne 0x418d86
mov esi, dword [ebp - 0xc]
mov dword [esi], edi
xor eax, eax
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov eax, edx
mov dword [esp + 0x10], ecx
mov edx, dword [ebp + 8]
push esi
push edi
test dl, 7
je 0x419cf6
mov eax, 0xffffffce
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x419dbe
test edx, edx
je 0x419e5c
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
lea edx, [ecx + 2]
sub ecx, eax
lea esi, [eax + 2]
mov dword [esp + 0x10], edx
mov eax, dword [ebp + 8]
add ecx, 0xfffffffe
dec eax
mov dword [esp + 0x1c], ecx
shr eax, 3
inc eax
mov dword [esp + 0x14], eax
nop
movzx eax, byte [esi - 2]
lea edi, [ecx + esi]
xor al, byte [ebx]
mov byte [edi], al
movzx eax, byte [esi - 1]
xor al, byte [ebx + 1]
mov byte [edx - 1], al
movzx eax, byte [ebx + 2]
xor al, byte [esi]
mov byte [edx], al
movzx eax, byte [esi + 1]
xor al, byte [ebx + 3]
mov ecx, dword [esp + 0x18]
mov byte [edx + 1], al
movzx eax, byte [esi + 2]
xor al, byte [ebx + 4]
mov byte [edx + 2], al
movzx eax, byte [esi + 3]
xor al, byte [ebx + 5]
mov byte [edx + 3], al
movzx eax, byte [esi + 4]
xor al, byte [ebx + 6]
mov byte [edx + 4], al
movzx eax, byte [esi + 5]
xor al, byte [ebx + 7]
mov byte [edx + 5], al
mov edx, edi
push edi
call fcn.00419340
mov eax, dword [edi]
lea esi, [esi + 8]
mov edx, dword [esp + 0x14]
add esp, 4
mov ecx, dword [esp + 0x1c]
add edx, 8
sub dword [esp + 0x14], 1
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov dword [esp + 0x10], edx
jne 0x419d30
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x419e5c
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
sub eax, ecx
lea esi, [ecx + 2]
mov dword [esp + 0x14], esi
lea ecx, [eax - 2]
lea eax, [edx - 1]
mov dword [esp + 0x1c], ecx
shr eax, 3
inc eax
mov dword [esp + 0x10], eax
nop word [eax + eax]
mov edi, dword [ecx + esi]
lea edx, [ecx + esi]
mov ecx, dword [esp + 0x18]
add esi, 0xfffffffe
mov ebx, dword [edx + 4]
push esi
call fcn.00419340
mov ecx, dword [ebp + 0xc]
add esp, 4
movzx eax, byte [ecx]
xor byte [esi], al
mov esi, dword [esp + 0x14]
movzx eax, byte [ecx + 1]
xor byte [esi - 1], al
movzx eax, byte [ecx + 2]
xor byte [esi], al
movzx eax, byte [ecx + 3]
xor byte [esi + 1], al
movzx eax, byte [ecx + 4]
xor byte [esi + 2], al
movzx eax, byte [ecx + 5]
xor byte [esi + 3], al
movzx eax, byte [ecx + 6]
xor byte [esi + 4], al
movzx eax, byte [ecx + 7]
xor byte [esi + 5], al
add esi, 8
sub dword [esp + 0x10], 1
mov dword [ecx], edi
mov dword [ecx + 4], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], esi
jne 0x419df0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov eax, edx
mov dword [esp + 0x10], ecx
mov edx, dword [ebp + 8]
push esi
push edi
test dl, 7
je 0x41b966
mov eax, 0xffffffce
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x41ba2e
test edx, edx
je 0x41bacc
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
lea edx, [ecx + 2]
sub ecx, eax
lea esi, [eax + 2]
mov dword [esp + 0x10], edx
mov eax, dword [ebp + 8]
add ecx, 0xfffffffe
dec eax
mov dword [esp + 0x1c], ecx
shr eax, 3
inc eax
mov dword [esp + 0x14], eax
nop
movzx eax, byte [esi - 2]
lea edi, [ecx + esi]
xor al, byte [ebx]
mov byte [edi], al
movzx eax, byte [esi - 1]
xor al, byte [ebx + 1]
mov byte [edx - 1], al
movzx eax, byte [ebx + 2]
xor al, byte [esi]
mov byte [edx], al
movzx eax, byte [esi + 1]
xor al, byte [ebx + 3]
mov ecx, dword [esp + 0x18]
mov byte [edx + 1], al
movzx eax, byte [esi + 2]
xor al, byte [ebx + 4]
mov byte [edx + 2], al
movzx eax, byte [esi + 3]
xor al, byte [ebx + 5]
mov byte [edx + 3], al
movzx eax, byte [esi + 4]
xor al, byte [ebx + 6]
mov byte [edx + 4], al
movzx eax, byte [esi + 5]
xor al, byte [ebx + 7]
mov byte [edx + 5], al
mov edx, edi
push edi
call fcn.00419e70
mov eax, dword [edi]
lea esi, [esi + 8]
mov edx, dword [esp + 0x14]
add esp, 4
mov ecx, dword [esp + 0x1c]
add edx, 8
sub dword [esp + 0x14], 1
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov dword [esp + 0x10], edx
jne 0x41b9a0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x41bacc
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
sub eax, ecx
lea esi, [ecx + 2]
mov dword [esp + 0x14], esi
lea ecx, [eax - 2]
lea eax, [edx - 1]
mov dword [esp + 0x1c], ecx
shr eax, 3
inc eax
mov dword [esp + 0x10], eax
nop word [eax + eax]
mov edi, dword [ecx + esi]
lea edx, [ecx + esi]
mov ecx, dword [esp + 0x18]
add esi, 0xfffffffe
mov ebx, dword [edx + 4]
push esi
call fcn.00419e70
mov ecx, dword [ebp + 0xc]
add esp, 4
movzx eax, byte [ecx]
xor byte [esi], al
mov esi, dword [esp + 0x14]
movzx eax, byte [ecx + 1]
xor byte [esi - 1], al
movzx eax, byte [ecx + 2]
xor byte [esi], al
movzx eax, byte [ecx + 3]
xor byte [esi + 1], al
movzx eax, byte [ecx + 4]
xor byte [esi + 2], al
movzx eax, byte [ecx + 5]
xor byte [esi + 3], al
movzx eax, byte [ecx + 6]
xor byte [esi + 4], al
movzx eax, byte [ecx + 7]
xor byte [esi + 5], al
add esi, 8
sub dword [esp + 0x10], 1
mov dword [ecx], edi
mov dword [ecx + 4], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], esi
jne 0x41ba60
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e0a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0x10
mov ecx, dword [ebp + 8]
mov eax, edx
mov dword [ebp - 0x10], eax
mov ebx, edi
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 4], ecx
xor eax, dword [ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov dword [ebp - 0xc], eax
movzx esi, al
shr ecx, 8
movzx edx, cl
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
movzx eax, al
mov eax, dword [edi + eax*4 + 0x48]
add eax, dword [edi + ecx*4 + 0x448]
xor eax, dword [edi + edx*4 + 0x848]
add eax, dword [edi + esi*4 + 0xc48]
xor eax, dword [ebp - 4]
sub dword [ebp - 8], 1
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
jne 0x41e0c3
mov ecx, dword [edi + 0x44]
xor ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [edx], ecx
mov ecx, dword [edi + 0x40]
xor ecx, eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x41e130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0x10
mov ecx, dword [ebp + 8]
mov eax, edx
mov dword [ebp - 0x10], eax
lea ebx, [edi + 0x44]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 4], ecx
xor eax, dword [ebx]
lea ebx, [ebx - 4]
mov ecx, eax
mov dword [ebp - 0xc], eax
movzx esi, al
shr ecx, 8
movzx edx, cl
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
movzx eax, al
mov eax, dword [edi + eax*4 + 0x48]
add eax, dword [edi + ecx*4 + 0x448]
xor eax, dword [edi + edx*4 + 0x848]
add eax, dword [edi + esi*4 + 0xc48]
xor eax, dword [ebp - 4]
sub dword [ebp - 8], 1
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
jne 0x41e154
mov ecx, dword [edi]
xor ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [edx], ecx
mov ecx, dword [edi + 4]
xor ecx, eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret