joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434060
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00406b3c
mov eax, dword [ebp - 8]
mov edx, 0x400
call fcn.00407458
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43409a
mov eax, dword [ebp - 0x10]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jns 0x4340a6
call fcn.00405468
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040735c
push eax
mov eax, dword [ebp - 4]
call fcn.0040735c
push eax
call sub.kernel32.dll_QueryDosDeviceW
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00407458
mov eax, dword [ebp - 8]
call fcn.00429190
mov esp, ebp
pop ebp
ret

Function at 0x434270
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43435d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
mov eax, dword [ebp - 0xc]
call fcn.00406b3c
mov eax, dword [ebp - 0xc]
mov edx, 0x8000
call fcn.00407458
push 0x8000
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040735c
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.psapi.dll_GetModuleFileNameExW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
jne 0x4342fb
cmp dword [ebp - 0x10], 0
jne 0x4342fb
push 0x8000
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040735c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.psapi.dll_GetProcessImageFileNameW
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00407458
cmp byte [ebp - 0x11], 0
je 0x434324
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.004340e0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00406eec
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00429f90
cmp dword [ebp - 0x18], 0
je 0x434342
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
call fcn.00406eec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434364
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00406b9c
ret
Function at 0x4344e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00405114
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x500
mov eax, dword [ebp - 4]
call fcn.0040735c
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
call fcn.0040735c
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0xc], 0
je 0x434533
mov eax, dword [ebp - 0xc]
call fcn.0040735c
mov dword [ebp - 0x38], eax
cmp dword [ebp + 0xc], 0
je 0x434544
mov eax, dword [ebp + 0xc]
call fcn.0040735c
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
add dword [0x43cfb8], 1
jno 0x434558
call fcn.00405470
xor eax, eax
push ebp
push 0x43458b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434592
sub dword [0x43cfb8], 1
jno 0x43458a
call fcn.00405470
ret
Function at 0x434ab0
Capabilities:
Create process on windows
Create process suspended
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
xor eax, eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x434c7a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x434c50
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x43d014]
call fcn.00428de0
call fcn.00429c30
test eax, eax
jle 0x434b41
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x6c]
push eax
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0x10]
call fcn.00429ca0
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0x70]
call fcn.00428ee0
mov edx, dword [ebp - 0x70]
mov ecx, 0x434c94
mov eax, dword [ebp - 0xc]
call fcn.004292a0
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 0xc]
call fcn.00406f34
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x434b04
lea eax, [ebp - 0xc]
mov edx, 0x434ca4
call fcn.004074d8
mov eax, dword [ebp - 0xc]
call fcn.0040735c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.00405114
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], 1
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x68]
xor ecx, ecx
mov edx, 0x10
call fcn.00405114
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
jne 0x434bcd
call sub.kernel32.dll_GetLastError
mov dword [0x43d010], eax
call fcn.004063f8
jmp 0x434c57
xor eax, eax
push ebp
push 0x434c22
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
call fcn.004348b0
test al, al
jne 0x434bf5
push 0
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_ResumeThread
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434c29
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434c81
lea eax, [ebp - 0x74]
mov edx, 3
call fcn.00406b9c
lea eax, [ebp - 0xc]
call fcn.00406b3c
ret
Function at 0x401b80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b12e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4720bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov edi, dword [ebp + 8]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
test ebx, ebx
je 0x401d4e
mov ecx, dword [ebp + 0xc]
mov al, byte [ecx]
dec ebx
mov byte [ebp + esi - 0x14], al
inc ecx
mov ah, byte [ebp - 0x12]
inc esi
mov dl, byte [ebp - 0x13]
mov dh, byte [ebp - 0x14]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0xe], ah
mov byte [ebp + 0x13], dl
mov byte [ebp - 0xd], dh
cmp esi, 3
jne 0x401c85
mov al, dh
mov cl, dh
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
and ah, 0x3f
mov cl, dl
shr al, 6
and cl, 0xf
mov byte [ebp - 0x15], ah
shl cl, 2
add cl, al
xor esi, esi
mov byte [ebp - 0x16], cl
nop dword [eax]
cmp dword [0x472014], 0x10
mov ecx, section..data
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [section..data]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.00401d70
inc esi
cmp esi, 4
jl 0x401c50
mov ecx, dword [ebp + 0xc]
xor esi, esi
mov dl, byte [ebp + 0x13]
mov dh, byte [ebp - 0xd]
test ebx, ebx
jne 0x401bf5
mov dword [ebp + 0x10], esi
test esi, esi
je 0x401d4e
mov eax, esi
cmp esi, 3
jge 0x401cbe
cmp eax, 3
jae 0x401d62
mov byte [ebp + eax - 0x14], 0
inc eax
cmp eax, 3
jl 0x401ca2
mov cl, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov dh, byte [ebp - 0x14]
jmp 0x401cc1
mov cl, byte [ebp - 0xe]
mov al, dh
shr cl, 6
shr al, 2
and dh, 3
mov byte [ebp - 0x18], al
xor ebx, ebx
mov al, dl
shl dh, 4
shr al, 4
and dl, 0xf
add dh, al
shl dl, 2
lea eax, [esi + 1]
mov byte [ebp - 0x17], dh
add dl, cl
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x16], dl
test eax, eax
jle 0x401d2c
mov esi, eax
nop word [eax + eax]
cmp dword [0x472014], 0x10
mov ecx, section..data
movzx eax, byte [ebp + ebx - 0x18]
cmovae ecx, dword [section..data]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.00401d70
inc ebx
cmp ebx, esi
jl 0x401d00
mov esi, dword [ebp + 0x10]
cmp esi, 3
jge 0x401d4e
mov ebx, 3
sub ebx, esi
nop dword [eax + eax]
push 0x3d
mov ecx, edi
call fcn.00401d70
sub ebx, 1
jne 0x401d40
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00459e1c
int3
Function at 0x4026c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0x270
jne 0x402710
lea edx, [edi + 8]
mov esi, eax
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x4026d2
mov eax, dword [edi]
jmp 0x4027f7
cmp eax, 0x4e0
jb 0x4027f7
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
push ebp
mov ebp, 0xe3
nop
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x402730
mov eax, dword [edi + 0xd50]
lea ebx, [edi + 0xd50]
mov ebp, 0x18c
nop word [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x402780
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
pop ebx
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x402850
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
push edi
nop dword [eax]
mov edi, dword [ecx]
mov eax, dword [edi]
cmp eax, 0x270
jne 0x4028b3
lea eax, [edi + 8]
mov esi, 0x270
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x402873
mov eax, dword [edi]
jmp 0x402995
cmp eax, 0x4e0
jb 0x402995
mov eax, dword [edi + 0x9c4]
lea ebx, [edi + 0x9c4]
mov ebp, 0xe3
nop
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x4028d0
mov eax, dword [edi + 0xd50]
lea ebx, [edi + 0xd50]
mov ebp, 0x18c
nop word [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x402920
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
mov ecx, dword [esp + 0x10]
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, dword [ecx + 8]
ja 0x402860
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x404380
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi + 3], 0
je 0x4043a2
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x46]
inc eax
xor byte [edx], cl
cmp eax, 2
jb 0x404390
mov byte [esi + 3], 0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 7]
push eax
lea eax, [esi + 2]
push eax
push esi
call fcn.00403020
mov eax, dword [esp + 0x10]
pop esi
add esp, 8
ret 4

Function at 0x4043c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x4043e2
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x46]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x4043d0
mov byte [esi + 5], 0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 7]
push eax
lea eax, [esi + 4]
push eax
push esi
call fcn.00403020
mov eax, dword [esp + 0x10]
pop esi
add esp, 8
ret 4

Function at 0x404400
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x404422
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x46]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x404410
mov byte [esi + 9], 0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 7]
push eax
lea eax, [esi + 8]
push eax
push esi
call fcn.00403020
mov eax, dword [esp + 0x10]
pop esi
add esp, 8
ret 4

Function at 0x404440
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x404462
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x46]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0x404450
mov byte [esi + 0x18], 0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 7]
push eax
lea eax, [esi + 0x17]
push eax
push esi
call fcn.00403020
mov eax, dword [esp + 0x10]
pop esi
add esp, 8
ret 4

Function at 0x404480
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi + 0x75], 0
je 0x4044a2
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x46]
inc eax
xor byte [edx], cl
cmp eax, 0x74
jb 0x404490
mov byte [esi + 0x75], 0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 7]
push eax
lea eax, [esi + 0x74]
push eax
push esi
call fcn.00403020
mov eax, dword [esp + 0x10]
pop esi
add esp, 8
ret 4

Function at 0x4044c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x4044e2
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x46]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0x4044d0
mov byte [esi + 0xd], 0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 7]
push eax
lea eax, [esi + 0xc]
push eax
push esi
call fcn.00403020
mov eax, dword [esp + 0x10]
pop esi
add esp, 8
ret 4
Function at 0x404500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b34c
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x4720bc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0xf
mov byte [ebp - 0x64], 0
push 4
mov byte [ebp - 4], 2
call fcn.00459a3a
add esp, 4
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x4045a4
mov ecx, eax
call fcn.0040cc90
mov esi, eax
jmp 0x4045a6
xor esi, esi
sub esp, 0x18
mov byte [ebp - 4], 4
mov edi, esp
mov dword [ebp - 0x1c], 0x88fac38a
sub esp, 0x18
mov word [ebp - 0x18], 0x100
mov edx, esp
xor ecx, ecx
mov dword [ebp - 0x80], edx
lea eax, [ecx - 0x46]
xor byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 4
jb 0x4045c6
lea eax, [ebp - 0x81]
mov byte [ebp - 0x17], 0
push eax
lea eax, [ebp - 0x18]
mov ecx, edx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00403020
push edi
call fcn.0040baa0
add esp, 0x1c
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
call fcn.0040cd40
mov esi, eax
cmp esi, 0x4724f8
je 0x40463d
mov ecx, 0x4724f8
call fcn.00401890
movups xmm0, xmmword [esi]
movups xmmword [0x4724f8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x472508], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov ecx, dword [ebp - 0x68]
cmp ecx, 0x10
jb 0x404673
mov edx, dword [ebp - 0x7c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404669
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404669
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00459a6a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00459a78
mov esp, ebp
pop ebp
ret
Function at 0x4076a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x4076c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x46]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x4076b0
mov byte [esi + 5], 0
mov eax, esi
pop esi
ret

Function at 0x4076d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x4076f2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x46]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0x4076e0
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
ret

Function at 0x407700
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x407722
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x46]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x407710
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret
Function at 0x40c450
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4
Function at 0x40e460
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x40e5d6
test ebx, ebx
je 0x40e5d6
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, ebx
div ecx
test edx, edx
jne 0x40e5d6
mov eax, ebx
div ecx
mov ecx, dword [esp + 0x18]
push ebp
push edi
cmp ecx, 1
jne 0x40e525
mov ebp, dword [esp + 0x14]
xor ecx, ecx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x20], ecx
test eax, eax
je 0x40e5d4
lea edi, [esi + 0x3f4]
nop dword [eax]
push ebx
push ebp
mov ecx, esi
call fcn.0040e5e0
cmp byte [esi + 4], 0
mov edx, ebx
je 0x40e4f2
xor ecx, ecx
cmp dword [esi + 0x3cc], ecx
jle 0x40e4f2
nop dword [eax + eax]
mov al, byte [edi + ecx]
lea edx, [edx + 1]
xor byte [edx - 1], al
inc ecx
cmp ecx, dword [esi + 0x3cc]
jl 0x40e4e0
push dword [esi + 0x3cc]
push ebp
push edi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [esp + 0x28]
add esp, 0xc
div ecx
inc dword [esp + 0x20]
add ebp, ecx
add ebx, ecx
cmp dword [esp + 0x20], eax
jb 0x40e4c0
pop edi
pop ebp
pop esi
pop ebx
ret 0x10
cmp ecx, 2
jne 0x40e5a6
mov edi, dword [esp + 0x14]
xor ecx, ecx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x20], ecx
test eax, eax
je 0x40e5d4
lea ebp, [esi + 0x3f4]
push ebx
push ebp
mov ecx, esi
call fcn.0040f1a0
cmp byte [esi + 4], 0
mov edx, ebx
je 0x40e573
xor ecx, ecx
cmp dword [esi + 0x3cc], ecx
jle 0x40e573
mov al, byte [ecx + edi]
lea edx, [edx + 1]
xor byte [edx - 1], al
inc ecx
cmp ecx, dword [esi + 0x3cc]
jl 0x40e561
push dword [esi + 0x3cc]
push edi
push ebp
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [esp + 0x28]
add esp, 0xc
div ecx
inc dword [esp + 0x20]
add edi, ecx
add ebx, ecx
cmp dword [esp + 0x20], eax
jb 0x40e546
pop edi
pop ebp
pop esi
pop ebx
ret 0x10
mov ebx, dword [esp + 0x14]
xor edi, edi
mov ebp, dword [esp + 0x18]
test eax, eax
je 0x40e5d4
push ebp
push ebx
mov ecx, esi
call fcn.0040e5e0
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [esp + 0x1c]
inc edi
div ecx
add ebx, ecx
add ebp, ecx
cmp edi, eax
jb 0x40e5b4
pop edi
pop ebp
pop esi
pop ebx
ret 0x10
Function at 0x40f000
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x40f192
test ebx, ebx
je 0x40f192
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, ebx
div ecx
test edx, edx
jne 0x40f192
mov eax, ebx
div ecx
mov edx, dword [esp + 0x18]
push ebp
push edi
cmp edx, 1
jne 0x40f0c9
mov ebp, dword [esp + 0x14]
xor edx, edx
mov edi, dword [esp + 0x18]
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], edi
test eax, eax
je 0x40f190
lea ebx, [esi + 0x3f4]
cmp byte [esi + 4], 0
mov eax, ebx
je 0x40f089
xor edx, edx
test ecx, ecx
jle 0x40f089
mov edi, ebp
sub edi, ebx
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
inc edx
cmp edx, dword [esi + 0x3cc]
jl 0x40f073
mov edi, dword [esp + 0x14]
push edi
push ebx
mov ecx, esi
call fcn.0040f1a0
push dword [esi + 0x3cc]
push edi
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [esp + 0x28]
add edi, ecx
div ecx
inc dword [esp + 0x2c]
add esp, 0xc
add ebp, ecx
mov dword [esp + 0x14], edi
cmp dword [esp + 0x20], eax
jb 0x40f061
pop edi
pop ebp
pop esi
pop ebx
ret 0x10
cmp edx, 2
jne 0x40f15c
mov edi, dword [esp + 0x14]
xor ebp, ebp
mov ebx, dword [esp + 0x18]
test eax, eax
je 0x40f190
lea eax, [esi + 0x3f4]
nop word [eax + eax]
push ebx
push eax
mov ecx, esi
call fcn.0040f1a0
cmp byte [esi + 4], 0
mov edx, ebx
je 0x40f122
xor ecx, ecx
cmp dword [esi + 0x3cc], ecx
jle 0x40f122
nop dword [eax + eax]
mov al, byte [ecx + edi]
lea edx, [edx + 1]
xor byte [edx - 1], al
inc ecx
cmp ecx, dword [esi + 0x3cc]
jl 0x40f110
push dword [esi + 0x3cc]
lea eax, [esi + 0x3f4]
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [esp + 0x28]
inc ebp
div ecx
add esp, 0xc
add edi, ecx
add ebx, ecx
cmp ebp, eax
lea eax, [esi + 0x3f4]
jb 0x40f0f0
pop edi
pop ebp
pop esi
pop ebx
ret 0x10
mov ebx, dword [esp + 0x14]
xor edi, edi
mov ebp, dword [esp + 0x18]
test eax, eax
je 0x40f190
nop word [eax + eax]
push ebp
push ebx
mov ecx, esi
call fcn.0040f1a0
mov ecx, dword [esi + 0x3cc]
xor edx, edx
mov eax, dword [esp + 0x1c]
inc edi
div ecx
add ebx, ecx
add ebp, ecx
cmp edi, eax
jb 0x40f170
pop edi
pop ebp
pop esi
pop ebx
ret 0x10