joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40546d
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0040571c
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x4054a1
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x446fc8], eax
jmp 0x405635
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x4054bf
test eax, eax
je 0x4055e0
test byte [ebp + 0xc], 2
je 0x4055e0
mov esi, 0x439d40
push edi
push esi
call fcn.00405b48
test ebx, ebx
je 0x4054dc
push 0x4093dc
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x4054e2
push edi
call fcn.00405682
cmp byte [edi], 0
jne 0x4054f0
cmp byte [0x439d40], 0x5c
jne 0x4054fb
push 0x409010
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4055d6
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405666
cmp byte [eax], 0
je 0x405541
cmp byte [ebp - 0x18], 0
je 0x405541
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405557
mov al, byte [esi + 1]
test al, al
je 0x4055b5
cmp al, 0x2e
jne 0x405557
cmp byte [esi + 2], 0
je 0x4055b5
push esi
push ebx
call fcn.00405b48
test byte [ebp - 0x148], 0x10
je 0x40557c
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4055b5
push dword [ebp + 0xc]
push edi
call fcn.0040546d
jmp 0x4055b5
push edi
call fcn.00405800
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4055ad
test byte [ebp + 0xc], 4
je 0x4055a5
push edi
push 0xfffffffffffffff1
call fcn.00404e34
push 0
push edi
call fcn.00405896
jmp 0x4055b5
inc dword [0x446fc8]
jmp 0x4055b5
push edi
push 0xfffffffffffffff2
call fcn.00404e34
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40551f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x4055e0
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x405635
cmp dword [ebp - 8], esi
jne 0x4055f5
inc dword [0x446fc8]
jmp 0x405635
push edi
call fcn.00405e43
test eax, eax
je 0x405635
push edi
call fcn.0040563b
push edi
call fcn.00405800
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40562d
test byte [ebp + 0xc], 4
je 0x4055ed
push edi
push 0xfffffffffffffff1
call fcn.00404e34
push esi
push edi
call fcn.00405896
jmp 0x405635
push edi
push 0xffffffffffffffe5
call fcn.00404e34
pop edi
pop esi
leave
ret 8
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x1f6c535a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x3c487376
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x100033db
Capabilities:
Create tcp socket

Disassembly:
push 6
push 1
push 2
call sub.WS2_32.dll_socket
pop edx
mov edx, dword [esp - 4]
jmp edx
Function at 0x409368
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40941c
jmp 0x409411
cmp dword [esi + 0x10], 0x1000
jne 0x4093fd
test byte [esi + 0x15], 1
jne 0x4093fd
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x4093bc
cmp eax, 2
je 0x4093bc
cmp eax, 0x10
je 0x4093bc
cmp eax, 0x20
jne 0x4093d1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4093d1
mov bl, 1
xor ebp, ebp
jmp 0x4093e2
mov eax, dword [esi]
add eax, ebp
call fcn.00409360
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jl 0x4093d5
test bl, bl
je 0x4093fd
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40941c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409394
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4d52210
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x49702af6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x403637
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
xor eax, edx
add eax, 0x5d588b65
xor eax, edx
add eax, 0xca62c1d6
mov ecx, eax
xor eax, edx
add eax, 0x8f1bbcdc
shr ecx, 0x1b
xor eax, edx
add eax, 0x6c078965
rol eax, cl
ret 8

Function at 0x403665
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, eax
add eax, 0x5d588b65
xor eax, edx
add edx, 0xca62c1d6
xor edx, eax
add eax, 0x8f1bbcdc
xor eax, edx
add edx, 0x6c078965
xor edx, eax
push edx
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add ecx, 7
shr ecx, 3
je 0x4036b1
movq mm1, qword [ebp - 8]
movq mm0, qword [edx]
pxor mm0, mm1
paddw mm1, mm0
movq qword [edx], mm0
add edx, 8
dec ecx
jne 0x40369f
emms
leave
ret 0xc

Function at 0x404f83
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
xor ecx, ecx
test ebx, ebx
je 0x404fa2
mov edx, dword [esp + 0xc]
mov eax, ecx
and eax, edx
xor byte [edi + ecx], al
inc ecx
dec ebx
jne 0x404f97
pop edi
pop ebx
ret 0xc

Function at 0x4076f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 0x18]
movzx ecx, word [ebp + 0x1e]
xor edx, edx
div ecx
shr ecx, 2
cmp edx, ecx
sbb eax, eax
and edx, eax
mov eax, dword [ebp + 0x18]
and eax, 1
add eax, edx
sub dword [ebp + 0x18], eax
mov ecx, dword [ebp + 0x18]
cmp ecx, 0x8000
jb 0x407735
push ecx
call fcn.00430880
jb 0x4077bc
mov dword [ebp - 4], eax
xchg edi, eax
jmp 0x407753
add ecx, 3
and ecx, 0xfffffffc
mov eax, 0xfffff000
add ecx, eax
jae 0x40774d
lea esp, [esp + eax + 4]
push eax
add ecx, eax
jb 0x407744
sub ecx, eax
sub esp, ecx
mov edi, esp
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
mov ah, byte [ebp + 0x1c]
test ebx, ebx
je 0x40779f
movzx ecx, word [ebp + 0x1e]
cmp ecx, ebx
jb 0x40776a
mov ecx, ebx
sub ebx, ecx
add edi, ecx
push ecx
inc ecx
shr ecx, 1
je 0x407785
lea edx, [edi - 1]
lodsb al, byte [esi]
xor al, ah
mov byte [edx], al
sub edx, 2
add ah, byte [ebp + 0x1d]
dec ecx
jne 0x407777
pop ecx
shr ecx, 1
je 0x40779b
lea edx, [edi - 2]
lodsb al, byte [esi]
xor al, ah
mov byte [edx], al
sub edx, 2
add ah, byte [ebp + 0x1d]
dec ecx
jne 0x40778d
test ebx, ebx
jne 0x407760
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
test esi, esi
mov eax, esi
jne 0x4077b0
mov esi, esp
rep movsb byte es:[edi], byte [esi]
test eax, eax
je 0x4077bc
push eax
call fcn.004308ae
leave
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x40812a
Capabilities:
Encode data using xor

Disassembly:
push dword [ebp - 0x10]
call fcn.004308ae
neg dword [ebp + 0x14]
leave
pop edi
pop esi
pop ebx
ret 4
push eax
mov eax, dword [edi]
mov ecx, dword [esi + 0x3c]
sub eax, dword [esi + ecx + 0x34]
push eax
push esi
call fcn.00430d6e
mov ecx, dword [edi + 5]
xchg edi, eax
pop eax
jb 0x408118
mov edx, dword [ebp - 0xc]
sub edx, edi
jb 0x408118
add edi, esi
sub edx, ecx
jb 0x408118
test ecx, ecx
je 0x40815d
lea eax, [eax + eax*4 + 0x11]
xor byte [edi], al
inc edi
dec ecx
jne 0x408153
ret

Function at 0x408dca
Capabilities:
Encode data using xor

Disassembly:
push edx
push ebx
push edi
mov ecx, ebx
mov edi, edx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebx + 0xc]
cmp byte [ebx], 1
je 0x408de6
mov eax, dword [esi + 0x4c]
dec eax
shr eax, 1
jne 0x408e07
jb 0x408e25
shr ecx, 2
je 0x408e07
cmp byte [ebx + 1], 0
mov ebx, dword [ebx + 4]
jne 0x408e0b
mov eax, dword [edi]
xor eax, edx
mov dword [edi], eax
add edi, 4
rol eax, 0x10
xor eax, ebx
add edx, eax
dec ecx
jne 0x408df4
pop edi
pop ebx
pop edx
ret
mov eax, dword [edi]
xor eax, edx
mov dword [edi], eax
add edi, 4
add edx, eax
add edx, ebx
dec ecx
jne 0x408e0b
jmp 0x408e07
xor byte [edi], dl
inc edi
dec ecx
jne 0x408e1d
jmp 0x408e07
cmp byte [ebx + 1], 0
jne 0x408e1d
movzx ebx, dl
sub ecx, 4
jb 0x408e07
imul ebx, ebx, 0x1010101
mov eax, dword [edi]
mov edx, eax
shr eax, 2
shl edx, 6
xor eax, ebx
xor eax, edx
and eax, 0x3f3f3f3f
xor eax, edx
mov dword [edi], eax
add edi, 4
sub ecx, 4
jae 0x408e39
and ecx, 3
je 0x408e07
mov al, byte [edi]
ror al, 2
xor al, bl
mov byte [edi], al
inc edi
dec ecx
jne 0x408e5d
jmp 0x408e07

Function at 0x409162
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
sub esp, 0x4c
lea ecx, [eax + 0xf]
mov edi, esp
push 0x8020
rep stosd dword es:[edi], eax
push ebx
push edx
add ecx, 8
mov dword [edi - 8], ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub edi, 0x10
sub esi, 0x10
lea edx, [edi - 0x40]
push edx
push edi
call fcn.0043204d
pop edx
mov eax, dword [edi + 0xc]
xor eax, dword [edx + 0xc]
push edx
push esi
push eax
mov eax, dword [edi + 8]
xor eax, dword [edx + 8]
push eax
mov eax, dword [edi + 4]
xor eax, dword [edx + 4]
push eax
mov eax, dword [edi]
xor eax, dword [edx]
push eax
mov esi, esp
call dword [esi + 0x70]
lea esp, [esi + 0x10]
pop esi
mov ecx, dword [edi - 8]
jae 0x4091c9
cmp ecx, 0x600
jb 0x409175
add esp, 0x58
stc
ret 4
push eax
shr ecx, 3
dec ecx
lea edx, [ebp - 0x1f]
push edx
push ecx
push 0
call fcn.0040202d
lea edx, [ebp + eax - 0x1f]
pop eax
mov byte [edx], 0x2e
mov dword [edx + 1], eax
add ebx, 0xf
shr ebx, 4
push 0x40
pop eax
cmp ebx, eax
jb 0x4091f3
xchg ebx, eax
pop edx
xor ecx, ecx
mov eax, dword [edi + ecx*4]
xor dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 4
jb 0x4091f6
dec ebx
je 0x409218
push edx
add dword [edi - 8], 8
lea edx, [edi - 0x40]
push edx
push edi
call fcn.0043204d
jmp 0x4091f3
pop ebx
add esp, 0x50
clc
ret 4
Function at 0x40a747
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
push eax
push edx
push ecx
push ecx
lea edi, [ebx + 3]
and edi, 0xfffffffc
add edi, esi
sub ebx, 0x17
jb 0x40a7a2
mov eax, esi
stosd dword es:[edi], eax
movzx eax, byte [esi + 4]
xor al, 0xff
push eax
push dword [ebp - 4]
call fcn.0043609e
mov byte [esi + 4], al
sub ebx, eax
jb 0x40a7a2
mov edx, dword [ebp - 8]
test eax, eax
je 0x40a796
test edx, edx
jns 0x40a78f
cmp eax, 4
jb 0x40a7a2
movzx edx, byte [esi + eax + 1]
xor edx, 0x2e
mov dword [ebp - 8], edx
xor byte [esi + 5], dl
inc esi
dec eax
jne 0x40a78f
mov eax, dword [esi + 0xf]
add esi, 0x17
stosd dword es:[edi], eax
dec dword [ebp - 0xc]
jne 0x40a756
sub dword [ebp + 0xc], ebx
pop eax
pop edx
sub eax, edx
leave
pop edi
pop esi
pop ebx
ret

Function at 0x40d025
Capabilities:
Encode data using xor

Disassembly:
pop edi
repe cmpsb byte [esi], byte es:[edi]
je 0x40d02d
stc
leave
ret
push dword [esi + 1]
call fcn.00430880
jb 0x40d02a
xchg edi, eax
lea edx, [esi + 5]
sub ebx, 0x14
mov al, byte [esi]
mov ecx, ebx
test al, al
je 0x40d04d
xor byte [esi + 5], al
inc esi
dec ecx
jne 0x40d046
push ebx
push edx
push dword [edx - 4]
push edi
call fcn.0043135d
push eax
push edi
call fcn.00401a2f
push edi
call fcn.004308ae
clc
leave
ret

Function at 0x40d192
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
test edi, edi
js 0x40d1da
cmp edi, 3
je 0x40d1da
and edi, 3
xor ecx, ecx
mov eax, dword [esi + ecx*4 + 0x24]
inc ecx
xor eax, ebx
cmp edi, 3
jne 0x40d1ba
rol eax, 0x10
shr eax, cl
mov dword [esi + ecx*4 + 0x20], eax
cmp ecx, 3
jb 0x40d1ab
cmp edi, 2
jb 0x40d1d4
xor dword [esi + ecx*4 - 0xc], ebx
inc ecx
cmp ecx, 0xa
jb 0x40d1ca
add esi, 0x30
dec edx
jne 0x40d1a9
pop esi
pop ebx
ret
Function at 0x40e6a2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, esp
push 0x4352b2
call fcn.00435281
xchg esi, eax
jae 0x40e708
xor edi, edi
mov dword [esi], edi
push edi
call fcn.00401708
insd dword es:[edi], dx
popal
push 0x69
jb 0x40e733
pop edi
imul esp, dword [ebp + 0x79], 0
jae 0x40e6f0
inc edi
call fcn.00401702
insd dword es:[edi], dx
popal
push 0x69
jb 0x40e746
pop edi
jae 0x40e74e
jb 0x40e6dc
jb 0x40e6e8
push eax
call fcn.004312b2
mov eax, esp
jmp 0x40e6f0
dec edi
call fcn.0040e7eb
jb 0x40e708
push eax
push 0x400
call fcn.00430880
pop edx
mov dword [esi], eax
jb 0x40e708
push edi
push edx
push eax
call fcn.0040e736
mov esi, dword [esi]
mov esp, ebx
cmp esi, 1
jb 0x40e730
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
test ebx, ebx
je 0x40e730
xor ecx, ecx
mov al, byte [esi + ecx]
inc ecx
xor byte [edx], al
inc edx
and ecx, 0x3ff
dec ebx
jne 0x40e71f
clc
pop edi
pop esi
pop ebx
ret 8
mov eax, ecx
push 8
pop edx
shr eax, 1
jae 0x40e74f
xor eax, 0xedb88320
in eax, dx
dec edx
jne 0x40e746
stosd dword es:[edi], eax
inc cl
jne 0x40e741
mov esi, dword [ebp + 0x18]
cmp dword [ebp + 0x1c], 0
je 0x40e77a
or eax, 0xffffffff
jmp 0x40e76f
mov dh, 0
xor dl, al
shr eax, 8
xor eax, dword [esp + edx*4]
movzx edx, byte [esi]
inc esi
test edx, edx
jne 0x40e765
not eax
xchg esi, eax
mov edi, dword [ebp + 0x14]
xor edx, edx
lea eax, [esi + edx]
movzx eax, al
mov eax, dword [esp + eax*4]
xor eax, esi
stosd dword es:[edi], eax
inc dl
jne 0x40e77f
leave
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x40e736
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
enter 0x400, 0
xor ecx, ecx
mov edi, esp

Function at 0x40f822
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x20]
xor esi, esi
mov ecx, dword [ebx]
mov eax, dword [ebp + 0x1c]
dec ecx
add eax, esi
xor edx, edx
div ecx
mov al, byte [ebx + edx + 4]
xor byte [edi + esi], al
inc esi
cmp esi, dword [ebp + 0x18]
jb 0x40f82d
leave
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x40f850
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x20]
shl edi, 2
dec edi
xor esi, esi
mov eax, dword [ebp + 0x1c]
xor edx, edx
add eax, esi
div edi
xchg edx, eax
xor edx, edx
mov ecx, eax
div dword [ebx]
mov al, byte [ebx + edx + 4]
add al, cl
inc edx
cmp edx, dword [ebx]
sbb ecx, ecx
and edx, ecx
xor al, byte [ebx + edx + 4]
mov edx, dword [ebp + 0x14]
add eax, dword [ebp + 0x18]
xor byte [edx + esi], al
inc esi
cmp esi, edi
jbe 0x40f85f
leave
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x40f8f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov esi, dword [ebp + 0x14]
xor ebx, ebx
xor edx, edx
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
adc ecx, 0
movsx edi, byte [esi + eax]
add edx, edi
add edi, eax
xor ebx, edi
inc eax
add ebx, ecx
cmp eax, ecx
jb 0x40f90c
mov edi, dword [ebp + 0x18]
movzx eax, bl
add ebx, edx
add eax, 0x40
stosd dword es:[edi], eax
dec eax
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x18], eax
mov eax, 0x8846ff0f
and ebx, eax
mov ax, bx
stosd dword es:[edi], eax
push 4
pop ecx
mov eax, ecx
cdq
div dword [ebp + 0x14]
mov al, byte [esi + edx]
xor eax, ebx
add ebx, ecx
add eax, ebx
stosb byte es:[edi], al
inc ecx
xchg ebx, eax
cmp ecx, dword [ebp + 0x18]
jb 0x40f93e
xor eax, eax
stosb byte es:[edi], al
leave
pop edi
pop esi
pop ebx
ret 8

Function at 0x41149e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
enter 0x400, 0
mov edi, esp
xor ecx, ecx
or eax, 0xffffffff
mov edx, ecx
shrd eax, edx, 2
shr eax, 6
shr edx, 2
test al, al
js 0x4114ae
stosd dword es:[edi], eax
inc cl
jne 0x4114a9
mov ecx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
imul ecx, dword [ebp + 0x1c]
xor eax, eax
lodsb al, byte [esi]
mov edx, dword [esp + eax*4]
shl edx, 2
lodsb al, byte [esi]
add edx, dword [esp + eax*4]
shl edx, 2
lodsb al, byte [esi]
add edx, dword [esp + eax*4]
shl edx, 2
lodsb al, byte [esi]
add edx, dword [esp + eax*4]
mov dword [esi - 4], edx
dec ecx
jne 0x4114cd
push 4
mov edi, dword [ebp + 0x14]
pop ecx
mov al, byte [edi]
shr al, 1
sbb dl, dl
xor al, dl
stosb byte es:[edi], al
dec ecx
jne 0x4114f2
mov ecx, dword [ebp + 0x18]
dec ecx
je 0x411516
shl ecx, 2
mov al, byte [edi]
shr al, 1
sbb dl, dl
xor al, dl
add al, byte [edi - 4]
stosb byte es:[edi], al
dec ecx
jne 0x411507
mov ebx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
shl ebx, 2
dec ecx
je 0x411536
imul ecx, ebx
neg ebx
mov al, byte [edi]
shr al, 1
sbb dl, dl
xor al, dl
add al, byte [edi + ebx]
stosb byte es:[edi], al
dec ecx
jne 0x411527
leave
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x412a38
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
lea edx, [ecx + 0x6f349]
shl eax, 5
xor al, 0xa5
imul eax, edx
mov edx, dword [esp + 4]
xor eax, 0x34a9b129
cmp ecx, 0x10
jbe 0x412a69
sub ecx, 0xd
sar ecx, 2
xor dword [edx + 0x10], eax
add edx, 4
dec ecx
jne 0x412a60
ret 8

Function at 0x413252
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
shr ecx, 1
je 0x413270
movzx eax, word [edx]
xchg ah, al
xor eax, 0x33cc
mov word [edx], ax
inc edx
inc edx
dec ecx
jne 0x41325e
ret 8

Function at 0x413516
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
add ecx, ebx
mov eax, dword [edx]
lea edi, [ebx + ecx]
sub eax, ecx
xor eax, ebx
sub ecx, 3
sub ebx, eax
shl edi, 7
shr ebx, 7
sub edx, 4
xor ebx, edi
cmp edx, esi
jae 0x41351a
pop edi
pop ebx
ret
Function at 0x41353d
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x14]
cmp eax, 8
jb 0x41358b
mov edi, dword [ebp + 0x18]
lea ecx, [eax - 4]
test al, 3
jne 0x41358b
add edi, ecx
add ecx, esi
mov eax, dword [edi]
lea edx, [esi + ecx]
sub eax, ecx
xor eax, esi
sub ecx, 3
sub esi, eax
mov dword [edi], eax
shl edx, 7
shr esi, 7
sub edi, 4
xor esi, edx
cmp edi, dword [ebp + 0x18]
jae 0x413559
mov ecx, dword [ebp + 0x1c]
mov eax, dword [edi + ecx - 4]
lea edx, [eax + 0xb]
and edx, 0xfffffffc
cmp edx, ecx
je 0x41358b
xchg ecx, eax
leave
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x415427
Capabilities:
Encode data using xor

Disassembly:
push edi
push ebp
mov ebp, esp
lea edi, [ebp + 0xc]
xor eax, eax
lodsb al, byte [esi]
xor al, 0x55
stosd dword es:[edi], eax
stosd dword es:[edi], eax
dec ecx
jne 0x41542f
mov al, 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
mov edi, 0x101
jmp 0x41545e
add esi, ecx
mov dword [ebp + edi*8 + 0xc], edx
mov dword [ebp + edi*8 + 0x10], esi
movzx ebx, dx
shr edx, 0x10
and dword [ebp + ebx*8 + 0x10], 0
and dword [ebp + edx*8 + 0x10], 0
inc edi
or esi, 0xffffffff
xor ebx, ebx
mov ecx, esi
mov eax, dword [ebp + ebx*8 + 0x10]
test eax, eax
je 0x415479
cmp eax, esi
jae 0x415479
shl edx, 0x10
mov esi, ecx
xchg ecx, eax
add edx, ebx
inc ebx
cmp ebx, edi
jb 0x415465
test esi, esi
jg 0x415443
xchg edi, eax
dec eax
pop esi
leave
pop edi
cmp eax, 0x101
ret

Function at 0x41682f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
push pe_nt_image_headers32
mov ebx, dword [ebp + 0x1c]
mov edi, ebx
mov eax, 0x3020100
stosd dword es:[edi], eax
add eax, 0x4040404
jae 0x416841
mov eax, dword [ebp + 0x14]
mov edi, eax
shl edi, 8
movzx esi, al
shr edi, 0x18
mov dl, byte [ebx + esi]
mov dh, byte [ebx + edi]
mov byte [ebx + edi], dl
mov byte [ebx + esi], dh
mov edi, eax
movzx esi, ah
shr edi, 0x18
mov dl, byte [ebx + esi]
mov dh, byte [ebx + edi]
mov byte [ebx + edi], dl
mov byte [ebx + esi], dh
ror eax, 2
imul eax, eax, 0x1a743125
add eax, dword [ebp + 0x18]
dec dword [ebp - 4]
jne 0x41684c
leave
pop edi
pop esi
pop ebx
ret 0xc