joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c2ac0
Capabilities:
Get disk information
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.004095e0
mov eax, dword [0x5cb004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x5c2ae9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe2aa2
jge 0x5c2b91
cmp dword [0x20a068c], 0xa5f
jne 0x5c2b35
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push 0x5c9a90
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84526b
jne 0x5c2b5a
mov eax, dword [0x5ccce0]
mov dword [0x20a068c], eax
mov ecx, dword [0x20a068c]
add ecx, 0xa231
mov dword [0x20a068c], ecx
cmp dword [0x20a068c], 0x141
jne 0x5c2b8c
push str.jisaxivemuvanacucoxoxobo_necogoduhutevepipojomaji_kadesezimini_joretevigusopibiyigibiga_wemakihumovuyo
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x5ce3a8], 0xec58acac
mov dword [0x5ce3ac], 0xffffffff
jmp 0x5c2ae0
call fcn.005c2810
jmp dword [0x20a0030]
Function at 0x403adc
Capabilities:
Access peb ldr_data
Encode data using xor
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x40a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x18]
push ebx
mov ebx, edx
mov dword [ebp - 0x58], ecx
push esi
mov eax, dword [eax + 0x30]
push edi
mov dword [ebp - 0x4c], ebx
mov edx, dword [eax + 0xc]
add edx, 0x14
mov dword [ebp - 0x54], edx
mov esi, dword [edx]
mov dword [ebp - 0x48], esi
cmp esi, edx
je 0x403c1a
push 0x3f
pop eax
xor ecx, ecx
cmp word [esi + 0x24], ax
jae 0x403c0d
mov eax, dword [esi + 0x28]
mov edi, ecx
cmp word [eax], cx
je 0x403b6b
mov esi, eax
cmp edi, 0x3f
jae 0x403b59
mov bl, byte [esi]
lea eax, [ebx - 0x20]
lea edx, [ebx - 0x61]
movzx ecx, al
cmp dl, 0x19
movzx eax, bl
cmova ecx, eax
add esi, 2
mov byte [ebp + edi - 0x44], cl
xor ecx, ecx
inc edi
cmp word [esi], cx
jne 0x403b31
mov esi, dword [ebp - 0x48]
cmp edi, 0x40
jae 0x403c3c
mov edx, dword [ebp - 0x54]
mov ebx, dword [ebp - 0x4c]
mov byte [ebp + edi - 0x44], cl
lea edi, [ebp - 0x44]
mov al, byte [ebp - 0x44]
mov ecx, 0x811c9dc5
jmp 0x403b8a
inc edi
movzx eax, al
xor eax, ecx
imul ecx, eax, 0x1000193
mov al, byte [edi]
test al, al
jne 0x403b7c
cmp ecx, ebx
jne 0x403c08
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x78]
add eax, ecx
mov edi, dword [eax + 0x20]
test edi, edi
je 0x403c08
mov ebx, dword [eax + 0x24]
add ebx, ecx
mov dword [ebp - 0x60], ebx
lea ebx, [edi + ecx]
mov dword [ebp - 0x50], ebx
xor edi, edi
mov ebx, dword [eax + 0x1c]
mov eax, dword [eax + 0x18]
add ebx, ecx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x5c], eax
test eax, eax
je 0x403c05
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x48], 0x811c9dc5
mov ebx, dword [eax + edi*4]
add ebx, ecx
mov al, byte [ebx]
test al, al
je 0x403bf7
mov edx, dword [ebp - 0x48]
inc ebx
movzx eax, al
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ebx]
test al, al
jne 0x403bdf
mov dword [ebp - 0x48], edx
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x48], eax
je 0x403c2b
inc edi
cmp edi, dword [ebp - 0x5c]
jb 0x403bc7
mov ebx, dword [ebp - 0x4c]
push 0x3f
pop eax
xor ecx, ecx
mov esi, dword [esi]
mov dword [ebp - 0x48], esi
cmp esi, edx
jne 0x403b1b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405050
leave
ret
mov eax, dword [ebp - 0x60]
mov edx, dword [ebp - 0x64]
movzx eax, word [eax + edi*2]
mov eax, dword [edx + eax*4]
add eax, ecx
jmp 0x403c1c
call fcn.0040536f
int3
Function at 0x40403a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov edx, 0x29cdd463
mov ecx, 0x41b1eab9
call fcn.00403adc
xor ebx, ebx
mov esi, eax
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], 0x79
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x15], 0x29
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x13], 0x55
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0x11], 0x3f
mov byte [ebp - 0x10], 0x6a
mov byte [ebp - 0xf], 0x3f
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 0xd], 0x2b
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 0xb], 0x55
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 9], 0x3f
mov byte [ebp - 8], 0x6a
mov byte [ebp - 7], 0x3f
mov byte [ebp - 6], 0x6a
mov byte [ebp - 5], 0x6a
mov byte [ebp - 4], 0x6a
mov al, byte [ebp - 0x17]
cmp byte [ebp - 0x18], bl
jne 0x4040d7
push edi
push 0x7f
pop edi
mov al, byte [ebp + ebx - 0x17]
movzx eax, al
push 0x6a
pop ecx
sub ecx, eax
imul eax, ecx, 0x23
cdq
idiv edi
lea eax, [edi + edx]
cdq
idiv edi
mov byte [ebp + ebx - 0x17], dl
inc ebx
cmp ebx, 0x14
jb 0x4040b4
pop edi
lea eax, [ebp - 0x17]
push eax
call esi
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x4046ed
Capabilities:
Encode data using xor

Disassembly:
push 0x24
mov eax, 0x406845
call fcn.00406024
mov esi, ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], edi
mov ebx, dword [0x40a404]
mov dword [esi], edi
push ebx
mov dword [ebp - 0x20], ebx
mov dword [esi + 4], edi
call fcn.00404c1c
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 1
test ebx, ebx
je 0x4047bf
mov ecx, dword [0x40a424]
mov eax, edi
mov dword [ebp - 0x24], ecx
xorps xmm0, xmm0
mov ecx, dword [0x40a400]
mov dword [ebp - 0x28], ecx
mov eax, dword [ecx + eax*8 + 4]
lea ecx, [ebp - 0x18]
push eax
mov dword [ebp - 0x1c], eax
movlpd qword [ebp - 0x18], xmm0
call fcn.00404f0b
or dword [ebp - 0x10], 2
xor ebx, ebx
cmp dword [ebp - 0x1c], ebx
jbe 0x40478c
mov esi, edi
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov eax, dword [eax + esi*8]
mov ecx, dword [ecx + esi*8]
mov dl, byte [eax + ebx]
mov eax, dword [ebp - 0x18]
xor dl, byte [ecx + ebx]
mov byte [eax + ebx], dl
inc ebx
cmp ebx, dword [ebp - 0x1c]
jb 0x40476b
mov esi, dword [ebp - 0x2c]
mov ecx, dword [esi]
lea eax, [ebp - 0x18]
push eax
mov eax, edi
shl eax, 3
add ecx, eax
call fcn.00404c9f
cmp dword [ebp - 0x18], 0
je 0x4047ad
push dword [ebp - 0x18]
call fcn.004051a3
pop ecx
and dword [ebp - 0x14], 0
and dword [ebp - 0x18], 0
inc edi
cmp edi, dword [ebp - 0x20]
jb 0x404732
mov eax, esi
call fcn.00406001
ret

Function at 0x405caa
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405ce9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405ce9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405ce9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405ce9
cmp dword [ecx + 0x74], 0xe
jbe 0x405ce9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40fd20
Capabilities:
Hash data using sha256

Disassembly:
push esi
push edi
push 0xf0
mov esi, ecx
push 0
push esi
mov edi, eax
call fcn.004538e0
mov dword [esi + 0x100], 0
mov byte [esi + 0x104], 0
mov eax, dword [esi + 0xf4]
mov dword [eax], 0x6a09e667
mov ecx, dword [esi + 0xf4]
mov dword [ecx + 4], 0xbb67ae85
mov edx, dword [esi + 0xf4]
mov dword [edx + 8], 0x3c6ef372
mov eax, dword [esi + 0xf4]
mov dword [eax + 0xc], 0xa54ff53a
mov ecx, dword [esi + 0xf4]
mov dword [ecx + 0x10], 0x510e527f
mov edx, dword [esi + 0xf4]
mov dword [edx + 0x14], 0x9b05688c
mov eax, dword [esi + 0xf4]
mov edx, dword [esp + 0x18]
mov dword [eax + 0x18], 0x1f83d9ab
mov ecx, dword [esi + 0xf4]
mov dword [ecx + 0x1c], 0x5be0cd19
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov eax, dword [esi + 0xf4]
xor dword [eax + 8], edx
mov esi, dword [esi + 0xf4]
or edi, 0x2000
shl edi, 0x10
xor dword [esi + 0xc], edi
add esp, 0xc
pop edi
pop esi
ret 4
Function at 0x410f20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x460fab
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x46aee0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
lea edi, [esi + 0x14]
mov ecx, edi
call fcn.00434760
mov eax, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esi], eax
mov dword [esi + 0x3c], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], 1
call fcn.00446c10
mov ecx, dword [esi]
push 0x40000
push ecx
push 0x410e10
mov ecx, edi
mov dword [esi + 4], eax
call fcn.00434780
mov ecx, edi
call fcn.00434730
mov dword [esi + 0x10], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x411610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x460fdb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x46aee0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esi + 8]
push eax
mov dword [esp + 0x1c], 0
call fcn.00453d40
mov eax, dword [esi + 0x30]
add esp, 4
test eax, eax
je 0x411674
mov ecx, dword [eax - 4]
lea edi, [eax - 4]
push 0x410fc0
push ecx
push 0x8a4
push eax
call fcn.004540bb
push edi
call fcn.00453d40
add esp, 4
mov edx, dword [esi + 4]
push edx
call fcn.00446ab0
lea ecx, [esi + 0x14]
mov dword [esp + 0x18], 0xffffffff
call fcn.00434720
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x416e00
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebp, eax
mov byte [esp + 0x13], 1
push 0
push 0
push ebp
call fcn.00445c90
test eax, eax
je 0x416e8d
sub eax, ebp
sar eax, 1
add eax, 2
mov edi, eax
lea eax, [edi + edi]
push eax
call fcn.00454317
mov esi, eax
add esp, 4
test esi, esi
je 0x416e8d
push edi
push esi
push ebp
call fcn.00445c90
mov ebp, eax
test ebp, ebp
je 0x416e8d
cmp byte [esp + 0x13], 0
mov bl, 1
jne 0x416e72
cmp byte [esp + 0x1c], 0
mov ecx, dword [esp + 0x14]
push esi
je 0x416e6d
call fcn.00416c90
mov bl, al
jmp 0x416e72
call fcn.004169e0
push esi
call fcn.00453634
add esp, 4
cmp byte [esp + 0x1c], 0
je 0x416e86
test bl, bl
je 0x416e8d
mov byte [esp + 0x13], 0
jmp 0x416e18
cmp byte [esp + 0x1c], 0
pop edi
pop esi
pop ebp
pop ebx
jne 0x416ea1
mov ecx, dword [esp + 4]
call fcn.00414870
add esp, 8
ret 0xc
Function at 0x417650
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x80c
mov eax, dword [0x46aee0]
xor eax, esp
mov dword [esp + 0x808], eax
mov eax, dword [esp + 0x810]
push esi
mov esi, ecx
push 0x400
lea ecx, [esp + 0x10]
push ecx
push eax
call fcn.00445d40
call fcn.00455488
add eax, 0x20
cmp esi, eax
jne 0x417693
cmp byte [0x46d499], 0
jne 0x4176b0
call fcn.00455488
add eax, 0x40
cmp esi, eax
jne 0x417745
cmp byte [0x46d49a], 0
je 0x417745
push edi
push 0
lea edx, [esp + 0x14]
push edx
push 0x1800
push 0x46eca8
call fcn.004535cb
add esp, 0x14
push 0x1800
push 0x46d4a8
push 0x46eca8
call fcn.00447360
push 0x46d4a8
push 0x46d4a8
call dword [sym.imp.USER32.dll_CharToOemA]
call fcn.00455488
xor ecx, ecx
add eax, 0x20
cmp esi, eax
sete cl
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0x46d4a8
lea esi, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x417710
push 0
lea edx, [esp + 0xc]
push edx
sub ecx, esi
push ecx
push 0x46d4a8
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0045334a
add esp, 0x80c
ret 4
push edi
push 0
lea eax, [esp + 0x14]
push eax
push 0x1800
push 0x46eca8
call fcn.004535cb
add esp, 0x14
call fcn.00455488
xor ecx, ecx
add eax, 0x40
cmp esi, eax
setne cl
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0x46eca8
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x417780
push 0
sub ecx, esi
lea edx, [esp + 8]
push edx
sar ecx, 1
push ecx
push 0x46eca8
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov ecx, dword [esp + 0x80c]
pop esi
xor ecx, esp
call fcn.0045334a
add esp, 0x80c
ret 4

Function at 0x418320
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x41834f
test cl, 7
je 0x41834f
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4794b0]
dec esi
inc ecx
test esi, esi
ja 0x418332
cmp esi, 8
jb 0x4183e8
mov edi, esi
push ebx
shr edi, 3
push ebp
nop
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x4798b0]
mov dword [esp + 0x14], ecx
mov ebp, edx
shr ebp, 0x18
xor ebx, dword [ebp*4 + 0x4794b0]
mov ecx, edx
shr ecx, 8
movzx ebp, cl
xor ebx, dword [ebp*4 + 0x479cb0]
mov ebp, eax
shr ebp, 0x18
xor ebx, dword [ebp*4 + 0x47a4b0]
mov ecx, eax
shr ecx, 0x10
movzx ebp, cl
xor ebx, dword [ebp*4 + 0x47a8b0]
mov ecx, eax
shr ecx, 8
movzx ebp, cl
xor ebx, dword [ebp*4 + 0x47acb0]
mov ecx, dword [esp + 0x14]
movzx edx, dl
xor ebx, dword [edx*4 + 0x47a0b0]
movzx eax, al
xor ebx, dword [eax*4 + 0x47b0b0]
sub esi, 8
add ecx, 8
sub edi, 1
mov eax, ebx
jne 0x418360
pop ebp
pop ebx
test esi, esi
jbe 0x418408
lea esp, [esp]
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4794b0]
dec esi
inc ecx
test esi, esi
ja 0x4183f0
pop edi
pop esi
ret 0xc
Function at 0x4186a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
test esi, esi
jbe 0x4186e3
test bl, 7
je 0x4186df
movzx ecx, byte [ebx]
movzx edi, al
shrd eax, edx, 8
xor ecx, edi
xor eax, dword [ecx*8 + 0x4754b0]
shr edx, 8
xor edx, dword [ecx*8 + 0x4754b4]
dec esi
inc ebx
test esi, esi
ja 0x4186b7
mov dword [esp + 0x1c], esi
mov ecx, esi
shr ecx, 3
lea ecx, [ebx + ecx*8]
mov dword [esp + 0x18], ecx
cmp ebx, ecx
jae 0x4187d1
push ebp
mov ecx, dword [ebx]
xor ecx, eax
mov eax, dword [ebx + 4]
xor eax, edx
mov edx, eax
shr edx, 0x10
movzx esi, dl
mov edi, dword [esi*8 + 0x475cb0]
mov esi, dword [esi*8 + 0x475cb4]
mov edx, eax
shr edx, 0x18
movzx edx, dl
xor edi, dword [edx*8 + 0x4754b0]
xor esi, dword [edx*8 + 0x4754b4]
mov edx, eax
shr edx, 8
movzx edx, dl
xor edi, dword [edx*8 + 0x4764b0]
xor esi, dword [edx*8 + 0x4764b4]
movzx edx, al
xor edi, dword [edx*8 + 0x476cb0]
xor esi, dword [edx*8 + 0x476cb4]
mov ebp, eax
mov edx, ecx
shrd edx, ebp, 0x18
movzx edx, dl
xor edi, dword [edx*8 + 0x4774b0]
xor esi, dword [edx*8 + 0x4774b4]
shr ebp, 0x18
mov ebp, eax
mov edx, ecx
shrd edx, ebp, 0x10
movzx edx, dl
xor edi, dword [edx*8 + 0x477cb0]
xor esi, dword [edx*8 + 0x477cb4]
mov edx, ecx
shrd edx, eax, 8
mov dword [esp + 0x18], eax
shr eax, 8
movzx eax, dl
xor edi, dword [eax*8 + 0x4784b0]
xor esi, dword [eax*8 + 0x4784b4]
movzx eax, cl
xor esi, dword [eax*8 + 0x478cb4]
xor edi, dword [eax*8 + 0x478cb0]
add ebx, 8
shr ebp, 0x10
mov eax, edi
mov edx, esi
cmp ebx, dword [esp + 0x1c]
jb 0x4186f8
mov esi, dword [esp + 0x20]
pop ebp
and esi, 7
jbe 0x4187f9
movzx ecx, byte [ebx]
movzx edi, al
shrd eax, edx, 8
xor ecx, edi
xor eax, dword [ecx*8 + 0x4754b0]
shr edx, 8
xor edx, dword [ecx*8 + 0x4754b4]
dec esi
inc ebx
test esi, esi
ja 0x4187d6
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x418800
Capabilities:
Encode data using xor

Disassembly:
xor dl, dl
push esi
mov esi, dword [esp + 8]
mov byte [ecx + 0xbfe], dl
mov byte [ecx + 0xbfd], dl
mov byte [ecx + 0xbfc], dl
mov al, byte [esi]
cmp al, dl
je 0x418844
push ebx
mov bl, byte [ecx + 0xbfe]
add byte [ecx + 0xbfc], al
xor byte [ecx + 0xbfd], al
add bl, al
rol bl, 1
inc esi
mov byte [ecx + 0xbfe], bl
mov al, byte [esi]
cmp al, dl
jne 0x418820
pop ebx
pop esi
ret 4
Function at 0x418850
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x6ec]
push eax
call fcn.004181d0
mov edi, dword [esp + 0xc]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418870
sub eax, edx
push eax
push edi
push 0xffffffffffffffff
call fcn.00418320
mov word [esi + 0xc00], ax
shr eax, 0x10
xor ecx, ecx
xor edx, edx
mov word [esi + 0xc02], ax
mov word [esi + 0xc06], cx
mov word [esi + 0xc04], dx
mov al, byte [edi]
test al, al
je 0x4188e6
mov edx, edi
lea ecx, [ecx]
movzx ecx, al
mov di, word [esi + ecx*4 + 0x6ec]
lea ecx, [esi + ecx*4 + 0x6ec]
movzx ax, al
xor di, ax
xor word [esi + 0xc04], di
mov cx, word [ecx + 2]
add cx, ax
add word [esi + 0xc06], cx
mov al, byte [edx + 1]
inc edx
test al, al
jne 0x4188b0
pop edi
pop esi
ret 4

Function at 0x418950
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
mov eax, ecx
test edi, edi
je 0x418a0a
push ebx
push esi
mov esi, dword [esp + 0x10]
jmp 0x418970
mov ecx, 0x1234
add word [eax + 0xc00], cx
movzx ecx, word [eax + 0xc00]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [eax + edx*4 + 0x6ec]
xor word [eax + 0xc02], dx
mov bx, word [eax + 0xc06]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [eax + edx*4 + 0x6ee]
sub word [eax + 0xc04], dx
movzx edx, word [eax + 0xc04]
xor edx, ecx
mov word [eax + 0xc00], dx
mov edx, 1
mov ecx, edx
dec edi
ror bx, cl
inc esi
xor bx, word [eax + 0xc02]
ror bx, cl
movzx ecx, bx
xor word [eax + 0xc00], cx
mov word [eax + 0xc06], cx
movzx ecx, word [eax + 0xc00]
shr ecx, 8
xor byte [esi - 1], cl
test edi, edi
jne 0x418970
pop esi
pop ebx
pop edi
ret 8

Function at 0x418a10
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov eax, dword [esp + 4]
inc eax
mov edx, 4
push esi
jmp 0x418a20
movzx esi, byte [eax - 1]
mov esi, dword [ecx + esi*4 + 0x6ec]
xor dword [ecx + 0xbec], esi
movzx esi, byte [eax]
mov esi, dword [ecx + esi*4 + 0x6ec]
xor dword [ecx + 0xbf0], esi
movzx esi, byte [eax + 1]
mov esi, dword [ecx + esi*4 + 0x6ec]
xor dword [ecx + 0xbf4], esi
movzx esi, byte [eax + 2]
mov esi, dword [ecx + esi*4 + 0x6ec]
xor dword [ecx + 0xbf8], esi
add eax, 4
sub edx, 1
jne 0x418a20
pop esi
ret 4
Function at 0x418ef0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x1d8
mov eax, dword [0x46aee0]
xor eax, esp
mov dword [esp + 0x1d4], eax
mov eax, dword [esp + 0x1ec]
push ebx
mov ebx, dword [esp + 0x1e8]
push esi
mov esi, dword [esp + 0x1e8]
push edi
mov edi, dword [esp + 0x1e8]
mov dword [esp + 0xc], eax
cmp esi, 0x40
jbe 0x418f69
lea ecx, [esp + 0xf0]
push ecx
call fcn.00444fa0
push esi
push edi
lea edx, [esp + 0xf8]
push edx
call fcn.00445450
lea eax, [esp + 0x1a0]
push eax
lea ecx, [esp + 0xf4]
push ecx
call fcn.00445500
lea edi, [esp + 0x1a0]
mov esi, 0x20
xor eax, eax
test esi, esi
jbe 0x418f95
push ebp
mov ebp, edi
lea edx, [esp + 0x164]
sub ebp, edx
jmp 0x418f80
lea ecx, [esp + eax + 0x164]
mov dl, byte [ecx + ebp]
xor dl, 0x36
inc eax
mov byte [ecx], dl
cmp eax, esi
jb 0x418f80
pop ebp
cmp esi, 0x40
jae 0x418fb4
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x164]
push 0x36
push eax
call fcn.004538e0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
call fcn.00444fa0
push 0x40
lea eax, [esp + 0x164]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00445450
mov edx, dword [esp + 0x1f4]
push edx
push ebx
lea eax, [esp + 0x18]
push eax
call fcn.00445450
lea ecx, [esp + 0x1c0]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.00445500
lea eax, [esp + 0x80]
push eax
call fcn.00444fa0
xor eax, eax
test esi, esi
jbe 0x419027
lea ecx, [esp + 0x160]
sub edi, ecx
lea ecx, [esp + eax + 0x160]
mov dl, byte [edi + ecx]
xor dl, 0x5c
inc eax
mov byte [ecx], dl
cmp eax, esi
jb 0x419013
cmp esi, 0x40
jae 0x419046
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x164]
push 0x5c
push eax
call fcn.004538e0
add esp, 0xc
push 0x40
lea edx, [esp + 0x164]
push edx
lea eax, [esp + 0x88]
push eax
call fcn.00445450
push 0x20
lea ecx, [esp + 0x1c4]
push ecx
lea edx, [esp + 0x88]
push edx
call fcn.00445450
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x84]
push ecx
call fcn.00445500
mov ecx, dword [esp + 0x1e0]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045334a
add esp, 0x1d8
ret 0x14
Function at 0x4190a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc8
mov eax, dword [0x46aee0]
xor eax, esp
mov dword [esp + 0xc4], eax
mov ecx, dword [esp + 0xe4]
mov eax, dword [esp + 0xd4]
push ebx
mov ebx, dword [esp + 0xe4]
push ebp
mov ebp, dword [esp + 0xe4]
push esi
mov esi, dword [esp + 0xe4]
push edi
mov edi, dword [esp + 0xdc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
mov ecx, esi
cmp esi, 0x40
jb 0x4190f6
mov ecx, 0x40
push ecx
push eax
lea edx, [esp + 0x78]
push edx
call fcn.004543f0
mov edx, dword [esp + 0xec]
add esp, 0xc
lea eax, [esp + 0x50]
push eax
mov byte [esp + esi + 0x74], 0
mov byte [esp + esi + 0x75], 0
mov byte [esp + esi + 0x76], 0
mov byte [esp + esi + 0x77], 1
add esi, 4
push esi
lea ecx, [esp + 0x78]
push ecx
push edx
push edi
call fcn.00418ef0
mov eax, dword [esp + 0xf8]
dec eax
mov ecx, 8
lea esi, [esp + 0x50]
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, 0x10
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ecx
xor ebx, ebx
nop
mov eax, dword [esp + ebx + 0x24]
test eax, eax
jbe 0x4191f1
mov ebp, eax
lea ebx, [ebx]
mov ecx, dword [esp + 0xe0]
lea edx, [esp + 0xb4]
push edx
mov edx, dword [esp + 0x18]
push 0x20
lea eax, [esp + 0x58]
push eax
push ecx
push edx
call fcn.00418ef0
mov ecx, 8
lea esi, [esp + 0xb4]
lea edi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
jmp 0x4191c0
movzx ecx, byte [esp + eax + 0x50]
movzx edx, byte [esp + eax + 0x51]
xor byte [esp + eax + 0x30], cl
xor byte [esp + eax + 0x31], dl
movzx ecx, byte [esp + eax + 0x52]
movzx edx, byte [esp + eax + 0x53]
xor byte [esp + eax + 0x32], cl
xor byte [esp + eax + 0x33], dl
add eax, 4
cmp eax, 0x20
jb 0x4191c0
sub ebp, 1
jne 0x419180
mov edi, dword [esp + ebx + 0x18]
add ebx, 4
mov ecx, 8
lea esi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
cmp ebx, 0xc
jb 0x419170
push 0x44
lea eax, [esp + 0x74]
push eax
call fcn.00443160
push 0x20
lea ecx, [esp + 0x34]
push ecx
call fcn.00443160
push 0x20
lea edx, [esp + 0x54]
push edx
call fcn.00443160
push 0x20
lea eax, [esp + 0xb8]
push eax
call fcn.00443160
mov ecx, dword [esp + 0xd4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045334a
add esp, 0xc8
ret 0x20
Function at 0x419630
Capabilities:
Encode data using xor
Generate random numbers via winapi

Disassembly:
sub esp, 0xc
push ebx
push ebp
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebp, dword [esp + 0x1c]
test eax, eax
je 0x419683
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 8]
push ecx
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
cmp eax, 1
mov eax, dword [esp + 8]
push 0
push eax
sete bl
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test bl, bl
jne 0x4196e7
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.00446e10
lea ecx, [esp + 0x14]
call fcn.00446d60
lea ecx, [esp + 0x14]
call fcn.00446d40
mov esi, eax
mov edi, edx
call fcn.0045563d
cdq
add esi, eax
adc edi, edx
xor ebx, ebx
test ebp, ebp
jbe 0x4196e5
mov ecx, ebx
and ecx, 7
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov eax, esi
mov edx, edi
call fcn.004558b0
mov edx, dword [esp + 0x20]
mov cl, al
mov eax, dword [0x47b970]
xor cl, bl
add cl, al
mov byte [ebx + edx], cl
inc eax
inc ebx
mov dword [0x47b970], eax
cmp ebx, ebp
jb 0x4196b4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8