joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413e90
Capabilities:
Get common file path
Get disk information
Query environment variable

Disassembly:
mov eax, 0x2004
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x2000], eax
push esi
mov esi, dword [esp + 0x200c]
push edi
push 0x800
push 0x4d69fc
lea ecx, [esp + 0x10]
push ecx
push str.TempFolder
xor eax, eax
push str.Paths
mov word [esi], ax
call fcn.0046bcb0
cmp word [esp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
jne 0x413efb
cmp byte [0x54ecd0], 0
je 0x413fa4
lea edx, [esp + 8]
push edx
push 0x800
call edi
push 0x800
lea eax, [esp + 0x100c]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jle 0x413f38
cmp eax, 0x800
jae 0x413f38
push 0x800
lea edx, [esp + 0x100c]
push edx
lea eax, [esp + 0x10]
push eax
call fcn.004c193c
add esp, 0xc
lea ecx, [esp + 8]
push ecx
call fcn.0043c780
test al, al
jne 0x413f52
lea edx, [esp + 8]
push edx
push 0x800
call edi
push 1
push str.TempRemovableOnly
push str.Paths
call fcn.0046bce0
mov edi, dword [esp + 0x2014]
test eax, eax
je 0x413f91
cmp byte [0x54ecd0], 0
jne 0x413f91
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x413f89
cmp eax, 5
jne 0x413f9d
push edi
lea eax, [esp + 0xc]
push eax
jmp 0x413f97
push edi
lea ecx, [esp + 0xc]
push ecx
push esi
call fcn.0047e340
push edi
push esi
call fcn.0045f4a0
mov ecx, dword [esp + 0x2008]
pop edi
pop esi
xor ecx, esp
call fcn.004bfc52
add esp, 0x2004
ret 8
Function at 0x417bc0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x148
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x1004], eax
test eax, eax
jne 0x417c0f
push ebx
call fcn.0049d940
test eax, eax
je 0x417c04
cmp eax, 0x20
je 0x417c04
push ebx
push eax
push 0x20
push 0x5c8
call fcn.004744a0
push eax
call fcn.004ab990
add esp, 0x10
pop esi
xor al, al
pop ebx
add esp, 0x148
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Prepare
push eax
call edi
mov dword [esi + 0x11e0], eax
mov eax, dword [esi + 0x1004]
push str.Open
push eax
call edi
mov ecx, dword [esi + 0x1004]
push str.Close
push ecx
mov dword [esi + 0x11e4], eax
call edi
mov edx, dword [esi + 0x1004]
push str.GetNextName
push edx
mov dword [esi + 0x11e8], eax
call edi
mov dword [esi + 0x11ec], eax
mov eax, dword [esi + 0x1004]
push str.GetListItem
push eax
call edi
mov ecx, dword [esi + 0x1004]
push str.Extract
push ecx
mov dword [esi + 0x11f0], eax
call edi
mov edx, dword [esi + 0x1004]
push str.GetComment
push edx
mov dword [esi + 0x11f4], eax
call edi
cmp dword [esi + 0x11e0], 0
mov dword [esi + 0x11f8], eax
je 0x417e1e
cmp dword [esi + 0x11e4], 0
je 0x417e1e
push 0x148
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004c05a0
add esp, 0xc
mov dword [esp + 0xc], 0x148
mov dword [esp + 0x10], 0x413380
mov dword [esp + 0x14], 0x4134c0
mov dword [esp + 0x18], 0x413520
mov dword [esp + 0x44], 0x413530
mov dword [esp + 0x20], 0x413540
mov dword [esp + 0x2c], 0x4136c0
mov dword [esp + 0x30], 0x4136e0
mov dword [esp + 0x38], 0x4136f0
mov dword [esp + 0x3c], 0x4153c0
mov dword [esp + 0x34], 0x415580
mov dword [esp + 0x48], 0x4137d0
mov dword [esp + 0x4c], 0x4137e0
mov dword [esp + 0x24], 0x4137f0
mov dword [esp + 0x54], 0x4138c0
mov dword [esp + 0x28], 0x413940
mov dword [esp + 0x40], 0x413a70
mov dword [esp + 0x58], 0x413aa0
mov dword [esp + 0x5c], 0x413ab0
mov dword [esp + 0x60], 0x413ac0
mov dword [esp + 0x64], 0x413ad0
mov dword [esp + 0x1c], 0x4179e0
mov dword [esp + 0x50], 0x413ae0
mov dword [esp + 0x68], 0x413b40
call fcn.0044a940
push 0x1d8
lea edi, [esi + 0x1008]
push 0
push edi
mov dword [esp + 0xe4], eax
call fcn.004c05a0
mov edx, dword [esi + 0x11e0]
add esp, 0xc
push edi
lea ecx, [esp + 0x10]
push ecx
mov dword [edi], 0x1d8
mov dword [esi + 0x100c], 2
mov dword [esi + 0x1010], 0x50001
call edx
test al, al
je 0x417ded
cmp dword [esi + 0x100c], 2
jne 0x417ded
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x148
ret
mov eax, dword [esi + 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
mov dword [esi + 0x1004], 0
call fcn.0045f900
push eax
push 0x42e
call fcn.004744a0
push eax
call fcn.004ab990
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x148
ret
Function at 0x41b560
Capabilities:
Hash data using sha256

Disassembly:
push edi
push 0xc0
push 0
push esi
mov edi, eax
call fcn.004c05a0
mov eax, dword [esp + 0x14]
or edi, 0x2000
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
xor dword [esi], 0x2080020
xor dword [esi + 8], eax
shl edi, 0x10
xor dword [esi + 0xc], edi
add esp, 0xc
pop edi
ret 4

Function at 0x41b5d0
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x200
xor ebp, ebp
lea eax, [edi + 0x6c0]
push ebp
push eax
call fcn.004c05a0
add esp, 0xc
push ebp
lea esi, [edi + 0x600]
lea eax, [ebp + 1]
mov dword [edi + 0x8c0], ebp
call fcn.0041b560
lea esi, [edi + 0x10]
push 0xc0
lea edi, [esi - 0x10]
push 0
push edi
call fcn.004c05a0
mov dword [esi - 0xc], 0xbb67ae85
mov dword [esi - 8], 0x3c6ef372
mov dword [esi - 4], 0xa54ff53a
mov dword [esi], 0x510e527f
mov dword [esi + 4], 0x9b05688c
mov dword [esi + 8], 0x1f83d9ab
mov dword [esi + 0xc], 0x5be0cd19
mov dword [edi], 0x6a09e667
xor dword [esi - 8], ebp
xor dword [esi - 4], 0x20000000
xor dword [edi], 0x2080020
inc ebp
add esp, 0xc
add esi, 0xc0
cmp ebp, 8
jb 0x41b606
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov byte [eax + 0x6b4], 1
mov byte [eax + 0x5f4], 1
pop ebp
ret 4
Function at 0x41d4b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d191b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4ea93c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
lea edi, [esi + 0x14]
mov ecx, edi
call fcn.00464540
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x24]
mov dword [esi], eax
mov dword [esi + 0x3c], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], 1
call fcn.00481460
mov ecx, dword [esi]
push 0x40000
push ecx
push 0x41e140
mov ecx, edi
mov dword [esi + 4], eax
call fcn.00464560
mov ecx, edi
call fcn.00464510
mov dword [esi + 0x10], ebx
mov dword [esp + 0x1c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x41dc30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d198b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ea93c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 0
mov eax, dword [esi + 8]
push eax
call fcn.004c061a
mov eax, dword [esi + 0x30]
add esp, 4
test eax, eax
je 0x41dc94
mov ecx, dword [eax - 4]
lea edi, [eax - 4]
push 0x41d550
push ecx
push 0x8a4
push eax
call fcn.004c099b
push edi
call fcn.004c061a
add esp, 4
mov edx, dword [esi + 4]
push edx
call fcn.00481300
mov dword [esp + 0x18], 0xffffffff
lea ecx, [esi + 0x14]
call fcn.00464500
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x422d90
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebp, eax
mov byte [esp + 0x13], 1
push 0
push 0
push ebp
call fcn.0047e4c0
test eax, eax
je 0x422e1d
sub eax, ebp
sar eax, 1
add eax, 2
mov edi, eax
lea eax, [edi + edi]
push eax
call fcn.004c0bc4
mov esi, eax
add esp, 4
test esi, esi
je 0x422e1d
push edi
push esi
push ebp
call fcn.0047e4c0
mov ebp, eax
test ebp, ebp
je 0x422e1d
cmp byte [esp + 0x13], 0
mov bl, 1
jne 0x422e02
cmp byte [esp + 0x1c], 0
mov ecx, dword [esp + 0x14]
push esi
je 0x422dfd
call fcn.00422c70
mov bl, al
jmp 0x422e02
call fcn.004229b0
push esi
call fcn.004bff04
add esp, 4
cmp byte [esp + 0x1c], 0
je 0x422e16
test bl, bl
je 0x422e1d
mov byte [esp + 0x13], 0
jmp 0x422da8
cmp byte [esp + 0x1c], 0
pop edi
pop esi
pop ebp
pop ebx
jne 0x422e31
mov ecx, dword [esp + 4]
call fcn.00420da0
add esp, 8
ret 0xc
Function at 0x422ef0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x804
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
mov ebx, dword [esp + 0x80c]
push esi
xor eax, eax
push edi
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x400
lea ecx, [esp + 0x10]
push ecx
push eax
xor edi, edi
call fcn.0047e4c0
mov esi, eax
test esi, esi
je 0x422f85
test edi, edi
jne 0x422f3c
mov edi, 1
jmp 0x422f67
movzx edx, word [esp + 0xc]
push edx
mov ecx, 0x5448f8
call fcn.004206c0
test al, al
jne 0x422f67
cmp edi, 1
jne 0x422f66
mov ax, word [esp + 0xc]
mov cx, word [esp + 0xe]
mov word [ebx], ax
mov word [ebx + 2], cx
inc edi
push 0x400
lea edx, [esp + 0x10]
push edx
push esi
call fcn.0047e4c0
mov esi, eax
test esi, esi
jne 0x422f31
cmp edi, 2
jne 0x422f85
mov word [ebx], ax
mov ecx, dword [esp + 0x80c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004bfc52
add esp, 0x804
ret 4
Function at 0x4238b0
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
mov eax, 0x1010
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x100c], eax
push esi
xor esi, esi
cmp dword [0x550d28], esi
je 0x423a94
push esi
push 1
push 0x54fd12
mov ecx, 0x540eb0
call fcn.004183d0
cmp eax, 1
jne 0x423a94
cmp dword [0x548910], 3
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 4], esi
push eax
jne 0x42391e
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x540eb0
call fcn.004150a0
jmp 0x423932
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
mov ecx, 0x540eb0
call fcn.00414fc0
cmp dword [esp + 4], esi
je 0x423a94
push 0x800
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x550d14
call fcn.0047e9b0
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4239a2
push esi
push esi
push 0x7fffffff
push 0x7fffffff
lea eax, [esp + 0x20]
push eax
push esi
call fcn.0040b3b0
cmp al, 0x43
je 0x42397f
cmp al, 0x4e
jne 0x4239a2
mov ecx, dword [esp + 8]
push ecx
call fcn.004c061a
add esp, 4
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.004bfc52
add esp, 0x1010
ret
push edi
push 0x4d73cc
lea edx, [esp + 0x18]
push edx
call fcn.0043c420
mov edi, eax
cmp edi, esi
jne 0x4239f6
lea eax, [esp + 0x14]
push eax
push 0x1f6
call fcn.004744a0
push eax
push 0x54fd12
call fcn.004abfe0
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004c061a
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.004bfc52
add esp, 0x1010
ret
mov eax, dword [0x548910]
cmp eax, 3
jne 0x423a4b
push edi
push 0xff
call fcn.004c25f8
push edi
push 0xfe
call fcn.004c25f8
add esp, 0x10
cmp dword [esp + 8], esi
jbe 0x423a76
nop
mov edx, dword [esp + 0x10]
movzx eax, word [edx + esi*2]
push edi
push eax
call fcn.004c25f8
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + esi*2 + 1]
push edi
push edx
call fcn.004c25f8
inc esi
add esp, 0x10
cmp esi, dword [esp + 8]
jb 0x423a20
jmp 0x423a76
cmp eax, 2
jne 0x423a61
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
push eax
call dword [sym.imp.USER32.dll_CharToOemBuffA]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push edi
push ecx
push 1
push edx
call fcn.004c2576
add esp, 0x10
push edi
call fcn.004c2398
mov eax, dword [esp + 0x10]
push eax
call fcn.004c061a
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004c061a
add esp, 0xc
pop edi
mov ecx, dword [esp + 0x1010]
pop esi
xor ecx, esp
call fcn.004bfc52
add esp, 0x1010
ret
Function at 0x426290
Capabilities:
Read file via mapping

Disassembly:
mov eax, 0x3024
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x3020], eax
push esi
push str.winrar_config_integration
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
mov dword [esp + 4], esi
test esi, esi
je 0x4263ca
push ebp
push 0x10000
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebp, eax
test ebp, ebp
jne 0x4262fd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop esi
mov ecx, dword [esp + 0x3020]
xor ecx, esp
call fcn.004bfc52
add esp, 0x3024
ret
cmp byte [ebp], 0x49
push ebx
push edi
mov ebx, ebp
jne 0x426364
cmp byte [ebp + 1], 0x1a
jne 0x426364
lea esi, [ebp + 2]
mov ecx, 6
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x1030]
movsw word es:[edi], word [esi]
push eax
lea edi, [ebp + 0x1c]
mov ebx, 0x400
call fcn.00426240
lea ecx, [esp + 0x30]
push ecx
mov edi, eax
call fcn.00426240
mov ebx, eax
test ebx, ebx
je 0x426360
push 0
lea edx, [esp + 0x18]
push edx
call fcn.0044a7d0
lea edi, [esp + 0x30]
lea esi, [esp + 0x1030]
call fcn.00426140
mov esi, dword [esp + 0x10]
cmp byte [ebx], 0x54
jne 0x4263b9
lea eax, [esp + 0x2030]
lea edi, [ebx + 1]
push eax
mov ebx, 0x800
call fcn.00426240
lea ecx, [esp + 0x30]
push ecx
mov edi, eax
call fcn.00426240
lea edx, [esp + 0x1030]
push edx
mov edi, eax
call fcn.00426240
test eax, eax
je 0x4263b9
push 0
lea eax, [esp + 0x1034]
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x203c]
push edx
call fcn.0044a330
push ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x3024]
pop esi
xor ecx, esp
call fcn.004bfc52
add esp, 0x3024
ret
Function at 0x4275c0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4440
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x443c], eax
push ebx
push 0x800
lea eax, [esp + 0x44]
push eax
call fcn.0045fce0
push 0x800
lea ecx, [esp + 0x44]
push ecx
call fcn.0045f4a0
push 0x800
push str.Settings.reg
lea edx, [esp + 0x48]
push edx
call fcn.0047e380
push 0x800
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x1048]
push ecx
call fcn.0047e340
mov ebx, dword [esp + 0x4448]
push 1
test bl, bl
je 0x4277ac
push str.ExportedSettings
push 0x4d69fc
call fcn.0046bc00
cmp byte [esp + 0x444c], 0
jne 0x42767e
xor edx, edx
test bl, bl
sete dl
push ebx
push str..reg
lea ecx, [esp + 0x48]
push ecx
add edx, 0x5b4
push edx
call fcn.004744a0
push eax
mov eax, dword [0x534544]
push eax
call fcn.0041c110
test al, al
je 0x4277db
test bl, bl
jne 0x42781a
push 0x4d69fc
call fcn.0046c0e0
mov eax, 0x4d7c44
lea ecx, [esp + 0x40]
push ecx
push eax
lea edx, [esp + 0x2048]
push edx
mov edx, 0x900
call fcn.0043a6e0
push 0x3c
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004c05a0
mov ecx, dword [0x534544]
add esp, 0x18
lea eax, [esp + 4]
lea edx, [esp + 0x2040]
push eax
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], str.regedit
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
test bl, bl
je 0x427722
mov ecx, dword [esp + 0x3c]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x4448], 0
je 0x42773b
push str.ExportedSettings
push 0x4d69fc
call fcn.0046b860
test bl, bl
je 0x427824
cmp byte [esp + 0x4448], 0
jne 0x427752
call fcn.004272b0
xor ecx, ecx
cmp byte [esp + 0x4448], cl
lea eax, [esp + 0x40]
sete cl
push eax
add ecx, 0x460
push ecx
call fcn.004744a0
push eax
lea edx, [esp + 0x3248]
push edx
mov edx, 0x900
call fcn.0043a6e0
add esp, 0xc
push 0
push 0x2fb
call fcn.004744a0
mov ecx, dword [0x534544]
push eax
lea eax, [esp + 0x3248]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x427849
push 0x800
lea edx, [esp + 0x48]
push edx
push str.Settings.reg
call fcn.0045fdd0
lea eax, [esp + 0x40]
push eax
call fcn.0043c780
test al, al
jne 0x427642
cmp byte [esp + 0x444c], al
je 0x4277f5
xor al, al
pop ebx
mov ecx, dword [esp + 0x443c]
xor ecx, esp
call fcn.004bfc52
add esp, 0x4440
ret 8
xor eax, eax
jmp 0x427800
movzx ecx, word [esp + eax + 0x1040]
mov word [esp + eax + 0x40], cx
add eax, 2
test cx, cx
jne 0x427800
jmp 0x42764c
mov eax, str._e___s__HKEY_CURRENT_USERSoftwareWinRAR
jmp 0x427695
cmp byte [esp + 0x444c], 0
jne 0x427849
lea edx, [esp + 0x2040]
push edx
push 0x201
call fcn.004744a0
push eax
call fcn.004ab990
add esp, 8
mov ecx, dword [esp + 0x4440]
mov al, bl
pop ebx
xor ecx, esp
call fcn.004bfc52
add esp, 0x4440
ret 8
Function at 0x4279c0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x4279ef
test cl, 7
je 0x4279ef
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4f6b68]
dec esi
inc ecx
test esi, esi
ja 0x4279d2
cmp esi, 8
jb 0x427a88
mov edi, esi
push ebx
shr edi, 3
push ebp
nop
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x4f6f68]
mov dword [esp + 0x14], ecx
mov ebp, edx
shr ebp, 0x18
xor ebx, dword [ebp*4 + 0x4f6b68]
mov ecx, edx
shr ecx, 8
movzx ebp, cl
xor ebx, dword [ebp*4 + 0x4f7368]
mov ebp, eax
shr ebp, 0x18
xor ebx, dword [ebp*4 + 0x4f7b68]
mov ecx, eax
shr ecx, 0x10
movzx ebp, cl
xor ebx, dword [ebp*4 + 0x4f7f68]
mov ecx, eax
shr ecx, 8
movzx ebp, cl
xor ebx, dword [ebp*4 + 0x4f8368]
mov ecx, dword [esp + 0x14]
movzx edx, dl
xor ebx, dword [edx*4 + 0x4f7768]
movzx eax, al
xor ebx, dword [eax*4 + 0x4f8768]
sub esi, 8
add ecx, 8
sub edi, 1
mov eax, ebx
jne 0x427a00
pop ebp
pop ebx
test esi, esi
jbe 0x427aa8
lea esp, [esp]
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4f6b68]
dec esi
inc ecx
test esi, esi
ja 0x427a90
pop edi
pop esi
ret 0xc
Function at 0x427d40
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
test esi, esi
jbe 0x427d83
test bl, 7
je 0x427d7f
movzx ecx, byte [ebx]
movzx edi, al
shrd eax, edx, 8
xor ecx, edi
xor eax, dword [ecx*8 + 0x4f2b68]
shr edx, 8
xor edx, dword [ecx*8 + 0x4f2b6c]
dec esi
inc ebx
test esi, esi
ja 0x427d57
mov dword [esp + 0x1c], esi
mov ecx, esi
shr ecx, 3
lea ecx, [ebx + ecx*8]
mov dword [esp + 0x18], ecx
cmp ebx, ecx
jae 0x427e71
push ebp
mov ecx, dword [ebx]
xor ecx, eax
mov eax, dword [ebx + 4]
xor eax, edx
mov edx, eax
shr edx, 0x10
movzx esi, dl
mov edi, dword [esi*8 + 0x4f3368]
mov esi, dword [esi*8 + 0x4f336c]
mov edx, eax
shr edx, 0x18
movzx edx, dl
xor edi, dword [edx*8 + 0x4f2b68]
xor esi, dword [edx*8 + 0x4f2b6c]
mov edx, eax
shr edx, 8
movzx edx, dl
xor edi, dword [edx*8 + 0x4f3b68]
xor esi, dword [edx*8 + 0x4f3b6c]
movzx edx, al
xor edi, dword [edx*8 + 0x4f4368]
xor esi, dword [edx*8 + 0x4f436c]
mov ebp, eax
mov edx, ecx
shrd edx, ebp, 0x18
movzx edx, dl
xor edi, dword [edx*8 + 0x4f4b68]
xor esi, dword [edx*8 + 0x4f4b6c]
shr ebp, 0x18
mov ebp, eax
mov edx, ecx
shrd edx, ebp, 0x10
movzx edx, dl
xor edi, dword [edx*8 + 0x4f5368]
xor esi, dword [edx*8 + 0x4f536c]
mov edx, ecx
shrd edx, eax, 8
mov dword [esp + 0x18], eax
shr eax, 8
movzx eax, dl
xor edi, dword [eax*8 + 0x4f5b68]
xor esi, dword [eax*8 + 0x4f5b6c]
movzx eax, cl
xor esi, dword [eax*8 + 0x4f636c]
xor edi, dword [eax*8 + 0x4f6368]
add ebx, 8
shr ebp, 0x10
mov eax, edi
mov edx, esi
cmp ebx, dword [esp + 0x1c]
jb 0x427d98
mov esi, dword [esp + 0x20]
pop ebp
and esi, 7
jbe 0x427e99
movzx ecx, byte [ebx]
movzx edi, al
shrd eax, edx, 8
xor ecx, edi
xor eax, dword [ecx*8 + 0x4f2b68]
shr edx, 8
xor edx, dword [ecx*8 + 0x4f2b6c]
dec esi
inc ebx
test esi, esi
ja 0x427e76
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x427ea0
Capabilities:
Encode data using xor

Disassembly:
xor dl, dl
push esi
mov esi, dword [esp + 8]
mov byte [ecx + 0xbfe], dl
mov byte [ecx + 0xbfd], dl
mov byte [ecx + 0xbfc], dl
mov al, byte [esi]
cmp al, dl
je 0x427ee4
push ebx
mov bl, byte [ecx + 0xbfe]
add byte [ecx + 0xbfc], al
xor byte [ecx + 0xbfd], al
add bl, al
rol bl, 1
inc esi
mov byte [ecx + 0xbfe], bl
mov al, byte [esi]
cmp al, dl
jne 0x427ec0
pop ebx
pop esi
ret 4
Function at 0x427ef0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x6ec]
push eax
call fcn.00427870
mov edi, dword [esp + 0xc]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427f10
sub eax, edx
push eax
push edi
push 0xffffffffffffffff
call fcn.004279c0
mov word [esi + 0xc00], ax
shr eax, 0x10
xor ecx, ecx
xor edx, edx
mov word [esi + 0xc02], ax
mov word [esi + 0xc06], cx
mov word [esi + 0xc04], dx
mov al, byte [edi]
test al, al
je 0x427f86
mov edx, edi
lea ecx, [ecx]
movzx ecx, al
mov di, word [esi + ecx*4 + 0x6ec]
lea ecx, [esi + ecx*4 + 0x6ec]
movzx ax, al
xor di, ax
xor word [esi + 0xc04], di
mov cx, word [ecx + 2]
add cx, ax
add word [esi + 0xc06], cx
mov al, byte [edx + 1]
inc edx
test al, al
jne 0x427f50
pop edi
pop esi
ret 4

Function at 0x427ff0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
mov eax, ecx
test edi, edi
je 0x4280aa
push ebx
push esi
mov esi, dword [esp + 0x10]
jmp 0x428010
mov ecx, 0x1234
add word [eax + 0xc00], cx
movzx ecx, word [eax + 0xc00]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [eax + edx*4 + 0x6ec]
xor word [eax + 0xc02], dx
mov bx, word [eax + 0xc06]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [eax + edx*4 + 0x6ee]
sub word [eax + 0xc04], dx
movzx edx, word [eax + 0xc04]
xor edx, ecx
mov word [eax + 0xc00], dx
mov edx, 1
mov ecx, edx
dec edi
ror bx, cl
inc esi
xor bx, word [eax + 0xc02]
ror bx, cl
movzx ecx, bx
xor word [eax + 0xc00], cx
mov word [eax + 0xc06], cx
movzx ecx, word [eax + 0xc00]
shr ecx, 8
xor byte [esi - 1], cl
test edi, edi
jne 0x428010
pop esi
pop ebx
pop edi
ret 8

Function at 0x4280b0
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov eax, dword [esp + 4]
inc eax
mov edx, 4
push esi
jmp 0x4280c0
movzx esi, byte [eax - 1]
mov esi, dword [ecx + esi*4 + 0x6ec]
xor dword [ecx + 0xbec], esi
movzx esi, byte [eax]
mov esi, dword [ecx + esi*4 + 0x6ec]
xor dword [ecx + 0xbf0], esi
movzx esi, byte [eax + 1]
mov esi, dword [ecx + esi*4 + 0x6ec]
xor dword [ecx + 0xbf4], esi
movzx esi, byte [eax + 2]
mov esi, dword [ecx + esi*4 + 0x6ec]
xor dword [ecx + 0xbf8], esi
add eax, 4
sub edx, 1
jne 0x4280c0
pop esi
ret 4