joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030f0
Capabilities:
Access peb ldr_data
Get disk size
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x447548
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x45cefc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, 3
lea ecx, [esp + 0x10]
mov edx, 0x471d4c
call fcn.00401d60
mov esi, eax
mov dword [esp + 0x30], 0
mov eax, dword [esi]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
or eax, ecx
jge 0x403156
xor ecx, ecx
mov eax, esi
call fcn.00401fc0
mov esi, dword [esi]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
mov edx, eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov esi, ebx
sub esi, dword [esp + 0x14]
sbb edi, dword [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4031a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
push 0
push 0x400
push ecx
push ebx
call fcn.00445e90
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
fild qword [esp + 0x1c]
fld qword [0x456370]
fmul st(1), st(0)
fxch st(1)
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fld st(0)
call fcn.004242f0
mov ecx, eax
mov dword [esp + 0x10], ecx
fisub dword [esp + 0x10]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fld dword [0x456388]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
mov eax, ecx
je 0x403205
lea eax, [ecx + 1]
mov edx, dword [ebp + 8]
push 0
push 0x400
push edi
push esi
mov dword [edx], eax
call fcn.00445e90
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
fild qword [esp + 0x1c]
fmul st(2)
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fld st(0)
call fcn.004242f0
mov ecx, eax
mov dword [esp + 0x10], ecx
fisub dword [esp + 0x10]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fcomp st(1)
fnstsw ax
test ah, 5
mov eax, ecx
jnp 0x403255
lea eax, [ecx + 1]
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x18]
push 0
push 0x400
mov dword [ecx], eax
mov eax, dword [esp + 0x1c]
push edx
push eax
call fcn.00445e90
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
fild qword [esp + 0x1c]
fmulp st(2)
fxch st(1)
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fld st(0)
call fcn.004242f0
mov ecx, eax
mov dword [esp + 0x10], ecx
fisub dword [esp + 0x10]
fstp dword [esp + 0x10]
fcomp dword [esp + 0x10]
fnstsw ax
test ah, 0x41
jne 0x4032c2
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 1]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405240
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x50c
mov eax, dword [0x45cefc]
xor eax, esp
mov dword [esp + 0x508], eax
push esi
mov esi, 1
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [0x471d4c]
cmp dword [eax - 0xc], 0
jge 0x40527b
push 0x80070057
call entry0
movsx eax, byte [eax]
sub eax, 0x41
push eax
call fcn.00402a20
add esp, 4
test eax, eax
jne 0x405290
xor esi, esi
push ecx
mov ecx, esp
mov dword [esp + 8], esp
push ecx
mov ecx, str.USBVID_17EF
call fcn.00401c50
call fcn.00402e70
add esp, 4
test eax, eax
jne 0x4052b4
test esi, esi
je 0x4052b4
xor esi, esi
push 3
push 0x4557d0
push 0x471d4c
call fcn.00402150
push 1
push 0x4557d4
push 0x471d4c
call fcn.00402150
push 0xd
push 0x4557ec
push 0x471d4c
call fcn.00402150
push 0xff
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10c]
push str._sLxUDisk.sys
push ecx
call fcn.00425524
add esp, 0xc
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x20c]
push str._sLxUDisk64.sys
push eax
call fcn.00425524
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x30c]
push str._smsvcr80.dll
push edx
call fcn.00425524
add esp, 0xc
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x40c]
push str._smsvcp80.dll
push ecx
call fcn.00425524
add esp, 8
mov edx, esp
mov dword [esp + 8], esp
push edx
lea ecx, [esp + 0x110]
call fcn.00401c50
call fcn.004032e0
add esp, 4
cmp eax, 1
je 0x405394
lea eax, [esp + 0x108]
push eax
mov eax, dword [0x471d58]
call fcn.00402980
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 8], esp
push ecx
lea ecx, [esp + 0x210]
call fcn.00401c50
call fcn.004032e0
add esp, 4
cmp eax, 1
je 0x4053ca
mov eax, dword [0x471d48]
lea edx, [esp + 0x208]
push edx
call fcn.00402980
add esp, 4
call fcn.004062c0
test eax, eax
je 0x4053d9
test esi, esi
je 0x4053d9
xor esi, esi
mov ecx, dword [esp + 0x50c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00423893
mov esp, ebp
pop ebp
ret

Function at 0x405d60
Capabilities:
Terminate process

Disassembly:
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
mov eax, dword [esp + 4]
push eax
push str.____hs___
push 0x474260
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [0x471a9c]
add esp, 0xc
push 0x10
push ecx
push 0x474260
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call fcn.00426035
int3
Function at 0x406180
Capabilities:
Query service status

Disassembly:
mov eax, 0x3698
call fcn.00424bd0
mov eax, dword [0x463dd0]
cmp eax, 0xffffffff
je 0x4062b0
push 0
lea ecx, [esp + 8]
push ecx
push 0x3674
lea edx, [esp + 0x30]
push edx
push 0x3674
mov ecx, edx
push ecx
push 0x72004
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4062b0
cmp dword [esp + 0x24], 0
je 0x4061d5
xor eax, eax
add esp, 0x3698
ret
call fcn.00407380
cmp eax, 1
jg 0x4061cc
mov edx, dword [0x463dd0]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xf003f
push 0
push 0
mov dword [0x463dd0], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
mov dword [esp + 4], esi
je 0x40628f
push edi
push 0xf01ff
push str.truecrypt
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x406287
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [esp + 0x14]
push eax
push edi
call ebp
cmp eax, 1
jne 0x40627f
cmp dword [esp + 0x18], eax
je 0x40627f
push ebx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
lea edx, [esp + 0x18]
push edx
push edi
call ebp
cmp eax, 1
jne 0x40627a
cmp dword [esp + 0x1c], eax
je 0x40627a
push 0xc8
call ebx
add esi, 1
cmp esi, 5
jl 0x406258
mov esi, dword [esp + 0x10]
pop ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebp
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, 1
cmp dword [esp + 0x10], eax
pop esi
jne 0x4061cc
mov dword [0x463dd0], 0xffffffff
add esp, 0x3698
ret
mov eax, 1
add esp, 0x3698
ret

Function at 0x4062c0
Capabilities:
Get installed programs

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
push 0
push 0
push 3
push 0
push 0
push 0
push str..TrueCrypt
call esi
cmp eax, 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x463dd0], eax
je 0x40634b
push 0
lea ecx, [esp + 0x14]
push ecx
push 4
push 0x474a68
push 4
push 0x474a68
push 0x72018
push eax
call edi
test eax, eax
je 0x40636c
cmp dword [0x474a68], 0x43a
je 0x4063a6
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallTrueCrypt
push SysReAllocStringLen
call ebx
test eax, eax
je 0x406378
call fcn.00406180
test eax, eax
je 0x406383
call fcn.00405ee0
test eax, eax
jne 0x4063a8
push eax
push eax
push 3
push eax
push eax
push eax
push str..TrueCrypt
call esi
cmp eax, 0xffffffff
mov dword [0x463dd0], eax
jne 0x4062f5
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x463dd0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x463dd0], 0xffffffff
mov eax, 0x10
pop edi
pop esi
pop ebx
add esp, 8
ret
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x406840
Capabilities:
Get disk information

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, 0x19
jmp 0x406850
mov edx, 1
shl edx, cl
test eax, edx
je 0x406867
sub ecx, 1
cmp ecx, 2
jg 0x406850
or eax, 0xffffffff
ret
mov eax, ecx
ret
Function at 0x407080
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
cmp dword [0x471aa8], 0xc
mov dword [esp], 1
mov dword [esp + 8], 4
je 0x4070a1
xor eax, eax
add esp, 0xc
ret
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4070f3
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 4]
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.EnableLUA
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4070e8
mov dword [esp], 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [esp], eax
setne al
add esp, 0xc
ret

Function at 0x4074b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SYSTEMControlSet001ServicesMountMgr
push SysReAllocStringLen
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407537
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.NoAutoMount
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407517
cmp dword [esp + 4], eax
je 0x407517
push str.SYS_AUTOMOUNT_DISABLED
jmp 0x407525
cmp dword [0x471aa8], 0xc
jne 0x40752d
push str.SYS_ASSIGN_DRIVE_LETTER
call fcn.00407410
add esp, 4
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0xc
ret
Function at 0x408190
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
mov ecx, dword [edx + 4]
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [edx]
push 0
mov ebp, ecx
push 1
mov edi, eax
add eax, 1
push ebp
adc ecx, 0
mov dword [edx], eax
mov eax, dword [esp + 0x28]
push edi
push esi
mov dword [edx + 4], ecx
call fcn.00409e50
mov eax, dword [ebx]
mov edx, dword [esp + 0x2c]
lea edi, [eax + edx]
add eax, 0x200
add esp, 0x14
cmp eax, 0x10000
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
mov dword [ebx], eax
jne 0x4081fa
push eax
mov eax, dword [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll__lwrite]
cmp eax, 0xffffffff
jne 0x4081f4
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret
mov dword [ebx], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x471cf8]
cmp eax, 0x19
jbe 0x408214
call esi
mov dword [0x471cf8], eax
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x40a3f0
Capabilities:
Create new key via cryptacquirecontext
Create thread
Log keystrokes via application hook

Disassembly:
cmp dword [0x471d04], 0
je 0x40a3fc
xor eax, eax
ret
push esi
push 0x4740e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x140
mov dword [0x471d04], 1
call fcn.00424a35
mov esi, eax
add esp, 4
test esi, esi
mov dword [0x471d00], esi
je 0x40a4ec
push edi
push 0x140
push 0
push esi
call fcn.00423160
add esp, 0xc
push 0x140
push esi
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
push 0
push 0x40ab30
push 2
call edi
test eax, eax
mov dword [0x471d18], eax
jne 0x40a478
push eax
call fcn.00405da0
add esp, 4
call esi
push eax
push 0
push 0x40a970
push 7
call edi
test eax, eax
pop edi
mov dword [0x471d14], eax
push 0
jne 0x40a4a6
call fcn.00405da0
add esp, 4
call fcn.0040a500
mov eax, 1
pop esi
ret
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 1
push 0
push 0
push 0x4740f8
call esi
test eax, eax
jne 0x40a4d3
push 8
push 1
push eax
push eax
push 0x4740f8
call esi
test eax, eax
jne 0x40a4d3
mov dword [0x4740f8], eax
push 0
push 0x2000
push 0x40ad10
call fcn.0042574a
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40a4f8
call fcn.0040a500
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x40a630
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1b4
mov eax, dword [0x45cefc]
xor eax, esp
mov dword [esp + 0x1ac], eax
mov eax, dword [0x463b00]
test eax, eax
push esi
push edi
je 0x40a77f
mov eax, dword [0x463af8]
sub eax, 1
je 0x40a687
sub eax, 1
je 0x40a687
sub eax, 1
je 0x40a680
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x1ac]
xor ecx, esp
call fcn.00423893
add esp, 0x1b4
ret
mov esi, 0x40
jmp 0x40a68c
mov esi, 0x14
xor edi, edi
mov eax, dword [0x463af8]
sub eax, 1
je 0x40a716
sub eax, 1
je 0x40a6e2
sub eax, 1
jne 0x40a74a
lea ecx, [esp + 0xc8]
push ecx
call fcn.004447b0
mov eax, dword [0x471d00]
lea edx, [esp + 0xcc]
push edx
push 0xa00
push eax
call fcn.00444830
lea ecx, [esp + 0x180]
push ecx
lea edx, [esp + 0xdc]
push edx
call fcn.00444a00
jmp 0x40a747
lea eax, [esp + 8]
push eax
call fcn.00441040
mov edx, dword [0x471d00]
lea ecx, [esp + 0xc]
push ecx
push 0x140
push edx
call fcn.00441080
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x184]
push ecx
call fcn.00441130
jmp 0x40a747
lea edx, [esp + 0x68]
push edx
call fcn.00441220
mov eax, dword [0x471d00]
push 0x140
push eax
lea ecx, [esp + 0x74]
push ecx
call fcn.00442cc0
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x184]
push eax
call fcn.00442d80
add esp, 0x18
xor eax, eax
test esi, esi
jle 0x40a771
mov ecx, dword [0x471d00]
add ecx, edi
jmp 0x40a760
mov dl, byte [esp + eax + 0x170]
xor byte [ecx + eax], dl
add eax, 1
cmp eax, esi
jl 0x40a760
add edi, esi
cmp edi, 0x140
jl 0x40a68e
mov ecx, dword [esp + 0x1b4]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00423893
add esp, 0x1b4
ret
Function at 0x40b5a0
Capabilities:
Hash data with crc32

Disassembly:
movzx eax, byte [ecx]
movzx edx, byte [ecx + 1]
not eax
and eax, 0xff
mov eax, dword [eax*4 + 0x461668]
xor eax, 0xffffff
xor edx, eax
add ecx, 1
shr eax, 8
and edx, 0xff
xor eax, dword [edx*4 + 0x461668]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
shr eax, 8
and edx, 0xff
xor eax, dword [edx*4 + 0x461668]
mov edx, eax
movzx eax, byte [ecx + 1]
xor eax, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x461668]
not eax
shr edx, 8
xor eax, edx
ret
Function at 0x40b960
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
push 0x1000
push 0
push esi
call fcn.00423160
add esp, 0xc
xor ebp, ebp
mov dword [esp + 0x10], ebp
lea esp, [esp]
test ebp, ebp
jne 0x40ba15
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esi + 0x180], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x184], edx
mov edi, 4
lea eax, [edi + 0x10]
shl eax, 4
lea ecx, [eax + esi]
lea eax, [edi + 8]
shl eax, 5
mov edx, dword [eax + esi]
mov dword [ecx], edx
mov eax, dword [eax + esi + 4]
mov dword [ecx + 4], eax
call fcn.0040b6b0
sar edi, 1
test edi, edi
jg 0x40b9a2
mov edx, dword [esi + 0x110]
mov eax, dword [esi + 0x114]
lea ecx, [esi + 0x80]
mov dword [ecx], edx
mov dword [ecx + 4], eax
call fcn.0040b6b0
mov edi, 4
lea esp, [esp]
mov ecx, edi
mov eax, edi
shl eax, 5
mov edx, dword [eax + esi]
shl ecx, 4
add ecx, esi
mov dword [ecx], edx
mov eax, dword [eax + esi + 4]
mov dword [ecx + 4], eax
call fcn.0040b6b0
sar edi, 1
test edi, edi
jg 0x40b9f0
jmp 0x40ba7f
cmp ebp, 1
jle 0x40ba7f
lea ecx, [ebp - 2]
shl ecx, 4
mov eax, ebp
shl eax, 4
mov edi, 8
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
jmp 0x40ba3c
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
add ecx, edi
shl ecx, 4
mov edx, dword [ecx + esi]
mov ecx, dword [ecx + esi + 4]
add eax, edi
shl eax, 4
add eax, esi
mov dword [eax + 4], ecx
mov ebx, ecx
mov ebp, edx
shl ecx, 8
shr ebp, 0x18
or ebp, ecx
mov dword [eax], edx
shr ebx, 0x18
mov dword [eax + 4], ebp
movzx ecx, word [ebx*2 + 0x455100]
shl edx, 8
xor ecx, edx
sar edi, 1
test edi, edi
mov dword [eax], ecx
jg 0x40ba34
mov ebp, dword [esp + 0x10]
mov edx, ebp
shl edx, 8
mov ebx, ebp
lea eax, [edx + esi + 0x10]
shl ebx, 4
mov edi, 2
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], ebx
lea ebx, [ebx]
lea ecx, [ebx + edi]
shl ecx, 4
cmp edi, 1
lea edx, [ecx + esi]
mov ecx, dword [esp + 0x14]
lea eax, [edx + 0x10]
jle 0x40bafa
lea ebx, [edi - 1]
mov ebp, dword [ecx]
xor ebp, dword [edx]
add ecx, 4
mov dword [eax], ebp
mov ebp, dword [ecx]
xor ebp, dword [edx + 4]
add eax, 4
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
xor ebp, dword [edx + 8]
add ecx, 4
add eax, 4
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
xor ebp, dword [edx + 0xc]
add ecx, 4
add eax, 4
mov dword [eax], ebp
add eax, 4
add ecx, 4
sub ebx, 1
jne 0x40bab8
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
add edi, edi
cmp edi, 0x10
jl 0x40baa0
add ebp, 1
cmp ebp, 0x10
mov dword [esp + 0x10], ebp
jl 0x40b980
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x40df60
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x198
mov eax, dword [0x45cefc]
xor eax, esp
mov dword [esp + 0x194], eax
push ebp
mov ebp, dword [esp + 0x1a4]
push esi
mov esi, ecx
cmp esi, 0x40
push edi
mov edi, edx
mov dword [esp + 0xc], ebp
jle 0x40dfcb
lea eax, [esp + 0xc8]
push eax
call fcn.00441040
lea ecx, [esp + 0xcc]
push ecx
push esi
push edi
call fcn.00441080
lea edx, [esp + 0xd8]
push edx
lea eax, [esp + 0x1a0]
push eax
call fcn.00441130
add esp, 0x18
lea edi, [esp + 0x18c]
mov esi, 0x14
lea ecx, [esp + 0x10]
push ecx
call fcn.00441040
add esp, 4
xor eax, eax
test esi, esi
jle 0x40e00a
mov ebp, edi
lea edx, [esp + 0x138]
sub ebp, edx
lea esp, [esp]
lea ecx, [esp + eax + 0x138]
mov dl, byte [ecx + ebp]
xor dl, 0x36
add eax, 1
cmp eax, esi
mov byte [ecx], dl
jl 0x40dff0
mov ebp, dword [esp + 0xc]
cmp esi, 0x40
jge 0x40e029
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x13c]
push 0x36
push eax
call fcn.00423160
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x13c]
push 0x40
push eax
call fcn.00441080
mov edx, dword [esp + 0x1b4]
lea ecx, [esp + 0x1c]
push ecx
push edx
push ebx
call fcn.00441080
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x194]
push ecx
call fcn.00441130
lea edx, [esp + 0x8c]
push edx
call fcn.00441040
add esp, 0x24
xor eax, eax
test esi, esi
jle 0x40e097
lea ecx, [esp + 0x138]
sub edi, ecx
lea ecx, [esp + eax + 0x138]
mov dl, byte [edi + ecx]
xor dl, 0x5c
add eax, 1
cmp eax, esi
mov byte [ecx], dl
jl 0x40e081
cmp esi, 0x40
jge 0x40e0b6
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x13c]
push 0x5c
push eax
call fcn.00423160
add esp, 0xc
lea edx, [esp + 0x6c]
push edx
lea eax, [esp + 0x13c]
push 0x40
push eax
call fcn.00441080
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x188]
push 0x14
push edx
call fcn.00441080
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x140]
push ecx
call fcn.00441130
mov edx, dword [esp + 0x144]
mov eax, dword [esp + 0x148]
mov ecx, dword [esp + 0x14c]
mov dword [ebp], edx
mov edx, dword [esp + 0x150]
add esp, 0x20
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x134]
mov dword [ebp + 8], ecx
mov ecx, dword [esp + 0x1a0]
pop edi
mov dword [ebp + 0xc], edx
pop esi
mov dword [ebp + 0x10], eax
pop ebp
xor ecx, esp
call fcn.00423893
add esp, 0x198
ret
Function at 0x40e140
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xb0
mov eax, dword [0x45cefc]
xor eax, esp
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0xbc]
push ebx
push ebp
mov ebp, dword [esp + 0xbc]
push esi
push edi
mov edi, ecx
mov cl, byte [esp + 0xd4]
push edi
mov esi, edx
push eax
lea edx, [esp + 0x44]
mov dword [esp + 0x18], 0
push edx
mov byte [esp + 0x1f], cl
call fcn.00423b90
mov eax, dword [esp + 0x1c]
mov dword [esp + edi + 0x48], eax
lea ecx, [esp + 0x20]
push ecx
add edi, 4
push edi
mov edi, dword [esp + 0xdc]
lea ebx, [esp + 0x50]
mov ecx, edi
mov edx, ebp
call fcn.0040df60
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [esi], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0xe4]
add esp, 0x14
cmp eax, 1
jle 0x40e22e
lea ecx, [esp + 0x28]
sub esi, ecx
add eax, 0xffffffff
mov dword [esp + 0x10], eax
lea esp, [esp]
lea edx, [esp + 0x28]
push edx
push 0x14
lea ebx, [esp + 0x1c]
mov ecx, edi
mov edx, ebp
call fcn.0040df60
add esp, 8
xor eax, eax
lea esp, [esp]
mov dl, byte [esp + eax + 0x28]
lea ecx, [esp + eax + 0x28]
xor byte [esi + ecx], dl
mov byte [esp + eax + 0x14], dl
add eax, 1
cmp eax, 0x14
jl 0x40e210
sub dword [esp + 0x10], 1
jne 0x40e1f0
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00423893
add esp, 0xb0
ret
Function at 0x40e350
Capabilities:
Authenticate hmac
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0x178
mov eax, dword [0x45cefc]
xor eax, esp
mov dword [esp + 0x174], eax
mov eax, dword [esp + 0x17c]
push ebx
push ebp
mov ebp, dword [esp + 0x18c]
push esi
mov ebx, ecx
cmp ebx, 0x40
push edi
mov edi, edx
mov dword [esp + 0x14], eax
jle 0x40e3c0
lea ecx, [esp + 0x78]
push ecx
call fcn.00441220
push ebx
lea edx, [esp + 0x80]
push edi
push edx
call fcn.00442cc0
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0xf0]
push ecx
call fcn.00442d80
add esp, 0x18
lea edi, [esp + 0xdc]
mov ebx, 0x14
push 0x41
lea edx, [esp + 0xf4]
push 0x36
push edx
call fcn.00423160
push 0x41
lea eax, [esp + 0x148]
push 0x5c
push eax
call fcn.00423160
add esp, 0x18
test ebx, ebx
jle 0x40e410
lea edx, [esp + 0xf0]
lea esi, [esp + 0x138]
sub edx, edi
mov eax, edi
sub esi, edi
lea ecx, [ecx]
mov cl, byte [eax]
xor byte [edx + eax], cl
xor byte [esi + eax], cl
add eax, 1
sub ebx, 1
jne 0x40e400
lea ecx, [esp + 0x18]
push ecx
call fcn.00441220
push 0x40
lea edx, [esp + 0xf8]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00442cc0
mov ecx, dword [esp + 0x1a0]
mov edx, dword [esp + 0x24]
push ecx
push edx
lea eax, [esp + 0x30]
push eax
call fcn.00442cc0
lea ecx, [esp + 0x34]
push ecx
push ebp
call fcn.00442d80
lea edx, [esp + 0x3c]
push edx
call fcn.00441220
push 0x40
lea eax, [esp + 0x164]
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.00442cc0
push 0x14
lea edx, [esp + 0x50]
push ebp
push edx
call fcn.00442cc0
add esp, 0x40
lea eax, [esp + 0x18]
push eax
push ebp
call fcn.00442d80
mov ecx, dword [esp + 0x18c]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00423893
add esp, 0x178
ret

Function at 0x40e4b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xb8
mov eax, dword [0x45cefc]
xor eax, esp
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0xc0]
push ebp
mov ebp, dword [esp + 0xc8]
push esi
push edi
mov edi, ecx
mov cl, byte [esp + 0xd4]
push edi
mov esi, edx
push eax
lea edx, [esp + 0x40]
mov dword [esp + 0x14], 0
push edx
mov byte [esp + 0x1b], cl
call fcn.00423b90
mov eax, dword [esp + 0x18]
add esp, 0xc
mov dword [esp + edi + 0x38], eax
lea ecx, [esp + 0x10]
push ecx
add edi, 4
push edi
mov edi, dword [esp + 0xd0]
lea edx, [esp + 0x40]
push edx
mov ecx, edi
mov edx, ebx
call fcn.0040e350
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esi], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 8], edx
add esp, 0xc
cmp ebp, 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
jle 0x40e58c
lea edx, [esp + 0x24]
sub esi, edx
add ebp, 0xffffffff
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x14]
push 0x14
push ecx
mov ecx, edi
mov edx, ebx
call fcn.0040e350
add esp, 0xc
xor eax, eax
mov edi, edi
mov dl, byte [esp + eax + 0x24]
lea ecx, [esp + eax + 0x24]
xor byte [esi + ecx], dl
mov byte [esp + eax + 0x10], dl
add eax, 1
cmp eax, 0x14
jl 0x40e570
sub ebp, 1
jne 0x40e554
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00423893
add esp, 0xb8
ret