joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409dc0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x473a98
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x48d034]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48d034]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x48]
mov eax, dword [ebx + 0x14]
xor edi, edi
test eax, eax
mov dword [esp + 0x14], eax
jbe 0x409ee9
lea ebp, [ebx + 4]
lea ebx, [ebx]
cmp edi, dword [ebx + 0x14]
jbe 0x409e1a
call fcn.0045cf3a
mov esi, 8
cmp dword [ebx + 0x18], esi
jb 0x409e29
mov eax, dword [ebp]
jmp 0x409e2b
mov eax, ebp
cmp word [eax + edi*2], 0x2f
je 0x409e53
cmp edi, dword [ebx + 0x14]
jbe 0x409e3c
call fcn.0045cf3a
cmp dword [ebx + 0x18], esi
jb 0x409e46
mov eax, dword [ebp]
jmp 0x409e48
mov eax, ebp
cmp word [eax + edi*2], 0x5c
jne 0x409edc
push edi
xor ecx, ecx
lea esi, [esp + 0x1c]
mov edx, ebx
call fcn.00403280
xor esi, esi
mov dword [esp + 0x40], esi
cmp dword [esp + 0x2c], esi
je 0x409eaf
lea ecx, [esp + 0x18]
push ecx
call fcn.00409a00
add esp, 4
test al, al
jne 0x409eaf
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x409e8d
lea eax, [esp + 0x1c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x409eaf
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x409ecb
mov edx, dword [esp + 0x1c]
push edx
jmp 0x409ec3
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x409ecb
mov eax, dword [esp + 0x1c]
push eax
call fcn.0045ca7a
add esp, 4
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], esi
mov word [esp + 0x1c], si
add edi, 1
cmp edi, dword [esp + 0x14]
jb 0x409e10
push ebx
call fcn.00409a00
add esp, 4
test al, al
jne 0x409f15
cmp dword [ebx + 0x18], 8
jb 0x409f01
mov eax, dword [ebx + 4]
jmp 0x409f04
lea eax, [ebx + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x409f15
xor al, al
jmp 0x409f1e
push ebx
call fcn.00409bb0
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0045ca6b
add esp, 0x30
ret
Function at 0x40abe0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x473a68
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48d034]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x38]
mov edx, dword [ebx]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor esi, esi
lea eax, [esp + 0x38]
push eax
push esi
lea ecx, [esp + 0x1c]
push ecx
push esi
push str.LastDir
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x50], esi
call ebp
cmp eax, esi
je 0x40ac3a
mov dword [ebx + 4], eax
jmp 0x40ac88
mov edi, dword [esp + 0x38]
lea esi, [esp + 0x18]
call fcn.0040acc0
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x30], 0
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x38]
push ecx
push esi
lea edx, [esp + 0x1c]
push edx
push 0
mov dword [edi], eax
mov eax, dword [ebx]
push str.LastDir
push eax
call ebp
test eax, eax
je 0x40aca0
mov dword [ebx + 4], eax
test esi, esi
je 0x40ac88
push esi
call fcn.0045cf4a
add esp, 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
mov ecx, dword [esp + 0x38]
push esi
push edi
call fcn.0040ae60
test al, al
je 0x40ac7b
test esi, esi
je 0x40acbc
push esi
call fcn.0045cf4a
add esp, 4
mov al, 1
jmp 0x40ac8a

Function at 0x40ad30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x473213
mov eax, dword fs:[0]
push eax
push ecx
push ebx
mov eax, dword [0x48d034]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
push 0xffffffffffffffff
lea eax, [esi + 4]
mov dword [esi], 1
push ebx
lea ecx, [esp + 0x24]
mov dword [eax + 0x18], 7
mov dword [eax + 0x14], ebx
push ecx
mov word [eax + 4], bx
call fcn.00403490
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x4c], 7
mov dword [esi + 0x48], ebx
mov word [esi + 0x38], bx
cmp dword [esp + 0x34], 8
mov dword [esi + 0x58], vtable.GameMgr::GMBuffer_unsigned_char_.0
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov byte [esi + 0x68], bl
jb 0x40adba
mov edx, dword [esp + 0x20]
push edx
call fcn.0045ca7a
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x10
ret 0x1c
Function at 0x40b2a0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x473a09
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48d034]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2c]
mov esi, ecx
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov dword [esp + 0x18], esi
mov word [esi + 4], di
mov dword [esp + 0x24], edi
push ebx
mov dword [esp + 0x18], 1
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp eax, edi
jle 0x40b354
lea ebp, [eax + eax]
xor ecx, ecx
lea eax, [ebp + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045ca66
add esp, 4
push ebp
mov edi, eax
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, ebp
jg 0x40b34b
mov word [edi + eax*2], 0
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b335
sub eax, edx
sar eax, 1
push eax
push edi
call fcn.00403990
push edi
call fcn.0045cf4a
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x40cdb0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x473948
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x48d034]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x48d034]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp eax, 0xffffffff
mov edi, ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], esi
je 0x40cf04
lea ecx, [esp + 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x40ce1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40cf04
xor eax, eax
mov dword [esp + 0x39], eax
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], al
mov eax, dword [esi]
cmp eax, 0xffffffff
mov byte [esp + 0x38], 0
je 0x40cf04
push 0
lea edx, [esp + 0x18]
push edx
push 8
lea ecx, [esp + 0x44]
push ecx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40cf04
mov ecx, dword [esp + 0x14]
test ecx, ecx
seta al
test al, al
je 0x40cf04
cmp ecx, 8
jne 0x40cf04
movzx edx, byte [esp + 0x38]
mov eax, 0x47
sub eax, edx
jne 0x40cea6
movzx ecx, byte [esp + 0x39]
mov eax, 0x4d
sub eax, ecx
jne 0x40cea6
movzx edx, byte [esp + 0x3a]
mov eax, 0x5a
sub eax, edx
je 0x40ceb4
test eax, eax
mov ecx, 1
jg 0x40ceb6
or ecx, 0xffffffff
jmp 0x40ceb6
xor ecx, ecx
test ecx, ecx
jne 0x40cf04
mov al, byte [esp + 0x3b]
cmp al, 1
mov byte [edi + 0xa8], al
ja 0x40cf04
mov edi, dword [esp + 0x3c]
cmp edi, 0x3200000
mov ebx, edi
ja 0x40cf04
lea esi, [esp + 0x18]
call fcn.0040acc0
mov ecx, dword [esp + 0x30]
xor edi, edi
mov dword [esp + 0x50], edi
mov eax, dword [esp + 0x20]
push ebx
lea esi, [esp + 0x18]
call fcn.00408860
test al, al
jne 0x40cf08
lea ecx, [esp + 0x18]
call fcn.00408fa0
xor al, al
jmp 0x40cf63
cmp dword [esp + 0x14], ebx
jne 0x40cefb
mov eax, dword [esp + 0x1c]
cmp ebx, eax
mov dword [esp + 0x24], eax
ja 0x40cf1e
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
lea esi, [edi + 8]
push ecx
mov ecx, esi
call fcn.0040c820
test al, al
je 0x40cefb
mov ecx, esi
mov byte [edi + 0xd4], 1
call fcn.0040cac0
lea ecx, [esp + 0x18]
mov dword [edi + 0xf0], eax
mov dword [edi + 0xf4], edx
call fcn.00408fa0
mov al, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0045ca6b
mov esp, ebp
pop ebp
ret 4
Function at 0x410f70
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
xor edi, edi
cmp ebx, edi
jne 0x410fc8
cmp byte [ebp + 0x2c], 0
jne 0x410fbf
mov byte [ebp + 0x2c], 1
mov dword [ebp + 0x30], 2
mov edx, dword [str.Failed_to_open_file]
mov eax, edx
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x410fa0
sub eax, esi
push edx
lea edi, [ebp + 0x34]
mov esi, eax
call fcn.0040fd50
or eax, 0xffffffff
mov dword [ebp + 0x40], eax
mov dword [ebp + 0x3c], eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x410fe1
nop
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
cmp esi, edi
jne 0x410fd0
push 2
or eax, 0xffffffff
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x1c], edi
push edi
push ebx
mov dword [ebp + 8], eax
mov dword [ebp + 4], eax
call fcn.00469006
push ebx
call fcn.00468f11
push 0
push 0
push ebx
mov edi, eax
call fcn.00469006
add esp, 0x1c
test edi, edi
jg 0x41103e
cmp byte [ebp + 0x2c], 0
jne 0x410fbf
mov byte [ebp + 0x2c], 1
mov dword [ebp + 0x30], 0xc
mov edx, dword [str.Error_document_empty.]
mov eax, edx
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x411030
jmp 0x410fa9
lea eax, [edi + 1]
push eax
call fcn.0045ca98
push ebx
push 1
mov esi, eax
push edi
push esi
mov byte [esi], 0
call fcn.00468c0f
add esp, 0x14
cmp eax, 1
je 0x411095
push esi
call fcn.0045ca7a
add esp, 4
cmp byte [ebp + 0x2c], 0
jne 0x410fbf
mov byte [ebp + 0x2c], 1
mov dword [ebp + 0x30], 2
mov edx, dword [str.Failed_to_open_file]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x411087
jmp 0x410fa9
mov byte [esi + edi], 0
cmp byte [esi], 0
mov eax, esi
mov ecx, esi
je 0x4110c6
mov dl, byte [eax]
cmp dl, 0xd
jne 0x4110b9
mov byte [ecx], 0xa
add eax, 1
add ecx, 1
cmp byte [eax], 0xa
jne 0x4110c1
jmp 0x4110be
mov byte [ecx], dl
add ecx, 1
add eax, 1
cmp byte [eax], 0
jne 0x4110a2
push 0
mov byte [ecx], 0
mov edx, dword [ebp]
mov eax, dword [edx + 8]
push 0
push esi
mov ecx, ebp
call eax
push esi
call fcn.0045ca7a
add esp, 4
pop edi
xor eax, eax
cmp byte [ebp + 0x2c], al
pop esi
pop ebp
sete al
pop ebx
ret 8
Function at 0x413b40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x472f68
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x48d034]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov eax, dword [0x48d034]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [0x490968]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0xc], ebx
mov byte [esp + 0xb], 1
jbe 0x413c01
lea ecx, [esp + 0xb]
push ecx
push eax
lea edx, [esp + 0x18]
push edi
push edx
call fcn.00413c30
add esp, 0x10
mov dword [esp + 0x38], ebx
cmp byte [esp + 0xb], bl
je 0x413bd4
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x18]
push eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov eax, esi
mov word [esi + 4], bx
call fcn.00403490
cmp dword [esp + 0x28], 8
jb 0x413c11
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0045ca7a
add esp, 4
jmp 0x413c11
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], 8
jb 0x413bf0
mov edx, dword [esp + 0x14]
push edx
call fcn.0045ca7a
add esp, 4
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], bx
lea eax, [esp + 0xb]
push eax
push ebx
push edi
push esi
call fcn.00413c30
add esp, 0x10
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0045ca6b
add esp, 0x34
ret

Function at 0x4140c0
Capabilities:
Read data from internet
Receive data

Disassembly:
mov eax, dword [eax]
sub esp, 8
test eax, eax
jne 0x4140d2
or eax, 0xffffffff
add esp, 8
ret 4
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push ecx
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4140c9
mov edx, dword [esp + 4]
add dword [esi + 0xc], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [esi + 4]
mov ecx, dword [esp + 4]
je 0x414161
mov edx, ecx
test edx, edx
mov dword [esp + 0xc], edx
fild dword [esp + 0xc]
jge 0x41411a
fadd qword [0x482018]
mov edx, eax
test edx, edx
mov dword [esp + 0xc], edx
fild dword [esp + 0xc]
jge 0x41412e
fadd qword [0x482018]
fdivp st(1)
mov edx, dword [esi + 0xc]
test edx, edx
fstp qword [esi + 0x10]
fild dword [esi + 0xc]
jge 0x414143
fadd qword [0x482018]
mov edx, eax
sub edx, dword [esi]
test edx, edx
mov dword [esp + 0xc], edx
fild dword [esp + 0xc]
jge 0x414159
fadd qword [0x482018]
fdivp st(1)
mov dword [esi + 4], eax
fstp qword [esi + 0x18]
mov eax, ecx
add esp, 8
ret 4
Function at 0x4170d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x18], eax
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebx + 0x18]
test eax, eax
mov dword [esp + 0x18], 0x416ce0
mov dword [esp + 0x28], 0x416d40
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], 0x416b80
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x14], 0
je 0x417140
mov ecx, dword [ecx]
cmp ecx, 0xffffffff
je 0x417140
push 0
lea edx, [esp + 0x18]
push edx
push 5
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
add dword [edi], eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x28]
adc dword [edi + 4], 0
mov edi, dword [ebx + 0x14]
mov eax, edi
mov dword [edi + 0x1d0], ecx
mov dword [edi + 0x3bd10], 1
mov dword [edi + 0x3bcd4], edx
call fcn.0041b0c0
test eax, eax
jne 0x417185
lea eax, [esp + 0x34]
push eax
mov ecx, edi
call fcn.0041b150
add esp, 4
mov edx, dword [esi]
mov edi, dword [esi + 4]
mov ecx, edx
or ecx, edi
jne 0x41719a
fld qword [0x482020]
fld st(0)
jmp 0x417208
mov ecx, dword [esi + 0x10]
add ecx, dword [esi + 8]
mov eax, dword [esi + 0x14]
adc eax, dword [esi + 0xc]
mov dword [esp + 0x20], ecx
mov ecx, eax
and eax, 0x7fffffff
mov dword [esp + 0x24], eax
fild qword [esp + 0x20]
and ecx, 0x80000000
mov dword [esp + 0x24], ecx
xor esi, esi
mov dword [esp + 0x20], esi
fild qword [esp + 0x20]
mov eax, edi
mov ecx, edi
and eax, 0x7fffffff
fchs
mov dword [esp + 0x20], edx
faddp st(1)
mov dword [esp + 0x24], eax
fld qword [0x482020]
and ecx, 0x80000000
fmul st(1), st(0)
fild qword [esp + 0x20]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], esi
fild qword [esp + 0x20]
fchs
faddp st(1)
fdivp st(2)
fxch st(1)
mov ecx, dword [ebp + 0x14]
fxch st(1)
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
sub esp, 0x10
fstp qword [esp + 8]
fstp qword [esp]
call eax
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x418000
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x418010
pop edi
pop ebx
ret

Function at 0x418040
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, pe_nt_image_headers32
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x418050
pop esi
pop ebp
pop ebx
ret
Function at 0x4181c0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, ecx
xor eax, eax
test edi, edi
mov edx, 1
je 0x418204
push ebx
push ebp
mov ebx, dword [esp + 0x14]
movzx ebx, word [ebx + edx*2]
mov ecx, esi
and ecx, 1
mov ebp, ecx
neg ebp
sar ebp, 4
and ebp, 0x7f
shr ebx, 4
xor ebx, ebp
mov ebp, dword [esp + 0x18]
add eax, dword [ebp + ebx*4]
add edx, edx
shr esi, 1
or edx, ecx
sub edi, 1
jne 0x4181d3
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x418350
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp + 0x10], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
push edi
mov dword [esp + 0x10], ecx
xor edx, edx
lea ebx, [ebx]
cmp edx, dword [esp + 0x20]
jae 0x4184c7
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x4183e0
mov ebp, dword [esp + 0x1c]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x4183b6
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
add edi, eax
mov dword [ecx + edx*4], edi
add edx, 1
cmp edx, 8
jb 0x4183a0
cmp edx, 0x10
jae 0x418462
lea eax, [edx - 8]
mov dword [esp + 0x18], eax
cmp edx, dword [esp + 0x20]
jae 0x4184c7
or eax, 8
xor edi, edi
cmp eax, 1
je 0x418442
mov ebp, dword [esp + 0x1c]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x418415
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x24]
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
add edx, 1
add eax, 1
cmp edx, 0x10
mov dword [esp + 0x18], eax
jb 0x418401
cmp edx, dword [esp + 0x20]
jae 0x4184c7
lea eax, [edx - 0x10]
mov dword [esp + 0x18], eax
nop
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x4184a6
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x418480
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
add edx, 1
add eax, 1
cmp edx, dword [esp + 0x20]
mov dword [esp + 0x18], eax
jb 0x418470
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x41a060
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x41a080
xor edx, edx
mov ecx, 1
mov dword [esp + 0xc], 4
nop
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
sub dword [esp + 0xc], 1
jne 0x41a090
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
add esi, 1
mov dword [eax], edx
add eax, 4
cmp esi, 0x10
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jb 0x41a080
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret

Function at 0x41a0f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push edi
mov edi, 4
lea ebp, [esi + 0x30ea0]
movzx ebx, byte [esi + edi + 0x306a0]
mov ecx, ebx
mov edx, ebx
and edx, 1
shr ecx, 1
or edx, 2
sub ecx, 1
shl edx, cl
mov eax, edi
push ebp
sub eax, edx
sub edx, ebx
lea edx, [esi + edx*2 + 0x32b0e]
push edx
call fcn.004181c0
mov dword [esp + edi*4 + 0x24], eax
add edi, 1
add esp, 8
cmp edi, 0x80
jb 0x41a104
lea ebp, [esp + 0x1c]
sub ebp, esi
lea eax, [esi + 0x32910]
lea ecx, [esi + 0x31d58]
sub ebp, 0x31d50
lea edi, [esi + 0x31950]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 4
jmp 0x41a184
mov ecx, dword [esp + 0xc]
xor ebx, ebx
cmp dword [esi + 0x32594], ebx
jbe 0x41a1e1
mov edi, edi
mov eax, ebx
or eax, 0x40
xor edx, edx
cmp eax, 1
je 0x41a1d3
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edx, dword [esi + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x41a1a0
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov dword [edi + ebx*4], edx
add ebx, 1
cmp ebx, dword [esi + 0x32594]
jb 0x41a190
mov eax, 0xe
cmp dword [esi + 0x32594], eax
jbe 0x41a208
mov edi, edi
mov edx, eax
shr edx, 1
sub edx, 5
shl edx, 4
add dword [edi + eax*4], edx
add eax, 1
cmp eax, dword [esi + 0x32594]
jb 0x41a1f0
mov eax, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi + 4]
mov dword [ecx - 4], edx
mov eax, dword [edi + 8]
mov dword [ecx], eax
mov edx, dword [edi + 0xc]
mov dword [ecx + 4], edx
mov eax, 4
add ecx, 8
jmp 0x41a230
movzx edx, byte [esi + eax + 0x306a0]
mov edx, dword [edi + edx*4]
add edx, dword [ecx + ebp]
add eax, 1
mov dword [ecx], edx
add ecx, 4
cmp eax, 0x80
jb 0x41a230
add dword [esp + 0x10], 0x80
add dword [esp + 0xc], 0x200
sub ebp, 0x200
add edi, 0x100
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], ebp
jne 0x41a180
pop edi
pop ebp
mov dword [esi + 0x3bcf8], 0
pop ebx
add esp, 0x210
ret
Function at 0x41fe20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov dword [eax + 0x30], edx
mov dword [eax + 0x4c], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x2c], 0x20
mov dword [eax + 0x54], 1
mov dword [eax + 0x48], 4
mov dword [eax + 0x58], edx
lea esi, [eax + 0x70]
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
add edx, 1
add esi, 4
cmp edx, 0x100
jb 0x41fe47
pop esi
ret