joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403741
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push esi
push edi
mov edi, 0x5d744c
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_CharToOemBuffA]
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatW]
dec edi
jne 0x403753
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [ebp - 4], esi
mov ebx, 0x2b259d
call edi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
cmp dword [ebp - 4], ebx
jle 0x4037a6
cmp dword [ebp - 4], 0x785074d5
jne 0x4037b2
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1c1b
jl 0x40378b
mov dword [ebp - 4], esi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], 0x206d47
jg 0x4037d9
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x4f6a4
jl 0x4037b5
cmp dword [0x2a9f368], 0x400
jne 0x403808
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push esi
push esi
call fcn.00403b22
push esi
call fcn.00403e95
push esi
call fcn.00403ce5
push esi
push esi
call fcn.00403a16
add esp, 0x18
mov eax, dword [0x42b31c]
mov dword [0x2a9f368], eax
mov eax, dword [0x42b2f0]
mov dword [0x2a9f36c], eax
call fcn.00403531
xor edi, edi
push 0x402e6c
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
cmp edi, ebx
jle 0x40383b
cmp dword [ebp - 4], 0x785074d5
jne 0x403844
inc edi
cmp edi, 0x11915
jl 0x403823
mov edi, 0x3078f
pop ebx
cmp dword [0x2a9f368], 0x51f
jne 0x403878
push 0x402e74
push esi
lea eax, [ebp - 0x80c]
push eax
push 0x402eb4
push 0x402ee8
push 0x402f30
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
dec edi
jne 0x40384a
mov eax, dword [0x2a9e2b8]
mov dword [0x2a9e8fc], eax
call eax
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x408c49
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a694]
jne 0x408c53
repz ret
jmp fcn.0040ab8b
Function at 0x40a119
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040523c
and dword [ebp - 4], 0
cmp dword [0x42bc3c], 0
mov ebx, eax
jne 0x40a1ca
push 0x40216c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a27b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402160
push edi
call esi
test eax, eax
je 0x40a27b
push eax
call fcn.004051ca
mov dword [esp], 0x402150
push edi
mov dword [0x42bc3c], eax
call esi
push eax
call fcn.004051ca
mov dword [esp], 0x40213c
push edi
mov dword [0x42bc40], eax
call esi
push eax
call fcn.004051ca
mov dword [esp], 0x402120
push edi
mov dword [0x42bc44], eax
call esi
push eax
call fcn.004051ca
pop ecx
mov dword [0x42bc4c], eax
test eax, eax
je 0x40a1ca
push 0x402108
push edi
call esi
push eax
call fcn.004051ca
pop ecx
mov dword [0x42bc48], eax
mov eax, dword [0x42bc48]
cmp eax, ebx
je 0x40a222
cmp dword [0x42bc4c], ebx
je 0x40a222
push eax
call fcn.00405245
push dword [0x42bc4c]
mov esi, eax
call fcn.00405245
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a222
test edi, edi
je 0x40a222
call esi
test eax, eax
je 0x40a219
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a219
test byte [ebp - 0xc], 1
jne 0x40a222
or dword [ebp + 0x10], 0x200000
jmp 0x40a25b
mov eax, dword [0x42bc40]
cmp eax, ebx
je 0x40a25b
push eax
call fcn.00405245
pop ecx
test eax, eax
je 0x40a25b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a25b
mov eax, dword [0x42bc44]
cmp eax, ebx
je 0x40a25b
push eax
call fcn.00405245
pop ecx
test eax, eax
je 0x40a25b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42bc3c]
call fcn.00405245
pop ecx
test eax, eax
je 0x40a27b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a27d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45de44
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
cmp dword [ebp + 0x10], 0x20
jbe 0x45de58
or eax, 0xffffffff
jmp 0x45df86
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [edx + 0xb0], ecx
mov eax, dword [ebp + 0x10]
shr eax, 2
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov dword [ecx], 0xb7e15163
mov dword [ebp - 0x14], 1
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax + edx*4 - 4]
add ecx, 0x9e3779b9
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov dword [eax + edx*4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x2c
jb 0x45de83
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 4]
jae 0x45decd
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + ecx*4]
mov edx, dword [ebp - 0x14]
mov dword [ebp + edx*4 - 0x3c], eax
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 4]
jb 0x45deb2
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x14], 0x84
jae 0x45df84
mov eax, dword [ebp - 0x14]
mov ecx, 0x2c
xor edx, edx
div ecx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
xor edx, edx
div dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov edx, dword [ecx + eax*4]
add edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x1c]
shl edx, 3
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ecx + eax*4]
add ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x1c]
shr ecx, 0x1d
or edx, ecx
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x18]
add dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
and eax, 0x1f
mov ecx, 0x20
sub ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + edx*4 - 0x3c]
add eax, dword [ebp - 0x1c]
shr eax, cl
mov ecx, dword [ebp - 0x1c]
and ecx, 0x1f
mov edx, dword [ebp - 0x10]
mov edx, dword [ebp + edx*4 - 0x3c]
add edx, dword [ebp - 0x1c]
shl edx, cl
or eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x84
jb 0x45dee5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4640b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor eax, eax
lea ecx, [ebp + 9]
xor dl, byte [ecx]
inc eax
inc ecx
cmp eax, 5
jl 0x4640c2
xor eax, eax
lea ecx, [ebp + 0xe]
xor dl, byte [ecx]
inc eax
inc ecx
cmp eax, 0x12
jl 0x4640d0
mov eax, edx
pop ebp
ret

Function at 0x4640e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
shl eax, 4
add eax, ebx
lea eax, [ebx + eax*8]
cmp dword [eax*2 + 0x605554], 0
jne 0x464108
mov eax, 0xa0100002
jmp 0x4641c1
push 0x19
push 0
lea edx, [ebp - 0x20]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 5], al
mov byte [ebp - 0x1f], 0xb
mov cl, byte [ebp - 5]
mov byte [ebp - 0x1e], cl
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 0
lea edx, [ebp - 0x20]
mov al, byte [edx + 0x18]
push eax
mov eax, 5
push dword [edx + eax*4]
dec eax
jns 0x46414e
call fcn.004640b8
mov ecx, ebx
add esp, 0x1c
shl ecx, 4
mov byte [ebp - 8], al
add ecx, ebx
lea ecx, [ebx + ecx*8]
add ecx, ecx
add ecx, 0x605562
push ecx
call fcn.00466da4
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea edx, [ebp - 0x20]
push edx
push ebx
call fcn.00463b40
mov ecx, ebx
add esp, 0xc
shl ecx, 4
mov dword [ebp - 4], eax
add ecx, ebx
lea ecx, [ebx + ecx*8]
add ecx, ecx
add ecx, 0x605562
push ecx
call fcn.00466dbc
pop ecx
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov edx, eax
lea eax, [ebp - 0x36]
mov bl, byte [eax]
xor bl, byte [ebp - 5]
mov byte [edx], bl
inc ecx
inc edx
inc eax
cmp ecx, 4
jl 0x4641af
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4641c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x605554], 0
jne 0x4641f2
mov eax, 0xa0100002
jmp 0x4642a2
push 0x19
push 0
lea edx, [ebp - 0x1c]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 0x1b], 0xc
mov ecx, eax
xor edi, edi
mov byte [ebp - 0x1a], cl
lea edx, [ebp - 0x16]
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov eax, dword [ebp + 0xc]
mov bl, byte [eax]
inc eax
xor bl, cl
inc edi
mov byte [edx], bl
inc edx
cmp edi, 4
jl 0x464230
lea edx, [ebp - 0x1c]
mov al, byte [edx + 0x18]
push eax
mov eax, 5
push dword [edx + eax*4]
dec eax
jns 0x46424a
call fcn.004640b8
mov ecx, esi
add esp, 0x1c
shl ecx, 4
mov byte [ebp - 4], al
add ecx, esi
lea ecx, [esi + ecx*8]
add ecx, ecx
add ecx, 0x605562
push ecx
call fcn.00466da4
pop ecx
lea eax, [ebp - 0x38]
push eax
lea edx, [ebp - 0x1c]
push edx
push esi
call fcn.00463b40
mov ebx, eax
mov eax, esi
shl eax, 4
add esp, 0xc
add eax, esi
lea eax, [esi + eax*8]
add eax, eax
add eax, 0x605562
push eax
call fcn.00466dbc
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4642ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
shl eax, 4
add eax, ebx
lea eax, [ebx + eax*8]
cmp dword [eax*2 + 0x605554], 0
jne 0x4642d4
mov eax, 0xa0100002
jmp 0x46438d
push 0x19
push 0
lea edx, [ebp - 0x20]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 5], al
mov byte [ebp - 0x1f], 4
mov cl, byte [ebp - 5]
mov byte [ebp - 0x1e], cl
mov al, byte [ebp - 5]
xor al, 0
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x1b], al
lea ecx, [ebp - 0x20]
mov dl, byte [ecx + 0x18]
push edx
mov edx, 5
push dword [ecx + edx*4]
dec edx
jns 0x46431c
call fcn.004640b8
mov byte [ebp - 8], al
mov eax, ebx
shl eax, 4
add esp, 0x1c
add eax, ebx
lea eax, [ebx + eax*8]
add eax, eax
add eax, 0x605562
push eax
call fcn.00466da4
pop ecx
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x20]
push ecx
push ebx
call fcn.00463b40
mov dword [ebp - 4], eax
mov eax, ebx
shl eax, 4
add esp, 0xc
add eax, ebx
lea eax, [ebx + eax*8]
add eax, eax
add eax, 0x605562
push eax
call fcn.00466dbc
pop ecx
xor ecx, ecx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x36]
mov bl, byte [eax]
xor bl, byte [ebp - 5]
mov byte [edx], bl
inc ecx
inc edx
inc eax
cmp ecx, 8
jl 0x46437b
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x464394
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x605554], 0
jne 0x4643bd
mov eax, 0xa0100002
jmp 0x464462
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov ebx, eax
push 0x19
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.cc3260mt.dll__memset
mov byte [ebp - 0x1b], 0xa
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
add esp, 0xc
xor edx, edx
lea eax, [ebp - 0x16]
xor byte [eax], bl
inc edx
inc eax
cmp edx, 0x12
jl 0x4643f5
lea ecx, [ebp - 0x1c]
mov dl, byte [ecx + 0x18]
push edx
mov edx, 5
push dword [ecx + edx*4]
dec edx
jns 0x46440a
call fcn.004640b8
mov byte [ebp - 4], al
mov eax, esi
shl eax, 4
add esp, 0x1c
add eax, esi
lea eax, [esi + eax*8]
add eax, eax
add eax, 0x605562
push eax
call fcn.00466da4
pop ecx
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x1c]
push ecx
push esi
call fcn.00463b40
mov ebx, eax
mov eax, esi
shl eax, 4
add esp, 0xc
add eax, esi
lea eax, [esi + eax*8]
add eax, eax
add eax, 0x605562
push eax
call fcn.00466dbc
pop ecx
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x464728
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x605554], 0
jne 0x464755
mov eax, 0xa0100002
jmp 0x46485c
cmp edi, 0x1f0
jle 0x464767
mov eax, 0xa0100004
jmp 0x46485c
mov edx, edi
and edx, 0x8000000f
jns 0x464776
dec edx
or edx, 0xfffffff0
inc edx
test edx, edx
je 0x464784
mov eax, 0xa0100004
jmp 0x46485c
test edi, edi
jge 0x464792
mov eax, 0xa0100004
jmp 0x46485c
push 0x19
push 0
lea edx, [ebp - 0x1c]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 0x1b], 0x10
mov ebx, eax
mov edx, edi
mov byte [ebp - 0x1a], bl
mov ecx, edi
mov al, byte [ebp + 0xc]
and cl, 0xff
sar edx, 8
xor al, bl
mov byte [ebp - 0x19], al
xor dl, bl
mov byte [ebp - 0x18], dl
xor cl, bl
mov byte [ebp - 0x17], cl
push 0x10
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x16]
push eax
push edx
call sub.cc3260mt.dll__memcpy
add esp, 0xc
xor edx, edx
lea eax, [ebp - 0x16]
xor byte [eax], bl
inc edx
inc eax
cmp edx, 0x10
jl 0x4647ef
lea eax, [ebp - 0x1c]
mov cl, byte [eax + 0x18]
push ecx
mov ecx, 5
push dword [eax + ecx*4]
dec ecx
jns 0x464804
call fcn.004640b8
mov edx, esi
add esp, 0x1c
shl edx, 4
mov byte [ebp - 4], al
add edx, esi
lea edx, [esi + edx*8]
add edx, edx
add edx, 0x605562
push edx
call fcn.00466da4
pop ecx
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x38]
push ecx
push eax
push esi
call fcn.00463b40
mov ebx, eax
mov eax, esi
shl eax, 4
add esp, 0xc
add eax, esi
lea eax, [esi + eax*8]
add eax, eax
add eax, 0x605562
push eax
call fcn.00466dbc
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x464868
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x605554], 0
jne 0x464895
mov eax, 0xa0100002
jmp 0x4649a9
cmp edi, 0x1f0
jle 0x4648a7
mov eax, 0xa0100004
jmp 0x4649a9
mov edx, edi
and edx, 0x8000000f
jns 0x4648b6
dec edx
or edx, 0xfffffff0
inc edx
test edx, edx
je 0x4648c4
mov eax, 0xa0100004
jmp 0x4649a9
test edi, edi
jge 0x4648d2
mov eax, 0xa0100004
jmp 0x4649a9
push 0x19
push 0
lea edx, [ebp - 0x20]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 0x1f], 0xf
mov ebx, eax
mov edx, edi
mov byte [ebp - 0x1e], bl
mov ecx, edi
mov al, byte [ebp + 0xc]
and cl, 0xff
sar edx, 8
xor al, bl
xor dl, bl
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], dl
xor cl, bl
mov byte [ebp - 0x1b], cl
xor edx, edx
lea eax, [ebp - 0x1a]
mov ecx, ebx
xor cl, 0
mov byte [eax], cl
inc edx
inc eax
cmp edx, 0x12
jl 0x46491d
lea edx, [ebp - 0x20]
mov al, byte [edx + 0x18]
push eax
mov eax, 5
push dword [edx + eax*4]
dec eax
jns 0x464937
call fcn.004640b8
mov ecx, esi
add esp, 0x1c
shl ecx, 4
mov byte [ebp - 8], al
add ecx, esi
lea ecx, [esi + ecx*8]
add ecx, ecx
add ecx, 0x605562
push ecx
call fcn.00466da4
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea edx, [ebp - 0x20]
push edx
push esi
call fcn.00463b40
mov ecx, esi
add esp, 0xc
shl ecx, 4
mov dword [ebp - 4], eax
add ecx, esi
lea ecx, [esi + ecx*8]
add ecx, ecx
add ecx, 0x605562
push ecx
call fcn.00466dbc
mov eax, dword [ebp + 0x14]
pop ecx
xor esi, esi
mov edx, eax
lea eax, [ebp - 0x36]
mov cl, byte [eax]
inc eax
xor cl, bl
inc esi
mov byte [edx], cl
inc edx
cmp esi, 0x10
jl 0x464998
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x464c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
shl eax, 4
add eax, ebx
lea eax, [ebx + eax*8]
cmp dword [eax*2 + 0x605554], 0
jne 0x464c88
mov eax, 0xa0100002
jmp 0x464d41
push 0x19
push 0
lea edx, [ebp - 0x20]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 5], al
mov byte [ebp - 0x1f], 0xd
mov cl, byte [ebp - 5]
mov byte [ebp - 0x1e], cl
mov al, byte [ebp - 5]
xor al, 0
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x1b], al
lea ecx, [ebp - 0x20]
mov dl, byte [ecx + 0x18]
push edx
mov edx, 5
push dword [ecx + edx*4]
dec edx
jns 0x464cd0
call fcn.004640b8
mov byte [ebp - 8], al
mov eax, ebx
shl eax, 4
add esp, 0x1c
add eax, ebx
lea eax, [ebx + eax*8]
add eax, eax
add eax, 0x605562
push eax
call fcn.00466da4
pop ecx
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x20]
push ecx
push ebx
call fcn.00463b40
mov dword [ebp - 4], eax
mov eax, ebx
shl eax, 4
add esp, 0xc
add eax, ebx
lea eax, [ebx + eax*8]
add eax, eax
add eax, 0x605562
push eax
call fcn.00466dbc
pop ecx
xor ecx, ecx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x36]
mov bl, byte [eax]
xor bl, byte [ebp - 5]
mov byte [edx], bl
inc ecx
inc edx
inc eax
cmp ecx, 0x10
jl 0x464d2f
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x464ef4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x605554], 0
jne 0x464f1e
mov eax, 0xa0100002
jmp 0x464fd4
push 0x19
push 0
lea edx, [ebp - 0x1c]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov ebx, eax
mov byte [ebp - 0x1b], 0xe
mov byte [ebp - 0x1a], bl
mov eax, ebx
xor al, 0
mov byte [ebp - 0x19], al
mov byte [ebp - 0x18], al
mov byte [ebp - 0x17], al
xor edx, edx
lea eax, [ebp - 0x16]
mov ecx, ebx
xor cl, 0
mov byte [eax], cl
inc edx
inc eax
cmp edx, 0x12
jl 0x464f5a
lea eax, [ebp - 0x1c]
mov dl, byte [eax + 0x18]
push edx
mov edx, 5
push dword [eax + edx*4]
dec edx
jns 0x464f74
call fcn.004640b8
mov edx, esi
add esp, 0x1c
shl edx, 4
mov byte [ebp - 4], al
add edx, esi
lea edx, [esi + edx*8]
add edx, edx
add edx, 0x605562
push edx
call fcn.00466da4
pop ecx
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x38]
push ecx
push eax
push esi
call fcn.00463b40
mov edi, eax
mov eax, esi
shl eax, 4
add esp, 0xc
add eax, esi
lea eax, [esi + eax*8]
add eax, eax
add eax, 0x605562
push eax
call fcn.00466dbc
mov edx, dword [ebp + 0xc]
mov eax, edi
xor bl, byte [ebp - 0x32]
pop ecx
mov byte [edx], bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x464fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x605554], 0
jne 0x46500d
mov eax, 0xa0100002
jmp 0x465114
cmp edi, 0x1f0
jle 0x46501f
mov eax, 0xa0100004
jmp 0x465114
mov edx, edi
and edx, 0x8000000f
jns 0x46502e
dec edx
or edx, 0xfffffff0
inc edx
test edx, edx
je 0x46503c
mov eax, 0xa0100004
jmp 0x465114
test edi, edi
jge 0x46504a
mov eax, 0xa0100004
jmp 0x465114
push 0x19
push 0
lea edx, [ebp - 0x1c]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 0x1b], 3
mov ebx, eax
mov edx, edi
mov byte [ebp - 0x1a], bl
mov ecx, edi
mov al, byte [ebp + 0xc]
and cl, 0xff
sar edx, 8
xor al, bl
mov byte [ebp - 0x19], al
xor dl, bl
mov byte [ebp - 0x18], dl
xor cl, bl
mov byte [ebp - 0x17], cl
push 0x10
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x16]
push eax
push edx
call sub.cc3260mt.dll__memcpy
add esp, 0xc
xor edx, edx
lea eax, [ebp - 0x16]
xor byte [eax], bl
inc edx
inc eax
cmp edx, 0x10
jl 0x4650a7
lea eax, [ebp - 0x1c]
mov cl, byte [eax + 0x18]
push ecx
mov ecx, 5
push dword [eax + ecx*4]
dec ecx
jns 0x4650bc
call fcn.004640b8
mov edx, esi
add esp, 0x1c
shl edx, 4
mov byte [ebp - 4], al
add edx, esi
lea edx, [esi + edx*8]
add edx, edx
add edx, 0x605562
push edx
call fcn.00466da4
pop ecx
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x38]
push ecx
push eax
push esi
call fcn.00463b40
mov ebx, eax
mov eax, esi
shl eax, 4
add esp, 0xc
add eax, esi
lea eax, [esi + eax*8]
add eax, eax
add eax, 0x605562
push eax
call fcn.00466dbc
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x465120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x605554], 0
jne 0x46514d
mov eax, 0xa0100002
jmp 0x46525c
cmp edi, 0x1f0
jle 0x46515f
mov eax, 0xa0100004
jmp 0x46525c
mov edx, edi
and edx, 0x8000000f
jns 0x46516e
dec edx
or edx, 0xfffffff0
inc edx
test edx, edx
je 0x46517c
mov eax, 0xa0100004
jmp 0x46525c
test edi, edi
jge 0x46518a
mov eax, 0xa0100004
jmp 0x46525c
push 0x19
push 0
lea edx, [ebp - 0x20]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 0x1f], 2
mov ebx, eax
mov edx, edi
mov byte [ebp - 0x1e], bl
mov ecx, edi
mov al, byte [ebp + 0xc]
and cl, 0xff
sar edx, 8
xor al, bl
xor dl, bl
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], dl
xor cl, bl
mov byte [ebp - 0x1b], cl
xor edx, edx
lea eax, [ebp - 0x1a]
xor byte [eax], bl
inc edx
inc eax
cmp edx, 0x12
jl 0x4651d5
lea eax, [ebp - 0x20]
mov cl, byte [eax + 0x18]
push ecx
mov ecx, 5
push dword [eax + ecx*4]
dec ecx
jns 0x4651ea
call fcn.004640b8
mov edx, esi
add esp, 0x1c
shl edx, 4
mov byte [ebp - 8], al
add edx, esi
lea edx, [esi + edx*8]
add edx, edx
add edx, 0x605562
push edx
call fcn.00466da4
pop ecx
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x3c]
push ecx
push eax
push esi
call fcn.00463b40
mov edx, esi
add esp, 0xc
shl edx, 4
mov dword [ebp - 4], eax
add edx, esi
lea edx, [esi + edx*8]
add edx, edx
add edx, 0x605562
push edx
call fcn.00466dbc
mov eax, dword [ebp + 0x14]
xor esi, esi
mov edx, eax
lea eax, [ebp - 0x36]
pop ecx
mov cl, byte [eax]
inc eax
xor cl, bl
inc esi
mov byte [edx], cl
inc edx
cmp esi, 0x10
jl 0x46524b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10