joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4056b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x47e064]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x4777b4
push edi
mov edi, dword [ebp + 0xc]
mov ecx, ebx
push 0
mov eax, dword [edi]
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40581d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4056fe
jle 0x405703
movzx eax, ax
or eax, 0x80070000
jmp 0x405703
mov eax, 0x8007054f
cmp byte [ebp + 0x10], 0
je 0x405808
cmp eax, 0x80070003
jne 0x405808
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.00406ea0
add esp, 8
cmp dword [ebp - 0x2c], 0
je 0x4057d8
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.00403190
add esp, 8
test al, al
jne 0x4057d8
push 1
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004056b0
add esp, 0xc
mov ecx, dword [eax]
test ecx, ecx
jns 0x405779
mov dword [esi], ecx
lea ecx, [ebp - 0x30]
call fcn.00401420
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d480
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
test eax, eax
push 0
cmovne ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4057b7
push 0x8007054f
call fcn.00406e70
add esp, 4
mov dword [esi], eax
lea ecx, [ebp - 0x30]
call fcn.00401420
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d480
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x30]
mov dword [esi], 0
call fcn.00401420
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d480
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov dword [esi], 0x80070003
test eax, eax
je 0x405823
lea ecx, [ebp - 0x24]
cmp eax, ecx
je 0x405823
push eax
call fcn.0043817b
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d480
mov esp, ebp
pop ebp
ret
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d480
mov esp, ebp
pop ebp
ret
mov dword [esi], 0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d480
mov esp, ebp
pop ebp
ret
Function at 0x405840
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x47e064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
test eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, 0x4777b4
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405896
test al, 0x10
je 0x405896
mov dword [esi], 0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x405969
lea ecx, [ebp + 0x18]
cmp eax, ecx
je 0x405969
push eax
jmp 0x405961
cmp dword [ebp + 0x10], 2
jne 0x4058c5
mov eax, dword [ebp + 0xc]
cmp word [eax + 2], 0x3a
jne 0x4058c5
mov dword [esi], 0x80070002
test eax, eax
je 0x405969
lea ecx, [ebp + 0x18]
cmp eax, ecx
je 0x405969
push eax
jmp 0x405961
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00406ea0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00403190
add esp, 0x10
test al, al
je 0x405908
mov dword [esi], 0x80070002
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x40587a
lea ecx, [ebp - 0x24]
cmp eax, ecx
je 0x40587a
push eax
call fcn.0043817b
add esp, 4
jmp 0x40587a
sub esp, 0x2c
lea eax, [ebp - 0x30]
mov ecx, esp
push eax
call fcn.00401a50
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.00405840
mov eax, dword [ebp - 0x34]
test eax, eax
jns 0x40592c
mov dword [esi], eax
jmp 0x4058ec
push 1
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.004056b0
mov eax, dword [ebp - 0x30]
add esp, 0xc
test eax, eax
je 0x405952
lea ecx, [ebp - 0x24]
cmp eax, ecx
je 0x405952
push eax
call fcn.0043817b
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x405969
lea eax, [ebp + 0x18]
cmp ecx, eax
je 0x405969
push ecx
call fcn.0043817b
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0042d480
mov esp, ebp
pop ebp
ret 0x30
Function at 0x407290
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x47e064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
push 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1c4]
push eax
call fcn.00403660
cmp byte [ebp - 0x1c4], 0
jne 0x4072ee
sub esp, 0x2c
mov ecx, esp
push 0xffffffffffffffff
push str.Installation_file_is_corrupt._Please_visit_http:__gnutoolchains.com_and_re_download_it.
call fcn.00402bb0
push 0x8007054f
mov ecx, esi
call fcn.004090f0
mov esi, 0x8007054f
jmp 0x407413
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x2c], 1
push edi
mov word [ebp - 0x28], ax
call fcn.0040b360
mov al, byte [ebp + 0x14]
lea ecx, [ebp - 0x68]
mov byte [ebp - 6], al
mov al, byte [ebp + 0x18]
push 0xffffffffffffffff
mov byte [ebp - 5], al
lea eax, [ebp - 0x34]
push 0
push eax
mov word [ebp - 8], 1
mov dword [ebp - 0x6c], esi
call fcn.0040b2d0
movzx eax, byte [ebp - 8]
mov esi, dword [ebp - 0x7c]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 0x3c], al
movzx eax, byte [ebp - 7]
mov byte [ebp - 0x3b], al
movzx eax, byte [ebp - 6]
mov byte [ebp - 0x3a], al
movzx eax, byte [ebp - 5]
mov byte [ebp - 0x39], al
test esi, esi
je 0x40738f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 4], eax
je 0x407376
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x407384
push 0xffffffffffffffff
push eax
call edi
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x407384
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x18
push esi
call fcn.0042cd4a
add esp, 8
push 0x18
call fcn.0042cd1a
mov esi, eax
add esp, 4
test esi, esi
je 0x4073be
lea eax, [ebp - 0x1c4]
mov dword [esi], 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 0x10], 0x407a40
mov dword [esi + 0xc], 0x4033a0
jmp 0x4073c0
xor esi, esi
mov dword [ebp - 0x7c], esi
cmp dword [esi], 0xffffffff
jne 0x4073e3
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x409590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
mov esi, dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 4], eax
je 0x4073fa
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4073fa
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [ebp - 0x34]
xor esi, esi
test ecx, ecx
je 0x407413
lea eax, [ebp - 0x28]
cmp ecx, eax
je 0x407413
push ecx
call fcn.0043817b
add esp, 4
lea ecx, [ebp - 0x1c4]
call fcn.00403b70
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0042d480
mov esp, ebp
pop ebp
ret 0x14
Function at 0x408780
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x47e064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x60
push 0
mov dword [ebp - 0x410], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x408], 0
call ebx
mov edi, eax
test edi, edi
jne 0x4087f0
push 2
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x4087f0
call fcn.004046f0
mov esi, eax
jmp 0x4088dc
push dword [ebp - 0x40c]
push dword [ebp - 0x410]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x408813
call fcn.004046f0
jmp 0x4088cf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x40882b
call fcn.004046f0
jmp 0x4088cf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x408846
mov esi, 0x8007000e
jmp 0x4088d1
mov ecx, 2
mul ecx
test edx, edx
ja 0x40890a
jb 0x408860
cmp eax, 0xffffffff
ja 0x40890a
cmp eax, 0x400
jbe 0x408883
push eax
lea ecx, [ebp - 0x408]
call fcn.004044f0
cmp dword [ebp - 0x408], 0
jne 0x40888f
mov esi, 0x8007000e
jmp 0x4088d1
lea eax, [ebp - 0x404]
mov dword [ebp - 0x408], eax
push esi
push dword [ebp - 0x408]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x4088af
call fcn.004046f0
jmp 0x4088cf
mov eax, dword [ebp - 0x408]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x418]
push dword [ebp - 0x408]
call fcn.004085e0
mov esi, eax
test edi, edi
je 0x4088dc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x4088f5
lea ecx, [ebp - 0x408]
call fcn.00406e60
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d480
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00404730
int3
Function at 0x40b1e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
test edx, edx
jne 0x40b201
mov edx, dword [ebp + 0xc]
push edi
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40b1f1
sub edx, edi
sar edx, 1
pop edi
lea eax, [edx*2 + 2]
push eax
push dword [ebp + 0xc]
mov eax, dword [ecx + 4]
push dword [ebp + 0x14]
push 0
push dword [ecx]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40b250
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
test ecx, ecx
je 0x40b242
jle 0x40b247
mov eax, dword [ebp + 8]
movzx ecx, cx
or ecx, 0x80070000
mov dword [eax], ecx
pop ebp
ret 0x10
mov ecx, 0x8007054f
mov eax, dword [ebp + 8]
mov dword [eax], ecx
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
mov dword [eax], 0
pop ebp
ret 0x10
Function at 0x40d5f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x148]
test eax, eax
je 0x40d613
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x40d613
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
movzx eax, word [ebp + 0xc]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x417d20
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x417d4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x417d4b
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x4188c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x4188d1
mov dword [esi], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x418935
push 0
lea ecx, [ebp + 0x14]
push ecx
mov ecx, 0x8000
cmp eax, ecx
cmovae eax, ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
add dword [ecx + 8], edx
adc dword [ecx + 0xc], 0
test esi, esi
je 0x41890e
add dword [esi], edx
test eax, eax
jne 0x418935
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x418926
mov eax, 0x80004005
pop esi
pop ebp
ret 0x10
jle 0x418937
movzx eax, ax
or eax, 0x80070000
pop esi
pop ebp
ret 0x10
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x419120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x419144
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
add dword [ebp + 8], 5
push ebx
lea ebx, [edx - 4]
add ebx, ecx
mov dword [ebp - 0xc], ebx
lea eax, [edi + ecx]
cmp eax, ebx
jae 0x41916a
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x419167
inc eax
cmp eax, ebx
jb 0x419158
mov ecx, dword [ebp - 4]
mov edx, eax
sub edx, edi
mov edi, eax
sub edx, ecx
sub edi, ecx
cmp eax, ebx
jae 0x41926e
cmp edx, 2
jbe 0x4191f3
xor esi, esi
movzx edx, byte [eax + 4]
lea ecx, [edx + 1]
test cl, 0xfe
jne 0x41925a
movzx ecx, byte [eax + 3]
mov ebx, dword [ebp + 8]
shl edx, 8
add ebx, edi
or edx, ecx
movzx ecx, byte [eax + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
add edx, ebx
sub ecx, ebx
cmp dword [ebp + 0x10], 0
cmove edx, ecx
mov dword [ebp - 8], edx
mov ebx, edx
test esi, esi
je 0x41922a
and esi, 6
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x419228
mov ebx, 0x100
shl ebx, cl
mov ecx, dword [ebp + 8]
dec ebx
xor ebx, dword [ebp - 8]
add ecx, edi
cmp dword [ebp + 0x10], 0
je 0x419226
add ebx, ecx
jmp 0x419228
mov ecx, edx
shr esi, cl
test esi, esi
je 0x419183
cmp esi, 4
ja 0x419218
cmp esi, 3
je 0x419218
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x419183
mov ecx, dword [ebp - 4]
or esi, 8
shr esi, 1
inc edi
jmp 0x419151
sub ebx, ecx
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov ecx, dword [ebp - 4]
mov byte [eax + 4], bl
mov eax, 5
mov ebx, dword [ebp - 0xc]
add edi, eax
jmp 0x419151
mov ecx, dword [ebp - 4]
or esi, 8
mov eax, 1
shr esi, 1
add edi, eax
jmp 0x419151
mov eax, dword [ebp + 0xc]
mov ecx, edx
shr esi, cl
xor ecx, ecx
cmp edx, 2
pop ebx
cmovbe ecx, esi
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41b320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx esi, word [ecx]
mov eax, esi
mov dword [ebp - 4], ebx
xor eax, 0x7f0
shr esi, 4
shr eax, 4
mov edx, dword [edi + esi*4]
mov eax, dword [edi + eax*4]
mov dword [ebp + 0xc], eax
movzx eax, word [ecx + 0x10]
mov esi, dword [ebp + 0xc]
shr eax, 4
mov dword [ebp - 0x14], edx
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x41b3a8
mov esi, ecx
mov dword [ebp - 8], eax
add ebx, 4
push edi
push ebx
mov ecx, esi
call fcn.0041d430
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x20]
push edi
push eax
lea ecx, [esi + 0x10]
call fcn.0041d430
mov edx, dword [ebp - 0x14]
add ebx, 0x440
add esi, 0x20
sub dword [ebp - 8], 1
jne 0x41b374
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp ebx, 0x10
jbe 0x41b489
mov eax, dword [ebp - 4]
add ebx, 0xfffffff1
add eax, 0x44
shr ebx, 1
mov dword [ebp - 0x10], eax
movzx eax, word [ecx + 0x10]
xor eax, 0x7f0
shr eax, 4
add esi, dword [edi + eax*4]
lea eax, [ebx + 0x180]
mov dword [ebp + 0xc], esi
lea eax, [ecx + eax*2]
nop dword [eax]
dec ebx
sub eax, 2
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], ebx
lea eax, [ebx + 0x80]
mov ebx, dword [ebp + 8]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x200]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
add esi, dword [edi + ecx*4]
cmp eax, 2
jae 0x41b3f3
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
movzx ecx, word [eax]
mov eax, ecx
xor ecx, 0x7f0
shr eax, 4
shr ecx, 4
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [edx + ebx*8], eax
mov eax, dword [edi + ecx*4]
add eax, esi
mov esi, dword [ebp + 0xc]
mov dword [edx + ebx*8 + 4], eax
mov eax, dword [ebp - 8]
test ebx, ebx
jne 0x41b3e0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
lea ebx, [eax*4 - 0x40]
mov eax, dword [ebp - 0xc]
cmp eax, 1
jbe 0x41b489
lea esi, [ecx + 0x484]
lea edi, [eax - 1]
nop dword [eax]
push ebx
push edx
push esi
call fcn.0042ec90
mov edx, dword [ebp - 0x10]
add esp, 0xc
add esi, 0x440
sub edi, 1
jne 0x41b470
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41b620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov edi, ecx
or edx, 0x100
mov esi, edx
shr edx, 1
and esi, 1
neg esi
shr esi, 4
movzx ecx, word [edi + edx*2]
and esi, 0x7f
shr ecx, 4
xor ecx, esi
add eax, dword [ebx + ecx*4]
cmp edx, 2
jae 0x41b633
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x41b660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, 0x100
mov dword [ebp - 4], ecx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
or edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
add ecx, esi
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
movzx ecx, word [ecx + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add ebx, dword [eax + ecx*4]
mov ecx, edx
xor ecx, edi
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x41b676
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41d430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov dword [ebp - 8], edx
xor ebx, ebx
push esi
mov edx, ecx
push edi
mov dword [ebp - 4], edx
mov edi, ebx
mov esi, ebx
shr esi, 2
shr edi, 1
mov eax, edi
and eax, 1
movzx ecx, word [edx + esi*2 + 4]
neg eax
shr eax, 4
neg esi
and eax, 0x7f
shr ecx, 4
xor ecx, eax
and esi, 0x7f0
movzx eax, word [edx + 2]
xor esi, eax
mov eax, dword [ebp + 0xc]
shr esi, 4
mov edx, dword [eax + ecx*4]
add edx, dword [eax + esi*4]
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
add edx, dword [ebp - 8]
movzx ecx, word [eax + edi*2 + 8]
mov edi, dword [ebp + 8]
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
mov eax, dword [esi + eax*4]
add eax, edx
mov dword [edi + ebx*4], eax
mov eax, dword [esi + ecx*4]
add eax, edx
mov edx, dword [ebp - 4]
mov dword [edi + ebx*4 + 4], eax
add ebx, 2
cmp ebx, 8
jb 0x41d443
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x421010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x47e064]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp + 0x14]
movlpd qword [ebp - 0x50], xmm0
mov esi, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x48], ecx
test esi, esi
ja 0x42113c
jb 0x421053
cmp eax, 0x40
jae 0x42113c
mov byte [ebp + eax - 0x44], 0
add eax, 1
adc esi, 0
jne 0x421065
cmp eax, 0x40
jb 0x421040
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x50], xmm0
jb 0x421127
mov eax, dword [ebp + 8]
ja 0x421084
test eax, eax
je 0x421127
mov esi, dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x50]
nop word [eax + eax]
test edi, edi
je 0x4210aa
movzx eax, bl
or eax, 0
jne 0x4210aa
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
test eax, eax
jne 0x421114
mov ecx, dword [ebp - 0x48]
mov eax, dword [ecx]
push ecx
call dword [eax + 0xc]
mov ecx, dword [ebp - 0x48]
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x10]
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [ebp - 0x48]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
cmp eax, 0x40
ja 0x42110f
xor edx, edx
xor ecx, ecx
test eax, eax
je 0x4210ed
xor edx, dword [ebp + ecx - 0x44]
add ecx, 4
cmp ecx, eax
jb 0x4210e2
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4210f8
cmp edx, dword [eax]
jne 0x42110f
add ebx, 1
adc esi, 0
cmp esi, dword [ebp + 0xc]
ja 0x421127
jb 0x42110a
cmp ebx, dword [ebp + 8]
jae 0x421127
mov ecx, dword [ebp - 0x48]
jmp 0x421090
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d480
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d480
mov esp, ebp
pop ebp
ret 0x14
call fcn.0042d289
int3

Function at 0x421150
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
or eax, 0xffffffff
xor esi, esi
mov ebx, ecx
test edi, edi
je 0x421178
movzx edx, byte [esi + ebx]
inc esi
xor edx, eax
shr eax, 8
movzx ecx, dl
xor eax, dword [ecx*4 + 0x480880]
cmp esi, edi
jb 0x421160
pop edi
pop esi
not eax
pop ebx
ret
Function at 0x422620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ecx + 4]
mov edx, 0x159a55e5
mov ecx, dword [ecx]
push ebx
push esi
mov esi, 1
mov dword [ebp - 0x18], eax
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], esi
push edi
mov edi, 0x1f123bb5
test eax, eax
je 0x4227e6
movzx eax, dx
imul eax, eax, 0x9069
shr edx, 0x10
add edx, eax
movzx eax, di
imul eax, eax, 0x4650
shr edi, 0x10
mov dword [ebp - 4], edx
add edi, eax
mov eax, edx
shl eax, 0x10
add eax, edi
xor eax, dword [ebp + 0xc]
mov ecx, eax
shr eax, 1
and ecx, 1
je 0x4227ef
cmp ebx, 0x400
jb 0x4227ef
mov ecx, eax
mov edx, 1
and ecx, 3
shr eax, 2
inc ecx
shl edx, cl
dec edx
and edx, eax
shr eax, cl
mov ecx, eax
inc edx
shr eax, 3
mov dword [ebp - 8], edx
and ecx, 7
je 0x422799
mov ecx, eax
mov edx, 1
and ecx, 3
shr eax, 2
inc ecx
shl edx, cl
dec edx
and edx, eax
shr eax, cl
add dword [ebp - 8], edx
mov edx, 1
mov ecx, dword [ebp - 0xc]
shl edx, cl
cmp edx, ebx
jae 0x4226fa
mov edx, 1
rol edx, cl
nop dword [eax]
rol edx, 1
inc ecx
cmp edx, ebx
jb 0x4226f0
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
cmp edx, ecx
cmova edx, ecx
mov ecx, 0x15
cmp ecx, edx
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 4]
sbb esi, esi
and esi, 0x10
add esi, 0xf
mov dword [ebp - 0x10], esi
nop word [eax + eax]
and esi, eax
movzx eax, cx
imul eax, eax, 0x9069
add esi, 6
shr ecx, 0x10
mov dword [ebp - 0x20], esi
add ecx, eax
movzx eax, di
imul eax, eax, 0x4650
mov edx, ecx
shr edi, 0x10
mov dword [ebp - 4], ecx
add edi, eax
mov eax, ecx
shl eax, 0x10
add eax, edi
xor eax, dword [ebp + 0xc]
cmp esi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x10]
ja 0x422720
mov ecx, dword [ebp - 0x20]
mov esi, 1
shl esi, cl
dec esi
and esi, eax
cmp esi, ebx
jb 0x422792
mov esi, dword [ebp - 0x10]
movzx eax, dx
imul ecx, eax, 0x9069
movzx eax, di
imul eax, eax, 0x4650
shr edi, 0x10
shr edx, 0x10
add ecx, edx
add edi, eax
mov eax, edi
xor eax, dword [ebp + 0xc]
jmp 0x422720
mov edx, dword [ebp - 8]
inc esi
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x18]
sub eax, ebx
mov dword [ebp - 0x20], 0
cmp edx, eax
cmovbe eax, edx
mov edx, dword [ebp - 0x14]
add edx, ebx
mov dword [ebp - 0x1c], eax
mov ecx, edx
add ebx, eax
sub ecx, esi
mov dword [ebp - 8], ebx
test eax, eax
je 0x4227da
mov esi, dword [ebp - 0x20]
mov ebx, eax
mov al, byte [ecx]
lea edx, [edx + 1]
inc esi
mov byte [edx - 1], al
lea ecx, [ecx + 1]
cmp esi, ebx
jb 0x4227c4
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp ebx, dword [ebp - 0x18]
jb 0x422653
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x14]
mov byte [ecx + ebx], al
inc ebx
jmp 0x4227dd