joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4200aa
Capabilities:
Connect to http server
Parse url

Disassembly:
mov eax, 0x471276
call fcn.0046f99c
sub esp, 0x54
mov eax, dword [ebp + 8]
push ebx
push esi
xor edx, edx
push edi
mov dword [eax + 4], edx
mov dword [ebp - 4], edx
mov dword [eax + 8], 0x490228
mov byte [eax + 0xc], 1
mov dword [eax + 0x24], 0xf
mov dword [eax + 0x20], edx
mov byte [eax + 0x10], dl
lea edi, [eax + 0x2c]
mov dword [eax], 0x490234
mov dword [eax + 8], 0x490238
xor esi, esi
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], edx
mov dword [ebp - 0x10], edi
mov word [edi], si
mov byte [ebp - 4], 2
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], 0x3c
mov edx, dword [ecx + 0x14]
cmp edx, 0x10
jb 0x42011f
mov esi, dword [ecx]
jmp 0x420121
mov esi, ecx
mov eax, dword [ecx + 0x10]
add eax, esi
cmp edx, 0x10
jb 0x42012d
mov ecx, dword [ecx]
push eax
push ecx
lea esi, [ebp - 0x60]
call fcn.00421d26
mov ebx, eax
mov eax, edi
mov byte [ebp - 4], 3
call fcn.00403cb9
push 1
xor edi, edi
mov byte [ebp - 4], 2
call fcn.00403da6
mov ebx, dword [ebp + 8]
push 0x3c
pop edi
push edi
lea esi, [ebx + 0x48]
push 0
push esi
call fcn.0044cca0
mov eax, dword [ebp - 0x10]
or dword [ebx + 0x50], 0xffffffff
or dword [ebx + 0x5c], 0xffffffff
add esp, 0xc
mov dword [esi], edi
cmp dword [eax + 0x14], 8
jb 0x42017b
mov eax, dword [eax]
push esi
xor edi, edi
push edi
push edi
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x4201d3
call fcn.00420286
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041fc81
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.004496da
push eax
lea ecx, [ebx + 0x10]
call fcn.00403c54
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x28]
mov byte [ebx + 0xc], 0
call fcn.004497ca
mov dword [ebp - 0x28], 0x48fda0
push 0x4915c0
lea eax, [ebp - 0x28]
push eax
call fcn.004535e6
mov eax, dword [ebx + 0x5c]
mov ecx, dword [ebx + 0x58]
xor edx, edx
lea esi, [ebp - 0x44]
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], edi
mov word [ebp - 0x44], dx
call fcn.0040b325
mov byte [ebp - 4], 5
cmp dword [ebp - 0x30], 8
mov ecx, dword [ebp - 0x44]
jae 0x420200
mov ecx, esi
movzx edx, word [ebx + 0x60]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push edi
push edi
push 3
push edi
push edi
push edx
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [ebx + 4], eax
cmp eax, edi
jne 0x420267
call fcn.004202f6
push eax
lea ecx, [ebp - 0x28]
call fcn.0041fc81
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.004496da
push eax
lea ecx, [ebx + 0x10]
call fcn.00403c54
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebx + 0xc], 0
call fcn.004497ca
mov dword [ebp - 0x1c], 0x48fda0
push 0x4915c0
lea eax, [ebp - 0x1c]
jmp 0x4201cd
push 1
xor edi, edi
lea esi, [ebp - 0x44]
call fcn.00403da6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x420286
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a45b0], 1
jne 0x4202d9
or dword [0x4a45b0], 1
mov dword [0x4a2a7c], 0x7e585f61
mov dword [0x4a2a80], 0x75464242
mov dword [0x4a2a84], 0x5d555744
mov dword [0x4a2a88], 0x1e5a4463
mov dword [0x4a2a8c], 0x5750161f
mov dword [0x4a2a90], 0x52535a5f
mov byte [0x4a2a94], 0x36
xor eax, eax
mov cl, byte [eax + 0x4a2a7c]
xor cl, 0x36
mov byte [eax + 0x4a2d30], cl
inc eax
cmp eax, 0x19
jb 0x4202db
mov eax, 0x4a2d30
ret

Function at 0x4202f6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a45ac], 1
jne 0x420342
or dword [0x4a45ac], 1
mov dword [0x4a2a98], 0x7e585f61
mov dword [0x4a2a9c], 0x75464242
mov dword [0x4a2aa0], 0x53585859
mov dword [0x4a2aa4], 0x1f1e4255
mov dword [0x4a2aa8], 0x5f575016
mov dword [0x4a2aac], 0x3652535a
xor eax, eax
mov cl, byte [eax + 0x4a2a98]
xor cl, 0x36
mov byte [eax + 0x4a2d4c], cl
inc eax
cmp eax, 0x18
jb 0x420344
mov eax, 0x4a2d4c
ret
Function at 0x42098c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a45a8], 1
jne 0x420a65
or dword [0x4a45a8], 1
mov dword [0x4a2ab0], 0x43475364
mov dword [0x4a2ab4], 0x16424553
mov dword [0x4a2ab8], 0x165a4443
mov dword [0x4a2abc], 0x52534543
mov dword [0x4a2ac0], 0x52165716
mov dword [0x4a2ac4], 0x5350505f
mov dword [0x4a2ac8], 0x42585344
mov dword [0x4a2acc], 0x5e554516
mov dword [0x4a2ad0], 0x16535b53
mov dword [0x4a2ad4], 0x58575e42
mov dword [0x4a2ad8], 0x535e4216
mov dword [0x4a2adc], 0x58595516
mov dword [0x4a2ae0], 0x42555358
mov dword [0x4a2ae4], 0x1658595f
mov dword [0x4a2ae8], 0x16455741
mov dword [0x4a2aec], 0x425f585f
mov dword [0x4a2af0], 0x5f5a575f
mov dword [0x4a2af4], 0x1652534c
mov dword [0x4a2af8], 0x5e425f41
mov byte [0x4a2afc], 0x36
xor eax, eax
mov cl, byte [eax + 0x4a2ab0]
xor cl, 0x36
mov byte [eax + 0x4a2d68], cl
inc eax
cmp eax, 0x4d
jb 0x420a67
mov eax, 0x4a2d68
ret

Function at 0x420a82
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a45a4], 1
jne 0x420b5e
or dword [0x4a45a4], 1
mov dword [0x4a2b00], 0x43475364
mov dword [0x4a2b04], 0x16424553
mov dword [0x4a2b08], 0x165a4443
mov dword [0x4a2b0c], 0x52534543
mov dword [0x4a2b10], 0x52165716
mov dword [0x4a2b14], 0x5350505f
mov dword [0x4a2b18], 0x42585344
mov dword [0x4a2b1c], 0x45595e16
mov dword [0x4a2b20], 0x57581642
mov dword [0x4a2b24], 0x4216535b
mov dword [0x4a2b28], 0x1658575e
mov dword [0x4a2b2c], 0x16535e42
mov dword [0x4a2b30], 0x58585955
mov dword [0x4a2b34], 0x5f425553
mov dword [0x4a2b38], 0x41165859
mov dword [0x4a2b3c], 0x5f164557
mov dword [0x4a2b40], 0x5f425f58
mov dword [0x4a2b44], 0x4c5f5a57
mov dword [0x4a2b48], 0x41165253
mov dword [0x4a2b4c], 0x365e425f
xor eax, eax
mov cl, byte [eax + 0x4a2b00]
xor cl, 0x36
mov byte [eax + 0x4a2db8], cl
inc eax
cmp eax, 0x50
jb 0x420b60
mov eax, 0x4a2db8
ret

Function at 0x420b7b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a45a0], 1
jne 0x420c53
or dword [0x4a45a0], 1
mov dword [0x4a2b50], 0x43475364
mov dword [0x4a2b54], 0x16424553
mov dword [0x4a2b58], 0x165a4443
mov dword [0x4a2b5c], 0x52534543
mov dword [0x4a2b60], 0x52165716
mov dword [0x4a2b64], 0x5350505f
mov dword [0x4a2b68], 0x42585344
mov dword [0x4a2b6c], 0x44594616
mov dword [0x4a2b70], 0x5e421642
mov dword [0x4a2b74], 0x42165857
mov dword [0x4a2b78], 0x5516535e
mov dword [0x4a2b7c], 0x53585859
mov dword [0x4a2b80], 0x595f4255
mov dword [0x4a2b84], 0x57411658
mov dword [0x4a2b88], 0x585f1645
mov dword [0x4a2b8c], 0x575f425f
mov dword [0x4a2b90], 0x534c5f5a
mov dword [0x4a2b94], 0x5f411652
mov word [0x4a2b98], 0x5e42
mov byte [0x4a2b9a], 0x36
xor eax, eax
mov cl, byte [eax + 0x4a2b50]
xor cl, 0x36
mov byte [eax + 0x4a2e08], cl
inc eax
cmp eax, 0x4b
jb 0x420c55
mov eax, 0x4a2e08
ret
Function at 0x420c70
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a459c], 1
jne 0x420cc6
or dword [0x4a459c], 1
mov dword [0x4a2b9c], 0x7e585f61
mov dword [0x4a2ba0], 0x79464242
mov dword [0x4a2ba4], 0x64585346
mov dword [0x4a2ba8], 0x53434753
mov dword [0x4a2bac], 0x1f1e4245
mov dword [0x4a2bb0], 0x5f575016
mov dword [0x4a2bb4], 0x3652535a
xor eax, eax
mov cl, byte [eax + 0x4a2b9c]
xor cl, 0x36
mov byte [eax + 0x4a2e54], cl
inc eax
cmp eax, 0x1c
jb 0x420cc8
mov eax, 0x4a2e54
ret

Function at 0x420ce3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4598], 1
jne 0x420db2
or dword [0x4a4598], 1
mov dword [0x4a2bb8], 0x7e585f61
mov dword [0x4a2bbc], 0x65464242
mov dword [0x4a2bc0], 0x46794253
mov dword [0x4a2bc4], 0x58595f42
mov dword [0x4a2bc8], 0x787f611e
mov dword [0x4a2bcc], 0x6662627e
mov dword [0x4a2bd0], 0x62667969
mov dword [0x4a2bd4], 0x6978797f
mov dword [0x4a2bd8], 0x63757365
mov dword [0x4a2bdc], 0x6f627f64
mov dword [0x4a2be0], 0x777a7069
mov dword [0x4a2be4], 0x161f6571
mov dword [0x4a2be8], 0x44165859
mov dword [0x4a2bec], 0x53434753
mov dword [0x4a2bf0], 0x5e164245
mov dword [0x4a2bf4], 0x5a525857
mov dword [0x4a2bf8], 0x57501653
mov dword [0x4a2bfc], 0x52535a5f
mov byte [0x4a2c00], 0x36
xor eax, eax
mov cl, byte [eax + 0x4a2bb8]
xor cl, 0x36
mov byte [eax + 0x4a2e70], cl
inc eax
cmp eax, 0x49
jb 0x420db4
mov eax, 0x4a2e70
ret

Function at 0x420dcf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4594], 1
jne 0x420e9d
or dword [0x4a4594], 1
mov dword [0x4a2c08], 0x7e585f61
mov dword [0x4a2c0c], 0x65464242
mov dword [0x4a2c10], 0x46794253
mov dword [0x4a2c14], 0x58595f42
mov dword [0x4a2c18], 0x787f611e
mov dword [0x4a2c1c], 0x6662627e
mov dword [0x4a2c20], 0x62667969
mov dword [0x4a2c24], 0x6978797f
mov dword [0x4a2c28], 0x72787365
mov dword [0x4a2c2c], 0x7b7f6269
mov dword [0x4a2c30], 0x62637973
mov dword [0x4a2c34], 0x5859161f
mov dword [0x4a2c38], 0x47534416
mov dword [0x4a2c3c], 0x42455343
mov dword [0x4a2c40], 0x58575e16
mov dword [0x4a2c44], 0x16535a52
mov dword [0x4a2c48], 0x5a5f5750
mov word [0x4a2c4c], 0x5253
mov byte [0x4a2c4e], 0x36
xor eax, eax
mov cl, byte [eax + 0x4a2c08]
xor cl, 0x36
mov byte [eax + 0x4a2ec0], cl
inc eax
cmp eax, 0x47
jb 0x420e9f
mov eax, 0x4a2ec0
ret

Function at 0x420eba
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4590], 1
jne 0x420f23
or dword [0x4a4590], 1
mov dword [0x4a2c50], 0x7e585f61
mov dword [0x4a2c54], 0x77464242
mov dword [0x4a2c58], 0x53645252
mov dword [0x4a2c5c], 0x45534347
mov dword [0x4a2c60], 0x57537e42
mov dword [0x4a2c64], 0x45445352
mov dword [0x4a2c68], 0x50161f1e
mov dword [0x4a2c6c], 0x535a5f57
mov word [0x4a2c70], 0x3652
xor eax, eax
mov cl, byte [eax + 0x4a2c50]
xor cl, 0x36
mov byte [eax + 0x4a2f08], cl
inc eax
cmp eax, 0x22
jb 0x420f25
mov eax, 0x4a2f08
ret
Function at 0x420f40
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a458c], 1
jne 0x420f93
or dword [0x4a458c], 1
mov dword [0x4a2c74], 0x4642427e
mov dword [0x4a2c78], 0x52585365
mov dword [0x4a2c7c], 0x43475364
mov dword [0x4a2c80], 0x1e424553
mov dword [0x4a2c84], 0x5750161f
mov dword [0x4a2c88], 0x52535a5f
mov byte [0x4a2c8c], 0x36
xor eax, eax
mov cl, byte [eax + 0x4a2c74]
xor cl, 0x36
mov byte [eax + 0x4a2f2c], cl
inc eax
cmp eax, 0x19
jb 0x420f95
mov eax, 0x4a2f2c
ret

Function at 0x420fb3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4588], 1
jne 0x421005
or dword [0x4a4588], 1
mov dword [0x4a2c90], 0x4642427e
mov dword [0x4a2c94], 0x44534367
mov dword [0x4a2c98], 0x50587f4f
mov dword [0x4a2c9c], 0x161f1e59
mov dword [0x4a2ca0], 0x5a5f5750
mov word [0x4a2ca4], 0x5253
mov byte [0x4a2ca6], 0x36
xor eax, eax
mov cl, byte [eax + 0x4a2c90]
xor cl, 0x36
mov byte [eax + 0x4a2f48], cl
inc eax
cmp eax, 0x17
jb 0x421007
mov eax, 0x4a2f48
ret
Function at 0x4215b1
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x471200
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
xor ebx, ebx
cmp dword [esi + 4], ebx
jne 0x4215eb
xor al, al
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0x2c], ebx
jne 0x4215fe
push 0x100000
call fcn.0044911e
pop ecx
mov dword [esi + 0x2c], eax
mov dword [esp + 0x10], ebx
jmp 0x421692
cmp dword [esp + 8], ebx
je 0x4216f7
jbe 0x421692
mov eax, 0x100000
cmp dword [esp + 8], eax
ja 0x421622
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push eax
push dword [esi + 0x2c]
push dword [esi + 4]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4216fe
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x10], ebx
je 0x421656
push dword [esp + 0xc]
mov eax, dword [esi + 0x2c]
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x42166b
cmp dword [ebp + 8], ebx
je 0x42166b
push ebx
push dword [esp + 0x10]
push dword [esi + 0x2c]
push dword [ebp + 8]
call fcn.00421875
mov eax, dword [esp + 0xc]
add dword [esp + 0x10], eax
sub dword [esp + 8], eax
cmp dword [edi + 0x10], ebx
je 0x42168c
mov eax, dword [esi + 0x34]
mov ecx, dword [edi + 0x10]
mov edx, dword [ecx]
push eax
push dword [esp + 0x14]
call dword [edx + 4]
cmp dword [esp + 8], ebx
ja 0x421613
push ebx
push ebx
lea eax, [esp + 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x421607
call fcn.0042174b
push eax
lea ecx, [esp + 0x18]
call fcn.0041fc81
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], ebx
call fcn.004496da
push eax
lea ecx, [esi + 0x10]
call fcn.00403c54
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
mov byte [esi + 0xc], bl
call fcn.004497ca
mov dword [esp + 0x20], 0x48fda0
push 0x4915c0
lea eax, [esp + 0x24]
push eax
call fcn.004535e6
mov al, 1
jmp 0x4215d9
call fcn.004217d8
push eax
lea ecx, [esp + 0x24]
call fcn.0041fc81
lea ecx, [esp + 0x20]
mov dword [esp + 0x44], 1
call fcn.004496da
push eax
lea ecx, [esi + 0x10]
call fcn.00403c54
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x30]
mov byte [esi + 0xc], bl
call fcn.004497ca
mov dword [esp + 0x2c], 0x48fda0
push 0x4915c0
lea eax, [esp + 0x30]
jmp 0x4216f1

Function at 0x42174b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4580], 1
jne 0x4217bb
or dword [0x4a4580], 1
mov dword [0x4a2cac], 0x7e585f61
mov dword [0x4a2cb0], 0x67464242
mov dword [0x4a2cb4], 0x4f445343
mov dword [0x4a2cb8], 0x57425772
mov dword [0x4a2cbc], 0x5f574077
mov dword [0x4a2cc0], 0x5a54575a
mov dword [0x4a2cc4], 0x161f1e53
mov dword [0x4a2cc8], 0x5a5f5750
mov word [0x4a2ccc], 0x5253
mov byte [0x4a2cce], 0x36
xor eax, eax
mov cl, byte [eax + 0x4a2cac]
xor cl, 0x36
mov byte [eax + 0x4a2f64], cl
inc eax
cmp eax, 0x23
jb 0x4217bd
mov eax, 0x4a2f64
ret
Function at 0x4217d8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a457c], 1
jne 0x42182d
or dword [0x4a457c], 1
mov dword [0x4a2cd0], 0x5342587f
mov dword [0x4a2cd4], 0x42535844
mov dword [0x4a2cd8], 0x52575364
mov dword [0x4a2cdc], 0x535a5f70
mov dword [0x4a2ce0], 0x50161f1e
mov dword [0x4a2ce4], 0x535a5f57
mov word [0x4a2ce8], 0x3652
xor eax, eax
mov cl, byte [eax + 0x4a2cd0]
xor cl, 0x36
mov byte [eax + 0x4a2f88], cl
inc eax
cmp eax, 0x1a
jb 0x42182f
mov eax, 0x4a2f88
ret

Function at 0x42267b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4560], 1
jne 0x422702
or dword [0x4a4560], 1
mov dword [0x4a2fc0], 0x42175976
mov dword [0x4a2fc4], 0x54524559
mov dword [0x4a2fc8], 0x5e595058
mov dword [0x4a2fcc], 0x1753524d
mov dword [0x4a2fd0], 0x525c5843
mov dword [0x4a2fd4], 0x56401759
mov dword [0x4a2fd8], 0x58511744
mov dword [0x4a2fdc], 0x17535942
mov dword [0x4a2fe0], 0x54174356
mov dword [0x4a2fe4], 0x5645565f
mov dword [0x4a2fe8], 0x45524354
mov word [0x4a2fec], 0x3717
xor eax, eax
mov cl, byte [eax + 0x4a2fc0]
xor cl, 0x37
mov byte [eax + 0x4a3110], cl
inc eax
cmp eax, 0x2e
jb 0x422704
mov eax, 0x4a3110
ret
Function at 0x42481c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x42485e
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x48eec0]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x48eec0]
inc edx
cmp dword [ebp + 8], 0
jne 0x424829
pop esi
not eax
pop ebp
ret

Function at 0x4264a9
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x4264ce
cmp dword [ecx + 0x38], ebx
je 0x4264ce
cmp eax, dword [ecx + 0x10]
jae 0x4264ce
cmp dword [ecx + 0x14], 1
jne 0x4264ce
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x4264d0
xor edi, edi
cmp edi, ebx
je 0x4265b3
cmp esi, ebx
je 0x4265b3
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.00425c52
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x42655f
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.0044cd60
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x426584
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.0044cd60
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x4265b5
xor eax, eax
pop edi
pop ebx
ret
Function at 0x426bde
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cdq
and edx, 3
add eax, edx
sar eax, 2
xor edx, edx
lea ecx, [ecx + eax*4]
neg eax
push esi
je 0x426c1a
mov esi, dword [ecx + eax*4]
imul esi, esi, 0xcc9e2d51
rol esi, 0xf
imul esi, esi, 0x1b873593
xor edx, esi
rol edx, 0xd
imul edx, edx, 5
add edx, 0xe6546b64
inc eax
jne 0x426bf7
mov eax, dword [ebp + 8]
and eax, 3
xor esi, esi
dec eax
je 0x426c3b
dec eax
je 0x426c32
dec eax
jne 0x426c51
movzx esi, byte [ecx + 2]
shl esi, 0x10
movzx eax, byte [ecx + 1]
shl eax, 8
xor esi, eax
movzx eax, byte [ecx]
xor eax, esi
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
xor edx, dword [ebp + 8]
pop esi
mov eax, edx
shr eax, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
pop ebp
ret
Function at 0x42836c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x470b82
call fcn.0046f99c
sub esp, 0xb0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x4283b4
call fcn.0042850e
mov ecx, dword [ebp + 8]
push eax
call fcn.00405a06
mov eax, dword [ebp + 8]
jmp 0x4284ff
test byte [0x4a450c], 1
jne 0x4283d5
or dword [0x4a450c], 1
mov dword [0x4a33f8], 0x18323531
mov byte [0x4a33fc], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a33f8]
xor cl, 0x38
mov byte [eax + 0x4a3bec], cl
inc eax
cmp eax, 5
jb 0x4283d7
push 0xf
mov esi, 0x4a3bec
pop edi
mov eax, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x428402
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.00403bdf
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00403c54
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.0042d708
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403c75
push ebx
push 1
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00403c75
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push dword [ebp + 0xc]
lea esi, [ebp - 0xb8]
call fcn.00428858
pop ecx
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.00428577
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00405a43
add esp, 0xc
push 0x490324
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 6
call fcn.0040c434
add esp, 0xc
push ebx
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 7
call fcn.0040a34b
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.00403c75
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00403c75
push ebx
push 1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.00403c75
mov edi, dword [ebp + 8]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
call fcn.00403b95
push ebx
push 1
mov ecx, esi
call fcn.00403c75
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x42850e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4510], 1
jne 0x42855a
or dword [0x4a4510], 1
mov dword [0x4a33e0], 0x5d4a566d
mov dword [0x4a33e4], 0x565f575b
mov dword [0x4a33e8], 0x5c5d4251
mov dword [0x4a33ec], 0x4a4a5d18
mov dword [0x4a33f0], 0x5b184a57
mov dword [0x4a33f4], 0x385d5c57
xor eax, eax
mov cl, byte [eax + 0x4a33e0]
xor cl, 0x38
mov byte [eax + 0x4a3bd4], cl
inc eax
cmp eax, 0x18
jb 0x42855c
mov eax, 0x4a3bd4
ret
Function at 0x428577
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4508], 1
jne 0x4285b5
or dword [0x4a4508], 1
mov dword [0x4a3400], 0x4a5d1018
mov dword [0x4a3404], 0x184a574a
mov dword [0x4a3408], 0x5d5c575b
mov word [0x4a340c], 0x1802
mov byte [0x4a340e], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a3400]
xor cl, 0x38
mov byte [eax + 0x4a3bf4], cl
inc eax
cmp eax, 0xf
jb 0x4285b7
mov eax, 0x4a3bf4
ret

Function at 0x428858
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
and dword [ebp - 4], 0
test byte [0x4a4504], 1
jne 0x428883
or dword [0x4a4504], 1
mov dword [0x4a3410], 0x5c54541d
mov byte [0x4a3414], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a3410]
xor cl, 0x38
mov byte [eax + 0x4a3c04], cl
inc eax
cmp eax, 5
jb 0x428885
push dword [ebp + 0xc]
lea eax, [ebp - 0x48]
push dword [ebp + 8]
push 0x4a3c04
push eax
call fcn.0042d761
and dword [esi + 0x10], 0
add esp, 0x10
lea eax, [ebp - 0x48]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00403c54
mov eax, esi
leave
ret

Function at 0x428a03
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4500], 1
jne 0x428a5f
or dword [0x4a4500], 1
mov dword [0x4a3418], 0x754c5d7f
mov dword [0x4a341c], 0x544d5c57
mov dword [0x4a3420], 0x54517e5d
mov dword [0x4a3424], 0x5559765d
mov dword [0x4a3428], 0x595e185d
mov dword [0x4a342c], 0x5c5d5451
mov word [0x4a3430], 0x1802
mov byte [0x4a3432], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a3418]
xor cl, 0x38
mov byte [eax + 0x4a3c0c], cl
inc eax
cmp eax, 0x1b
jb 0x428a61
mov eax, 0x4a3c0c
ret

Function at 0x428a7c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a44fc], 1
jne 0x428ad9
or dword [0x4a44fc], 1
mov dword [0x4a3434], 0x7b4c5d6b
mov dword [0x4a3438], 0x5d4a4a4d
mov dword [0x4a343c], 0x517c4c56
mov dword [0x4a3440], 0x4c5b5d4a
mov dword [0x4a3444], 0x18414a57
mov dword [0x4a3448], 0x5451595e
mov dword [0x4a344c], 0x18025c5d
mov byte [0x4a3450], 0x38
xor eax, eax
mov cl, byte [eax + 0x4a3434]
xor cl, 0x38
mov byte [eax + 0x4a3c28], cl
inc eax
cmp eax, 0x1d
jb 0x428adb
mov eax, 0x4a3c28
ret