joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427004]
jne 0x401010
repz ret
jmp fcn.004016df

Function at 0x406568
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004023d2
and dword [ebp - 4], 0
cmp dword [0x4290bc], 0
mov ebx, eax
jne 0x406619
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4066ca
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4066ca
push eax
call fcn.00402360
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4290bc], eax
call esi
push eax
call fcn.00402360
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4290c0], eax
call esi
push eax
call fcn.00402360
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4290c4], eax
call esi
push eax
call fcn.00402360
pop ecx
mov dword [0x4290cc], eax
test eax, eax
je 0x406619
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402360
pop ecx
mov dword [0x4290c8], eax
mov eax, dword [0x4290c8]
cmp eax, ebx
je 0x406671
cmp dword [0x4290cc], ebx
je 0x406671
push eax
call fcn.004023db
push dword [0x4290cc]
mov esi, eax
call fcn.004023db
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406671
test edi, edi
je 0x406671
call esi
test eax, eax
je 0x406668
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406668
test byte [ebp - 0xc], 1
jne 0x406671
or dword [ebp + 0x10], 0x200000
jmp 0x4066aa
mov eax, dword [0x4290c0]
cmp eax, ebx
je 0x4066aa
push eax
call fcn.004023db
pop ecx
test eax, eax
je 0x4066aa
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4066aa
mov eax, dword [0x4290c4]
cmp eax, ebx
je 0x4066aa
push eax
call fcn.004023db
pop ecx
test eax, eax
je 0x4066aa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4290bc]
call fcn.004023db
pop ecx
test eax, eax
je 0x4066ca
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4066cc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x420cdc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x437024]
push dword [0x436d40]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret

Function at 0x420de2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp ebx, 0x19f
jne 0x420df6
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push edi
xor edi, edi
test ebx, ebx
jle 0x420e1a
push esi
and dword [ebp - 4], 0
lea esi, [ebp - 4]
call fcn.00420dd7
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, ebx
jl 0x420dfe
pop esi
pop edi
cmp ebx, 0x2d
jne 0x420e31
or dword [0x437034], 0xffffffff
mov dword [0x437030], 0xa62e7790
leave
ret
Function at 0x61b3b1
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x68
mov eax, dword [reloc.MSVCRT.dll_strncpy]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
mov esi, dword [ebp + 8]
push edi
test edx, edx
jne 0x61b3d4
xorps xmm0, xmm0
movups xmmword [esi], xmm0
push edx
mov edx, ecx
mov dword [esp + 0xc], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.0061aac1
mov ecx, dword [esp + 8]
mov eax, 0x78
shr ecx, 3
mov edi, 0x38
and ecx, 0x3f
sub eax, ecx
sub edi, ecx
cmp ecx, 0x38
lea ecx, [esp + 9]
cmovae edi, eax
xor edx, edx
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [esp + edx + 0x64], al
movzx eax, byte [ecx - 4]
mov byte [esp + edx + 0x65], al
movzx eax, byte [ecx - 3]
mov byte [esp + edx + 0x66], al
movzx eax, byte [ecx - 2]
mov byte [esp + edx + 0x67], al
add edx, 4
cmp edx, 8
jb 0x61b434
push edi
mov edx, 0x100e08c0
lea ecx, [esp + 0xc]
call fcn.0061aac1
push 8
lea edx, [esp + 0x68]
lea ecx, [esp + 0xc]
call fcn.0061aac1
lea edx, [esi + 1]
mov esi, 4
lea eax, [esp + 0x11]
nop dword [eax + eax]
movzx ecx, byte [eax - 1]
lea eax, [eax + 4]
mov byte [edx - 1], cl
lea edx, [edx + 4]
movzx ecx, byte [eax - 4]
mov byte [edx - 4], cl
movzx ecx, byte [eax - 3]
mov byte [edx - 3], cl
movzx ecx, byte [eax - 2]
mov byte [edx - 2], cl
sub esi, 1
jne 0x61b491
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
xor ecx, esp
call fcn.00667949
mov esp, ebp
pop ebp
ret 4
Function at 0x863b17
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x45e33c], 0
jne 0x863b25
call fcn.00863a87
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x863b54
test dl, 7
je 0x863b54
movzx ecx, byte [edx]
movzx edi, al
xor ecx, edi
shr eax, 8
xor eax, dword [ecx*4 + reloc.MSVCRT.dll_strncpy]
dec esi
inc edx
test esi, esi
ja 0x863b37
cmp esi, 8
jb 0x863be3
mov edi, esi
shr edi, 3
jmp 0x863b67
xor eax, dword [edx]
add edx, 8
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + reloc.MSVCRT.dll_strncpy]
sub esi, 8
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + reloc.MSVCRT.dll_strncpy]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + reloc.MSVCRT.dll_strncpy]
mov ecx, eax
movzx eax, cl
mov eax, dword [eax*4 + reloc.MSVCRT.dll_strncpy]
xor eax, dword [edx - 4]
shr ecx, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + reloc.MSVCRT.dll_strncpy]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + reloc.MSVCRT.dll_strncpy]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + reloc.MSVCRT.dll_strncpy]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + reloc.MSVCRT.dll_strncpy]
sub edi, 1
jne 0x863b67
xor ecx, ecx
test esi, esi
jbe 0x863c03
push ebx
movzx edi, byte [ecx + edx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
inc ecx
cmp ecx, esi
jb 0x863bea
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x863c97
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov eax, dword [esp + 4]
inc eax
mov edx, 4
push esi
jmp 0x863ca7
movzx esi, byte [eax - 1]
mov esi, dword [esi*4 + reloc.MSVCRT.dll_strncpy]
xor dword [ecx + reloc.MSVCRT.dll_strncpy], esi
movzx esi, byte [eax]
mov esi, dword [esi*4 + reloc.MSVCRT.dll_strncpy]
xor dword [ecx + reloc.MSVCRT.dll_strncpy], esi
movzx esi, byte [eax + 1]
mov esi, dword [esi*4 + reloc.MSVCRT.dll_strncpy]
xor dword [ecx + reloc.MSVCRT.dll_strncpy], esi
movzx esi, byte [eax + 2]
mov esi, dword [esi*4 + reloc.MSVCRT.dll_strncpy]
xor dword [ecx + reloc.MSVCRT.dll_strncpy], esi
add eax, 4
sub edx, 1
jne 0x863ca7
pop esi
ret 4

Function at 0x863cf7
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, edi
mov esi, ecx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x863d07
sub eax, edx
push eax
push edi
push 0xffffffffffffffff
call fcn.00863b17
mov word [esi + 0x214], ax
shr eax, 0x10
xor ecx, ecx
mov word [esi + 0x216], ax
xor eax, eax
mov word [esi + 0x21a], ax
mov word [esi + 0x218], cx
mov byte [esi + 0x21e], cl
mov byte [esi + 0x21d], cl
mov byte [esi + 0x21c], cl
mov al, byte [edi]
test al, al
je 0x863dad
lea ecx, [ecx]
add byte [esi + 0x21c], al
xor byte [esi + 0x21d], al
mov dl, byte [esi + 0x21e]
add dl, al
rol dl, 1
movzx ecx, al
mov byte [esi + 0x21e], dl
mov dx, word [ecx*4 + 0x45e338]
xor dx, word [esi + 0x218]
movzx ax, al
xor dx, ax
mov word [esi + 0x218], dx
mov cx, word [ecx*4 + 0x45e33a]
add cx, ax
add word [esi + 0x21a], cx
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x863d57
pop edi
pop esi
ret 4
Function at 0x863e97
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
mov eax, ecx
test edi, edi
je 0x863f51
push ebx
push esi
mov esi, dword [esp + 0x10]
jmp 0x863eb7
mov ecx, 0x1234
add word [eax + 0x214], cx
movzx ecx, word [eax + 0x214]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [edx*4 + 0x45e338]
xor word [eax + 0x216], dx
mov bx, word [eax + 0x21a]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [edx*4 + 0x45e33a]
sub word [eax + 0x218], dx
movzx edx, word [eax + 0x218]
xor edx, ecx
mov word [eax + 0x214], dx
mov edx, 1
mov ecx, edx
dec edi
ror bx, cl
inc esi
xor bx, word [eax + 0x216]
ror bx, cl
movzx ecx, bx
xor word [eax + 0x214], cx
mov word [eax + 0x21a], cx
movzx ecx, word [eax + 0x214]
shr ecx, 8
xor byte [esi - 1], cl
test edi, edi
jne 0x863eb7
pop esi
pop ebx
pop edi
ret 8
Function at 0x864f97
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov edx, dword [esi]
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [edi]
cmp eax, edx
jbe 0x864fff
mov ebx, dword [esp + 0x14]
mov ecx, 1
cmp edx, ecx
jb 0x864fdb
mov edx, edi
sub edx, esi
lea eax, [esi + 4]
sub ebx, esi
lea ebx, [ebx]
mov ebp, dword [edx + eax]
xor ebp, dword [eax]
inc ecx
mov dword [ebx + eax], ebp
add eax, 4
cmp ecx, dword [esi]
jbe 0x864fc7
mov ebx, dword [esp + 0x14]
mov eax, dword [edi]
sub eax, dword [esi]
lea edx, [edi + ecx*4]
add eax, eax
add eax, eax
push eax
push edx
lea eax, [ebx + ecx*4]
push eax
call fcn.00892a17
mov ecx, dword [edi]
add esp, 0xc
pop edi
pop esi
pop ebp
mov dword [ebx], ecx
pop ebx
ret 0xc
jae 0x86504f
mov ebx, dword [esp + 0x14]
mov ecx, 1
cmp eax, ecx
jb 0x86502b
mov edx, edi
sub edx, esi
lea eax, [esi + 4]
sub ebx, esi
mov ebp, dword [eax + edx]
xor ebp, dword [eax]
inc ecx
mov dword [eax + ebx], ebp
add eax, 4
cmp ecx, dword [edi]
jbe 0x865017
mov ebx, dword [esp + 0x14]
mov edx, dword [esi]
sub edx, dword [edi]
lea eax, [esi + ecx*4]
add edx, edx
add edx, edx
push edx
push eax
lea ecx, [ebx + ecx*4]
push ecx
call fcn.00892a17
mov edx, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
mov dword [ebx], edx
pop ebx
ret 0xc
test eax, eax
jbe 0x865069
mov edx, edi
lea ecx, [esi + eax*4]
sub edx, esi
mov ebx, dword [ecx + edx]
xor ebx, dword [ecx]
jne 0x865069
dec eax
sub ecx, 4
test eax, eax
ja 0x86505a
mov edx, dword [esp + 0x14]
mov dword [edx], eax
test eax, eax
jbe 0x86508a
sub edi, esi
lea ecx, [esi + eax*4]
sub edx, esi
mov esi, dword [ecx + edi]
xor esi, dword [ecx]
dec eax
mov dword [ecx + edx], esi
sub ecx, 4
test eax, eax
ja 0x86507a
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x865097
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x4c
push ebp
push esi
mov esi, dword [esp + 0x5c]
cmp dword [esi], 0
je 0x8651c1
mov ebp, dword [esp + 0x60]
mov eax, dword [ebp]
test eax, eax
je 0x8651c1
mov ecx, ebp
lea edx, [esp + 8]
sub ecx, edx
push edi
lea ebx, [ebx]
mov edi, dword [0x45ebec]
lea edx, [ecx + eax*4]
sub eax, 1
mov edx, dword [esp + edx + 0xc]
mov edx, dword [edi + edx*4]
mov dword [esp + eax*4 + 0x10], edx
jne 0x8650c7
mov edi, dword [esp + 0x5c]
push ebx
push 0x90
push eax
push edi
call fcn.00892d87
mov ebx, dword [esi]
add esp, 0xc
test ebx, ebx
je 0x86516e
mov ebp, dword [0x45ebe8]
lea esp, [esp]
mov eax, dword [esi + ebx*4]
mov ecx, dword [0x45ebec]
mov esi, dword [ecx + eax*4]
cmp esi, 0x7fff
je 0x865161
mov edx, dword [esp + 0x68]
mov eax, dword [edx]
test eax, eax
je 0x865161
lea ecx, [ebx + eax]
lea edx, [edi + ecx*4 - 4]
jmp 0x865137
mov ecx, dword [esp + eax*4 + 0x10]
cmp ecx, 0x7fff
je 0x865159
add ecx, esi
cmp ecx, 0x7fff
jb 0x865153
add ecx, 0xffff8001
mov ecx, dword [ebp + ecx*4]
xor dword [edx], ecx
dec eax
sub edx, 4
test eax, eax
jne 0x865137
sub ebx, 1
mov esi, dword [esp + 0x64]
jne 0x865107
mov ebp, dword [esp + 0x68]
mov edx, dword [esi]
mov eax, dword [ebp]
lea ecx, [edx + eax - 1]
cmp ecx, 0x11
mov dword [edi], ecx
pop ebx
jle 0x86519e
lea eax, [edi + ecx*4 - 0x38]
lea edx, [ecx - 0x11]
nop
mov ecx, dword [eax + 0x38]
xor dword [eax - 0xc], ecx
xor dword [eax], ecx
mov dword [eax + 0x38], 0
sub eax, 4
sub edx, 1
jne 0x865187
cmp dword [edi], 0x11
jbe 0x8651b8
mov dword [edi], 0x11
mov eax, dword [edi]
cmp dword [edi + eax*4], 0
jne 0x8651b8
dec eax
mov dword [edi], eax
test eax, eax
jne 0x8651a9
pop edi
pop esi
pop ebp
add esp, 0x4c
ret 0xc
mov ecx, dword [esp + 0x58]
pop esi
mov dword [ecx], 0
pop ebp
add esp, 0x4c
ret 0xc
Function at 0x8651d7
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
xor ebp, ebp
cmp eax, ebp
je 0x8652bc
mov ecx, dword [edi + eax*4]
push ebx
mov ebx, dword [0x45ebec]
mov ecx, dword [ebx + ecx*4]
push esi
cmp ecx, 0x7fff
je 0x865222
add ecx, ecx
cmp ecx, 0x7fff
jb 0x86520f
add ecx, 0xffff8001
mov edx, dword [0x45ebe8]
mov ecx, dword [edx + ecx*4]
mov esi, dword [esp + 0x14]
mov dword [esi + eax*8 - 4], ecx
jmp 0x86522a
mov esi, dword [esp + 0x14]
mov dword [esi + eax*8 - 4], ebp
mov ecx, dword [edi]
sub ecx, 1
je 0x86526f
lea edx, [esi + ecx*8 - 4]
mov edi, edi
mov dword [edx + 4], ebp
mov eax, dword [edi + ecx*4]
mov eax, dword [ebx + eax*4]
cmp eax, 0x7fff
je 0x865265
add eax, eax
cmp eax, 0x7fff
jb 0x865255
add eax, 0xffff8001
mov ebp, dword [0x45ebe8]
mov eax, dword [ebp + eax*4]
mov dword [edx], eax
xor ebp, ebp
jmp 0x865267
mov dword [edx], ebp
dec ecx
sub edx, 8
cmp ecx, ebp
jne 0x865237
mov eax, dword [edi]
lea ecx, [eax + eax - 1]
cmp ecx, 0x11
mov dword [esi], ecx
jle 0x86529a
lea eax, [esi + ecx*4 - 0x38]
lea edx, [ecx - 0x11]
lea esp, [esp]
mov ecx, dword [eax + 0x38]
xor dword [eax - 0xc], ecx
xor dword [eax], ecx
mov dword [eax + 0x38], ebp
sub eax, 4
sub edx, 1
jne 0x865287
cmp dword [esi], 0x11
jbe 0x8652b5
mov dword [esi], 0x11
mov edi, edi
mov eax, dword [esi]
cmp dword [esi + eax*4], ebp
jne 0x8652b5
dec eax
mov dword [esi], eax
cmp eax, ebp
jne 0x8652a7
pop esi
pop ebx
pop edi
pop ebp
ret 8
mov ecx, dword [esp + 0xc]
pop edi
mov dword [ecx], ebp
pop ebp
ret 8
Function at 0x875c37
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, ecx
mov cl, byte [eax + 0xcc49]
mov byte [ebp + 0x14a5], cl
mov dl, byte [eax + 0xcc4a]
mov byte [ebp + 0x14a4], dl
mov ecx, dword [eax + reloc.MSVCRT.dll_strncpy]
push esi
mov dword [ebp + reloc.MSVCRT.dll_strncpy], ecx
mov edx, dword [eax + reloc.MSVCRT.dll_strncpy]
push edi
add eax, 0xcaa0
push eax
lea ecx, reloc.MSVCRT.dll_strncpy
mov dword [ebp + reloc.MSVCRT.dll_strncpy], edx
call fcn.0085d967
mov ecx, dword [ebp + 0x20]
cmp ecx, 0x400000
jae 0x875cea
mov edx, dword [ebp + reloc.MSVCRT.dll_strncpy]
cmp edx, ecx
jae 0x875cbb
mov esi, 0x400000
mov eax, edx
sub esi, ecx
lea esp, [esp]
mov ecx, dword [ebp]
lea edx, [ecx + esi]
mov dl, byte [edx + eax]
mov byte [ecx + eax], dl
inc eax
cmp eax, dword [ebp + 0x20]
jb 0x875ca7
jmp 0x875cea
sub edx, ecx
xor eax, eax
mov esi, edx
test ecx, ecx
jbe 0x875cd9
mov edi, edi
mov ecx, dword [ebp]
lea edx, [ecx + esi]
mov dl, byte [edx + eax]
mov byte [ecx + eax], dl
inc eax
cmp eax, dword [ebp + 0x20]
jb 0x875cc7
mov dword [ebp + reloc.MSVCRT.dll_strncpy], 0
mov byte [ebp + 0x14a5], 1
mov esi, dword [ebp]
mov edi, dword [ebp + 0x20]
add edi, esi
cmp dword [esp + 0x18], 0
mov ecx, 0x44
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, dword [ebp + reloc.MSVCRT.dll_strncpy]
lea eax, [ebx + 1]
jne 0x875d60
mov esi, dword [ebp + 0x24]
and eax, esi
xor edx, edx
mov dword [ebp + reloc.MSVCRT.dll_strncpy], eax
cmp eax, ebx
je 0x875d89
mov ecx, dword [ebp]
movzx ecx, byte [eax + ecx + 2]
shl edx, 5
xor ecx, edx
mov edx, dword [ebp + 0x10]
and ecx, 0x7fff
lea edi, [edx + ecx*4]
mov edx, dword [edi]
mov dword [edi], eax
mov eax, dword [ebp + reloc.MSVCRT.dll_strncpy]
and edx, esi
mov esi, dword [ebp + 0x14]
mov dword [esi + eax*4], edx
mov eax, dword [ebp + reloc.MSVCRT.dll_strncpy]
mov esi, dword [ebp + 0x24]
inc eax
and eax, esi
mov edx, ecx
mov dword [ebp + reloc.MSVCRT.dll_strncpy], eax
cmp eax, ebx
jne 0x875d1b
jmp 0x875d89
and eax, dword [ebp + 0x24]
mov dword [ebp + reloc.MSVCRT.dll_strncpy], eax
cmp eax, ebx
je 0x875d89
push eax
mov ecx, ebp
call fcn.00873187
mov eax, dword [ebp + reloc.MSVCRT.dll_strncpy]
inc eax
and eax, dword [ebp + 0x24]
mov dword [ebp + reloc.MSVCRT.dll_strncpy], eax
cmp eax, ebx
jne 0x875d6d
mov esi, dword [esp + 0x14]
push 0x4bf0
add esi, 0x10
lea ecx, reloc.MSVCRT.dll_strncpy
push esi
push ecx
mov byte [ebp + 0x60a4], 0
call fcn.00892a17
add esp, 0xc
mov ecx, esi
call fcn.0088abe7
lea ecx, reloc.MSVCRT.dll_strncpy
call fcn.00878427
pop edi
xor eax, eax
pop esi
mov dword [ebp + reloc.MSVCRT.dll_strncpy], eax
mov dword [ebp + reloc.MSVCRT.dll_strncpy], eax
mov byte [ebp + 0x97c], 1
pop ebp
pop ebx
ret 8
Function at 0x883da7
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x4597d0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
mov ebp, ecx
mov ecx, 8
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
xor ecx, ecx
xor eax, eax
lea esp, [esp]
cmp edi, 0xa
jg 0x883f04
cmp eax, 4
jge 0x883e1d
mov edi, edi
cmp ecx, 4
jge 0x883e20
mov bl, byte [esp + eax*4 + 0x10]
lea edx, [ecx + edi*4]
mov byte [ebp + edx*4 + 0x14], bl
lea edx, [ecx + edi*4]
lea esi, [ebp + edx*4]
movzx edx, byte [esp + eax*4 + 0x11]
mov byte [esi + 0x15], dl
movzx edx, byte [esp + eax*4 + 0x12]
mov byte [esi + 0x16], dl
movzx edx, byte [esp + eax*4 + 0x13]
inc eax
inc ecx
cmp eax, 4
mov byte [esi + 0x17], dl
jl 0x883de7
cmp ecx, 4
jne 0x883e25
inc edi
xor ecx, ecx
cmp eax, 4
jl 0x883dd7
cmp edi, 0xa
jg 0x883f04
mov edx, 0x467688
movzx esi, byte [esp + 0x1d]
mov al, byte [esp + 0x10]
xor al, byte [esi + 0x4677a8]
movzx esi, byte [esp + 0x1e]
movzx ebx, byte [esi + 0x4677a8]
movzx esi, byte [esp + 0x1f]
xor byte [esp + 0x11], bl
movzx ebx, byte [esi + 0x4677a8]
movzx esi, byte [esp + 0x1c]
xor byte [esp + 0x12], bl
movzx ebx, byte [esi + 0x4677a8]
xor al, byte [edx]
xor byte [esp + 0x13], bl
mov byte [esp + 0x10], al
inc edx
lea eax, [esp + 0x11]
mov esi, 3
movzx ebx, byte [eax - 1]
xor byte [eax + 3], bl
movzx ebx, byte [eax]
xor byte [eax + 4], bl
movzx ebx, byte [eax + 1]
xor byte [eax + 5], bl
movzx ebx, byte [eax + 2]
xor byte [eax + 6], bl
add eax, 4
sub esi, 1
jne 0x883e87
xor eax, eax
cmp edi, 0xa
jg 0x883f04
cmp eax, 4
jge 0x883eee
nop
cmp ecx, 4
jge 0x883ef1
movzx ebx, byte [esp + eax*4 + 0x10]
lea esi, [ecx + edi*4]
mov byte [ebp + esi*4 + 0x14], bl
movzx ebx, byte [esp + eax*4 + 0x11]
lea esi, [ecx + edi*4]
lea esi, [ebp + esi*4]
mov byte [esi + 0x15], bl
movzx ebx, byte [esp + eax*4 + 0x12]
mov byte [esi + 0x16], bl
movzx ebx, byte [esp + eax*4 + 0x13]
inc eax
inc ecx
cmp eax, 4
mov byte [esi + 0x17], bl
jl 0x883eb7
cmp ecx, 4
jne 0x883ef6
inc edi
xor ecx, ecx
cmp eax, 4
jl 0x883eac
cmp edi, 0xa
jle 0x883e38
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00892869
add esp, 0x24
ret 4
Function at 0x883f27
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x4597d0]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
mov eax, ecx
push edi
lea esi, [eax + 0x24]
lea ecx, [eax + 0x28]
mov edi, 9
mov edi, edi
xor eax, eax
jmp 0x883f57
movzx edx, byte [ecx - 1]
movzx edx, byte [eax + edx*4 + 0x464688]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x464a88]
movzx ebx, byte [ecx - 3]
xor dl, byte [eax + ebx*4 + 0x464e88]
movzx ebx, byte [ecx - 4]
xor dl, byte [eax + ebx*4 + 0x465288]
movzx ebx, byte [ecx + 2]
mov byte [esp + eax + 0xc], dl
movzx edx, byte [ecx + 3]
movzx edx, byte [eax + edx*4 + 0x464688]
xor dl, byte [eax + ebx*4 + 0x464a88]
movzx ebx, byte [ecx + 1]
xor dl, byte [eax + ebx*4 + 0x464e88]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x465288]
movzx ebx, byte [ecx + 6]
mov byte [esp + eax + 0x10], dl
movzx edx, byte [ecx + 7]
movzx edx, byte [eax + edx*4 + 0x464688]
xor dl, byte [eax + ebx*4 + 0x464a88]
movzx ebx, byte [ecx + 5]
xor dl, byte [eax + ebx*4 + 0x464e88]
movzx ebx, byte [ecx + 4]
xor dl, byte [eax + ebx*4 + 0x465288]
movzx ebx, byte [ecx + 0xa]
mov byte [esp + eax + 0x14], dl
movzx edx, byte [ecx + 0xb]
movzx edx, byte [eax + edx*4 + 0x464688]
xor dl, byte [eax + ebx*4 + 0x464a88]
movzx ebx, byte [ecx + 9]
xor dl, byte [eax + ebx*4 + 0x464e88]
movzx ebx, byte [ecx + 8]
xor dl, byte [eax + ebx*4 + 0x465288]
inc eax
cmp eax, 4
mov byte [esp + eax + 0x17], dl
jl 0x883f57
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esi], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
add ecx, 0x10
add esi, 0x10
sub edi, 1
jne 0x883f47
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00892869
add esp, 0x14
ret
Function at 0x8851f7
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x4597d0]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
push ebx
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
mov ebx, ecx
test eax, eax
ja 0x885230
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00892869
add esp, 0x18
ret 0xc
mov ecx, dword [esi + 4]
xor ecx, dword [ebx + 8]
mov edx, dword [esi + 8]
xor edx, dword [ebx + 0xc]
shr eax, 4
push ebp
mov ebp, eax
mov eax, dword [esi]
xor eax, dword [ebx + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
xor eax, dword [ebx + 0x10]
push edi
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
call fcn.00884067
add esi, 0x10
add ebp, reloc.MSVCRT.dll_strncpy
je 0x8852b5
nop
mov edx, dword [edi]
xor edx, dword [esi]
mov eax, dword [edi + 4]
xor eax, dword [esi + 4]
mov ecx, dword [edi + 8]
xor ecx, dword [esi + 8]
mov dword [esp + 0x14], edx
mov edx, dword [edi + 0xc]
xor edx, dword [esi + 0xc]
mov dword [esp + 0x18], eax
add edi, 0x10
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x20], ecx
push eax
mov ecx, ebx
mov dword [esp + 0x28], edx
call fcn.00884067
add esi, 0x10
sub ebp, 1
jne 0x885277
mov ecx, dword [edi]
mov dword [ebx + 4], ecx
mov edx, dword [edi + 4]
mov dword [ebx + 8], edx
mov eax, dword [edi + 8]
mov dword [ebx + 0xc], eax
mov ecx, dword [edi + 0xc]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [ebx + 0x10], ecx
mov ecx, dword [esp + 0x1c]
pop esi
pop ebx
xor ecx, esp
shl eax, 4
call fcn.00892869
add esp, 0x18
ret 0xc