joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405a6c
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0xbc
push esi
mov esi, dword [ebp + 0x6c]
push edi
push 0x40
pop eax
cmp esi, eax
jae 0x405a85
mov eax, esi
push eax
push dword [ebp + 0x68]
lea eax, [ebp - 0x44]
push eax
call fcn.0041b4f0
add esp, 0xc
lea eax, [ebp + 0x20]
push eax
mov byte [ebp + esi - 0x44], 0
mov byte [ebp + esi - 0x43], 0
mov byte [ebp + esi - 0x42], 0
mov byte [ebp + esi - 0x41], 1
add esi, 4
push esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.0040592f
push 0x20
pop esi
push esi
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp]
push eax
call fcn.0041b4f0
mov eax, dword [ebp + 0x7c]
add esp, 0xc
dec eax
mov dword [ebp + 0x4c], eax
push 0x10
pop eax
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x70]
mov dword [ebp + 0x40], eax
mov eax, dword [ebp + 0x74]
mov dword [ebp + 0x44], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x48], eax
xor edi, edi
mov eax, dword [ebp + edi + 0x4c]
test eax, eax
jbe 0x405b3c
mov dword [ebp + 0x6c], eax
lea eax, [ebp - 0x64]
push eax
push esi
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.0040592f
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0041b4f0
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax + 0x20]
xor byte [ebp + eax], cl
inc eax
cmp eax, esi
jb 0x405b2a
dec dword [ebp + 0x6c]
jne 0x405b03
push esi
lea eax, [ebp]
push eax
push dword [ebp + edi + 0x40]
call fcn.0041b4f0
add edi, 4
add esp, 0xc
cmp edi, 0xc
jb 0x405af8
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.0040cb60
push esi
lea eax, [ebp]
push eax
call fcn.0040cb60
push esi
lea eax, [ebp + 0x20]
push eax
call fcn.0040cb60
push esi
lea eax, [ebp - 0x64]
push eax
call fcn.0040cb60
pop edi
pop esi
add ebp, 0x58
leave
ret 0x20
Function at 0x405b87
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push ebx
push edi
mov edi, dword [ebp + 0x1c]
mov ebx, ecx
mov dword [ebp - 4], ebx
cmp edi, 0x18
ja 0x405d30
and dword [ebp + 0x1c], 0
push esi
lea esi, [ebx + 0x102]
cmp dword [esi + 0x12], edi
jne 0x405bd7
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.0040cc2f
test al, al
je 0x405bd7
push 0x10
push dword [ebp + 0x14]
push esi
call fcn.00419e64
add esp, 0xc
test eax, eax
je 0x405d36
inc dword [ebp + 0x1c]
add ebx, 0x178
cmp dword [ebp + 0x1c], 4
jb 0x405ba8
mov esi, 0x200
push esi
lea eax, [ebp - 0x264]
push eax
push dword [ebp + 0x10]
call fcn.004112d3
xor eax, eax
inc eax
mov ecx, edi
shl eax, cl
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x10
push dword [ebp + 0x14]
lea eax, [ebp - 0x264]
push eax
call fcn.00419d70
pop ecx
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.00405a6c
push esi
lea eax, [ebp - 0x264]
push eax
call fcn.0040cb60
mov edx, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
lea eax, [edx + 0x5e0]
mov ecx, dword [eax]
mov ebx, ecx
and ebx, 3
imul ebx, ebx, 0x178
add ebx, edx
inc ecx
mov dword [eax], ecx
push 0x40
mov dword [ebx + 0x114], edi
pop ecx
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 0x10
push dword [ebp + 0x14]
lea eax, [ebx + 0x102]
push eax
movsw word es:[edi], word [esi]
call fcn.0041b4f0
push 0x20
pop esi
push esi
lea eax, [ebp - 0x24]
push eax
lea edi, [ebx + 0x118]
push edi
call fcn.0041b4f0
push esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebx + 0x138]
push eax
call fcn.0041b4f0
push esi
lea eax, [ebp - 0x64]
push eax
add ebx, 0x158
push ebx
call fcn.0041b4f0
add esp, 0x30
push 1
push esi
push edi
call fcn.0040caba
xor ebx, ebx
cmp dword [ebp + 0x20], ebx
je 0x405cd2
push esi
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0x20]
call fcn.0041b4f0
add esp, 0xc
mov edi, dword [ebp + 0x24]
cmp edi, ebx
je 0x405d03
push 8
push ebx
push edi
call fcn.00419b00
add esp, 0xc
xor ecx, ecx
mov dl, byte [ebp + ecx - 0x44]
mov eax, ecx
and eax, 7
add eax, edi
xor byte [eax], dl
inc ecx
cmp ecx, esi
jb 0x405ce7
push esi
lea eax, [ebp - 0x44]
push eax
call fcn.0040cb60
cmp dword [ebp + 0x18], ebx
je 0x405d25
push dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
push 0x100
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
add ecx, 0x5e8
call fcn.0040c90d
push esi
lea eax, [ebp - 0x24]
push eax
call fcn.0040cb60
pop esi
pop edi
pop ebx
leave
ret 0x20
push 0
push 0x20
pop esi
push esi
lea edi, [ebx + 0x118]
push edi
call fcn.0040caba
push esi
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.0041b4f0
add esp, 0xc
push 1
push esi
push edi
call fcn.0040caba
push esi
lea eax, [ebx + 0x138]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0041b4f0
push esi
add ebx, 0x158
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.0041b4f0
add esp, 0x18
jmp 0x405cbb
Function at 0x405e03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 2
jne 0x405e55
lea eax, [ebp + 8]
push eax
push dword [esi + 4]
call fcn.00404829
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp + 8]
push eax
push 0x20
push dword [ebp + 0xc]
call fcn.0040592f
xor edx, edx
mov dword [esi + 4], edx
xor eax, eax
push ebx
movzx ebx, byte [ebp + eax - 0x20]
mov ecx, eax
and ecx, 3
shl ecx, 3
shl ebx, cl
xor edx, ebx
inc eax
cmp eax, 0x20
jb 0x405e3a
mov dword [esi + 4], edx
pop ebx
cmp dword [esi], 3
jne 0x405e7d
lea eax, [ebp - 0x20]
push eax
push 0x20
add esi, 4
push esi
push 0x20
push dword [ebp + 0xc]
call fcn.0040592f
push 0x20
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0041b4f0
add esp, 0xc
pop esi
leave
ret 8

Function at 0x4061be
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00419e00
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x406234
push esi
push dword [ebp + 8]
call fcn.00419a83
pop ecx
push dword [ebp + 8]
mov esi, eax
call fcn.0040a50f
test al, al
jne 0x406211
lea eax, [ebp - 0x1000]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1000]
push eax
call fcn.00419a83
pop ecx
lea esi, [esi + eax + 1]
mov eax, 0x104
cmp esi, eax
pop esi
jbe 0x406234
push eax
push 0xc3
call fcn.0040c05e
push eax
push 0x426558
call fcn.0040df6e
add esp, 0xc
leave
ret 4
Function at 0x40835b
Capabilities:
Move file

Disassembly:
mov eax, 0x42589e
call fcn.00419784
mov eax, 0x5028
call fcn.00419e00
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x800
push esi
lea eax, [ebp - 0x5034]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x408518
cmp eax, esi
jae 0x408518
push esi
lea eax, [ebp - 0x4034]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x408518
cmp eax, esi
jae 0x408518
lea eax, [ebp - 0x5034]
push eax
call fcn.0040a11f
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4034]
push eax
call fcn.0040a11f
mov edi, eax
cmp word [edi], 0
je 0x408518
push edi
push dword [ebp - 0x10]
call fcn.0041154c
test eax, eax
je 0x408518
push edi
push ebx
call fcn.0040a11f
push eax
call fcn.0041154c
test eax, eax
jne 0x408518
mov word [ebp - 0x1010], ax
xor edi, edi
cmp word [ebp - 0x1010], 0
jne 0x408474
push esi
push ebx
lea eax, [ebp - 0x1010]
push eax
call fcn.00410823
push edi
push str.rtmp_d
push esi
lea eax, [ebp - 0x1010]
push eax
call fcn.0040a11f
push eax
call fcn.0040b8bd
add esp, 0x10
lea eax, [ebp - 0x1010]
push eax
call fcn.004091fc
test al, al
je 0x40845b
xor eax, eax
mov word [ebp - 0x1010], ax
add edi, 0x7b
cmp edi, 0x2710
jl 0x40840e
cmp word [ebp - 0x1010], 0
je 0x408518
push esi
push ebx
lea eax, [ebp - 0x3034]
push eax
call fcn.00410823
push esi
push dword [ebp - 0x10]
lea eax, [ebp - 0x3034]
push eax
call fcn.0040a289
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x3034]
push eax
call esi
test eax, eax
je 0x408518
lea ecx, [ebp - 0x2034]
call fcn.00408713
push dword [ebp + 8]
and dword [ebp - 4], 0
xor bl, bl
call fcn.004091fc
test al, al
jne 0x4084db
push 9
push dword [ebp + 8]
lea ecx, [ebp - 0x2034]
call fcn.0040888d
mov bl, al
lea eax, [ebp - 0x3034]
push eax
lea eax, [ebp - 0x1010]
push eax
call esi
test bl, bl
je 0x408505
lea ecx, [ebp - 0x2034]
call fcn.00408987
lea ecx, [ebp - 0x2034]
call fcn.004089d7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2034]
call fcn.00408bcf
mov al, 1
jmp 0x40851a
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x408a00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp dword [ebp + 0xc], ebx
je 0x408afa
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x408a2f
dec eax
je 0x408a24
dec eax
jne 0x408a2f
push 0xfffffffffffffff4
jmp 0x408a26
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push edi
mov dword [ebp - 4], ebx
cmp dword [esi + 0xc], ebx
je 0x408a7a
xor edi, edi
cmp dword [ebp + 0xc], ebx
jbe 0x408a99
mov eax, dword [ebp + 0xc]
sub eax, edi
mov ecx, 0x4000
cmp eax, ecx
jb 0x408a4f
mov eax, ecx
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec eax
neg eax
sbb al, al
inc al
je 0x408a99
add edi, 0x4000
cmp edi, dword [ebp + 0xc]
jb 0x408a3f
jmp 0x408a95
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec eax
neg eax
sbb al, al
inc al
cmp al, bl
jne 0x408af5
cmp byte [esi + 0x14], bl
je 0x408af5
cmp dword [esi + 0xc], ebx
jne 0x408af5
push ebx
lea eax, [esi + 0x1e]
mov edi, 0x42e76c
push eax
mov ecx, edi
call fcn.004062fa
test al, al
je 0x408ae9
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x408a30
cmp eax, ebx
jbe 0x408a30
mov edi, dword [esi]
push ebx
mov ecx, esi
call dword [edi + 0xc]
mov ecx, dword [ebp - 4]
xor ebx, ebx
sub eax, ecx
sbb edx, ebx
push edx
push eax
mov ecx, esi
call dword [edi + 8]
jmp 0x408a30
lea eax, [esi + 0x1e]
push eax
push ebx
mov ecx, edi
call fcn.00406462
mov byte [esi + 8], 1
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x408bf2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
mov edi, 0x4e20
jne 0x408c19
cmp dword [ebp + 0xc], edi
jbe 0x408c0e
mov dword [ebp + 0xc], edi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x408c82
mov ecx, esi
call fcn.00408bac
test al, al
je 0x408c4f
cmp dword [ebp + 0xc], edi
jbe 0x408c4f
push edi
push dword [ebp + 8]
mov ecx, esi
call fcn.00408bf2
jmp 0x408c85
cmp dword [esi + 0xc], 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x408c66
call ebx
cmp eax, 0x6d
jne 0x408c66
xor eax, eax
jmp 0x408c85
cmp dword [esi + 0xc], 0
jne 0x408c7d
mov edi, 0x8000
cmp dword [ebp + 0xc], edi
jbe 0x408c7d
call ebx
cmp eax, 0x21
je 0x408c42
or eax, 0xffffffff
jmp 0x408c85
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x408f98
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00419e00
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
push dword [ebp + 8]
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x408fdc
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.0040a5d3
test al, al
je 0x408fdc
lea eax, [ebp - 0x1000]
push eax
call esi
mov edi, eax
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x408fe4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00419e00
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call esi
test eax, eax
setne bl
test bl, bl
jne 0x409033
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.0040a5d3
test al, al
je 0x409033
push dword [ebp + 0xc]
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
setne bl
pop esi
mov al, bl
pop ebx
leave
ret 8

Function at 0x409220
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00419e00
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
mov edi, dword [ebp + 8]
push 0
push edi
call esi
test eax, eax
jne 0x409270
push edi
call fcn.004091fc
test al, al
jne 0x409283
push 0x800
lea eax, [ebp - 0x1000]
push eax
push edi
call fcn.0040a5d3
test al, al
je 0x409283
push 0
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
je 0x409283
cmp byte [ebp + 0xc], 0
je 0x40927f
push dword [ebp + 0x10]
push edi
call fcn.00408fe4
xor eax, eax
jmp 0x40929b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x409298
cmp eax, 3
je 0x409298
xor eax, eax
inc eax
jmp 0x40929b
push 2
pop eax
pop edi
pop esi
leave
ret 0xc
Function at 0x4093b9
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1250
call fcn.00419e00
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [ebp - 0x250]
mov edi, 0x800
push eax
jne 0x409448
push dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
call ebx
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x409475
push edi
lea eax, [ebp - 0x1250]
push eax
push dword [ebp + 0xc]
call fcn.0040a5d3
test al, al
je 0x409421
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x1250]
push eax
call ebx
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x409475
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40943b
cmp eax, 3
je 0x40943b
cmp eax, 0x12
je 0x40943b
xor eax, eax
inc eax
jmp 0x40943d
xor eax, eax
mov byte [esi + 0x1044], al
jmp 0x409540
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40946b
or dword [ebp + 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [esi + 0x1044], al
cmp dword [ebp + 8], 0xffffffff
je 0x409540
push edi
push dword [ebp + 0xc]
push esi
call fcn.00410823
push edi
lea eax, [ebp - 0x224]
push eax
push esi
call fcn.0040a289
push 1
push 0
push 0
push dword [ebp - 0x234]
call fcn.00419e30
mov ecx, dword [ebp - 0x230]
xor edi, edi
add eax, ecx
mov dword [esi + 0x1000], eax
mov eax, dword [ebp - 0x250]
mov dword [esi + 0x1008], eax
mov eax, dword [ebp - 0x24c]
mov dword [esi + 0x1028], eax
mov eax, dword [ebp - 0x248]
mov dword [esi + 0x102c], eax
mov eax, dword [ebp - 0x244]
mov dword [esi + 0x1030], eax
mov eax, dword [ebp - 0x240]
mov dword [esi + 0x1034], eax
mov eax, dword [ebp - 0x23c]
mov dword [esi + 0x1038], eax
mov eax, dword [ebp - 0x238]
mov dword [esi + 0x103c], eax
lea eax, [ebp - 0x23c]
adc edx, edi
push eax
lea ecx, [esi + 0x1010]
mov dword [esi + 0x1004], edx
call fcn.00410f3c
lea eax, [ebp - 0x24c]
push eax
lea ecx, [esi + 0x1018]
call fcn.00410f3c
lea eax, [ebp - 0x244]
push eax
lea ecx, [esi + 0x1020]
call fcn.00410f3c
and dword [esi + 0x1040], 0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40a5d3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00419e00
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.0040a068
push esi
call fcn.00419a83
pop ecx
push esi
mov ebx, eax
call fcn.0040a50f
test al, al
je 0x40a68d
push esi
call fcn.0040a068
test al, al
je 0x40a63d
add ebx, 4
cmp dword [ebp + 0x10], ebx
jbe 0x40a756
mov edi, dword [ebp + 0xc]
push 4
push 0x4266f4
push edi
call fcn.0041bbff
push esi
add edi, 8
push edi
call fcn.00419acb
add esp, 0x14
mov al, 1
jmp 0x40a758
cmp word [esi], 0x5c
jne 0x40a756
add esi, 2
cmp word [esi], 0x5c
jne 0x40a756
add ebx, 6
cmp dword [ebp + 0x10], ebx
jbe 0x40a756
mov edi, dword [ebp + 0xc]
push 4
push 0x4266f4
push edi
call fcn.0041bbff
lea eax, [edi + 8]
push 0x4266ec
push eax
call fcn.00419acb
push esi
add edi, 0xe
push edi
call fcn.00419acb
add esp, 0x1c
jmp 0x40a636
lea eax, [ebp - 0x1000]
push eax
mov edi, 0x7ff
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40a756
cmp eax, edi
ja 0x40a756
movzx eax, word [esi]
push eax
call fcn.00409e4e
test al, al
je 0x40a6fd
add ebx, 6
cmp dword [ebp + 0x10], ebx
jbe 0x40a756
mov edi, dword [ebp + 0xc]
push 4
push 0x4266f4
push edi
call fcn.0041bbff
push 2
lea eax, [ebp - 0x1000]
push eax
lea eax, [edi + 8]
push eax
call fcn.0041bbff
push esi
add edi, 0xc
push edi
call fcn.00419acb
add esp, 0x20
jmp 0x40a636
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.00409e73
lea eax, [ebp - 0x1000]
push eax
call fcn.00419a83
lea eax, [eax + ebx + 4]
pop ecx
cmp dword [ebp + 0x10], eax
jbe 0x40a756
mov edi, dword [ebp + 0xc]
push 4
push 0x4266f4
push edi
call fcn.0041bbff
lea eax, [ebp - 0x1000]
push eax
lea eax, [edi + 8]
push eax
call fcn.00419acb
add esp, 0x14
push dword [ebp + 0x10]
push esi
push edi
call fcn.00410850
jmp 0x40a636
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40aa93
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
and dword [edi + 4], 0
and dword [edi], 0
mov eax, 0x8000
cmp dword [ebp + 0xc], eax
jae 0x40aaaf
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push eax
push esi
push dword [edi + 0xc]
call fcn.0041b4f0
xor eax, eax
inc eax
add esp, 0xc
xor bl, bl
cmp dword [ebp + 0xc], eax
jbe 0x40aad2
xor bl, byte [eax + esi]
inc eax
cmp eax, dword [ebp + 0xc]
jb 0x40aac9
push 8
mov ecx, edi
call fcn.004096fd
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
and dword [esi + 0x14], 0
cmp bl, byte [eax]
jne 0x40ab30
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.0040a92f
mov edi, eax
test edi, edi
je 0x40ab30
push 1
mov ecx, esi
call fcn.0040aa19
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
imul eax, eax, 0x28
add eax, dword [esi]
mov dword [esi + 0x14], ecx
lea ecx, [eax + 0xc]
mov dword [ecx], edi
mov dword [eax + 0x14], ecx
lea ecx, [eax + 0x1c]
push 3
mov dword [eax + 0x24], ecx
pop ecx
mov dword [eax], 0x28
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
jmp 0x40ab90
push 1
mov ecx, esi
call fcn.0040aa19
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
imul eax, eax, 0x28
add eax, dword [esi]
mov dword [esi + 0x14], ecx
lea ecx, [eax + 0xc]
mov dword [eax + 0x14], ecx
lea ecx, [eax + 0x1c]
mov dword [eax + 0x24], ecx
push 3
pop ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
xor edx, edx
mov dword [eax], 0x16
xor ecx, ecx
cmp dword [esi + 0x14], edx
jle 0x40ab90
xor edi, edi
mov eax, dword [esi]
add eax, edi
cmp dword [eax + 0x14], edx
jne 0x40ab7c
lea ebx, [eax + 0xc]
mov dword [eax + 0x14], ebx
cmp dword [eax + 0x24], edx
jne 0x40ab87
lea ebx, [eax + 0x1c]
mov dword [eax + 0x24], ebx
inc ecx
add edi, 0x28
cmp ecx, dword [esi + 0x14]
jl 0x40ab6d
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40c10c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 0x20
push dword [ebp + 8]
mov edi, ecx
mov ebx, dword [edi]
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 4], edi
sub ebx, 6
call fcn.0041b4f0
xor eax, eax
add esp, 0xc
xor edx, edx
cmp ebx, eax
mov dword [ebp + 8], eax
jle 0x40c17a
cmp edx, dword [edi]
jg 0x40c2c5
cmp eax, ebx
jge 0x40c16b
lea ecx, [ebp + eax*4 - 0x38]
mov esi, dword [ebp + 8]
cmp esi, 4
jge 0x40c16b
lea esi, [esi + edx*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, ecx
inc eax
add ecx, 4
inc dword [ebp + 8]
cmp eax, ebx
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
jl 0x40c14b
cmp dword [ebp + 8], 4
jne 0x40c176
inc edx
and dword [ebp + 8], 0
cmp eax, ebx
jl 0x40c13b
cmp edx, dword [edi]
jg 0x40c2c5
mov eax, ebx
shl eax, 2
lea ecx, [ebp + eax - 0x3b]
mov dword [ebp - 0xc], ecx
lea ecx, [ebp + eax - 0x3a]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + eax - 0x39]
lea eax, [ebp + eax - 0x3c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0x433798
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
mov al, byte [ebp - 0x38]
xor al, byte [ecx + 0x4338b8]
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 0x38], al
movzx ecx, byte [ecx]
mov cl, byte [ecx + 0x4338b8]
xor byte [ebp - 0x37], cl
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ecx]
mov cl, byte [ecx + 0x4338b8]
xor byte [ebp - 0x36], cl
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ecx]
mov cl, byte [ecx + 0x4338b8]
xor byte [ebp - 0x35], cl
mov ecx, dword [ebp - 8]
xor al, byte [ecx]
inc dword [ebp - 8]
mov byte [ebp - 0x38], al
cmp ebx, 8
je 0x40c21b
cmp ebx, 1
jle 0x40c27c
lea ecx, [ebp - 0x34]
lea edi, [ebx - 1]
xor esi, esi
mov al, byte [ecx + esi - 4]
xor byte [ecx + esi], al
inc esi
cmp esi, 4
jl 0x40c206
add ecx, 4
dec edi
jne 0x40c204
jmp 0x40c279
push 3
lea ecx, [ebp - 0x34]
pop edi
push 4
pop esi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
dec esi
jne 0x40c224
dec edi
jne 0x40c221
movzx eax, byte [ebp - 0x2c]
mov al, byte [eax + 0x4338b8]
xor byte [ebp - 0x28], al
movzx eax, byte [ebp - 0x2b]
mov al, byte [eax + 0x4338b8]
xor byte [ebp - 0x27], al
movzx eax, byte [ebp - 0x2a]
mov al, byte [eax + 0x4338b8]
xor byte [ebp - 0x26], al
movzx eax, byte [ebp - 0x29]
mov al, byte [eax + 0x4338b8]
xor byte [ebp - 0x25], al
push 3
lea ecx, [ebp - 0x24]
pop edi
push 4
pop esi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
dec esi
jne 0x40c26d
dec edi
jne 0x40c26a
mov edi, dword [ebp - 4]
xor ecx, ecx
test ebx, ebx
jle 0x40c2bd
cmp edx, dword [edi]
jg 0x40c2c5
cmp ecx, ebx
jge 0x40c2ae
lea eax, [ebp + ecx*4 - 0x38]
mov esi, dword [ebp + 8]
cmp esi, 4
jge 0x40c2ae
lea esi, [esi + edx*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, eax
inc ecx
add eax, 4
inc dword [ebp + 8]
cmp ecx, ebx
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
jl 0x40c28e
cmp dword [ebp + 8], 4
jne 0x40c2b9
inc edx
and dword [ebp + 8], 0
cmp ecx, ebx
jl 0x40c282
cmp edx, dword [edi]
jle 0x40c1aa
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40c2cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push edi
inc eax
mov edi, ecx
cmp dword [edi], eax
mov dword [ebp - 8], eax
jle 0x40c359
lea eax, [edi + 0x24]
push ebx
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 0xc], 4
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x430798]
xor dl, byte [eax + ebx*4 + 0x430f98]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x431398]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x430b98]
add ecx, 4
mov byte [esi], dl
add esi, 4
dec dword [ebp - 0xc]
jne 0x40c2fa
inc eax
cmp eax, 4
jl 0x40c2e9
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0041b4f0
add dword [ebp - 4], 0x10
add esp, 0xc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edi]
jl 0x40c2e7
pop esi
pop ebx
pop edi
leave
ret