joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d464
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44d60f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44d5f0
mov dl, 1
mov eax, dword [0x411be4]
call fcn.004030cc
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403e4c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44d5df
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043b498
test al, al
je 0x44d5d2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44d620
lea eax, [ebp - 0x254]
call fcn.004088ec
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44d5d2
xor eax, eax
push ebp
push 0x44d5cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44d658
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44d5b4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040bc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44d5b4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d5d2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44d4d5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004156c0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d616
lea eax, [ebp - 0x260]
call fcn.00403e4c
ret

Function at 0x44df44
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x455b9c]
cmp byte [eax + 0xa5], 0
jne 0x44dfb5
cmp dword [0x455bb4], 0
jne 0x44df76
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44df00
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x455bb4], eax
cmp dword [0x455bb0], 0
jne 0x44df91
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x455bb0], eax
cmp dword [0x455bb8], 0
jne 0x44dfb5
push esp
push 0
push 0
push 0x44dea4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x455bb8], eax
pop edx
ret
Function at 0x44e0ac
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44e0c3
add esp, 0xfffffff0
call fcn.00403420
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004194d0
mov eax, dword [0x453f88]
cmp word [eax + 2], 0
jne 0x44e0eb
mov eax, dword [0x453f88]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044f600
mov eax, dword [0x454030]
cmp word [eax + 2], 0
jne 0x44e105
mov eax, dword [0x454030]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044f7f8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4117c8]
call fcn.004030cc
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4117c8]
call fcn.004030cc
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41ba04]
call fcn.00422d7c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44e28c
mov eax, dword [0x453eb4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042314c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44fd98
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x453eb4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040bfbc
test eax, eax
je 0x44e1fa
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004082e0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040bfe4
test eax, eax
je 0x44e20e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004040bc
mov eax, dword [0x453dac]
cmp byte [eax], 0
jne 0x44e242
mov eax, ebx
call fcn.0044e3b4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044ff74
mov eax, ebx
call fcn.00450938
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44e282
call fcn.00403478
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e634
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x455b9c]
cmp dword [eax + 0x30], 0
je 0x44e6de
cmp dword [ebx + 0x94], 0
jne 0x44e6d8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44e5c4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44e6d8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44e69e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44e6d8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413b30
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44e6ad
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44f240
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44f275
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f3c
jmp 0x44f282
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403ea0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x450150
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x450191
mov eax, esi
call fcn.00436b58
test al, al
je 0x450191
mov eax, dword [ebx + 0x84]
call fcn.00436880
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x450191
push 0
mov eax, dword [ebx + 0x84]
call fcn.00436880
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4510f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004042fc
xor eax, eax
push ebp
push 0x45121e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4511f1
xor eax, eax
push ebp
push 0x4511ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040410c
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4511bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x4511ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040410c
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.0040430c
mov edx, ebx
pop ecx
call fcn.004028b8
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4511b5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x453df8]
mov dl, 1
mov eax, dword [0x406d28]
call fcn.0040b2a8
call fcn.00403888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451225
lea eax, [ebp - 4]
call fcn.00403e4c
ret
Function at 0x45122c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4513dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.004044fc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4513f4
call fcn.00404158
mov eax, ebx
call fcn.00419af4
mov edi, eax
dec edi
test edi, edi
jl 0x4512e4
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00419ac8
mov edx, dword [0x428d60]
call fcn.00403288
test al, al
je 0x4512e0
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00419ac8
lea edx, [ebp - 0x14]
call fcn.004300a4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.004044fc
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004041cc
inc esi
dec edi
jne 0x451292
mov al, byte [0x4513f8]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x451404
mov eax, dword [ebp - 0xc]
call fcn.0040c5fc
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00403ee4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.004300a4
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x4513f4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.004300a4
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x4513f4
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x4513f4
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x451410
call fcn.0040896c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4513e4
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00403e70
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00403e70
lea eax, [ebp - 0x14]
call fcn.00403e4c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403e70
ret
Function at 0x412678
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x412687
pop dword [ebp - 0x40]
mov eax, 0xf9cf6afd
add eax, 0x671bb8a
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x37c7a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x4ba1
mov edx, eax
mov edi, 0x43d27a5b
add edi, 0xbc71eda5
add edi, dword [ebp - 0x40]
mov esi, 0xccaa1b9c
mov dword [ebp - 0x2c], 0xaed5f27b
mov ebx, dword [edi]
xor dword [ebp - 0x1c], 0x2a8b26f0
xor ebx, esi
add dword [ebp - 0x2c], 0x542a50e
mov dword [edx], ebx
add dword [ebp - 0x18], 0x31197fbd
add edx, 4
add edi, 0xf67af0f7
sub edi, 0xf67af0f3
loop 0x4126d5
add eax, 0xe092d861
sub eax, 0xe091b70a
mov ebx, eax
add eax, 0x3ce4fe17
add eax, 0xc31b01ee
mov ecx, 0x3593efa6
add ecx, 0xcaac105a
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x408c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
xor edx, edx
test edi, edi
jne 0x408ca2
xor eax, eax
pop edi
pop ebp
ret
mov eax, edi
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408ca8
sub eax, esi
xor esi, esi
test eax, eax
jle 0x408ccf
movsx ecx, byte [esi + edi]
inc esi
add ecx, edx
imul edx, ecx, 0x401
mov ecx, edx
shr ecx, 6
xor edx, ecx
cmp esi, eax
jl 0x408cb7
lea ecx, [edx + edx*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
mov ecx, 1
imul eax, eax, 0x8001
pop esi
pop edi
test eax, eax
cmove eax, ecx
pop ebp
ret

Function at 0x41f810
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
mov eax, dword [ecx + 4]
push dword [ebp + 8]
push dword [eax]
call fcn.006a3507
add esp, 0xc
cdq
pop ebp
ret 0xc

Function at 0x421010
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 8
call fcn.00698526
add esp, 4
test eax, eax
je 0x42102f
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
jmp 0x421031
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x421070
push 0x80000
push 0
call fcn.006a2097
add esp, 0x18
cmp eax, 0xffffffff
je 0x421062
test eax, eax
je 0x421062
push eax
call dword [0x702080]
xor eax, eax
mov esp, ebp
pop ebp
ret
call fcn.0069f851
mov eax, dword [eax]
mov esp, ebp
pop ebp
ret
Function at 0x4226d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004228d0
add esp, 0xc
test eax, eax
js 0x4228c3
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [eax + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x422750
lea esi, [eax + 8]
add eax, 8
lea esi, [esi + edi*4]
nop word [eax + eax]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x422710
mov ebx, dword [ebp + 0x10]
mov edi, 1
cmp dword [ebx + 0xf0], edi
jle 0x4228be
lea esi, [ebx + 2]
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + 0x90c778]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x90d378]
movzx eax, byte [eax*4 + 0x90c778]
xor ecx, dword [eax*4 + 0x90db78]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + 0x90c778]
xor ecx, dword [eax*4 + 0x90d778]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + 0x90c778]
xor ecx, dword [eax*4 + 0x90df78]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + 0x90c778]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x90d378]
movzx eax, byte [eax*4 + 0x90c778]
xor ecx, dword [eax*4 + 0x90db78]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + 0x90c778]
xor ecx, dword [eax*4 + 0x90d778]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + 0x90c778]
xor ecx, dword [eax*4 + 0x90df78]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + 0x90c778]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x90d378]
movzx eax, byte [eax*4 + 0x90c778]
xor ecx, dword [eax*4 + 0x90db78]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + 0x90c778]
xor ecx, dword [eax*4 + 0x90d778]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + 0x90c778]
xor ecx, dword [eax*4 + 0x90df78]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + 0x90c778]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x90d378]
movzx eax, byte [eax*4 + 0x90c778]
xor ecx, dword [eax*4 + 0x90db78]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + 0x90c778]
xor ecx, dword [eax*4 + 0x90d778]
movzx eax, dl
movzx eax, byte [eax*4 + 0x90c778]
xor ecx, dword [eax*4 + 0x90df78]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x422767
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x42e230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov ebx, 1
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 8]
shl ebx, cl
call fcn.0042b990
add esp, 8
test eax, eax
jne 0x42e261
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 3
jg 0x42e2c3
xor ecx, ecx
mov dword [ebp + 0x18], ecx
cmp dword [ebp + 0xc], ecx
jle 0x42e3ef
xor esi, esi
xor eax, eax
test ebx, ebx
jle 0x42e2a4
nop dword [eax]
mov ecx, eax
xor ecx, dword [ebp + 0x14]
lea edx, [ecx - 1]
not ecx
sar edx, 0x1f
sar ecx, 0x1f
and edx, ecx
and edx, 1
neg edx
and edx, dword [edi + eax*4]
inc eax
or esi, edx
cmp eax, ebx
jl 0x42e280
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [eax + ecx*4], esi
inc ecx
lea eax, [ebx*4]
mov dword [ebp + 0x18], ecx
add edi, eax
cmp ecx, dword [ebp + 0xc]
jl 0x42e274
jmp 0x42e3ef
mov edx, dword [ebp + 0x14]
lea ecx, [esi - 2]
sar edx, cl
mov esi, 1
shl esi, cl
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x24], esi
lea eax, [esi - 1]
and ecx, eax
mov eax, edx
mov dword [ebp - 0x10], ecx
not eax
sar eax, 0x1f
lea ecx, [edx - 1]
sar ecx, 0x1f
and ecx, eax
mov eax, edx
xor eax, 1
and ecx, 1
neg ecx
mov dword [ebp - 0x20], ecx
lea ecx, [eax - 1]
not eax
sar eax, 0x1f
sar ecx, 0x1f
and ecx, eax
mov eax, edx
xor eax, 2
and ecx, 1
neg ecx
xor edx, 3
mov dword [ebp - 0x1c], ecx
lea ecx, [eax - 1]
not eax
sar eax, 0x1f
sar ecx, 0x1f
and ecx, eax
lea eax, [edx - 1]
sar eax, 0x1f
not edx
sar edx, 0x1f
and ecx, 1
and eax, edx
neg ecx
and eax, 1
mov dword [ebp - 0x18], ecx
xor edx, edx
neg eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], edx
cmp dword [ebp + 0xc], edx
jle 0x42e3ef
shl ebx, 2
mov dword [ebp - 0x28], ebx
xor ecx, ecx
xor ebx, ebx
mov dword [ebp + 0x18], ecx
test esi, esi
jle 0x42e3d7
lea eax, [esi + esi*2]
lea edx, [edi + esi*4]
lea ecx, [edi + esi*8]
mov dword [ebp - 8], edx
lea eax, [edi + eax*4]
mov dword [ebp - 4], ecx
mov dword [ebp + 0x10], eax
mov eax, dword [eax]
mov esi, ebx
mov ecx, dword [ecx]
and ecx, dword [ebp - 0x18]
and eax, dword [ebp - 0x14]
xor esi, dword [ebp - 0x10]
or ecx, eax
mov edx, dword [edx]
and edx, dword [ebp - 0x1c]
mov eax, dword [edi + ebx*4]
or edx, ecx
and eax, dword [ebp - 0x20]
lea ecx, [esi - 1]
sar ecx, 0x1f
not esi
sar esi, 0x1f
or eax, edx
mov edx, dword [ebp - 8]
and ecx, esi
mov esi, dword [ebp - 0x24]
and ecx, 1
neg ecx
inc ebx
and ecx, eax
add edx, 4
or dword [ebp + 0x18], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
add eax, 4
add ecx, 4
mov dword [ebp + 0x10], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
cmp ebx, esi
jl 0x42e377
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add edi, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [eax + edx*4], ecx
inc edx
mov dword [ebp - 0xc], edx
cmp edx, dword [ebp + 0xc]
jl 0x42e357
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push eax
mov dword [eax + 4], edi
call fcn.0042b910
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xorps xmm0, xmm0
mov dword [ebp - 8], 0
movlpd qword [ebp - 0x10], xmm0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
push esi
mov esi, 1
mov dword [ebp - 0x14], 0x40
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], eax
mov edi, esi
xor ebx, ebx
and edi, 1
neg edi
adc ebx, ebx
and edi, dword [ebp + 8]
neg ebx
mov ecx, edi
xor ecx, dword [ebp - 4]
mov esi, ebx
and esi, dword [ebp + 0xc]
and edi, dword [ebp - 4]
mov eax, esi
xor eax, dword [ebp - 8]
and esi, dword [ebp - 8]
shrd ecx, eax, 1
shr eax, 1
add ecx, edi
mov dword [ebp - 4], ecx
adc eax, esi
mov esi, ecx
mov ecx, dword [ebp - 0xc]
and ebx, 0x80000000
shrd ecx, edx, 1
mov dword [ebp - 8], eax
xor eax, eax
shr edx, 1
add eax, ecx
mov dword [ebp - 0xc], eax
adc edx, ebx
sub dword [ebp - 0x14], 1
jne 0x431040
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4386c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov edx, 0x400
push ebx
mov ebx, 0x80
mov ecx, ebx
cmp dword [ebp + 0xc], ecx
push esi
cmovle ecx, dword [ebp + 0xc]
mov esi, edx
test eax, eax
push edi
mov edi, dword [ebp + 8]
cmovg esi, eax
cmp esi, edx
cmovg esi, edx
mov byte [edi], 0
mov dword [ebp + 0xc], esi
test ecx, ecx
jle 0x438714
sub dword [ebp + 0x10], edi
mov edx, edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
nop
mov al, byte [edi + edx]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub esi, 1
jne 0x438700
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi - 1]
mov dword [ebp + 8], eax
cmp ecx, ebx
jge 0x438747
mov edx, edi
mov ebx, eax
movzx eax, byte [edx]
lea edx, [edx + 1]
add eax, ebx
movzx eax, al
movzx ebx, byte [eax + 0x911058]
mov byte [ecx + edi], bl
inc ecx
cmp ecx, 0x80
jl 0x438724
mov ebx, 0x80
mov ecx, dword [ebp + 0xc]
lea eax, [esi + 7]
sar eax, 3
neg ecx
sub ebx, eax
mov dword [ebp + 8], eax
movzx eax, byte [ebx + edi]
lea esi, [ebx + edi]
and ecx, 7
mov edx, 0xff
sar edx, cl
and edx, eax
movzx ecx, byte [edx + 0x911058]
mov byte [esi], cl
test ebx, ebx
je 0x438798
mov edx, dword [ebp + 8]
nop word [eax + eax]
movzx eax, byte [esi + edx - 1]
lea esi, [esi - 1]
xor eax, ecx
movzx ecx, byte [eax + 0x911058]
mov byte [esi], cl
sub ebx, 1
jne 0x438780
lea ebx, [edi - 1]
mov edx, 0x7f
lea esi, [ebx + 0x7f]
sub edi, ebx
movzx ecx, byte [edi + esi]
lea esi, [esi - 2]
movzx eax, byte [esi + 2]
shl cx, 8
or cx, ax
mov word [ebx + edx], cx
sub edx, 2
jns 0x4387a5
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43a570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x1c]
sub esp, 0x10
mov edx, dword [ebp + 0x14]
inc ecx
cmp ecx, edx
jbe 0x43a587
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
dec eax
add eax, edx
push ebx
mov dword [ebp - 4], eax
mov ebx, edx
push esi
mov al, byte [eax]
push edi
movzx edi, al
mov byte [ebp + 0x1f], al
mov dword [ebp - 0x10], edi
lea eax, [edi + ecx]
mov ecx, 0x100
sub ebx, eax
xor eax, edx
xor ebx, edx
or ebx, eax
mov eax, edx
xor ebx, edx
sar ebx, 0x1f
cmp edx, ecx
not ebx
cmovae eax, ecx
xor esi, esi
mov dword [ebp - 8], eax
test eax, eax
je 0x43a60c
mov edx, edi
sar edx, 0x1f
mov dword [ebp - 0xc], edx
nop
mov ecx, edi
mov eax, esi
sar ecx, 0x1f
inc esi
xor cl, dl
sar eax, 0x1f
xor al, dl
dec edi
or cl, al
mov eax, dword [ebp - 4]
dec dword [ebp - 4]
xor cl, dl
not cl
movzx edx, cl
movzx ecx, byte [ebp + 0x1f]
movzx eax, byte [eax]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [ebp - 0xc]
cmp esi, dword [ebp - 8]
jb 0x43a5d0
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp - 0x10]
not ebx
movzx eax, bl
lea ecx, [eax - 1]
not eax
sar eax, 0x1f
sar ecx, 0x1f
and ecx, eax
lea eax, [edi + 1]
and eax, ecx
sub edx, eax
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret