joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42962e
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xd67d1ef4
mov dr0, ebp
popal
invalid
sbb edx, esi
mov dl, 0x38
test al, 0xb7
invalid
cmp ecx, edi
invalid
inc esp
cmc
pop ecx
dec eax
pop esi
jne 0x4294f0
xor eax, dword [esi + 0x74]
lodsb al, byte [esi]
pop esi
sub dword [esi], edx
cld
push ebp
je 0x429517
adc dword gs:[edx - 0x11], 0x3344f1c0
mov byte [edi], cl
call 0x2bc4db09
fmul dword [ebx]
inc esi
sar dword [0x38bc366c], cl
xor byte [ebx + 0x7f4dbc90], dl
mov ss, ebx
mov esp, 0x90933038
mov esp, 0xd38e7f4d
adc eax, esp
jae 0x4295a4
jecxz 0x429576
out 0x6f, eax
std
fdivr qword [eax + 0x36]
je 0x429538
enter 0x354, 0xffffffffffffffeb
les esi, [esi - 0x5c]
add byte [ebx + 0x7d3d8b64], 0x81
std
mov dword [ecx - 0x63], esi
mov eax, 0xc08a3c74
das
js 0x42953d
ljmp 0x9807:0x651d89ad
mov al, 0xff
sbb eax, 0x3d02258e
fnstsw word [eax + 0x37a394ab]
push esp
jp 0x4295d0
stosd dword es:[edi], eax
xchg esp, eax
mov dword [0x1c7a5437], eax
mov ebp, 0x581d2316
popfd
add dh, byte fs:[ebx + 0x7e9d0c9d]
fisttp word [ebx - 0x10]
jle 0x429565
pop ecx
or edi, dword [eax]
or al, 0x6f
outsd dx, dword [esi]
jp 0x429644
cmp byte [eax - 0x210787ad], ah
xor eax, 0x4a069a03
js 0x4295ca
fidiv word [0x4a069a03]
fld st(2)
sbb eax, 0xdb8cbc11
cmp edx, dword [eax]
cmp dword [ebp + 0x41], ecx
int 0xbd
push ebx
fdiv qword [ebx - 0x6756372f]
in al, dx
cmp eax, 0x6ac63f20
push esp
cmp eax, 0x72131bd
outsb dx, byte [esi]
jae 0x429627
ror eax, 1
test eax, 0x3dec6598
and byte [edi], bh
invalid
sbb ah, bh
out dx, eax
dec eax
in eax, 0x9c
salc
push esi
cmpsd dword [esi], dword es:[edi]
xor al, 0x8c
sti
or ebp, edi
sbb dword [edi + ecx*4 - 0x64ccc483], esi
dec esi
adc eax, 0x3d3d8c81
or eax, 0x3bad79ac
pop ebp
inc esp
ja 0x4295ad
lodsd eax, dword [esi]
push ds
push ds
jle 0x429657
jle 0x429657
ret 0x7646
aad 0x76
lodsb al, byte [esi]
ja 0x4295fe
retf
dec eax
xchg dword [edx + 0x70], esp
jbe 0x4295ea
sub byte [edi - 0x4f], ch
push esi
mov bl, 7
mov al, 0x88
push edi
mov dh, 0x66
xor bl, byte [esi + 0xff6310d]
js 0x4296b9
sahf
or eax, 0x780ff631
pop ebx
and cl, ch
je 0x429614
mov dword [edi + 0x71d9e68d], edi
loope 0x4296be
daa
mov al, 0x16
dec eax
punpckhdq mm7, qword [ebx]
push ss
dec ebx
dec eax
and ecx, dword [ebx + esi]
mov cl, 0xeb
les eax, [edi + 0x46]
sub al, 0xb0
popal
mov ebp, 0xfa269071
pop esi
xlatb
inc edx
mov al, byte [0x8f87b105]
mov ah, 0xc8
xor byte [0xf03e2766], dh
mov bl, 0xd5
in al, 0xc6
mov edi, 0xb7837efd
sub ebp, 0x31
mov ebp, 0xe06dc8b0
invalid
cwde
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov al, byte [0x5ca078aa]
js 0x429660
pop esp
sub al, 0x3e
mov al, byte [0x7d71b1a4]
sti
mov esp, 0x9fe9f60a
rcr byte [eax + edx], 0xc2
int 0xd3
dec edi
and ebp, esp
inc edi
mov ch, 0xd5
invalid

Function at 0x438e45
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
mov byte [ecx], ah
add byte [ebp - 0x7e2e42be], cl
mov byte [0x53750bc9], al
cli
add dword [ecx - 0x1b], ebp
pop es
std
invalid
Function at 0x439ad3
Capabilities:
Encode data using xor

Disassembly:
in al, 0x9f
adc edx, edx
pop esi
fisubr dword [ebx]
or eax, 0xc67af779
popfd
sub cl, byte [ebp + 0x6e16468e]
je 0x439b46
xchg esi, eax
loopne 0x439b2f
mov ebp, 0xb3fe92df
vdivps xmm5, xmm3, xmmword [ebp + 0x31]
push 0xffffffffffffffb2
xor dword [edx - 0x4e], ebp
fdiv qword [edi + 0x62]
ficomp dword [edi - 0x21]
rcr dword [edi - 0x77c36bf6], cl
dec eax
push ebp
sbb ebx, eax
insd dword es:[edi], dx
mov bl, 0xeb
cmpsd dword [esi], dword es:[edi]
jbe 0x439af5
test eax, 0x3d50077f
lodsd eax, dword [esi]
adc edx, edi
mov esi, 0xdbb98dd3
invalid
cmp eax, 0xb699ac7c
inc esi
aad 0xd5
mov esi, 0x792fb6c9
int 0x8c
mov esp, 0x5184ff16
lds esi, [esp + esi*2 - 0x3b]
wait
inc ebp
pop eax
cmpsb byte [esi], byte es:[edi]
mov eax, dword [edx + 0x2c6c10e3]
or eax, 0xbff05a97
xchg edx, eax
adc byte [edx], ah
adc esp, dword ss:[eax - 0x12]
test dword [esi + 0x70f8c0c6], esp
sbb byte [edi + 0x2d], al
stc
pop ss
sub bh, ch
mov dword [0x3760b5e1], eax
das
aas
sub byte [edx], dh
add al, 7
pop edi
xor al, 0xd6
mov ch, 0x6d
jmp 0x439b46
lds ebx, [ebx - 0x7459a7bb]
and bl, 0x10
insb byte es:[edi], dx
sub al, 0xd
xchg edi, eax
pop edx
invalid

Function at 0x489135
Capabilities:
Encode data using xor

Disassembly:
fdivr qword [eax + 0x59]
bound esi, qword [eax + 0xe]
push ebx
inc ebx
int 0xc3
mov edx, 0xf5d2b4f4
out 0x5e, al
xchg esp, eax
cmc
mov dword [ecx + 0x34], edi
or dword [ecx - 0x18], ebx
lahf
je 0x489170
neg byte [ebp - 0x6207b3ce]
insd dword es:[edi], dx
dec ecx
push esp
invalid
neg dword [esi - 0x4a]
xchg ebx, edx
out dx, al
or eax, 0xaacb4e94
fsub dword [ebp + 0x12]
test eax, edi
cli
mov bh, 0x1c
add ah, byte [edi + 0x483b3fb6]
cmpsd dword [esi], dword es:[edi]
mov dh, 0x3f
cmp ecx, dword [eax - 0x1e]
invalid
cmpsd dword [esi], dword es:[edi]
mov dh, 0x3f
cmp ecx, dword [eax - 0x1e]
mov esi, 0x6ff84e71
jno 0x48918c
clc
outsd dx, dword [esi]
mov eax, dword [0x702f75d6]
dec esi
rol byte [edi - 0x786b3bf2], 1
push 0xffffffffffffffec
scasd eax, dword es:[edi]
mov eax, dword [0x42f34d18]
and al, al
fcomp dword [edi - 0x15]
rol ecx, 0x95
rol byte [ebx], 1
cmp dword [eax + 0x280d5890], 0x69
stosb byte es:[edi], al
xor dword [eax - 0x285dfee1], 0x318441d7
jecxz 0x489120
add ebp, dword [eax - 0x68]
test eax, 0xade40208
push ecx
out 0xc2, al
out dx, eax
call 0xcd33582c
aam 0xf1
mov bh, 0x90
add byte [esi], ah
nop
in eax, dx
dec ebx
int 0xd4
mov bh, 0x18
call 0xeb6a256d
jp 0x48914c
ret
Function at 0x49edd2
Capabilities:
Encode data using xor

Disassembly:
adc bl, ch
lahf
outsb dx, byte [esi]
cli
adc dword [ebp - 0x55], 0x63
mov al, byte [0x4def7dc]
sbb dword [ecx - 0x45], esp
add byte [ebx], cl
push ecx
dec edx
mov bh, 0xec
rcr dword [edx - 0x4e], 1
push ebx
mov byte [ebx - 0x28f50cae], bl
aad 0xb1
mov esp, 0x93bea9f4
mov ecx, 0xe3a21081
mov edx, 0x93f6faa7
cwde
push ss
inc eax
xor al, byte [edx - 0x7b]
imul eax, dword [edi + 0x71cc8fa], 0x5648f573
sbb al, 7
jae 0x49ee08
dec eax
push esi
out dx, al
sbb al, 0x35
mov eax, dword [0x8cf101d5]
mov ss, word [edx + 0x5d70914a]
in al, 0x34
add eax, 0x4658e56a
mov esi, 0xb8f09620
add eax, 0x703f91b6
lodsd eax, dword [esi]
pop dword [ebp + 0x73d202b0]
push esi
xchg edx, eax
mov ah, 5
or ch, byte es:[ebx + esi*2 - 0x51]
mov byte [edi], 0x8c
mov eax, 0x7a259505
test bl, ch
in eax, 0xfe
push 0xffffffffffffffd6
add dword [edi - 5], ebx
add ecx, edx
arpl word [di - 0x3bb0], di
mov dl, 0xa
xor esi, dword [edx + ebx*4 + 0x2de7fa84]
jae 0x49ee0f
invalid

Function at 0x4b3c77
Capabilities:
Encode data using xor

Disassembly:
or byte [ecx], dl
shr ebp, 0x7d
add eax, 0x7f0d8bd9
sal byte [ebp + edi*4 + 0x6f12d597], cl
cmp al, 0x2d
xor eax, dword [ecx]
inc esp
div eax
imul edx, dword [esi], 0xffffffe2
jmp 0x4b3cba
stosd dword es:[edi], eax
or bl, byte [edi + eax + 0x5d0b862b]
xchg esi, eax
xchg esi, eax
or ecx, eax
mov edx, 0x18c974f8
inc eax
stc
and dword [edi - 0x108eb8d3], edx
sub eax, 0x7480f6b8
cmp ebx, dword [edx]
add al, 0x85
and byte [esi + eax*8 - 0x7e62fc96], dl
je 0x4b3cb2
xchg esp, eax
invalid
xor al, 0x8b
movsb byte es:[edi], byte [esi]
pop ds
xor dword [ebp + 0x13aaf035], eax
xchg esp, eax
mov ebx, 0xac31a481
insd dword es:[edi], dx
cwde
jbe 0x4b3cd5
rcr byte [ebx + edi*8 - 0x7c], cl
inc ecx
mov dword gs:[esi + 0x44], ebp
invalid

Function at 0x4b520c
Capabilities:
Encode data using xor

Disassembly:
pop ds
pop ebx
sub byte [ebx - 0x38], dl
idiv dword [edi]
xor dword [esi], esp
cwde
and esi, dword [0x944651ac]
loop 0x4b5247
push ss
mov fs, word [ebp + ebp*4 + 0x38]
lodsd eax, dword fs:[esi]
cmp byte [edi - 0x4f], dl
pop es
lodsd eax, dword fs:[esi]
cmp byte [edi - 0x4f], dl
pop es
adc al, 0x56
push ecx
div byte [ecx]
adc bh, ah
shr dword [ebx + 0x2de535f6], cl
cmpsb byte [esi], byte es:[edi]
jl 0x4b51d4
inc ecx
and bl, bl
sub esi, esi
sub eax, 0x5be9510e
test dword [edi + edx*4], ecx
push edi
jg 0x4b51e4
sub byte [eax - 0x73], dh
mov ah, 0xd4
jns 0x4b5281
push ecx
xor esi, dword [edx + esi*8 + 4]
salc
fcomp dword [edi + 0x100160af]
pushfd
mov cl, 0x26
mov ch, 0xf4
daa
mov edi, 0x65558e18
and eax, 0xfe67cd66
push ss
xchg ebp, eax
and al, 0xa3
adc al, bh
invalid
popfd
cmp dword [edi], esp
lodsb al, byte [esi]
jbe 0x4b5208
popfd
ret 0x4b78
Function at 0x4bd1b7
Capabilities:
Query environment variable

Disassembly:
je 0x4bd2a7
mov dword [0x4cae88], 2
jmp 0x4bd25b
cmp edi, ebx
jne 0x4bd26b
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, eax
cmp edi, ebx
je 0x4bd2a7
cmp byte [edi], bl
mov eax, edi
je 0x4bd27b
inc eax
cmp byte [eax], bl
jne 0x4bd271
inc eax
cmp byte [eax], bl
jne 0x4bd271
sub eax, edi
inc eax
mov ebp, eax
push ebp
call fcn.004bec02
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x4bd291
xor esi, esi
jmp 0x4bd29c
push ebp
push edi
push esi
call fcn.004bed40
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, esi
jmp 0x4bd2a9
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x4bd745
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c63a8
cmp edx, dword [eax]
je 0x4bd767
add eax, 8
inc ecx
cmp eax, 0x4c6438
jl 0x4bd758
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c63a8]
jne 0x4bd895
mov eax, dword [0x4cad3c]
cmp eax, 1
je 0x4bd86f
test eax, eax
jne 0x4bd798
cmp dword [0x4c62d0], 1
je 0x4bd86f
cmp edx, 0xfc
je 0x4bd895
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bd7cf
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004be130
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004be5c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bd812
lea eax, [ebp - 0x1a4]
push eax
call fcn.004be5c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c2aac
push edi
call fcn.004c0490
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004be130
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004be140
lea eax, [ebp - 0xa0]
push 0x4c2a8c
push eax
call fcn.004be140
push dword [esi + 0x4c63ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.004be140
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c0404
add esp, 0x2c
pop edi
jmp 0x4bd895
lea eax, [ebp + 8]
lea esi, [esi + 0x4c63ac]
push 0
push eax
push dword [esi]
call fcn.004be5c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x402b3a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4014
call fcn.0046c270
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x4014]
push edi
mov edi, dword [ebp + 8]
mov ecx, 0x4000
and dword [ebp + 8], 0
mov dword [ebp - 0x14], ecx
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov esi, dword [esi + 4]
mov dword [ebp - 4], esi
call sub.KERNEL32.dll_GetTickCount
and dword [ebp - 0xc], 0
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ebx
jmp 0x402b84
mov esi, dword [ebp - 4]
cmp ebx, esi
jge 0x402bc8
cmp dword [edi + 4], 0
ja 0x402bc8
lea eax, [ebp - 0x14]
sub esi, ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
call fcn.004018e2
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov esi, eax
push ebx
mov dword [edi + 4], esi
call fcn.0042ba03
add ebx, esi
mov dword [edi], eax
mov eax, dword [ebp + 8]
cmp ebx, dword [ebp - 4]
push 3
pop ecx
cmovge eax, ecx
mov dword [ebp - 8], ebx
mov dword [ebp + 8], eax
jmp 0x402bcb
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.0046d590
mov esi, eax
pop ecx
pop ecx
cmp esi, 5
je 0x402c80
cmp esi, 7
je 0x402c80
cmp esi, 8
jle 0x402bf6
cmp esi, 0xb
jle 0x402c80
cmp dword [edi + 0x14], 0
jbe 0x402c01
cmp esi, 1
jne 0x402c39
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x4014]
mov ebx, 0x4000
sub ebx, dword [edi + 0x14]
push ebx
mov eax, dword [ecx]
push edx
mov eax, dword [eax]
call eax
test al, al
je 0x402c80
add dword [ebp - 0xc], ebx
lea eax, [ebp - 0x4014]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0x4000
cmp esi, 1
je 0x402c8e
mov ebx, dword [ebp - 8]
cmp dword [ebp + 0x14], 0
mov esi, dword [ebp - 4]
je 0x402b84
call sub.KERNEL32.dll_GetTickCount
mov esi, eax
push esi
push dword [ebp - 0x10]
call fcn.00459100
pop ecx
pop ecx
cmp eax, 0xc8
jbe 0x402b81
mov eax, dword [ebp - 0xc]
shl eax, 3
push eax
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 4]
push esi
push ebx
call dword [ebp + 0x14]
add esp, 0xc
test al, al
je 0x402b84
push edi
call fcn.0046d840
xor al, al
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push edi
call fcn.0046d840
mov al, 1
jmp 0x402c88

Function at 0x403081
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
je 0x4030df
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], 0x70b
jne 0x4030df
cmp dword [eax + 0xc], 0x202
jne 0x4030df
push dword [eax + 0x1c]
push dword [eax + 0x18]
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.004037e6
add esp, 0x10
mov eax, 0x49cb74
cmp dword [ebp - 0xc], 0
cmovne eax, dword [ebp - 0xc]
xor ecx, ecx
push 5
push ecx
push ecx
push eax
push 0x49cf40
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0xc]
call fcn.004266a4
leave
ret
Function at 0x409b27
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x49ab23
call fcn.0046c220
sub esp, 0x7c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 4], edi
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x88]
push eax
call fcn.0042a591
add esp, 0xc
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x5c], 1
xor eax, eax
mov word [ebp - 0x58], ax
lea ecx, [ebp - 0x1c]
call fcn.00428d6d
lea eax, [ebp - 0x34]
push eax
call fcn.004418a0
mov esi, 0x49cb74
mov ecx, esi
cmp dword [eax], edi
cmovne ecx, dword [eax]
push edi
push 0x4a016c
push ecx
push 0x4a0174
lea eax, [ebp - 0x1c]
push eax
call fcn.0042fba8
add esp, 0x18
lea ecx, [ebp - 0x34]
call fcn.004266a4
lea ecx, [ebp - 0x28]
call fcn.00428d6d
push dword [ebp + 8]
lea eax, [ebp - 0x34]
push eax
call fcn.0044641c
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00425912
lea ecx, [ebp - 0x34]
call fcn.004266a4
lea eax, [ebp - 0x28]
push eax
push 0x4a0178
lea ecx, [ebp - 0x1c]
call fcn.004248b6
push 0x200
lea ecx, [ebp - 0x1c]
call fcn.00423f1f
cmp dword [ebp - 0x1c], edi
cmovne esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x88]
push eax
push edi
push edi
push 0x10
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x409c31
push dword [ebp - 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x44]
call esi
lea ecx, [ebp - 0x28]
call fcn.004266a4
lea ecx, [ebp - 0x1c]
call fcn.004266a4
mov al, 1
jmp 0x409c69
push edi
push edi
push edi
push dword [ebp + 8]
push 0x49cf40
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setge bl
lea ecx, [ebp - 0x28]
call fcn.004266a4
lea ecx, [ebp - 0x1c]
call fcn.004266a4
mov al, bl
jmp 0x409c69
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40c1db
Capabilities:
Terminate process

Disassembly:
mov eax, 0x49ab41
call fcn.0046c220
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 4], esi
call fcn.00409e68
mov eax, dword [0x4deeb4]
test eax, eax
je 0x40c21b
push 6
push eax
call fcn.0046494b
push dword [0x4deeb4]
call fcn.0046430a
add esp, 0xc
mov dword [0x4deeb4], esi
call fcn.00464d3a
call fcn.0040e7fc
mov ecx, dword [0x4def2c]
test ecx, ecx
je 0x40c253
push esi
push 1
call fcn.00469531
mov ecx, dword [0x4def2c]
call fcn.00469929
mov ecx, dword [0x4def2c]
call fcn.004686e2
mov dword [0x4def2c], esi
call fcn.00412655
call dword [sym.imp.ole32.dll_OleUninitialize]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x423152
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 4], edi
push dword [esi]
call fcn.0042745f
push dword [esi + 4]
mov ebx, eax
call fcn.0042745f
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
add edi, 0x44
mov dword [ebp - 8], 8
xor ebx, dword [edi]
lea edi, [edi - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
shr eax, 0x10
mov ecx, ebx
movzx eax, al
mov esi, dword [edi + 4]
shr ecx, 0x18
mov edx, dword [edx + eax*4 + 0x448]
mov eax, dword [ebp - 4]
add edx, dword [eax + ecx*4 + 0x48]
mov eax, ebx
mov ecx, dword [ebp - 4]
shr eax, 8
movzx eax, al
xor edx, dword [ecx + eax*4 + 0x848]
movzx eax, bl
add edx, dword [ecx + eax*4 + 0xc48]
mov ecx, dword [ebp + 0xc]
xor edx, esi
mov esi, dword [ebp - 4]
xor ecx, edx
mov eax, ecx
mov dword [ebp + 0xc], ecx
shr eax, 0x10
movzx eax, al
shr ecx, 0x18
mov edx, dword [esi + eax*4 + 0x448]
add edx, dword [esi + ecx*4 + 0x48]
mov ecx, dword [ebp + 0xc]
mov eax, ecx
shr eax, 8
movzx eax, al
xor edx, dword [esi + eax*4 + 0x848]
movzx eax, cl
add edx, dword [esi + eax*4 + 0xc48]
xor ebx, edx
sub dword [ebp - 8], 1
jne 0x423182
mov eax, dword [edi]
xor eax, ebx
push eax
call fcn.0042745f
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [edi - 4]
xor eax, dword [ebp + 0xc]
push eax
call fcn.0042745f
pop ecx
pop ecx
pop edi
mov dword [esi], eax
pop esi
pop ebx
leave
ret 8

Function at 0x4232bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
push dword [esi]
call fcn.0042745f
push dword [esi + 4]
mov ebx, eax
call fcn.0042745f
pop ecx
lea edx, [edi + 0x48]
mov dword [ebp - 4], eax
pop ecx
mov dword [ebp + 0xc], edx
mov dword [ebp - 8], 8
xor ebx, dword [edi]
lea edi, [edi + 8]
mov esi, dword [edi - 4]
mov eax, ebx
shr eax, 0x10
mov ecx, ebx
movzx eax, al
shr ecx, 0x18
mov edx, dword [edx + eax*4 + 0x400]
mov eax, dword [ebp + 0xc]
add edx, dword [eax + ecx*4]
mov eax, ebx
mov ecx, dword [ebp + 0xc]
shr eax, 8
movzx eax, al
xor edx, dword [ecx + eax*4 + 0x800]
movzx eax, bl
add edx, dword [ecx + eax*4 + 0xc00]
mov ecx, dword [ebp - 4]
xor edx, esi
mov esi, dword [ebp + 0xc]
xor ecx, edx
mov eax, ecx
mov dword [ebp - 4], ecx
shr eax, 0x10
movzx eax, al
shr ecx, 0x18
mov edx, dword [esi + eax*4 + 0x400]
add edx, dword [esi + ecx*4]
mov ecx, dword [ebp - 4]
mov eax, ecx
shr eax, 8
movzx eax, al
xor edx, dword [esi + eax*4 + 0x800]
movzx eax, cl
add edx, dword [esi + eax*4 + 0xc00]
xor ebx, edx
sub dword [ebp - 8], 1
mov edx, esi
jne 0x4232ed
mov eax, dword [edi]
xor eax, ebx
push eax
call fcn.0042745f
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
xor eax, dword [ebp - 4]
push eax
call fcn.0042745f
pop ecx
pop ecx
pop edi
mov dword [esi], eax
pop esi
pop ebx
leave
ret 8
Function at 0x4233b2
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push edi
call fcn.004230fd
pop ecx
test al, al
je 0x423482
push ebx
push 0x48
push 0x4a2db8
lea ebx, [esi + 0x48]
push esi
mov dword [ebp + 0xc], ebx
call fcn.0042a528
push 0x1000
push 0x4a2e00
push ebx
call fcn.0042a528
add esp, 0x18
sar edi, 5
xor ecx, ecx
mov eax, ecx
mov ebx, dword [ebp + 8]
cdq
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [esi + ecx*4], eax
inc ecx
cmp ecx, 0x12
jl 0x4233f9
and dword [ebp - 4], 0
mov edi, esi
and dword [ebp - 8], 0
push 9
pop ebx
lea eax, [ebp - 8]
mov ecx, esi
push eax
push eax
call fcn.004232bd
push dword [ebp - 8]
call fcn.0042745f
push dword [ebp - 4]
mov dword [edi], eax
call fcn.0042745f
mov dword [edi + 4], eax
lea edi, [edi + 8]
pop ecx
pop ecx
sub ebx, 1
jne 0x42341a
mov ebx, dword [ebp + 0xc]
mov edi, 0x200
lea eax, [ebp - 8]
mov ecx, esi
push eax
push eax
call fcn.004232bd
push dword [ebp - 8]
call fcn.0042745f
push dword [ebp - 4]
mov dword [ebx], eax
call fcn.0042745f
mov dword [ebx + 4], eax
lea ebx, [ebx + 8]
pop ecx
pop ecx
sub edi, 1
jne 0x42344d
mov ecx, esi
call fcn.0042339e
mov al, 1
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x431c05
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x431dc9
mov eax, dword [esi]
test eax, eax
je 0x431dc9
test byte [ebp + 0xc], 1
push edi
mov edi, eax
je 0x431c42
movzx eax, word [eax]
jmp 0x431c37
add dword [esi], 2
mov edi, dword [esi]
movzx eax, word [edi]
push eax
call fcn.004254bc
pop ecx
test al, al
jne 0x431c2f
xor eax, eax
test byte [ebp + 0xc], 4
mov dword [ebp - 8], eax
mov byte [ebp + 0xb], al
mov eax, edi
mov dword [ebp - 4], eax
jne 0x431c8f
movzx ecx, word [edi]
mov dword [ebp - 4], eax
sub ecx, 0x2b
je 0x431c6a
dec ecx
sub ecx, 1
jne 0x431c8f
mov byte [ebp + 0xb], 1
add edi, 2
test byte [ebp + 0xc], 0x40
mov eax, edi
mov dword [esi], edi
mov dword [ebp - 4], eax
je 0x431c8f
push 0x20
pop ecx
cmp word [edi], cx
jmp 0x431c8a
add dword [esi], 2
mov eax, dword [esi]
cmp word [eax], cx
mov dword [ebp - 4], eax
je 0x431c82
xorps xmm1, xmm1
movsd qword [ebp - 0x1c], xmm1
movzx eax, word [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
push eax
mov dword [ebp - 0x10], ecx
mov edi, eax
call fcn.00425304
pop ecx
test al, al
je 0x431cdc
movd xmm0, dword [ebp - 0xc]
movsd xmm1, qword [ebp - 0x1c]
mulsd xmm1, qword [0x4a4710]
mov byte [ebp - 8], 1
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
subsd xmm1, qword [0x4a4720]
movsd qword [ebp - 0x1c], xmm1
jmp 0x431cef
push 0x2e
pop ecx
cmp di, cx
je 0x431cfc
cmp edi, 0x2c
jne 0x431d00
test byte [ebp + 0xc], 0x20
je 0x431d00
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov dword [esi], eax
jmp 0x431c97
mov al, 1
jmp 0x431d03
mov eax, dword [ebp - 8]
pop edi
test al, al
jne 0x431d28
test byte [ebp + 0xc], 8
je 0x431d18
movsd xmm0, qword [str.v_w0]
jmp 0x431d1b
xorps xmm0, xmm0
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
jmp 0x431de4
cmp word [ebp - 0x10], cx
jne 0x431d86
mov eax, dword [ebp - 4]
movsd xmm0, qword [0x4a4710]
add eax, 2
movsd qword [ebp - 0x14], xmm0
jmp 0x431d76
mov ecx, dword [esi]
movsd xmm2, qword [ebp - 0x14]
movzx eax, word [ecx]
sub eax, 0x30
movd xmm0, eax
lea eax, [ecx + 2]
cvtdq2pd xmm0, xmm0
divsd xmm0, xmm2
mulsd xmm2, qword [0x4a4710]
addsd xmm0, qword [ebp - 0x1c]
movsd qword [ebp - 0x14], xmm2
movsd qword [ebp - 0x1c], xmm0
mov dword [esi], eax
movzx eax, word [eax]
push eax
call fcn.00425304
pop ecx
test al, al
jne 0x431d43
test byte [ebp + 0xc], 2
je 0x431da1
jmp 0x431d91
add dword [esi], 2
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.004254bc
pop ecx
test al, al
jne 0x431d8e
cmp byte [ebp + 0xb], 0
je 0x431dba
movsd xmm0, qword [ebp - 0x1c]
xorps xmm0, xmmword [0x4a3e30]
movsd qword [ebp - 0x1c], xmm0
jmp 0x431dc4
movsd xmm1, qword [ebp - 0x1c]
movsd qword [ebp - 0x1c], xmm1
fld qword [ebp - 0x1c]
jmp 0x431de4
test byte [ebp + 0xc], 8
je 0x431dd9
movsd xmm0, qword [str.v_w0]
jmp 0x431ddc
xorps xmm0, xmm0
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
pop esi
leave
ret