joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f970
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov ebp, dword [esp + 0x468]
mov edi, dword [esp + 0x450]
mov dword [esp + 0x3c], 0xf345f1a5
mov dword [esp + 0x40], 0xff57fd46
mov dword [esp + 0x44], 0xfb4ef94c
mov dword [esp + 0x48], 0xc7b1c565
mov dword [esp + 0x4c], 0xc3b4c1bd
mov dword [esp + 0x50], 0xcfaecdbc
mov dword [esp + 0x54], 0xcb95c9a0
mov dword [esp + 0x58], 0xd760d57d
mov dword [esp + 0x5c], 0xd365d17c
mov dword [esp + 0x60], 0xdf6ddd63
mov dword [esp + 0x64], 0xdb8cd9b8
mov dword [esp + 0x68], 0x27462578
mov dword [esp + 0x6c], 0x23522151
mov dword [esp + 0x70], 0x2f5e2d5a
mov dword [esp + 0x74], 0x2b4a2953
mov dword [esp + 0x78], 0x379f356b
mov dword [esp + 0x7c], 0x334c3186
mov dword [esp + 0x80], 0x3f453d40
mov dword [esp + 0x84], 0x3b823958
mov dword [esp + 0x88], 0x77a057a
mov dword [esp + 0x8c], 0x3620169
mov dword [esp + 0x90], 0xfbe0d4d
mov dword [esp + 0x94], 0xbbe09b8
mov dword [esp + 0x98], 0x174915b9
mov dword [esp + 0x9c], 0x13b011bd
mov dword [esp + 0xa0], 0x1fb71d57
mov dword [esp + 0xa4], 0x1b6d19a4
mov dword [esp + 0xa8], 0x67156519
mov dword [esp + 0xac], 0x6314611f
mov dword [esp + 0xb0], 0x6f106d1f
mov dword [esp + 0xb4], 0x6b026908
mov dword [esp + 0xb8], 0x773e753f
mov dword [esp + 0xbc], 0x7327712c
mov dword [esp + 0xc0], 0x7f0a7d28
mov dword [esp + 0xc4], 0x7bce7918
mov dword [esp + 0xc8], 0x47ed45ed
mov dword [esp + 0xcc], 0x432241ed
mov dword [esp + 0xd0], 0x4fe34d03
mov dword [esp + 0xd4], 0x4be149eb
mov dword [esp + 0xd8], 0x573f55e3
mov dword [esp + 0xdc], 0x53115130
mov dword [esp + 0xe0], 0x5fec5df4
mov dword [esp + 0xe4], 0x5bef59ef
mov dword [esp + 0xe8], 0xa7d1a509
mov dword [esp + 0xec], 0xa3d3a1d1
mov dword [esp + 0xf0], 0xafd8add5
mov dword [esp + 0xf4], 0xabdca9d8
mov dword [esp + 0xf8], 0xb7c0b5c4
mov dword [esp + 0xfc], 0xb3d2b1c0
mov dword [esp + 0x100], 0xbf1fbdef
mov dword [esp + 0x104], 0xbb1bb916
mov dword [esp + 0x108], 0x872f8536
mov dword [esp + 0x10c], 0x83ff81f7
mov dword [esp + 0x110], 0x8ff18dff
mov dword [esp + 0x114], 0x8bf989fe
mov dword [esp + 0x118], 0x979695ea
mov byte [esp + 0x11e], 0
mov word [esp + 0x11c], 0
mov eax, dword [0x44f190]
mov ecx, 0x6d3616d6
mov edx, 0xda6c2dac
nop
nop
mov esi, edx
and esi, 0x86000a8
mov ebx, ecx
xor ebx, 0x14f8c854
add ebx, esi
mov esi, ebx
xor esi, 0xd6
and ebx, 0x29
add ebx, ebx
sub ebx, esi
xor bl, byte [esp + ecx - 0x6d36169a]
add bl, 0x5c
mov byte [esp + ecx - 0x6d36169a], bl
inc ecx
add edx, 2
cmp ecx, 0x6d3617b9
jne 0x40fbe0
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
xor ecx, ecx
mov dword [esp + 8], eax
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449b70]
Function at 0x79bf14ce
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
lea ebx, [eax + edi + 0x78]
mov eax, dword [ebx]
test eax, eax
je 0x79bf157d
cmp dword [ebx + 4], 0x28
jb 0x79bf157d
lea esi, [eax + edi]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x79bf157d
mov edx, dword [esi + 0x20]
cmp edx, eax
jb 0x79bf157d
lea edx, [edx + ecx*4]
mov ecx, dword [ebx + 4]
add ecx, eax
cmp ecx, edx
jb 0x79bf157d
mov eax, dword [esi + 0x20]
and dword [ebp + 8], 0
add eax, edi
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x1c]
add eax, edi
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x24]
add eax, edi
cmp dword [esi + 0x18], 0
mov dword [ebp - 0xc], eax
jbe 0x79bf157d
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
lea eax, [eax + ecx*4]
mov ecx, dword [ebx]
cmp ecx, dword [eax]
ja 0x79bf1572
mov eax, dword [eax]
push dword [ebp + 0xc]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebx]
mov ecx, dword [ebp - 8]
add edx, dword [ebx + 4]
lea eax, [eax + ecx + 1]
cmp eax, edx
ja 0x79bf1572
push dword [ebp + 0xc]
lea eax, [ecx + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x79bf1584
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x18]
jb 0x79bf1534
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp + 8]
cmp dword [esi + 0x14], ecx
jbe 0x79bf157d
mov esi, dword [esi + 0x1c]
mov eax, dword [ebx]
cmp esi, eax
jb 0x79bf157d
lea edx, [esi + ecx*4 + 4]
mov esi, dword [ebx + 4]
add esi, eax
cmp esi, edx
jb 0x79bf157d
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + eax*4]
jmp 0x79bf157f

Function at 0x79bf1654
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x40
mov edi, 0x101000
push edi
push dword [esp + 0x14]
push 0
call esi
test eax, eax
jne 0x79bf167a
push 4
push edi
push dword [esp + 0x14]
push eax
call esi
pop edi
pop esi
ret
Function at 0x79bf1d99
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 4]
test edi, edi
jne 0x79bf1de2
mov ecx, dword [eax + 4]
push edi
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x79bf1dde
cmp dword [ebp - 8], ebx
je 0x79bf1e13
xor eax, eax
jmp 0x79bf1e16
mov esi, dword [esi + 8]
mov edx, ebx
xor ecx, ecx
add edx, dword [eax]
adc ecx, dword [eax + 4]
xor ebx, ebx
cmp ebx, ecx
jg 0x79bf1e04
jl 0x79bf1dfa
cmp esi, edx
jae 0x79bf1e04
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x79bf1dde
mov ecx, dword [eax]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
add ecx, edi
call fcn.79bf168f
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x79bf1eec
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
cmp dword [eax + 0x38], ebx
jne 0x79bf1f09
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x79bf209a
mov ecx, dword [ebp + 0xc]
push edi
lea edi, [eax + 0x30]
push 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
mov eax, edi
call fcn.79bf1d99
add esp, 0xc
test eax, eax
je 0x79bf1f3f
push dword [ebp - 0x14]
call fcn.79bf1654
pop ecx
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x79bf1f46
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x79bf2099
mov eax, dword [edi]
mov edi, dword [edi + 4]
mov ecx, dword [ebp + 0xc]
push esi
push dword [ebp - 0x14]
add eax, 0xc
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
adc edi, ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
call fcn.79bf1d99
mov eax, dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
add esp, 0xc
push ebx
push eax
push ebx
push 0x40
push ebx
push 0xffffffffffffffff
mov dword [ebp - 8], eax
call edi
mov esi, eax
cmp esi, ebx
jne 0x79bf1f9c
push ebx
push dword [ebp - 8]
push ebx
push 4
push ebx
push 0xffffffffffffffff
call edi
mov esi, eax
cmp esi, ebx
je 0x79bf1fc7
push ebx
push ebx
push ebx
push 0x26
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, ebx
jne 0x79bf1fd2
push ebx
push ebx
push ebx
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, ebx
jne 0x79bf1fd2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call fcn.79bf167d
pop ecx
jmp 0x79bf203b
cmp dword [ebp - 0x10], ebx
jne 0x79bf1fe6
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov eax, edi
call fcn.79bf168f
jmp 0x79bf1ff5
push dword [ebp - 0x18]
push edi
push dword [ebp - 4]
call fcn.79bf2490
add esp, 0xc
push dword [ebp - 4]
call fcn.79bf167d
mov eax, dword [edi + 0x3c]
pop ecx
cmp edi, dword [eax + edi + 0x34]
je 0x79bf2045
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
push ebx
push ebx
push ebx
push 0x26
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov edi, eax
cmp edi, ebx
jne 0x79bf2045
push ebx
push ebx
push ebx
push ebx
push 0x26
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov edi, eax
cmp edi, ebx
jne 0x79bf2045
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x79bf208c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp + 0x10], bl
je 0x79bf2063
push dword [ebp - 0x18]
push edi
call fcn.79bf194b
pop ecx
pop ecx
test al, al
jne 0x79bf2063
push edi
jmp 0x79bf2086
mov eax, dword [edi + 0x3c]
lea esi, [eax + edi + 0x18]
mov eax, edi
sub eax, dword [esi + 0x1c]
push eax
call fcn.79bf16a3
push dword [esi + 0x68]
push esi
call fcn.79bf1779
add esp, 0xc
push edi
test al, al
jne 0x79bf2090
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
jmp 0x79bf2098
call fcn.79bf1e9e
pop ecx
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x79bf2490
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov bl, byte [eax]
push esi
cmp bl, 0xd8
je 0x79bf24c1
cmp bl, 0xd7
je 0x79bf24c1
mov esi, dword [esp + 0x14]
lea ecx, [eax + 1]
test esi, esi
jle 0x79bf24e9
mov eax, dword [esp + 0x10]
sub ecx, eax
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
sub esi, 1
jne 0x79bf24b3
pop esi
pop ebx
ret
mov esi, dword [esp + 0x10]
push esi
inc eax
push eax
call fcn.79bf250e
cmp bl, 0xd8
jne 0x79bf24e9
mov ecx, dword [esp + 0x14]
xor eax, eax
test ecx, ecx
jle 0x79bf24e9
lea esp, [esp]
xor byte [eax + esi], 0xf0
inc eax
cmp eax, ecx
jl 0x79bf24e0
pop esi
pop ebx
ret
Function at 0x43ebb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x43ebce
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x43ebc3
pop esi
ret

Function at 0x43ed10
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x43eda2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x43ed94
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x43ed8c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x43ed55
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x409a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d125a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
lea ebx, [ecx + eax*4]
mov ecx, dword [ebp + 8]
xor eax, eax
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
mov word [ebp - 0x24], ax
mov dword [ebp - 4], eax
call fcn.0040afd0
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x409c1b
mov edi, dword [eax]
test edi, edi
je 0x409c0d
mov ecx, dword [edi + 0x18]
cmp ecx, 0x10
jb 0x409af7
mov esi, dword [edi + 4]
jmp 0x409afa
lea esi, [edi + 4]
mov edx, dword [edi + 0x14]
add edx, esi
cmp ecx, 0x10
jb 0x409b09
mov ecx, dword [edi + 4]
jmp 0x409b0c
lea ecx, [edi + 4]
xor eax, eax
cmp ecx, edx
je 0x409b2f
mov esi, eax
mov ebx, eax
shl esi, 6
shr ebx, 2
add esi, ebx
movsx ebx, byte [ecx]
lea esi, [esi + ebx - 0x61c88647]
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x409b12
mov ecx, dword [ebp + 8]
xor edx, edx
div dword [ecx + 4]
mov eax, dword [ecx]
mov ecx, dword [edi]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x2c]
lea esi, [eax + edx*4]
call fcn.0040b210
mov ebx, dword [ebp - 0x28]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 1
je 0x409b81
push 0xffffffffffffffff
push 0
lea eax, [edi + 4]
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
push eax
mov ecx, ebx
mov byte [ebx], 0
call fcn.004018d0
mov edx, dword [edi + 0x20]
mov dword [ebx + 0x1c], edx
mov byte [ebp - 4], 0
mov ebx, dword [ebp - 0x28]
mov eax, dword [esi]
mov dword [ebx], eax
mov dword [esi], ebx
mov edi, dword [edi]
mov byte [ebp - 0x23], 1
mov dword [ebp - 0x28], 0
cmp edi, dword [ebp - 0x10]
je 0x409bff
lea ecx, [ebp - 0x2c]
call fcn.0040b210
mov esi, dword [ebp - 0x28]
add esi, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 2
je 0x409be0
push 0xffffffffffffffff
push 0
lea eax, [edi + 4]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.004018d0
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x1c], ecx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov edx, dword [ebx]
mov dword [eax], edx
mov dword [ebx], ebx
mov edi, dword [edi]
mov byte [ebp - 0x23], 1
mov dword [ebp - 0x28], 0
cmp edi, dword [ebp - 0x10]
jne 0x409ba0
test edi, edi
jne 0x409aea
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x409ae0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d11ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
lea ebx, [ecx + eax*4]
mov ecx, dword [ebp + 8]
xor eax, eax
push edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
call fcn.0040afd0
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x40a5c5
mov edi, dword [eax]
test edi, edi
je 0x40a5b7
mov ecx, dword [edi + 0x18]
cmp ecx, 0x10
jb 0x40a487
mov esi, dword [edi + 4]
jmp 0x40a48a
lea esi, [edi + 4]
mov edx, dword [edi + 0x14]
add edx, esi
cmp ecx, 0x10
jb 0x40a499
mov ecx, dword [edi + 4]
jmp 0x40a49c
lea ecx, [edi + 4]
xor eax, eax
cmp ecx, edx
je 0x40a4bf
mov esi, eax
mov ebx, eax
shl esi, 6
shr ebx, 2
add esi, ebx
movsx ebx, byte [ecx]
lea esi, [esi + ebx - 0x61c88647]
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x40a4a2
mov ecx, dword [ebp + 8]
xor edx, edx
div dword [ecx + 4]
mov eax, dword [ecx]
lea ecx, [eax + edx*4]
mov edx, dword [edi]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], edx
call fcn.0040b8c0
mov ebx, dword [ebp - 0x2c]
lea esi, [ebx + 4]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x40a520
push 0xffffffffffffffff
push 0
lea eax, [edi + 4]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.004018d0
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 2
call fcn.0040bed0
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 0
mov ecx, dword [eax]
mov dword [ebx], ecx
mov dword [eax], ebx
mov edi, dword [edi]
mov byte [ebp - 0x27], 1
mov dword [ebp - 0x2c], 0
cmp edi, dword [ebp - 0x10]
je 0x40a5a9
nop
lea ecx, [ebp - 0x30]
call fcn.0040b8c0
mov esi, dword [ebp - 0x2c]
add esi, 4
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 3
je 0x40a58a
push 0xffffffffffffffff
push 0
lea eax, [edi + 4]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.004018d0
lea edx, [edi + 0x20]
push edx
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 4
call fcn.0040bed0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebx]
mov dword [eax], ecx
mov dword [ebx], ebx
mov edi, dword [edi]
mov byte [ebp - 0x27], 1
mov dword [ebp - 0x2c], 0
cmp edi, dword [ebp - 0x10]
jne 0x40a540
test edi, edi
jne 0x40a47a
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x40a470
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d167a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
lea ebx, [ecx + eax*4]
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
call fcn.0040afd0
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x40aa8b
push edi
mov edi, dword [eax]
test edi, edi
je 0x40aa7c
lea ebx, [ebx]
mov ecx, dword [edi + 0x18]
cmp ecx, 0x10
jb 0x40a94d
mov esi, dword [edi + 4]
jmp 0x40a950
lea esi, [edi + 4]
mov edx, dword [edi + 0x14]
add edx, esi
cmp ecx, 0x10
jb 0x40a95f
mov ecx, dword [edi + 4]
jmp 0x40a962
lea ecx, [edi + 4]
xor eax, eax
cmp ecx, edx
je 0x40a985
mov esi, eax
mov ebx, eax
shl esi, 6
shr ebx, 2
add esi, ebx
movsx ebx, byte [ecx]
lea esi, [esi + ebx - 0x61c88647]
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x40a968
mov ecx, dword [ebp + 8]
xor edx, edx
div dword [ecx + 4]
mov eax, dword [ecx]
lea ecx, [eax + edx*4]
mov edx, dword [edi]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], edx
call fcn.0040bbb0
mov ebx, dword [ebp - 0x2c]
lea esi, [ebx + 4]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x40a9e6
push 0xffffffffffffffff
push 0
lea eax, [edi + 4]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.004018d0
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 2
call fcn.00406470
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 0
mov ecx, dword [eax]
mov dword [ebx], ecx
mov dword [eax], ebx
mov edi, dword [edi]
mov byte [ebp - 0x27], 1
mov dword [ebp - 0x2c], 0
cmp edi, dword [ebp - 0x10]
je 0x40aa6e
lea ecx, [ebp - 0x30]
call fcn.0040bbb0
mov esi, dword [ebp - 0x2c]
add esi, 4
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 3
je 0x40aa4f
push 0xffffffffffffffff
push 0
lea eax, [edi + 4]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.004018d0
lea edx, [edi + 0x20]
push edx
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 4
call fcn.00406470
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebx]
mov dword [eax], ecx
mov dword [ebx], ebx
mov edi, dword [edi]
mov byte [ebp - 0x27], 1
mov dword [ebp - 0x2c], 0
cmp edi, dword [ebp - 0x10]
jne 0x40aa05
test edi, edi
jne 0x40a940
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x40a930
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d0a50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov dword [esp + 0x1c], eax
lea eax, [edx + ecx*4]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x4c], edi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], edi
inc eax
push eax
lea edx, [esp + 0x1c]
mov byte [esp + 0x50], 1
push edx
lea ecx, [esp + 0x38]
mov dword [esp + 0x20], edi
call fcn.005001e0
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
lea eax, [ecx + eax*4]
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x24], ecx
mov ecx, dword [esi]
mov dword [esi], edi
mov dword [esi + 4], eax
mov ebx, dword [esi + 0x18]
mov edx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov dword [esi + 0x10], edi
mov dword [esp + 0x18], ebx
cmp ebx, dword [esp + 0x1c]
je 0x40b17b
lea ecx, [ecx]
mov edi, dword [ebx]
mov dword [esp + 0x14], edi
test edi, edi
je 0x40b168
cmp dword [edi + 0x18], 0x10
lea eax, [edi + 4]
jb 0x40b107
mov ecx, dword [eax]
jmp 0x40b109
mov ecx, eax
mov edx, dword [eax + 0x10]
add edx, ecx
cmp dword [eax + 0x14], 0x10
jb 0x40b116
mov eax, dword [eax]
mov ecx, eax
mov dword [esp + 0x10], eax
xor eax, eax
cmp ecx, edx
je 0x40b147
mov edi, eax
mov ebx, eax
shl edi, 6
shr ebx, 2
add edi, ebx
movsx ebx, byte [ecx]
lea edi, [edi + ebx - 0x61c88647]
inc ecx
xor eax, edi
cmp ecx, edx
jne 0x40b122
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
xor edx, edx
div dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edi]
mov dword [ebx], ecx
lea eax, [eax + edx*4]
mov edx, dword [eax]
mov dword [edi], edx
mov dword [eax], edi
mov edi, dword [ebx]
mov dword [esp + 0x14], edi
test edi, edi
jne 0x40b0fa
add ebx, 4
mov dword [esp + 0x18], ebx
cmp ebx, dword [esp + 0x1c]
jne 0x40b0f0
xor edi, edi
mov eax, dword [esp + 0x20]
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [esi], eax
mov eax, dword [esp + 0x28]
mov edx, dword [esi + 4]
mov dword [esi + 4], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
cmp dword [esi + 0x10], edi
je 0x40b1bc
mov eax, dword [esi]
mov dword [esi + 0x18], eax
cmp dword [eax], edi
jne 0x40b1c6
lea ebx, [ebx]
add eax, 4
mov dword [esi + 0x18], eax
cmp dword [eax], edi
je 0x40b1b0
jmp 0x40b1c6
mov edx, eax
mov eax, dword [esi]
lea ecx, [eax + edx*4]
mov dword [esi + 0x18], ecx
mov ecx, esi
call fcn.0040b5c0
mov dword [esi + 0x1c], eax
cmp dword [esp + 0x30], edi
je 0x40b1df
lea ecx, [esp + 0x30]
call fcn.00409930
cmp dword [esp + 0x24], edi
je 0x40b1ee
lea ecx, [esp + 0x24]
call fcn.00409930
mov ecx, dword [esp + 0x44]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4