joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404590
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov eax, 0x2068
call fcn.00407c40
mov eax, dword [0x42d008]
xor eax, esp
mov dword [esp + 0x2064], eax
mov eax, dword [esp + 0x206c]
push 0x1000
push eax
lea eax, [esp + 0x6c]
mov dword [esp + 8], 0
push eax
call fcn.00404f00
push 1
push 0x16
call fcn.0040fbb6
push 1
push 2
call fcn.0040fbb6
push 1
push 0xf
call fcn.0040fbb6
push 1
push 0x15
call fcn.0040fbb6
push str.LOADER:_Setting_up_to_run_child_n
call fcn.004018c0
add esp, 0x30
mov dword [esp + 4], 0xc
lea eax, [esp + 0x20]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 1
mov dword [esp + 0x24], 0
push 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x50], 0x101
mov word [esp + 0x54], ax
call fcn.0040ad1d
push eax
call fcn.0040ecec
push eax
call fcn.0040f6ff
push 1
mov dword [esp + 0x68], eax
call fcn.0040ad1d
push eax
call fcn.0040ecec
push eax
call fcn.0040f6ff
push 2
mov dword [esp + 0x78], eax
call fcn.0040ad1d
push eax
call fcn.0040ecec
push eax
call fcn.0040f6ff
push str.LOADER:_Creating_child_process_n
mov dword [esp + 0x88], eax
call fcn.004018c0
add esp, 0x28
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
push 1
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40470b
push str.LOADER:_Waiting_for_child_process_to_finish..._n
call fcn.004018c0
add esp, 4
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp]
mov ecx, dword [esp + 0x2064]
xor ecx, esp
call fcn.00407c24
add esp, 0x2068
ret
push str.Error_creating_child_process__n
push 0x422e70
call fcn.004018f0
mov ecx, dword [esp + 0x206c]
add esp, 8
xor ecx, esp
or eax, 0xffffffff
call fcn.00407c24
add esp, 0x2068
ret

Function at 0x404d50
Capabilities:
Create directory

Disassembly:
sub esp, 0x38
mov eax, dword [0x42d008]
xor eax, esp
mov dword [esp + 0x34], eax
movups xmm0, xmmword [str.D:_A__FA___S_1_3_4_]
push esi
mov esi, dword [esp + 0x40]
lea eax, [esp + 8]
movups xmmword [esp + 0x10], xmm0
push 0
movups xmm0, xmmword [0x42317c]
push eax
push 1
movups xmmword [esp + 0x2c], xmm0
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], 0xc
movq xmm0, qword [0x42318c]
push eax
movq qword [esp + 0x40], xmm0
mov dword [esp + 0x1c], 0
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x404dc3
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00407c24
add esp, 0x38
ret
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [esp + 0x38]
neg eax
pop esi
sbb eax, eax
xor ecx, esp
neg eax
dec eax
call fcn.00407c24
add esp, 0x38
ret
Function at 0x4132c2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00413141

Function at 0x41760b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416f79

Function at 0x417616
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004171b4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x3c205d0b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, str.9U_
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x55d72f39
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40d259
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [esp + 0x24]
push edi
call fcn.0040ce96
add esp, 4
mov esi, eax
push edi
call fcn.0040c8d4
add esp, 4
mov ebp, eax
mov dword [esp + 4], esi
push esi
call fcn.0040c8d4
add esp, 4
mov ebx, eax
push dword [esp + 0x28]
call fcn.0041312d
add esp, 4
test eax, eax
je 0x40d344
dec eax
xor ecx, ecx
inc ecx
mov dword [esp + 8], ecx
mov dword [esp], eax
push eax
push dword [esp + 0x2c]
call fcn.00413590
add esp, 8
mov esi, eax
push ebx
push ebp
call fcn.0040caae
add esp, 8
mov dword [esp + 0xc], eax
mov ecx, ebp
mov edx, ebx
push esi
call fcn.0040d369
add esp, 4
push ebp
call fcn.0040ce96
add esp, 4
mov edi, eax
push ebp
call fcn.0040c92a
add esp, 4
push ebx
call fcn.0040c92a
add esp, 4
mov ebp, dword [esp + 0xc]
mov ecx, edi
mov edx, ebp
push esi
call fcn.0040d369
add esp, 4
mov ebx, dword [esp + 8]
mov edx, dword [esp + 0x24]
mov ecx, edi
push ebx
call fcn.0040d3a3
add esp, 4
mov edx, dword [esp + 4]
mov ecx, ebp
push ebx
call fcn.0040d3a3
mov eax, dword [esp + 4]
add esp, 4
xor ecx, ecx
mov dword [esp], edi
dec ecx
xor esi, ecx
and ebx, esi
mov esi, ebp
add eax, ecx
mov ebp, edi
mov dword [esp + 8], ebx
mov ebx, esi
jb 0x40d2a5
jmp 0x40d349
mov esi, ebx
mov dword [esp], ebp
push dword [esp + 4]
call fcn.0040c92a
add esp, 4
push esi
call fcn.0040c92a
add esp, 4
mov eax, dword [esp]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40db02
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [esp + 0x24]
push edi
call fcn.0040d99e
add esp, 4
mov esi, eax
push edi
call fcn.0040d75b
add esp, 4
mov edi, eax
mov dword [esp], esi
push esi
call fcn.0040d75b
add esp, 4
mov ebp, eax
push dword [esp + 0x28]
call fcn.0041312d
add esp, 4
test eax, eax
je 0x40dc0e
mov ecx, eax
dec ecx
xor eax, eax
inc eax
mov dword [esp + 4], eax
mov dword [esp + 0xc], ecx
push ecx
push dword [esp + 0x2c]
call fcn.00413590
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push eax
push ebp
push edi
call fcn.0040d7cb
add esp, 0xc
mov dword [esp + 8], eax
push esi
push dword [ebp]
push dword [edi]
call fcn.00413213
add esp, 0xc
push esi
push dword [ebp + 4]
push dword [edi + 4]
call fcn.00413213
add esp, 0xc
push edi
call fcn.0040d99e
add esp, 4
mov ebx, eax
push edi
call fcn.0040d7a0
add esp, 4
push ebp
call fcn.0040d7a0
add esp, 4
push esi
mov ebp, dword [esp + 0xc]
push dword [ebp]
push dword [ebx]
call fcn.00413213
add esp, 0xc
push esi
push dword [ebp + 4]
push dword [ebx + 4]
call fcn.00413213
add esp, 0xc
mov edi, dword [esp + 4]
mov edx, dword [esp + 0x24]
mov ecx, ebx
push edi
call fcn.0040dc30
add esp, 4
mov edx, dword [esp]
mov ecx, ebp
push edi
call fcn.0040dc30
mov ecx, dword [esp + 0x10]
add esp, 4
xor eax, eax
dec eax
xor esi, eax
and edi, esi
mov esi, ebp
add ecx, eax
mov dword [esp + 4], edi
mov edi, ebx
jb 0x40db4f
jmp 0x40dc12
mov esi, ebp
mov ebx, edi
push dword [esp]
call fcn.0040d7a0
add esp, 4
push esi
call fcn.0040d7a0
add esp, 4
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40e20d
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [esp + 0x24]
push edi
push edi
call fcn.0040df9f
add esp, 8
mov ebx, eax
push edi
call fcn.0040dd5a
add esp, 4
mov edi, eax
mov dword [esp], ebx
push ebx
call fcn.0040dd5a
add esp, 4
mov ebp, eax
push dword [esp + 0x28]
call fcn.0041312d
add esp, 4
test eax, eax
je 0x40e2f4
dec eax
xor ecx, ecx
inc ecx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
push eax
push dword [esp + 0x2c]
call fcn.00413590
add esp, 8
mov esi, eax
push ebp
push edi
call fcn.0040df9f
add esp, 8
mov dword [esp + 8], eax
mov ecx, edi
mov edx, ebp
push esi
call fcn.0040e316
add esp, 4
push edi
push edi
call fcn.0040df9f
add esp, 8
mov ebx, eax
push edi
call fcn.0040ddc1
add esp, 4
push ebp
call fcn.0040ddc1
add esp, 4
mov ebp, dword [esp + 8]
mov ecx, ebx
mov edx, ebp
push esi
call fcn.0040e316
add esp, 4
mov edi, dword [esp + 4]
mov edx, dword [esp + 0x24]
mov ecx, ebx
push edi
call fcn.0040e35f
add esp, 4
mov edx, dword [esp]
mov ecx, ebp
push edi
call fcn.0040e35f
mov eax, dword [esp + 0x10]
add esp, 4
xor ecx, ecx
dec ecx
xor esi, ecx
and edi, esi
add eax, ecx
mov esi, ebp
mov dword [esp + 4], edi
mov edi, ebx
jb 0x40e259
jmp 0x40e2f8
mov esi, ebp
mov ebx, edi
push dword [esp]
call fcn.0040ddc1
add esp, 4
push esi
call fcn.0040ddc1
add esp, 4
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40f39e
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx + 4]
mov edi, edx
mov esi, ecx
test eax, eax
jne 0x40f3b8
push esi
call fcn.0040ef1b
add esp, 4
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, 2
je 0x40f3d6
cmp eax, 1
jne 0x40f42f
add esi, 8
push ebx
push edi
push esi
call fcn.0045602d
add esp, 0xc
jmp 0x40f42f
mov eax, dword [esi]
test eax, eax
jne 0x40f3f2
push 0x2f
push str..._logging.c
push str.ctx__lgfp
call fcn.0047b3ef
add esp, 0xc
mov eax, dword [esi]
push eax
push ebx
push 1
push edi
call fcn.0047d800
add esp, 0x10
cmp eax, ebx
jae 0x40f42f
mov eax, dword [esi]
test eax, eax
je 0x40f418
push eax
call fcn.0047cf88
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 3
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
push str.Disabled_writing_session_log_due_to_error_while_writing
push eax
call dword [ecx]
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x413213
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi]
cmp eax, dword [esi]
je 0x413242
push 0x92
push str..._mpint.c
push str.x0__nw__x1__nw
call fcn.0047b3ef
add esp, 0xc
mov eax, dword [edi]
and ebx, 1
neg ebx
test eax, eax
mov dword [esp], ebx
je 0x413272
xor eax, eax
mov edx, dword [esi + 4]
mov ecx, dword [edi + 4]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esp]
and ecx, edx
mov edx, dword [edi + 4]
xor dword [edx + eax*4], ecx
mov edx, dword [esi + 4]
xor dword [edx + eax*4], ecx
inc eax
cmp eax, dword [edi]
jb 0x413250
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x41348c
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
cmp eax, 0x40000000
jb 0x4134b9
push 0xf2
push str..._mpint.c
push str.hex.len_____size_t_0____4
mov esi, eax
call fcn.0047b3ef
mov eax, esi
add esp, 0xc
lea ecx, [eax*4 + 0x1f]
mov esi, eax
shr ecx, 5
xor eax, eax
inc eax
cmp ecx, eax
cmovbe ecx, eax
call fcn.0041307f
test esi, esi
je 0x413545
xor edx, edx
mov dword [esp], 0
mov ecx, dword [esp + 0x1c]
mov edi, 0x66
mov dword [esp + 4], esi
movsx ecx, byte [ecx + esi - 1]
mov esi, 0x46
lea ebp, [ecx - 0x61]
sub edi, ecx
sub esi, ecx
lea ebx, [ecx - 0x57]
or edi, ebp
lea ebp, [ecx - 0x41]
or esi, ebp
lea ebp, [ecx - 0x30]
sar edi, 0x1f
add ecx, 0xffffffc9
xor ebp, ebx
sar esi, 0x1f
and ebp, edi
mov edi, dword [eax + 4]
xor ebp, ebx
mov ebx, dword [esp]
xor ebp, ecx
and ebp, esi
mov esi, edx
inc edx
xor ebp, ecx
shr esi, 3
mov ecx, ebx
and ebp, 0xf
add ebx, 4
and cl, 0x1c
shl ebp, cl
or dword [edi + esi*4], ebp
mov dword [esp], ebx
mov esi, dword [esp + 4]
dec esi
jne 0x4134df
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x413603
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
test ecx, ecx
je 0x41367f
mov eax, dword [eax + 4]
mov dword [esp + 4], 0
mov dword [esp], ecx
mov dword [esp + 8], eax
xor eax, eax
xor ebx, ebx
xor ebp, ebp
dec eax
mov edx, eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov esi, edx
mov eax, dword [eax + ebp*4]
mov edi, ecx
mov edx, eax
or edi, eax
and eax, 1
shr edx, 1
xor edi, esi
or eax, edx
neg eax
mov edx, eax
shr edx, 0x1f
neg edx
sbb ecx, ecx
and edx, edi
mov edi, dword [esp + 0xc]
sar eax, 0x1f
and ecx, ebx
xor edx, esi
xor ebx, ecx
mov ecx, ebp
inc ebp
xor ecx, edi
and eax, ecx
xor eax, edi
cmp dword [esp], ebp
jne 0x41362f
shl eax, 5
or eax, 1
jmp 0x413687
xor edx, edx
mov eax, 0xffffffe1
dec edx
mov ecx, 0x10
xor esi, esi
mov edi, edx
shr edi, cl
mov ebx, edi
xor edi, edx
neg ebx
sar ebx, 0x1f
and edi, ebx
and ebx, ecx
xor edx, edi
add esi, ebx
shr ecx, 1
jne 0x41368e
add eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4137f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [esp + 0x24]
test edi, edi
je 0x41381a
lea eax, [edi - 1]
movzx esi, byte [ecx + eax]
xor edi, eax
xor esi, 0x30
dec esi
sar esi, 0x1f
and edi, esi
xor edi, eax
add eax, 0xffffffff
jb 0x413802
jmp 0x41381c
xor edi, edi
test edx, edx
mov dword [esp + 8], edi
mov dword [esp + 0xc], ecx
je 0x413880
mov esi, dword [esp + 0xc]
xor ecx, ecx
mov dword [esp], edx
xor ebx, ebx
mov dword [esp + 4], ecx
inc ebx
shl ebx, cl
cmp ebx, edx
jae 0x413870
mov eax, dword [esp + 8]
mov ebp, dword [esp]
mov ecx, dword [esp + 4]
xor edi, edi
shr eax, cl
sub ebp, ebx
add ebx, esi
and al, 1
neg al
mov ecx, eax
mov al, byte [esi + edi]
mov ah, byte [ebx + edi]
mov edx, ecx
xor ah, al
and ah, dl
xor al, ah
mov byte [esi + edi], al
xor byte [ebx + edi], ah
inc edi
cmp ebp, edi
jne 0x413857
mov ecx, dword [esp + 4]
mov edx, dword [esp]
inc ecx
mov eax, edx
shr eax, cl
test eax, eax
jne 0x413831
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41aa32
Capabilities:
Get session user name

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x37
push esi
call fcn.004031c6
add esp, 8
cmp byte [eax], 0
je 0x41aa52
push eax
call fcn.00455915
add esp, 4
jmp 0x41aa69
push 0x38
push esi
call fcn.00402fe1
add esp, 8
test al, al
je 0x41aa67
pop esi
jmp fcn.00466c19
xor eax, eax
pop esi
ret
Function at 0x433b1f
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x100
mov eax, dword [0x4b507c]
mov esi, edx
xor eax, esp
mov dword [esp + 0xfc], eax
lea eax, [edx*4]
mov ebp, eax
add ebp, 0x1c
je 0x433bfc
neg eax
xor edx, edx
xor ebx, ebx
mov dword [esp + 4], ecx
mov dword [esp], ebp
lea eax, [esp + eax + 0xc]
mov dword [esp + 8], eax
cmp ebx, esi
jae 0x433b6c
mov edi, dword [ecx + ebx*4]
jmp 0x433bef
mov edi, dword [esp + ebx*4 + 8]
mov ebp, edx
mov eax, ebx
xor edx, edx
div esi
test edx, edx
je 0x433ba2
cmp esi, 8
jne 0x433b9e
mov eax, ebx
and eax, 7
cmp eax, 4
jne 0x433b9e
movd xmm0, edi
pshufd xmm0, xmm0, 0x51
aeskeygenassist xmm0, xmm0, 0
movd edi, xmm0
mov edx, ebp
jmp 0x433be5
movd xmm0, edi
mov edx, ebp
cmp ebp, 0xa
pshufd xmm0, xmm0, 0x51
aeskeygenassist xmm0, xmm0, 0
pextrd edi, xmm0, 1
jb 0x433bdb
push 0x539
push str..._sshaes.c
push str.rconpos___lenof_key_setup_round_constants_
call fcn.0047b3ef
mov ecx, dword [esp + 0x10]
mov edx, ebp
add esp, 0xc
movzx eax, byte [edx + 0x492260]
inc edx
xor edi, eax
mov eax, dword [esp + 8]
mov ebp, dword [esp]
xor edi, dword [eax + ebx*4]
mov dword [esp + ebx*4 + 0xc], edi
inc ebx
cmp ebp, ebx
jne 0x433b60
mov edi, dword [esp + 0x118]
mov ebx, dword [esp + 0x114]
add esi, 6
xor eax, eax
xor ecx, ecx
movdqu xmm0, xmmword [esp + eax + 0xc]
inc ecx
movdqa xmmword [ebx + eax], xmm0
add eax, 0x10
cmp ecx, esi
jbe 0x433c11
lea eax, [esp + 0xc]
push 0xf0
push eax
call fcn.00467374
add esp, 8
mov eax, esi
shl eax, 4
add edi, eax
xor eax, eax
movdqa xmm0, xmmword [ebx]
test eax, eax
je 0x433c50
cmp esi, eax
je 0x433c50
aesimc xmm0, xmm0
inc eax
movdqa xmmword [edi], xmm0
add ebx, 0x10
add edi, 0xfffffff0
cmp esi, eax
jae 0x433c3f
mov ecx, dword [esp + 0xfc]
xor ecx, esp
call fcn.0046f0c8
add esp, 0x100
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x433ddb
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
mov al, byte [ecx]
mov ah, byte [ecx + 1]
test esi, esi
jle 0x433e2c
inc al
movzx edi, al
mov byte [esp + 3], al
movzx ebx, byte [ecx + edi + 2]
add ah, bl
movzx ebp, ah
mov byte [esp + 2], ah
mov al, byte [ecx + ebp + 2]
mov byte [ecx + edi + 2], al
mov byte [ecx + ebp + 2], bl
movzx eax, byte [ecx + edi + 2]
add eax, ebx
movzx eax, al
mov al, byte [ecx + eax + 2]
mov ah, byte [esp + 2]
xor byte [edx], al
inc edx
dec esi
mov al, byte [esp + 3]
jne 0x433ded
mov byte [ecx], al
mov byte [ecx + 1], ah
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436fe8
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test ecx, ecx
je 0x437046
mov edx, dword [esp + 0x18]
movzx edi, byte [edx]
mov esi, 0xf
inc edx
xor edi, eax
mov eax, edi
shr edi, 4
and eax, esi
imul ebx, eax, 0x11111044
xor ebx, edi
imul edi, eax, 0x8840020
imul eax, eax, 0x4220000
xor edi, ebx
and ebx, esi
xor edi, eax
imul ebp, ebx, 0x11111044
imul eax, ebx, 0x4220000
imul esi, ebx, 0x8840020
shr edi, 4
xor eax, ebp
xor eax, edi
xor eax, esi
dec ecx
jne 0x436ffc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4372ad
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
xor eax, eax
mov esi, edx
test ecx, ecx
je 0x4372f5
mov edx, dword [edi]
mov ebp, dword [edi + 4]
xor edx, dword [ecx]
xor ebp, dword [ecx + 4]
or ebp, edx
jne 0x4372f5
mov ebp, 4
push ebp
push 0x4b5044
push 0
call fcn.00436fe8
add esp, 0xc
push ebp
push 0x4b5a98
push eax
call fcn.00436fe8
add esp, 0xc
test ebx, ebx
jle 0x43733a
add ebx, esi
mov ebp, 4
mov ecx, dword [edi]
mov edx, dword [edi + 4]
xor ecx, dword [esi]
xor edx, dword [esi + 4]
or edx, ecx
mov ecx, 0x4b5a98
mov edx, 0x4b5044
cmove ecx, edx
push ebp
push ecx
push eax
call fcn.00436fe8
add esp, 0xc
push ebp
push 0x4b5a98
push eax
call fcn.00436fe8
add esp, 0xc
add esi, 8
cmp esi, ebx
jb 0x437300
test eax, eax
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4384eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, edx
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp], ecx
mov ebx, eax
rol ebx, 4
mov edi, dword [esi + edx*4]
xor ebx, dword [esi + edx*4 + 0x40]
mov edx, 0x493c88
xor edi, eax
movd xmm1, edi
shr edi, 8
movd xmm0, edi
punpckldq xmm0, xmm1
movd xmm1, ebx
shr ebx, 8
movd xmm2, ebx
punpckldq xmm2, xmm1
pxor xmm1, xmm1
punpcklqdq xmm0, xmm2
movdqa xmm2, xmmword [str._b_b_b_b_b_b_b_b]
pand xmm0, xmmword [0x493e90]
por xmm0, xmmword [0x493ea0]
movdqu xmm3, xmmword [edx]
add edx, 0x10
cmp edx, 0x493e88
pshufd xmm3, xmm3, 0x1b
pand xmm3, xmm0
paddd xmm0, xmm2
pxor xmm1, xmm3
jb 0x43854e
pshufd xmm2, xmm1, 0xe7
mov ebx, 0x40004
movd esi, xmm2
pshufd xmm2, xmm0, 0xe7
movd edx, xmm2
mov edi, esi
pshufd xmm2, xmm1, 0x4e
and edx, ebx
shl edi, 4
imul edx, edx, 0x3c00
and edx, edi
xor edx, esi
movd esi, xmm2
pshufd xmm2, xmm0, 0x4e
movd edi, xmm2
mov ebp, esi
pshufd xmm2, xmm1, 0xe5
shr edx, 0xc
and edi, ebx
shl ebp, 4
movd ecx, xmm2
pshufd xmm2, xmm0, 0xe5
and edx, 0xf000f
imul edi, edi, 0x3c00
and edi, ebp
mov ebp, ecx
xor edi, esi
movd esi, xmm2
shl ebp, 4
and esi, ebx
shr edi, 4
imul esi, esi, 0x3c00
and edi, 0xf000f00
and esi, ebp
xor esi, ecx
movd ecx, xmm0
and ecx, ebx
movd ebx, xmm1
shr esi, 8
mov ebp, ebx
imul ecx, ecx, 0x3c00
and esi, 0xf000f0
shl ebp, 4
or esi, edi
and ecx, ebp
xor ecx, ebx
and ecx, 0xf000f000
or esi, ecx
or edx, esi
shr esi, 4
xor esi, edx
and esi, 0x7030702
xor edx, esi
shl esi, 4
xor esi, edx
mov ecx, esi
shr ecx, 8
xor ecx, edx
and ecx, 0x4e009e
mov edi, ecx
shl edi, 8
xor edi, esi
xor edi, ecx
mov ecx, edi
shr ecx, 0x10
xor ecx, edi
and ecx, 0xd9d3
mov edx, ecx
shl edx, 0x10
xor edx, edi
xor edx, ecx
mov ecx, edx
shr ecx, 4
xor ecx, edx
and ecx, 0x5040004
mov esi, ecx
shl ecx, 4
xor esi, edx
shr edx, 1
xor ecx, dword [esp]
xor edx, esi
and edx, 0x4045015
xor esi, edx
add edx, edx
xor edx, esi
xor edx, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e459
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x404
mov eax, dword [0x4b507c]
mov ebx, esp
mov edi, ecx
xor eax, esp
mov dword [esp + 0x400], eax
push ecx
push 0x3ff
push 1
push ebx
call fcn.0047d612
add esp, 0x10
mov esi, eax
push edi
call fcn.0047e321
add esp, 4
test esi, esi
js 0x43e4a3
xor edi, edi
inc edi
cmp esi, 0x20
jge 0x43e4aa
mov esi, edi
jmp 0x43e6ce
xor esi, esi
jmp 0x43e6ce
cmp esi, 0x400
jb 0x43e4c9
push 0x615
push str..._sshpubk.c
push str.i___0__i___sizeof_buf_
call fcn.0047b3ef
add esp, 0xc
mov byte [esp + esi], 0
movdqu xmm0, xmmword [esp]
movdqu xmm1, xmmword [esp + 0x10]
pcmpeqb xmm1, xmmword [str.FILE_FORMAT_1.1_nSSH_PRIVATE_KEY__SSH2_PUBLIC_KEY_____BEGIN_SSH2_NSSH_PRIVATE_KEY_____BEGIN_OPENSENCRYPTED_PRIVATv]
pcmpeqb xmm0, xmmword [0x4944d0]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x43e6a6
movdqu xmm0, xmmword [esp]
movdqu xmm1, xmmword [esp + 0xa]
pcmpeqb xmm1, xmmword [0x4944e0]
pcmpeqb xmm0, xmmword [0x4944f0]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x43e6ad
movdqu xmm0, xmmword [esp]
movd xmm1, dword [esp + 0x10]
pcmpeqb xmm1, xmmword [str.ile_]
pcmpeqb xmm0, xmmword [str.PuTTY_User_Key_FUser_Key_File_1]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x43e6b4
movdqu xmm0, xmmword [esp]
movdqu xmm1, xmmword [esp + 0xe]
pcmpeqb xmm1, xmmword [0x494500]
pcmpeqb xmm0, xmmword [0x494510]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x43e6bb
push 0xb
push str._____BEGIN
push ebx
call fcn.0046ff5d
add esp, 0xc
test eax, eax
je 0x43e6c2
mov eax, 0x20324853
mov ecx, 0x53204e49
mov edx, 0x47454220
mov esi, 0x2d2d2d2d
movdqu xmm3, xmmword [esp]
movd xmm4, ecx
movd xmm2, eax
movd xmm0, esi
movd xmm1, edx
punpckldq xmm4, xmm2
movdqu xmm2, xmmword [esp + 0x10]
punpckldq xmm0, xmm1
punpcklqdq xmm0, xmm4
pcmpeqb xmm3, xmm0
pcmpeqb xmm2, xmmword [0x494520]
pand xmm2, xmm3
pmovmskb eax, xmm2
cmp eax, 0xffff
je 0x43e6c9
push str.0123456789
push ebx
call fcn.0047ea10
add esp, 8
cmp byte [esp + eax], 0x20
jne 0x43e654
lea esi, [esp + eax]
lea eax, [esi + 1]
push str.0123456789
push eax
call fcn.0047ea10
add esp, 8
cmp byte [esi + eax + 1], 0x20
jne 0x43e654
lea esi, [esi + eax + 1]
lea eax, [esi + 1]
push str.0123456789
push eax
call fcn.0047ea10
add esp, 8
mov al, byte [esi + eax + 1]
mov esi, 8
test al, al
je 0x43e6ce
cmp al, 0xa
je 0x43e6ce
cmp al, 0x20
je 0x43e6ce
push 0x4ab2fc
push ebx
call fcn.0047e580
add esp, 8
mov esi, eax
push eax
push ebx
call fcn.0043d130
add esp, 8
test eax, eax
je 0x43e49c
lea eax, [esp + esi + 1]
lea ebx, [esp + esi]
push str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_
push eax
call fcn.0047ea10
add esp, 8
mov al, byte [eax + ebx + 1]
mov esi, 0xa
test al, al
je 0x43e6ce
cmp al, 0xa
je 0x43e6ce
cmp al, 0x20
jne 0x43e49c
jmp 0x43e6ce
mov esi, 2
jmp 0x43e6ce
mov esi, 9
jmp 0x43e6ce
mov esi, 3
jmp 0x43e6ce
mov esi, 6
jmp 0x43e6ce
mov esi, 5
jmp 0x43e6ce
mov esi, 7
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.0046f0c8
mov eax, esi
add esp, 0x404
pop esi
pop edi
pop ebx
ret