joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fa60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x18
push ebx
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x28]
push esi
push edi
call fcn.00423ad7
add esp, 8
test eax, eax
jne 0x40fbb8
push ebp
push edi
call fcn.0040fc10
add esp, 4
mov ebp, eax
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40fbae
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40fbae
lea edi, [esi + 0x24]
lea eax, [esp + 0x20]
test ebp, ebp
push edi
push eax
jne 0x40fb4e
call fcn.0040f8e0
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
jne 0x40fb03
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40fb03
mov ecx, dword [edi]
mov dword [esi + 0x20], ecx
jmp 0x40fb14
lea edx, [esi + 0x20]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.0040f8e0
add esp, 8
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x40fb33
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x40fb33
mov ecx, dword [edi]
pop ebp
mov dword [esi + 0x28], ecx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
add esi, 0x28
lea edx, [esp + 0x18]
push esi
push edx
call fcn.0040f8e0
add esp, 8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
call fcn.0040f960
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
jne 0x40fb6d
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40fb6d
mov ecx, dword [edi]
mov dword [esi + 0x20], ecx
jmp 0x40fb7e
lea edx, [esi + 0x20]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.0040f960
add esp, 8
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x40fb9d
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x40fb9d
mov ecx, dword [edi]
pop ebp
mov dword [esi + 0x28], ecx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
add esi, 0x28
lea edx, [esp + 0x18]
push esi
push edx
call fcn.0040f960
add esp, 8
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40fc04
test bl, 0x10
je 0x40fc04
mov ecx, 0xc
xor eax, eax
mov edi, esi
push 0x210000
rep stosd dword es:[edi], eax
call fcn.00407de0
not bl
and ebx, 1
add esp, 4
or bl, 0x82
mov dword [esi + 0x24], eax
shl ebx, 7
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], eax
mov word [esi + 6], bx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x18
ret
Function at 0x40fc10
Capabilities:
Get disk information

Disassembly:
sub esp, 0x428
push esi
mov esi, dword [esp + 0x430]
push 0x103
mov ax, word [esi]
push eax
call fcn.004251bf
add esp, 8
test eax, eax
je 0x40fc3e
cmp word [esi + 2], 0x3a
jne 0x40fc3e
mov eax, esi
jmp 0x40fc5e
lea ecx, [esp + 4]
lea edx, [esp + 0x224]
push ecx
push edx
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea eax, [esp + 0x224]
push 3
mov dword [esp + 8], eax
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00425211
add esp, 0xc
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
push 0x104
push ecx
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
lea edx, [esp + 0x238]
push 0x104
lea eax, [esp + 0x20]
push edx
push eax
mov word [esp + 0x2e], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push 3
lea ecx, [esp + 0x20]
push 0x437bc4
push ecx
call fcn.004254b5
add esp, 4
push eax
call fcn.0042547d
add esp, 0xc
test eax, eax
pop esi
je 0x40fd05
push 4
lea edx, [esp + 0x1c]
push str.VFAT
push edx
call fcn.0042547d
add esp, 0xc
test eax, eax
je 0x40fd05
push 4
lea eax, [esp + 0x1c]
push 0x437bac
push eax
call fcn.0042547d
add esp, 0xc
test eax, eax
je 0x40fd05
xor eax, eax
add esp, 0x428
ret
mov eax, 1
add esp, 0x428
ret

Function at 0x40fd20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push esi
push edi
push 0
push 0
push 3
push 0
push 1
or edi, 0xffffffff
push 0xc0000000
push str.CONIN_
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, edi
je 0x40fdda
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x40fd69
push 1
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0xc]
push 0
push ecx
lea edx, [esp + 0x18]
push 1
push edx
push esi
call ebx
test eax, eax
je 0x40fdc1
cmp dword [esp + 0xc], 1
jne 0x40fdc1
mov edi, dword [esp + 0x10]
and edi, 0xff
cmp edi, 0xa
jne 0x40fdc1
lea eax, [esp + 0xc]
push 0
push eax
lea ecx, [esp + 0x18]
push 1
push ecx
push esi
call ebx
test eax, eax
je 0x40fdc1
cmp dword [esp + 0xc], 1
jne 0x40fdc1
mov edi, dword [esp + 0x10]
and edi, 0xff
mov eax, dword [esp + 0x14]
pop ebx
cmp eax, 0xffffffff
je 0x40fdd3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret

Function at 0x410340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [0x436cb0]
cmp eax, 0xffffffff
je 0x410354
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
ret
push 0x436658
mov dword [0x436cb0], 1
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x41038d
push 0x4379f8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41038d
cmp eax, 0x10
jne 0x41038d
mov dword [0x436cb0], 0
mov ecx, dword [0x436cb0]
xor eax, eax
test ecx, ecx
sete al
ret
Function at 0x422770
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x4474cc]
push ebx
push ebp
push esi
test eax, eax
push edi
jne 0x4227ae
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov ecx, dword [0x462c34]
push eax
push ebx
push ecx
call fcn.00428fb0
mov ebp, eax
add esp, 0xc
cmp ebp, 0xffffffff
je 0x422920
test ebp, ebp
jne 0x4228d2
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 1
jne 0x422840
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov edx, dword [0x462c34]
shr eax, 1
push eax
lea esi, [ebx + eax]
push esi
push edx
call fcn.00428fb0
mov ebp, eax
add esp, 0xc
cmp ebp, 0xffffffff
mov edi, ebp
je 0x422920
test ebp, ebp
je 0x422920
mov eax, dword [0x462c44]
cmp eax, 0xffffffff
jne 0x422808
push ebp
push esi
call fcn.0040ebd0
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [0x462c44], eax
cmp eax, 1
je 0x422829
mov al, byte [esi]
mov byte [ebx], al
inc ebx
inc esi
cmp al, 0xa
jne 0x42281f
mov byte [ebx - 1], 0xd
mov byte [ebx], al
inc ebx
inc ebp
dec edi
jne 0x42280d
sub ebx, ebp
jmp 0x4228d2
mov ecx, ebp
mov edi, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4228d2
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov edx, dword [0x462c34]
dec ecx
push ecx
push ebx
push edx
mov esi, ebx
call fcn.00428fb0
mov ebp, eax
add esp, 0xc
cmp ebp, 0xffffffff
mov edi, ebp
je 0x422920
test ebp, ebp
je 0x422920
mov eax, dword [0x462c44]
cmp eax, 0xffffffff
jne 0x42288f
push ebp
push ebx
call fcn.0040ebd0
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [0x462c44], eax
cmp eax, 1
je 0x4228d2
mov byte [ebx + ebp], 0xa
mov al, byte [esi]
mov byte [ebx], al
inc ebx
inc esi
cmp al, 0xd
jne 0x4228a9
cmp byte [esi], 0xa
jne 0x4228a9
dec ebx
dec ebp
dec edi
jne 0x422898
test ebp, ebp
jne 0x4228c8
mov eax, dword [0x462c34]
push 1
push ebx
push eax
call fcn.00428fb0
add esp, 0xc
mov ebp, 1
jmp 0x4228d2
sub ebx, ebp
cmp byte [ebx + ebp - 1], 0x1a
jne 0x4228d2
dec ebp
mov ecx, dword [0x462818]
push ebp
push ebx
push ecx
call fcn.004053d0
mov ecx, dword [0x462c28]
mov dword [0x462818], eax
mov eax, dword [0x462c2c]
add esp, 0xc
mov esi, ecx
add ecx, ebp
mov edx, eax
mov dword [0x462c28], ecx
adc eax, 0
cmp eax, edx
mov dword [0x462c2c], eax
jg 0x422920
jl 0x422911
cmp ecx, esi
jae 0x422920
push str.overflow_in_byte_count
push 6
call fcn.00412590
add esp, 8
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x42ddb5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42ddd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00429d10
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x42ddf6
test byte [esp + 8], 2
je 0x42ddf6
mov dword [0x462c68], 0xd
mov dword [0x462c6c], 5
jmp 0x42ddd1
xor eax, eax
ret
Function at 0x431dc1
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x431dec
test byte [esp + 8], 0x80
je 0x431ddb
and al, 0xfe
jmp 0x431ddd
or al, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x431dfd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00429d10
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x402300
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x402315
xor eax, eax
jmp 0x40238a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x402342
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x402385
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x402383
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x40237f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x402383
xor eax, eax
jmp 0x40238a
jmp 0x402339
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x402de0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401660
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x67e470], 0
jne 0x402e1d
cmp dword [0x67e46c], 0
je 0x402e1d
mov eax, dword [0x67e46c]
mov dword [0x67e470], eax
cmp dword [0x67e470], 0
je 0x402e9a
mov ecx, dword [0x67e470]
cmp dword [ecx + 8], 0
je 0x402e9a
mov edx, dword [0x67e470]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x402e9a
mov ecx, dword [0x67e470]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x402e9a
mov eax, dword [0x67e470]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x402e69
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x402e70
xor eax, eax
jmp 0x402fbd
mov ecx, dword [0x67e470]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.005c7c50
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x402fbd
mov edx, dword [0x67e46c]
mov dword [0x67e470], edx
jmp 0x402eb6
mov eax, dword [0x67e470]
mov ecx, dword [eax + 4]
mov dword [0x67e470], ecx
cmp dword [0x67e470], 0
je 0x402ef6
cmp dword [0x67e470], 0
je 0x402ef4
mov edx, dword [0x67e470]
cmp dword [edx + 8], 0
je 0x402ef4
mov eax, dword [0x67e470]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x402ef4
mov edx, dword [0x67e470]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x402ef4
jmp 0x402e4e
jmp 0x402ea8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401740
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402fbb
mov eax, dword [ebp - 4]
mov dword [0x67e470], eax
mov ecx, dword [0x67e470]
mov dword [ecx], 0x52727464
mov edx, dword [0x67e470]
mov dword [edx + 8], 0
mov eax, dword [0x67e470]
mov ecx, dword [0x67e46c]
mov dword [eax + 4], ecx
mov edx, dword [0x67e470]
mov dword [0x67e46c], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x67e470]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x38c
jmp 0x402f87
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 1
jle 0x402fab
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
jmp 0x402f7e
mov eax, dword [0x67e470]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x402e4e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x403270
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40329b
push 0x57
push ebp
call 0x99e773
xor eax, eax
jmp 0x403354
push 0x1c
push 0
lea ecx, [ebp - 0x64]
push ecx
call fcn.005c7c50
add esp, 0xc
push 0x1c
lea edx, [ebp - 0x64]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push eax
call 0x8cfa04
test eax, eax
jne 0x4032ca
xor eax, eax
jmp 0x403354
push 0
push 0x40
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push edi
call 0x93b31c
test eax, eax
jne 0x4032e8
xor eax, eax
jmp 0x403354
movzx edx, word [ebp - 0x48]
cmp edx, 0x5a4d
jne 0x403302
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x58]
ja 0x403302
cmp dword [ebp - 0xc], 0x40
jae 0x403311
push 0xc1
push ecx
call 0x98e351
xor eax, eax
jmp 0x403354
push 0
push 0xf8
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push eax
call 0x831af7
test eax, eax
jne 0x403335
xor eax, eax
jmp 0x403354
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0x4550
je 0x40334f
push 0xc1
push eax
call 0x99239c
xor eax, eax
jmp 0x403354
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40b160
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040aed0
Function at 0x40beb0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.005c7c50
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret

Function at 0x40c120
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.005c7c50
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret
Function at 0x449d30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x449d49
mov esi, edi
mov edi, eax
jmp 0x449d4b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x449d5b
mov eax, ebx
jmp 0x449d65
push eax
push ebx
call fcn.0040ce50
add esp, 8
test eax, eax
jne 0x449d6d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x449d89
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x449d74
cmp eax, dword [esi + 4]
jge 0x449da0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x449d90
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x449dc1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x449dbe
dec eax
test eax, eax
jg 0x449db0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4524e0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x452500
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x454a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ecx, dword [esp + 0x1c]
cmp ecx, 0
je 0x454c2d
call fcn.00454a86
Function at 0x45c7c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x6802ed], 0
jne 0x45c855
cmp byte [0x6802ec], 0
mov byte [0x6802ed], 1
jne 0x45c7fb
push 0x6802f0
mov byte [0x6802ec], 1
call fcn.0085a904
call fcn.0045c3f0
call fcn.0045c870
mov dword [0x680308], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x6e72656b
push eax
mov dword [ebp - 0xc], 0x32336c65
mov byte [ebp - 8], 0
mov dword [ebp - 0x20], 0x6f577349
mov dword [ebp - 0x1c], 0x50343677
mov dword [ebp - 0x18], 0x65636f72
mov word [ebp - 0x14], 0x7373
mov byte [ebp - 0x12], 0
call fcn.006cb03b
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret

Function at 0x47b750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], esi
mov dword [esi], 0
call fcn.0047b6d0
mov edi, eax
mov dword [ebp - 0x48], edi
test edi, edi
jne 0x47b7a1
mov dword [esi], 6
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x40]
push 0
push dword [edi + 0x20]
push dword [eax + 0x9c]
call fcn.005c4057
mov eax, dword [ebp - 0x40]
push dword [eax + 0x9c]
push 1
push dword [edi + 0x28]
push dword [0x6803b8]
call fcn.005c469b
push 0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push eax
push dword [0x6803b4]
push dword [edi + 0x28]
push dword [0x6803b8]
call fcn.005deb40
add esp, 0x30
test eax, eax
jne 0x47b8eb
mov eax, dword [ebp - 0x38]
cmp eax, dword [edi + 0x24]
jne 0x47b8eb
mov eax, dword [0x6803b4]
xorps xmm0, xmm0
push 0x2c
push 0
movdqu xmmword [ebp - 0x74], xmm0
movzx edi, word [eax]
movzx esi, word [eax + 2]
lea eax, [ebp - 0x34]
push eax
movdqu xmmword [ebp - 0x64], xmm0
call fcn.005c7c50
add esp, 0xc
mov dword [ebp - 0x74], 0x28
mov dword [ebp - 0x68], 0x180001
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], esi
movdqu xmm0, xmmword [ebp - 0x74]
push 0
push 0
push eax
movdqu xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x64], 0
lea eax, [ebp - 0x34]
movdqu xmm0, xmmword [ebp - 0x64]
push 0
push eax
movdqu xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x3c], 0
xorps xmm0, xmm0
push 0
movq qword [ebp - 0x14], xmm0
call fcn.009d468f
ret
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
mov dword [esi], 7
xor ecx, ebp
pop esi
call fcn.005c02df
mov esp, ebp
pop ebp
ret 0xc