joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d863
Capabilities:
Set registry value

Disassembly:
cmp dword [esp + 8], 0
push edi
mov edi, ecx
jne 0x40d872
push 0xd
pop eax
jmp 0x40d898
push dword [esp + 0xc]
call fcn.00433d15
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [esp + 0x10]
push 1
push 0
push dword [esp + 0x18]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
ret 0xc

Function at 0x417c35
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
mov dword [ebp - 0x18], edx
push edi
mov dword [ebp - 8], esi
call fcn.0043be08
xor edi, edi
xorps xmm1, xmm1
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x18]
mov dword [eax], esi
movzx eax, byte [esi]
test byte [eax + 0x464ac1], 8
je 0x417c8f
inc esi
movzx eax, byte [esi]
test byte [eax + 0x464ac1], 8
jne 0x417c7f
mov dword [ebp - 8], esi
lea ecx, [ebp - 8]
call fcn.00417c1a
mov edx, dword [ebp - 8]
mov dword [ebp - 0x24], eax
cmp byte [edx], 0x30
jne 0x417db7
mov cl, byte [edx + 1]
cmp cl, 0x78
je 0x417cb7
cmp cl, 0x58
jne 0x417db7
mov al, byte [ebp - 1]
add edx, 2
mov esi, edi
mov cl, byte [edx]
cmp cl, al
jne 0x417ccc
test esi, esi
jne 0x417d1c
inc esi
jmp 0x417d19
movzx eax, cl
test byte [eax + 0x464ac1], 0x10
je 0x417d1c
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x417ce9
cmp cl, 0x30
jne 0x417ce9
inc dword [ebp - 0x14]
jmp 0x417d11
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 0x1e
jg 0x417d10
movsx ecx, cl
call fcn.00417c06
mulsd xmm1, qword [0x469d30]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
jmp 0x417d11
inc edi
mov al, byte [ebp - 1]
test esi, esi
je 0x417d19
dec edi
inc edx
jmp 0x417cbf
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edi
push 0
pop edi
add eax, ecx
je 0x417db7
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov esi, eax
mov al, byte [edx]
shl esi, 2
cmp al, 0x70
je 0x417d47
cmp al, 0x50
jne 0x417d90
inc edx
lea ecx, [ebp - 8]
mov dword [ebp - 8], edx
call fcn.00417c1a
mov edx, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov al, byte [edx]
movzx ecx, al
test byte [ecx + 0x464ac1], 2
je 0x417db7
imul ecx, edi, 0xa
movsx edi, al
add edi, 0xffffffd0
add edi, ecx
inc edx
movzx eax, byte [edx]
test byte [eax + 0x464ac1], 2
mov al, byte [edx]
jne 0x417d67
cmp dword [ebp - 0x1c], 0
je 0x417d89
neg edi
mov eax, dword [ebp - 0x18]
add esi, edi
mov dword [eax], edx
cmp dword [ebp - 0x24], 0
je 0x417d9d
xorps xmm1, xmmword [0x469da0]
push esi
push ecx
push ecx
movsd qword [esp], xmm1
call fcn.0043be32
fstp qword [ebp - 0x28]
movsd xmm0, qword [ebp - 0x28]
add esp, 0xc
jmp 0x417dba
xorps xmm0, xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4202aa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00454a20
mov eax, dword [0x477014]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1010], 0
lea eax, [ebp - 0x1008]
push esi
push edi
mov edi, 0x1000
mov dword [ebp - 0x100c], ecx
mov esi, edx
mov dword [ebp - 0x1018], eax
mov dword [ebp - 0x1014], edi
mov edx, edi
lea ecx, [ebp - 0x1018]
call fcn.0041045f
push esi
push edi
push 1
push eax
call fcn.00438554
add dword [ebp - 0x1010], eax
add esp, 0x10
cmp eax, edi
je 0x4202e9
lea ecx, [ebp - 0x1018]
call fcn.00410501
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042fb8d
mov esp, ebp
pop ebp
ret

Function at 0x420328
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00454a20
mov eax, dword [0x477014]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x1014], 0
lea eax, [ebp - 0x100c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
mov dword [ebp - 0x1010], ecx
mov edx, esi
mov dword [ebp - 0x101c], eax
lea ecx, [ebp - 0x101c]
mov dword [ebp - 0x1018], 0x1000
call fcn.0041045f
push edi
push esi
push 1
push eax
call fcn.00438554
add esp, 0x10
lea ecx, [ebp - 0x101c]
mov esi, eax
add dword [ebp - 0x1014], esi
call fcn.00410501
mov ecx, dword [ebp - 8]
xor eax, eax
cmp eax, esi
pop edi
sbb eax, eax
xor ecx, ebp
neg eax
pop esi
call fcn.0042fb8d
mov esp, ebp
pop ebp
ret

Function at 0x420683
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ecx + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ecx + 0xc]
sub esi, dword [eax]
sub esi, 0x10
mov dword [esp + 0xc], edx
push edi
sar esi, 4
mov dword [esp + 0xc], ecx
push 1
pop edi
sub esi, ebx
jne 0x4206bd
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov edx, ebx
dec esi
call fcn.0040e9c3
mov ecx, dword [esp + 0xc]
mov edx, ebx
cmp eax, 3
jne 0x420730
call fcn.0040e757
mov ecx, dword [esp + 0xc]
mov edx, ebx
push 0
cmp dword [eax + 8], 0x13
jne 0x4206f2
call fcn.0040eaf9
pop ecx
push edx
push eax
push str._lld
jmp 0x420702
call fcn.0040eaba
push ecx
movsd qword [esp], xmm0
push str._.14g
push dword [esp + 0x1c]
call fcn.0040f9d5
add esp, 0x10
test edi, edi
je 0x420716
test eax, eax
jg 0x420758
xor edi, edi
inc ebx
test esi, esi
jne 0x4206b9
test edi, edi
jne 0x4206af
mov ecx, dword [esp + 0xc]
xor edx, edx
push edi
call fcn.0040ff94
pop ecx
jmp 0x4206b2
lea eax, [esp + 0x14]
push eax
call fcn.00410281
pop ecx
test edi, edi
je 0x420716
push dword [esp + 0x10]
push dword [esp + 0x18]
push 1
push eax
call fcn.0043cb2f
add esp, 0x10
cmp eax, dword [esp + 0x14]
jne 0x420716
xor edi, edi
inc edi
jmp 0x420718
Function at 0x428b70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [edx*4 + 0x478f00], eax
inc edx
cmp edx, 0x100
jb 0x428b73
mov eax, 0x478f04
mov esi, 0x1c0
mov edx, dword [eax - 4]
lea eax, [eax + 0x10]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x478f00]
mov dword [eax + 0x3ec], edx
mov edx, dword [eax - 0x10]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x478f00]
mov dword [eax + 0x3f0], edx
mov edx, dword [eax - 0xc]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x478f00]
mov dword [eax + 0x3f4], edx
mov edx, dword [eax - 8]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x478f00]
mov dword [eax + 0x3f8], edx
sub esi, 1
jne 0x428c17
mov dword [0x478ef8], 0x45be30
call fcn.0042bdf0
mov ecx, dword [0x478ef8]
test eax, eax
mov edx, 0x45bd50
cmove ecx, edx
mov dword [0x478ef8], ecx
pop esi
ret

Function at 0x42ba40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
je 0x42ba9f
mov dword [edi], 0
mov edx, 0x400000
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
cmp esi, 0x400000
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x42baa8
test ecx, ecx
je 0x42ba9f
mov ecx, dword [ebp - 4]
mov edx, 0x400000
test esi, esi
jne 0x42ba60
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42bac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
je 0x42bb1f
mov dword [edi], 0
mov edx, 0x400000
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
cmp esi, 0x400000
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x42bb28
test ecx, ecx
je 0x42bb1f
mov ecx, dword [ebp - 4]
mov edx, 0x400000
test esi, esi
jne 0x42bae0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f4b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
xor edi, edi
mov dword [ebp - 8], ebx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x42f4d6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add edx, 0xfffffffc
add edx, ebx
mov dword [ebp - 4], edx
nop
lea eax, [edi + ebx]
cmp eax, edx
jae 0x42f4f6
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x42f4f6
inc eax
cmp eax, edx
jb 0x42f4e7
mov ecx, eax
sub ecx, edi
mov edi, eax
sub ecx, ebx
sub edi, ebx
cmp eax, edx
jae 0x42f5e0
cmp ecx, 2
jbe 0x42f59a
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x42f5cc
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
lea ecx, [edi + 5]
sub ebx, ecx
test esi, esi
je 0x42f56d
and esi, 6
mov edx, ebx
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x42f568
mov edx, 0x100
shl edx, cl
lea ecx, [edi + 5]
dec edx
xor ebx, edx
sub ebx, ecx
mov edx, dword [ebp - 4]
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov eax, 5
mov ebx, dword [ebp - 8]
add edi, eax
jmp 0x42f4e0
shr esi, cl
test esi, esi
je 0x42f513
cmp esi, 4
ja 0x42f5c1
cmp esi, 3
je 0x42f5c1
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x42f513
or esi, 8
shr esi, 1
inc edi
jmp 0x42f4e0
mov ebx, dword [ebp - 8]
or esi, 8
mov eax, 1
shr esi, 1
add edi, eax
jmp 0x42f4e0
cmp ecx, 2
jbe 0x42f5f5
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
shr esi, cl
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42f660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, ecx
and edx, 0xfffffffe
push esi
push edi
mov eax, ebx
lea edi, [ebx - 4]
add edi, edx
nop
cmp eax, edi
ja 0x42f6d6
movzx esi, byte [eax + 1]
movzx ecx, byte [eax + 3]
xor esi, 8
and ecx, esi
add eax, 2
cmp ecx, 0xf8
jb 0x42f670
movzx edx, byte [eax - 2]
movzx ecx, byte [eax + 1]
and ecx, 7
shl esi, 8
add edx, esi
lea edx, [ecx + edx*8]
movzx ecx, byte [eax]
add eax, 2
shl edx, 8
add edx, ecx
mov ecx, eax
sub ecx, ebx
shr ecx, 1
sub edx, ecx
mov ecx, edx
mov byte [eax - 2], dl
shr ecx, 0xb
mov byte [eax - 4], cl
mov ecx, edx
shr ecx, 0x13
and cl, 7
shr edx, 8
or cl, 0xf0
or dl, 0xf8
mov byte [eax - 3], cl
mov byte [eax - 1], dl
jmp 0x42f670
pop edi
pop esi
sub eax, ebx
pop ebx
ret

Function at 0x445fb0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00445e2f

Function at 0x44d696
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044d356
Function at 0x401000
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3c
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.004051f0
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
lea eax, [ebp - 0x40]
mov dword [ebp - 0x34], str.runas
mov dword [ebp - 0x30], str.HELIXMAIN.EXE
mov dword [ebp - 0x2c], str.husky
push eax
mov dword [ebp - 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x40107a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
jne 0x401066
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push str.Error
push str.Unable_to_execute_the_game.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040108a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40458a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00402577
mov dword [ebp - 0x14], eax
cmp dword [0x411e00], esi
jne 0x40467d
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40460a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40475d
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40475d
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40475d
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x411e00], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x411e04], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x411e08], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x411e10], eax
test eax, eax
je 0x40467a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x411e0c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4046a2
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x404695
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4046b7
push 4
pop eax
jmp 0x40475f
cmp dword [ebp - 0x14], esi
je 0x4046b7
push dword [0x411e00]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40469c
mov eax, dword [0x411e0c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x404715
cmp dword [0x411e10], edi
je 0x404715
push eax
call ebx
push dword [0x411e10]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x404715
test eax, eax
je 0x404715
call ecx
test eax, eax
je 0x40470a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40470a
test byte [ebp - 8], 1
jne 0x404715
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x404745
mov eax, dword [0x411e04]
cmp eax, edi
je 0x404742
push eax
call ebx
test eax, eax
je 0x404742
call eax
mov esi, eax
test esi, esi
je 0x404742
mov eax, dword [0x411e08]
cmp eax, edi
je 0x404742
push eax
call ebx
test eax, eax
je 0x404742
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x411e00]
call ebx
test eax, eax
je 0x40475d
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40475f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040108a
mov esp, ebp
pop ebp
ret
Function at 0x911210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 0x18
mov eax, edx
push ebx
mov ebx, dword [ebp + 0xc]
shr eax, 4
push esi
mov ecx, ebx
test eax, eax
je 0x911282
add ebx, 8
mov dword [ebp - 4], eax
nop
mov eax, dword [ecx]
xor dword [edi], eax
mov edx, dword [ebx - 4]
xor dword [edi + 4], edx
mov edx, dword [ebx]
xor dword [edi + 8], edx
mov edx, dword [ebx + 4]
xor dword [edi + 0xc], edx
add ecx, 0x10
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
add ebx, 0x10
call fcn.00911180
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 8]
add esp, 4
dec dword [ebp - 4]
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
jne 0x911230
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
lea eax, [ebx + edx]
cmp eax, ecx
jbe 0x9112f5
sub ebx, ecx
add ebx, edx
test ebx, ebx
jle 0x91129f
push ebx
push ecx
lea ecx, [ebp - 0x18]
push ecx
call fcn.0092be20
add esp, 0xc
mov eax, 0x10
sub eax, ebx
lea ecx, [ebp + ebx - 0x18]
je 0x9112b8
push eax
push 0
push ecx
call fcn.0092be50
add esp, 0xc
mov edx, dword [ebp - 0x18]
xor dword [edi], edx
mov ecx, dword [ebp - 0x14]
xor dword [edi + 4], ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor dword [edi + 8], edx
xor dword [edi + 0xc], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
call fcn.00911180
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [edi], edx
mov edx, dword [ebp - 0xc]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov dword [edi + 0xc], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x911300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0x18]
push edi
mov edi, ecx
test eax, eax
je 0x911402
push esi
mov esi, dword [edx]
mov dword [ebp - 0x14], esi
mov esi, dword [edx + 4]
mov dword [ebp - 0x10], esi
mov esi, dword [edx + 8]
mov edx, dword [edx + 0xc]
shr eax, 4
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edx
test eax, eax
je 0x9113c9
mov edx, ebx
sub ecx, edx
lea esi, [edx + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp + 0x18], eax
jmp 0x911350
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
call fcn.00913610
mov eax, dword [edi]
xor dword [ebx], eax
mov ecx, dword [edi + 4]
xor dword [esi - 8], ecx
mov edx, dword [edi + 8]
xor dword [esi - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + esi]
xor dword [esi], ecx
movzx eax, byte [ebp - 8]
movzx edx, byte [ebp - 7]
movzx ecx, byte [ebp - 6]
shl eax, 8
or eax, edx
movzx edx, byte [ebp - 5]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
inc eax
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 8], cl
mov edx, eax
mov ecx, eax
shr edx, 0x10
shr ecx, 8
add esp, 0x10
add edi, 0x10
add ebx, 0x10
add esi, 0x10
dec dword [ebp + 0x18]
mov byte [ebp - 7], dl
mov byte [ebp - 6], cl
mov byte [ebp - 5], al
jne 0x911350
mov ecx, dword [ebp + 0x10]
sub ecx, edi
add ecx, dword [ebp + 0x14]
mov esi, ecx
je 0x911401
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x24]
push edx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
call fcn.00913610
add esp, 0x10
xor eax, eax
test esi, esi
je 0x911401
sub ebx, edi
mov cl, byte [ebp + eax - 0x24]
xor cl, byte [edi]
inc eax
mov byte [ebx + edi], cl
inc edi
cmp eax, esi
jb 0x9113f2
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x9136b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
xor al, al
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x14], al
mov byte [ebp - 4], al
mov byte [ebp - 0xc], al
push 2
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 0x18], 0x38
mov dword [ebp - 8], 0x3031
mov dword [ebp - 0x28], 0x32313032
mov word [ebp - 0x24], 0
mov dword [ebp - 0x30], 0x36313032
mov word [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0x37
mov dword [ebp - 0x20], 0x38303032
mov word [ebp - 0x1c], 0
call fcn.0092c510
add esp, 0xc
test eax, eax
je 0x91371e
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x64], 1
push 1
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.0092c510
add esp, 0xc
test eax, eax
jne 0x91379f
push 4
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0092c510
add esp, 0xc
test eax, eax
jne 0x91379f
push 1
lea ecx, [ebp - 0x18]
push ecx
push esi
call fcn.0092c510
add esp, 0xc
test eax, eax
jne 0x913795
push 2
lea edx, [ebp - 8]
push edx
push esi
call fcn.0092c510
add esp, 0xc
test eax, eax
jne 0x913795
push 4
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.0092c510
add esp, 0xc
test eax, eax
jne 0x913795
push 4
lea ecx, [ebp - 0x30]
push ecx
push esi
call fcn.0092c510
add esp, 0xc
test eax, eax
jne 0x913795
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 8
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 7
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x9147b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x27e]
push ecx
mov word [ebp - 0x280], ax
call fcn.0092be50
push 0x40
lea ecx, [ebp - 0x7c]
push 0
push ecx
mov dword [ebp - 0x2c], 0x65005c
mov dword [ebp - 0x28], 0x700078
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x650072
mov dword [ebp - 0x1c], 0x2e0072
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.0092be50
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x10]
push ecx
xor edx, edx
push esi
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x10], 0x690077
mov dword [ebp - 0xc], 0x64006e
mov dword [ebp - 8], 0x720069
mov word [ebp - 4], dx
call fcn.0091af00
push 0
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x280]
push eax
call fcn.0092c230
mov ecx, dword [esi + 0xba0]
push 0xad0121ab
push 0
push 0
push ecx
add esi, 0x1c
push esi
call fcn.00924e40
add esp, 0x44
pop esi
test eax, eax
je 0x9148b5
push 0
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x80]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x280]
push edx
push 0
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x915f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
push ebx
xor ebx, ebx
push esi
push 0x1fe
lea eax, [ebp - 0x29e]
xor edx, edx
push ebx
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x5c], 0x18
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x2a0], dx
call fcn.0092be50
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0x401
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.00929d00
add esp, 0x20
test eax, eax
js 0x9160c7
mov eax, dword [esi + 0xba0]
push edi
push 0xcc145ef7
push ebx
push ebx
push eax
lea edi, [esi + 0x1c]
push edi
mov dword [ebp - 0x2c], 0x65005c
mov dword [ebp - 0x28], 0x700078
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x650072
mov dword [ebp - 0x1c], 0x2e0072
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.00924e40
add esp, 0x14
cmp eax, ebx
je 0x916026
mov ecx, dword [ebp + 0xc]
push ebx
push ecx
call eax
push 0x40
lea edx, [ebp - 0x9c]
push ebx
push edx
call fcn.0092be50
lea ecx, [ebp - 0x2a0]
push ecx
xor eax, eax
lea edx, [ebp - 0x10]
push edx
push esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xa0], 0x44
mov dword [ebp - 0x10], 0x690077
mov dword [ebp - 0xc], 0x64006e
mov dword [ebp - 8], 0x720069
mov word [ebp - 4], ax
call fcn.0091af00
push ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x2a0]
push ecx
call fcn.0092c230
mov edx, dword [esi + 0xba0]
push 0xad0121ab
push ebx
push ebx
push edx
push edi
call fcn.00924e40
add esp, 0x38
pop edi
cmp eax, ebx
je 0x9160c7
push ebx
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0xa0]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x2a0]
push ecx
push ebx
call eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret