joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d0e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x42d111
je 0x42d16b
sub eax, 7
je 0x42d132
dec eax
je 0x42d15c
sub eax, 0x17
je 0x42d210
jmp 0x42d24e
add eax, 0xffffff00
sub eax, 9
jb 0x42d1fc
add eax, 0xffffff09
sub eax, 0xb
jb 0x42d1c4
jmp 0x42d24e
mov eax, ebx
call fcn.0043f030
mov edi, eax
test edi, edi
je 0x42d2ae
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x42d2b7
jmp 0x42d2ae
test byte [ebx + 0x44], 0x20
jne 0x42d2b7
jmp 0x42d2ae
mov edx, esi
mov eax, ebx
call fcn.0042a6e0
cmp dword [esi + 0xc], 0xffffffff
jne 0x42d2b7
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00406ce0
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.00429214
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.0042cfb8
test eax, eax
je 0x42d2b7
mov dword [esi + 0xc], 1
jmp 0x42d2b7
mov edx, esi
mov eax, ebx
call fcn.0042d04c
test al, al
je 0x42d2ae
cmp dword [esi + 0xc], 0
jne 0x42d2b7
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.0042f748
push eax
call sub.user32.dll_DefWindowProcA
jmp 0x42d2b7
mov eax, ebx
call fcn.00429d7c
test al, al
jne 0x42d2b7
jmp 0x42d2ae
mov eax, ebx
call fcn.0042f748
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x42d2ae
cmp dword [0x4837bc], 0
je 0x42d2ae
mov eax, dword [0x4837bc]
cmp ebx, dword [eax + 0x24]
jne 0x42d2ae
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x4837bc]
call fcn.0042a614
jmp 0x42d2ae
mov eax, dword [0x4a2744]
cmp byte [eax + 0x20], 0
je 0x42d2ae
mov eax, dword [0x4a2744]
cmp dword [eax + 0x1c], 0
je 0x42d2ae
mov eax, dword [esi]
mov edx, dword [0x4a2744]
cmp eax, dword [edx + 0x1c]
jne 0x42d2ae
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.0043ef74
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.00403064
jmp 0x42d2b7
mov edx, esi
mov eax, ebx
call fcn.0042a6e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d778
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x42d794
cmp dword [esi + 4], 0
je 0x42d7c1
test byte [ebx + 0x45], 1
jne 0x42d7b3
mov eax, ebx
call fcn.0042c6b0
test eax, eax
jne 0x42d7b3
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x42d8d1
mov edx, esi
mov eax, ebx
call fcn.0042d3f0
jmp 0x42d8d1
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42d8ca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0042f748
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0042a614
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0042d778
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0042f748
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d8d1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x437334
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403b94
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x437383
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403dc4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ed4c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4a27dc
cmp dword [edi], 0
jne 0x43edc8
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4a27d8]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x483950
mov ecx, 2
call fcn.00402824
mov edx, 0x43ed24
lea eax, [esi + 5]
call fcn.0043ed44
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0043ed44
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x43ed9d
mov dword [0x4a27d8], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x43eee4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x43ef34]
test si, 4
je 0x43eef8
or bl, 1
test si, 8
je 0x43ef02
or bl, 4
test si, 1
je 0x43ef0c
or bl, 8
test si, 2
je 0x43ef16
or bl, 0x10
test si, 0x10
je 0x43ef20
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43ef2f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x43ef38
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x43ef70]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43ef51
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43ef60
or bl, 4
test esi, 0x20000000
je 0x43ef6b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4451a0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4451b2
add esp, 0xfffffff0
call fcn.00403188
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00413f84
mov eax, ebx
call fcn.004454ec
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x40d9fc]
call fcn.00402e58
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x40d9fc]
call fcn.00402e58
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x40d9fc]
call fcn.00402e58
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x40d9fc]
call fcn.00402e58
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x40d9fc]
call fcn.00402e58
mov dword [ebx + 0x70], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x34], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x441c90
push eax
push 0
push 0
mov eax, dword [0x4a1170]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41544c]
call fcn.00416984
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x41544c]
call fcn.00416984
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x41544c]
call fcn.00416984
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.004458cc
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4457e8
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4457e8
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4457e8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4452c1
call fcn.004031e0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4455cc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x445777
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x445758
mov dl, 1
mov eax, dword [0x40dcfc]
call fcn.00402e58
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403b94
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x445747
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00433cd0
test al, al
je 0x44573a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x445788
lea eax, [ebp - 0x254]
call fcn.00408d8c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44573a
xor eax, eax
push ebp
push 0x445733
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4457c0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44571c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403dc4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x44571c
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403dc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44573a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44563d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.00410aec
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44577e
lea eax, [ebp - 0x260]
call fcn.00403b94
ret

Function at 0x445fc4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4a27cc]
cmp byte [eax + 0x95], 0
jne 0x446035
cmp dword [0x4a27e8], 0
jne 0x445ff6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x445f80
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4a27e8], eax
cmp dword [0x4a27e4], 0
jne 0x446011
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4a27e4], eax
cmp dword [0x4a27ec], 0
jne 0x446035
push esp
push 0
push 0
push 0x445f24
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4a27ec], eax
pop edx
ret
Function at 0x44612c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x446143
add esp, 0xfffffff0
call fcn.00403188
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00413f84
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40d9fc]
call fcn.00402e58
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40d9fc]
call fcn.00402e58
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x415ddc]
call fcn.0041cf44
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x4462b8
mov eax, dword [0x4a1084]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041d314
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x447cdc
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4a1084]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040b578
test eax, eax
je 0x446236
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040872c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040b5a0
test eax, eax
je 0x44624a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403dc4
mov eax, dword [0x4a0f68]
cmp byte [eax], 0
jne 0x44627b
mov eax, ebx
call fcn.004463a4
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4462ad
call fcn.004031e0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x446614
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4a27cc]
cmp dword [eax + 0x24], 0
je 0x4466b7
cmp dword [ebx + 0x84], 0
jne 0x4466b1
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4465a4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x4466b1
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44667a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4466b1
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.0040f11c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x446689
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x4470c4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x4470f9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403c7c
jmp 0x447103
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403be8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x448050
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x448088
mov eax, esi
call fcn.0042fa44
test al, al
je 0x448088
mov eax, dword [ebx + 0x74]
call fcn.0042f748
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x448088
push 0
mov eax, dword [ebx + 0x74]
call fcn.0042f748
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x44c048
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
and edx, edx
je 0x44c065
jcxz 0x44c065
push ebx
movzx ebx, al
xor bl, byte [edx]
shr eax, 8
xor eax, dword cs:[ebx*4 + 0x44c066]
inc edx
dec ecx
jne 0x44c050
pop ebx
ret

Function at 0x45d470
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov ebx, edx
xor edi, edi
mov ax, word [ebx + edi*2]
xchg al, ah
mov word [ebx + edi*2], ax
inc edi
cmp edi, 4
jne 0x45d47b
mov edi, 8
movzx edx, word [esi]
movzx eax, word [ebx]
call fcn.0045d448
mov word [ebx], ax
add esi, 2
mov ax, word [esi]
add word [ebx + 2], ax
add esi, 2
mov ax, word [esi]
add word [ebx + 4], ax
add esi, 2
movzx edx, word [esi]
movzx eax, word [ebx + 6]
call fcn.0045d448
mov word [ebx + 6], ax
add esi, 2
movzx edx, word [esi]
mov ax, word [ebx + 4]
xor ax, word [ebx]
movzx eax, ax
call fcn.0045d448
mov word [esp], ax
add esi, 2
mov bp, word [ebx + 2]
xor bp, word [ebx + 6]
add bp, word [esp]
movzx edx, word [esi]
movzx eax, bp
call fcn.0045d448
mov ebp, eax
add esi, 2
add word [esp], bp
xor word [ebx], bp
mov ax, word [esp]
xor word [ebx + 6], ax
mov ax, word [ebx + 2]
xor word [esp], ax
xor bp, word [ebx + 4]
mov word [ebx + 2], bp
mov ax, word [esp]
mov word [ebx + 4], ax
dec edi
jne 0x45d490
movzx edx, word [esi]
movzx eax, word [ebx]
call fcn.0045d448
xchg al, ah
mov word [ebx], ax
add esi, 2
mov ax, word [esi]
add word [ebx + 4], ax
add esi, 2
mov ax, word [esi]
add word [ebx + 2], ax
add esi, 2
mov ax, word [ebx + 4]
xchg al, ah
mov ebp, eax
mov ax, word [ebx + 2]
xchg al, ah
mov word [ebx + 4], ax
movzx edx, word [esi]
movzx eax, word [ebx + 6]
call fcn.0045d448
xchg al, ah
mov word [ebx + 6], ax
mov word [ebx + 2], bp
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x460634
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, dword [ebp + 8]
add ebx, 0xffffffdc
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, 0x4a0c14
mov dword [ebp - 0xc], eax
push ebp
call fcn.004605bc
pop ecx
jmp 0x46076a
mov eax, ebx
mov edx, dword [ebx + edx*4 - 0x1c]
shr edx, 8
and edx, 0xff
mov dl, byte [edx + 0x491168]
xor dl, byte [eax]
mov ecx, dword [ebp - 0xc]
xor dl, byte [ecx]
mov byte [eax], dl
inc eax
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [ebx + edx*4 - 0x1c]
shr edx, 0x10
and edx, 0xff
mov dl, byte [edx + 0x491168]
xor byte [eax], dl
inc eax
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [ebx + edx*4 - 0x1c]
shr edx, 0x18
mov dl, byte [edx + 0x491168]
xor byte [eax], dl
inc eax
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [ebx + edx*4 - 0x1c]
and edx, 0xff
mov dl, byte [edx + 0x491168]
xor byte [eax], dl
inc dword [ebp - 0xc]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
cmp eax, 0xe
jne 0x46074d
mov edx, 7
mov eax, ebx
mov ecx, dword [eax]
xor dword [eax + 4], ecx
add eax, 4
dec edx
jne 0x4606e0
lea eax, [ebx + 0x10]
mov edx, dword [ebx + 0xc]
and edx, 0xff
mov dl, byte [edx + 0x491168]
xor byte [eax], dl
inc eax
mov edx, dword [ebx + 0xc]
shr edx, 8
and edx, 0xff
mov dl, byte [edx + 0x491168]
xor byte [eax], dl
inc eax
mov edx, dword [ebx + 0xc]
shr edx, 0x10
and edx, 0xff
mov dl, byte [edx + 0x491168]
xor byte [eax], dl
inc eax
mov edx, dword [ebx + 0xc]
shr edx, 0x18
mov dl, byte [edx + 0x491168]
xor byte [eax], dl
mov edx, 3
lea eax, [ebx + 0x10]
mov ecx, dword [eax]
xor dword [eax + 4], ecx
add eax, 4
dec edx
jne 0x460740
jmp 0x460763
mov edx, eax
sub edx, 7
test edx, edx
jle 0x460763
mov eax, ebx
mov ecx, dword [eax]
xor dword [eax + 4], ecx
add eax, 4
dec edx
jne 0x460758
push ebp
call fcn.004605bc
pop ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
cmp edx, dword [ebp - 4]
jge 0x460666
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x28]
mov ebx, eax
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x18]
shr edx, 1
add ebx, edx
mov ecx, dword [ebp + 8]
mov ecx, edx
mov edx, dword [ebp + 8]
mov edx, ebx
call fcn.00402824
add ebx, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov esi, dword [eax + 0x30]
shl esi, 2
sub esi, 5
test esi, esi
jl 0x46082f
inc esi
mov edi, dword [ebx]
mov eax, edi
shr eax, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x493368]
mov edx, 8
call fcn.0044bd70
and edi, 0xff
xor eax, dword [edi*4 + 0x493368]
push eax
mov eax, dword [ebx]
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x493368]
mov edx, 0x10
call fcn.0044bd70
pop edx
xor edx, eax
push edx
mov eax, dword [ebx]
shr eax, 0x18
mov eax, dword [eax*4 + 0x493368]
mov edx, 0x18
call fcn.0044bd70
pop edx
xor edx, eax
mov dword [ebx], edx
add ebx, 4
dec esi
jne 0x4607c4
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x460ce0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x28]
mov esi, eax
mov edx, dword [ebp + 8]
mov edi, eax
add edi, 0x100
mov ecx, 1
xor ebx, ebx
mov eax, ecx
and al, 0xff
mov byte [esi], al
mov eax, ecx
and eax, 0xff
mov byte [edi + eax], bl
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*8]
mov ecx, 0x101
cdq
idiv ecx
mov ecx, edx
inc esi
inc ebx
cmp ebx, 0x100
jne 0x460d03
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x462f08
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x462f1e
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x462f17
mov edx, esp
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xff
mov ebx, dword [ebp - 4]
shr ebx, 8
and ebx, 0xff
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xff
mov esi, dword [ebp - 4]
shr esi, 0x18
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x20
jne 0x462fa9
movzx ecx, byte [ecx + 0x494968]
mov esi, dword [edx + 0xc]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x494868]
mov esi, dword [edx + 0xc]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x494868]
mov esi, dword [edx + 0xc]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x494968]
mov edi, dword [edx + 0xc]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x18
jl 0x463006
movzx ecx, byte [ecx + 0x494968]
mov esi, dword [edx + 8]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x494968]
mov esi, dword [edx + 8]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x494868]
mov esi, dword [edx + 8]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x494868]
mov edi, dword [edx + 8]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x494868]
mov esi, dword [edx + 4]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x494968]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x494868]
mov esi, dword [edx + 4]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x494968]
mov edi, dword [edx + 4]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x494868]
mov esi, dword [edx]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x494868]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x494968]
mov esi, dword [edx]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x494968]
mov edx, dword [edx]
shr edx, 0x18
xor esi, edx
mov dword [ebp - 8], esi
mov edx, dword [ecx*4 + 0x494a68]
xor edx, dword [ebx*4 + 0x494e68]
xor edx, dword [eax*4 + 0x495268]
mov eax, dword [ebp - 8]
xor edx, dword [eax*4 + 0x495668]
mov eax, edx
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x463208
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
and ecx, 0xff
xor ebx, ebx
mov esi, dword [edx + ebx*4]
imul edi, ecx, 0x1010101
xor esi, edi
mov dword [eax + ebx*4], esi
inc ebx
cmp ebx, 0x40
jne 0x463213
pop edi
pop esi
pop ebx
ret