joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454fb3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x49ea5b
call fcn.0045ce8c
sub esp, 0x244
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 0x48], ebx
mov ecx, dword [ebp + 8]
push 0x4bbd40
mov dword [ebp - 4], ebx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__12]
push 0x208
lea eax, [ebp - 0x250]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x48], 1
call sub.VCRUNTIME140.dll_memset
push 0x104
lea eax, [ebp - 0x250]
push eax
push ebx
call fcn.00454c42
add esp, 0x18
push 0x53
pop eax
push 0x69
mov word [ebp - 0x44], ax
pop eax
push 0x61
mov word [ebp - 0x38], ax
pop eax
push 0x68
mov word [ebp - 0x3c], ax
pop eax
push 0x6c
pop ecx
push 0x2e
mov word [ebp - 0x42], ax
pop eax
push 0x70
mov word [ebp - 0x36], ax
pop eax
push 0x64
mov word [ebp - 0x3a], ax
pop eax
mov word [ebp - 0x34], ax
push 0x77
pop eax
mov word [ebp - 0x3e], ax
xor eax, eax
mov word [ebp - 0x2e], ax
lea eax, [ebp - 0x44]
push eax
mov word [ebp - 0x40], cx
mov word [ebp - 0x32], cx
mov word [ebp - 0x30], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4550f5
push 0x65
pop ebx
lea eax, [ebp - 0x20]
mov byte [ebp - 0x15], bl
push eax
push edi
mov word [ebp - 0x14], 0x614e
mov dword [ebp - 0x20], 0x68746150
mov word [ebp - 0x17], 0x6c69
mov dword [ebp - 0x1c], 0x646e6946
mov word [ebp - 0x10], 0x57
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x18], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4550ee
lea ecx, [ebp - 0x250]
push ecx
call eax
mov ecx, dword [ebp + 8]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
mov ecx, dword [ebp + 8]
push 0x78
pop eax
push 0x2e
mov word [ebp - 0x28], ax
pop eax
mov word [ebp - 0x2c], ax
xor eax, eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x2c]
push 0x4bbd40
push eax
mov word [ebp - 0x26], bx
mov word [ebp - 0x2a], bx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x459979
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push 0x2e
pop eax
push 0x6e
mov word [ebp - 0x20], ax
xor ebx, ebx
pop eax
push 0x65
pop edx
push 0x32
mov word [ebp - 0x2a], ax
pop eax
push 0x6c
mov word [ebp - 0x22], ax
pop eax
push 0x64
pop ecx
push 0x72
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], ax
mov word [ebp - 0x26], ax
pop eax
push 0x33
mov word [ebp - 0x2c], ax
pop eax
mov word [ebp - 0x24], ax
push 0x4b
pop eax
mov word [ebp - 0x30], ax
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
mov word [ebp - 0x2e], dx
push eax
mov word [ebp - 0x28], dx
mov word [ebp - 0x1e], cx
mov word [ebp - 0xe], 0x6c75
mov byte [ebp - 0x13], dl
mov byte [ebp - 0xc], dl
mov byte [ebp - 8], dl
mov word [ebp - 0x11], 0x6f4d
mov word [ebp - 0xa], 0x6c69
mov byte [ebp - 4], dl
mov word [ebp - 3], 0x57
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xb], 0x46
mov word [ebp - 6], 0x6d61
mov byte [ebp - 7], 0x4e
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x12], 0x74
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x459a36
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret
Function at 0x459a3b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x4a1f7d
call fcn.0045ce8c
sub esp, 0x244
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 0x48], ebx
mov ecx, dword [ebp + 8]
push 0x4bbd40
mov dword [ebp - 4], ebx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__12]
push 0x208
lea eax, [ebp - 0x250]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x48], 1
call sub.VCRUNTIME140.dll_memset
push 0x104
lea eax, [ebp - 0x250]
push eax
push ebx
call fcn.00459979
add esp, 0x18
push 0x53
pop eax
push 0x69
mov word [ebp - 0x44], ax
pop eax
push 0x61
mov word [ebp - 0x38], ax
pop eax
push 0x68
mov word [ebp - 0x3c], ax
pop eax
push 0x6c
pop ecx
push 0x2e
mov word [ebp - 0x42], ax
pop eax
push 0x70
mov word [ebp - 0x36], ax
pop eax
push 0x64
mov word [ebp - 0x3a], ax
pop eax
mov word [ebp - 0x34], ax
push 0x77
pop eax
mov word [ebp - 0x3e], ax
xor eax, eax
mov word [ebp - 0x2e], ax
lea eax, [ebp - 0x44]
push eax
mov word [ebp - 0x40], cx
mov word [ebp - 0x32], cx
mov word [ebp - 0x30], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x459b7d
push 0x65
pop ebx
lea eax, [ebp - 0x20]
mov byte [ebp - 0x15], bl
push eax
push edi
mov word [ebp - 0x14], 0x614e
mov dword [ebp - 0x20], 0x68746150
mov word [ebp - 0x17], 0x6c69
mov dword [ebp - 0x1c], 0x646e6946
mov word [ebp - 0x10], 0x57
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x18], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x459b76
lea ecx, [ebp - 0x250]
push ecx
call eax
mov ecx, dword [ebp + 8]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
mov ecx, dword [ebp + 8]
push 0x78
pop eax
push 0x2e
mov word [ebp - 0x28], ax
pop eax
mov word [ebp - 0x2c], ax
xor eax, eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x2c]
push 0x4bbd40
push eax
mov word [ebp - 0x26], bx
mov word [ebp - 0x2a], bx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x45b684
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push 0x2e
pop eax
push 0x6e
mov word [ebp - 0x20], ax
xor ebx, ebx
pop eax
push 0x65
pop edx
push 0x32
mov word [ebp - 0x2a], ax
pop eax
push 0x6c
mov word [ebp - 0x22], ax
pop eax
push 0x64
pop ecx
push 0x72
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], ax
mov word [ebp - 0x26], ax
pop eax
push 0x33
mov word [ebp - 0x2c], ax
pop eax
mov word [ebp - 0x24], ax
push 0x4b
pop eax
mov word [ebp - 0x30], ax
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
mov word [ebp - 0x2e], dx
push eax
mov word [ebp - 0x28], dx
mov word [ebp - 0x1e], cx
mov word [ebp - 0xe], 0x6c75
mov byte [ebp - 0x13], dl
mov byte [ebp - 0xc], dl
mov byte [ebp - 8], dl
mov word [ebp - 0x11], 0x6f4d
mov word [ebp - 0xa], 0x6c69
mov byte [ebp - 4], dl
mov word [ebp - 3], 0x57
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xb], 0x46
mov word [ebp - 6], 0x6d61
mov byte [ebp - 7], 0x4e
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x12], 0x74
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45b741
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
mov eax, ebx
pop ebx
leave
ret
Function at 0x45b782
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x4a5250
call fcn.0045ce8c
sub esp, 0x244
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 0x48], ebx
mov ecx, dword [ebp + 8]
push 0x4bbd40
mov dword [ebp - 4], ebx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__12]
push 0x208
lea eax, [ebp - 0x250]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x48], 1
call sub.VCRUNTIME140.dll_memset
push 0x104
lea eax, [ebp - 0x250]
push eax
push ebx
call fcn.0045b684
add esp, 0x18
push 0x53
pop eax
push 0x69
mov word [ebp - 0x44], ax
pop eax
push 0x61
mov word [ebp - 0x38], ax
pop eax
push 0x68
mov word [ebp - 0x3c], ax
pop eax
push 0x6c
pop ecx
push 0x2e
mov word [ebp - 0x42], ax
pop eax
push 0x70
mov word [ebp - 0x36], ax
pop eax
push 0x64
mov word [ebp - 0x3a], ax
pop eax
mov word [ebp - 0x34], ax
push 0x77
pop eax
mov word [ebp - 0x3e], ax
xor eax, eax
mov word [ebp - 0x2e], ax
lea eax, [ebp - 0x44]
push eax
mov word [ebp - 0x40], cx
mov word [ebp - 0x32], cx
mov word [ebp - 0x30], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x45b8c4
push 0x65
pop ebx
lea eax, [ebp - 0x20]
mov byte [ebp - 0x15], bl
push eax
push edi
mov word [ebp - 0x14], 0x614e
mov dword [ebp - 0x20], 0x68746150
mov word [ebp - 0x17], 0x6c69
mov dword [ebp - 0x1c], 0x646e6946
mov word [ebp - 0x10], 0x57
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x18], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45b8bd
lea ecx, [ebp - 0x250]
push ecx
call eax
mov ecx, dword [ebp + 8]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
mov ecx, dword [ebp + 8]
push 0x78
pop eax
push 0x2e
mov word [ebp - 0x28], ax
pop eax
mov word [ebp - 0x2c], ax
xor eax, eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x2c]
push 0x4bbd40
push eax
mov word [ebp - 0x26], bx
mov word [ebp - 0x2a], bx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x46f063
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x46f1be
xor ebp, ebp
cmp dword [edi + 0x18], ebp
je 0x46f1be
cmp dword [edi + 0x7c], ebp
je 0x46f08c
push edi
call fcn.0048e273
pop ecx
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.0048a992
add esp, 0x10
test eax, eax
je 0x46f0af
push 0xffffffffffffff99
jmp 0x46f1c0
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push 0x84
call ebx
mov esi, eax
pop ecx
test esi, esi
jne 0x46f0ca
push 0xffffffffffffff98
jmp 0x46f1c0
push 0x4000
call ebx
mov dword [esi], eax
mov dword [esi + 0x4c], ebp
pop ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x44], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x48], ecx
test eax, eax
jne 0x46f0f3
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x46f0c3
mov dword [esi + 0x40], ebp
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], ebp
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], ebp
test ecx, ecx
je 0x46f138
lea eax, [esi + 4]
mov dword [esi + 0x24], ebp
push eax
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], ebp
call fcn.0042d9b8
pop ecx
test eax, eax
jne 0x46f138
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x46f15b
mov al, byte [edi + 0x39]
jmp 0x46f15e
mov al, byte [edi + 0x3f]
mov ebx, dword [esp + 0x20]
lea ebp, [esi + 0x70]
mov byte [esi + 0x80], al
xor eax, eax
cmp byte [esi + 0x6c], al
push 0xc
pop ecx
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [ebp], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x46f1a6
mov al, byte [ebx]
test al, al
je 0x46f1a6
push eax
push ebp
call fcn.00433c6f
pop ecx
pop ecx
add ebx, 1
jne 0x46f192
mov eax, dword [esp + 0x14]
add eax, 0x1e
add eax, dword [edi + 0x78]
and dword [esi + 8], 0
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [edi + 0x7c], esi
jmp 0x46f1c1
push 0xffffffffffffff9a
pop eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..data
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x3a4d3b34
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x2f482cb7
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x407b20
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov cl, 4
mov al, byte [esp + 8]
push esi
cbw
idiv cl
movsx edx, al
push edi
xor eax, eax
lea ecx, [eax + edx]
inc eax
and ecx, 0xff
mov cl, byte [ecx + 0x48a610]
mov bl, cl
mov byte [eax + 0x426c9f], cl
shr bl, 1
shl cl, 2
mov byte [eax + 0x426a9f], bl
mov byte [eax + 0x426e9f], cl
cmp eax, 0x200
jl 0x407b32
test edx, edx
jge 0x407ba1
mov ecx, edx
mov esi, edx
mov edi, 0x48a810
mov eax, 0x10101010
neg esi
mov ecx, esi
rep stosd dword es:[edi], eax
lea eax, [edx + 0x40]
lea ecx, [esi + edx]
cmp ecx, eax
jge 0x407bdf
lea esi, [ecx*4 + 0x48a710]
mov eax, ecx
sub eax, edx
sub edx, ecx
lea edi, [eax*4 + 0x48a810]
lea ecx, [edx + 0x40]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
ret
xor ebx, ebx
mov eax, 0x40
sub eax, edx
test eax, eax
jle 0x407bc5
lea esi, [edx*4 + 0x48a710]
mov ebx, 0x40
sub ebx, edx
mov edi, 0x48a810
mov ecx, ebx
rep movsd dword es:[edi], dword [esi]
cmp ebx, 0x40
jge 0x407bdf
lea edi, [ebx*4 + 0x48a810]
mov ecx, 0x40
sub ecx, ebx
mov eax, 0xe0e0e0e0
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4155f0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebp
push ebx
mov esi, dword [0x4265f4]
mov edi, dword [0x48ab1c]
mov edx, dword [0x48ab10]
mov eax, dword [0x48baac]
lea ebx, [esi + 0x18c00]
mov ecx, 0x2c
movd mm0, dword [ebx]
pxor mm7, mm7
movd mm1, dword [ebx + 0x6300]
punpcklbw mm0, mm7
movq mm6, qword [0x4a53a0]
punpcklbw mm1, mm7
movq mm4, qword [esi]
psubw mm0, mm6
pxor mm4, qword [0x4a5398]
movq mm2, mm0
pmullw mm0, qword [0x4a53b0]
psubw mm1, mm6
movq mm3, mm1
movq mm5, mm4
pmullw mm1, qword [0x4a53a8]
movq mm6, mm4
pmullw mm2, qword [str.XXXX]
psraw mm0, 7
pmullw mm3, qword [0x4a53b8]
psraw mm1, 7
movq mm7, qword [0x48d060]
packsswb mm0, mm0
paddsb mm4, mm7
psraw mm2, 8
paddsb mm5, mm7
punpcklbw mm0, mm0
paddsb mm6, mm7
psraw mm3, 8
packsswb mm1, mm1
paddw mm2, mm3
movq mm3, qword [0x4a5398]
paddsb mm6, mm0
punpcklbw mm1, mm1
pxor mm6, mm3
movq mm7, qword [0x4a53c8]
packsswb mm2, mm2
pand mm6, mm7
punpcklbw mm2, mm2
paddsb mm4, mm1
movq mm0, mm6
pxor mm4, mm3
psubsb mm5, mm2
pxor mm5, mm3
pand mm4, mm7
pand mm5, qword [0x4a53c8]
movq mm3, mm4
pxor mm7, mm7
movq mm1, mm5
punpcklbw mm3, mm7
punpckhbw mm4, mm7
punpcklbw mm0, mm7
punpckhbw mm6, mm7
punpcklbw mm1, mm7
punpckhbw mm5, mm7
psllw mm3, 7
add edi, 0x10
psllw mm1, 2
add esi, 8
psllw mm4, 7
por mm3, mm1
psllw mm5, 2
add ebx, 4
psrlw mm0, 3
por mm4, mm5
psrlw mm6, 3
por mm3, mm0
por mm4, mm6
dec ecx
movq qword [edi - 0x10], mm3
movq qword [edi - 8], mm4
jne 0x415616
mov ecx, 0x2c
sub ebx, 0xb0
lea edi, [edx + edi - 0x2c0]
dec eax
je 0x41574f
test eax, 1
jne 0x415616
add ebx, 0xb0
jmp 0x415616
pop ebx
pop ebp
pop edi
pop esi
ret
Function at 0x415760
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebp
push ebx
mov esi, dword [0x4265f4]
mov edi, dword [0x48ab1c]
mov edx, dword [0x48ab10]
mov eax, dword [0x48baac]
lea ebx, [esi + 0x18c00]
mov ecx, 0x2c
movd mm0, dword [ebx]
pxor mm7, mm7
movd mm1, dword [ebx + 0x6300]
punpcklbw mm0, mm7
movq mm6, qword [0x4a53a0]
punpcklbw mm1, mm7
movq mm4, qword [esi]
psubw mm0, mm6
pxor mm4, qword [0x4a5398]
movq mm2, mm0
pmullw mm0, qword [0x4a53b0]
psubw mm1, mm6
movq mm3, mm1
movq mm5, mm4
pmullw mm1, qword [0x4a53a8]
movq mm6, mm4
pmullw mm2, qword [str.XXXX]
psraw mm0, 7
pmullw mm3, qword [0x4a53b8]
psraw mm1, 7
movq mm7, qword [0x48d060]
packsswb mm0, mm0
paddsb mm4, mm7
psraw mm2, 8
paddsb mm5, mm7
punpcklbw mm0, mm0
paddsb mm6, mm7
psraw mm3, 8
packsswb mm1, mm1
paddw mm2, mm3
movq mm3, qword [0x4a5398]
paddsb mm6, mm0
punpcklbw mm1, mm1
pxor mm6, mm3
movq mm7, qword [0x4a53c8]
packsswb mm2, mm2
punpcklbw mm2, mm2
paddsb mm4, mm1
pand mm6, mm7
pxor mm4, mm3
movq mm0, mm6
psubsb mm5, mm2
pand mm4, mm7
pxor mm5, mm3
pand mm5, qword [0x4a53d0]
movq mm3, mm4
pxor mm7, mm7
movq mm1, mm5
punpcklbw mm3, mm7
punpckhbw mm4, mm7
punpcklbw mm0, mm7
punpckhbw mm6, mm7
punpcklbw mm1, mm7
punpckhbw mm5, mm7
psllw mm3, 8
add edi, 0x10
psllw mm1, 3
add esi, 8
psllw mm4, 8
por mm3, mm1
psllw mm5, 3
add ebx, 4
psrlw mm0, 3
por mm4, mm5
psrlw mm6, 3
por mm3, mm0
por mm4, mm6
dec ecx
movq qword [edi - 0x10], mm3
movq qword [edi - 8], mm4
jne 0x415786
mov ecx, 0x2c
sub ebx, 0xb0
lea edi, [edx + edi - 0x2c0]
dec eax
je 0x4158bf
test eax, 1
jne 0x415786
add ebx, 0xb0
jmp 0x415786
pop ebx
pop ebp
pop edi
pop esi
ret
Function at 0x4158d0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebp
push ebx
mov esi, dword [0x4265f4]
mov edi, dword [0x48ab1c]
mov edx, dword [0x48ab10]
mov eax, dword [0x48baac]
lea ebx, [esi + 0x18c00]
mov ecx, 0x2c
movd mm0, dword [ebx]
pxor mm7, mm7
movd mm1, dword [ebx + 0x6300]
punpcklbw mm0, mm7
movq mm6, qword [0x4a53a0]
punpcklbw mm1, mm7
movq mm4, qword [esi]
psubw mm0, mm6
pxor mm4, qword [0x4a5398]
movq mm2, mm0
pmullw mm0, qword [0x4a53b0]
psubw mm1, mm6
movq mm3, mm1
movq mm5, mm4
pmullw mm1, qword [0x4a53a8]
movq mm6, mm4
pmullw mm2, qword [str.XXXX]
psraw mm0, 7
pmullw mm3, qword [0x4a53b8]
psraw mm1, 7
movq mm7, qword [0x48d060]
packsswb mm0, mm0
paddsb mm4, mm7
psraw mm2, 8
paddsb mm5, mm7
punpcklbw mm0, mm0
paddsb mm6, mm7
psraw mm3, 8
packsswb mm1, mm1
paddw mm2, mm3
movq mm3, qword [0x4a5398]
paddsb mm6, mm0
punpcklbw mm1, mm1
pxor mm6, mm3
movq mm7, qword [0x4a53c8]
packsswb mm2, mm2
pand mm6, mm7
punpcklbw mm2, mm2
paddsb mm4, mm1
movq mm0, mm6
pxor mm4, mm3
psubsb mm5, mm2
pxor mm5, mm3
pand mm4, mm7
pand mm5, qword [0x4a53d0]
movq mm3, mm4
punpcklbw mm0, mm5
pxor mm7, mm7
punpckhbw mm6, mm5
add edi, 0x18
punpcklbw mm3, mm7
add esi, 8
punpckhbw mm4, mm7
movq mm1, mm0
punpcklwd mm0, mm3
movq mm2, mm6
punpckhwd mm1, mm3
add ebx, 4
punpcklwd mm2, mm4
movq mm3, mm0
punpckhwd mm6, mm4
movq mm5, mm1
pand mm0, qword [0x4a53d8]
psrlq mm3, 8
pand mm3, qword [0x4a53e0]
psllq mm1, 0x30
por mm0, mm3
movq mm4, mm5
psrlq mm4, 0x10
por mm0, mm1
pand mm4, qword [0x4a53e8]
psrlq mm5, 0x18
movq qword [edi - 0x18], mm0
movq mm1, mm2
psllq mm2, 0x20
movq mm3, mm1
psrlq mm3, 0x28
por mm4, mm5
psllq mm1, 0x18
por mm2, mm4
pand mm1, qword [0x4a53f0]
movq mm5, mm6
psllq mm6, 0x10
por mm2, mm1
pand mm6, qword [0x4a53f8]
psllq mm5, 8
pand mm5, qword [0x4a5400]
por mm6, mm3
movq qword [edi - 0x10], mm2
por mm6, mm5
dec ecx
movq qword [edi - 8], mm6
jne 0x4158f6
mov ecx, 0x2c
sub ebx, 0xb0
lea edi, [edx + edi - 0x420]
dec eax
je 0x415a8d
test eax, 1
jne 0x4158f6
add ebx, 0xb0
jmp 0x4158f6
pop ebx
pop ebp
pop edi
pop esi
ret
Function at 0x415aa0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebp
push ebx
mov esi, dword [0x4265f4]
mov edi, dword [0x48ab1c]
mov edx, dword [0x48ab10]
mov eax, dword [0x48baac]
lea ebx, [esi + 0x18c00]
mov ecx, 0x2c
movd mm0, dword [ebx]
pxor mm7, mm7
movd mm1, dword [ebx + 0x6300]
punpcklbw mm0, mm7
movq mm6, qword [0x4a53a0]
punpcklbw mm1, mm7
movq mm4, qword [esi]
psubw mm0, mm6
pxor mm4, qword [0x4a5398]
movq mm2, mm0
pmullw mm0, qword [0x4a53b0]
psubw mm1, mm6
movq mm3, mm1
movq mm5, mm4
pmullw mm1, qword [0x4a53a8]
movq mm6, mm4
pmullw mm2, qword [str.XXXX]
psraw mm0, 7
pmullw mm3, qword [0x4a53b8]
psraw mm1, 7
movq mm7, qword [0x48d060]
packsswb mm0, mm0
paddsb mm4, mm7
psraw mm2, 8
paddsb mm5, mm7
punpcklbw mm0, mm0
paddsb mm6, mm7
psraw mm3, 8
packsswb mm1, mm1
paddw mm2, mm3
movq mm3, qword [0x4a5398]
paddsb mm6, mm0
punpcklbw mm1, mm1
pxor mm6, mm3
movq mm7, qword [0x4a53c8]
packsswb mm2, mm2
pand mm6, mm7
punpcklbw mm2, mm2
paddsb mm4, mm1
movq mm0, mm6
pxor mm4, mm3
psubsb mm5, mm2
pxor mm5, mm3
pand mm4, mm7
pand mm5, qword [0x4a53d0]
movq mm3, mm4
punpcklbw mm0, mm5
pxor mm7, mm7
punpckhbw mm6, mm5
add edi, 0x20
punpcklbw mm3, mm7
add esi, 8
punpckhbw mm4, mm7
movq mm1, mm0
punpcklwd mm0, mm3
movq mm2, mm6
punpckhwd mm1, mm3
add ebx, 4
movq qword [edi - 0x20], mm0
punpcklwd mm2, mm4
movq qword [edi - 0x18], mm1
punpckhwd mm6, mm4
movq qword [edi - 0x10], mm2
movq qword [edi - 8], mm6
dec ecx
jne 0x415ac6
mov ecx, 0x2c
sub ebx, 0xb0
lea edi, [edx + edi - 0x580]
dec eax
je 0x415bec
test eax, 1
jne 0x415ac6
add ebx, 0xb0
jmp 0x415ac6
pop ebx
pop ebp
pop edi
pop esi
ret

Function at 0x415c00
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 2
movd mm0, dword [ebp]
pxor mm7, mm7
movd mm1, dword [ebp + 0x6300]
punpcklbw mm0, mm7
movq mm6, qword [0x4a53a0]
punpcklbw mm1, mm7
movq mm4, qword [esi]
psubw mm0, mm6
pand mm4, qword [0x4a5410]
movq mm2, mm0
pxor mm4, qword [0x4a5398]
psubw mm1, mm6
pmullw mm0, qword [0x4a53b0]
movq mm3, mm1
pmullw mm1, qword [0x4a53a8]
movq mm5, mm4
pmullw mm2, qword [str.XXXX]
movq mm6, mm4
pmullw mm3, qword [0x4a53b8]
psraw mm0, 7
movq mm7, qword [0x48d060]
psraw mm1, 7
paddsb mm4, mm7
packsswb mm0, mm0
psraw mm2, 8
add esi, 0x160
paddsb mm5, mm7
punpcklbw mm0, mm0
paddsb mm6, mm7
psraw mm3, 8
packsswb mm1, mm1
paddw mm2, mm3
movq mm3, qword [0x4a5398]
paddsb mm6, mm0
punpcklbw mm1, mm1
pxor mm6, mm3
movq mm7, qword [0x4a53c8]
packsswb mm2, mm2
pand mm6, mm7
punpcklbw mm2, mm2
paddsb mm4, mm1
movq mm0, mm6
pxor mm4, mm3
psubsb mm5, mm2
pxor mm5, mm3
pand mm4, mm7
pand mm5, qword [0x4a53d0]
movq mm3, mm4
pxor mm7, mm7
movq mm1, mm5
punpcklbw mm3, mm7
punpckhbw mm4, mm7
punpcklbw mm0, mm7
punpckhbw mm6, mm7
punpcklbw mm1, mm7
punpckhbw mm5, mm7
psllw mm3, 8
psllw mm1, 3
psllw mm4, 8
por mm3, mm1
psllw mm5, 3
psrlw mm0, 3
por mm4, mm5
psrlw mm6, 3
por mm3, mm0
por mm4, mm6
dec ecx
movq qword [edi], mm3
movq qword [edi + 8], mm4
lea edi, [ebx + edi]
jne 0x415c05
sub edi, ebx
sub esi, 0x2b8
sub edi, ebx
add ebp, 4
add edi, 0x10
ret
Function at 0x416370
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 2
movd mm0, dword [ebp]
pxor mm7, mm7
movd mm1, dword [ebp + 0x6300]
punpcklbw mm0, mm7
movq mm6, qword [0x4a53a0]
punpcklbw mm1, mm7
movq mm4, qword [esi]
psubw mm0, mm6
pand mm4, qword [0x4a5410]
movq mm2, mm0
pxor mm4, qword [0x4a5398]
psubw mm1, mm6
pmullw mm0, qword [0x4a53b0]
movq mm3, mm1
pmullw mm1, qword [0x4a53a8]
movq mm5, mm4
pmullw mm2, qword [str.XXXX]
movq mm6, mm4
pmullw mm3, qword [0x4a53b8]
psraw mm0, 7
movq mm7, qword [0x48d060]
psraw mm1, 7
paddsb mm4, mm7
packsswb mm0, mm0
psraw mm2, 8
add esi, 0x160
paddsb mm5, mm7
punpcklbw mm0, mm0
paddsb mm6, mm7
psraw mm3, 8
packsswb mm1, mm1
paddw mm2, mm3
movq mm3, qword [0x4a5398]
paddsb mm6, mm0
punpcklbw mm1, mm1
pxor mm6, mm3
movq mm7, qword [0x4a53c8]
packsswb mm2, mm2
pand mm6, mm7
punpcklbw mm2, mm2
paddsb mm4, mm1
movq mm0, mm6
pxor mm4, mm3
psubsb mm5, mm2
pxor mm5, mm3
pand mm4, mm7
pand mm5, qword [0x4a53c8]
movq mm3, mm4
pxor mm7, mm7
movq mm1, mm5
punpcklbw mm3, mm7
punpckhbw mm4, mm7
punpcklbw mm0, mm7
punpckhbw mm6, mm7
punpcklbw mm1, mm7
punpckhbw mm5, mm7
psllw mm3, 7
psllw mm1, 2
psllw mm4, 7
por mm3, mm1
psllw mm5, 2
psrlw mm0, 3
por mm4, mm5
psrlw mm6, 3
por mm3, mm0
por mm4, mm6
dec ecx
movq qword [edi], mm3
movq qword [edi + 8], mm4
lea edi, [ebx + edi]
jne 0x416375
sub edi, ebx
sub esi, 0x2b8
sub edi, ebx
add ebp, 4
add edi, 0x10
ret
Function at 0x4052a5
Capabilities:
Get file size

Disassembly:
call fcn.00401018
mov edi, dword [ebp + 0xc]
add edi, 4
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
sub edi, 4
stosd dword es:[edi], eax
call fcn.00401026
ret 8

Function at 0x4052df
Capabilities:
Get file attributes

Disassembly:
call fcn.00401018
cmp byte [0x405f0d], 0
je 0x4052f8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
jmp 0x405324
push dword [ebp + 8]
call fcn.00405493
push 0
push dword [ebp + 8]
push 0x11
push 0x4051f2
push 1
call fcn.004023fa
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
push eax
push ebx
call fcn.0040156e
pop eax
call fcn.00401026
cmp eax, 0xffffffff
je 0x405331
and eax, 0x10
ret 4