joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456320
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
push ebp
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esi]
mov ebx, dword [ebx]
mov ecx, dword [esp + 0x18]
xor eax, eax
lea ecx, [ecx + 0x100]
pxor mm0, mm0
movd mm3, ebx
movd mm1, ecx
pcmpeqb xmm2, xmm2
jmp 0x456358
add eax, 1
add esi, 1
movd mm0, eax
cmp esi, dword [esp + 0x34]
jge 0x456485
cmp eax, dword [esp + 0x38]
jge 0x456485
movzx eax, byte [esi + edi + 2]
shl ebx, 5
xor ebx, eax
mov eax, esi
and ebx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov ebp, dword [edx + ebx*4]
mov dword [edx + ebx*4], esi
movd mm3, ebx
mov ebx, edi
sub eax, ebp
cmp eax, dword [esp + 0x2c]
jge 0x456457
cmp ebp, dword [esp + 0x3c]
cmovl ebx, dword [esp + 0x24]
movd mm2, eax
movzx eax, word [esi + edi]
lea edi, [esi + edi]
movzx ecx, word [ebp + ebx]
lea ebx, [ebp + ebx]
cmp eax, ecx
jne 0x456453
xor ecx, ecx
mov eax, dword [ecx + edi]
xor eax, dword [ecx + ebx]
jne 0x4563e1
lea ecx, [ecx + 4]
cmp ecx, 0x100
jl 0x4563bd
movzx eax, word [ecx + edi]
movzx edx, word [ecx + ebx]
xor eax, edx
jne 0x4563e1
add ecx, 2
jmp 0x4563e9
bsf eax, eax
shr eax, 3
add ecx, eax
cmp ecx, 3
jl 0x456453
lea ebp, [esi + 1]
lea esi, [ecx + esi - 1]
lea eax, [ecx - 3]
mov edi, dword [esp + 0x14]
movd ebx, mm3
mov edx, dword [esp + 0x28]
movzx ecx, byte [ebp + edi + 2]
shl ebx, 5
xor ebx, ecx
and ebx, dword [esp + 0x30]
mov dword [edx + ebx*4], ebp
add ebp, 1
cmp ebp, esi
jle 0x456403
movd edx, mm2
lea ecx, [edx - 1]
movd ebp, mm1
cmp edx, 0x101
jl 0x456435
shr ecx, 7
add ecx, 0x100
movzx ecx, byte [ecx + ebp]
mov ebp, dword [esp + 0x20]
add word [ebp + ecx*4], 1
mov ebp, dword [esp + 0x18]
movzx ebp, byte [eax + ebp]
add ebp, 0x101
jmp 0x456462
mov edi, dword [esp + 0x14]
movzx eax, byte [esi + edi]
xor edx, edx
mov ebp, eax
movd ebx, mm3
mov ecx, dword [esp + 0x1c]
add word [ecx + ebp*4], 1
movd ebp, mm0
mov ecx, dword [esp + 0x44]
mov word [ecx + ebp*2], dx
mov edx, dword [esp + 0x40]
mov byte [ebp + edx], al
mov eax, ebp
jmp 0x45634f
mov edi, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [edi], esi
mov dword [ecx], ebx
emms
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x4572c0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
push ebp
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esi]
mov ebx, dword [ebx]
mov ecx, dword [esp + 0x18]
xor eax, eax
lea ecx, [ecx + 0x100]
pxor mm0, mm0
movd mm3, ebx
movd mm1, ecx
pcmpeqb xmm2, xmm2
jmp 0x4572f8
add eax, 1
add esi, 1
movd mm0, eax
cmp esi, dword [esp + 0x34]
jge 0x457425
cmp eax, dword [esp + 0x38]
jge 0x457425
movzx eax, byte [esi + edi + 2]
shl ebx, 5
xor ebx, eax
mov eax, esi
and ebx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov ebp, dword [edx + ebx*4]
mov dword [edx + ebx*4], esi
movd mm3, ebx
mov ebx, edi
sub eax, ebp
cmp eax, dword [esp + 0x2c]
jge 0x4573f7
cmp ebp, dword [esp + 0x3c]
cmovl ebx, dword [esp + 0x24]
movd mm2, eax
movzx eax, word [esi + edi]
lea edi, [esi + edi]
movzx ecx, word [ebp + ebx]
lea ebx, [ebp + ebx]
cmp eax, ecx
jne 0x4573f3
xor ecx, ecx
mov eax, dword [ecx + edi]
xor eax, dword [ecx + ebx]
jne 0x457381
lea ecx, [ecx + 4]
cmp ecx, 0x100
jl 0x45735d
movzx eax, word [ecx + edi]
movzx edx, word [ecx + ebx]
xor eax, edx
jne 0x457381
add ecx, 2
jmp 0x457389
bsf eax, eax
shr eax, 3
add ecx, eax
cmp ecx, 3
jl 0x4573f3
lea ebp, [esi + 1]
lea esi, [ecx + esi - 1]
lea eax, [ecx - 3]
mov edi, dword [esp + 0x14]
movd ebx, mm3
mov edx, dword [esp + 0x28]
movzx ecx, byte [ebp + edi + 2]
shl ebx, 5
xor ebx, ecx
and ebx, dword [esp + 0x30]
mov dword [edx + ebx*4], ebp
add ebp, 1
cmp ebp, esi
jle 0x4573a3
movd edx, mm2
lea ecx, [edx - 1]
movd ebp, mm1
cmp edx, 0x101
jl 0x4573d5
shr ecx, 7
add ecx, 0x100
movzx ecx, byte [ecx + ebp]
mov ebp, dword [esp + 0x20]
add word [ebp + ecx*4], 1
mov ebp, dword [esp + 0x18]
movzx ebp, byte [eax + ebp]
add ebp, 0x101
jmp 0x457402
mov edi, dword [esp + 0x14]
movzx eax, byte [esi + edi]
xor edx, edx
mov ebp, eax
movd ebx, mm3
mov ecx, dword [esp + 0x1c]
add word [ecx + ebp*4], 1
movd ebp, mm0
mov ecx, dword [esp + 0x44]
mov word [ecx + ebp*2], dx
mov edx, dword [esp + 0x40]
mov byte [ebp + edx], al
mov eax, ebp
jmp 0x4572ef
mov edi, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [edi], esi
mov dword [ecx], ebx
emms
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x458260
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
push ebp
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esi]
mov ebx, dword [ebx]
mov ecx, dword [esp + 0x18]
xor eax, eax
lea ecx, [ecx + 0x100]
pxor mm0, mm0
movd mm3, ebx
movd mm1, ecx
pcmpeqb xmm2, xmm2
jmp 0x458298
add eax, 1
add esi, 1
movd mm0, eax
cmp esi, dword [esp + 0x34]
jge 0x4583c5
cmp eax, dword [esp + 0x38]
jge 0x4583c5
movzx eax, byte [esi + edi + 2]
shl ebx, 5
xor ebx, eax
mov eax, esi
and ebx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov ebp, dword [edx + ebx*4]
mov dword [edx + ebx*4], esi
movd mm3, ebx
mov ebx, edi
sub eax, ebp
cmp eax, dword [esp + 0x2c]
jge 0x458397
cmp ebp, dword [esp + 0x3c]
cmovl ebx, dword [esp + 0x24]
movd mm2, eax
movzx eax, word [esi + edi]
lea edi, [esi + edi]
movzx ecx, word [ebp + ebx]
lea ebx, [ebp + ebx]
cmp eax, ecx
jne 0x458393
xor ecx, ecx
mov eax, dword [ecx + edi]
xor eax, dword [ecx + ebx]
jne 0x458321
lea ecx, [ecx + 4]
cmp ecx, 0x100
jl 0x4582fd
movzx eax, word [ecx + edi]
movzx edx, word [ecx + ebx]
xor eax, edx
jne 0x458321
add ecx, 2
jmp 0x458329
bsf eax, eax
shr eax, 3
add ecx, eax
cmp ecx, 3
jl 0x458393
lea ebp, [esi + 1]
lea esi, [ecx + esi - 1]
lea eax, [ecx - 3]
mov edi, dword [esp + 0x14]
movd ebx, mm3
mov edx, dword [esp + 0x28]
movzx ecx, byte [ebp + edi + 2]
shl ebx, 5
xor ebx, ecx
and ebx, dword [esp + 0x30]
mov dword [edx + ebx*4], ebp
add ebp, 1
cmp ebp, esi
jle 0x458343
movd edx, mm2
lea ecx, [edx - 1]
movd ebp, mm1
cmp edx, 0x101
jl 0x458375
shr ecx, 7
add ecx, 0x100
movzx ecx, byte [ecx + ebp]
mov ebp, dword [esp + 0x20]
add word [ebp + ecx*4], 1
mov ebp, dword [esp + 0x18]
movzx ebp, byte [eax + ebp]
add ebp, 0x101
jmp 0x4583a2
mov edi, dword [esp + 0x14]
movzx eax, byte [esi + edi]
xor edx, edx
mov ebp, eax
movd ebx, mm3
mov ecx, dword [esp + 0x1c]
add word [ecx + ebp*4], 1
movd ebp, mm0
mov ecx, dword [esp + 0x44]
mov word [ecx + ebp*2], dx
mov edx, dword [esp + 0x40]
mov byte [ebp + edx], al
mov eax, ebp
jmp 0x45828f
mov edi, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [edi], esi
mov dword [ecx], ebx
emms
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x462270
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
push ebx
push ebp
push esi
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
cmp ebx, 0xf
mov ebp, dword [esp + 0x18]
mov edx, dword [ecx]
not edx
jge 0x462300
test ebx, ebx
je 0x4622ef
mov eax, ebx
shr eax, 0x1f
add eax, ebx
sar eax, 1
test eax, eax
jbe 0x4622f9
xor edi, edi
movzx esi, byte [ebp + edi*2]
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x616d60]
movzx esi, byte [ebp + edi*2 + 1]
inc edi
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x616d60]
cmp edi, eax
jb 0x46229d
lea edi, [edi + edi + 1]
lea eax, [edi - 1]
cmp ebx, eax
jbe 0x4622ef
movzx eax, byte [ebp + edi - 1]
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x616d60]
not edx
mov dword [ecx], edx
pop ecx
pop ebp
pop ebx
pop edi
pop esi
ret
mov edi, 1
jmp 0x4622d4
mov eax, ebp
and eax, 7
je 0x462328
neg eax
and eax, 7
sub ebx, eax
movzx edi, byte [ebp]
inc ebp
xor edi, edx
and edi, 0xff
shr edx, 8
xor edx, dword [edi*4 + 0x616d60]
dec eax
jne 0x46230e
mov eax, ebx
and ebx, 7
sar eax, 3
mov dword [esp], ebx
xor edx, dword [ebp]
movzx edi, dl
mov esi, dword [ebp + 4]
add ebp, 8
mov ebx, dword [edi*4 + 0x617160]
mov edi, edx
shr edi, 8
and edi, 0xff
xor ebx, dword [edi*4 + 0x617560]
mov edi, edx
shr edi, 0x10
and edi, 0xff
shr edx, 0x18
mov edi, dword [edi*4 + 0x617960]
xor edi, dword [edx*4 + 0x617d60]
xor ebx, edi
mov edi, esi
mov edx, esi
and edx, 0xff
shr edi, 8
and edi, 0xff
mov edx, dword [edx*4 + 0x618160]
xor edx, dword [edi*4 + 0x618560]
mov edi, esi
shr edi, 0x10
and edi, 0xff
shr esi, 0x18
mov edi, dword [edi*4 + 0x618960]
xor edi, dword [esi*4 + 0x616d60]
xor edx, edi
xor edx, ebx
dec eax
jne 0x462333
mov ebx, dword [esp]
jmp 0x46228a
Function at 0x4627a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
push ebx
push ebp
push esi
mov ecx, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov edx, dword [ecx]
not edx
cmp dword [esp + 0x1c], 0xf
jge 0x462831
test ebx, ebx
je 0x462820
mov eax, ebx
shr eax, 0x1f
add eax, ebx
sar eax, 1
test eax, eax
jbe 0x46282a
xor edi, edi
movzx esi, byte [ebp + edi*2]
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x618d80]
movzx esi, byte [ebp + edi*2 + 1]
inc edi
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x618d80]
cmp edi, eax
jb 0x4627cf
add edi, edi
inc edi
mov eax, edi
dec eax
cmp ebx, eax
jbe 0x462820
movzx eax, byte [ebp + edi - 1]
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x618d80]
not edx
mov dword [ecx], edx
pop ecx
pop ebp
pop ebx
pop edi
pop esi
ret
mov edi, 1
jmp 0x462805
mov eax, ebp
and eax, 7
je 0x462859
neg eax
and eax, 7
sub ebx, eax
movzx edi, byte [ebp]
inc ebp
xor edi, edx
and edi, 0xff
shr edx, 8
xor edx, dword [edi*4 + 0x618d80]
dec eax
jne 0x46283f
mov eax, ebx
and ebx, 7
sar eax, 3
mov dword [esp], ebx
xor edx, dword [ebp]
movzx edi, dl
mov esi, dword [ebp + 4]
mov ebx, dword [edi*4 + 0x619180]
mov edi, edx
shr edi, 8
and edi, 0xff
xor ebx, dword [edi*4 + 0x619580]
mov edi, edx
shr edi, 0x10
and edi, 0xff
shr edx, 0x18
mov edi, dword [edi*4 + 0x619980]
xor edi, dword [edx*4 + 0x619d80]
xor ebx, edi
mov edi, esi
shr edi, 8
movzx edx, byte [ebp + 4]
add ebp, 8
and edi, 0xff
mov edx, dword [edx*4 + 0x61a180]
xor edx, dword [edi*4 + 0x61a580]
mov edi, esi
shr edi, 0x10
and edi, 0xff
shr esi, 0x18
mov edi, dword [edi*4 + 0x61a980]
xor edi, dword [esi*4 + 0x618d80]
xor edx, edi
xor edx, ebx
dec eax
jne 0x462864
mov ebx, dword [esp]
jmp 0x4627bc
Function at 0x4630e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
push ebx
push ebp
push esi
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
cmp ebx, 0xf
mov ebp, dword [esp + 0x18]
mov edx, dword [ecx]
not edx
jge 0x463170
test ebx, ebx
je 0x46315f
mov eax, ebx
shr eax, 0x1f
add eax, ebx
sar eax, 1
test eax, eax
jbe 0x463169
xor edi, edi
movzx esi, byte [ebp + edi*2]
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x61b220]
movzx esi, byte [ebp + edi*2 + 1]
inc edi
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x61b220]
cmp edi, eax
jb 0x46310d
lea edi, [edi + edi + 1]
lea eax, [edi - 1]
cmp ebx, eax
jbe 0x46315f
movzx eax, byte [ebp + edi - 1]
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x61b220]
not edx
mov dword [ecx], edx
pop ecx
pop ebp
pop ebx
pop edi
pop esi
ret
mov edi, 1
jmp 0x463144
mov eax, ebp
and eax, 7
je 0x463198
neg eax
and eax, 7
sub ebx, eax
movzx edi, byte [ebp]
inc ebp
xor edi, edx
and edi, 0xff
shr edx, 8
xor edx, dword [edi*4 + 0x61b220]
dec eax
jne 0x46317e
mov eax, ebx
and ebx, 7
sar eax, 3
mov dword [esp], ebx
xor edx, dword [ebp]
movzx edi, dl
mov esi, dword [ebp + 4]
add ebp, 8
mov ebx, dword [edi*4 + 0x61b620]
mov edi, edx
shr edi, 8
and edi, 0xff
xor ebx, dword [edi*4 + 0x61ba20]
mov edi, edx
shr edi, 0x10
and edi, 0xff
shr edx, 0x18
mov edi, dword [edi*4 + 0x61be20]
xor edi, dword [edx*4 + 0x61c220]
xor ebx, edi
mov edi, esi
mov edx, esi
and edx, 0xff
shr edi, 8
and edi, 0xff
mov edx, dword [edx*4 + 0x61c620]
xor edx, dword [edi*4 + 0x61ca20]
mov edi, esi
shr edi, 0x10
and edi, 0xff
shr esi, 0x18
mov edi, dword [edi*4 + 0x61ce20]
xor edi, dword [esi*4 + 0x61b220]
xor edx, edi
xor edx, ebx
dec eax
jne 0x4631a3
mov ebx, dword [esp]
jmp 0x4630fa
Function at 0x4639a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
push ebx
push ebp
push esi
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
cmp ebx, 0xf
mov ebp, dword [esp + 0x18]
mov edx, dword [ecx]
not edx
jge 0x463a30
test ebx, ebx
je 0x463a1f
mov eax, ebx
shr eax, 0x1f
add eax, ebx
sar eax, 1
test eax, eax
jbe 0x463a29
xor edi, edi
movzx esi, byte [ebp + edi*2]
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x61d6c0]
movzx esi, byte [ebp + edi*2 + 1]
inc edi
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x61d6c0]
cmp edi, eax
jb 0x4639cd
lea edi, [edi + edi + 1]
lea eax, [edi - 1]
cmp ebx, eax
jbe 0x463a1f
movzx eax, byte [ebp + edi - 1]
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x61d6c0]
not edx
mov dword [ecx], edx
pop ecx
pop ebp
pop ebx
pop edi
pop esi
ret
mov edi, 1
jmp 0x463a04
mov eax, ebp
and eax, 7
je 0x463a58
neg eax
and eax, 7
sub ebx, eax
movzx edi, byte [ebp]
inc ebp
xor edi, edx
and edi, 0xff
shr edx, 8
xor edx, dword [edi*4 + 0x61d6c0]
dec eax
jne 0x463a3e
mov eax, ebx
and ebx, 7
sar eax, 3
mov dword [esp], ebx
xor edx, dword [ebp]
movzx edi, dl
mov esi, dword [ebp + 4]
add ebp, 8
mov ebx, dword [edi*4 + 0x61dac0]
mov edi, edx
shr edi, 8
and edi, 0xff
xor ebx, dword [edi*4 + 0x61dec0]
mov edi, edx
shr edi, 0x10
and edi, 0xff
shr edx, 0x18
mov edi, dword [edi*4 + 0x61e2c0]
xor edi, dword [edx*4 + 0x61e6c0]
xor ebx, edi
mov edi, esi
mov edx, esi
and edx, 0xff
shr edi, 8
and edi, 0xff
mov edx, dword [edx*4 + 0x61eac0]
xor edx, dword [edi*4 + 0x61eec0]
mov edi, esi
shr edi, 0x10
and edi, 0xff
shr esi, 0x18
mov edi, dword [edi*4 + 0x61f2c0]
xor edi, dword [esi*4 + 0x61d6c0]
xor edx, edi
xor edx, ebx
dec eax
jne 0x463a63
mov ebx, dword [esp]
jmp 0x4639ba
Function at 0x4733a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push ebp
sub esp, 8
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
cmp edx, 0xf
mov ecx, dword [esp + 0x14]
mov ebx, dword [eax]
not ebx
jge 0x4733e6
dec edx
cmp edx, 0xffffffff
je 0x4733dc
movzx ebp, byte [ecx]
dec edx
xor ebp, ebx
inc ecx
and ebp, 0xff
shr ebx, 8
xor ebx, dword [ebp*4 + 0x621fc0]
cmp edx, 0xffffffff
jne 0x4733c0
not ebx
mov dword [eax], ebx
add esp, 8
pop ebp
pop ebx
ret
mov ebp, ecx
and ebp, 7
je 0x473413
neg ebp
and ebp, 7
mov dword [esp], esi
sub edx, ebp
movzx esi, byte [ecx]
inc ecx
xor esi, ebx
and esi, 0xff
shr ebx, 8
xor ebx, dword [esi*4 + 0x621fc0]
dec ebp
jne 0x4733f7
mov esi, dword [esp]
mov ebp, edx
and edx, 7
sar ebp, 3
mov dword [esp], esi
mov dword [esp + 4], edi
xor ebx, dword [ecx]
movzx edi, bl
mov esi, dword [ecx + 4]
add ecx, 8
mov eax, dword [edi*4 + 0x6223c0]
mov edi, ebx
shr edi, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x6227c0]
mov edi, ebx
shr edi, 0x10
and edi, 0xff
shr ebx, 0x18
mov edi, dword [edi*4 + 0x622bc0]
xor edi, dword [ebx*4 + 0x622fc0]
xor eax, edi
mov edi, esi
mov ebx, esi
and ebx, 0xff
shr edi, 8
and edi, 0xff
mov ebx, dword [ebx*4 + 0x6233c0]
xor ebx, dword [edi*4 + 0x6237c0]
mov edi, esi
shr edi, 0x10
and edi, 0xff
shr esi, 0x18
mov edi, dword [edi*4 + 0x623bc0]
xor edi, dword [esi*4 + 0x621fc0]
xor ebx, edi
xor ebx, eax
dec ebp
jne 0x473422
mov eax, dword [esp + 0x1c]
mov esi, dword [esp]
mov edi, dword [esp + 4]
jmp 0x4733ba
Function at 0x479f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x644018], 0xffffffff
je 0x479f6c
mov eax, 0x80004004
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
call edi
push str.fltlib.dll
mov esi, eax
call dword [0x648e68]
push esi
mov ebx, eax
call edi
test ebx, ebx
je 0x47a08a
mov esi, dword [0x648e40]
push str.FilterConnectCommunicationPort
push ebx
call esi
push str.FilterSendMessage
push ebx
mov edi, eax
call esi
mov dword [ebp - 0x18], eax
test edi, edi
je 0x47a06b
test eax, eax
je 0x47a06b
push 0x644018
push 0
push 0
push 0
push 0
push str.TBU_ProtectIt
call edi
mov esi, eax
test esi, esi
js 0x47a070
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x20]
mov ecx, 0x7391883b
mov esi, 4
movzx eax, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
ror ecx, 0xc
sub esi, 1
jne 0x479ff5
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
movq xmm0, qword [ebp - 0x20]
push eax
push esi
push esi
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push dword [0x644018]
mov dword [ebp - 0x10], 8
movq qword [ebp - 0xc], xmm0
call dword [ebp - 0x18]
mov esi, eax
test esi, esi
jns 0x47a070
push dword [0x644018]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
mov dword [0x644018], 0xffffffff
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
mov esi, 0x278
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov esi, 0x278
pop edi
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
Function at 0x480a10
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x480a40
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
push 0
push 0x480410
call fcn.005d21c2
add esp, 0xc
cmp eax, 0xffffffff
je 0x480a40
mov byte [esi + 0x25], 1
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x48db50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
call fcn.0048d0e0
push ebx
push 0
push 0x48dba0
call fcn.005d21c2
add esp, 0xc
cmp eax, 0xffffffff
je 0x48db97
cmp dword [ebx + 0x14], 0
jne 0x48db8b
nop dword [eax]
pause
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
je 0x48db80
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48fff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x490189
push ebx
push esi
xor esi, esi
lea ebx, [esi + 0x5f]
nop dword [eax]
call fcn.005d28ab
cdq
idiv ebx
add dl, 0x20
mov byte [ebp + esi + 8], dl
inc esi
cmp esi, 4
jb 0x490010
push 0
push edi
push 0xfde9
call fcn.0050f680
add esp, 0xc
mov dword [ebp - 8], eax
test eax, eax
je 0x490180
mov edi, eax
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x490045
sub edi, ecx
mov esi, 2
xor ecx, ecx
mov dword [ebp - 0x1c], edi
lea eax, [edi*2 + 9]
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00479f2b
mov ebx, eax
add esp, 4
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x490118
xor esi, esi
movzx eax, byte [ebp + esi + 8]
push ebx
push eax
call fcn.00518810
inc esi
add esp, 8
add ebx, 4
cmp esi, 2
jb 0x490080
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ebx
test edi, edi
je 0x4900f0
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
mov cl, byte [esi]
lea esi, [esi + 1]
mov dl, al
xor dl, cl
rol dl, 1
xor dl, ah
rol dl, 1
xor dl, byte [ebp + 0xa]
rol dl, 1
xor dl, byte [ebp + 0xb]
rol dl, 1
mov byte [ebp - 0x14], dl
push ebx
push dword [ebp - 0x14]
call fcn.00518810
mov eax, dword [ebp + 8]
add esp, 8
add ebx, 4
sub edi, 1
jne 0x4900b4
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
lea edi, [ebx + edi*4]
cmp esi, 4
jae 0x490110
movzx eax, byte [ebp + esi + 8]
push edi
push eax
call fcn.00518810
inc esi
add esp, 8
add edi, 4
cmp esi, 4
jb 0x4900f8
mov ebx, dword [ebp - 4]
mov esi, 2
push dword [ebp - 8]
call fcn.0058bb5f
add esp, 4
test ebx, ebx
je 0x490180
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x490130
sub ecx, edx
sar ecx, 1
lea edi, [ecx + 7]
xor ecx, ecx
mov eax, edi
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00479f2b
mov esi, eax
add esp, 4
test esi, esi
je 0x49016e
push ebx
push 0x5f5ec0
push edi
push esi
call fcn.00502130
add esp, 0x10
push ebx
call fcn.0058bb5f
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x490620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x490755
xor esi, esi
lea ebx, [esi + 0x5f]
nop dword [eax]
call fcn.005d28ab
cdq
idiv ebx
add dl, 0x20
mov byte [ebp + esi + 8], dl
inc esi
cmp esi, 4
jb 0x490640
push 0
push edi
push 0xfde9
call fcn.0050f680
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
je 0x490755
mov edi, eax
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x490675
sub edi, ecx
mov edx, 2
xor ecx, ecx
mov dword [ebp - 0x18], edi
lea eax, [edi*2 + 9]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00479f2b
add esp, 4
mov dword [ebp - 0x20], eax
test eax, eax
je 0x490740
mov ebx, eax
xor esi, esi
movzx eax, byte [ebp + esi + 8]
push ebx
push eax
call fcn.00518810
inc esi
add esp, 8
add ebx, 4
cmp esi, 2
jb 0x4906b0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ebx
test edi, edi
je 0x490720
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0xc]
mov cl, byte [esi]
lea esi, [esi + 1]
mov dl, al
xor dl, cl
rol dl, 1
xor dl, ah
rol dl, 1
xor dl, byte [ebp + 0xa]
rol dl, 1
xor dl, byte [ebp + 0xb]
rol dl, 1
mov byte [ebp - 0x10], dl
push ebx
push dword [ebp - 0x10]
call fcn.00518810
mov eax, dword [ebp + 8]
add esp, 8
add ebx, 4
sub edi, 1
jne 0x4906e4
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
lea edi, [ebx + edi*4]
cmp esi, 4
jae 0x490740
movzx eax, byte [ebp + esi + 8]
push edi
push eax
call fcn.00518810
inc esi
add esp, 8
add edi, 4
cmp esi, 4
jb 0x490728
push dword [ebp - 4]
call fcn.0058bb5f
mov eax, dword [ebp - 0x20]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x490760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x490770
sub ecx, edx
sar ecx, 1
cmp ecx, 8
jbe 0x490854
test cl, 1
jne 0x490854
push ebx
lea ebx, [ecx - 8]
shr ebx, 1
mov dword [ebp - 0x10], ebx
lea eax, [ebx + 1]
push eax
call fcn.00479f2b
add esp, 4
mov dword [ebp - 0xc], eax
test eax, eax
je 0x49084c
push esi
xor esi, esi
lea eax, [ebp - 8]
add eax, esi
push eax
push edi
call fcn.00518870
inc esi
add esp, 8
add edi, 4
cmp esi, 2
jb 0x4907b4
lea ebx, [edi + ebx*4]
cmp esi, 4
jae 0x4907ec
lea eax, [ebp - 8]
add eax, esi
push eax
push ebx
call fcn.00518870
inc esi
add esp, 8
add ebx, 4
cmp esi, 4
jb 0x4907d4
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
test ebx, ebx
je 0x490825
lea eax, [ebp - 1]
dec ebx
push eax
push edi
call fcn.00518870
mov al, byte [ebp - 1]
add esp, 8
add edi, 4
mov ecx, 4
nop
dec ecx
ror al, 1
xor al, byte [ebp + ecx - 8]
test ecx, ecx
jne 0x490810
mov byte [esi], al
inc esi
mov byte [ebp - 1], al
test ebx, ebx
jne 0x4907f6
mov ebx, dword [ebp - 0xc]
push 0
push ebx
push 0xfde9
mov byte [esi], 0
call fcn.0050f5d0
push ebx
mov esi, eax
call fcn.0058bb5f
add esp, 0x10
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret