joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e99
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x363a2705
xor ecx, ecx
mov dword [ebp - 0xc], 0x66262630
mov dword [ebp - 8], 0x273c1367
mov word [ebp - 4], 0x2126
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414af4], al
inc ecx
cmp byte [ecx + 0x414af3], 0
jne 0x401ec0
mov eax, 0x414af4
leave
ret

Function at 0x401f0a
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414d0c], al
inc ecx
cmp byte [ecx + 0x414d0b], 0
jne 0x401f2b
mov eax, 0x414d0c
leave
ret

Function at 0x401f48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x363a2705
xor ecx, ecx
mov dword [ebp - 0xc], 0x66262630
mov dword [ebp - 8], 0x2d301b67
mov word [ebp - 4], 0x5521
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414ae4], al
inc ecx
cmp byte [ecx + 0x414ae3], 0
jne 0x401f6b
mov eax, 0x414ae4
leave
ret

Function at 0x401fb2
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414d1c], al
inc ecx
cmp byte [ecx + 0x414d1b], 0
jne 0x401fd3
mov eax, 0x414d1c
leave
ret

Function at 0x401ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x20313a18
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663039
mov dword [ebp - 8], 0x26273c13
mov word [ebp - 4], 0x5521
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414d3c], al
inc ecx
cmp byte [ecx + 0x414d3b], 0
jne 0x402013
mov eax, 0x414d3c
leave
ret

Function at 0x40205a
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414c94], al
inc ecx
cmp byte [ecx + 0x414c93], 0
jne 0x40207b
mov eax, 0x414c94
leave
ret

Function at 0x402098
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x20313a18
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663039
mov dword [ebp - 8], 0x212d301b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414d74], al
inc ecx
cmp byte [ecx + 0x414d73], 0
jne 0x4020b9
mov eax, 0x414d74
leave
ret
Function at 0x402100
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414b50], al
inc ecx
cmp byte [ecx + 0x414b4f], 0
jne 0x402121
mov eax, 0x414b50
leave
ret

Function at 0x40213e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x263a3916
xor ecx, ecx
mov dword [ebp - 8], 0x3b341d30
mov dword [ebp - 4], 0x55303931
mov al, byte [ebp + ecx - 0xc]
xor al, 0x55
mov byte [ecx + 0x414a44], al
inc ecx
cmp byte [ecx + 0x414a43], 0
jne 0x40215b
mov eax, 0x414a44
leave
ret

Function at 0x4021a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x26263018
xor ecx, ecx
mov dword [ebp - 8], 0x17303234
mov dword [ebp - 4], 0x55142d3a
mov al, byte [ebp + ecx - 0xc]
xor al, 0x55
mov byte [ecx + 0x414b34], al
inc ecx
cmp byte [ecx + 0x414b33], 0
jne 0x4021be
mov eax, 0x414b34
leave
ret

Function at 0x4028f5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x402918
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x4029d8
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x40293e
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x402943
xor ecx, ecx
mov dword [ebp - 8], eax
mov eax, ecx
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x4029a4
jg 0x402958
test esi, esi
je 0x4029a4
test ecx, ecx
jl 0x40299f
jg 0x402962
test eax, eax
je 0x40299f
cmp edi, ecx
jg 0x402974
jl 0x40296c
cmp esi, eax
jae 0x402974
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
mov eax, dword [ebp - 8]
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [ebp - 4]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x4029a7
mov ecx, dword [ebp + 8]
jmp 0x4029b1
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x4029cc
jg 0x4029b1
test esi, esi
je 0x4029cc
cmp dword [ebx + 0x4c], 0
je 0x4029cc
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4029dd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
test esi, esi
jg 0x4029ff
jl 0x4029f6
test ebx, ebx
jne 0x4029ff
xor eax, eax
xor edx, edx
jmp 0x402ac3
cmp dword [ecx + 0x38], 0
je 0x402a15
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x402ac3
mov eax, dword [ecx + 0x1c]
push edi
mov edi, ebx
mov edx, dword [eax]
test edx, edx
je 0x402a55
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x402a55
cmp dword [eax], ebx
mov esi, ebx
cmovb esi, dword [eax]
push esi
push edx
push dword [ebp + 8]
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
mov ecx, dword [ebp - 4]
sub edi, esi
add dword [ebp + 8], esi
add esp, 0xc
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
jmp 0x402a5b
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
cmp dword [ecx + 0x4c], 0
je 0x402ab9
call fcn.0040302b
mov edx, dword [ebp + 8]
mov eax, edi
cmp edi, 0xfff
jbe 0x402aa3
push dword [ecx + 0x4c]
push 0xfff
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, dword [ebp + 8]
mov ecx, 0xfff
add edx, eax
add esp, 0x10
sub edi, eax
mov dword [ebp + 8], edx
cmp eax, ecx
jne 0x402ab9
cmp edi, ecx
mov ecx, dword [ebp - 4]
ja 0x402a73
mov eax, edi
test eax, eax
je 0x402ab9
push dword [ecx + 0x4c]
push edi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x402d1c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x402d38
xor eax, eax
jmp 0x402df8
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x402d5c
mov ecx, dword [esi + 0x30]
mov ecx, dword [ecx]
add ecx, dword [eax]
cmp dword [eax], ecx
jae 0x402d5c
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x402df8
cmp dword [esi + 0x4c], 0
je 0x402df6
mov ecx, esi
call fcn.0040302b
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x402d8a
movsx eax, bl
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
pop ecx
pop ecx
cmove ebx, edi
jmp 0x402d55
lea eax, [ebp + 8]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x402dc5
sub eax, 1
je 0x402dc5
dec eax
sub eax, 1
jne 0x402df6
movsx eax, byte [ebp - 1]
jmp 0x402d77
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
sub eax, ecx
mov dword [ebp - 8], eax
je 0x402de9
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 8], eax
jne 0x402df6
lea eax, [ebp - 1]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0xc], eax
cmovne edi, ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40307b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x4030c9
cmp byte [esi + 0x3d], bl
je 0x4030c9
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4030f9
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, ebx
je 0x4030d0
sub eax, 1
je 0x4030d3
dec eax
sub eax, 1
jne 0x4030f9
mov byte [esi + 0x3d], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4030f1
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4030f9
cmp byte [esi + 0x3d], bl
sete al
jmp 0x4030cb
xor al, al
jmp 0x4030cb
Function at 0x404232
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0x6536257b
xor ecx, ecx
mov word [ebp - 4], 0x5565
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 8]
xor al, 0x55
mov byte [ecx + 0x414db8], al
inc ecx
cmp byte [ecx + 0x414db7], 0
jne 0x40424a
mov eax, 0x414db8
leave
ret

Function at 0x404267
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0x6536257b
xor ecx, ecx
mov word [ebp - 4], 0x5564
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 8]
xor al, 0x55
mov byte [ecx + 0x414dd0], al
inc ecx
cmp byte [ecx + 0x414dcf], 0
jne 0x40427f
mov eax, 0x414dd0
leave
ret

Function at 0x40429c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0x6536257b
xor ecx, ecx
mov word [ebp - 4], 0x5567
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 8]
xor al, 0x55
mov byte [ecx + 0x414dc0], al
inc ecx
cmp byte [ecx + 0x414dbf], 0
jne 0x4042b4
mov eax, 0x414dc0
leave
ret

Function at 0x4042d1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0x6531257b
xor ecx, ecx
mov word [ebp - 4], 0x5565
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 8]
xor al, 0x55
mov byte [ecx + 0x414dd8], al
inc ecx
cmp byte [ecx + 0x414dd7], 0
jne 0x4042e9
mov eax, 0x414dd8
leave
ret

Function at 0x404306
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0x6531257b
xor ecx, ecx
mov word [ebp - 4], 0x5564
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 8]
xor al, 0x55
mov byte [ecx + 0x414de0], al
inc ecx
cmp byte [ecx + 0x414ddf], 0
jne 0x40431e
mov eax, 0x414de0
leave
ret

Function at 0x40433b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0x2d30217b
xor ecx, ecx
mov word [ebp - 4], 0x5521
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 8]
xor al, 0x55
mov byte [ecx + 0x414dc8], al
inc ecx
cmp byte [ecx + 0x414dc7], 0
jne 0x404353
mov eax, 0x414dc8
leave
ret

Function at 0x404aa8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
add eax, 0x10
push edi
push 0x10
mov dword [ebp - 4], ecx
mov edx, eax
mov dword [ebp - 8], eax
pop ebx
mov cl, byte [esi]
mov al, byte [edx]
xor al, cl
mov byte [edx + 0x10], cl
inc esi
mov byte [edx + 0x20], al
inc edx
sub ebx, 1
jne 0x404ac4
mov ebx, dword [ebp - 8]
xor eax, eax
mov edi, dword [ebp - 4]
mov ecx, eax
push 0x30
mov edx, ebx
pop esi
mov al, byte [eax + edi]
xor byte [edx], al
movzx eax, byte [edx]
inc edx
sub esi, 1
jne 0x404ae6
add eax, ecx
inc ecx
movzx eax, al
cmp ecx, 0x12
jl 0x404ae1
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x10
pop esi
movzx edx, byte [eax + 0x4f]
lea ecx, [eax + 0x40]
movzx eax, byte [edi]
xor eax, edx
mov edx, dword [ebp - 4]
mov al, byte [eax + edx]
xor byte [ecx], al
inc edi
movzx edx, byte [ecx]
inc ecx
sub esi, 1
jne 0x404b0f
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x404b2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
cmp dword [ebp + 0xc], 0
jle 0x404c9d
lea eax, [ecx + 8]
mov dword [ebp - 0x34], eax
lea eax, [ecx + 0x190]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x134]
push esi
sub eax, ebx
push edi
mov dword [ebp - 8], eax
push 0x10
pop esi
add eax, ebx
push eax
push ebx
call fcn.00404e3d
mov eax, dword [ebp - 8]
add ebx, 4
sub esi, 1
jne 0x404b63
push 0x30
mov dword [ebp + 8], ebx
lea edi, [ebp - 0x130]
pop ebx
mov ecx, dword [edi]
mov esi, ecx
mov edx, dword [edi + 0x34]
lea edi, [edi + 4]
mov eax, ecx
ror esi, 0x12
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
ror eax, 0x11
ror ecx, 0x13
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [edi + 0x1c]
add esi, dword [edi - 8]
mov dword [edi + 0x38], esi
sub ebx, 1
jne 0x404b83
mov esi, dword [ebp - 0x10]
lea edi, [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov ebx, dword [ebp + 8]
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esi
mov edx, dword [ebp - 0x20]
mov edi, edx
ror edi, 0x19
mov eax, edx
ror eax, 0xb
mov ecx, edx
xor edi, eax
not ecx
and ecx, dword [ebp - 0x18]
mov eax, edx
ror eax, 6
xor edi, eax
mov eax, dword [ebp - 0x1c]
and eax, edx
xor ecx, eax
mov eax, dword [ebp - 4]
add edi, ecx
add dword [ebp - 4], 4
add edi, dword [ebp + esi*4 - 0x134]
mov esi, dword [ebp - 0x2c]
add edi, dword [eax]
add edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add eax, edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
mov ecx, eax
mov dword [ebp - 0x2c], eax
ror eax, 0xd
ror ecx, 0x16
xor ecx, eax
mov eax, dword [ebp - 0x30]
ror eax, 2
xor ecx, eax
mov eax, esi
xor eax, edx
and esi, edx
and eax, dword [ebp - 0x30]
add ecx, edi
xor eax, esi
mov esi, dword [ebp - 0xc]
add eax, ecx
inc esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xc], esi
cmp esi, 0x40
jl 0x404bd6
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp + ecx*4 - 0x30]
add dword [edx], eax
inc ecx
lea edx, [edx + 4]
cmp ecx, 8
jl 0x404c78
mov eax, dword [ebp - 8]
sub eax, 0x40
sub dword [ebp + 0xc], 1
mov dword [ebp - 8], eax
jne 0x404b60
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x404e6a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
cmp dword [ebp + 0xc], 0
jle 0x404fda
lea eax, [ecx + 8]
mov dword [ebp - 0x34], eax
lea eax, [ecx + 0x190]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x134]
push esi
sub eax, ebx
push edi
mov dword [ebp - 8], eax
push 0x10
pop esi
add eax, ebx
push eax
push ebx
call fcn.0040517a
mov eax, dword [ebp - 8]
add ebx, 4
sub esi, 1
jne 0x404ea0
push 0x30
mov dword [ebp + 8], ebx
lea edi, [ebp - 0x130]
pop ebx
mov ecx, dword [edi]
mov esi, ecx
mov edx, dword [edi + 0x34]
lea edi, [edi + 4]
mov eax, ecx
ror esi, 0x12
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
ror eax, 0x11
ror ecx, 0x13
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [edi + 0x1c]
add esi, dword [edi - 8]
mov dword [edi + 0x38], esi
sub ebx, 1
jne 0x404ec0
mov esi, dword [ebp - 0x10]
lea edi, [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov ebx, dword [ebp + 8]
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esi
mov edx, dword [ebp - 0x20]
mov edi, edx
ror edi, 0x19
mov eax, edx
ror eax, 0xb
mov ecx, edx
xor edi, eax
not ecx
and ecx, dword [ebp - 0x18]
mov eax, edx
ror eax, 6
xor edi, eax
mov eax, dword [ebp - 0x1c]
and eax, edx
xor ecx, eax
mov eax, dword [ebp - 4]
add edi, ecx
add dword [ebp - 4], 4
add edi, dword [ebp + esi*4 - 0x134]
mov esi, dword [ebp - 0x2c]
add edi, dword [eax]
add edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add eax, edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
mov ecx, eax
mov dword [ebp - 0x2c], eax
ror eax, 0xd
ror ecx, 0x16
xor ecx, eax
mov eax, dword [ebp - 0x30]
ror eax, 2
xor ecx, eax
mov eax, esi
xor eax, edx
and esi, edx
and eax, dword [ebp - 0x30]
add ecx, edi
xor eax, esi
mov esi, dword [ebp - 0xc]
add eax, ecx
inc esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xc], esi
cmp esi, 0x40
jl 0x404f13
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp + ecx*4 - 0x30]
add dword [edx], eax
inc ecx
lea edx, [edx + 4]
cmp ecx, 8
jl 0x404fb5
mov eax, dword [ebp - 8]
sub eax, 0x40
sub dword [ebp + 0xc], 1
mov dword [ebp - 8], eax
jne 0x404e9d
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x407dd3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00401029
push 0x10
push dword [ebp + 0x14]
lea eax, [ebp - 0x10]
push eax
call fcn.00401220
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x14], 0x20
lea edi, [eax + 0x2f0]
lea ebx, [eax + 0x2e8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx]
mov esi, dword [ebp - 0xc]
xor eax, ecx
ror edx, 9
sub edx, eax
mov dword [ebp - 0x20], ecx
xor edx, dword [edi - 4]
mov eax, dword [edi]
mov ecx, dword [ebp - 8]
xor eax, edx
ror esi, 0x1b
sub esi, eax
ror ecx, 0x1d
xor esi, dword [edi + 4]
mov eax, dword [edi + 8]
xor eax, esi
mov dword [ebp - 0x1c], edx
sub ecx, eax
mov dword [ebp - 0x18], esi
xor ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], ecx
call fcn.00401029
push 0x10
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00401220
sub dword [ebp + 0x14], 1
lea ebx, [ebx - 0x18]
lea edi, [edi - 0x18]
jne 0x407e05
pop edi
pop esi
pop ebx
call fcn.00401029
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
call fcn.00401220
leave
ret 0x10
Function at 0x4fb000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
cmp dword [0x4fe154], 0
jne 0x4fb087
push 0x14
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004fbb28
add esp, 0xc
mov byte [ebp - 0x1c], 0x47
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x16], 0x46
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x19], 0x62
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x13], 0x65
mov eax, dword [0x4fe158]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [fcn.004fe14c]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4fb075
mov eax, dword [ebp - 0x20]
mov dword [0x4fe154], eax
push 0x14
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004fbb28
add esp, 0xc
jmp 0x4fb08f
mov eax, dword [0x4fe154]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4fb0a4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4fb0a9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004fbb28
add esp, 0xc
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x43
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x50
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0x49
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x4fe158]
push eax
call dword [fcn.004fe14c]
mov dword [ebp - 4], eax
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004fbb28
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4fb142
call dword [ebp - 4]
jmp 0x4fb149
mov eax, 1
jmp 0x4fb149
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4fb26a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov byte [ebp - 0x14], 0x45
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0x13], 0x78
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 8], 0
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 9], 0
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], 0x73
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x4fe158]
push eax
call dword [fcn.004fe14c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4fb2c2
jmp 0x4fb2c9
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 4