joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405d60
Capabilities:
Query environment variable

Disassembly:
push ebp
xchg ebx, eax
mov cl, byte [esi + 0x10]
mov esi, 0x111ddc7
add byte [eax - 0x3da2a1f6], cl
adc byte [eax], al
nop
nop
nop
nop
imul edx, dword [eax - 0x6f6f6f70], 0xffffff90
nop
nop
nop
push ebp
mov ecx, esi
push ecx
push esi
push edi
call 0xd0405f0e
test eax, eax
jne 0x40a55e
cmp eax, 0x5441f3dc
adc al, 0xf
mov esi, gs
add byte [eax], al
add byte [ecx - 0x73befc7c], ah
test dword [ebp + 0xe1850f], eax
add byte [eax], al
mov dword [0x770384], 0xea0000df
adc eax, sym.imp.KERNEL32.dll_GetCommandLineW
mov esp, dword [eax*4 + 0x695074f6]
div byte [eax + edx*2 + 0x69]
fild dword [ebx]
and al, 0
test eax, eax
jne 0x405d89
push eax
push 0x406d10
push 4
call 0x40d140
add esp, 0xc
push esp
pop eax
add eax, dword [ecx]
or eax, 0x6e8453c0
add byte [0x95458d00], bl
lea eax, [ebp - 0x6b]
push ecx
push esi
call eax
mov edx, ebp
test esi, esi
je 0x405db3
mov edx, dword [ebp - 4]
jae 0x405d33
or al, 0x52
push esi
cmp ebp, eax
sub al, 0x60
add byte [ebx], bh
mov edi, dword [ecx]
or byte [ebx - 0x76a94f3c], al
add edi, edi
adc eax, 0xe540c05c
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
xor edi, edi
sar edi, 1
movsb byte es:[edi], byte [esi]
and al, 0xc1
inc eax
add byte [eax - 0x18], dl
test dword [eax], eax
add byte [eax], al
mov edi, dword [ebp + 0x10]
add esp, 0x4b
test edi, edi
je 0x405e11
lea esi, [ebx + edi*2]
add al, 0
js 0x405ddc
push esi
call [edi + 0x21]
shr dword [esi], 0
add esp, 4
mov dword [edi], eax
jmp [esi]
mov ecx, dword [eax]
pop ebx
test ecx, ecx
xchg edx, eax
push ss
call esi
ja 0x405e54
call esi
mov eax, dword [0xc7]
add byte [eax], al
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, esi
pop edi
pop esi
mov ebx, dword [esi]
pop ebp
push ecx
or al, 0
push 1
inc dword [0x78584c]
jmp 0x405db3
mov eax, dword [ebp + 0xc]
push ebx
mov esi, dword [ecx + 0x10]
push esi
invalid
lea esi, [eax + ecx - 0x4e]
cmp eax, esi
lodsb al, byte [esi]
mov bl, 0x12
push ebp
or al, 0x8a
or bh, byte [ecx]
leave
mov byte [eax], cl
je 0x40a56f
inc eax
inc edx
cmp eax, esi
jb 0x40a5b7
mov al, byte [eax]
add byte [esi + 0x5d], bl
int1
or al, 0
nop
push ebp
sbb al, 0xec
push ebx
mov ebx, dword [0x2c40c100]
adc byte [edi + 0x5c], 0x7d
or byte [edx - 0x5d], ch
push edi
call ebx
push 0xf08bcf5c
call ebx
add esp, 0x10
cmp eax, esi
jbe 0x40a5a4
mov esi, eax
outsb dx, byte [esi]
div byte [ebp + 0xe]
push 0x3a
push edi
call ebx
mov ebx, ecx
add esp, 8
test dword [edx + 0x468d0a74], edi
inc esi
add dword [edi + 0x5e], ebx
pop ebx
xchg edi, eax
pushfd
add al, 0
sub byte [ebx + 0x43], 0x5e
pop ebp
xchg edi, eax
ret 4
Function at 0x68711384
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
xchg esi, eax
or bl, byte [esi + 0x66]
nop
movsx eax, word [edx]
lea edx, [edx + 2]
lea ecx, [ecx + 4]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [ecx - 4], xmm0
sub esi, 1
jne 0x68711362
pop esi
mov esp, ebp
pop ebp
pop eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [0x69b3202c], eax
push eax
mov eax, 0x687114b3
push eax
ret

Function at 0x687a7540
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x69b32068]
test esi, esi
jle 0x687a7660
mov eax, dword [0x69b3206c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x687a7574
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x687a75f7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x687a7560
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x687a7687
mov eax, dword [0x69b3206c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x69b3206c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x687a7667
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x687a75f0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x687a7600
add dword [0x69b32068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x69b3206c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x687a75f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x687a757e
mov eax, dword [0x69b3206c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x687a79a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x69b32078
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x69b32070]
sub esp, 4
test ebx, ebx
je 0x687a79f5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x687a79ee
test esi, esi
je 0x687a79ee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x687a79d0
mov dword [esp], 0x69b32078
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x687a7d30
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x68700000], 0x5a4d
jne 0x687a7d55
mov ecx, dword [0x6870003c]
cmp dword [ecx + 0x68700000], 0x4550
lea edx, [ecx + 0x68700000]
je 0x687a7d60
ret
cmp word [ecx + 0x68700018], 0x10b
jne 0x687a7d55
push esi
movzx eax, word [ecx + 0x68700014]
push ebx
movzx esi, word [ecx + 0x68700006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x68700000
test si, si
je 0x687a7da8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x687a7d9e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x687a7daa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x687a7d90
xor eax, eax
pop ebx
pop esi
ret
Function at 0x405cb5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c56c], 0
push esi
jne 0x405cec
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405cc6
mov dword [ecx*4 + 0x42c568], eax
inc ecx
cmp ecx, 0x100
jl 0x405cc1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405d1d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c568]
xor eax, esi
inc ecx
dec edx
jne 0x405cff
pop edi
not eax
pop esi
ret 0xc

Function at 0x401d7d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
mov edx, dword [0x404050]
mov ebx, eax
add edx, eax
mov eax, 0x404054
call fcn.00401cbd
lea edx, [ebp - 4]
push edx
mov edx, esi
or dl, 0x40
mov edi, 0x4034fa
push edx
sub edi, fcn.00402ca4
push edi
xor eax, eax
push fcn.00402ca4
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x401de7
mov eax, fcn.00402ca4
mov ebx, esi
mov edx, edi
call fcn.00401cbd
mov edx, 0x1c000
mov eax, 0x404054
mov ebx, esi
call fcn.0040189d
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x401eeb
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ecx
push edx
sub esp, 0x430
xor eax, eax
mov dword [esp + 0x424], eax
mov dword [esp + 0x428], 0x14
mov eax, dword [esp + 0x424]
mov word [esp + 0x208], ax
lea eax, [esp + 0x428]
push eax
lea eax, [esp + 0x414]
push eax
push 1
push 1
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringW]
movzx eax, word [esp + 0x410]
sub eax, 0x47
mov dword [esp + 0x42c], eax
mov eax, dword [esp + 0x428]
add dword [esp + 0x42c], eax
push 0x104
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x42c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov eax, esp
push eax
call dword [sym.imp.SHLWAPI.DLL_PathFindExtensionW]
mov eax, dword [esp + 0x42c]
add esp, 0x430
pop edx
pop ecx
ret
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
inc eax
add bh, dh
adc byte [edi], dh
sbb dl, byte [edx]
inc eax
xor bh, byte [0xd3005e12]
leave
add eax, 0x40122900
add byte [ebp + 0x14], ah
add byte [di + 0x4014], al
test dword [eax + eax*2], edx
test dword [eax + eax*2], edx
add bh, bl
adc al, 0x40
add bl, dh
adc al, 0x40
add byte [esi], dl
adc eax, 0x1b000040
add dword [ebx], ebx
sbb esi, edx
sbb eax, dword [edx]
sbb ebx, dword [ebx]
salc
or byte [ebx], bl
sbb edi, dword [ecx + 0x591b1b03]
add eax, 0x7f1b9a1b
sbb ebx, dword [ebx]
sbb ebx, dword [ebx]
sbb ebx, dword [ebx]
sbb ebx, dword [ebx]
sbb ecx, dword [eax]
add ecx, dword [edx]
or ebx, dword [ebx]
or al, 0xd
push cs
sbb ecx, dword [edi]
sbb ebp, dword [ebx + 0x17]
sbb esp, dword [ebp + 0x6f]
adc ecx, esi
adc al, 0x15
push ss
pop ss
or esp, dword [esi + 0x2e]
nop
nop
nop
nop
or dh, ch
mov ah, 0x90
nop
nop
jg 0x4016de
nop
or al, 0x55
push ebp
mov ebp, esp
mov edx, dword [esi + edi*4 - 0x1cc8f275]
inc eax
mov ebp, 0x400b8350
push 0x40d274
push ecx
call dword [str._tr__s__th__s_Connect:__th__td__s__5I64d__td__td__s__5I64d__td__td__s__5I64d__td___tr__n]
mov eax, dword [0xcf4102ac]
stosb byte es:[edi], al
les eax, [edi - 0x7b]
mov ebx, 0x681e0f74
test eax, 0xff0040b5
adc eax, 0xb240c164
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
pop eax
aas
sub esp, 0xe11eb8
mov eax, dword [0xfc410278]
test eax, eax
mov eax, dword [0x4140aa]
je 0x4017bb
push 0x413c75
push eax
call 0xdce550
mov cx, word [ebx]
dec esi
add bl, cl
add byte [eax + 0x14], cl
mov edx, dword [0x411860]
push edx
push eax
call 0x1065850
mov cx, word [0x1b4117f4]
int1
or cl, bh
retf 0xb800
Function at 0x404eff
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebp, esp
jmp 0x404f0e
xor edx, edx
mov edx, dword fs:[edx + 0x30]
nop
mov edx, dword [edx + 0xc]
nop
mov edx, dword [edx + 0x14]
nop
jmp 0x404f29
movzx ecx, word [edx + 0x26]
mov esi, dword [edx + 0x28]
nop
xor edi, edi
jmp 0x404f3f
xor eax, eax
jmp 0x404f4c
lodsb al, byte [esi]
nop
cmp al, 0x61
jl 0x404f7c
jmp 0x404f61
jmp 0x404f6c
sub al, 0x20
jmp 0x404f7c
nop
ror edi, 0xd
add edi, eax
dec ecx
nop
jne 0x404f3f
nop
nop
push edx
jmp 0x404f97
push edi
nop
mov edx, dword [edx + 0x10]
jmp 0x404fa7
mov eax, dword [edx + 0x3c]
nop
add eax, edx
nop
jmp 0x404fbd
mov eax, dword [eax + 0x78]
jmp 0x404fcc
test eax, eax
jmp 0x404fdd
je 0x40516e
jmp 0x404fed
add eax, edx
nop
mov ecx, dword [eax + 0x18]
nop
jmp 0x404ffe
mov ebx, dword [eax + 0x20]
nop
push eax
nop
jmp 0x405010
add ebx, edx
nop
nop
test ecx, ecx
jmp 0x405027
je 0x40515c
nop
xor edi, edi
dec ecx
nop
jmp 0x40503d
mov esi, dword [ebx + ecx*4]
nop
jmp 0x40504e
add esi, edx
nop
jmp 0x405060
nop
jmp 0x405072
xor eax, eax
nop
ror edi, 0xd
nop
lodsb al, byte [esi]
nop
add edi, eax
cmp al, ah
jne 0x405060
nop
jmp 0x405093
jmp 0x4050a1
add edi, dword [ebp - 8]
jmp 0x4050af
cmp edi, dword [ebp + 0x24]
nop
jmp 0x4050be
jne 0x405013
pop eax
mov ebx, dword [eax + 0x24]
nop
add ebx, edx
mov cx, word [ebx + ecx*2]
nop
mov ebx, dword [eax + 0x1c]
jmp 0x4050de
add ebx, edx
jmp 0x4050ef
mov eax, dword [ebx + ecx*4]
nop
jmp 0x405101
add eax, edx
nop
jmp 0x405118
mov dword [esp + 0x24], eax
nop
pop ebx
jmp 0x405130
pop ebx
popal
nop
pop ecx
nop
jmp 0x405144
pop edx
push ecx
jmp eax
pop eax
nop
jmp 0x40516e
add byte [eax], al
invalid
nop
jmp 0x405181
pop edi
pop edx
mov edx, dword [edx]
nop
jmp 0x405196
jmp 0x404f1d
Function at 0x40225f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021cb
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406350
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 0x401cf5
lea eax, [ebp - 0x104]
push eax
call fcn.00406464
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406890
add esp, 0xc
call fcn.00401d3d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
add edx, 1
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
and eax, 0xff
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x41a3198
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
and edx, edx
je 0x41a31b6
and ecx, ecx
jle 0x41a31b6
push ebx
xor al, byte [edx]
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
shr ebx, 0x18
mov byte [edx], bl
inc edx
dec ecx
jne 0x41a31a1
pop ebx
ret

Function at 0x41a31fc
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x41a3221
and ecx, ecx
jle 0x41a3221
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x41a3223]
mov bl, byte [edx]
xor bl, al
shr ax, 8
xor ax, word [edi + ebx*2]
inc edx
dec ecx
jne 0x41a320f
pop edi
pop ebx
ret

Function at 0x41a3424
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x41a3447
and ecx, ecx
jle 0x41a3447
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x41a344d]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x41a3437
pop edi
pop ebx
ret

Function at 0x41af9a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
lea ebx, [esi + 0x1c]
mov eax, edx
lea edx, [ebx + 0x20]
mov ecx, 0x20
call sub.rtl60.bpl__System_Move_qqrpxvpvi
mov eax, dword [esi + 0x14]
dec eax
test eax, eax
jb 0x41afa8d
inc eax
mov dword [esp + 8], eax
mov dword [esp], 0
mov dword [esp + 4], 4
mov eax, 0x41d65a4
mov dword [esp + 0xc], eax
xor eax, eax
mov edx, dword [esp]
add edx, edx
mov ecx, eax
shr ecx, 1
and ecx, 1
add edx, ecx
shl edx, 7
lea ecx, [edx*8 + 0x41cf09c]
mov edx, dword [ebx + eax*4]
and edx, 0xff
mov esi, dword [ecx + edx*4]
lea edx, [eax + 1]
and edx, 0xf
xor dword [ebx + edx*4], esi
lea edx, [eax + 0xf]
and edx, 0xf
xor dword [ebx + edx*4], esi
inc eax
mov edx, dword [ebx + eax*4]
and edx, 0xff
mov esi, dword [ecx + edx*4]
lea edx, [eax + 1]
and edx, 0xf
xor dword [ebx + edx*4], esi
lea edx, [eax + 0xf]
and edx, 0xf
xor dword [ebx + edx*4], esi
inc eax
cmp eax, 0x10
jb 0x41af9ee
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
mov esi, 0x20
sub esi, edx
xor eax, eax
mov ecx, edx
mov edi, dword [ebx + eax*4]
shr edi, cl
mov ecx, esi
mov ebp, dword [ebx + eax*4]
shl ebp, cl
or edi, ebp
mov dword [ebx + eax*4], edi
inc eax
cmp eax, 0x10
jne 0x41afa58
add dword [esp + 0xc], 4
dec dword [esp + 4]
jne 0x41af9ec
inc dword [esp]
dec dword [esp + 8]
jne 0x41af9db
xor eax, eax
mov edx, 0xf
sub edx, eax
mov edx, dword [ebx + edx*4]
xor dword [ebx + eax*4], edx
inc eax
cmp eax, 8
jne 0x41afa8f
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41b3eb8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov edi, dword [0x41e5294]
mov edi, dword [edi]
mov esi, dword [ebp - 8]
mov eax, dword [esi]
call edi
mov dword [ebp - 4], eax
movzx edi, word [ebp - 2]
movzx eax, word [ebp - 4]
mov dword [ebp - 0xc], eax
mov edx, dword [0x41e5294]
mov edx, dword [edx]
mov eax, dword [esi + 4]
call edx
mov dword [ebp - 4], eax
movzx eax, word [ebp - 2]
mov dword [ebp - 0x10], eax
movzx eax, word [ebp - 4]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 4], eax
movzx edx, word [ebx]
mov eax, edi
call fcn.041b3e88
mov edi, eax
movzx eax, word [ebx + 2]
add dword [ebp - 0xc], eax
movzx eax, word [ebx + 4]
add dword [ebp - 0x10], eax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.041b3e88
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x10]
xor esi, edi
movzx edx, word [ebx + 8]
mov eax, esi
call fcn.041b3e88
mov esi, eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
add eax, esi
movzx edx, word [ebx + 0xa]
call fcn.041b3e88
add esi, eax
xor edi, eax
xor dword [ebp - 0x14], esi
xor esi, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
add ebx, 0xc
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
jne 0x41b3f06
movzx edx, word [ebx]
mov eax, edi
call fcn.041b3e88
mov word [ebp - 2], ax
mov ax, word [ebp - 0x10]
add ax, word [ebx + 2]
mov word [ebp - 4], ax
mov edi, dword [0x41e5294]
mov edi, dword [edi]
mov eax, dword [ebp - 4]
call edi
mov esi, dword [ebp - 8]
mov dword [esi], eax
mov ax, word [ebp - 0xc]
add ax, word [ebx + 4]
mov word [ebp - 2], ax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.041b3e88
mov word [ebp - 4], ax
mov ebx, dword [0x41e5294]
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call ebx
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41b462c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov esi, eax
mov edx, dword [ebp + 8]
mov edi, eax
add edi, 0x100
mov ecx, 1
xor ebx, ebx
mov eax, ecx
and al, 0xff
mov byte [esi], al
mov eax, ecx
and eax, 0xff
mov byte [edi + eax], bl
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*8]
mov ecx, 0x101
cdq
idiv ecx
mov ecx, edx
inc esi
inc ebx
cmp ebx, 0x100
jne 0x41b464f
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41b5fe4
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x41b5ffa
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x41b5ff3
mov edx, esp
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xff
mov ebx, dword [ebp - 4]
shr ebx, 8
and ebx, 0xff
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xff
mov esi, dword [ebp - 4]
shr esi, 0x18
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x20
jne 0x41b6085
movzx ecx, byte [ecx + 0x41d9700]
mov esi, dword [edx + 0xc]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x41d9600]
mov esi, dword [edx + 0xc]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x41d9600]
mov esi, dword [edx + 0xc]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x41d9700]
mov edi, dword [edx + 0xc]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x18
jl 0x41b60e2
movzx ecx, byte [ecx + 0x41d9700]
mov esi, dword [edx + 8]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x41d9700]
mov esi, dword [edx + 8]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x41d9600]
mov esi, dword [edx + 8]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x41d9600]
mov edi, dword [edx + 8]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x41d9600]
mov esi, dword [edx + 4]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x41d9700]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x41d9600]
mov esi, dword [edx + 4]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x41d9700]
mov edi, dword [edx + 4]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x41d9600]
mov esi, dword [edx]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x41d9600]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x41d9700]
mov esi, dword [edx]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x41d9700]
mov edx, dword [edx]
shr edx, 0x18
xor esi, edx
mov dword [ebp - 8], esi
mov edx, dword [ecx*4 + 0x41d9800]
xor edx, dword [ebx*4 + 0x41d9c00]
xor edx, dword [eax*4 + 0x41da000]
mov eax, dword [ebp - 8]
xor edx, dword [eax*4 + 0x41da400]
mov eax, edx
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x41b62e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
and ecx, 0xff
imul ecx, ecx, 0x1010101
xor ebx, ebx
mov esi, dword [edx + ebx*4]
xor esi, ecx
mov dword [eax + ebx*4], esi
inc ebx
cmp ebx, 0x40
jne 0x41b62f4
pop esi
pop ebx
ret