joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406d24
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, 0x43336c
push 0x400
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
call fcn.00406efc
xor ebx, ebx
test eax, eax
je 0x406db6
mov esi, eax
push eax
call fcn.00406f71
mov eax, dword [0x40a77c]
test byte [eax], 0x80
je 0x406d67
movzx eax, word [esi]
test eax, eax
je 0x406db6
cmp eax, 0x5c
je 0x406db6
mov edi, 0x43336c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub esi, edi
sar esi, 1
cmp eax, esi
jle 0x406da1
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x43336c
call fcn.00406e41
test eax, eax
je 0x406d94
test byte [eax], 0x10
je 0x406db6
push edi
call fcn.00406ddb
push edi
call ebp
cmp eax, esi
jg 0x406d81
push edi
call fcn.00406e69
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x406e12
Capabilities:
Move file

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
push 5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406e34
push edi
push esi
call fcn.0040729c
add esp, 8
mov eax, dword [0x40a474]
inc dword [eax + 0x10]
pop esi
pop edi
ret 8

Function at 0x4070f5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove eax, ecx
push ecx
push eax
push ebx
push ecx
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop esi
pop edi
pop ebx
ret 0xc

Function at 0x407127
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x1c]
mov ebx, 0xffffff9b
mov ebp, esp
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
inc ebx
je 0x407182
mov dword [esp + 4], 0x61
mov dword [esp], 0x73006e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov edx, 0x4ec4ec4f
mul edx
shr edx, 3
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
add eax, edx
sub ecx, eax
add word [esp + 4], cx
push esi
push 0
push ebp
push dword [esp + 0x2c]
call edi
test eax, eax
je 0x40713f
jmp 0x407189
mov word [esi], 0
xor esi, esi
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x407195
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
mov edi, esp
push 0
push edi
push esi
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne al
cmp dword [edi], esi
sete cl
and cl, al
movzx eax, cl
add esp, 4
pop esi
pop edi
ret 0xc
Function at 0x4071c7
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
mov edi, esp
push 0
push edi
push esi
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
cmp dword [edi], esi
sete cl
and cl, al
movzx eax, cl
add esp, 4
pop esi
pop edi
ret 0xc

Function at 0x4071f9
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x1c]
xor ebx, ebx
push 1
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor esi, esi
inc esi
test eax, eax
jne 0x40726b
lea eax, [esp + 4]
lea ecx, [esp + 2]
push 0
push eax
push 2
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407247
cmp dword [esp + 4], 2
jne 0x407247
movzx eax, word [esp + 2]
cmp eax, 0xfeff
jne 0x407247
mov esi, ebx
jmp 0x40726b
cmp dword [esp + 0x20], 0
je 0x40725f
xor ebx, ebx
push 1
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x407276
xor eax, eax
push eax
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
ret 8
lea esi, [esp + 8]
push ebx
push esi
push 2
push 0x40a806
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esi], 2
mov ecx, 0x80004005
cmovne ebx, ecx
test eax, eax
cmove ebx, ecx
jmp 0x407243
Function at 0x40729c
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x20]
mov dword [0x434774], 0x4c
mov dword [0x434770], 0x55004e
test esi, esi
je 0x40731d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
sub esp, 0x1c
mov dword [esp + 0x14], ecx
movaps xmm0, xmmword [0x40a7a0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
push 0x434770
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x40748a
cmp eax, 0x400
jg 0x40748a
push 0x400
push 0x433f6c
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x40748a
cmp eax, 0x400
jg 0x40748a
mov esi, 0x433f6c
push esi
push 0x434770
push str._ls_ls_r_n
push 0x433b6c
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edi, eax
mov eax, dword [0x40a004]
mov eax, dword [eax]
push dword [eax + 0x128]
push esi
call fcn.00407492
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
sub esp, 0x1c
mov dword [esp + 0x14], ecx
movaps xmm0, xmmword [0x40a7b0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40748a
mov esi, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
add eax, edi
add eax, 0xa
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x407483
mov ebx, eax
mov eax, esp
push 0
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407483
cmp dword [esp], ebp
jne 0x407483
push str._Rename__r_n
push ebx
call fcn.00407066
test eax, eax
je 0x407433
add eax, 0xa
push 0x40a81d
push eax
call fcn.00407066
test eax, eax
je 0x407445
mov ecx, ebp
add ecx, ebx
cmp ecx, eax
jbe 0x40742e
mov dl, byte [ecx]
mov byte [ecx + edi], dl
lea edx, [ecx - 1]
mov ecx, edx
cmp edx, eax
ja 0x407420
sub eax, ebx
inc eax
jmp 0x407447
lea eax, [ebx + ebp]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add ebp, 0xa
mov eax, ebp
test edi, edi
je 0x40745f
mov ecx, ebx
add ecx, eax
xor eax, eax
mov dl, byte [eax + 0x433b6c]
mov byte [ecx + eax], dl
inc eax
cmp edi, eax
jne 0x407451
add ebp, edi
xor edi, edi
push edi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 4]
push edi
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407848
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor edx, edx
cmp dword [esp + 0x28], 0
mov dword [esp + 8], 0x800
setne dl
shl edx, 8
or edx, 0x20019
mov esi, esp
push esi
push edx
push ecx
push eax
call fcn.004077df
test eax, eax
jne 0x4078c2
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
push edi
push ecx
push 0
push dword [esp + 0x30]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [edi + 0x7fe], 0
test esi, esi
jne 0x4078c2
mov eax, dword [esp + 4]
add eax, 0xfffffffd
cmp eax, 0xfffffffd
ja 0x4078c7
mov word [edi], 0
add esp, 0xc
pop esi
pop edi
ret 0x14

Function at 0x4079aa
Capabilities:
Get common file path

Disassembly:
push edi
push esi
sub esp, 0x23c
mov edi, dword [esp + 0x248]
mov esi, esp
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
cmp eax, 0x105
cmovb ecx, eax
test ecx, ecx
je 0x4079e2
xor eax, eax
cmp word [esp + ecx*2 - 2], 0x5c
sete al
jmp 0x4079e5
xor eax, eax
inc eax
lea ecx, [esp + ecx*2]
lea eax, [eax*2 + 0x40a802]
push edi
push eax
push str._s_S.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add esp, 0x23c
pop esi
pop edi
ret 4

Function at 0x407ae4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
cmp dword [0x4361c4], 0
jne 0x407b20
xor eax, eax
mov edx, 8
mov esi, eax
mov edi, esi
shr edi, 1
and esi, 1
neg esi
and esi, 0xedb88320
xor esi, edi
dec edx
jne 0x407afd
mov dword [eax*4 + 0x4361c0], esi
inc eax
cmp eax, 0x100
jne 0x407af6
mov eax, dword [esp + 0x10]
test ecx, ecx
je 0x407b49
mov edx, dword [esp + 0x14]
not eax
xor esi, esi
mov bl, byte [edx + esi]
xor bl, al
movzx edi, bl
shr eax, 8
xor eax, dword [edi*4 + 0x4361c0]
inc esi
cmp ecx, esi
jne 0x407b30
not eax
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x52d6e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd0000]
push edi
jmp 0x52d6fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52d701
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d6f0
mov eax, 1
add ebx, ebx
jne 0x52d713
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52d724
jne 0x52d743
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d743
dec eax
add ebx, ebx
jne 0x52d730
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x52d708
add ebx, ebx
jne 0x52d73f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52d795
xor ecx, ecx
sub eax, 3
jb 0x52d75b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52d7ca
sar eax, 1
mov ebp, eax
jmp 0x52d766
add ebx, ebx
jne 0x52d766
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d734
inc ecx
add ebx, ebx
jne 0x52d774
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d734
add ebx, ebx
jne 0x52d781
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52d776
jne 0x52d792
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52d776
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52d7b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52d7a6
jmp 0x52d6f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52d7b4
add edi, ecx
jmp 0x52d6f6
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52d7d2
cmp byte [edi], 0x11
jne 0x52d7d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52d7d7
lea edi, [esi + 0x126000]
mov eax, dword [edi]
or eax, eax
je 0x52d84f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1751c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x175340]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52d804
mov ecx, edi
jns 0x52d833
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x175344]
or eax, eax
je 0x52d849
mov dword [ebx], eax
add ebx, 4
jmp 0x52d821
call dword [esi + 0x175354]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x52d880
cmp al, 0xef
ja 0x52d873
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x52d855
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x52d862
mov ebp, dword [esi + 0x175348]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52d8b4
sub esp, 0xffffff80
jmp 0x420577
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0xdd0dec
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdd0df6
pushal
call 0xdd0dfc
pop ebp
sub ebp, 0x10
sub ebp, 0x9d0dec
jmp 0xdd0e12
mov eax, 0x9d0dec
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cd
mov edx, 0x119a0b9e
xor byte [eax], dl
inc eax
dec ecx
jne 0xdd0e29
jmp 0xdd0e3c
adc eax, 0xa2171553
sahf
sahf
sahf
pop ds
pop ss
mov byte [0x1f9e9e9e], al
pop edi
sahf
sahf
sahf
popfd
push ebx
lcall 0x9eb6, 0x249e9e9e
sahf
sahf
imul edi, dword [ebp + ebx*4 + 0x56], 0x9e921f15
sahf
sahf
popfd
pop ebx
adc edi, edx
mov edx, 0xba9a1762
adc edi, edx
mov edx, 0xba9a1762
mul byte [esi + 4]
mov edi, 0xec6af69e
in eax, 0x9e
lahf
mov dl, 0xba
not byte [eax + 0x763aed89]
wait
sahf
sahf
sahf
ja 0xdd0e3f
sahf
sahf
sahf
retf
Function at 0x437484
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x5474de
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00437474
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00425e4c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00425a4c
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5474e5
lea eax, [ebp - 4]
call fcn.00404060
ret

Function at 0x43b2d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x43b2ed
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x43b2e6
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x43b2ff
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x43b2f8
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.0043aec8
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x43b319
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.0043afd8
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x43b39e
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x43b3bb
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.0043af58
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x43b3e4
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43b3fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x43b415
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x43b40e
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x43b429
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043adc0
test bl, bl
jne 0x43b4fc
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x646c6c
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x43b460
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x43b474
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043b2d4
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x43b4a6
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x43b455
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x43b4c9
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x43b4da
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x43b4ee
jmp 0x43b5b7
cmp bl, 1
jne 0x43b5b7
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x646cc6
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x43b51c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x43b530
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043b2d4
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x43b562
sub ebx, 6
inc dword [ebp - 8]
jne 0x43b511
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x43b589
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x43b59a
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x43b5ae
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043ae44
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x43d45c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x54d4d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404060
mov eax, dword [ebp - 4]
call fcn.00404320
mov esi, eax
test esi, esi
jle 0x43d4c0
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov bl, byte [eax + edx - 1]
xor bl, 0xa
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404248
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404328
inc dword [ebp - 8]
dec esi
jne 0x43d499
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54d4dd
lea eax, [ebp - 0xc]
call fcn.00404060
ret

Function at 0x444e04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x554e81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404060
mov eax, dword [ebp - 4]
call fcn.00404320
mov esi, eax
test esi, esi
jle 0x444e6b
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov bl, byte [eax + edx - 1]
xor bl, byte [ebp - 5]
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404248
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00404328
inc dword [ebp - 0xc]
dec esi
jne 0x444e44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x554e88
lea eax, [ebp - 0x10]
call fcn.00404060
ret

Function at 0x5641fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [esp + 4]
pushal
mov byte [esp + 4], 0xb9
pushfd
lea esi, [esi + 1]
mov byte [esp + 4], 0x26
jmp 0x5be146
rdtsc
cwde
mov ecx, dword [ebp + 0x18]
bswap dx
movsx edx, dl
mov edx, dword [ebp + 0x14]
not ax
movsx ax, bl
pushal
movsx eax, bl
mov eax, dword [ebp + 0x10]
call fcn.005ae90f
mov dword [esp], edi
jmp 0x5be8ee
jmp 0x5d0406
push ecx
mov dword [esp + 0x2c], esi
push 0xd2c4a6ee
call fcn.00570cdc
clc
bt bx, 0xa
cmc
cmp dword [ebp + 8], 0
jmp 0x5af623
cmp eax, dword [esi]
push 0x868963e
lea esp, [esp + 4]
jne 0x565672
shl eax, 1
call fcn.005a67b3
pushfd
pushal
lea esp, [esp + 0x24]
jne 0x5d5b04
pushfd
mov dword [esp], 0
pushal
call fcn.005acfc6
setle al
lahf
shl ah, cl
pushfd
mov eax, dword [ebp + 8]
cmc
push eax
cmp ch, ah
mov dword [esp + 4], ebx
stc
jmp 0x5a3d63

Function at 0x569960
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0x43
mov byte [esp + 4], al
lea esp, [esp + 0x28]
call fcn.00542390
pushal
cmp dh, 0xdc
btc bx, di
mov ebx, dword [ebp - 8]
cmp cl, cl
jmp 0x58bc1f
mov word [esp + 4], 0x56fe
bt si, 7
test eax, eax
pushal
lea esp, [esp + 0x40]
je 0x5bdea5
call fcn.005867b3

Function at 0x56c5d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xb99b1411
lea esp, [esp + 8]
je 0x5bdea5
cmp bh, ah
test ebx, 0xffff0000
pushfd
call fcn.005428b0
push ebx
call fcn.0056667d