joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4214b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x421596
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x421585
jg 0x4214f0
test edx, edx
je 0x421585
nop dword [eax]
call fcn.00424310
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x421544
jg 0x421507
test esi, esi
je 0x421544
cmp ebx, eax
jg 0x421517
jl 0x421511
cmp edi, esi
jae 0x421517
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.0042b4c0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x421569
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x42157f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x4214f0
jl 0x42157f
test edi, edi
jne 0x4214f0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4215b8
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x4215ba
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x421638
jg 0x4215cd
test esi, esi
je 0x421638
test eax, eax
jl 0x42161c
jg 0x4215d7
test ebx, ebx
je 0x42161c
cmp edi, eax
jg 0x4215e7
jl 0x4215e1
cmp esi, ebx
jae 0x4215e7
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.0042b4c0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x421638
jg 0x42161f
test esi, esi
je 0x421638
jmp 0x42161f
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x421638
push eax
push esi
push 1
push edx
call fcn.00431576
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x421650
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x421682
jl 0x421675
test ecx, ecx
jne 0x421682
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x421742
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00424330
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4216ee
jg 0x4216ad
test esi, esi
je 0x4216ee
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x4216c5
mov eax, dword [esp + 0x10]
jl 0x4216bf
cmp eax, esi
jae 0x4216c5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.0042b4c0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x42170f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x42172b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x421694
jl 0x42172b
test ecx, ecx
jne 0x421694
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x421781
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x421781
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.0042b4c0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x4217f0
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x4217a7
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x4217d9
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0043265c
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x421804
cmp edi, eax
ja 0x4217b5
test ecx, ecx
je 0x4217f0
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0043265c
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x421b70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x466124]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x421ba0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429db0
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x421bdc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x421bdc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429db0
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x421cc4
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x421c04
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x421c37
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0042e3d1
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429db0
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x421c97
sub eax, 1
je 0x421c97
sub eax, 2
jne 0x421cc4
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.0042e3d1
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429db0
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x421cb4
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00431576
add esp, 0x10
cmp edi, eax
jne 0x421cc4
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x421bc7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429db0
mov esp, ebp
pop ebp
ret 4
Function at 0x423ed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x466124]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x423f8a
cmp byte [esi + 0x3d], 0
je 0x423f8a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x423f78
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x423f40
sub eax, 1
je 0x423f44
sub eax, 2
jne 0x423f78
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429db0
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x423f61
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00431576
add esp, 0x10
cmp edi, eax
jne 0x423f78
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429db0
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429db0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00429db0
mov esp, ebp
pop ebp
ret

Function at 0x424800
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c870
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x466124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0042a1a8
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00428c3e
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4391ee
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00439064

Function at 0x440b6a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004406bd
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x15465e8d
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x14b85f5e
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401000
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edx, 1
lea ecx, [ecx]
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movsx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor edx, ecx
and edx, 0xff
cmp esi, 0x100
jl 0x401020
mov esi, 1
mov edx, 0x423aa0
lea esp, [esp]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movsx ecx, al
neg ecx
sbb ecx, ecx
add esi, esi
and ecx, 0x1b
add edx, 4
xor esi, ecx
and esi, 0xff
cmp edx, 0x423ac8
jl 0x401060
mov eax, 1
mov byte [0x4242d0], 0x63
mov byte [0x422203], 0
mov dword [ebp - 0x808], eax
mov edi, edi
mov ecx, dword [ebp + eax*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
and ecx, 0xff
mov edx, ecx
xor ebx, ecx
sar edx, 7
lea eax, [ecx + ecx]
or edx, eax
and edx, 0xff
mov esi, edx
xor ebx, edx
sar esi, 7
lea eax, [edx + edx]
or esi, eax
and esi, 0xff
mov ecx, esi
sar ecx, 7
lea eax, [esi + esi]
or ecx, eax
mov eax, dword [ebp - 0x808]
xor ecx, 0x63
and ecx, 0xff
xor ecx, esi
xor ebx, ecx
mov byte [eax + 0x4242d0], bl
mov byte [ebx + 0x4221a0], al
inc eax
mov dword [ebp - 0x808], eax
cmp eax, 0x100
jl 0x4010a0
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 0x80c], ebx
lea esp, [esp]
movzx edx, byte [esi + 0x4242d0]
mov eax, edx
and al, 0x80
movsx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
and ecx, 0xff
mov eax, ecx
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, ecx
movzx ecx, byte [esi + 0x4221a0]
mov dword [esi*4 + 0x4222a0], eax
rol eax, 8
mov dword [esi*4 + 0x4226a0], eax
rol eax, 8
mov dword [esi*4 + 0x422aa0], eax
rol eax, 8
mov dword [esi*4 + 0x422ea0], eax
test ecx, ecx
je 0x4011f3
mov ecx, dword [ebp + ecx*4 - 0x404]
mov eax, dword [ebp - 0x3cc]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e0]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d0]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x80c]
mov eax, dword [ebp + edx*4 - 0x804]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x3d8]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x4011ff
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x808], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 0x808]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x4232a0], eax
rol eax, 8
mov dword [esi*4 + 0x4236a0], eax
rol eax, 8
mov dword [esi*4 + 0x423ad0], eax
rol eax, 8
mov dword [esi*4 + 0x423ed0], eax
inc esi
cmp esi, 0x100
jl 0x401130
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a5bf
mov esp, ebp
pop ebp
ret
Function at 0x4020d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
push 0x118
lea eax, [esp + 0x14]
mov esi, edx
push 0
push eax
call fcn.00410240
add esp, 8
mov dword [0x422084], 0x422088
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.00401260
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4022bf
mov edx, dword [esp + 0x10]
mov esi, 0x422098
mov ecx, edx
mov dword [0x422080], edx
shl ecx, 4
add ecx, dword [esp + 0x14]
lea edi, [edx - 1]
mov eax, dword [ecx]
mov dword [0x422088], eax
mov eax, dword [ecx + 4]
mov dword [0x42208c], eax
mov eax, dword [ecx + 8]
mov dword [0x422090], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [0x422094], eax
test edi, edi
jle 0x4022a9
lea ebx, [ebx]
movzx eax, byte [ecx + 3]
dec edi
movzx edx, byte [eax + 0x4242d0]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x423ed0]
movzx eax, byte [eax + 0x4242d0]
xor edx, dword [eax*4 + 0x423ad0]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x4242d0]
xor edx, dword [eax*4 + 0x4236a0]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x4242d0]
xor edx, dword [eax*4 + 0x4232a0]
mov dword [esi], edx
movzx eax, byte [ecx + 4]
movzx edx, byte [eax + 0x4242d0]
movzx eax, byte [ecx + 7]
mov edx, dword [edx*4 + 0x4232a0]
movzx eax, byte [eax + 0x4242d0]
xor edx, dword [eax*4 + 0x423ed0]
movzx eax, byte [ecx + 6]
movzx eax, byte [eax + 0x4242d0]
xor edx, dword [eax*4 + 0x423ad0]
movzx eax, byte [ecx + 5]
movzx eax, byte [eax + 0x4242d0]
xor edx, dword [eax*4 + 0x4236a0]
mov dword [esi + 4], edx
movzx eax, byte [ecx + 8]
movzx edx, byte [eax + 0x4242d0]
movzx eax, byte [ecx + 0xb]
mov edx, dword [edx*4 + 0x4232a0]
movzx eax, byte [eax + 0x4242d0]
xor edx, dword [eax*4 + 0x423ed0]
movzx eax, byte [ecx + 0xa]
movzx eax, byte [eax + 0x4242d0]
xor edx, dword [eax*4 + 0x423ad0]
movzx eax, byte [ecx + 9]
movzx eax, byte [eax + 0x4242d0]
xor edx, dword [eax*4 + 0x4236a0]
mov dword [esi + 8], edx
movzx eax, byte [ecx + 0xc]
movzx edx, byte [eax + 0x4242d0]
movzx eax, byte [ecx + 0xf]
mov edx, dword [edx*4 + 0x4232a0]
movzx eax, byte [eax + 0x4242d0]
xor edx, dword [eax*4 + 0x423ed0]
movzx eax, byte [ecx + 0xe]
movzx eax, byte [eax + 0x4242d0]
xor edx, dword [eax*4 + 0x423ad0]
movzx eax, byte [ecx + 0xd]
sub ecx, 0x10
movzx eax, byte [eax + 0x4242d0]
xor edx, dword [eax*4 + 0x4236a0]
mov dword [esi + 0xc], edx
add esi, 0x10
test edi, edi
jg 0x402170
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0xc], eax
mov eax, 0x118
lea ecx, [esp + 0x10]
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec eax
jne 0x4022c8
mov ecx, dword [esp + 0x12c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a5bf
mov esp, ebp
pop ebp
ret
Function at 0x406040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x338
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x334], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
push esi
mov esi, edx
push edi
cmp eax, 0x180
jbe 0x406089
mov eax, 0xffffffc8
pop edi
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.0040a5bf
mov esp, ebp
pop ebp
ret
push 0x1a0
lea eax, [esp + 0x19c]
push 0
push eax
call fcn.00410240
push 0x118
lea eax, [esp + 0x28]
push 0
push eax
call fcn.00410240
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x1c0], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x1c1], al
mov eax, ecx
shr eax, 8
push ecx
mov byte [esp + 0x1c6], al
lea eax, [esp + 0x1cc]
push esi
push eax
mov byte [esp + 0x1cf], cl
mov byte [esp + 0x1d3], 0x30
call fcn.00411150
mov eax, dword [esp + 0x30]
add esp, 0x24
lea esi, [eax + 0x19]
mov byte [esp + eax + 0x1b0], 0x80
mov dword [esp + 0x14], esi
xor eax, eax
lea esp, [esp]
mov byte [esp + eax + 0x178], al
inc eax
cmp eax, 0x20
jl 0x406110
push ecx
lea edx, [esp + 0x17c]
lea ecx, [esp + 0x1c]
call fcn.00401260
mov cl, byte [esp + 0x19f]
add esp, 4
xor eax, eax
mov dword [esp + 0xc], eax
mov edi, edi
xorps xmm0, xmm0
mov edi, esi
movdqa xmmword [esp + 0x130], xmm0
test esi, esi
je 0x4061bc
lea esi, [esp + 0x198]
lea eax, [esp + 0x130]
sub esi, eax
xor eax, eax
lea edx, [esp + 0x130]
add edx, eax
inc eax
mov cl, byte [esi + edx]
xor byte [edx], cl
cmp eax, 0x10
jl 0x406164
add esi, 0x10
mov eax, edi
cmp edi, 0x10
mov ecx, 0x10
cmovae eax, ecx
lea ecx, [esp + 0x18]
sub edi, eax
lea eax, [esp + 0x130]
push eax
mov edx, eax
call fcn.004022f0
add esp, 4
test edi, edi
jne 0x406162
movdqa xmm0, xmmword [esp + 0x130]
mov eax, dword [esp + 0xc]
mov cl, byte [esp + 0x19b]
mov esi, dword [esp + 0x14]
movdqu xmmword [esp + eax + 0x148], xmm0
add eax, 0x10
inc cl
mov byte [esp + 0x19b], cl
mov dword [esp + 0xc], eax
cmp eax, 0x30
jl 0x406140
push ecx
lea edx, [esp + 0x14c]
lea ecx, [esp + 0x1c]
call fcn.00401260
add esp, 4
mov esi, 3
jmp 0x406200
lea eax, [esp + 0x168]
push eax
mov edx, eax
lea ecx, [esp + 0x1c]
call fcn.004022f0
mov eax, dword [esp + 0x14]
add esp, 4
movdqu xmm0, xmmword [esp + 0x168]
movdqu xmmword [eax], xmm0
add eax, 0x10
mov dword [esp + 0x10], eax
dec esi
jne 0x406200
mov eax, 0x118
lea ecx, [esp + 0x18]
lea ebx, [ebx]
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec eax
jne 0x406240
mov ecx, dword [esp + 0x33c]
pop edi
pop esi
xor ecx, esp
call fcn.0040a5bf
mov esp, ebp
pop ebp
ret
Function at 0x406260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x30
lea edi, [ebp - 0x34]
mov dword [ebp - 0x40], edx
mov eax, edi
mov dword [ebp - 0x38], ecx
push 0
push eax
call fcn.00410240
mov edx, dword [ebp - 0x38]
mov esi, 1
add esp, 0xc
mov ebx, 3
sub esi, edx
lea ecx, [edx + 0x20]
lea eax, [edx + 0xf]
mov dword [ebp - 0x3c], ecx
inc byte [eax]
jne 0x4062af
dec eax
lea ecx, [esi + eax]
test ecx, ecx
jg 0x4062a3
mov ecx, dword [ebp - 0x3c]
push edi
call fcn.004022f0
mov edx, dword [ebp - 0x38]
add esp, 4
add edi, 0x10
lea eax, [edx + 0xf]
dec ebx
jne 0x4062a3
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x34]
pop edi
pop esi
xor edx, edx
sub ecx, eax
pop ebx
lea eax, [ebp - 0x34]
add eax, edx
add edx, 0x10
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [ecx + eax]
pxor xmm1, xmm0
movdqu xmmword [eax], xmm1
cmp edx, 0x30
jl 0x4062d4
push ecx
mov ecx, dword [ebp - 0x3c]
lea edx, [ebp - 0x34]
call fcn.00401260
mov ecx, dword [ebp - 0x38]
add esp, 4
movdqu xmm0, xmmword [ebp - 0x14]
xor eax, eax
movdqu xmmword [ecx], xmm0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a5bf
mov esp, ebp
pop ebp
ret

Function at 0x406520
Capabilities:
Hash data using sha256

Disassembly:
push 0x200
push 0
push 0x425600
call fcn.00410240
mov eax, dword [0x42566c]
add esp, 0xc
mov dword [0x425600], 0
mov dword [0x425604], 0
mov dword [0x425608], 0x6a09e667
mov dword [0x42560c], 0xbb67ae85
mov dword [0x425610], 0x3c6ef372
mov dword [0x425614], 0xa54ff53a
mov dword [0x425618], 0x510e527f
mov dword [0x42561c], 0x9b05688c
mov dword [0x425620], 0x1f83d9ab
mov dword [0x425624], 0x5be0cd19
mov dword [0x425668], 0
cmp eax, 0x14
jge 0x4065e1
lea eax, [eax + eax*4]
mov dword [eax*4 + 0x425670], 0x406ac0
mov dword [eax*4 + 0x425674], 0
mov dword [eax*4 + 0x42567c], 0x20
mov dword [eax*4 + 0x425680], 1
inc dword [0x42566c]
ret