joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c340
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44c373
push esi
call fcn.0045a6e0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44c36c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44c3f9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44c3e2
mov eax, dword [esi + 8]
test eax, eax
je 0x44c397
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44c3de
cmp eax, 2
je 0x44c3e2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44c38a
cmp eax, 3
je 0x44c3bd
cmp eax, 1
jne 0x44c38a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44c38a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44c38a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044c420
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44c408
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044c420
add esp, 4
pop esi
ret

Function at 0x44cc90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x44ccb1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x44ccb1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x44ccb1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x467500
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x467566
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x467566
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x467547
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x4680a0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004681f0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x4680c0
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x4680a1
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004681f0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x4680c0
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x4680f0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x468147
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x46815d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.00468180
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x468180
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x468210
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x468259
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x4686d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48ba30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00468280
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00468300
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00468300
lea ecx, [esi + 0xc]
call fcn.0047ceb6
lea ecx, [esi + 0x10]
call fcn.0047ceb6
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0046ab30
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0046ab30
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0046ab30
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0047cf2b
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0047cf2b
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x469378
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48bc58
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x469388
call fcn.004698a0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x46946b
cmp byte [edi], 0
je 0x46946b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x4693ad
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.004680a0
test eax, eax
jne 0x4693cd
push 0x54c8cc
lea ecx, [esi + 0x38]
call fcn.0047d068
jmp 0x46946b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.004680f0
test eax, eax
jne 0x4693fc
mov ecx, esi
call fcn.004681f0
push edi
add esi, 0x38
push 0x54c8a8
push esi
call fcn.0047ae8a
add esp, 0xc
jmp 0x46946b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.0046a120
test eax, eax
je 0x469464
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.00469540
test eax, eax
jne 0x469480
push edi
lea eax, [esi + 0x38]
push 0x54c884
push eax
call fcn.0047ae8a
add esp, 0xc
mov ecx, esi
call fcn.004698a0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x469528
mov ecx, dword [0x54cb3c]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.0047ae8a
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.004681a0
test eax, eax
jne 0x4694ea
push 0x54c868
lea ecx, [esi + 0x38]
call fcn.0047d068
jmp 0x4694fa
push 0xfa
mov ecx, esi
call fcn.0046a120
test eax, eax
jne 0x469517
mov ecx, esi
call fcn.004698a0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0047cf2b
jmp 0x46946b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0047cf2b
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x47f2d2
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47f30a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047d386
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047d35e
jmp 0x47f316
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4809c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x480a06
call fcn.0048657c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x480a06
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4809fd
xor eax, eax
jmp 0x480a0e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00480a14
pop edi
pop esi
pop ebx
ret 4

Function at 0x486aac
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x486ada
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x486af8
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00486a12
jmp 0x486af8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x486af8
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00486a12
test edi, edi
mov eax, edi
jne 0x486ae2
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x402680
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test ecx, ecx
je 0x40278b
test edx, edx
je 0x40278b
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp], ecx
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4026ca
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x4026d1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x4026b0
jmp 0x4026d3
mov esi, 0x1505
jmp 0x4026d3
mov esi, ecx
mov edi, dword [esp]
mov ecx, dword [edi + 0x20]
mov ebx, ecx
sub ebx, 1
jb 0x402784
mov dword [esp + 8], edx
and ebx, esi
mov eax, ecx
or eax, 1
mov edx, ecx
or edx, 0xfffffffe
add edx, eax
mov dword [esp + 0x14], edx
mov edx, edi
mov eax, dword [edi + 4]
mov dword [esp + 0x10], eax
xor edi, edi
mov dword [esp + 4], ecx
mov dword [esp + 0xc], ebx
jmp 0x402719
inc edi
cmp ecx, edi
mov ebx, dword [esp + 0xc]
je 0x402782
mov ebp, ecx
mov eax, edi
and eax, ebx
mov ecx, edi
xor ecx, ebx
lea eax, [ecx + eax*2]
and eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov ebx, dword [ecx + eax*4]
cmp ebx, 0xffffffff
je 0x402782
mov eax, dword [edx + 8]
cmp dword [eax + ebx*4], esi
mov ecx, ebp
jne 0x402710
mov eax, dword [edx + 0xc]
mov ebp, dword [eax + ebx*4]
push ebp
call fcn.00408fd0
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x402710
push dword [esp + 0x2c]
push ebp
push dword [esp + 0x10]
call fcn.00408ff0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402710
mov eax, dword [edx + 0x10]
mov eax, dword [eax + ebx*4]
jmp 0x402784
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402ad0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x402bef
mov ecx, dword [eax + 4]
cmp ecx, 2
je 0x402be3
cmp ecx, 5
je 0x402bb3
cmp ecx, 4
jne 0x402bef
mov esi, dword [eax + 8]
cmp dword [esi + 0x18], 0
je 0x402b3d
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0xc]
push dword [eax + edi*4]
call dword [0x446b44]
add esp, 4
mov eax, dword [esi + 0x10]
push dword [eax + edi*4]
call fcn.00402ad0
add esp, 4
mov eax, edi
and eax, 1
xor edi, 1
lea edi, [edi + eax*2]
cmp edi, dword [esi + 0x18]
jb 0x402b10
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
push dword [esi + 4]
call dword [0x446b44]
add esp, 4
push dword [esi + 0xc]
call dword [0x446b44]
add esp, 4
push dword [esi + 0x10]
call dword [0x446b44]
add esp, 4
push dword [esi + 0x14]
call dword [0x446b44]
add esp, 4
push dword [esi + 8]
call dword [0x446b44]
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
jmp 0x402be0
mov esi, dword [eax + 8]
cmp dword [esi + 8], 0
je 0x402bd4
xor edi, edi
nop
nop
mov eax, dword [esi + 4]
push dword [eax + edi*4]
call fcn.00402ad0
add esp, 4
inc edi
cmp edi, dword [esi + 8]
jb 0x402bc0
push dword [esi + 4]
call dword [0x446b44]
add esp, 4
push esi
jmp 0x402be6
push dword [eax + 8]
call dword [0x446b44]
add esp, 4
pop esi
pop edi
jmp dword [0x446b44]
Function at 0x403580
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x403712
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
movzx esi, cx
shr ecx, 0x10
test edi, edi
je 0x40370b
mov edx, 0x5e6ea9af
mov eax, edi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, edi
sub ebx, eax
jmp 0x403610
add ebp, dword [esp + 8]
mov edi, dword [esp + 4]
mov eax, esi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub esi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub edi, dword [esp]
mov ebx, 0x15b0
je 0x40370b
xor eax, eax
cmp ebx, 8
mov dword [esp], ebx
mov dword [esp + 4], edi
jb 0x403688
mov eax, ebx
and eax, 0x1ff8
mov edx, 7
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ebp]
mov edi, esi
and edi, ebx
xor esi, ebx
lea esi, [esi + edi*2]
add ecx, esi
movzx edi, byte [ebp + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + 3]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + 4]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + 5]
add edi, esi
add ecx, edi
movzx ebx, byte [ebp + 6]
add ebx, edi
add ecx, ebx
movzx esi, byte [ebp + 7]
add esi, ebx
mov ebx, dword [esp]
add ecx, esi
add ebp, 8
add edx, 8
cmp edx, ebx
jb 0x403630
mov edi, dword [esp + 4]
mov edx, ebx
sub edx, eax
jbe 0x4035d8
mov dword [esp + 8], edx
mov edx, eax
or edx, 1
test bl, 1
jne 0x4036b0
mov ebx, ebp
cmp dword [esp], edx
je 0x4035d0
jmp 0x4036cd
lea ebx, [ebp + 1]
movzx eax, byte [ebp]
add esi, eax
mov eax, esi
and eax, ecx
xor ecx, esi
lea ecx, [ecx + eax*2]
mov eax, edx
cmp dword [esp], edx
je 0x4035d0
mov edx, dword [esp]
sub edx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ebx + eax]
add edi, esi
mov esi, edi
and esi, ecx
xor ecx, edi
lea ecx, [ecx + esi*2]
movzx esi, byte [ebx + eax + 1]
add esi, edi
mov edi, esi
and edi, ecx
xor ecx, esi
lea ecx, [ecx + edi*2]
add eax, 2
cmp edx, eax
jne 0x4036e0
jmp 0x4035d0
shl ecx, 0x10
or ecx, esi
jmp 0x403717
mov ecx, 1
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403730
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x403789
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x40378b
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x443a14]
mov eax, ebx
shr eax, 4
mov ebp, ebx
not ebp
or ebp, 0xf
add ebx, ebp
inc ebx
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x443a14]
inc esi
cmp edx, esi
jne 0x403750
not eax
jmp 0x40378b
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40bd60
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x13c], 0
mov dword [esi + 0x138], 0
mov dword [esi + 0x130], 0
mov dword [esi + 0x12c], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x120], 0
mov dword [esi + 0x11c], 0
mov dword [esi + 0x114], 0
mov dword [esi + 0x110], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x104], 0x3c
mov dword [esi + 0x10c], 0xffffffff
mov dword [esi + 0x118], 0xffffffff
mov dword [esi + 0x134], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44c1d8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40be41
sar edx, 1
lea edi, [esi + 0x104]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x446e08]
xor eax, eax
jmp 0x40c4b0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4162b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x4162d0
sar esi, 1
lea edi, [esp + 0x80]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x44d510]
mov ebx, dword [esp + 0x80]
test ebx, ebx
jns 0x416305
mov eax, 0xffffffff
jmp 0x416308
lea eax, [ebx + ebx]
push eax
call fcn.00408d90
add esp, 4
push edi
push ebx
mov dword [esp + 0x20], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x44d510]
mov dword [esp + 0x20], 0x439441a2
mov dword [esp + 0x24], 0x5fd15da1
mov dword [esp + 0x28], 0x5b7859d2
mov dword [esp + 0x2c], 0x57ab55b4
mov dword [esp + 0x30], 0x53dd51a4
mov dword [esp + 0x34], 0x6f9d6da9
mov dword [esp + 0x38], 0x6b686998
lea eax, [esp + 0x3c]
mov dword [esp + 8], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x43], 0
xor ecx, ecx
nop
nop
movzx ebx, byte [esp + ecx + 0x20]
lea eax, [ecx - 0x36ea0cf5]
lea edi, [ebx + ebx]
mov edx, edi
not edx
add edx, ebx
and edx, eax
or eax, ebx
lea esi, [ecx + ebx]
add esi, 0xc915f30b
xor ebx, 1
add eax, ebx
mov ebx, edx
not ebx
or ebx, 0x36ea0880
and edi, 2
not esi
add esi, eax
add esi, edi
mov edi, esi
not edi
mov eax, edx
and eax, 0x8118000
or edi, ebx
and ebx, 0x21204b88
add eax, ebx
add eax, 0xc6000445
and edx, 0xc0043477
xor edx, eax
xor edx, 0xce1b8445
xor esi, 0x293bcb88
mov eax, edx
and eax, esi
add esi, edx
add eax, eax
sub esi, eax
lea eax, [edi + edi]
not eax
add eax, edi
or eax, esi
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x90]
mov edx, 0x1b
sub edx, eax
add eax, 0x64
and edx, 0x4d
and eax, 0xb2
sub eax, edx
add al, 0x9c
mov byte [esp + ecx + 0x20], al
inc ecx
cmp ecx, 0x27
jne 0x416380
lea edi, [esp + 0xb8]
lea eax, [esp + 0x20]
mov ecx, 7
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xd4]
xor ecx, ecx
mov eax, dword [esp + 8]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x80]
mov ecx, eax
add ecx, 0xd
jns 0x416467
mov eax, 0xffffffff
jmp 0x41646e
lea eax, [eax*2 + 0x1a]
push eax
call fcn.00408d90
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x18]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x4164a1
mov eax, dword [esp + 0x18]
lea edx, [eax + 2]
mov eax, ebx
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416490
mov word [eax], 0
movzx ecx, word [esp + 0xb8]
test cx, cx
je 0x4164d1
lea edx, [esp + 0xba]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4164c0
mov word [eax], 0
lea eax, [esp + 0x64]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.004406e0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448144]
Function at 0x419470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, esp
mov ecx, dword [ebp + 0xc]
push eax
mov dword [esi + 0xc], esp
push eax
mov dword [esi + 8], esp
push eax
mov dword [esi + 0x10], esp
sub esp, 0x14
mov dword [esi + 4], esp
sub esp, 0x10
mov eax, esp
and eax, 0xfffffff8
mov dword [esi], eax
mov esp, eax
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edi + 2], 0
lea edi, [edi + 2]
jne 0x4194b0
sar edi, 1
mov ebx, dword [esi + 0xc]
push ebx
push 0
push 0
push edi
push ecx
push 0
call dword [0x44d510]
mov ebx, dword [ebx]
test ebx, ebx
jns 0x4194dc
mov eax, 0xffffffff
jmp 0x4194df
lea eax, [ebx + ebx]
push eax
call fcn.00408d90
add esp, 4
mov ecx, eax
mov eax, dword [esi + 8]
mov dword [eax], ecx
push dword [esi + 0xc]
push ebx
push ecx
push edi
mov edi, ecx
push dword [ebp + 0xc]
push 0
call dword [0x44d510]
mov ebx, dword [esi + 0x10]
push ebx
push edi
call fcn.00440950
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4484c0]
Function at 0x41bc10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov dword [esp + 8], 0xa35dad40
mov dword [esp + 0xc], 0xa72fa145
mov dword [esp + 0x10], 0xbb88a590
mov dword [esp + 0x14], 0xbf58b95c
lea eax, [esp + 0x18]
mov dword [esp], eax
mov word [esp + 0x18], 0xbdbc
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov dword [esp + 0x22], 0
mov byte [esp + 0x26], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 8]
mov eax, ecx
and eax, 4
mov edx, ecx
and edx, 2
mov esi, edx
xor esi, 2
imul esi, eax
or eax, 2
imul eax, edx
mov edx, ecx
xor edx, 0x7cc0e766
add edx, esi
add edx, eax
mov edi, ebx
mov esi, ebx
not esi
or esi, edx
mov eax, edx
and eax, ebx
xor edx, ebx
and ebx, 1
xor edi, 0x7ffffffe
lea esi, [esi + ebx*2]
sub edi, esi
mov esi, eax
and esi, 2
mov ebx, eax
or eax, 2
imul eax, esi
xor esi, 2
and ebx, 0xfffffffd
imul ebx, esi
add edx, eax
add edx, ebx
lea eax, [edx + edi*2]
add eax, 2
mov dword [esp + 4], eax
mov edx, dword [esp + 4]
mov esi, edx
not esi
and esi, 0x694653ca
lea eax, [esi + esi]
not eax
add eax, esi
and eax, edx
or edx, 0x35
and eax, 0x35
add eax, edx
inc al
mov byte [esp + ecx + 8], al
inc ecx
cmp ecx, 0x1f
jne 0x41bc70
lea edi, [esp + 0x2a]
lea ebx, [esp + 8]
mov eax, ebx
mov ecx, 4
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x3a]
mov ecx, 1
mov eax, dword [esp]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
mov edi, dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41bd40
cmp eax, 0xffffffed
jge 0x41bd57
mov eax, 0xffffffff
jmp 0x41bd5a
add eax, 0x12
push eax
call fcn.00408d90
add esp, 4
mov esi, eax
movzx ecx, word [edi]
test cx, cx
je 0x41bd91
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41bd80
mov word [eax], 0
movzx ecx, word [esp + 0x2a]
test cx, cx
je 0x41bdc1
lea edx, [esp + 0x2c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bdb0
mov word [eax], 0
push ebx
push esi
call fcn.00440950
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4485a0]