joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c4d60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [0x538ae9]
test eax, eax
jne 0x4c4d85
mov eax, 4
jmp 0x4c4eb2
lea ecx, [ebp - 0x20]
push ecx
call fcn.004af400
add esp, 4
lea ecx, [ebp - 0x20]
call fcn.00480720
movzx edx, al
test edx, edx
jne 0x4c4db8
lea ecx, [ebp - 0x20]
call fcn.0041a000
push eax
call fcn.004af330
add esp, 4
movzx eax, al
test eax, eax
jne 0x4c4dcf
mov dword [ebp - 0x30], 2
lea ecx, [ebp - 0x20]
call fcn.00419fe0
mov eax, dword [ebp - 0x30]
jmp 0x4c4eb2
call fcn.004b1930
movzx ecx, al
test ecx, ecx
jne 0x4c4df2
mov dword [ebp - 0x34], 3
lea ecx, [ebp - 0x20]
call fcn.00419fe0
mov eax, dword [ebp - 0x34]
jmp 0x4c4eb2
push 0x538e3c
push 8
call fcn.004ede92
add esp, 8
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
push edx
lea ecx, [ebp - 0x24]
call fcn.00419d50
lea ecx, [ebp - 0x24]
call fcn.0044ea20
test eax, eax
je 0x4c4e37
lea ecx, [ebp - 0x24]
call fcn.004dd240
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
lea ecx, [ebp - 0x24]
call fcn.004dd240
mov dl, byte [ebp + 0xc]
mov byte [eax + 4], dl
mov dword [ebp - 0x2c], 1
push 0
push 0
lea ecx, [ebp - 0x24]
call fcn.0044ea20
push eax
push 0x4c4ec0
push 0
push 0
call fcn.004eddb8
add esp, 0x18
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4c4e99
lea ecx, [ebp - 0x24]
call fcn.004143c0
cmp dword [ebp + 0x10], 0
je 0x4c4e81
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x24]
call fcn.0046e4d0
lea ecx, [ebp - 0x20]
call fcn.00419fe0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x4c6140
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
push str.chrome.dll
lea ecx, [ebp - 0xd0]
call fcn.0049a2f0
push str.chrome_child.dll
lea ecx, [ebp - 0xb4]
call fcn.0049a2f0
push str.natives_blob.bin
lea ecx, [ebp - 0x98]
call fcn.0049a2f0
push str.icudtl.dat
lea ecx, [ebp - 0x7c]
call fcn.0049a2f0
push str.chrome_100_percent.pak
lea ecx, [ebp - 0x60]
call fcn.0049a2f0
push str.resources.pak
lea ecx, [ebp - 0x44]
call fcn.0049a2f0
push 0x52022c
lea ecx, [ebp - 0x28]
call fcn.0049a2f0
mov dword [ebp - 0x10c], 0
jmp 0x4c61d2
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x64
jge 0x4c628b
push 0x52022c
mov ecx, dword [ebp - 0x10c]
imul ecx, ecx, 0x1c
lea edx, [ebp + ecx - 0xd0]
push edx
call fcn.004c7070
add esp, 8
movzx eax, al
test eax, eax
je 0x4c6209
jmp 0x4c628b
mov ecx, dword [ebp - 0x10c]
imul ecx, ecx, 0x1c
lea edx, [ebp + ecx - 0xd0]
sub esp, 0x1c
mov ecx, esp
push edx
call fcn.0049a330
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp + 8]
call fcn.004c5d20
lea ecx, [ebp - 0x128]
call fcn.004ac010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4c627b
mov byte [ebp - 0x12d], 0
lea ecx, [ebp - 0x128]
call fcn.0049a370
push fcn.0049a370
push 7
push 0x1c
lea ecx, [ebp - 0xd0]
push ecx
call fcn.00420f80
mov al, byte [ebp - 0x12d]
jmp 0x4c6347
lea ecx, [ebp - 0x128]
call fcn.0049a370
jmp 0x4c61c3
lea edx, [ebp - 0xec]
push edx
mov ecx, dword [ebp + 8]
call fcn.004c5a40
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
call fcn.004c5bb0
lea ecx, [ebp - 0xec]
call fcn.004ac010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4c62d5
lea ecx, [ebp - 0x108]
call fcn.004ac010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c630f
mov byte [ebp - 0x12e], 1
lea ecx, [ebp - 0x108]
call fcn.0049a370
lea ecx, [ebp - 0xec]
call fcn.0049a370
push fcn.0049a370
push 7
push 0x1c
lea ecx, [ebp - 0xd0]
push ecx
call fcn.00420f80
mov al, byte [ebp - 0x12e]
jmp 0x4c6347
mov byte [ebp - 0x12f], 0
lea ecx, [ebp - 0x108]
call fcn.0049a370
lea ecx, [ebp - 0xec]
call fcn.0049a370
push fcn.0049a370
push 7
push 0x1c
lea edx, [ebp - 0xd0]
push edx
call fcn.00420f80
mov al, byte [ebp - 0x12f]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 4
Function at 0x4c63e0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
cmp dword [ebp + 0xc], 0
jne 0x4c63f3
xor al, al
jmp 0x4c655f
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4c6408
xor al, al
jmp 0x4c655f
cmp dword [ebp + 0x10], 0
je 0x4c641f
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004ebfed
add esp, 4
mov dword [ebp - 0x70], eax
jmp 0x4c6426
mov dword [ebp - 0x70], 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.004ebfed
add esp, 4
mov ecx, dword [ebp - 0x70]
lea edx, [eax + ecx + 4]
mov dword [ebp - 0x64], edx
push 0x538e3c
xor ecx, ecx
mov eax, dword [ebp - 0x64]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ef666
add esp, 8
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4c6473
xor al, al
jmp 0x4c655f
cmp dword [ebp + 0x10], 0
je 0x4c6498
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x510ad8
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004ed64c
add esp, 0x14
jmp 0x4c64b1
mov edx, dword [ebp + 0xc]
push edx
push 0x510acc
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004ed64c
add esp, 0x10
mov dword [ebp - 0x60], 0
push 0x40
push 0
lea edx, [ebp - 0x5c]
push edx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x60], 0x44
mov cx, word [ebp + 0x18]
mov word [ebp - 0x30], cx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x60]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
mov byte [ebp - 0x15], al
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x4c6543
cmp dword [ebp + 0x1c], 0
je 0x4c652f
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.004ec873
add esp, 4
mov dword [ebp - 4], 0
mov al, byte [ebp - 0x15]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4c66d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x29], 0
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.004c5a40
lea ecx, [ebp - 0x28]
call fcn.004ac010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c6707
mov byte [ebp - 0x29], 1
mov byte [ebp - 0x49], 0
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004c5bb0
lea ecx, [ebp - 0x48]
call fcn.004ac010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c672e
mov byte [ebp - 0x49], 1
mov byte [ebp - 0x4a], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360se6
lea edx, [ebp - 8]
push edx
push 0x20019
push 0
mov eax, dword [ebp - 4]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c6762
mov byte [ebp - 0x4a], 1
movzx ecx, byte [ebp - 0x49]
test ecx, ecx
je 0x4c6795
movzx edx, byte [ebp - 0x29]
test edx, edx
jne 0x4c6795
movzx eax, byte [ebp - 0x4a]
neg eax
sbb eax, eax
add eax, 3
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x48]
call fcn.0049a370
lea ecx, [ebp - 0x28]
call fcn.0049a370
mov eax, dword [ebp - 0x50]
jmp 0x4c67d3
movzx ecx, byte [ebp - 0x29]
test ecx, ecx
je 0x4c67b9
mov dword [ebp - 0x54], 1
lea ecx, [ebp - 0x48]
call fcn.0049a370
lea ecx, [ebp - 0x28]
call fcn.0049a370
mov eax, dword [ebp - 0x54]
jmp 0x4c67d3
mov dword [ebp - 0x58], 0
lea ecx, [ebp - 0x48]
call fcn.0049a370
lea ecx, [ebp - 0x28]
call fcn.0049a370
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 4
Function at 0x4c6a90
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x22c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004c5bb0
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.004ebd80
add esp, 0xc
lea ecx, [ebp - 0x22c]
call fcn.004ac010
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp + 8]
call fcn.004c67f0
push str.Software360360se6
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov byte [ebp - 0x22d], 1
lea ecx, [ebp - 0x22c]
call fcn.0049a370
mov al, byte [ebp - 0x22d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 4

Function at 0x4c6b40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push str.SoftMgrGameChrome.exe
lea eax, [ebp - 4]
push eax
call fcn.00493b60
mov ecx, eax
call fcn.00493db0
lea ecx, [ebp - 4]
call fcn.0044ea20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c6bcd
push 0
lea ecx, [ebp - 4]
call fcn.0044ea20
push eax
call fcn.0043f790
add esp, 8
test eax, eax
je 0x4c6bcd
push str.11.2.0.1041
lea ecx, [ebp - 0xc]
call fcn.0040f510
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
call fcn.004c6360
xor ecx, ecx
test eax, eax
setge cl
mov byte [ebp - 5], cl
lea ecx, [ebp - 0xc]
call fcn.004335b0
movzx edx, byte [ebp - 5]
test edx, edx
je 0x4c6bcd
mov byte [ebp - 0xd], 1
lea ecx, [ebp - 4]
call fcn.004335b0
mov al, byte [ebp - 0xd]
jmp 0x4c6bdc
mov byte [ebp - 0xe], 0
lea ecx, [ebp - 4]
call fcn.004335b0
mov al, byte [ebp - 0xe]
mov esp, ebp
pop ebp
ret 4

Function at 0x4c9a80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 9
call fcn.0041b310
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4c9ab5
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x4c9ad2
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4c9b40
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x11
call fcn.0041b310
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4c9b69
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x4c9b7a
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x4cac40
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x4cac50
mov eax, 1
jmp 0x4cacb5
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0xc3d2e1f0
mov edx, dword [ebp + 8]
mov dword [edx + 0x60], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x64], 0
xor eax, eax
pop ebp
ret
Function at 0x4e95dc
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x538e30], 0
push esi
jne 0x4e954f
call fcn.004e9475
test eax, eax
je 0x4e9592
mov eax, dword [0x538e30]
cmp eax, 1
jne 0x4e9570
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4e9592
pop esi
ret
push eax
call dword [0x538e38]
test eax, eax
jne 0x4e95da
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4e9596
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x538e30]
call dword [0x538e38]
mov edi, eax
test edi, edi
je 0x4e95bb
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4e95d7
mov edi, esi
add esi, 0xff0
push edi
push dword [0x538e30]
call dword [0x538e34]
add edi, 0x10
cmp edi, esi
jb 0x4e95c3
mov eax, edi
pop edi
pop esi
ret
jmp 0x4e953c

Function at 0x4eabb3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x533014]
jne 0x4eabbd
repz ret
jmp fcn.004f4a01

Function at 0x504ab7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004f6440
and dword [ebp - 4], 0
cmp dword [0x539c14], 0
mov ebx, eax
jne 0x504b68
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x504c19
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x504c19
push eax
call fcn.004f63ce
mov dword [esp], 0x51da08
push edi
mov dword [0x539c14], eax
call esi
push eax
call fcn.004f63ce
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x539c18], eax
call esi
push eax
call fcn.004f63ce
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x539c1c], eax
call esi
push eax
call fcn.004f63ce
pop ecx
mov dword [0x539c24], eax
test eax, eax
je 0x504b68
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004f63ce
pop ecx
mov dword [0x539c20], eax
mov eax, dword [0x539c20]
cmp eax, ebx
je 0x504bc0
cmp dword [0x539c24], ebx
je 0x504bc0
push eax
call fcn.004f6449
push dword [0x539c24]
mov esi, eax
call fcn.004f6449
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x504bc0
test edi, edi
je 0x504bc0
call esi
test eax, eax
je 0x504bb7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x504bb7
test byte [ebp - 0xc], 1
jne 0x504bc0
or dword [ebp + 0x10], 0x200000
jmp 0x504bf9
mov eax, dword [0x539c18]
cmp eax, ebx
je 0x504bf9
push eax
call fcn.004f6449
pop ecx
test eax, eax
je 0x504bf9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x504bf9
mov eax, dword [0x539c1c]
cmp eax, ebx
je 0x504bf9
push eax
call fcn.004f6449
pop ecx
test eax, eax
je 0x504bf9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x539c14]
call fcn.004f6449
pop ecx
test eax, eax
je 0x504c19
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x504c1b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405741
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x441e68], 2
jl 0x405766
movaps xmm0, xmmword [0x430480]
movaps xmmword [0x43ab80], xmm0
movaps xmm0, xmmword [0x430470]
movaps xmmword [0x43ab90], xmm0
push esi
mov esi, dword [esp + 8]
mov ecx, esi
call fcn.00405b12
xor edx, edx
mov ecx, dword [esi + 0xf4]
mov eax, dword [edx + 0x430450]
mov dword [edx + ecx], eax
add edx, 4
cmp edx, 0x20
jl 0x405774
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0xc]
xor dword [ecx + 8], eax
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0x10]
or eax, 0x2000
shl eax, 0x10
xor dword [ecx + 0xc], eax
pop esi
ret 0xc

Function at 0x405e96
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x405ec8
test dl, 7
je 0x405ec8
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x43aba0]
inc edx
mov dword [ebp + 0xc], edx
sub esi, 1
jne 0x405ea8
cmp esi, 8
jb 0x405f58
push edi
mov edi, esi
shr edi, 3
xor ebx, dword [edx]
sub esi, 8
mov edx, dword [edx + 4]
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
movzx eax, al
mov ecx, dword [ecx*4 + 0x43aba0]
xor ecx, dword [eax*4 + 0x43afa0]
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43b3a0]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x43bba0]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x43bfa0]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43c3a0]
movzx eax, dl
mov edx, dword [ebp + 0xc]
add edx, 8
mov dword [ebp + 0xc], edx
xor ecx, dword [eax*4 + 0x43b7a0]
movzx eax, bl
xor ecx, dword [eax*4 + 0x43c7a0]
mov ebx, ecx
sub edi, 1
jne 0x405ed7
pop edi
test esi, esi
je 0x405f74
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x43aba0]
inc edx
sub esi, 1
jne 0x405f5c
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x4060e1
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebx, ebx
push 0x20
pop ebp
cmp dword [esi], 2
jne 0x406138
mov eax, dword [esi + 4]
push edi
push ebx
push ebx
push ebx
push ebx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x20]
push eax
push 4
lea eax, [esp + 0x4c]
push eax
push ebp
push dword [esp + 0x58]
call fcn.004067bb
mov dword [esi + 4], ebx
mov edx, ebx
mov edi, ebx
movzx eax, byte [esp + edx + 0x10]
mov ecx, edx
and ecx, 3
shl ecx, 3
shl eax, cl
xor edi, eax
inc edx
cmp edx, ebp
jb 0x40611e
mov dword [esi + 4], edi
pop edi
cmp dword [esi], 3
jne 0x406164
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x1c]
add esi, 4
push eax
push ebp
push esi
push ebp
push dword [esp + 0x54]
call fcn.004067bb
push ebp
lea eax, [esp + 0x10]
push eax
push esi
call fcn.0041e000
add esp, 0xc
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x406564
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x264
push ebx
mov ebx, dword [esp + 0x280]
mov eax, ecx
mov dword [esp + 4], eax
cmp ebx, 0x18
ja 0x406760
push ebp
push esi
xor ebp, ebp
lea esi, [eax + 0x4b4]
push edi
mov edi, ebp
cmp dword [esi + 0x134], ebx
jne 0x4065c8
push dword [esp + 0x27c]
mov ecx, esi
call fcn.0040ddfb
test al, al
je 0x4065c8
push 0x10
push dword [esp + 0x288]
lea eax, [esi + 0x102]
push eax
call fcn.0041e94a
add esp, 0xc
test eax, eax
je 0x40676a
inc edi
add esi, 0x178
cmp edi, 4
jb 0x40658e
mov esi, 0x200
lea eax, [esp + 0x74]
push esi
push eax
push dword [esp + 0x288]
call fcn.00410973
xor eax, eax
mov ecx, ebx
inc eax
shl eax, cl
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x20]
push eax
push 0x10
push dword [esp + 0x298]
lea eax, [esp + 0x8c]
push eax
call fcn.00422130
pop ecx
push eax
lea eax, [esp + 0x90]
push eax
call fcn.004069c6
push esi
lea eax, [esp + 0x78]
push eax
call fcn.0040e029
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x27c]
push 0x40
mov ecx, dword [edx + 0xa94]
lea ebx, [edx + 0x4b4]
mov eax, ecx
and eax, 3
imul eax, eax, 0x178
add ebx, eax
lea eax, [ecx + 1]
mov dword [edx + 0xa94], eax
mov edi, ebx
mov eax, dword [esp + 0x290]
pop ecx
mov dword [ebx + 0x134], eax
lea eax, [ebx + 0x102]
rep movsd dword es:[edi], dword [esi]
push 0x10
push dword [esp + 0x288]
push eax
movsw word es:[edi], word [esi]
call fcn.0041e000
push 0x20
pop edi
push edi
lea eax, [esp + 0x24]
push eax
lea esi, [ebx + 0x112]
push esi
call fcn.0041e000
push edi
lea eax, [esp + 0x50]
push eax
lea eax, [ebx + 0x138]
push eax
call fcn.0041e000
push edi
lea eax, [esp + 0x7c]
push eax
lea eax, [ebx + 0x158]
push eax
call fcn.0041e000
add esp, 0x30
push ebp
push 1
push edi
push esi
call fcn.0040df34
cmp dword [esp + 0x290], ebp
je 0x4066ee
push edi
lea eax, [esp + 0x58]
push eax
push dword [esp + 0x298]
call fcn.0041e000
add esp, 0xc
mov esi, dword [esp + 0x294]
test esi, esi
je 0x406721
push 8
push ebp
push esi
call fcn.0041dea0
add esp, 0xc
mov al, byte [esp + ebp + 0x34]
mov ecx, ebp
and ecx, 7
xor byte [ecx + esi], al
inc ebp
cmp ebp, edi
jb 0x406705
push edi
lea eax, [esp + 0x38]
push eax
call fcn.0040e029
cmp dword [esp + 0x288], 0
je 0x406752
push dword [esp + 0x288]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push 0x100
push eax
push dword [esp + 0x284]
add ecx, 0xa9c
call fcn.0040d4d5
push edi
lea eax, [esp + 0x18]
push eax
call fcn.0040e029
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x264
ret 0x20
push 0x20
pop edi
push edi
lea eax, [esi + 0x112]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0041e000
add esp, 0xc
lea eax, [esp + 0x14]
push ebp
push ebp
push edi
push eax
call fcn.0040df34
push edi
lea eax, [esi + 0x138]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0041e000
push edi
lea eax, [esi + 0x158]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.0041e000
add esp, 0x18
jmp 0x4066d0
Function at 0x4067bb
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x1bc
push ebx
mov ebx, dword [esp + 0x1c8]
push ebp
push esi
push edi
push 0x40
pop edi
cmp ebx, edi
jbe 0x406810
lea eax, [esp + 0x164]
push eax
call fcn.0040ebf6
push ebx
push dword [esp + 0x1d4]
lea eax, [esp + 0x16c]
push eax
call fcn.0040ec3c
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x168]
push eax
call fcn.0040eb07
push 0x20
lea eax, [esp + 0x58]
pop ebx
jmp 0x406817
mov eax, dword [esp + 0x1d0]
mov ebp, dword [esp + 0x1e4]
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x406842
mov edx, dword [esp + 0x1e8]
cmp byte [edx], 0
je 0x406842
push 0x1a
pop ecx
mov esi, ebp
lea edi, [esp + 0x94]
rep movsd dword es:[edi], dword [esi]
jmp 0x4068a3
xor edx, edx
test ebx, ebx
je 0x406862
mov esi, eax
lea eax, [esp + 0x14]
sub esi, eax
lea ecx, [esp + 0x14]
add ecx, edx
mov al, byte [esi + ecx]
xor al, 0x36
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x406850
cmp ebx, edi
jae 0x40687c
mov eax, edi
lea ecx, [esp + 0x14]
sub eax, ebx
add ecx, ebx
push eax
push 0x36
push ecx
call fcn.0041dea0
add esp, 0xc
lea eax, [esp + 0x94]
push eax
call fcn.0040ebf6
push edi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x9c]
push eax
call fcn.0040ec3c
mov edx, dword [esp + 0x1e8]
test ebp, ebp
je 0x4068bd
cmp byte [edx], 0
jne 0x4068bd
push 0x1a
pop ecx
lea esi, [esp + 0x94]
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov byte [edx], 1
push dword [esp + 0x1dc]
lea eax, [esp + 0x98]
push dword [esp + 0x1dc]
push eax
call fcn.0040ec3c
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x98]
push eax
call fcn.0040eb07
mov ebp, dword [esp + 0x1ec]
test ebp, ebp
je 0x406911
mov eax, dword [esp + 0x1f0]
cmp byte [eax], 0
je 0x406911
push 0x1a
pop ecx
mov esi, ebp
lea edi, [esp + 0xfc]
rep movsd dword es:[edi], dword [esi]
jmp 0x406977
test ebx, ebx
je 0x406933
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
sub edx, eax
xor esi, esi
lea ecx, [esp + 0x14]
add ecx, esi
mov al, byte [edx + ecx]
xor al, 0x5c
inc esi
mov byte [ecx], al
cmp esi, ebx
jb 0x406921
cmp ebx, 0x40
jae 0x40694f
push 0x40
pop eax
sub eax, ebx
lea ecx, [esp + 0x14]
push eax
add ecx, ebx
push 0x5c
push ecx
call fcn.0041dea0
add esp, 0xc
lea eax, [esp + 0xfc]
push eax
call fcn.0040ebf6
push 0x40
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x104]
push eax
call fcn.0040ec3c
mov eax, dword [esp + 0x1f0]
test ebp, ebp
je 0x406991
cmp byte [eax], 0
jne 0x406991
push 0x1a
pop ecx
lea esi, [esp + 0xfc]
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov byte [eax], 1
push 0x20
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x104]
push eax
call fcn.0040ec3c
push dword [esp + 0x1e0]
lea eax, [esp + 0x100]
push eax
call fcn.0040eb07
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1bc
ret 0x24