joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488eff
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, dword [esp + 0x3c]
xor ebx, ebx
cmp esi, 1
je 0x488f2f
cmp esi, 2
je 0x488f2f
cmp esi, 4
je 0x488f2f
cmp esi, 8
je 0x488f2f
cmp esi, 0x18
je 0x488f2f
cmp esi, 0x20
je 0x488f2f
xor eax, eax
jmp 0x4890f9
mov ecx, dword [0x9738a4]
push ebp
push edi
xor edi, edi
mov dword [esp + 0x10], edi
test ecx, ecx
jle 0x4890f5
mov edx, dword [esp + 0x28]
mov eax, dword [edi*4 + 0x9748c4]
cmp dword [eax], edx
je 0x488f62
inc edi
mov dword [esp + 0x10], edi
cmp edi, ecx
jl 0x488f49
jmp 0x4890f5
cmp dword [esp + 0x38], 0x20
jne 0x4890cc
mov eax, dword [eax + 8]
test eax, eax
je 0x488fa2
cmp esi, 0x20
je 0x488f7e
cmp esi, 0xffffffff
jne 0x488fa2
push esi
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call eax
jmp 0x4890f3
mov eax, dword [esp + 0x2c]
inc eax
imul ebp, eax, 3
and ebp, 0xfffffffc
mov eax, ebp
mov dword [esp + 0x14], ebp
imul eax, dword [esp + 0x30]
push eax
push 0
push dword [0x8f9998]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4890f5
mov ebx, dword [esp + 0x30]
test ebx, ebx
jle 0x489097
mov edx, dword [esp + 0x24]
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ecx
mov esi, edx
test eax, eax
jle 0x489077
mov ebp, ecx
mov edi, eax
mov ecx, 0xff
movzx eax, byte [esi + 2]
sub eax, ecx
movzx ecx, byte [esi + 3]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebp + 2], al
movzx eax, byte [esi + 1]
sub eax, ecx
movzx ecx, byte [esi + 3]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebp + 1], al
movzx eax, byte [esi]
lea esi, [esi + 4]
sub eax, ecx
movzx ecx, byte [esi - 1]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebp], al
lea ebp, [ebp + 3]
dec edi
jne 0x489008
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
add edx, dword [esp + 0x34]
add ecx, ebp
dec dword [esp + 0x24]
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], ecx
jne 0x488ff5
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x10]
mov eax, dword [edi*4 + 0x9748c4]
push esi
push dword [esp + 0x44]
mov esi, dword [esp + 0x20]
push dword [esp + 0x44]
push ebp
push ebx
push dword [esp + 0x40]
push esi
push dword [esp + 0x3c]
call dword [eax + 4]
push esi
push 0
push dword [0x8f9998]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4890f5
cmp dword [esp + 0x38], 0x18
jne 0x4890f5
push esi
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call dword [eax + 4]
mov ebx, eax
pop edi
mov eax, ebx
pop ebp
pop esi
pop ebx
add esp, 0xc
ret 0x28
Function at 0x48caa6
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x973af0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x48cb07
push esi
push dword [0x973aec]
push 8
push dword [0x8f9998]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x973af0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x973ae8]
jmp 0x48caf7
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x48caf5
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x48cae5
push edi
push 0x48ca44
call fcn.0058e081
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4

Function at 0x48cb11
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
push edi
and ecx, 3
je 0x48cb27
push 4
pop eax
sub eax, ecx
add esi, eax
mov eax, dword [0x973aec]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x48cb5e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
push 8
push dword [0x8f9998]
mov dword [0x973af0], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x973af0]
call ebx
mov eax, dword [0x973aec]
mov edi, eax
add eax, esi
push eax
push dword [0x973af0]
mov dword [0x973aec], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x8f9998]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x973af0]
call ebx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test esi, esi
jne 0x48cb9e
test ebx, ebx
je 0x48cbbf
push 0x14
push 0x973ae8
call fcn.0048d455
pop ecx
pop ecx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
test esi, esi
je 0x48cbbf
lea ecx, [edi + ebp]
push ecx
call esi
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x48d5d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x8f4304]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x48d616
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
push 0
mov edx, dword [0x974948]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x48d637
mov edx, dword [ebp - 4]
add edx, 0xa
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x974948]
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
shr edx, 1
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.0048df10
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x48d660
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x8f4304]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 2
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret

Function at 0x48d730
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x8f4304]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
add eax, dword [edx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x48d990
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x8f4304]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x48d9b4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
lea eax, [ecx + edx*2]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
sub edx, 4
cmp dword [ebp - 8], edx
jl 0x48da04
mov eax, dword [ebp - 8]
add eax, 0x4000
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x974948]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x48da4c
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0x100000
jle 0x48da4c
cmp dword [ebp - 8], 0x100000
jge 0x48da20
mov dword [ebp - 8], 0x100000
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x974948]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*2]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x48da70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x8f4304]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
sub eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x48de90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x8f4304]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x48dece
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x48dece
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x48ded0
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x48df60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x8f4304]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x48e2b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x8f4304]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x48e330
Capabilities:
Query environment variable

Disassembly:
push str.EXPAT_ENTROPY_DEBUG
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x48e394
mov ecx, 0x5b4dd8
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x48e367
test dl, dl
je 0x48e363
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x48e367
add eax, 2
add ecx, 2
test dl, dl
jne 0x48e347
xor eax, eax
jmp 0x48e36c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x48e394
push 4
push dword [esp + 0xc]
push 8
push dword [esp + 0x10]
push str.Entropy:__s_____0x_0lx___lu_bytes__n
call dword [sym.imp.MSVCRT.dll___p__iob]
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0x18
mov eax, dword [esp + 8]
ret

Function at 0x492700
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub esp, 0xc
push esi
xor esi, esi
jmp 0x492710
push 4
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x492761
mov edx, dword [esp + 4]
xor ecx, ecx
mov edi, edi
cmp esi, 4
jae 0x49274b
mov eax, edx
shr eax, cl
add ecx, 8
mov byte [esp + esi + 8], al
inc esi
cmp ecx, 0x20
jb 0x492730
cmp esi, 4
jb 0x492710
push dword [esp + 8]
push str.rand_s
call fcn.0048e330
add esp, 8
pop esi
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [esp + 8]
xor esi, dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, esi
imul eax, eax, 0x7fffffff
push eax
push str.fallback_4_
call fcn.0048e330
add esp, 8
pop esi
add esp, 0xc
ret
Function at 0x55c860
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov dword [edi], 0
cmp dword [0x8f4e38], 0
je 0x55c8b3
mov eax, dword [0x973bc0]
test eax, eax
je 0x55c888
push eax
call dword [0x8f4e88]
add esp, 4
lea eax, [esp + 0xc]
push eax
push 0x14
call fcn.0051b7d0
mov eax, dword [0x973bc0]
add esp, 8
test eax, eax
je 0x55c8ad
push eax
call dword [0x8f4e90]
mov esi, dword [esp + 0x10]
jmp 0x55c8bd
mov esi, dword [esp + 0xc]
jmp 0x55c8c0
push 0x14
call dword [0x8f4e58]
mov esi, eax
add esp, 4
test esi, esi
jne 0x55c8ca
pop edi
lea eax, [esi + 7]
pop esi
ret
cmp byte [0x8f4e3c], 0
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
je 0x55c919
mov eax, dword [0x8f4f38]
test eax, eax
je 0x55c8f4
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x55c919
lea eax, [esi + 4]
mov dword [esi + 8], ebp
push eax
push 0
push esi
push 0x55c9b0
push 0
push 0
mov dword [esi + 0xc], ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x55c929
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x55c941
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call ebp
add esp, 4
mov dword [esi + 0x10], eax
pop ebp
pop ebx
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
ret
Function at 0x58e081
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x973f00], 0
push ebx
push esi
mov esi, 0x973f08
jne 0x58e0ad
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x973f20], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x973f00], 1
push dword [0x973f20]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x58e14a
push 0x14
push 8
push dword [0x8f9998]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x58e174
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x973f04]
test eax, eax
je 0x58e0ef
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x973f04], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x58e179
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x973f20]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x8f9998]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x58e174
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x58e659
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x184
push 8
push dword [0x8f9998]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x974834]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x974838], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.0059128c
mov dword [esi + 0x58], 0x58f26c
mov eax, esi
mov dword [esi + 0x5c], 0x58f2b8
mov dword [esi + 0x10], fcn.0058ee0d
mov dword [esi + 0x30], 0x58ecff
mov dword [esi + 0x64], 0x58f342
mov dword [esi + 0x60], 0x58f2fa
mov dword [esi + 0x34], 0x58e9af
mov dword [esi + 0x24], 0x58e986
mov dword [esi + 0x28], 0x58e95b
mov dword [esi + 0x2c], 0x58e8ad
mov dword [esi + 0x44], 0x58f072
pop esi
ret 4
Function at 0x4016d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x4016e0
pop edi
pop ebx
ret

Function at 0x401710
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x401720
pop esi
pop ebp
pop ebx
ret

Function at 0x4019c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor edx, edx
push edi
cmp edx, dword [esp + 0x1c]
jae 0x401b31
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x401a4a
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x401a20
add edi, dword [esp + 8]
mov ecx, dword [esp + 0x20]
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x401a04
cmp edx, 0x10
jae 0x401acb
lea eax, [edx - 8]
mov dword [esp + 8], eax
jmp 0x401a70
cmp edx, dword [esp + 0x1c]
jae 0x401b31
or eax, 8
xor edi, edi
cmp eax, 1
je 0x401ab1
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x401a84
add edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, 0x10
jb 0x401a70
cmp edx, dword [esp + 0x1c]
jae 0x401b31
lea eax, [edx - 0x10]
mov dword [esp + 8], eax
jmp 0x401ae0
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x401b16
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x401af0
add edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, dword [esp + 0x1c]
jb 0x401ae0
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x403680
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x4036a0
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
dec dword [esp + 0xc]
jne 0x4036b0
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
cmp esi, 0x10
jb 0x4036a0
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret
Function at 0x403710
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x214
mov eax, dword [0x514d34]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
mov eax, 4
push edi
mov dword [esp + 0x18], eax
movzx ebp, byte [edx + eax + 0x306a0]
mov ecx, ebp
mov esi, ebp
and esi, 1
shr ecx, 1
dec ecx
or esi, 2
shl esi, cl
mov edi, eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x10], 0
sub edi, esi
mov ebx, 1
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x4037a8
jmp 0x40376b
mov ebp, dword [esp + 0x1c]
mov ecx, ebx
sub ecx, ebp
mov eax, edi
and eax, 1
add ecx, esi
movzx ecx, word [edx + ecx*2 + 0x32b0e]
mov ebp, eax
neg ebp
sar ebp, 4
shr ecx, 4
and ebp, 0x7f
xor ecx, ebp
mov ecx, dword [edx + ecx*4 + 0x30ea0]
add dword [esp + 0x10], ecx
add ebx, ebx
shr edi, 1
or ebx, eax
dec dword [esp + 0x14]
jne 0x403767
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x20], ecx
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x80
jb 0x403731
lea eax, [edx + 0x32910]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
sub eax, edx
lea ebp, [edx + 0x31d58]
sub eax, 0x31d50
lea edi, [edx + 0x31950]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 4
xor ebx, ebx
cmp dword [edx + 0x32594], ebx
jbe 0x40384b
jmp 0x403800
mov eax, ebx
or eax, 0x40
xor esi, esi
cmp eax, 1
je 0x40383f
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add esi, dword [edx + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x403810
mov ebp, dword [esp + 0x18]
mov dword [edi + ebx*4], esi
inc ebx
cmp ebx, dword [edx + 0x32594]
jb 0x403800
mov eax, 0xe
cmp dword [edx + 0x32594], eax
jbe 0x40386e
mov ecx, eax
shr ecx, 1
sub ecx, 5
shl ecx, 4
add dword [edi + eax*4], ecx
inc eax
cmp eax, dword [edx + 0x32594]
jb 0x403858
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov ecx, dword [edi + 4]
mov dword [ebp - 4], ecx
mov eax, dword [edi + 8]
mov dword [ebp], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp + 4], ecx
mov eax, 4
lea ecx, [ebp + 8]
lea ecx, [ecx]
movzx esi, byte [edx + eax + 0x306a0]
mov esi, dword [edi + esi*4]
mov ebx, dword [esp + 0x14]
add esi, dword [ebx + ecx]
inc eax
mov dword [ecx], esi
add ecx, 4
cmp eax, 0x80
jb 0x403890
sub dword [esp + 0x10], 0xffffff80
sub dword [esp + 0x14], 0x200
add ebp, 0x200
add edi, 0x100
dec dword [esp + 0x1c]
mov dword [esp + 0x18], ebp
jne 0x4037f1
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov dword [edx + 0x3bcf8], 0
call fcn.00441a5e
add esp, 0x214
ret
Function at 0x405d10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
push esi
mov dword [eax + 0x30], edx
mov dword [eax + 0x4c], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x2c], 0x20
mov dword [eax + 0x54], 1
mov dword [eax + 0x48], 4
mov dword [eax + 0x58], edx
lea esi, [eax + 0x70]
jmp 0x405d40
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x405d40
pop esi
ret

Function at 0x406ed0
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.004a4c2d
mov ecx, dword [esp + 0x20]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x406efb
xor eax, eax
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x406f0a
mov eax, 1
pop ecx
ret