joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4541c0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4541d7
add esp, 0xfffffff0
call fcn.004039e4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041f4d8
mov eax, dword [0x47da7c]
cmp word [eax + 2], 0
jne 0x4541ff
mov eax, dword [0x47da7c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045580c
mov eax, dword [0x47db1c]
cmp word [eax + 2], 0
jne 0x454219
mov eax, dword [0x47db1c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00455a04
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x415538]
call fcn.00403650
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x415538]
call fcn.00403650
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4219a8]
call fcn.0042951c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x4543a0
mov eax, dword [0x47d990]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004298ec
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x455f74
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x47d990]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ce60
test eax, eax
je 0x45430e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408e44
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ce88
test eax, eax
je 0x454322
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404670
mov eax, dword [0x47d85c]
cmp byte [eax], 0
jne 0x454356
mov eax, ebx
call fcn.004544c8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00456150
mov eax, ebx
call fcn.00456a90
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x454396
call fcn.00403a3c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45473c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x47ec00]
cmp dword [eax + 0x30], 0
je 0x4547e6
cmp dword [ebx + 0x94], 0
jne 0x4547e0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4546cc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4547e0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4547a6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4547e0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417bd8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4547b5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4552c4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4552f9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004044f8
jmp 0x455306
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040445c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45632c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45636d
mov eax, esi
call fcn.0043c9b8
test al, al
je 0x45636d
mov eax, dword [ebx + 0x84]
call fcn.0043c6b4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45636d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043c6b4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x456fa8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x414ba4]
call fcn.00404e28
xor eax, eax
push ebp
push 0x4570ec
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x47cc8c], 0
jne 0x456ffb
mov ecx, dword [0x47d870]
mov dl, 1
mov eax, dword [0x40784c]
call fcn.0040c244
call fcn.00403e4c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402f40
mov eax, ebx
call fcn.00404c98
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4570fc
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004061b0
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404ca8
test eax, eax
jle 0x457093
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45708c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404688
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404670
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004086f8
test eax, eax
jne 0x45708c
mov ebx, 0x15
jmp 0x457098
mov ebx, 0x10
jmp 0x457098
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x47cc8c]
call fcn.00456f00
mov eax, dword [ebp - 8]
call fcn.00456f00
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004061c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4570f3
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040442c
lea eax, [ebp - 0x10]
mov edx, dword [0x414ba4]
call fcn.00404ef8
ret
Function at 0x4617a4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4617d2
mov eax, ebx
call fcn.0046225c
cmp dword [ebx + 0x3c], 0
je 0x4617cb
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x461843
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x461835
cmp dword [ebx + 8], 0
je 0x4617f4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x461806
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x461835
cmp dword [ebx + 8], 0
je 0x4617e7
cmp eax, 3
je 0x461819
dec eax
jne 0x4617e7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4617e7
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x4617e7
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x461861
cmp dword [ebx + 0x10], 0xcc
je 0x461861
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046186c
pop ebx
ret

Function at 0x476d1c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x47db08]
mov eax, dword [eax]
call fcn.00455560
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp esi, eax
ja 0x476d27
pop esi
pop ebx
ret

Function at 0x476d48
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov ebp, eax
mov bl, 1
call sub.kernel32.dll_GetTickCount
mov esi, eax
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x47db08]
mov eax, dword [eax]
call fcn.00455560
mov edx, 0xd4
mov eax, ebp
call fcn.0045b4b0
cmp ax, 1
sbb eax, eax
inc eax
test al, al
jne 0x476d94
mov edx, 0xfffffdf3
mov eax, ebp
call fcn.0045b4c4
cmp eax, 4
je 0x476da1
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp edi, eax
ja 0x476d59
xor ebx, ebx
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x476da8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x476ef7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x10], eax
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x47db08]
mov eax, dword [eax]
call fcn.00455560
lea ecx, [ebp - 0x18]
mov edx, 0xd3
mov eax, esi
call fcn.0045b660
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00404688
push edi
call sub.kernel32.dll_lstrlenA_1
test eax, eax
je 0x476e24
push edi
mov eax, dword [ebp - 0xc]
call fcn.004048b8
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x476e28
mov bl, 1
jmp 0x476e2a
xor ebx, ebx
mov eax, dword [ebp + 0x14]
push eax
call sub.kernel32.dll_lstrlenA_1
test eax, eax
je 0x476e4d
mov eax, dword [ebp - 0xc]
call fcn.004048b8
xor ecx, ecx
mov edx, dword [ebp + 0x14]
call fcn.0045e340
test eax, eax
jle 0x476e53
mov byte [ebp - 0x11], 1
jmp 0x476e57
mov byte [ebp - 0x11], 0
cmp byte [ebp + 0x10], 0
je 0x476e74
mov edx, 0xd4
mov eax, esi
call fcn.0045b4b0
cmp ax, 1
sbb eax, eax
inc eax
test al, al
jne 0x476e7a
mov byte [ebp - 0x12], 1
jmp 0x476e7e
mov byte [ebp - 0x12], 0
cmp byte [ebp + 0xc], 0
je 0x476e95
mov edx, 0xfffffdf3
mov eax, esi
call fcn.0045b4c4
cmp eax, 4
jne 0x476e99
mov al, 1
jmp 0x476e9b
xor eax, eax
cmp bl, 1
jne 0x476eb0
cmp byte [ebp - 0x11], 1
jne 0x476eb0
cmp byte [ebp - 0x12], 1
jne 0x476eb0
cmp al, 1
je 0x476ed9
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
jb 0x476ec3
mov byte [ebp - 5], 0
jmp 0x476ed9
cmp dword [ebp + 8], 0
je 0x476dda
mov eax, dword [ebp + 8]
cmp byte [eax], 1
jne 0x476dda
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476efe
lea eax, [ebp - 0x18]
call fcn.00404b24
lea eax, [ebp - 0xc]
call fcn.00404408
ret
Function at 0x477f20
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x478070
push ebx
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x477f5c
push 0x478080
lea eax, [ebp - 0x814]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x478070
push ebx
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x477f7c
push 0x478084
lea eax, [ebp - 0x414]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x478088
push ebx
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x477f9c
push 0x478098
lea eax, [ebp - 0x814]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x478088
push ebx
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x477fbc
push 0x4780c8
lea eax, [ebp - 0x414]
push eax
call sub.kernel32.dll_lstrcpyA
push 0
push 0
push 0
push 0
push 0x4780d0
call sub.wininet.dll_InternetOpenA
mov esi, eax
push 0
push 0
push 3
push 0
push 0
push 0x50
push edi
push esi
call sub.wininet.dll_InternetConnectA
mov edi, eax
push 0
push 0x80200000
push 0
push 0
push 0x478104
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
call sub.wininet.dll_HttpOpenRequestA
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_lstrlenA_1
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x814]
push eax
call sub.kernel32.dll_lstrlenA_1
push eax
lea eax, [ebp - 0x814]
push eax
push ebx
call sub.wininet.dll_HttpSendRequestA
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0x21
push ebx
call sub.wininet.dll_HttpQueryInfoA
push ebx
call sub.wininet.dll_InternetCloseHandle
push edi
call sub.wininet.dll_InternetCloseHandle
push esi
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404df0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x4a1400]
xor eax, esp
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [esp + 0x20], ecx
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
xor eax, eax
mov dword [esp + 0xc], edx
cmp ax, word [ecx + 6]
jae 0x404f46
mov eax, edx
mov dword [esp + 0x40], 0
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
movaps xmmword [esp + 0x30], xmm0
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404e70
sub eax, esi
lea ecx, [esp + 0x30]
push eax
push edx
call fcn.00412900
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x30]
mov esi, dword [esp + 0x30]
cmp ecx, 0xf
mov dword [esp + 0x18], esi
cmova eax, esi
cmp dword [esp + 0x40], 5
jne 0x404ef8
cmp dword [eax], 0x7865742e
jne 0x404ef8
cmp byte [eax + 4], 0x74
jne 0x404ef8
mov eax, dword [esp + 0xc]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x24], eax
mov edi, dword [eax + 0xc]
add edi, dword [esp + 0x14]
mov dword [esp + 0x28], edi
cmp dword [eax + 8], ecx
jbe 0x404ee3
mov esi, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
crc32 ecx, eax
cmp edx, dword [esi + 8]
jb 0x404ed0
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
movq xmm0, qword [esp + 0x24]
movq qword [edi], xmm0
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x44]
cmp ecx, 0xf
jbe 0x404f22
inc ecx
mov eax, esi
cmp ecx, 0x1000
jb 0x404f18
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404f5b
push ecx
push esi
call fcn.00483cf3
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
inc ecx
add edx, 0x28
mov dword [esp + 0x10], ecx
movzx eax, word [eax + 6]
mov dword [esp + 0xc], edx
cmp ecx, eax
jl 0x404e52
mov ecx, dword [esp + 0x5c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004839af
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x406fc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x20], 0
je 0x407099
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x499e00]
movaps xmm1, xmmword [0x49a0b0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x49a0c0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x49a0d0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x49a0e0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax - 0x79]
inc eax
xor byte [edx], cl
cmp eax, 0x1f
jb 0x407087
mov byte [esi + 0x20], 0
mov eax, esi
pop esi
ret

Function at 0x4070a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4855cd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x4a1400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov esi, dword [ebx + 8]
mov dword [ebp - 0x18], ecx
cmp byte [esi + 7], 0
je 0x407103
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x79]
inc edx
xor byte [ecx], al
cmp edx, 6
jb 0x4070f1
mov byte [esi + 7], 0
push ecx
lea eax, [esi + 6]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.00411d30
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x407123
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x34]
call fcn.00415010
mov esi, dword [ebp - 0x14]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 0xf
jbe 0x40719c
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407192
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x407192
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00483cf3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4072b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 9], 0
je 0x407329
movups xmm4, xmmword [0x499e00]
push ebx
mov esi, 0xffffff8a
mov ebx, 2
lea eax, [esi - 1]
movd xmm2, esi
lea edx, [esi - 3]
movd xmm0, eax
movd xmm3, edx
lea ecx, [esi - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + esi + 0x76]
punpcklbw xmm0, xmm0
movd xmm1, ecx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + esi + 0x76], xmm3
add esi, 4
sub ebx, 1
jne 0x4072d0
pop ebx
mov byte [edi + 9], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edi + 8]
push eax
push edi
call fcn.00411d30
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x407350
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4855cd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x4a1400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov esi, dword [ebx + 8]
mov dword [ebp - 0x18], ecx
cmp byte [esi + 0xa], 0
je 0x4073b3
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x79]
inc edx
xor byte [ecx], al
cmp edx, 9
jb 0x4073a1
mov byte [esi + 0xa], 0
push ecx
lea eax, [esi + 9]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.00411d30
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x4073d3
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x34]
call fcn.00415010
mov esi, dword [ebp - 0x14]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 0xf
jbe 0x40744c
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407442
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x407442
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00483cf3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x407470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x32], 0
je 0x407604
movaps xmm5, xmmword [0x499d90]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [0x49a0b0]
mov edx, 0xffffff8e
movups xmm4, xmmword [0x499e00]
mov dword [ebp - 8], ecx
sub edx, ebx
push esi
mov ecx, 0xffffff8c
mov dword [ebp - 4], 0xffffff87
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0xffffff8b
sub edi, ebx
mov esi, 0xffffff8d
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0xffffff83
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x30
jb 0x4074e4
mov ebx, dword [ebp - 0x20]
pop edi
pop esi
cmp eax, 0x31
jae 0x407600
lea edx, [eax + ebx]
lea ecx, [eax - 0x79]
inc eax
xor byte [edx], cl
cmp eax, 0x31
jb 0x4075f2
mov byte [ebx + 0x32], 0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4078b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x10], 0
je 0x407937
movups xmm4, xmmword [0x499e00]
push ebx
mov ebx, 0xffffff8a
mov eax, 0xc
lea ecx, [ebx - 1]
movd xmm2, ebx
lea esi, [ebx - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [ebx - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + ebx + 0x76]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + ebx + 0x76], xmm3
add ebx, 4
cmp ebx, 0xffffff96
jb 0x4078d0
pop ebx
lea edx, [edi + eax]
lea ecx, [eax - 0x79]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x407925
mov byte [edi + 0x10], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edi + 0xf]
push eax
push edi
call fcn.00411d30
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4