joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402b10
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov esi, ecx
test esi, esi
mov edi, eax
mov dword [esp], edx
je 0x402cc8
mov eax, dword [edi + 0xc]
test eax, eax
je 0x402b4b
dec eax
je 0x402b35
dec eax
je 0x402b41
jmp 0x402b4b
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x402b4b
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x402b9d
xor ebp, ebp
cmp esi, ebp
jle 0x402bb9
push 0
lea eax, [esp + 8]
push eax
mov edx, esi
sub edx, ebp
cmp edx, 0x4000
jge 0x402b70
mov ecx, esi
sub ecx, ebp
jmp 0x402b75
mov ecx, 0x4000
push ecx
mov eax, dword [esp + 0xc]
add eax, ebp
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x402bb9
add ebp, 0x4000
cmp esi, ebp
jg 0x402b57
jmp 0x402bb9
push 0
lea eax, [esp + 8]
push eax
push esi
push dword [esp + 0xc]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
jne 0x402cc4
cmp byte [edi + 0x14], 0
je 0x402cc4
cmp dword [edi + 0xc], 0
jne 0x402cc4
call sub.KERNEL32.DLL_GetLastError
mov ebp, eax
mov eax, edi
call fcn.00402eec
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lea eax, [edi + 0x17]
call fcn.00403574
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
push ebp
call sub.KERNEL32.DLL_SetLastError
mov eax, esi
cdq
cmp edx, dword [esp + 0x14]
jne 0x402c12
cmp eax, dword [esp + 0x10]
jae 0x402c5e
jmp 0x402c14
jge 0x402c5e
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x402c36
cmp eax, 0xffffffff
ja 0x402c5e
jmp 0x402c38
jg 0x402c5e
mov eax, esi
cdq
add eax, dword [esp + 8]
adc edx, dword [esp + 0xc]
cmp edx, 0
jne 0x402c4f
cmp eax, 0xffffffff
jbe 0x402c5e
jmp 0x402c51
jle 0x402c5e
lea edx, [edi + 0x17]
mov eax, 0x42b23c
call fcn.00418ae4
lea edx, [edi + 0x17]
mov eax, 0x42b23c
call fcn.00418b18
test al, al
je 0x402cae
mov ecx, dword [esp + 4]
cmp ecx, esi
jae 0x402b4b
cmp dword [esp + 4], 0
jbe 0x402b4b
mov eax, edi
call fcn.00402eec
push edx
push eax
mov eax, dword [esp + 0xc]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
xor edx, edx
mov eax, edi
call fcn.00402e34
jmp 0x402b4b
lea ecx, [edi + 0x17]
mov eax, 0x42b23c
xor edx, edx
call fcn.00418acc
jmp 0x402cc4
mov byte [edi + 8], 1
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x402db4
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ecx
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x402ddb
cmp esi, 0x4e20
jle 0x402dd1
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x402e2c
mov eax, ebx
call fcn.0040310c
test al, al
je 0x402e13
cmp esi, 0x4e20
jle 0x402e13
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.00402db4
jmp 0x402e2f
cmp dword [ebx + 0xc], 1
jne 0x402e27
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x402e27
xor eax, eax
jmp 0x402e2f
or eax, 0xffffffff
jmp 0x402e2f
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4031b8
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.00408b34
test eax, eax
je 0x4031de
test ebx, ebx
je 0x4031de
cmp word [ebx], 0
je 0x4031de
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x4031e6
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x4031f9
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.004037b8
xor eax, eax
jmp 0x403214
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x403208
cmp eax, 3
jne 0x40320f
mov eax, 2
jmp 0x403214
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x403538
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffffc00
mov edx, esp
call fcn.00402210
cmp byte [esp], 0
je 0x40354f
mov eax, esp
jmp 0x403551
xor eax, eax
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
je 0x403565
cmp eax, 5
je 0x403565
xor edx, edx
jmp 0x40356a
mov edx, 1
mov eax, edx
add esp, 0x400
ret
Function at 0x403574
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
add esp, 0xfffffbd0
mov ebx, eax
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.00402210
cmp dword [0x4281ac], 0
jne 0x4035b2
push 0x4281b4
call sub.KERNEL32.DLL_GetModuleHandleA
mov esi, eax
test esi, esi
je 0x4035b2
push str.GetDiskFreeSpaceExA
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4281ac], eax
cmp dword [0x4281ac], 0
je 0x403621
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.00401d3c
xor ecx, ecx
lea eax, [esp + 8]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
push eax
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x18]
push eax
cmp byte [esp + 0x3c], 0
je 0x4035ec
lea edx, [esp + 0x3c]
jmp 0x4035ee
xor edx, edx
push edx
call dword [0x4281ac]
test eax, eax
je 0x403621
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0xc]
ja 0x403621
mov eax, dword [esp + 0x14]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [esp + 0x18]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
jmp 0x40368e
lea ecx, [esp + 0x24]
push ecx
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x24]
push ecx
cmp byte [esp + 0x40], 0
je 0x403642
lea eax, [esp + 0x40]
jmp 0x403644
xor eax, eax
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
jne 0x403657
mov eax, 0x163e00
xor edx, edx
jmp 0x40368e
mov eax, dword [esp + 0x18]
imul dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
call fcn.004224b4
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
add esp, 0x430
pop esi
pop ebx
ret

Function at 0x403698
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.00408b34
test eax, eax
je 0x4036c3
test ebx, ebx
je 0x4036c3
cmp word [ebx], 0
je 0x4036c3
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x40378c
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.00408b34
test eax, eax
je 0x4037ae
test ebx, ebx
je 0x4037ae
cmp word [ebx], 0
je 0x4037ae
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
pop esi
pop ebx
ret

Function at 0x4037b8
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.00408b34
test eax, eax
je 0x4037e5
test ebx, ebx
je 0x4037e5
cmp word [ebx], 0
je 0x4037e5
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x4037f4
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x403d20
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x403d29
mov eax, dword [esp + 0x2000]
add esp, 0xfffffb30
mov ebx, edx
mov esi, eax
lea edi, [esp + 0x10b4]
lea eax, [esp + 0xc14]
call fcn.0040f9c4
lea eax, [esp + 0xc40]
call fcn.0040f9c4
lea eax, [esp + 0xc6c]
call fcn.0040f9c4
push 0
lea ecx, [esp + 4]
mov edx, ebx
mov eax, esi
call fcn.0040b120
test al, al
jne 0x403d89
xor eax, eax
jmp 0x403edd
cmp byte [esp], 0
je 0x403d99
cmp byte [esp + 0xc98], 0
jne 0x403da0
xor eax, eax
jmp 0x403edd
mov eax, esp
call fcn.0040183c
lea edx, [esp + 0xc98]
call fcn.00401734
test eax, eax
je 0x403dce
mov eax, esi
call fcn.0040183c
lea edx, [esp + 0xc98]
call fcn.00401734
test eax, eax
je 0x403dd5
xor eax, eax
jmp 0x403edd
xor ebx, ebx
push 0x400
push esi
push edi
call fcn.0041fb6c
add esp, 0xc
push ebx
push str.rtmp_d
mov eax, edi
call fcn.0040183c
push eax
call fcn.0042111c
add esp, 0xc
mov eax, edi
xor edx, edx
call fcn.00403698
test al, al
je 0x403e14
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x403dd7
mov eax, edi
xor edx, edx
call fcn.00403698
test al, al
je 0x403e28
xor eax, eax
jmp 0x403edd
push 0x400
push esi
lea edx, [esp + 0x14bc]
push edx
call fcn.0041fb6c
add esp, 0xc
mov eax, esp
call fcn.0040183c
push eax
lea eax, [esp + 0x14b8]
call fcn.0040183c
push eax
call fcn.0041f9d4
add esp, 8
push edi
lea edx, [esp + 0x14b8]
push edx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
jne 0x403e71
xor eax, eax
jmp 0x403edd
lea eax, [esp + 0x18b4]
call fcn.00402714
xor ebx, ebx
xor edx, edx
mov eax, esi
call fcn.00403698
test al, al
jne 0x403e9e
lea eax, [esp + 0x18b4]
xor ecx, ecx
mov edx, esi
call fcn.00402924
mov ebx, eax
lea eax, [esp + 0x14b4]
push eax
push edi
call sub.KERNEL32.DLL_MoveFileA
test bl, bl
je 0x403ec8
lea eax, [esp + 0x18b4]
call fcn.00402a58
lea eax, [esp + 0x18b4]
call fcn.00402ae0
mov al, 1
push eax
lea eax, [esp + 0x18b8]
mov edx, 2
call fcn.00402764
pop eax
add esp, 0x24d4
pop edi
pop esi
pop ebx
ret
Function at 0x405b24
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
ret

Function at 0x408bb4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, 0x42d5c0
push ebp
mov ebp, edx
cmp dword [edi + 4], 0
mov esi, ecx
mov ebx, eax
jne 0x408bce
call fcn.00408b7c
mov eax, ebp
jmp 0x408be6
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x408bee
test al, 7
jne 0x408bd2
cmp esi, 8
jb 0x408c77
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x408bf7
xor edx, edx
jmp 0x408c91
mov ecx, ebx
xor cl, byte [eax + edx]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [edi + ecx*4]
xor ecx, ebx
mov ebx, ecx
inc edx
cmp esi, edx
ja 0x408c7b
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x408d10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], edx
mov edx, dword [esp]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
xor edx, dword [eax + 0x204]
mov dword [esp + 4], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 4]
xor edx, dword [eax + 0x208]
mov dword [esp + 8], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ebx, dword [ecx + 8]
mov esi, dword [edx + 0xc]
xor ebx, dword [eax + 0x20c]
xor esi, dword [eax + 0x210]
xor edx, edx
mov ecx, esi
mov edi, esi
shr edi, 0x15
shl ecx, 0xb
or ecx, edi
mov edi, edx
and edi, 3
add ecx, ebx
xor ecx, dword [eax + edi*4 + 0x204]
mov ebp, ecx
mov edi, ecx
shr ebp, 8
and edi, 0xff
and ebp, 0xff
movzx edi, byte [eax + edi + 0x104]
movzx ebp, byte [eax + ebp + 0x104]
shl ebp, 8
or edi, ebp
mov ebp, ecx
shr ebp, 0x10
shr ecx, 0x18
and ebp, 0xff
and ecx, 0xff
movzx ebp, byte [eax + ebp + 0x104]
movzx ecx, byte [eax + ecx + 0x104]
shl ebp, 0x10
shl ecx, 0x18
or edi, ebp
or edi, ecx
mov ecx, ebx
xor edi, dword [esp + 4]
mov dword [esp + 0xc], edi
mov edi, ebx
shr edi, 0xf
shl ecx, 0x11
or ecx, edi
mov edi, edx
and edi, 3
xor ecx, esi
add ecx, dword [eax + edi*4 + 0x204]
mov ebp, ecx
mov edi, ecx
shr ebp, 8
and edi, 0xff
and ebp, 0xff
movzx edi, byte [eax + edi + 0x104]
movzx ebp, byte [eax + ebp + 0x104]
shl ebp, 8
or edi, ebp
mov ebp, ecx
shr ebp, 0x10
shr ecx, 0x18
and ebp, 0xff
and ecx, 0xff
movzx ebp, byte [eax + ebp + 0x104]
movzx ecx, byte [eax + ecx + 0x104]
shl ebp, 0x10
shl ecx, 0x18
or edi, ebp
or edi, ecx
xor edi, dword [esp + 8]
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov ecx, edi
mov esi, ecx
mov ebx, dword [esp + 0xc]
inc edx
cmp edx, 0x20
jl 0x408d5e
mov edx, dword [esp + 0x10]
xor ebx, dword [eax + 0x204]
mov dword [edx], ebx
xor esi, dword [eax + 0x208]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x10]
xor edx, dword [eax + 0x20c]
mov dword [ecx + 8], edx
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
xor edx, dword [eax + 0x210]
mov dword [ecx + 0xc], edx
mov edx, dword [esp]
call fcn.0040905c
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x408eb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
xor ecx, dword [ebx + 0x204]
mov dword [esp], ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 4]
xor ecx, dword [ebx + 0x208]
mov dword [esp + 4], ecx
mov eax, dword [esp + 0xc]
mov esi, dword [eax + 8]
mov eax, dword [esp + 0xc]
xor esi, dword [ebx + 0x20c]
mov edi, dword [eax + 0xc]
xor edi, dword [ebx + 0x210]
push 0x10
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0041f7e4
add esp, 0xc
mov edx, 0x1f
mov eax, edi
mov ecx, edi
shr ecx, 0x15
shl eax, 0xb
or eax, ecx
mov ecx, edx
and ecx, 3
add eax, esi
xor eax, dword [ebx + ecx*4 + 0x204]
mov ebp, eax
mov ecx, eax
shr ebp, 8
and ecx, 0xff
and ebp, 0xff
movzx ecx, byte [ebx + ecx + 0x104]
movzx ebp, byte [ebx + ebp + 0x104]
shl ebp, 8
or ecx, ebp
mov ebp, eax
shr ebp, 0x10
shr eax, 0x18
and ebp, 0xff
and eax, 0xff
movzx ebp, byte [ebx + ebp + 0x104]
movzx eax, byte [ebx + eax + 0x104]
shl ebp, 0x10
shl eax, 0x18
or ecx, ebp
or ecx, eax
mov eax, esi
xor ecx, dword [esp]
mov dword [esp + 8], ecx
mov ecx, esi
shr ecx, 0xf
shl eax, 0x11
or eax, ecx
mov ecx, edx
and ecx, 3
xor eax, edi
add eax, dword [ebx + ecx*4 + 0x204]
mov ebp, eax
mov ecx, eax
shr ebp, 8
and ecx, 0xff
and ebp, 0xff
movzx ecx, byte [ebx + ecx + 0x104]
movzx ebp, byte [ebx + ebp + 0x104]
shl ebp, 8
or ecx, ebp
mov ebp, eax
shr ebp, 0x10
shr eax, 0x18
and ebp, 0xff
and eax, 0xff
movzx ebp, byte [ebx + ebp + 0x104]
movzx eax, byte [ebx + eax + 0x104]
shl ebp, 0x10
shl eax, 0x18
or ecx, ebp
or ecx, eax
xor ecx, dword [esp + 4]
mov dword [esp], esi
mov dword [esp + 4], edi
mov eax, ecx
mov edi, eax
mov esi, dword [esp + 8]
dec edx
test edx, edx
jge 0x408f0c
mov eax, dword [esp + 0xc]
xor esi, dword [ebx + 0x204]
mov dword [eax], esi
xor edi, dword [ebx + 0x208]
mov edx, dword [esp + 0xc]
mov dword [edx + 4], edi
mov ecx, dword [esp]
mov eax, dword [esp + 0xc]
xor ecx, dword [ebx + 0x20c]
mov dword [eax + 8], ecx
mov eax, ebx
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0xc]
xor edx, dword [ebx + 0x210]
mov dword [ecx + 0xc], edx
lea edx, [esp + 0x10]
call fcn.0040905c
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40905c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, 0x42d5c0
xor ecx, ecx
movzx esi, byte [edx + ecx]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x204], esi
movzx esi, byte [edx + ecx + 1]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x208], esi
movzx esi, byte [edx + ecx + 2]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x20c], esi
movzx esi, byte [edx + ecx + 3]
mov esi, dword [ebx + esi*4]
xor dword [eax + 0x210], esi
add ecx, 4
cmp ecx, 0x10
jl 0x409065
pop esi
pop ebx
ret
Function at 0x40986c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x409883
test esi, esi
jg 0x40988a
xor eax, eax
jmp 0x409932
push 0x10
mov edx, dword [ebp - 4]
add edx, 4
push edx
lea ecx, [ebp - 0x28]
push ecx
call fcn.0041f7e4
add esp, 0xc
test esi, esi
jns 0x4098a6
add esi, 0xf
sar esi, 4
mov dword [ebp - 8], esi
mov esi, dword [ebp - 8]
test esi, esi
jle 0x409917
lea ecx, [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00409be8
mov eax, dword [ebp - 0x28]
xor dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x24]
xor dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x20]
xor dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0xc], eax
mov eax, ebx
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0xc], ecx
add ebx, 0x10
add dword [ebp + 8], 0x10
dec esi
test esi, esi
jg 0x4098b3
push 0x10
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
add eax, 4
push eax
call fcn.0041f7e4
add esp, 0xc
mov eax, dword [ebp - 8]
shl eax, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40993c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 4
push 0x20
push edx
lea edx, [esp + 0x14]
push edx
call fcn.0041f7e4
add esp, 0xc
xor esi, esi
xor ecx, ecx
xor edx, edx
jmp 0x4099a5
xor eax, eax
mov edi, esi
mov ebp, dword [esp]
shl edi, 4
lea ebx, [esp + edx*4 + 0xc]
lea edi, [ebp + edi]
mov bl, byte [ebx + eax]
lea edi, [edi + ecx*4]
mov byte [edi + eax + 0x14], bl
inc eax
cmp eax, 4
jl 0x409970
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x40999d
cmp ecx, 4
jl 0x40996e
cmp ecx, 4
jne 0x4099a5
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x4099b0
cmp esi, 0xa
jle 0x409992
cmp esi, 0xa
jg 0x409b43
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov al, byte [edx + 0x42d9c0]
xor byte [esp + 0xc], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 0xa]
mov dl, byte [eax + 0x42d9c0]
xor byte [esp + 0xd], dl
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov al, byte [edx + 0x42d9c0]
xor byte [esp + 0xe], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 8]
mov dl, byte [eax + 0x42d9c0]
xor byte [esp + 0xf], dl
mov eax, dword [esp + 4]
mov dl, byte [eax + 0x42dbc0]
xor byte [esp + 0xc], dl
inc dword [esp + 4]
cmp dword [esp + 8], 8
je 0x409a53
mov edx, 1
cmp edx, dword [esp + 8]
jge 0x409af1
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x409a33
inc edx
cmp edx, dword [esp + 8]
jl 0x409a31
jmp 0x409af1
mov edx, 1
jmp 0x409a71
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x409a5c
inc edx
mov eax, dword [esp + 8]
sar eax, 1
jns 0x409a7c
adc eax, 0
cmp edx, eax
jl 0x409a5a
mov eax, dword [esp + 8]
sar eax, 1
jns 0x409a8b
adc eax, 0
xor edx, edx
mov dl, byte [esp + eax*4 + 8]
mov dl, byte [edx + 0x42d9c0]
xor byte [esp + eax*4 + 0xc], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov dl, byte [edx + 0x42d9c0]
xor byte [esp + eax*4 + 0xd], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xa]
mov dl, byte [edx + 0x42d9c0]
xor byte [esp + eax*4 + 0xe], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov dl, byte [edx + 0x42d9c0]
xor byte [esp + eax*4 + 0xf], dl
mov edx, eax
inc edx
cmp edx, dword [esp + 8]
jge 0x409af1
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x409ad6
inc edx
cmp edx, dword [esp + 8]
jl 0x409ad4
xor edx, edx
jmp 0x409b2f
xor eax, eax
mov ebx, esi
shl ebx, 4
mov edi, dword [esp]
lea ebx, [edi + ebx]
lea ebx, [ebx + ecx*4]
lea edi, [ebx + eax + 0x14]
lea ebx, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
mov byte [edi], bl
inc eax
cmp eax, 4
jl 0x409af9
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x409b27
cmp ecx, 4
jl 0x409af7
cmp ecx, 4
jne 0x409b2f
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x409b3a
cmp esi, 0xa
jle 0x409b1c
cmp esi, 0xa
jle 0x4099b9
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x409b4c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
shl ebx, 2
add edx, edi
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx ebp, byte [edx + 1]
mov bl, byte [edx]
lea ebp, [ebp*4 + 0x42ffde]
lea ebx, [ebx*4 + 0x42fbde]
mov bl, byte [ebx + eax]
xor bl, byte [ebp + eax]
movzx ebp, byte [edx + 2]
movzx edx, byte [edx + 3]
lea ebp, [ebp*4 + 0x4303de]
lea edx, [edx*4 + 0x4307de]
xor bl, byte [ebp + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x409b5e
inc eax
cmp eax, 4
jl 0x409b5c
mov ecx, esi
push 0x10
shl ecx, 4
lea eax, [esp + 4]
add ecx, edi
push eax
add ecx, 0x14
push ecx
call fcn.0041f7e4
add esp, 0xc
inc esi
cmp esi, 0xa
jl 0x409b5a
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40b8c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [eax]
cmp edx, 0x11
jle 0x40b8e0
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x44], ecx
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x38], ecx
xor ecx, ecx
mov dword [eax + edx*4], ecx
dec edx
cmp edx, 0x11
jg 0x40b8c7
cmp dword [eax], 0x11
jbe 0x40b8fb
mov dword [eax], 0x11
jmp 0x40b8ef
dec dword [eax]
mov edx, dword [eax]
test edx, edx
je 0x40b8fb
cmp dword [eax + edx*4], 0
je 0x40b8ed
ret

Function at 0x40c084
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [esi]
cmp eax, dword [ebx]
jae 0x40c0cb
mov eax, 1
jmp 0x40c0a4
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [esi]
jbe 0x40c09a
mov ecx, dword [ebx]
mov edx, eax
sub ecx, dword [esi]
shl ecx, 2
shl edx, 2
push ecx
mov ecx, edx
add ecx, ebx
add edx, edi
push ecx
push edx
call fcn.0041f7e4
add esp, 0xc
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40c130
mov eax, dword [esi]
cmp eax, dword [ebx]
jbe 0x40c109
mov eax, 1
jmp 0x40c0e2
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [ebx]
jbe 0x40c0d8
mov ecx, dword [esi]
mov edx, eax
sub ecx, dword [ebx]
shl ecx, 2
shl edx, 2
push ecx
mov ecx, edx
add ecx, esi
add edx, edi
push ecx
push edx
call fcn.0041f7e4
add esp, 0xc
mov eax, dword [esi]
mov dword [edi], eax
jmp 0x40c130
mov eax, dword [ebx]
test eax, eax
jbe 0x40c11c
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
jne 0x40c11c
dec eax
test eax, eax
ja 0x40c10f
mov dword [edi], eax
test eax, eax
jbe 0x40c130
mov ecx, dword [esi + eax*4]
xor ecx, dword [ebx + eax*4]
mov dword [edi + eax*4], ecx
dec eax
test eax, eax
ja 0x40c122
pop edi
pop esi
pop ebx
ret