joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x4d42ec]
push edi
push 0x4c809c
push 0x12d
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x422897
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x20000000
je 0x422883
test eax, eax
jle 0x42287d
and eax, 0xffff
or eax, 0xa0070000
pop edi
mov esi, eax
pop esi
pop ebp
ret
test eax, eax
jle 0x42287d
and eax, 0xffff
or eax, 0x80070000
pop edi
mov esi, eax
pop esi
pop ebp
ret
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
jne 0x4228dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x20000000
je 0x4228c8
test eax, eax
jle 0x4228d6
and eax, 0xffff
pop ebx
or eax, 0xa0070000
pop edi
mov esi, eax
pop esi
pop ebp
ret
test eax, eax
jle 0x4228d6
and eax, 0xffff
or eax, 0x80070000
pop ebx
pop edi
mov esi, eax
pop esi
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x422924
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x20000000
je 0x42290e
test eax, eax
jg 0x422900
mov esi, eax
jmp 0x42293a
and eax, 0xffff
or eax, 0xa0070000
mov esi, eax
jmp 0x42293a
test eax, eax
jg 0x422916
mov esi, eax
jmp 0x42293a
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x42293a
mov eax, dword [ebp + 8]
push eax
mov eax, ebx
call fcn.00422750
mov esi, eax
add esp, 4
test esi, esi
jl 0x42293a
xor esi, esi
test edi, edi
je 0x422945
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4265ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ce540]
jne 0x4265f4
repz ret
jmp fcn.0042bbe3

Function at 0x438855
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042f8eb
and dword [ebp - 4], 0
cmp dword [0x4d2324], 0
mov ebx, eax
jne 0x438906
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4389b7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a28bc
push edi
call esi
test eax, eax
je 0x4389b7
push eax
call fcn.0042f879
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4d2324], eax
call esi
push eax
call fcn.0042f879
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4d2328], eax
call esi
push eax
call fcn.0042f879
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4d232c], eax
call esi
push eax
call fcn.0042f879
pop ecx
mov dword [0x4d2334], eax
test eax, eax
je 0x438906
push 0x4a2864
push edi
call esi
push eax
call fcn.0042f879
pop ecx
mov dword [0x4d2330], eax
mov eax, dword [0x4d2330]
cmp eax, ebx
je 0x43895e
cmp dword [0x4d2334], ebx
je 0x43895e
push eax
call fcn.0042f8f4
push dword [0x4d2334]
mov esi, eax
call fcn.0042f8f4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43895e
test edi, edi
je 0x43895e
call esi
test eax, eax
je 0x438955
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x438955
test byte [ebp - 0xc], 1
jne 0x43895e
or dword [ebp + 0x10], 0x200000
jmp 0x438997
mov eax, dword [0x4d2328]
cmp eax, ebx
je 0x438997
push eax
call fcn.0042f8f4
pop ecx
test eax, eax
je 0x438997
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x438997
mov eax, dword [0x4d232c]
cmp eax, ebx
je 0x438997
push eax
call fcn.0042f8f4
pop ecx
test eax, eax
je 0x438997
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d2324]
call fcn.0042f8f4
pop ecx
test eax, eax
je 0x4389b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4389b9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43c6d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x2c
call fcn.00437980
mov eax, dword [0x4ce540]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov al, 0x38
push edi
xor esi, esi
mov byte [esp + 0x2f], al
mov byte [esp + 0x37], al
mov dl, 0x36
mov cl, 0x37
lea eax, [esp + 0x14]
push str.FFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFC
push eax
xor edi, edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], esi
mov byte [esp + 0x30], 0x31
mov byte [esp + 0x31], 0x32
mov byte [esp + 0x32], 0x33
mov byte [esp + 0x33], 0x34
mov byte [esp + 0x34], 0x35
mov byte [esp + 0x35], dl
mov byte [esp + 0x36], cl
mov byte [esp + 0x38], 0x31
mov byte [esp + 0x39], 0x32
mov byte [esp + 0x3a], 0x33
mov byte [esp + 0x3b], 0x34
mov byte [esp + 0x3c], 0x35
mov byte [esp + 0x3d], dl
mov byte [esp + 0x3e], cl
call fcn.00449290
lea ecx, [esp + 0x24]
push str.28E9FA9E9D9F5E344D5A9E4BCF6509A7F39789F515AB8F92DDBCBD414D940E93
push ecx
call fcn.00449290
lea edx, [esp + 0x28]
push str.32C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A4589334C74C7
push edx
call fcn.00449290
lea eax, [esp + 0x28]
push str.BC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0
push eax
call fcn.00449290
add esp, 0x20
call fcn.0043de10
mov dword [esp + 0x20], eax
call fcn.0043de10
mov dword [esp + 0x24], eax
cmp dword [esp + 0x14], esi
je 0x43c842
cmp dword [esp + 0x1c], esi
je 0x43c82d
cmp dword [esp + 0x18], esi
je 0x43c82d
cmp dword [esp + 0x10], esi
je 0x43c82d
mov ecx, dword [esp + 0x20]
cmp ecx, esi
je 0x43c82d
cmp eax, esi
je 0x43c82d
push ecx
push 0x20
push ebx
call fcn.0043c330
mov edi, eax
add esp, 0xc
cmp edi, esi
je 0x43c82d
mov ebx, dword [esp + 0x24]
push ebx
push 0x20
push ebp
call fcn.0043c330
mov edi, eax
add esp, 0xc
cmp edi, esi
je 0x43c82d
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
push ebx
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
lea ecx, [esp + 0x44]
push 0x10
push ecx
call fcn.0043c3c0
mov edi, eax
add esp, 0x24
cmp edi, esi
je 0x43c82d
lea edi, [esi + 1]
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x43c842
push eax
call fcn.0043ddb0
add esp, 4
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x43c857
push eax
call fcn.0043ddb0
add esp, 4
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x43c86c
push eax
call fcn.0043ddb0
add esp, 4
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x43c881
push eax
call fcn.0043ddb0
add esp, 4
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x20]
cmp eax, esi
je 0x43c892
push eax
call fcn.0043ddb0
add esp, 4
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x43c8a3
push eax
call fcn.0043ddb0
add esp, 4
mov ecx, dword [esp + 0x38]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004265ea
add esp, 0x2c
ret
Function at 0x44d160
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.00437980
mov eax, dword [0x4ce540]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x44d1c5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x44d1c5
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.00427276
add eax, 0x40
push eax
call fcn.004955a8
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004265ea
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.00495470
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x44d254
call fcn.0044d020
test eax, eax
jle 0x44d254
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004265ea
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004265ea
add esp, 0x108
ret

Function at 0x44d2b0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x44d2d4
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x44d2c6
pop esi
movzx eax, cl
pop edi
ret
Function at 0x452600
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x110
call fcn.00437980
push ebx
push ebp
push esi
push edi
push 0x8c
lea eax, [esp + 0x98]
push 0
push eax
mov dword [esp + 0x1c], 0x70e15
mov dword [esp + 0x20], 0x1c232a31
mov dword [esp + 0x24], 0x383f464d
mov dword [esp + 0x28], 0x545b6269
mov dword [esp + 0x2c], 0x70777e85
mov dword [esp + 0x30], 0x8c939aa1
mov dword [esp + 0x34], 0xa8afb6bd
mov dword [esp + 0x38], 0xc4cbd2d9
mov dword [esp + 0x3c], 0xe0e7eef5
mov dword [esp + 0x40], 0xfc030a11
mov dword [esp + 0x44], 0x181f262d
mov dword [esp + 0x48], 0x343b4249
mov dword [esp + 0x4c], 0x50575e65
mov dword [esp + 0x50], 0x6c737a81
mov dword [esp + 0x54], 0x888f969d
mov dword [esp + 0x58], 0xa4abb2b9
mov dword [esp + 0x5c], 0xc0c7ced5
mov dword [esp + 0x60], 0xdce3eaf1
mov dword [esp + 0x64], 0xf8ff060d
mov dword [esp + 0x68], 0x141b2229
mov dword [esp + 0x6c], 0x30373e45
mov dword [esp + 0x70], 0x4c535a61
mov dword [esp + 0x74], 0x686f767d
mov dword [esp + 0x78], 0x848b9299
mov dword [esp + 0x7c], 0xa0a7aeb5
mov dword [esp + 0x80], 0xbcc3cad1
mov dword [esp + 0x84], 0xd8dfe6ed
mov dword [esp + 0x88], 0xf4fb0209
mov dword [esp + 0x8c], 0x10171e25
mov dword [esp + 0x90], 0x2c333a41
mov dword [esp + 0x94], 0x484f565d
mov dword [esp + 0x98], 0x646b7279
call fcn.00427b00
mov eax, dword [esp + 0x130]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ebp, dword [esp + 0x134]
xor ecx, 0xa3b1bac6
xor edx, 0x56aa3350
mov dword [esp + 0x9c], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0xa0], edx
mov edx, dword [eax + 0xc]
xor ecx, 0x677d9197
xor edx, 0xb27022dc
add esp, 0xc
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
xor edi, edi
lea esp, [esp]
mov eax, dword [esp + edi + 0x10]
xor eax, dword [esp + edi + 0x94]
push 0x17
xor eax, dword [esp + edi + 0xa0]
xor eax, dword [esp + edi + 0x9c]
mov dl, al
shr eax, 8
mov bl, al
shr eax, 8
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mov cl, byte [ecx + 0x4cf618]
movzx eax, al
mov al, byte [eax + 0x4cf618]
movzx esi, bl
mov bl, byte [esi + 0x4cf618]
movzx esi, cl
shl esi, 8
movzx eax, al
movzx edx, dl
mov dl, byte [edx + 0x4cf618]
add esi, eax
movzx ecx, bl
shl esi, 8
add esi, ecx
movzx edx, dl
shl esi, 8
add esi, edx
push esi
call fcn.00443140
push 0xd
push esi
mov ebx, eax
call fcn.00443140
xor ebx, eax
xor ebx, dword [esp + edi + 0xa0]
add edi, 4
xor ebx, esi
mov dword [edi + ebp - 4], ebx
mov dword [esp + edi + 0xac], ebx
add esp, 0x10
cmp edi, 0x80
jl 0x452790
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret
Function at 0x459550
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebx
push eax
push ecx
call fcn.00458260
add esp, 0xc
test eax, eax
jl 0x4589d8
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x45880d
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea ebx, [ebx]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x4587d0
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x4589d4
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x4b9888]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4b9888]
and esi, 0xff
mov esi, dword [esi*4 + 0x4ba488]
and edi, 0xff
xor esi, dword [edi*4 + 0x4bac88]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4b9888]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4bb088]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x4b9888]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4ba888]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x4b9888]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4b9888]
and esi, 0xff
mov esi, dword [esi*4 + 0x4ba488]
and edi, 0xff
xor esi, dword [edi*4 + 0x4bac88]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x4b9888]
and edi, 0xff
xor esi, dword [edi*4 + 0x4ba888]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4b9888]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4bb088]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x4b9888]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4b9888]
and esi, 0xff
mov esi, dword [esi*4 + 0x4ba488]
and edi, 0xff
xor esi, dword [edi*4 + 0x4bac88]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x4b9888]
and edi, 0xff
xor esi, dword [edi*4 + 0x4ba888]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4b9888]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4bb088]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x4b9888]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4b9888]
and esi, 0xff
mov esi, dword [esi*4 + 0x4ba488]
and edi, 0xff
xor esi, dword [edi*4 + 0x4bac88]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x4b9888]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4b9888]
and edi, 0xff
xor esi, dword [edi*4 + 0x4ba888]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x4bb088]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x458821
pop edi
xor eax, eax
pop esi
pop ebx
ret
jmp 0x458790
Function at 0x459560
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.00437980
mov eax, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x2c]
mov ebp, eax
cmp ebx, 0x10
jb 0x4595dd
shr ebx, 4
mov dword [esp + 0x10], ebx
lea esp, [esp]
mov ecx, edi
sub ebp, esi
mov eax, esi
sub ecx, esi
mov edx, 4
lea ecx, [ecx]
mov ebx, dword [eax + ebp]
xor ebx, dword [eax]
add eax, 4
sub edx, 1
mov dword [ecx + eax - 4], ebx
jne 0x4595a0
mov eax, dword [esp + 0x34]
push eax
push edi
push edi
call dword [esp + 0x48]
mov ebx, dword [esp + 0x3c]
mov ebp, edi
sub ebx, 0x10
add esp, 0xc
add esi, 0x10
add edi, 0x10
sub dword [esp + 0x10], 1
mov dword [esp + 0x30], ebx
jne 0x459590
mov eax, dword [esp + 0x38]
test ebx, ebx
je 0x4596dc
mov ecx, edi
sub ecx, esi
mov dword [esp + 0x14], ecx
mov ecx, 1
sub ecx, esi
mov dword [esp + 0x18], ecx
mov ecx, 2
sub ecx, esi
mov dword [esp + 0x1c], ecx
mov edx, ebp
sub edx, esi
mov ecx, 3
xor eax, eax
sub ecx, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x20], ecx
jmp 0x459624
mov edx, dword [esp + 0x10]
cmp eax, ebx
jae 0x459692
mov ebx, dword [esp + 0x14]
lea ecx, [eax + esi]
mov dl, byte [edx + ecx]
xor dl, byte [ecx]
mov byte [ebx + ecx], dl
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x30]
add edx, ecx
cmp edx, ebx
jae 0x459687
mov dl, byte [eax + ebp + 1]
xor dl, byte [eax + esi + 1]
mov byte [eax + edi + 1], dl
mov edx, dword [esp + 0x1c]
add edx, ecx
cmp edx, ebx
jae 0x45968a
mov dl, byte [eax + esi + 2]
xor dl, byte [eax + ebp + 2]
mov byte [eax + edi + 2], dl
mov edx, dword [esp + 0x20]
add edx, ecx
cmp edx, ebx
jae 0x45968f
mov cl, byte [eax + ebp + 3]
xor cl, byte [eax + esi + 3]
add eax, 4
mov byte [eax + edi - 1], cl
cmp eax, 0x10
jb 0x459620
jmp 0x4596ae
inc eax
jmp 0x459692
add eax, 2
jmp 0x459692
add eax, 3
cmp eax, 0x10
jae 0x4596ae
mov edx, 0x10
sub ebp, edi
lea ecx, [eax + edi]
sub edx, eax
mov al, byte [ecx + ebp]
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4596a3
mov ecx, dword [esp + 0x34]
push ecx
push edi
push edi
call dword [esp + 0x48]
add esp, 0xc
mov ebp, edi
cmp ebx, 0x10
jbe 0x4596d8
sub ebx, 0x10
add esi, 0x10
add edi, 0x10
mov dword [esp + 0x30], ebx
test ebx, ebx
jne 0x4595e5
mov eax, dword [esp + 0x38]
mov edx, dword [ebp]
mov dword [eax], edx
mov ecx, dword [ebp + 4]
mov dword [eax + 4], ecx
mov edx, dword [ebp + 8]
pop edi
mov dword [eax + 8], edx
mov ecx, dword [ebp + 0xc]
pop esi
pop ebp
mov dword [eax + 0xc], ecx
pop ebx
add esp, 0x14
ret
Function at 0x4599e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00437980
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x28]
test esi, esi
je 0x459a25
test ebx, ebx
je 0x459a25
mov cl, byte [esi + edi]
mov ebp, dword [esp + 0x18]
xor cl, byte [ebp]
mov eax, dword [esp + 0x1c]
mov byte [eax], cl
inc eax
inc ebp
inc esi
dec ebx
and esi, 0xf
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebp
jne 0x459a00
cmp ebx, 0x10
jb 0x459aa0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, edx
sub eax, edi
mov dword [esp + 0x20], eax
mov eax, ebx
shr eax, 4
mov ebp, ecx
mov dword [esp + 0x10], eax
shl eax, 4
add ecx, eax
sub ebp, edi
add edx, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x24]
push edx
push edi
push edi
call dword [esp + 0x3c]
add esp, 0xc
cmp esi, 0x10
jae 0x459a8c
mov ecx, 0xf
sub ecx, esi
shr ecx, 2
lea eax, [esi + edi]
inc ecx
mov edx, dword [esp + 0x20]
mov edx, dword [edx + eax]
xor edx, dword [eax]
add eax, 4
sub ecx, 1
mov dword [eax + ebp - 4], edx
jne 0x459a77
add dword [esp + 0x20], 0x10
sub ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x10], 1
jne 0x459a56
test ebx, ebx
je 0x459add
mov eax, dword [esp + 0x24]
push eax
push edi
push edi
call dword [esp + 0x3c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esi + edi]
sub ebp, edi
sub ecx, edi
add esi, ebx
mov dl, byte [eax + ebp]
xor dl, byte [eax]
dec ebx
mov byte [eax + ecx], dl
inc eax
test ebx, ebx
jne 0x459ac3
mov eax, dword [esp + 0x2c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x2c]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x459d20
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x34
call fcn.00437980
mov eax, dword [0x4ce540]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push ebx
push esi
mov esi, dword [esp + 0x44]
mov ebx, edx
lea edx, [esi - 1]
push edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
cmp edx, 0x7f
ja 0x459ed9
mov edx, dword [edi]
mov dword [esp + 0x18], edx
mov edx, dword [edi + 4]
push ebp
mov dword [esp + 0x20], edx
mov edx, dword [edi + 8]
push eax
mov dword [esp + 0x28], edx
mov edx, dword [edi + 0xc]
push edi
push edi
mov dword [esp + 0x34], edx
call ecx
lea eax, [esi + 7]
cdq
and edx, 7
add eax, edx
mov esi, eax
add esp, 0xc
sar esi, 3
cmp dword [esp + 0x58], 0
je 0x459dc7
test esi, esi
jle 0x459e0e
mov eax, dword [esp + 0x14]
mov edx, edi
lea ebp, [esp + 0x2c]
sub edx, ebx
sub ebp, ebx
sub eax, ebx
mov ecx, ebx
mov dword [esp + 0x14], eax
lea ecx, [ecx]
mov al, byte [edx + ecx]
xor al, byte [ecx]
mov ebx, dword [esp + 0x14]
mov byte [ecx + ebp], al
mov byte [ebx + ecx], al
inc ecx
sub esi, 1
jne 0x459db0
jmp 0x459e0e
xor ebp, ebp
test esi, esi
jle 0x459e0e
lea eax, [esp + 0x2c]
mov ecx, eax
sub ebx, eax
mov eax, dword [esp + 0x14]
mov edx, edi
sub edx, ecx
sub eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
jmp 0x459df4
mov edx, dword [esp + 0x18]
lea ecx, [esp + ebp + 0x2c]
mov al, byte [ebx + ecx]
mov dl, byte [edx + ecx]
xor dl, al
mov byte [ecx], al
mov eax, dword [esp + 0x14]
inc ebp
cmp ebp, esi
mov byte [eax + ecx], dl
jl 0x459df0
mov eax, dword [esp + 0x4c]
mov ecx, eax
and ecx, 0x80000007
jns 0x459e21
dec ecx
or ecx, 0xfffffff8
inc ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x14], ecx
test ecx, ecx
jne 0x459e62
mov ecx, dword [esp + eax + 0x1c]
mov edx, dword [esp + eax + 0x20]
lea eax, [esp + eax + 0x1c]
mov dword [edi], ecx
mov ecx, dword [eax + 8]
mov dword [edi + 4], edx
mov edx, dword [eax + 0xc]
pop ebp
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004265ea
add esp, 0x34
ret
mov dl, 8
sub dl, cl
mov byte [esp + 0x13], dl
inc edi
lea esi, [esp + eax + 0x1d]
mov ebp, 4
movzx edx, byte [esi - 1]
mov al, byte [esi]
shl dl, cl
movzx ecx, byte [esp + 0x13]
mov bl, al
shr bl, cl
mov ecx, dword [esp + 0x14]
shl al, cl
movzx ecx, byte [esp + 0x13]
or dl, bl
mov byte [edi - 1], dl
mov dl, byte [esi + 1]
mov bl, dl
shr bl, cl
mov ecx, dword [esp + 0x14]
shl dl, cl
movzx ecx, byte [esp + 0x13]
or al, bl
mov byte [edi], al
mov al, byte [esi + 2]
mov bl, al
shr bl, cl
movzx ecx, byte [esp + 0x13]
or dl, bl
mov byte [edi + 1], dl
movzx edx, byte [esi + 3]
shr dl, cl
mov ecx, dword [esp + 0x14]
shl al, cl
add esi, 4
add edi, 4
or dl, al
sub ebp, 1
mov byte [edi - 2], dl
jne 0x459e74
pop ebp
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004265ea
add esp, 0x34
ret
Function at 0x45a000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00437980
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x2c]
test esi, esi
je 0x45a045
test ebx, ebx
je 0x45a045
mov cl, byte [esi + edi]
mov ebp, dword [esp + 0x18]
xor cl, byte [ebp]
mov eax, dword [esp + 0x1c]
mov byte [eax], cl
inc eax
inc ebp
inc esi
dec ebx
and esi, 0xf
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebp
jne 0x45a020
cmp ebx, 0x10
jb 0x45a0d9
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, edx
sub eax, edi
mov dword [esp + 0x20], eax
mov eax, ebx
shr eax, 4
mov ebp, ecx
mov dword [esp + 0x10], eax
shl eax, 4
add ecx, eax
sub ebp, edi
add edx, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
lea ebx, [ebx]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
push edx
push edi
push eax
call dword [esp + 0x40]
mov edx, dword [esp + 0x34]
add esp, 0xc
call fcn.00459fe0
cmp esi, 0x10
jae 0x45a0c5
mov ecx, 0xf
sub ecx, esi
shr ecx, 2
lea eax, [esi + edi]
inc ecx
mov edi, edi
mov edx, dword [esp + 0x20]
mov edx, dword [edx + eax]
xor edx, dword [eax]
add eax, 4
sub ecx, 1
mov dword [eax + ebp - 4], edx
jne 0x45a0b0
add dword [esp + 0x20], 0x10
sub ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x10], 1
jne 0x45a080
test ebx, ebx
je 0x45a121
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
push eax
push edi
push ebp
call dword [esp + 0x40]
add esp, 0xc
mov edx, ebp
call fcn.00459fe0
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea eax, [esi + edi]
sub ebp, edi
sub ecx, edi
add esi, ebx
mov dl, byte [eax + ebp]
xor dl, byte [eax]
dec ebx
mov byte [eax + ecx], dl
inc eax
test ebx, ebx
jne 0x45a107
mov eax, dword [esp + 0x30]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x30]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
pop ecx
ret