joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4025d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403cb6
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x60], 0xa300ce
mov dword [ebp - 0x5c], 0x3e0062
mov dword [ebp - 0x58], 0xb20093
mov ecx, dword [eax]
mov dword [ebp - 0x54], 0xb300a0
mov dword [ebp - 0x50], 0xa600fd
mov dword [ebp - 0x4c], 0x38007b
mov eax, dword [ecx + 0x1e4]
lea esi, [ecx + 0x2a8]
mov dword [ebp - 0x48], 0xe1008f
mov dword [ebp - 0x44], 0xe700f3
mov dword [ebp - 0x40], 0x8800af
mov dword [ebp - 0x3c], 0x380067
mov dword [ebp - 0x38], 0xb00092
mov dword [ebp - 0x34], 0x8600f3
mov dword [ebp - 0x30], 0xb300ec
mov dword [ebp - 0x2c], 0x210066
mov dword [ebp - 0x28], 0xaf009c
mov dword [ebp - 0x24], 0xa800ba
mov dword [ebp - 0x20], 0xe700e1
mov dword [ebp - 0x1c], 0x79003d
mov dword [ebp - 0x18], 0xdb00c8
test al, 1
jne 0x4026e3
or eax, 1
mov dword [ecx + 0x1e4], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movlpd qword [ebp - 0x68], xmm0
mov edx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x68]
mov byte [esi + 0x4c], 1
nop word [eax + eax]
mov ax, word [ebp + ecx*2 - 0x60]
mov word [esi + ecx*2], ax
add ecx, 1
adc edx, 0
jne 0x4026d6
cmp ecx, 0x26
jb 0x4026c0
push 0x404010
call fcn.00402c6d
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00402bde
mov esp, ebp
pop ebp
ret

Function at 0x4034d0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40350f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40350f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40350f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40350f
cmp dword [ecx + 0x74], 0xe
jbe 0x40350f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4012a4
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x14]
push edi
mov dword [ebp - 0x38], esi
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [ebp - 8], eax
mov eax, dword [str._vf_4m]
mov dword [ebp - 0x30], eax
mov eax, dword [0x41b5c4]
mov dword [ebp - 0x34], eax
call fcn.0040129d
mov edi, dword [ebp - 0x14]
mov eax, dword [0x41b5c8]
add edi, 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [0x41b5cc]
push 0x20
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x2c], eax
pop esi
mov dword [ebp - 0x20], 2
add dword [ebp - 0x20], 3
mov edx, dword [ebp - 8]
mov eax, edx
mov ecx, dword [0xb6024c]
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x40132d
push 0x418300
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [0xb6024c]
add eax, dword [ebp - 0x28]
cmp ecx, 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0xb60248]
mov dword [ebp - 0x24], 0xedeb2e40
cmove eax, dword [ebp - 0x24]
and dword [ebp - 0x24], 0
cmp ecx, 0x3eb
mov dword [0xb60248], eax
mov eax, dword [0xb601a0]
cmove eax, dword [ebp - 0x24]
mov dword [0xb601a0], eax
lea eax, [edi + edx]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x18], 0
mov dword [0xb60244], 0xf4ea3dee
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x1c]
sub ebx, eax
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x1c], ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
nop
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
xor eax, dword [ebp - 0x24]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 8], eax
add edi, 0x61c88647
mov dword [ebp - 0x14], edi
dec esi
jne 0x4012f5
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
pop edi
mov dword [esi + 4], ebx
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d5ac
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a35c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004050d5
mov dword [ebp - 0x14], eax
cmp dword [0x4bba00], esi
jne 0x40d69f
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d62c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d77f
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d77f
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d77f
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4bba00], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4bba04], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4bba08], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4bba10], eax
test eax, eax
je 0x40d69c
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4bba0c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d6c4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d6b7
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d6d9
push 4
pop eax
jmp 0x40d781
cmp dword [ebp - 0x14], esi
je 0x40d6d9
push dword [0x4bba00]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d6be
mov eax, dword [0x4bba0c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d737
cmp dword [0x4bba10], edi
je 0x40d737
push eax
call ebx
push dword [0x4bba10]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d737
test eax, eax
je 0x40d737
call ecx
test eax, eax
je 0x40d72c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d72c
test byte [ebp - 8], 1
jne 0x40d737
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d767
mov eax, dword [0x4bba04]
cmp eax, edi
je 0x40d764
push eax
call ebx
test eax, eax
je 0x40d764
call eax
mov esi, eax
test esi, esi
je 0x40d764
mov eax, dword [0x4bba08]
cmp eax, edi
je 0x40d764
push eax
call ebx
test eax, eax
je 0x40d764
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4bba00]
call ebx
test eax, eax
je 0x40d77f
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d781
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040443b
mov esp, ebp
pop ebp
ret
Function at 0x40164e
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x2db414c]
push esi
mov esi, eax
shr esi, 3
push edi
mov edi, dword [0x2db40a4]
test esi, esi
je 0x401694
push ebx
xor ebx, ebx
cmp eax, 0x959
jne 0x40167f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, edi
call fcn.004014f2
add edi, 8
dec esi
je 0x401693
mov eax, dword [0x2db414c]
jmp 0x401667
pop ebx
pop edi
pop esi
ret 4
Function at 0x40d069
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a36c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00404ed5
mov dword [ebp - 0x14], eax
cmp dword [0x4ba800], esi
jne 0x40d15c
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d0e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d23c
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d23c
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d23c
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4ba800], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4ba804], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4ba808], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ba810], eax
test eax, eax
je 0x40d159
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ba80c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d181
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d174
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d196
push 4
pop eax
jmp 0x40d23e
cmp dword [ebp - 0x14], esi
je 0x40d196
push dword [0x4ba800]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d17b
mov eax, dword [0x4ba80c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d1f4
cmp dword [0x4ba810], edi
je 0x40d1f4
push eax
call ebx
push dword [0x4ba810]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d1f4
test eax, eax
je 0x40d1f4
call ecx
test eax, eax
je 0x40d1e9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d1e9
test byte [ebp - 8], 1
jne 0x40d1f4
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d224
mov eax, dword [0x4ba804]
cmp eax, edi
je 0x40d221
push eax
call ebx
test eax, eax
je 0x40d221
call eax
mov esi, eax
test esi, esi
je 0x40d221
mov eax, dword [0x4ba808]
cmp eax, edi
je 0x40d221
push eax
call ebx
test eax, eax
je 0x40d221
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4ba800]
call ebx
test eax, eax
je 0x40d23c
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d23e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040415b
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 4]
mov edx, ecx
dec ecx
test edx, edx
je 0x40103e
push ebx
push esi
lea esi, [ecx + 1]
mov ecx, dword [esp + 0x10]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xffff
shr edx, 8
xor edx, ebx
xor ebx, ebx
mov bh, al
mov ax, word [edx*2 + 0x50e120]
xor ax, bx
inc ecx
dec esi
jne 0x401018
pop esi
pop ebx
ret

Function at 0x4045a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4045ab
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4046ae
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4f988c]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4f988c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4f988c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4f988c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4f988c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4f988c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4f988c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4f988c]
xor eax, edx
inc ecx
dec edi
jne 0x4045c6
pop edi
test esi, esi
je 0x4046d0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4f988c]
xor eax, edx
inc ecx
dec esi
jne 0x4046b2
pop esi
pop ebx
not eax
ret
Function at 0x40ea00
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
mov eax, dword [esi]
mov edx, dword [esi + 0x58]
and al, 1
push edi
neg al
sbb al, al
lea ebx, [esi + 0x3e]
and eax, 0xff
push eax
push ecx
push edx
push ebx
push ebp
call fcn.0040eab0
mov edi, eax
xor eax, eax
add esp, 0x14
cmp edi, eax
jne 0x40ea5d
mov eax, dword [ebp]
xor ecx, ecx
push ebx
mov ax, word [eax + 6]
mov cl, ah
mov ch, al
mov word [esi + 0x4a], cx
call fcn.0040ea80
add esp, 4
mov word [esi + 0x4c], ax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov word [esi + 0x4c], ax
mov word [esi + 0x4a], ax
mov eax, dword [esi]
and al, 0xf9
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x413830
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x290
push ebx
mov ebx, dword [esp + 0x2a0]
test ebx, ebx
push esi
je 0x413a48
mov eax, dword [esp + 0x2c4]
test al, 1
je 0x413a48
mov dl, byte [esp + 0x2ba]
mov cl, bh
shr cl, 3
and cl, 0x10
and dl, 0x10
xor cl, dl
je 0x413a48
cmp word [0x536294], 0x96fe
je 0x413a48
mov ecx, dword [0x58d26c]
test ecx, ecx
jne 0x413a48
and eax, 0x3f
cmp al, 0x10
jne 0x413a48
push edi
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x9c]
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], 0x36edbd2e
mov dword [esp + 0x10], 0x73fabb0f
mov dword [esp + 0x14], 0x62fbbc1d
mov dword [esp + 0x18], 0x72eda71f
mov dword [esp + 0x1c], 0x64eda35a
mov dword [esp + 0x20], 0x78e7bc09
mov dword [esp + 0x24], 0x78e9b65a
mov dword [esp + 0x28], 0x7ae6ba5a
mov dword [esp + 0x2c], 0x64ebf503
mov dword [esp + 0x30], 0x73fcb41f
mov dword [esp + 0x34], 0x36faba5a
mov dword [esp + 0x38], 0x62e1b11f
mov dword [esp + 0x3c], 0x73e0a15a
mov dword [esp + 0x40], 0x7ae1b35a
mov dword [esp + 0x44], 0x7efff51f
mov dword [esp + 0x48], 0x36e0b613
mov dword [esp + 0x4c], 0x65edba1e
mov dword [esp + 0x50], 0x62e7bb5a
mov dword [esp + 0x54], 0x75f0b05a
mov dword [esp + 0x58], 0x36ecb01f
mov dword [esp + 0x5c], 0x36edbd0e
mov dword [esp + 0x60], 0x73f2bc09
mov dword [esp + 0x64], 0x36eeba5a
mov dword [esp + 0x68], 0x5bb8e549
mov dword [esp + 0x6c], 0x79dcf554
mov dword [esp + 0x70], 0x7beda75a
mov dword [esp + 0x74], 0x36eda315
mov dword [esp + 0x78], 0x65e1bd0e
mov dword [esp + 0x7c], 0x7be1b95a
mov dword [esp + 0x80], 0x62e9a113
mov dword [esp + 0x84], 0x3ae6ba13
mov dword [esp + 0x88], 0x73e4a55a
mov dword [esp + 0x8c], 0x36eda61b
mov dword [esp + 0x90], 0x7fefb008
mov dword [esp + 0x94], 0x64eda109
mov dword [esp + 0x98], 0x1688d554
pop edi
mov ecx, dword [esp + eax + 8]
add eax, 4
xor ecx, 0x1688d57a
cmp eax, 0x90
mov dword [esp + eax + 0x94], ecx
jl 0x4139df
mov edx, dword [0x548c7c]
push 0x40000
push 0
push edx
lea eax, [esp + 0xa4]
push 0xffffffffffffffff
push eax
call fcn.00420f90
mov ecx, dword [0x548c7c]
push 0x10
push ecx
call fcn.00486e20
push 0
push 0
push str.Status
call fcn.00488970
or eax, 0x80000000
push 0
push eax
push str.Status
call fcn.00488b80
add esp, 0x34
mov esi, dword [esp + 0x29c]
push esi
call fcn.00413610
mov edx, dword [esp + 0x2c8]
mov eax, dword [esp + 0x2c4]
mov ecx, dword [esp + 0x2c0]
push edx
mov edx, dword [esp + 0x2c0]
push eax
mov eax, dword [esp + 0x2c0]
push ecx
mov ecx, dword [esp + 0x2c0]
push edx
mov edx, dword [esp + 0x2c0]
push eax
mov eax, dword [esp + 0x2c0]
push ecx
mov ecx, dword [esi + 0x11fc]
push edx
push eax
mov eax, dword [0x550c90]
mov edx, dword [ecx]
push ebx
push 1
push edx
push eax
push esi
call fcn.00416ed0
add esp, 0x38
cmp eax, 1
pop esi
pop ebx
je 0x413ac1
or eax, 0xffffffff
add esp, 0x290
ret
mov edx, dword [0x550c90]
mov eax, dword [esp + 0x298]
inc edx
push 0
test eax, eax
mov dword [0x550c90], edx
push 0x800
je 0x413aef
call dword [eax + 4]
add esp, 8
xor eax, eax
add esp, 0x290
ret
call fcn.00474a20
add esp, 8
xor eax, eax
add esp, 0x290
ret
Function at 0x41b120
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x290
push ebx
mov ebx, dword [esp + 0x2a0]
push esi
push edi
test ebx, ebx
je 0x41b337
mov eax, dword [esp + 0x2c8]
test al, 1
je 0x41b337
mov cl, byte [esp + 0x2b8]
mov dl, bh
shr cl, 4
and cl, 8
and dl, 8
xor cl, dl
je 0x41b337
cmp word [0x536320], 0x62cc
je 0x41b337
mov ecx, dword [0x58d26c]
test ecx, ecx
jne 0x41b337
and eax, 0x1f
cmp al, 0x18
jne 0x41b337
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x9c]
mov dword [esp + 0xc], 0x8303b67d
mov dword [esp + 0x10], 0xc614b05c
mov dword [esp + 0x14], 0xd715b74e
mov dword [esp + 0x18], 0xc703ac4c
mov dword [esp + 0x1c], 0xd103a809
mov dword [esp + 0x20], 0xcd09b75a
mov dword [esp + 0x24], 0xcd07bd09
mov dword [esp + 0x28], 0xcf08b109
mov dword [esp + 0x2c], 0xd105fe50
mov dword [esp + 0x30], 0xc612bf4c
mov dword [esp + 0x34], 0x8314b109
mov dword [esp + 0x38], 0xd70fba4c
mov dword [esp + 0x3c], 0xc60eaa09
mov dword [esp + 0x40], 0xcf0fb809
mov dword [esp + 0x44], 0xcb11fe4c
mov dword [esp + 0x48], 0x830ebd40
mov dword [esp + 0x4c], 0xd003b14d
mov dword [esp + 0x50], 0xd709b009
mov dword [esp + 0x54], 0xc01ebb09
mov dword [esp + 0x58], 0x8302bb4c
mov dword [esp + 0x5c], 0x8303b65d
mov dword [esp + 0x60], 0xc61cb75a
mov dword [esp + 0x64], 0x8300b109
mov dword [esp + 0x68], 0xee56ee1a
mov dword [esp + 0x6c], 0xcc32fe07
mov dword [esp + 0x70], 0xce03ac09
mov dword [esp + 0x74], 0x8303a846
mov dword [esp + 0x78], 0xd00fb65d
mov dword [esp + 0x7c], 0xce0fb209
mov dword [esp + 0x80], 0xd707aa40
mov dword [esp + 0x84], 0x8f08b140
mov dword [esp + 0x88], 0xc60aae09
mov dword [esp + 0x8c], 0x8303ad48
mov dword [esp + 0x90], 0xca01bb5b
mov dword [esp + 0x94], 0xd103aa5a
mov dword [esp + 0x98], 0xa366de07
rep stosd dword es:[edi], eax
mov ecx, dword [esp + eax + 0xc]
add eax, 4
xor ecx, 0xa366de29
cmp eax, 0x90
mov dword [esp + eax + 0x98], ecx
jl 0x41b2ce
mov edx, dword [0x548c7c]
push 0x40000
push 0
push edx
lea eax, [esp + 0xa8]
push 0xffffffffffffffff
push eax
call fcn.00420f90
mov ecx, dword [0x548c7c]
push 0x10
push ecx
call fcn.00486e20
push 0
push 0
push str.Status
call fcn.00488970
or eax, 0x80000000
push 0
push eax
push str.Status
call fcn.00488b80
add esp, 0x34
mov esi, dword [esp + 0x2a0]
push 0
lea edi, [esi + 0x8ec]
push edi
push esi
call fcn.004129d0
mov edx, dword [esp + 0x2d4]
mov eax, dword [esp + 0x2d0]
mov ecx, dword [esp + 0x2cc]
push edx
mov edx, dword [esp + 0x2cc]
push eax
mov eax, dword [esp + 0x2cc]
push ecx
mov ecx, dword [esp + 0x2cc]
push edx
mov edx, dword [esp + 0x2cc]
push eax
mov eax, dword [esp + 0x2cc]
push ecx
mov ecx, dword [0x550c90]
push edx
push eax
push ebx
push 1
push edi
push ecx
push esi
call fcn.00416ed0
add esp, 0x40
cmp eax, 1
pop edi
pop esi
pop ebx
je 0x41b3b3
or eax, 0xffffffff
add esp, 0x290
ret
mov edx, dword [0x550c90]
mov eax, dword [esp + 0x298]
inc edx
push 0
test eax, eax
mov dword [0x550c90], edx
push 0x800
je 0x41b3e1
call dword [eax + 4]
add esp, 8
xor eax, eax
add esp, 0x290
ret
call fcn.00474a20
add esp, 8
xor eax, eax
add esp, 0x290
ret
Function at 0x41eaa0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
xor eax, eax
mov edx, ecx
dec ecx
test edx, edx
jle 0x41ead6
push ebx
push esi
lea esi, [ecx + 1]
mov ecx, dword [esp + 0xc]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4f1708]
xor eax, edx
inc ecx
dec esi
jne 0x41eab6
pop esi
pop ebx
ret
Function at 0x422340
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x290
push ebx
mov ebx, dword [esp + 0x2a0]
test ebx, ebx
je 0x422552
mov eax, dword [esp + 0x2c0]
test al, 1
je 0x422552
mov cl, byte [esp + 0x2b0]
mov dl, bh
shr cl, 5
and cl, 1
and dl, 1
xor cl, dl
je 0x422552
cmp byte [0x5362e0], 0x59
je 0x422552
mov ecx, dword [0x58d26c]
test ecx, ecx
jne 0x422552
and eax, 0x7f
cmp al, 0x38
jne 0x422552
push edi
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x98]
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x59c94aba
mov dword [esp + 0xc], 0x1cde4c9b
mov dword [esp + 0x10], 0xddf4b89
mov dword [esp + 0x14], 0x1dc9508b
mov dword [esp + 0x18], 0xbc954ce
mov dword [esp + 0x1c], 0x17c34b9d
mov dword [esp + 0x20], 0x17cd41ce
mov dword [esp + 0x24], 0x15c24dce
mov dword [esp + 0x28], 0xbcf0297
mov dword [esp + 0x2c], 0x1cd8438b
mov dword [esp + 0x30], 0x59de4dce
mov dword [esp + 0x34], 0xdc5468b
mov dword [esp + 0x38], 0x1cc456ce
mov dword [esp + 0x3c], 0x15c544ce
mov dword [esp + 0x40], 0x11db028b
mov dword [esp + 0x44], 0x59c44187
mov dword [esp + 0x48], 0xac94d8a
mov dword [esp + 0x4c], 0xdc34cce
mov dword [esp + 0x50], 0x1ad447ce
mov dword [esp + 0x54], 0x59c8478b
mov dword [esp + 0x58], 0x59c94a9a
mov dword [esp + 0x5c], 0x1cd64b9d
mov dword [esp + 0x60], 0x59ca4dce
mov dword [esp + 0x64], 0x349c12dd
mov dword [esp + 0x68], 0x16f802c0
mov dword [esp + 0x6c], 0x14c950ce
mov dword [esp + 0x70], 0x59c95481
mov dword [esp + 0x74], 0xac54a9a
mov dword [esp + 0x78], 0x14c54ece
mov dword [esp + 0x7c], 0xdcd5687
mov dword [esp + 0x80], 0x55c24d87
mov dword [esp + 0x84], 0x1cc052ce
mov dword [esp + 0x88], 0x59c9518f
mov dword [esp + 0x8c], 0x10cb479c
mov dword [esp + 0x90], 0xbc9569d
mov dword [esp + 0x94], 0x79ac22c0
pop edi
mov ecx, dword [esp + eax + 4]
add eax, 4
xor ecx, 0x79ac22ee
cmp eax, 0x90
mov dword [esp + eax + 0x90], ecx
jl 0x4224e9
mov edx, dword [0x548c7c]
push 0x40000
push 0
push edx
lea eax, [esp + 0xa0]
push 0xffffffffffffffff
push eax
call fcn.00420f90
mov ecx, dword [0x548c7c]
push 0x10
push ecx
call fcn.00486e20
push 0
push 0
push str.Status
call fcn.00488970
or eax, 0x80000000
push 0
push eax
push str.Status
call fcn.00488b80
add esp, 0x34
mov edx, dword [esp + 0x2c0]
mov eax, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2b8]
push edx
mov edx, dword [esp + 0x2b8]
push eax
mov eax, dword [esp + 0x2b8]
push ecx
mov ecx, dword [esp + 0x2b8]
push edx
mov edx, dword [esp + 0x2b8]
push eax
mov eax, dword [esp + 0x2b8]
push ecx
push edx
mov edx, dword [0x550c90]
push eax
mov eax, dword [esp + 0x2b8]
push ebx
push 1
lea ecx, [eax + 0xec]
push ecx
push edx
push eax
call fcn.00416ed0
add esp, 0x34
cmp eax, 1
pop ebx
je 0x4225c3
or eax, 0xffffffff
add esp, 0x290
ret
mov edx, dword [0x550c90]
mov eax, dword [esp + 0x298]
inc edx
push 0
test eax, eax
mov dword [0x550c90], edx
push 0x800
je 0x4225f1
call dword [eax + 4]
add esp, 8
xor eax, eax
add esp, 0x290
ret
call fcn.00474a20
add esp, 8
xor eax, eax
add esp, 0x290
ret