joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409990
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Initialize winsock library
Start tcp server

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x44e054]
xor eax, esp
mov dword [esp + 0x1b0], eax
mov eax, dword [ebp + 0xc]
mov ecx, 1
push ebx
push esi
mov dword [esp + 0x10], eax
mov edx, 0x451a30
push edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4099d8
lea eax, [esp + 0x28]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xorps xmm0, xmm0
mov dword [esp + 0x10], 0xffffffff
mov eax, 2
mov dword [esp + 0xc], 0x10
push 0x7f000001
or edi, 0xffffffff
movlpd qword [esp + 0x24], xmm0
mov word [esp + 0x1c], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov ebx, dword [sym.imp.WS2_32.dll_socket]
mov dword [esp + 0x1c], eax
xor eax, eax
push eax
push 1
push 2
mov word [esp + 0x26], ax
call ebx
mov esi, eax
test esi, esi
jns 0x409a31
mov eax, str.socket
jmp 0x409acf
push dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x409a4f
mov eax, str.bind
jmp 0x409acf
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jns 0x409a63
mov eax, str.listen
jmp 0x409acf
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x409a7f
mov eax, str.getsockname
jmp 0x409acf
push 0
push 1
push 2
call ebx
mov edi, eax
test edi, edi
jns 0x409a94
mov eax, str.socket
jmp 0x409acf
push dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x409aaf
mov eax, str.connect
jmp 0x409acf
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jns 0x409b12
mov eax, str.accept
push eax
call fcn.0042e467
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
add esp, 4
cmp esi, 0xffffffff
je 0x409ae6
push esi
call ebx
cmp edi, 0xffffffff
je 0x409aee
push edi
call ebx
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x409afa
push eax
call ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.00427ba1
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1bc]
mov dword [eax], edi
pop edi
mov dword [eax + 4], ebx
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.00427ba1
mov esp, ebp
pop ebp
ret
Function at 0x4147c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x44e054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea esi, [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0x30
mov eax, esi
mov dword [ebp - 0x3c], esi
push 0
push eax
call fcn.00429010
mov edx, dword [ebp - 0x38]
mov edi, 1
add esp, 0xc
xor ebx, ebx
sub edi, edx
lea ecx, [edx + 0x20]
lea eax, [edx + 0xf]
mov dword [ebp - 0x40], ecx
add byte [eax], 1
jne 0x414810
dec eax
lea ecx, [edi + eax]
test ecx, ecx
jg 0x414803
push esi
push edx
lea ecx, [edx + 0x20]
push 1
push ecx
call fcn.004173d0
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x414887
mov esi, dword [ebp - 0x3c]
add ebx, 0x10
mov edx, dword [ebp - 0x38]
add esi, 0x10
mov dword [ebp - 0x3c], esi
lea eax, [edx + 0xf]
cmp ebx, 0x30
jl 0x414803
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
xor ecx, ecx
sub edx, eax
lea eax, [ebp - 0x34]
add eax, ecx
add ecx, 0x10
movups xmm0, xmmword [eax]
movups xmm1, xmmword [edx + eax]
pxor xmm1, xmm0
movups xmmword [eax], xmm1
cmp ecx, 0x30
jl 0x414847
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x34]
push 0x100
push eax
push ecx
call fcn.00417670
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x414887
mov eax, dword [ebp - 0x38]
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [eax], xmm0
lea eax, [ebp - 0x34]
push 0x30
push eax
call fcn.004153f0
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00427ba1
mov esp, ebp
pop ebp
ret
Function at 0x415410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
sub esp, 0x10
xor ecx, ecx
test edx, edx
je 0x415516
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp edx, 0x40
jb 0x4154f8
lea eax, [edx - 1]
add eax, ebx
cmp edi, eax
ja 0x41544e
lea eax, [edx - 1]
add eax, edi
cmp eax, ebx
jae 0x4154f8
lea eax, [edx - 1]
add eax, esi
cmp edi, eax
ja 0x415464
lea eax, [edx - 1]
add eax, edi
cmp eax, esi
jae 0x4154f8
mov eax, edx
mov edx, esi
sub edx, ebx
and eax, 0xffffffc0
mov dword [ebp - 4], edx
mov edx, edi
sub edx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edx
lea eax, [ebx + 0x10]
mov ebx, dword [ebp - 4]
mov edx, esi
sub edx, edi
mov dword [ebp - 0xc], edx
lea edx, [edi + 0x20]
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x10]
mov edi, dword [ebp - 8]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx + esi]
lea edx, [edx + 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x40]
movups xmmword [edx - 0x60], xmm1
movups xmm1, xmmword [ebx + eax - 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x30]
movups xmmword [edi + eax - 0x40], xmm1
mov edi, dword [ebp - 0xc]
movups xmm1, xmmword [edi + edx - 0x40]
mov edi, dword [ebp + 8]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x20]
movups xmmword [edx - 0x40], xmm1
movups xmm1, xmmword [ecx + esi + 0x30]
add ecx, 0x40
pxor xmm1, xmm0
movups xmmword [edx - 0x30], xmm1
cmp ecx, dword [ebp - 0x10]
jb 0x415490
mov edx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
cmp ecx, edx
jae 0x415513
sub esi, ebx
lea eax, [ecx + ebx]
sub edi, ebx
sub edx, ecx
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + edi - 1], cl
sub edx, 1
jne 0x415501
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push edi
xor edi, edi
test ebx, ebx
je 0x41638c
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
sub eax, esi
mov dword [ebp + 8], eax
nop word [eax + eax]
mov cl, byte [eax + esi]
lea esi, [esi + 1]
mov al, byte [esi - 1]
movzx edx, al
movzx eax, cl
xor edx, eax
mov eax, dword [ebp + 8]
or edi, edx
sub ebx, 1
jne 0x416370
pop esi
mov eax, edi
movzx ecx, di
shr eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
Function at 0x416530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 4], ecx
test ebx, ebx
je 0x416609
mov eax, ebx
sub eax, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
nop dword [eax]
nop dword [eax + eax]
mov esi, dword [0x44eb5c]
mov edx, dword [0x44eb5c]
xor esi, ecx
xor edx, dword [ebp - 8]
mov eax, edx
xor eax, esi
sub esi, edx
shr eax, 0x1f
xor eax, dword [0x44eb5c]
mov ecx, eax
neg eax
shr ecx, 1
neg ecx
or ecx, eax
mov eax, dword [0x44eb5c]
shr ecx, 0x1f
neg ecx
xor eax, ecx
and ecx, edx
not eax
and esi, eax
mov eax, dword [0x44eb5c]
or esi, ecx
shr esi, 0x1f
xor eax, esi
lea esi, [ebx - 1]
mov ecx, eax
neg eax
shr ecx, 1
neg ecx
or ecx, eax
xor eax, eax
shr ecx, 0x1f
neg ecx
mov dword [ebp + 8], ecx
test esi, esi
je 0x4165ed
mov dl, byte [eax + edi]
mov cl, byte [eax + edi + 1]
mov ebx, dword [0x44eb5c]
xor ebx, dword [ebp + 8]
not ebx
and bl, cl
movzx ecx, byte [ebp + 8]
and cl, dl
or bl, cl
mov byte [eax + edi], bl
inc eax
cmp eax, esi
jb 0x4165c3
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
movzx eax, byte [edi + ebx - 1]
and al, cl
mov ecx, dword [ebp - 4]
inc ecx
mov byte [edi + ebx - 1], al
mov dword [ebp - 4], ecx
cmp ecx, ebx
jb 0x416560
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416dd0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x443010
mov edx, edi
test eax, eax
je 0x416e51
cmp dword [0x443010], 0
je 0x416e51
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x416e47
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x416e12
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x416e17
add edx, 4
add eax, 4
sub esi, 4
jae 0x416e01
cmp esi, 0xfffffffc
je 0x416e5b
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x416e44
cmp esi, 0xfffffffd
je 0x416e5b
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x416e44
cmp esi, 0xfffffffe
je 0x416e5b
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x416e44
cmp esi, 0xffffffff
je 0x416e5b
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x416e5b
mov eax, dword [ebp + 8]
add edi, 0x14
mov edx, edi
cmp dword [edi], 0
jne 0x416df0
pop edi
pop esi
mov eax, 0xffffffd2
pop ebx
pop ebp
ret
test edi, edi
je 0x416e51
mov eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0x10]
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x416f40
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x442f80
mov edx, edi
test eax, eax
je 0x416fc1
cmp dword [0x442f80], 0
je 0x416fc1
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x416fb7
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x416f82
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x416f87
add edx, 4
add eax, 4
sub esi, 4
jae 0x416f71
cmp esi, 0xfffffffc
je 0x416fc8
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x416fb4
cmp esi, 0xfffffffd
je 0x416fc8
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x416fb4
cmp esi, 0xfffffffe
je 0x416fc8
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x416fb4
cmp esi, 0xffffffff
je 0x416fc8
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x416fc8
mov eax, dword [ebp + 8]
add edi, 0x18
mov edx, edi
cmp dword [edi], 0
jne 0x416f60
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4171c0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44e054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dl, 1
nop word [eax + eax]
movzx eax, dl
mov cl, dl
sar cl, 7
and cl, 0x1b
mov byte [ebp + ebx - 0x204], dl
mov byte [ebp + eax - 0x104], bl
mov al, dl
add al, al
inc ebx
xor cl, al
xor dl, cl
cmp ebx, 0x100
jl 0x4171e0
mov cl, 1
mov edx, 0x450d60
movzx eax, cl
mov dword [edx], eax
mov al, cl
sar al, 7
add cl, cl
and al, 0x1b
add edx, 4
xor cl, al
cmp edx, 0x450d88
jl 0x417211
mov byte [0x44eb60], 0x63
xor ebx, ebx
mov byte [0x44fcc3], 0
nop dword [eax]
movzx eax, byte [ebp + ebx - 0x103]
lea ecx, [ebp - 0x105]
sub ecx, eax
mov dl, byte [ecx]
mov cl, dl
rol cl, 1
xor dl, cl
rol cl, 1
xor dl, cl
rol cl, 1
mov al, cl
rol al, 1
xor al, cl
xor al, dl
xor al, 0x63
mov byte [ebx + 0x44eb61], al
inc ebx
movzx eax, al
mov byte [eax + 0x44fc60], bl
lea eax, [ebx + 1]
cmp eax, 0x100
jl 0x417240
xor edi, edi
mov dword [ebp - 0x20c], 0xff
nop
mov dl, byte [edi + 0x44eb60]
mov bl, dl
movzx ecx, dl
sar bl, 7
mov al, dl
add al, al
and bl, 0x1b
xor bl, al
movzx eax, dl
movzx esi, bl
xor esi, eax
movzx eax, bl
shl esi, 8
xor esi, ecx
shl esi, 8
xor esi, ecx
shl esi, 8
xor esi, eax
mov al, byte [edi + 0x44fc60]
mov dword [edi*4 + 0x44ec60], esi
rol esi, 8
mov dword [edi*4 + 0x44f060], esi
rol esi, 8
mov dword [edi*4 + 0x44f460], esi
rol esi, 8
mov dword [edi*4 + 0x44f860], esi
test al, al
je 0x41736d
movzx eax, al
xor edx, edx
mov ebx, 0xff
movzx ecx, byte [ebp + eax - 0x104]
mov eax, dword [ebp - 0xf6]
movzx eax, al
add eax, ecx
div ebx
mov eax, dword [ebp - 0xfb]
movzx eax, al
add eax, ecx
movzx esi, byte [ebp + edx - 0x204]
xor edx, edx
div ebx
mov eax, dword [ebp - 0xf7]
movzx eax, al
add eax, ecx
movzx ebx, byte [ebp + edx - 0x204]
xor edx, edx
div dword [ebp - 0x20c]
movzx eax, byte [ebp + edx - 0x204]
xor edx, edx
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0xf9]
movzx eax, al
add eax, ecx
mov ecx, 0xff
div ecx
movzx eax, byte [ebp + edx - 0x204]
jmp 0x417379
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x208], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 0x208]
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, esi
mov dword [edi*4 + 0x44fd60], eax
rol eax, 8
mov dword [edi*4 + 0x450160], eax
rol eax, 8
mov dword [edi*4 + 0x450560], eax
rol eax, 8
mov dword [edi*4 + 0x450960], eax
inc edi
cmp edi, 0x100
jl 0x417290
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427ba1
mov esp, ebp
pop ebp
ret
Function at 0x4232f0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x44e054]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x74], edi
je 0x423326
pop edi
mov eax, 0xffffff8c
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00427ba1
mov esp, ebp
pop ebp
ret
push esi
push 0x6c
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.00429010
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x28], 0x6a09e667
mov dword [ebp - 0x24], 0xbb67ae85
mov dword [ebp - 0x20], 0x3c6ef372
mov dword [ebp - 0x1c], 0xa54ff53a
mov dword [ebp - 0x18], 0x510e527f
mov dword [ebp - 0x14], 0x9b05688c
mov dword [ebp - 0x10], 0x1f83d9ab
mov dword [ebp - 0xc], 0x5be0cd19
test eax, eax
je 0x4233cc
mov dword [ebp - 0x30], eax
cmp eax, 0x40
jb 0x4233ba
nop
mov edi, eax
xor esi, esi
lea eax, [esi + ebx]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00422880
add esp, 8
test eax, eax
jne 0x4233ef
sub edi, 0x40
add esi, 0x40
cmp edi, 0x40
jae 0x423384
cmp esi, 0x40
jb 0x4233ef
mov eax, dword [ebp + 0xc]
add ebx, esi
sub eax, esi
mov dword [ebp + 0xc], eax
cmp eax, 0x40
jae 0x423380
mov edi, dword [ebp - 0x74]
test eax, eax
je 0x4233cc
push eax
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.00428a90
add esp, 0xc
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x70]
and ecx, 0x3f
mov byte [ebp + ecx - 0x70], pe_nt_image_headers32
inc ecx
add edx, ecx
cmp ecx, 0x38
ja 0x4233f7
mov eax, 0x38
sub eax, ecx
push eax
push 0
push edx
jmp 0x423425
or esi, 0xffffffff
jmp 0x4234ae
mov eax, 0x40
sub eax, ecx
push eax
push 0
push edx
call fcn.00429010
lea eax, [ebp - 0x70]
push eax
push eax
call fcn.00422880
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x4234a0
push 0x38
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00429010
mov eax, dword [ebp - 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 0x30]
lea edx, [eax*8]
mov eax, ecx
shr eax, 0x1d
or edx, eax
shl ecx, 3
lea eax, [ebp - 0x70]
push eax
bswap edx
bswap ecx
push eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ecx
call fcn.00422880
mov esi, eax
add esp, 8
test esi, esi
jne 0x4234a0
mov eax, dword [ebp - 0x28]
bswap eax
mov dword [edi], eax
mov eax, dword [ebp - 0x24]
bswap eax
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x20]
bswap eax
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x1c]
bswap eax
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x18]
bswap eax
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x14]
bswap eax
mov dword [edi + 0x14], eax
mov eax, dword [ebp - 0x10]
bswap eax
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 0xc]
bswap eax
mov dword [edi + 0x1c], eax
lea eax, [ebp - 0x70]
push 0x6c
push eax
call fcn.004153f0
add esp, 8
lea eax, [ebp - 0x70]
push 0x6c
push eax
call fcn.004153f0
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, esi
xor ecx, ebp
pop esi
pop edi
pop ebx
call fcn.00427ba1
mov esp, ebp
pop ebp
ret
Function at 0x424f90
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x424fa1
mov eax, 0xffffff8b
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0xc1059ed8
mov dword [eax + 0x14], 0xcbbb9d5d
mov dword [eax + 0x18], 0x367cd507
mov dword [eax + 0x1c], 0x629a292a
mov dword [eax + 0x20], 0x3070dd17
mov dword [eax + 0x24], 0x9159015a
mov dword [eax + 0x28], 0xf70e5939
mov dword [eax + 0x2c], 0x152fecd8
mov dword [eax + 0x30], 0xffc00b31
mov dword [eax + 0x34], 0x67332667
mov dword [eax + 0x38], 0x68581511
mov dword [eax + 0x3c], 0x8eb44a87
mov dword [eax + 0x40], 0x64f98fa7
mov dword [eax + 0x44], 0xdb0c2e0d
mov dword [eax + 0x48], 0xbefa4fa4
mov dword [eax + 0x4c], 0x47b5481d
mov dword [eax + 0xd0], ecx
xor eax, eax
pop ebp
ret
Function at 0x425e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp eax, edi
je 0x425e62
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x425e61
push ebx
mov ebx, dword [ebp + 0x14]
sub edi, eax
nop dword [eax]
mov edx, dword [0x44eb5c]
lea eax, [eax + 4]
mov ecx, dword [edi + eax - 4]
xor edx, ebx
not edx
and ecx, ebx
and edx, dword [eax - 4]
or ecx, edx
mov dword [eax - 4], ecx
sub esi, 1
jne 0x425e40
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x425e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, eax
je 0x425ece
cmp dword [ebp + 0x10], 0
jbe 0x425ece
push esi
push edi
mov edi, dword [ebp + 0x14]
sub ebx, eax
nop dword [eax + eax]
mov edx, dword [0x44eb5c]
lea eax, [eax + 4]
mov ecx, dword [eax - 4]
xor edx, edi
mov esi, dword [ebx + eax - 4]
not edx
and edx, dword [ebx + eax - 4]
and ecx, edi
or ecx, edx
and esi, edi
mov dword [ebx + eax - 4], ecx
mov ecx, dword [0x44eb5c]
mov edx, dword [eax - 4]
xor ecx, edi
not ecx
and edx, ecx
or edx, esi
sub dword [ebp + 0x10], 1
mov dword [eax - 4], edx
jne 0x425e90
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x425f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [0x44eb5c]
mov eax, dword [0x44eb5c]
mov eax, dword [0x44eb5c]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
test edi, edi
je 0x426080
mov eax, dword [ebp + 0xc]
lea edx, [edi - 1]
mov ecx, dword [ebp + 8]
sub ecx, eax
mov dword [ebp + 8], ecx
lea edx, [eax + edx*4]
mov dword [ebp + 0x10], edx
push esi
nop dword [eax]
mov esi, dword [0x44eb5c]
xor esi, dword [edx]
mov edx, dword [0x44eb5c]
mov eax, dword [ebp + 0x10]
xor edx, dword [ecx + eax]
mov eax, edx
xor eax, esi
sub esi, edx
shr eax, 0x1f
xor eax, dword [0x44eb5c]
mov ecx, eax
neg eax
shr ecx, 1
neg ecx
or ecx, eax
mov eax, dword [0x44eb5c]
shr ecx, 0x1f
neg ecx
xor eax, ecx
and ecx, edx
not eax
and esi, eax
mov eax, dword [0x44eb5c]
or esi, ecx
shr esi, 0x1f
xor eax, esi
mov esi, dword [0x44eb5c]
mov edx, dword [0x44eb5c]
mov ecx, eax
shr ecx, 1
neg eax
neg ecx
or ecx, eax
mov eax, dword [ebp + 8]
shr ecx, 0x1f
neg ecx
or dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
xor esi, dword [eax + ecx]
xor edx, dword [ecx]
mov eax, edx
xor eax, esi
sub esi, edx
shr eax, 0x1f
xor eax, dword [0x44eb5c]
mov ecx, eax
neg eax
shr ecx, 1
neg ecx
or ecx, eax
mov eax, dword [0x44eb5c]
shr ecx, 0x1f
neg ecx
xor eax, ecx
and ecx, edx
not eax
and esi, eax
mov eax, dword [0x44eb5c]
or esi, ecx
shr esi, 0x1f
xor eax, esi
mov edx, eax
neg eax
shr edx, 1
neg edx
or edx, eax
mov eax, dword [ebp - 4]
shr edx, 0x1f
mov ecx, eax
neg edx
not ecx
and ecx, edx
or eax, edx
mov edx, dword [ebp + 0x10]
or ebx, ecx
mov ecx, dword [ebp + 8]
sub edx, 4
mov dword [ebp - 4], eax
mov dword [ebp + 0x10], edx
sub edi, 1
jne 0x425fa0
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f2ba
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00441670
mov eax, dword [0x44e054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00435a36
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x42f2fc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x42f458
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00428170
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x451420]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004377bf
mov ecx, dword [esi*4 + 0x451420]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x42f451
cmp eax, dword [edi + ecx + 0x24]
jne 0x42f451
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42f451
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004377bf
add esp, 0x14
test edx, edx
jl 0x42f451
jg 0x42f3c7
test eax, eax
jb 0x42f451
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x42f451
jl 0x42f3e1
cmp dword [ebp - 0x1008], eax
ja 0x42f451
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x42f3ff
test ebx, ebx
je 0x42f438
cmp ecx, edi
jae 0x42f438
mov al, byte [ecx]
cmp al, 0xd
jne 0x42f419
lea eax, [edi - 1]
cmp ecx, eax
jae 0x42f425
cmp byte [ecx + 1], 0xa
jne 0x42f425
inc ecx
jmp 0x42f425
movzx eax, al
movsx eax, byte [eax + 0x44e158]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x42f3ff
cmp edx, ebx
jne 0x42f3ff
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x42f456
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00427ba1
leave
ret
Function at 0x4323c5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x451420]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x432405
cmp byte [ebx], 0xa
jne 0x432405
or byte [eax + edi + 0x28], 4
jmp 0x43240a
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x432508
mov al, byte [edx]
cmp al, 0x1a
je 0x4324ea
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x432439
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x43245e
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x432468
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x43241b
jmp 0x432508
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4324e5
cmp dword [ebp - 0xc], 0
je 0x4324e5
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x451420]
test byte [eax + edi + 0x28], 0x48
je 0x4324bf
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4324aa
mov byte [esi], dl
jmp 0x4324bb
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x451420]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x432508
cmp byte [ebp - 1], 0xa
jne 0x4324ce
cmp esi, ebx
jne 0x4324ce
mov byte [esi], 0xa
jmp 0x432507
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004377dd
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x432508
mov byte [esi], 0xd
jmp 0x432507
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x451420]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x432504
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x432508
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret