joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x6f7a6b63
mov dword [ebp - 0xc], 0x636f7c68
mov word [ebp - 8], 0x2e6b
mov ecx, dword [eax]
mov eax, dword [0x4a08dc]
cmp eax, dword [ecx + 4]
jle 0x40d50b
push 0x4a08dc
call fcn.004374fa
add esp, 4
cmp dword [0x4a08dc], 0xffffffff
jne 0x40d50b
movaps xmm0, xmmword [0x489c70]
mov ax, word [ebp - 8]
movups xmmword [0x4a06b8], xmm0
push 0x476e40
movq xmm0, qword [ebp - 0x10]
movq qword [0x4a06c8], xmm0
mov word [0x4a06d0], ax
call fcn.00437921
push 0x4a08dc
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a06b8
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x40d740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x6f627f7d
mov dword [ebp - 0x10], 0x5a404b49
mov dword [ebp - 0xc], 0x617c7e0a
mov ecx, dword [eax]
mov eax, dword [0x4a06a0]
mov word [ebp - 8], 0x2e6a
cmp eax, dword [ecx + 4]
jle 0x40d7cc
push 0x4a06a0
call fcn.004374fa
add esp, 4
cmp dword [0x4a06a0], 0xffffffff
jne 0x40d7cc
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49e634], eax
mov ax, word [ebp - 8]
push 0x476db0
movq qword [0x49e62c], xmm0
mov word [0x49e638], ax
call fcn.00437921
push 0x4a06a0
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e62c
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x40d7e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x5a485d43
mov dword [ebp - 0x10], 0x425f5d4b
mov dword [ebp - 0xc], 0x617c7e0a
mov ecx, dword [eax]
mov eax, dword [0x4a0664]
mov word [ebp - 8], 0x2e6a
cmp eax, dword [ecx + 4]
jle 0x40d86c
push 0x4a0664
call fcn.004374fa
add esp, 4
cmp dword [0x4a0664], 0xffffffff
jne 0x40d86c
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49e564], eax
mov ax, word [ebp - 8]
push 0x476d90
movq qword [0x49e55c], xmm0
mov word [0x49e568], ax
call fcn.00437921
push 0x4a0664
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e55c
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret
Function at 0x40e340
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x10], 0x4b4d564b
mov dword [ebp - 0xc], 0x564b0042
mov word [ebp - 8], 0x2e4b
mov ecx, dword [eax]
mov eax, dword [0x49e438]
cmp eax, dword [ecx + 4]
jle 0x40e3bd
push 0x49e438
call fcn.004374fa
add esp, 4
cmp dword [0x49e438], 0xffffffff
jne 0x40e3bd
movq xmm0, qword [ebp - 0x10]
mov ax, word [ebp - 8]
push 0x476b50
movq qword [0x49ed34], xmm0
mov word [0x49ed3c], ax
call fcn.00437921
push 0x49e438
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49ed34
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x40ea10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x5b4f4d41
mov bl, 0x2e
mov dword [ebp - 0x10], 0x5e5b415a
mov ecx, dword [eax]
mov eax, dword [0x49e6f8]
mov dword [ebp - 0xc], 0x4b005d4a
mov word [ebp - 8], 0x4b56
cmp eax, dword [ecx + 4]
jle 0x40eaa5
push 0x49e6f8
call fcn.004374fa
add esp, 4
cmp dword [0x49e6f8], 0xffffffff
jne 0x40eaa5
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x4a07c4], eax
mov ax, word [ebp - 8]
push 0x4769c0
movq qword [0x4a07bc], xmm0
mov word [0x4a07c8], ax
mov byte [0x4a07ca], bl
call fcn.00437921
push 0x49e6f8
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a07bc
xor ecx, ebp
pop ebx
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x40ef70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov dword [ebp - 0x14], 0x4c425f5d
mov bl, 0x2e
mov dword [ebp - 0x10], 0x5d59415c
mov ecx, dword [eax]
mov eax, dword [0x49e3b0]
mov dword [ebp - 0xc], 0x4b005c4b
mov word [ebp - 8], 0x4b56
cmp eax, dword [ecx + 4]
jle 0x40f005
push 0x49e3b0
call fcn.004374fa
add esp, 4
cmp dword [0x49e3b0], 0xffffffff
jne 0x40f005
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49e3a4], eax
mov ax, word [ebp - 8]
push 0x476890
movq qword [0x49e39c], xmm0
mov word [0x49e3a8], ax
mov byte [0x49e3aa], bl
call fcn.00437921
push 0x49e3b0
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49e39c
xor ecx, ebp
pop ebx
call fcn.00437366
mov esp, ebp
pop ebp
ret
Function at 0x40f0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x59425f5d
mov dword [ebp - 0x10], 0x4b5a475c
mov dword [ebp - 0xc], 0x564b005c
mov ecx, dword [eax]
mov eax, dword [0x49ea5c]
mov word [ebp - 8], 0x2e4b
cmp eax, dword [ecx + 4]
jle 0x40f14c
push 0x49ea5c
call fcn.004374fa
add esp, 4
cmp dword [0x49ea5c], 0xffffffff
jne 0x40f14c
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x4a05a0], eax
mov ax, word [ebp - 8]
push 0x476850
movq qword [0x4a0598], xmm0
mov word [0x4a05a4], ax
call fcn.00437921
push 0x49ea5c
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x4a0598
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x40f640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x5d5d4856
mov dword [ebp - 0x10], 0x414d4d58
mov dword [ebp - 0xc], 0x564b0040
mov ecx, dword [eax]
mov eax, dword [0x49ff98]
mov word [ebp - 8], 0x2e4b
cmp eax, dword [ecx + 4]
jle 0x40f6cc
push 0x49ff98
call fcn.004374fa
add esp, 4
cmp dword [0x49ff98], 0xffffffff
jne 0x40f6cc
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49eed0], eax
mov ax, word [ebp - 8]
push 0x476730
movq qword [0x49eec8], xmm0
mov word [0x49eed4], ax
call fcn.00437921
push 0x49ff98
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49eec8
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret

Function at 0x40f820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x493018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x14], 0x6f7a606d
mov dword [ebp - 0x10], 0x49637d41
mov dword [ebp - 0xc], 0x564b005c
mov ecx, dword [eax]
mov eax, dword [0x4a087c]
mov word [ebp - 8], 0x2e4b
cmp eax, dword [ecx + 4]
jle 0x40f8ac
push 0x4a087c
call fcn.004374fa
add esp, 4
cmp dword [0x4a087c], 0xffffffff
jne 0x40f8ac
mov eax, dword [ebp - 0xc]
movq xmm0, qword [ebp - 0x14]
mov dword [0x49ec2c], eax
mov ax, word [ebp - 8]
push 0x4766d0
movq qword [0x49ec24], xmm0
mov word [0x49ec30], ax
call fcn.00437921
push 0x4a087c
call fcn.004374b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 0x49ec24
xor ecx, ebp
call fcn.00437366
mov esp, ebp
pop ebp
ret
Function at 0x416660
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x17], 0
je 0x41668a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x18
jb 0x416680
mov eax, ecx
ret

Function at 0x416690
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x12], 0
je 0x4166ba
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x13
jb 0x4166b0
mov eax, ecx
ret

Function at 0x416710
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xd], 0
je 0x416722
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xe
jb 0x416718
mov eax, ecx
ret

Function at 0x416760
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xb], 0
je 0x416772
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xc
jb 0x416768
mov eax, ecx
ret

Function at 0x416780
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xe], 0
je 0x416792
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xf
jb 0x416788
mov eax, ecx
ret

Function at 0x416800
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x13], 0
je 0x41682a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x14
jb 0x416820
mov eax, ecx
ret

Function at 0x416870
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xa], 0
je 0x416882
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xb
jb 0x416878
mov eax, ecx
ret

Function at 0x416890
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x16], 0
je 0x4168ba
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x17
jb 0x4168b0
mov eax, ecx
ret

Function at 0x416980
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x18], 0
je 0x4169aa
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x19
jb 0x4169a0
mov eax, ecx
ret

Function at 0x4169b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x11], 0
je 0x4169da
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x12
jb 0x4169d0
mov eax, ecx
ret

Function at 0x416a00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x15], 0
je 0x416a2a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x16
jb 0x416a20
mov eax, ecx
ret
Function at 0x416a90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xc], 0
je 0x416aa2
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xd
jb 0x416a98
mov eax, ecx
ret

Function at 0x416ab0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x19], 0
je 0x416ada
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x1a
jb 0x416ad0
mov eax, ecx
ret

Function at 0x416ae0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x14], 0
je 0x416b0a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x15
jb 0x416b00
mov eax, ecx
ret
Function at 0x418940
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1f], 0
je 0x418964
movaps xmm1, xmmword [0x4896d0]
xor eax, eax
nop
movups xmm0, xmmword [eax + ecx]
pxor xmm0, xmm1
movups xmmword [eax + ecx], xmm0
add eax, 0x10
cmp eax, 0x20
jb 0x418950
ret

Function at 0x418970
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x12], 0
je 0x41899a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x13
jb 0x418990
ret

Function at 0x4189f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xd], 0
je 0x418a02
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xe
jb 0x4189f8
ret

Function at 0x418a10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1e], 0
je 0x418a3a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x1f
jb 0x418a30
ret

Function at 0x418a70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xb], 0
je 0x418a82
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xc
jb 0x418a78
ret

Function at 0x418a90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xe], 0
je 0x418aa2
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xf
jb 0x418a98
ret

Function at 0x418af0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x13], 0
je 0x418b1a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x14
jb 0x418b10
ret

Function at 0x418b20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1c], 0
je 0x418b4a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x1d
jb 0x418b40
ret

Function at 0x418b80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xa], 0
je 0x418b92
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xb
jb 0x418b88
ret

Function at 0x418ba0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x21], 0
je 0x418bda
movaps xmm1, xmmword [0x4896d0]
xor eax, eax
nop
movups xmm0, xmmword [eax + ecx]
pxor xmm0, xmm1
movups xmmword [eax + ecx], xmm0
add eax, 0x10
cmp eax, 0x20
jb 0x418bb0
cmp eax, 0x22
jae 0x418bda
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x22
jb 0x418bd0
ret

Function at 0x418be0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x16], 0
je 0x418c0a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x17
jb 0x418c00
ret
Function at 0x418c10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1a], 0
je 0x418c3a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x1b
jb 0x418c30
ret

Function at 0x418c40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x20], 0
je 0x418c7a
movaps xmm1, xmmword [0x4896d0]
xor eax, eax
nop
movups xmm0, xmmword [eax + ecx]
pxor xmm0, xmm1
movups xmmword [eax + ecx], xmm0
add eax, 0x10
cmp eax, 0x20
jb 0x418c50
cmp eax, 0x21
jae 0x418c7a
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x21
jb 0x418c70
ret

Function at 0x418c80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x18], 0
je 0x418caa
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x19
jb 0x418ca0
ret

Function at 0x418cb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x11], 0
je 0x418cda
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x12
jb 0x418cd0
ret

Function at 0x418d00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x15], 0
je 0x418d2a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x16
jb 0x418d20
ret

Function at 0x418d30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1b], 0
je 0x418d5a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x1c
jb 0x418d50
ret

Function at 0x418d60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1d], 0
je 0x418d8a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x1e
jb 0x418d80
ret

Function at 0x418d90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xc], 0
je 0x418da2
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xd
jb 0x418d98
ret

Function at 0x418db0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x19], 0
je 0x418dda
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x1a
jb 0x418dd0
ret

Function at 0x418de0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x14], 0
je 0x418e0a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4896d0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x15
jb 0x418e00
ret
Function at 0x420f18
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test ebx, ebx
jg 0x420f3c
jl 0x420f33
test esi, esi
jne 0x420f3c
xor eax, eax
xor edx, edx
jmp 0x42102f
cmp dword [edi + 0x38], 0
je 0x420f51
push ebx
push esi
push dword [ebp + 8]
call fcn.00421036
jmp 0x42102f
mov eax, dword [edi + 0x1c]
mov ecx, esi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], esi
mov ecx, dword [eax]
test ecx, ecx
je 0x420fa5
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x420fa5
cmp eax, esi
jb 0x420f77
mov eax, esi
mov dword [ebp - 4], esi
push eax
push ecx
push dword [ebp + 8]
call fcn.0044e840
mov edx, dword [ebp - 4]
mov ecx, esi
mov eax, dword [ebp + 8]
sub ecx, edx
add eax, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
add esp, 0xc
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0xc], ecx
sub dword [eax], edx
mov eax, dword [edi + 0x1c]
add dword [eax], edx
jmp 0x420fab
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [edi + 0x4c], 0
je 0x421023
mov ecx, edi
call fcn.0042077c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
cmp eax, 0xfff
jbe 0x420fff
mov ecx, dword [ebp - 4]
push dword [edi + 0x4c]
push 0xfff
push 1
push ecx
call fcn.00456b44
mov ecx, dword [ebp - 4]
add esp, 0x10
mov edx, dword [ebp - 8]
add ecx, eax
sub edx, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
cmp eax, 0xfff
jne 0x420ffb
cmp edx, eax
ja 0x420fc8
jmp 0x421002
sub esi, edx
jmp 0x421028
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, eax
test eax, eax
je 0x421026
push dword [edi + 0x4c]
push edx
push 1
push dword [ebp - 4]
call fcn.00456b44
mov ecx, dword [ebp - 0xc]
add esp, 0x10
sub ecx, eax
jmp 0x421026
mov ecx, dword [ebp - 0xc]
sub esi, ecx
sbb ebx, 0
mov eax, esi
mov edx, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x439fff
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x466a0f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00466885
Function at 0x4084a0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x491fcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00486dca
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x408522
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00484cdc
mov eax, dword [eax]
push 0x711c6c
push eax
call fcn.00476f24
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00487055
test bl, bl
je 0x408522
push 0x711c6c
lea ecx, [esp + 0xc]
call fcn.004873e5
push 0x711c78
lea ecx, [esp + 0xc]
call fcn.004873e5
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40855e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00487055
jmp 0x408629
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4085e2
lea edx, [esp + 0x7c]
push 0x711c74
push edx
call fcn.00476f24
add esp, 8
test eax, eax
je 0x4085e2
lea eax, [esp + 0x7c]
push 0x711c70
push eax
call fcn.00476f24
add esp, 8
test eax, eax
je 0x4085e2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408572
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00487055
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x408e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x408e92
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc