joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58b26f
Capabilities:
Encode data using xor

Disassembly:
xlatb
push es
das
sal dword [ebx - 0x6b], cl
ja 0x58b209
and eax, 0x7d044323
inc ebx
add al, 0x7d
sbb byte [edx - 0x8a1e6f9], ah
push ss
salc
or dword [esi + edx*4 - 0xd], ebx
pop ebp
adc al, 0x38
add dword [eax + 0x72f65684], 1
jb 0x58b224
xor esp, esp
ja 0x58b289
in al, 0x77
bound ecx, qword [ebx + 0x5e3a23c8]
mov ecx, eax
and edi, dword [edx]
pop esi
push esp
sub eax, 0xab6b89d0
test cl, al
salc
dec ebx
jb 0x58b1ff
sbb eax, 0xa48744e8
ficom word [eax]
mov eax, dword [0x2114a011]
call 0xdefd3982
adc byte [ecx + 0x2114a011], ah
xor dl, byte [edx]
fiadd dword [ebx]
jecxz 0x58b2a5
jne 0x58b292
dec ebp
push ecx
pushfd
dec ecx
retf 0x3980
loop 0x58b2a1
ret
jbe 0x58b221
lodsb al, byte [esi]
pop esp
mov dword [0xa4d6e1a0], eax
mov byte [0xe98df6b9], al
and byte [edx], 0x5b
inc edx
in eax, 0xbc
ret 0x527b
out 0xd1, al
xor ebx, dword [eax - 0x1313aeee]
adc dl, byte [ecx - 0x14]
in al, dx
jp 0x58b2a3
jle 0x58b239
inc esp
loop 0x58b232
adc dword [edx + 0x74a7e8b2], ebp
lea edx, gs:[ecx]
inc edx
cmovge eax, eax
mov al, 0xf4
pop esp
mov eax, 0x5592b29a
sal byte [eax - 0x6547a30c], 0xb2
xchg edx, eax
push ebp
mov esp, 0xe099eec9
and ch, dl
adc al, 0xf0
adc dword [esi - 0x7d], ecx
insd dword es:[edi], dx
sbb al, 0x70
stc
inc eax
jae 0x58b2bd
fistp qword [edx + 0x43f2c351]
or dh, byte [ecx - 0x49]
popfd
lock sub dword [edx - 0x73], 0xffffffbd
sahf
hlt

Function at 0x658e1d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65f398
cmp edx, dword [eax]
je 0x658e3f
add eax, 8
inc ecx
cmp eax, 0x65f428
jl 0x658e30
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65f398]
jne 0x658f6d
mov eax, dword [0xa5bdf4]
cmp eax, 1
je 0x658f47
test eax, eax
jne 0x658e70
cmp dword [0x65f2c4], 1
je 0x658f47
cmp edx, 0xfc
je 0x658f6d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x658ea7
lea eax, [ebp - 0x1a4]
push 0x65e4e8
push eax
call fcn.00659800
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00659c90
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x658eea
lea eax, [ebp - 0x1a4]
push eax
call fcn.00659c90
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65e4e4
push edi
call fcn.0065bb60
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65e4c8
push eax
call fcn.00659800
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00659810
lea eax, [ebp - 0xa0]
push 0x65e4c4
push eax
call fcn.00659810
push dword [esi + 0x65f39c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00659810
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65e49c
push eax
call fcn.0065bad4
add esp, 0x2c
pop edi
jmp 0x658f6d
lea eax, [ebp + 8]
lea esi, [esi + 0x65f39c]
push 0
push eax
push dword [esi]
call fcn.00659c90
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x5f5602
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
mov ecx, 0x37bfb0a6
mov ebx, ecx
pop ecx
jmp 0x5f588f
xchg dword [esp], edi
jmp 0x5f5ebe
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
jmp 0x5f5c3e
xor ebx, 0x7df6b626
sub ebx, 0x90328b0d
sub ebp, ebx
pop ebx
jmp 0x5f57cf
pop ecx
jmp 0x5f5e99
push ebp
mov ebp, esp
jmp 0x5f543c
push dword [esp]
pop eax
push ecx
mov ecx, esp
push edi
mov dword [esp], ebp
jmp 0x5f5e1b
pop edx
pop esi
push edx
mov edx, 0x3bceaf8f
sub esi, edx
pop edx
mov edx, esi
pop esi
push dword [esp]
pop ebp
push esi
push esp
mov esi, dword [esp]
jmp 0x5f581b
add ecx, ebp
mov ebp, dword [esp]
add esp, 4
jmp 0x5f592f
add esp, 4
add esi, 4
push ecx
mov ecx, 4
add esi, ecx
jmp 0x5f555a
mov dword [esp], ebp
push edx
push 0x7ff1c8ac
jmp 0x5f597c
mov edx, 0x738e6035
sub edx, ebx
pop ebx
add dword [esp + 4], edx
jmp 0x5f576b
not eax
add eax, 0xddf327bc
jmp 0x5f5940
add ecx, 4
xchg dword [esp], ecx
mov esp, dword [esp]
jmp 0x5f5fb0
sub ebx, eax
pop eax
sub ebx, eax
push eax
mov eax, 0x773bfa36
add ebx, eax
pop eax
mov eax, dword [esp]
add esp, 4
push edx
push 0xe8ca721
jmp 0x5f5871
pop edx
mov ebp, edx
pop edx
jmp 0x5f5d8f
push esp
pop edi
add edi, 4
sub edi, 4
jmp 0x5f5434
pop esp
pop edx
push eax
mov eax, 0x66b72d85
jmp 0x5f58a8
sub ebp, 0x7efbb68d
push edi
jmp 0x5f5dad
mov edi, 0x656f2139
xor edi, 0x21c9fc84
add edi, 0x37346e1b
jmp 0x5f5e8b
mov ebp, 0x3d6edd2d
sub ebp, 0x2f3d9342
not ebp
push ebx
push 0x45c77944
jmp 0x5f5ed1
push esi
push ebp
push edx
jmp 0x5f5410
sub ebp, edi
pop edi
add ebp, 0xf0116c5a
jmp 0x5f5e70
xchg dword [esp], esi
mov esp, dword [esp]
jmp 0x5f5eaa
push edi
mov edi, edx
mov eax, edi
pop edi
pop edx
push 0x345ac426
mov dword [esp], edi
jmp 0x5f59e6
pop esp
mov dword [esp], edi
mov dword [esp], edx
mov dword [esp], 0x74d6644c
jmp 0x5f563b
mov dword [esp], edx
mov edx, 0x7d7b8393
jmp 0x5f5ede
neg edx
not edx
and edx, 0x7bfaf5e2
dec edx
shr edx, 2
xor edx, 0x61a35f68
push edx
pop ebx
pop edx
add ebx, 0xffffffff
add ebx, 0x7ce79631
or ebx, 0x6bb37203
jmp 0x5f54d6
les eax, [ebx + eax*4]
les eax, [ecx + eax*4]
jmp 0x7aec7438
jle 0x5f5f9a
cmp byte [edx], dh
pop ss
xor dword [edx], esi
pop ss
fnstcw word [edi + 0x69ea49f5]
imul edx, dword ds:[edi + 3], 0x6815583e
cmp eax, 0x86d5daa
loopne 0x5f5f98
inc eax
xor ah, byte [edi + 0x7a]
imul ecx, ebx, 0x3239d922
add dword [edx + 0x41], ebx
xor ecx, esp
xlatb
mov al, 0x46
pop ss
fnstcw word [ecx]
sub bh, cl
std
adc eax, 0x38746416
add eax, 0x3239dd7f
pop ss
cmp dword [ecx + 0x6c51ee87], esp
and bx, word [edx + 0x74]
and ax, word [ebp + 0x3a]
xor dl, byte [edi]
sbb ch, byte [ecx + 0x57066687]
mov dword [ebx + 0x58a6221a], esp
sub byte [ebp + ebx*4 - 0x555826f3], 0x24
fnstcw word [ecx]
xor dh, byte [edi]
xor ebp, 0x1c
sahf
cmc
sbb al, 0x9e
or al, 0x56
inc esi
xchg esi, eax
sbb al, 0x56
inc esi
xor bl, cl
cmp dword [edx], esi
in eax, 0xa
mul edi
push ebx
fdiv dword [edi + 0x39d9174a]
inc ebx
test eax, 0x173239da
jns 0x5f5fd2
cmp byte [esi - 0x22], dl
push 0xffffffffffffffc6
jmp 0x5f601a
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x2d3a61ca
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, str.3_M
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x24733dd5
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10016a26
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10016a47
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x10016a5f
push 0
push 0x129e
push 0
push 0
push 0x261a
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1001d985
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001d99b
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
jmp 0x1001d9bf
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001d9bf
push 0
push 0x129e
push 0
push 0
push 0x261a
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret
Function at 0x10027ece
Capabilities:
Create thread
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10027ef5
push 0
push 0x129e
push 0
push 0
push 0x261a
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10027f15
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10027f15
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret
Function at 0x1002efe3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002f007
xor eax, eax
jmp 0x1002f12d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002f025
xor eax, eax
jmp 0x1002f12d
push 1
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
call fcn.1002eaf2
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x1002f043
xor eax, eax
jmp 0x1002f12d
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x288
push 0x58bb
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1002ede0
add esp, 0x20
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 1
call fcn.1002ee79
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
call fcn.1002eeea
add esp, 0x10
cmp dword [ebp - 0x14], 0
je 0x1002f0af
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 4]
push eax
call fcn.1002ef45
add esp, 0xc
push dword [ebp - 4]
call fcn.1002e9d9
pop ecx
test eax, eax
jne 0x1002f0c0
xor eax, eax
jmp 0x1002f12d
push 1
lea eax, [ebp - 4]
push eax
push 0xc16
call fcn.1002ef9e
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002f115
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002f0f2
xor eax, eax
jmp 0x1002f12d
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002f10b
xor eax, eax
jmp 0x1002f12d
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002f126
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002f12a
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10042694
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100426c6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x100426f4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x100426f4
push 0
push 0x129e
push 0
push 0
push 0x261a
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret

Function at 0x10042cf8
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10042d2d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [eax + 0xc], ecx
jmp 0x10042d4d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10042d4d
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret
Function at 0x10061b50
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1008e340]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20], ax
xor ecx, ecx
mov word [ebp - 0x1e], cx
cmp dword [ebp + 8], 0xffffffff
jne 0x10061b74
jmp 0x10061be3
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x10061b88
jmp 0x10061be3
movsx ecx, word [ebp - 0x1c]
movsx edx, word [ebp - 0x1a]
imul ecx, edx
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
jne 0x10061bb4
jmp 0x10061be3
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x10061bd5
jmp 0x10061be3
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006fb8e
mov esp, ebp
pop ebp
ret

Function at 0x1006a2d0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 5]
and ecx, 0xf
movzx edx, byte [0x1067a0a2]
or ecx, edx
mov byte [ebp - 1], cl
movzx ax, byte [ebp - 1]
movzx ecx, ax
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
push ecx
push 0x10d88db8
call fcn.1005cfa0
add esp, 8
mov esp, ebp
pop ebp
ret 4
Function at 0x10085815
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008e340]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1007605a
mov dword [ebp - 0x14], eax
cmp dword [0x10d89dac], esi
jne 0x10085908
push 0x800
push esi
push 0x100092ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10085895
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100859e8
push esi
push esi
push 0x100092ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100859e8
push 0x100092c4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100859e8
push eax
call ebx
push 0x100092d0
push edi
mov dword [0x10d89dac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100092e0
push edi
mov dword [0x10d89db0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100092f4
push edi
mov dword [0x10d89db4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10d89dbc], eax
test eax, eax
je 0x10085905
push 0x10009310
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10d89db8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1008592d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10085920
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10085942
push 4
pop eax
jmp 0x100859ea
cmp dword [ebp - 0x14], esi
je 0x10085942
push dword [0x10d89dac]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10085927
mov eax, dword [0x10d89db8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100859a0
cmp dword [0x10d89dbc], edi
je 0x100859a0
push eax
call ebx
push dword [0x10d89dbc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100859a0
test eax, eax
je 0x100859a0
call ecx
test eax, eax
je 0x10085995
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10085995
test byte [ebp - 8], 1
jne 0x100859a0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100859d0
mov eax, dword [0x10d89db0]
cmp eax, edi
je 0x100859cd
push eax
call ebx
test eax, eax
je 0x100859cd
call eax
mov esi, eax
test esi, esi
je 0x100859cd
mov eax, dword [0x10d89db4]
cmp eax, edi
je 0x100859cd
push eax
call ebx
test eax, eax
je 0x100859cd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10d89dac]
call ebx
test eax, eax
je 0x100859e8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100859ea
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006fb8e
mov esp, ebp
pop ebp
ret
Function at 0x4025c1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
push esi
push edi
mov eax, dword [ebx]
mov edi, dword [ebx + 4]
xor edi, eax
mov dword [ebp - 0xc], eax
mov eax, edi
mov ecx, edi
and eax, 0xfffffffc
mov esi, edi
add eax, 4
and cl, 3
cmovne esi, eax
mov ecx, esi
call fcn.00402ef3
mov dword [ebp - 4], eax
test eax, eax
je 0x40263b
shr esi, 2
lea edx, [ebx + 8]
xor ebx, ebx
and dword [ebp - 8], ebx
lea ecx, [edx + esi*4]
mov esi, ecx
sub esi, edx
add esi, 3
shr esi, 2
cmp edx, ecx
cmova esi, dword [ebp - 8]
test esi, esi
je 0x40262f
mov ecx, eax
sub ecx, edx
mov eax, dword [edx]
xor eax, dword [ebp - 0xc]
inc ebx
mov dword [ecx + edx], eax
lea edx, [edx + 4]
cmp ebx, esi
jb 0x40261f
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x402638
mov dword [eax], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402647
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
xor ebx, ecx
mov dword [ebp - 0xc], ecx
push edi
mov dword [ebp - 0x14], ebx
lea esi, [ebx + 1]
mov eax, esi
mov edx, esi
and eax, 0xfffffffc
add eax, 4
and dl, 3
cmovne esi, eax
lea ecx, [esi + esi]
call fcn.00402ef3
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x4026f2
mov eax, dword [ebp - 4]
and dword [ebp - 4], 0
add eax, 8
shr esi, 2
lea ecx, [eax + esi*4]
mov esi, edi
mov edx, ecx
sub edx, eax
add edx, 3
shr edx, 2
cmp eax, ecx
cmova edx, dword [ebp - 4]
test edx, edx
je 0x4026ec
mov ebx, eax
xor edi, edi
mov ecx, dword [ebx]
lea ebx, [ebx + 4]
xor ecx, dword [ebp - 0xc]
movzx eax, cl
mov word [esi], ax
mov eax, ecx
shr eax, 8
lea esi, [esi + 8]
movzx eax, al
mov word [esi - 6], ax
shr ecx, 0x10
movzx eax, cl
shr ecx, 8
inc edi
mov word [esi - 4], ax
movzx eax, cl
mov word [esi - 2], ax
cmp edi, edx
jb 0x4026b0
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
xor eax, eax
mov word [edi + ebx*2], ax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4026fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
push edi
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
xor eax, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], eax
lea edi, [eax + 1]
mov eax, edi
mov edx, edi
and eax, 0xfffffffc
add eax, 4
and dl, 3
cmovne edi, eax
mov ecx, edi
call fcn.00402ef3
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0x40278d
and dword [ebp - 4], 0
add ebx, 8
shr edi, 2
xor eax, eax
mov edx, esi
lea ecx, [ebx + edi*4]
mov edi, ecx
sub edi, ebx
add edi, 3
shr edi, 2
cmp ebx, ecx
cmova edi, eax
test edi, edi
je 0x402786
mov esi, dword [ebp - 4]
mov ecx, dword [ebx]
lea ebx, [ebx + 4]
xor ecx, dword [ebp - 8]
mov byte [edx], cl
mov eax, ecx
shr eax, 8
lea edx, [edx + 4]
shr ecx, 0x10
mov byte [edx - 3], al
mov byte [edx - 2], cl
shr ecx, 8
inc esi
mov byte [edx - 1], cl
cmp esi, edi
jb 0x40275d
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov byte [esi + eax], 0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402abd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0xcb5f
add dword [ebp - 8], 0xffffe5a3
imul eax, dword [ebp - 8], 0x24
push ebx
mov ebx, ecx
mov dword [ebp - 8], eax
add dword [ebp - 8], 0xffff8849
shl dword [ebp - 8], 5
xor dword [ebp - 8], 0x900ea921
xor dword [ebp - 8], 0x93033b01
mov dword [ebp - 4], 0xd4cb
xor dword [ebp - 4], 0x12ca9c68
shl dword [ebp - 4], 4
xor dword [ebp - 4], 0xf01dbcf9
xor dword [ebp - 4], 0xdcb936cf
mov dword [ebp - 4], 0x89fe
add dword [ebp - 4], 0xffffaceb
imul eax, dword [ebp - 4], 0x74
mov dword [ebp - 4], eax
imul eax, dword [ebp - 4], 0x2c
mov dword [ebp - 4], eax
shl dword [ebp - 4], 3
shr dword [ebp - 4], 0xb
xor dword [ebp - 4], 0x446d5
cmp byte [ebx], 0
je 0x402bba
push esi
push edi
mov edi, dword [ebp - 8]
mov dword [ebp - 4], 0xd4cb
xor dword [ebp - 4], 0x12ca9c68
shl dword [ebp - 4], 4
xor dword [ebp - 4], 0xf01dbcf9
xor dword [ebp - 4], 0xdcb936cf
mov cl, byte [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [ebp - 4], 0x89fe
add dword [ebp - 4], 0xffffaceb
imul eax, dword [ebp - 4], 0x74
shl esi, cl
mov dword [ebp - 4], eax
imul eax, dword [ebp - 4], 0x2c
mov dword [ebp - 4], eax
shl dword [ebp - 4], 3
shr dword [ebp - 4], 0xb
xor dword [ebp - 4], 0x446d5
mov cl, byte [ebp - 4]
mov edx, dword [ebp - 8]
movsx eax, byte [ebx]
mov dword [ebp - 8], eax
add dword [ebp - 8], esi
shl edx, cl
add dword [ebp - 8], edx
sub dword [ebp - 8], edi
inc ebx
cmp byte [ebx], 0
jne 0x402b45
pop edi
pop esi
mov eax, dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret