joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e59fabc
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4e5d94e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.4e58c8bf
mov dword [ebp - 0x14], eax
cmp dword [0x4e5de00c], edi
jne 0x4e59fbad
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4e59fb3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4e59fc8d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4e59fc8d
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4e59fc8d
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4e5de00c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4e5de010], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4e5de014], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4e5de01c], eax
test eax, eax
je 0x4e59fbaa
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4e5de018], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4e59fbd2
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4e59fbc5
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4e59fbe7
push 4
pop eax
jmp 0x4e59fc8f
cmp dword [ebp - 0x14], edi
je 0x4e59fbe7
push dword [0x4e5de00c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4e59fbcc
mov eax, dword [0x4e5de018]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4e59fc45
cmp dword [0x4e5de01c], esi
je 0x4e59fc45
push eax
call ebx
push dword [0x4e5de01c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4e59fc45
test eax, eax
je 0x4e59fc45
call ecx
test eax, eax
je 0x4e59fc3a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4e59fc3a
test byte [ebp - 8], 1
jne 0x4e59fc45
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4e59fc75
mov eax, dword [0x4e5de010]
cmp eax, esi
je 0x4e59fc72
push eax
call ebx
test eax, eax
je 0x4e59fc72
call eax
mov edi, eax
test edi, edi
je 0x4e59fc72
mov eax, dword [0x4e5de014]
cmp eax, esi
je 0x4e59fc72
push eax
call ebx
test eax, eax
je 0x4e59fc72
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4e5de00c]
call ebx
test eax, eax
je 0x4e59fc8d
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4e59fc8f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4e587fd7
leave
ret
Function at 0x4e5a2198
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.4e591a5d
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4e5a21d0
xor eax, eax
jmp 0x4e5a21fc
cmp esi, dword [ebp - 4]
je 0x4e5a21f9
cmp dword [ebp + 0xc], 0
je 0x4e5a21f9
push dword [edi + 0x9c]
call fcn.4e5a1da6
push dword [edi + 0x9c]
mov esi, eax
call fcn.4e58cb67
pop ecx
pop ecx
cmp esi, eax
je 0x4e5a21cc
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x401000
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x401137
mov eax, dword [ebp + 0xc]
test eax, eax
js 0x401137
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x401129
mov dword [ebp - 8], eax
test eax, eax
jle 0x401121
mov eax, dword [section..data]
push ebx
push edi
push 2
pop ebx
cmp dword [ebp - 8], 3
mov dl, byte [esi]
mov byte [ebp - 1], dl
jl 0x4010ae
mov dl, byte [esi + 1]
movzx edi, byte [ebp - 1]
mov byte [ebp + 0xb], dl
mov dl, byte [esi + 2]
mov byte [ebp - 2], dl
mov edx, edi
shr edx, 2
movsx dx, byte [edx + eax]
mov word [ecx], dx
movzx edx, byte [ebp + 0xb]
mov dword [ebp + 8], edx
shl edi, 4
shr edx, 4
or edx, edi
and edx, 0x3f
movsx dx, byte [edx + eax]
add ecx, ebx
mov word [ecx], dx
movzx edx, byte [ebp - 2]
add ecx, ebx
mov ebx, dword [ebp + 8]
mov edi, edx
shr edi, 6
shl ebx, 2
or edi, ebx
and edi, 0x3f
movsx di, byte [edi + eax]
add esi, 3
push 2
and edx, 0x3f
mov word [ecx], di
movsx dx, byte [edx + eax]
pop ebx
jmp 0x40110a
inc esi
cmp dword [ebp - 8], ebx
jne 0x4010bc
mov dl, byte [esi]
mov byte [ebp + 0xb], dl
inc esi
jmp 0x4010c0
mov byte [ebp + 0xb], 0
movzx edi, byte [ebp - 1]
mov edx, edi
shr edx, 2
movsx dx, byte [edx + eax]
mov word [ecx], dx
movzx edx, byte [ebp + 0xb]
mov dword [ebp + 8], edx
shr edx, 4
shl edi, 4
or edx, edi
and edx, 0x3f
movsx dx, byte [edx + eax]
add ecx, ebx
mov word [ecx], dx
add ecx, ebx
cmp dword [ebp - 8], 1
jne 0x4010fa
push 0x3d
pop edx
jmp 0x401104
mov edx, dword [ebp + 8]
and edx, 0xf
movsx edx, byte [eax + edx*4]
push 0x3d
mov word [ecx], dx
pop edx
sub dword [ebp - 8], 3
add ecx, ebx
mov word [ecx], dx
add ecx, ebx
cmp dword [ebp - 8], 0
jg 0x40103c
pop edi
pop ebx
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp + 0xc]
add eax, 2
cdq
push 3
pop ecx
idiv ecx
shl eax, 2
jmp 0x40113a
or eax, 0xffffffff
pop esi
leave
ret

Function at 0x405945
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x483e68]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0x14]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, ecx
call fcn.004374f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
push 0xb0
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0x210]
jne 0x4059e8
mov ecx, dword [esi + 0x98]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0x70], 0
jbe 0x4059e8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, dword [esi + 0x70]
jb 0x4059e8
mov dword [edi], 1
and dword [edi], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00435805
leave
ret 0x10
Function at 0x405fce
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push 0
push 0xb1
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x405ffd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_SetFocus]
push 5
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x46c39c
push 0x46c380
call fcn.00407d31
mov eax, dword [esi]
add esp, 0xc
push dword [ebp - 4]
mov ecx, esi
call dword [eax + 0x20]
push dword [esi + 0xa0]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x48]
push dword [esi + 0xa8]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xbc]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x78]
cmp dword [esi + 0x98], 0
je 0x406076
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx]
mov eax, dword [ebp + 0x14]
and dword [eax], 0
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x40771e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xb0
mov eax, 0x46481e
call fcn.0043587d
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xbc], ebx
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
push str.HKEY_LOCAL_MACHINE
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 2
mov dword [ebp - 0xb4], eax
call fcn.004061cf
test eax, eax
jne 0x40780d
lea eax, [ebp - 0xb8]
push eax
push 0x20019
push ebx
push edi
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40780d
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xb0]
push eax
push ebx
push ebx
push dword [ebp - 0xb4]
mov dword [ebp - 0xbc], 0x208
push dword [ebp - 0xb8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xb8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x40780d
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0xb4]
call fcn.004076dd
mov eax, dword [ebp - 0xb4]
mov byte [ebp - 4], 3
cmp dword [eax - 0xc], ebx
jle 0x4077ff
add eax, 0xfffffff0
push eax
call fcn.00405e04
add eax, 0x10
pop ecx
mov dword [esi], eax
mov ecx, dword [ebp - 0xb4]
add ecx, 0xfffffff0
call fcn.00405c12
jmp 0x407819
push 0x46bb7c
mov ecx, esi
call fcn.004074b0
jmp 0x4077ef
push 0x46bb7c
mov ecx, esi
call fcn.004074b0
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00405c12
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00405c12
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.00405c12
mov eax, esi
call fcn.00435900
ret
Function at 0x407d31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x407d51
xor eax, eax
jmp 0x407dc9
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push edi
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
cmp ebx, esi
jne 0x407d6f
xor eax, eax
jmp 0x407dc8
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push dword [ebp - 8]
push ebx
push eax
call fcn.004350c0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push esi
push dword [ebp - 4]
call fcn.00405c9f
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
push edi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeResource]
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret

Function at 0x408ee0
Capabilities:
Terminate thread

Disassembly:
push esi
lea esi, [ecx + 0xdc]
mov eax, dword [esi]
test eax, eax
je 0x408efe
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
ret
Function at 0x409085
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x483e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xb0], ecx
push 6
pop edx
mov byte [ebp - 0x20], 0
mov ecx, edx
lea edi, [ebp - 0x1f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0x74], 0
mov ecx, edx
lea edi, [ebp - 0x73]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov esi, dword [ebp + 8]
mov byte [ebp - 0x58], 0
mov ecx, edx
lea edi, [ebp - 0x57]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, dword [ebp + 0xc]
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0x3c], 0
mov ecx, edx
lea edi, [ebp - 0x3b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x1c
stosb byte es:[edi], al
pop edi
push edi
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.004350c0
push edi
add esi, edi
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.004350c0
imul ebx, ebx, 0x300
add esp, 0x18
xor esi, esi
add ebx, dword [ebp - 0xb0]
movsx eax, byte [esi + 0x46c8d8]
mov ecx, edi
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x20]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004350c0
movsx eax, byte [esi + 0x46c8d8]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x3c]
sub ecx, eax
push ecx
call fcn.004350c0
movsx eax, byte [esi + 0x46c8d8]
mov ecx, edi
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x74]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004350c0
movsx eax, byte [esi + 0x46c8d8]
push eax
lea ecx, [ebp - 0x74]
push ecx
lea ecx, [ebp - 0x20]
sub ecx, eax
push ecx
call fcn.004350c0
push 0x37
lea eax, [ebp - 0xab]
push 0
push eax
mov byte [ebp - 0xac], 0
call fcn.004374f0
push edi
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.004350c0
add esp, 0x48
push edi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.004350c0
add esp, 0xc
xor eax, eax
movsx ecx, byte [eax + 0x46c8a8]
mov cl, byte [ebp + ecx - 0xad]
mov byte [ebx + eax], cl
inc eax
cmp eax, 0x30
jl 0x4091b9
push edi
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004350c0
push edi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.004350c0
add esp, 0x18
inc esi
add ebx, 0x30
cmp esi, 0x10
jl 0x409116
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00435805
leave
ret 8

Function at 0x40920d
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov ecx, 0x46c8e8
push 0x40
sub ecx, eax
pop esi
movsx edx, byte [ecx + eax]
mov edi, dword [ebp + 8]
mov dl, byte [edx + edi - 1]
mov byte [eax], dl
inc eax
dec esi
jne 0x40921f
pop edi
pop esi
pop ebp
ret 8

Function at 0x409236
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov ecx, 0x46c928
push 0x30
sub ecx, eax
pop esi
movsx edx, byte [ecx + eax]
mov edi, dword [ebp + 8]
mov dl, byte [edx + edi - 1]
mov byte [eax], dl
inc eax
dec esi
jne 0x409248
pop edi
pop esi
pop ebp
ret 8
Function at 0x40925f
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov ecx, 0x46cb58
push 0x20
sub ecx, eax
pop esi
movsx edx, byte [ecx + eax]
mov edi, dword [ebp + 8]
mov dl, byte [edx + edi - 1]
mov byte [eax], dl
inc eax
dec esi
jne 0x409271
pop edi
pop esi
pop ebp
ret 8

Function at 0x4099db
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
call fcn.00408ee0
mov ecx, esi
pop esi
jmp fcn.00408f00

Function at 0x4099f6
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x483e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push 0x40
xor ebx, ebx
lea eax, [esi + 0x600]
push ebx
push eax
call fcn.004374f0
push 0x40
lea eax, [esi + 0x640]
push ebx
push eax
call fcn.004374f0
push 8
lea eax, [esi + 0x680]
push ebx
push eax
call fcn.004374f0
push 8
lea eax, [esi + 0x688]
push ebx
push eax
call fcn.004374f0
push 0x41
lea eax, [esi + 0x690]
push ebx
push eax
call fcn.004374f0
push 0x11
lea eax, [esi + 0x6d1]
push ebx
push eax
call fcn.004374f0
add esp, 0x48
push 9
lea eax, [esi + 0x6e2]
push ebx
push eax
call fcn.004374f0
mov edi, 0x1000
push edi
lea eax, [esi + 0x6eb]
push ebx
push eax
call fcn.004374f0
push edi
lea eax, [esi + 0x16eb]
push ebx
push eax
call fcn.004374f0
push 0x3f
lea eax, [ebp - 0x7b]
push ebx
push eax
mov byte [ebp - 0x7c], bl
call fcn.004374f0
add esp, 0x30
push 0x40
lea eax, [ebp - 0x7c]
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.00409288
push 0x37
lea eax, [ebp - 0x3b]
push ebx
push eax
mov byte [ebp - 0x3c], bl
call fcn.004374f0
add esp, 0xc
movsx eax, byte [ebx + 0x46c870]
mov al, byte [ebp + eax - 0x7d]
mov byte [ebp + ebx - 0x3c], al
inc ebx
cmp ebx, 0x38
jl 0x409ace
push dword [ebp + 0xc]
lea eax, [ebp - 0x3c]
push eax
mov ecx, esi
call fcn.00409085
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00435805
leave
ret 8
Function at 0x40a2f9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x483e68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
push 0x2f
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0xf3]
push ebx
push eax
mov dword [ebp - 0x100], ecx
mov byte [ebp - 0xf4], bl
call fcn.004374f0
push 0x2f
lea eax, [ebp - 0x93]
push ebx
push eax
mov byte [ebp - 0x94], bl
call fcn.004374f0
push 7
xor eax, eax
pop ecx
mov byte [ebp - 0x24], bl
lea edi, [ebp - 0x23]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x64], bl
lea edi, [ebp - 0x63]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x2f
stosb byte es:[edi], al
lea eax, [ebp - 0xc3]
push ebx
push eax
mov byte [ebp - 0xc4], bl
call fcn.004374f0
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x44], bl
shl esi, 4
add esi, dword [ebp - 0x104]
lea edi, [ebp - 0x43]
rep stosd dword es:[edi], eax
imul esi, esi, 0x30
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp - 0x100]
push 0x30
add esi, edi
lea eax, [ebp - 0xc4]
push esi
push eax
call fcn.004350c0
add esp, 0x30
lea eax, [ebp - 0xf4]
push eax
push dword [ebp - 0xf8]
mov ecx, edi
call fcn.00409236
xor eax, eax
mov cl, byte [ebp + eax - 0xc4]
xor cl, byte [ebp + eax - 0xf4]
inc eax
mov byte [ebp + eax - 0x95], cl
cmp eax, 0x30
jb 0x40a3e0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x94]
push eax
mov ecx, edi
call fcn.00409b02
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x44]
push eax
mov ecx, edi
call fcn.0040925f
mov esi, dword [ebp - 0xfc]
lea eax, [ebp - 0x24]
sub esi, eax
lea eax, [ebp + ebx - 0x24]
mov cl, byte [esi + eax]
xor cl, byte [eax]
inc ebx
mov byte [ebp + ebx - 0x65], cl
cmp ebx, 0x20
jb 0x40a427
push 0x20
push dword [ebp - 0xf8]
push dword [ebp - 0xfc]
call fcn.004350c0
push 0x20
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0xf8]
call fcn.004350c0
mov ecx, dword [ebp - 4]
add esp, 0x18
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00435805
leave
ret 0x10
Function at 0x40ada1
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x483e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x3f
lea eax, [ebp - 0x103]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x104], bl
call fcn.004374f0
push 0x3f
lea eax, [ebp - 0x83]
push ebx
push eax
mov byte [ebp - 0x84], bl
call fcn.004374f0
push 7
xor eax, eax
pop ecx
mov byte [ebp - 0x24], bl
lea edi, [ebp - 0x23]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x44], bl
lea edi, [ebp - 0x43]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3f
stosb byte es:[edi], al
lea eax, [ebp - 0xc3]
push ebx
push eax
mov byte [ebp - 0xc4], bl
call fcn.004374f0
add esp, 0x24
push 0x40
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.00409288
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x104]
push eax
mov ecx, esi
call fcn.0040920d
push 0x20
pop edi
push edi
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004350c0
push edi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004350c0
add esp, 0x18
mov dword [ebp - 0x108], ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x44]
push dword [ebp - 0x108]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040a2f9
inc dword [ebp - 0x108]
cmp dword [ebp - 0x108], 0x10
jl 0x40ae70
push edi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.004350c0
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.004350c0
add esp, 0x18
lea eax, [esi + 0x600]
movsx ecx, byte [ebx + 0x46cb78]
mov cl, byte [ebp + ecx - 0xc5]
mov byte [eax + ebx], cl
inc ebx
cmp ebx, 0x40
jl 0x40aec2
push 0x40
push eax
lea eax, [esi + 0x680]
push eax
mov ecx, esi
call fcn.004092bb
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00435805
leave
ret 8
Function at 0x40aefb
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x483e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x3f
lea eax, [ebp - 0x103]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x104], bl
call fcn.004374f0
push 0x3f
lea eax, [ebp - 0x83]
push ebx
push eax
mov byte [ebp - 0x84], bl
call fcn.004374f0
push 7
xor eax, eax
pop ecx
mov byte [ebp - 0x44], bl
lea edi, [ebp - 0x43]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x24], bl
lea edi, [ebp - 0x23]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3f
stosb byte es:[edi], al
lea eax, [ebp - 0xc3]
push ebx
push eax
mov byte [ebp - 0xc4], bl
call fcn.004374f0
add esp, 0x24
push 0x40
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.00409288
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x104]
push eax
mov ecx, esi
call fcn.0040920d
push 0x20
pop edi
push edi
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004350c0
push edi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004350c0
add esp, 0x18
mov dword [ebp - 0x108], ebx
push dword [ebp + 0xc]
mov ecx, esi
push 0xf
pop eax
sub eax, dword [ebp - 0x108]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040a2f9
inc dword [ebp - 0x108]
cmp dword [ebp - 0x108], 0x10
jl 0x40afca
push edi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.004350c0
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.004350c0
add esp, 0x18
lea eax, [esi + 0x640]
movsx ecx, byte [ebx + 0x46cb78]
mov cl, byte [ebp + ecx - 0xc5]
mov byte [eax + ebx], cl
inc ebx
cmp ebx, 0x40
jl 0x40b020
push 0x40
push eax
lea eax, [esi + 0x688]
push eax
mov ecx, esi
call fcn.004092bb
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00435805
leave
ret 8