joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456d60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cf54d
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x65ebc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 3
push 0x644b78
push 0
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.00464410
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0x3c
cmova eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x50]
push eax
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x4c], 0x40
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], str.cmd.exe
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x456e0c
or esi, 0xffffffff
jmp 0x456e30
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x456e66
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x456e5c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x456e5c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005cad77
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ca9f7
mov esp, ebp
pop ebp
ret
Function at 0x457170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cf61e
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x65ebc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x60], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
movaps xmm0, xmmword [0x64e610]
movups xmmword [ebp - 0x5c], xmm0
push 0
movaps xmm0, xmmword [0x64e670]
movups xmmword [ebp - 0x4c], xmm0
push 0x644805
movaps xmm0, xmmword [0x64e750]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x7a797877
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0x33323130
movups xmmword [esi], xmm0
mov dword [ebp - 0x24], 0x37363534
mov word [ebp - 0x20], 0x3938
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00466b00
mov dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0x18], 1
nop dword [eax]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0x3e
idiv ecx
mov ecx, dword [esi + 0x10]
mov al, byte [ebp + edx - 0x5c]
mov byte [ebp - 0x14], al
cmp ecx, 0x7fffffff
je 0x457321
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x45724e
mov eax, dword [esi]
push 1
lea edx, [ebp - 0x14]
push edx
push ecx
push eax
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x78]
call fcn.004683b0
or dword [ebp - 0x18], 2
lea eax, [ebp - 0x78]
cmp esi, eax
je 0x4572c4
mov ecx, dword [esi + 0x14]
cmp ecx, 0xf
jbe 0x4572a0
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x457296
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45731b
mov eax, edx
push ecx
push eax
call fcn.005cad77
add esp, 8
movups xmm0, xmmword [ebp - 0x78]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x68]
movq qword [esi + 0x10], xmm0
jmp 0x4572f4
mov ecx, dword [ebp - 0x64]
cmp ecx, 0xf
jbe 0x4572f4
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4572ea
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45731b
push ecx
push edx
call fcn.005cad77
add esp, 8
inc edi
cmp edi, 0x20
jl 0x457220
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ca9f7
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.00447190
int3

Function at 0x457330
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
cmova eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, dword [ebp + 0x1c]
add esp, 4
cmp ecx, 0xf
jbe 0x45737e
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x457374
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x457374
jmp dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005cad77
add esp, 8
pop ebp
ret
Function at 0x4573c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cf66d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x65ebc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], esi
lea eax, [ebp + 0x20]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x28]
call fcn.00462a30
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x18]
cmp dword [ebp + 0x30], eax
jae 0x457424
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 0x20]
call fcn.00462850
mov eax, dword [ebp + 0x18]
cmp dword [ebp + 0x30], eax
jb 0x457410
xor edx, edx
test eax, eax
je 0x457452
nop word [eax + eax]
cmp dword [ebp + 0x34], 0xf
lea eax, [ebp + 0x20]
cmova eax, dword [ebp + 0x20]
cmp dword [ebp + 0x1c], 0xf
mov cl, byte [eax + edx]
lea eax, [ebp + 8]
cmova eax, dword [ebp + 8]
xor byte [eax + edx], cl
inc edx
cmp edx, dword [ebp + 0x18]
jb 0x457430
mov ecx, dword [ebp - 0x14]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov eax, 0xf
mov dword [esi + 0x14], 0
movups xmm0, xmmword [ebp + 8]
mov byte [ebp + 8], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp + 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], eax
cmp ecx, eax
jbe 0x4574bc
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4574af
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x457523
push ecx
push edx
call fcn.005cad77
mov eax, dword [ebp + 0x1c]
add esp, 8
cmp eax, 0xf
jbe 0x4574eb
mov edx, dword [ebp + 8]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4574e1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x457523
push ecx
push edx
call fcn.005cad77
add esp, 8
mov ecx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp ecx, 0xf
jbe 0x457533
mov edx, dword [ebp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x457529
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x457529
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005cad77
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ca9f7
mov esp, ebp
pop ebp
ret
Function at 0x45e270
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
mov eax, dword [0x65ebc0]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
call fcn.00451f70
mov ebx, dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor esi, esi
push esi
push 2
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
call ebx
mov edi, eax
mov dword [esp + 0x18], 0x128
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x45e32b
mov ecx, str.ProjectTitan.exe
lea eax, [esp + 0x3c]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x45e300
test dl, dl
je 0x45e2fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x45e300
add eax, 2
add ecx, 2
test dl, dl
jne 0x45e2e0
xor eax, eax
jmp 0x45e305
sbb eax, eax
or eax, 1
test eax, eax
jne 0x45e31b
mov eax, dword [esp + 0x2c]
cmp eax, esi
jle 0x45e31b
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x45e2d1
xor edi, edi
xor esi, esi
push edi
push 2
call ebx
mov ebx, eax
mov dword [esp + 0x140], 0x128
lea eax, [esp + 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
lea eax, [esp + 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x45e3d0
nop dword [eax]
nop word [eax + eax]
mov eax, 0x644e28
lea ecx, [esp + 0x164]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x45e3a0
test dl, dl
je 0x45e39c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x45e3a0
add ecx, 2
add eax, 2
test dl, dl
jne 0x45e380
xor eax, eax
jmp 0x45e3a5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x45e3bd
mov eax, dword [esp + 0x154]
cmp eax, edi
jle 0x45e3bd
mov esi, dword [esp + 0x148]
mov edi, eax
lea eax, [esp + 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x45e370
mov eax, dword [esp + 0x10]
test eax, eax
je 0x45e3dd
cmp eax, 1
jne 0x45e3ed
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45e3eb
cmp eax, 1
cmovne esi, eax
mov eax, esi
mov ecx, dword [esp + 0x26c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005ca9f7
mov esp, ebp
pop ebp
ret
Function at 0x45fc00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x45fc22
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0x45fc10
mov byte [esi + 0x17], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x16]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45fc40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x45fc62
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x21
jb 0x45fc50
mov byte [esi + 0x22], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x21]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45fc80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x2f], 0
je 0x45fca2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x2e
jb 0x45fc90
mov byte [esi + 0x2f], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2e]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45fcc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x45fce2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x45fcd0
mov byte [esi + 0x11], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x10]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45fd00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x2a], 0
je 0x45fd22
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x29
jb 0x45fd10
mov byte [esi + 0x2a], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x29]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45fd40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x45fd62
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x45fd50
mov byte [esi + 0x16], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x15]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45fd80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x30], 0
je 0x45fda2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x2f
jb 0x45fd90
mov byte [esi + 0x30], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2f]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x45fdc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x45fde2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0xd
jb 0x45fdd0
mov byte [esi + 0xe], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xd]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45fe00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x45fe22
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0x45fe10
mov byte [esi + 0xd], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xc]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45fe40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x45fe62
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x45fe50
mov byte [esi + 0x10], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xf]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45fe80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x45fea2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x45fe90
mov byte [esi + 0x12], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x11]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45fec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x45fee2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x45fed0
mov byte [esi + 0x13], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x12]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45ff00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x45ff22
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x45ff10
mov byte [esi + 0xf], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xe]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45ff40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x45], 0
je 0x45ff62
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x44
jb 0x45ff50
mov byte [esi + 0x45], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x44]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x45ff80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x45ffa2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x1d
jb 0x45ff90
mov byte [esi + 0x1e], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1d]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45ffc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x48], 0
je 0x45ffe2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x47
jb 0x45ffd0
mov byte [esi + 0x48], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x47]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x460000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x21], 0
je 0x460022
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x20
jb 0x460010
mov byte [esi + 0x21], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x20]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x460040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x27], 0
je 0x460062
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x26
jb 0x460050
mov byte [esi + 0x27], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x26]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x460080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x4b], 0
je 0x4600a2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x4a
jb 0x460090
mov byte [esi + 0x4b], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x4a]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4600c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
je 0x4600e2
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x23
jb 0x4600d0
mov byte [esi + 0x24], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x23]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x460100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x26], 0
je 0x460122
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x25
jb 0x460110
mov byte [esi + 0x26], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x25]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x460140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x23], 0
je 0x460162
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x10]
inc eax
xor byte [edx], cl
cmp eax, 0x22
jb 0x460150
mov byte [esi + 0x23], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x22]
push eax
push esi
call fcn.00466530
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4607b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x4607dc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x460804
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x46080a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x460872
jg 0x460821
test esi, esi
je 0x460872
test ecx, ecx
jl 0x46086d
jg 0x46082b
test eax, eax
je 0x46086d
cmp edi, ecx
jg 0x46083f
jl 0x460835
cmp esi, eax
jae 0x46083f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x460875
mov ecx, dword [ebp + 8]
jmp 0x46087f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x460899
jg 0x46087f
test esi, esi
je 0x460899
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x460899
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4608b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x4608dc
jl 0x4608d0
test ecx, ecx
jne 0x4608dc
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x4608f5
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x460943
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x460949
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x460949
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x4609b6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x460972
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x4609a4
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x4609b6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x460980
test edi, edi
je 0x4609b6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc