joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x43a008], 0x8088405
inc edx
mov dword [ebx + 0x43a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cb9c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cbcd
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cbb5
add dl, dl
jne 0x41cbd8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc29
xor eax, eax
add dl, dl
jne 0x41cbe5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ccc6
add dl, dl
jne 0x41cbf4
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cbff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc0a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc15
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cc1f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cbc4
mov eax, 1
add dl, dl
jne 0x41cc37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc42
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc2e
sub eax, ebx
mov ebx, 1
jne 0x41cc75
mov ecx, 1
add dl, dl
jne 0x41cc5b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc66
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc52
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cc8c
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc97
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc83
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cce7
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cbc4
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42356f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e161
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e14a
test esi, esi
jbe 0x41e161
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ac
test eax, eax
jne 0x41e13c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e161
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e119
jmp 0x41e161
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e161
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423576
ret
Function at 0x41e9a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x423f53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41e9df
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41e9f8
lea eax, [ebp - 0x10]
mov edx, dword [0x43c248]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ea0b
lea eax, [ebp - 0x10]
mov edx, dword [0x43c248]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ea17
adc edx, 0
mov edx, dword [edx*4 + 0x43b0d8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406af4
mov esi, eax
cmp esi, 0xffffffff
je 0x41eb25
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d44
test eax, eax
je 0x41eb18
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41eb18
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406d9c
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d44
test eax, eax
je 0x41eb18
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41eb18
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41eb18
cmp dx, 0x150
ja 0x41eb18
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d44
test eax, eax
je 0x41eb18
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41eb18
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406aac
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41eb3d
inc ebx
cmp ebx, 0x19
jne 0x41e9d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423f5a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x4042e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7f5660
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x90cf34]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.004042a0
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov word [esi + 0xc], 0
push dword [ecx]
lea ecx, [esi + 0x10]
call fcn.00405650
mov dword [esi + 0x28], 0
mov eax, esi
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x407cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x90cf34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x407d93
cmp byte [esi + 0x3d], 0
je 0x407d93
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x407d49
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x407d5b
sub eax, 1
je 0x407d5f
sub eax, 2
je 0x407d93
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059961f
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x407d7c
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.006ad3ae
add esp, 0x10
cmp edi, eax
jne 0x407d49
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059961f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0059961f
mov esp, ebp
pop ebp
ret
Function at 0x408b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
push ebx
mov dword [ebp - 0x10], eax
push esi
mov eax, dword [eax]
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
add eax, 8
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
lea esi, [eax + 1]
push esi
call fcn.004680dd
push esi
mov esi, eax
mov dword [ebp + 8], eax
push 0
push esi
call fcn.006a3e10
mov eax, dword [edi + 0x10]
add esp, 0x10
cmp dword [edi + 0x14], 0x10
jb 0x408b8c
mov edi, dword [edi]
push eax
push edi
push esi
call fcn.006a3890
xor edi, edi
add esp, 0xc
cmp dword [ebp - 0xc], edi
jle 0x408be8
nop
mov eax, dword [ebp - 4]
inc bl
mov esi, dword [ebp - 4]
movzx ebx, bl
mov ecx, dword [eax + ebx*4]
mov eax, dword [ebp - 8]
add eax, ecx
movzx edx, al
mov eax, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [eax + edx*4]
mov dword [esi + ebx*4], eax
mov dword [esi + edx*4], ecx
add cl, al
movzx eax, cl
mov ecx, esi
mov esi, dword [ebp + 8]
movzx eax, byte [ecx + eax*4]
xor byte [edi + esi], al
mov al, byte [edi + esi]
mov ecx, dword [ebp + 0xc]
push eax
call fcn.00404e30
inc edi
cmp edi, dword [ebp - 0xc]
jl 0x408ba0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
push esi
mov eax, dword [ecx]
mov dword [eax], ebx
mov eax, dword [ecx]
mov dword [eax + 4], edx
call fcn.004680d8
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x411110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x41111b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x4111d7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8cf330]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8cf330]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8cf330]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8cf330]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8cf330]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8cf330]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8cf330]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8cf330]
sub edi, 1
jne 0x411130
pop edi
test esi, esi
je 0x4111fa
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8cf330]
sub esi, 1
jne 0x4111e0
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x4127f0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x4129ac
cmp dword [edi + 0x18], 0
je 0x4129ac
cmp dword [edi + 0x7c], 0
je 0x412819
call fcn.00412ca0
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.00412580
add esp, 8
test eax, eax
je 0x41283d
pop edi
mov eax, 0xffffff99
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call fcn.006ad406
mov esi, eax
add esp, 4
test esi, esi
je 0x412880
push 0x4000
call fcn.006ad406
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x41288c
push esi
call fcn.006acee9
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], 0
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], 0
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x4128e7
lea ecx, [esi + 4]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00411450
test eax, eax
jne 0x4128e7
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x41290a
mov al, byte [edi + 0x39]
jmp 0x41290d
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov ecx, 0xc
xor eax, eax
cmp byte [esi + 0x6c], al
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x41298d
nop dword [eax]
mov al, byte [ebx]
test al, al
je 0x41298d
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, ecx
shr ecx, 8
movzx eax, al
mov eax, dword [eax*4 + 0x8cf330]
xor eax, ecx
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x70], eax
movzx eax, al
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x8cf330]
mov dword [esi + 0x78], ecx
add ebx, 1
jne 0x412940
mov eax, dword [ebp - 0xc]
add eax, 0x1e
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xffffff9a
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7f61e8
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x90cf34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x84], edx
push 0
call fcn.006b163b
push eax
call fcn.006b15aa
add esp, 8
mov dword [ebp - 0x50], 0x33323130
mov dword [ebp - 0x4c], 0x37363534
mov dword [ebp - 0x48], 0x42413938
mov dword [ebp - 0x44], 0x46454443
mov dword [ebp - 0x40], 0x4a494847
mov dword [ebp - 0x3c], 0x4e4d4c4b
mov dword [ebp - 0x38], 0x5251504f
mov dword [ebp - 0x34], 0x56555453
mov dword [ebp - 0x30], 0x5a595857
mov dword [ebp - 0x2c], 0x64636261
mov dword [ebp - 0x28], 0x68676665
mov dword [ebp - 0x24], 0x6c6b6a69
mov dword [ebp - 0x20], 0x706f6e6d
mov dword [ebp - 0x1c], 0x74737271
mov dword [ebp - 0x18], 0x78777675
mov word [ebp - 0x14], 0x7a79
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xf
mov byte [ebp - 0x68], 0
mov esi, 0x10
mov dword [ebp - 4], 0
lea edi, [esi + 0x2e]
call fcn.006b1589
cdq
lea ecx, [ebp - 0x68]
idiv edi
movzx eax, byte [ebp + edx - 0x50]
push eax
call fcn.00404e30
sub esi, 1
jne 0x414e00
cmp dword [ebp - 0x54], 0x10
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 0x58]
lea edi, [ebp - 0x68]
cmovae edx, dword [ebp - 0x68]
add eax, edx
mov dword [ebp - 0x70], esi
cmp dword [ebp - 0x54], 0x10
mov dword [ebp - 0x88], eax
cmovae edi, dword [ebp - 0x68]
xor ecx, ecx
sub eax, edi
mov word [ebp - 0x80], cx
push eax
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x6c], 7
call fcn.00407a40
push dword [ebp - 0x84]
lea ecx, [ebp - 0x80]
push dword [ebp - 0x88]
push edi
call fcn.004076b0
mov esi, dword [ebp - 0x84]
lea eax, [ebp - 0x80]
cmp esi, eax
je 0x414e93
mov ecx, esi
call fcn.00406720
movups xmm0, xmmword [ebp - 0x80]
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x70]
movq qword [esi + 0x10], xmm0
jmp 0x414ec9
mov edx, dword [ebp - 0x6c]
cmp edx, 8
jb 0x414ec9
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x414ebf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414f14
push edx
push ecx
call fcn.0059982b
add esp, 8
mov edx, dword [ebp - 0x54]
cmp edx, 0x10
jb 0x414ef9
mov ecx, dword [ebp - 0x68]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x414eef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414f19
push edx
push ecx
call fcn.0059982b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059961f
mov esp, ebp
pop ebp
ret
call fcn.006a6ec9
call fcn.006a6ec9
int3
Function at 0x41ce40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7f68e6
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x90cf34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xb8]
mov dword [ebp - 0x144], eax
push edx
mov ecx, dword [eax + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 4], 0
xor esi, esi
movups xmm0, xmmword [0x8d1aa0]
mov cx, word [0x8d1ab0]
mov word [ebp - 0x24], cx
movups xmmword [ebp - 0x34], xmm0
mov eax, 0x94f2095
mov ecx, esi
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x37
sub ecx, eax
add ecx, 0x32
xor word [ebp + esi*2 - 0x34], cx
inc esi
cmp esi, 9
jl 0x41ceb1
mov ecx, dword [ebp - 0x148]
lea eax, [ebp - 0x34]
push eax
call fcn.005b93f5
lea ecx, [ebp - 0xb8]
mov byte [ebp - 0x13d], al
mov dword [ebp - 4], 0xffffffff
call fcn.005b932f
cmp byte [ebp - 0x13d], 0
je 0x41cf93
lea ecx, [edi + 0x7f0]
call fcn.00451610
test eax, eax
je 0x41d048
mov eax, dword [0x1807d24]
cmp dword [eax + 0x5ec], 4
jne 0x41cf3d
push 1
lea ecx, [edi + 0x7f0]
call fcn.004519d0
mov eax, dword [0x1807d24]
mov ecx, dword [eax + 0x84c]
cmp ecx, 1
jne 0x41cf59
push 0x2bc
mov ecx, edi
call fcn.005bf6bb
jmp 0x41d048
cmp ecx, 2
mov ecx, edi
jne 0x41cf6f
push 0x320
call fcn.005bf6bb
jmp 0x41d048
cmp dword [eax + 0x5ec], 4
jne 0x41cf84
push 0x64
call fcn.005bf6bb
jmp 0x41d048
push 0x384
call fcn.005bf6bb
jmp 0x41d048
mov ecx, dword [ebp - 0x144]
lea edx, [ebp - 0x13c]
push edx
mov ecx, dword [ecx + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 4], 1
xor esi, esi
mov ecx, dword [0x8d1a98]
movq xmm0, qword [0x8d1a90]
mov dword [ebp - 0x18], ecx
mov cx, word [0x8d1a9c]
movq qword [ebp - 0x20], xmm0
mov word [ebp - 0x14], cx
nop dword [eax]
mov eax, 0x94f2095
mov ecx, esi
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x37
sub ecx, eax
add ecx, 0x32
xor word [ebp + esi*2 - 0x20], cx
inc esi
cmp esi, 7
jl 0x41cfe0
mov ecx, dword [ebp - 0x144]
lea eax, [ebp - 0x20]
push eax
call fcn.005b93f5
lea ecx, [ebp - 0x13c]
mov byte [ebp - 0x13d], al
mov dword [ebp - 4], 0xffffffff
call fcn.005b932f
cmp byte [ebp - 0x13d], 0
je 0x41d048
push 0
push 0xf020
push 0x112
mov ecx, edi
call fcn.005bf99b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059961f
mov esp, ebp
pop ebp
ret 4
Function at 0x4219c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x90cf34]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [0x8d231c]
mov eax, dword [0x8d2334]
xor ecx, ecx
cmp dword [0x18011f4], 2
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0xc], eax
movq xmm0, qword [0x8d232c]
mov ax, word [0x8d2338]
movq qword [ebp - 0x14], xmm0
mov word [ebp - 8], ax
jl 0x421b00
movaps xmm2, xmmword [0x8d5c60]
mov eax, 1
movaps xmm4, xmmword [0x8d5cd0]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
movd xmm5, eax
mov eax, 0x1f
psrad xmm1, xmm5
movaps xmm0, xmm1
movd xmm6, eax
mov eax, 0x8d231c
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x8d5c80]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x8d5c70]
paddd xmm2, xmmword [0x8d5c60]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
paddw xmm1, xmmword [0x8d5cb0]
movq xmm0, qword [eax]
pxor xmm1, xmm0
movaps xmm0, xmm2
movq qword [ebp - 0x24], xmm1
movaps xmm1, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x8d5c80]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, qword [ebp - 0x1c]
paddw xmm1, xmmword [0x8d5cb0]
pxor xmm1, xmm0
movq qword [ebp - 0x1c], xmm1
nop dword [eax + eax]
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul eax, eax, 0x37
sub edx, eax
add edx, 0x32
xor word [ebp + ecx*2 - 0x24], dx
inc ecx
cmp ecx, 0xf
jl 0x421b00
cmp dword [0x1807e5c], 8
lea eax, [ebp - 0x24]
mov edx, 0x1807e48
mov ecx, 0x80000001
cmovae edx, dword [0x1807e48]
push 0x17f49a0
push eax
call fcn.00414c40
mov ecx, dword [ebp - 4]
xor eax, eax
add esp, 8
cmp dword [0x17f49b0], eax
setne al
xor ecx, ebp
call fcn.0059961f
mov esp, ebp
pop ebp
ret
Function at 0x424fb0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.0041b540
push 0
push 0
push esi
push 0x422b90
push 0
push 0
call fcn.006b2724
add esp, 0x18
pop esi
ret

Function at 0x42c4e0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
cmp edi, 5
jne 0x42c529
cmp dword [ebx + 0x84], 0x10
push esi
lea esi, [ebx + 0x70]
mov eax, esi
jb 0x42c500
mov eax, dword [esi]
push eax
call dword [0x8106c8]
test eax, eax
jne 0x42c528
cmp dword [esi + 0x14], 0x10
jb 0x42c513
mov esi, dword [esi]
cmp dword [ebx + 0x6c], 0x10
lea eax, [ebx + 0x58]
jb 0x42c51e
mov eax, dword [eax]
push esi
push eax
call fcn.006b2a3b
add esp, 8
pop esi
mov eax, dword [0x1807d20]
mov dword [ebx + 0x18], edi
test eax, eax
je 0x42c584
cmp edi, 5
jne 0x42c556
push 0x1807d1c
push 0x81f7
push 0x81f4
push eax
call dword [0x810a50]
pop edi
pop ebx
pop ebp
ret 8
push 4
call fcn.004680a0
add esp, 4
test eax, eax
je 0x42c56b
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x42c56d
xor eax, eax
push eax
push 0x81f8
push 0x81f4
push dword [0x1807d20]
call dword [0x810a50]
pop edi
pop ebx
pop ebp
ret 8
Function at 0x42eba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x90cf34]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x8d4216], 0
movups xmm0, xmmword [0x8d4204]
mov eax, dword [0x8d4214]
push edi
mov edi, dword [ecx + 0x858]
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], eax
je 0x42ebfd
push esi
xor esi, esi
mov eax, 0x94f2095
mov ecx, esi
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x37
sub ecx, eax
add ecx, 0x32
xor word [ebp + esi*2 - 0x18], cx
inc esi
cmp esi, 0xa
jl 0x42ebd7
pop esi
cmp dword [0x1807e74], 8
lea ecx, [ebp - 0x1c]
push 4
push ecx
push 4
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], edi
mov eax, 0x1807e60
cmovae eax, dword [0x1807e60]
push ecx
push eax
push 0x80000001
call dword [0x8106b0]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop edi
call fcn.0059961f
mov esp, ebp
pop ebp
ret
Function at 0x441950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x90cf34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x8d3354]
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov ax, word [0x8d3358]
mov word [ebp - 8], ax
mov al, byte [0x8d335a]
mov byte [ebp - 6], al
nop dword [eax]
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, cl
movsx eax, al
imul eax, eax, 0x37
sub dl, al
add dl, 0x32
xor byte [ebp + ecx - 0xc], dl
inc ecx
cmp ecx, 7
jl 0x441980
push 0xf
lea eax, [ebp - 0xc]
push eax
call fcn.00444150
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0059961f
mov esp, ebp
pop ebp
ret