joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Delete file
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
mov esi, str._TEMP_
lea edi, [ebp - 0x41c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x7e
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x40e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
and word [ebp - 0x214], 0
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
mov dword [ebp - 8], 0xfffffffd
call fcn.004011ab
test al, al
pop ecx
pop ecx
je 0x40108c
lea esi, [ebp - 8]
lea edi, [ebp - 0x214]
call fcn.0040139b
test al, al
mov byte [ebp - 1], al
jne 0x4010d3
lea eax, [ebp - 0x214]
push eax
push 0
push 0x4030b8
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 8], 0xfffffffd
call fcn.00401248
test al, al
pop ecx
mov byte [ebp - 1], al
je 0x4010d3
lea esi, [ebp - 8]
lea edi, [ebp - 0x214]
call fcn.0040139b
mov byte [ebp - 1], al
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp - 1], 0
jne 0x4011a1
xor eax, eax
push eax
push ebx
lea ecx, [ebp - 0x41c]
push ecx
push eax
push 0x70
push eax
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x4011a1
mov esi, dword [ebp - 0x214]
push ebx
lea eax, [ebp - 0x214]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x214]
push 0x5c
push eax
call fcn.004014e9
cmp eax, ebx
pop ecx
pop ecx
push 2
mov dword [ebp - 0xc], eax
pop edi
je 0x401140
add dword [ebp - 0xc], edi
xor ax, ax
lea ecx, [ebp - 0x41c]
call fcn.004014c6
mov word [eax], 0x28
add eax, edi
mov word [eax], si
add eax, edi
mov word [eax], 0x3a
add eax, edi
mov word [eax], 0x29
push str.user32.dll
mov word [eax + 2], bx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x4011a1
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x40119a
push 0x10
push dword [ebp - 0xc]
lea ecx, [ebp - 0x41c]
push ecx
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4011ab
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
cmp edi, ebx
jne 0x4011d1
xor al, al
jmp 0x401244
push esi
xor esi, esi
inc esi
cmp dword [ebp - 4], esi
jle 0x40123a
mov ecx, dword [edi + esi*4]
mov edx, str._DLL
call fcn.00401454
test eax, eax
jne 0x4011f3
lea eax, [esi + 1]
cmp eax, dword [ebp - 4]
jl 0x4011fb
inc esi
cmp esi, dword [ebp - 4]
jl 0x4011da
jmp 0x40123a
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.004014a7
pop ecx
mov ecx, dword [ebp + 0xc]
xor ax, ax
call fcn.004014c6
mov ecx, eax
sub ecx, dword [ebp + 0xc]
and ecx, 0xfffffffe
cmp ecx, 2
jle 0x40123a
cmp word [eax - 2], 0x5c
je 0x40122d
mov word [eax], 0x5c
inc eax
inc eax
mov ecx, dword [edi + esi*4 + 4]
push eax
call fcn.004014a7
pop ecx
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov al, bl
pop esi
pop edi
pop ebx
leave
ret

Function at 0x401248
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x403078
push 0x90
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
je 0x40137e
cmp esi, 0xffffffff
je 0x40137e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, edi
je 0x40137e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, edi
mov dword [ebp - 8], eax
jbe 0x40137e
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
je 0x40137e
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x40137e
cmp eax, 0xffffffff
je 0x40137e
mov dword [ebp - 4], edi
xor ecx, ecx
lea eax, [esi + 5]
movzx edx, byte [eax]
shl edx, cl
add ecx, 8
add dword [ebp - 4], edx
inc eax
cmp ecx, 0x40
jb 0x4012e1
push dword [ebp - 4]
call fcn.0040141e
mov ebx, eax
cmp ebx, edi
pop ecx
jne 0x401306
push 2
pop esi
jmp 0x40136c
mov eax, dword [ebp - 8]
add eax, 0xfffffff3
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
push 5
push esi
lea eax, [ebp - 0x10]
push eax
add esi, 0xd
push esi
lea eax, [ebp - 4]
push eax
push ebx
mov dword [ebp - 0x1c], 0x401385
mov dword [ebp - 0x18], 0x401390
call fcn.00402c6c
mov esi, eax
add esp, 0x24
cmp esi, edi
jne 0x401365
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], edi
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
je 0x401365
push 9
pop esi
push ebx
call fcn.00401439
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp esi, edi
sete al
jmp 0x401380
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b470
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 4], 0
jne 0x40b486
push edi
call fcn.0040b0e0
add esp, 4
mov eax, dword [edi + 4]
cmp eax, 1
jne 0x40b4a3
push dword [ebp + 0x10]
lea eax, [edi + 8]
push dword [ebp + 0xc]
push eax
call fcn.0040daa0
add esp, 0xc
pop edi
pop ebp
ret
cmp eax, 2
jne 0x40b4dc
push dword [edi]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.0048dbc4
add esp, 0x10
cmp eax, dword [ebp + 0x10]
jae 0x40b4dc
push edi
call fcn.0040b090
push str.Disabled_writing_session_log_due_to_error_while_writing
push dword [edi + 0x18]
mov dword [edi + 4], 3
call fcn.004569c0
add esp, 0xc
pop edi
pop ebp
ret

Function at 0x40d900
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4e4840]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
mov edi, dword [ebp + 0xc]
nop dword [eax + eax]
mov cl, byte [edx + esi]
lea eax, [ecx - 0x41]
cmp al, 0x19
ja 0x40d932
movsx eax, cl
sub eax, 0x41
jmp 0x40d974
lea eax, [ecx - 0x61]
cmp al, 0x19
ja 0x40d941
movsx eax, cl
sub eax, 0x47
jmp 0x40d974
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x40d950
movsx eax, cl
add eax, 4
jmp 0x40d974
cmp cl, 0x2b
jne 0x40d95c
mov eax, 0x3e
jmp 0x40d974
cmp cl, 0x2f
jne 0x40d968
mov eax, 0x3f
jmp 0x40d974
cmp cl, 0x3d
jne 0x40d9f1
or eax, 0xffffffff
mov dword [ebp + edx*4 - 0x14], eax
inc edx
cmp edx, 4
jl 0x40d920
mov edx, dword [ebp - 0x14]
cmp edx, 0xffffffff
je 0x40d9f1
mov esi, dword [ebp - 0x10]
cmp esi, 0xffffffff
je 0x40d9f1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp ecx, 0xffffffff
jne 0x40d9a2
cmp eax, ecx
jne 0x40d9f1
lea ebx, [ecx + 2]
jmp 0x40d9ad
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
add ebx, 2
shl edx, 6
and ecx, 0x3f
or edx, esi
and eax, 0x3f
shl edx, 6
or edx, ecx
shl edx, 6
or edx, eax
mov eax, edx
shr eax, 0x10
mov byte [edi], al
cmp ebx, 1
jbe 0x40d9d6
mov ecx, edx
shr ecx, 8
mov byte [edi + 1], cl
cmp ebx, 2
jbe 0x40d9de
mov byte [edi + 2], dl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004668ab
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004668ab
mov esp, ebp
pop ebp
ret

Function at 0x40e730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
test esi, esi
je 0x40e765
push ebx
mov ebx, dword [ebp + 0xc]
sub ebx, eax
nop word [eax + eax]
movzx edx, byte [ebx + eax]
lea eax, [eax + 1]
movzx ecx, byte [eax - 1]
xor edx, ecx
or edi, edx
sub esi, 1
jne 0x40e750
pop ebx
mov eax, 0x100
sub eax, edi
pop edi
shr eax, 8
pop esi
pop ebp
ret

Function at 0x412f00
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0x34
push dword [ebp + 8]
call fcn.00403140
add esp, 8
cmp byte [eax], 0
je 0x412f1e
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0040df50
push 0x35
push dword [ebp + 8]
call fcn.004030e0
add esp, 8
test eax, eax
je 0x412f35
pop ebp
jmp fcn.0045d8d0
xor eax, eax
pop ebp
ret
Function at 0x413200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004558e0
add esp, 8
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.00462f10
Function at 0x4271d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x4e4840]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x40], edi
movups xmm0, xmmword [edi + 0x3c8]
movups xmmword [ebp - 0x34], xmm0
test ebx, ebx
jle 0x427335
dec ebx
add edx, 3
shr ebx, 4
inc ebx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ebx
push esi
movzx ecx, byte [edx - 3]
lea esi, [edx - 1]
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], ecx
movzx ecx, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 6]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], ecx
movzx ecx, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xa]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], ecx
movzx ecx, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ecx
call fcn.004271b0
add esp, 8
xor edi, edi
mov edx, dword [ebp + edi - 0x34]
lea esi, [esi + 4]
mov ebx, dword [ebp + edi - 0x14]
mov ecx, edx
shr ecx, 0x18
mov eax, ebx
shr eax, 0x18
xor cl, al
mov eax, ebx
mov byte [esi - 6], cl
mov ecx, edx
shr ecx, 0x10
shr eax, 0x10
xor cl, al
mov eax, ebx
mov byte [esi - 5], cl
mov ecx, edx
shr eax, 8
xor dl, bl
shr ecx, 8
xor cl, al
mov byte [esi - 3], dl
mov eax, dword [ebp + edi - 0x24]
mov dword [ebp + edi - 0x34], eax
add edi, 4
mov byte [esi - 4], cl
cmp edi, 0x10
jl 0x4272b4
mov edx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x40]
add edx, 0x10
sub dword [ebp - 0x3c], 1
mov dword [ebp - 0x38], edx
jne 0x427210
movups xmm0, xmmword [ebp - 0x34]
mov eax, edi
pop esi
pop edi
pop ebx
movups xmmword [eax + 0x3c8], xmm0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004668ab
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
movups xmmword [edi + 0x3c8], xmm0
pop edi
xor ecx, ebp
pop ebx
call fcn.004668ab
mov esp, ebp
pop ebp
ret
Function at 0x428090
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4e4840]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
movups xmm0, xmmword [ebx + 0x3c8]
mov edi, dword [ebp + 0xc]
movups xmmword [ebp - 0x14], xmm0
test edi, edi
jle 0x4281ed
mov edx, dword [ebp - 8]
dec edi
shr edi, 4
add esi, 2
inc edi
nop word [eax + eax]
movzx ecx, byte [esi - 2]
movzx eax, byte [esi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 3]
xor dword [ebp - 0x14], ecx
movzx ecx, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 7]
xor dword [ebp - 0x10], ecx
movzx ecx, byte [esi + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xb]
xor dword [ebp - 0xc], ecx
movzx ecx, byte [esi + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xd]
shl ecx, 8
or ecx, eax
lea eax, [ebp - 0x14]
push eax
xor edx, ecx
push ebx
mov dword [ebp - 8], edx
call fcn.00428070
mov ecx, dword [ebp - 0x14]
add esp, 8
mov eax, ecx
mov byte [esi + 1], cl
shr eax, 0x18
mov byte [esi - 2], al
mov eax, ecx
shr eax, 0x10
mov byte [esi - 1], al
mov eax, ecx
mov ecx, dword [ebp - 0x10]
shr eax, 8
mov byte [esi], al
mov eax, ecx
shr eax, 0x18
mov byte [esi + 2], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 3], al
mov eax, ecx
shr eax, 8
mov byte [esi + 4], al
mov byte [esi + 5], cl
mov ecx, dword [ebp - 0xc]
mov eax, ecx
shr eax, 0x18
mov byte [esi + 6], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 7], al
mov eax, ecx
shr eax, 8
mov edx, dword [ebp - 8]
lea esi, [esi + 0x10]
mov byte [esi - 8], al
mov eax, edx
shr eax, 0x18
mov byte [esi - 6], al
mov eax, edx
shr eax, 0x10
mov byte [esi - 5], al
mov eax, edx
shr eax, 8
mov byte [esi - 7], cl
mov byte [esi - 4], al
mov byte [esi - 3], dl
sub edi, 1
jne 0x4280d0
movups xmm0, xmmword [ebp - 0x14]
mov ecx, dword [ebp - 4]
pop edi
pop esi
movups xmmword [ebx + 0x3c8], xmm0
xor ecx, ebp
pop ebx
call fcn.004668ab
mov esp, ebp
pop ebp
ret
Function at 0x429280
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
lea edx, [eax + 2]
mov bh, byte [eax]
mov cl, byte [eax + 1]
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], edi
jle 0x4292df
mov al, cl
push esi
inc bh
movzx esi, bh
add esi, edx
mov bl, byte [esi]
add al, bl
movzx ecx, al
add edx, ecx
movzx ecx, byte [edx]
mov byte [esi], cl
mov byte [edx], bl
movzx edx, byte [esi]
mov esi, dword [ebp + 0xc]
movzx ecx, bl
add edx, ecx
movzx ecx, dl
mov edx, dword [ebp - 8]
movzx ecx, byte [ecx + edx]
xor byte [edi + esi], cl
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x4292a0
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 1]
pop esi
pop edi
mov byte [eax], bh
mov byte [eax + 1], cl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x429360
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4e4840]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
push edi
lea ebx, [eax + 2]
mov word [eax], 0
mov edi, ebx
mov dword [ebp - 0x108], ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x104]
sub edi, eax
mov eax, ecx
lea esi, [ebp - 0x104]
xor edx, edx
add esi, ecx
div dword [ebp + 0x10]
mov byte [edi + esi], cl
inc ecx
mov al, byte [edx + ebx]
mov byte [esi], al
cmp ecx, 0x100
jb 0x429396
mov esi, dword [ebp - 0x108]
lea ebx, [ebp - 0x104]
xor edi, edi
mov dword [ebp - 0x10c], 0x100
sub ebx, esi
mov dl, byte [esi]
lea esi, [esi + 1]
movzx eax, byte [ebx + esi - 1]
add eax, edi
movzx ecx, dl
add ecx, eax
sub dword [ebp - 0x10c], 1
movzx edi, cl
mov ecx, dword [ebp - 0x108]
mov al, byte [edi + ecx]
mov byte [esi - 1], al
mov byte [edi + ecx], dl
jne 0x4293d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004668ab
mov esp, ebp
pop ebp
ret
Function at 0x42a3d0
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movups xmm0, xmmword [0x4cd280]
movups xmmword [eax + 0x1000], xmm0
lea edx, [eax + 0x800]
movups xmm0, xmmword [0x4cd290]
movups xmmword [eax + 0x1010], xmm0
movups xmm0, xmmword [0x4cd2a0]
movups xmmword [eax + 0x1020], xmm0
movups xmm0, xmmword [0x4cd2b0]
movups xmmword [eax + 0x1030], xmm0
movq xmm0, qword [0x4cd2c0]
movq qword [eax + 0x1040], xmm0
xor eax, eax
nop word [eax + eax]
mov ecx, dword [eax + 0x4cd2c8]
lea edx, [edx + 4]
mov dword [edx - 0x804], ecx
mov ecx, dword [eax + 0x4cd6c8]
mov dword [edx - 0x404], ecx
mov ecx, dword [eax + 0x4cdac8]
mov dword [edx - 4], ecx
mov ecx, dword [eax + 0x4cdec8]
add eax, 4
mov dword [edx + 0x3fc], ecx
cmp eax, 0x400
jl 0x42a430
pop ebp
ret

Function at 0x42a470
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov ebx, dword [ecx + 0x1048]
mov edi, dword [ecx + 0x104c]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
test eax, eax
jle 0x42a565
push esi
mov esi, dword [ebp + 8]
dec eax
shr eax, 3
add esi, 2
inc eax
mov dword [ebp + 0xc], eax
nop word [eax + eax]
movzx ebx, byte [esi + 1]
movzx eax, byte [esi]
movzx edi, byte [esi + 5]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi - 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 4]
or edi, eax
movzx eax, byte [esi + 3]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 2]
shl edi, 8
or edi, eax
lea eax, [ebp - 0x10]
push ecx
push eax
push edi
push ebx
call fcn.00429610
mov ecx, dword [ebp - 4]
lea esi, [esi + 8]
xor ecx, dword [ebp - 0x10]
add esp, 0x10
mov edx, dword [ebp - 8]
mov eax, ecx
xor edx, dword [ebp - 0xc]
shr eax, 8
mov byte [esi - 9], al
mov eax, ecx
shr eax, 0x10
mov byte [esi - 8], al
mov eax, edx
shr eax, 8
mov byte [esi - 5], al
mov eax, edx
mov byte [esi - 0xa], cl
shr ecx, 0x18
mov byte [esi - 6], dl
shr eax, 0x10
shr edx, 0x18
sub dword [ebp + 0xc], 1
mov byte [esi - 7], cl
mov ecx, dword [ebp + 0x10]
mov byte [esi - 4], al
mov byte [esi - 3], dl
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
jne 0x42a4b0
mov eax, ecx
pop esi
mov dword [eax + 0x104c], edi
pop edi
mov dword [eax + 0x1048], ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ecx + 0x104c], edi
pop edi
mov dword [ecx + 0x1048], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e140
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x42e16c
movzx ecx, byte [edi]
lea edi, [edi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4ce3d8]
sub esi, 1
jne 0x42e152
pop edi
pop esi
pop ebp
ret

Function at 0x42ee10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [esi + 0x80]
mov eax, dword [esi + 0x84]
mov dword [ebp - 4], ebx
mov dword [ebp + 0x10], eax
test edx, edx
je 0x42ef2b
mov ecx, dword [ebp + 8]
lea eax, [edx - 1]
add ecx, 2
shr eax, 3
inc eax
mov dword [ebp + 0xc], ecx
mov dword [ebp - 8], eax
push edi
nop dword [eax]
movzx ebx, byte [ecx - 2]
movzx eax, byte [ecx - 1]
movzx edi, byte [ecx + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [ecx]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 3]
or edi, eax
movzx eax, byte [ecx + 4]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 5]
shl edi, 8
or edi, eax
lea eax, [esi + 0x110]
push eax
push edi
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.0042f240
lea eax, [esi + 0x88]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push dword [ebp - 0x10]
push eax
call fcn.0042fc20
push esi
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push dword [ebp - 0x10]
push eax
call fcn.0042f240
mov ecx, dword [ebp + 0xc]
add esp, 0x30
mov eax, dword [ebp + 0x10]
xor eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
xor edx, dword [ebp - 0x10]
mov dword [ebp + 0x10], eax
mov eax, edx
shr eax, 0x18
mov byte [ecx - 2], al
mov eax, edx
shr eax, 0x10
mov byte [ecx - 1], al
mov eax, edx
shr eax, 8
mov byte [ecx], al
mov byte [ecx + 1], dl
mov edx, dword [ebp + 0x10]
mov eax, edx
shr eax, 0x18
mov byte [ecx + 2], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 3], al
mov eax, edx
shr eax, 8
mov byte [ecx + 4], al
mov eax, edi
mov byte [ecx + 5], dl
add ecx, 8
sub dword [ebp - 8], 1
mov dword [ebp + 0xc], ecx
mov dword [ebp - 4], ebx
mov dword [ebp + 0x10], eax
jne 0x42ee50
pop edi
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4307c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x80]
mov ecx, dword [edi + 0x84]
mov dword [ebp - 4], eax
mov dword [ebp + 0x10], ecx
test ebx, ebx
je 0x43088a
dec ebx
shr ebx, 3
push esi
mov esi, dword [ebp + 8]
inc ebx
push edi
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0042fc20
lea eax, [edi + 0x88]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push dword [ebp - 0xc]
push eax
call fcn.0042f240
lea eax, [edi + 0x110]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push dword [ebp - 0xc]
push eax
call fcn.0042fc20
mov ecx, dword [ebp - 0xc]
lea esi, [esi + 8]
xor byte [esi - 5], cl
mov eax, ecx
shr eax, 0x18
add esp, 0x30
xor byte [esi - 8], al
mov eax, ecx
mov edx, dword [ebp - 4]
shr eax, 0x10
xor byte [esi - 7], al
mov eax, ecx
mov ecx, dword [ebp - 8]
xor byte [esi - 1], cl
shr eax, 8
xor byte [esi - 6], al
mov eax, ecx
shr eax, 0x18
xor byte [esi - 4], al
mov eax, ecx
shr eax, 0x10
xor byte [esi - 3], al
mov eax, ecx
mov ecx, dword [ebp + 0x10]
shr eax, 8
xor byte [esi - 2], al
add ecx, 1
lea eax, [edx + 1]
mov dword [ebp + 0x10], ecx
cmovne eax, edx
mov dword [ebp - 4], eax
sub ebx, 1
jne 0x4307f1
pop esi
mov dword [edi + 0x84], ecx
mov dword [edi + 0x80], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x434090
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4e4840]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x120], esi
mov eax, dword [esi]
test eax, eax
jne 0x4340d4
lea eax, [esi + 0x20]
push ebx
push eax
call fcn.00435050
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004668ab
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x434183
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.0043f290
mov edi, dword [esi + 0xc]
add esp, 4
shr edi, 3
xor esi, esi
test edi, edi
je 0x43412a
nop dword [eax]
push esi
push ebx
call fcn.0042b080
mov byte [ebp - 0x119], al
lea eax, [ebp - 0x119]
push 1
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0043ed20
inc esi
add esp, 0x14
cmp esi, edi
jl 0x434100
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0043ef40
mov al, byte [ebp - 0x25]
and byte [ebp - 0x44], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.0042b320
mov ecx, dword [ebp - 0x120]
mov edi, eax
add ecx, 0x1c
push edi
push ecx
call fcn.00435050
push edi
mov esi, eax
call fcn.0042b910
add esp, 0x1c
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004668ab
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.004668ab
mov esp, ebp
pop ebp
ret