joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x405a12
pop dword [ebp - 0x24]
mov eax, 0xdf6118a9
sub eax, 0xdf20be97
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x33afdd7f
sub dword [ebp - 0x34], 0xe55d9834
mov dword [ebp - 0x30], 0x5cec1f5a
add dword [ebp - 0x30], 0xd5472ceb
mov dword [ebp - 0x2c], 0x6b536c40
sub dword [ebp - 0x2c], 0x1f072812
mov dword [ebp - 0x28], 0x4b424e23
sub dword [ebp - 0x28], 0x4b424e23
lea eax, [ebp - 0x34]
push eax
mov eax, 0x81505569
add eax, 0x7ef02b9b
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x5a05cd8
sub dword [ebp - 0x34], 0x912df382
mov dword [ebp - 0x30], 0xcb1b06dd
add dword [ebp - 0x30], 0x76515a98
mov dword [ebp - 0x2c], 0x4121dd70
add dword [ebp - 0x2c], 0x224d8efc
mov dword [ebp - 0x28], 0xc0723d4c
sub dword [ebp - 0x28], 0xc0723d4c
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x392f0
push 0
call eax
mov ecx, 0xc339f8b8
add ecx, 0x3cc65818
xor edi, edi
add edi, eax
mov ebx, 0x46e400
add ebx, dword [ebp - 0x24]
mov esi, 0x608bc768
add esi, 0x2998df54
xor dword [ebp - 0x1c], eax
mov edx, dword [ebx]
sub dword [ebp - 8], 0xb9b75a90
sub edx, esi
sub dword [ebp - 0x10], 0x31792fa4
mov dword [edi], edx
sub dword [ebp - 0xc], 0xb27d9a70
add edi, 0xda81abe5
add edi, 0x257e541f
add ebx, 0xa786d825
add ebx, 0x587927df
loop 0x405b2b
add eax, 0x13613
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x54b50127
add ecx, 0xab8afed9
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x401d25
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x412320]
xor eax, ebp
mov dword [ebp + 0x1a0], eax
mov eax, dword [ebp + 0x1ac]
push ebx
push esi
mov esi, dword [ebp + 0x1b0]
push 0x104
lea ecx, [ebp - 0x68]
push ecx
push 0xffffffffffffffff
push eax
xor ebx, ebx
push ebx
push 0xfde9
mov dword [ebp - 0x6c], 0xfffffffd
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
je 0x401e01
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x78], eax
cmp eax, ebx
je 0x401e01
push edi
mov edi, dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
push ebx
call edi
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x70], eax
cmp eax, ebx
je 0x401e00
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x68]
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x401df3
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x40e484
push dword [ebp - 0x70]
mov dword [ebp - 0x74], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x401df3
mov eax, dword [ebp - 0x7c]
movzx ecx, word [eax + 0xa]
mov dword [esi], ecx
movzx ecx, word [eax + 8]
mov dword [esi + 4], ecx
movzx ecx, word [eax + 0xe]
mov dword [esi + 8], ecx
movzx eax, word [eax + 0xc]
mov dword [esi + 0xc], eax
mov dword [ebp - 0x6c], ebx
push dword [ebp - 0x70]
push ebx
call edi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
pop edi
mov ecx, dword [ebp + 0x1a0]
mov eax, dword [ebp - 0x6c]
pop esi
xor ecx, ebp
pop ebx
call fcn.004024bc
add ebp, 0x1a4
leave
ret

Function at 0x4024bc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412320]
jne 0x4024c6
repz ret
jmp fcn.00403ae7

Function at 0x40269e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x4026ad
pop dword [ebp - 0x28]
mov eax, 0xd30db89c
add eax, 0x2d326e11
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3cddd
push 0
mov eax, 0x616826e3
sub eax, 0x612745c3
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0xc1ecaa36
sub ecx, 0xc1ec558b
mov edi, eax
mov ebx, 0xd6a6ed66
sub ebx, 0xd6657566
add ebx, dword [ebp - 0x28]
mov esi, 0xee8dfef7
add esi, 0xfe68b275
xor dword [ebp - 0x24], esi
mov edx, dword [ebx]
xor dword [ebp - 4], 0xfafa5f8f
xor edx, esi
mov dword [ebp - 8], 0xe04c55f8
mov dword [edi], edx
add dword [ebp - 0x24], eax
add edi, 0x68bc8803
add edi, 0x97437801
add ebx, 0x432935b3
add ebx, 0xbcd6ca51
loop 0x40270c
add eax, 0x1457f
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10002570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1001a024]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1002b7b0], 2
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x9000
mov dword [ebp - 0x28], 0
je 0x100026b1
push 0
push 1
push 1
push edi
call dword [0x1003c83c]
add esp, 0x10
cmp ax, bx
jne 0x100026db
mov esi, dword [section..rdata]
push 0x3e8
call esi
push 1
push 1
push 1
push edi
call dword [0x1003c83c]
add esp, 0x10
cmp ax, bx
jne 0x100026db
push 0x1f4
call esi
push 0
push 1
push 8
push 0xc0
push edi
call dword [0x1003c844]
add esp, 0x14
cmp ax, bx
jne 0x100026db
push 0x3e8
lea eax, [ebp - 0x28]
mov byte [ebp - 0x1c], 1
push eax
push 5
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.10002b10
add esp, 0x1c
cmp ax, 1
jne 0x100026c5
cmp byte [ebp - 0x14], al
jne 0x100026c5
mov eax, dword [str.NNYH]
lea edx, [ebp - 0xc]
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov al, byte [0x1001379c]
mov byte [ebp - 8], al
lea esi, [ecx + 4]
mov al, byte [ebp + ecx - 0x13]
lea edx, [edx + 1]
xor al, byte [edx - 1]
ror al, 2
mov byte [ebp + ecx - 0x2c], al
inc ecx
sub esi, 1
jne 0x10002650
lea eax, [ebp - 0x2c]
xor cl, cl
mov edx, 4
xor cl, byte [eax]
lea eax, [eax + 1]
sub edx, 1
jne 0x10002671
push 0x3e8
lea eax, [ebp - 0x28]
rol cl, 1
push eax
push 2
lea eax, [ebp - 0x24]
mov byte [0x1003b7e0], cl
push eax
push 4
lea eax, [ebp - 0x2c]
push eax
push edi
call fcn.10002b10
add esp, 0x1c
cmp ax, 1
jne 0x100026c5
mov dword [0x1002b7b0], 2
pop edi
pop esi
mov ax, bx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008cc1
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xe022
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008cc1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 2
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008cc1
mov esp, ebp
pop ebp
ret
Function at 0x10002700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, ecx
mov edx, dword [ebp + 0x14]
push ebx
mov bl, byte [ebp + 0x18]
mov bh, dl
push esi
mov esi, dword [ebp + 0xc]
add bh, 4
shr eax, 0x10
push edi
movzx edi, dx
mov byte [esi + 2], al
mov eax, ecx
shr eax, 8
mov byte [esi + 3], al
lea eax, [esi + 4]
mov byte [esi], 0xac
mov byte [esi + 1], bh
mov byte [eax], cl
mov dword [ebp + 0xc], edi
push edi
push dword [ebp + 0x10]
test bl, bl
jne 0x10002757
lea eax, [esi + 5]
push eax
call fcn.10009980
movzx eax, byte [esi + 1]
add esp, 0xc
inc ax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp bl, 4
jae 0x100027bd
lea eax, [esi + 5]
push eax
call fcn.10009980
add esp, 0xc
cmp bl, 3
je 0x1000278d
mov eax, dword [ebp + 0x14]
lea ecx, [esi + 4]
push ecx
inc al
movzx eax, al
push eax
push ecx
push 0x1003b7f4
push 0x1003b7e4
call fcn.10001450
add esp, 0x14
cmp bl, 2
je 0x1000279b
cmp bl, 3
jne 0x10002837
inc byte [esi + 1]
lea eax, [edi + 1]
push eax
lea ebx, [esi + 4]
push ebx
call fcn.100016c0
add esp, 8
mov byte [edi + esi + 5], al
movzx eax, byte [esi + 1]
inc ax
pop edi
pop esi
pop ebx
pop ebp
ret
dec bh
push eax
mov byte [esi + 1], bh
call fcn.10009980
add esp, 0xc
cmp bl, 0x10
jne 0x10002837
mov eax, dword [ebp + 0x14]
inc byte [esi + 1]
inc eax
movzx ecx, ax
mov eax, 0xffff
test cx, cx
je 0x10002833
xor edi, edi
mov dword [ebp + 0x14], ecx
nop dword [eax]
mov byte [ebp + 0x19], al
shr eax, 8
mov byte [ebp + 0x18], al
movzx eax, byte [esi + edi + 4]
inc edi
xor ax, word [ebp + 0x18]
movzx ecx, ax
mov eax, ecx
shr eax, 4
and eax, 0xf
xor ecx, eax
mov eax, ecx
shl eax, 0xc
xor ecx, eax
movzx edx, cl
shl edx, 5
movzx eax, dx
xor edx, ecx
mov dword [ebp + 0x18], eax
movzx eax, dx
cmp edi, dword [ebp + 0x14]
jb 0x100027f0
mov edi, dword [ebp + 0xc]
movzx eax, dx
mov byte [edi + esi + 5], al
movzx eax, byte [esi + 1]
pop edi
pop esi
inc ax
pop ebx
pop ebp
ret
Function at 0x10002930
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x1001a024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0xc0], eax
nop dword [eax]
mov eax, dword [0x1002b7b8]
lea edi, [ebx*4]
push 1
lea ecx, [eax + ebx*2]
movzx eax, byte [ecx + 0x1001a7a8]
mov byte [ebp - 0xc], al
movzx eax, byte [ecx + 0x1001a7a9]
mov byte [ebp - 0xb], al
mov eax, dword [0x1002b7b4]
mov eax, dword [edi + eax + 0x1001a7a8]
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.100037d0
movzx eax, ax
mov ecx, 0x9000
add esp, 0xc
cmp ax, cx
jne 0x10002a07
push 0x3e8
lea eax, [ebp - 0xb8]
mov byte [ebp - 0x20], 0x20
push eax
push 0x21
lea eax, [ebp - 0xb4]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.10002b10
mov ax, word [ebp - 0xb8]
add esp, 0x1c
cmp ax, 1
je 0x100029f0
cmp ax, 0x21
je 0x100029f0
mov eax, 0xe02b
jmp 0x10002a07
mov cl, byte [ebp - 0xb4]
test cl, cl
je 0x10002a25
xor eax, eax
cmp cl, 0xeb
sete al
add eax, 0xe02b
inc ebx
cmp ebx, 0xa
jl 0x10002960
pop edi
pop esi
movzx eax, ax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008cc1
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [ebp - 0xb3]
lea ecx, [ebp - 0x28]
mov edx, 4
mov eax, ecx
sub edi, eax
mov eax, dword [0x1002b7cc]
movups xmmword [ebp - 0x34], xmm0
movups xmm0, xmmword [ebp - 0xa3]
lea esi, [eax + 0x1001a7a8]
add esi, edi
movups xmmword [ebp - 0x24], xmm0
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x10002a54
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xc0]
pop edi
pop esi
mov byte [eax], bl
mov ax, word [ebp - 0x27]
mov word [ecx], ax
mov al, byte [ebp - 0x25]
mov byte [ecx + 2], al
mov eax, 0x9000
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10008cc1
mov esp, ebp
pop ebp
ret
Function at 0x10002b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ax, word [ebp + 0x18]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 0x1c]
movzx ecx, ax
push edi
movzx edi, word [ebp + 0x20]
mov word [esi], dx
cmp dword [0x1002b7b0], 2
mov dl, byte [0x1003b7e0]
mov dword [ebp - 4], ecx
jne 0x10002b69
mov eax, dword [ebp + 0x10]
xor ecx, ecx
movzx ebx, ax
test ebx, ebx
je 0x10002b62
mov esi, dword [ebp + 0xc]
nop dword [eax + eax]
mov al, byte [ecx + esi]
rol al, 1
xor al, dl
mov byte [ecx + esi], al
inc ecx
cmp ecx, ebx
jl 0x10002b50
mov esi, dword [ebp + 0x1c]
mov ax, word [ebp + 0x18]
mov ecx, dword [ebp - 4]
test edi, edi
je 0x10002bdd
mov bx, word [ebp - 4]
movzx edx, ax
mov dword [ebp + 0x1c], edx
mov dword [ebp + 0x20], 3
nop
cmp edi, 3
movzx eax, di
cmovg eax, dword [ebp + 0x20]
movzx eax, ax
push eax
lea eax, [ebp + 0x18]
push eax
movzx eax, bx
push ecx
sub edx, eax
add edx, dword [ebp + 0x14]
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x1003c84c]
mov ax, word [ebp + 0x18]
add esp, 0x1c
add word [esi], ax
sub bx, ax
sub edi, 3
mov word [ebp - 4], bx
mov dword [ebp + 0x10], 0
test bx, bx
je 0x10002bd7
test edi, edi
jle 0x10002bd7
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x1c]
jmp 0x10002b80
mov dl, byte [0x1003b7e0]
cmp dword [0x1002b7b0], 2
jne 0x10002c08
test esi, esi
je 0x10002c08
xor eax, eax
xor ecx, ecx
cmp ax, word [esi]
jae 0x10002c08
mov ebx, dword [ebp + 0x14]
mov al, byte [ecx + ebx]
ror al, 1
xor al, dl
mov byte [ecx + ebx], al
inc ecx
movzx eax, word [esi]
cmp ecx, eax
jl 0x10002bf6
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1001a024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor al, al
nop word [eax + eax]
movzx ecx, al
cmp ecx, 0x1a
jae 0x100039c2
inc al
mov byte [ebp + ecx - 0x28], 0
cmp al, 0x19
jb 0x10003920
mov ecx, dword [ebp + 0xc]
mov edx, 0xe
mov byte [ebp - 0x28], 0x13
mov eax, dword [ecx + 4]
mov dword [ebp - 0x27], eax
movzx eax, word [ecx + 2]
mov word [ebp - 0x21], ax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x1f], eax
movzx eax, word [ecx]
xor cl, cl
mov word [ebp - 0x1b], ax
lea eax, [ebp - 0x27]
xor cl, byte [eax]
lea eax, [eax + 1]
sub edx, 1
jne 0x10003963
push 0x3e8
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x10], cl
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push 0x19
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.10002b10
add esp, 0x1c
cmp word [ebp - 0x2c], 1
pop esi
jne 0x100039af
cmp byte [ebp - 0xc], 0x13
jne 0x100039af
mov eax, 0x9000
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008cc1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xe026
xor ecx, ebp
call fcn.10008cc1
mov esp, ebp
pop ebp
ret
call fcn.10008df3
int3
Function at 0x10003bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1001a024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], eax
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x25], 0
call fcn.10002570
movzx ebx, ax
add esp, 4
cmp ebx, 0x9000
jne 0x10003cca
push esi
call fcn.10001fe0
mov ebx, eax
add esp, 4
cmp ebx, 0x9000
jne 0x10003cca
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x25]
push eax
push esi
call fcn.10002930
mov ebx, eax
add esp, 0xc
cmp ebx, 0x9000
je 0x10003c4d
mov ebx, 0xe025
jmp 0x10003cca
movzx ecx, byte [ebp - 0x25]
lea edx, [ebp - 0xb]
mov eax, dword [0x1002b7cc]
mov esi, 3
lea ecx, [ecx*4 + 0x1001a7a9]
add ecx, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor byte [edx], al
lea edx, [edx + 1]
sub esi, 1
jne 0x10003c67
xor al, al
push edi
nop dword [eax]
xor esi, esi
lea edi, [ebp - 9]
cmp al, 0x10
jae 0x10003c9f
mov cl, byte [edi]
inc esi
movzx edx, al
dec edi
inc al
mov byte [ebp + edx - 0x24], cl
cmp esi, 3
jl 0x10003c85
cmp al, 0x10
jb 0x10003c80
mov eax, dword [0x1002b7dc]
movups xmm1, xmmword [ebp - 0x24]
pop edi
movups xmm2, xmmword [eax + 0x1001a7a8]
mov eax, 5
movaps xmm0, xmm2
pxor xmm1, xmm0
sub eax, 1
jne 0x10003cb5
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x2c]
movups xmmword [eax], xmm1
push 0x1f4
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 1
lea eax, [ebp - 0xc]
mov dword [0x1002b7b0], 0
push eax
push 1
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 2
push eax
push esi
call fcn.10002b10
push 0
push 1
push 1
push esi
call dword [0x1003c83c]
mov ecx, dword [ebp - 4]
add esp, 0x2c
mov eax, ebx
xor ecx, ebp
pop esi
pop ebx
call fcn.10008cc1
mov esp, ebp
pop ebp
ret
Function at 0x10004b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1001a024]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
call sym.Key.dll_Cas4ReadWorkKey
movzx eax, ax
mov ecx, 0x9000
add esp, 0xc
cmp ax, cx
jne 0x10004c40
mov eax, dword [ebp - 0x14]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push 0x100227a8
push 0x1f80
mov dword [ebp - 8], eax
call fcn.10001a40
push 0x100227a8
push 0x1fa0
mov esi, eax
call fcn.10001a40
push 0x100227a8
push 0x1fc0
mov edi, eax
call fcn.10001a40
add esp, 0x18
xor bl, bl
movzx ecx, bl
mov dl, byte [ecx + edi]
xor dl, byte [ecx + esi]
cmp dl, 0xff
jne 0x10004bd7
inc bl
cmp bl, 0x10
jb 0x10004bc0
jmp 0x10004bdc
cmp bl, 0x10
jb 0x10004c38
xor dl, dl
mov edi, eax
movzx eax, dl
mov cl, byte [eax + edi]
xor cl, byte [eax + esi]
cmp cl, 0xaa
jne 0x10004bf7
inc dl
cmp dl, 0x10
jb 0x10004be0
jmp 0x10004bfc
cmp dl, 0x10
jb 0x10004c38
lea edx, [ebp - 0x14]
mov edi, 0x10
mov eax, edx
mov ecx, edx
sub esi, eax
mov eax, dword [ebp - 0x1c]
sub eax, ecx
nop
mov cl, byte [esi + edx]
lea edx, [edx + 1]
xor cl, byte [edx - 1]
mov byte [eax + edx - 1], cl
sub edi, 1
jne 0x10004c10
pop edi
pop esi
mov eax, 0x9000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008cc1
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xe029
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008cc1
mov esp, ebp
pop ebp
ret
Function at 0x10007de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1001a024]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
push ebx
mov ebx, dword [ebp + 0x14]
mov edx, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [ebp - 0x14]
sub esi, ecx
movups xmmword [ebp - 0x14], xmm0
sub edi, ecx
nop
mov al, byte [esi + ecx]
xor al, byte [ecx]
mov byte [edi + ecx], al
inc ecx
sub edx, 1
jne 0x10007e10
xor cl, cl
mov edi, 3
movzx esi, cl
xor edx, edx
mov eax, esi
div edi
mov al, byte [ebp + edx - 0x14]
cmp al, byte [ebp + esi - 0x14]
jne 0x10007e6a
inc cl
cmp cl, 0x10
jb 0x10007e25
lea ecx, [ebp - 0x14]
mov esi, edi
lea edx, [ebx + 2]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx - 1]
sub esi, 1
jne 0x10007e47
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008cc1
mov esp, ebp
pop ebp
ret
cmp cl, 0x10
jae 0x10007e3f
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008cc1
mov esp, ebp
pop ebp
ret

Function at 0x10008430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x100227a8
push 0x1f80
call fcn.10001a40
push 0x100227a8
push 0x1fa0
mov esi, eax
call fcn.10001a40
push 0x100227a8
push 0x1fc0
mov edi, eax
call fcn.10001a40
add esp, 0x18
xor bl, bl
nop dword [eax]
movzx ecx, bl
mov dl, byte [ecx + edi]
xor dl, byte [ecx + esi]
cmp dl, 0xff
jne 0x10008487
inc bl
cmp bl, 0x10
jb 0x10008470
jmp 0x1000848c
cmp bl, 0x10
jb 0x10008500
xor dl, dl
mov edi, eax
movzx eax, dl
mov cl, byte [eax + edi]
xor cl, byte [eax + esi]
cmp cl, 0xaa
jne 0x100084a7
inc dl
cmp dl, 0x10
jb 0x10008490
jmp 0x100084ac
cmp dl, 0x10
jb 0x10008500
mov edi, dword [ebp + 8]
mov edx, 0x10
mov ecx, edi
sub esi, edi
nop dword [eax + eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x100084c0
xor dl, dl
movzx ecx, dl
mov al, byte [ecx + edi]
cmp al, byte [edi + ecx + 8]
jne 0x100084ef
inc dl
cmp dl, 8
jb 0x100084d0
pop edi
pop esi
mov eax, 0x9000
pop ebx
mov esp, ebp
pop ebp
ret
cmp dl, 8
jae 0x100084e3
pop edi
pop esi
mov eax, 0xe02a
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xe029
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10053780
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov dword [0xa27d6f4d], eax
imul esi, dword [ebx - 0x1554fb70], 0x1ad16f4a
cmc
mov bh, 0x90
cmpsb byte [esi], byte es:[edi]
xor esi, dword [eax - 0x4e]
nop
add al, 0xa1
dec edx
outsd dx, dword [esi]
adc bl, bh
add ebx, dword [eax + 0x6f]
cli
imul edx, dword [esi], 0x7ac990a2
cmp dword [ebp + 0x6f], ecx
invalid
Function at 0x406a5e
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
lea edi, [ebp - 0x11c]
push 0x47
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x41f01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
and dword [ebp - 0x18], 0
and dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0x10
mov esi, esp
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp esi, esp
call fcn.00413f7e
test eax, eax
je 0x406b5c
mov esi, esp
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp esi, esp
call fcn.00413f7e
test eax, eax
je 0x406b5c
cmp dword [ebp - 0x24], 0
je 0x406b5c
mov esi, esp
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp esi, esp
call fcn.00413f7e
test eax, eax
je 0x406b5c
mov esi, esp
push 0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x48]
push eax
push 2
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp esi, esp
call fcn.00413f7e
test eax, eax
je 0x406b5c
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004064a8
add esp, 0x10
movzx eax, al
test eax, eax
je 0x406b5c
push dword [ebp + 0x10]
lea eax, [ebp - 0x58]
push eax
call fcn.004071f3
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x406b5c
mov byte [ebp - 9], 1
cmp dword [ebp - 0x24], 0
je 0x406b74
mov esi, esp
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp esi, esp
call fcn.00413f7e
cmp dword [ebp - 0x18], 0
je 0x406b8e
mov esi, esp
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp esi, esp
call fcn.00413f7e
mov al, byte [ebp - 9]
push edx
mov ecx, ebp
push eax
lea edx, [0x406bc2]
call fcn.00413f26
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413fa1
add esp, 0x11c
cmp ebp, esp
call fcn.00413f7e
mov esp, ebp
pop ebp
ret