joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475a51
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x475a86
cmp edi, dword [esi + 0xc]
jge 0x475a86
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x475a86
cmp edi, dword [eax + 8]
jge 0x475a86
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x475a88
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x475b8c
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x475bc0
jmp fcn.00468a2c
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x475c31
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x475d2a
cmp eax, dword [edi + 0xc]
jge 0x475d2a
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x475c82
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x475d13
cmp dword [ebp + 0xc], ebx
je 0x475d13
jmp 0x475cac
push 0x10
call fcn.0047591d
cmp eax, ebx
je 0x475c98
mov ecx, eax
call fcn.00475b83
mov esi, eax
jmp 0x475c9a
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x475cc3
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x475cd3
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x475ce5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00468a2c
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.004503d0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x475d25
cmp ecx, dword [esi + 8]
jge 0x475d25
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x475d2b
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x475de9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x475e17
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x475e35
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00475d53
jmp 0x475e35
mov eax, dword [esi + 0x14]
test eax, eax
je 0x475e35
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00475d53
test edi, edi
mov eax, edi
jne 0x475e1f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4c1a7c]
test ecx, ecx
je 0x475ee8
jmp 0x475de8
ret 8

Function at 0x47f000
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0x33
xor al, 0xd6
loop 0x47f059
ror dword [edi], cl
xor al, 0x8f
adc byte [ecx + ebp], al
cmp bh, byte [esi + eax*2]
stosb byte es:[edi], al
jecxz 0x47f04a
and byte [ebx + ebx*2], bh
popfd
or dword [ebp - 0x58c08c96], 0x17
sti
xor dword [eax], ecx
add dword [0x95a0a943], eax
and al, 0xda
add eax, 0x6c092c41
nop
push 0xf14eb8ba
rcl byte [edx], 0xe6
mov edi, eax
fcomi st(7)
inc eax
jns 0x47f07b
pop eax
cwde
jmp 0x47f0a7
pop edi
cmpsb byte [esi], byte es:[edi]
xor eax, dword [eax + 0x3f]
xchg ecx, eax
invalid
jae 0x47f078
inc ecx
or eax, 0xd9fc0c7f
leave
inc edx
sti
in eax, 0xa2
pop ebx
aam 0xa3
inc edx
mov word [eax - 0x4d7a0fac], gs
sub ebp, 0x1dc8b1ca
aam 0xb8
test dh, dl
and al, 0xee
out dx, al
dec esi
push cs
adc dl, al
mov ebx, 0xc6a5e82d
retf
pop ss
inc eax
wait
cmp ebp, dword [eax - 0x74b6ad4b]
cmp eax, 0x6d8d7e52
test eax, 0xc8bad658
insb byte es:[edi], dx
invalid
Function at 0x484aa0
Capabilities:
Encode data using xor

Disassembly:
or edi, ebx
xchg edi, eax
invalid
test byte [edi - 0x798d5d6a], dh
loopne 0x484a9b
jp 0x484aea
rol dword [edx], cl
fcmovnu st(0), st(3)
out dx, eax
sub al, 0xa6
cmp bl, bh
sbb eax, 0xb7b558e3
in al, 7
aad 0xc5
mov cl, 0xd9
fisubr word [ebp - 0x5d748dbc]
adc dword [esi + 0xc], esi
jge 0x484b40
imul dword [edi]
cmc
or dl, ch
jnp 0x484b01
invalid
adc al, 0x80
and al, 0xb0
inc edi
fcmovu st(0), st(4)
mov esi, 0x74736b3
popfd
imul esp, dword [ebx], 0xffffffe0
sahf
mov byte [0x40b252b5], al
add byte [esi + eax*4 - 0x7b], al
jmp 0x484ad2
xchg byte [ebp + 0x153e4eb], al
in eax, 0x45
dec esp
xchg dword [ecx - 0x56b3a780], ebp
sti
das
jns 0x484a9d
ficom dword [ecx + ecx - 0x7bcbc71a]
cmp byte [esp + eax*4], dh
sub eax, 0xa24741b9
aad 0xad
mov ebp, 0xf353602c
sbb dword [eax + 0x68], 0xc9d86bf3
pushal
push ebx
sbb dword [eax + 0x68], 0xc9d86bf3
jg 0x484b5d
inc ebp
mov dl, 0x6a
xor eax, 0xe27d0e52
mov edi, 0xbbdbab2a
jp 0x484b0d
sub byte [ecx + ebp], cl
imul esi, dword [esi - 1], 0x600948
pop ebp
js 0x484ad4
lahf
stc
fimul word [ecx]
jbe 0x484b36
jl 0x484b5a
sbb esp, dword [ebx - 0x67]
pop edx
xor edx, dword [ecx + 0x3b]
inc edi
popfd
mov bh, 0xdd
lea ecx, [esi + edi*8]
sti
cmpsd dword [esi], dword es:[edi]
rcr dword [esi + 0x271bde18], 0xe8
in al, dx
cmp al, 0x23
fst qword [eax + 0x1f]
sbb esp, dword [edi]
call 0xdd6b8844
push esp
loopne 0x484b7a
pop ds
xor eax, 0x74f9f9d3
outsd dx, dword [esi]
stc
stc
je 0x484bd0
cld
and al, 0xf7
bswap eax
cmp edi, dword [esi + 0x14bbe20d]
or byte [esi], ah
dec edx
or ah, byte [ebp - 0x33]
xchg esi, eax
fsubr dword [edi]
dec ebp
jb 0x484b51
jne 0x484bc9
cmp byte [edx], bh
sub eax, 0xd4cc91e7
mov dword [ebp + eax - 0x3fccf818], ebx
or eax, 0x69b6720d
std
push cs
in al, dx
insd dword es:[edi], dx
in al, 0xec
arpl word [eax - 0x26522426], dx
or bl, byte [0xb67985ac]
and byte [ecx + 0x22], dl
fild word [eax]
sal ebp, 0x2e
invalid
fld dword [edx]
pushal
push cs
lds ebp, [edx + 0x75]
adc cl, bh
hlt
Function at 0x401b40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [ebp + 0xc]
push ebx
mov bl, byte [eax + 0x80]
push esi
push edi
lea esi, [eax + 0x20]
mov ecx, 8
lea edi, [esp + 0x58]
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x40]
mov ecx, 8
lea edi, [esp + 0x78]
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x449d70]
mov byte [esp + 0x13], bl
cmp cl, 1
jne 0x401d21
xor eax, eax
xor ecx, ecx
cpuid
lea esi, [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov eax, 1
mov dword [esi + 0xc], edx
cmp dword [esp + 0x18], eax
jl 0x401d0e
xor ecx, ecx
cpuid
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
test dword [esp + 0x20], 0x200
je 0x401be2
push eax
mov eax, dword [ebp + 8]
push eax
mov byte [0x449d70], 2
call fcn.00401d40
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, byte [esp + 0x13]
mov byte [0x449d70], 0
mov edi, dword [ebp + 8]
mov ecx, 8
mov esi, eax
rep movsd dword es:[edi], dword [esi]
test bl, bl
je 0x401ca7
movzx ecx, bl
push ecx
add eax, 0x60
push eax
lea edx, [esp + 0x20]
push edx
call fcn.0042a7e0
mov edx, dword [esp + 0x84]
movzx ecx, bl
mov al, 0x20
add esp, 0xc
sub al, bl
lea ecx, [edx + ecx*8]
mov dword [esp + 0x78], ecx
je 0x401c3e
lea ecx, [ecx]
movzx edx, bl
inc bl
dec al
mov byte [esp + edx + 0x18], 0
jne 0x401c30
xor al, al
xor edi, edi
mov dword [esp + 0x14], 8
lea ebx, [ebx]
mov ecx, dword [esp + edi + 0x18]
xor esi, esi
xor ebx, ebx
add ecx, dword [esp + edi + 0x58]
movzx eax, al
adc esi, ebx
cdq
add ecx, eax
adc esi, edx
test esi, esi
setne al
mov dword [esp + edi + 0x58], ecx
add edi, 4
dec dword [esp + 0x14]
jne 0x401c50
mov edi, dword [ebp + 8]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov eax, edi
call fcn.00401fc0
lea edx, [esp + 0x20]
push edi
push edx
lea eax, [esp + 0x48]
call fcn.00402190
mov ecx, 8
mov esi, eax
add esp, 0x10
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x78]
push eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x3c]
push ecx
call fcn.00401fc0
mov ebx, dword [ebp + 8]
lea edx, [esp + 0x80]
push ebx
push edx
lea eax, [esp + 0x48]
call fcn.00402190
mov esi, eax
mov ecx, 8
mov edi, ebx
lea eax, [esp + 0x68]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x4c]
push ecx
mov eax, ebx
call fcn.00401fc0
lea edx, [esp + 0x70]
push ebx
push edx
lea eax, [esp + 0x58]
call fcn.00402190
mov ecx, 8
mov esi, eax
mov edi, ebx
add esp, 0x20
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, byte [esp + 0x13]
mov eax, dword [ebp + 0xc]
mov byte [0x449d70], 0
jmp 0x401bed
test cl, cl
je 0x401bed
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00401d40
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402200
Capabilities:
Encode data using xor

Disassembly:
test cl, cl
je 0x4022b4
push esi
lea esp, [esp]
mov dx, word [eax + 4]
xor dx, word [eax]
movzx esi, word [eax + 0x18]
xor dx, word [eax + 6]
xor dx, word [eax + 2]
movzx edx, dx
xor si, dx
xor si, word [eax + 0x1e]
dec cl
movzx edx, si
movzx esi, word [eax + 2]
mov word [eax], si
movzx esi, word [eax + 4]
mov word [eax + 2], si
movzx esi, word [eax + 6]
mov word [eax + 4], si
movzx esi, word [eax + 8]
mov word [eax + 6], si
movzx esi, word [eax + 0xa]
mov word [eax + 8], si
movzx esi, word [eax + 0xc]
mov word [eax + 0xa], si
movzx esi, word [eax + 0xe]
mov word [eax + 0xc], si
movzx esi, word [eax + 0x10]
mov word [eax + 0xe], si
movzx esi, word [eax + 0x12]
mov word [eax + 0x10], si
movzx esi, word [eax + 0x14]
mov word [eax + 0x12], si
movzx esi, word [eax + 0x16]
mov word [eax + 0x14], si
movzx esi, word [eax + 0x18]
mov word [eax + 0x16], si
movzx esi, word [eax + 0x1a]
mov word [eax + 0x18], si
movzx esi, word [eax + 0x1c]
mov word [eax + 0x1a], si
movzx esi, word [eax + 0x1e]
mov word [eax + 0x1c], si
mov word [eax + 0x1e], dx
jne 0x402210
pop esi
ret
Function at 0x403fc3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov al, byte [0x449d70]
sub esp, 0x1c
push ebx
push esi
push edi
cmp al, 1
jne 0x403f72
xor eax, eax
xor ecx, ecx
cpuid
lea esi, [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov eax, 1
mov dword [esi + 0xc], edx
cmp dword [esp + 0x18], eax
jl 0x403f57
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
test dword [esp + 0x20], 0x200
je 0x403f57
mov byte [0x449d70], 2
jmp 0x403f76
mov byte [0x449d70], 0
mov esi, dword [ebp + 0x10]
movzx eax, byte [esi + 0x38]
dec eax
cmp eax, 6
ja case.0x403f6b.2
jmp dword [eax*4 + 0x4040d0]
test al, al
je 0x403f5e
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call fcn.004040f0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x10], 0x444e1c
jmp 0x403fcb
mov dword [esp + 0x10], 0x444e58
jmp 0x403fcb
mov dword [esp + 0x10], 0x444e94
jmp 0x403fcb
mov dword [esp + 0x10], 0x444ed0
jmp 0x403fcb
mov dword [esp + 0x10], 0x444f0c
jmp 0x403fcb
mov dword [esp + 0x10], 0x444de0
mov al, byte [esi + 0x28]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test al, al
je 0x404009
cmp al, 8
je 0x403ffd
lea esp, [esp]
test ebx, ebx
je 0x4040c8
movzx eax, byte [esi + 0x28]
mov cl, byte [eax + esi + 0x30]
xor byte [edi], cl
inc byte [esi + 0x28]
inc edi
dec ebx
cmp byte [esi + 0x28], 8
jne 0x403fe0
test ebx, ebx
je 0x4040c8
mov byte [esi + 0x28], 0
mov eax, ebx
shr eax, 3
test eax, eax
je 0x404063
mov dword [esp + 0x14], eax
add dword [esi + 0x20], 0x1010101
mov eax, dword [esi + 0x24]
xor ecx, ecx
add eax, 0x1010104
adc ecx, ecx
je 0x40402c
inc eax
mov edx, dword [esi + 0x20]
mov ecx, dword [esp + 0x10]
push ecx
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x1c]
push esi
push edx
mov dword [esi + 0x24], eax
mov dword [esp + 0x28], eax
call fcn.00402a80
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
xor dword [edi], eax
xor dword [edi + 4], ecx
add esp, 0xc
add edi, 8
dec dword [esp + 0x14]
jne 0x404016
and ebx, 7
je 0x4040c8
add dword [esi + 0x20], 0x1010101
mov eax, dword [esi + 0x24]
xor ecx, ecx
add eax, 0x1010104
adc ecx, ecx
je 0x40407e
inc eax
mov edx, dword [esi + 0x20]
mov ecx, dword [esp + 0x10]
push ecx
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x1c]
push esi
push edx
mov dword [esi + 0x24], eax
mov dword [esp + 0x28], eax
call fcn.00402a80
add esp, 0xc
xor cl, cl
test ebx, ebx
je 0x4040ba
xor eax, eax
mov al, byte [esp + eax + 0x18]
xor byte [edi], al
inc byte [esi + 0x28]
inc cl
movzx eax, cl
inc edi
cmp eax, ebx
jb 0x4040a7
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4043b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
movzx eax, byte [ebp + 0x18]
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
dec eax
shr edi, 3
cmp eax, 6
ja case.0x40437c.2
jmp dword [eax*4 + 0x4044c8]
mov dword [esp + 0xc], 0x444e1c
jmp 0x4043bd
mov dword [esp + 0xc], 0x444e58
jmp 0x4043bd
mov dword [esp + 0xc], 0x444e94
jmp 0x4043bd
mov dword [esp + 0xc], 0x444ed0
jmp 0x4043bd
mov dword [esp + 0xc], 0x444f0c
jmp 0x4043bd
mov dword [esp + 0xc], 0x444de0
mov al, byte [0x449d70]
cmp al, 1
jne 0x404427
xor eax, eax
xor ecx, ecx
cpuid
lea esi, [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov eax, 1
mov dword [esi + 0xc], edx
cmp dword [esp + 0x18], eax
jl 0x404408
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
test dword [esp + 0x20], 0x200
je 0x404408
mov byte [0x449d70], 2
jmp 0x40442b
mov byte [0x449d70], 0
mov eax, dword [ebp + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x40444e
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
jmp 0x404456
test al, al
je 0x40440f
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
call fcn.004044f0
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
cmp edi, ecx
jbe 0x404493
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push ebx
push edx
call fcn.00402a80
mov eax, dword [esp + 0x1c]
xor dword [esi], eax
mov ecx, dword [esp + 0x20]
xor dword [esi + 4], ecx
mov edx, dword [esi]
mov eax, dword [esi + 4]
add esp, 0xc
add esi, 8
dec edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
jne 0x404460
mov edi, dword [ebp + 0xc]
and edi, 7
je 0x4044c0
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push ebx
push edx
call fcn.00402a80
add esp, 0xc
xor eax, eax
test edi, edi
je 0x4044c0
mov cl, byte [esp + eax + 0x10]
xor byte [esi], cl
inc eax
inc esi
cmp eax, edi
jb 0x4044b4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4044f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x2b8
push esi
lea eax, [ebp - 0x2b0]
push edi
push eax
call fcn.00425470
mov eax, dword [ebx + 0xc]
shr eax, 3
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
movzx eax, byte [ebx + 0x18]
add eax, 0xfffffffe
add esp, 4
cmp eax, 5
ja case.0x40454c.2
jmp dword [eax*4 + 0x404640]
mov dword [ebp - 4], 0x444f88
jmp 0x40457e
mov dword [ebp - 4], 0x444fc8
jmp 0x40457e
mov dword [ebp - 4], 0x445008
jmp 0x40457e
mov dword [ebp - 4], 0x445048
jmp 0x40457e
mov dword [ebp - 4], 0x444f48
mov esi, dword [ebx + 0x10]
mov ecx, 8
lea edi, [ebp - 0xb0]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xb0]
push ecx
call fcn.0042552e
mov eax, dword [ebx + 0x14]
add esp, 4
test eax, eax
je 0x4045af
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x4045ef
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0xb0]
push ecx
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.004259dd
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
xor dword [eax], ecx
xor dword [eax + 4], edx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
add eax, 8
add esp, 0xc
dec esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
mov dword [ebx + 8], eax
jne 0x4045b6
mov edi, dword [ebx + 0xc]
and edi, 7
je 0x404626
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0xb0]
push eax
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.004259dd
add esp, 0xc
xor eax, eax
test edi, edi
je 0x404626
mov esi, dword [ebx + 8]
mov cl, byte [ebp + eax - 0x28]
xor byte [esi], cl
inc esi
inc eax
mov dword [ebx + 8], esi
cmp eax, edi
jb 0x404614
lea edx, [ebp - 0x2b0]
push edx
call fcn.0042547b
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4046b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
movzx eax, byte [ebp + 0x18]
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
dec eax
shr edi, 3
cmp eax, 6
ja case.0x40467c.2
jmp dword [eax*4 + 0x4047c0]
mov dword [esp + 0xc], 0x444e1c
jmp 0x4046bd
mov dword [esp + 0xc], 0x444e58
jmp 0x4046bd
mov dword [esp + 0xc], 0x444e94
jmp 0x4046bd
mov dword [esp + 0xc], 0x444ed0
jmp 0x4046bd
mov dword [esp + 0xc], 0x444f0c
jmp 0x4046bd
mov dword [esp + 0xc], 0x444de0
mov al, byte [0x449d70]
cmp al, 1
jne 0x40471d
xor eax, eax
xor ecx, ecx
cpuid
lea esi, [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov eax, 1
mov dword [esi + 0xc], edx
cmp dword [esp + 0x18], eax
jl 0x404708
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
test dword [esp + 0x20], 0x200
je 0x404708
mov byte [0x449d70], 2
jmp 0x404721
mov byte [0x449d70], 0
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x404744
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
jmp 0x404748
test al, al
je 0x40470f
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
call fcn.004047e0
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
xor ecx, ecx
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
test edi, edi
je 0x404784
lea ebx, [ebx]
xor ecx, dword [esi + 4]
xor eax, dword [esi]
push ecx
push eax
mov eax, dword [esp + 0x14]
push ebx
add esi, 8
call fcn.004034e0
add esp, 0xc
dec edi
mov ecx, edx
jne 0x404760
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov edi, dword [ebp + 0xc]
and edi, 7
je 0x4047b8
lea eax, [esp + 0x10]
mov ecx, eax
sub esi, ecx
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec edi
jne 0x404794
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
push ebx
call fcn.004034e0
add esp, 0xc
mov dword [esp + 0x14], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4047e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x2b8
push esi
lea eax, [ebp - 0x2b0]
push edi
push eax
call fcn.00425470
mov eax, dword [ebx + 0xc]
shr eax, 3
push 0x60
xor esi, esi
mov dword [ebp - 0x2c], eax
xor eax, eax
lea ecx, [ebp - 0x90]
push esi
push ecx
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
call fcn.0042adc0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
movzx eax, byte [ebx + 0x18]
add eax, 0xfffffffe
add esp, 0x10
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
cmp eax, 5
ja case.0x404873.2
jmp dword [eax*4 + 0x40495c]
mov dword [ebp - 4], 0x444f88
jmp 0x4048a5
mov dword [ebp - 4], 0x444fc8
jmp 0x4048a5
mov dword [ebp - 4], 0x445008
jmp 0x4048a5
mov dword [ebp - 4], 0x445048
jmp 0x4048a5
mov dword [ebp - 4], 0x444f48
mov esi, dword [ebx + 0x10]
lea edx, [ebp - 0xb0]
mov ecx, 8
lea edi, [ebp - 0xb0]
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.0042552e
mov eax, dword [ebx + 0x14]
add esp, 4
test eax, eax
je 0x4048d6
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x40490b
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
xor dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 4]
xor dword [ebp - 0x24], edx
add eax, 8
mov dword [ebx + 8], eax
lea eax, [ebp - 0xb0]
push eax
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00427377
add esp, 0xc
dec esi
jne 0x4048dd
mov edi, dword [ebx + 0xc]
and edi, 7
je 0x404940
mov esi, dword [ebx + 8]
lea eax, [ebp - 0x28]
mov ecx, eax
sub esi, ecx
lea ecx, [ecx]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec edi
jne 0x404920
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0xb0]
push eax
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00427377
add esp, 0xc
lea eax, [ebp - 0x2b0]
push eax
call fcn.0042547b
mov eax, dword [ebp - 0x28]
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret