joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015a0c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp dword [ebp + 8], eax
je 0x1015be8
mov edi, dword [ebp + 0x1c]
cmp edi, eax
je 0x1015be8
cmp dword [ebp + 0xc], eax
je 0x1015be8
cmp dword [ebp + 0x14], eax
je 0x1015a55
mov dword [edi], eax
cmp dword [ebp + 0x18], eax
je 0x1015a6f
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x1015b6e
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
mov edi, 0xc0
xor ebx, ebx
push 1
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x28]
push eax
inc ebx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1015aa7
cmp dword [ebp - 0x24], 0x12
je 0x1015b04
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp ebx, 0x64
jb 0x1015a7c
mov ebx, dword [ebp + 0xc]
push 6
push 0
push 0
push dword [ebp + 8]
push ebx
call esi
test eax, eax
je 0x1015abc
jbe 0x1015ac5
dec ebx
cmp eax, ebx
jbe 0x1015b6b
cmp eax, edi
je 0x1015a7a
push 6
push 0x4ff
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp + 0xc]
call esi
cmp eax, edi
je 0x1015a7a
cmp eax, dword [ebp + 0xc]
jne 0x1015b6b
cmp dword [ebp - 4], 0xffffffff
je 0x1015a7a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jae 0x1015b35
sub dword [ebp - 4], eax
jmp 0x1015a7a
mov eax, dword [section..data]
cmp eax, section..data
je 0x1015b2b
test byte [eax + 0x1c], 2
je 0x1015b2b
push dword [ebp - 0xc]
push 0x1003ec4
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005d30
mov eax, 0x83450068
jmp 0x1015bed
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1015b61
test byte [ecx + 0x1c], 4
je 0x1015b61
push 0x1003ec4
push 0x14
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01005f2d
mov ecx, dword [section..data]
mov edi, dword [ebp + 0x1c]
mov eax, 0x102
jmp 0x1015b74
mov edi, dword [ebp + 0x1c]
mov ecx, dword [section..data]
xor edx, edx
cmp eax, edx
je 0x1015b7c
jbe 0x1015b8f
mov esi, dword [ebp + 0xc]
dec esi
cmp eax, esi
ja 0x1015b8f
cmp dword [ebp + 0x14], edx
jne 0x1015b8b
mov dword [edi], eax
xor eax, eax
jmp 0x1015bed
cmp eax, 0x80
jb 0x1015bb1
mov esi, dword [ebp + 0xc]
add esi, 0x7f
cmp eax, esi
ja 0x1015bb1
cmp dword [ebp + 0x14], edx
jne 0x1015baa
add eax, 0xffffff80
mov dword [edi], eax
mov eax, 0x83450066
jmp 0x1015bed
cmp eax, 0x102
jne 0x1015bc1
mov dword [edi], edx
mov eax, 0x83450067
jmp 0x1015bed
cmp ecx, section..data
je 0x1015be1
test byte [ecx + 0x1c], 4
je 0x1015be1
push 0x1003ec4
push 0x15
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01005f2d
mov eax, 0x80004005
jmp 0x1015bed
mov eax, 0x80070057
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x101612d
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
cmp edi, esi
je 0x1016201
mov ebx, dword [ebp + 0x10]
cmp ebx, esi
je 0x1016201
push 0xc
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x101616f
mov edi, 0x8007000e
jmp 0x101622a
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
lea eax, [ebp - 4]
push eax
push 0x1026154
push 4
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x10161c3
mov eax, dword [section..data]
cmp eax, section..data
je 0x10161bc
test byte [eax + 0x1c], 4
je 0x10161bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push 0x1003ec4
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005d30
mov edi, 0x80004005
jmp 0x101622a
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [ebp - 8]
push eax
xor edi, edi
push edi
push esi
push 0x1016965
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
jne 0x10161f5
cmp dword [ebp - 4], edi
je 0x10161bc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], edi
jmp 0x10161bc
mov ecx, dword [ebp - 8]
mov dword [ebx], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jmp 0x1016234
mov eax, dword [section..data]
cmp eax, section..data
je 0x1016225
test byte [eax + 0x1c], 4
je 0x1016225
push 0x1003ec4
push 0x26
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005f2d
mov edi, 0x80070057
test esi, esi
je 0x1016234
push esi
call fcn.010157c8
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x10162c7
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x1025020], 2
push esi
mov esi, 0x80004005
je 0x10162e2
mov esi, 0x83450065
jmp 0x10162f7
push dword [ebp + 8]
push dword [0x1026124]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x10162f7
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1016303
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x101633b
mov esi, 0x80070057
mov eax, dword [section..data]
cmp eax, section..data
je 0x1016374
test byte [eax + 0x1c], 4
je 0x1016374
push 0x1003ec4
push 0x2a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005f2d
jmp 0x1016374
cmp dword [0x1025020], 2
je 0x1016364
mov esi, 0x83450065
mov eax, dword [section..data]
cmp eax, section..data
je 0x1016374
test byte [eax + 0x1c], 4
je 0x1016374
push 0x1003ec4
push 0x2b
jmp 0x101632e
push dword [0x1026124]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi], eax
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x1016875
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x1025020]
push ebx
push esi
mov esi, 0x80004005
mov ebx, 0x1003ec4
cmp eax, 1
je 0x1016894
cmp eax, 3
jne 0x1016936
mov esi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call esi
mov dword [0x1026124], eax
call esi
push 0x1026150
mov dword [0x1026128], eax
call fcn.010157d9
mov esi, eax
test esi, esi
jge 0x10168e0
mov eax, dword [section..data]
cmp eax, section..data
je 0x1016930
test byte [eax + 0x1c], 4
je 0x1016930
push esi
push 0x1004190
push ebx
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101cae4
jmp 0x101692b
push 0x1026144
call fcn.010169c4
mov esi, eax
test esi, esi
jge 0x101690d
mov eax, dword [section..data]
cmp eax, section..data
je 0x1016930
test byte [eax + 0x1c], 4
je 0x1016930
push esi
push 0x1004148
push ebx
push 0xb
jmp 0x10168d3
push edi
xor eax, eax
mov edi, 0x102612c
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
stosd dword es:[edi], eax
mov dword [0x1026138], esi
mov dword [0x1025020], 2
pop edi
mov eax, dword [section..data]
test esi, esi
jge 0x101695b
jmp 0x101693b
mov eax, dword [section..data]
cmp eax, section..data
je 0x1016956
test byte [eax + 0x1c], 4
je 0x1016956
push ebx
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005f2d
call fcn.01016739
mov eax, esi
pop esi
pop ebx
ret

Function at 0x10176d2
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1024008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x104
push esi
mov esi, dword [ebp + 8]
jae 0x101772d
mov esi, 0x80070057
mov eax, dword [section..data]
cmp eax, section..data
je 0x10177d5
test byte [eax + 0x1c], 4
je 0x10177d5
push dword [ebp + 0xc]
push 0x1004320
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005d30
jmp 0x10177d5
push 0x105
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x101778b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x1017770
test byte [eax + 0x1c], 4
je 0x1017770
push esi
push 0x1004320
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005d30
test esi, esi
jle 0x1017782
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x10177d5
mov esi, 0x80004005
jmp 0x10177d5
push 0x10043f8
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x10177d3
mov eax, dword [section..data]
mov esi, 0x80004005
cmp eax, section..data
je 0x10177d5
test byte [eax + 0x1c], 4
je 0x10177d5
push esi
push 0x10043d0
push 0x1004320
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101cae4
jmp 0x10177d5
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01006cd8
leave
ret 8
Function at 0x10177eb
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x1024008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x209
lea eax, [ebp - 0x418]
push eax
call fcn.010176d2
mov ebx, eax
test ebx, ebx
jge 0x1017853
mov eax, dword [section..data]
cmp eax, section..data
je 0x101796d
test byte [eax + 0x1c], 4
je 0x101796d
push ebx
push 0x1004420
push 0x1004320
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101cae4
jmp 0x101796d
push 0x3c
lea eax, [ebp - 0x454]
push 0
push eax
call fcn.01006cf0
and dword [ebp - 0x43c], 0
add esp, 0xc
cmp dword [0x102626c], 0
lea eax, [ebp - 0x418]
mov dword [ebp - 0x440], esi
mov dword [ebp - 0x454], 0x3c
mov dword [ebp - 0x448], 0x1004414
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x450], 0x8440
mov esi, 0x102627c
jne 0x10178f6
mov ecx, esi
call fcn.0101bb24
test eax, eax
jne 0x10178ec
mov ebx, 0x8007000e
mov eax, dword [section..data]
cmp eax, section..data
je 0x101796d
test byte [eax + 0x1c], 4
je 0x101796d
push 0x1004320
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005f2d
jmp 0x101796d
mov dword [0x102626c], 1
mov ecx, esi
call fcn.0101bb9a
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x101795b
mov ecx, esi
call fcn.0101bbad
mov eax, dword [section..data]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, section..data
je 0x1017947
test byte [eax + 0x1c], 4
je 0x1017947
call esi
push eax
mov eax, dword [section..data]
push 0x1004320
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005d30
call esi
test eax, eax
jle 0x1017957
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x101796d
push dword [ebp - 0x41c]
call fcn.010175b2
mov ecx, esi
call fcn.0101bbad
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01006cd8
leave
ret 4
Function at 0x10206cd
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x544b2fba
mov dword [ebp - 0x1c], 0xef0bc9df
mov dword [ebp - 0x18], 0x39d589ae
mov dword [ebp - 0x14], 0xe5ea8173
test edi, edi
je 0x102085b
mov ecx, dword [eax + 0xc]
push ebx
mov ebx, dword [eax + 4]
and edi, 3
mov dword [ebp - 4], ecx
mov ecx, dword [eax]
push esi
mov esi, dword [eax + 8]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], ecx
mov edi, 0xf993291a
je 0x1020764
mov eax, dword [ebp - 0xc]
sub dword [ebp + 8], eax
mov eax, dword [edx]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add eax, ecx
imul eax, eax, 0x6f6e65f
mov ecx, edi
sub ecx, eax
xor ebx, ecx
mov eax, ebx
shr eax, 0x1f
xor esi, ecx
add ebx, ebx
xor ebx, dword [ebp + eax*4 - 0x18]
mov eax, esi
shr eax, 0x1f
add esi, esi
xor esi, dword [ebp + eax*4 - 0x20]
add edx, 4
dec dword [ebp - 0xc]
mov dword [ebp - 8], ecx
jne 0x1020728
mov eax, dword [ebp - 0x10]
cmp dword [ebp + 8], 0
je 0x102084b
mov eax, dword [edx]
add ecx, eax
imul ecx, ecx, 0x6f6e65f
mov eax, edi
sub eax, ecx
xor ebx, eax
mov ecx, dword [edx + 4]
xor esi, eax
add eax, ecx
imul eax, eax, 0x6f6e65f
mov ecx, edi
sub ecx, eax
mov eax, ebx
shr eax, 0x1f
mov dword [ebp - 0xc], eax
lea eax, [ebx + ebx]
mov ebx, dword [ebp - 0xc]
xor eax, dword [ebp + ebx*4 - 0x18]
mov ebx, esi
shr ebx, 0x1f
add esi, esi
xor esi, dword [ebp + ebx*4 - 0x20]
mov ebx, dword [edx + 8]
add ebx, ecx
imul ebx, ebx, 0x6f6e65f
xor eax, ecx
xor esi, ecx
mov ecx, edi
sub ecx, ebx
mov ebx, eax
shr ebx, 0x1f
add eax, eax
xor eax, dword [ebp + ebx*4 - 0x18]
mov ebx, esi
xor eax, ecx
shr ebx, 0x1f
add esi, esi
xor esi, dword [ebp + ebx*4 - 0x20]
mov ebx, dword [edx + 0xc]
xor esi, ecx
mov dword [ebp - 8], ecx
mov ecx, dword [edx + 8]
add ebx, ecx
add ebx, dword [edx + 4]
mov ecx, dword [edx + 0xc]
add ebx, dword [edx]
add edx, 0x10
add dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
add ecx, ebx
imul ecx, ecx, 0x6f6e65f
mov ebx, edi
sub ebx, ecx
mov ecx, ebx
mov ebx, eax
add eax, eax
shr ebx, 0x1f
xor eax, dword [ebp + ebx*4 - 0x18]
xor eax, ecx
mov ebx, eax
add eax, eax
shr ebx, 0x1f
xor eax, dword [ebp + ebx*4 - 0x18]
mov ebx, eax
mov eax, esi
shr eax, 0x1f
mov dword [ebp - 0xc], eax
lea eax, [esi + esi]
mov esi, dword [ebp - 0xc]
xor eax, dword [ebp + esi*4 - 0x20]
xor eax, ecx
mov esi, eax
shr esi, 0x1f
add eax, eax
xor eax, dword [ebp + esi*4 - 0x20]
sub dword [ebp + 8], 4
mov esi, eax
jne 0x102076e
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dword [eax + 8], esi
pop esi
mov dword [eax + 4], ebx
mov dword [eax + 0xc], edx
mov dword [eax], ecx
pop ebx
pop edi
leave
ret 4
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x588c4f1b
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4c98213b
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40e200
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x40e2db
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x40e276
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.0040de40
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x40e244
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x40e394
call fcn.0040e288
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x40e333
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.0040de40
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x40e2ec
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x40e394
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.0040de40
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x40e38f
jmp 0x40e394
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40e400
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x40e4e4
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x40e47f
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.0040dfa0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x40e44d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x40e59d
call fcn.0040e491
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x40e53c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.0040e0d0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x40e4f5
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x40e59d
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.0040e0d0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x40e598
jmp 0x40e59d
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40f640
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x40f72a
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x40f6bd
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0040ee00
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x40f683
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x40f7f3
call fcn.0040f6cf
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x40f78a
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0040f220
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x40f73b
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x40f7f3
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0040f220
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x40f7ee
jmp 0x40f7f3
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x410520
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x41053e
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x410580
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x41059e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret