joyce8/EMBER2024-capa huggingface dataset:
Function at 0x651a5c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x651a89
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x651a98
mov edx, ebx
mov eax, 1
call fcn.00430f40
mov edx, eax
mov eax, 5
call fcn.00430e54
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x652d40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x652d7b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_GetKeyboardState
test byte [ebp - 0xf0], 0x80
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x652d85
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x65342c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x65348f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x6718a8]
cmp dword [eax], 1
jne 0x65345a
mov eax, dword [ebp - 4]
call fcn.00475080
mov ebx, eax
jmp 0x653485
mov eax, dword [ebp - 4]
call fcn.004054b8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x653471
test al, 0x10
je 0x653475
xor ebx, ebx
jmp 0x653477
mov bl, 1
test bl, bl
jne 0x653485
mov eax, dword [ebp - 4]
call fcn.00475080
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6534a3
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x653868
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405870
xor eax, eax
push ebp
push 0x6539a0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x65396b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x14]
mov edx, 0x6539b4
call fcn.004052c4
mov eax, dword [0x6713c0]
mov eax, dword [eax]
cmp dword [eax + 0x304], 6
jl 0x653922
lea eax, [ebp - 0x10]
mov edx, 0x6539c4
call fcn.004052c4
lea eax, [ebp - 8]
mov edx, 0x6539e8
call fcn.004052c4
push dword [ebp - 0x10]
push dword [ebp - 4]
push 0x653a08
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405598
push 1
push 0
mov eax, dword [ebp - 0xc]
call fcn.004054b8
push eax
mov eax, dword [ebp - 8]
call fcn.004054b8
push eax
mov eax, dword [ebp - 0x14]
call fcn.004054b8
push eax
mov eax, dword [0x6713c0]
mov eax, dword [eax]
call fcn.00451704
push eax
call sub.shell32.dll_ShellExecuteW
mov bl, 1
test bl, bl
jne 0x653961
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00474f1c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00404dc0
push 1
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404ff0
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [0x6713c0]
mov eax, dword [eax]
call fcn.00451704
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x653975
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6539a7
lea eax, [ebp - 0x1c]
call fcn.00405264
lea eax, [ebp - 0x18]
call fcn.00404b30
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040527c
ret
Function at 0x656ebc
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb9c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x464], ecx
mov esi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405870
xor eax, eax
push ebp
push 0x6570e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, esi
call fcn.00405264
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x18], 0xffffffff
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
je 0x6570c4
xor edx, edx
push ebp
push 0x6570bd
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x44
call fcn.004034f8
lea eax, [ebp - 0x74]
xor ecx, ecx
mov edx, 0x10
call fcn.004034f8
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x101
mov word [ebp - 0x34], 0
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle_1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004054b8
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x6570a6
xor edx, edx
push ebp
push 0x65709f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
call fcn.00405264
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x45e]
xor ecx, ecx
mov edx, 0x3ea
call fcn.004034f8
push 0
lea eax, [ebp - 0x14]
push eax
push 0x190
lea eax, [ebp - 0x45e]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x65702f
cmp dword [ebp - 0x14], 0
jbe 0x657029
lea eax, [ebp - 0x464]
lea edx, [ebp - 0x45e]
mov ecx, 0x1f5
call fcn.00405420
mov edx, dword [ebp - 0x464]
mov eax, esi
call fcn.004054d4
cmp dword [ebp - 0x14], 0
ja 0x656fca
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6570a6
xor edx, edx
push ebp
push 0x657065
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x65705b
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65706f
xor edx, edx
push ebp
push 0x657094
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x65708a
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65709e
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6570c4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6570ec
lea eax, [ebp - 0x464]
call fcn.00405264
lea eax, [ebp - 4]
call fcn.00405264
ret
Function at 0x6578e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405870
xor eax, eax
push ebp
push 0x657a35
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x657a15
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.004034f8
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.004034f8
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], si
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004054b8
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x657980
mov dword [ebp - 8], 0xffffffff
jmp 0x657a0b
test bl, bl
je 0x657a0b
xor eax, eax
mov dword [ebp - 8], eax
push 0x32
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x6579ad
mov eax, dword [0x6712e4]
mov eax, dword [eax]
call fcn.0046c078
jmp 0x65798d
xor edx, edx
push ebp
push 0x6579d2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x6579c8
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6579dc
xor edx, edx
push ebp
push 0x657a01
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x6579f7
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x657a0b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x657a1f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x657a3c
lea eax, [ebp - 4]
call fcn.00405264
ret
Function at 0x40a6d8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
cmp dword [esp + 4], 0
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebp, edx
mov bl, byte [edi + 0x100]
mov bh, byte [edi + 0x101]
mov eax, ecx
jbe 0x40a737
sub eax, ebp
mov dword [esp + 0x14], eax
push esi
inc bl
movzx esi, bl
mov dl, byte [esi + edi]
add bh, dl
movzx ecx, bh
mov al, byte [ecx + edi]
mov byte [esi + edi], al
mov byte [ecx + edi], dl
movzx ecx, byte [esi + edi]
movzx eax, dl
add ecx, eax
and ecx, 0xff
mov al, byte [ecx + edi]
mov ecx, dword [esp + 0x18]
xor al, byte [ecx + ebp]
mov byte [ebp], al
inc ebp
dec dword [esp + 0x14]
jne 0x40a6fd
pop esi
mov byte [edi + 0x100], bl
mov byte [edi + 0x101], bh
pop edi
pop ebp
pop ebx
ret 8

Function at 0x40a749
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x40a773
push ebx
mov ebx, dword [esp + 0x14]
sub ecx, edx
mov al, byte [ecx + edx]
xor al, byte [esi + ebx]
inc esi
mov byte [edx], al
xor eax, eax
cmp esi, dword [esp + 0x18]
cmove esi, eax
inc edx
dec edi
jne 0x40a75c
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x40a778
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, edx
mov dword [esp + 0xc], eax
mov ebp, ecx
mov esi, eax
test edi, edi
je 0x40a85a
lea eax, [esp + 0x14]
sub ebp, eax
push ebx
push 3
xor bl, bl
lea ecx, [esp + 0x1c]
pop edx
test edi, edi
je 0x40a7b0
mov al, byte [ecx + ebp]
dec edi
inc bl
mov byte [ecx], al
jmp 0x40a7b3
mov byte [ecx], 0
inc ecx
dec edx
jne 0x40a7a2
movzx ecx, byte [esp + 0x18]
movzx edx, byte [esp + 0x19]
mov eax, ecx
shr eax, 2
and ecx, 3
mov bh, byte [eax + 0x9d77b8]
shl ecx, 4
mov eax, edx
shr eax, 4
or eax, ecx
mov cl, byte [esp + 0x1a]
mov ch, byte [eax + 0x9d77b8]
add ebp, 3
cmp bl, 1
jbe 0x40a801
movzx eax, cl
and edx, 0xf
shl edx, 2
shr eax, 6
or eax, edx
mov dl, byte [eax + 0x9d77b8]
jmp 0x40a803
mov dl, 0x3d
cmp bl, 2
jbe 0x40a816
movzx eax, cl
and eax, 0x3f
mov cl, byte [eax + 0x9d77b8]
jmp 0x40a818
mov cl, 0x3d
cmp byte [esp + 0x1c], 0
je 0x40a83f
movzx eax, bh
mov word [esi], ax
movzx eax, ch
mov word [esi + 2], ax
movzx eax, dl
mov word [esi + 4], ax
movzx eax, cl
mov word [esi + 6], ax
add esi, 8
jmp 0x40a84d
mov byte [esi], bh
mov byte [esi + 1], ch
mov byte [esi + 2], dl
mov byte [esi + 3], cl
add esi, 4
test edi, edi
jne 0x40a799
mov eax, dword [esp + 0x10]
pop ebx
sub esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x40a947
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [ecx]
mov byte [edx], al
mov eax, dword [esp + 4]
cmp eax, 1
jbe 0x40a96a
push esi
lea esi, [edx + 1]
sub ecx, edx
lea edx, [eax - 1]
mov al, byte [ecx + esi]
xor al, byte [esi - 1]
mov byte [esi], al
inc esi
dec edx
jne 0x40a95d
pop esi
ret 4
Function at 0x40a96d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
push edi
mov edi, dword [esp + 0xc]
cmp ecx, esi
je 0x40a985
push edi
push ecx
push esi
call dword [0x9d14ec]
add esp, 0xc
lea ecx, [edi - 1]
test ecx, ecx
je 0x40a996
mov al, byte [ecx + esi - 1]
xor byte [ecx + esi], al
dec ecx
jne 0x40a98c
pop edi
pop esi
ret 4

Function at 0x40ae99
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
mov eax, dword [esi + 0x3c]
push edi
mov edi, dword [esp + 0x1c]
mov ebp, ebx
sub ebp, esi
add eax, esi
lea ecx, [edi + ebp]
push ecx
push ebp
push dword [eax + 0x34]
mov edx, esi
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.004198d4
lea eax, [esp + 0x1c]
push eax
push 0x40
push edi
push ebx
call dword [0x9d1248]
test eax, eax
je 0x40af14
xor ecx, ecx
mov edx, ecx
test edi, edi
je 0x40af03
and dword [esp + 0x10], 0
movzx eax, cl
mov al, byte [esp + eax + 0x20]
xor byte [edx + ebx], al
inc cl
movzx eax, cl
cmp cl, 4
cmove eax, dword [esp + 0x10]
inc edx
mov cl, al
cmp edx, edi
jb 0x40aee0
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push edi
push ebx
call dword [0x9d1248]
mov edx, dword [esp + 0x14]
lea eax, [edi + ebp]
mov edx, dword [edx + 0x34]
push eax
push ebp
push esi
mov ecx, esi
call fcn.004198d4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 8

Function at 0x40b051
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
push esi
push edi
push 0x10
push ecx
lea eax, [esp + 0x10]
push eax
mov esi, edx
call dword [0x9d14ec]
xor dword [esp + 0x14], esi
xor word [esp + 0x18], si
shr esi, 0x10
xor word [esp + 0x1a], si
add esp, 0xc
xor edx, edx
xor ecx, ecx
mov al, byte [ebp + ecx + 8]
xor byte [esp + edx + 0x10], al
inc ecx
xor eax, eax
cmp ecx, 4
cmove ecx, eax
inc edx
cmp edx, 8
jb 0x40b087
cmp dword [ebp + 0x10], eax
je 0x40b0c3
push dword [ebp + 0x10]
and dword [esp + 0x1c], eax
lea ecx, [esp + 0x1c]
call fcn.0040aa15
lea eax, [esp + 8]
push 0x10
push eax
lea ecx, [esp + 0x20]
call fcn.0040aa75
movzx eax, byte [ebp + 0x14]
sub eax, 0
je 0x40b0f3
dec eax
je 0x40b0db
dec eax
jne 0x40b0f3
mov edx, 0x9d77fc
push 7
jmp 0x40b0e2
mov edx, 0x9d780c
push 6
mov esi, dword [ebp + 0xc]
pop edi
push edi
mov ecx, esi
call fcn.0041fae2
lea eax, [esi + edi*2]
jmp 0x40b0f6
mov eax, dword [ebp + 0xc]
push 0x28
push eax
lea eax, [esp + 0x10]
push eax
call dword [0x9d1540]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40bc9d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x48]
mov ebp, ecx
lea ecx, [esp + 0x2c]
push 0x14
sub esi, edi
mov dword [esp + 0x14], ebp
mov edx, edi
sub ecx, edi
pop ebx
mov al, byte [esi + edx]
xor al, byte [edx]
mov byte [ecx + edx], al
inc edx
dec ebx
jne 0x40bcbf
xor esi, esi
cmp dword [ebp + 4], esi
jle 0x40bd2d
lea edx, [esp + 0x18]
sub edx, edi
mov dword [esp + 0x14], edx
mov ebx, esi
mov eax, dword [ebp]
add eax, 8
add eax, ebx
sub eax, edi
push 0x14
mov ecx, edi
mov dword [esp + 0x48], eax
pop ebp
mov edi, eax
mov al, byte [edi + ecx]
xor al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
dec ebp
jne 0x40bcf3
mov edi, dword [esp + 0x48]
mov ebp, dword [esp + 0x10]
push 0x14
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call dword [0x9d14f4]
add esp, 0xc
test eax, eax
js 0x40bd3a
mov edx, dword [esp + 0x14]
inc esi
add ebx, 0x38
cmp esi, dword [ebp + 4]
jl 0x40bcde
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 8
mov eax, esi
jmp 0x40bd30

Function at 0x40c295
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
dec eax
dec eax
je 0x40c300
call fcn.0040c1de
test al, al
jne 0x40c2b1
xor al, al
jmp 0x40c32b
lea edi, [esi + 4]
xor ebx, ebx
cmp dword [edi], ebx
jne 0x40c2e9
mov eax, dword [esi + 8]
sub eax, ebx
je 0x40c2d0
dec eax
jne 0x40c2cb
mov eax, 0x8004
jmp 0x40c2d5
mov eax, dword [ebp + 0xc]
jmp 0x40c2d5
mov eax, 0x8003
push edi
push ebx
push ebx
push eax
push dword [esi]
call dword [0x9d1020]
test eax, eax
jne 0x40c2e9
mov dword [edi], ebx
jmp 0x40c2ad
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi]
call dword [0x9d1028]
dec eax
neg eax
sbb eax, eax
inc eax
jmp 0x40c32b
mov ecx, dword [esi]
xor edx, edx
cmp dword [ebp + 0xc], edx
jbe 0x40c327
mov edi, dword [ebp + 8]
movzx eax, byte [edx + edi]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0xa0ffa0]
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40c30c
mov dword [esi], ecx
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x40db36
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xor edx, edx
mov dword [0xa103c0], ecx
inc edx
mov ecx, 0xa103c0
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
add ecx, 4
imul eax, eax, 0x6c078965
add eax, edx
mov dword [ecx], eax
inc edx
cmp ecx, 0xa10d7c
jl 0x40db44
mov dword [0xa103a4], edx
ret

Function at 0x40db68
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, dword [0xa103a4]
cmp esi, 0x270
jl 0x40dc2d
xor esi, esi
push ebx
mov edx, esi
mov ebx, 0x7fffffff
mov ecx, dword [edx*4 + 0xa103c4]
xor ecx, dword [edx*4 + 0xa103c0]
and ecx, ebx
xor ecx, dword [edx*4 + 0xa103c0]
mov eax, ecx
and eax, 1
shr ecx, 1
xor ecx, dword [eax*4 + 0xa0f350]
xor ecx, dword [edx*4 + 0xa109f4]
inc edx
mov dword [edx*4 + 0xa103bc], ecx
cmp edx, 0xe3
jl 0x40db85
cmp edx, 0x26f
jge 0x40dbfe
push edi
lea edi, [edx*4 + 0xa103c0]
mov ecx, dword [edi]
xor ecx, dword [edi + 4]
and ecx, ebx
xor ecx, dword [edi]
mov eax, ecx
and eax, 1
shr ecx, 1
mov eax, dword [eax*4 + 0xa0f350]
xor eax, dword [edi - 0x38c]
xor eax, ecx
mov dword [edi], eax
add edi, 4
cmp edi, 0xa10d7c
jl 0x40dbd1
pop edi
mov ecx, dword [0xa103c0]
xor ecx, dword [0xa10d7c]
and ecx, ebx
xor ecx, dword [0xa10d7c]
pop ebx
mov eax, ecx
and eax, 1
shr ecx, 1
xor ecx, dword [eax*4 + 0xa0f350]
xor ecx, dword [0xa109f0]
mov dword [0xa10d7c], ecx
mov ecx, dword [esi*4 + 0xa103c0]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
inc esi
mov eax, ecx
shr eax, 0x12
mov dword [0xa103a4], esi
xor eax, ecx
pop esi
ret

Function at 0x410e66
Capabilities:
Encode data using xor

Disassembly:
push esi
movzx esi, cx
push edi
mov edi, edx
xor eax, eax
xor edx, edx
cmp ax, word [esi*8 + 0x9d63ea]
jae 0x410e9f
mov eax, dword [esi*8 + 0x9d63ec]
movzx ecx, dx
mov al, byte [eax + ecx]
xor al, byte [esi*8 + 0x9d63e8]
xor al, dl
inc edx
mov byte [ecx + edi], al
cmp dx, word [esi*8 + 0x9d63ea]
jb 0x410e7b
movzx eax, word [esi*8 + 0x9d63ea]
mov byte [eax + edi], 0
pop edi
pop esi
ret

Function at 0x410eae
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
movzx esi, cx
push edi
xor eax, eax
xor edi, edi
mov ebx, edx
cmp ax, word [esi*8 + 0x9d63ea]
jae 0x410ef8
mov eax, dword [esi*8 + 0x9d63ec]
movzx edx, di
movsx cx, byte [eax + edx]
movzx eax, byte [esi*8 + 0x9d63e8]
xor cx, ax
xor cx, di
mov eax, 0xff
and cx, ax
inc edi
mov word [ebx + edx*2], cx
cmp di, word [esi*8 + 0x9d63ea]
jb 0x410ec4
movzx eax, word [esi*8 + 0x9d63ea]
pop edi
xor ecx, ecx
pop esi
mov word [ebx + eax*2], cx
pop ebx
ret

Function at 0x415e6f
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push esi
push edi
cld
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
mov ecx, 0x18
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x415e92
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x415e89
cmp edi, 0x6a4abc5b
mov eax, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x415e7f
pop edi
pop esi
ret
Function at 0x4166c6
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, 0x614
push edi
mov esi, ecx
push 0x9d7128
push esi
call dword [0x9d14ec]
mov ecx, dword [0xa0fe0c]
add ecx, dword [0xa0f764]
add esp, 0xc
sub ecx, esi
mov al, byte [ecx + esi]
xor byte [esi], al
inc esi
dec edi
jne 0x4166ed
pop edi
pop esi
ret

Function at 0x4167c4
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
push edi
mov ebp, 0x114
push ebp
lea eax, [esp + 0x2c]
push 0x9d6bc0
push eax
mov edi, edx
mov ebx, ecx
mov dword [esp + 0x30], 0x33effd06
call dword [0x9d14ec]
add esp, 0xc
xor edx, edx
xor ecx, ecx
mov al, byte [esp + ecx + 0x24]
xor byte [esp + edx + 0x28], al
inc ecx
xor eax, eax
cmp ecx, 4
cmove ecx, eax
inc edx
cmp edx, ebp
jb 0x4167f7
push 1
lea ecx, [esp + 0x18]
call fcn.0040c207
and dword [esp + 0x20], 0
push ecx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
call fcn.004141da
test al, al
je 0x416872
lea ecx, [esp + 0x14]
call fcn.00414225
mov esi, eax
test esi, esi
jle 0x416872
cmp edi, esi
jbe 0x416872
sub edi, esi
push edi
push ebx
lea ecx, [esp + 0x1c]
call fcn.0040c295
test al, al
je 0x416872
push ecx
push esi
lea eax, [edi + ebx]
push eax
lea ecx, [esp + 0x20]
call fcn.0041426a
test al, al
je 0x416872
lea ecx, [esp + 0x14]
call fcn.004141c0
jmp 0x41687d
lea ecx, [esp + 0x14]
call fcn.004141c0
xor esi, esi
push ebp
lea eax, [esp + 0x2c]
push 0
push eax
call dword [0x9d14f0]
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret

Function at 0x417902
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0xa0c9e8
call fcn.0043c7dc
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [0x9d1158]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x417966
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x417966
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x417966
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x417966
or dword [ebp - 4], 0xffffffff
mov al, 1
jmp 0x41796c
or dword [ebp - 4], 0xffffffff
xor al, al
call fcn.0043c817
ret
Function at 0x4196ee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, edx
mov edx, dword [ecx + 0x3c]
push esi
push edi
mov edi, dword [edx + ecx + 0x78]
add edi, ecx
xor esi, esi
mov ebx, dword [edi + 0x1c]
add ebx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x2c], ebx
cmp ebp, 0xffff
jbe 0x4197b3
mov eax, dword [edi + 0x24]
add eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0x20]
add eax, ecx
mov ebx, esi
mov dword [esp + 0x20], eax
cmp dword [edi + 0x18], ebx
jbe 0x4197d5
movzx edx, byte [ebp]
mov dword [esp + 0x24], edx
mov eax, dword [eax + ebx*4]
add eax, ecx
mov dword [esp + 0x14], eax
mov al, byte [eax]
mov byte [esp + 0x13], al
movzx eax, al
sub edx, eax
jne 0x419782
mov edi, dword [esp + 0x14]
mov cl, byte [esp + 0x13]
mov esi, ebp
sub esi, edi
test cl, cl
je 0x419778
inc edi
mov cl, byte [edi]
movzx edx, byte [esi + edi]
movzx eax, cl
sub edx, eax
je 0x419766
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor esi, esi
test edx, edx
js 0x419792
xor eax, eax
inc eax
test edx, edx
cmovg edx, eax
test edx, edx
je 0x4197a2
inc ebx
cmp ebx, dword [edi + 0x18]
jae 0x4197d2
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x419744
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
movzx eax, word [eax + ebx*2]
mov eax, dword [edx + eax*4]
jmp 0x4197cb
movzx edx, bp
cmp edx, dword [edi + 0x10]
jb 0x4197ea
mov eax, dword [edi + 0x14]
add eax, dword [edi + 0x10]
cmp edx, eax
ja 0x4197ea
sub edx, dword [edi + 0x10]
mov eax, dword [ebx + edx*4]
test eax, eax
je 0x4197ea
lea esi, [eax + ecx]
mov edx, dword [ecx + 0x3c]
cmp esi, edi
jb 0x4197e6
mov ecx, dword [edx + ecx + 0x7c]
add ecx, edi
xor eax, eax
cmp esi, ecx
cmovb esi, eax
mov eax, esi
jmp 0x4197ec
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret