joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e4bf
Capabilities:
Create pipe

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1b4
mov dword [esp + 4], edx
mov edi, ecx
call sub.KERNEL32.dll_GetCurrentProcessId
xor ebx, ebx
mov ebp, eax
lea eax, [esp + 0x134]
lea esi, [esp + 8]
lea ecx, [esp + 0x14]
mov edx, str..pipezig_childprocess_d_d
inc ebx
lock xadd dword [0x430004], ebx
mov dword [esi], eax
mov dword [esi + 4], 0x80
mov dword [esp], esi
mov dword [ecx], esi
and dword [esi + 8], 0
push 0x1a
call fcn.0040f9ce
pop ecx
test ax, ax
jne 0x40e564
mov edx, esp
mov ecx, ebp
call fcn.0040a6da
test ax, ax
jne 0x40e564
lea ecx, [esp + 0x18]
mov edx, 0x42bd79
mov dword [ecx], esi
push 1
call fcn.0040f9ce
pop ecx
test ax, ax
jne 0x40e564
mov edx, esp
mov ecx, ebx
call fcn.0040a6da
test ax, ax
jne 0x40e564
lea ecx, [esp + 0x1c]
mov edx, 0x42bd7d
mov dword [ecx], esi
push 1
call fcn.0040f9ce
pop ecx
test ax, ax
je 0x40e626
lea ebp, [esp + 0x34]
lea esi, [esp + 0x20]
mov ecx, esi
mov edx, ebp
push ebx
push eax
call fcn.0040909f
pop eax
pop ecx
mov eax, dword [esi]
and word [esp + eax*2 + 0x34], 0
mov eax, 0x1000
push 0x42bce0
push 0
push eax
push eax
push 1
push 0
push 0x40000001
push ebp
call sub.KERNEL32.dll_CreateNamedPipeW
cmp eax, 0xffffffff
je 0x40e5f7
mov ebx, eax
mov eax, dword [0x42bce8]
movsd xmm0, qword [0x42bce0]
lea ecx, [esp + 0x28]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
push 0
push 0x80
push 3
push ecx
push 0
push 0x40000000
push ebp
call sub.KERNEL32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x40e5fe
mov ecx, ebx
mov esi, eax
call fcn.0040e457
test ax, ax
je 0x40e61a
mov ebp, eax
push esi
call sub.ntdll.dll_NtClose
push ebx
call sub.ntdll.dll_NtClose
jmp 0x40e60d
call sub.KERNEL32.dll_GetLastError
jmp 0x40e609
call sub.KERNEL32.dll_GetLastError
push ebx
call sub.ntdll.dll_NtClose
mov bp, 0xe
mov eax, ebp
add esp, 0x1b4
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 4]
mov dword [edi], ebx
xor ebp, ebp
mov dword [eax], esi
jmp 0x40e60d
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 8]
dec ebx
jmp 0x40e564

Function at 0x40e9e8
Capabilities:
Get process heap force flags

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
call fcn.0040f7eb
mov dword [esp], edx
mov dword [esp + 4], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
xor edx, edx
mov eax, dword [eax + 0x10]
mov ebp, dword [eax + 0x48]
movzx ecx, word [ebp + edx*2]
cmp ecx, 0x3d
je 0x40ea1e
test ecx, ecx
mov esi, edx
jne 0x40ea21
jmp 0x40ea8c
lea esi, [edx + 1]
lea eax, [ebp + edx*2]
mov dword [esp + 0xc], eax
movzx edi, word [ebp + esi*2]
test edi, edi
je 0x40ea3a
cmp edi, 0x3d
je 0x40ea3a
inc esi
jmp 0x40ea29
xor eax, eax
cmp di, 0x3d
sete al
xor ebx, ebx
add eax, esi
lea ecx, [ebp + eax*2]
mov dword [esp + 8], eax
cmp word [ecx + ebx*2], 0
lea ebx, [ebx + 1]
jne 0x40ea4f
mov eax, esi
mov ecx, dword [esp + 4]
sub eax, edx
mov edx, dword [esp]
push eax
push dword [esp + 0x10]
call fcn.0040f7ac
pop ecx
pop edx
mov edx, dword [esp + 8]
add edx, ebx
test al, 1
je 0x40ea0c
xor eax, eax
cmp di, 0x3d
sete al
dec ebx
add eax, esi
lea eax, [ebp + eax*2]
jmp 0x40ea90
xor eax, eax
xor ebx, ebx
mov edx, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f72d
Capabilities:
Create process on windows

Disassembly:
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0x8000400
push 1
push 0
push 0
push edx
push ecx
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x40f756
xor eax, eax
ret
call sub.KERNEL32.dll_GetLastError
movzx eax, ax
lea ecx, [eax - 0xbc]
cmp ecx, 0xf
jae 0x40f76e
mov ax, 0x6d
ret
lea ecx, [eax - 2]
cmp ecx, 2
jb 0x40f798
cmp eax, 5
je 0x40f79d
cmp eax, 0xb
je 0x40f769
cmp eax, 0x7b
je 0x40f7a2
cmp eax, 0xce
je 0x40f7a7
cmp eax, 0xd8
je 0x40f769
mov ax, 0xe
ret
mov ax, 8
ret
mov ax, 9
ret
mov ax, 0x70
ret
mov ax, 0xb
ret

Function at 0x40fbd2
Capabilities:
Set file attributes

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x40]
test byte [esp + 0x45], 2
mov esi, ecx
mov ecx, 0x200040
mov edi, 0x200001
cmove edi, ecx
lea ecx, [eax + eax]
mov word [esp + 8], cx
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edx
cmp word [edx], 0x2e
jne 0x40fc27
movzx ecx, word [edx + 2]
cmp ecx, 0x2e
je 0x40fc1c
test ecx, ecx
jne 0x40fc27
and word [esp + 8], 0
jmp 0x40fc27
cmp word [edx + 4], 0
je 0x40fd1c
lea ebx, [esp + 0x18]
mov ecx, edx
mov edx, eax
mov dword [ebx], 0x18
call fcn.0040ac1d
xor ecx, ecx
test al, 1
lea eax, [esp + 8]
cmovne esi, ecx
mov dword [ebx + 4], esi
and dword [ebx + 0xc], 0
mov dword [ebx + 8], eax
and dword [ebx + 0x10], 0
and dword [ebx + 0x14], 0
lea esi, [esp + 0x10]
mov eax, esp
push 0
push 0
push edi
push 1
push 7
push 0
push 0
push esi
push ebx
push 0x110000
push eax
call sub.ntdll.dll_NtCreateFile
cmp eax, 0xc0000022
je 0x40fd36
mov ecx, eax
mov ax, 8
cmp ecx, 0xc0000034
je 0x40fd56
cmp ecx, 0xc000003a
je 0x40fd56
cmp ecx, 0xc0000043
je 0x40fd1c
cmp ecx, 0xc0000056
je 0x40fd12
cmp ecx, 0xc00000ba
je 0x40fd28
cmp ecx, 0xc00000be
je 0x40fd16
cmp ecx, 0xc00000cc
je 0x40fd16
cmp ecx, 0xc0000103
je 0x40fd22
test ecx, ecx
jne 0x40fd52
lea eax, [esp + 4]
mov byte [eax], 1
push 0xd
push 1
push eax
push esi
push dword [esp + 0x10]
call sub.ntdll.dll_NtSetInformationFile
cmp eax, 0xc0000022
je 0x40fd2e
cmp eax, 0xc00000a2
je 0x40fd2e
cmp eax, 0xc0000101
je 0x40fd3c
cmp eax, 0xc0000121
je 0x40fd2e
test eax, eax
jne 0x40fd4a
push dword [esp]
call sub.ntdll.dll_NtClose
xor eax, eax
jmp 0x40fd56
mov ax, 0xf
jmp 0x40fd56
mov ax, 0x1c
jmp 0x40fd56
mov ax, 0x19
jmp 0x40fd56
mov ax, 0x17
jmp 0x40fd56
push dword [esp]
call sub.ntdll.dll_NtClose
mov ax, 9
jmp 0x40fd56
push dword [esp]
call sub.ntdll.dll_NtClose
mov ax, 0x6c
jmp 0x40fd56
push dword [esp]
call sub.ntdll.dll_NtClose
mov ax, 0xe
add esp, 0x30
pop esi
pop edi
pop ebx
ret

Function at 0x40fd5d
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov ebp, edx
cmp ebx, esi
jae 0x40fd80
push ebp
push edi
call sub.ADVAPI32.dll_SystemFunction036
test eax, eax
je 0x40fd84
add ebx, ebp
add edi, ebp
xor ebp, ebp
jmp 0x40fd69
xor eax, eax
jmp 0x40fd8d
call sub.KERNEL32.dll_GetLastError
mov ax, 0xe
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4111af
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [ecx]
add esi, 0x3f
xor eax, eax
cmp esi, 0x40
jb 0x4111fd
mov dword [esp], edx
mov edx, dword [esp + 0x18]
shr esi, 5
neg edx
xor ebx, ebx
inc ebx
xor ebp, ebp
mov edi, dword [ecx + ebx*4]
add ebp, edi
mov eax, ebp
mov ebp, dword [esp]
sub eax, dword [ebp + ebx*4]
mov ebp, eax
and ebp, 0x7fffffff
xor ebp, edi
and ebp, edx
xor ebp, edi
mov dword [ecx + ebx*4], ebp
mov ebp, eax
sar ebp, 0x1f
inc ebx
cmp esi, ebx
jne 0x4111d1
shr eax, 0x1f
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41135b
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, ecx
xor eax, eax
cmp ecx, dword [esp + 0x24]
cmove edi, eax
mov ebx, 0x20
xor ecx, ecx
inc ecx
mov dword [esp], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], edi
mov ecx, dword [esp]
shl edi, cl
mov ebp, edx
mov dword [esp + 8], edx
dec ebx
mov ecx, ebx
shr ebp, cl
or ebp, edi
mov edi, ebp
mov eax, dword [esp + 0x24]
sub edi, eax
xor ebp, eax
mov esi, edi
xor esi, eax
and esi, ebp
xor esi, edi
mov ebp, dword [esp + 4]
shr ebp, cl
not esi
shr esi, 0x1f
or ebp, esi
mov ecx, dword [esp]
shr edi, cl
mov ecx, ebx
shl eax, cl
sub edx, eax
mov eax, dword [esp + 0xc]
mov ecx, ebp
neg ecx
mov esi, dword [esp + 4]
xor edi, esi
and edi, ecx
xor edi, esi
mov esi, dword [esp + 8]
xor edx, esi
and edx, ecx
mov ecx, ebx
shl ebp, cl
mov ecx, dword [esp]
xor edx, esi
or eax, ebp
inc ecx
cmp ebx, 1
ja 0x411375
mov esi, edx
mov ebx, dword [esp + 0x24]
sub esi, ebx
mov ecx, edx
xor ecx, ebx
xor ebx, esi
and ebx, ecx
xor ebx, esi
not ebx
shr ebx, 0x1f
or edi, ebx
or eax, edi
neg edi
xor esi, edx
and esi, edi
xor esi, edx
mov ecx, dword [esp + 0x28]
mov dword [ecx], esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41153f
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov dword [esp], edx
mov esi, dword [ecx]
add esi, 0x3f
xor eax, eax
cmp esi, 0x40
jb 0x411587
mov edx, dword [esp + 0x18]
shr esi, 5
neg edx
xor ebx, ebx
inc ebx
xor ebp, ebp
mov edi, dword [ecx + ebx*4]
add ebp, edi
mov eax, dword [esp]
add ebp, dword [eax + ebx*4]
mov eax, ebp
and ebp, 0x7fffffff
xor ebp, edi
and ebp, edx
xor ebp, edi
shr eax, 0x1f
mov dword [ecx + ebx*4], ebp
inc ebx
cmp esi, ebx
mov ebp, eax
jne 0x411561
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4119f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10c
mov dword [esp + 8], edx
mov esi, ecx
mov edi, dword [esp + 0x124]
mov bl, byte [esp + 0x128]
mov eax, dword [ecx]
mov dword [esp + 4], eax
mov eax, dword [eax + 4]
mov dword [esp], eax
lea ebp, [esp + 0xc]
push edi
push dword [esp + 0x124]
push ebp
call fcn.0040307b
add esp, 0xc
test edi, edi
je 0x411a44
mov eax, edi
xor byte [ebp], bl
inc ebp
dec eax
jne 0x411a3d
mov ecx, dword [esp]
shr ecx, 0x17
and cl, 0xf
xor ebp, ebp
inc ebp
shl ebp, cl
lea eax, [esp + edi + 0xc]
mov ecx, ebp
sub ecx, edi
movzx edx, bl
push ecx
push edx
push eax
call fcn.00403060
add esp, 0xc
push esi
mov eax, dword [esp + 8]
call dword [eax + 8]
add esp, 4
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ebp
push ecx
push esi
call dword [eax + 0xc]
add esp, 0xc
mov eax, dword [esi]
push dword [esp + 8]
push esi
call dword [eax + 0x14]
add esp, 0x114
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41201d
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x484
mov dword [esp + 4], edx
mov ebp, ecx
mov esi, 0xe4
lea ebx, [esp + 0x3a0]
push esi
push ecx
push ebx
call fcn.0040307b
add esp, 0xc
mov ecx, ebx
mov edx, ebx
push 0x42c132
push dword [esp + 0x4a0]
call fcn.0041224a
add esp, 8
lea edi, [esp + 0x2bc]
push esi
mov dword [esp + 4], ebp
push ebp
push edi
call fcn.0040307b
add esp, 0xc
mov ecx, edi
mov edx, ebx
push str.U8_b6X9
mov ebx, dword [esp + 0x4a0]
push ebx
call fcn.0041224a
add esp, 8
lea edi, [esp + 0x14]
push 0xe0
push 0
push edi
call fcn.00403060
add esp, 0xc
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [edi + 0x94], eax
mov dword [edi + 0x48], eax
mov dword [edi - 4], eax
mov eax, dword [esp + 0x498]
mov dword [esp + 8], eax
cmp dword [esp + 0x498], 0
je 0x41222c
xor edi, edi
inc edi
mov ebx, 6
mov dword [esp + 0xc], edi
lea ebp, [esp + 0x10]
mov ecx, ebp
mov edx, ebp
mov eax, 0x42c132
push eax
mov edi, dword [esp + 0x4a0]
push edi
call fcn.0041224a
add esp, 8
mov ecx, ebp
mov edx, ebp
mov eax, 0x42c132
push eax
push edi
call fcn.0041224a
add esp, 8
push esi
push dword [esp + 4]
lea eax, [esp + 0xfc]
push eax
call fcn.0040307b
add esp, 0xc
push esi
push ebp
lea eax, [esp + 0x1e0]
push eax
call fcn.0040307b
add esp, 0xc
mov eax, dword [esp + 4]
movzx eax, byte [eax]
mov ebp, ebx
mov ecx, ebx
shr eax, cl
and eax, 3
mov ecx, 0xffffff1c
lea edx, [esp + ecx + 0xf4]
lea ebx, [edx + esi]
lea edi, [esp + ecx + 0x3a0]
add edi, esi
cmp eax, 2
cmovne edi, ebx
mov bl, byte [edi]
mov byte [edx + 0xe4], bl
inc ecx
jne 0x412141
mov ecx, 0xffffff1c
lea edx, [esp + ecx + 0xf4]
lea edi, [edx + esi]
lea ebx, [esp + ecx + 0x2bc]
add ebx, esi
cmp eax, 3
cmovne ebx, edi
mov bl, byte [ebx]
mov byte [edx + 0xe4], bl
inc ecx
jne 0x41216a
xor ebx, ebx
test eax, eax
setne bl
lea ecx, [esp + 0x1d8]
lea edx, [esp + 0xf4]
push str.U8_b6X9
push dword [esp + 0x4a0]
call fcn.0041224a
add esp, 8
mov edi, dword [esp + 0xc]
mov eax, edi
and eax, ebx
neg al
mov ecx, 0xffffff1c
mov dl, byte [esp + ecx + 0xf4]
mov dh, byte [esp + ecx + 0x1d8]
xor dh, dl
and dh, al
xor dh, dl
mov byte [esp + ecx + 0xf4], dh
inc ecx
jne 0x4121c6
mov eax, edi
not eax
and eax, ebx
neg al
mov ecx, 0xffffff1c
mov dl, byte [esp + ecx + 0xf4]
mov dh, byte [esp + ecx + 0x2bc]
xor dh, dl
and dh, al
xor dh, dl
mov byte [esp + ecx + 0xf4], dh
inc ecx
jne 0x4121f1
not ebx
and edi, ebx
test ebp, ebp
lea ebx, [ebp - 2]
jne 0x4120d0
inc dword [esp + 4]
dec dword [esp + 8]
jne 0x4120cb
lea eax, [esp + 0x10]
push 0xe4
push eax
push dword [esp + 8]
call fcn.0040307b
add esp, 0x490
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4143a7
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x22c
mov dword [esp + 4], edx
mov ebp, ecx
lea ebx, [esp + 0x1c0]
mov ecx, 0x1b
mov edi, ebx
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.00414afc
lea eax, [esp + 0x154]
mov ecx, 0x1b
mov edi, eax
mov dword [esp], ebp
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov edx, ebx
call fcn.004148da
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x50], xmm0
movups xmmword [esp + 0x60], xmm0
xor eax, eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x240]
mov dword [esp + 8], eax
cmp dword [esp + 0x240], 0
je 0x414544
xor esi, esi
inc esi
lea edi, [esp + 0x7c]
mov ebx, 6
mov dword [esp + 0xc], esi
lea ebp, [esp + 0x10]
mov ecx, ebp
call fcn.00414afc
mov ecx, ebp
call fcn.00414afc
mov ecx, 0x1b
mov esi, dword [esp]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x1b
lea edi, [esp + 0xe8]
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 4]
movzx eax, byte [eax]
mov ebp, ebx
mov ecx, ebx
shr eax, cl
and eax, 3
mov ecx, 0xffffff94
cmp eax, 2
lea edx, [esp + ecx + 0xe8]
lea esi, [esp + ecx + 0x22c]
cmovne esi, edx
mov bl, byte [esi]
mov byte [edx], bl
inc ecx
jne 0x414487
mov ecx, 0xffffff94
cmp eax, 3
lea edx, [esp + ecx + 0xe8]
lea esi, [esp + ecx + 0x1c0]
cmovne esi, edx
mov bl, byte [esi]
mov byte [edx], bl
inc ecx
jne 0x4144a7
xor ebx, ebx
test eax, eax
setne bl
lea ecx, [esp + 0xe8]
lea edi, [esp + 0x7c]
mov edx, edi
call fcn.004148da
mov esi, dword [esp + 0xc]
mov eax, esi
and eax, ebx
neg al
mov ecx, 0xffffff94
mov dl, byte [esp + ecx + 0x7c]
mov dh, byte [esp + ecx + 0xe8]
xor dh, dl
and dh, al
xor dh, dl
mov byte [esp + ecx + 0x7c], dh
inc ecx
jne 0x4144ea
mov eax, esi
not eax
and eax, ebx
neg al
mov ecx, 0xffffff94
mov dl, byte [esp + ecx + 0x7c]
mov dh, byte [esp + ecx + 0x154]
xor dh, dl
and dh, al
xor dh, dl
mov byte [esp + ecx + 0x7c], dh
inc ecx
jne 0x41450f
not ebx
and esi, ebx
test ebp, ebp
lea ebx, [ebp - 2]
jne 0x414442
inc dword [esp + 4]
dec dword [esp + 8]
jne 0x41443d
lea esi, [esp + 0x10]
mov ecx, 0x1b
mov edi, dword [esp]
rep movsd dword es:[edi], dword [esi]
add esp, 0x22c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x419752
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, ecx
mov ecx, dword [ecx + 8]
mov ebx, dword [edi + 0xc]
mov eax, ecx
add eax, 1
mov dword [edi + 8], eax
mov eax, ebx
adc eax, 0
mov dword [edi + 0xc], eax
mov eax, ebx
shr eax, 0x18
mov byte [esp + 3], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 4], al
mov byte [esp + 5], bh
mov byte [esp + 6], bl
mov eax, ecx
shr eax, 0x18
mov byte [esp + 7], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 8], al
mov byte [esp + 9], ch
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], dl
mov eax, dword [esp + 0x30]
mov byte [esp + 0xc], ah
mov byte [esp + 0xd], al
mov eax, dword [esp + 0x38]
mov byte [esp + 0xe], ah
mov byte [esp + 0xf], al
movsd xmm0, qword [edi + 0x30]
movsd qword [esp + 0x10], xmm0
mov eax, dword [edi + 0x38]
mov dword [esp + 0x18], eax
mov ebp, dword [esp + 0x34]
mov esi, 8
xor byte [esp + esi + 0x13], cl
shrd ecx, ebx, 8
shr ebx, 8
dec esi
jne 0x4197dc
lea eax, [edi + 0x10]
lea edx, [esp + 3]
lea esi, [esp + 0x10]
push dword [esp + 0x40]
push dword [edi + 0x3c]
push dword [esp + 0x44]
push 0xd
push edx
push dword [esp + 0x4c]
push ebp
push esi
push eax
call dword [edi + 0x40]
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41b528
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp], ecx
mov eax, dword [edx]
bswap eax
lea edi, [esp + 0x14]
mov dword [edi], eax
mov eax, dword [edx + 4]
bswap eax
lea ebx, [esp + 0x10]
mov dword [ebx], eax
mov ecx, edi
mov edx, ebx
call fcn.0041b317
mov eax, dword [ebx]
mov ebp, eax
mov ecx, eax
shr ecx, 4
mov esi, 0xff00000
and esi, ecx
mov edx, dword [edi]
mov ebx, edx
shr ebx, 0xc
shr ebp, 0xc
mov edi, 0xff0
and ebp, edi
or ebp, esi
mov esi, 0xff000
and ebx, esi
or ebp, ebx
mov ebx, edx
shr ebx, 0x14
and ebx, 0xf
or ebx, ebp
mov ebp, edx
shl ebp, 4
and ebp, esi
and ecx, edi
movzx eax, al
shl eax, 0x14
or ecx, eax
or ecx, ebp
shr edx, 0x10
and edx, 0xf
or edx, ecx
xor esi, esi
mov eax, 0x8103
bt eax, esi
setae al
mov ah, al
inc ah
mov ebp, ebx
mov cl, ah
shl ebp, cl
xor al, 0x1b
mov ecx, eax
shr ebx, cl
mov edi, edx
mov cl, ah
shl edi, cl
mov ecx, eax
shr edx, cl
mov eax, 0xffffffe
and ebp, eax
or ebx, ebp
and edi, eax
or edx, edi
mov eax, dword [esp]
mov dword [eax + esi*8], ebx
mov dword [eax + esi*8 + 4], edx
inc esi
cmp esi, 0x10
jne 0x41b5a3
xor eax, eax
mov ecx, dword [esp]
lea edx, [eax + eax]
mov esi, dword [ecx + eax*8]
mov dword [esp + 0xc], eax
lea eax, [eax + eax + 1]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov ebp, dword [ecx + edx*4 + 4]
mov edi, 0xfffffff0
xor edx, edx
xor eax, eax
add eax, eax
mov cl, byte [edi + 0x42d878]
mov ebx, esi
shr ebx, cl
add edx, edx
and ebx, 1
shl ebx, 0x10
or ebx, eax
movzx ecx, byte [edi + 0x42d888]
xor eax, eax
bt ebp, ecx
setb al
or eax, ebx
mov cl, byte [edi + 0x42d898]
mov ebx, esi
shr ebx, cl
and ebx, 1
shl ebx, 0x10
or ebx, edx
movzx ecx, byte [edi + 0x42d8a8]
xor edx, edx
bt ebp, ecx
setb dl
or edx, ebx
inc edi
jne 0x41b60d
mov ecx, dword [esp]
mov esi, dword [esp + 8]
mov dword [ecx + esi*4], eax
mov eax, dword [esp + 4]
mov dword [ecx + eax*4], edx
mov eax, dword [esp + 0xc]
inc eax
cmp eax, 0x10
jne 0x41b5ea
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41d9f8
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov esi, ecx
mov edi, esp
mov ecx, edi
push dword [ebp + 8]
call fcn.0041d181
add esp, 4
mov ecx, eax
shl ecx, 4
movdqa xmm0, xmmword [esp + ecx]
movdqu xmmword [esi], xmm0
cmp eax, 2
jb 0x41da47
mov edx, eax
dec edx
lea edi, [ecx + edi - 0x10]
lea ebx, [esi + 0x10]
aesimc xmm0, xmmword [edi]
movdqu xmmword [ebx], xmm0
add edi, 0xfffffff0
add ebx, 0x10
dec edx
jne 0x41da35
movaps xmm0, xmmword [esp]
movups xmmword [esi + ecx], xmm0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41f77b
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov ebp, dword [ecx + 0x44]
test ebp, ebp
mov dword [esp], edx
je 0x41f80d
mov edi, 0x10
sub edi, ebp
cmp edi, eax
cmovae edi, eax
test edx, edx
je 0x41f7c5
test edi, edi
je 0x41f7e0
lea ecx, [ebp + esi + 0x34]
xor edx, edx
mov al, byte [ebx + edx]
mov ah, byte [ecx + edx]
xor ah, al
mov byte [ecx + edx], al
mov byte [ebx + edx], ah
inc edx
cmp edi, edx
jne 0x41f7b0
jmp 0x41f7e0
test edi, edi
je 0x41f7e0
lea ecx, [ebp + esi + 0x34]
xor edx, edx
mov al, byte [ebx + edx]
xor al, byte [ecx + edx]
mov byte [ebx + edx], al
mov byte [ecx + edx], al
inc edx
cmp edi, edx
jne 0x41f7cf
add ebp, edi
cmp ebp, 0x10
jb 0x41f8a3
mov ebp, dword [esp + 0x28]
sub ebp, edi
add ebx, edi
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [esi + 0x14]
lea edi, [esi + 0x34]
push 0x10
push edi
push edx
push eax
call dword [ecx + 0x1c]
mov eax, ebp
add esp, 0x10
mov edx, dword [esp]
mov dword [esp + 0xc], eax
mov edi, eax
and edi, 0xfffffff0
xor eax, eax
test edx, edx
setne al
mov edx, dword [esi]
mov ecx, dword [edx]
mov dword [esp + 8], ecx
lea ecx, [esi + 4]
lea ebp, [esi + 0x14]
push edi
push ebx
push ebp
mov dword [esp + 0x10], ecx
push ecx
push edx
mov ecx, dword [esp + 0x1c]
call dword [ecx + eax*4 + 0x10]
add esp, 0x14
mov ebp, dword [esp + 0xc]
and ebp, 0xf
je 0x41f88a
add ebx, edi
lea eax, [esi + 0x34]
xor edi, edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov ecx, dword [esi]
mov edx, dword [ecx]
push 0x10
push eax
push dword [esp + 0xc]
push ecx
call dword [edx + 0x18]
add esp, 0x10
cmp dword [esp], 0
je 0x41f88e
mov al, byte [ebx + edi]
mov cl, byte [esi + edi + 0x34]
xor cl, al
mov byte [esi + edi + 0x34], al
mov byte [ebx + edi], cl
inc edi
cmp ebp, edi
jne 0x41f873
jmp 0x41f8a3
xor ebp, ebp
jmp 0x41f8a3
xor eax, eax
mov cl, byte [ebx + eax]
xor cl, byte [esi + eax + 0x34]
mov byte [ebx + eax], cl
mov byte [esi + eax + 0x34], cl
inc eax
cmp ebp, eax
jne 0x41f890
mov dword [esi + 0x44], ebp
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41f8ae
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
mov eax, dword [ecx + 0x44]
test eax, eax
je 0x41f8e8
lea ebx, [esi + 0x34]
lea ecx, [esi + eax + 0x34]
mov edx, 0x10
sub edx, eax
push edx
push 0
push ecx
call fcn.00403060
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [esi + 0x14]
push 0x10
push ebx
push edx
push eax
call dword [ecx + 0x1c]
add esp, 0x10
cmp dword [esi + 0x48], 0
je 0x41f902
xor eax, eax
mov cl, byte [esi + eax + 0x24]
xor byte [esi + eax + 0x14], cl
inc eax
mov ecx, dword [esi + 0x48]
cmp eax, ecx
jb 0x41f8f0
jmp 0x41f904
xor ecx, ecx
lea eax, [esi + 0x14]
push ecx
push eax
push edi
call fcn.0040307b
add esp, 0xc
mov eax, dword [esi + 0x48]
pop esi
pop edi
pop ebx
ret
Function at 0x407292
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x424210]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], eax
push ecx
mov esi, 0x104
mov dword [eax], edi
mov edx, esi
mov dword [eax + 4], edi
lea ecx, [esp + 0x1c]
call fcn.00406454
push 0x401adc
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.00406489
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x407318
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x407352
mov ecx, dword [ebp + 4]
mov edx, 0xc9
push 0x401aa0
call fcn.00406fad
mov edi, eax
jmp 0x407352
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.00407175
mov ebx, eax
test ebx, ebx
jns 0x407344
mov ecx, dword [ebp + 4]
mov edx, 0xcf
push ebx
push 0x401aa0
call fcn.00406f90
mov edi, ebx
jmp 0x407352
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x40735c
push esi
call fcn.00407000
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00421870
mov esp, ebp
pop ebp
ret 8