joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40100d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
xor eax, eax
mov dword [ebp - 0x10], 0x2e80b153
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], ecx
rdtsc
mov esi, edx
mov edi, eax
rdtsc
mov ebx, edx
mov ecx, eax
mov eax, 0x2e80b153
mov edx, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
add eax, 1
sub ecx, edi
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
cmp edi, eax
mov eax, dword [ebp - 0x2c]
cmove eax, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
cmp edi, eax
mov eax, dword [ebp - 0x34]
cmove eax, ecx
cmp eax, ecx
cmova eax, ecx
mov edi, dword [ebp - 0x40]
cmp edi, ecx
cmovb edi, ecx
add edx, 0xd17f4f11
mov ecx, dword [ebp - 0x3c]
cmp ecx, edx
mov edx, eax
mov dword [ebp - 0x44], eax
mov eax, edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
jne 0x401028
mov eax, 0x2e80b153
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x44]
cmp edx, 0x53
sete bl
mov si, word [ebp - 0x12]
add si, word [ebp - 0x12]
mov edi, dword [ebp - 0x48]
cmp edi, edx
sete bh
mov word [ebp - 0x12], si
sub eax, ecx
cmp edx, 3
sete cl
cmp edx, eax
sete ch
cmp edx, 6
sete al
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
or bl, cl
mov edx, dword [ebp - 0x18]
imul edx, dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
or ch, bl
or al, ch
and bh, al
and bh, 1
movzx eax, bh
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x11438d74
Capabilities:
Encode data using xor

Disassembly:
jmp 0x11438d7e
pushal
call 0x11438d84
pop ebp
sub ebp, 0x10
sub ebp, 0x1438d74
jmp 0x11438d9a
mov eax, 0x1438d74
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b9
mov edx, 0x52256912
xor byte [eax], dl
inc eax
dec ecx
jne 0x11438db1
jmp 0x11438dc4
cdq
fistp word [ecx + 0x12122e9b]
adc dl, byte [ebx + 0x1212ead3]
adc dl, byte [ecx]
fild qword [edx + 0x12121218]
test al, 0x3a
adc dl, byte [edx]
adc ah, ch
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x639488
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405500
xor eax, eax
push ebp
push 0x639597
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x63956d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41e024]
call fcn.004040f0
mov dword [ebp - 8], eax
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005eda58
mov eax, dword [ebp - 0xc]
call fcn.00405318
mov esi, eax
test esi, esi
jle 0x639510
mov ebx, 1
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
mov ecx, 0x6395ac
xor dl, byte [ecx + ebx - 1]
call 0x405214
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00405320
inc ebx
dec esi
jne 0x6394e9
mov dl, 0x26
mov eax, dword [ebp - 8]
call 0x422eb4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call 0x422d24
mov eax, dword [0x67aa2c]
mov edx, 0x6395f4
call fcn.00405088
mov ecx, dword [0x67aa2c]
mov ecx, dword [ecx]
lea eax, [ebp - 0x18]
mov edx, 0x639600
call fcn.00405364
mov eax, dword [ebp - 0x18]
call fcn.00663a28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x639574
cmp dword [ebp - 8], 0
je 0x63956c
lea eax, [ebp - 8]
call fcn.0041033c
ret
Function at 0x654c3c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x654cfb
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x654cb5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 0x68]
call fcn.0040aa78
mov dl, 1
mov eax, dword [0x589f6c]
call fcn.0058acc8
mov esi, eax
mov dword [ebx + 0x78], esi
mov byte [esi + 0xc], 1
lea eax, [esi + 4]
mov edx, dword [ebx + 0x6c]
call fcn.00405088
mov eax, dword [ebx + 0x78]
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x28], 0x654ac4
mov dword [eax + 0x34], ebx
mov dword [eax + 0x30], 0x654d30
or ecx, 0xffffffff
xor edx, edx
call fcn.0058adf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x654ce5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x654d02
lea eax, [ebp - 4]
call fcn.00405034
ret
Function at 0x8e4c30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x224000]
mov dword [edi + 0x27a710], 0x959e4be7
push edi
or ebp, 0xffffffff
jmp 0x8e4c5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8e4c61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8e4c50
mov eax, 1
add ebx, ebx
jne 0x8e4c73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8e4c84
jne 0x8e4ca3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8e4ca3
dec eax
add ebx, ebx
jne 0x8e4c90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8e4c68
add ebx, ebx
jne 0x8e4c9f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x8e4cf5
xor ecx, ecx
sub eax, 3
jb 0x8e4cbb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8e4d2a
sar eax, 1
mov ebp, eax
jmp 0x8e4cc6
add ebx, ebx
jne 0x8e4cc6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8e4c94
inc ecx
add ebx, ebx
jne 0x8e4cd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8e4c94
add ebx, ebx
jne 0x8e4ce1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x8e4cd6
jne 0x8e4cf2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8e4cd6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x8e4d14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8e4d06
jmp 0x8e4c56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x8e4d14
add edi, ecx
jmp 0x8e4c56
pop esi
mov edi, esi
mov ecx, 0x127b1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8e4d32
cmp byte [edi], 0x26
jne 0x8e4d32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8e4d37
lea edi, [esi + 0x4be000]
mov eax, dword [edi]
or eax, eax
je 0x8e4da6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4fb2f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4fb444]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8e4d64
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4fb448]
or eax, eax
je 0x8e4da0
mov dword [ebx], eax
add ebx, 4
jmp 0x8e4d81
call dword [esi + 0x4fb458]
mov ebp, dword [esi + 0x4fb44c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8e4dda
sub esp, 0xffffff80
jmp fcn.00664b14
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6a05529f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x699757ed
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401e60
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x401ec3
test edx, edx
je 0x401ec3
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
mov esi, 0x1505
je 0x401ead
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + eax]
test ecx, ecx
je 0x401ead
mov ebx, esi
shl ebx, 5
mov edi, ebx
and edi, esi
xor ebx, esi
add ebx, ecx
lea esi, [ebx + edi*2]
inc eax
cmp ebp, eax
jne 0x401e90
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jae 0x401ecb
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x401ee4
inc ebx
dec ebp
je 0x401ec1
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x401ec1
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x401ee0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0041e620
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x401ee0
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.0041e640
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x401ee0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x401ec3
Function at 0x402cc0
Capabilities:
Compute adler32 checksum
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x402e76
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0x402e6f
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0x402d58
add ebp, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov eax, edi
mov esi, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov eax, ecx
mul esi
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov edx, dword [esp + 4]
mov eax, edx
xor eax, ebx
not edx
and edx, ebx
add edx, edx
mov ebx, edx
mov esi, 0x15b0
sub ebx, eax
je 0x402e6f
xor edx, edx
cmp esi, 8
mov dword [esp + 4], esi
jb 0x402dcd
and esi, 0x1ff8
mov dword [esp], esi
xor edx, edx
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 6]
add edx, esi
mov esi, dword [esp + 4]
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, esi
jb 0x402d70
add ebp, edx
mov edx, dword [esp]
mov eax, esi
sub eax, edx
jbe 0x402d18
mov dword [esp], edx
not edx
add edx, esi
mov dword [esp + 8], edx
and esi, 3
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
je 0x402e23
neg esi
xor edx, edx
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0x402e00
mov eax, dword [esp]
sub eax, edx
mov edx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x402d10
jmp 0x402e35
mov ebx, ebp
mov eax, dword [esp + 8]
mov edx, dword [esp]
cmp eax, 3
jb 0x402d10
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x402e40
jmp 0x402d10
shl ecx, 0x10
or ecx, edi
jmp 0x402e7b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41e360
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov esi, ecx
not esi
or esi, 3
add esi, ecx
inc esi
je 0x41e390
cmp esi, 2
jne 0x41e3a0
shr ecx, 1
mov edi, eax
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
jmp 0x41e43d
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
jmp 0x41e43d
test ecx, ecx
je 0x41e43d
mov edi, ecx
and edi, 7
je 0x41e3db
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
mov byte [eax + esi], bl
inc esi
cmp edi, esi
jne 0x41e3c0
mov edi, ecx
sub edi, esi
add edx, esi
add esi, eax
cmp ecx, 8
jae 0x41e3e4
jmp 0x41e43d
mov edi, ecx
mov esi, eax
cmp ecx, 8
jb 0x41e43d
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + ecx]
mov byte [esi + ecx], bl
movzx ebx, byte [edx + ecx + 1]
mov byte [esi + ecx + 1], bl
movzx ebx, byte [edx + ecx + 2]
mov byte [esi + ecx + 2], bl
movzx ebx, byte [edx + ecx + 3]
mov byte [esi + ecx + 3], bl
movzx ebx, byte [edx + ecx + 4]
mov byte [esi + ecx + 4], bl
movzx ebx, byte [edx + ecx + 5]
mov byte [esi + ecx + 5], bl
movzx ebx, byte [edx + ecx + 6]
mov byte [esi + ecx + 6], bl
movzx ebx, byte [edx + ecx + 7]
mov byte [esi + ecx + 7], bl
add ecx, 8
cmp edi, ecx
jne 0x41e3f0
pop esi
pop edi
pop ebx
ret
Function at 0x41ec50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x41ed7a
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x41ec8d
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x41ecb1
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x41ec80
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x41ec80
lea esi, [ebx + 1]
push esi
call fcn.0045cfc0
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x41ed88
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x41ecf8
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x41ed8a
movzx edx, word [edi]
test dx, dx
je 0x41ed8a
cmp dx, 0x7f
jbe 0x41ece0
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp esi, 0x7ff
ja 0x41ed40
xor esi, esi
cmp ecx, 2
jb 0x41ece7
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x41ece7
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x41ece7
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x41ece7
push 1
call fcn.0045cfc0
add esp, 4
mov ebp, eax
jmp 0x41ed8a
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x41eda7
mov eax, ebx
mov byte [esp + ecx + 0xc], al
inc ecx
movzx ebx, byte [ebp + ecx]
mov al, 0x2f
cmp ebx, 0x5c
je 0x41eda2
test ebx, ebx
jne 0x41eda0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00413760
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x423980
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov esi, 0xffffffff
cmp byte [edi + esi + 1], 0
lea esi, [esi + 1]
jne 0x423990
mov eax, esi
and eax, 0xfffffffc
mov dword [esp], esi
mov ecx, dword [esp]
and ecx, 3
mov edx, dword [esp]
or edx, 3
imul edx, ecx
xor ecx, 3
imul ecx, eax
add edx, ecx
mov ecx, dword [esp]
shr edx, 2
cmp byte [edi + ecx - 1], 0x3d
je 0x4239dd
mov eax, ecx
or eax, 0xfffffffe
mov ecx, dword [esp]
and ecx, 0xfffffffe
add ecx, eax
cmp byte [edi + ecx + 1], 0x2e
mov ecx, dword [esp]
jne 0x4239de
dec edx
movzx eax, byte [edi + ecx - 2]
cmp eax, 0x3d
je 0x4239ed
cmp eax, 0x2e
jne 0x4239ee
dec edx
mov dword [esp + 8], edx
mov edx, 0
test ecx, ecx
je 0x423ae7
xor esi, esi
mov ebp, 2
jmp 0x423a22
lea eax, [ebp + 4]
add ebp, 2
mov esi, edx
cmp ebp, ecx
mov ebp, eax
jae 0x423ae7
mov edi, dword [esp + 0x40]
movzx eax, byte [edi + ebp - 2]
push eax
call fcn.0042b1c0
add esp, 4
mov ebx, eax
movzx eax, byte [edi + ebp - 1]
push eax
call fcn.0042b1c0
add esp, 4
mov bh, al
shl bl, 2
shr al, 4
and al, 3
or al, bl
lea edx, [esi + 1]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi], al
mov ecx, dword [esp]
cmp ebp, ecx
jae 0x423a10
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 8], edx
call fcn.0042b1c0
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
add esp, 4
cmp al, 0x40
je 0x423a10
mov bl, al
shl bh, 4
shr al, 2
and al, 0xf
or al, bh
lea edx, [esi + 2]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi + 1], al
mov ecx, dword [esp]
lea eax, [ebp + 1]
cmp eax, ecx
jae 0x423a10
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp + 1]
push eax
mov dword [esp + 8], edx
call fcn.0042b1c0
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
add esp, 4
cmp al, 0x40
je 0x423a10
shl bl, 6
add al, bl
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi + 2], al
mov ecx, dword [esp]
add esi, 3
mov edx, esi
jmp 0x423a10
mov ebx, dword [esp + 8]
cmp edx, ebx
mov eax, 0
jne 0x423b65
lea edi, [esp + 0xc]
mov esi, dword [esp + 0x44]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, ebx
add eax, 0xffffffe0
je 0x423b61
xor edi, edi
cmp ebx, 0x21
je 0x423b4b
mov ecx, eax
and ecx, 0xfffffffe
xor edi, edi
nop
nop
nop
nop
mov edx, edi
and edx, 0x1e
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + edi + 0x20]
mov byte [esi + edi], dl
lea edx, [edi + 1]
and edx, 0x1f
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + edi + 0x21]
mov byte [esi + edi + 1], dl
add edi, 2
cmp ecx, edi
jne 0x423b20
test bl, 1
je 0x423b61
mov ecx, edi
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0xc]
xor cl, byte [esi + edi + 0x20]
mov byte [esi + edi], cl
mov byte [esi + eax], 0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x461600
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x483224]
test eax, eax
jne 0x461722
movzx eax, byte [0x47dea0]
xor al, 0x21
mov byte [0x47dec0], al
movzx eax, byte [0x47dea1]
xor al, 0xad
mov byte [0x47dec1], al
movzx eax, byte [0x47dea2]
mov ecx, eax
not cl
or al, 0xa8
or cl, 0x57
and cl, al
not cl
mov byte [0x47dec2], cl
movzx eax, byte [0x47dea3]
xor al, 0x8f
mov byte [0x47dec3], al
movzx eax, byte [0x47dea4]
xor al, 0xfe
mov byte [0x47dec4], al
movzx eax, byte [0x47dea5]
xor al, 0x1a
mov byte [0x47dec5], al
movzx eax, byte [0x47dea6]
mov ecx, eax
add cl, al
and cl, 0x82
sub al, cl
add al, 0x41
mov byte [0x47dec6], al
movzx eax, byte [0x47dea7]
mov ecx, eax
add cl, al
and cl, 0x5c
sub al, cl
add al, 0x2e
mov byte [0x47dec7], al
movzx eax, byte [0x47dea8]
xor al, 0xeb
mov byte [0x47dec8], al
movzx eax, byte [0x47dea9]
xor al, 0x15
mov byte [0x47dec9], al
movzx eax, byte [0x47deaa]
xor al, 0x93
mov byte [0x47deca], al
movzx eax, byte [0x47deab]
xor al, 0x58
mov byte [0x47decb], al
movzx eax, byte [0x47deac]
xor al, 0x8d
mov byte [0x47decc], al
movzx eax, byte [0x47dead]
xor al, 0x19
mov byte [0x47decd], al
movzx eax, byte [0x47deae]
xor al, 0x6f
mov byte [0x47dece], al
movzx eax, byte [0x47deaf]
xor al, 0x36
mov byte [0x47decf], al
movzx eax, byte [0x47deb0]
xor al, 0xa4
mov byte [0x47ded0], al
mov dword [0x483224], 1
push eax
sub esp, 0x10
mov ebx, esp
push eax
mov edx, esp
push eax
mov eax, esp
push eax
mov esi, esp
mov ecx, dword [0x482d04]
mov edi, 0xffffffff
test ecx, ecx
je 0x461810
mov dword [ebp - 0x14], edx
mov edx, dword [0x482d08]
add edx, 8
mov edi, dword [ebp + 8]
nop
nop
nop
cmp dword [edx - 8], edi
je 0x461775
add edx, 0xc
dec ecx
jne 0x461760
mov edi, 0xffffffff
jmp 0x461810
movzx ecx, byte [0x47ded0]
mov byte [ebx + 0x10], cl
mov ecx, dword [0x47decc]
mov dword [ebx + 0xc], ecx
mov ecx, dword [0x47dec8]
mov dword [ebx + 8], ecx
mov ecx, dword [0x47dec4]
mov dword [ebx + 4], ecx
mov ecx, dword [0x47dec0]
mov dword [ebx], ecx
mov ecx, dword [edx]
mov dword [ebx + 1], ecx
mov ecx, dword [0x482d0c]
mov dword [ebx + 6], ecx
mov word [ebx + 0xd], 0x10
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [eax], 0x10
push 0x40
push 0x3000
push eax
push 0
push esi
push 0xffffffffffffffff
call dword [0x482d10]
mov edi, dword [esi]
mov ecx, 4
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [esi]
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
push 0x8000
push eax
push esi
push 0xffffffffffffffff
call dword [0x482d14]
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret