joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fce0
Capabilities:
Convert ip address from string
Initialize winsock library
Resolve dns

Disassembly:
push edi
push esi
sub esp, 0x190
mov esi, dword [esp + 0x1a0]
mov edi, dword [esp + 0x19c]
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x443400], cl
jne 0x40fd12
mov eax, esp
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [esi + 4]
push eax
push edi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x40fd34
mov word [esi], 2
xor eax, eax
add esp, 0x190
pop esi
pop edi
ret
lea eax, [esi + 8]
push eax
push edi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x40fd4b
mov word [esi], 0x17
mov dword [esp], 0
mov eax, esp
push eax
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x40fd2b
mov edi, dword [esp]
test edi, edi
je 0x40fd2b
xor eax, eax
cmp dword [edi + 0x18], 0
je 0x40fd2b
cmp dword [edi + 0x10], 0
je 0x40fd2b
mov eax, edi
nop dword [eax + eax]
cmp dword [eax + 4], 2
je 0x40fd8f
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x40fd80
mov eax, edi
push dword [eax + 0x10]
push dword [eax + 0x18]
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x40fd29
Function at 0x40fe30
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Initialize winsock library
Start tcp server

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x194
cmp dword [esp + 0x1a8], 2
mov eax, 0xffffffff
jne 0x40ffd9
cmp dword [esp + 0x1ac], 1
jne 0x40ffd9
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x443400], cl
lea ebx, [esp + 4]
jne 0x40fe79
push ebx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [esp], 0x10
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov word [esp + 4], 2
push 0x7f000001
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 8], eax
mov word [esp + 6], 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test eax, eax
js 0x40ff48
push 0x10
push ebx
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
js 0x40ff62
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
js 0x40ff69
mov ebp, esp
push ebp
push ebx
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
js 0x40ff70
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
test eax, eax
js 0x40ff81
push dword [esp]
push ebx
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x40ffa2
push ebp
push ebx
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
test eax, eax
js 0x40ffae
mov ebp, dword [esp + 0x1b4]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebp], edi
mov dword [ebp + 4], ebx
xor eax, eax
jmp 0x40ffd9
push 0x43b3fd
call sub.msvcrt.dll_perror
add esp, 4
mov eax, 0xffffffff
cmp esi, 0xffffffff
je 0x40ffd9
push esi
jmp 0x40ffce
mov eax, 0x43b404
jmp 0x40ff75
mov eax, 0x43b409
jmp 0x40ff75
mov eax, 0x43b410
push eax
call sub.msvcrt.dll_perror
add esp, 4
push esi
jmp 0x40ffce
push 0x43b3fd
call sub.msvcrt.dll_perror
add esp, 4
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xffffffff
cmp edi, 0xffffffff
je 0x40ffd9
push edi
jmp 0x40ffce
mov eax, 0x43b41c
mov ebx, 0xffffffff
jmp 0x40ffb3
mov eax, 0x43b424
push eax
call sub.msvcrt.dll_perror
add esp, 4
mov ebp, dword [sym.imp.WS2_32.dll_closesocket]
push esi
call ebp
push edi
call ebp
cmp ebx, 0xffffffff
je 0x40ffd4
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xffffffff
add esp, 0x194
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x411460
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x411471
jmp dword [eax*4 + 0x43b540]
cmp dword [0x4402a0], 0
je 0x411580
push 0x4402a4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4402bc]
test edi, edi
je 0x411575
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4114bb
mov edi, dword [edi + 8]
test edi, edi
je 0x411575
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x4114b0
test esi, esi
je 0x4114b0
mov ecx, dword [edi + 4]
call dword [0x43efa4]
push esi
call ecx
add esp, 4
jmp 0x4114b0
call fcn.0040a390
jmp case.default.0x411471
cmp dword [0x4402a0], 0
je case.default.0x411471
push 0x4402a4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4402bc]
test edi, edi
je 0x411568
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x411527
mov edi, dword [edi + 8]
test edi, edi
je 0x411568
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x411520
test esi, esi
je 0x411520
mov ecx, dword [edi + 4]
call dword [0x43efa4]
push esi
call ecx
add esp, 4
jmp 0x411520
cmp dword [0x4402a0], 0
jne 0x41155c
push 0x4402a4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4402a0], 1
jmp case.default.0x411471
push 0x4402a4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x411471
push 0x4402a4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x4402a0]
cmp eax, 1
jne case.default.0x411471
mov eax, dword [0x4402bc]
test eax, eax
je 0x4115b2
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call fcn.00439a34
add esp, 4
mov eax, esi
test esi, esi
jne 0x4115a0
mov dword [0x4402bc], 0
mov dword [0x4402a0], 0
push 0x4402a4
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4116e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x43a004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x411746
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x411746
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x411746
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x411746
mov edx, dword [esp + 0xc]
sub edx, dword [0x43a004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x411736
add esi, 0x28
dec ecx
je 0x411746
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x411730
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x411730
mov eax, esi
pop esi
pop edi
ret
Function at 0x41c3c0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
push 0x43bae0
push dword [esp + 0x1c]
call sub.msvcrt.dll_fopen
add esp, 8
mov esi, 0xffffc200
test eax, eax
je 0x41c4af
mov edi, eax
push 0
push eax
call sub.msvcrt.dll_setbuf
add esp, 8
push 2
push 0
push edi
call sub.msvcrt.dll_fseek
add esp, 0xc
push edi
call sub.msvcrt.dll_ftell
add esp, 4
cmp eax, 0xffffffff
je 0x41c48a
mov ebx, eax
mov ebp, dword [esp + 0x20]
push 0
push 0
push edi
call sub.msvcrt.dll_fseek
add esp, 0xc
mov dword [ebp], ebx
mov eax, ebx
inc eax
push eax
push 1
call sub.msvcrt.dll_calloc
add esp, 8
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
test eax, eax
je 0x41c495
push edi
push ebx
push 1
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
mov dword [esp], eax
mov ebp, dword [esp + 0x20]
mov ebx, dword [ebp]
push edi
call sub.msvcrt.dll_fclose
add esp, 4
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp]
cmp dword [esp], ebx
jne 0x41c4a5
mov edi, ebp
mov byte [eax + ecx], 0
push str._____BEGIN
mov eax, dword [esp + 0x20]
push dword [eax]
call sub.msvcrt.dll_strstr
add esp, 8
xor esi, esi
test eax, eax
je 0x41c4af
inc dword [edi]
jmp 0x41c4af
push edi
call sub.msvcrt.dll_fclose
add esp, 4
jmp 0x41c4af
push edi
call sub.msvcrt.dll_fclose
add esp, 4
mov esi, 0xffffc080
jmp 0x41c4af
push ecx
push eax
call fcn.00422ea0
add esp, 8
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x424ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x424f08
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, ebp
and edx, 3
mov dword [esp], edx
cmp ebp, 4
jae 0x424f0c
xor edi, edi
xor esi, esi
jmp 0x424f5d
xor eax, eax
jmp 0x424f84
and ebp, 0xfffffffc
xor edi, edi
xor esi, esi
nop word cs:[eax + eax]
movzx edx, byte [ecx + edi]
xor dl, byte [eax + edi]
movzx edx, dl
or edx, esi
movzx ebx, byte [ecx + edi + 1]
xor bl, byte [eax + edi + 1]
movzx esi, bl
movzx ebx, byte [ecx + edi + 2]
xor bl, byte [eax + edi + 2]
movzx ebx, bl
or ebx, esi
or ebx, edx
movzx edx, byte [ecx + edi + 3]
xor dl, byte [eax + edi + 3]
movzx esi, dl
or esi, ebx
add edi, 4
cmp ebp, edi
jne 0x424f20
mov ebx, dword [esp]
test ebx, ebx
je 0x424f81
add eax, edi
add ecx, edi
xor edi, edi
nop word [eax + eax]
movzx edx, byte [ecx + edi]
xor dl, byte [eax + edi]
movzx edx, dl
or esi, edx
inc edi
cmp ebx, edi
jne 0x424f70
movzx eax, si
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4271e0
Capabilities:
Encrypt data using openssl ecdsa
Encrypt data using openssl rsa

Disassembly:
xor eax, eax
test ecx, ecx
je 0x427294
push ebx
push edi
push esi
mov edx, dword [ecx + 4]
cmp edx, 8
je 0x42724e
cmp edx, 9
jne 0x427291
push 9
mov esi, ecx
push dword [ecx + 8]
push 0x43ce75
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x42727e
push 9
push dword [esi + 8]
push 0x43cea8
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x42728c
push 9
push dword [esi + 8]
push 0x43cf35
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
mov eax, 0
jne 0x427291
mov eax, 0x43cb50
jmp 0x427291
mov esi, dword [ecx + 8]
mov edx, 0xce48862a
mov edi, dword [esi]
xor edi, edx
mov ebx, 0x203043d
xor ebx, dword [esi + 4]
or ebx, edi
je 0x427285
mov ecx, dword [ecx + 8]
xor edx, dword [ecx]
mov esi, 0x303043d
xor esi, dword [ecx + 4]
or esi, edx
jne 0x427291
mov eax, 0x43cb38
jmp 0x427291
mov eax, 0x43caf0
jmp 0x427291
mov eax, 0x43cb20
jmp 0x427291
mov eax, 0x43cb08
pop esi
pop edi
pop ebx
ret

Function at 0x4272d0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push esi
mov ecx, dword [esp + 8]
mov eax, 0xffffffd2
test ecx, ecx
je 0x42730d
mov edx, dword [ecx + 4]
cmp edx, 5
je 0x42732c
cmp edx, 7
je 0x42730f
cmp edx, 9
jne 0x42730d
push 9
push dword [ecx + 8]
push 0x43cf4a
call sub.msvcrt.dll_memcmp
add esp, 0xc
mov ecx, eax
mov eax, 0xffffffd2
test ecx, ecx
je 0x427348
pop esi
ret
mov ecx, dword [ecx + 8]
mov edx, 0xce48862a
xor edx, dword [ecx]
mov esi, 0x1023dce
xor esi, dword [ecx + 3]
or esi, edx
jne 0x42730d
mov eax, 0x43cb94
jmp 0x42734d
mov ecx, dword [ecx + 8]
mov edx, 0x104812b
xor edx, dword [ecx]
movzx ecx, byte [ecx + 4]
xor ecx, 0xc
or ecx, edx
jne 0x42730d
mov eax, 0x43cba8
jmp 0x42734d
mov eax, 0x43cb80
mov ecx, dword [esp + 0xc]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
xor eax, eax
pop esi
ret
Function at 0x429e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x410
mov eax, dword [esp + 0x424]
cmp dword [eax + 0x70], 0
mov esi, 0xffffbf80
jne 0x429e70
mov edi, dword [eax + 4]
lea ecx, [edi - 0x401]
cmp ecx, 0xfffffc0f
jb 0x429e70
lea ebx, [esp + 0x10]
push ebx
push dword [esp + 0x438]
push dword [esp + 0x434]
push dword [esp + 0x434]
push eax
call fcn.004294f0
add esp, 0x14
mov esi, eax
test eax, eax
jne 0x429e62
movzx eax, byte [esp + 0x10]
mov ecx, eax
neg ecx
or eax, ecx
sar eax, 0x1f
mov dword [esp], eax
movzx ecx, byte [esp + 0x11]
mov eax, 2
xor eax, ecx
lea ecx, [edi - 0xb]
mov dword [esp + 8], ecx
mov ecx, eax
neg ecx
or eax, ecx
sar eax, 0x1f
mov dword [esp + 0xc], eax
xor ebx, ebx
mov edx, 2
xor ebp, ebp
nop dword [eax]
movzx ecx, byte [esp + edx + 0x10]
xor eax, eax
xor eax, ecx
mov ecx, eax
neg ecx
or eax, ecx
sar eax, 0x1f
not eax
or ebx, eax
mov eax, ebx
not eax
mov ecx, eax
and ecx, 1
add ebp, ecx
inc edx
cmp edi, edx
jne 0x429d50
mov ecx, dword [esp + 0x43c]
mov edx, dword [esp + 8]
cmp edx, ecx
cmovb ecx, edx
mov dword [esp + 4], ecx
mov esi, dword [esp + 0xc]
or esi, dword [esp]
or esi, eax
mov eax, ebp
mov ecx, 8
mov ebx, eax
xor ebx, ecx
sub eax, ecx
and ecx, ebx
not ebx
and eax, ebx
or eax, ecx
sar eax, 0x1f
mov edx, eax
or edx, esi
mov ebx, edi
sub ebx, ebp
add ebx, 0xfffffffd
mov ecx, edx
mov esi, dword [esp + 4]
mov eax, esi
and eax, ecx
not ecx
and ecx, ebx
or eax, ecx
mov ecx, eax
mov dword [esp], eax
mov eax, esi
mov ebx, eax
xor ebx, ecx
sub eax, ecx
and ecx, ebx
not ebx
and eax, ebx
or eax, ecx
sar eax, 0x1f
mov ebp, eax
mov ebx, eax
and ebx, 0x4400
mov ecx, edx
mov eax, 0x4100
and eax, ecx
not ecx
and ecx, ebx
or eax, ecx
mov esi, eax
or edx, ebp
lea eax, [esp + 0x1b]
push dword [esp + 8]
push eax
push edx
call fcn.00425340
add esp, 0xc
mov ebx, dword [esp]
mov eax, dword [esp + 4]
mov ecx, ebp
mov ebp, eax
and eax, ecx
not ecx
and ecx, ebx
or eax, ecx
mov ebx, eax
add edi, esp
add edi, 0x10
sub edi, ebp
mov eax, ebp
sub eax, ebx
push eax
push ebp
push edi
call fcn.00424f90
add esp, 0xc
cmp dword [esp + 0x43c], 0
je 0x429e53
push ebp
push edi
push dword [esp + 0x440]
call sub.msvcrt.dll_memcpy
add esp, 0xc
neg esi
mov eax, dword [esp + 0x430]
mov dword [eax], ebx
lea ebx, [esp + 0x10]
push 0x400
push ebx
call fcn.00422e20
add esp, 8
mov eax, esi
add esp, 0x410
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 4]
cmp dword [eax + 0x70], 0
je 0x429cb0
mov eax, 0xffffbf00
ret
Function at 0x42f230
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp], edx
cmp byte [ecx + 0x179], 0
jne 0x42f361
mov eax, dword [esp]
movzx edi, byte [eax + 0xf]
mov edx, edi
and edi, 0xf
shl edi, 4
mov esi, dword [ecx + edi + 0x38]
mov eax, dword [ecx + edi + 0x3c]
mov ebp, eax
shld eax, esi, 0x1c
mov ebx, dword [ecx + edi + 0x44]
shld esi, ebx, 0x1c
mov edi, dword [ecx + edi + 0x40]
shld ebx, edi, 0x1c
shr ebp, 4
and edi, 0xf
movzx edi, word [edi + edi + 0x43d6a0]
shl edi, 0x10
xor edi, ebp
and edx, 0xfffffff0
xor ebx, dword [ecx + edx + 0x40]
xor esi, dword [ecx + edx + 0x44]
xor eax, dword [ecx + edx + 0x38]
xor edi, dword [ecx + edx + 0x3c]
add ecx, 0x38
mov dword [esp + 4], ecx
mov edx, 0xf
nop word cs:[eax + eax]
mov dword [esp + 0x10], edx
mov ecx, dword [esp]
movzx edx, byte [ecx + edx - 1]
mov dword [esp + 0xc], edx
mov ebp, edi
shld ebp, eax, 0x1c
shld eax, esi, 0x1c
shld esi, ebx, 0x1c
and ebx, 0xf
shr edi, 4
movzx ecx, word [ebx + ebx + 0x43d6a0]
shl ecx, 0x10
xor ecx, edi
mov edi, edx
and edi, 0xf
shl edi, 4
mov edx, dword [esp + 4]
xor ebp, dword [edx + edi]
xor ecx, dword [edx + edi + 4]
xor esi, dword [edx + edi + 8]
xor eax, dword [edx + edi + 0xc]
mov edi, ecx
shld edi, ebp, 0x1c
mov dword [esp + 8], edi
shld ebp, eax, 0x1c
mov ebx, eax
shld ebx, esi, 0x1c
and esi, 0xf
shr ecx, 4
movzx edi, word [esi + esi + 0x43d6a0]
shl edi, 0x10
xor edi, ecx
mov ecx, dword [esp + 0xc]
and ecx, 0xfffffff0
mov eax, dword [esp + 8]
xor eax, dword [edx + ecx]
xor edi, dword [edx + ecx + 4]
xor ebx, dword [edx + ecx + 8]
mov esi, ebp
xor esi, dword [edx + ecx + 0xc]
mov edx, dword [esp + 0x10]
dec edx
jne 0x42f2b0
bswap edi
bswap eax
mov ecx, dword [esp + 0x28]
mov dword [ecx + 4], eax
mov dword [ecx], edi
bswap esi
bswap ebx
mov dword [ecx + 0xc], ebx
mov dword [ecx + 8], esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x438370
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
shl ebx, 2
mov eax, edi
sub eax, ebx
jbe 0x4383a4
add edi, ecx
sub edi, ebx
push eax
push 0
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, edi
jmp 0x4383ec
jae 0x4383ea
mov esi, ebx
lea edx, [edi*8]
mov ebx, edi
nop word cs:[eax + eax]
mov eax, ebx
and eax, 0xfffffffc
mov eax, dword [ebp + eax]
mov ecx, edx
and cl, 0x18
shr eax, cl
test al, al
jne 0x43848e
inc ebx
add edx, 8
mov eax, esi
cmp esi, ebx
jne 0x4383c0
mov ebx, edi
mov ecx, dword [esp + 0x28]
jmp 0x4383ec
mov ebx, edi
test ebx, ebx
je 0x438484
mov edi, ebp
mov esi, 0
cmp ebx, 1
mov dword [esp], ebx
je 0x438460
mov eax, dword [esp]
mov edx, eax
and edx, 0xfffffffe
mov dword [esp + 8], edx
lea ebp, [eax + ecx]
dec ebp
xor edx, edx
xor esi, esi
mov dword [esp + 4], ecx
nop dword [eax + eax]
mov ebx, edi
mov edi, esi
and edi, 0xfffffffc
mov eax, dword [ebx + edi]
mov ecx, edx
and cl, 0x10
shr eax, cl
mov byte [ebp], al
mov eax, dword [ebx + edi]
mov edi, ebx
or cl, 8
shr eax, cl
mov ecx, esi
xor ecx, 0xfffffffe
add ecx, dword [esp]
mov ebx, dword [esp + 4]
mov byte [ebx + ecx], al
mov ecx, dword [esp + 4]
add esi, 2
add edx, 0x10
add ebp, 0xfffffffe
cmp dword [esp + 8], esi
jne 0x438420
mov ebx, dword [esp]
test bl, 1
je 0x438484
mov edx, edi
mov eax, esi
and eax, 0xfffffffc
mov edx, dword [edi + eax]
mov eax, ecx
lea ecx, [esi*8]
shr edx, cl
not esi
add ebx, esi
mov byte [eax + ebx], dl
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0xfffffff8
jmp 0x438486
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2f772bbf
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x181c28d4
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x403370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [esp + 0x14], edx
lea esi, [ecx + 4]
mov edx, dword [ecx]
add esi, 4
xor eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
push edi
movd xmm0, edx
mov edi, eax
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x20], xmm0
test al, 3
je 0x4033b0
and edi, 0xfffffffc
add edi, 4
mov eax, dword [0x40daf4]
test eax, eax
jne 0x4033d4
mov ecx, 0xbf336bcc
call fcn.00403ea0
mov edx, 0x44a2d105
mov ecx, eax
call fcn.00403e00
mov dword [0x40daf4], eax
call eax
mov ebx, eax
mov eax, dword [0x40e6a8]
test eax, eax
jne 0x4033fc
mov ecx, 0xbf336bcc
call fcn.00403ea0
mov edx, 0xa4fe6fa9
mov ecx, eax
call fcn.00403e00
mov dword [0x40e6a8], eax
push edi
push 8
push ebx
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x4034b2
shr edi, 2
xor edx, edx
lea ecx, [esi + edi*4]
mov edi, eax
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
mov ecx, eax
cmova ebx, edx
test ebx, ebx
je 0x4034a2
cmp ebx, 8
jb 0x403487
lea eax, [esi - 4]
lea eax, [eax + ebx*4]
cmp ecx, eax
ja 0x403446
lea eax, [ecx - 4]
lea eax, [eax + ebx*4]
cmp eax, esi
jae 0x403487
movdqa xmm1, xmmword [esp + 0x20]
mov eax, ebx
and eax, 7
mov dword [esp + 0xc], ebx
sub dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea ecx, [ecx]
movdqu xmm0, xmmword [esi]
add edx, 8
pxor xmm0, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
add esi, 0x20
pxor xmm0, xmm1
movdqu xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, eax
jb 0x403460
cmp edx, ebx
jae 0x4034a2
sub edi, esi
lea ecx, [ecx]
mov eax, dword [esi]
lea esi, [esi + 4]
xor eax, dword [esp + 0x14]
inc edx
mov dword [edi + esi - 4], eax
cmp edx, ebx
jb 0x403490
mov edx, dword [esp + 0x18]
test edx, edx
je 0x4034b0
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403520
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], edx
lea ebx, [eax + 1]
mov dword [esp + 0x10], eax
add esi, 4
push edi
test bl, 3
je 0x403549
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x40daf4]
test eax, eax
jne 0x40356d
mov ecx, 0xbf336bcc
call fcn.00403ea0
mov edx, 0x44a2d105
mov ecx, eax
call fcn.00403e00
mov dword [0x40daf4], eax
call eax
mov edi, eax
mov eax, dword [0x40e6a8]
test eax, eax
jne 0x403595
mov ecx, 0xbf336bcc
call fcn.00403ea0
mov edx, 0xa4fe6fa9
mov ecx, eax
call fcn.00403e00
mov dword [0x40e6a8], eax
lea ecx, [ebx + ebx]
push ecx
push 8
push edi
call eax
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x403615
shr ebx, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, edi
lea ecx, [esi + ebx*4]
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x40360a
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [edx + 8]
xor ecx, edi
lea esi, [esi + 4]
movzx eax, cl
inc ebp
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [edx - 4], ax
shr ecx, 8
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, ebx
jb 0x4035d0
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
pop ebp
mov word [edi + eax*2], cx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x403620
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 4]
mov dword [esp + 0xc], edx
lea ebx, [eax + 1]
mov dword [esp + 0x14], eax
add esi, 4
push edi
test bl, 3
je 0x40364a
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x40daf4]
test eax, eax
jne 0x40366e
mov ecx, 0xbf336bcc
call fcn.00403ea0
mov edx, 0x44a2d105
mov ecx, eax
call fcn.00403e00
mov dword [0x40daf4], eax
call eax
mov edi, eax
mov eax, dword [0x40e6a8]
test eax, eax
jne 0x403696
mov ecx, 0xbf336bcc
call fcn.00403ea0
mov edx, 0xa4fe6fa9
mov ecx, eax
call fcn.00403e00
mov dword [0x40e6a8], eax
push ebx
push 8
push edi
call eax
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x403702
shr ebx, 2
xor eax, eax
xor edi, edi
mov ecx, ebp
lea edx, [esi + ebx*4]
mov ebx, edx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, edx
cmova ebx, eax
test ebx, ebx
je 0x4036fa
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
lea ecx, [ecx + 4]
xor edx, ebp
lea esi, [esi + 4]
mov byte [ecx - 4], dl
mov eax, edx
shr eax, 8
inc edi
shr edx, 0x10
mov byte [ecx - 3], al
mov byte [ecx - 2], dl
shr edx, 8
mov byte [ecx - 1], dl
cmp edi, ebx
jb 0x4036d0
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x403bb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp], 0xfca8
add dword [esp], 0x7388
xor dword [esp], 0xf85a93fe
add dword [esp], 0x93fa
shr dword [esp], 9
or dword [esp], 0xbf302969
imul eax, dword [esp], 0x45
push ebx
mov ebx, ecx
mov dword [esp + 4], eax
mov eax, 0x22b63cbf
xor dword [esp + 4], 0x9c78cc27
mov dword [esp + 8], 0xd2a7
mov ecx, dword [esp + 8]
mul ecx
shr edx, 3
mov dword [esp + 8], edx
or dword [esp + 8], 0xfefddf7e
xor dword [esp + 8], 0xfefddff8
mov dword [esp + 8], 0x3c4
xor dword [esp + 8], 0x17e68ae3
xor dword [esp + 8], 0x17e68937
cmp byte [ebx], 0
je 0x403cba
push esi
push edi
lea ebx, [ebx]
mov edi, dword [esp + 0xc]
lea ebx, [ebx + 1]
mov dword [esp + 0x10], 0xd2a7
mov eax, 0x22b63cbf
mov ecx, dword [esp + 0x10]
mul ecx
shr edx, 3
mov dword [esp + 0x10], edx
or dword [esp + 0x10], 0xfefddf7e
xor dword [esp + 0x10], 0xfefddff8
movzx ecx, byte [esp + 0x10]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], 0x3c4
xor dword [esp + 0x10], 0x17e68ae3
xor dword [esp + 0x10], 0x17e68937
shl esi, cl
movzx ecx, byte [esp + 0x10]
mov edx, dword [esp + 0xc]
movsx eax, byte [ebx - 1]
mov dword [esp + 0xc], eax
add dword [esp + 0xc], esi
shl edx, cl
add dword [esp + 0xc], edx
sub dword [esp + 0xc], edi
cmp byte [ebx], 0
jne 0x403c40
pop edi
pop esi
mov eax, dword [esp + 4]
pop ebx
add esp, 8
ret