joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409b34
Capabilities:
Get file attributes

Disassembly:
call fcn.00405d3c
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x409b48
dec eax
and al, 0x10
sete al
ret

Function at 0x40ac10
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x37], 0xef
test dl, dl
je 0x40ac1c
or byte [eax + 0x37], 0x10
mov byte [eax + 0x52], dl
mov ecx, dword [eax + 0x28]
jecxz 0x40ac38
push eax
je 0x40ac39
call dword [0x425128]
pop eax
push 5
push dword [eax + 0x28]
call sub.user32.dll_ShowWindow
ret
mov byte [eax + 0x174], dl
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x425128]
ret

Function at 0x40fb14
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40fb4d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403a20
jmp 0x40fb56
mov eax, ebx
mov edx, esi
call fcn.00403984
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40fb60
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40fb81
mov al, byte [esp]
jmp 0x40fb83
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x410208
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x410080
mov eax, dword [0x425a9c]
cmp byte [eax], 0
je 0x410284
mov eax, dword [0x425938]
call fcn.00402834
call fcn.00402698
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040d4d4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4102cc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4102ba
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x425900]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x426668]
call fcn.00404d8c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x410fb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x411014
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403ba0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040d19c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41101b
lea eax, [ebp - 0xc]
call fcn.00403930
ret
Function at 0x411dfc
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x411fe6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x411e30
mov eax, dword [ebp - 8]
call fcn.00403930
jmp 0x411fd0
mov eax, dword [ebp - 4]
call fcn.00403bcc
mov dword [ebp - 0xc], eax
test byte [ebp - 0xc], 3
je 0x411e6f
push 0x411ffc
push dword [ebp - 4]
push 0x412020
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00403c8c
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x40c4c8]
call fcn.004102d0
call fcn.00403370
mov eax, dword [ebp - 0xc]
shr eax, 2
lea eax, [eax + eax*2]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
call fcn.00403a20
mov ebx, 1
mov esi, 1
cmp ebx, dword [ebp - 0xc]
jg 0x411fa5
mov edx, 4
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + ebx - 1]
cmp ecx, 0x3d
jg 0x411ec4
je 0x411f0a
sub ecx, 0x2b
je 0x411f00
sub ecx, 4
je 0x411f05
dec ecx
sub ecx, 0xa
jb 0x411ef2
jmp 0x411f0f
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x411ed6
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x411ee4
jmp 0x411f0f
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 1]
sub cl, 0x41
mov byte [eax], cl
jmp 0x411f3a
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 1]
sub cl, 0x47
mov byte [eax], cl
jmp 0x411f3a
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 1]
add cl, 4
mov byte [eax], cl
jmp 0x411f3a
mov byte [eax], 0x3e
jmp 0x411f3a
mov byte [eax], 0x3f
jmp 0x411f3a
mov byte [eax], 0
jmp 0x411f3a
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea eax, [ebp - 0x20]
push eax
push 0
mov ecx, 0x412030
mov dl, 1
mov eax, dword [0x40c4c8]
call fcn.0041030c
call fcn.00403370
inc ebx
inc eax
dec edx
jne 0x411ea3
mov eax, dword [ebp - 8]
call fcn.00403e24
xor edx, edx
mov dl, byte [ebp - 0x14]
shl edx, 2
xor ecx, ecx
mov cl, byte [ebp - 0x13]
shr ecx, 4
or edx, ecx
mov byte [eax + esi - 1], dl
mov eax, dword [ebp - 8]
call fcn.00403e24
xor edx, edx
mov dl, byte [ebp - 0x13]
shl edx, 4
xor ecx, ecx
mov cl, byte [ebp - 0x12]
shr ecx, 2
or edx, ecx
mov byte [eax + esi], dl
mov eax, dword [ebp - 8]
call fcn.00403e24
xor edx, edx
mov dl, byte [ebp - 0x12]
shl edx, 6
xor ecx, ecx
mov cl, byte [ebp - 0x11]
or edx, ecx
mov byte [eax + esi + 1], dl
add esi, 3
cmp ebx, dword [ebp - 0xc]
jle 0x411e9b
mov edx, dword [ebp - 4]
mov eax, 0x412054
call fcn.00403eb4
mov ebx, eax
test ebx, ebx
je 0x411fd0
mov eax, dword [ebp - 0xc]
sub eax, ebx
inc eax
mov ebx, eax
mov edx, dword [ebp - 0x10]
sub edx, ebx
inc edx
mov eax, dword [ebp - 8]
mov ecx, ebx
call fcn.00403e6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411fed
lea eax, [ebp - 0x18]
call fcn.00403930
ret

Function at 0x41299c
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00402898
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x41b7fc
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
mov byte [0x425700], 1
push esp
xor edx, edx
mov al, 1
call fcn.004059dc
push eax
call sub.wsock32.dll_WSAStartup
test eax, eax
sete al
add esp, 0x190
ret

Function at 0x41b838
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403dbc
xor eax, eax
push ebp
push 0x41ba6d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10c]
mov eax, dword [ebp - 4]
call fcn.00409994
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.0040995c
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 4]
call fcn.004039c8
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 4]
call fcn.0040829c
test eax, eax
jl 0x41b8e9
lea ecx, [ebp - 0x110]
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 4]
call fcn.00408390
cmp dword [ebp - 0x110], 0
je 0x41b8e9
mov ecx, esi
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 4]
call fcn.00408390
jmp 0x41ba37
cmp byte [0x425700], 0
jne 0x41b8fe
mov eax, esi
call fcn.00403930
jmp 0x41ba37
lea eax, [ebp - 0x104]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00402898
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x104]
mov edx, dword [ebp - 4]
call fcn.00409a30
lea eax, [ebp - 0x104]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x41b9bd
mov edx, dword [eax + 0xc]
test edx, edx
je 0x41b9b4
mov edi, dword [edx]
test edi, edi
je 0x41b9ab
push esi
xor eax, eax
mov al, byte [edi]
mov dword [ebp - 0x130], eax
mov byte [ebp - 0x12c], 0
xor eax, eax
mov al, byte [edi + 1]
mov dword [ebp - 0x128], eax
mov byte [ebp - 0x124], 0
xor eax, eax
mov al, byte [edi + 2]
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x11c], 0
xor eax, eax
mov al, byte [edi + 3]
mov dword [ebp - 0x118], eax
mov byte [ebp - 0x114], 0
lea edx, [ebp - 0x130]
mov ecx, 3
mov eax, 0x41ba84
call fcn.00409ac8
jmp 0x41b9c4
mov eax, esi
call fcn.00403930
jmp 0x41b9c4
mov eax, esi
call fcn.00403930
jmp 0x41b9c4
mov eax, esi
call fcn.00403930
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 4]
call fcn.0040829c
test eax, eax
jl 0x41b9e2
mov ecx, dword [esi]
mov eax, dword [ebx + 0x40]
mov edx, dword [ebp - 4]
call fcn.0040843c
jmp 0x41ba0a
push dword [ebp - 4]
push 0x41ba98
push dword [esi]
lea eax, [ebp - 0x134]
mov edx, 3
call fcn.00403c8c
mov edx, dword [ebp - 0x134]
mov eax, dword [ebx + 0x40]
call fcn.0040b8bc
cmp dword [esi], 0
jne 0x41ba37
lea eax, [ebp - 0x138]
mov ecx, 0x41baa4
mov edx, dword [ebp - 4]
call fcn.00403c18
mov edx, dword [ebp - 0x138]
mov eax, dword [0x425978]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
call fcn.0041d34c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ba74
lea eax, [ebp - 0x138]
mov edx, 2
call fcn.00403954
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.00403954
lea eax, [ebp - 4]
call fcn.00403930
ret
Function at 0x41bd4c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403dbc
xor eax, eax
push ebp
push 0x41beb6
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x41bd92
inc eax
jne 0x41bdc0
push 0x41bed0
push dword [esi + 0xc]
push 0x41beec
lea edx, [ebp - 0x18]
mov eax, edi
call fcn.004098a8
push dword [ebp - 0x18]
lea eax, [esi + 4]
mov edx, 4
call fcn.00403c8c
xor ebx, ebx
jmp 0x41be98
push 4
lea eax, [esi + 0x4c]
push eax
push 0x1005
push 0xffff
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_setsockopt
inc eax
je 0x41bdf8
push 4
lea eax, [esi + 0x4c]
push eax
push 0x1006
push 0xffff
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_setsockopt
inc eax
jne 0x41be19
lea eax, [esi + 4]
mov edx, 0x41bef8
call fcn.00403984
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_closesocket
mov dword [esi + 8], 0xffffffff
xor ebx, ebx
jmp 0x41be98
cmp dword [esi + 0x58], 0
je 0x41be46
mov eax, dword [esi + 0x58]
call fcn.00403dcc
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
mov ax, word [esi + 0x5c]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], 2
jmp 0x41be67
mov eax, dword [ebp - 4]
call fcn.00403dcc
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
push edi
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], 2
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_connect
inc eax
jne 0x41be98
lea eax, [esi + 4]
mov edx, 0x41bf18
call fcn.00403984
mov eax, dword [esi + 8]
push eax
call sub.wsock32.dll_closesocket
mov dword [esi + 8], 0xffffffff
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bebd
lea eax, [ebp - 0x18]
call fcn.00403930
lea eax, [ebp - 4]
call fcn.00403930
ret
Function at 0x41e8dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov ebx, eax
lea esi, [esp + 4]
mov eax, ebx
call fcn.00403930
push esp
push 0x20019
push 0
push 0x41e9c4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x41e956
xor eax, eax
mov dword [esi], eax
lea eax, [esp + 8]
mov byte [eax], 0
inc dword [esi]
inc eax
cmp dword [esi], 0x100
jne 0x41e914
mov dword [esi], 0xff
push esi
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0x41e9ec
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x41e956
mov eax, ebx
lea edx, [esp + 8]
mov ecx, pe_nt_image_headers32
call fcn.00403ba0
jmp 0x41e9b9
push esp
push 0x20019
push 0
push 0x41e9c4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x41e9b9
xor eax, eax
mov dword [esi], eax
lea eax, [esp + 8]
mov byte [eax], 0
inc dword [esi]
inc eax
cmp dword [esi], 0x100
jne 0x41e979
mov dword [esi], 0xff
push esi
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0x41e9ec
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x41e9b9
mov eax, ebx
lea edx, [esp + 8]
mov ecx, pe_nt_image_headers32
call fcn.00403ba0
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x413b48
Capabilities:
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xd9
push 0
push 0
dec ecx
jne 0x413b50
push ecx
push ebx
lea ebx, [ebp - 4]
xor eax, eax
push ebp
push 0x413d80
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x6a4]
xor eax, eax
call fcn.00402938
mov edx, dword [ebp - 0x6a4]
lea eax, [ebp - 0x154]
call fcn.00402c34
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.00403074
lea edx, [ebp - 0x6a8]
xor eax, eax
call fcn.00402938
lea eax, [ebp - 0x6a8]
mov edx, 0x413d94
call fcn.00404394
mov edx, dword [ebp - 0x6a8]
lea eax, [ebp - 0x2a0]
call fcn.00402c34
mov edx, 1
lea eax, [ebp - 0x2a0]
call fcn.00403090
push 2
lea edx, [ebp - 0x6ac]
xor eax, eax
call fcn.00402938
lea eax, [ebp - 0x6ac]
mov edx, 0x413d94
call fcn.00404394
mov eax, dword [ebp - 0x6ac]
call fcn.0040458c
push eax
call sub.kernel32.dll_SetFileAttributesA
mov edx, 0x1d000
lea eax, [ebp - 0x154]
call fcn.0040309c
xor edx, edx
lea eax, [ebp - 0x2a0]
call fcn.0040309c
push ebx
lea edx, [ebp - 0x6a0]
mov ecx, 0x400
lea eax, [ebp - 0x154]
call fcn.00402d8c
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x6a0]
mov ecx, dword [ebx]
lea eax, [ebp - 0x2a0]
call fcn.00402dac
cmp dword [ebx], 0
je 0x413c5d
mov eax, dword [ebp - 8]
cmp eax, dword [ebx]
je 0x413c23
lea eax, [ebp - 0x154]
call fcn.00402dcc
lea eax, [ebp - 0x2a0]
call fcn.00402dcc
push 9
push 0
lea edx, [ebp - 0x6b4]
mov eax, 1
call fcn.00402938
push dword [ebp - 0x6b4]
push 0x413da4
lea edx, [ebp - 0x6b8]
mov eax, 2
call fcn.00402938
push dword [ebp - 0x6b8]
push 0x413da4
lea edx, [ebp - 0x6bc]
mov eax, 3
call fcn.00402938
push dword [ebp - 0x6bc]
push 0x413da4
lea edx, [ebp - 0x6c0]
mov eax, 4
call fcn.00402938
push dword [ebp - 0x6c0]
push 0x413da4
lea edx, [ebp - 0x6c4]
mov eax, 5
call fcn.00402938
push dword [ebp - 0x6c4]
push 0x413da4
lea edx, [ebp - 0x6c8]
mov eax, 6
call fcn.00402938
push dword [ebp - 0x6c8]
lea eax, [ebp - 0x6b0]
mov edx, 0xb
call fcn.0040444c
mov eax, dword [ebp - 0x6b0]
call fcn.0040458c
push eax
lea edx, [ebp - 0x6cc]
xor eax, eax
call fcn.00402938
lea eax, [ebp - 0x6cc]
mov edx, 0x413d94
call fcn.00404394
mov eax, dword [ebp - 0x6cc]
call fcn.0040458c
push eax
push 0
push 1
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413d87
lea eax, [ebp - 0x6cc]
mov edx, 0xb
call fcn.00404114
ret

Function at 0x405e7c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x4229f4], esi
push edi
jne 0x405eb6
mov ecx, 0x4229f0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x405e92
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422df0
jl 0x405e8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x405eeb
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4229f0]
xor eax, esi
inc ecx
dec edx
jne 0x405ece
pop edi
pop esi
not eax
ret 0xc
Function at 0x9d211e
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9d213e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9d212a
add dl, dl
jne 0x9d2149
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9d219a
xor eax, eax
add dl, dl
jne 0x9d2156
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9d223b
add dl, dl
jne 0x9d2165
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9d2170
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9d217b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9d2186
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9d2190
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9d2135
mov eax, 1
add dl, dl
jne 0x9d21a8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9d21b3
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9d219f
sub eax, ebx
mov ebx, 1
jne 0x9d21e6
mov ecx, 1
add dl, dl
jne 0x9d21cc
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9d21d7
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9d21c3
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9d2135
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9d21fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9d2208
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9d21f4
cmp eax, 0x7d00
jae 0x9d222b
cmp eax, 0x500
jb 0x9d2226
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9d2135
cmp eax, 0x7f
ja 0x9d222e
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9d2135
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9d225c
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9d2135
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x40dd48
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x464204]
mov dword [ebp - 0x18], eax
mov eax, dword [0x464208]
mov dword [ebp - 0x14], eax
mov eax, dword [0x46420c]
mov dword [ebp - 0x10], eax
mov eax, dword [0x464210]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, 2
and eax, 7
test eax, eax
je 0x40dde0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, 2
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jns 0x40dd98
add dword [ebp - 0x40], 7
mov eax, dword [ebp - 0x40]
sar eax, 3
shl eax, 3
mov edx, dword [ebp - 0x3c]
sub edx, eax
mov eax, 8
sub eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 4]
add eax, 8
mov dword [esp], eax
call sym._memset
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx]
mov dword [ecx], eax
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
add eax, 0xa
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jns 0x40de02
add dword [ebp - 0x44], 3
mov eax, dword [ebp - 0x44]
sar eax, 2
cmp eax, dword [ebp - 0x20]
jbe 0x40dee9
mov eax, dword [ebp - 0x20]
lea edx, [eax*4]
mov eax, dword [ebp - 0x24]
mov eax, dword [edx + eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
shl eax, 2
add eax, dword [ebp - 0x24]
add eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x61c88647
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
cmp dword [ebp - 0x38], 0x1f
jg 0x40deba
mov eax, dword [ebp - 0x2c]
mov edx, eax
shl edx, 4
mov eax, dword [ebp - 0x2c]
shr eax, 5
xor eax, edx
mov ecx, eax
add ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
and edx, 3
mov eax, dword [ebp - 0x34]
add eax, dword [ebp + edx*4 - 0x18]
mov edx, ecx
xor edx, eax
lea eax, [ebp - 0x28]
add dword [eax], edx
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x34]
sub dword [eax], edx
mov eax, dword [ebp - 0x28]
mov edx, eax
shl edx, 4
mov eax, dword [ebp - 0x28]
shr eax, 5
xor eax, edx
mov ecx, eax
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
shr eax, 0xb
mov edx, eax
and edx, 3
mov eax, dword [ebp - 0x34]
add eax, dword [ebp + edx*4 - 0x18]
mov edx, ecx
xor edx, eax
lea eax, [ebp - 0x2c]
add dword [eax], edx
lea eax, [ebp - 0x38]
inc dword [eax]
jmp 0x40de4a
mov eax, dword [ebp - 0x20]
lea ecx, [eax*4]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [ecx + edx], eax
mov eax, dword [ebp - 0x20]
shl eax, 2
add eax, dword [ebp - 0x24]
lea edx, [eax + 4]
mov eax, dword [ebp - 0x2c]
mov dword [edx], eax
lea eax, [ebp - 0x20]
add dword [eax], 2
jmp 0x40ddf0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, 2
mov dword [edx], eax
mov edx, dword [ebp + 8]
add edx, 8
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov word [edx], ax
leave
ret
Function at 0x40df06
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x464204]
mov dword [ebp - 0x18], eax
mov eax, dword [0x464208]
mov dword [ebp - 0x14], eax
mov eax, dword [0x46420c]
mov dword [ebp - 0x10], eax
mov eax, dword [0x464210]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
add eax, 0xa
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jns 0x40df4e
add dword [ebp - 0x38], 3
mov eax, dword [ebp - 0x38]
sar eax, 2
cmp eax, dword [ebp - 0x20]
jbe 0x40e035
mov eax, dword [ebp - 0x20]
lea edx, [eax*4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [edx + eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
shl eax, 2
add eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0x61c88647
mov dword [ebp - 0x30], 0xc6ef3720
mov dword [ebp - 0x34], 0
cmp dword [ebp - 0x34], 0x1f
jg 0x40e006
mov eax, dword [ebp - 0x24]
mov edx, eax
shl edx, 4
mov eax, dword [ebp - 0x24]
shr eax, 5
xor eax, edx
mov ecx, eax
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
shr eax, 0xb
mov edx, eax
and edx, 3
mov eax, dword [ebp - 0x30]
add eax, dword [ebp + edx*4 - 0x18]
mov edx, ecx
xor edx, eax
lea eax, [ebp - 0x28]
sub dword [eax], edx
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x30]
add dword [eax], edx
mov eax, dword [ebp - 0x28]
mov edx, eax
shl edx, 4
mov eax, dword [ebp - 0x28]
shr eax, 5
xor eax, edx
mov ecx, eax
add ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x30]
and edx, 3
mov eax, dword [ebp - 0x30]
add eax, dword [ebp + edx*4 - 0x18]
mov edx, ecx
xor edx, eax
lea eax, [ebp - 0x24]
sub dword [eax], edx
lea eax, [ebp - 0x34]
inc dword [eax]
jmp 0x40df96
mov eax, dword [ebp - 0x20]
lea ecx, [eax*4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov dword [ecx + edx], eax
mov eax, dword [ebp - 0x20]
shl eax, 2
add eax, dword [ebp - 0x1c]
lea edx, [eax + 4]
mov eax, dword [ebp - 0x28]
mov dword [edx], eax
lea eax, [ebp - 0x20]
add dword [eax], 2
jmp 0x40df3c
leave
ret