joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cbc3
Capabilities:
Get disk information

Disassembly:
push 0x124
mov eax, 0x48d946
call fcn.0044f992
mov ebx, ecx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x11c], ebx
xor eax, eax
mov edi, ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x12c], eax
stosd dword es:[edi], eax
push ecx
push ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00413ccb
and dword [ebp - 4], 0
lea eax, [ebp - 0xe8]
xor edi, edi
push eax
inc edi
push 0x68
mov dword [ebp - 0x12c], edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x40ccdb
cmp word [ebp - 0xe8], 0
lea esi, [ebp - 0xe8]
je 0x40ccdb
push esi
lea ecx, [ebp - 0x100]
call fcn.00409b2a
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x100]
cmp dword [ebp - 0xec], 8
mov eax, dword [ebp - 0xf0]
cmovae ecx, dword [ebp - 0x100]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x100]
cmovae ecx, dword [ebp - 0x100]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x118]
call fcn.0040a3b7
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub eax, 0
je 0x40ccb3
sub eax, 1
je 0x40ccb3
sub eax, 1
je 0x40cca5
sub eax, 1
je 0x40cca5
sub eax, 1
je 0x40cca5
sub eax, 1
jmp 0x40ccb3
lea eax, [ebp - 0x118]
mov ecx, ebx
push eax
call fcn.00413c95
lea ecx, [ebp - 0x118]
call fcn.0040855a
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0
call fcn.0040840e
add esi, 8
xor eax, eax
cmp word [esi], ax
jne 0x40cc35
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
mov dword [ebp - 0x124], esi
cmp esi, edi
jae 0x40cd73
lea eax, [esi + 0x18]
mov dword [ebp - 0x120], eax
mov edx, 0x4a969d
mov dword [ebp - 0x11c], edi
mov ecx, esi
call fcn.0040cace
test al, al
je 0x40cd57
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x11c], eax
cmp eax, edi
je 0x40cd46
mov dword [ebp - 0x128], esi
mov ebx, eax
sub esi, eax
push ebx
lea ecx, [esi + ebx]
call fcn.00413d2f
add ebx, 0x18
cmp ebx, edi
jne 0x40cd27
mov ebx, dword [ebp - 0x130]
mov esi, dword [ebp - 0x124]
mov edi, dword [ebx + 4]
lea ecx, [edi - 0x18]
call fcn.0040855a
add dword [ebx + 4], 0xffffffe8
mov eax, dword [ebx + 4]
jmp 0x40cd5d
mov eax, dword [ebp - 0x11c]
add dword [ebp - 0x120], 0x18
add esi, 0x18
mov dword [ebp - 0x124], esi
mov edi, eax
cmp esi, eax
jb 0x40ccf7
mov eax, ebx
call fcn.0044f93c
ret
Function at 0x4115a2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x14
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
push esi
lea esi, [eax*2 + 2]
jb 0x4115be
mov edx, dword [edx]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4115c9
mov eax, dword [eax]
push esi
push edx
push 1
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4115e1
pop esi
leave
ret 8
push str.Cannot_write_string_value:_RegSetValueExW_failed.
push eax
lea ecx, [ebp - 0x14]
call fcn.004116c1
push 0x4bd43c
lea eax, [ebp - 0x14]
push eax
call fcn.00466072
int3

Function at 0x4115fe
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24
mov eax, 0x48e7d9
call fcn.0044f992
mov ebx, ecx
mov esi, dword [ebp + 0xc]
xor edx, edx
mov edi, dword [ebp + 8]
mov eax, esi
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edx
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x14], edx
jb 0x41162a
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push edx
push edx
push 2
push eax
push edx
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x4116a4
mov eax, dword [ebp - 0x14]
mov ecx, edi
push 0x20
shr eax, 1
push eax
call fcn.004059b5
xor edx, edx
mov eax, edi
mov dword [ebp - 4], edx
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x18], 1
jb 0x411665
mov eax, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x41166d
mov esi, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push eax
push edx
push 2
push esi
push edx
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x41168a
push str.Cannot_get_string_value:_RegGetValueW_failed.
jmp 0x4116a9
mov ecx, dword [ebp - 0x14]
shr ecx, 1
dec ecx
push 0
push ecx
mov ecx, edi
call fcn.00413d0c
mov eax, edi
call fcn.0044f93c
ret 8
push str.Cannot_get_size_of_string_value:_RegGetValueW_failed.
push eax
lea ecx, [ebp - 0x30]
call fcn.004116c1
push 0x4bd43c
lea eax, [ebp - 0x30]
push eax
call fcn.00466072
int3
Function at 0x439770
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491a28
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4bf114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0xf0000000
push 1
push 0
push 0
push esi
mov dword [esi], 0
call edi
test eax, eax
jne 0x4397e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 8
push 1
push 0
push str.Crypto_RNG
push esi
mov ebx, eax
call edi
test eax, eax
jne 0x4397e6
push 0x28
push 1
push eax
push str.Crypto_RNG
push esi
call edi
test eax, eax
je 0x439804
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044e8ec
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.CryptAcquireContext
lea ecx, [ebp - 0x28]
call fcn.00405b55
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x50]
call fcn.004398d0
push 0x4b9eec
lea eax, [ebp - 0x50]
push eax
call fcn.00466072
int3
Function at 0x43d5f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
xor dl, dl
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x43d721
test al, 3
jne 0x43d721
mov edi, ecx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x43d6dc
cmp edi, 8
jb 0x43d6a5
mov ebp, dword [esp + 0x20]
mov edx, edi
mov dword [esp + 0x14], ebx
and edx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x43d654
mov eax, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x43d6e0
mov ebp, ebx
lea edx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [edx + ebx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or edi, eax
sub ebp, 1
jne 0x43d6c2
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], edi
jmp 0x43d6e4
xor edi, edi
jmp 0x43d6e4
mov edi, dword [esp + 0x10]
shl esi, 2
sub ecx, esi
jne 0x43d6f8
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x20]
mov edx, eax
shr eax, 0x10
add ebp, esi
shr edx, 0x18
or dl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or dl, al
mov eax, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test ecx, ecx
je 0x43d7e0
cmp ecx, 0x20
jb 0x43d7ba
mov esi, ecx
xorps xmm3, xmm3
and esi, 0xffffffe0
xorps xmm2, xmm2
mov dword [esp + 0x1c], esi
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x43d755
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebp, dword [esp + 0x14]
cmp edi, ecx
jae 0x43d7e0
sub ebx, ebp
lea esi, [edi + ebp]
sub ecx, edi
nop dword [eax]
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or dl, al
sub ecx, 1
jne 0x43d7d0
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x440c90
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x4c73d4], 0
jne 0x440c9e
call fcn.00449300
cmp byte [0x4c73dd], 0
je 0x440cbc
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.0044ad20
add esp, 0x10
ret
jmp fcn.0043efd0
Function at 0x451af1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x47cce0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047c9a3

Function at 0x47cceb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047cb24

Function at 0x483e0a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00483aca
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..retplne
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x3141f86
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x50614c68
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401c40
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
mov eax, 0x411c
call fcn.00403530
lea eax, [esp + 8]
lea ecx, [esp + 0x11c]
push eax
push 0xfff
push ecx
mov byte [esp + 0xf], 0
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x401c75
xor al, al
add esp, 0x411c
ret 4
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
test eax, eax
push edi
mov dword [esp + 0x14], 0
jle 0x401d50
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ebp, [esp + 0x12c]
mov edx, dword [ebp]
push edx
push 0
push 0x410
call ebx
mov esi, eax
test esi, esi
je 0x401cff
lea eax, [esp + 0x20]
lea ecx, [esp + 0x1c]
push eax
push 4
push ecx
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x401cff
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push 0x104
push edx
push eax
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x401d50
mov ecx, dword [esp + 0x4130]
lea edx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x401d24
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
inc eax
add ebp, 4
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x401c9a
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x411c
ret 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax*4 + 0x12c]
push ecx
push 0
push 0x411
call ebx
mov esi, eax
push 0
push esi
mov byte [esp + 0x1b], 1
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x411c
ret 4
Function at 0x406b01
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40f7d8
cmp edx, dword [eax]
je 0x406b23
add eax, 8
inc ecx
cmp eax, 0x40f868
jl 0x406b14
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40f7d8]
jne 0x406c51
mov eax, dword [0x40ff48]
cmp eax, 1
je 0x406c2b
test eax, eax
jne 0x406b54
cmp dword [0x40d454], 1
je 0x406c2b
cmp edx, 0xfc
je 0x406c51
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x406b8b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00402340
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004022c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x406bce
lea eax, [ebp - 0x1a4]
push eax
call fcn.004022c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40c4e4
push edi
call fcn.004021c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00402340
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00402350
lea eax, [ebp - 0xa0]
push 0x40c4c4
push eax
call fcn.00402350
push dword [esi + 0x40f7dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00402350
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00408cc5
add esp, 0x2c
pop edi
jmp 0x406c51
lea eax, [ebp + 8]
lea esi, [esi + 0x40f7dc]
push 0
push eax
push dword [esi]
call fcn.004022c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x773700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0077378f
jae 0x77370e
xor ecx, ecx
call fcn.0077378f
jae 0x77373d
xor eax, eax
call fcn.0077378f
jae 0x77374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0077378f
adc al, al
jae 0x77372f
jne 0x773779
stosb byte es:[edi], al
jmp 0x773711
call fcn.0077379b
sub ecx, ebx
jne 0x773756
call fcn.00773799
jmp 0x773775
lodsb al, byte [esi]
shr eax, 1
je 0x773783
adc ecx, ecx
jmp 0x773772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00773799
cmp eax, 0x7d00
jae 0x773772
cmp ah, 5
jae 0x773773
cmp eax, 0x7f
ja 0x773774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x773711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x793700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0079378f
jae 0x79370e
xor ecx, ecx
call fcn.0079378f
jae 0x79373d
xor eax, eax
call fcn.0079378f
jae 0x79374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0079378f
adc al, al
jae 0x79372f
jne 0x793779
stosb byte es:[edi], al
jmp 0x793711
call fcn.0079379b
sub ecx, ebx
jne 0x793756
call fcn.00793799
jmp 0x793775
lodsb al, byte [esi]
shr eax, 1
je 0x793783
adc ecx, ecx
jmp 0x793772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00793799
cmp eax, 0x7d00
jae 0x793772
cmp ah, 5
jae 0x793773
cmp eax, 0x7f
ja 0x793774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x793711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x406330
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x47], 0
je 0x406352
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x76]
inc eax
xor byte [edx], cl
cmp eax, 0x46
jb 0x406340
mov byte [esi + 0x47], 0
mov eax, esi
pop esi
ret

Function at 0x406360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47aefd
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x495400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 7], 0
je 0x4063b2
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx - 0x76]
inc edx
xor byte [ecx], al
cmp edx, 6
jb 0x4063a0
mov byte [esi + 7], 0
push ecx
lea eax, [esi + 6]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00410550
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x4063d2
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.00413700
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x40644b
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406441
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x406441
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00479834
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47aefd
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x495400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 9], 0
je 0x4064b2
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx - 0x76]
inc edx
xor byte [ecx], al
cmp edx, 8
jb 0x4064a0
mov byte [esi + 9], 0
push ecx
lea eax, [esi + 8]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00410550
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x4064d2
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.00413700
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x40654b
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406541
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x406541
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00479834
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47aefd
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x495400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0xa], 0
je 0x4065b2
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx - 0x76]
inc edx
xor byte [ecx], al
cmp edx, 9
jb 0x4065a0
mov byte [esi + 0xa], 0
push ecx
lea eax, [esi + 9]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00410550
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x4065d2
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.00413700
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x40664b
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406641
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x406641
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00479834
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x406660
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x32], 0
je 0x406682
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x76]
inc eax
xor byte [edx], cl
cmp eax, 0x31
jb 0x406670
mov byte [esi + 0x32], 0
mov eax, esi
pop esi
ret
Function at 0x406820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47aefd
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x495400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0x31], 0
je 0x406872
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx - 0x76]
inc edx
xor byte [ecx], al
cmp edx, 0x30
jb 0x406860
mov byte [esi + 0x31], 0
push ecx
lea eax, [esi + 0x30]
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00410550
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x406892
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.00413700
mov esi, dword [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x40690b
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406901
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x406901
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00479834
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x406920
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x406942
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x76]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x406930
mov byte [esi + 8], 0
mov eax, esi
pop esi
ret

Function at 0x406950
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x44], 0
je 0x406972
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x76]
inc eax
xor byte [edx], cl
cmp eax, 0x43
jb 0x406960
mov byte [esi + 0x44], 0
mov eax, esi
pop esi
ret

Function at 0x406980
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x136], 0
je 0x4069a7
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax - 0x76]
inc eax
xor byte [edx], cl
cmp eax, 0x135
jb 0x406990
mov byte [esi + 0x136], 0
mov eax, esi
pop esi
ret

Function at 0x4069b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x4069d2
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x76]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x4069c0
mov byte [esi + 5], 0
mov eax, esi
pop esi
ret