joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f903
Capabilities:
Connect to http server
Parse url

Disassembly:
push 0x60
mov eax, 0x470600
call fcn.00455d47
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x68], eax
mov dword [eax + 4], edx
mov dword [ebp - 4], edx
mov dword [eax + 8], 0x481f78
mov byte [eax + 0xc], 1
mov dword [eax + 0x24], 0xf
mov dword [eax + 0x20], edx
mov byte [eax + 0x10], dl
lea edi, [eax + 0x2c]
mov dword [eax], 0x481f84
mov dword [eax + 8], 0x481f88
xor esi, esi
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], edx
mov dword [ebp - 0x64], edi
mov word [edi], si
mov byte [ebp - 4], 2
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], 0x3c
mov eax, dword [ecx + 0x14]
cmp eax, 0x10
jb 0x41f97d
mov esi, dword [ecx]
jmp 0x41f97f
mov esi, ecx
mov edx, dword [ecx + 0x10]
add edx, esi
cmp eax, 0x10
jb 0x41f98b
mov ecx, dword [ecx]
push edx
push ecx
lea esi, [ebp - 0x48]
call fcn.004210af
mov ebx, eax
mov eax, edi
mov byte [ebp - 4], 3
call fcn.00403b5c
push 1
xor edi, edi
mov byte [ebp - 4], 2
call fcn.00403c49
mov ebx, dword [ebp - 0x68]
push 0x3c
pop edi
push edi
lea esi, [ebx + 0x48]
push 0
push esi
call fcn.0044fbd0
mov eax, dword [ebp - 0x64]
or dword [ebx + 0x50], 0xffffffff
or dword [ebx + 0x5c], 0xffffffff
add esp, 0xc
mov dword [esi], edi
cmp dword [eax + 0x14], 8
jb 0x41f9d9
mov eax, dword [eax]
push esi
xor edi, edi
push edi
push edi
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x41fa31
call fcn.0041fadb
push eax
lea ecx, [ebp - 0x54]
call fcn.0041f4f6
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 4
call fcn.0044c610
push eax
lea ecx, [ebx + 0x10]
call fcn.00403af7
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x60]
mov byte [ebx + 0xc], 0
call fcn.0044c700
mov dword [ebp - 0x60], 0x481b80
push 0x4916e4
lea eax, [ebp - 0x60]
push eax
call fcn.004554bb
mov eax, dword [ebx + 0x5c]
mov ecx, dword [ebx + 0x58]
xor edx, edx
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], dx
call fcn.0040a200
mov byte [ebp - 4], 5
cmp dword [ebp - 0x18], 8
mov ecx, dword [ebp - 0x2c]
jae 0x41fa5e
mov ecx, esi
movzx edx, word [ebx + 0x60]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax + 4]
push edi
push edi
push 3
push edi
push edi
push edx
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [ebx + 4], eax
cmp eax, edi
jne 0x41fac5
call fcn.0041fb4b
push eax
lea ecx, [ebp - 0x60]
call fcn.0041f4f6
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 6
call fcn.0044c610
push eax
lea ecx, [ebx + 0x10]
call fcn.00403af7
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x54]
mov byte [ebx + 0xc], 0
call fcn.0044c700
mov dword [ebp - 0x54], 0x481b80
push 0x4916e4
lea eax, [ebp - 0x54]
jmp 0x41fa2b
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.00403c49
mov eax, ebx
call fcn.00455dca
ret 8
Function at 0x41fadb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a405c], 1
jne 0x41fb2e
or dword [0x4a405c], 1
mov dword [0x4a2568], 0x7c5a5d63
mov dword [0x4a256c], 0x77444040
mov dword [0x4a2570], 0x5f575546
mov dword [0x4a2574], 0x1c584661
mov dword [0x4a2578], 0x5552141d
mov dword [0x4a257c], 0x5051585d
mov byte [0x4a2580], 0x34
xor eax, eax
mov cl, byte [eax + 0x4a2568]
xor cl, 0x34
mov byte [eax + 0x4a281c], cl
inc eax
cmp eax, 0x19
jb 0x41fb30
mov eax, 0x4a281c
ret

Function at 0x41fb4b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4058], 1
jne 0x41fb97
or dword [0x4a4058], 1
mov dword [0x4a2584], 0x7c5a5d63
mov dword [0x4a2588], 0x77444040
mov dword [0x4a258c], 0x515a5a5b
mov dword [0x4a2590], 0x1d1c4057
mov dword [0x4a2594], 0x5d555214
mov dword [0x4a2598], 0x34505158
xor eax, eax
mov cl, byte [eax + 0x4a2584]
xor cl, 0x34
mov byte [eax + 0x4a2838], cl
inc eax
cmp eax, 0x18
jb 0x41fb99
mov eax, 0x4a2838
ret
Function at 0x42021d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4054], 1
jne 0x4202f6
or dword [0x4a4054], 1
mov dword [0x4a25a0], 0x41455166
mov dword [0x4a25a4], 0x14404751
mov dword [0x4a25a8], 0x14584641
mov dword [0x4a25ac], 0x50514741
mov dword [0x4a25b0], 0x50145514
mov dword [0x4a25b4], 0x5152525d
mov dword [0x4a25b8], 0x405a5146
mov dword [0x4a25bc], 0x5c574714
mov dword [0x4a25c0], 0x14515951
mov dword [0x4a25c4], 0x5a555c40
mov dword [0x4a25c8], 0x515c4014
mov dword [0x4a25cc], 0x5a5b5714
mov dword [0x4a25d0], 0x4057515a
mov dword [0x4a25d4], 0x145a5b5d
mov dword [0x4a25d8], 0x14475543
mov dword [0x4a25dc], 0x405d5a5d
mov dword [0x4a25e0], 0x5d58555d
mov dword [0x4a25e4], 0x1450514e
mov dword [0x4a25e8], 0x5c405d43
mov byte [0x4a25ec], 0x34
xor eax, eax
mov cl, byte [eax + 0x4a25a0]
xor cl, 0x34
mov byte [eax + 0x4a2850], cl
inc eax
cmp eax, 0x4d
jb 0x4202f8
mov eax, 0x4a2850
ret

Function at 0x420313
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4050], 1
jne 0x4203ef
or dword [0x4a4050], 1
mov dword [0x4a25f0], 0x41455166
mov dword [0x4a25f4], 0x14404751
mov dword [0x4a25f8], 0x14584641
mov dword [0x4a25fc], 0x50514741
mov dword [0x4a2600], 0x50145514
mov dword [0x4a2604], 0x5152525d
mov dword [0x4a2608], 0x405a5146
mov dword [0x4a260c], 0x475b5c14
mov dword [0x4a2610], 0x555a1440
mov dword [0x4a2614], 0x40145159
mov dword [0x4a2618], 0x145a555c
mov dword [0x4a261c], 0x14515c40
mov dword [0x4a2620], 0x5a5a5b57
mov dword [0x4a2624], 0x5d405751
mov dword [0x4a2628], 0x43145a5b
mov dword [0x4a262c], 0x5d144755
mov dword [0x4a2630], 0x5d405d5a
mov dword [0x4a2634], 0x4e5d5855
mov dword [0x4a2638], 0x43145051
mov dword [0x4a263c], 0x345c405d
xor eax, eax
mov cl, byte [eax + 0x4a25f0]
xor cl, 0x34
mov byte [eax + 0x4a28a0], cl
inc eax
cmp eax, 0x50
jb 0x4203f1
mov eax, 0x4a28a0
ret

Function at 0x42040c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a404c], 1
jne 0x4204e4
or dword [0x4a404c], 1
mov dword [0x4a2640], 0x41455166
mov dword [0x4a2644], 0x14404751
mov dword [0x4a2648], 0x14584641
mov dword [0x4a264c], 0x50514741
mov dword [0x4a2650], 0x50145514
mov dword [0x4a2654], 0x5152525d
mov dword [0x4a2658], 0x405a5146
mov dword [0x4a265c], 0x465b4414
mov dword [0x4a2660], 0x5c401440
mov dword [0x4a2664], 0x40145a55
mov dword [0x4a2668], 0x5714515c
mov dword [0x4a266c], 0x515a5a5b
mov dword [0x4a2670], 0x5b5d4057
mov dword [0x4a2674], 0x5543145a
mov dword [0x4a2678], 0x5a5d1447
mov dword [0x4a267c], 0x555d405d
mov dword [0x4a2680], 0x514e5d58
mov dword [0x4a2684], 0x5d431450
mov word [0x4a2688], 0x5c40
mov byte [0x4a268a], 0x34
xor eax, eax
mov cl, byte [eax + 0x4a2640]
xor cl, 0x34
mov byte [eax + 0x4a28f0], cl
inc eax
cmp eax, 0x4b
jb 0x4204e6
mov eax, 0x4a28f0
ret
Function at 0x420501
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4048], 1
jne 0x420557
or dword [0x4a4048], 1
mov dword [0x4a268c], 0x7c5a5d63
mov dword [0x4a2690], 0x7b444040
mov dword [0x4a2694], 0x665a5144
mov dword [0x4a2698], 0x51414551
mov dword [0x4a269c], 0x1d1c4047
mov dword [0x4a26a0], 0x5d555214
mov dword [0x4a26a4], 0x34505158
xor eax, eax
mov cl, byte [eax + 0x4a268c]
xor cl, 0x34
mov byte [eax + 0x4a293c], cl
inc eax
cmp eax, 0x1c
jb 0x420559
mov eax, 0x4a293c
ret

Function at 0x420574
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4044], 1
jne 0x420643
or dword [0x4a4044], 1
mov dword [0x4a26a8], 0x7c5a5d63
mov dword [0x4a26ac], 0x67444040
mov dword [0x4a26b0], 0x447b4051
mov dword [0x4a26b4], 0x5a5b5d40
mov dword [0x4a26b8], 0x7a7d631c
mov dword [0x4a26bc], 0x6460607c
mov dword [0x4a26c0], 0x60647b6b
mov dword [0x4a26c4], 0x6b7a7b7d
mov dword [0x4a26c8], 0x61777167
mov dword [0x4a26cc], 0x6d607d66
mov dword [0x4a26d0], 0x7578726b
mov dword [0x4a26d4], 0x141d6773
mov dword [0x4a26d8], 0x46145a5b
mov dword [0x4a26dc], 0x51414551
mov dword [0x4a26e0], 0x5c144047
mov dword [0x4a26e4], 0x58505a55
mov dword [0x4a26e8], 0x55521451
mov dword [0x4a26ec], 0x5051585d
mov byte [0x4a26f0], 0x34
xor eax, eax
mov cl, byte [eax + 0x4a26a8]
xor cl, 0x34
mov byte [eax + 0x4a2958], cl
inc eax
cmp eax, 0x49
jb 0x420645
mov eax, 0x4a2958
ret

Function at 0x420660
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4040], 1
jne 0x42072e
or dword [0x4a4040], 1
mov dword [0x4a26f8], 0x7c5a5d63
mov dword [0x4a26fc], 0x67444040
mov dword [0x4a2700], 0x447b4051
mov dword [0x4a2704], 0x5a5b5d40
mov dword [0x4a2708], 0x7a7d631c
mov dword [0x4a270c], 0x6460607c
mov dword [0x4a2710], 0x60647b6b
mov dword [0x4a2714], 0x6b7a7b7d
mov dword [0x4a2718], 0x707a7167
mov dword [0x4a271c], 0x797d606b
mov dword [0x4a2720], 0x60617b71
mov dword [0x4a2724], 0x5a5b141d
mov dword [0x4a2728], 0x45514614
mov dword [0x4a272c], 0x40475141
mov dword [0x4a2730], 0x5a555c14
mov dword [0x4a2734], 0x14515850
mov dword [0x4a2738], 0x585d5552
mov word [0x4a273c], 0x5051
mov byte [0x4a273e], 0x34
xor eax, eax
mov cl, byte [eax + 0x4a26f8]
xor cl, 0x34
mov byte [eax + 0x4a29a8], cl
inc eax
cmp eax, 0x47
jb 0x420730
mov eax, 0x4a29a8
ret

Function at 0x42074b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a403c], 1
jne 0x4207b4
or dword [0x4a403c], 1
mov dword [0x4a2740], 0x7c5a5d63
mov dword [0x4a2744], 0x75444040
mov dword [0x4a2748], 0x51665050
mov dword [0x4a274c], 0x47514145
mov dword [0x4a2750], 0x55517c40
mov dword [0x4a2754], 0x47465150
mov dword [0x4a2758], 0x52141d1c
mov dword [0x4a275c], 0x51585d55
mov word [0x4a2760], 0x3450
xor eax, eax
mov cl, byte [eax + 0x4a2740]
xor cl, 0x34
mov byte [eax + 0x4a29f0], cl
inc eax
cmp eax, 0x22
jb 0x4207b6
mov eax, 0x4a29f0
ret
Function at 0x4207d1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4038], 1
jne 0x420824
or dword [0x4a4038], 1
mov dword [0x4a2764], 0x4440407c
mov dword [0x4a2768], 0x505a5167
mov dword [0x4a276c], 0x41455166
mov dword [0x4a2770], 0x1c404751
mov dword [0x4a2774], 0x5552141d
mov dword [0x4a2778], 0x5051585d
mov byte [0x4a277c], 0x34
xor eax, eax
mov cl, byte [eax + 0x4a2764]
xor cl, 0x34
mov byte [eax + 0x4a2a14], cl
inc eax
cmp eax, 0x19
jb 0x420826
mov eax, 0x4a2a14
ret

Function at 0x420841
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4034], 1
jne 0x420893
or dword [0x4a4034], 1
mov dword [0x4a2780], 0x4440407c
mov dword [0x4a2784], 0x46514165
mov dword [0x4a2788], 0x525a7d4d
mov dword [0x4a278c], 0x141d1c5b
mov dword [0x4a2790], 0x585d5552
mov word [0x4a2794], 0x5051
mov byte [0x4a2796], 0x34
xor eax, eax
mov cl, byte [eax + 0x4a2780]
xor cl, 0x34
mov byte [eax + 0x4a2a30], cl
inc eax
cmp eax, 0x17
jb 0x420895
mov eax, 0x4a2a30
ret
Function at 0x420b2f
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4704ba
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
mov eax, dword [0x499520]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [esi + 4], ebx
jne 0x420b75
xor al, al
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0x2c], ebx
jne 0x420b88
push 0x100000
call fcn.0044c10b
pop ecx
mov dword [esi + 0x2c], eax
mov dword [esp + 0x14], ebx
jmp 0x420c1c
cmp dword [esp + 0xc], ebx
je 0x420c81
jbe 0x420c1c
mov eax, 0x100000
cmp dword [esp + 0xc], eax
ja 0x420bac
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esi + 0x2c]
push dword [esi + 4]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x420c88
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x10], ebx
je 0x420be0
push dword [esp + 0x10]
mov eax, dword [esi + 0x2c]
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x420bf5
cmp dword [ebp + 8], ebx
je 0x420bf5
push ebx
push dword [esp + 0x14]
push dword [esi + 0x2c]
push dword [ebp + 8]
call fcn.00420dd4
mov eax, dword [esp + 0x10]
add dword [esp + 0x14], eax
sub dword [esp + 0xc], eax
cmp dword [edi + 0x10], ebx
je 0x420c16
mov eax, dword [esi + 0x34]
mov ecx, dword [edi + 0x10]
mov edx, dword [ecx]
push eax
push dword [esp + 0x18]
call dword [edx + 4]
cmp dword [esp + 0xc], ebx
ja 0x420b9d
push ebx
push ebx
lea eax, [esp + 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x420b91
call fcn.00420cd5
push eax
lea ecx, [esp + 0x1c]
call fcn.0041f4f6
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], ebx
call fcn.0044c610
push eax
lea ecx, [esi + 0x10]
call fcn.00403af7
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
mov byte [esi + 0xc], bl
call fcn.0044c700
mov dword [esp + 0x24], 0x481b80
push 0x4916e4
lea eax, [esp + 0x28]
push eax
call fcn.004554bb
mov al, 1
jmp 0x420b62
call fcn.00420d62
push eax
lea ecx, [esp + 0x28]
call fcn.0041f4f6
lea ecx, [esp + 0x24]
mov dword [esp + 0x48], 1
call fcn.0044c610
push eax
lea ecx, [esi + 0x10]
call fcn.00403af7
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x34]
mov byte [esi + 0xc], bl
call fcn.0044c700
mov dword [esp + 0x30], 0x481b80
push 0x4916e4
lea eax, [esp + 0x34]
jmp 0x420c7b

Function at 0x420cd5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4030], 1
jne 0x420d45
or dword [0x4a4030], 1
mov dword [0x4a2798], 0x7c5a5d63
mov dword [0x4a279c], 0x65444040
mov dword [0x4a27a0], 0x4d465141
mov dword [0x4a27a4], 0x55405570
mov dword [0x4a27a8], 0x5d554275
mov dword [0x4a27ac], 0x58565558
mov dword [0x4a27b0], 0x141d1c51
mov dword [0x4a27b4], 0x585d5552
mov word [0x4a27b8], 0x5051
mov byte [0x4a27ba], 0x34
xor eax, eax
mov cl, byte [eax + 0x4a2798]
xor cl, 0x34
mov byte [eax + 0x4a2a48], cl
inc eax
cmp eax, 0x23
jb 0x420d47
mov eax, 0x4a2a48
ret
Function at 0x420d62
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a402c], 1
jne 0x420db7
or dword [0x4a402c], 1
mov dword [0x4a27bc], 0x51405a7d
mov dword [0x4a27c0], 0x40515a46
mov dword [0x4a27c4], 0x50555166
mov dword [0x4a27c8], 0x51585d72
mov dword [0x4a27cc], 0x52141d1c
mov dword [0x4a27d0], 0x51585d55
mov word [0x4a27d4], 0x3450
xor eax, eax
mov cl, byte [eax + 0x4a27bc]
xor cl, 0x34
mov byte [eax + 0x4a2a6c], cl
inc eax
cmp eax, 0x1a
jb 0x420db9
mov eax, 0x4a2a6c
ret

Function at 0x421545
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4010], 1
jne 0x4215ec
or dword [0x4a4010], 1
or al, 0xff
mov byte [0x4a2aa4], 0xd0
mov byte [0x4a2aa5], al
mov word [0x4a2aa6], 0xe4b1
mov byte [0x4a2aa8], al
mov dword [0x4a2aa9], 0xfef2f4e3
mov byte [0x4a2aad], 0xf6
mov byte [0x4a2aae], al
mov dword [0x4a2aaf], 0xf5f4ebf8
mov dword [0x4a2ab3], 0xfafee5b1
mov byte [0x4a2ab7], 0xf4
mov byte [0x4a2ab8], al
mov dword [0x4a2ab9], 0xe2f0e6b1
mov dword [0x4a2abd], 0xe4fef7b1
mov byte [0x4a2ac1], al
mov dword [0x4a2ac2], 0xe5f0b1f5
mov dword [0x4a2ac6], 0xf0f9f2b1
mov dword [0x4a2aca], 0xe5f2f0e3
mov dword [0x4a2ace], 0x91b1e3f4
xor eax, eax
mov cl, byte [eax + 0x4a2aa4]
xor cl, 0x91
mov byte [eax + 0x4a2bf4], cl
inc eax
cmp eax, 0x2e
jb 0x4215ee
mov eax, 0x4a2bf4
ret
Function at 0x421a60
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a400c], 1
jne 0x421abc
or dword [0x4a400c], 1
mov dword [0x4a2ad4], 0xe2e2f8dc
mov dword [0x4a2ad8], 0xb1f6fff8
mov dword [0x4a2adc], 0xf4fdb1f0
mov dword [0x4a2ae0], 0xe1b1e5f7
mov dword [0x4a2ae4], 0xfff4e3f0
mov dword [0x4a2ae8], 0xe2f4f9e5
mov word [0x4a2aec], 0xe2f8
mov byte [0x4a2aee], 0x91
xor eax, eax
mov cl, byte [eax + 0x4a2ad4]
xor cl, 0x91
mov byte [eax + 0x4a2c24], cl
inc eax
cmp eax, 0x1b
jb 0x421abe
mov eax, 0x4a2c24
ret

Function at 0x421ad9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4008], 1
jne 0x421b5b
or dword [0x4a4008], 1
or al, 0xff
mov dword [0x4a2af0], 0xb1e5fedf
mov byte [0x4a2af4], 0xf4
mov byte [0x4a2af5], al
mov dword [0x4a2af6], 0xf9f6e4fe
mov dword [0x4a2afa], 0xf4e1feb1
mov word [0x4a2afe], 0xf0e3
mov byte [0x4a2b00], al
mov dword [0x4a2b01], 0xf8b1e2f5
mov byte [0x4a2b05], al
mov dword [0x4a2b06], 0xe1e9f4b1
mov dword [0x4a2b0a], 0xe2e2f4e3
mov word [0x4a2b0e], 0xfef8
mov byte [0x4a2b10], al
mov byte [0x4a2b11], 0x91
xor eax, eax
mov cl, byte [eax + 0x4a2af0]
xor cl, 0x91
mov byte [eax + 0x4a2c40], cl
inc eax
cmp eax, 0x22
jb 0x421b5d
mov eax, 0x4a2c40
ret

Function at 0x421b78
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4004], 1
jne 0x421bf9
or dword [0x4a4004], 1
or al, 0xff
mov dword [0x4a2b14], 0xb1fefec5
mov word [0x4a2b18], 0xf0fc
mov byte [0x4a2b1a], al
mov dword [0x4a2b1b], 0xe1feb1e8
mov word [0x4a2b1f], 0xe3f4
mov byte [0x4a2b21], 0xf0
mov byte [0x4a2b22], al
mov dword [0x4a2b23], 0xf8b1e2f5
mov byte [0x4a2b27], al
mov dword [0x4a2b28], 0xe1e9f4b1
mov dword [0x4a2b2c], 0xe2e2f4e3
mov word [0x4a2b30], 0xfef8
mov byte [0x4a2b32], al
mov byte [0x4a2b33], 0x91
xor eax, eax
mov cl, byte [eax + 0x4a2b14]
xor cl, 0x91
mov byte [eax + 0x4a2c64], cl
inc eax
cmp eax, 0x20
jb 0x421bfb
mov eax, 0x4a2c64
ret

Function at 0x421c16
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a4000], 1
jne 0x421c6c
or dword [0x4a4000], 1
mov dword [0x4a2b34], 0xe2e2f8dc
mov dword [0x4a2b38], 0xb1f6fff8
mov dword [0x4a2b3c], 0xf8e3b1f0
mov dword [0x4a2b40], 0xb1e5f9f6
mov dword [0x4a2b44], 0xf4e3f0e1
mov dword [0x4a2b48], 0xf4f9e5ff
mov dword [0x4a2b4c], 0x91e2f8e2
xor eax, eax
mov cl, byte [eax + 0x4a2b34]
xor cl, 0x91
mov byte [eax + 0x4a2c84], cl
inc eax
cmp eax, 0x1c
jb 0x421c6e
mov eax, 0x4a2c84
ret

Function at 0x421c89
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ffc], 1
jne 0x421cfa
or dword [0x4a3ffc], 1
mov dword [0x4a2b50], 0xe3f0ffc4
mov dword [0x4a2b54], 0xe1feb1e8
mov dword [0x4a2b58], 0xe5f0e3f4
mov dword [0x4a2b5c], 0xfcb1e3fe
mov dword [0x4a2b60], 0xb1e5e2e4
mov dword [0x4a2b64], 0xf4e7f0f9
mov dword [0x4a2b68], 0xf4fffeb1
mov dword [0x4a2b6c], 0xf4e1feb1
mov dword [0x4a2b70], 0xf5fff0e3
mov byte [0x4a2b74], 0x91
xor eax, eax
mov cl, byte [eax + 0x4a2b50]
xor cl, 0x91
mov byte [eax + 0x4a2ca0], cl
inc eax
cmp eax, 0x25
jb 0x421cfc
mov eax, 0x4a2ca0
ret
Function at 0x421d17
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ff8], 1
jne 0x421d91
or dword [0x4a3ff8], 1
mov dword [0x4a2b78], 0xf0fff8d3
mov dword [0x4a2b7c], 0xfeb1e8e3
mov dword [0x4a2b80], 0xf0e3f4e1
mov dword [0x4a2b84], 0xb1e3fee5
mov dword [0x4a2b88], 0xe5e2e4fc
mov dword [0x4a2b8c], 0xe7f0f9b1
mov dword [0x4a2b90], 0xe6e5b1f4
mov dword [0x4a2b94], 0xe1feb1fe
mov dword [0x4a2b98], 0xfff0e3f4
mov word [0x4a2b9c], 0xe2f5
mov byte [0x4a2b9e], 0x91
xor eax, eax
mov cl, byte [eax + 0x4a2b78]
xor cl, 0x91
mov byte [eax + 0x4a2cc8], cl
inc eax
cmp eax, 0x27
jb 0x421d93
mov eax, 0x4a2cc8
ret

Function at 0x421dae
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ff4], 1
jne 0x421e17
or dword [0x4a3ff4], 1
mov dword [0x4a2ba0], 0xf0fff8d3
mov dword [0x4a2ba4], 0xfeb1e8e3
mov dword [0x4a2ba8], 0xf0e3f4e1
mov dword [0x4a2bac], 0xb1e3fee5
mov dword [0x4a2bb0], 0xb1e5feff
mov dword [0x4a2bb4], 0xfde1fcf8
mov dword [0x4a2bb8], 0xfff4fcf4
mov dword [0x4a2bbc], 0xabf5f4e5
mov word [0x4a2bc0], 0x91b1
xor eax, eax
mov cl, byte [eax + 0x4a2ba0]
xor cl, 0x91
mov byte [eax + 0x4a2cf0], cl
inc eax
cmp eax, 0x22
jb 0x421e19
mov eax, 0x4a2cf0
ret
Function at 0x42371c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x42375e
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x480ca8]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x480ca8]
inc edx
cmp dword [ebp + 8], 0
jne 0x423729
pop esi
not eax
pop ebp
ret

Function at 0x4258e8
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x42590d
cmp dword [ecx + 0x38], ebx
je 0x42590d
cmp eax, dword [ecx + 0x10]
jae 0x42590d
cmp dword [ecx + 0x14], 1
jne 0x42590d
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x42590f
xor edi, edi
cmp edi, ebx
je 0x4259f2
cmp esi, ebx
je 0x4259f2
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx ecx, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.0042502a
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x42599e
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.0044fc90
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x4259c3
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.0044fc90
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x4259f4
xor eax, eax
pop edi
pop ebx
ret
Function at 0x42610c
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cdq
and edx, 3
add eax, edx
sar eax, 2
xor edx, edx
lea ecx, [ecx + eax*4]
neg eax
push esi
je 0x426148
mov esi, dword [ecx + eax*4]
imul esi, esi, 0xcc9e2d51
rol esi, 0xf
imul esi, esi, 0x1b873593
xor edx, esi
rol edx, 0xd
imul edx, edx, 5
add edx, 0xe6546b64
inc eax
jne 0x426125
mov eax, dword [ebp + 8]
and eax, 3
xor esi, esi
dec eax
je 0x426169
dec eax
je 0x426160
dec eax
jne 0x42617f
movzx esi, byte [ecx + 2]
shl esi, 0x10
movzx eax, byte [ecx + 1]
shl eax, 8
xor esi, eax
movzx eax, byte [ecx]
xor eax, esi
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
xor edx, dword [ebp + 8]
pop esi
mov eax, edx
shr eax, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
pop ebp
ret