joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40876c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [0x430080], 0x55004e
mov dword [0x430084], 0x4c
test ebx, ebx
jne 0x4087c5
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x42f880
mov dword [esp], eax
call esi
sub esp, 0xc
test eax, eax
je 0x4089ba
cmp eax, 0x400
jle 0x408816
jmp 0x4089ba
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.00407d90
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x430080
mov dword [esp], ebx
call esi
sub esp, 0xc
test eax, eax
je 0x4089ba
cmp eax, 0x400
jle 0x408796
jmp 0x4089ba
mov dword [esp + 0xc], 0x42f880
mov dword [esp + 8], 0x430080
mov dword [esp + 4], str._ls_ls_r_n
mov dword [esp], 0x42f480
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x431d60]
mov eax, dword [eax + 0x128]
mov dword [esp], 0x42f880
mov dword [esp + 4], eax
call fcn.0040844a
push esi
push esi
mov dword [esp + 8], 4
mov dword [esp + 4], 0xc0000000
mov dword [esp], 0x42f880
call fcn.00407d90
sub esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
je 0x4089ba
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov eax, dword [ebp - 0x1c]
push ecx
push ecx
add eax, esi
mov dword [ebp - 0x24], eax
add eax, 0xa
mov dword [esp + 4], eax
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
push ebx
mov ebx, eax
test eax, eax
je 0x4089b0
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00407e59
sub esp, 0xc
test eax, eax
je 0x4089b0
mov dword [esp + 4], str._Rename__r_n
mov dword [esp], ebx
call fcn.00407c65
lea ecx, [ebx + esi]
push edx
push edx
test eax, eax
jne 0x408910
mov dword [esp + 4], str._Rename__r_n
add esi, 0xa
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, esi
push eax
push eax
jmp 0x408950
add eax, 0xa
mov dword [esp + 4], 0x40c6b3
mov dword [esp], eax
mov dword [ebp - 0x28], ecx
call fcn.00407c65
mov edx, esi
push ecx
mov dword [ebp - 0x20], eax
push ecx
test eax, eax
je 0x408950
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
add edx, ebx
cmp dword [ebp - 0x20], ecx
jae 0x408948
dec ecx
mov al, byte [ecx + 1]
dec edx
mov byte [edx + 1], al
jmp 0x408939
mov eax, dword [ebp - 0x20]
sub eax, ebx
lea edx, [eax + 1]
mov eax, dword [ebp - 0x1c]
add edx, ebx
mov dword [esp + 4], 0x42f480
mov dword [esp], edx
mov dword [esp + 8], eax
call fcn.00407cd0
add esi, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.00407e9f
sub esp, 0xc
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408a3f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], 0x430880
mov dword [esp + 4], eax
call fcn.004082a4
push ebx
push ebx
mov dword [esp], 0x430880
call fcn.00407bd1
push edx
test eax, eax
jne 0x408a70
xor eax, eax
jmp 0x408aec
mov dword [esp], eax
mov ebx, eax
call fcn.0040836d
push ecx
test byte [0x431dc4], 0x80
je 0x408a92
mov ax, word [ebx]
test ax, ax
je 0x408a6c
cmp ax, 0x5c
je 0x408a6c
sub ebx, 0x430880
sar ebx, 1
mov dword [esp], 0x430880
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
mov dword [esp], 0x430880
cmp ebx, eax
jge 0x408ad1
call fcn.00408a07
push edx
test eax, eax
je 0x408ac2
test byte [eax], 0x10
je 0x408a6c
mov dword [esp], 0x430880
call fcn.00407b5e
push eax
jmp 0x408a9a
call fcn.004082d8
push eax
mov dword [esp], 0x430880
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
push edx
setne al
movzx eax, al
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x408d78
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408db6
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408dbd
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
mov dword [esp + 4], str._s_S.dll
add edx, 0x40c688
add eax, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4

Function at 0x408f5c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x4318e4], 0
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
push ebx
jne 0x408f99
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x408f84
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x408f76
mov dword [ecx*4 + 0x4318e0], eax
inc ecx
cmp ecx, 0x100
jne 0x408f6f
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x408fbc
inc edx
mov cl, byte [edx - 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4318e0]
jmp 0x408fa3
pop ebx
not eax
pop esi
pop ebp
ret 0xc
Function at 0x405a60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jl 0x405af1
jg 0x405a88
test esi, esi
je 0x405af1
push ebx
call fcn.004614df
push eax
call fcn.00465028
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xffff7fff
cmp eax, 1
jne 0x405ab8
push eax
push edi
push esi
push ebx
call fcn.00465e39
add esp, 0x10
test eax, eax
je 0x405af1
test edi, edi
jl 0x405acd
jg 0x405ac6
cmp esi, 0x400
jbe 0x405acd
mov eax, 0x400
jmp 0x405acf
mov eax, esi
push ebx
push eax
lea eax, [ebp - 0x408]
push 1
push eax
call fcn.00465a96
add esp, 0x10
test eax, eax
je 0x405b07
sub esi, eax
mov eax, esi
sbb edi, 0
or eax, edi
jne 0x405ab8
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00457d6e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00457d6e
mov esp, ebp
pop ebp
ret

Function at 0x405b20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], eax
push edi
push 8
lea eax, [ebp - 0x10]
mov ebx, edx
push 1
push eax
call fcn.00465a96
add esp, 0x10
cmp eax, 8
jb 0x405bf8
nop word [eax + eax]
movzx esi, byte [ebp - 9]
movzx eax, byte [ebp - 0xa]
shl esi, 8
or esi, eax
movzx eax, byte [ebp - 0xb]
shl esi, 8
or esi, eax
movzx eax, byte [ebp - 0xc]
shl esi, 8
or esi, eax
lea eax, [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [ebx]
je 0x405c0b
xor eax, eax
nop
mov cl, byte [ebp + eax - 0x10]
cmp cl, 0x20
jb 0x405b9e
cmp cl, 0x7e
jbe 0x405ba3
mov byte [ebp + eax - 0x10], 0x3f
inc eax
cmp eax, 4
jl 0x405b90
push esi
lea eax, [ebp - 0x10]
push eax
push str.Skipping_chunk_of_type___.4s___length__u_n
push 2
call fcn.0045ae98
add esp, 4
push eax
call fcn.00401040
mov ecx, esi
xor eax, eax
and ecx, 1
add ecx, esi
adc eax, eax
push eax
push ecx
mov ecx, edi
call fcn.00405a60
add esp, 0x18
test eax, eax
je 0x405bf8
push edi
push 8
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.00465a96
add esp, 0x10
cmp eax, 8
jae 0x405b60
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00457d6e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
mov dword [eax], esi
mov eax, 1
pop esi
pop ebx
call fcn.00457d6e
mov esp, ebp
pop ebp
ret
Function at 0x405c30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x420], eax
xor esi, esi
mov dword [ebp - 0x41c], edi
mov ebx, ecx
mov dword [ebp - 0x418], esi
jmp 0x405c6f
mov esi, dword [ebp - 0x418]
mov edi, dword [ebp - 0x41c]
push ebx
push 8
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.00465a96
add esp, 0x10
cmp eax, 8
jae 0x405cdc
test esi, esi
jne 0x405cc9
mov esi, 1
push ebx
mov dword [ebp - 0x418], esi
call fcn.004614df
add esp, 4
push eax
call fcn.00465028
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xffff7fff
cmp eax, esi
jne 0x405cc9
push 0
push 0
push 0xc
push ebx
call fcn.00465e39
add esp, 0x10
test eax, eax
je 0x405c6f
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00457d6e
mov esp, ebp
pop ebp
ret
movzx ecx, byte [ebp - 0xc]
movzx eax, byte [ebp - 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 9]
shl ecx, 8
or ecx, eax
lea eax, [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [edi]
je 0x405d99
mov esi, ecx
mov edi, 0
and esi, 1
add esi, ecx
adc edi, edi
jne 0x405d20
test esi, esi
je 0x405c63
push ebx
call fcn.004614df
add esp, 4
push eax
call fcn.00465028
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xffff7fff
cmp eax, 1
jne 0x405d57
push eax
push edi
push esi
push ebx
call fcn.00465e39
add esp, 0x10
test eax, eax
je 0x405c63
test edi, edi
jl 0x405d6c
jg 0x405d65
cmp esi, 0x400
jbe 0x405d6c
mov eax, 0x400
jmp 0x405d6e
mov eax, esi
push ebx
push eax
lea eax, [ebp - 0x414]
push 1
push eax
call fcn.00465a96
add esp, 0x10
test eax, eax
je 0x405cc9
sub esi, eax
mov eax, esi
sbb edi, 0
or eax, edi
jne 0x405d57
jmp 0x405c63
mov eax, dword [ebp - 0x420]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00457d6e
mov esp, ebp
pop ebp
ret
Function at 0x40d8c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
mov ebp, dword [edi + 0x10]
mov ecx, dword [edi + 0x1c]
mov edx, ecx
mov dword [esp + 0x20], ebp
cmp ebp, ecx
jbe 0x40d96d
mov esi, dword [edi + 0x20]
test esi, esi
je 0x40d975
mov eax, dword [edi]
mov ebx, dword [edi + 0x18]
mov edx, dword [eax + ecx*8]
mov eax, dword [eax + ecx*8 + 4]
mov dword [esp + 0x10], edx
lea edx, [ecx + 1]
mov dword [esp + 0x24], edx
mov dword [edi + 0x1c], edx
cmp esi, 0x40
jae 0x40d963
mov edi, dword [esp + 0x10]
mov ebp, eax
mov ecx, 0x38
sub ecx, esi
cmp ecx, 0x40
jae 0x40d92b
mov eax, edi
mov edx, ebp
call fcn.0047a300
movzx ecx, al
jmp 0x40d938
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov ecx, dword [esp + 0x18]
mov eax, ebx
add esi, 8
shr eax, 8
xor eax, ecx
movzx ebx, bl
shl ebx, 8
movzx ecx, word [eax*2 + 0x48b080]
xor ebx, ecx
cmp esi, 0x40
jb 0x40d911
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [edi + 0x18], ebx
mov dword [edi + 0x20], 0
cmp ebp, edx
jbe 0x40da22
mov eax, dword [edi]
movzx ecx, word [edi + 0x18]
mov dword [esp + 0x10], ecx
lea esi, [eax + edx*8]
sub ebp, edx
je 0x40da1c
mov edi, ecx
nop dword [eax]
mov ecx, dword [esi + 4]
lea esi, [esi + 8]
mov edx, dword [esi - 8]
mov ebx, ecx
shrd edx, ecx, 0x10
movzx eax, di
shr ebx, 0x10
xor ebx, eax
movzx eax, dl
mov ecx, ebx
shr ecx, 8
mov dx, word [eax*2 + 0x48b480]
movzx eax, byte [esi - 7]
xor dx, word [ecx*2 + 0x48be80]
xor dx, word [eax*2 + 0x48b280]
movzx eax, byte [esi - 5]
xor dx, word [eax*2 + 0x48b680]
movzx eax, byte [esi - 4]
xor dx, word [eax*2 + 0x48b880]
movzx eax, byte [esi - 3]
xor dx, word [eax*2 + 0x48ba80]
mov eax, dword [esi - 8]
movzx eax, al
xor dx, word [eax*2 + 0x48b080]
movzx eax, bl
xor dx, word [eax*2 + 0x48bc80]
movzx edi, dx
sub ebp, 1
jne 0x40d990
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
movzx eax, cx
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x40f140
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov ebx, edx
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x20]
xor ebp, ebp
xor esi, esi
mov dword [esp + 0x10], ebp
push edi
test edx, edx
je 0x40f1c6
cmp edx, 8
jb 0x40f1c6
cmp dword [0x5c3f5c], 2
jl 0x40f1c6
mov eax, edx
xorps xmm2, xmm2
and eax, 0xfffffff8
xorps xmm1, xmm1
nop word [eax + eax]
movups xmm0, xmmword [ebx + esi*4]
pabsd xmm0, xmm0
paddd xmm2, xmm0
movups xmm0, xmmword [ebx + esi*4 + 0x10]
add esi, 8
pabsd xmm0, xmm0
paddd xmm1, xmm0
cmp esi, eax
jb 0x40f180
paddd xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd ebp, xmm1
mov dword [esp + 0x14], ebp
xor ecx, ecx
xor edi, edi
cmp esi, edx
jae 0x40f217
mov eax, edx
sub eax, esi
cmp eax, 2
jb 0x40f208
lea eax, [edx - 1]
mov ebp, eax
nop dword [eax]
mov eax, dword [ebx + esi*4]
cdq
xor eax, edx
sub eax, edx
add ecx, eax
mov eax, dword [ebx + esi*4 + 4]
cdq
add esi, 2
xor eax, edx
sub eax, edx
add edi, eax
mov eax, esi
cmp esi, ebp
jb 0x40f1e0
mov ebp, dword [esp + 0x14]
cmp eax, dword [esp + 0x24]
jae 0x40f212
mov eax, dword [ebx + esi*4]
cdq
xor eax, edx
sub eax, edx
add ebp, eax
lea eax, [edi + ecx]
add ebp, eax
mov eax, 1
test ebp, ebp
je 0x40f222
mov eax, ebp
cdq
mov edi, edx
mov ecx, eax
and ecx, edi
mov esi, eax
cmp ecx, 0xffffffff
jne 0x40f241
mov eax, 2
add eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
test edi, edi
jg 0x40f253
jl 0x40f24b
test eax, eax
jae 0x40f253
mov eax, esi
mov edi, edx
not eax
not edi
mov edx, eax
mov esi, edi
shrd edx, esi, 1
push 0x218a392
or edx, eax
shr esi, 1
or esi, edi
mov eax, edx
mov ecx, esi
shrd eax, ecx, 2
push 0xcd3d5dbf
shr ecx, 2
or edx, eax
or esi, ecx
mov eax, edx
mov ecx, esi
shrd eax, ecx, 4
shr ecx, 4
or edx, eax
or esi, ecx
mov eax, edx
mov ecx, esi
shrd eax, ecx, 8
shr ecx, 8
or edx, eax
or esi, ecx
mov eax, edx
mov ecx, esi
shrd eax, ecx, 0x10
shr ecx, 0x10
or edx, eax
or esi, ecx
xor eax, eax
or eax, esi
mov ecx, esi
or ecx, edx
shrd ecx, eax, 1
shr eax, 1
add ecx, 1
adc eax, 0
push eax
push ecx
call fcn.0047a130
shr edx, 0x1a
pop edi
pop esi
pop ebp
movzx eax, byte [edx + 0x48c180]
add eax, 2
add eax, dword [esp + 0xc]
pop ebx
add esp, 0x10
ret
Function at 0x419ed0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
movaps xmm5, xmm3
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x41a015
mov eax, dword [ebp + 0x18]
sub dword [ebp - 4], edx
movss xmm6, dword [0x5baf30]
push esi
mov esi, dword [ebp + 0xc]
push edi
nop dword [eax + eax]
mov edi, dword [ebp - 4]
movss xmm3, dword [edi + edx]
mov edi, dword [ebp + 0x10]
movaps xmm4, xmm3
mulss xmm4, xmm5
movaps xmm1, xmm3
mulss xmm1, dword [esi]
addss xmm4, dword [eax]
addss xmm1, dword [eax + 4]
movaps xmm2, xmm4
xorps xmm2, xmm6
movaps xmm0, xmm2
mulss xmm0, dword [edi]
addss xmm1, xmm0
movaps xmm0, xmm2
movss dword [eax], xmm1
movaps xmm1, xmm3
mulss xmm1, dword [esi + 4]
mulss xmm0, dword [edi + 4]
addss xmm1, dword [eax + 8]
addss xmm1, xmm0
movaps xmm0, xmm2
movss dword [eax + 4], xmm1
movaps xmm1, xmm3
mulss xmm1, dword [esi + 8]
mulss xmm0, dword [edi + 8]
addss xmm1, dword [eax + 0xc]
addss xmm1, xmm0
movaps xmm0, xmm2
movss dword [eax + 8], xmm1
movaps xmm1, xmm3
mulss xmm1, dword [esi + 0xc]
mulss xmm0, dword [edi + 0xc]
addss xmm1, dword [eax + 0x10]
addss xmm1, xmm0
movaps xmm0, xmm2
movss dword [eax + 0xc], xmm1
movaps xmm1, xmm3
mulss xmm1, dword [esi + 0x10]
mulss xmm0, dword [edi + 0x10]
addss xmm1, dword [eax + 0x14]
addss xmm1, xmm0
movaps xmm0, xmm2
movss dword [eax + 0x10], xmm1
movaps xmm1, xmm3
mulss xmm1, dword [esi + 0x14]
mulss xmm0, dword [edi + 0x14]
addss xmm1, dword [eax + 0x18]
addss xmm1, xmm0
movaps xmm0, xmm2
movss dword [eax + 0x14], xmm1
movaps xmm1, xmm3
mulss xmm1, dword [esi + 0x18]
mulss xmm0, dword [edi + 0x18]
addss xmm1, dword [eax + 0x1c]
addss xmm1, xmm0
movss dword [eax + 0x18], xmm1
mulss xmm3, dword [esi + 0x1c]
mulss xmm2, dword [edi + 0x1c]
addss xmm3, dword [eax + 0x20]
addss xmm3, xmm2
movss dword [eax + 0x1c], xmm3
movss dword [edx], xmm4
add edx, 4
sub ecx, 1
jne 0x419f00
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41af60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xorps xmm5, xmm5
push esi
mov esi, edx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
push edi
mov edi, dword [ebp + 8]
test eax, eax
jle 0x41b024
movss xmm7, dword [0x5baf30]
movss xmm6, dword [0x5ba688]
nop
movss xmm0, dword [edi + edx*8]
movss xmm4, dword [ecx]
movss xmm3, dword [ecx + 4]
subss xmm0, xmm4
movss xmm1, dword [ecx + 8]
mulss xmm0, dword [0x5ba6fc]
addss xmm4, xmm0
addss xmm0, dword [edi + edx*8]
movss dword [ecx], xmm0
movss xmm2, dword [edi + edx*8 + 4]
inc edx
movaps xmm0, xmm2
subss xmm0, xmm3
addss xmm3, xmm4
mulss xmm0, xmm6
addss xmm3, xmm0
addss xmm0, xmm2
mulss xmm3, dword [0x5ba6ec]
movss dword [ecx + 4], xmm0
movaps xmm0, xmm2
xorps xmm0, xmm7
subss xmm0, xmm1
addss xmm1, xmm4
mulss xmm0, xmm6
addss xmm1, xmm0
subss xmm0, xmm2
mulss xmm1, xmm1
movss dword [ecx + 8], xmm0
movss dword [esi], xmm3
add esi, 4
addss xmm5, xmm1
cmp edx, eax
jl 0x41af90
pop edi
movaps xmm0, xmm5
pop esi
pop ebp
ret
pop edi
xorps xmm0, xmm0
pop esi
pop ebp
ret
Function at 0x42bcd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 0xc]
push ebx
push esi
mov esi, 0x8000
mov dword [ebp - 0x20], eax
sub esi, dword [ebp + 8]
mov ebx, edx
movzx eax, si
xor edx, edx
mov word [ebp - 0xc], ax
xor eax, eax
shr si, 1
mov word [ebp - 0xa], si
mov word [ebp - 8], ax
push edi
mov edi, ecx
test ebx, ebx
je 0x42bd14
setle dl
inc edx
push ecx
lea eax, [ebp - 0xc]
push eax
call fcn.0041ddd0
mov eax, ebx
add esp, 8
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
je 0x42be36
mov ax, word [ebp + 0xc]
mov esi, 7
mov edx, esi
cmp si, ax
ja 0x42bd43
movzx edx, ax
mov eax, dword [ebp - 0x20]
movzx ecx, ax
mov eax, ecx
mov word [ebp - 0x1c], dx
imul eax, edx
mov edx, 6
sar eax, 0xf
cmp eax, edx
cmovl eax, edx
mov edx, 5
movzx eax, ax
mov word [ebp - 0x1a], ax
imul eax, ecx
sar eax, 0xf
cmp eax, edx
cmovl eax, edx
mov edx, 4
movzx eax, ax
mov word [ebp - 0x18], ax
imul eax, ecx
sar eax, 0xf
cmp eax, edx
cmovl eax, edx
mov edx, 3
movzx eax, ax
mov word [ebp - 0x16], ax
imul eax, ecx
sar eax, 0xf
cmp eax, edx
cmovl eax, edx
mov edx, 2
movzx eax, ax
mov word [ebp - 0x14], ax
imul eax, ecx
sar eax, 0xf
cmp eax, edx
cmovl eax, edx
movzx eax, ax
mov word [ebp - 0x12], ax
imul eax, ecx
mov ecx, 1
sar eax, 0xf
cmp eax, ecx
cmovl eax, ecx
mov word [ebp - 0x10], ax
xor eax, eax
mov word [ebp - 0xe], ax
dec ebx
nop dword [eax]
cmp ebx, 7
lea ecx, [ebp - 0x1c]
mov eax, esi
mov esi, dword [edi + 0x1c]
cmovl eax, ebx
mov edx, esi
shr edx, 0xf
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x20], ecx
test eax, eax
jle 0x42be18
movzx eax, word [ecx - 2]
mov ecx, eax
imul ecx, edx
sub esi, ecx
mov ecx, dword [ebp - 0x20]
add dword [edi + 0x20], esi
movzx ecx, word [ecx]
sub eax, ecx
imul eax, edx
jmp 0x42be22
movzx ecx, word [ecx]
mov eax, esi
imul ecx, edx
sub eax, ecx
mov ecx, edi
mov dword [edi + 0x1c], eax
call fcn.0041dbc0
sub ebx, 7
mov esi, 7
jns 0x42bde0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00457d6e
mov esp, ebp
pop ebp
ret
Function at 0x435470
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x1418
call fcn.0047a320
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
movss xmm1, dword [0x5baf30]
push esi
push edi
mov dword [ebp - 0x1414], ecx
lea edi, [ebp - 0xa10]
mov esi, edx
mov ecx, 0x142
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xa1
lea edx, [ebp - 0x514]
lea esi, [ebp - 0xa10]
lea edi, [ebp - 0xa08]
mov eax, dword [edx - 4]
lea edx, [edx - 0x20]
mov dword [esi + ecx*8], eax
lea esi, [ebp - 0xa00]
movss xmm0, dword [edx + 0x20]
xorps xmm0, xmm1
movss dword [ebp + ecx*8 - 0xa0c], xmm0
mov eax, dword [edx + 0x14]
mov dword [edi + ecx*8], eax
lea eax, [ebp - 0xa04]
movss xmm0, dword [edx + 0x18]
xorps xmm0, xmm1
movss dword [eax + ecx*8], xmm0
mov eax, dword [edx + 0xc]
mov dword [esi + ecx*8], eax
lea eax, [ebp - 0x9fc]
movss xmm0, dword [edx + 0x10]
lea esi, [ebp - 0x9f8]
xorps xmm0, xmm1
movss dword [eax + ecx*8], xmm0
mov eax, dword [edx + 4]
mov dword [esi + ecx*8], eax
lea eax, [ebp - 0x9f4]
movss xmm0, dword [edx + 8]
lea esi, [ebp - 0xa10]
xorps xmm0, xmm1
movss dword [eax + ecx*8], xmm0
add ecx, 4
cmp ecx, 0x13d
jl 0x4354d0
cmp ecx, 0x140
jge 0x435593
lea eax, [ecx*8]
lea edx, [ebp - 0xc]
sub edx, eax
nop word [eax + eax]
mov eax, dword [edx - 4]
lea edx, [edx - 8]
mov dword [esi + ecx*8], eax
movss xmm0, dword [edx + 8]
xorps xmm0, xmm1
movss dword [ebp + ecx*8 - 0xa0c], xmm0
inc ecx
cmp ecx, 0x140
jl 0x435570
movss xmm2, dword [0x5ba5e4]
lea edx, [ebp - 0xa10]
mov ecx, 0x5a1120
movss xmm0, dword [edx]
lea edx, [edx + 8]
movsx eax, word [ecx]
movss xmm1, dword [edx - 4]
mulss xmm0, xmm2
mulss xmm1, xmm2
movss dword [ebp + eax*8 - 0x1410], xmm0
movsx eax, word [ecx]
add ecx, 2
movss dword [ebp + eax*8 - 0x140c], xmm1
cmp ecx, 0x5a13a0
jl 0x4355a6
lea edx, [ebp - 0x1410]
mov ecx, 0x59ff50
call fcn.0042ee40
movss xmm0, dword [ebp - 0x1410]
lea ecx, [ebp - 0xa20]
movss xmm1, dword [0x5ba9f0]
mov esi, 0x27
mov edi, dword [ebp - 0x1414]
mov edx, 0x139
mulss xmm0, xmm1
lea eax, [edi + 0xc]
movss dword [edi], xmm0
nop
movss xmm0, dword [ecx + 8]
lea eax, [eax + 0x20]
mulss xmm0, xmm1
lea ecx, [ecx - 0x40]
movss dword [eax - 0x28], xmm0
movss xmm0, dword [ecx + 0x40]
mulss xmm0, xmm1
movss dword [eax - 0x24], xmm0
movss xmm0, dword [ecx + 0x38]
mulss xmm0, xmm1
movss dword [eax - 0x20], xmm0
movss xmm0, dword [ecx + 0x30]
mulss xmm0, xmm1
movss dword [eax - 0x1c], xmm0
movss xmm0, dword [ecx + 0x28]
mulss xmm0, xmm1
movss dword [eax - 0x18], xmm0
movss xmm0, dword [ecx + 0x20]
mulss xmm0, xmm1
movss dword [eax - 0x14], xmm0
movss xmm0, dword [ecx + 0x18]
mulss xmm0, xmm1
movss dword [eax - 0x10], xmm0
movss xmm0, dword [ecx + 0x10]
mulss xmm0, xmm1
movss dword [eax - 0xc], xmm0
sub esi, 1
jne 0x435620
lea eax, [ebp - 0x13d8]
movss xmm0, dword [eax]
lea eax, [eax - 8]
mulss xmm0, xmm1
movss dword [edi + edx*4], xmm0
inc edx
cmp edx, 0x140
jl 0x4356a1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00457d6e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret