joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4173d0
Capabilities:
Authenticate hmac
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov esi, esp
mov ecx, dword [ebp + 0x10]
push eax
sub esp, 0x14
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x50], eax
mov esp, eax
push eax
sub esp, 0x1c
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x74], eax
mov esp, eax
push eax
sub esp, 0x34
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0xc0], eax
mov esp, eax
push eax
sub esp, 0x1c
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x78], eax
mov esp, eax
push eax
sub esp, 0x1c
mov dword [esi + 0x4c], esp
sub esp, 0x28
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x54], eax
mov esp, eax
push eax
mov dword [esi + 0x48], esp
push eax
mov dword [esi + 0x6c], esp
sub esp, 0x48
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x38], eax
mov esp, eax
push eax
sub esp, 0x2c
mov dword [esi + 0x40], esp
sub esp, 0x38
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x60], eax
mov esp, eax
push eax
mov dword [esi + 0x68], esp
sub esp, 0x18
mov dword [esi + 0x44], esp
sub esp, 0x20
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x70], eax
mov esp, eax
push eax
mov dword [esi + 0x64], esp
sub esp, 0x10
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x5c], eax
mov esp, eax
xor eax, eax
test ecx, ecx
setne al
xor ebx, ebx
mov dword [esi + 0x34], 0
jmp dword [eax*4 + 0x44124c]
Function at 0x41f332
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x2218
call fcn.00408d10
mov dword [esp + 0x1210], 0xc390c19c
mov dword [esp + 0x1214], 0xc781c581
mov dword [esp + 0x1218], 0xcb99c981
mov dword [esp + 0x121c], 0xcf9ccd98
mov dword [esp + 0x1220], 0xd38ed189
mov dword [esp + 0x1224], 0xd785d581
mov dword [esp + 0x1228], 0xdb88d99d
mov word [esp + 0x122c], 0xdddc
mov dword [esp + 0x122e], 0
mov byte [esp + 0x1232], 0
mov dword [esp + 0xaa0], 0
mov eax, dword [esp + 0xaa0]
cmp eax, 0x22
ja 0x41f24b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xaa0]
mov ecx, dword [esp + 0xaa0]
movzx ecx, byte [esp + ecx + 0x1210]
lea edx, [eax + ecx]
add edx, 0x91982e0
add eax, 0x91982e0
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0xa0], edx
mov eax, dword [esp + 0xa0]
add al, 0xe0
mov ecx, dword [esp + 0xaa0]
mov byte [esp + ecx + 0x1210], al
inc dword [esp + 0xaa0]
mov eax, dword [esp + 0xaa0]
cmp eax, 0x23
jb 0x41f1f0
lea eax, [esp + 0x24]
lea esi, [esp + 0x1210]
push 0
push 0
push 0x20019
push eax
push esi
call fcn.0043acf0
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0x4420fc]
jmp dword [0x442124]
lea eax, [esp + 0x60]
lea ecx, [esp + 0x64]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push dword [esp + 0x44]
call fcn.0043b100
add esp, 0x24
nop
nop
nop
nop
nop
lea eax, [esp + 0x60]
lea ecx, [esp + 0x64]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push dword [esp + 0x44]
call fcn.0043b100
add esp, 0x24
jmp dword [0x442130]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442134]
jmp case.0x41f26c.9
jmp dword [0x44210c]
mov eax, dword [case.0x41f26c.9]
nop
nop
nop
nop
nop
jmp eax
xor ebx, ebx
jmp 0x420d69
mov eax, dword [case.0x41f26c.19]
nop
nop
jmp eax
mov dword [esp + 0x54], 0
xor ebx, ebx
jmp 0x41f311
mov eax, dword [case.0x41f26c.23]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov eax, dword [esp + 0x64]
mov ecx, dword [case.0x41f26c.27]
mov dword [esp + 0xc], esi
jmp ecx
xor ecx, ecx
cmp ebx, eax
setb cl
jmp dword [ecx*4 + 0x44216c]
mov edi, dword [esp + 0x60]
mov eax, edi
inc eax
lea eax, [edi + edi + 2]
jns 0x41f352
mov eax, 0xffffffff
push eax
call fcn.00408d40
add esp, 4
mov dword [esp + 0x88], edi
mov edi, eax
lea eax, [esp + 0x88]
push eax
push edi
push ebx
push dword [esp + 0x30]
call fcn.0043ae30
add esp, 0x10
not eax
shr eax, 0x1f
mov esi, dword [esp + 0xc]
jmp dword [eax*4 + 0x442194]
jmp dword [0x44217c]
jmp dword [0x442190]
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x422260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.00422280
add esp, 4
test al, al
je 0x422273
mov al, 1
ret
jmp fcn.00422a60
Function at 0x432770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
lea eax, [esp + 0x20]
push 0x68
push 7
push 0x100080
push eax
push dword [ebp + 8]
call fcn.0043a480
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4441d8]
Function at 0x432a90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov esi, 0xffffffff
cmp byte [edi + esi + 1], 0
lea esi, [esi + 1]
jne 0x432aa0
mov eax, esi
and eax, 0xfffffffc
mov dword [esp], esi
mov ecx, dword [esp]
and ecx, 3
mov edx, dword [esp]
or edx, 3
imul edx, ecx
xor ecx, 3
imul ecx, eax
add edx, ecx
shr edx, 2
mov eax, dword [esp]
or eax, 0xfffffffe
mov ecx, dword [esp]
and ecx, 0xfffffffe
add ecx, eax
cmp byte [edi + ecx + 1], 0x3d
mov ecx, dword [esp]
je 0x432aeb
cmp byte [edi + ecx - 1], 0x2e
jne 0x432aec
dec edx
movzx eax, byte [edi + ecx - 2]
cmp eax, 0x3d
je 0x432afb
cmp eax, 0x2e
jne 0x432afc
dec edx
mov dword [esp + 4], edx
mov edx, 0
test ecx, ecx
je 0x432bf7
xor esi, esi
mov ebp, 2
jmp 0x432b32
lea eax, [ebp + 4]
add ebp, 2
mov esi, edx
cmp ebp, ecx
mov ebp, eax
jae 0x432bf7
mov edi, dword [esp + 0x40]
movzx eax, byte [edi + ebp - 2]
push eax
call fcn.004187f0
add esp, 4
mov ebx, eax
movzx eax, byte [edi + ebp - 1]
push eax
call fcn.004187f0
add esp, 4
mov bh, al
shl bl, 2
shr al, 4
and al, 3
or al, bl
lea edx, [esi + 1]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi], al
mov ecx, dword [esp]
cmp ebp, ecx
jae 0x432b20
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 0xc], edx
call fcn.004187f0
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
add esp, 4
cmp al, 0x40
je 0x432b20
mov bl, al
shl bh, 4
shr al, 2
and al, 0xf
or al, bh
lea edx, [esi + 2]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi + 1], al
mov ecx, dword [esp]
lea eax, [ebp + 1]
cmp eax, ecx
jae 0x432b20
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp + 1]
push eax
mov dword [esp + 0xc], edx
call fcn.004187f0
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
add esp, 4
cmp al, 0x40
je 0x432b20
shl bl, 6
add al, bl
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi + 2], al
mov ecx, dword [esp]
add esi, 3
mov edx, esi
jmp 0x432b20
mov esi, dword [esp + 4]
cmp edx, esi
mov eax, 0
jne 0x432cb5
mov ebx, dword [esp + 0x44]
lea edx, [ebx + 0x20]
lea edi, [esp + 0xc]
mov eax, ebx
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x2c]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov edi, ebx
mov eax, esi
add eax, 0xffffffe0
je 0x432cb1
cmp esi, 0x21
je 0x432c8e
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebp
and edx, 0x1e
mov dh, byte [esp + edx + 0xc]
movzx ebx, byte [edi + ebp + 0x20]
mov dl, byte [edi + ebp + 0x21]
mov bh, dh
and bh, bl
add dh, bl
add bh, bh
sub dh, bh
mov byte [edi + ebp], dh
lea esi, [ebp + 1]
and esi, 0x1f
mov dh, byte [esp + esi + 0xc]
mov bl, dh
and bl, dl
add dh, dl
add bl, bl
sub dh, bl
mov byte [edi + ebp + 1], dh
add ebp, 2
cmp ecx, ebp
jne 0x432c50
test byte [esp + 4], 1
je 0x432cb1
movzx ecx, byte [edi + ebp + 0x20]
mov edx, ebp
and edx, 0x1f
movzx edx, byte [esp + edx + 0xc]
mov ch, dl
and ch, cl
add dl, cl
add ch, ch
sub dl, ch
mov byte [edi + ebp], dl
mov byte [edi + eax], 0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4361e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0x2050407
mov dword [esp + 0x14], 0
mov dword [esp + 0x17], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x436262
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + 0x3e506d01]
inc eax
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov ecx, eax
xor ecx, 0xf8
and eax, 0x78
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x436220
mov ebx, dword [esp + 0x10]
mov eax, dword [0x446c20]
test eax, eax
je 0x4362c0
xor ecx, ecx
mov edx, dword [0x446c24]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xe4aa2089
je 0x43629a
mov esi, ecx
and esi, 1
xor ecx, 1
lea ecx, [ecx + esi*2]
cmp ecx, eax
jb 0x436280
jmp 0x4362c0
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebx
je 0x4362c0
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x446c28]
push eax
call fcn.00437df0
add esp, 0x1c
mov ebx, eax
cmp ebx, 0xc0000004
jne 0x436418
push dword [esp + 8]
call fcn.00435ff0
add esp, 4
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], 0x2050407
mov dword [esp + 0x14], 0
mov dword [esp + 0x17], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xa
ja 0x436352
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x10]
lea esi, [ecx + 0x3e506d01]
inc ecx
and ecx, edx
or esi, edx
sub esi, ecx
mov dword [esp + 0xc], esi
mov ecx, dword [esp + 0xc]
mov edx, ecx
xor edx, 0xf8
and ecx, 0x78
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esp]
mov byte [esp + edx + 0x10], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xb
jb 0x436310
mov ebx, dword [esp + 0x10]
mov ecx, dword [0x446c20]
test ecx, ecx
je 0x4363a4
xor edx, edx
mov esi, dword [0x446c24]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe4aa2089
je 0x436380
inc edx
cmp ecx, edx
jne 0x436370
jmp 0x4363a4
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, ebx
je 0x4363a4
push 0
push eax
push dword [esp + 0xc]
push 5
push 4
push dword [0x446c28]
push ecx
call fcn.00437df0
add esp, 0x1c
mov ebx, eax
test ebx, ebx
js 0x43640c
mov dword [esp + 0x20], edi
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 4]
mov esi, dword [ecx]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebx]
movzx edi, word [eax + ebx]
test si, si
je 0x4363e5
add ebx, 2
cmp si, di
je 0x4363d0
cmp si, di
je 0x4363f7
mov esi, dword [ecx]
test esi, esi
jne 0x4363c0
mov ebx, 0xc0000225
jmp 0x43640c
mov eax, dword [ecx + 0x44]
mov edx, dword [esp + 0x20]
mov dword [edx + 4], eax
mov eax, dword [ecx + 0xdc]
mov dword [edx + 8], eax
xor ebx, ebx
push dword [esp + 4]
call fcn.004360f0
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x436450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov edx, dword [ecx + 4]
test edx, edx
je 0x436550
xor eax, eax
cmp dword [ecx], 0
jne 0x436555
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], edx
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 8], 0x2050407
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x436522
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea esi, [eax + 0x3e506d01]
inc eax
and eax, edx
or esi, edx
sub esi, eax
mov dword [esp + 4], esi
mov eax, dword [esp + 4]
mov edx, eax
xor edx, 0xf8
and eax, 0x78
lea eax, [edx + eax*2]
inc al
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x4364e0
mov eax, dword [esp + 8]
mov esi, dword [0x446c20]
test esi, esi
je 0x436555
mov edx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x446c24]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x94b236a1
je 0x43655f
inc edi
cmp esi, edi
jne 0x436540
jmp 0x436555
mov eax, 0xc0000008
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x436555
lea eax, [esp + 0x1c]
lea edi, [esp + 0x24]
push eax
push edi
push edx
push ecx
push 4
push dword [0x446c28]
push esi
call fcn.00437df0
add esp, 0x1c
jmp 0x436555

Function at 0x436590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
test eax, eax
je 0x436667
mov esi, ecx
mov dword [esp + 8], 0x2050407
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xa
ja 0x436612
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + 0x3e506d01]
inc ecx
and ecx, edx
or edi, edx
sub edi, ecx
mov dword [esp + 4], edi
mov ecx, dword [esp + 4]
mov edx, ecx
xor edx, 0xf8
and ecx, 0x78
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xb
jb 0x4365d0
mov ecx, dword [0x446c20]
test ecx, ecx
je 0x43665a
mov edx, dword [esp + 8]
xor edi, edi
mov ebx, dword [0x446c24]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x11081610
je 0x436640
inc edi
cmp ecx, edi
jne 0x436630
jmp 0x43665a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43665a
push eax
push 1
push dword [0x446c28]
push ecx
call fcn.00437df0
add esp, 0x10
mov dword [esi], 0
mov dword [esi + 4], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, 0xc0000008
cmp dword [ecx + 4], 0
je 0x43685e
mov esi, ecx
mov eax, dword [ecx]
test eax, eax
je 0x43685e
mov dword [esp + 8], 0x2050407
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xa
ja 0x436702
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + 0x3e506d01]
inc ecx
and ecx, edx
or edi, edx
sub edi, ecx
mov dword [esp + 0x18], edi
mov ecx, dword [esp + 0x18]
mov edx, ecx
xor edx, 0xf8
and ecx, 0x78
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xb
jb 0x4366c0
mov ebx, dword [ebp + 0x10]
mov edi, dword [esp + 8]
mov edx, dword [0x446c20]
test edx, edx
je 0x436755
xor ecx, ecx
mov ebx, dword [0x446c24]
nop
nop
nop
nop
nop
cmp dword [ebx + ecx*8], 0xac3673b8
je 0x436733
inc ecx
cmp edx, ecx
jne 0x436720
mov ebx, dword [ebp + 0x10]
jmp 0x436755
mov ecx, dword [ebx + ecx*8 + 4]
cmp ecx, edi
mov ebx, dword [ebp + 0x10]
je 0x436755
push dword [ebp + 8]
push eax
push 2
push dword [0x446c28]
push ecx
call fcn.00437df0
add esp, 0x14
mov edi, eax
cmp dword [ebp + 0xc], 1
mov eax, ebx
sbb eax, 0
jl 0x436853
cmp edi, 0xc000010a
jne 0x436853
mov ecx, 0xffffd8f0
mov edi, dword [ebp + 0xc]
mov eax, edi
mul ecx
sub edx, edi
imul ecx, ebx, 0xffffd8f0
add ecx, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esi]
mov dword [esp + 8], 0x2050407
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0xa
ja 0x436805
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + 0x3e506d01]
inc ecx
and ecx, edx
or edi, edx
sub edi, ecx
mov dword [esp], edi
mov ecx, dword [esp]
mov edx, ecx
xor edx, 0xf8
and ecx, 0x78
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0xb
jb 0x4367c0
mov edi, dword [esp + 8]
mov ecx, dword [0x446c20]
test ecx, ecx
je 0x436853
xor edx, edx
mov ebx, dword [0x446c24]
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0xb33e16a3
je 0x436830
inc edx
cmp ecx, edx
jne 0x436820
jmp 0x436853
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, edi
je 0x436853
lea edx, [esp + 0x18]
push edx
push 0
push eax
push 3
push dword [0x446c28]
push ecx
call fcn.00437df0
add esp, 0x18
mov edi, eax
test edi, edi
js 0x43685e
mov ecx, esi
call fcn.00436590
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x436870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x436887
lea edx, [esp + 0x18]
mov ecx, dword [ecx]
mov dword [esp + 8], 0x2050407
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x4368f2
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 8]
lea edi, [eax + 0x3e506d01]
inc eax
and eax, esi
or edi, esi
sub edi, eax
mov dword [esp + 4], edi
mov eax, dword [esp + 4]
mov esi, eax
xor esi, 0xf8
and eax, 0x78
lea eax, [esi + eax*2]
inc al
mov esi, dword [esp]
mov byte [esp + esi + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x4368b0
mov eax, dword [esp + 8]
mov esi, dword [0x446c20]
test esi, esi
je 0x436944
xor edi, edi
mov ebx, dword [0x446c24]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xc99a73c4
je 0x436920
inc edi
cmp esi, edi
jne 0x436910
jmp 0x436944
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x436944
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push 5
push dword [0x446c28]
push esi
call fcn.00437df0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x438a60
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [esp + 0x20], 0x8b8a6b59
mov dword [esp + 0x24], 0
mov word [esp + 0x28], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 9
ja 0x438af5
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx esi, byte [esp + ecx + 0x20]
lea ecx, [edx + esi]
add ecx, 0x35fdbe42
add edx, 0x35fdbe42
mov edi, esi
not edi
or edi, edx
add edi, esi
and edx, esi
add edx, edi
inc edx
mov esi, edx
xor esi, ecx
not edx
and edx, ecx
add edx, edx
sub edx, esi
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
add cl, 0x32
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x20], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0xa
jb 0x438aa0
xor ecx, ecx
cmp dword [esp + 0x20], eax
setne cl
xor eax, eax
mov ebx, dword [ebp + 8]
jmp dword [ecx*4 + 0x444e08]
jmp dword [0x444e14]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x444e30]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ebx + ecx]
mov dword [esp + 0x20], 0x33344e46
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 0
mov dword [esp + 4], 0
mov edx, dword [esp + 4]
cmp edx, 8
ja 0x4390ee
nop
nop
mov edx, dword [esp + 4]
mov esi, dword [esp + 4]
movzx esi, byte [esp + esi + 0x20]
lea edi, [edx + 0x29]
and edi, esi
add edx, esi
add edi, edi
sub edx, edi
add edx, 0x333e9a29
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 0xe1
mov esi, dword [esp + 4]
mov byte [esp + esi + 0x20], dl
inc dword [esp + 4]
mov edx, dword [esp + 4]
cmp edx, 9
jb 0x4390b0
jmp dword [0x444e1c]
mov dword [esp + 0x20], 0x33344e46
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 8
ja case.0x438b03.3
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x20]
lea edx, [eax + 0x29]
and edx, ecx
add eax, ecx
add edx, edx
sub eax, edx
add eax, 0x333e9a29
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0xe1
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x20], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 9
jb 0x439120
jmp case.0x438b03.3
xor edx, edx
cmp eax, dword [esp + 0x20]
setne dl
jmp dword [edx*4 + 0x444e20]
xor edx, edx
cmp dword [ebx + ecx + 0x7c], 0
sete dl
xor eax, eax
jmp dword [edx*4 + 0x444e48]
Function at 0x4391b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 0x18], 0x63626130
mov dword [esp + 0x1c], 0
mov byte [esp + 0x20], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x439229
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x18]
lea edx, [eax + ecx]
add edx, 0x3bbf3a50
add eax, 0x3bbf3a50
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
mov ecx, eax
xor ecx, 0xcf
and eax, 0x4f
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb case.default.0x439239
mov eax, dword [esp + 0x18]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
jmp dword [ecx*4 + 0x445584]
jmp dword [0x445594]
mov ecx, dword [eax + 0xc]
add ecx, 0xc
mov esi, dword [0x4455c0]
mov dword [esp + 4], 0
mov edi, dword [ecx]
xor eax, eax
cmp edi, ecx
setne al
mov ebx, dword [0x4455d8]
mov dword [esp + 0xc], ecx
jmp dword [eax*4 + 0x44559c]
mov edx, dword [edi + 0x30]
xor eax, eax
test edx, edx
setne al
mov dword [esp + 8], 1
jmp dword [eax*4 + 0x4455a4]
nop
nop
nop
nop
jmp esi
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4395f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ecx, dword [ebp + 8]
mov dword [esp + 8], 0x63646536
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x13], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xe
ja 0x43965e
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
add eax, 0xd3452271
xor eax, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0xe9
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xf
jb 0x439630
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x445634]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov edi, dword [case.0x43966c.10]
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x44563c]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
mov edi, dword [case.0x43966c.10]
jmp dword [ebx*4 + 0x44563c]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x445644]
mov ebx, 1
jmp dword [ebx*4 + 0x44564c]
mov eax, dword [esi + 0x30]
xor ebx, ebx
jmp dword [ebx*4 + 0x44564c]
jmp edi
mov esi, dword [esi]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x44563c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret