joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.00469579
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0046952e
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
add byte [eax - 0x5225b], al
inc dword [eax]
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.00469579
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0046952e
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.00469569
cwde
ror eax, 0xe5
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
invalid
invalid

Function at 0x46a100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.00469579
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0046952e
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
add byte [eax - 0x5225b], al
inc dword [eax]
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.00469579
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0046952e
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.00469569
cwde
ror eax, 0xe5
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
invalid
invalid
Function at 0x46d400
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x4c36e8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4c3678], esi
je 0x46d479
cmp dword [0x4c3684], esi
je 0x46d479
push 0x12237
call dword [0x4c368c]
push esi
push esi
push edi
call dword [0x4c3678]
cmp dword [0x4c36d0], 0
mov esi, eax
je 0x46d479
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0x4aa26c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x804]
push eax
push edi
call dword [0x4c36d0]
push 0x4c36e8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
setne al
xor ecx, ebp
pop esi
call fcn.00470e77
mov esp, ebp
pop ebp
ret

Function at 0x46d4a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 8]
xor bl, bl
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
push esi
call fcn.00471b44
add esp, 4
mov dword [ebp - 4], eax
push eax
push esi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
mov eax, dword [ebp - 4]
je 0x46d4f0
cmp dword [eax + 0x30], 0x60000
mov ecx, 1
movzx ebx, bl
cmovae ebx, ecx
push eax
call fcn.00471b0c
add esp, 4
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xccc058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00ccc1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xccc07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xccc06a
add dl, dl
jne 0xccc089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xccc0dc
xor eax, eax
add dl, dl
jne 0xccc096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xccc17d
add dl, dl
jne 0xccc0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xccc0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xccc0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xccc0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xccc0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xccc075
mov eax, 1
add dl, dl
jne 0xccc0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xccc0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xccc0e1
sub eax, ebx
mov ebx, 1
jne 0xccc128
mov ecx, 1
add dl, dl
jne 0xccc10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xccc119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xccc105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xccc075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xccc13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xccc14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xccc136
cmp eax, 0x7d00
jae 0xccc16d
cmp eax, 0x500
jb 0xccc168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xccc075
cmp eax, 0x7f
ja 0xccc170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xccc075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xccc19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xccc075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403a81
Capabilities:
Allocate or change rwx memory
Read .ini file

Disassembly:
mov eax, 0x447c63
call fcn.00447b70
sub esp, 0xf4
push ebx
push esi
mov eax, 0xb2d3b
add dword [0x487314], eax
xor ebx, ebx
cmp dword [0x487314], 0x20a
jne 0x403b11
push edi
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_MapWindowPoints]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x402c08
push ebx
push 0x402c2c
push 0x402c54
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
call fcn.00403040
lea eax, [ebp - 0x38]
call fcn.00403d3b
push ebx
mov dword [ebp - 4], ebx
call fcn.00404bd0
push ebx
push ebx
push ebx
call fcn.004051cd
or dword [ebp - 4], 0xffffffff
add esp, 0x10
lea edi, [ebp - 0x38]
call fcn.00403d60
pop edi
xor eax, eax
cmp eax, 0xf027935
jg 0x403b22
inc eax
cmp eax, 0x736251e2
jl 0x403b13
push 0x45ab08
mov byte [0x45ab0d], 0x6c
mov byte [0x45ab0f], 0x32
mov byte [0x45ab10], 0x2e
mov byte [0x45ab0b], 0x6e
mov byte [0x45ab0c], 0x65
mov byte [0x45ab11], 0x64
mov byte [0x45ab0e], 0x33
mov byte [0x45ab12], 0x6c
mov byte [0x45ab13], 0x6c
mov byte [0x45ab14], bl
mov byte [0x45ab08], 0x6b
mov byte [0x45ab09], 0x65
mov byte [0x45ab0a], 0x72
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [0x487314]
mov dword [0x487284], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push dword [0x487314]
mov dword [0x487280], eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x45503c]
xor esi, esi
mov dword [0x4873ec], eax
cmp dword [0x487314], ebx
jbe 0x403c14
mov eax, dword [0x4873ec]
mov dword [ebp - 0x14], eax
mov eax, 0xb2d3b
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov al, byte [eax + esi]
mov ecx, dword [0x487280]
mov byte [ecx + esi], al
cmp dword [0x487314], 0x44
jne 0x403c0b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalShrink]
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
inc esi
cmp esi, dword [0x487314]
jb 0x403bc5
call fcn.004039c4
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
cmp esi, 0x770e
jne 0x403c38
call fcn.00403a5b
inc esi
cmp esi, 0x286c535
jl 0x403c1b
push 0x7b
pop esi
cmp dword [0x487314], 0xd
jne 0x403c79
push 0x30
lea eax, [ebp - 0x68]
push ebx
push eax
mov dword [ebp - 0x6c], ebx
call fcn.00405d70
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigA]
push 0x402c98
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec esi
jne 0x403c44
call fcn.00403a75
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4059ab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x454168]
jne 0x4059b5
repz ret
jmp fcn.0040c75c
Function at 0x40ccee
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00408f0d
and dword [ebp - 4], 0
cmp dword [0x45a9f4], 0
mov ebx, eax
jne 0x40cd9f
push 0x401ae4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ce50
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401ad8
push edi
call esi
test eax, eax
je 0x40ce50
push eax
call fcn.00408e9b
mov dword [esp], 0x401ac8
push edi
mov dword [0x45a9f4], eax
call esi
push eax
call fcn.00408e9b
mov dword [esp], 0x401ab4
push edi
mov dword [0x45a9f8], eax
call esi
push eax
call fcn.00408e9b
mov dword [esp], 0x401a98
push edi
mov dword [0x45a9fc], eax
call esi
push eax
call fcn.00408e9b
pop ecx
mov dword [0x45aa04], eax
test eax, eax
je 0x40cd9f
push 0x401a80
push edi
call esi
push eax
call fcn.00408e9b
pop ecx
mov dword [0x45aa00], eax
mov eax, dword [0x45aa00]
cmp eax, ebx
je 0x40cdf7
cmp dword [0x45aa04], ebx
je 0x40cdf7
push eax
call fcn.00408f16
push dword [0x45aa04]
mov esi, eax
call fcn.00408f16
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40cdf7
test edi, edi
je 0x40cdf7
call esi
test eax, eax
je 0x40cdee
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40cdee
test byte [ebp - 0xc], 1
jne 0x40cdf7
or dword [ebp + 0x10], 0x200000
jmp 0x40ce30
mov eax, dword [0x45a9f8]
cmp eax, ebx
je 0x40ce30
push eax
call fcn.00408f16
pop ecx
test eax, eax
je 0x40ce30
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ce30
mov eax, dword [0x45a9fc]
cmp eax, ebx
je 0x40ce30
push eax
call fcn.00408f16
pop ecx
test eax, eax
je 0x40ce30
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45a9f4]
call fcn.00408f16
pop ecx
test eax, eax
je 0x40ce50
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ce52
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x9d4550
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x9d4640
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x9d4640
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x9d459a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x9d45a1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x9d4580
jmp 0x9d45a3
mov esi, 0x1505
jmp 0x9d45a3
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
mov edx, ebx
sub edx, 1
jb 0x9d4640
mov ecx, esi
not ecx
or edx, ecx
mov eax, ebx
and eax, 0xfffffffe
add eax, eax
mov ecx, ebx
xor ecx, 1
sub eax, ecx
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
lea ebp, [esi + edx]
inc ebp
jmp 0x9d45e4
inc ebp
dec ebx
je 0x9d463e
mov eax, ebp
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x9d463e
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x9d45e0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp], eax
push eax
call fcn.009dc9c0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x9d45e0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.009dc9e0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x9d45e0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x9d4640
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x9f8090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x1c
mov ebx, esp
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x5c], 0xf935fbd7
mov dword [ebp - 0x58], 0xe576e768
mov dword [ebp - 0x54], 0xe10de328
mov dword [ebp - 0x50], 0xed01ef7c
mov dword [ebp - 0x4c], 0xe90eebc7
mov dword [ebp - 0x48], 0x957e9714
mov dword [ebp - 0x44], 0x9100930f
mov dword [ebp - 0x40], 0x9d759f7c
mov dword [ebp - 0x3c], 0x99749b02
mov dword [ebp - 0x38], 0x8518870f
mov dword [ebp - 0x34], 0x81668368
mov dword [ebp - 0x30], 0x8d108f70
mov dword [ebp - 0x2c], 0x89608b1d
mov dword [ebp - 0x28], 0xb522b71f
mov dword [ebp - 0x24], 0xb12fb35f
lea eax, [ebp - 0x20]
mov word [ebp - 0x20], 0xbfb0
mov dword [ebp - 0x1e], 0
mov byte [ebp - 0x1a], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xab
xor dl, byte [ebp + ecx - 0x5c]
add dl, 0xa9
mov byte [ebp + ecx - 0x5c], dl
inc ecx
cmp ecx, 0x43
jne 0x9f8130
lea esi, [ebp - 0x9a]
lea edx, [ebp - 0x5c]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [ebp - 0x5e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, dword [ebp - 0x10]
push edi
push 0
push 0
push 0x1e
push esi
push 0
call dword [0xa20370]
mov edi, dword [edi]
test edi, edi
jns 0x9f8189
mov eax, 0xffffffff
jmp 0x9f818c
lea eax, [edi + edi]
push eax
call fcn.009dc880
add esp, 4
push dword [ebp - 0x10]
push edi
mov dword [ebp - 0x14], eax
push eax
push 0x1e
lea eax, [ebp - 0x9a]
push eax
push 0
call dword [0xa20370]
mov dword [ebx], 0x137a116c
mov dword [ebx + 4], 0x1f881d81
mov dword [ebx + 8], 0x1b771974
mov dword [ebx + 0xc], 0x7640596
mov dword [ebx + 0x10], 0x3900169
mov dword [ebx + 0x14], 0xf0e0d60
mov word [ebx + 0x18], 0
mov byte [ebx + 0x1a], 0
xor edx, edx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx + ecx]
mov dword [ebp - 0x10], eax
mov edi, ecx
xor edi, 0x3cfb82b2
mov esi, edx
and esi, 0x1a
sub esi, edi
lea ebx, [esi + 0x1ed585b6]
and ebx, eax
mov eax, ebx
and eax, 0xfffffffd
mov edi, ebx
or edi, 0xfd
inc edi
imul edi, eax
mov eax, ebx
and eax, 2
or ebx, 2
imul ebx, eax
sub edi, ebx
mov ebx, dword [ebp - 0x18]
lea eax, [edi + esi]
add eax, 0x1ed585b6
add al, byte [ebp - 0x10]
add al, 0xec
mov byte [ebx + ecx], al
inc ecx
add edx, 2
cmp ecx, 0x1b
jne 0x9f81f0
push 0
push 0
push ebx
mov esi, dword [ebp - 0x14]
push esi
push dword [ebp + 8]
call fcn.009f35b0
add esp, 0x14
jmp dword [0xa1bfc8]
Function at 0xa2cc90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x460
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x5c], 0x49c64bc1
mov dword [esp + 0x60], 0x45d947d3
mov dword [esp + 0x64], 0x419043d7
mov dword [esp + 0x68], 0x7df67fdb
mov dword [esp + 0x6c], 0x797a7be7
mov byte [esp + 0x70], 0
xor eax, eax
nop
nop
movzx ecx, byte [esp + eax + 0x5c]
mov edx, eax
and edx, 0xd
xor edx, 0x76d8c3ed
mov esi, eax
and esi, 0x12
sub esi, edx
mov edx, esi
not edx
lea edx, [esi + edx*2]
inc edx
xor edx, esi
and edx, ecx
xor edx, esi
mov ecx, edx
and ecx, 0x8243418
xor edx, 0xfc74b418
lea ecx, [edx + ecx*2]
add ecx, 0x523bd3a0
mov edx, ecx
xor edx, 0xe7
and ecx, 0x67
lea ecx, [edx + ecx*2]
add cl, 2
mov byte [esp + eax + 0x5c], cl
inc eax
cmp eax, 0x15
jne 0xa2ccf0
lea ebx, [esp + 0x5c]
lea ecx, [esp + 0x40]
push ebx
call fcn.00a3fec0
shr eax, 0x1f
jmp dword [eax*4 + 0xa1c6e0]
Function at 0xa3fec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0xf4f5f6f7
mov eax, 0x92bb3fd4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x6d44c02c]
xor ecx, eax
mov edx, ecx
not edx
add ecx, 0x2257c0db
or edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
mov byte [esp + eax + 0x6d44c02c], cl
inc eax
cmp eax, 0x92bb3fd8
jne 0xa3fef0
mov edi, dword [esp]
mov eax, dword [0xa20374]
test eax, eax
je 0xa3ff76
xor ecx, ecx
mov edx, dword [0xa20378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0xa3ff50
inc ecx
cmp eax, ecx
jne 0xa3ff40
jmp 0xa3ff76
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0xa3ff76
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0xa2037c]
push eax
call fcn.00a42b10
add esp, 0x1c
mov edi, eax
mov dword [esp], 0xff3e393c
mov byte [esp + 4], 0
mov eax, 0x7302b58a
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x7302b58a]
xor ecx, eax
mov edx, ecx
and edx, 0x4d
xor ecx, 0x4d
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x7302b58a], cl
inc eax
cmp eax, 0x7302b58f
jne 0xa3ff90
cmp edi, dword [esp]
jne 0xa400c5
mov dword [esp + 0xc], esi
push dword [esp + 8]
call fcn.00a3fdb0
add esp, 4
mov ebp, dword [esp + 8]
mov dword [esp], 0xf4f5f6f7
mov edx, 0x92bb3fd4
nop
movzx ecx, byte [esp + edx + 0x6d44c02c]
xor ecx, edx
mov esi, ecx
not esi
add ecx, 0x2257c0db
or esi, ecx
and esi, 1
or ecx, 1
add ecx, esi
mov byte [esp + edx + 0x6d44c02c], cl
inc edx
cmp edx, 0x92bb3fd8
jne 0xa3ffe0
mov edi, dword [esp]
mov edx, dword [0xa20374]
test edx, edx
je 0xa40065
xor ecx, ecx
mov esi, dword [0xa20378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ecx*8], 0x9abdb589
je 0xa40040
inc ecx
cmp edx, ecx
jne 0xa40030
jmp 0xa40065
mov edx, dword [esi + ecx*8 + 4]
cmp edx, edi
je 0xa40065
push 0
push ebp
push eax
push 5
push 4
push dword [0xa2037c]
push edx
mov esi, eax
call fcn.00a42b10
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0xa400bc
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0xa40095
add edi, 2
cmp si, bp
je 0xa40080
cmp si, bp
je 0xa400a7
mov esi, dword [ecx]
test esi, esi
jne 0xa40070
mov edi, 0xc0000225
jmp 0xa400bc
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.00a3fe10
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0xa40ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0xa40ac9
lea edi, [esp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0xa40ada
cmp eax, 2
je 0xa40b4c
jmp 0xa40b79
push 0xbbf966b4
push dword [0xa20368]
call fcn.00a45690
add esp, 8
test eax, eax
je 0xa40b17
mov ecx, dword [esi]
test ecx, ecx
je 0xa40b44
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0xa40b20
cmp dword [esp], 0
je 0xa40b20
mov dword [esi + 4], 3
jmp 0xa40b44
mov dword [esi + 4], 1
jmp 0xa40b79
lea eax, [esp + 4]
push eax
call fcn.00a45f20
add esp, 4
test al, al
je 0xa40b44
mov eax, dword [esp + 4]
mov ecx, 2
cmp eax, 3
je 0xa40b41
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0xa40b79
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0xa28390]
call fcn.00a45690
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0xa40c14
mov ecx, dword [esi]
mov dword [esp], 0xf4f5f6f7
mov eax, 0x92bb3fd4
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x6d44c02c]
xor edx, eax
mov esi, edx
not esi
add edx, 0x2257c0db
or esi, edx
and esi, 1
or edx, 1
add edx, esi
mov byte [esp + eax + 0x6d44c02c], dl
inc eax
cmp eax, 0x92bb3fd8
jne 0xa40b90
mov eax, dword [esp]
mov edx, dword [0xa20374]
test edx, edx
je 0xa40c14
xor esi, esi
mov ebx, dword [0xa20378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0xa40bf0
inc esi
cmp edx, esi
jne 0xa40be0
jmp 0xa40c14
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0xa40c14
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0xa2037c]
push edx
call fcn.00a42b10
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0xa440e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc eax, 0
xor edx, edx
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, eax
mov esi, dword [esp + 0x28]
jb 0xa44150
mov ecx, ebx
shr ecx, 2
mov eax, ebp
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0xa442ee
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0xa442ee
mov dword [esp], 0x282b2a25
mov byte [esp + 4], 0
nop
nop
nop
nop
mov ebp, edx
shr ebp, 1
and ebp, 1
movzx ecx, byte [esp + edx]
mov edi, edx
and edi, 5
mov eax, edx
or eax, 0xfffffffd
inc eax
imul eax, edi
mov edi, edx
or edi, 2
imul edi, ebp
add edi, edi
sub eax, edi
add eax, edx
add eax, 0x3773c848
xor eax, ecx
mov ecx, eax
not ecx
and ecx, 1
xor eax, 0xfe
lea eax, [eax + ecx*2]
add al, 0x6c
mov byte [esp + edx], al
inc edx
cmp edx, 5
jne 0xa44160
mov eax, dword [esp]
mov ecx, dword [0xa20374]
test ecx, ecx
je 0xa441e0
xor edx, edx
mov edi, dword [0xa20378]
mov ebp, dword [esp + 0x20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0xa441e6
inc edx
cmp ecx, edx
jne 0xa441d0
jmp 0xa44210
mov ebp, dword [esp + 0x20]
jmp 0xa44210
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0xa44210
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0xa2037c]
push ecx
call fcn.00a42b10
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0xa442ee
push 0x732f71fd
push dword [0xa28390]
call fcn.00a45690
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x282b2a25
mov byte [esp + 4], 0
xor edx, edx
nop
mov edi, edx
shr edi, 1
and edi, 1
movzx esi, byte [esp + edx]
mov ebx, edx
and ebx, 5
mov ebp, edx
or ebp, 0xfffffffd
inc ebp
imul ebp, ebx
mov ebx, edx
or ebx, 2
imul ebx, edi
add ebx, ebx
sub ebp, ebx
lea edi, [edx + ebp]
add edi, 0x3773c848
xor edi, esi
mov esi, edi
not esi
and esi, 1
xor edi, 0xfe
lea ebx, [edi + esi*2]
add bl, 0x6c
mov byte [esp + edx], bl
inc edx
cmp edx, 5
jne 0xa44250
mov edx, dword [0xa20374]
test edx, edx
je 0xa442ee
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0xa20378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0xa442d0
inc edi
cmp edx, edi
jne 0xa442c0
jmp 0xa442ee
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0xa442ee
push ecx
push 1
push dword [0xa2037c]
push edx
mov esi, eax
call fcn.00a42b10
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret