joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp fcn.00431219
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x4212d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x19000]
push edi
jmp 0x4212ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4212f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4212e0
mov eax, 1
add ebx, ebx
jne 0x421303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4212f8
jne 0x421314
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4212f8
xor ecx, ecx
sub eax, 3
jb 0x421328
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42139a
mov ebp, eax
add ebx, ebx
jne 0x421333
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x421340
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x421364
inc ecx
add ebx, ebx
jne 0x421350
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x421345
jne 0x421361
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421345
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x421384
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x421375
jmp 0x4212e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x421384
add edi, ecx
jmp 0x4212e6
pop esi
mov edi, esi
mov ecx, 0x6d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4213a2
cmp byte [edi], 2
jne 0x4213a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4213a7
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x42141f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x27264]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x272a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4213d4
mov ecx, edi
jns 0x421403
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x272a8]
or eax, eax
je 0x421419
mov dword [ebx], eax
add ebx, 4
jmp 0x4213f1
call dword [esi + 0x272a4]
mov ebp, dword [esi + 0x272ac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x421453
sub esp, 0xffffff80
jmp 0x4016b4
Function at 0x40193e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401951
push esp
mov dword [ebp - 0x24], 0x4016b5
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019f0
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4019d1
pop ebp
ret 0x10
Function at 0x401000
Capabilities:
Delete directory
Delete file
Delete registry value
Delete service
Enumerate files on windows
Get common file path
Persist via run registry key
Stop service

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x96c
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x401084
push eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [0x405048], eax
pop edx
test eax, eax
je 0x401070
push esi
push 0xf01ff
push str.shttps
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [0x405044], eax
pop edi
test eax, eax
je 0x401084
lea edx, [ebp - 0x958]
push ecx
push edx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
push ebx
push ebx
push dword [0x405044]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
add esp, 0xc
jmp 0x401084
push 0
push str.Error
push str.Cant_open_SCM
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push eax
push section..bss
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov eax, dword [section..bss]
pop edx
test eax, eax
je 0x4010c2
push edi
push edi
push str.http.exe
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push eax
push dword [section..bss]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0xc
mov ebx, 0x402208
mov eax, dword [ebx]
add ebx, 4
test eax, eax
je 0x4010f6
lea esi, [ebp - 0x418]
push eax
push 0x402008
push str._s_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
jmp 0x4010c7
mov dword [ebp - 0x970], 2
mov eax, 2
lea edx, [ebp - 0x95c]
push ebx
push edx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
pop esi
test eax, eax
je 0x401139
cmp dword [ebp - 0x970], 1
mov eax, 0x17
je 0x4011e9
mov dword [ebp - 0x970], 1
jmp 0x401105
lea esi, [ebp - 0x418]
push ecx
lea ebx, [ebp - 0x818]
push ecx
push esi
push dword [ebp - 0x95c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
sub esp, 0xc
push esi
push str._sSmall_HTTP_server.
push ebx
call edi
lea eax, [ebp - 0x958]
add esp, 0x18
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x96c], eax
inc eax
pop edx
pop ecx
je 0x40111b
cmp byte [ebp - 0x92c], 0x2e
je 0x4011a7
lea eax, [ebp - 0x92c]
push eax
push esi
push str._sSmall_HTTP_server_s
push ebx
call edi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea eax, [ebp - 0x958]
push edx
push edx
push eax
push dword [ebp - 0x96c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
pop ecx
pop edx
test eax, eax
jne 0x401182
sub esp, 0xc
push dword [ebp - 0x96c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push eax
push eax
push esi
push str._sSmall_HTTP_server
push ebx
call edi
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x401229
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
sub esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0xc
push 0
push ebx
push 0
push eax
call fcn.004011f3
sub esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x354142
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
push edi
push dword [esp + 0x38]
push eax
push dword [esp + 0x38]
push edx
push ecx
call fcn.00356dc3
mov ecx, dword [eax]
lea ebp, [eax + 4]
mov edi, dword [ebp]
add esp, 0x14
mov dword [esp + 0x1c], 0x92889
xor edi, ecx
mov dword [esp + 0x20], 0xe27f2
add ebp, 4
mov dword [esp + 0x24], 0x2967a
mov dword [esp + 0x28], 0x68e00
mov dword [esp + 0x10], 0x2b5038
xor dword [esp + 0x10], 0xf8623106
or dword [esp + 0x10], 0x188404b8
add dword [esp + 0x10], 0xe4a8
xor dword [esp + 0x10], 0xf8ce4a67
mov dword [esp + 0x34], 0xd36d71
or dword [esp + 0x34], 0x65ec4c62
imul eax, dword [esp + 0x34], 0x5c
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], eax
xor dword [esp + 0x34], 0xb1a6b198
xor dword [esp + 0x34], 0x166de4c8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
add ecx, edi
mov esi, dword [esp + 0x10]
dec eax
add esi, edi
test eax, ecx
je 0x354208
mov eax, dword [esp + 0x34]
dec eax
not eax
and esi, eax
add esi, dword [esp + 0x34]
mov dword [esp + 0x34], 0xdbb4d4
mov edx, esi
add dword [esp + 0x34], 0x8a88
shl dword [esp + 0x34], 0xd
shl dword [esp + 0x34], 0xd
xor dword [esp + 0x34], 0x700abd10
mov dword [esp + 0x10], 0x5bec98
shr dword [esp + 0x10], 0xb
xor dword [esp + 0x10], 0x4f107
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
push ecx
call fcn.003532c0
mov ebx, eax
mov dword [esp + 0x14], ebx
pop ecx
test ebx, ebx
je 0x3542bc
and dword [esp + 0x34], 0
xor eax, eax
shr esi, 2
mov edx, ebx
lea ecx, [esi*4]
add ecx, ebp
mov esi, ecx
sub esi, ebp
add esi, 3
shr esi, 2
cmp ebp, ecx
cmova esi, eax
test esi, esi
je 0x3542b8
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x14]
mov ecx, dword [ebp]
lea ebp, [ebp + 4]
xor ecx, ebx
mov byte [edx], cl
mov eax, ecx
shr eax, 8
lea edx, [edx + 4]
shr ecx, 0x10
mov byte [edx - 3], al
mov byte [edx - 2], cl
shr ecx, 8
inc edi
mov byte [edx - 1], cl
cmp edi, esi
jb 0x35428a
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
mov byte [ebx + edi], 0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x1c
ret
Function at 0x357834
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x24]
push ebp
push esi
push dword [esp + 0x30]
mov ebp, ecx
push ebx
push dword [esp + 0x30]
push edx
push ebp
call fcn.00356dc3
and dword [esp + 0x30], 0
add esp, 0x14
and dword [esp + 0x20], 0
xor edx, edx
mov ecx, dword [ebx + 0x3c]
mov dword [esp + 0x18], 0xeded2
add ecx, ebx
mov dword [esp + 0xc], 0xa6709b
mov eax, dword [esp + 0xc]
push 0x1a
pop esi
div esi
mov dword [esp + 0xc], eax
xor dword [esp + 0xc], 0x666cf
mov eax, dword [esp + 0xc]
sub ebp, dword [ecx + 0x34]
mov dword [esp + 0xc], ebp
mov edx, dword [ecx + eax*8 + 0x78]
mov ebp, dword [ecx + eax*8 + 0x7c]
add edx, ebx
add ebp, edx
mov dword [esp + 0x14], ebp
cmp edx, ebp
jae 0x3578f1
push edi
mov edi, dword [edx + 4]
lea esi, [edx + 8]
add edi, edx
cmp esi, edi
jae 0x3578e9
mov ebp, dword [esp + 0x10]
movzx eax, word [esi]
mov ecx, eax
mov dword [esp + 0x14], 0x3000
and ecx, 0xfff
and eax, 0xf000
add ecx, dword [edx]
add ecx, ebx
cmp ax, word [esp + 0x14]
jne 0x3578de
add dword [ecx], ebp
add esi, 2
cmp esi, edi
jb 0x3578b9
mov ebp, dword [esp + 0x18]
add edx, dword [edx + 4]
cmp edx, ebp
jb 0x3578a9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x359319
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
push dword [esp + 0x3c]
push ebp
push dword [esp + 0x3c]
push edx
push ecx
call fcn.00356dc3
mov eax, dword [ebp + 0x3c]
xor esi, esi
mov dword [esp + 0x3c], 0xd9fc2
add eax, ebp
mov dword [esp + 0x40], esi
add esp, 0x14
mov dword [esp + 0x38], 0x1e8e79
mov edi, esi
or dword [esp + 0x38], 0x8c620c89
xor dword [esp + 0x38], 0x8c7e8ef9
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov ebx, dword [eax + ecx*8 + 0x78]
add ebx, ebp
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x20]
add eax, ebp
mov dword [esp + 0x1c], eax
add ecx, ebp
mov eax, dword [ebx + 0x24]
add eax, ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [ebx + 0x18], esi
jbe 0x35941a
mov eax, dword [ecx + edi*4]
mov ecx, dword [esp + 0x34]
add eax, ebp
mov dword [esp + 0x10], 0xa37fae
shl dword [esp + 0x10], 0xd
xor dword [esp + 0x10], 0x6ff08ee6
mov dword [esp + 0x38], 0x7490db
or dword [esp + 0x38], 0xbbfffefa
xor dword [esp + 0x38], 0xbbf8104b
push dword [esp + 0x38]
mov edx, dword [esp + 0x14]
push eax
call fcn.00367fe1
pop ecx
pop ecx
test eax, eax
je 0x3593f0
mov ecx, dword [esp + 0x14]
inc edi
cmp edi, dword [ebx + 0x18]
jb 0x35939a
jmp 0x35941a
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
movzx eax, word [eax + edi*2]
mov esi, dword [esi + eax*4]
add esi, ebp
cmp esi, ebx
jb 0x35941a
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx + eax*8 + 0x7c]
xor eax, eax
add ecx, ebx
cmp esi, ecx
cmovb esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x35f201
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
push dword [esp + 0x38]
push dword [esp + 0x38]
push edx
push ecx
call fcn.00356dc3
mov dword [esp + 0x30], 0xb07bf
lea edi, [esp + 0x34]
xor eax, eax
lea ebp, [ecx + 4]
mov ebx, dword [ebp]
add esp, 0x10
stosd dword es:[edi], eax
add ebp, 4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ecx]
xor ebx, eax
mov dword [esp + 0x14], 0x81dc8e
add dword [esp + 0x14], 0xffffd7f0
xor dword [esp + 0x14], 0x81b47f
mov dword [esp + 0x10], 0xcb9660
mov dword [esp + 0x18], eax
imul eax, dword [esp + 0x10], 0x63
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x4ebb2724
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add ecx, ebx
mov esi, dword [esp + 0x14]
dec eax
add esi, ebx
test eax, ecx
je 0x35f293
mov eax, dword [esp + 0x10]
dec eax
not eax
and esi, eax
add esi, dword [esp + 0x10]
mov dword [esp + 0x10], 0x59bd5a
lea edx, [esi + esi]
xor dword [esp + 0x10], 0xf925609d
imul eax, dword [esp + 0x10], 0x25
push ecx
mov dword [esp + 0x14], eax
shl dword [esp + 0x14], 0xa
xor dword [esp + 0x14], 0x303e246a
mov dword [esp + 0x18], 0x44df6d
shr dword [esp + 0x18], 4
shr dword [esp + 0x18], 9
xor dword [esp + 0x18], 0x13f4c
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
call fcn.003532c0
mov edi, eax
mov dword [esp + 0x18], edi
pop ecx
test edi, edi
je 0x35f35c
shr esi, 2
xor eax, eax
lea ecx, [esi*4]
mov esi, edi
add ecx, ebp
mov edx, ecx
sub edx, ebp
add edx, 3
shr edx, 2
cmp ebp, ecx
cmova edx, eax
test edx, edx
je 0x35f356
mov edi, dword [esp + 0x18]
xor ebx, ebx
mov ecx, dword [ebp]
lea ebp, [ebp + 4]
xor ecx, edi
movzx eax, cl
mov word [esi], ax
mov eax, ecx
shr eax, 8
lea esi, [esi + 8]
movzx eax, al
mov word [esi - 6], ax
shr ecx, 0x10
movzx eax, cl
shr ecx, 8
inc ebx
mov word [esi - 4], ax
movzx eax, cl
mov word [esi - 2], ax
cmp ebx, edx
jb 0x35f318
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
xor eax, eax
mov word [edi + ebx*2], ax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x364496
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x98
push ebx
mov ebx, dword [esp + 0xa4]
push ebp
push esi
push edi
push dword [esp + 0xb4]
mov edi, edx
push ebx
push dword [esp + 0xb4]
mov dword [esp + 0x24], edi
push edi
push ecx
call fcn.00356dc3
mov dword [esp + 0x30], 0x5d27c
xor ebp, ebp
mov dword [esp + 0x34], ebp
add esp, 0x14
mov dword [esp + 0x24], ebp
mov esi, ebp
mov dword [esp + 0x10], 0x4b4c7a
shl dword [esp + 0x10], 2
or dword [esp + 0x10], 0x8e590156
imul eax, dword [esp + 0x10], 0x21
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x7f2371bf
mov eax, dword [esp + 0x10]
test edi, eax
je 0x364518
push 0x61
pop eax
mov word [esp + esi*2 + 0x28], ax
inc esi
inc eax
cmp ax, 0x7a
jbe 0x36450b
mov dword [esp + 0x10], 0xa371ac
xor edx, edx
mov eax, dword [esp + 0x10]
push 0x5e
pop ecx
div ecx
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x1bd1d
mov eax, dword [esp + 0x10]
test edi, eax
je 0x36454f
push 0x41
pop eax
mov word [esp + esi*2 + 0x28], ax
inc esi
inc eax
cmp ax, 0x5a
jbe 0x364542
mov dword [esp + 0x10], 0xa719d2
shr dword [esp + 0x10], 0x10
xor dword [esp + 0x10], 0xa3
mov eax, dword [esp + 0x10]
test edi, eax
je 0x36457c
push 0x30
pop eax
mov word [esp + esi*2 + 0x28], ax
inc esi
inc eax
cmp ax, 0x39
jbe 0x36456f
test ebx, ebx
je 0x3645f1
mov edi, dword [esp + 0xb4]
mov dword [esp + 0x14], 0x6f03c8
xor edx, edx
or dword [esp + 0x14], 0xd40a41b0
xor dword [esp + 0x14], 0xd46ac1b0
mov dword [esp + 0x10], 0x3d64a0
mov eax, dword [esp + 0x10]
push 0x28
pop ecx
div ecx
mov dword [esp + 0x10], eax
add dword [esp + 0x10], 0xffff929f
xor dword [esp + 0x10], 0x26b2625b
xor dword [esp + 0x10], 0x26b4643a
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
call fcn.0036f7c2
xor edx, edx
div esi
mov ax, word [esp + edx*2 + 0x28]
mov word [edi + ebp*2], ax
inc ebp
cmp ebp, ebx
jb 0x364587
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], 0xdd4ae6
shr dword [esp + 0x10], 4
shr dword [esp + 0x10], 2
xor dword [esp + 0x10], 0x37523
mov eax, dword [esp + 0x10]
test edi, eax
je 0x364620
mov eax, dword [esp + 0xb4]
xor ecx, ecx
mov word [eax + ebx*2], cx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret
Function at 0x3646ea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x34
push ebx
push ebp
mov ebp, dword [esp + 0x44]
mov eax, ecx
push esi
push edi
push ebp
push dword [esp + 0x4c]
mov dword [esp + 0x24], eax
push edx
push eax
call fcn.00356dc3
mov eax, dword [ebp + 0x3c]
xor esi, esi
mov dword [esp + 0x44], 0xb4c3d
add eax, ebp
mov dword [esp + 0x48], 0xfa4cc
add esp, 0x10
mov dword [esp + 0x3c], esi
mov ebx, esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x4c], 0xd57ebc
add dword [esp + 0x4c], 0xffff9d75
xor dword [esp + 0x4c], 0xd51c31
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov edi, dword [eax + ecx*8 + 0x78]
add edi, ebp
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x20]
add eax, ebp
mov dword [esp + 0x28], eax
add ecx, ebp
mov eax, dword [edi + 0x24]
add eax, ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
cmp dword [edi + 0x18], esi
jbe 0x36484f
mov eax, dword [ecx + ebx*4]
mov dword [esp + 0x4c], 0x4e564f
add eax, ebp
add dword [esp + 0x4c], 0xffff0e9c
add dword [esp + 0x4c], 0xbf39
xor dword [esp + 0x4c], 0x151ee554
xor dword [esp + 0x4c], 0x155f51d9
mov dword [esp + 0x18], 0x4ca640
xor dword [esp + 0x18], 0x33910216
xor dword [esp + 0x18], 0x33d064ee
mov dword [esp + 0x14], 0xbedd0c
shr dword [esp + 0x14], 3
xor dword [esp + 0x14], 0x1938a8
mov dword [esp + 0x10], 0xe28260
or dword [esp + 0x10], 0x6500356a
xor dword [esp + 0x10], 0x65ee114e
push dword [esp + 0x10]
push dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x54]
push eax
call fcn.00366dbf
xor eax, 0x13513119
add esp, 0xc
cmp eax, dword [esp + 0x1c]
je 0x36481f
mov ecx, dword [esp + 0x20]
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x364779
jmp 0x36484f
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
movzx eax, word [eax + ebx*2]
mov esi, dword [esi + eax*4]
add esi, ebp
cmp esi, edi
jb 0x36484f
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov eax, dword [eax + ecx*8 + 0x7c]
add eax, edi
cmp esi, eax
jae 0x36484f
mov ecx, esi
call fcn.0036de14
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x36e003
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push dword [esp + 0x24]
mov edi, edx
push edi
push ecx
call fcn.00356dc3
mov eax, dword [edi + 0x3c]
add esp, 0xc
mov dword [esp + 0x18], 0x5c14d
add eax, edi
mov dword [esp + 0x1c], 0x45f3e
mov dword [esp + 0x14], 0x2793c9
or dword [esp + 0x14], 0x3c5f2686
xor dword [esp + 0x14], 0x3c7fb7ce
mov ecx, dword [esp + 0x14]
mov edx, dword [eax + ecx*8 + 0x78]
test edx, edx
je 0x36e16c
cmp dword [eax + ecx*8 + 0x7c], 0
je 0x36e16c
lea esi, [edx + edi]
jmp 0x36e161
mov dword [esp + 0x14], 0x9aa8c2
lea ecx, [eax + edi]
shr dword [esp + 0x14], 1
or dword [esp + 0x14], 0x2a8bfbba
add dword [esp + 0x14], 0xa414
xor dword [esp + 0x14], 0x2ad51638
mov dword [esp + 0x10], 0x21fb33
add dword [esp + 0x10], 0xffffc7af
add dword [esp + 0x10], 0x80e1
add dword [esp + 0x10], 0xffff3e22
xor dword [esp + 0x10], 0x22e10a
push dword [esp + 0x10]
mov edx, dword [esp + 0x18]
call fcn.0036f844
mov edx, eax
mov dword [esp + 0x1c], edx
pop ecx
test edx, edx
je 0x36e177
mov ebx, dword [esi]
mov ebp, dword [esi + 0x10]
add ebx, edi
add ebp, edi
jmp 0x36e158
jns 0x36e0e7
movzx ecx, ax
jmp 0x36e0ec
lea ecx, [edi + 2]
add ecx, eax
mov dword [esp + 0x14], 0x99e24d
add dword [esp + 0x14], 0xffffc65d
add dword [esp + 0x14], 0xffffea4b
imul eax, dword [esp + 0x14], 0x5b
push edx
mov dword [esp + 0x18], eax
xor dword [esp + 0x18], 0x3699dfee
mov dword [esp + 0x14], 0xcec4a2
imul eax, dword [esp + 0x14], 0x2e
mov dword [esp + 0x14], eax
imul eax, dword [esp + 0x14], 0x67
mov dword [esp + 0x14], eax
xor dword [esp + 0x14], 0xf2d7fd6b
push dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
call fcn.00358499
pop ecx
pop ecx
test eax, eax
je 0x36e177
mov edx, dword [esp + 0x18]
add ebx, 4
mov dword [ebp], eax
add ebp, 4
mov eax, dword [ebx]
test eax, eax
jne 0x36e0e0
add esi, 0x14
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x36e06a
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
xor eax, eax
jmp 0x36e16f