joyce8/EMBER2024-capa huggingface dataset:
Function at 0x546596
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x5465a5
xor eax, eax
jmp 0x546688
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x546668
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5944c0]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5944c0]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5944c0]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5944c0]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5944c0]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5944c0]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5944c0]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5944c0]
inc edx
dec edi
jne 0x5465c5
pop edi
test eax, eax
je 0x546682
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5944c0]
inc edx
dec eax
jne 0x54666c
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc
Function at 0x546829
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
jne 0x546855
test ecx, ecx
jne 0x54685f
test esi, esi
jne 0x54685f
mov eax, edx
jmp 0x5468d0
cmp eax, 0xffffffff
jne 0x54685f
push 0xfffffffffffffffe
pop eax
jmp 0x5468d0
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jb 0x5468d0
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edi + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x546895
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x5468b4
mov eax, dword [ebp - 4]
add eax, edx
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x54697d
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
jbe 0x5468f5
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5468ff
xor ecx, ecx
jmp 0x54693e
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x546921
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.0056ce83
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x546969
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x54697d
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x546837
pop edi
pop esi
leave
ret
Function at 0x575824
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebp
push ebx
push esi
mov dword [esp], eax
test eax, eax
je 0x5758d1
mov esi, eax
mov edx, dword [esi]
xor eax, eax
mov byte [edx + 0x16], al
mov ecx, dword [esi]
mov byte [ecx + 0x17], al
mov ebx, dword [esi]
mov byte [ebx + 0x18], al
mov ebp, dword [esi]
mov byte [ebp + 0x19], al
mov ebp, dword [esi + 4]
test ebp, ebp
jle 0x57587b
mov eax, esi
mov edx, dword [eax]
xor ecx, ecx
xor ebx, ebx
movzx esi, byte [edx + ebx]
mov edi, ecx
shl edi, 8
shr ecx, 0x18
xor ecx, esi
mov eax, ecx
mov ecx, edi
xor ecx, dword [eax*4 + 0x598fe0]
inc ebx
cmp ebx, ebp
jl 0x57585b
jmp 0x575881
mov eax, esi
mov edx, dword [eax]
xor ecx, ecx
mov eax, dword [esp]
mov edi, dword [eax + 0xc]
test edi, edi
jle 0x5758af
mov ebp, dword [eax + 8]
xor esi, esi
movzx eax, byte [ebp + esi]
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
xor ecx, eax
mov eax, ecx
mov ecx, ebx
xor ecx, dword [eax*4 + 0x598fe0]
inc esi
cmp esi, edi
jl 0x575890
mov esi, dword [esp]
mov byte [edx + 0x16], cl
mov ebp, dword [esi]
mov eax, ecx
shr eax, 8
mov byte [ebp + 0x17], al
mov ebx, dword [esi]
mov edx, ecx
shr edx, 0x10
mov byte [ebx + 0x18], dl
mov edi, dword [esi]
shr ecx, 0x18
mov byte [edi + 0x19], cl
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret

Function at 0x8daa90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x14], ebx
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x128]
call eax
push eax
push 0x8d97ec
lea eax, [ebp - 0x24]
xorps xmm0, xmm0
push 0x10
push eax
movups xmmword [ebp - 0x24], xmm0
call fcn.008d9e30
mov al, byte [ebp - 0x24]
lea edx, [ebp - 0x23]
mov ch, al
add esp, 0x10
xor al, 0x55
mov edi, 1
mov byte [ebp - 0x24], al
mov eax, 2
sub eax, edx
mov dword [ebp - 4], eax
mov eax, 3
mov ebx, dword [ebp - 4]
sub eax, edx
mov dword [ebp - 8], eax
mov eax, 4
sub eax, edx
mov dword [ebp - 0xc], eax
mov eax, 5
sub eax, edx
mov dword [ebp - 0x10], eax
mov eax, edi
lea esi, [ebp - 0x24]
and eax, 0x1f
add esi, edi
add edi, 5
movzx eax, byte [eax + 0x8d9870]
mov cl, byte [esi]
xor al, cl
mov dl, byte [esi + 1]
xor al, ch
mov ch, byte [esi + 4]
mov byte [esi], al
lea eax, [ebx + esi]
and eax, 0x1f
movzx eax, byte [eax + 0x8d9870]
xor al, dl
xor al, cl
mov cl, byte [esi + 2]
mov byte [esi + 1], al
mov eax, dword [ebp - 8]
add eax, esi
and eax, 0x1f
movzx eax, byte [eax + 0x8d9870]
xor al, cl
xor al, dl
mov dl, byte [esi + 3]
mov byte [esi + 2], al
mov eax, dword [ebp - 0xc]
add eax, esi
and eax, 0x1f
movzx eax, byte [eax + 0x8d9870]
xor al, dl
xor al, cl
mov byte [esi + 3], al
mov eax, dword [ebp - 0x10]
add eax, esi
and eax, 0x1f
movzx eax, byte [eax + 0x8d9870]
xor al, ch
xor al, dl
mov byte [esi + 4], al
cmp edi, 0x10
jb 0x8dab01
mov ebx, dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
push 0x10
push ecx
push 0xfc
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x28]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x8dad10
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp byte [eax + 2], 1
sete al
ret
Function at 0x8dad30
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
test byte [eax + 0x68], 0x70
setne al
ret

Function at 0x8db620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor eax, eax
mov cl, byte [edx]
test cl, cl
je 0x8db64b
nop
movsx ecx, cl
lea edx, [edx + 1]
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x8db630
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
pop ebp
ret

Function at 0x8dcef0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ecx, esi
add ecx, 2
push 0
push 3
adc eax, 0
push eax
push ecx
call fcn.008e1d80
mov ebx, eax
shld edx, ebx, 2
shl ebx, 2
mov dword [ebp + 0x14], edx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
test edx, edx
je 0x8dd007
push edi
test ebx, ebx
je 0x8dcf45
mov edi, edx
mov ecx, ebx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [ebp + 0xc]
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
test esi, esi
je 0x8dcfd7
mov ebx, dword [ebp + 8]
mov edi, edx
cmp eax, esi
jae 0x8dcf5f
movzx edx, byte [eax + ebx]
inc eax
jmp 0x8dcf61
xor edx, edx
cmp eax, esi
jae 0x8dcf6f
movzx ecx, byte [eax + ebx]
inc eax
mov dword [ebp + 0x14], ecx
jmp 0x8dcf76
mov dword [ebp + 0x14], 0
cmp eax, esi
jae 0x8dcf81
movzx ecx, byte [eax + ebx]
inc eax
jmp 0x8dcf83
xor ecx, ecx
shl edx, 8
add edx, dword [ebp + 0x14]
shl edx, 8
add edx, ecx
mov ecx, edx
shr ecx, 0x12
movzx ecx, byte [ecx + 0x8d81d8]
mov byte [edi], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x8d81d8]
mov byte [edi + 1], cl
mov ecx, edx
shr ecx, 6
and edx, 0x3f
and ecx, 0x3f
movzx ecx, byte [ecx + 0x8d81d8]
mov byte [edi + 2], cl
movzx ecx, byte [edx + 0x8d81d8]
mov byte [edi + 3], cl
add edi, 4
cmp eax, esi
jb 0x8dcf58
mov ebx, dword [ebp - 4]
mov eax, 0xaaaaaaab
xor ecx, ecx
mul esi
pop edi
shr edx, 1
lea eax, [edx + edx*2]
sub esi, eax
cmp dword [esi*4 + 0x8d8218], ecx
jle 0x8dd007
mov eax, dword [ebp + 0xc]
dec eax
add eax, ebx
mov byte [eax], 0x3d
lea eax, [eax - 1]
inc ecx
cmp ecx, dword [esi*4 + 0x8d8218]
jl 0x8dcff7
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8ddc10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1598
call fcn.008e1e30
push esi
push 0x105
lea eax, [ebp - 0x1598]
push 0
push eax
call fcn.008db290
mov al, byte [0x8e31c5]
add esp, 0xc
xor al, 0x1a
mov dword [ebp - 0x1493], 0
mov dword [ebp - 0x108f], 0
xor esi, esi
mov dword [ebp - 0x100b], 0
mov dword [ebp - 0x807], 0
mov byte [ebp - 0x1598], al
push ebx
nop dword [eax]
lea eax, [esi + 1]
and eax, 0x3f
mov cl, byte [eax + 0x8d8328]
lea eax, [esi + 2]
xor cl, byte [esi + 0x8e31c6]
and eax, 0x3f
xor cl, byte [ebp + esi - 0x1598]
mov byte [ebp + esi - 0x1597], cl
mov dl, byte [eax + 0x8d8328]
lea eax, [esi + 3]
xor dl, byte [esi + 0x8e31c7]
and eax, 0x3f
xor dl, cl
mov byte [ebp + esi - 0x1596], dl
mov bl, byte [eax + 0x8d8328]
lea eax, [esi + 4]
xor bl, byte [esi + 0x8e31c8]
lea esi, [esi + 4]
and eax, 0x3f
xor bl, dl
mov byte [ebp + esi - 0x1599], bl
mov al, byte [eax + 0x8d8328]
xor al, byte [esi + 0x8e31c5]
xor al, bl
mov byte [ebp + esi - 0x1598], al
lea eax, [esi + 1]
cmp eax, 0x1595
jb 0x8ddc70
mov al, byte [ebp - 0x1598]
mov ecx, dword [0x8fccb0]
pop ebx
cmp al, 0xe4
jne 0x8ddd34
mov eax, dword [ecx]
push 0x1d
push 0x8d8de0
call dword [eax + 0x14]
mov ecx, dword [0x8fccb0]
push 0
push dword [ebp - 0x1597]
mov eax, dword [ecx]
call dword [eax + 0x1c]
push dword [ebp - 0x1597]
mov ecx, dword [0x8fcc8c]
call fcn.008db460
pop esi
mov esp, ebp
pop ebp
ret
cmp al, 0x4a
mov eax, dword [ecx]
jne 0x8ddd6c
push 0x1c
push 0x8d8e00
call dword [eax + 0x14]
mov ecx, dword [0x8fccb0]
lea edx, [ebp - 0x1593]
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
lea eax, [ebp - 0x1593]
push eax
mov eax, dword [0x8fcc8c]
mov eax, dword [eax + 0x38]
call eax
pop esi
mov esp, ebp
pop ebp
ret
push 0x48
push 0x8d8e20
call dword [eax + 0x14]
mov ecx, dword [0x8fccb0]
movzx eax, byte [ebp - 0x1598]
cdq
push edx
mov esi, dword [ecx]
push eax
call dword [esi + 0x1c]
mov ecx, dword [0x8fcc8c]
push 0xfffffc10
mov ecx, dword [ecx + 0x2c]
call ecx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x8e0670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x8e06dc
push esi
mov esi, dword [ebp + 0xc]
dec ebx
push edi
mov edi, dword [ebp + 8]
add edi, 0xb0
shr ebx, 4
sub edi, esi
inc ebx
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.008ded50
push dword [ebp + 8]
push esi
call fcn.008e0a80
add esp, 0x14
mov ecx, 0x10
mov al, byte [edi + esi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x8e06b0
push 0x10
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
add eax, 0xb0
push eax
call fcn.008ded50
add esp, 0xc
sub edi, 0x10
sub ebx, 1
jne 0x8e0693
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8e0790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
add eax, 0xb0
mov dword [ebp - 4], eax
push esi
mov esi, eax
test ebx, ebx
je 0x8e07e8
dec ebx
shr ebx, 4
push edi
mov edi, dword [ebp + 0xc]
inc ebx
mov eax, edi
sub esi, edi
mov edx, 0x10
nop dword [eax]
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x8e07c0
push dword [ebp + 8]
push edi
call fcn.008e08d0
mov esi, edi
add esp, 8
add edi, 0x10
sub ebx, 1
jne 0x8e07b3
mov eax, dword [ebp - 4]
pop edi
push 0x10
push esi
push eax
call fcn.008ded50
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8e08d0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, 4
push edi
mov edi, dword [ebp + 8]
sub esi, edi
mov ecx, edi
mov edx, 4
nop dword [eax + eax]
mov al, byte [esi + ecx]
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0x8e08f0
sub ebx, 1
jne 0x8e08e6
mov esi, dword [ebp + 0xc]
add esi, 0x10
mov dword [ebp - 4], 9
nop dword [eax]
mov ebx, edi
mov dword [ebp + 8], 4
nop dword [eax]
mov ecx, ebx
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x8d9010]
mov byte [ecx - 4], al
sub edx, 1
jne 0x8e0930
inc ebx
sub dword [ebp + 8], 1
jne 0x8e0920
movzx eax, byte [edi + 5]
mov cl, byte [edi + 1]
mov byte [edi + 1], al
movzx eax, byte [edi + 9]
mov byte [edi + 5], al
movzx eax, byte [edi + 0xd]
mov byte [edi + 9], al
movzx eax, byte [edi + 0xa]
mov byte [edi + 0xd], cl
mov cl, byte [edi + 2]
mov byte [edi + 2], al
movzx eax, byte [edi + 0xe]
mov byte [edi + 0xa], cl
mov cl, byte [edi + 6]
mov byte [edi + 6], al
movzx eax, byte [edi + 0xf]
mov byte [edi + 0xe], cl
mov cl, byte [edi + 3]
mov byte [edi + 3], al
movzx eax, byte [edi + 0xb]
mov byte [edi + 0xf], al
movzx eax, byte [edi + 7]
push edi
mov byte [edi + 0xb], al
mov byte [edi + 7], cl
call fcn.008e0fa0
add esp, 4
mov eax, edi
mov ebx, 4
nop dword [eax + eax]
mov edx, 4
mov cl, byte [esi]
inc esi
xor byte [eax], cl
inc eax
sub edx, 1
jne 0x8e09b5
sub ebx, 1
jne 0x8e09b0
sub dword [ebp - 4], 1
jne 0x8e0910
mov esi, edi
lea ebx, [edx + 4]
mov ecx, esi
mov edx, 4
nop dword [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x8d9010]
mov byte [ecx - 4], al
sub edx, 1
jne 0x8e09e0
inc esi
sub ebx, 1
jne 0x8e09d4
mov cl, byte [edi + 1]
lea esi, [edx + 4]
movzx eax, byte [edi + 5]
mov byte [edi + 1], al
movzx eax, byte [edi + 9]
mov byte [edi + 5], al
movzx eax, byte [edi + 0xd]
mov byte [edi + 9], al
movzx eax, byte [edi + 0xa]
mov byte [edi + 0xd], cl
mov cl, byte [edi + 2]
mov byte [edi + 2], al
movzx eax, byte [edi + 0xe]
mov byte [edi + 0xa], cl
mov cl, byte [edi + 6]
mov byte [edi + 6], al
movzx eax, byte [edi + 0xf]
mov byte [edi + 0xe], cl
mov cl, byte [edi + 3]
mov byte [edi + 3], al
movzx eax, byte [edi + 0xb]
mov byte [edi + 0xf], al
movzx eax, byte [edi + 7]
mov byte [edi + 7], cl
mov ecx, dword [ebp + 0xc]
mov byte [edi + 0xb], al
add ecx, 0xa0
mov edx, 4
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
xor byte [edi], al
inc edi
sub edx, 1
jne 0x8e0a60
sub esi, 1
jne 0x8e0a56
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8e0a80
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
add edx, 0xa0
push edi
mov ecx, esi
mov ebx, 4
nop word [eax + eax]
mov edi, 4
mov al, byte [edx]
inc edx
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x8e0aa5
sub ebx, 1
jne 0x8e0aa0
mov eax, dword [ebp + 0xc]
add eax, 0x90
mov byte [ebp + 0xb], 9
mov dword [ebp - 4], eax
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
nop dword [eax + eax]
mov ecx, edi
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x8d9110]
mov byte [ecx - 4], al
sub edx, 1
jne 0x8e0b30
inc edi
sub ebx, 1
jne 0x8e0b20
mov edx, dword [ebp - 4]
mov eax, esi
mov ebx, 4
mov edi, 4
nop dword [eax]
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
sub edi, 1
jne 0x8e0b60
sub ebx, 1
jne 0x8e0b54
push esi
call fcn.008e0c40
mov dl, byte [ebp + 0xb]
add esp, 4
sub dword [ebp - 4], 0x10
dec dl
mov byte [ebp + 0xb], dl
test dl, dl
jne 0x8e0ac4
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
mov ecx, edi
mov edx, 4
nop dword [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x8d9110]
mov byte [ecx - 4], al
sub edx, 1
jne 0x8e0bf0
inc edi
sub ebx, 1
jne 0x8e0be4
sub dword [ebp + 0xc], esi
mov dword [ebp + 8], 4
mov edx, dword [ebp + 0xc]
mov ecx, 4
nop dword [eax]
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x8e0c20
sub dword [ebp + 8], 1
jne 0x8e0c14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8e0e40
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [ecx]
lea edx, [esi + 1]
lea ebx, [esi + 2]
sub dword [ebp + 8], edx
push edi
mov byte [esi], al
lea edi, [esi + 3]
movzx eax, byte [ecx + 1]
mov byte [edx], al
movzx eax, byte [ecx + 2]
mov byte [ebx], al
movzx eax, byte [ecx + 3]
mov byte [edi], al
movzx eax, byte [ecx + 4]
mov byte [esi + 4], al
movzx eax, byte [ecx + 5]
mov byte [esi + 5], al
movzx eax, byte [ecx + 6]
mov byte [esi + 6], al
movzx eax, byte [ecx + 7]
mov byte [esi + 7], al
movzx eax, byte [ecx + 8]
mov byte [esi + 8], al
movzx eax, byte [ecx + 9]
mov byte [esi + 9], al
movzx eax, byte [ecx + 0xa]
mov byte [esi + 0xa], al
movzx eax, byte [ecx + 0xb]
mov byte [esi + 0xb], al
movzx eax, byte [ecx + 0xc]
mov byte [esi + 0xc], al
movzx eax, byte [ecx + 0xd]
mov byte [esi + 0xd], al
movzx eax, byte [ecx + 0xe]
mov dword [ebp - 8], ebx
mov ebx, 4
mov byte [esi + 0xe], al
movzx eax, byte [ecx + 0xf]
mov ecx, dword [ebp - 8]
sub ecx, edx
mov byte [esi + 0xf], al
mov dword [ebp - 0x10], ecx
lea eax, [edx + 0xc]
mov ecx, edi
add esi, 0x11
sub ecx, edx
mov dword [ebp - 0xc], esi
sub dword [ebp - 8], edi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
nop dword [eax]
mov esi, dword [ebp - 0x10]
mov dl, byte [ecx + eax]
mov cl, byte [eax]
mov byte [ebp - 2], cl
mov ch, byte [esi + eax]
mov esi, dword [ebp - 0x14]
mov byte [ebp - 1], ch
mov dh, byte [esi + eax]
mov esi, dword [ebp - 0xc]
mov byte [ebp - 3], dh
test bl, 3
jne 0x8e0f52
movzx ecx, cl
movzx edx, dl
mov cl, byte [ecx + 0x8d9010]
mov dh, byte [edx + 0x8d9010]
mov byte [ebp - 4], cl
movzx ecx, byte [ebp - 1]
mov dl, byte [ebp - 4]
mov cl, byte [ecx + 0x8d9010]
mov byte [ebp - 2], cl
movzx ecx, byte [ebp - 3]
mov cl, byte [ecx + 0x8d9010]
mov byte [ebp - 1], cl
mov ecx, ebx
shr ecx, 2
xor dl, byte [ecx + 0x8d9210]
mov ch, byte [ebp - 1]
mov cl, byte [esi - 0x11]
inc ebx
xor cl, dl
mov byte [esi - 1], cl
mov cl, byte [eax - 0xc]
add eax, 4
xor cl, byte [ebp - 2]
mov byte [esi], cl
mov esi, dword [ebp - 8]
mov cl, byte [esi + edi]
mov esi, dword [ebp - 0xc]
xor cl, ch
mov byte [esi + 1], cl
mov cl, byte [edi]
add edi, 4
xor cl, dh
mov byte [esi + 2], cl
add esi, 4
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], esi
cmp ebx, 0x2c
jb 0x8e0ef0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8e0fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
add eax, 2
mov esi, 4
mov dl, byte [eax + 1]
lea eax, [eax + 4]
mov bh, byte [eax - 4]
mov dh, dl
mov cl, byte [eax - 6]
xor dh, bh
mov bl, byte [eax - 5]
mov byte [ebp - 2], cl
mov byte [ebp - 3], dl
mov dl, dh
xor dl, cl
xor dl, bl
mov byte [ebp - 1], dl
mov dl, cl
xor dl, bl
mov cl, dl
add dl, dl
shr cl, 7
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dl
mov dl, bl
xor cl, byte [ebp - 2]
xor dl, bh
xor cl, byte [ebp - 1]
mov byte [eax - 6], cl
mov cl, dl
shr cl, 7
add dl, dl
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dl
mov dl, byte [ebp - 3]
xor cl, bl
xor dl, byte [ebp - 2]
mov bl, byte [ebp - 1]
xor cl, bl
mov byte [eax - 5], cl
mov cl, dh
shr cl, 7
add dh, dh
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dh
xor cl, bh
xor cl, bl
mov byte [eax - 4], cl
mov cl, dl
shr cl, 7
add dl, dl
movzx ecx, cl
imul ecx, ecx, 0x1b
xor cl, dl
xor cl, byte [ebp - 3]
xor cl, bl
mov byte [eax - 3], cl
sub esi, 1
jne 0x8e0fb1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40596d
pop dword [ebp - 0x4c]
mov eax, 0x1488113f
sub eax, 0x1447b7d2
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xad659340
add dword [ebp - 0x5c], 0xa0ecb20b
mov dword [ebp - 0x58], 0xd4a58c2
add dword [ebp - 0x58], 0x24e8f383
mov dword [ebp - 0x54], 0x15969c69
add dword [ebp - 0x54], 0x36b5a7c5
mov dword [ebp - 0x50], 0x6b6dfb93
sub dword [ebp - 0x50], 0x6b6dfb93
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x82b8c9d2
sub dword [ebp - 0x5c], 0xe46607c
mov dword [ebp - 0x58], 0x77dac756
sub dword [ebp - 0x58], 0x366e65e1
mov dword [ebp - 0x54], 0x70feeab5
add dword [ebp - 0x54], 0xf27081b7
mov dword [ebp - 0x50], 0xdd63a613
add dword [ebp - 0x50], 0x229c59ed
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x7518b5
add eax, 0xffcb584b
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x35abf
push 0
call eax
mov ecx, 0xc78e8bfc
sub ecx, 0xc78e482a
mov esi, eax
mov edx, 0x6bfbba3c
add edx, 0x944545c4
add edx, dword [ebp - 0x4c]
mov edi, 0x6c2a6733
xor dword [ebp - 0x14], ebx
mov ebx, dword [edx]
xor dword [ebp - 0x34], 0xe93beb88
add ebx, edi
xor dword [ebp - 0x40], 0x44a0e9f1
mov dword [esi], ebx
mov dword [ebp - 0xc], 0xf98b9ebe
add esi, 0x53caa0c2
sub esi, 0x53caa0be
add edx, 0x571cb7e4
sub edx, 0x571cb7e0
loop 0x405a84
add eax, 0xa7a071ca
add eax, 0x58609051
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x5af74cbe
add ecx, 0xa548b342
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941