joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1ba356
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [esp + 8], 0x333493e5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xb
ja 0x1ba112
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov esi, ecx
and esi, 0x28a1b659
xor ecx, 0xa8a1b659
lea ecx, [ecx + esi*2]
lea esi, [ecx + edx]
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 4], esi
mov ecx, dword [esp + 4]
add cl, 0x91
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xc
jb 0x1ba0d0
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
xor edi, edi
jmp dword [ecx*4 + 0x1c7ce0]
jmp dword [0x1c7ce8]
mov edx, dword [eax + edx + 0x78]
xor ecx, ecx
test edx, edx
sete cl
jmp dword [ecx*4 + 0x1c7d08]
mov dword [esp + 0x20], esi
mov ecx, dword [eax + edx + 0x20]
add ecx, eax
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + edx + 0x1c]
add ecx, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], edx
mov ecx, dword [eax + edx + 0x18]
xor esi, esi
xor eax, eax
mov dword [esp + 0x38], ecx
cmp esi, ecx
setb al
mov ecx, dword [0x1c7d40]
mov dword [esp + 0x34], ecx
mov edx, 1
jmp dword [eax*4 + 0x1c7d20]
mov eax, dword [ebp + 8]
mov esi, dword [eax + edx + 0x7c]
xor ecx, ecx
test esi, esi
sete cl
jmp dword [ecx*4 + 0x1c7d00]
jmp dword [0x1c7d18]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 8]
setne cl
xor edi, edi
jmp dword [ecx*4 + 0x1c7cf8]
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x3c]
mov eax, dword [eax + edx]
mov dword [esp + 0x1c], eax
mov dword [esp + 8], 0x63622410
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xa
ja 0x1ba3f7
nop
nop
nop
nop
nop
nop
mov edi, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea ebx, [edi + 0x1c172d70]
lea esi, [edi + 0x70]
mov eax, esi
and eax, ebx
and eax, ecx
xor esi, ebx
and esi, ecx
add ecx, edi
add ecx, 0x1c172d70
lea eax, [esi + eax*2]
sub ecx, eax
mov dword [esp + 4], ecx
mov eax, dword [esp + 4]
add al, 0xf0
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x1ba3b0
jmp dword [0x1c7cf4]
mov dword [esp + 8], 0x63622410
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja case.0x1ba11d.2
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov eax, dword [esp]
movzx eax, byte [esp + eax + 8]
lea ecx, [edx + 0x1c172d70]
lea esi, [edx + 0x70]
mov edi, esi
and edi, ecx
and edi, eax
xor esi, ecx
and esi, eax
add eax, edx
add eax, 0x1c172d70
lea ecx, [esi + edi*2]
sub eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0xf0
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x1ba430
jmp case.0x1ba11d.2
Function at 0x1ba3fd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [esp + 8], 0x333493e5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xb
ja 0x1ba112
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov esi, ecx
and esi, 0x28a1b659
xor ecx, 0xa8a1b659
lea ecx, [ecx + esi*2]
lea esi, [ecx + edx]
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 4], esi
mov ecx, dword [esp + 4]
add cl, 0x91
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xc
jb 0x1ba0d0
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
xor edi, edi
jmp dword [ecx*4 + 0x1c7ce0]
jmp dword [0x1c7ce8]
mov edx, dword [eax + edx + 0x78]
xor ecx, ecx
test edx, edx
sete cl
jmp dword [ecx*4 + 0x1c7d08]
mov dword [esp + 0x20], esi
mov ecx, dword [eax + edx + 0x20]
add ecx, eax
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + edx + 0x1c]
add ecx, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], edx
mov ecx, dword [eax + edx + 0x18]
xor esi, esi
xor eax, eax
mov dword [esp + 0x38], ecx
cmp esi, ecx
setb al
mov ecx, dword [0x1c7d40]
mov dword [esp + 0x34], ecx
mov edx, 1
jmp dword [eax*4 + 0x1c7d20]
mov eax, dword [ebp + 8]
mov esi, dword [eax + edx + 0x7c]
xor ecx, ecx
test esi, esi
sete cl
jmp dword [ecx*4 + 0x1c7d00]
jmp dword [0x1c7d18]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 8]
setne cl
xor edi, edi
jmp dword [ecx*4 + 0x1c7cf8]
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x3c]
mov eax, dword [eax + edx]
mov dword [esp + 0x1c], eax
mov dword [esp + 8], 0x63622410
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xa
ja 0x1ba3f7
nop
nop
nop
nop
nop
nop
mov edi, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea ebx, [edi + 0x1c172d70]
lea esi, [edi + 0x70]
mov eax, esi
and eax, ebx
and eax, ecx
xor esi, ebx
and esi, ecx
add ecx, edi
add ecx, 0x1c172d70
lea eax, [esi + eax*2]
sub ecx, eax
mov dword [esp + 4], ecx
mov eax, dword [esp + 4]
add al, 0xf0
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x1ba3b0
jmp dword [0x1c7cf4]
mov dword [esp + 8], 0x63622410
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja case.0x1ba11d.2
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov eax, dword [esp]
movzx eax, byte [esp + eax + 8]
lea ecx, [edx + 0x1c172d70]
lea esi, [edx + 0x70]
mov edi, esi
and edi, ecx
and edi, eax
xor esi, ecx
and esi, eax
add eax, edx
add eax, 0x1c172d70
lea ecx, [esi + edi*2]
sub eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0xf0
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x1ba430
jmp case.0x1ba11d.2
Function at 0x1baac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x1baae0
mov edi, eax
sar edi, 1
and eax, 8
mov ecx, edi
xor ecx, 4
lea ebx, [ecx + eax]
add eax, ecx
inc eax
test eax, eax
jns 0x1bab08
mov eax, 0xffffffff
jmp 0x1bab0e
lea eax, [ebx + ebx]
add eax, 2
push eax
call fcn.00189390
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ecx, word [esi]
test cx, cx
je 0x1bab51
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [edx], cx
add edx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x1bab40
mov word [edx], 0
mov edx, ebx
and edx, 0xfffd
and edi, 2
mov ecx, edi
xor ecx, 2
imul ecx, edx
or ebx, 2
imul ebx, edi
lea edx, [ebx + ecx]
mov word [esp + 4], dx
add ecx, ebx
add ecx, 2
mov word [esp + 6], cx
mov esi, eax
mov dword [esp + 8], eax
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0xb2b5b4b7
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x1bac25
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xf1
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x1babe0
mov edi, dword [esp + 0x10]
mov eax, dword [0x1c91d8]
test eax, eax
je 0x1bac8d
xor ecx, ecx
mov edx, dword [0x1c91dc]
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x7a96736e
je 0x1bac50
inc ecx
cmp eax, ecx
jne 0x1bac40
jmp 0x1bac8d
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x1bac8d
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x1c91e0]
push eax
call fcn.001b8180
add esp, 0x38
mov edi, eax
push esi
call fcn.001893a0
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1baca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x1bacc0
cmp edi, 0xfffffff5
jge 0x1bacd7
mov eax, 0xffffffff
jmp 0x1bacda
lea eax, [edi + 0xa]
push eax
call fcn.00189390
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [ebx]
test cx, cx
je 0x1bad21
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x1bad10
mov word [eax], 0
and edi, 0xfffffffe
lea eax, [edi + 8]
mov word [esp + 4], ax
add edi, 0xa
mov word [esp + 6], di
mov dword [esp + 8], esi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0xb2b5b4b7
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x1bade5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xf1
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x1bada0
mov edi, dword [esp + 0x10]
mov eax, dword [0x1c91d8]
test eax, eax
je 0x1bae41
xor ecx, ecx
mov edx, dword [0x1c91dc]
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x366ceda
je 0x1bae10
inc ecx
cmp eax, ecx
jne 0x1bae00
jmp 0x1bae41
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x1bae41
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x1c91e0]
push eax
call fcn.001b8180
add esp, 0x24
mov edi, eax
push esi
call fcn.001893a0
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1bae60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x1bae80
cmp edi, 0xfffffff5
jge 0x1bae97
mov eax, 0xffffffff
jmp 0x1bae9a
lea eax, [edi + 0xa]
push eax
call fcn.00189390
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [ebx]
test cx, cx
je 0x1baee1
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x1baed0
mov word [eax], 0
and edi, 0xfffffffe
lea eax, [edi + 8]
mov word [esp + 4], ax
add edi, 0xa
mov word [esp + 6], di
mov dword [esp + 8], esi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xb2b5b4b7
mov dword [esp + 0x2c], 0
mov byte [esp + 0x30], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x1bafa5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x28]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xf1
mov ecx, dword [esp]
mov byte [esp + ecx + 0x28], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x1baf60
mov edi, dword [esp + 0x28]
mov eax, dword [0x1c91d8]
test eax, eax
je 0x1baff5
xor ecx, ecx
mov edx, dword [0x1c91dc]
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xb5b385c7
je 0x1bafd0
inc ecx
cmp eax, ecx
jne 0x1bafc0
jmp 0x1baff5
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x1baff5
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push ecx
push edx
push 2
push dword [0x1c91e0]
push eax
call fcn.001b8180
add esp, 0x14
mov edi, eax
push esi
call fcn.001893a0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x1bb00b
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1bb020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0xb2b5b4b7
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 8
ja 0x1bb0aa
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
add al, 0xf1
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 9
jb 0x1bb060
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 8]
mov edx, dword [0x1c91d8]
test edx, edx
je 0x1bb108
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x1c91dc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3bebd150
je 0x1bb0e0
inc edi
cmp edx, edi
jne 0x1bb0d0
jmp 0x1bb108
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x1bb108
lea eax, [esp + 8]
lea edi, [esp + 0x24]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x1c91e0]
push edx
call fcn.001b8180
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x1bb115
mov edx, dword [esp + 0x10]
mov dword [esi], edx
test ecx, ecx
je 0x1bb121
cmp byte [esp + 0x1d], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1bb130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0xb2b5b4b7
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x1bb1a5
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0xf1
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x1bb160
mov eax, dword [esp + 8]
mov edi, dword [0x1c91d8]
test edi, edi
je 0x1bb20d
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x1c91dc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebx*8], 0xb0852ef6
je 0x1bb1e0
inc ebx
cmp edi, ebx
jne 0x1bb1d0
jmp 0x1bb20d
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x1bb20d
lea eax, [esp + 0x1c]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x1c91e0]
push edi
call fcn.001b8180
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x1bb2e8
mov dword [esp + 8], 0xb2b5b4b7
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 8
ja 0x1bb298
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xf1
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 9
jb 0x1bb250
mov eax, dword [esp + 8]
mov ecx, dword [0x1c91d8]
test ecx, ecx
je 0x1bb2e0
xor edx, edx
mov esi, dword [0x1c91dc]
nop
nop
cmp dword [esi + edx*8], 0xb33e16a3
je 0x1bb2c0
inc edx
cmp ecx, edx
jne 0x1bb2b0
jmp 0x1bb2e0
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x1bb2e0
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x1c91e0]
push ecx
call fcn.001b8180
add esp, 0x18
test eax, eax
js 0x1bb2e8
mov eax, dword [esp + 0x1c]
test edi, edi
je 0x1bb2fb
xor ecx, ecx
cmp eax, 0xc0000011
je 0x1bb2f9
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1bb310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0xb2b5b4b7
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x1bb385
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0xf1
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x1bb340
mov eax, dword [esp + 8]
mov edi, dword [0x1c91d8]
test edi, edi
je 0x1bb3ed
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x1c91dc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebx*8], 0x58c2bab5
je 0x1bb3c0
inc ebx
cmp edi, ebx
jne 0x1bb3b0
jmp 0x1bb3ed
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x1bb3ed
lea eax, [esp + 0x1c]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x1c91e0]
push edi
call fcn.001b8180
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x1bb4c8
mov dword [esp + 8], 0xb2b5b4b7
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 8
ja 0x1bb478
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xf1
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 9
jb 0x1bb430
mov eax, dword [esp + 8]
mov ecx, dword [0x1c91d8]
test ecx, ecx
je 0x1bb4c0
xor edx, edx
mov esi, dword [0x1c91dc]
nop
nop
cmp dword [esi + edx*8], 0xb33e16a3
je 0x1bb4a0
inc edx
cmp ecx, edx
jne 0x1bb490
jmp 0x1bb4c0
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x1bb4c0
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x1c91e0]
push ecx
call fcn.001b8180
add esp, 0x18
test eax, eax
js 0x1bb4c8
mov eax, dword [esp + 0x1c]
test edi, edi
je 0x1bb4d2
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1bb4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x1bb500
sar ebx, 1
mov ecx, ebx
and ecx, 0xfffd
mov edx, ebx
and edx, 2
or ebx, 2
imul ebx, edx
xor edx, 2
imul edx, ecx
lea ecx, [edx + ebx]
mov word [esp + 4], cx
lea ecx, [edx + ebx]
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0xb2b5b4b7
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x1bb5d5
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x2eec1bb9
add eax, 0xb9
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xf1
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x1bb590
mov eax, dword [esp + 0x10]
mov edi, dword [0x1c91d8]
test edi, edi
je 0x1bb625
xor ebx, ebx
mov ecx, dword [0x1c91dc]
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x850a6e6
je 0x1bb600
inc ebx
cmp edi, ebx
jne 0x1bb5f0
jmp 0x1bb625
mov ecx, dword [ecx + ebx*8 + 4]
cmp ecx, eax
je 0x1bb625
lea eax, [esp + 0x24]
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 4
push dword [0x1c91e0]
push ecx
call fcn.001b8180
add esp, 0x1c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40ad80
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b6a8]
jne 0x40ad8a
repz ret
jmp fcn.00411fcc

Function at 0x420e2b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b6a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00410538
and dword [ebp - 0x14], 0
cmp dword [0x4616a4], 0
mov dword [ebp - 0x18], eax
jne 0x420ede
push 0x404348
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x420f86
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40433c
push ebx
call edi
test eax, eax
je 0x420f86
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40432c
push ebx
mov dword [0x4616a4], eax
call edi
push eax
call esi
push 0x404318
push ebx
mov dword [0x4616a8], eax
call edi
push eax
call esi
push 0x4042fc
push ebx
mov dword [0x4616ac], eax
call edi
push eax
call esi
mov dword [0x4616b4], eax
test eax, eax
je 0x420ede
push 0x4042e4
push ebx
call edi
push eax
call esi
mov dword [0x4616b0], eax
mov eax, dword [0x4616b0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x420f37
cmp dword [0x4616b4], ecx
je 0x420f37
push eax
call esi
push dword [0x4616b4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x420f37
test ebx, ebx
je 0x420f37
call edi
test eax, eax
je 0x420f2e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x420f2e
test byte [ebp - 8], 1
jne 0x420f37
or dword [ebp + 0x10], 0x200000
jmp 0x420f6a
mov eax, dword [0x4616a8]
cmp eax, dword [ebp - 0x18]
je 0x420f6a
push eax
call esi
test eax, eax
je 0x420f6a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x420f6a
mov eax, dword [0x4616ac]
cmp eax, dword [ebp - 0x18]
je 0x420f6a
push eax
call esi
test eax, eax
je 0x420f6a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4616a4]
call esi
test eax, eax
je 0x420f86
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x420f88
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ad80
leave
ret