joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2d03d00
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x2d03ea6
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0x2d03e9f
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0x2d03d93
add ebp, dword [esp + 0xc]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov ebx, dword [esp + 0x10]
sub ebx, esi
mov esi, 0x15b0
je 0x2d03e9f
mov dword [esp + 0x10], ebx
xor edx, edx
cmp esi, 8
jb 0x2d03e05
xor eax, eax
movzx edx, byte [ebp]
add edx, edi
add ecx, edx
mov ebx, esi
movzx esi, byte [ebp + 1]
add esi, edx
mov edx, ecx
and edx, esi
xor ecx, esi
movzx edi, byte [ebp + 2]
add edi, esi
add ecx, edi
lea ecx, [ecx + edx*2]
movzx edx, byte [ebp + 3]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + 4]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + 5]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + 6]
add esi, edx
add ecx, esi
movzx edi, byte [ebp + 7]
add edi, esi
add ecx, edi
mov esi, eax
and esi, 8
xor eax, 8
lea edx, [eax + esi*2]
add ebp, 8
lea esi, [eax + esi*2]
add esi, 7
mov eax, edx
cmp esi, ebx
mov esi, ebx
jb 0x2d03da0
mov eax, esi
sub eax, edx
jbe 0x2d03d58
mov ebx, edx
not ebx
add ebx, esi
mov dword [esp], ebx
mov ebx, eax
and ebx, 3
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
je 0x2d03e53
neg dword [esp + 8]
xor esi, esi
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec esi
cmp dword [esp + 8], esi
jne 0x2d03e40
sub edx, esi
jmp 0x2d03e55
mov ebx, ebp
mov eax, dword [esp]
cmp eax, 3
jb 0x2d03d50
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x2d03e70
jmp 0x2d03d50
shl ecx, 0x10
or ecx, edi
jmp 0x2d03eab
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x2d03ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x2d03f1a
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x2d03f1c
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
mov ebp, eax
and ebp, edi
or eax, edi
not ebp
and ebp, eax
and ebp, 0xf
xor ebx, dword [ebp*4 + 0x2d40938]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x2d40938]
inc esi
cmp edx, esi
jne 0x2d03ee0
not eax
jmp 0x2d03f1c
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x2d09b90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x2d09cb6
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x2d09bcd
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x2d09bf1
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x2d09bc0
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x2d09bc0
lea esi, [ebx + 1]
push esi
call fcn.02d39cc0
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x2d09cc4
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x2d09c38
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x2d09cc6
movzx edx, word [edi]
test dx, dx
je 0x2d09cc6
cmp dx, 0x7f
jbe 0x2d09c20
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
mov dword [esp + 4], esi
cmp esi, 0x7ff
ja 0x2d09c80
cmp ecx, 2
jb 0x2d09c80
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x2d09c27
xor esi, esi
cmp ecx, 3
jb 0x2d09c27
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x2d09c27
push 1
call fcn.02d39cc0
add esp, 4
mov ebp, eax
jmp 0x2d09cc6
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x2d09ce7
mov bl, 0x2f
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx ebx, byte [ebp + ecx]
cmp ebx, 0x5c
je 0x2d09ce0
test ebx, ebx
jne 0x2d09ce2
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.02d06140
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x2d0aec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x2d0afbf
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x2d0aef8
mov ebp, ebx
mov esi, ebp
lea eax, [edi + 4]
add edi, 2
cmp edi, ecx
mov edi, eax
mov ebp, dword [esp + 0x18]
jae 0x2d0afc1
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.02d10560
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.02d10560
add esp, 4
shl bh, 2
mov ah, al
shr ah, 4
and ah, 3
or ah, bh
mov ecx, esi
and ecx, 1
mov edx, esi
xor edx, 1
lea ebx, [edx + ecx*2]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov byte [edx + esi], ah
cmp edi, ecx
jae 0x2d0aee0
mov byte [esp + 3], al
mov esi, ebx
movzx eax, byte [ebp + edi]
push eax
call fcn.02d10560
add esp, 4
cmp al, 0x40
jne 0x2d0af60
mov ebp, esi
mov ecx, dword [esp + 0x1c]
jmp 0x2d0aee2
mov bh, al
movzx ecx, byte [esp + 3]
shl cl, 4
shr al, 2
and al, 0xf
or al, cl
lea ebp, [esi + 1]
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi], al
lea eax, [edi + 1]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jae 0x2d0aee2
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.02d10560
mov ecx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x2d0aee2
shl bh, 6
add al, bh
mov edx, dword [esp + 0x20]
mov byte [edx + esi + 1], al
add esi, 2
mov ebp, esi
jmp 0x2d0aee2
xor esi, esi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x2d15f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x2d15f80
sar esi, 1
lea edi, [esp + 0xac]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x2d4cd60]
mov ebx, dword [esp + 0xac]
test ebx, ebx
jns 0x2d15fb5
mov eax, 0xffffffff
jmp 0x2d15fb8
lea eax, [ebx + ebx]
push eax
call fcn.02d39cc0
add esp, 4
push edi
push ebx
mov dword [esp + 0x34], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x2d4cd60]
mov dword [esp + 0x30], 0x83548122
mov dword [esp + 0x34], 0x9f119d21
mov dword [esp + 0x38], 0x9b789912
mov dword [esp + 0x3c], 0x972b9534
mov dword [esp + 0x40], 0x931d9124
mov dword [esp + 0x44], 0x6fdd6d29
mov dword [esp + 0x48], 0x6b6869d8
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov word [esp + 0x5c], 0
mov dword [esp + 0xb8], 0
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x2d
ja 0x2d16086
nop
nop
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0xb8]
add cl, 0x6b
xor cl, byte [esp + edx + 0x30]
add cl, 0x13
mov edx, dword [esp + 0xb8]
mov byte [esp + edx + 0x30], cl
inc dword [esp + 0xb8]
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x2e
jb 0x2d16050
lea edi, [esp + 0xe0]
lea edx, [esp + 0x30]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xfc]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0xac]
mov ecx, eax
add ecx, 0xd
jns 0x2d160bf
mov eax, 0xffffffff
jmp 0x2d160c4
add eax, eax
add eax, 0x1a
mov esi, dword [esp + 0x2c]
push eax
call fcn.02d39cc0
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x2d160f1
lea edx, [esi + 2]
mov eax, ebx
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x2d160e0
mov word [eax], 0
movzx ecx, word [esp + 0xe0]
test cx, cx
je 0x2d16121
lea edx, [esp + 0xe2]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x2d16110
mov word [eax], 0
lea eax, [esp + 0x8c]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.02d3edb0
add esp, 0x14
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x2d454d0]
mov ecx, 0x535950c7
xor ecx, dword [0x2d454d8]
add eax, ecx
inc eax
jmp eax
Function at 0x2d1b930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 0x20], 0x83358122
mov dword [esp + 0x24], 0x9f179d3d
mov dword [esp + 0x28], 0x9b6e9952
mov dword [esp + 0x2c], 0x97369526
lea eax, [esp + 0x30]
mov word [esp + 0x30], 0x9196
mov dword [esp + 0x32], 0
mov dword [esp + 0x36], 0
mov dword [esp + 0x3a], 0
mov dword [esp + 0x3e], 0
mov dword [esp + 0x42], 0
mov dword [esp + 0x46], 0
mov dword [esp + 0x4a], 0
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0xc]
cmp ecx, 0x2d
ja 0x2d1b9d7
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
add cl, 0x6b
xor cl, byte [esp + edx + 0x20]
add cl, 0x13
mov edx, dword [esp + 0xc]
mov byte [esp + edx + 0x20], cl
inc dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
cmp ecx, 0x2e
jb 0x2d1b9b0
mov ebx, dword [ebp + 8]
lea edi, [esp + 0xc]
lea esi, [esp + 0x20]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x1c]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x2d1ba10
mov edi, esi
cmp eax, 0xffffffed
jge 0x2d1ba29
mov eax, 0xffffffff
jmp 0x2d1ba2c
add eax, 0x12
push eax
call fcn.02d39cc0
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x2d1ba61
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x2d1ba50
mov word [eax], 0
movzx ecx, word [esp + 0xc]
test cx, cx
je 0x2d1ba91
lea edx, [esp + 0xe]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x2d1ba80
mov word [eax], 0
push edi
push esi
call fcn.02d3efa0
add esp, 8
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x2d460ec]
mov ecx, 0x3a0bb6fa
xor ecx, dword [0x2d460f4]
add eax, ecx
inc eax
jmp eax
Function at 0x2d37f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 0x10], 0xb550d61
mov dword [esp + 0x14], 0x17a909b1
mov dword [esp + 0x18], 0x13bf15a8
mov dword [esp + 0x1c], 0x1f5211a5
mov dword [esp + 0x20], 0x1bb31da2
mov dword [esp + 0x24], 0x67cb19a2
mov dword [esp + 0x28], 0x63626509
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov byte [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x40]
cmp eax, 0x2c
ja 0x2d38005
nop
nop
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x40]
add al, 0x2a
xor al, byte [esp + ecx + 0x10]
add al, 0xda
mov ecx, dword [esp + 0x40]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 0x40]
mov eax, dword [esp + 0x40]
cmp eax, 0x2d
jb 0x2d37fe0
lea eax, [esp + 0x40]
lea ebx, [esp + 0x10]
mov esi, ebx
mov ecx, 7
mov edi, eax
xchg esi, esi
rep movsd dword es:[edi], dword [esi]
xchg esi, esi
lea edi, [esp + 0x5c]
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
lea ecx, [esp + 0x5c]
push ecx
push 8
push ebx
push 0xd
push eax
push 0
call dword [0x2d4cd60]
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x2d4a400]
mov ecx, 0x18054be0
xor ecx, dword [0x2d4a408]
add eax, ecx
inc eax
jmp eax
Function at 0x2d3ebc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax], 0
lea eax, [eax + 2]
jne 0x2d3ebe0
add eax, edi
add eax, 0xfffffffe
mov ebx, edi
not ebx
and ebx, eax
xor eax, edi
add ebx, ebx
sub ebx, eax
cmp ebx, 0xfffffff5
jge 0x2d3ec07
mov eax, 0xffffffff
jmp 0x2d3ec0a
lea eax, [ebx + 0xa]
push eax
call fcn.02d39cc0
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [edi]
test cx, cx
je 0x2d3ec51
add edi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x2d3ec40
mov word [eax], 0
and ebx, 0xfffffffe
lea eax, [ebx + 8]
mov word [esp + 8], ax
add ebx, 0xa
mov word [esp + 0xa], bx
mov dword [esp + 0xc], esi
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov word [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x7a797867
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1d
ja 0x2d3ed33
nop
nop
nop
mov ecx, dword [esp + 4]
mov eax, dword [esp + 4]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx - 0x304c7791]
add ecx, 0x6f
xor ecx, eax
xor eax, edx
and ecx, edx
sub eax, ecx
mov ecx, eax
xor ecx, 0xf6
and eax, 0x76
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x1e
jb 0x2d3ecf0
mov edi, dword [esp + 0x10]
mov eax, dword [0x2d4dd6c]
test eax, eax
je 0x2d3ed9d
xor ecx, ecx
mov edx, dword [0x2d4dd70]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xb1cf12ba
je 0x2d3ed60
inc ecx
cmp eax, ecx
jne 0x2d3ed50
jmp 0x2d3ed9d
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x2d3ed9d
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x2d4dd74]
push eax
call fcn.02d3c030
add esp, 0x38
mov edi, eax
push esi
call fcn.02d09400
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x2d3edb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax], 0
lea eax, [eax + 2]
jne 0x2d3edd0
add eax, edi
add eax, 0xfffffffe
mov ebx, edi
not ebx
and ebx, eax
xor eax, edi
add ebx, ebx
sub ebx, eax
cmp ebx, 0xfffffff5
jge 0x2d3edf7
mov eax, 0xffffffff
jmp 0x2d3edfa
lea eax, [ebx + 0xa]
push eax
call fcn.02d39cc0
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [edi]
test cx, cx
je 0x2d3ee41
add edi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x2d3ee30
mov word [eax], 0
and ebx, 0xfffffffe
lea eax, [ebx + 8]
mov word [esp + 8], ax
add ebx, 0xa
mov word [esp + 0xa], bx
mov dword [esp + 0xc], esi
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov word [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x7a797867
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1d
ja 0x2d3ef23
nop
nop
nop
mov ecx, dword [esp + 4]
mov eax, dword [esp + 4]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx - 0x304c7791]
add ecx, 0x6f
xor ecx, eax
xor eax, edx
and ecx, edx
sub eax, ecx
mov ecx, eax
xor ecx, 0xf6
and eax, 0x76
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x1e
jb 0x2d3eee0
mov edi, dword [esp + 0x10]
mov eax, dword [0x2d4dd6c]
test eax, eax
je 0x2d3ef81
xor ecx, ecx
mov edx, dword [0x2d4dd70]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x37e2bdc6
je 0x2d3ef50
inc ecx
cmp eax, ecx
jne 0x2d3ef40
jmp 0x2d3ef81
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x2d3ef81
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x2d4dd74]
push eax
call fcn.02d3c030
add esp, 0x24
mov edi, eax
push esi
call fcn.02d09400
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x2d3efa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax], 0
lea eax, [eax + 2]
jne 0x2d3efc0
add eax, edi
add eax, 0xfffffffe
mov ebx, edi
not ebx
and ebx, eax
xor eax, edi
add ebx, ebx
sub ebx, eax
cmp ebx, 0xfffffff5
jge 0x2d3efe7
mov eax, 0xffffffff
jmp 0x2d3efea
lea eax, [ebx + 0xa]
push eax
call fcn.02d39cc0
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [edi]
test cx, cx
je 0x2d3f031
add edi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x2d3f020
mov word [eax], 0
and ebx, 0xfffffffe
lea eax, [ebx + 8]
mov word [esp + 8], ax
add ebx, 0xa
mov word [esp + 0xa], bx
mov dword [esp + 0xc], esi
mov dword [esp + 0x44], 0x18
mov dword [esp + 0x48], 0
mov dword [esp + 0x50], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov word [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x7a797867
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1d
ja 0x2d3f113
nop
nop
nop
mov ecx, dword [esp + 4]
mov eax, dword [esp + 4]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx - 0x304c7791]
add ecx, 0x6f
xor ecx, eax
xor eax, edx
and ecx, edx
sub eax, ecx
mov ecx, eax
xor ecx, 0xf6
and eax, 0x76
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x1e
jb 0x2d3f0d0
mov edi, dword [esp + 0x10]
mov eax, dword [0x2d4dd6c]
test eax, eax
je 0x2d3f165
xor ecx, ecx
mov edx, dword [0x2d4dd70]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x6a34d54b
je 0x2d3f140
inc ecx
cmp eax, ecx
jne 0x2d3f130
jmp 0x2d3f165
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x2d3f165
lea ecx, [esp + 0x10]
lea edx, [esp + 0x44]
push ecx
push edx
push 2
push dword [0x2d4dd74]
push eax
call fcn.02d3c030
add esp, 0x14
mov edi, eax
push esi
call fcn.02d09400
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x2d3f17b
mov eax, dword [esp + 0x30]
mov dword [ecx], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x2d3f190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov word [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x7a797867
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1d
ja 0x2d3f233
nop
nop
nop
nop
mov ecx, dword [esp + 8]
mov eax, dword [esp + 8]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx - 0x304c7791]
add ecx, 0x6f
xor ecx, eax
xor eax, edx
and ecx, edx
sub eax, ecx
mov ecx, eax
xor ecx, 0xf6
and eax, 0x76
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1e
jb 0x2d3f1f0
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [0x2d4dd6c]
test edx, edx
je 0x2d3f288
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x2d4dd70]
nop
cmp dword [ebx + edi*8], 0x904d52bc
je 0x2d3f260
inc edi
cmp edx, edi
jne 0x2d3f250
jmp 0x2d3f288
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x2d3f288
lea eax, [esp + 0x10]
lea edi, [esp + 8]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x2d4dd74]
push edx
call fcn.02d3c030
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x2d3f295
mov edx, dword [esp + 0x18]
mov dword [esi], edx
test ecx, ecx
je 0x2d3f2a1
cmp byte [esp + 0x25], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x2d3f2b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov word [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x7a797867
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1d
ja 0x2d3f353
nop
nop
nop
nop
mov ecx, dword [esp + 8]
mov eax, dword [esp + 8]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx - 0x304c7791]
add ecx, 0x6f
xor ecx, eax
xor eax, edx
and ecx, edx
sub eax, ecx
mov ecx, eax
xor ecx, 0xf6
and eax, 0x76
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1e
jb 0x2d3f310
mov eax, dword [esp + 0x10]
mov edi, dword [0x2d4dd6c]
test edi, edi
je 0x2d3f3ad
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x2d4dd70]
nop
cmp dword [esi + ebx*8], 0xcdf6794a
je 0x2d3f380
inc ebx
cmp edi, ebx
jne 0x2d3f370
jmp 0x2d3f3ad
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x2d3f3ad
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x2d4dd74]
push edi
call fcn.02d3c030
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x2d3f4a8
mov word [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x7a797867
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1d
ja 0x2d3f453
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov eax, dword [esp + 4]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx - 0x304c7791]
add ecx, 0x6f
xor ecx, eax
xor eax, edx
and ecx, edx
sub eax, ecx
mov ecx, eax
xor ecx, 0xf6
and eax, 0x76
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x1e
jb 0x2d3f410
mov eax, dword [esp + 0x10]
mov ecx, dword [0x2d4dd6c]
test ecx, ecx
je 0x2d3f4a0
xor edx, edx
mov esi, dword [0x2d4dd70]
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x7a1a689f
je 0x2d3f480
inc edx
cmp ecx, edx
jne 0x2d3f470
jmp 0x2d3f4a0
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x2d3f4a0
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x2d4dd74]
push ecx
call fcn.02d3c030
add esp, 0x18
test eax, eax
js 0x2d3f4a8
mov eax, dword [esp + 8]
test edi, edi
je 0x2d3f4bb
xor ecx, ecx
cmp eax, 0xc0000011
je 0x2d3f4b9
mov ecx, dword [esp + 0xc]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret