joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12e0460
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0x1785196d
mov dword [esp + 0x40], 0x138b1592
mov dword [esp + 0x44], 0xf9a1184
mov dword [esp + 0x48], 0xb590d6d
mov dword [esp + 0x4c], 0x7540945
mov dword [esp + 0x50], 0x3220554
mov dword [esp + 0x54], 0x3f550158
mov dword [esp + 0x58], 0x3ba83da5
mov dword [esp + 0x5c], 0x37a539a4
mov dword [esp + 0x60], 0x33bd35bf
mov dword [esp + 0x64], 0x2f5c3110
mov dword [esp + 0x68], 0x2b0a2d40
mov dword [esp + 0x6c], 0x27762979
mov dword [esp + 0x70], 0x23722576
mov dword [esp + 0x74], 0x5f7e2167
mov dword [esp + 0x78], 0x5bc35d37
mov dword [esp + 0x7c], 0x571c59ca
mov dword [esp + 0x80], 0x53155518
mov dword [esp + 0x84], 0x4fc65170
mov dword [esp + 0x88], 0x4b064d06
mov dword [esp + 0x8c], 0x47664911
mov dword [esp + 0x90], 0x43d24505
mov dword [esp + 0x94], 0x7fea41d0
mov dword [esp + 0x98], 0x7b117de1
mov dword [esp + 0x9c], 0x77e879e5
mov dword [esp + 0xa0], 0x73eb7503
mov dword [esp + 0xa4], 0x6f3d71fc
mov dword [esp + 0xa8], 0x6b256d21
mov dword [esp + 0xac], 0x67346923
mov dword [esp + 0xb0], 0x6328652b
mov dword [esp + 0xb4], 0x9fc66140
mov dword [esp + 0xb8], 0x9be29deb
mov dword [esp + 0xbc], 0x97e399f4
mov dword [esp + 0xc0], 0x93c695e0
mov dword [esp + 0xc4], 0x8f1a91b0
mov dword [esp + 0xc8], 0x8b1d8d15
mov dword [esp + 0xcc], 0x87a68915
mov dword [esp + 0xd0], 0x831f85ff
mov dword [esp + 0xd4], 0xbf29811f
mov dword [esp + 0xd8], 0xbbe3bd2f
mov dword [esp + 0xdc], 0xb7c9b998
mov dword [esp + 0xe0], 0xb33cb52c
mov dword [esp + 0xe4], 0xaf3bb123
mov dword [esp + 0xe8], 0xabf9ad31
mov dword [esp + 0xec], 0xa7f7a9f9
mov dword [esp + 0xf0], 0xa3f0a5ed
mov dword [esp + 0xf4], 0xdf8ca1f0
mov dword [esp + 0xf8], 0xdb88dd8c
mov dword [esp + 0xfc], 0xd7f6d988
mov dword [esp + 0x100], 0xd3b3d5bb
mov dword [esp + 0x104], 0xcfafd14a
mov dword [esp + 0x108], 0xcb53cd42
mov dword [esp + 0x10c], 0xc78bc99b
mov dword [esp + 0x110], 0xc389c58b
mov dword [esp + 0x114], 0xffb1c192
mov dword [esp + 0x118], 0xfbfafdb6
mov byte [esp + 0x11e], 0
mov word [esp + 0x11c], 0
mov eax, dword [0x131f02c]
mov ecx, 0x42dadf06
mov edx, 0xf9
movzx esi, byte [esp + ecx - 0x42dadeca]
mov edi, edx
and edi, 0x88
mov ebx, ecx
xor ebx, 0x88
or ebx, edi
xor ebx, esi
xor ebx, 0x88
add bl, 0xe2
mov byte [esp + ecx - 0x42dadeca], bl
inc ecx
dec edx
cmp ecx, 0x42dadfe9
jne 0x12e06c0
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
jmp dword [eax*4 + 0x1319c64]
Function at 0x12ecc20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x12ecc40
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x12ecc60
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x12ecc80
mov eax, 0xffffffff
jmp 0x12ecc89
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.012dc880
add esp, 4
movzx ecx, word [esi]
mov dword [esp + 4], eax
test cx, cx
je 0x12eccc1
add esi, 2
mov eax, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x12eccb0
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0x12eccf3
lea edx, [ebp + 2]
mov esi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x12ecce0
jmp 0x12eccf7
mov esi, dword [esp + 4]
mov word [eax], 0
lea eax, [esp + 8]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.01314520
add esp, 0x14
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x131b00c]
Function at 0x12f1100
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov edi, dword [esp + 0x60]
xor eax, eax
test edi, edi
setne al
xor ebx, ebx
mov dword [esp + 0x38], 0
mov dword [esp], 0
jmp dword [eax*4 + 0x131b654]
Function at 0x12f8090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x1c
mov ebx, esp
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x5c], 0xf935fbd7
mov dword [ebp - 0x58], 0xe576e768
mov dword [ebp - 0x54], 0xe10de328
mov dword [ebp - 0x50], 0xed01ef7c
mov dword [ebp - 0x4c], 0xe90eebc7
mov dword [ebp - 0x48], 0x957e9714
mov dword [ebp - 0x44], 0x9100930f
mov dword [ebp - 0x40], 0x9d759f7c
mov dword [ebp - 0x3c], 0x99749b02
mov dword [ebp - 0x38], 0x8518870f
mov dword [ebp - 0x34], 0x81668368
mov dword [ebp - 0x30], 0x8d108f70
mov dword [ebp - 0x2c], 0x89608b1d
mov dword [ebp - 0x28], 0xb522b71f
mov dword [ebp - 0x24], 0xb12fb35f
lea eax, [ebp - 0x20]
mov word [ebp - 0x20], 0xbfb0
mov dword [ebp - 0x1e], 0
mov byte [ebp - 0x1a], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xab
xor dl, byte [ebp + ecx - 0x5c]
add dl, 0xa9
mov byte [ebp + ecx - 0x5c], dl
inc ecx
cmp ecx, 0x43
jne 0x12f8130
lea esi, [ebp - 0x9a]
lea edx, [ebp - 0x5c]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [ebp - 0x5e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, dword [ebp - 0x10]
push edi
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x1320370]
mov edi, dword [edi]
test edi, edi
jns 0x12f8189
mov eax, 0xffffffff
jmp 0x12f818c
lea eax, [edi + edi]
push eax
call fcn.012dc880
add esp, 4
push dword [ebp - 0x10]
push edi
mov dword [ebp - 0x14], eax
push eax
push 0x1e
lea eax, [ebp - 0x9a]
push eax
push 0
call dword [0x1320370]
mov dword [ebx], 0x137a116c
mov dword [ebx + 4], 0x1f881d81
mov dword [ebx + 8], 0x1b771974
mov dword [ebx + 0xc], 0x7640596
mov dword [ebx + 0x10], 0x3900169
mov dword [ebx + 0x14], 0xf0e0d60
mov word [ebx + 0x18], 0
mov byte [ebx + 0x1a], 0
xor edx, edx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx + ecx]
mov dword [ebp - 0x10], eax
mov edi, ecx
xor edi, 0x3cfb82b2
mov esi, edx
and esi, 0x1a
sub esi, edi
lea ebx, [esi + 0x1ed585b6]
and ebx, eax
mov eax, ebx
and eax, 0xfffffffd
mov edi, ebx
or edi, 0xfd
inc edi
imul edi, eax
mov eax, ebx
and eax, 2
or ebx, 2
imul ebx, eax
sub edi, ebx
mov ebx, dword [ebp - 0x18]
lea eax, [edi + esi]
add eax, 0x1ed585b6
add al, byte [ebp - 0x10]
add al, 0xec
mov byte [ebx + ecx], al
inc ecx
add edx, 2
cmp ecx, 0x1b
jne 0x12f81f0
push 0
push 0
push ebx
mov esi, dword [ebp - 0x14]
push esi
push dword [ebp + 8]
call fcn.012f35b0
add esp, 0x14
jmp dword [0x131bfc8]
Function at 0x12f8290
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x21ec
call fcn.012dc7e0
mov dword [esp + 0x11ec], 0x13601174
mov dword [esp + 0x11f0], 0x1f511d51
mov dword [esp + 0x11f4], 0x1b691951
mov dword [esp + 0x11f8], 0x7740578
mov dword [esp + 0x11fc], 0x3660179
mov dword [esp + 0x1200], 0xf7d0d71
mov dword [esp + 0x1204], 0xb780945
mov dword [esp + 0x1208], 0x3534
mov byte [esp + 0x120c], 0
mov eax, 0x5bc1284
mov ecx, 0x1243ed7b
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x5bc0098]
mov edi, ecx
and edi, 0x12018d58
mov edx, eax
and edx, 0x43810a7
or edx, edi
xor edx, esi
mov esi, edx
xor esi, 0xdf29d3cd
add edx, edx
and edx, 0x242302d4
xor edx, 0xb6030690
sub edx, esi
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + eax - 0x5bc0098], dl
inc eax
dec ecx
cmp eax, 0x5bc12a5
jne 0x12f8310
lea eax, [esp + 0x34]
lea esi, [esp + 0x11ec]
push 0
push 0
push 0x20019
push eax
push esi
call fcn.01314c40
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0x131bfe0]

Function at 0x12fa040
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x840
xor ebp, ebp
mov dword [esp + 8], 0
mov dword [esp], 0x20219
mov eax, 1
mov dword [esp + 4], 0
jmp dword [eax*4 + 0x131c648]
Function at 0x12fb070
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.012fb090
add esp, 4
test al, al
je 0x12fba10
mov al, 1
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
push eax
mov dword [ebp - 0x2c], esp
sub esp, 0x24
mov esi, esp
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x40
mov dword [ebp - 0x18], esp
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], eax
push eax
mov dword [ebp - 0x50], esp
push eax
mov dword [ebp - 0x4c], esp
push eax
mov dword [ebp - 0x34], esp
sub esp, 0x28
mov dword [ebp - 0x40], esp
sub esp, 8
mov dword [ebp - 0xc8], esp
sub esp, 8
mov dword [ebp - 0xc4], esp
sub esp, 8
mov dword [ebp - 0x44], esp
sub esp, 0x24
mov dword [ebp - 0x48], esp
mov dword [ebp - 0xc0], 0x9780b5b
mov dword [ebp - 0xbc], 0x58a0785
mov dword [ebp - 0xb8], 0x176037b
mov dword [ebp - 0xb4], 0x1d4e1f74
mov dword [ebp - 0xb0], 0x19961b63
mov dword [ebp - 0xac], 0x15161760
mov eax, 0x74b62903
nop
nop
nop
nop
nop
movzx ecx, byte [ebp + eax - 0x74b629c3]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xf1
mov byte [ebp + eax - 0x74b629c3], cl
inc eax
cmp eax, 0x74b6291b
jne 0x12fbab0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xa8], 0x3d001dc
mov dword [ebp - 0xa4], 0x7c105c1
mov dword [ebp - 0xa0], 0xbd909c1
mov dword [ebp - 0x9c], 0xfdc0dd8
mov dword [ebp - 0x98], 0x13ce11c9
mov dword [ebp - 0x94], 0x17d715d9
mov dword [ebp - 0x90], 0x1bd219db
mov dword [ebp - 0x8c], 0x1fd01dd5
mov dword [ebp - 0x88], 0x23fe21e5
mov dword [ebp - 0x84], 0x27e925f7
mov dword [ebp - 0x80], 0x2bfe29ee
mov dword [ebp - 0x7c], 0x2fef2dfb
mov dword [ebp - 0x78], 0x33f731e2
mov dword [ebp - 0x74], 0x37e035e8
mov dword [ebp - 0x70], 0x3bd639d9
mov dword [ebp - 0x6c], 0x3fdb3dca
mov dword [ebp - 0x68], 0xc311c11c
mov dword [ebp - 0x64], 0xc723c530
mov dword [ebp - 0x60], 0xcb27c929
mov word [ebp - 0x5c], 0xcdcc
mov dword [ebp - 0x5a], 0
mov eax, 0x39a40
mov ecx, 0x6fbc65bf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ebp + eax - 0x39ae8]
mov esi, ecx
and esi, 0x46b4202c
mov edx, eax
and edx, 0x312d3
or edx, esi
xor edx, 0xd3
or edx, edi
lea esi, [ecx - 0x6fbc6500]
and esi, edi
not edx
or edx, esi
add dl, 0xc0
mov byte [ebp + eax - 0x39ae8], dl
inc eax
dec ecx
cmp eax, 0x39a92
jne 0x12fbba0
lea eax, [ebp - 0xc0]
lea edi, [ebp - 0xa8]
push eax
push edi
call fcn.0130c4c0
add esp, 8
mov ebx, eax
xor eax, eax
test ebx, ebx
sete al
jmp dword [eax*4 + 0x131c7b8]
Function at 0x12fdba0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xb8
mov dword [esp + 0x24], 0xc303c125
mov dword [esp + 0x28], 0xc756c554
mov dword [esp + 0x2c], 0xcb6bc90c
mov dword [esp + 0x30], 0xcf6fcd58
mov dword [esp + 0x34], 0xb30eb155
mov dword [esp + 0x38], 0xb719b57a
mov dword [esp + 0x3c], 0xbb1fb92c
mov dword [esp + 0x40], 0xbf1fbd2c
mov dword [esp + 0x44], 0xa349a104
mov dword [esp + 0x48], 0xa71aa54f
mov dword [esp + 0x4c], 0xab0fa93b
mov dword [esp + 0x50], 0xaf3dad3f
mov dword [esp + 0x54], 0x933d9139
mov dword [esp + 0x58], 0x9778953a
mov dword [esp + 0x5c], 0x9b379900
mov dword [esp + 0x60], 0x9f9e9d30
lea eax, [esp + 0x64]
mov dword [esp + 0x64], 0
mov ecx, 0xb0
mov edx, 0x4f
movzx ebx, byte [esp + ecx - 0x8c]
mov esi, ebx
not esi
or esi, edx
or ebx, ecx
and ebx, esi
add bl, 0x90
mov byte [esp + ecx - 0x8c], bl
inc ecx
dec edx
cmp ecx, 0xf4
jne 0x12fdc40
lea ebx, [esp + 0x78]
lea edx, [esp + 0x24]
mov edi, ebx
mov ecx, 0x10
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xb8]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x74]
push esi
push 0
push 0
push 0x1f
push ebx
push 0
call dword [0x1320370]
mov edi, dword [esp + 0x74]
test edi, edi
jns 0x12fdcac
mov eax, 0xffffffff
jmp 0x12fdcaf
lea eax, [edi + edi]
push eax
call fcn.012dc880
add esp, 4
mov ebp, eax
push esi
push edi
push eax
push 0x1f
push ebx
push 0
call dword [0x1320370]
lea eax, [esp + 0x18]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.01314520
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x131ca10]
Function at 0x12ff570
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov esi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
cmp byte [ebx + eax], 0
lea eax, [eax + 1]
jne 0x12ff590
add eax, ebx
dec eax
mov ecx, ebx
not ecx
and ecx, eax
xor eax, ebx
add ecx, ecx
sub ecx, eax
mov dword [esp + 4], ecx
lea ebp, [ecx + 1]
mov dword [esp + 8], ebp
push ebp
call fcn.012dc880
add esp, 4
mov dword [esp], esi
mov dword [esi], eax
mov ecx, ebp
shr ecx, 2
mov edx, ebx
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebp
and edx, 0xfffffffc
add eax, edx
add edx, ebx
mov esi, ebp
and esi, 3
mov ecx, esi
shr ecx, 1
mov dword [esp + 0xc], edx
mov edi, eax
mov ebp, dword [esp + 0xc]
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
mov ebp, dword [esp + 8]
mov ecx, ebp
xor ecx, 2
and ecx, esi
je 0x12ff612
and ebp, 2
add edx, ebp
add eax, ebp
push ecx
push edx
push eax
call fcn.012dc8b0
add esp, 0xc
cmp dword [esp + 4], 0
je 0x12ff6cb
mov ecx, 0xffffffff
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ebx + eax]
xor edi, ecx
mov ecx, edi
shr ecx, 1
mov edx, edi
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov esi, edx
shr esi, 1
mov ecx, edi
shl ecx, 0x1e
sar ecx, 0x1f
and ecx, 0xedb88320
xor ecx, esi
mov ebp, edi
shl ebp, 0x1d
sar ebp, 0x1f
and ebp, 0x76dc419
mov esi, edi
shl esi, 0x1c
sar esi, 0x1f
and esi, 0xedb8832
xor esi, ebp
mov ebp, edi
shl ebp, 0x1b
sar ebp, 0x1f
and ebp, 0x1db71064
shl edi, 0x1a
sar edi, 0x1f
and edi, 0x3b6e20c8
xor edi, ebp
xor edi, esi
mov esi, ecx
shr esi, 6
xor edi, esi
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
xor edx, edi
shl ecx, 0x1a
sar ecx, 0x1f
and ecx, 0xedb88320
xor ecx, edx
inc eax
cmp dword [esp + 4], eax
jne 0x12ff630
not ecx
jmp 0x12ff6cd
xor ecx, ecx
mov eax, dword [esp]
mov dword [eax + 4], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x13069a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.012de190
sub esp, 8
push eax
test ebx, ebx
sets al
mov ecx, ebx
sub ecx, 1
sete cl
or al, cl
mov ecx, ebx
sub ecx, 0x25
setge cl
or al, cl
test al, 1
jne 0x13069d7
jmp 0x13069dc
jmp 0x1306b5e
mov ecx, edi
mov eax, dword [ebp + 0x10]
add ecx, eax
add ecx, 0xffffffff
mov byte [edi + eax - 1], 0
cmp esi, 0
jne 0x13069ff
add ecx, 0xffffffff
jmp 0x13069f5
mov byte [ecx], 0x30
jmp 0x13069fa
jmp 0x1306b5a
cmp ebx, 0xa
sete al
test al, 1
jne 0x1306a0e
jmp 0x1306a9a
jmp 0x1306a10
cmp esi, 0x64
setae al
test al, 1
jne 0x1306a1c
jmp 0x1306a56
mov edi, 0x64
mov eax, esi
xor edx, edx
div edi
shl edx, 1
mov al, byte [edx + 0x13176d9]
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], al
mov al, byte [edx + 0x13176d8]
add edi, 0xffffffff
mov byte [ecx - 2], al
mov ecx, 0x64
mov eax, esi
xor edx, edx
div ecx
mov esi, eax
mov ecx, edi
jmp 0x1306a10
cmp esi, 0xa
setb al
test al, 1
jne 0x1306a62
jmp 0x1306a73
mov dl, byte [esi + 0x1317fd5]
mov eax, ecx
add eax, 0xffffffff
mov byte [ecx - 1], dl
jmp 0x1306a93
shl esi, 1
mov dl, byte [esi + 0x13176d9]
mov eax, ecx
add eax, 0xffffffff
mov byte [ecx - 1], dl
mov dl, byte [esi + 0x13176d8]
add eax, 0xffffffff
mov byte [ecx - 2], dl
jmp 0x1306a93
mov ecx, eax
jmp 0x1306b5a
cmp ebx, 0x10
je 0x1306aa4
jmp 0x1306b2b
jmp 0x1306aa6
cmp esi, 0x100
jb 0x1306adb
mov edx, esi
and edx, 0xff
shl edx, 1
mov bl, byte [edx + 0x13177a2]
mov eax, ecx
add eax, 0xffffffff
mov byte [ecx - 1], bl
mov dl, byte [edx + 0x13177a1]
add eax, 0xffffffff
mov byte [ecx - 2], dl
shr esi, 8
mov ecx, eax
jmp 0x1306aa6
cmp esi, 0x10
jae 0x1306aee
mov al, byte [esi + 0x1317fd5]
add ecx, 0xffffffff
mov byte [ecx], al
jmp 0x1306b5a
mov edx, esi
and edx, 0xfffffffd
mov eax, esi
or eax, 0xfffffffd
xor eax, 0xffffffff
imul eax, edx
mov edx, esi
and edx, 2
or esi, 2
imul esi, edx
add esi, eax
mov al, byte [esi + 0x13177a2]
mov edx, ecx
add edx, 0xffffffff
mov byte [ecx - 1], al
mov al, byte [esi + 0x13177a1]
add edx, 0xffffffff
mov byte [ecx - 2], al
mov ecx, edx
jmp 0x1306b5a
cmp esi, 0
seta al
test al, 1
jne 0x1306b37
jmp 0x1306b58
mov eax, esi
xor edx, edx
div ebx
mov al, byte [edx + 0x1317fd5]
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], al
mov eax, esi
xor edx, edx
div ebx
mov esi, eax
mov ecx, edi
jmp 0x1306b2b
jmp 0x1306b5a
mov edi, ecx
jmp 0x1306b5e
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x130e210
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x131e10c]

Function at 0x130e2c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0xf4f5f6f7
mov eax, 0x92bb3fd4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x6d44c02c]
xor ecx, eax
mov edx, ecx
not edx
add ecx, 0x2257c0db
or edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
mov byte [esp + eax + 0x6d44c02c], cl
inc eax
cmp eax, 0x92bb3fd8
jne 0x130e2f0
mov edi, dword [esp]
mov eax, dword [0x1320374]
test eax, eax
je 0x130e376
xor ecx, ecx
mov edx, dword [0x1320378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x130e350
inc ecx
cmp eax, ecx
jne 0x130e340
jmp 0x130e376
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x130e376
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x132037c]
push eax
call fcn.01310f10
add esp, 0x1c
mov edi, eax
mov dword [esp], 0xff3e393c
mov byte [esp + 4], 0
mov eax, 0x7302b58a
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x7302b58a]
xor ecx, eax
mov edx, ecx
and edx, 0x4d
xor ecx, 0x4d
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x7302b58a], cl
inc eax
cmp eax, 0x7302b58f
jne 0x130e390
cmp edi, dword [esp]
jne 0x130e4c5
mov dword [esp + 0xc], esi
push dword [esp + 8]
call fcn.0130e1b0
add esp, 4
mov ebp, dword [esp + 8]
mov dword [esp], 0xf4f5f6f7
mov edx, 0x92bb3fd4
nop
movzx ecx, byte [esp + edx + 0x6d44c02c]
xor ecx, edx
mov esi, ecx
not esi
add ecx, 0x2257c0db
or esi, ecx
and esi, 1
or ecx, 1
add ecx, esi
mov byte [esp + edx + 0x6d44c02c], cl
inc edx
cmp edx, 0x92bb3fd8
jne 0x130e3e0
mov edi, dword [esp]
mov edx, dword [0x1320374]
test edx, edx
je 0x130e465
xor ecx, ecx
mov esi, dword [0x1320378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ecx*8], 0x9abdb589
je 0x130e440
inc ecx
cmp edx, ecx
jne 0x130e430
jmp 0x130e465
mov edx, dword [esi + ecx*8 + 4]
cmp edx, edi
je 0x130e465
push 0
push ebp
push eax
push 5
push 4
push dword [0x132037c]
push edx
mov esi, eax
call fcn.01310f10
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x130e4bc
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x130e495
add edi, 2
cmp si, bp
je 0x130e480
cmp si, bp
je 0x130e4a7
mov esi, dword [ecx]
test esi, esi
jne 0x130e470
mov edi, 0xc0000225
jmp 0x130e4bc
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0130e210
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x130e510
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x130e5e0
xor eax, eax
cmp dword [ecx], 0
jne 0x130e60a
mov edx, dword [esp + 0x34]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0xf4f5f6f7
mov eax, 0x92bb3fd4
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x6d44c02c]
xor ebx, eax
mov esi, ebx
not esi
add ebx, 0x2257c0db
or esi, ebx
and esi, 1
or ebx, 1
add ebx, esi
mov byte [esp + eax + 0x6d44c02c], bl
inc eax
cmp eax, 0x92bb3fd8
jne 0x130e580
mov eax, dword [esp]
mov esi, dword [0x1320374]
test esi, esi
je 0x130e60a
xor edi, edi
mov ebx, dword [0x1320378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x130e613
inc edi
cmp esi, edi
jne 0x130e5d0
jmp 0x130e60a
mov dword [esp + 4], 0x43020108
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x40
xor cl, byte [esp + eax + 4]
add cl, 0xc0
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 4
jne 0x130e5f0
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x130e60a
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 4
push dword [0x132037c]
push esi
call fcn.01310f10
add esp, 0x1c
jmp 0x130e60a

Function at 0x130e650
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x130e6fa
push ebx
push edi
push esi
push eax
mov dword [esp], 0xf4f5f6f7
mov edx, 0x92bb3fd4
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx + 0x6d44c02c]
xor ebx, edx
mov esi, ebx
not esi
add ebx, 0x2257c0db
or esi, ebx
and esi, 1
or ebx, 1
add ebx, esi
mov byte [esp + edx + 0x6d44c02c], bl
inc edx
cmp edx, 0x92bb3fd8
jne 0x130e670
mov edx, dword [0x1320374]
test edx, edx
je 0x130e6ee
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x1320378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x130e6d0
inc edi
cmp edx, edi
jne 0x130e6c0
jmp 0x130e6ee
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x130e6ee
push eax
push 1
push dword [0x132037c]
push edx
mov esi, ecx
call fcn.01310f10
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
ret