joyce8/EMBER2024-capa huggingface dataset:
Function at 0x38593cf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi], 0x4550
jne 0x38593f28
cmp dword [esi + 0xdc14], 0x800
jb 0x38593f28
mov eax, dword [esi + 0x94cd]
cmp eax, dword [esi + 0x9545]
je 0x38593f28
mov eax, dword [esi + 0x955d]
and eax, 0xa0000020
cmp eax, 0xa0000020
jne 0x38593f28
xor edi, edi
cmp byte [esi + edi + 0x400], 0xe8
je 0x38593d55
inc edi
cmp edi, 0x3fb
jl 0x38593d42
cmp byte [edi + esi + 0x400], 0xe8
jne 0x38593f28
mov ecx, dword [edi + esi + 0x401]
mov eax, dword [esi + 0x28]
add ecx, edi
add eax, 5
add eax, ecx
push eax
push esi
call 0x37ea5270
mov edx, eax
add esp, 8
mov eax, dword [esi + 0x94d5]
mov dword [ebp - 8], edx
cmp edx, eax
jb 0x38593f28
mov ecx, edx
sub ecx, eax
cmp ecx, dword [esi + 0x94d1]
ja 0x38593f28
mov eax, dword [esi + 0xdc14]
sub eax, 0x51
cmp edx, eax
ja 0x38593f28
push 0x51
lea ebx, [esi + 0x1400]
push ebx
push edx
push esi
call 0x37e6d7f0
add esp, 0x10
cmp eax, 0x51
jne 0x38593f28
cmp byte [ebx], 0xe8
jne 0x38593f28
cmp dword [esi + 0x1401], 0
jne 0x38593f28
cmp byte [esi + 0x1405], 0x5d
jne 0x38593f28
mov eax, 0xed81
cmp word [esi + 0x1406], ax
jne 0x38593f28
mov eax, 0xb5ff
cmp word [esi + 0x140c], ax
jne 0x38593f28
cmp word [esi + 0x1429], ax
jne 0x38593f28
cmp byte [esi + 0x142f], 0xc3
jne 0x38593f28
mov eax, dword [esi + 0x144d]
mov ecx, dword [esi + 0x34]
sub eax, ecx
test eax, eax
jle 0x38593f28
cmp eax, dword [esi + 0x50]
ja 0x38593f28
sub eax, edi
sub eax, dword [esi + 0x28]
sub eax, 5
mov dword [ebp - 4], eax
mov al, byte [esi + 0x1444]
mov byte [ebp + 0xb], al
test al, al
je 0x38593f28
mov eax, dword [esi + 0x1449]
mov ebx, dword [esi + 0x1440]
sub eax, ecx
push eax
push esi
call 0x37ea5270
mov edx, eax
add esp, 8
mov eax, dword [esi + 0x954d]
mov dword [ebp - 0xc], edx
cmp edx, eax
jb 0x38593f28
mov ecx, edx
sub ecx, eax
cmp ecx, dword [esi + 0x9549]
ja 0x38593f28
cmp ebx, 0x800
jbe 0x38593eaf
mov ebx, 0x800
mov eax, dword [esi + 0xdc14]
cmp eax, ebx
jb 0x38593f28
sub eax, ebx
cmp edx, eax
ja 0x38593f28
push ebx
lea eax, [esi + 0x1400]
push eax
push edx
push esi
call 0x37e6d7f0
add esp, 0x10
cmp eax, ebx
jne 0x38593f28
lea ecx, [esi + 0x1400]
test ebx, ebx
je 0x38593eee
mov dl, byte [ebp + 0xb]
mov eax, ecx
xor byte [eax], dl
lea eax, [eax + 1]
sub ebx, 1
jne 0x38593ee4
cmp byte [ecx], 0xe8
jne 0x38593f28
cmp dword [esi + 0x1401], 0
jne 0x38593f28
lea eax, [edi + 1]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x1404], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x1408], eax
mov eax, dword [ebp - 0xc]
pop edi
mov dword [esi + 0x140c], eax
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x38594920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [edx], 0x4550
jne 0x38594a20
cmp dword [edx + 0xdc14], 0x800
jb 0x38594a20
mov al, byte [edx + 0x402]
test al, al
jle 0x38594a20
movsx ecx, al
mov eax, 0x3fe
sub eax, ecx
cmp eax, 0x380
jl 0x38594a20
lea esi, [edx + 0x403]
add esi, ecx
lea edi, [edx + 0x1400]
mov ecx, 0xe0
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor bl, bl
lea edi, [edx + 0x1400]
add edi, esi
movzx eax, byte [edi]
movzx ecx, word [eax*2 + 0x7428fa8]
movzx eax, byte [edi + 1]
movzx eax, byte [ecx + eax + 0x74291a8]
test eax, eax
jne 0x385949b0
push edi
call 0x37e8c7b0
mov edx, dword [ebp + 8]
add esp, 4
cmp eax, 0xffffffff
je 0x38594a20
movzx ecx, byte [edi]
sub ecx, 0xb6
je 0x38594a0e
sub ecx, 0x35
jne 0x38594a15
cmp byte [esi + edx + 0x1401], cl
jge 0x38594a15
test bl, bl
je 0x38594a15
add esi, 2
cmp esi, 0x380
jge 0x38594a04
lea ecx, [edx + 0x1400]
mov edx, 0x380
add ecx, esi
sub edx, esi
lea esp, [esp]
mov al, byte [ecx]
test al, al
je 0x385949fe
cmp al, bl
je 0x385949fe
xor al, bl
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x385949f0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov bl, byte [esi + edx + 0x1401]
add esi, eax
cmp esi, 0x40
jl 0x38594981
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x3859c8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0xdc14], 0x800
jb 0x3859c950
cmp word [ebx + 0xdc4c], 0
jne 0x3859c950
push esi
push edi
lea eax, [ebx + 0x1400]
mov ecx, 0x100
lea esi, [ebx + 0x400]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
pop edi
xor edx, edx
mov ecx, 0x100
pop esi
lea ecx, [ecx]
add edx, ecx
lea eax, [eax + 2]
xor word [eax - 2], dx
sub ecx, 1
jne 0x3859c920
mov eax, dword [ebx + 0x143c]
cmp eax, 0x3fc
ja 0x3859c950
cmp dword [eax + ebx + 0x1400], 0x4550
jne 0x3859c950
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x3859c960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov ebx, dword [eax + 0xdc14]
mov dword [ebp - 4], esi
push edi
test ebx, ebx
je 0x3859ca10
lea edi, [eax + 0x1400]
cmp ebx, 0x800
jl 0x3859ca1c
push 0x800
push edi
push esi
push eax
call 0x37e6d7f0
add esp, 0x10
cmp eax, 0x800
jne 0x3859ca74
mov esi, edi
mov edi, 2
xor edx, edx
mov ecx, 0x100
mov eax, esi
lea ebx, [ebx]
add edx, ecx
lea eax, [eax + 2]
xor word [eax - 2], dx
sub ecx, 1
jne 0x3859c9c0
add esi, 0x400
sub edi, 1
jne 0x3859c9b1
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 4]
push 0x800
lea edi, [ecx + 0x1400]
push edi
push esi
push ecx
call 0x37e6d820
add esp, 0x10
cmp eax, 0x800
jne 0x3859ca74
add esi, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], esi
add ebx, 0xfffff800
jne 0x3859c983
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push edi
push esi
push eax
call 0x37e6d7f0
add esp, 0x10
cmp eax, ebx
jne 0x3859ca74
mov esi, edi
mov edi, 2
xor edx, edx
mov eax, 0x100
mov ecx, esi
lea esp, [esp]
add edx, eax
lea ecx, [ecx + 2]
xor word [ecx - 2], dx
sub eax, 1
jne 0x3859ca40
add esi, 0x400
sub edi, 1
jne 0x3859ca33
mov ecx, dword [ebp + 8]
push ebx
lea eax, [ecx + 0x1400]
push eax
push dword [ebp - 4]
push ecx
call 0x37e6d820
add esp, 0x10
cmp eax, ebx
je 0x3859ca10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3859ccc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x10000
push esi
call 0x37fbac60
add esp, 8
test eax, eax
jne 0x3859cd53
push esi
call 0x37fbbbe0
add esp, 4
test eax, eax
jne 0x3859cd53
lea eax, [ebp - 4]
push eax
push esi
call 0x37fbbb70
add esp, 8
test eax, eax
jne 0x3859cd53
lea esp, [esp]
mov edx, dword [ebp - 4]
cmp byte [edx + 0x94], 0x4d
jne 0x3859cd42
cmp byte [edx + 0x95], 0x5a
jne 0x3859cd42
push edx
push esi
call fcn.3859cc80
add esp, 8
cmp eax, 1
jne 0x3859cd42
mov eax, dword [edx + 0x84]
test eax, eax
je 0x3859cd42
mov ecx, dword [edx + 0x8c]
test ecx, ecx
je 0x3859cd42
add eax, ecx
cmp eax, dword [esi + 0xdc14]
jbe 0x3859cd5b
lea eax, [ebp - 4]
push eax
push esi
call 0x37fbbb70
add esp, 8
test eax, eax
je 0x3859cd00
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0x200
lea edi, [esi + 0x1400]
push edi
push dword [edx + 0x84]
push esi
call 0x37e6d7f0
add esp, 0x10
cmp eax, 0x200
jne 0x3859cd53
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x3859cd53
cmp dword [esi + 0x140c], 0x4550
jne 0x3859cd53
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov ecx, dword [edx + 0x84]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [edx + 0x8c]
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x3859dd80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
xor eax, eax
test edx, edx
je 0x3859dda1
push ebx
mov bl, byte [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
xor byte [eax + esi], bl
lea ecx, [eax + esi]
inc eax
cmp eax, edx
jb 0x3859dd94
pop esi
pop ebx
pop ebp
ret
Function at 0x3859f700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
xor eax, eax
test edx, edx
je 0x3859f721
push ebx
mov bl, byte [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
xor byte [eax + esi], bl
lea ecx, [eax + esi]
inc eax
cmp eax, edx
jb 0x3859f714
pop esi
pop ebx
pop ebp
ret
Function at 0x385b0820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi], 0x4550
jne 0x385b09e7
cmp word [esi + 0xdc4c], 1
jne 0x385b09e7
mov eax, 0x2000
test word [esi + 0x16], ax
jne 0x385b09e7
cmp dword [esi + 0xdc14], 0x800
jb 0x385b09e7
cmp word [esi + 6], 3
jne 0x385b09e7
mov eax, dword [esi + 0x1c]
sub eax, 0x5000
cmp eax, 0x2000
ja 0x385b09e7
mov eax, dword [esi + 0x20]
sub eax, 0x4000
cmp eax, 0x2000
ja 0x385b09e7
cmp dword [esi + 0x78], 0
jne 0x385b09e7
cmp dword [esi + 0x88], 0
jne 0x385b09e7
cmp dword [esi + 0xa0], 0
jne 0x385b09e7
cmp dword [esi + 0xa8], 0
jne 0x385b09e7
cmp dword [esi + 0xc0], 0
jne 0x385b09e7
cmp dword [esi + 0x58], 0
jne 0x385b09e7
push 8
push esi
call 0x37fb8c60
add esp, 8
test eax, eax
jne 0x385b09e7
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 3
push esi
call 0x37fb8e60
add esp, 0x10
test eax, eax
jne 0x385b09e7
cmp dword [ebp - 4], 0x838
jb 0x385b09e7
mov ebx, dword [ebp + 8]
mov dl, byte [ebx + 0x38]
xor dl, 0xe8
jne 0x385b0930
mov dl, byte [ebx + 0x460]
test dl, dl
je 0x385b09e7
xor ecx, ecx
lea edi, [esi + 0x1400]
jmp 0x385b0940
mov al, byte [ebx + ecx + 0x38]
xor al, dl
mov byte [edi + ecx], al
inc ecx
cmp ecx, 0x800
jl 0x385b0940
push 0x800
push edi
push 0x1b
push 0x7b4ebec
push esi
call 0x37e7fb30
add esp, 0x14
test eax, eax
jne 0x385b09db
push 0x800
push edi
push 0xf
push 0x7b4ec08
push esi
call 0x37e7fb30
add esp, 0x14
test eax, eax
jne 0x385b09db
mov ebx, dword [ebp + 8]
mov dl, byte [ebx + 0x460]
test dl, dl
je 0x385b09e7
xor ecx, ecx
mov al, byte [ebx + ecx + 0x38]
xor al, dl
mov byte [edi + ecx], al
inc ecx
cmp ecx, 0x800
jl 0x385b0995
push 0x800
push edi
push 0x1b
push 0x7b4ebec
push esi
call 0x37e7fb30
add esp, 0x14
test eax, eax
jne 0x385b09db
push 0x800
push edi
push 0xf
push 0x7b4ec08
push esi
call 0x37e7fb30
add esp, 0x14
test eax, eax
je 0x385b09e7
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x385b1590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
push esi
push edi
test dl, 3
jne 0x385b1606
movzx eax, byte [ebp + 0x18]
sub eax, 0
je 0x385b15d6
sub eax, 1
jne 0x385b1606
test edx, edx
je 0x385b1600
mov esi, dword [ebp + 8]
dec edx
mov ecx, dword [ebp + 0xc]
sub esi, ecx
mov edi, dword [ebp + 0x14]
shr edx, 2
inc edx
nop
mov eax, dword [esi + ecx]
lea ecx, [ecx + 4]
xor eax, edi
mov dword [ecx - 4], eax
sub edx, 1
jne 0x385b15c0
pop edi
mov al, 1
pop esi
pop ebp
ret
test edx, edx
je 0x385b1600
mov esi, dword [ebp + 8]
dec edx
mov ecx, dword [ebp + 0xc]
sub esi, ecx
mov edi, dword [ebp + 0x14]
shr edx, 2
inc edx
lea ebx, [ebx]
mov eax, dword [ecx + esi]
lea ecx, [ecx + 4]
add eax, edi
mov dword [ecx - 4], eax
sub edx, 1
jne 0x385b15f0
pop edi
mov al, 1
pop esi
pop ebp
ret
pop edi
xor al, al
pop esi
pop ebp
ret
Function at 0x385b1610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 0x18]
push ebx
push esi
sub eax, 0
je 0x385b1656
sub eax, 1
je 0x385b1629
pop esi
xor al, al
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x385b1678
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub esi, ecx
mov bl, byte [ebp + 0x14]
jmp 0x385b1640
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, bl
mov byte [ecx - 1], al
sub edx, 1
jne 0x385b1640
pop esi
mov al, 1
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x385b1678
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub esi, ecx
mov bl, byte [ebp + 0x14]
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
add al, bl
mov byte [ecx - 1], al
sub edx, 1
jne 0x385b1668
pop esi
mov al, 1
pop ebx
pop ebp
ret
Function at 0x385bc4d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
cmp dword [ebx], 0x4550
jne 0x385bc681
cmp dword [ebx + 0xdc14], 0x800
jb 0x385bc681
mov eax, dword [ebx + 0x955d]
and eax, 0xe0000020
cmp eax, 0xe0000020
jne 0x385bc681
mov edx, 7
mov byte [ebp + 0xb], 0
xor edi, edi
mov dword [ebp - 4], edx
xor esi, esi
mov edi, edi
lea eax, [ebx + 0x400]
add eax, edx
mov dword [ebp - 8], eax
movzx eax, byte [eax]
movzx ecx, word [eax*2 + 0x7428fa8]
lea eax, [edx + ebx]
movzx eax, byte [eax + 0x401]
movzx eax, byte [ecx + eax + 0x74291a8]
test eax, eax
jne 0x385bc55a
push dword [ebp - 8]
call 0x37e8a7b0
mov edx, dword [ebp - 4]
add esp, 4
cmp eax, 0xffffffff
je 0x385bc681
movzx ecx, byte [edx + ebx + 0x400]
sub ecx, 0x81
je 0x385bc5a4
sub ecx, 0xc
je 0x385bc589
sub ecx, 0x26
jne 0x385bc5c0
mov cl, byte [edx + ebx + 0x401]
mov byte [ebp + 0xb], cl
jmp 0x385bc5c3
cmp byte [edx + ebx + 0x401], 0xb5
mov cl, byte [ebp + 0xb]
jne 0x385bc5c3
mov esi, dword [edx + ebx + 0x402]
sub esi, dword [ebx + 0x28]
add esi, edi
jmp 0x385bc5c3
cmp byte [edx + ebx + 0x401], 0xed
mov cl, byte [ebp + 0xb]
jne 0x385bc5c3
mov edi, dword [ebx + 0x28]
sub edi, dword [edx + ebx + 0x402]
add edi, 6
jmp 0x385bc5c3
mov cl, byte [ebp + 0xb]
test cl, cl
je 0x385bc5cb
test esi, esi
jne 0x385bc5e6
add edx, eax
mov dword [ebp - 4], edx
cmp edx, 0x3f1
jl 0x385bc520
cmp byte [ebp + 0xb], 0
je 0x385bc681
lea eax, [esi - 1]
cmp eax, 0x1b8
ja 0x385bc681
add esi, 0x3400
lea edx, [ebx + 0x1400]
add esi, ebx
mov ecx, 0x191
mov edi, edx
mov eax, edx
rep movsd dword es:[edi], dword [esi]
mov cl, byte [ebp + 0xb]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x647
xor byte [eax], cl
lea eax, [eax + 1]
sub esi, 1
jne 0x385bc618
xor eax, eax
cmp byte [edx + eax], 0x90
jne 0x385bc634
inc eax
cmp eax, 0x647
jl 0x385bc624
jmp 0x385bc653
lea ecx, [ebx + 0x1400]
mov esi, 0x647
add ecx, eax
sub esi, eax
mov al, byte [ecx]
lea edx, [edx + 1]
mov byte [edx - 1], al
lea ecx, [ecx + 1]
sub esi, 1
jne 0x385bc643
xor ecx, ecx
lea eax, [ebx + 0x1404]
mov edx, 0x6861
cmp dword [eax - 4], 0x5350006a
jne 0x385bc677
cmp dword [eax], 0x95ff006a
jne 0x385bc677
cmp word [eax + 8], dx
je 0x385bc68a
inc ecx
inc eax
cmp ecx, 0x615
jl 0x385bc660
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + ebx + 0x142e]
pop edi
mov dword [ebx + 0x1bfc], eax
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x385c1b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0xf083
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp word [esi + 0x3339], ax
jne 0x385c1d0b
cmp word [esi + 0x334e], ax
jne 0x385c1d0b
cmp word [esi + 0x3364], ax
jne 0x385c1d0b
cmp byte [esi + 0x337a], 0x35
jne 0x385c1d0b
movzx edi, byte [esi + 0x337b]
lea ebx, [esi + 0x1400]
movzx eax, byte [esi + 0x3366]
mov edx, dword [esi + 0x1404]
mov ecx, dword [ebx]
shl edi, 8
or edi, eax
mov dword [ebp - 4], ecx
movzx eax, byte [esi + 0x3350]
shl edi, 8
or edi, eax
mov dword [ebp - 8], edx
movzx eax, byte [esi + 0x333b]
shl edi, 8
or edi, eax
xor eax, eax
mov dword [ebp - 0xc], eax
test edx, edx
je 0x385c1c98
mov dword [ebp + 8], ecx
mov ebx, edx
sub ebx, eax
cmp ebx, 0x800
jb 0x385c1c3f
push 0x800
lea ebx, [esi + 0x1400]
push ebx
push ecx
push esi
call 0x37e6b7f0
add esp, 0x10
cmp eax, 0x800
jne 0x385c1d0b
mov eax, ebx
mov ecx, 0x200
xor dword [eax], edi
lea eax, [eax + 4]
sub ecx, 1
jne 0x385c1bf8
push 0x800
push ebx
push dword [ebp + 8]
push esi
call 0x37e6b820
add esp, 0x10
cmp eax, 0x800
jne 0x385c1d0b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add eax, 0x800
mov edx, dword [ebp - 8]
add ecx, 0x800
mov dword [ebp - 0xc], eax
mov dword [ebp + 8], ecx
cmp eax, edx
jb 0x385c1bc4
jmp 0x385c1c95
push ebx
lea eax, [esi + 0x1400]
push eax
push ecx
push esi
call 0x37e6b7f0
add esp, 0x10
cmp eax, ebx
jne 0x385c1d0b
lea eax, [esi + 0x1400]
test ebx, ebx
je 0x385c1c7a
lea edx, [ebx - 1]
mov ecx, eax
shr edx, 2
inc edx
lea esp, [esp]
xor dword [ecx], edi
lea ecx, [ecx + 4]
sub edx, 1
jne 0x385c1c70
push ebx
push eax
push dword [ebp + 8]
push esi
call 0x37e6b820
add esp, 0x10
cmp eax, ebx
jne 0x385c1d0b
mov edx, dword [ebp - 8]
lea ebx, [esi + 0x1400]
mov ecx, dword [ebp - 4]
mov eax, edx
mov dword [ebp + 8], 0
shr eax, 0xb
add eax, 1
mov dword [ebp - 0xc], eax
je 0x385c1cf5
xor edi, edi
mov edi, edi
push 0x800
push ebx
lea eax, [edi + ecx]
push eax
push esi
call 0x37e6b7f0
add esp, 0x10
cmp eax, 0x800
jne 0x385c1d0b
push eax
push ebx
push edi
push esi
call 0x37e6b820
add esp, 0x10
cmp eax, 0x800
jne 0x385c1d0b
mov eax, dword [ebp + 8]
add edi, 0x800
mov ecx, dword [ebp - 4]
inc eax
mov dword [ebp + 8], eax
cmp eax, dword [ebp - 0xc]
jb 0x385c1cb0
mov edx, dword [ebp - 8]
push edx
push esi
call 0x37e6b760
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x385c1df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp byte [esi + 0x3339], 0x35
jne 0x385c1ff1
cmp byte [esi + 0x3366], 0x35
jne 0x385c1ff1
mov edi, dword [esi + 0x1404]
lea ecx, [esi + 0x1400]
mov eax, dword [ecx]
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edx
test edi, edi
je 0x385c1f84
mov dword [ebp + 8], eax
lea esp, [esp]
sub edi, edx
mov dword [ebp - 0x10], edi
cmp edi, 0x800
jb 0x385c1efc
push 0x800
push ecx
push eax
push esi
call 0x37e6b7f0
add esp, 0x10
cmp eax, 0x800
jne 0x385c1ff1
lea edx, [esi + 0x1400]
mov edi, 0x200
jmp 0x385c1e80
movzx eax, byte [esi + 0x3367]
lea edx, [edx + 4]
mov ecx, ebx
shl ecx, 8
or ecx, eax
movzx eax, bl
shl ecx, 8
add ebx, 4
or ecx, eax
movzx eax, byte [esi + 0x333a]
shl ecx, 8
or ecx, eax
xor dword [edx - 4], ecx
sub edi, 1
jne 0x385c1e80
push 0x800
lea edi, [esi + 0x1400]
push edi
push dword [ebp + 8]
push esi
call 0x37e6b820
add esp, 0x10
cmp eax, 0x800
jne 0x385c1ff1
mov edx, dword [ebp - 8]
lea ecx, [esi + 0x1400]
mov edi, dword [ebp - 4]
add edx, eax
mov eax, dword [ebp + 8]
add eax, 0x800
mov dword [ebp - 8], edx
mov dword [ebp + 8], eax
cmp edx, edi
jae 0x385c1f84
jmp 0x385c1e40
push edi
push ecx
push eax
push esi
call 0x37e6b7f0
add esp, 0x10
cmp eax, edi
jne 0x385c1ff1
lea edx, [esi + 0x1400]
test edi, edi
je 0x385c1f69
lea eax, [edi - 1]
shr eax, 2
inc eax
mov dword [ebp - 0xc], eax
mov edi, eax
jmp 0x385c1f30
movzx eax, byte [esi + 0x3367]
lea edx, [edx + 4]
mov ecx, ebx
shl ecx, 8
or ecx, eax
movzx eax, bl
shl ecx, 8
add ebx, 4
or ecx, eax
movzx eax, byte [esi + 0x333a]
shl ecx, 8
or ecx, eax
xor dword [edx - 4], ecx
sub edi, 1
jne 0x385c1f30
mov edi, dword [ebp - 0x10]
lea edx, [esi + 0x1400]
push edi
push edx
push dword [ebp + 8]
push esi
call 0x37e6b820
add esp, 0x10
cmp eax, edi
jne 0x385c1ff1
mov edi, dword [ebp - 4]
lea ecx, [esi + 0x1400]
mov eax, edi
xor ebx, ebx
shr eax, 0xb
add eax, 1
mov dword [ebp + 8], eax
je 0x385c1fdb
xor edi, edi
mov eax, dword [ebp - 0x14]
push 0x800
push ecx
add eax, edi
push eax
push esi
call 0x37e6b7f0
add esp, 0x10
cmp eax, 0x800
jne 0x385c1ff1
push eax
lea edx, [esi + 0x1400]
push edx
push edi
push esi
call 0x37e6b820
add esp, 0x10
cmp eax, 0x800
jne 0x385c1ff1
inc ebx
lea ecx, [esi + 0x1400]
add edi, eax
cmp ebx, dword [ebp + 8]
jb 0x385c1f95
mov edi, dword [ebp - 4]
push edi
push esi
call 0x37e6b760
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x385c39c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
cmp word [esi + 0xdc4c], 0
jne 0x385c3b91
cmp dword [esi], 0x4550
jne 0x385c3b91
cmp dword [esi + 0xd0], 0
je 0x385c3b91
cmp dword [esi + 0x84], 9
jbe 0x385c3b91
cmp dword [esi + 0xdc14], 0x800
jb 0x385c3b91
movzx edi, word [esi + 6]
test edi, edi
je 0x385c3b91
movzx ecx, word [esi + 0x14]
lea eax, [edi + edi*4]
add ecx, 0x18
lea eax, [ecx + eax*8]
cmp eax, 0x400
ja 0x385c3b91
add ecx, esi
xor edx, edx
xor ebx, ebx
mov dword [ebp - 8], ecx
xor eax, eax
mov dword [ebp - 4], edx
test edi, edi
je 0x385c3a65
add ecx, 0xc
mov edx, dword [ecx]
cmp edx, ebx
jbe 0x385c3a57
mov ebx, edx
mov edx, eax
mov dword [ebp - 4], edx
jmp 0x385c3a5a
mov edx, dword [ebp - 4]
inc eax
add ecx, 0x28
cmp eax, edi
jb 0x385c3a48
mov ecx, dword [ebp - 8]
lea eax, [edx + edx*4]
mov eax, dword [ecx + eax*8 + 0x24]
and eax, 0xa0000000
cmp eax, 0xa0000000
jne 0x385c3b91
push dword [esi + 0xd0]
push esi
call 0x37ea3270
mov edi, eax
add esp, 8
cmp edi, 0x18
jb 0x385c3b91
mov ecx, dword [esi + 0xdc14]
cmp edi, ecx
ja 0x385c3b91
add ecx, 0xffffffe0
cmp edi, ecx
ja 0x385c3b91
push 0x20
lea ebx, [esi + 0x1400]
push ebx
push edi
push esi
call 0x37e6b7f0
add esp, 0x10
cmp eax, 0x20
jne 0x385c3b91
mov ecx, dword [esi + 0x1418]
mov eax, ecx
or eax, dword [esi + 0x141c]
je 0x385c3b91
sub ecx, dword [esi + 0x30]
je 0x385c3b91
cmp ecx, dword [esi + 0x50]
ja 0x385c3b91
push ecx
push esi
call 0x37ea3270
add esp, 8
test eax, eax
je 0x385c3b91
mov ecx, dword [esi + 0xdc14]
sub ecx, 0x10
cmp eax, ecx
ja 0x385c3b91
push 0x10
push ebx
push eax
push esi
call 0x37e6b7f0
add esp, 0x10
cmp eax, 0x10
jne 0x385c3b91
mov eax, dword [esi + 0x1408]
or eax, dword [esi + 0x140c]
jne 0x385c3b91
mov ecx, dword [ebx]
mov eax, ecx
or eax, dword [ebx + 4]
je 0x385c3b91
sub ecx, dword [esi + 0x30]
je 0x385c3b91
cmp ecx, dword [esi + 0x50]
ja 0x385c3b91
push ecx
push esi
call 0x37ea3270
add esp, 8
test eax, eax
je 0x385c3b91
mov ecx, dword [esi + 0xdc14]
sub ecx, 0x800
cmp eax, ecx
ja 0x385c3b91
push 0x800
push ebx
push eax
push esi
call 0x37e6b7f0
add esp, 0x10
cmp eax, 0x800
jne 0x385c3b91
lea eax, [edi - 0x18]
pop edi
mov dword [esi + 0x1bfc], eax
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x385c40b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
test esi, esi
je 0x385c40e8
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 0xc]
sub edi, edx
lea ebx, [ebx]
mov ecx, ebx
lea edx, [edx + 4]
sub ecx, eax
inc eax
xor ecx, dword [edi + edx - 4]
xor ecx, dword [ebp + 0x18]
mov dword [edx - 4], ecx
cmp eax, esi
jb 0x385c40d0
pop edi
pop ebx
pop esi
pop ebp
ret