joyce8/EMBER2024-capa huggingface dataset:
Function at 0x385df960
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x7076dbc]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov eax, edx
mov dword [ebp - 0x210], eax
test edi, edi
je 0x385dfb1f
test eax, eax
je 0x385dfb1f
cmp dword [eax], 0
je 0x385dfb1f
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x385dfb1e
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x385dfb1d
mov dword [ebp - 0x214], 2
lea esp, [esp]
xor ecx, ecx
mov eax, ecx
mov byte [ebp + ecx*2 - 0x204], cl
xor edx, edx
div esi
mov al, byte [edx + ebx]
mov byte [ebp + ecx*2 - 0x203], al
inc ecx
cmp ecx, 0x100
jb 0x385df9c2
xor esi, esi
xor bl, bl
jmp 0x385df9f0
mov dl, byte [ebp + esi*2 - 0x204]
lea ecx, [ebp - 0x204]
movzx eax, byte [ebp + esi*2 - 0x203]
add al, dl
add bl, al
movzx eax, bl
lea ecx, [ecx + eax*2]
movzx eax, byte [ecx]
mov byte [ebp + esi*2 - 0x204], al
inc esi
mov byte [ecx], dl
cmp esi, 0x100
jb 0x385df9f0
mov eax, dword [ebp - 0x210]
xor esi, esi
xor ch, ch
mov dword [ebp - 0x20c], esi
xor bh, bh
mov eax, dword [eax]
test eax, eax
je 0x385dfb00
mov cl, byte [edi + esi]
inc ch
movzx eax, ch
mov al, byte [ebp + eax*2 - 0x204]
add bh, al
mov byte [ebp - 0x205], al
lea eax, [ecx - 0x30]
cmp al, 9
jbe 0x385dfa78
lea eax, [ecx - 0x41]
cmp al, 5
ja 0x385dfa6a
sub cl, 0x37
jmp 0x385dfa78
lea eax, [ecx - 0x61]
cmp al, 5
ja 0x385dfa76
sub cl, 0x57
jmp 0x385dfa78
xor cl, cl
mov dl, byte [edi + esi + 1]
mov bl, dl
sub bl, 0x30
cmp bl, 9
jbe 0x385dfaa4
lea eax, [edx - 0x41]
cmp al, 5
ja 0x385dfa94
mov bl, dl
sub bl, 0x37
jmp 0x385dfaa4
lea eax, [edx - 0x61]
cmp al, 5
ja 0x385dfaa2
mov bl, dl
sub bl, 0x57
jmp 0x385dfaa4
xor bl, bl
movzx eax, bh
add esi, 2
shl cl, 4
add cl, bl
movzx edx, byte [ebp + eax*2 - 0x204]
movzx eax, byte [ebp - 0x205]
add edx, eax
movzx eax, dl
xor edx, edx
xor cl, byte [ebp + eax*2 - 0x204]
mov eax, dword [ebp - 0x20c]
mov byte [edi + eax], cl
not cl
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor cl, byte [edx + eax]
mov edx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x210]
mov byte [edi + edx], cl
inc edx
mov eax, dword [eax]
mov dword [ebp - 0x20c], edx
cmp esi, eax
jb 0x385dfa40
mov ecx, dword [ebp - 0x210]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
shr eax, 1
sub dword [ebp - 0x214], 1
mov dword [ecx], eax
jne 0x385df9c0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call 0x37ac2614
mov esp, ebp
pop ebp
ret 8
Function at 0x385e29e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x385e2a48
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x385e2a48
mov eax, dword [ebp + 0x10]
cmp eax, 4
jb 0x385e2a48
cmp dword [ebp + 0x18], eax
jb 0x385e2a48
push ebx
xor ebx, ebx
sub ecx, edx
push esi
push edi
mov dword [ebp + 0xc], ecx
jmp 0x385e2a10
lea edi, [ebx + edx]
mov eax, 0x88888889
mul ebx
mov eax, dword [ebp + 8]
mov ecx, ebx
shr edx, 4
inc ebx
mov esi, edx
shl esi, 4
sub esi, edx
mov edx, dword [ebp + 0x14]
add esi, esi
sub ecx, esi
mov cl, byte [ecx + eax]
mov eax, dword [ebp + 0xc]
xor cl, byte [eax + edi]
mov eax, dword [ebp + 0x10]
mov byte [edi], cl
cmp ebx, eax
jb 0x385e2a10
pop edi
pop esi
pop ebx
pop ebp
ret
or eax, 0xffffffff
pop ebp
ret

Function at 0x385e3cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jne 0x385e3cd5
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x14], 0
push esi
push edi
je 0x385e3db8
cmp dword [ebp + 0x18], 0
je 0x385e3db8
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
jmp 0x385e3d00
mov eax, dword [ebp + 8]
cmp edi, dword [eax + 0xdc14]
jae 0x385e3daf
mov esi, 0x800
cmp ebx, 0x800
ja 0x385e3d1e
mov esi, ebx
push 1
push eax
call 0x37ac3a70
add esp, 8
test ax, ax
jne 0x385e3db8
mov eax, dword [ebp + 8]
push esi
lea ecx, [eax + 0x1400]
push ecx
push edi
push eax
mov dword [ebp - 8], ecx
call 0x37e6b7f0
add esp, 0x10
cmp eax, esi
jne 0x385e3db8
test esi, esi
je 0x385e3d81
mov edx, dword [ebp - 8]
mov ebx, esi
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 0x14]
lea ecx, [ecx]
cmp eax, dword [ebp + 0x18]
lea edx, [edx + 1]
sbb ecx, ecx
and ecx, eax
mov al, byte [ecx + edi]
xor byte [edx - 1], al
lea eax, [ecx + 1]
sub ebx, 1
jne 0x385e3d60
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push esi
push dword [ebp - 8]
push edi
push dword [ebp + 8]
call 0x37e6b820
add esp, 0x10
cmp eax, esi
jne 0x385e3db8
mov eax, esi
sub ebx, esi
not eax
mov dword [ebp + 0x10], ebx
cmp edi, eax
jae 0x385e3db8
add edi, esi
mov dword [ebp + 0xc], edi
test ebx, ebx
jne 0x385e3d00
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x385e97a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
je 0x385e97ce
push ebx
mov ebx, dword [ebp + 0xc]
movzx edx, byte [esi + ebx]
inc esi
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x7446e08]
cmp esi, edi
jb 0x385e97b5
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x385eb8d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
invalid
inc eax
add al, 0x89

Function at 0x385eb9e0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, dword [edx + 8]
mov eax, ebx
mov edi, dword [edx + 4]
xor eax, edi
mov esi, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
xor esi, ebx
xor esi, edi
Function at 0x385ec6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
test edx, edx
je 0x385ec6f7
sub esi, ecx
lea eax, [edx + ecx]
sub edi, ecx
test dl, 3
je 0x385ec6e6
mov cl, byte [esi + eax - 1]
lea eax, [eax - 1]
xor cl, byte [eax]
mov byte [edi + eax], cl
sub edx, 1
jne 0x385ec6d1
pop edi
pop esi
pop ebp
ret
mov ecx, dword [esi + eax - 4]
lea eax, [eax - 4]
xor ecx, dword [eax]
mov dword [edi + eax], ecx
sub edx, 4
jne 0x385ec6e6
pop edi
pop esi
pop ebp
ret

Function at 0x38604200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push esi
call 0x37ac3a50
mov ecx, eax
add esp, 8
test ecx, ecx
jne 0x38604229
push ecx
xor esi, esi
call 0x37ac3a10
add esp, 4
mov eax, esi
pop esi
pop ebp
ret
push edi
xor edi, edi
test esi, esi
je 0x38604262
push ebx
mov ebx, dword [ebp + 0x18]
mov eax, edi
xor edx, edx
div ebx
mov eax, dword [ebp + 0x14]
mov al, byte [edx + eax]
not al
mov byte [edi + ecx], al
inc edi
cmp edi, esi
jb 0x38604234
mov eax, dword [ebp + 0xc]
mov edi, ecx
sub edi, eax
pop ebx
mov dl, byte [edi + eax]
lea eax, [eax + 1]
inc dl
xor byte [eax - 1], dl
sub esi, 1
jne 0x38604252
pop edi
push ecx
mov esi, 1
call 0x37ac3a10
add esp, 4
mov eax, esi
pop esi
pop ebp
ret

Function at 0x38604a40
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
push ebx
call 0x37ea3270
add esp, 8
test eax, eax
je 0x38604b01
mov edi, dword [ebx + 0xdc14]
cmp eax, edi
jae 0x38604b01
sub edi, eax
cmp edi, 0x100
jbe 0x38604a7d
mov edi, 0x100
jmp 0x38604a82
cmp edi, 0xf
jb 0x38604b01
push edi
lea esi, [ebx + 0x1400]
push esi
push eax
push ebx
call 0x37e6b7f0
add esp, 0x10
cmp eax, edi
jne 0x38604b01
add edi, 0x13f2
mov dword [ebp - 4], esi
add edi, ebx
cmp esi, edi
jae 0x38604b01
mov ebx, dword [ebp + 0xc]
lea ebx, [ebx]
movzx ecx, byte [esi]
movzx edx, byte [esi + 1]
mov eax, ecx
and al, 0xf0
cmp al, 0x40
jne 0x38604ace
and ecx, 8
add ecx, 8
shl ecx, 5
add ecx, edx
movzx edx, byte [esi + 2]
movzx eax, word [ecx*2 + 0x742eb70]
movzx ecx, byte [eax + edx + 0x742f170]
test ecx, ecx
jne 0x38604af5
push esi
call 0x37e904f0
mov ecx, eax
add esp, 4
cmp ecx, 0xffffffff
je 0x38604b01
and ecx, 0xf
mov eax, ecx
cmp eax, 3
jne 0x38604b0a
cmp byte [esi], 0xc2
jne 0x38604b42
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x38604b1b
mov al, byte [esi]
cmp al, 0xc3
je 0x38604b01
cmp al, 0xcc
je 0x38604b01
jmp 0x38604b42
cmp eax, 6
jne 0x38604b42
cmp byte [esi], 0xff
jne 0x38604b42
cmp byte [esi + 1], 0x15
jne 0x38604b42
mov eax, dword [esi + 2]
sub eax, dword [ebp - 4]
add eax, 6
add eax, esi
add eax, ebx
cmp eax, dword [ebp + 0x10]
jb 0x38604b55
cmp eax, dword [ebp + 0x14]
ja 0x38604b55
add esi, ecx
cmp esi, edi
jb 0x38604ab0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x38605490
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
cmp edi, 0xff
jae 0x386054dc
mov eax, dword [ebp + 8]
mov esi, 0xff
add eax, 0x2fa
sub esi, edi
nop
mov cx, word [eax + 1]
cmp cx, word [eax + 4]
jbe 0x386054d4
mov cx, word [eax]
mov dx, word [eax + 3]
mov bl, byte [eax + 5]
mov word [eax + 3], cx
mov cl, byte [eax + 2]
mov word [eax], dx
mov byte [eax + 5], cl
mov byte [eax + 2], bl
sub eax, 3
sub esi, 1
jne 0x386054b0
inc edi
cmp edi, 0x100
jl 0x38605498
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
cmp byte [eax + 0x2fd], 0xcc
jne 0x3860550d
movzx ecx, word [eax + 0x2fb]
movzx eax, word [eax + 1]
sub ecx, eax
cmp ecx, 0x20
ja 0x3860550d
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x3860a550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x3860a55c
pop ebp
ret
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x3860a57f
mov ch, byte [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
sub ebx, eax
lea esp, [esp]
mov cl, bl
add cl, al
add cl, ch
xor byte [eax], cl
inc eax
sub edx, 1
jne 0x3860a570
pop ebx
mov eax, 1
pop ebp
ret

Function at 0x3860a590
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x3860a636
mov eax, dword [ebp + 0x10]
cmp eax, 0x40
jb 0x3860a636
mov ecx, 0x5a4d
cmp word [edi], cx
jne 0x3860a636
mov ecx, dword [edi + 0x3c]
cmp eax, ecx
jb 0x3860a636
sub eax, ecx
cmp eax, 0xf8
jb 0x3860a636
cmp dword [ecx + edi], 0x4550
jne 0x3860a636
mov eax, 0x2000
test word [ecx + edi + 0x16], ax
je 0x3860a636
mov ebx, dword [ebp + 8]
add ecx, 4
add ecx, edi
mov esi, 0x10
lea edx, [ebx + 4]
lea esp, [esp]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x3860a636
add ecx, 4
add edx, 4
sub esi, 4
jae 0x3860a5f0
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx + edi + 0x34]
cmp eax, dword [ebx + 0x34]
jne 0x3860a636
mov eax, dword [ecx + edi + 0x28]
cmp eax, dword [ebx + 0x28]
jne 0x3860a636
mov ax, word [ecx + edi + 0x44]
cmp ax, word [ebx + 0x44]
jne 0x3860a636
mov ax, word [ecx + edi + 0x46]
cmp ax, word [ebx + 0x46]
jne 0x3860a636
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x3860c4a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x10
push ebx
push esi
push edi
test ecx, ecx
je 0x3860c67a
mov edx, dword [ebp + 0x10]
cmp edx, 0x14
jb 0x3860c67a
xor eax, eax
mov dword [ebp - 4], 0
xor ebx, ebx
mov dword [ebp - 0xc], eax
xor edi, edi
mov dword [ebp - 8], eax
add edx, 0xffffffec
mov dword [ebp - 0x10], edx
je 0x3860c67a
nop
cmp eax, 0x64
jae 0x3860c5ba
movzx eax, byte [edi + ecx]
lea esi, [edi + ecx]
movzx ecx, word [eax*2 + 0x742c5a8]
movzx eax, byte [esi + 1]
movzx edx, byte [ecx + eax + 0x742c7a8]
test edx, edx
jne 0x3860c51f
push esi
call 0x37e8df90
mov edx, eax
add esp, 4
cmp edx, 0xffffffff
je 0x3860c5ba
and edx, 0xf
mov cl, byte [esi]
cmp cl, 0xe9
jne 0x3860c52b
add edi, dword [esi + 1]
jmp 0x3860c592
cmp cl, 0xb8
jne 0x3860c538
mov esi, dword [esi + 1]
mov dword [ebp - 4], esi
jmp 0x3860c595
cmp dword [ebp - 4], 0
je 0x3860c576
cmp cl, 0x8d
jne 0x3860c576
mov cl, byte [esi + 1]
cmp cl, 0x40
jae 0x3860c592
mov al, cl
and al, 7
cmp al, 5
jne 0x3860c592
and cl, 0x38
cmp cl, 0x30
jne 0x3860c592
mov eax, dword [esi + 2]
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x34]
cmp eax, ecx
jbe 0x3860c592
sub eax, ecx
cmp eax, dword [esi + 0x50]
mov esi, dword [ebp - 4]
jae 0x3860c595
mov ebx, eax
jmp 0x3860c595
test ebx, ebx
je 0x3860c592
cmp cl, 0x81
jne 0x3860c592
mov cl, byte [esi + 1]
mov al, cl
and al, 0xc0
cmp al, 0xc0
jne 0x3860c592
and cl, 0x38
cmp cl, 0x38
je 0x3860c5ab
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
add edi, edx
inc eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 0x10]
jae 0x3860c5bd
mov ecx, dword [ebp + 0xc]
jmp 0x3860c4e0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 4]
mov ecx, dword [edi + eax + 2]
mov dword [ebp - 0xc], ecx
jmp 0x3860c5bf
mov esi, dword [ebp - 4]
xor ecx, ecx
test esi, esi
je 0x3860c67a
test ebx, ebx
je 0x3860c67a
test ecx, ecx
je 0x3860c67a
mov eax, dword [ebp + 0x14]
cmp ebx, eax
jb 0x3860c67a
mov edx, dword [ebp + 0x10]
cmp edx, ecx
jb 0x3860c67a
sub ebx, eax
sub edx, ecx
cmp ebx, edx
ja 0x3860c67a
mov edi, dword [ebp + 0xc]
lea edx, [ebx + ecx]
lea ecx, [edx - 4]
mov eax, ebx
cmp ebx, ecx
jae 0x3860c612
xor dword [eax + edi], esi
add eax, 4
cmp eax, ecx
jb 0x3860c608
mov eax, dword [ebp - 0xc]
lea esi, [edx + edi]
push 0x14
push 0x7bbf884
push eax
lea eax, [ebx + edi]
push eax
call 0x37e62660
mov ecx, eax
add esp, 0x10
test ecx, ecx
je 0x3860c67a
mov eax, esi
sub eax, ecx
cmp eax, 0x19
jb 0x3860c67a
push 5
add eax, 0xffffffec
push 0x7bbed18
push eax
lea eax, [ecx + 0x14]
push eax
call 0x37e62660
add esp, 0x10
test eax, eax
je 0x3860c67a
sub esi, eax
cmp esi, 0x31
jb 0x3860c67a
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x3860c66e
lea esi, [eax + 5]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3860c830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x3860c870
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x3860c870
shr esi, 2
xor edx, edx
test esi, esi
je 0x3860c867
movzx ecx, byte [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
and ecx, 0x1f
mov eax, dword [edi + edx*4]
xor eax, ebx
ror eax, cl
mov dword [edi + edx*4], eax
inc edx
cmp edx, esi
jb 0x3860c857
pop ebx
pop edi
mov eax, 1
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x3860e2f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
test eax, eax
je 0x3860e34a
mov esi, dword [ebp + 0xc]
cmp esi, 4
jb 0x3860e34a
push ebx
mov ebx, esi
shr ebx, 2
test ebx, ebx
je 0x3860e32f
lea ecx, [ecx]
mov cl, byte [ebp + 0x14]
mov edx, dword [eax]
add cl, bl
and ecx, 0x1f
ror edx, cl
mov ecx, dword [ebp + 0x10]
xor edx, ecx
sub edx, ebx
mov dword [eax], edx
add eax, 4
sub ebx, 1
jne 0x3860e310
jmp 0x3860e332
mov ecx, dword [ebp + 0x10]
pop ebx
and esi, 3
je 0x3860e342
xor byte [eax], cl
lea eax, [eax + 1]
sub esi, 1
jne 0x3860e338
mov eax, 1
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x3860ecb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
test eax, eax
je 0x3860ed0a
mov esi, dword [ebp + 0xc]
cmp esi, 4
jb 0x3860ed0a
push ebx
mov ebx, esi
shr ebx, 2
test ebx, ebx
je 0x3860ecef
lea ecx, [ecx]
mov cl, byte [ebp + 0x14]
mov edx, dword [eax]
add cl, bl
and ecx, 0x1f
ror edx, cl
mov ecx, dword [ebp + 0x10]
xor edx, ecx
sub edx, ebx
mov dword [eax], edx
add eax, 4
sub ebx, 1
jne 0x3860ecd0
jmp 0x3860ecf2
mov ecx, dword [ebp + 0x10]
pop ebx
and esi, 3
je 0x3860ed02
xor byte [eax], cl
lea eax, [eax + 1]
sub esi, 1
jne 0x3860ecf8
mov eax, 1
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x3860f1a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
lea ebx, [ebx]
mov edi, dword [ebp + 8]
add edi, 0x400
add edi, esi
movzx eax, byte [edi]
movzx ecx, word [eax*2 + 0x742c5a8]
movzx eax, byte [edi + 1]
movzx eax, byte [ecx + eax + 0x742c7a8]
test eax, eax
jne 0x3860f1e7
push edi
call 0x37e8df90
add esp, 4
cmp eax, 0xffffffff
je 0x3860f1ff
and eax, 0xf
cmp byte [edi], 0xcc
jne 0x3860f1f5
inc ebx
cmp ebx, 0x15e
jae 0x3860f206
add esi, eax
cmp esi, 0x2dc
jb 0x3860f1b0
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x3860f210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x7076dbc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x3860f2b2
cmp dword [ebp + 0x10], 0x18
jb 0x3860f2b2
mov edi, dword [esi]
mov eax, dword [ebp + 0x18]
xor edi, eax
cmp eax, 0x14123d81
jne 0x3860f266
lea eax, [ebp - 0x1c]
xor edx, edx
sub esi, eax
lea esp, [esp]
lea ecx, [ebp - 0x1c]
add ecx, edx
add edx, 4
mov eax, dword [esi + ecx]
xor eax, edi
mov dword [ecx], eax
cmp edx, 0x14
jb 0x3860f250
jmp 0x3860f28a
cmp eax, 0x2c123d81
jne 0x3860f2b2
lea eax, [ebp - 0x1c]
xor edx, edx
sub esi, eax
lea ecx, [ebp - 0x1c]
add ecx, edx
mov eax, dword [esi + ecx]
xor eax, edx
add edx, 4
xor eax, edi
mov dword [ecx], eax
cmp edx, 0x14
jb 0x3860f274
cmp byte [ebp - 0x12], 0xf
jne 0x3860f2b2
cmp byte [ebp - 0xc], 0xeb
jne 0x3860f2b2
test ebx, ebx
je 0x3860f29c
mov dword [ebx], edi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call 0x37ac2614
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call 0x37ac2614
mov esp, ebp
pop ebp
ret

Function at 0x3860fa00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x3860fabf
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp + 0x10], 0
push eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
mov dword [ebp - 8], 0
push ebx
call fcn.3860f7c0
add esp, 0x14
test eax, eax
je 0x3860fabf
push dword [ebp + 0x10]
push ebx
call 0x37ea3270
mov esi, dword [ebp - 4]
add esp, 8
mov edx, eax
cmp esi, 0x800
ja 0x3860fabf
mov eax, dword [ebp + 0x14]
cmp esi, dword [eax]
ja 0x3860fabf
mov ecx, dword [ebx + 0xdc14]
cmp ecx, edx
jb 0x3860fabf
sub ecx, edx
cmp ecx, esi
jb 0x3860fabf
lea eax, [ebx + 0x1400]
push esi
push eax
push edx
push ebx
mov dword [ebp + 0x10], eax
call 0x37e6b7f0
add esp, 0x10
cmp eax, esi
jne 0x3860fabf
xor ecx, ecx
test esi, esi
je 0x3860faae
mov edx, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
lea ecx, [ecx]
mov al, byte [ebx + ecx]
xor al, dl
inc edx
mov byte [ecx + edi], al
inc ecx
cmp ecx, esi
jb 0x3860faa0
mov eax, dword [ebp + 0x14]
pop edi
mov dword [eax], esi
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3860fca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x3860fdc6
cmp dword [ebp + 0x10], 2
jb 0x3860fdc6
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
push 2
push ebx
call fcn.3860f780
add esp, 0xc
test eax, eax
je 0x3860fdc6
push esi
push ebx
push 0x500
call 0x37ac3a50
mov esi, eax
add esp, 8
test esi, esi
je 0x3860fdb2
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x500
push eax
push esi
lea eax, [ebp - 0x30]
push eax
push ebx
call fcn.3860fa00
add esp, 0x10
test eax, eax
je 0x3860fdb2
cmp byte [esi], 0xe9
jne 0x3860fdb2
push dword [ebp + 0x18]
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push dword [ebp + 0x14]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x30]
push esi
push eax
push ebx
call fcn.3860fad0
add esp, 0x20
test eax, eax
je 0x3860fdb2
push dword [ebp - 4]
push ebx
call 0x37ea3270
mov ecx, dword [ebx + 0xdc14]
mov edx, eax
add esp, 8
cmp ecx, edx
jb 0x3860fdb2
mov eax, dword [ebp + 0x10]
sub ecx, edx
cmp ecx, eax
jb 0x3860fdb2
push eax
push edi
push edx
push ebx
call 0x37e6b7f0
mov ecx, dword [ebp + 0x10]
add esp, 0x10
cmp eax, ecx
jne 0x3860fdb2
xor eax, eax
add ecx, 0xfffffffe
je 0x3860fd9b
mov edx, dword [ebp - 8]
lea esp, [esp]
xor word [eax + edi], dx
add eax, 2
cmp eax, ecx
jb 0x3860fd90
push esi
mov edi, 1
call 0x37ac3a10
add esp, 4
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
xor edi, edi
call 0x37ac3a10
add esp, 4
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3860ffe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x386100c9
cmp dword [ebp + 0x10], 2
jb 0x386100c9
mov dl, byte [ebp + 0x14]
xor ecx, ecx
mov edi, edi
xor byte [ecx + edi], dl
lea eax, [ecx + edi]
mov eax, dword [ebp + 0x10]
inc ecx
cmp ecx, eax
jb 0x38610000
lea ecx, [eax - 2]
xor edx, edx
push esi
xor esi, esi
mov dword [ebp + 0xc], ecx
test ecx, ecx
je 0x386100bd
push ebx
mov cl, byte [esi + edi + 1]
test cl, cl
je 0x386100bc
movzx ebx, cl
cmp ebx, dword [ebp + 0xc]
ja 0x386100bc
sub eax, ebx
sub eax, 2
cmp esi, eax
ja 0x386100bc
test edx, edx
jne 0x3861006a
cmp cl, 6
jne 0x3861009c
cmp byte [esi + edi + 2], 0xc7
jne 0x3861009c
cmp byte [esi + edi + 3], 7
jne 0x3861009c
mov ecx, dword [ebp + 0x20]
mov edx, 1
mov eax, dword [esi + edi + 4]
mov dword [ecx], eax
jmp 0x3861009c
cmp edx, 1
jne 0x3861008b
cmp cl, 5
jne 0x3861009c
cmp byte [esi + edi + 2], 0xbb
jne 0x3861009c
mov ecx, dword [ebp + 0x1c]
mov edx, 2
mov eax, dword [esi + edi + 3]
mov dword [ecx], eax
jmp 0x3861009c
cmp edx, 2
jne 0x3861009c
cmp cl, 5
jne 0x3861009c
cmp byte [esi + edi + 2], 0xbf
je 0x386100ae
add esi, 2
add esi, ebx
cmp esi, dword [ebp + 0xc]
jae 0x386100bc
mov eax, dword [ebp + 0x10]
jmp 0x38610022
mov eax, dword [ebp + 0x18]
mov edx, 3
mov ecx, dword [esi + edi + 3]
mov dword [eax], ecx
pop ebx
xor eax, eax
cmp edx, 3
pop esi
sete al
pop edi
pop ebp
ret
xor eax, eax
pop edi
pop ebp
ret