joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9f4550
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x9f4640
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x9f4640
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x9f459a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x9f45a1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x9f4580
jmp 0x9f45a3
mov esi, 0x1505
jmp 0x9f45a3
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
mov edx, ebx
sub edx, 1
jb 0x9f4640
mov ecx, esi
not ecx
or edx, ecx
mov eax, ebx
and eax, 0xfffffffe
add eax, eax
mov ecx, ebx
xor ecx, 1
sub eax, ecx
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
lea ebp, [esi + edx]
inc ebp
jmp 0x9f45e4
inc ebp
dec ebx
je 0x9f463e
mov eax, ebp
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x9f463e
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x9f45e0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp], eax
push eax
call fcn.009fc9c0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x9f45e0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.009fc9e0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x9f45e0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x9f4640
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x9f5890
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x9f5a8a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x9f5a8a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x9f5a8a
cmp dword [ecx], 0
jne 0x9f5a8a
push esi
call fcn.009fc9c0
add esp, 4
test eax, eax
je 0x9f58fa
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x9f5901
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x9f58e0
jmp 0x9f5903
mov edi, 0x1505
jmp 0x9f5903
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
mov esi, edx
sub esi, 1
jae 0x9f59cd
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x9f595a
call fcn.009f5b60
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x9f5a8a
push esi
call fcn.009fc9c0
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.009f5aa0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.009fc9c0
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [fcn.00a39008]
add esp, 4
test eax, eax
je 0x9f5a85
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.009fc8b0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x9f5a8a
mov dword [esp], eax
mov eax, edx
mov edx, edi
not edx
or esi, edx
mov ebx, eax
and ebx, 0xfffffffe
add ebx, ebx
mov edx, eax
xor edx, 1
sub ebx, edx
mov dword [esp + 0xc], ebx
mov edx, eax
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
lea ebx, [edi + esi]
inc ebx
jmp 0x9f5a08
inc ebx
dec edx
je 0x9f5915
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x9f591a
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x9f5a00
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.009fc9c0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x9f5a00
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.009fc9e0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x9f5a00
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.009f4970
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x9f59c2
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x9f6b50
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x9f6cf2
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x9f6ceb
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x9f6be0
add ebp, dword [esp + 8]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x9f6ceb
xor eax, eax
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 4], esi
jb 0x9f6c65
mov eax, edx
and eax, 0x1ff8
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
movzx ebx, byte [ebp + ebx]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 1]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 2]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 3]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 4]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 5]
add edi, ebx
mov ebx, ecx
xor ebx, edi
and ecx, edi
movzx esi, byte [ebp + edx + 6]
add esi, edi
movzx edi, byte [ebp + edx + 7]
add edi, esi
add esi, ebx
lea ecx, [esi + ecx*2]
lea ebx, [edx + 8]
add ecx, edi
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x9f6c00
add ebp, ebx
mov esi, dword [esp + 4]
mov ebx, edx
sub ebx, eax
mov dword [esp + 8], ebx
jbe 0x9f6ba8
mov ebx, edx
mov edx, eax
or edx, 1
test bl, 1
jne 0x9f6c90
mov ebx, ebp
cmp dword [esp], edx
je 0x9f6ba0
jmp 0x9f6cad
lea ebx, [ebp + 1]
movzx eax, byte [ebp]
add edi, eax
mov eax, edi
and eax, ecx
xor ecx, edi
lea ecx, [ecx + eax*2]
mov eax, edx
cmp dword [esp], edx
je 0x9f6ba0
mov edx, dword [esp]
sub edx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + eax]
add esi, edi
mov edi, esi
and edi, ecx
xor ecx, esi
lea ecx, [ecx + edi*2]
movzx edi, byte [ebx + eax + 1]
add edi, esi
mov esi, edi
and esi, ecx
xor ecx, edi
lea ecx, [ecx + esi*2]
add eax, 2
cmp edx, eax
jne 0x9f6cc0
jmp 0x9f6ba0
shl ecx, 0x10
or ecx, edi
jmp 0x9f6cf7
mov ecx, 1
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x9f6d10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x9f6d3e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x9f6ddc
not eax
test bl, 1
jne 0x9f6d45
mov edx, ebx
cmp ebx, 1
jne 0x9f6d76
jmp 0x9f6dda
xor eax, eax
jmp 0x9f6ddc
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0xa36c50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0xa36c50]
cmp ebx, 1
je 0x9f6dda
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0xa36c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0xa36c50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0xa36c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0xa36c50]
add esi, 2
cmp edx, esi
jne 0x9f6d80
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x9fe990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x9fec03
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x9fe9cc
cmp edx, esi
jae 0x9fec03
test edi, edi
je 0x9fec03
movzx ebp, bl
test bl, bl
js 0x9fea10
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
xor esi, eax
not eax
and eax, ecx
add eax, eax
sub eax, esi
sar eax, 1
sub edi, eax
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x9fe9c0
jmp 0x9fec03
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x9fea4b
cmp bl, 0xc2
jb 0x9fe9f8
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x9feab4
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x9fe9e2
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x9fea75
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x9feabe
cmp ebp, 0xe0
jne 0x9feac7
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x9fe9f4
jmp 0x9feac7
mov ecx, ebp
not ecx
or ecx, 0xf8
add ecx, ebp
cmp ecx, 0xef
jne 0x9febde
cmp bl, 0xf4
ja 0x9fe9f8
movzx ecx, byte [edx + 1]
je 0x9feb11
cmp ebp, 0xf0
jne 0x9feb1a
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x9fe9f4
jmp 0x9feb1a
inc edx
mov esi, dword [esp + 0x24]
jmp 0x9fe9fa
cmp cl, 0x9f
ja 0x9fe9f4
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x9febe5
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x9febeb
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
mov word [eax], si
lea ecx, [eax + 2]
add edx, 3
jmp 0x9fe9e2
cmp cl, 0x8f
ja 0x9fe9f4
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x9febe5
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x9febeb
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x9febf7
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ecx, ebp
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x9fe9f4
mov ecx, dword [esp]
add ecx, ebp
add ecx, 0xffffff80
cmp ecx, 0x10000
jb 0x9fe9f4
cmp edi, 2
jb 0x9febde
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
mov esi, 0x3ff
sub esi, ecx
not esi
or esi, ecx
and esi, 0x3ff
or esi, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], si
jmp 0x9fe9e2
mov ecx, eax
jmp 0x9fe9e2
inc edx
jmp 0x9fe9f4
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x9fe9fa
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x9fe9fa
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x9ff190
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x13c], 0
mov dword [esi + 0x138], 0
mov dword [esi + 0x130], 0
mov dword [esi + 0x12c], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x120], 0
mov dword [esi + 0x11c], 0
mov dword [esi + 0x114], 0
mov dword [esi + 0x110], 0
mov dword [esi + 0x10c], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x104], 0x3c
mov dword [esi + 0x118], 0xffffffff
mov dword [esi + 0x134], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0xa3f038]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x9ff271
sar edx, 1
lea edi, [esi + 0x104]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0xa39ab4]
Function at 0xa00460
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0x1785196d
mov dword [esp + 0x40], 0x138b1592
mov dword [esp + 0x44], 0xf9a1184
mov dword [esp + 0x48], 0xb590d6d
mov dword [esp + 0x4c], 0x7540945
mov dword [esp + 0x50], 0x3220554
mov dword [esp + 0x54], 0x3f550158
mov dword [esp + 0x58], 0x3ba83da5
mov dword [esp + 0x5c], 0x37a539a4
mov dword [esp + 0x60], 0x33bd35bf
mov dword [esp + 0x64], 0x2f5c3110
mov dword [esp + 0x68], 0x2b0a2d40
mov dword [esp + 0x6c], 0x27762979
mov dword [esp + 0x70], 0x23722576
mov dword [esp + 0x74], 0x5f7e2167
mov dword [esp + 0x78], 0x5bc35d37
mov dword [esp + 0x7c], 0x571c59ca
mov dword [esp + 0x80], 0x53155518
mov dword [esp + 0x84], 0x4fc65170
mov dword [esp + 0x88], 0x4b064d06
mov dword [esp + 0x8c], 0x47664911
mov dword [esp + 0x90], 0x43d24505
mov dword [esp + 0x94], 0x7fea41d0
mov dword [esp + 0x98], 0x7b117de1
mov dword [esp + 0x9c], 0x77e879e5
mov dword [esp + 0xa0], 0x73eb7503
mov dword [esp + 0xa4], 0x6f3d71fc
mov dword [esp + 0xa8], 0x6b256d21
mov dword [esp + 0xac], 0x67346923
mov dword [esp + 0xb0], 0x6328652b
mov dword [esp + 0xb4], 0x9fc66140
mov dword [esp + 0xb8], 0x9be29deb
mov dword [esp + 0xbc], 0x97e399f4
mov dword [esp + 0xc0], 0x93c695e0
mov dword [esp + 0xc4], 0x8f1a91b0
mov dword [esp + 0xc8], 0x8b1d8d15
mov dword [esp + 0xcc], 0x87a68915
mov dword [esp + 0xd0], 0x831f85ff
mov dword [esp + 0xd4], 0xbf29811f
mov dword [esp + 0xd8], 0xbbe3bd2f
mov dword [esp + 0xdc], 0xb7c9b998
mov dword [esp + 0xe0], 0xb33cb52c
mov dword [esp + 0xe4], 0xaf3bb123
mov dword [esp + 0xe8], 0xabf9ad31
mov dword [esp + 0xec], 0xa7f7a9f9
mov dword [esp + 0xf0], 0xa3f0a5ed
mov dword [esp + 0xf4], 0xdf8ca1f0
mov dword [esp + 0xf8], 0xdb88dd8c
mov dword [esp + 0xfc], 0xd7f6d988
mov dword [esp + 0x100], 0xd3b3d5bb
mov dword [esp + 0x104], 0xcfafd14a
mov dword [esp + 0x108], 0xcb53cd42
mov dword [esp + 0x10c], 0xc78bc99b
mov dword [esp + 0x110], 0xc389c58b
mov dword [esp + 0x114], 0xffb1c192
mov dword [esp + 0x118], 0xfbfafdb6
mov byte [esp + 0x11e], 0
mov word [esp + 0x11c], 0
mov eax, dword [0xa3f02c]
mov ecx, 0x42dadf06
mov edx, 0xf9
movzx esi, byte [esp + ecx - 0x42dadeca]
mov edi, edx
and edi, 0x88
mov ebx, ecx
xor ebx, 0x88
or ebx, edi
xor ebx, esi
xor ebx, 0x88
add bl, 0xe2
mov byte [esp + ecx - 0x42dadeca], bl
inc ecx
dec edx
cmp ecx, 0x42dadfe9
jne 0xa006c0
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
jmp dword [eax*4 + 0xa39c64]
Function at 0xa0cc20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0xa0cc40
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0xa0cc60
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0xa0cc80
mov eax, 0xffffffff
jmp 0xa0cc89
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.009fc880
add esp, 4
movzx ecx, word [esi]
mov dword [esp + 4], eax
test cx, cx
je 0xa0ccc1
add esi, 2
mov eax, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0xa0ccb0
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0xa0ccf3
lea edx, [ebp + 2]
mov esi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xa0cce0
jmp 0xa0ccf7
mov esi, dword [esp + 4]
mov word [eax], 0
lea eax, [esp + 8]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00a34520
add esp, 0x14
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0xa3b00c]
Function at 0xa11100
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov edi, dword [esp + 0x60]
xor eax, eax
test edi, edi
setne al
xor ebx, ebx
mov dword [esp + 0x38], 0
mov dword [esp], 0
jmp dword [eax*4 + 0xa3b654]
Function at 0xa18090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x1c
mov ebx, esp
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x5c], 0xf935fbd7
mov dword [ebp - 0x58], 0xe576e768
mov dword [ebp - 0x54], 0xe10de328
mov dword [ebp - 0x50], 0xed01ef7c
mov dword [ebp - 0x4c], 0xe90eebc7
mov dword [ebp - 0x48], 0x957e9714
mov dword [ebp - 0x44], 0x9100930f
mov dword [ebp - 0x40], 0x9d759f7c
mov dword [ebp - 0x3c], 0x99749b02
mov dword [ebp - 0x38], 0x8518870f
mov dword [ebp - 0x34], 0x81668368
mov dword [ebp - 0x30], 0x8d108f70
mov dword [ebp - 0x2c], 0x89608b1d
mov dword [ebp - 0x28], 0xb522b71f
mov dword [ebp - 0x24], 0xb12fb35f
lea eax, [ebp - 0x20]
mov word [ebp - 0x20], 0xbfb0
mov dword [ebp - 0x1e], 0
mov byte [ebp - 0x1a], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xab
xor dl, byte [ebp + ecx - 0x5c]
add dl, 0xa9
mov byte [ebp + ecx - 0x5c], dl
inc ecx
cmp ecx, 0x43
jne 0xa18130
lea esi, [ebp - 0x9a]
lea edx, [ebp - 0x5c]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [ebp - 0x5e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, dword [ebp - 0x10]
push edi
push 0
push 0
push 0x1e
push esi
push 0
call dword [0xa40370]
mov edi, dword [edi]
test edi, edi
jns 0xa18189
mov eax, 0xffffffff
jmp 0xa1818c
lea eax, [edi + edi]
push eax
call fcn.009fc880
add esp, 4
push dword [ebp - 0x10]
push edi
mov dword [ebp - 0x14], eax
push eax
push 0x1e
lea eax, [ebp - 0x9a]
push eax
push 0
call dword [0xa40370]
mov dword [ebx], 0x137a116c
mov dword [ebx + 4], 0x1f881d81
mov dword [ebx + 8], 0x1b771974
mov dword [ebx + 0xc], 0x7640596
mov dword [ebx + 0x10], 0x3900169
mov dword [ebx + 0x14], 0xf0e0d60
mov word [ebx + 0x18], 0
mov byte [ebx + 0x1a], 0
xor edx, edx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx + ecx]
mov dword [ebp - 0x10], eax
mov edi, ecx
xor edi, 0x3cfb82b2
mov esi, edx
and esi, 0x1a
sub esi, edi
lea ebx, [esi + 0x1ed585b6]
and ebx, eax
mov eax, ebx
and eax, 0xfffffffd
mov edi, ebx
or edi, 0xfd
inc edi
imul edi, eax
mov eax, ebx
and eax, 2
or ebx, 2
imul ebx, eax
sub edi, ebx
mov ebx, dword [ebp - 0x18]
lea eax, [edi + esi]
add eax, 0x1ed585b6
add al, byte [ebp - 0x10]
add al, 0xec
mov byte [ebx + ecx], al
inc ecx
add edx, 2
cmp ecx, 0x1b
jne 0xa181f0
push 0
push 0
push ebx
mov esi, dword [ebp - 0x14]
push esi
push dword [ebp + 8]
call fcn.00a135b0
add esp, 0x14
jmp dword [0xa3bfc8]
Function at 0xa18290
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x21ec
call fcn.009fc7e0
mov dword [esp + 0x11ec], 0x13601174
mov dword [esp + 0x11f0], 0x1f511d51
mov dword [esp + 0x11f4], 0x1b691951
mov dword [esp + 0x11f8], 0x7740578
mov dword [esp + 0x11fc], 0x3660179
mov dword [esp + 0x1200], 0xf7d0d71
mov dword [esp + 0x1204], 0xb780945
mov dword [esp + 0x1208], 0x3534
mov byte [esp + 0x120c], 0
mov eax, 0x5bc1284
mov ecx, 0x1243ed7b
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x5bc0098]
mov edi, ecx
and edi, 0x12018d58
mov edx, eax
and edx, 0x43810a7
or edx, edi
xor edx, esi
mov esi, edx
xor esi, 0xdf29d3cd
add edx, edx
and edx, 0x242302d4
xor edx, 0xb6030690
sub edx, esi
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + eax - 0x5bc0098], dl
inc eax
dec ecx
cmp eax, 0x5bc12a5
jne 0xa18310
lea eax, [esp + 0x34]
lea esi, [esp + 0x11ec]
push 0
push 0
push 0x20019
push eax
push esi
call fcn.00a34c40
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0xa3bfe0]

Function at 0xa1a040
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x840
xor ebp, ebp
mov dword [esp + 8], 0
mov dword [esp], 0x20219
mov eax, 1
mov dword [esp + 4], 0
jmp dword [eax*4 + 0xa3c648]
Function at 0xa1b070
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.00a1b090
add esp, 4
test al, al
je 0xa1ba10
mov al, 1
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
push eax
mov dword [ebp - 0x2c], esp
sub esp, 0x24
mov esi, esp
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x40
mov dword [ebp - 0x18], esp
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], eax
push eax
mov dword [ebp - 0x50], esp
push eax
mov dword [ebp - 0x4c], esp
push eax
mov dword [ebp - 0x34], esp
sub esp, 0x28
mov dword [ebp - 0x40], esp
sub esp, 8
mov dword [ebp - 0xc8], esp
sub esp, 8
mov dword [ebp - 0xc4], esp
sub esp, 8
mov dword [ebp - 0x44], esp
sub esp, 0x24
mov dword [ebp - 0x48], esp
mov dword [ebp - 0xc0], 0x9780b5b
mov dword [ebp - 0xbc], 0x58a0785
mov dword [ebp - 0xb8], 0x176037b
mov dword [ebp - 0xb4], 0x1d4e1f74
mov dword [ebp - 0xb0], 0x19961b63
mov dword [ebp - 0xac], 0x15161760
mov eax, 0x74b62903
nop
nop
nop
nop
nop
movzx ecx, byte [ebp + eax - 0x74b629c3]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xf1
mov byte [ebp + eax - 0x74b629c3], cl
inc eax
cmp eax, 0x74b6291b
jne 0xa1bab0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xa8], 0x3d001dc
mov dword [ebp - 0xa4], 0x7c105c1
mov dword [ebp - 0xa0], 0xbd909c1
mov dword [ebp - 0x9c], 0xfdc0dd8
mov dword [ebp - 0x98], 0x13ce11c9
mov dword [ebp - 0x94], 0x17d715d9
mov dword [ebp - 0x90], 0x1bd219db
mov dword [ebp - 0x8c], 0x1fd01dd5
mov dword [ebp - 0x88], 0x23fe21e5
mov dword [ebp - 0x84], 0x27e925f7
mov dword [ebp - 0x80], 0x2bfe29ee
mov dword [ebp - 0x7c], 0x2fef2dfb
mov dword [ebp - 0x78], 0x33f731e2
mov dword [ebp - 0x74], 0x37e035e8
mov dword [ebp - 0x70], 0x3bd639d9
mov dword [ebp - 0x6c], 0x3fdb3dca
mov dword [ebp - 0x68], 0xc311c11c
mov dword [ebp - 0x64], 0xc723c530
mov dword [ebp - 0x60], 0xcb27c929
mov word [ebp - 0x5c], 0xcdcc
mov dword [ebp - 0x5a], 0
mov eax, 0x39a40
mov ecx, 0x6fbc65bf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ebp + eax - 0x39ae8]
mov esi, ecx
and esi, 0x46b4202c
mov edx, eax
and edx, 0x312d3
or edx, esi
xor edx, 0xd3
or edx, edi
lea esi, [ecx - 0x6fbc6500]
and esi, edi
not edx
or edx, esi
add dl, 0xc0
mov byte [ebp + eax - 0x39ae8], dl
inc eax
dec ecx
cmp eax, 0x39a92
jne 0xa1bba0
lea eax, [ebp - 0xc0]
lea edi, [ebp - 0xa8]
push eax
push edi
call fcn.00a2c4c0
add esp, 8
mov ebx, eax
xor eax, eax
test ebx, ebx
sete al
jmp dword [eax*4 + 0xa3c7b8]
Function at 0xa1dba0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xb8
mov dword [esp + 0x24], 0xc303c125
mov dword [esp + 0x28], 0xc756c554
mov dword [esp + 0x2c], 0xcb6bc90c
mov dword [esp + 0x30], 0xcf6fcd58
mov dword [esp + 0x34], 0xb30eb155
mov dword [esp + 0x38], 0xb719b57a
mov dword [esp + 0x3c], 0xbb1fb92c
mov dword [esp + 0x40], 0xbf1fbd2c
mov dword [esp + 0x44], 0xa349a104
mov dword [esp + 0x48], 0xa71aa54f
mov dword [esp + 0x4c], 0xab0fa93b
mov dword [esp + 0x50], 0xaf3dad3f
mov dword [esp + 0x54], 0x933d9139
mov dword [esp + 0x58], 0x9778953a
mov dword [esp + 0x5c], 0x9b379900
mov dword [esp + 0x60], 0x9f9e9d30
lea eax, [esp + 0x64]
mov dword [esp + 0x64], 0
mov ecx, 0xb0
mov edx, 0x4f
movzx ebx, byte [esp + ecx - 0x8c]
mov esi, ebx
not esi
or esi, edx
or ebx, ecx
and ebx, esi
add bl, 0x90
mov byte [esp + ecx - 0x8c], bl
inc ecx
dec edx
cmp ecx, 0xf4
jne 0xa1dc40
lea ebx, [esp + 0x78]
lea edx, [esp + 0x24]
mov edi, ebx
mov ecx, 0x10
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xb8]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x74]
push esi
push 0
push 0
push 0x1f
push ebx
push 0
call dword [0xa40370]
mov edi, dword [esp + 0x74]
test edi, edi
jns 0xa1dcac
mov eax, 0xffffffff
jmp 0xa1dcaf
lea eax, [edi + edi]
push eax
call fcn.009fc880
add esp, 4
mov ebp, eax
push esi
push edi
push eax
push 0x1f
push ebx
push 0
call dword [0xa40370]
lea eax, [esp + 0x18]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.00a34520
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0xa3ca10]