joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b9690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, 0x33
mov ecx, dword [ecx + 0x6e3c]
mov edx, dword [eax + 0x350]
mov ecx, dword [ecx + 0x6a4]
add ecx, ecx
lea ecx, [ecx + ecx*2]
sub edx, ecx
add edx, 0x30
cmp edx, 0x34
cmovl esi, edx
xor ecx, ecx
mov edx, 0x10246790
test esi, esi
cmovns ecx, esi
cmp dword [eax + 0x348], 1
jne 0x100b9722
mov esi, 0xfffffc00
movsx edi, byte [edx + esi*2 + 0x800]
movsx ebx, byte [edx + esi*2 + 0x801]
imul edi, ecx
sar edi, 4
add ebx, edi
lea edi, [ebx + ebx - 0x7f]
mov ebx, edi
sar ebx, 0x1f
xor ebx, edi
mov edi, eax
mov eax, ebx
and al, 1
or al, 0x7c
cmp ebx, 0x7c
movzx eax, al
cmovle eax, ebx
mov byte [edi + esi + 0x8488], al
mov eax, edi
inc esi
jne 0x100b96dd
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [eax + 0x8488]
shl edx, 0xb
lea edx, [edx + 0x10246f90]
jmp 0x100b96d8
Function at 0x100d52a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov al, 1
cmp dword [edx + 0x553c], 0
jne 0x100d52d2
mov esi, dword [ecx + 0x5f2c]
mov edi, dword [edx + 0x5524]
test byte [esi + edi*4], 4
jne 0x100d52d2
cmp dword [edx + 0x350], 0
sete al
mov esi, dword [ecx + 0x6e3c]
cmp dword [esi + 0xc], 3
je 0x100d52f3
test al, al
jne 0x100d5308
cmp dword [ecx + 0x6448], 0
jne 0x100d5310
pop esi
pop edi
pop ebp
jmp fcn.100ddba0
test al, al
jne 0x100d5300
cmp dword [ecx + 0x6448], 0
je 0x100d5318
pop esi
pop edi
pop ebp
jmp fcn.100d5320
pop esi
pop edi
pop ebp
jmp fcn.100d8c90
pop esi
pop edi
pop ebp
jmp fcn.100dbef0
pop esi
pop edi
pop ebp
jmp fcn.100d7ab0
Function at 0x10177450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x1026f864]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x20]
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x1c]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov esi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.101f16b2
add esp, 0x10
cmp eax, esi
jne 0x101774c0
cmp ebx, 1
je 0x10177469
cmp ebx, 2
mov esi, 0xffffffff
je 0x101774c3
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.101f114c
add esp, 4
neg eax
sbb esi, esi
jmp 0x101774c3
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e05ab
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x101774e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x10177504
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.101f16b2
add esp, 0x14
jmp 0x10177533
test esi, esi
jle 0x1017752c
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, byte [eax + edi]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x1017752e
inc edi
mov eax, ebx
cmp esi, edi
jne 0x1017750d
mov edi, esi
jmp 0x1017752e
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x10177540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x1026f864]
mov ebx, dword [ebp + 8]
xor eax, ebp
cmp ebx, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x10177607
mov byte [ebp - 0x19], bl
mov esi, ecx
cmp byte [ecx + 0x2c], 0
je 0x1017758e
xor edi, edi
lea eax, [ebp - 0x19]
inc edi
push dword [esi + 0x20]
push edi
push edi
push eax
call fcn.101f16b2
add esp, 0x10
cmp eax, edi
je 0x10177607
xor esi, esi
dec esi
jmp 0x1017760f
lea ebx, [ebp - 0x19]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [esi + 0x24]
lea edx, [ebp - 0x20]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push ebx
push dword [esi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], ebx
je 0x10177586
mov edi, eax
cmp eax, 3
je 0x101775ef
cmp edi, 1
ja 0x10177586
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub ebx, eax
push dword [esi + 0x20]
push ebx
push 1
push eax
call fcn.101f16b2
add esp, 0x10
cmp eax, ebx
jne 0x10177586
mov ebx, dword [ebp - 0x24]
cmp edi, 1
je 0x10177599
jmp 0x10177604
xor edi, edi
inc edi
push dword [esi + 0x20]
push edi
push edi
push ebx
call fcn.101f16b2
add esp, 0x10
cmp eax, edi
jne 0x10177586
mov ebx, dword [ebp + 8]
xor esi, esi
cmp ebx, 0xffffffff
cmovne esi, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e05ab
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x10177660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x10177684
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.101f16b2
add esp, 0x14
jmp 0x101776b4
test esi, esi
jle 0x101776ad
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, word [eax + edi*2]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x101776af
inc edi
mov eax, ebx
cmp esi, edi
jne 0x1017768d
mov edi, esi
jmp 0x101776af
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x101776c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x1026f864]
movzx esi, word [ebp + 8]
xor eax, ebp
cmp si, 0xffff
mov dword [ebp - 0x10], eax
je 0x1017778b
mov word [ebp - 0x1a], si
mov edi, ecx
cmp byte [ecx + 0x2c], 0
je 0x10177711
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.101f16b2
add esp, 0x10
cmp eax, 1
je 0x1017778b
xor esi, esi
dec esi
jmp 0x10177794
lea esi, [ebp - 0x1a]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x20]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x10177709
mov ebx, eax
cmp eax, 3
je 0x10177772
cmp ebx, 1
ja 0x10177709
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.101f16b2
add esp, 0x10
cmp eax, esi
jne 0x10177709
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x1017771c
jmp 0x10177787
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.101f16b2
add esp, 0x10
cmp eax, ebx
jne 0x10177709
movzx esi, word [ebp + 8]
xor eax, eax
cmp si, 0xffff
cmove esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e05ab
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x101779a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x101779cf
movsx esi, byte [edx]
shl eax, 4
inc edx
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x101779b1
pop esi
pop edi
pop ebp
ret 8

Function at 0x10177ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10177b01
movzx esi, word [edx]
shl eax, 4
add edx, 2
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x10177ae1
pop esi
pop edi
pop ebp
ret 8
Function at 0x101d2980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov cl, byte [ebp + 0x10]
mov edi, dword [eax + 0x1c]
movzx esi, byte [ebx]
mov edx, edi
shr edx, cl
mov ecx, dword [eax + 0x20]
imul esi, edx
cmp ecx, esi
jae 0x101d29cd
mov edi, ebx
movzx ebx, byte [ebx + 1]
imul ebx, edx
cmp ecx, ebx
jae 0x101d29d6
movzx esi, byte [edi + 2]
mov dword [ebp - 0x10], 2
imul esi, edx
cmp ecx, esi
jb 0x101d2a82
mov edi, ebx
jmp 0x101d29e0
mov dword [ebp - 0x10], 0
jmp 0x101d29e0
xor edx, edx
mov edi, esi
mov esi, ebx
inc edx
mov dword [ebp - 0x10], edx
sub edi, esi
sub ecx, esi
cmp edi, 0x800000
mov dword [eax + 0x20], ecx
mov dword [eax + 0x1c], edi
ja 0x101d2a77
mov edx, dword [eax + 4]
mov ebx, dword [eax + 0x14]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x24], edx
mov edx, dword [eax + 0x28]
mov dword [ebp - 0x14], esi
mov esi, edi
add ebx, 8
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x14]
shl edi, 8
mov dword [eax + 0x14], ebx
mov dword [ebp - 0x28], edi
mov dword [eax + 0x1c], edi
xor edi, edi
cmp esi, dword [ebp - 0x24]
jae 0x101d2a41
mov edi, dword [eax]
mov dword [ebp - 0x20], edi
lea edi, [esi + 1]
mov dword [ebp - 0x1c], edi
mov dword [eax + 0x18], edi
mov edi, dword [ebp - 0x20]
movzx edi, byte [edi + esi]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x14], esi
shl edx, 8
shl ecx, 8
mov esi, dword [ebp - 0x18]
mov dword [eax + 0x28], edi
add ebx, 8
or edx, edi
and ecx, 0x7fffff00
shr edx, 1
movzx edx, dl
or ecx, edx
mov edx, edi
mov edi, dword [ebp - 0x28]
xor ecx, 0xff
cmp esi, 0x8001
mov dword [eax + 0x20], ecx
mov esi, edi
jb 0x101d2a0d
mov eax, dword [ebp - 0x10]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 2
mov edi, esi
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp + 0xc]
movzx esi, byte [esi + ebx + 1]
inc ebx
mov dword [ebp - 0x10], ebx
imul esi, edx
cmp ecx, esi
jae 0x101d29e0
jmp 0x101d2a89
Function at 0x101fb0b3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101fb0be

Function at 0x10202486
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10202491
Function at 0x402762
Capabilities:
Get common file path

Disassembly:
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp edi, 0x1d803
jg 0x40279c
inc edi
cmp edi, 0x1e70dee2
jl 0x40276e
cmp dword [0x44e434], 0x400
jne 0x4027c4
push esi
call fcn.0040281f
push esi
push esi
call fcn.00402cc2
push esi
call fcn.00402ae2
push esi
call fcn.00402d6f
add esp, 0x14
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x58bc0a
jg 0x4027e3
inc edi
cmp edi, 0xe14a
jl 0x4027c6
mov eax, dword [0x44653c]
mov dword [0x44e434], eax
call fcn.00402507
mov edi, 0x3078f
cmp dword [0x44e434], 0x51f
jne 0x40280f
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x4027f7
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10

Function at 0x405712
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c570]
jne 0x40571c
repz ret
jmp fcn.00406ed0
Function at 0x4069db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40c570]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040421f
and dword [ebp - 0x14], 0
cmp dword [0x44804c], 0
mov dword [ebp - 0x18], eax
jne 0x406a8e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406b36
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406b36
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44804c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x448050], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x448054], eax
call edi
push eax
call esi
mov dword [0x44805c], eax
test eax, eax
je 0x406a8e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x448058], eax
mov eax, dword [0x448058]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406ae7
cmp dword [0x44805c], ecx
je 0x406ae7
push eax
call esi
push dword [0x44805c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406ae7
test ebx, ebx
je 0x406ae7
call edi
test eax, eax
je 0x406ade
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406ade
test byte [ebp - 8], 1
jne 0x406ae7
or dword [ebp + 0x10], 0x200000
jmp 0x406b1a
mov eax, dword [0x448050]
cmp eax, dword [ebp - 0x18]
je 0x406b1a
push eax
call esi
test eax, eax
je 0x406b1a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406b1a
mov eax, dword [0x448054]
cmp eax, dword [ebp - 0x18]
je 0x406b1a
push eax
call esi
test eax, eax
je 0x406b1a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44804c]
call esi
test eax, eax
je 0x406b36
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406b38
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405712
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x404f91
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x404fa6
xor eax, eax
jmp 0x40505a
push 0x28
push esi
push edi
call 0x4b1463
add ah, al
or al, 0xff
jne 0x404fbd
lea ecx, [ebp - 0x1c]
call dword [0x4b74e4]
push esi
lea ecx, [ebp - 0x1c]
call dword [0x4b7518]
add byte [esi - 0x73], dl
dec ebp
in al, 0xff
adc eax, 0x4b7518
cmp eax, esi
je 0x404fe7
cmp byte [eax], 0
mov ecx, eax
je 0x404fe7
mov al, byte [ecx]
cmp al, 0x41
jl 0x404fe1
cmp al, 0x5a
jg 0x404fe1
add al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x404fd3
push ebx
push dword [ebp - 8]
lea ecx, [ebp - 0x1c]
push esi
call dword [0x4b7518]
call fcn.00404d88
pop ecx
mov ecx, dword [ebp - 8]
push 0x25
movzx ebx, ax
pop eax
cmp ecx, eax
mov dword [ebp + 8], ecx
jbe 0x40500e
mov dword [ebp + 0x28], eax
push dword [ebp]
lea ecx, [ebp - 0x1c]
push 0
lea esi, [edi + 3]
call dword [0x4b7518]
push eax
push esi
call 0x4a5ec5
mov ecx, dword [ebp + 8]
mov al, cl
add esp, 0xc
add al, 2
test esi, esi
mov word [edi + 1], bx
mov byte [edi], al
pop ebx
je 0x40504e
test ecx, ecx
je 0x40504e
xor eax, eax
test ecx, ecx
jbe 0x40504e
xor byte [eax + esi], 0x5a
inc eax
cmp eax, ecx
jb 0x405045
lea ecx, [ebp - 0x1c]
call dword [0x4b74e0]
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x4051ef
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax + 4]
sub esp, 0x34
push ebx
xor ecx, ecx
cmp eax, ecx
push esi
push edi
jne 0x405205
xchg edx, eax
shr bl, 0
cmp dword [ebp + 8], ecx
lea esi, [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
je 0x405261
cmp esi, ecx
je 0x405261
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp + 8]
call fcn.0040505d
pop ecx
lea eax, [ebp - 0x30]
push eax
lea edi, [ebp - 8]
lea ebx, [ebp - 4]
mov eax, esi
call fcn.004050a7
cmp dword [ebp - 4], 0
pop ecx
je 0x405261
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
push 0x10
add eax, 0x2c
push eax
push esi
call 0x4a5ec5
add esp, 0xc
test esi, esi
je 0x405261
xor eax, eax
xor byte [eax + esi], 0x7a
inc eax
cmp eax, 0x10
jb 0x405257
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx

Function at 0x40a0e7
Capabilities:
Encode data using xor

Disassembly:
shr byte [ecx + 0x307dda99], 1
bound esp, qword [eax]
enter 0xffffffffffffcc04, 0x19
sbb dword [edx - 0x6844d110], eax
fisttp dword [edx - 0x10ddf0cf]
sbb dword [edx - 0x6844d110], eax
fisttp dword [edx - 0x10ddf0cf]
ror dword [eax], cl
loop 0x40a0dc
mov esp, 0xb3506283
and al, 0x40
nop
push edx
test al, 0xf
jmp 0x40a130
nop
xchg edi, eax
push 0xffffffffffffffba
or eax, 0xb0b233c6
mov byte [esi + 0x35], dl
out 0x2a, eax
or byte [ecx], bl
stosb byte es:[edi], al
or bl, dl
into
xor esi, dword [esi]
out 0x4b, eax
mov cl, 0x4a
xchg esi, eax
mov edi, 0x657c416d
jbe 0x40a16c
cmc
invalid
jb 0x40a11c
int3
Function at 0x411d9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x411db1
xor eax, eax
jmp 0x411e65
push 0x28
push esi
push edi
call 0x4be26e
add ah, al
or al, 0xff
jne 0x411dc8
lea ecx, [ebp - 0x1c]
call dword [0x4b74e4]
add byte [esi - 0x73], dl
dec ebp
in al, 0xff
adc eax, 0x4b7518
push esi
lea ecx, [ebp - 0x1c]
call dword [0x4b7518]
cmp eax, esi
je 0x411df2
cmp byte [eax], 0
mov ecx, eax
je 0x411df2
mov al, byte [ecx]
cmp al, 0x41
jl 0x411dec
cmp al, 0x5a
jg 0x411dec
add al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x411dde
push ebx
push dword [ebp - 8]
lea ecx, [ebp - 0x1c]
push esi
call dword [0x4b7518]
call fcn.00411b93
pop ecx
mov ecx, dword [ebp - 8]
push 0x25
movzx ebx, ax
pop eax
cmp ecx, eax
mov dword [ebp + 8], ecx
jbe 0x411e19
mov dword [ebp + 0x28], eax
push dword [ebp]
lea ecx, [ebp - 0x1c]
push 0
lea esi, [edi + 3]
call dword [0x4b7518]
push eax
push esi
call 0x4b2cd0
mov ecx, dword [ebp + 8]
mov al, cl
add esp, 0xc
add al, 2
test esi, esi
mov word [edi + 1], bx
mov byte [edi], al
pop ebx
je 0x411e59
test ecx, ecx
je 0x411e59
xor eax, eax
test ecx, ecx
jbe 0x411e59
xor byte [eax + esi], 0x5a
inc eax
cmp eax, ecx
jb 0x411e50
lea ecx, [ebp - 0x1c]
call dword [0x4b74e0]
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x411ffa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax + 4]
sub esp, 0x34
push ebx
xor ecx, ecx
cmp eax, ecx
push esi
push edi
jne 0x412010
xchg edx, eax
shr bl, 0
cmp dword [ebp + 8], ecx
lea esi, [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
je 0x41206c
cmp esi, ecx
je 0x41206c
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp + 8]
call fcn.00411e68
pop ecx
lea eax, [ebp - 0x30]
push eax
lea edi, [ebp - 8]
lea ebx, [ebp - 4]
mov eax, esi
call fcn.00411eb2
cmp dword [ebp - 4], 0
pop ecx
je 0x41206c
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
push 0x10
add eax, 0x2c
push eax
push esi
call 0x4b2cd0
add esp, 0xc
test esi, esi
je 0x41206c
xor eax, eax
xor byte [eax + esi], 0x7a
inc eax
cmp eax, 0x10
jb 0x412062
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
Function at 0x41eba7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41ebbc
xor eax, eax
jmp 0x41ec70
push 0x28
push esi
push edi
call 0x4cb079
add ah, al
or al, 0xff
jne 0x41ebd3
lea ecx, [ebp - 0x1c]
call dword [0x4b74e4]
push esi
lea ecx, [ebp - 0x1c]
call dword [0x4b7518]
add byte [esi - 0x73], dl
dec ebp
in al, 0xff
adc eax, 0x4b7518
cmp eax, esi
je 0x41ebfd
cmp byte [eax], 0
mov ecx, eax
je 0x41ebfd
mov al, byte [ecx]
cmp al, 0x41
jl 0x41ebf7
cmp al, 0x5a
jg 0x41ebf7
add al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x41ebe9
push ebx
push dword [ebp - 8]
lea ecx, [ebp - 0x1c]
push esi
call dword [0x4b7518]
call fcn.0041e99e
pop ecx
mov ecx, dword [ebp - 8]
push 0x25
movzx ebx, ax
pop eax
cmp ecx, eax
mov dword [ebp + 8], ecx
jbe 0x41ec24
mov dword [ebp + 0x28], eax
push dword [ebp]
lea ecx, [ebp - 0x1c]
push 0
lea esi, [edi + 3]
call dword [0x4b7518]
push eax
push esi
call 0x4bfadb
mov ecx, dword [ebp + 8]
mov al, cl
add esp, 0xc
add al, 2
test esi, esi
mov word [edi + 1], bx
mov byte [edi], al
pop ebx
je 0x41ec64
test ecx, ecx
je 0x41ec64
xor eax, eax
test ecx, ecx
jbe 0x41ec64
xor byte [eax + esi], 0x5a
inc eax
cmp eax, ecx
jb 0x41ec5b
lea ecx, [ebp - 0x1c]
call dword [0x4b74e0]
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x41ee05
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax + 4]
sub esp, 0x34
push ebx
xor ecx, ecx
cmp eax, ecx
push esi
push edi
jne 0x41ee1b
xchg edx, eax
shr bl, 0
cmp dword [ebp + 8], ecx
lea esi, [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
je 0x41ee77
cmp esi, ecx
je 0x41ee77
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp + 8]
call fcn.0041ec73
pop ecx
lea eax, [ebp - 0x30]
push eax
lea edi, [ebp - 8]
lea ebx, [ebp - 4]
mov eax, esi
call fcn.0041ecbd
cmp dword [ebp - 4], 0
pop ecx
je 0x41ee77
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
push 0x10
add eax, 0x2c
push eax
push esi
call 0x4bfadb
add esp, 0xc
test esi, esi
je 0x41ee77
xor eax, eax
xor byte [eax + esi], 0x7a
inc eax
cmp eax, 0x10
jb 0x41ee6d
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
Function at 0x4286f3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, 0x45843241
jae 0x428588
invalid
lcall 0x3bc4, 0xee36ea9a
cmc
lcall 0x7eb4, 0xa93652d5
jp 0x4285f7
fsub st(0)
xchg esp, eax
fincstp
invalid
sbb eax, 0x2cbdbea5
mov word [ebp - 0x3720b41b], gs
or cl, byte [ecx + edx]
pop ebx
xor al, ch
adc al, 0x4a
cmp eax, 0
add byte [eax], al
add byte [eax], al
test byte [eax], ah
add dword [eax], eax
add byte [ebx + 0x53], dl
push ebx
push ebx
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
ret

Function at 0x42b9b2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x42b9c7
xor eax, eax
jmp 0x42ba7b
push 0x28
push esi
push edi
call 0x4d7e84
add ah, al
or al, 0xff
jne 0x42b9de
lea ecx, [ebp - 0x1c]
call dword [0x4b74e4]
push esi
lea ecx, [ebp - 0x1c]
call dword [0x4b7518]
add byte [esi - 0x73], dl
dec ebp
in al, 0xff
adc eax, 0x4b7518
cmp eax, esi
je 0x42ba08
cmp byte [eax], 0
mov ecx, eax
je 0x42ba08
mov al, byte [ecx]
cmp al, 0x41
jl 0x42ba02
cmp al, 0x5a
jg 0x42ba02
add al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x42b9f4
push ebx
push dword [ebp - 8]
lea ecx, [ebp - 0x1c]
push esi
call dword [0x4b7518]
call fcn.0042b7a9
pop ecx
mov ecx, dword [ebp - 8]
push 0x25
movzx ebx, ax
pop eax
cmp ecx, eax
mov dword [ebp + 8], ecx
jbe 0x42ba2f
mov dword [ebp + 0x28], eax
push dword [ebp]
lea ecx, [ebp - 0x1c]
push 0
lea esi, [edi + 3]
call dword [0x4b7518]
push eax
push esi
call 0x4cc8e6
mov ecx, dword [ebp + 8]
mov al, cl
add esp, 0xc
add al, 2
test esi, esi
mov word [edi + 1], bx
mov byte [edi], al
pop ebx
je 0x42ba6f
test ecx, ecx
je 0x42ba6f
xor eax, eax
test ecx, ecx
jbe 0x42ba6f
xor byte [eax + esi], 0x5a
inc eax
cmp eax, ecx
jb 0x42ba66
lea ecx, [ebp - 0x1c]
call dword [0x4b74e0]
xor eax, eax
inc eax
pop esi
leave
ret