joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3c547e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
lea eax, [ebp - 0xd8]
push eax
call fcn.03c53104
pop ecx
lea edx, [ebp - 0xd8]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.03c5311b
add esp, 0xc
push 0xa0
lea ecx, [ebp - 0xd8]
push ecx
lea eax, [ebp - 0x178]
push eax
call fcn.03c51390
add esp, 0xc
lea edx, [ebp - 0x178]
push edx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.03c531b6
add esp, 0xc
mov eax, dword [ebp + 0x20]
dec eax
mov ecx, 0x14
xor edx, edx
div ecx
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x3c5497c
push 0x14
push 0
lea ecx, [ebp - 0x38]
push ecx
call fcn.03c5137c
add esp, 0xc
push 0xa0
lea eax, [ebp - 0x178]
push eax
lea edx, [ebp - 0x218]
push edx
call fcn.03c51390
add esp, 0xc
mov ecx, dword [ebp - 4]
inc ecx
shr ecx, 0x18
mov byte [ebp - 0x24], cl
mov eax, dword [ebp - 4]
inc eax
shr eax, 0x10
mov byte [ebp - 0x23], al
mov edx, dword [ebp - 4]
inc edx
shr edx, 8
mov byte [ebp - 0x22], dl
mov cl, byte [ebp - 4]
inc ecx
mov byte [ebp - 0x21], cl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x18]
jae 0x3c54936
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp - 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.03c531b6
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x14
lea ecx, [ebp - 0x24]
push ecx
call fcn.03c53282
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp + edx - 0x24]
mov eax, dword [ebp - 0xc]
xor byte [ebp + eax - 0x38], cl
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x14
jb 0x3c548f9
push 0xa0
lea edx, [ebp - 0xd8]
push edx
lea ecx, [ebp - 0x218]
push ecx
call fcn.03c51390
add esp, 0xc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x18]
jb 0x3c548c9
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 4]
shl ecx, 2
lea ecx, [ecx + ecx*4]
mov dword [ebp - 0xc], ecx
jmp 0x3c5495f
mov eax, dword [ebp - 8]
mov dl, byte [ebp + eax - 0x38]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
mov byte [ecx + eax], dl
inc dword [ebp - 8]
inc dword [ebp - 0xc]
cmp dword [ebp - 8], 0x14
jae 0x3c5496d
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0x20]
jb 0x3c54949
inc dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x3c54865
mov esp, ebp
pop ebp
ret

Function at 0x3c5c8dc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x180]
mov edx, ebx
mov eax, edi
call fcn.03c5cb44
mov esi, eax
mov dword [edi + 0x180], esi
and esi, 0xff
add dword [edi + 0x184], esi
imul esi, dword [edi + 0x184], 0x8088405
inc esi
mov dword [edi + 0x184], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x188]
mov eax, edi
call fcn.03c5cb44
mov dword [edi + 0x188], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x3c5c958
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [esi + 0x120]
cmp byte [eax + 0x4c], 0
jne 0x3c5c98f
mov edi, ecx
dec edi
test edi, edi
jl 0x3c5c9a0
inc edi
mov eax, esi
call fcn.03c5c938
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, esi
call fcn.03c5c8dc
inc ebx
dec edi
jne 0x3c5c976
jmp 0x3c5c9a0
lea eax, [esi + 0x3cc]
push eax
push ecx
push ebx
call fcn.03c51b78
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x3c5ca38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.03a6b388
xor eax, eax
push ebp
push 0x3c5beae
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.03c5c9a8
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.03c5c938
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.03c5c8dc
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x3c5ca78
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3c5beb5
lea eax, [ebp - 4]
call fcn.03a6b2b8
ret
Function at 0x3c5da04
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x3c5cfef
push dword fs:[eax]
mov dword fs:[eax], esp
cmp esi, 0xffffffff
jle 0x3c5dbab
mov eax, dword [ebp - 4]
call fcn.03c5f3f8
cmp esi, eax
jge 0x3c5dbab
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x128]
mov edx, esi
call fcn.03c40b58
mov edx, dword [0x3c40c3c]
call fcn.03a69744
mov edi, eax
mov eax, edi
call fcn.03c44cec
test al, al
je 0x3c5dba1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov eax, dword [edi + 0x50]
test eax, eax
je 0x3c5da87
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x3c5db94
xor eax, eax
push ebp
push 0x3c5cf8d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.03c5e034
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x140]
call fcn.03b0464c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push dword [edi + 0x34]
push dword [edi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x140]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x20]
lea edx, [ebp - 0x3e]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x140]
mov ecx, 0x2e
mov ebx, dword [eax]
call dword [ebx + 0xc]
movzx eax, word [ebp - 0x22]
movzx edx, word [ebp - 0x20]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x140]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x20]
movzx ebx, word [ebp - 0x1e]
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, ebx
call fcn.03a6bd64
mov eax, dword [ebp - 8]
call fcn.03a6b85c
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x140]
mov ecx, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x168]
movzx ebx, byte [eax + 0x28]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.03c5dd78
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x168]
mov byte [eax + 0x28], bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3c5cfd9
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x140]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
jne 0x3c5db8c
mov eax, dword [ebp - 4]
call fcn.03c5e0bc
ret
mov eax, dword [ebp - 8]
mov edx, dword [edi + 0x50]
call fcn.03a6b718
jmp 0x3c5dbd9
mov eax, dword [ebp - 8]
call fcn.03a6b2b8
jmp 0x3c5dbd9
mov dword [ebp - 0x48], esi
mov byte [ebp - 0x44], 0
lea eax, [ebp - 0x48]
push eax
push 0
lea edx, [ebp - 0x4c]
mov eax, 0xb3
call fcn.03a86a2c
mov ecx, dword [ebp - 0x4c]
mov dl, 1
mov eax, dword [0x3a7ea90]
call fcn.03a8cc48
call fcn.03a6a818
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3c5cff6
lea eax, [ebp - 0x4c]
call fcn.03a6b294
ret
Function at 0x3c8d60c
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x3c8d621
or edx, 0x200
test eax, 0x20000000
je 0x3c8d654
test eax, 0x40000000
je 0x3c8d640
test eax, 0x80000000
je 0x3c8d63b
or edx, 0x40
jmp 0x3c8d67b
or edx, 0x20
jmp 0x3c8d67b
test eax, 0x80000000
je 0x3c8d64f
or edx, 0x80
jmp 0x3c8d67b
or edx, 0x10
jmp 0x3c8d67b
test eax, 0x40000000
je 0x3c8d66c
test eax, 0x80000000
je 0x3c8d667
or edx, 4
jmp 0x3c8d67b
or edx, 2
jmp 0x3c8d67b
test eax, 0x80000000
je 0x3c8d678
or edx, 8
jmp 0x3c8d67b
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x3ca7410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
mov esi, 0x3e5620c
xor eax, eax
push ebp
push 0x3ca68e8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.03a6ee98
push eax
mov eax, dword [0x3e56214]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
call fcn.03a6efdc
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.03a6eeb0
cmp dword [esi], 0
jne 0x3ca745c
call fcn.03a9cfc0
jmp 0x3ca74d2
xor edx, edx
push ebp
push 0x3ca68b7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
call fcn.03a6efdc
mov eax, dword [ebx + 8]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.03a6efdc
mov eax, dword [ebx + 0xc]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
call fcn.03a6efdc
mov eax, dword [ebx]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
call fcn.03a6efdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x3ca74d2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ca68ef
lea eax, [ebp - 4]
call fcn.03a6ee98
ret
Function at 0x3cbbaac
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
push eax
add esp, 0xfffff004
push eax
add esp, 0xfffff004
push eax
add esp, 0xfffff004
push eax
add esp, 0xfffff004
push eax
add esp, 0xffffffe8
mov esi, ecx
mov ebx, eax
add edx, eax
mov dword [esp + 8], esi
mov dword [esp + 0x10], edx
movzx eax, word [ebx]
mov dword [esp], eax
or eax, eax
je 0x3cbbc38
add ebx, 2
mov eax, dword [esp]
test ah, 0x80
je 0x3cbbb0a
and eax, 0x7fff
movzx edx, word [ebx]
shl edx, 0xf
or eax, edx
mov dword [esp], eax
add ebx, 2
lea ebp, [esi - 1]
mov ecx, dword [ebx]
add ebx, 4
mov dword [esp + 0x14], ecx
mov edi, 1
cmp ebx, dword [esp + 0x10]
jae 0x3cbbc38
mov ecx, dword [esp + 0x14]
test ecx, edi
jne 0x3cbbb5e
mov al, byte [ebx]
inc ebx
mov byte [esi], al
inc esi
cmp ebx, dword [esp + 0x10]
lea eax, [esi - 3]
jae 0x3cbbc38
cmp eax, ebp
jbe 0x3cbbb58
inc ebp
mov eax, dword [ebp]
mov edx, eax
shr eax, 0xc
xor eax, edx
and eax, 0xfff
mov dword [esp + eax*4 + 0x1c], ebp
add edi, edi
jne 0x3cbbb29
jmp 0x3cbbb0d
movzx edx, word [ebx]
add ebx, 2
mov eax, edx
and edx, 0xf
add edx, 2
shr eax, 4
cmp edx, 2
jne 0x3cbbb7b
movzx edx, byte [ebx]
inc ebx
add edx, 0x12
mov eax, dword [esp + eax*4 + 0x1c]
mov ecx, esi
mov dword [esp + 0x18], edx
sub ecx, eax
cmp ecx, edx
jl 0x3cbbc26
cmp edx, 0x20
ja 0x3cbbbc8
sub edx, 8
jg 0x3cbbba5
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi], ecx
mov dword [esi + 4], eax
jmp 0x3cbbbf0
fild qword [edx + eax]
fild qword [eax]
cmp edx, 8
jle 0x3cbbbc0
fild qword [eax + 8]
cmp edx, 0x10
jle 0x3cbbbbd
fild qword [eax + 0x10]
fistp qword [esi + 0x10]
fistp qword [esi + 8]
fistp qword [esi]
fistp qword [edx + esi]
jmp 0x3cbbbf0
push esi
fild qword [eax]
lea eax, [edx + eax - 8]
lea edx, [edx + esi - 8]
fild qword [eax]
push edx
neg edx
and esi, 0xfffffff8
lea edx, [esi + edx + 8]
pop esi
fild qword [edx + eax]
fistp qword [edx + esi]
add edx, 8
jl 0x3cbbbe0
fistp qword [esi]
pop esi
fistp qword [esi]
cmp esi, ebp
jbe 0x3cbbc0c
inc ebp
mov edx, dword [ebp]
mov eax, edx
shr edx, 0xc
xor eax, edx
and eax, 0xfff
mov dword [esp + eax*4 + 0x1c], ebp
cmp esi, ebp
ja 0x3cbbbf4
add esi, dword [esp + 0x18]
cmp ebx, dword [esp + 0x10]
jae 0x3cbbc38
add edi, edi
lea ebp, [esi - 1]
je 0x3cbbb0d
jmp 0x3cbbb25
push ebx
xor ecx, ecx
dec edx
mov bl, byte [ecx + eax]
mov byte [ecx + esi], bl
lea ecx, [ecx + 1]
jne 0x3cbbc29
pop ebx
jmp 0x3cbbbf0
mov eax, dword [esp]
add esp, 0x401c
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x3cbbc48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov esi, ebx
dec esi
mov eax, dword [edi]
mov dword [ebp - 0xc], eax
add edi, 4
mov dword [ebp - 8], 1
cmp edi, dword [ebp - 4]
jae 0x3cbbda5
mov eax, dword [ebp - 0xc]
and eax, dword [ebp - 8]
jne 0x3cbbcbd
movzx eax, byte [edi]
mov byte [ebx], al
inc edi
inc ebx
cmp edi, dword [ebp - 4]
jae 0x3cbbda5
cmp ebx, dword [ebp + 0xc]
jae 0x3cbbda5
mov eax, ebx
sub eax, 3
cmp esi, eax
jae 0x3cbbcb2
inc esi
mov eax, dword [esi]
mov edx, eax
shr edx, 0xc
xor eax, edx
and eax, 0xfff
mov edx, dword [ebp + 8]
mov dword [edx + eax*4], esi
shl dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x3cbbc73
jmp 0x3cbbc5b
movzx eax, word [edi]
add edi, 2
mov edx, 0xf
and edx, eax
add edx, 2
mov dword [ebp - 0x10], edx
shr eax, 4
cmp dword [ebp - 0x10], 2
jne 0x3cbbce3
movzx edx, byte [edi]
add edx, 0x12
mov dword [ebp - 0x10], edx
inc edi
mov edx, ebx
add edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jb 0x3cbbd16
mov edx, dword [ebp + 8]
mov esi, dword [edx + eax*4]
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 0xc]
sub eax, ebx
add esi, eax
add dword [ebp - 0x14], eax
neg eax
movzx edx, byte [esi + eax]
mov ecx, dword [ebp - 0x14]
mov byte [ecx + eax], dl
inc eax
test eax, eax
jne 0x3cbbd02
jmp 0x3cbbda5
cmp dword [ebp - 0x10], 8
jbe 0x3cbbd29
mov edx, dword [ebp + 8]
mov ecx, ebx
sub ecx, dword [edx + eax*4]
cmp ecx, dword [ebp - 0x10]
jae 0x3cbbd5b
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x18], eax
add dword [ebp - 0x1c], eax
neg eax
mov edx, dword [ebp - 0x18]
movzx edx, byte [edx + eax]
mov byte [ebp - 0x1d], dl
mov edx, dword [ebp - 0x1c]
movzx ecx, byte [ebp - 0x1d]
mov byte [edx + eax], cl
inc eax
test eax, eax
jne 0x3cbbd40
jmp 0x3cbbd6b
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax*4]
mov edx, ebx
mov ecx, dword [ebp - 0x10]
call fcn.03a679b8
cmp edi, dword [ebp - 4]
jae 0x3cbbda5
cmp ebx, esi
jbe 0x3cbbd8d
inc esi
mov eax, dword [esi]
mov edx, eax
shr edx, 0xc
xor eax, edx
and eax, 0xfff
mov edx, dword [ebp + 8]
mov dword [edx + eax*4], esi
cmp ebx, esi
ja 0x3cbbd74
add ebx, dword [ebp - 0x10]
mov esi, ebx
dec esi
shl dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x3cbbc73
jmp 0x3cbbc5b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x3cdc6dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x3cdc744
cmp dword [ebp - 4], 0
je 0x3cdc744
mov eax, dword [ebp - 4]
movzx edx, byte [eax]
dec edx
sub dl, 0x20
jae 0x3cdc713
inc eax
movzx edx, byte [eax]
dec edx
sub dl, 0x20
jb 0x3cdc709
movzx eax, byte [eax]
sub al, 0x5b
je 0x3cdc71e
sub al, 0x20
jne 0x3cdc726
movzx eax, byte [ebp - 5]
xor al, 1
jmp 0x3cdc728
xor eax, eax
test al, al
je 0x3cdc73d
push esi
push ebx
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
call fcn.03cdc14c
jmp 0x3cdc79f
test byte [esi + 1], 2
setne bl
mov eax, dword [ebp - 0xc]
test dword [eax], 0xbfe8
jne 0x3cdc755
xor edx, edx
mov dword [eax], edx
jmp 0x3cdc75f
mov esi, dword [0x3e4d334]
mov esi, dword [esi]
call esi
cmp byte [ebp - 5], 0
jne 0x3cdc776
mov edx, dword [ebp - 0xc]
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.03cdc63c
test al, al
jne 0x3cdc79f
mov eax, dword [ebp - 0xc]
mov word [eax], pe_nt_image_headers32
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
call dword [0x3e20e4c]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add eax, 8
mov edx, dword [ebp - 4]
call fcn.03ccfb14
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x3ce4dfc
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
cmp byte [ebp + 8], 0
je 0x3ce4e3a
cmp dword [ebp - 8], 0
ja 0x3ce4e29
mov edx, 0x3ce43b0
mov eax, esi
call fcn.03ce47b8
jmp 0x3ce4fa5
mov edx, 0x3e20ffc
mov ecx, 4
mov eax, esi
call fcn.03ce3b14
cmp dword [ebp - 8], 0
jbe 0x3ce4f85
mov eax, dword [ebp - 8]
mov ecx, 3
xor edx, edx
div ecx
mov ebx, eax
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 8]
sub edx, eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
sub dword [ebp - 8], eax
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
sub edx, eax
inc ebx
add ebx, ebx
add ebx, ebx
cmp edx, ebx
jle 0x3ce4e93
inc eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.03cd2b2c
mov ebx, eax
mov eax, ebx
add eax, eax
add eax, eax
add dword [esi + 4], eax
lea eax, [ebx + ebx*2]
add dword [ebp - 4], eax
jmp 0x3ce4ef7
mov eax, esi
mov edx, dword [eax]
call dword [edx + 4]
cmp dword [ebp - 8], 0
jbe 0x3ce4ef7
mov eax, dword [esi + 0x1c]
sub eax, 4
shr eax, 2
lea ebx, [eax + eax*2]
cmp ebx, dword [ebp - 8]
jbe 0x3ce4eb4
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x20]
call fcn.03cd2b2c
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x10]
add ebx, ebx
add ebx, ebx
mov eax, dword [esi + 0x1c]
sub eax, 4
cmp ebx, eax
jae 0x3ce4eda
add dword [esi + 4], ebx
jmp 0x3ce4ee5
mov ecx, ebx
mov edx, dword [esi + 0x20]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx]
mov ebx, dword [ebp - 0x10]
lea ebx, [ebx + ebx*2]
add dword [ebp - 4], ebx
sub dword [ebp - 8], ebx
cmp dword [ebp - 8], 0
ja 0x3ce4ea0
cmp dword [ebp - 0xc], 0
jbe 0x3ce4f85
mov eax, dword [esi + 4]
inc eax
mov edx, 0x3e21275
mov ecx, dword [ebp - 0xc]
dec ecx
je 0x3ce4f15
dec ecx
je 0x3ce4f40
jmp 0x3ce4f81
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx]
shl ecx, 4
mov ebx, ecx
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [edx + ebx]
mov byte [eax], bl
and ecx, 0x3f
movzx edx, byte [edx + ecx]
mov byte [eax + 1], dl
add eax, 2
mov word [eax], 0x3d3d
jmp 0x3ce4f81
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx]
shl ecx, 0xa
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + 1]
add ebx, ebx
add ebx, ebx
or ecx, ebx
mov ebx, ecx
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [edx + ebx]
mov byte [eax], bl
mov ebx, ecx
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [edx + ebx]
mov byte [eax + 1], bl
and ecx, 0x3f
movzx edx, byte [edx + ecx]
mov byte [eax + 2], dl
mov byte [eax + 3], 0x3d
add dword [esi + 4], 4
cmp byte [ebp + 8], 0
je 0x3ce4fa5
mov ebx, esi
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
jb 0x3ce4f9c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
inc dword [ebx + 4]
mov eax, dword [ebx + 4]
mov byte [eax], 0x22
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x3ceb18c
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm1, xmmword [edx]
movups xmm5, xmmword [0x3cea621]
cmp al, 0x80
je 0x3ceb2c0
cmp al, 0xc0
je 0x3ceb331
movups xmm3, xmmword [edx + 0x10]
add edx, 0x20
aeskeygenassist xmm2, xmm3, 1
call fcn.03ceb231
aeskeygenassist xmm2, xmm3, 2
call fcn.03ceb231
aeskeygenassist xmm2, xmm3, 4
call fcn.03ceb231
aeskeygenassist xmm2, xmm3, 8
call fcn.03ceb231
aeskeygenassist xmm2, xmm3, 0x10
call fcn.03ceb231
aeskeygenassist xmm2, xmm3, 0x20
call fcn.03ceb231
aeskeygenassist xmm2, xmm3, 0x40
pshufd xmm2, xmm2, 0xff
movups xmm4, xmm1
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pxor xmm1, xmm2
movups xmmword [edx], xmm1
repz ret
add edx, 0x10
aeskeygenassist xmm2, xmm1, 1
call fcn.03ceb292
aeskeygenassist xmm2, xmm1, 2
call fcn.03ceb292
aeskeygenassist xmm2, xmm1, 4
call fcn.03ceb292
aeskeygenassist xmm2, xmm1, 8
call fcn.03ceb292
aeskeygenassist xmm2, xmm1, 0x10
call fcn.03ceb292
aeskeygenassist xmm2, xmm1, 0x20
call fcn.03ceb292
aeskeygenassist xmm2, xmm1, 0x40
call fcn.03ceb292
aeskeygenassist xmm2, xmm1, 0x80
call fcn.03ceb292
aeskeygenassist xmm2, xmm1, 0x1b
call fcn.03ceb292
aeskeygenassist xmm2, xmm1, 0x36
call fcn.03ceb292
repz ret

Function at 0x3ceb231
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pshufd xmm2, xmm2, 0xff
movups xmm4, xmm1
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pxor xmm1, xmm2
movups xmmword [edx], xmm1
add edx, 0x10
aeskeygenassist xmm4, xmm1, 0
pshufd xmm2, xmm4, 0xaa
movups xmm4, xmm3
pshufb xmm4, xmm5
pxor xmm3, xmm4
pshufb xmm4, xmm5
pxor xmm3, xmm4
pshufb xmm4, xmm5
pxor xmm3, xmm4
pxor xmm3, xmm2
movups xmmword [edx], xmm3
add edx, 0x10
ret
Function at 0x3cebb3c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov ebx, 0x3e5ba5c
mov eax, 0x3e5da5c
add edx, 0x10
dec dword [esp]
mov ecx, dword [edx]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx], esi
mov ecx, dword [edx + 4]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx + 4], esi
mov ecx, dword [edx + 8]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx + 8], esi
mov ecx, dword [edx + 0xc]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx + 0xc], esi
cmp dword [esp], 1
jne 0x3cebb4d
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x3cebda0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, edx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp + 8], 0
jbe 0x3cebe0f
dec dword [ebp + 8]
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call dword [esi + 0x110]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx]
lea edx, [ebp - 0x14]
xor eax, dword [edx]
mov dword [esi], eax
mov eax, dword [ebx + 4]
lea edx, [ebp - 0x14]
xor eax, dword [edx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 8]
lea edx, [ebp - 0x14]
xor eax, dword [edx + 8]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
lea edx, [ebp - 0x14]
xor eax, dword [edx + 0xc]
mov dword [esi + 0xc], eax
add ebx, 0x10
add dword [ebp + 0xc], 0x10
cmp dword [ebp + 8], 0
ja 0x3cebdbd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8