joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1081cfa
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xac
push dword [esp]
sub dword [esp], 0xa9
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1081d24
mov ecx, 0x7be
xor eax, eax
je 0x1081d29
call 0x175875ca
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1081d3c
mov ecx, 0x7be
xor eax, eax
je 0x1081d41
call 0xed8b75e2
and bh, al
inc esp
and al, 0x1c
add byte [esi + 0x44c7a7b2], ch
and al, 0x18
outsb dx, byte [esi]
add byte [edx], al
add byte [ecx - 0x41ebdb8c], cl
enter 0x81c, 1
popfd
pop eax
sub esp, 0x20
mov dword [esp + 0x1c], 0xa7b2ae00
mov dword [esp + 0x18], 0x2006e
mov dword [esp + 0x14], esi
mov esi, 0x1081cc8
mov dword [esp + 0x10], ebp
nop
mov dword [esp + 0x1c], esi
xor esi, esi
nop
mov ebp, dword [esp + 0x1c]
mov ebp, dword [ebp]
nop
xor esi, ebp
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x1081d6b
mov esi, esi
mov ebp, dword [esp + 0x10]
nop
add edi, esi
mov esi, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], edi
mov dword [esp + 4], 0x9e0004c2
jmp 0x1081d98
ret 4

Function at 0x1081f30
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xac
push dword [esp]
sub dword [esp], 0xab
push dword [esp]
xchg dword [esp], ecx
mov ecx, dword [ecx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1081f5a
mov ecx, 0x7be
xor eax, eax
je 0x1081f5f
call 0x17587800
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1081f72
mov ecx, 0x7be
xor eax, eax
je 0x1081f77
call 0xed8b7818
sbb al, 0xc7
inc esp
and al, 0x18
insb byte es:[edi], dx
clc
inc esi
popfd
pop eax
sub esp, 0x1c
mov dword [esp + 0x18], 0x46f86c26
mov dword [esp + 0x14], 0x20031
mov dword [esp + 0x10], edi
mov edi, 0x1081f00
mov dword [esp + 0xc], ebp
mov dword [esp + 0x18], edi
xor edi, edi
mov ebp, dword [esp + 0x18]
mov ebp, dword [ebp]
xor edi, ebp
add dword [esp + 0x18], 4
dec word [esp + 0x14]
lea ebp, [ebp]
jne 0x1081f9f
nop
mov ebp, dword [esp + 0xc]
add ecx, edi
mov edi, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], ecx
mov dword [esp + 4], 0xc70004c2
jmp 0x1081fcc
ret 4
Function at 0x1082064
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xad
push dword [esp]
sub dword [esp], 0xab
push dword [esp]
xchg dword [esp], esi
mov esi, dword [esi]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x108208e
mov ecx, 0x7be
xor eax, eax
je 0x1082093
call 0x17587934
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x10820a6
mov ecx, 0x7be
xor eax, eax
je 0x10820ab
call 0xed8b794c
sbb al, 0xc7
inc esp
and al, 0x18
sub bl, bl
xchg ebp, eax
add bh, 0x44
and al, 0x14
push eax
add byte [edx], al
add byte [ecx - 0x44efdba4], cl
xor al, 0x20
or byte [ecx], al
popfd
pop eax
sub esp, 0x1c
mov dword [esp + 0x18], 0x8295db2a
mov dword [esp + 0x14], 0x20050
mov dword [esp + 0x10], ebx
mov ebx, 0x1082034
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], ebx
nop
xor ebx, ebx
nop
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
xor ebx, eax
add dword [esp + 0x18], 4
dec word [esp + 0x14]
xchg ebp, ebp
jne 0x10820d4
nop
mov eax, dword [esp + 0xc]
add esi, ebx
mov ebx, dword [esp + 0x10]
add esp, 0x1c
mov ebx, ebx
xchg dword [esp], esi
mov dword [esp + 4], 0x5e0004c2
jmp 0x1082102
ret 4

Function at 0x108212f
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xad
push dword [esp]
sub dword [esp], 0xab
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1082159
mov ecx, 0x7be
xor eax, eax
je 0x108215e
call 0x175879ff
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1082171
mov ecx, 0x7be
xor eax, eax
je 0x1082176
call 0xed8b7a17
and al, 0xc7
inc esp
and al, 0x20
sbb dword [esi - 0x76], ebp
add al, bh
inc esp
and al, 0x1c
cmp eax, 0x89000200
pop esp
and al, 0x18
popfd
pop eax
sub esp, 0x24
mov dword [esp + 0x20], 0x28a6e19
mov dword [esp + 0x1c], 0x2003d
mov dword [esp + 0x18], ebx
mov ebx, 0x10820fc
mov dword [esp + 0x14], esi
nop
mov dword [esp + 0x20], ebx
xor ebx, ebx
mov esi, dword [esp + 0x20]
mov esi, dword [esi]
nop
xor ebx, esi
nop
add dword [esp + 0x20], 4
nop
dec word [esp + 0x1c]
jne 0x108219f
nop
nop
mov esi, dword [esp + 0x14]
add edx, ebx
mov ebx, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], edx
mov dword [esp + 4], 0x750004c2
jmp 0x10821cc
ret 4
Function at 0x1082299
Capabilities:
Encode data using xor

Disassembly:
cli
mov dword [esp], 0xad
xor dword [esp], 0xa5
add esp, dword [esp]
push 0x13
push 0x141c6d4
call fcn.01082299
aam 0x2e
xchg edx, eax
adc al, 1
in eax, dx
mov ch, 0x86
add dword [esp], 0xad
push dword [esp]
sub dword [esp], 0xac
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x10822c3
mov ecx, 0x7be
xor eax, eax
je 0x10822c8
call 0x17587b69
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x10822db
mov ecx, 0x7be
xor eax, eax
je 0x10822e0
call 0xed8b7b81
and bh, al
inc esp
and al, 0x1c
bnd jp 0x1082273
popfd
pop eax
sub esp, 0x20
mov dword [esp + 0x1c], 0xb4877af2
mov dword [esp + 0x18], 0x20061
mov dword [esp + 0x14], esi
mov esi, 0x1082268
mov dword [esp + 0x10], ebx
mov ah, 0xc7
inc esp
and al, 0x18
popal
add byte [edx], al
add byte [ecx - 0x41ebdb8c], cl
push 0x89010822
pop esp
and al, 0x10
mov dword [esp + 0x1c], esi
xor esi, esi
nop
xchg ecx, ecx
mov ebx, dword [esp + 0x1c]
mov ebx, dword [ebx]
nop
xor esi, ebx
nop
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
lea edx, [edx]
jne 0x1082309
nop
mov ebx, dword [esp + 0x10]
add edx, esi
mov esi, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], edx
mov dword [esp + 4], 0x100004c2
jmp 0x1082338
ret 4

Function at 0x1082601
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xab
push dword [esp]
sub dword [esp], 0xa8
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x108262b
mov ecx, 0x7be
xor eax, eax
je 0x1082630
call 0x17587ed1
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1082643
mov ecx, 0x7be
xor eax, eax
je 0x1082648
call 0xed8b7ee9
sbb bh, al
inc esp
and al, 0x14
sub byte [esi + 0x44c73ae7], 0x24
adc byte [ebx], cl
add al, byte [eax]
popfd
pop eax
sub esp, 0x18
mov dword [esp + 0x14], 0x3ae7ae82
mov dword [esp + 0x10], 0x2004b
mov dword [esp + 0xc], ecx
mov ecx, 0x10825d0
mov dword [esp + 8], ebx
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov ebx, dword [esp + 0x14]
lea ecx, [ecx]
mov ebx, dword [ebx]
xor ecx, ebx
add dword [esp + 0x14], 4
dec word [esp + 0x10]
nop
jne 0x1082670
mov ebx, dword [esp + 8]
add eax, ecx
mov ecx, dword [esp + 0xc]
add esp, 0x18
lea eax, [eax]
xchg dword [esp], eax
mov dword [esp + 4], 0xd90004c2
jmp 0x108269d
ret 4
Function at 0x10827d9
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xa7
push dword [esp]
sub dword [esp], 0xa6
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1082803
mov ecx, 0x7be
xor eax, eax
je 0x1082808
call 0x175880a9
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x108281b
mov ecx, 0x7be
xor eax, eax
je 0x1082820
call 0xed8b80c1
sbb al, 0xc7
inc esp
and al, 0x18
cmp dword [edx - 0x2e], edi
xchg ebx, eax
popfd
pop eax
sub esp, 0x1c
mov dword [esp + 0x18], 0x93d27a39
mov dword [esp + 0x14], 0x20051
mov dword [esp + 0x10], edx
mov edx, 0x10827a8
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], edx
nop
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
xor edx, eax
add dword [esp + 0x18], 4
dec word [esp + 0x14]
jne 0x1082849
nop
mov eax, dword [esp + 0xc]
nop
add edi, edx
mov edx, dword [esp + 0x10]
add esp, 0x1c
xchg dword [esp], edi
mov dword [esp + 4], 0x460004c2
jmp 0x1082873
ret 4

Function at 0x108289f
Capabilities:
Encode data using xor

Disassembly:
add eax, dword [eax]
add byte [ecx + 0x3e22434], al
add byte [eax], al
add esp, dword [esp]
push 0x1a
push 0x141c6cc
call fcn.0108289f
dec eax
push cs
lea edx, [ecx + eax]
xchg esp, eax
bound ecx, qword [edx - 0x7f]
add dword [esp], 0xad
push dword [esp]
add dword [esp], 0xad
push dword [esp]
sub dword [esp], 0xac
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x10828c9
mov ecx, 0x7be
xor eax, eax
je 0x10828ce
call 0x1758816f
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x10828e1
mov ecx, 0x7be
xor eax, eax
je 0x10828e6
call 0xed8b8187
and bh, al
inc esp
and al, 0x1c
loope 0x108287e
popfd
pop eax
sub esp, 0x20
mov dword [esp + 0x1c], 0xcb0a8de1
or cl, bl
mov dword [esp + 0x18], 0x20073
mov dword [esp + 0x14], ebp
mov ebp, 0x108286c
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ebp
nop
xor ebp, ebp
nop
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
nop
xor ebp, edx
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x1082910
nop
nop
mov edx, dword [esp + 0x10]
nop
add ebx, ebp
mov edi, edi
mov ebp, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], ebx
mov dword [esp + 4], 0xeb0004c2
jmp 0x108293e
ret 4
Function at 0x1082b3d
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xb2
push dword [esp]
sub dword [esp], 0xb0
push dword [esp]
xchg dword [esp], esi
mov esi, dword [esi]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1082b67
mov ecx, 0x7be
xor eax, eax
je 0x1082b6c
call 0x1758840d
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1082b7f
mov ecx, 0x7be
xor eax, eax
je 0x1082b84
call 0xed8b8425
adc al, 0xc7
inc esp
and al, 0x10
test al, 0x38
in al, dx
imul eax, edi, 0x44
and al, 0xc
push esi
add byte [edx], al
add byte [ecx - 0x45f7dbac], cl
or al, 0x2b
or byte [ecx], al
popfd
pop eax
sub esp, 0x14
mov dword [esp + 0x10], 0x6bec38a8
mov dword [esp + 0xc], 0x20056
mov dword [esp + 8], edx
mov edx, 0x1082b0c
mov dword [esp + 4], ebp
mov dword [esp + 0x10], edx
nop
xor edx, edx
mov edx, edx
mov ebp, dword [esp + 0x10]
xchg edi, edi
mov ebp, dword [ebp]
xor edx, ebp
add dword [esp + 0x10], 4
nop
dec word [esp + 0xc]
jne 0x1082baf
mov ebp, dword [esp + 4]
nop
add esi, edx
mov edx, dword [esp + 8]
add esp, 0x14
mov ebp, ebp
xchg dword [esp], esi
mov dword [esp + 4], 0x320004c2
jmp 0x1082bde
ret 4

Function at 0x1082c90
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xb2
push dword [esp]
sub dword [esp], 0xb0
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1082cba
mov ecx, 0x7be
xor eax, eax
je 0x1082cbf
call 0x17588560
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x1082cd2
mov ecx, 0x7be
xor eax, eax
je 0x1082cd7
call 0xed8b8578
and bh, al
inc esp
and al, 0x1c
invalid
popfd
pop eax
sub esp, 0x20
mov dword [esp + 0x1c], 0x99c88d3e
mov dword [esp + 0x18], 0x2005d
mov dword [esp + 0x14], ecx
mov ecx, 0x1082c60
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], ecx
mov ebx, ebx
xor ecx, ecx
nop
mov ebp, dword [esp + 0x1c]
mov ebp, dword [ebp]
nop
xor ecx, ebp
add dword [esp + 0x1c], 4
nop
dec word [esp + 0x18]
jne 0x1082d02
mov esi, esi
mov ecx, ecx
mov ebp, dword [esp + 0x10]
add ebx, ecx
mov ecx, dword [esp + 0x14]
add esp, 0x20
nop
xchg dword [esp], ebx
mov dword [esp + 4], 0x800004c2
jmp 0x1082d32
ret 4

Function at 0x1087e70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push eax
push ebx
push ecx
push edx
push esi
push edi
push 0x1087ee5
pop dword [0x1480920]
push 0x1087f0b
push dword fs:[0]
mov dword fs:[0], esp
push 0
call fcn.00cc32c8
mov esi, eax
cmp word [esi], 0x5a4d
jne 0x1087ee5
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x1087ee5
movzx ebx, word [eax + 0x16]
xor ecx, ecx
test ebx, 0x2000
je 0x1087ee2
cmp dword [eax + 0x78], 0
je 0x1087ee2
mov ebx, dword [eax + 0x78]
add ebx, esi
mov ecx, dword [ebx + 0xc]
jcxz 0x1087ed5
add ecx, esi
pushal
push esi
push dword [eax + 0x50]
push ecx
call dword [ebp + 8]
add esp, 0xc
popal
add esi, dword [eax + 0x50]
and esi, 0xffff0000
add esi, 0x10000
cmp esi, 0xc0000000
jb 0x1087ea0
pop dword fs:[0]
pop eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
ret 4
Function at 0x1087ee5
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push eax
push ebx
push ecx
push edx
push esi
push edi
push 0x1087ee5
pop dword [0x1480920]
push 0x1087f0b
push dword fs:[0]
mov dword fs:[0], esp
push 0
call fcn.00cc32c8
mov esi, eax
cmp word [esi], 0x5a4d
jne 0x1087ee5
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x1087ee5
movzx ebx, word [eax + 0x16]
xor ecx, ecx
test ebx, 0x2000
je 0x1087ee2
cmp dword [eax + 0x78], 0
je 0x1087ee2
mov ebx, dword [eax + 0x78]
add ebx, esi
mov ecx, dword [ebx + 0xc]
jcxz 0x1087ed5
add ecx, esi
pushal
push esi
push dword [eax + 0x50]
push ecx
call dword [ebp + 8]
add esp, 0xc
popal
add esi, dword [eax + 0x50]
and esi, 0xffff0000
add esi, 0x10000
cmp esi, 0xc0000000
jb 0x1087ea0
pop dword fs:[0]
pop eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
ret 4

Function at 0x1094590
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x12c1738
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00f41a90
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x153fb40
push 0x1094660
push 0x20
push 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
push ecx
call fcn.01094150
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1b4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1b0], 0x20
push 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x1b0
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x30
push edx
call fcn.01093600
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 3
call fcn.01093850
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], eax
push 0x20
push 0x153fb2c
mov edx, dword [ebp - 0x10]
add edx, 0xc
push edx
call fcn.0115d310
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10c1a09
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xab
push dword [esp]
sub dword [esp], 0xaa
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x10c1a33
mov ecx, 0x7be
xor eax, eax
je 0x10c1a38
call 0x175c72d9
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0x10c1a4b
mov ecx, 0x7be
xor eax, eax
je 0x10c1a50
call 0xed8f72f1
sbb bh, al
inc esp
and al, 0x14
mov ch, byte [0x44c71f4f]
and al, 0x10
push ecx
add byte [edx], al
add byte [ecx - 0x42f3db94], cl
fcomp dword [ecx]
or al, 1
popfd
pop eax
sub esp, 0x18
mov dword [esp + 0x14], 0x1f4f2d8a
mov dword [esp + 0x10], 0x20051
mov dword [esp + 0xc], ebp
mov ebp, 0x10c19d8
mov dword [esp + 8], eax
mov dword [esp + 0x14], ebp
xor ebp, ebp
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
xor ebp, eax
nop
add dword [esp + 0x14], 4
dec word [esp + 0x10]
nop
jne 0x10c1a78
mov eax, dword [esp + 8]
add edx, ebp
mov ebp, dword [esp + 0xc]
nop
add esp, 0x18
mov ecx, ecx
xchg dword [esp], edx
mov dword [esp + 4], 0xa20004c2
jmp 0x10c1aa5
ret 4
Function at 0x11356d0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
call fcn.01135700
push 0x149fef8
push 0x149eef8
call fcn.01135840
add esp, 8
push 0x149ff38
push 0x149f6f8
call fcn.01135840
add esp, 8
xor eax, eax
pop ebp
ret

Function at 0x1135700
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
jmp 0x1135718
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jge 0x1135758
mov dword [ebp - 8], 0
jmp 0x1135730
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x20
jge 0x1135756
mov edx, dword [ebp - 8]
movsx eax, byte [edx + 0x14a01f0]
sub eax, 1
cmp eax, dword [ebp - 4]
jne 0x1135754
mov ecx, dword [ebp - 4]
mov dl, byte [ebp - 8]
mov byte [ebp + ecx - 0x2c], dl
jmp 0x1135756
jmp 0x1135727
jmp 0x113570f
mov dword [ebp - 0xc], 0
jmp 0x113576a
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
jge 0x1135833
mov dword [ebp - 8], 0
jmp 0x1135786
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x40
jge 0x113582e
mov dword [ebp - 0x34], 0
mov edx, dword [ebp - 8]
and edx, 0x20
mov eax, dword [ebp - 8]
and eax, 1
neg eax
sbb eax, eax
and eax, 0x10
or edx, eax
mov ecx, dword [ebp - 8]
sar ecx, 1
and ecx, 0xf
or edx, ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x38], 0
jmp 0x11357cb
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 4
jge 0x1135816
mov eax, dword [ebp - 0xc]
shl eax, 6
mov ecx, dword [ebp - 0x30]
movsx edx, byte [eax + ecx + 0x149fff0]
mov eax, 8
mov ecx, dword [ebp - 0x38]
sar eax, cl
and edx, eax
je 0x1135814
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x38]
lea eax, [edx + ecx*4]
movsx ecx, byte [ebp + eax - 0x2c]
mov edx, 0x1f
sub edx, ecx
mov eax, 1
mov ecx, edx
shl eax, cl
or eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
jmp 0x11357c2
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x34]
mov dword [ecx + edx*4 + 0x149e6f8], eax
jmp 0x113577d
jmp 0x1135761
mov esp, ebp
pop ebp
ret
Function at 0x11577d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov cl, byte [eax]
mov dl, byte [eax + 1]
inc eax
inc eax
inc eax
mov byte [esp + 0xe], cl
mov cl, byte [eax - 1]
inc eax
inc eax
mov byte [esp + 0x16], cl
mov cl, byte [eax - 1]
mov byte [esp + 0xc], dl
mov dl, byte [eax - 2]
inc eax
inc eax
mov byte [esp + 0x12], cl
mov cl, byte [eax - 1]
mov byte [esp + 0x10], dl
mov dl, byte [eax - 2]
inc eax
mov byte [esp + 0x14], cl
mov cl, byte [eax - 1]
inc eax
mov byte [esp + 0x11], cl
mov cl, byte [eax - 1]
inc eax
mov byte [esp + 0xa], cl
mov cl, byte [eax - 1]
inc eax
mov byte [esp + 0xf], cl
mov cl, byte [eax - 1]
inc eax
mov byte [esp + 0x15], cl
mov cl, byte [eax - 1]
mov bl, byte [eax]
inc eax
test cl, cl
mov byte [esp + 0xb], bl
mov bl, byte [eax]
mov al, byte [eax + 1]
mov byte [esp + 9], dl
mov byte [esp + 8], cl
mov byte [esp + 0x13], bl
mov byte [esp + 0xd], al
jne 0x11578bf
test dl, dl
jne 0x11578bf
mov cl, byte [esp + 0xa]
test cl, cl
jne 0x11578bf
mov cl, byte [esp + 0xb]
test cl, cl
jne 0x11578bf
mov cl, byte [esp + 0xc]
test cl, cl
jne 0x11578bf
test al, al
jne 0x11578bf
mov al, byte [esp + 0xe]
test al, al
jne 0x11578bf
mov al, byte [esp + 0xf]
test al, al
jne 0x11578bf
mov al, byte [esp + 0x10]
test al, al
jne 0x11578bf
mov al, byte [esp + 0x11]
test al, al
jne 0x11578bf
mov al, byte [esp + 0x12]
test al, al
jne 0x11578bf
test bl, bl
jne 0x11578bf
mov al, byte [esp + 0x14]
test al, al
jne 0x11578bf
mov al, byte [esp + 0x15]
test al, al
jne 0x11578bf
mov al, byte [esp + 0x16]
test al, al
jne 0x11578bf
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x10
ret
push esi
push edi
mov ecx, 0xf
lea edi, [esp + 0x10]
call fcn.011570c0
mov edx, edi
mov ecx, 1
mov esi, 0xf
jmp 0x11578e0
mov bl, byte [edx]
xor bl, cl
mov edi, ecx
movzx cx, ch
and edi, 0x1ff
or cx, word [edi*2 + 0x14238c0]
mov byte [edx], bl
inc edx
dec esi
jne 0x11578e0
test eax, eax
pop edi
pop esi
jne 0x115792a
mov dl, byte [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 0x10]
mov byte [eax], dl
mov dl, byte [esp + 0x11]
movzx eax, byte [esp + 0xd]
mov byte [ebp], cl
mov byte [ebp + 1], dl
pop ebp
shl eax, 3
pop ebx
add esp, 0x10
ret
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x10
ret
Function at 0x1157940
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ecx]
sub esp, 0x4c
cmp ecx, 6
jge 0x1157959
cmp ecx, 0x100
jle 0x1157959
or eax, 0xffffffff
add esp, 0x4c
ret
mov dl, byte [eax]
mov cl, byte [eax + 1]
inc eax
inc eax
mov byte [esp + 2], dl
mov dl, byte [eax]
inc eax
mov byte [esp + 4], cl
mov cl, byte [eax]
inc eax
mov byte [esp + 1], dl
mov dl, byte [eax]
mov al, byte [eax + 1]
push esi
push edi
mov byte [esp + 0xd], cl
mov ecx, 6
lea edi, [esp + 8]
mov byte [esp + 8], dl
mov byte [esp + 0xb], al
call fcn.011570c0
mov edx, edi
mov ecx, 0xa1
mov esi, 6
nop
xor byte [edx], cl
mov edi, ecx
movzx cx, ch
and edi, 0x1ff
or cx, word [edi*2 + 0x14238c0]
inc edx
dec esi
jne 0x11579a0
test eax, eax
pop edi
pop esi
jne 0x11579e0
mov cl, byte [esp]
mov al, byte [esp + 2]
mov dl, byte [esp + 1]
mov byte [ebx], cl
mov cl, byte [esp + 3]
mov byte [ebx + 2], al
mov byte [ebx + 1], dl
mov byte [ebx + 3], cl
xor eax, eax
add esp, 0x4c
ret
mov eax, 0xfffffffe
add esp, 0x4c
ret

Function at 0x11579f0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ecx]
sub esp, 0x4c
cmp ecx, 0x10
jge 0x1157a09
cmp ecx, 0x100
jle 0x1157a09
or eax, 0xffffffff
add esp, 0x4c
ret
mov dl, byte [eax]
mov cl, byte [eax + 1]
inc eax
inc eax
inc eax
mov byte [esp + 9], dl
mov dl, byte [eax - 1]
inc eax
mov byte [esp + 5], cl
mov cl, byte [eax - 1]
inc eax
mov byte [esp + 0xd], dl
mov dl, byte [eax - 1]
inc eax
mov byte [esp], cl
mov cl, byte [eax - 1]
inc eax
mov byte [esp + 0xf], dl
mov dl, byte [eax - 1]
inc eax
mov byte [esp + 8], cl
mov cl, byte [eax - 1]
inc eax
mov byte [esp + 3], dl
mov dl, byte [eax - 1]
mov byte [esp + 0xb], cl
mov cl, byte [eax]
inc eax
mov byte [esp + 0xa], dl
mov dl, byte [eax]
inc eax
mov byte [esp + 2], cl
mov cl, byte [eax]
inc eax
mov byte [esp + 0xe], dl
mov dl, byte [eax]
inc eax
mov byte [esp + 4], cl
mov cl, byte [eax]
inc eax
mov byte [esp + 7], dl
mov dl, byte [eax]
mov al, byte [eax + 1]
push esi
push edi
mov byte [esp + 9], cl
mov ecx, 0x10
lea edi, [esp + 8]
mov byte [esp + 0x14], dl
mov byte [esp + 0xe], al
call fcn.011570c0
mov edx, edi
mov ecx, pe_nt_image_headers32
mov esi, 0x10
jmp 0x1157aa0
xor byte [edx], cl
mov edi, ecx
movzx cx, ch
and edi, 0x1ff
or cx, word [edi*2 + 0x14238c0]
inc edx
dec esi
jne 0x1157aa0
test eax, eax
pop edi
pop esi
jne 0x1157b08
mov edx, dword [esp + 0x50]
mov ecx, dword [esp]
mov eax, dword [esp + 4]
mov dword [edx], ecx
mov ecx, dword [esp + 0x54]
mov dl, byte [esp + 0xa]
mov dword [ecx], eax
mov eax, dword [esp + 0x58]
mov cl, byte [esp + 0xb]
mov byte [eax], dl
mov edx, dword [esp + 0x5c]
mov al, byte [esp + 0xc]
mov byte [edx], cl
mov cl, byte [esp + 0xd]
mov dl, byte [esp + 0xe]
mov byte [ebx], al
mov al, byte [esp + 0xf]
mov byte [ebx + 3], al
mov byte [ebx + 1], cl
mov byte [ebx + 2], dl
xor eax, eax
add esp, 0x4c
ret
mov eax, 0xfffffffe
add esp, 0x4c
ret