joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414fb0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push esi
sub esp, 0x18
mov eax, dword [0x8e4a3c]
xor eax, esp
mov dword [esp + 0x14], eax
cmp dword [0x8e7c28], 0
je 0x415084
call sub.KERNEL32.dll_GetTickCount
mov esi, eax
mov eax, dword [0x8e7c28]
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x414ff5
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [0x8e7c28]
mov dword [eax], 0
mov dword [eax + 4], esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [0x8e7c28]
mov dword [ecx + 8], eax
cmp eax, 0xffffffff
je 0x41507b
mov dword [esp], 1
mov ecx, esp
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov word [esp + 4], 2
push 0x1f97
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 6], ax
push 0x7f000001
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 8], eax
mov eax, dword [0x8e7c28]
lea ecx, [esp + 4]
push 0x10
push ecx
push dword [eax + 8]
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, dword [0x8e7c28]
test eax, eax
jne 0x415073
mov dword [ecx], 2
mov dword [ecx + 4], esi
mov dword [ecx], 1
jmp 0x415081
mov dword [ecx], 0
mov dword [ecx + 4], esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004c0e60
add esp, 0x18
pop esi
ret

Function at 0x415300
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x8e7c28]
test eax, eax
je 0x415322
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x415322
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_send]
ret
Function at 0x4154a0
Capabilities:
Create udp socket
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x164
mov eax, dword [0x8e4a3c]
xor eax, esp
mov dword [esp + 0x160], eax
mov dword [esp + 0x17], 0xc5130000
mov dword [esp + 0x14], 0x60580
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
je 0x415653
mov esi, eax
mov word [esp + 0x150], 2
push 0x438
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x152], ax
push 0x7f000001
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x154], eax
lea eax, [esp + 0x150]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
setne al
mov dword [esp], eax
je 0x415647
mov eax, esi
inc eax
mov dword [esp + 4], eax
xor ebp, ebp
lea edi, [esp + 0x120]
jmp 0x415559
mov edi, ebx
nop word cs:[eax + eax]
cmp ebp, 3
jge 0x415647
mov word [esp + 0x140], 2
push 0x1f96
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x142], ax
push 0x7f000001
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x144], eax
push 0x10
lea eax, [esp + 0x144]
push eax
push 0
push 7
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 1
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x30d40
lea eax, [esp + 8]
push eax
push 0
push 0
lea ebx, [esp + 0x28]
push ebx
push dword [esp + 0x14]
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x415550
push ebx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x415550
mov dword [esp + 0x10], 0x10
xorps xmm0, xmm0
movups xmmword [esp + 0x120], xmm0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x134]
push eax
push 0
push 0x10
mov ebx, edi
push edi
push esi
call dword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jle 0x415540
push ebx
call fcn.00435830
add esp, 4
test al, al
je 0x415550
inc ebp
push 0xc8
call fcn.004c0d20
add esp, 4
jmp 0x415550
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, dword [esp]
jmp 0x415655
xor ebx, ebx
mov ecx, dword [esp + 0x160]
xor ecx, esp
call fcn.004c0e60
mov eax, ebx
add esp, 0x164
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x415bd0
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
push esi
sub esp, 0x14
mov eax, dword [0x8e4a3c]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [0x8e7c40]
test eax, eax
je 0x415c34
cmp dword [eax], 0xffffffff
je 0x415c34
cmp dword [0x8e54ec], 0
je 0x415c34
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov word [esp], 2
push 0x1f96
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 2], ax
mov eax, dword [0x8e54ec]
mov dword [esp + 4], eax
mov eax, dword [0x8e7c40]
mov ecx, esp
push 0x10
push ecx
push 0
push edi
push esi
push dword [eax]
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004c0e60
add esp, 0x14
pop esi
pop edi
ret

Function at 0x430970
Capabilities:
Enumerate pe sections

Disassembly:
push edi
push esi
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, 1
jg 0x4309d0
movzx edx, word [esp + 0xc]
lea eax, [ecx + ecx*8]
lea eax, [eax + eax*2]
movzx esi, byte [ecx + eax + 0x4f9985]
cmp si, dx
jne 0x43099b
xor ecx, ecx
xor eax, eax
jmp 0x4309c2
lea esi, [ecx + eax]
add esi, 0x4f9984
movzx ecx, byte [esi + 2]
mov eax, 1
cmp cx, dx
je 0x4309c0
movzx ecx, byte [esi + 3]
mov eax, 2
cmp cx, dx
jne 0x4309d3
xor ecx, ecx
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov dword [edx], ecx
mov dword [esi], eax
mov al, 1
pop esi
pop edi
ret
movzx edi, byte [esi + 5]
mov ecx, 1
cmp di, dx
je 0x430997
movzx ecx, byte [esi + 6]
cmp cx, dx
jne 0x4309f6
mov ecx, 1
mov eax, 1
jmp 0x4309c2
movzx ecx, byte [esi + 7]
cmp cx, dx
jne 0x430a06
mov ecx, 1
jmp 0x4309c2
movzx eax, byte [esi + 9]
mov ecx, 2
cmp ax, dx
je 0x430997
movzx eax, byte [esi + 0xa]
cmp ax, dx
jne 0x430a24
mov eax, 1
jmp 0x4309c2
movzx ecx, byte [esi + 0xb]
mov eax, 2
cmp cx, dx
jne 0x430a39
mov ecx, 2
jmp 0x4309c2
movzx edi, byte [esi + 0xd]
mov ecx, 3
cmp di, dx
je 0x430997
movzx edi, byte [esi + 0xe]
cmp di, dx
je 0x430a1d
movzx edi, byte [esi + 0xf]
cmp di, dx
je 0x4309c2
movzx edi, byte [esi + 0x11]
mov ecx, 4
cmp di, dx
je 0x430997
movzx edi, byte [esi + 0x12]
cmp di, dx
je 0x430a1d
movzx edi, byte [esi + 0x13]
cmp di, dx
je 0x4309c2
movzx edi, byte [esi + 0x15]
mov ecx, 5
cmp di, dx
je 0x430997
movzx edi, byte [esi + 0x16]
cmp di, dx
je 0x430a1d
movzx edi, byte [esi + 0x17]
cmp di, dx
je 0x4309c2
movzx edi, byte [esi + 0x19]
mov ecx, 6
cmp di, dx
je 0x430997
movzx edi, byte [esi + 0x1a]
cmp di, dx
je 0x430a1d
movzx esi, byte [esi + 0x1b]
cmp si, dx
je 0x4309c2
xor eax, eax
jmp 0x4309d0
Function at 0x4329d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [0x8e4a3c]
xor eax, esp
mov dword [esp + 0xc], eax
cmp dword [0x8e7f10], 0
je 0x432a07
cmp dword [0x6633b4], 2
jl 0x432aef
push str._WARNING__scanner_is_working_
call fcn.004cfe43
add esp, 4
jmp 0x432aef
inc dword [0x8e7fc0]
push 0x17
call fcn.004cfdf3
add esp, 4
mov esi, eax
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov word [eax + 0x10], 0
mov dword [eax + 0x12], 0x544f4f52
mov byte [eax + 0x16], 0
call sub.KERNEL32.dll_GetTickCount
mov dword [0x8e7df4], eax
mov dword [0x8e7e00], 0
mov byte [0x8e7e04], 1
mov dword [0x8e7f0c], esi
mov dword [0x8e7f10], esi
mov dword [0x8e7f14], 0
mov dword [0x8e7fa4], 0
mov dword [0x8e7fac], 0
mov byte [0x8e7fb8], 0
mov dword [0x8e7dfc], 0
cmp dword [0x6633b4], 3
jl 0x432aa6
add esi, 0x12
push esi
push str._INFO__enter_folder:__s_n
call fcn.00401220
add esp, 8
mov esi, dword [0x8e7f10]
mov dword [0x8e7f14], 0
movzx eax, word [esi + 0xc]
movzx ecx, word [esi + 0xe]
rol ax, 8
rol cx, 8
mov word [esp + 3], ax
mov byte [esp + 5], 0xd1
mov word [esp + 6], cx
mov dword [esp + 8], 0xd00002d2
call sub.KERNEL32.dll_GetTickCount
mov dword [0x8e7fb0], eax
lea ecx, [esp + 3]
mov edx, 9
call fcn.00433720
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.004c0e60
add esp, 0x10
pop esi
ret
Function at 0x433450
Capabilities:
Check for time delay via gettickcount

Disassembly:
call sub.KERNEL32.dll_GetTickCount
mov dword [0x8e7fbc], eax
mov byte [0x8e7fb8], 1
call sub.KERNEL32.dll_GetTickCount
mov dword [0x8e7fb4], eax
mov ecx, 0x6633b8
mov edx, 3
jmp fcn.00433720

Function at 0x433480
Capabilities:
Check for time delay via gettickcount

Disassembly:
call sub.KERNEL32.dll_GetTickCount
mov dword [0x8e7fbc], eax
mov byte [0x8e7fb8], 1
call sub.KERNEL32.dll_GetTickCount
mov dword [0x8e7fb4], eax
mov ecx, 0x6633bb
mov edx, 3
jmp fcn.00433720

Function at 0x4334b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
call sub.KERNEL32.dll_GetTickCount
mov dword [0x8e7fbc], eax
mov byte [0x8e7fb8], 1
call sub.KERNEL32.dll_GetTickCount
mov dword [0x8e7fb4], eax
mov ecx, 0x6633be
mov edx, 3
jmp fcn.00433720

Function at 0x4334e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
call sub.KERNEL32.dll_GetTickCount
mov dword [0x8e7fbc], eax
mov byte [0x8e7fb8], 1
call sub.KERNEL32.dll_GetTickCount
mov dword [0x8e7fb4], eax
mov ecx, 0x6633c1
mov edx, 3
jmp fcn.00433720

Function at 0x433510
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov eax, dword [esp + 8]
cmp eax, 2
ja 0x433549
mov esi, dword [eax*4 + 0x4fca2c]
call sub.KERNEL32.dll_GetTickCount
mov dword [0x8e7fbc], eax
mov byte [0x8e7fb8], 1
call sub.KERNEL32.dll_GetTickCount
mov dword [0x8e7fb4], eax
mov ecx, esi
mov edx, 3
pop esi
jmp fcn.00433720
pop esi
ret

Function at 0x433720
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, edx
mov eax, dword [0x8e4a3c]
xor eax, esp
mov dword [esp + 0x18], eax
mov byte [esp + 3], 0x80
mov eax, ebx
add al, 3
mov byte [esp + 4], al
mov byte [esp + 5], 0x72
lea eax, [esp + 6]
push edx
push ecx
push eax
call fcn.004c3690
add esp, 0xc
mov edx, 0xffff
lea esi, [esp + 3]
mov ebp, ebx
cmp ebx, 0xfffffffe
jl 0x43380d
mov eax, ebp
lea edi, [ebp + 4]
mov ecx, esi
movzx eax, byte [ecx]
xor eax, edx
mov ebx, eax
shr ebx, 1
mov edx, ebx
xor edx, 0xa001
test al, 1
cmove edx, ebx
mov eax, edx
shr eax, 1
mov ebx, eax
xor ebx, 0xa001
test dl, 1
cmove ebx, eax
mov eax, ebx
shr eax, 1
mov edx, eax
xor edx, 0xa001
test bl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ebx, eax
xor ebx, 0xa001
test dl, 1
cmove ebx, eax
mov eax, ebx
shr eax, 1
mov edx, eax
xor edx, 0xa001
test bl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ebx, eax
xor ebx, 0xa001
test dl, 1
cmove ebx, eax
mov edx, ebx
shr edx, 1
mov eax, edx
xor eax, 0xa001
test bl, 1
cmove eax, edx
mov ebx, eax
shr ebx, 1
mov edx, ebx
xor edx, 0xa001
test al, 1
cmove edx, ebx
inc ecx
dec edi
cmp edi, 1
ja 0x433770
rol dx, 8
mov word [esp + ebp + 6], dx
add ebp, 5
call sub.KERNEL32.dll_GetTickCount
mov dword [0x8e7fa8], eax
push ebp
push esi
call fcn.00414ea0
add esp, 8
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004c0e60
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435530
Capabilities:
Decompress data using quicklz

Disassembly:
push ebx
push edi
push esi
mov byte [0x8e8172], 0
call fcn.00438890
cmp byte [0x8e5504], 0
setne cl
cmp dword [0x8e8294], 0
movzx eax, byte [0x8e54f8]
setne dl
or dl, cl
xor ecx, ecx
jmp 0x435589
or dword [esi*4 + 0x8e8298], edi
mov byte [0x8e83b4], 1
mov ah, byte [ecx + 0x8e8c8c]
and ah, 0xc0
or ah, 0x20
mov byte [ecx + 0x8e8c8c], ah
inc ecx
cmp ecx, 0x8d7
je 0x4355cd
mov esi, ecx
shr esi, 5
mov edi, 1
shl edi, cl
mov ebx, 0xfffffffe
rol ebx, cl
and esi, 0x7ff
and dword [esi*4 + 0x8e8174], ebx
lea ebx, [ecx - 2]
test al, al
je 0x4355c0
cmp bx, 0x34
jae 0x435560
jmp 0x43556e
cmp bx, 0x34
setb ah
test dl, ah
je 0x435560
jmp 0x43556e
movaps xmm0, xmmword [0x8e96c0]
andps xmm0, xmmword [0x4fcac0]
orps xmm0, xmmword [0x4fcad0]
or dword [0x8e96b4], 0xffff
movaps xmmword [0x8e96c0], xmm0
mov byte [0x8e96b8], 1
xor ecx, ecx
nop dword [eax]
mov eax, 1
shl eax, cl
mov edx, ecx
shr edx, 3
and edx, 0x1ffc
or dword [edx + 0x8e96e8], eax
mov eax, 2
shl eax, cl
movzx ebx, byte [ecx + 0x8e96f1]
and bl, 0xc0
or dword [edx + 0x8e96e8], eax
or bl, 0x20
mov byte [ecx + 0x8e96f1], bl
movzx eax, byte [ecx + 0x8e96f2]
and al, 0xc0
or al, 0x20
mov byte [ecx + 0x8e96f2], al
add ecx, 2
cmp ecx, 0x20
jne 0x435600
mov byte [0x8e96f0], 1
pop esi
pop edi
pop ebx
ret

Function at 0x435760
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x43581b
mov edx, dword [esp + 0xc]
inc esi
mov eax, 0xffff
nop dword [eax + eax]
movzx ecx, byte [edx]
xor ecx, eax
mov ebx, ecx
shr ebx, 1
mov eax, ebx
xor eax, 0xa001
test cl, 1
cmove eax, ebx
mov ecx, eax
shr ecx, 1
mov ebx, ecx
xor ebx, 0xa001
test al, 1
cmove ebx, ecx
mov ecx, ebx
shr ecx, 1
mov eax, ecx
xor eax, 0xa001
test bl, 1
cmove eax, ecx
mov ecx, eax
shr ecx, 1
mov ebx, ecx
xor ebx, 0xa001
test al, 1
cmove ebx, ecx
mov ecx, ebx
shr ecx, 1
mov eax, ecx
xor eax, 0xa001
test bl, 1
cmove eax, ecx
mov ecx, eax
shr ecx, 1
mov ebx, ecx
xor ebx, 0xa001
test al, 1
cmove ebx, ecx
mov eax, ebx
shr eax, 1
mov ecx, eax
xor ecx, 0xa001
test bl, 1
cmove ecx, eax
mov ebx, ecx
shr ebx, 1
mov eax, ebx
xor eax, 0xa001
test cl, 1
cmove eax, ebx
inc edx
dec esi
cmp esi, 1
ja 0x435780
jmp 0x435820
mov eax, 0xffff
pop esi
pop ebx
ret
Function at 0x435830
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x14]
cmp byte [esi], 0x80
jne 0x435929
movzx eax, byte [esi + 1]
cmp eax, 0xff
mov ebp, 0x106
cmovne ebp, eax
cmp byte [esi + 2], 0xff
cmovne ebp, eax
test ebp, ebp
je 0x435913
lea edx, [ebp + 1]
mov edi, 0xffff
nop dword [eax]
movzx ecx, byte [esi]
xor ecx, edi
mov eax, ecx
shr eax, 1
mov ebx, eax
xor ebx, 0xa001
test cl, 1
cmove ebx, eax
mov ecx, ebx
shr ecx, 1
mov eax, ecx
xor eax, 0xa001
test bl, 1
cmove eax, ecx
mov ecx, eax
shr ecx, 1
mov ebx, ecx
xor ebx, 0xa001
test al, 1
cmove ebx, ecx
mov ecx, ebx
shr ecx, 1
mov eax, ecx
xor eax, 0xa001
test bl, 1
cmove eax, ecx
mov ecx, eax
shr ecx, 1
mov ebx, ecx
xor ebx, 0xa001
test al, 1
cmove ebx, ecx
mov ecx, ebx
shr ecx, 1
mov eax, ecx
xor eax, 0xa001
test bl, 1
cmove eax, ecx
mov ecx, eax
shr ecx, 1
mov ebx, ecx
xor ebx, 0xa001
test al, 1
cmove ebx, ecx
mov eax, ebx
shr eax, 1
mov edi, eax
xor edi, 0xa001
test bl, 1
cmove edi, eax
inc esi
dec edx
cmp edx, 1
ja 0x435870
movzx edx, di
mov esi, dword [esp + 0x14]
jmp 0x435918
mov edx, 0xffff
movzx eax, word [esi + ebp]
rol ax, 8
movzx ecx, ax
mov al, 1
cmp ecx, edx
je 0x43592b
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435930
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x38]
mov ebx, dword [esp + 0x2c]
mov eax, dword [0x8e4a3c]
xor eax, esp
mov dword [esp + 0x14], eax
jmp 0x435961
push dword [esp + 0xc]
mov ebx, dword [esp + 0x30]
push ebx
call fcn.00402750
add esp, 8
xor eax, eax
lea edi, [esp + 0x13]
jmp 0x435976
mov eax, dword [esp + 4]
inc al
mov dword [esp + 4], eax
movzx esi, al
push esi
push edi
push ebx
call fcn.00402520
add esp, 0xc
test eax, eax
je 0x4359a8
cmp byte [esp + 0x13], 0x80
je 0x4359a8
test ebp, ebp
jne 0x435970
push 1
push ebx
call fcn.00402750
add esp, 8
mov eax, dword [esp + 4]
jmp 0x435976
push ebx
call fcn.00402580
add esp, 4
cmp eax, 5
jl 0x435b33
mov edi, eax
cmp eax, esi
jle 0x435b33
mov dword [esp], 0
lea eax, [esi + 1]
mov dword [esp + 0xc], eax
push eax
lea eax, [esp + 0x16]
push eax
push ebx
call fcn.00402520
add esp, 0xc
movzx eax, byte [esp + 0x12]
add eax, 2
cmp edi, eax
jae 0x435a10
test ebp, ebp
lea edi, [esp + 0x13]
mov eax, dword [esp + 4]
je 0x435b5c
inc al
jmp 0x435976
cmp eax, dword [esp + 0x34]
jg 0x435b3c
push esi
mov dword [esp + 0xc], eax
push eax
mov edi, dword [esp + 0x38]
push edi
push ebx
call fcn.004026c0
add esp, 0x10
movzx eax, byte [esp + 0x12]
test eax, eax
mov dword [esp], eax
je 0x435af0
lea ebp, [eax + 1]
mov edx, edi
mov edi, 0xffff
nop dword [eax + eax]
movzx ecx, byte [edx]
xor ecx, edi
mov ebx, ecx
shr ebx, 1
mov eax, ebx
xor eax, 0xa001
test cl, 1
cmove eax, ebx
mov ecx, eax
shr ecx, 1
mov ebx, ecx
xor ebx, 0xa001
test al, 1
cmove ebx, ecx
mov ecx, ebx
shr ecx, 1
mov eax, ecx
xor eax, 0xa001
test bl, 1
cmove eax, ecx
mov ecx, eax
shr ecx, 1
mov ebx, ecx
xor ebx, 0xa001
test al, 1
cmove ebx, ecx
mov ecx, ebx
shr ecx, 1
mov eax, ecx
xor eax, 0xa001
test bl, 1
cmove eax, ecx
mov ecx, eax
shr ecx, 1
mov ebx, ecx
xor ebx, 0xa001
test al, 1
cmove ebx, ecx
mov ecx, ebx
shr ecx, 1
mov eax, ecx
xor eax, 0xa001
test bl, 1
cmove eax, ecx
mov ecx, eax
shr ecx, 1
mov edi, ecx
xor edi, 0xa001
test al, 1
cmove edi, ecx
inc edx
dec ebp
cmp ebp, 1
ja 0x435a50
jmp 0x435af5
mov edi, 0xffff
mov eax, dword [esp]
add eax, dword [esp + 0x30]
push eax
call fcn.00402440
add esp, 4
movzx eax, ax
push eax
call fcn.00402420
add esp, 4
movzx eax, ax
cmp edi, eax
je 0x435b45
mov ebp, dword [esp + 0x38]
test ebp, ebp
je 0x435950
mov eax, dword [esp + 4]
inc al
mov ebx, dword [esp + 0x2c]
jmp 0x435963
mov dword [esp], 0
jmp 0x435b5c
mov dword [esp], 0xffffffff
jmp 0x435b50
mov eax, dword [esp + 8]
mov dword [esp], eax
mov ebx, dword [esp + 0x2c]
add eax, esi
push eax
push ebx
call fcn.00402750
add esp, 8
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004c0e60
mov eax, dword [esp]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
movzx esi, byte [esp + 0x24]
lea edi, [esi + 5]
xor eax, eax
cmp edi, dword [esp + 0x18]
ja 0x435c7c
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x1c]
mov ebx, dword [esp + 0x14]
lea edx, [esi + 3]
mov byte [ebx], 0x80
mov byte [ebx + 1], dl
mov byte [ebx + 2], cl
lea ecx, [ebx + 3]
cmp ecx, eax
je 0x435bc3
push esi
push eax
push ecx
call fcn.004c3690
add esp, 0xc
lea ebp, [esi + 4]
mov edx, 0xffff
mov ecx, ebx
nop dword [eax]
movzx eax, byte [ecx]
xor eax, edx
mov ebx, eax
shr ebx, 1
mov edx, ebx
xor edx, 0xa001
test al, 1
cmove edx, ebx
mov eax, edx
shr eax, 1
mov ebx, eax
xor ebx, 0xa001
test dl, 1
cmove ebx, eax
mov eax, ebx
shr eax, 1
mov edx, eax
xor edx, 0xa001
test bl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ebx, eax
xor ebx, 0xa001
test dl, 1
cmove ebx, eax
mov eax, ebx
shr eax, 1
mov edx, eax
xor edx, 0xa001
test bl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ebx, eax
xor ebx, 0xa001
test dl, 1
cmove ebx, eax
mov edx, ebx
shr edx, 1
mov eax, edx
xor eax, 0xa001
test bl, 1
cmove eax, edx
mov ebx, eax
shr ebx, 1
mov edx, ebx
xor edx, 0xa001
test al, 1
cmove edx, ebx
inc ecx
dec ebp
cmp ebp, 1
ja 0x435bd0
rol dx, 8
mov eax, dword [esp + 0x14]
mov word [eax + esi + 3], dx
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x436310
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov eax, dword [0x8e8294]
test eax, eax
je 0x43643a
movzx edx, byte [0x8e9681]
test dl, dl
je 0x43643a
movzx ecx, byte [0x8e9680]
test cl, cl
je 0x436344
dec cl
xor eax, eax
mov byte [0x8e9680], cl
jmp 0x436359
mov byte [0x8e9680], 0x64
dec dl
mov byte [0x8e9681], dl
je 0x43643c
test al, al
je 0x43643a
mov word [0x8ea92c], 0x480
mov byte [0x8ea92e], 1
mov byte [0x8ea92f], al
mov ecx, 0xffff
mov eax, 0xfffffffc
movzx edx, byte [eax + 0x8ea930]
xor edx, ecx
mov ebx, edx
shr ebx, 1
mov ecx, ebx
xor ecx, 0xa001
test dl, 1
cmove ecx, ebx
mov ebx, ecx
shr ebx, 1
mov edx, ebx
xor edx, 0xa001
test cl, 1
cmove edx, ebx
mov ebx, edx
shr ebx, 1
mov ecx, ebx
xor ecx, 0xa001
test dl, 1
cmove ecx, ebx
mov ebx, ecx
shr ebx, 1
mov edx, ebx
xor edx, 0xa001
test cl, 1
cmove edx, ebx
mov ebx, edx
shr ebx, 1
mov ecx, ebx
xor ecx, 0xa001
test dl, 1
cmove ecx, ebx
mov ebx, ecx
shr ebx, 1
mov edx, ebx
xor edx, 0xa001
test cl, 1
cmove edx, ebx
mov ecx, edx
shr ecx, 1
mov ebx, ecx
xor ebx, 0xa001
test dl, 1
cmove ebx, ecx
mov edx, ebx
shr edx, 1
mov ecx, edx
xor ecx, 0xa001
test bl, 1
cmove ecx, edx
inc eax
jne 0x436380
rol cx, 8
mov word [0x8ea930], cx
push 6
push 0x8ea92c
call fcn.00414ea0
add esp, 8
pop ebx
ret
mov dword [0x8e8294], 0
mov byte [0x8e9681], 0
xor ecx, ecx
jmp 0x43633c
Function at 0x436460
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov eax, dword [0x8e9684]
test eax, eax
je 0x43658a
movzx edx, byte [0x8e9683]
test dl, dl
je 0x43658a
movzx ecx, byte [0x8e9682]
test cl, cl
je 0x436494
dec cl
xor eax, eax
mov byte [0x8e9682], cl
jmp 0x4364a9
mov byte [0x8e9682], 0x64
dec dl
mov byte [0x8e9683], dl
je 0x43658c
test al, al
je 0x43658a
mov word [0x8ea92c], 0x480
mov byte [0x8ea92e], 0x11
mov byte [0x8ea92f], al
mov ecx, 0xffff
mov eax, 0xfffffffc
movzx edx, byte [eax + 0x8ea930]
xor edx, ecx
mov ebx, edx
shr ebx, 1
mov ecx, ebx
xor ecx, 0xa001
test dl, 1
cmove ecx, ebx
mov ebx, ecx
shr ebx, 1
mov edx, ebx
xor edx, 0xa001
test cl, 1
cmove edx, ebx
mov ebx, edx
shr ebx, 1
mov ecx, ebx
xor ecx, 0xa001
test dl, 1
cmove ecx, ebx
mov ebx, ecx
shr ebx, 1
mov edx, ebx
xor edx, 0xa001
test cl, 1
cmove edx, ebx
mov ebx, edx
shr ebx, 1
mov ecx, ebx
xor ecx, 0xa001
test dl, 1
cmove ecx, ebx
mov ebx, ecx
shr ebx, 1
mov edx, ebx
xor edx, 0xa001
test cl, 1
cmove edx, ebx
mov ecx, edx
shr ecx, 1
mov ebx, ecx
xor ebx, 0xa001
test dl, 1
cmove ebx, ecx
mov edx, ebx
shr edx, 1
mov ecx, edx
xor ecx, 0xa001
test bl, 1
cmove ecx, edx
inc eax
jne 0x4364d0
rol cx, 8
mov word [0x8ea930], cx
push 6
push 0x8ea92c
call fcn.00414ea0
add esp, 8
pop ebx
ret
mov dword [0x8e9684], 0
mov byte [0x8e9683], 0
xor ecx, ecx
jmp 0x43648c

Function at 0x4365b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
cmp byte [0x8e96b8], 1
jne 0x43672a
mov eax, dword [0x8e96b4]
test eax, eax
je 0x436640
xor ecx, ecx
mov edi, eax
jmp 0x4365df
test bl, 7
je 0x43664c
inc ecx
cmp ecx, 0x20
je 0x43672a
mov esi, 1
shl esi, cl
bt eax, ecx
jae 0x4365d5
movzx ebx, byte [ecx + 0x8e96c0]
test bl, 0x38
je 0x4365d5
test bl, 7
je 0x43660c
mov bh, bl
dec bh
and bh, 7
mov edx, ebx
and dl, 0xf8
or dl, bh
jmp 0x436629
mov edx, ebx
and dl, 0xc0
mov dh, bl
add dh, 0x38
and dh, 0x38
movzx ebp, dl
or dl, dh
or dl, 5
test dh, dh
movzx edx, dl
cmove edx, ebp
mov byte [ecx + 0x8e96c0], dl
test dl, 0x38
jne 0x4365d0
not esi
and edi, esi
mov dword [0x8e96b4], edi
jmp 0x4365d0
mov byte [0x8e96b8], 0
jmp 0x43672a
inc cl
mov byte [0x8ea92f], cl
mov word [0x8ea92c], 0x480
mov byte [0x8ea92e], 4
mov ecx, 0xffff
mov eax, 0xfffffffc
nop
movzx edx, byte [eax + 0x8ea930]
xor edx, ecx
mov ebx, edx
shr ebx, 1
mov ecx, ebx
xor ecx, 0xa001
test dl, 1
cmove ecx, ebx
mov ebx, ecx
shr ebx, 1
mov edx, ebx
xor edx, 0xa001
test cl, 1
cmove edx, ebx
mov ebx, edx
shr ebx, 1
mov ecx, ebx
xor ecx, 0xa001
test dl, 1
cmove ecx, ebx
mov ebx, ecx
shr ebx, 1
mov edx, ebx
xor edx, 0xa001
test cl, 1
cmove edx, ebx
mov ebx, edx
shr ebx, 1
mov ecx, ebx
xor ecx, 0xa001
test dl, 1
cmove ecx, ebx
mov ebx, ecx
shr ebx, 1
mov edx, ebx
xor edx, 0xa001
test cl, 1
cmove edx, ebx
mov ecx, edx
shr ecx, 1
mov ebx, ecx
xor ebx, 0xa001
test dl, 1
cmove ebx, ecx
mov edx, ebx
shr edx, 1
mov ecx, edx
xor ecx, 0xa001
test bl, 1
cmove ecx, edx
inc eax
jne 0x436670
rol cx, 8
mov word [0x8ea930], cx
push 6
push 0x8ea92c
call fcn.00414ea0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret