joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42faa0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
push 0x118
lea eax, [esp + 0x14]
mov esi, edx
push 0
push eax
mov ebx, ecx
call fcn.004459f0
push dword [ebp + 8]
lea edi, [ebx + 8]
mov edx, esi
lea ecx, [esp + 0x20]
mov dword [ebx + 4], edi
call fcn.0042eb00
add esp, 0x10
mov dword [esp + 0xc], eax
test eax, eax
jne 0x42fca0
mov ecx, dword [esp + 0x10]
mov dword [ebx], ecx
shl ecx, 4
add ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [edi + 0xc], eax
add edi, 0x10
mov esi, dword [ebx]
dec esi
test esi, esi
jle 0x42fc8a
nop dword [eax]
movzx eax, byte [ecx + 3]
dec esi
movzx edx, byte [eax + 0x474730]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x474830]
movzx eax, byte [eax + 0x474730]
xor edx, dword [eax*4 + 0x476558]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x474730]
xor edx, dword [eax*4 + 0x475558]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x474730]
xor edx, dword [eax*4 + 0x475958]
mov dword [edi], edx
mov ebx, dword [ecx + 4]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x474730]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x476558]
movzx eax, byte [eax + 0x474730]
xor edx, dword [eax*4 + 0x475558]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x474730]
xor edx, dword [eax*4 + 0x474830]
movzx eax, bl
movzx eax, byte [eax + 0x474730]
xor edx, dword [eax*4 + 0x475958]
mov dword [edi + 4], edx
mov ebx, dword [ecx + 8]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x474730]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x476558]
movzx eax, byte [eax + 0x474730]
xor edx, dword [eax*4 + 0x475558]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x474730]
xor edx, dword [eax*4 + 0x474830]
movzx eax, bl
movzx eax, byte [eax + 0x474730]
xor edx, dword [eax*4 + 0x475958]
mov dword [edi + 8], edx
mov ebx, dword [ecx + 0xc]
mov eax, ebx
shr eax, 0x10
sub ecx, 0x10
movzx eax, al
movzx edx, byte [eax + 0x474730]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x476558]
movzx eax, byte [eax + 0x474730]
xor edx, dword [eax*4 + 0x475558]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x474730]
xor edx, dword [eax*4 + 0x474830]
movzx eax, bl
movzx eax, byte [eax + 0x474730]
xor edx, dword [eax*4 + 0x475958]
mov dword [edi + 0xc], edx
add edi, 0x10
test esi, esi
jg 0x42fb30
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0xc], eax
push 0x118
lea eax, [esp + 0x14]
push 0
push eax
mov eax, dword [fcn.004459f0]
call eax
mov ecx, dword [esp + 0x138]
add esp, 0xc
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00444a17
mov esp, ebp
pop ebp
ret
Function at 0x4307f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov eax, edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
test cl, 0xf
je 0x43080f
mov eax, 0xffffffde
mov esp, ebp
pop ebp
ret
test ecx, ecx
je 0x43095d
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
test eax, eax
jne 0x4308b1
mov eax, dword [ebp + 0xc]
mov edi, eax
mov ebx, dword [ebp + 0x10]
sub edi, esi
lea edx, [eax + 0xf]
lea eax, [ecx - 1]
mov dword [ebp - 0xc], edx
shr eax, 4
inc eax
mov dword [ebp + 8], eax
nop
movups xmm0, xmmword [ebx]
mov ecx, dword [ebp - 4]
mov edx, ebx
push esi
movups xmmword [ebp - 0x20], xmm0
call fcn.00430260
add esp, 4
cmp esi, dword [ebp - 0xc]
ja 0x430883
lea eax, [esi + 0xf]
cmp eax, dword [ebp + 0xc]
jb 0x430883
mov eax, esi
mov edx, 0x10
nop dword [eax]
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x430870
mov eax, dword [ebp + 0xc]
jmp 0x430892
mov eax, dword [ebp + 0xc]
movups xmm0, xmmword [esi]
movups xmm1, xmmword [eax]
xorps xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm0, xmmword [ebp - 0x20]
add esi, 0x10
add ebx, 0x10
sub edi, 0x10
sub dword [ebp + 8], 1
movups xmmword [eax], xmm0
jne 0x430840
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
lea eax, [ecx - 1]
mov edi, dword [ebp + 0x10]
mov ebx, edx
sub ebx, edi
shr eax, 4
inc eax
mov dword [ebp + 8], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], esi
nop dword [eax + eax]
lea eax, [edi + 0xf]
lea ecx, [esi + 0xf]
cmp esi, eax
ja 0x4308de
cmp ecx, edi
jae 0x4308e9
lea eax, [edx + 0xf]
cmp esi, eax
ja 0x430911
cmp ecx, edx
jb 0x430911
mov ebx, esi
mov ecx, edi
mov esi, dword [ebp + 8]
sub ebx, edi
mov edx, 0x10
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub edx, 1
jne 0x4308f7
mov esi, dword [ebp - 8]
mov ebx, dword [ebp + 8]
jmp 0x43091d
movups xmm1, xmmword [edx]
movups xmm0, xmmword [edi]
xorps xmm1, xmm0
movups xmmword [esi], xmm1
cmp dword [ebp - 0x10], 1
mov edx, esi
mov ecx, dword [ebp - 4]
push esi
jne 0x430930
call fcn.0042fcd0
jmp 0x430935
call fcn.00430260
movups xmm0, xmmword [esi]
mov edx, dword [ebp + 0xc]
sub ebx, 0x10
add esi, 0x10
mov dword [ebp + 8], ebx
add esp, 4
mov dword [ebp - 8], esi
add edi, 0x10
sub dword [ebp - 0xc], 1
movups xmmword [edx], xmm0
jne 0x4308d0
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x433390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, edx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
test edi, edi
jne 0x4333da
lea eax, [edi - 0xd]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00444a17
mov esp, ebp
pop ebp
ret
push edi
lea ebx, [ebp - 0x14]
push ebx
push ecx
push dword [ebp - 0x18]
push ecx
push dword [ebp - 0x1c]
mov ecx, esi
push dword [ebp + 0xc]
push edx
push eax
mov edx, 1
call fcn.00431c00
mov ebx, dword [ebp + 0x20]
add esp, 0x24
test eax, eax
jne 0x4334f4
xor esi, esi
xor dl, dl
test edi, edi
je 0x4334a2
cmp edi, 8
jb 0x4334a2
mov ecx, edi
xorps xmm4, xmm4
and ecx, 0xfffffff8
xorps xmm3, xmm3
xor eax, eax
nop dword [eax + eax]
movd xmm2, dword [eax + ebx]
xorps xmm0, xmm0
movd xmm1, dword [ebp + eax - 0x14]
lea eax, [edx + 4]
punpcklbw xmm2, xmm0
add dl, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movzx eax, al
orps xmm4, xmm2
movd xmm2, dword [ebx + eax]
movd xmm1, dword [ebp + eax - 0x14]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
movzx eax, dl
xorps xmm2, xmm1
orps xmm3, xmm2
cmp eax, ecx
jb 0x433430
orps xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd esi, xmm3
movzx eax, dl
cmp eax, edi
jae 0x4334c6
nop dword [eax]
movzx ecx, byte [eax + ebx]
inc dl
movzx eax, byte [ebp + eax - 0x14]
xor ecx, eax
movzx eax, dl
or esi, ecx
cmp eax, edi
jb 0x4334b0
test esi, esi
je 0x4334f2
push dword [ebp - 0x20]
mov eax, dword [fcn.004459f0]
push 0
push dword [ebp - 0x24]
call eax
add esp, 0xc
mov eax, 0xfffffff1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00444a17
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00444a17
mov esp, ebp
pop ebp
ret
Function at 0x433a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, edx
mov esi, ecx
test edi, edi
jne 0x433a60
mov eax, 0xffffffa9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push 1
call fcn.004335a0
add esp, 4
test eax, eax
jne 0x433b89
test esi, esi
je 0x433a54
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x433a54
cmp dword [esi + 0xe0], 1
je 0x433a95
mov eax, 0xffffffac
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add dword [esi + 0xd0], 0xd
lea ecx, [esi + 0x84]
push 0xd
adc dword [esi + 0xd4], 0
call fcn.00440ed0
add esp, 4
test eax, eax
jne 0x433b89
push dword [ebp + 0x1c]
mov edx, ebx
mov ecx, esi
push dword [ebp + 0x18]
call fcn.00433670
add esp, 8
test eax, eax
jne 0x433b89
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.00433790
test eax, eax
jne 0x433b89
lea eax, [ebp - 0x10]
xorps xmm4, xmm4
lea ecx, [ebp - 0xc]
sub eax, edi
xorps xmm3, xmm3
sub ecx, edi
mov edx, 2
nop dword [eax]
movd xmm2, dword [eax + edi]
xorps xmm0, xmm0
movd xmm1, dword [edi]
lea edi, [edi + 8]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [edi - 4]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [ecx + edi - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
sub edx, 1
jne 0x433b00
orps xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
test eax, eax
je 0x433b87
mov eax, dword [fcn.004459f0]
push ebx
push edx
push dword [ebp + 0x1c]
call eax
add esp, 0xc
mov eax, 0xffffffaa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434180
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x464d7c]
push edi
mov edi, ecx
test esi, esi
je 0x4341bc
mov ebx, dword [ebp + 0xc]
mov ecx, 0x464d7c
nop word [eax + eax]
mov eax, dword [esi + 0x1c]
cmp dword [eax], edx
jne 0x4341b2
cmp dword [esi + 8], ebx
jne 0x4341b2
cmp dword [esi + 4], 1
je 0x4341c6
mov esi, dword [ecx + 8]
add ecx, 8
test esi, esi
jne 0x4341a0
mov eax, 0xffffffec
pop edi
pop esi
pop ebx
pop ebp
ret
test esi, esi
je 0x4341bc
cmp dword [esi + 0x18], 0x10
jne 0x4341bc
test edi, edi
je 0x434275
mov ecx, dword [edi + 0x3c]
test ecx, ecx
je 0x4341ed
mov eax, dword [edi]
push ecx
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x2c]
call eax
add esp, 4
mov eax, dword [fcn.004459f0]
push 0x40
push 0
push edi
call eax
push 0x40
push 0
push edi
call fcn.004459f0
mov eax, dword [esi + 0x1c]
add esp, 0x18
mov eax, dword [eax + 0x28]
call eax
mov dword [edi + 0x3c], eax
test eax, eax
jne 0x43421f
pop edi
pop esi
mov eax, 0xffff9e80
pop ebx
pop ebp
ret
mov dword [edi], esi
cmp dword [esi + 4], 2
jne 0x434235
mov dword [edi + 0xc], 0x41ac60
mov dword [edi + 0x10], 0x41ad30
mov eax, esi
test eax, eax
je 0x434275
test byte [eax + 0x14], 2
jne 0x434246
cmp dword [eax + 8], ebx
jne 0x434275
mov dword [edi + 4], ebx
mov dword [edi + 8], 1
mov eax, dword [eax + 0x1c]
push ebx
push dword [ebp + 8]
push dword [edi + 0x3c]
mov eax, dword [eax + 0x20]
call eax
add esp, 0xc
test eax, eax
jne 0x4341c1
mov ecx, edi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.00433b90
pop edi
pop esi
mov eax, 0xffff9f00
pop ebx
pop ebp
ret
Function at 0x434b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], edx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x140]
mov ecx, dword [esi + 0x144]
mov ebx, dword [esi + 0x148]
shld ecx, eax, 3
shl eax, 3
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x14c]
shld eax, ebx, 3
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
lea eax, [edi - 4]
shl ebx, 3
cmp eax, 0xc
ja 0x434c9d
push edi
lea eax, [esi + 0x150]
push eax
push edx
call fcn.00446970
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov ecx, dword [ebp - 8]
mov eax, edx
or eax, dword [ebp - 0xc]
jne 0x434bb4
mov eax, ebx
or eax, ecx
je 0x434c94
mov eax, ecx
mov byte [ebp - 0x21], cl
shr eax, 0x18
mov byte [ebp - 0x24], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0x23], al
mov eax, ecx
shr eax, 8
mov ecx, ebx
mov byte [ebp - 0x22], al
mov eax, dword [ebp - 8]
shrd ecx, eax, 0x18
mov eax, dword [ebp - 8]
mov byte [ebp - 0x20], cl
mov ecx, ebx
shrd ecx, eax, 0x10
mov eax, ebx
mov byte [ebp - 0x1d], bl
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 0x1f], cl
mov ecx, dword [ebp - 8]
shrd eax, ecx, 8
mov ecx, edx
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x1e], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 0x1c], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x1b], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0x1a], al
mov eax, ebx
shrd ecx, eax, 0x18
mov eax, ebx
mov byte [ebp - 0x15], dl
mov byte [ebp - 0x18], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
lea edx, [ebp - 0x23]
shrd eax, ebx, 8
mov byte [ebp - 0x17], cl
mov ebx, 4
mov byte [ebp - 0x16], al
lea eax, [esi + 0x171]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
sub ebx, 1
jne 0x434c44
lea edx, [esi + 0x170]
mov ecx, esi
push edx
call fcn.00434280
add esp, 4
xor ecx, ecx
test edi, edi
je 0x434c94
mov edx, dword [ebp - 0x14]
mov al, byte [esi + ecx + 0x170]
xor byte [edx + ecx], al
inc ecx
cmp ecx, edi
jb 0x434c85
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffec
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x20]
mov esi, ecx
mov ecx, dword [ebp + 8]
mov ebx, edx
mov edx, dword [ebp + 0x24]
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
xor edx, edx
push ecx
mov ecx, esi
mov dword [ebp - 0x20], ebx
call fcn.00434450
add esp, 0x10
test eax, eax
jne 0x434e1a
push dword [ebp - 0x18]
mov edx, ebx
mov ecx, esi
push edi
call fcn.004349b0
add esp, 8
test eax, eax
jne 0x434e1a
mov edi, dword [ebp + 0x1c]
lea edx, [ebp - 0x14]
push edi
mov ecx, esi
call fcn.00434b40
add esp, 4
test eax, eax
jne 0x434e1a
xor esi, esi
test edi, edi
je 0x434e18
mov ebx, dword [ebp + 0x18]
cmp edi, 8
jb 0x434dd2
mov edx, edi
lea esi, [ebp - 0x14]
sub esi, ebx
lea edi, [ebp - 0x10]
and edx, 0xfffffff8
mov ecx, ebx
sub edi, ebx
xorps xmm4, xmm4
mov dword [ebp - 0x1c], edi
xorps xmm3, xmm3
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp - 0x1c]
nop word [eax + eax]
movd xmm2, dword [ecx + esi]
lea ecx, [ecx + 8]
movd xmm1, dword [ecx - 8]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
add eax, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [ecx - 4]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [ebx + ecx - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp eax, edx
jb 0x434d60
mov ebx, dword [ebp + 0x18]
orps xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd esi, xmm3
cmp eax, edi
jae 0x434dec
lea ecx, [ebp - 0x14]
sub ebx, ecx
lea ecx, [ebp - 0x14]
add ecx, eax
inc eax
movzx edx, byte [ebx + ecx]
movzx ecx, byte [ecx]
xor edx, ecx
or esi, edx
cmp eax, edi
jb 0x434dd7
test esi, esi
je 0x434e18
push dword [ebp - 0x20]
mov eax, dword [fcn.004459f0]
push 0
push dword [ebp - 0x18]
call eax
add esp, 0xc
mov eax, 0xffffffee
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00444a17
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00444a17
mov esp, ebp
pop ebp
ret
Function at 0x436090
Capabilities:
Encrypt data using salsa20 or chacha
Enumerate pe sections

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x4361d1
test edx, edx
je 0x4361d1
mov dword [esi], 0x61707865
mov dword [esi + 4], 0x3320646e
mov dword [esi + 8], 0x79622d32
mov dword [esi + 0xc], 0x6b206574
movzx ecx, byte [edx + 3]
shl ecx, 8
movzx eax, byte [edx + 2]
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x10], ecx
movzx ecx, byte [edx + 7]
shl ecx, 8
movzx eax, byte [edx + 6]
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x14], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x18], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x1c], ecx
movzx ecx, byte [edx + 0x13]
movzx eax, byte [edx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x20], ecx
movzx ecx, byte [edx + 0x17]
movzx eax, byte [edx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x24], ecx
movzx ecx, byte [edx + 0x1b]
movzx eax, byte [edx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x28], ecx
movzx ecx, byte [edx + 0x1f]
movzx eax, byte [edx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1c]
shl ecx, 8
or ecx, eax
xor eax, eax
mov dword [esi + 0x2c], ecx
pop esi
ret
mov eax, 0xffffffaf
pop esi
ret
Function at 0x436290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
xor esi, esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], esi
push edi
test ebx, ebx
je 0x436423
test edx, edx
je 0x4362ff
mov eax, dword [ebp + 8]
test eax, eax
je 0x436423
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x436423
mov edi, eax
mov ecx, esi
sub edi, esi
nop
mov esi, dword [ebx + 0x80]
cmp esi, 0x40
jae 0x4362f9
mov al, byte [edi + ecx]
xor al, byte [esi + ebx + 0x40]
mov esi, dword [ebp - 4]
mov byte [ecx], al
inc esi
inc dword [ebx + 0x80]
inc ecx
mov dword [ebp - 4], esi
sub edx, 1
jne 0x4362d0
jmp 0x4362fc
mov esi, dword [ebp - 4]
mov dword [ebp - 8], edx
mov edi, dword [ebp + 8]
lea eax, [ebx + 0x40]
cmp edx, 0x40
jb 0x4363dd
mov ecx, dword [ebp + 0xc]
lea eax, [ebx + 0x41]
mov dword [ebp - 0x14], eax
mov eax, edi
sub eax, ecx
shr edx, 6
inc ecx
mov dword [ebp - 0x10], eax
add esi, ecx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 4]
add edi, 3
mov eax, edx
add edi, ecx
shl eax, 6
add ecx, eax
mov dword [ebp - 4], ecx
nop dword [eax]
lea edx, [ebx + 0x40]
mov ecx, ebx
call fcn.00435f90
inc dword [ebx + 0x30]
mov edx, 8
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
nop dword [eax + eax]
movzx eax, byte [edi - 3]
lea ecx, [ecx + 8]
xor al, byte [ecx - 9]
mov byte [esi - 1], al
movzx eax, byte [ebx + esi]
xor al, byte [ecx - 8]
mov byte [esi], al
movzx eax, byte [edi - 1]
xor al, byte [ecx - 7]
mov byte [esi + 1], al
movzx eax, byte [ecx - 6]
xor al, byte [edi]
mov byte [esi + 2], al
movzx eax, byte [edi + 1]
xor al, byte [ecx - 5]
mov byte [esi + 3], al
movzx eax, byte [edi + 2]
xor al, byte [ecx - 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 3]
xor al, byte [ecx - 3]
mov byte [esi + 5], al
movzx eax, byte [edi + 4]
add edi, 8
xor al, byte [ecx - 2]
mov byte [esi + 6], al
add esi, 8
sub edx, 1
jne 0x436360
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 0x18]
sub edx, 0x40
sub dword [ebp - 0xc], 1
mov dword [ebp - 8], edx
jne 0x436340
mov edi, dword [ebp - 0x10]
lea eax, [ebx + 0x40]
mov esi, dword [ebp + 0xc]
jmp 0x4363e2
mov esi, dword [ebp + 0xc]
sub edi, esi
test edx, edx
je 0x43641a
mov edx, eax
mov ecx, ebx
call fcn.00435f90
mov eax, dword [ebp - 4]
xor edx, edx
inc dword [ebx + 0x30]
add eax, esi
mov esi, dword [ebp - 8]
mov dword [ebp - 0x18], eax
nop
lea ecx, [eax + edx]
mov al, byte [edi + ecx]
xor al, byte [ebx + edx + 0x40]
inc edx
mov byte [ecx], al
mov eax, dword [ebp - 0x18]
cmp edx, esi
jb 0x436400
mov dword [ebx + 0x80], esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffaf
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, edx
mov dword [ebp - 4], ecx
push edi
mov edi, dword [ebp + 8]
xor dl, dl
xor esi, esi
mov dword [ebp - 8], eax
test edi, edi
je 0x438bf0
push ebx
mov ebx, eax
sub ebx, ecx
cmp edi, 0x20
jb 0x438bd1
mov eax, dword [ebp - 4]
mov ecx, edi
mov edx, dword [ebp - 8]
and ecx, 0xffffffe0
xorps xmm3, xmm3
xorps xmm2, xmm2
add eax, 0x10
nop dword [eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + edx]
add esi, 0x20
xorps xmm1, xmm0
orps xmm3, xmm1
movups xmm1, xmmword [ebx + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
xorps xmm1, xmm0
orps xmm2, xmm1
cmp esi, ecx
jb 0x438b70
orps xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
orps xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
orps xmm2, xmm0
movd edx, xmm2
cmp esi, edi
jae 0x438be6
mov ecx, dword [ebp - 4]
lea eax, [esi + ecx]
sub edi, esi
mov cl, byte [ebx + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub edi, 1
jne 0x438bd6
pop ebx
pop edi
movzx eax, dl
pop esi
mov esp, ebp
pop ebp
ret
pop edi
movzx eax, dl
pop esi
mov esp, ebp
pop ebp
ret