joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403580
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x403726
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40371f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x403610
add ebp, dword [esp]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 8]
mov edx, 0x15b0
je 0x40371f
xor eax, eax
cmp edx, 8
mov dword [esp + 4], esi
jb 0x40369f
mov eax, edx
and eax, 0x1ff8
mov dword [esp], eax
xor esi, esi
nop
nop
nop
nop
nop
mov eax, edx
mov edx, esi
movzx esi, byte [ebp + esi]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + edx + 3]
mov ebx, esi
and ebx, edi
xor esi, edi
lea esi, [esi + ebx*2]
add ecx, esi
movzx edi, byte [ebp + edx + 4]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + edx + 5]
mov ebx, edi
and ebx, esi
xor edi, esi
lea esi, [edi + ebx*2]
add ecx, esi
movzx ebx, byte [ebp + edx + 6]
add ebx, esi
add ecx, ebx
movzx edi, byte [ebp + edx + 7]
add edi, ebx
add ecx, edi
lea esi, [edx + 8]
add edx, 0xf
cmp edx, eax
mov edx, eax
jb 0x403630
add ebp, esi
mov esi, dword [esp + 4]
mov eax, dword [esp]
mov ebx, edx
sub ebx, eax
mov dword [esp + 8], edx
jbe 0x4035d7
mov esi, eax
not esi
add esi, edx
mov dword [esp + 0xc], esi
mov esi, edx
and esi, 3
mov dword [esp], ebx
mov ebx, ebp
je 0x4036dc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx]
add edi, edx
inc ebx
add ecx, edi
inc eax
dec esi
jne 0x4036d0
cmp dword [esp + 0xc], 3
jb 0x4035d0
mov edx, dword [esp + 8]
sub edx, eax
xor eax, eax
nop
movzx esi, byte [ebx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp edx, eax
jne 0x4036f0
jmp 0x4035d0
shl ecx, 0x10
or ecx, edi
jmp 0x40372b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403740
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40376e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x40380c
not eax
test bl, 1
jne 0x403775
mov edx, ebx
cmp ebx, 1
jne 0x4037a6
jmp 0x40380a
xor eax, eax
jmp 0x40380c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x43da18]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x43da18]
cmp ebx, 1
je 0x40380a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43da18]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43da18]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43da18]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43da18]
add esi, 2
cmp edx, esi
jne 0x4037b0
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x409660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x40978a
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40969d
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4096c1
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x409690
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x409690
lea esi, [ebx + 1]
push esi
call fcn.00408f80
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x409798
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x409708
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x40979a
movzx edx, word [edi]
test dx, dx
je 0x40979a
cmp dx, 0x7f
jbe 0x4096f0
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp ecx, 2
jb 0x409750
cmp esi, 0x7ff
ja 0x409750
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x4096f7
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x4096f7
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x4096f7
push 1
call fcn.00408f80
add esp, 4
mov ebp, eax
jmp 0x40979a
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x4097b7
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x4097b2
test eax, eax
jne 0x4097b0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.004059c0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x417c20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xf0
xor eax, eax
cmp dword [ebp + 0x10], 0
setne al
xor ecx, ecx
mov dword [esp + 0xc], 0
xor edx, edx
jmp dword [eax*4 + 0x442db4]
Function at 0x41b5d0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov dword [esp + 8], 0x43354122
mov dword [esp + 0xc], 0x5fd75d3d
mov dword [esp + 0x10], 0x5b6e5912
mov dword [esp + 0x14], 0x57365526
lea eax, [esp + 0x18]
mov word [esp + 0x18], 0x5156
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov dword [esp + 0x22], 0
mov byte [esp + 0x26], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x1e
ja 0x41b682
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea esi, [ecx + edx]
add esi, 0xaff9074b
add ecx, 0xaff9074b
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 0x28], esi
mov ecx, dword [esp + 0x28]
add cl, 0xf3
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x1f
jb 0x41b640
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x38]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x41b6b0
mov edi, esi
cmp eax, 0xffffffed
jge 0x41b6c9
mov eax, 0xffffffff
jmp 0x41b6cc
add eax, 0x12
push eax
call fcn.00408f80
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x41b701
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41b6f0
mov word [eax], 0
movzx ecx, word [esp + 0x28]
test cx, cx
je 0x41b731
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b720
mov word [eax], 0
push edi
push esi
call fcn.0043b430
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44303c]
Function at 0x41f560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0x8b53954d
mov dword [esp + 0x14], 0x8f18891a
mov dword [esp + 0x18], 0x832b8d4a
mov dword [esp + 0x1c], 0x87278116
mov dword [esp + 0x20], 0x7b28855d
mov dword [esp + 0x24], 0x7fe079ce
mov dword [esp + 0x28], 0x73ee7df5
mov dword [esp + 0x2c], 0x77eb71d6
mov dword [esp + 0x30], 0x6bd275e0
mov dword [esp + 0x34], 0x6ffe69f5
mov dword [esp + 0x38], 0x63c06dca
mov dword [esp + 0x3c], 0x67f661d2
mov dword [esp + 0x40], 0x5bfe65f7
mov dword [esp + 0x44], 0x5fc459c5
mov dword [esp + 0x48], 0x53c95dc5
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0x5152
mov dword [esp + 0x4e], 0
mov dword [esp + 0x51], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x44
ja 0x41f65c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
lea esi, [ecx - 0x57d23493]
add ecx, 0x6d
and ecx, edx
or esi, edx
sub esi, ecx
mov dword [esp + 0x5c], esi
mov ecx, dword [esp + 0x5c]
add cl, 5
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x45
jb 0x41f620
lea ebx, [esp + 0x5c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x449684]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41f6a5
mov eax, 0xffffffff
jmp 0x41f6a8
lea eax, [edi + edi]
push eax
call fcn.00408f80
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x1e
push ebx
push 0
call dword [0x449684]
mov dword [esp + 0x10], 0x338c359a
mov dword [esp + 0x14], 0xf8231b9
mov dword [esp + 0x18], 0xbb70db2
mov dword [esp + 0x1c], 0x7b60984
mov dword [esp + 0x20], 0x38a05b1
mov dword [esp + 0x24], 0x1f0001be
mov word [esp + 0x28], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x19
ja 0x41f760
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, eax
and edx, 0x8a712d9
xor eax, 0x8a712d9
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
mov ecx, eax
xor ecx, 0x10
and eax, 0x10
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1a
jb 0x41f710
push 0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.00419640
add esp, 0x14
mov ebx, eax
jmp dword [0x443b40]
Function at 0x4230f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x128
mov dword [esp], 0
mov eax, 0x20219
mov ecx, 1
jmp dword [ecx*4 + 0x44458c]
Function at 0x42f8e0
Capabilities:
Encode data using xor
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ebx, esp
mov dword [esi + 0x30], eax
mov byte [esi + 3], 0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x42f90f
cmp eax, 0
setne al
jmp 0x42f917
jmp 0x42f919
jmp 0x42f91b
test al, 1
jne 0x42f924
jmp 0x42faa4
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [esi + 0x38], eax
jmp 0x42f943
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x18]
jmp 0x42f95b
jmp 0x42f95d
cmp eax, 0
setne al
test al, 1
jne 0x42f96c
jmp 0x42fa98
mov eax, dword [esi + 0x18]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x42f97d
jmp 0x42f97f
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x24]
sub esp, 4
mov dword [esp], eax
call fcn.004090a0
add esp, 4
mov dword [esi + 0x20], eax
cmp dword [esi + 0x20], 0
setne al
test al, 1
jne 0x42f9a6
jmp 0x42fa87
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x28], eax
jmp 0x42f9b7
jmp 0x42f9b9
jmp 0x42f9bb
call fcn.0040ffb0
mov al, byte [ebx]
mov byte [esi + 0x1c], al
mov byte [esi + 8], 0xf3
mov byte [esi + 9], 0xd5
mov byte [esi + 0xa], 0xd3
mov byte [esi + 0xb], 0xcb
mov byte [esi + 0xc], 0xd8
mov byte [esi + 0xd], 0xcc
mov byte [esi + 0xe], 0xdf
mov byte [esi + 0xf], 0xcd
mov byte [esi + 0x10], 0xda
mov byte [esi + 0x11], 0xef
mov byte [esi + 0x12], 0x34
mov byte [esi + 0x13], 0x3b
mov byte [esi + 0x14], 0x36
mov byte [esi + 0x15], 0xc5
mov word [esi + 0x16], 0
mov dword [esi + 4], 0
mov eax, dword [esi + 4]
cmp eax, 0x10
jae 0x42fa5e
jmp 0x42fa14
mov eax, dword [esi + 4]
mov ecx, dword [esi + 4]
movzx edx, byte [esi + ecx + 8]
mov ecx, eax
add ecx, 0x1fa02677
lea eax, [eax + edx + 0x1fa02677]
and ecx, edx
add ecx, ecx
mov edx, ecx
xor edx, eax
not ecx
and eax, ecx
add eax, eax
sub eax, edx
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x34]
add al, 0xbf
mov ecx, dword [esi + 4]
mov byte [esi + ecx + 8], al
mov eax, dword [esi + 4]
inc eax
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
cmp eax, 0x10
jb 0x42fa14
jmp 0x42fa5e
lea eax, [esi + 8]
sub esp, 0xc
mov ecx, edi
mov dword [esp], eax
mov eax, dword [esi + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x2c]
mov dword [esp + 8], eax
call fcn.00409810
and al, 1
jmp 0x42fa80
mov byte [esi + 3], al
jmp 0x42fa85
jmp 0x42fa87
mov eax, dword [esi + 0x18]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x42fa98
jmp 0x42fa9a
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42faa2
jmp 0x42faa4
mov al, byte [esi + 3]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4340a0
Capabilities:
Encode data using xor
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x14], 0xc3d2e1f0
mov dword [esp + 0x10], 0x10325476
mov dword [esp + 0xc], 0x98badcfe
mov dword [esp + 8], 0xefcdab89
mov dword [esp + 4], 0x67452301
cmp ebp, 0x40
jb 0x43415d
mov edi, ebp
shr edi, 6
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
add esi, 4
cmp esi, 0x40
jne 0x434100
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.00434fe0
add esp, 8
inc ebx
lea eax, [esi + ebp]
cmp ebx, edi
jne 0x4340f0
add ebp, esi
mov eax, ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov ecx, ebp
and ecx, 0x3f
mov dword [esp], ecx
je 0x434254
mov ecx, ebp
and ecx, 1
xor edi, edi
cmp dword [esp], 1
je 0x43423d
mov dword [esp + 0x18], ecx
sub dword [esp], ecx
xor ebx, ebx
xor edi, edi
nop
movzx ebp, byte [eax + edi]
mov ecx, ebx
and cl, 0x10
shl ebp, cl
mov edx, edi
and edx, 0xfffffffc
xor ebp, dword [esp + edx + 0x1c]
mov dword [esp + edx + 0x1c], ebp
movzx esi, byte [eax + edi + 1]
or cl, 8
shl esi, cl
xor esi, ebp
mov dword [esp + edx + 0x1c], esi
add edi, 2
add ebx, 0x10
cmp dword [esp], edi
jne 0x434200
add eax, edi
mov ebp, dword [esp + 0x74]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x434254
movzx eax, byte [eax]
lea ecx, [edi*8]
shl eax, cl
and edi, 0xfffffffc
xor dword [esp + edi + 0x1c], eax
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x1c], eax
mov esi, dword [esp + 0x78]
mov eax, ebp
not eax
test al, 0x38
jne 0x4342a5
lea edi, [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
call fcn.00434fe0
add esp, 8
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x5c]
xor eax, eax
xor ecx, ecx
rep stosw word es:[edi], ax
mov dword [esp + 0x54], ebx
shr ebp, 0x1d
mov dword [esp + 0x58], ebp
lea eax, [esp + 0x1c]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.00434fe0
add esp, 8
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4346d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov ebx, dword [ebp + 8]
push eax
sub esp, 0x18
mov dword [esi + 0x1c], esp
sub esp, 0x28
mov edx, esp
and edx, 0xfffffff8
mov esp, edx
push eax
mov dword [esi + 0x18], esp
push eax
mov dword [esi + 4], esp
sub esp, 0x10
mov dword [esi + 0x10], esp
push eax
mov dword [esi + 0xc], esp
push eax
mov dword [esi + 8], esp
mov dword [edx], 0x63916145
mov dword [edx + 4], 0x67f565fd
mov dword [edx + 8], 0x6b8f69fc
mov dword [edx + 0xc], 0x6faa6d81
mov dword [edx + 0x10], 0x13fb1182
mov dword [edx + 0x14], 0x17f31582
mov dword [edx + 0x18], 0x1b1a193d
lea eax, [edx + 0x1c]
mov dword [esi + 0x14], eax
mov dword [edx + 0x1c], 0
mov dword [edx + 0x20], 0
mov byte [edx + 0x24], 0
mov dword [esi], 0
mov ecx, dword [esi]
cmp ecx, 0x24
ja 0x43479d
nop
nop
nop
mov ecx, dword [esi]
mov edi, dword [esi]
movzx eax, byte [edx + edi]
lea edi, [ecx + eax]
add edi, 0x4be49e30
add ecx, 0x4be49e30
and ecx, eax
add ecx, ecx
mov eax, ecx
xor eax, edi
not ecx
and ecx, edi
add ecx, ecx
sub ecx, eax
mov dword [esi + 0x20], ecx
mov eax, dword [esi + 0x20]
add al, 0xb0
mov ecx, dword [esi]
mov byte [edx + ecx], al
inc dword [esi]
mov eax, dword [esi]
cmp eax, 0x25
jb 0x434760
mov eax, dword [esi + 0x1c]
mov edi, eax
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edi, eax
add edi, 0x1c
xor ecx, ecx
mov edx, dword [esi + 0x14]
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
lea ecx, [esi + 0x20]
push dword [esi + 0x18]
push 8
push ecx
push 0xd
push eax
push 0
call dword [0x449684]
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x4463c0]
mov ecx, 0xd55a590c
xor ecx, dword [0x4463c8]
add eax, ecx
inc eax
jmp eax
add byte [eax], al
add al, dl
add dword [eax], eax
push esp
add byte [eax], al
add byte [edx], cl
xor byte [ecx], dh
xor byte [ebp + 0x31], al
ja 0x452ce5
test eax, 0x631d831
xor ch, byte [0x9b326c32]
xor cl, ah
xor al, byte [ebx]
xor ebp, dword [esi]
xor edx, dword [ebx + esi + 0x7e]
xor ebp, dword [ebx + esi + 0x340b33dd]
inc eax
xor al, 0x6d
xor al, 0x9b
xor al, 0x9e
xor eax, 0x35d935ad
imul esi, dword [esi], 0xffffff98
mov edi, 0x2436f336
aaa
aaa
and byte [eax + esi], bh
cmp al, 0x5d
cmp al, 0x84
lcall 0x403f, 0x2c3eb13e
aas
add al, ah
add dword [eax], eax
mov ah, 0
add byte [eax], al
jl 0x452d32
fidiv word [eax]
xor byte [edi - 0xce38cf], dh
xor dword [ebx], ebp
xor al, byte [ebp + 0x32]
mov esi, 0xe732d532
xor bh, dl
xor ch, byte [ebx + esi]
xor dh, byte [ebx]
dec esi
xor esp, dword [ebp + 0x33]
invalid
xor dh, byte [esi + eax*2]
xor al, 0x64
xor al, 0x72
xor al, 0xa1
xor al, 0xb8
xor al, 0xd8
xor al, 0xf5
xor al, 0xf
xor eax, 0x35323514
cmp byte [0x356a3564], dh
invalid
Function at 0x434e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edx, dword [esp + 0x40]
mov edi, 0xffffffff
mov ecx, 0xfffffffd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edi
add ecx, 3
cmp byte [edx + edi + 1], 0
lea edi, [edi + 1]
jne 0x434e20
shr ecx, 2
movzx eax, byte [edx + edi - 1]
cmp eax, 0x3d
je 0x434e41
cmp eax, 0x2e
jne 0x434e42
dec ecx
movzx eax, byte [edx + edi - 2]
cmp eax, 0x3d
je 0x434e51
cmp eax, 0x2e
jne 0x434e52
dec ecx
mov dword [esp + 4], ecx
mov edx, 0
test edi, edi
je 0x434f49
xor eax, eax
xor ebp, ebp
jmp 0x434e86
mov eax, ebp
and eax, 4
xor ebp, 4
lea ebp, [ebp + eax*2]
mov eax, edx
cmp ebp, edi
jae 0x434f49
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov esi, edi
mov edi, eax
movzx eax, byte [eax + ebp]
push eax
call fcn.00419510
add esp, 4
mov ebx, eax
movzx eax, byte [edi + ebp + 1]
mov edi, esi
mov esi, dword [esp + 8]
push eax
call fcn.00419510
add esp, 4
mov bh, al
shl bl, 2
shr al, 4
and al, 3
or al, bl
lea edx, [esi + 1]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi], al
lea eax, [ebp + 2]
cmp eax, edi
jae 0x434e70
mov ecx, dword [esp + 0x40]
movzx eax, byte [ecx + eax]
push eax
mov dword [esp + 4], edx
call fcn.00419510
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x434e70
mov bl, al
shl bh, 4
shr al, 2
and al, 0xf
or al, bh
lea edx, [esi + 2]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi + 1], al
lea eax, [ebp + 3]
cmp eax, edi
jae 0x434e70
mov ecx, dword [esp + 0x40]
movzx eax, byte [ecx + eax]
push eax
mov dword [esp + 4], edx
call fcn.00419510
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x434e70
shl bl, 6
add al, bl
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi + 2], al
add esi, 3
mov edx, esi
jmp 0x434e70
mov ebx, dword [esp + 4]
cmp edx, ebx
mov eax, 0
jne 0x434fd5
mov esi, dword [esp + 0x44]
lea edx, [esi + 0x20]
lea edi, [esp + 0xc]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x2c]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov eax, ebx
add eax, 0xffffffe0
je 0x434fd1
cmp ebx, 0x21
je 0x434fbb
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
nop
nop
mov edx, ebp
and edx, 0x1e
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], dl
lea edx, [ebp + 1]
and edx, 0x1f
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + ebp + 0x21]
mov byte [esi + ebp + 1], dl
add ebp, 2
cmp ecx, ebp
jne 0x434f90
test bl, 1
je 0x434fd1
mov ecx, ebp
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0xc]
xor cl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], cl
mov byte [esi + eax], 0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret