joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4338dc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
xor edx, edx
mov edi, ecx
mov eax, 0x3020100
mov dword [ecx], edx
mov dword [ecx + 4], eax
add ecx, 4
add eax, 0x4040404
jae 0x4338f0
xor ecx, ecx
xor ebx, ebx
mov esi, dword [ebp + 0x18]
mov al, byte [edi + ecx + 4]
add bl, byte [esi + edx]
add bl, al
mov ah, byte [edi + ebx + 4]
mov byte [edi + ebx + 4], al
mov byte [edi + ecx + 4], ah
inc edx
cmp edx, dword [ebp + 0x1c]
sbb eax, eax
and edx, eax
inc cl
jne 0x433904
leave
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x43392c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov ebp, dword [ebp + 0x1c]
movzx ecx, byte [edi]
movzx edx, byte [edi + 2]
xor eax, eax
inc cl
mov al, byte [edi + ecx + 4]
add dl, al
mov bl, al
mov al, byte [edi + edx + 4]
mov byte [edi + edx + 4], bl
mov byte [edi + ecx + 4], al
add al, bl
mov al, byte [edi + eax + 4]
xor byte [esi], al
inc esi
dec ebp
jne 0x433944
mov byte [edi], cl
mov byte [edi + 2], dl
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x4352ba
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
enter 0x404, 0
mov edx, 0x439418
mov ecx, dword [ebp + 0x14]
lea esi, [edx + ecx*8]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
test eax, eax
jne 0x43536e
push eax
mov dword [esi], esi
add eax, dword [edx + ecx*8 - 4]
dec ecx
jne 0x4352dc
mov dword [ebp + 0x14], eax
mov edi, esp
push 0x200
push edi
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
mov ecx, eax
dec eax
cmp eax, 0x1ff
jae 0x43536e
push edi
push ecx
call fcn.004311ce
mov dword [edx], 0x64002e
mov dword [edx + 4], 0x740061
and dword [edx + 8], 0
push 0x36
push edi
call fcn.00430960
jb 0x43536e
xchg edi, eax
push 0
push dword [ebp + 0x14]
push edi
call fcn.0043090f
jb 0x435368
push ebx
call fcn.00430880
jb 0x435368
xchg ebx, eax
push eax
push ebx
push edi
call fcn.004308c9
jb 0x435362
shr eax, 2
mov dword [esi], ebx
xchg ecx, eax
push ebx
mov eax, dword [ebx]
mov edx, eax
and eax, 0x3f3f3f3f
shl eax, 2
xor eax, edx
mov dword [ebx], eax
add ebx, 4
dec ecx
jne 0x435349
pop ebx
jmp 0x43536e
push ebx
call fcn.004308ae
push edi
call fcn.0043098d
mov eax, dword [esi]
cmp eax, esi
jne 0x435376
xor eax, eax
cmp eax, 1
leave
pop edi
pop esi
pop ebx
ret 4

Function at 0x4354c4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
test ecx, ecx
je 0x4354e8
push ebx
xor ebx, ebx
mov al, byte [ebx + 0x4354eb]
inc ebx
xor byte [edx], al
inc edx
cmp ebx, 0xc
sbb eax, eax
and ebx, eax
dec ecx
jne 0x4354d3
pop ebx
ret 8

Function at 0x4354f7
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
enter 0x400, 0
mov eax, dword [ebp + 0x14]
enter 0x9c0, 0
mov esi, eax
call fcn.004361a8
Function at 0x4358ab
Capabilities:
Enumerate pe sections

Disassembly:
movzx ecx, word [edx + 0x14]
add edx, 0x16
cmp ecx, 0x24
jb 0x4358fb
cmp word [edx], 0x24
jne 0x4358fb
push esi
push edi
mov edi, edx
call 0x4358eb
and al, 0x24
and al, 0x20
push esp
push 0x69207369
jae 0x4358f2
popal
and byte [eax + 0x72], dh
outsd dx, dword [esi]
je 0x43593e
arpl word [ebp + 0x64], si
and byte [ecx + 0x72], ah
arpl word [eax + 0x69], bp
jbe 0x43594a
and byte cs:[esp], ah
and al, 0
pop esi
xor eax, eax
lodsb al, byte [esi]
test al, al
je 0x4358f7
add al, 0x66
scasd eax, dword es:[edi]
scasw ax, word es:[edi]
je 0x4358ee
pop edi
pop esi
je 0x435933
dec ecx
js 0x435933
jne 0x43590d
movzx eax, word [edx]
cmp eax, 0x21
je 0x435933
cmp eax, 0x7e
je 0x435933
sub ecx, 5
jb 0x435931
cmp dword [edx], 0x544a8b66
jne 0x43592c
mov eax, dword [edx + 4]
cmp eax, 0x2e002f
jne 0x43592c
rol eax, 0x10
cmp dword [edx + 8], eax
je 0x435933
inc edx
inc edx
dec ecx
jns 0x435912
clc
ret
stc
ret
add byte [eax], al
mov ebx, 0x2000
push ecx
sub esp, eax
push ecx
sub esp, eax
mov esi, esp
push ebx
push esi
push dword [ebp + 0x14]
call fcn.004308c9
xchg ebx, eax
push ebx
push esi
push esp
call fcn.00430d0f
test eax, eax
je 0x43598f
loopne 0x4358d7
hlt
add esi, dword [esi + 0x3c]
movzx edx, word [esi + 0x14]
mov eax, dword [esi + 0x54]
lea edx, [esi + edx + 0x18]
movzx ecx, word [esi + 6]
mov ebx, dword [edx + 0x10]
mov esi, dword [edx + 0x14]
add edx, 0x28
test ebx, ebx
je 0x43598c
add esi, ebx
jb 0x43598c
cmp esi, eax
jb 0x43598c
xchg esi, eax
dec ecx
jne 0x435976
leave
pop edi
pop esi
pop ebx
ret 4

Function at 0x435935
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov eax, 0xffc

Function at 0x435a90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
movzx edx, byte [esp + 0x18]
sub ecx, 4
jb 0x435ab7
mov eax, dword [ebx + edx*4]
xor dword [edi], eax
add edi, 4
inc dl
sub ecx, 4
jae 0x435aa8
add ecx, 4
je 0x435ac7
mov al, byte [ebx + edx]
xor byte [edi], al
inc edi
inc dl
dec ecx
jne 0x435abc
pop edi
pop ebx
ret 0x10

Function at 0x435b9a
Capabilities:
Encode data using xor

Disassembly:
push edi
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 8]
test ecx, ecx
je 0x435bb7
xor edx, edx
mov al, byte [edx + 0x435bbb]
inc dl
xor byte [edi], al
inc edi
dec ecx
jne 0x435ba9
pop edi
ret 8

Function at 0x4360ee
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
mov eax, dword [esp + 0xc]
lea edi, [esp + 0x10]
xor ebx, ebx
stosd dword es:[edi], eax
inc ebx
mov ecx, eax
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, ebx
stosd dword es:[edi], eax
inc ebx
cmp ebx, 0x270
jb 0x4360fc
pop edi
pop ebx
ret 4
Function at 0x43611a
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x1c]
lea ebx, [esp + 0x20]
mov ecx, dword [ebx + ebp*4]
lea edx, [ebp + 1]
cmp edx, 0x270
sbb eax, eax
and edx, eax
mov edi, dword [ebx + edx*4]
xor edi, ecx
and edi, 0x7fffffff
xor edi, ecx
shr edi, 1
sbb ecx, ecx
and ecx, 0x9908b0df
xor edi, ecx
lea ecx, [ebp + 0x18d]
cmp ecx, 0x270
cmc
sbb eax, eax
and eax, 0x270
sub ecx, eax
xor edi, dword [ebx + ecx*4]
mov dword [ebx + ebp*4], edi
mov ebp, edx
mov eax, edi
shr edi, 0xb
xor eax, edi
mov ecx, eax
and eax, 0xff3a58ad
shl eax, 7
xor eax, ecx
mov ecx, eax
and eax, 0xffffdf8c
shl eax, 0xf
xor eax, ecx
mov ecx, eax
shr eax, 0x12
xor eax, ecx
xor byte [esi], al
inc esi
dec dword [esp + 0x18]
jne 0x43612a
xchg ebp, eax
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x4361e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + ebx*4 + 4]
lea edx, [ebx + 1]
cmp edx, 0x270
sbb eax, eax
and edx, eax
mov edi, dword [esp + edx*4 + 4]
xor edi, ecx
and edi, 0x7fffffff
xor edi, ecx
shr edi, 1
sbb ecx, ecx
and ecx, 0x9908b0df
xor edi, ecx
lea ecx, [ebx + 0x18d]
cmp ecx, 0x270
cmc
sbb eax, eax
and eax, 0x270
sub ecx, eax
xor edi, dword [esp + ecx*4 + 4]
mov dword [esp + ebx*4 + 4], edi
mov ebx, edx
mov eax, edi
shr edi, 0xb
xor eax, edi
mov ecx, eax
and eax, 0xff3a58ad
shl eax, 7
xor eax, ecx
mov ecx, eax
and eax, 0xffffdf8c
shl eax, 0xf
xor eax, ecx
mov ecx, eax
shr eax, 0x12
xor eax, ecx
ret

Function at 0x436260
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov edi, eax
imul eax, eax, 0x1c587629
add eax, 0x10dce
imul ecx, eax, 0x10dcd
imul edx, eax, 0x5a49ba61
inc ecx
add edx, 0xdc07a108
shr ecx, 0x10
mov ax, cx
xor eax, edi
and eax, 0x7fffffff
xor edi, eax
shr edi, 1
sbb ecx, ecx
and ecx, 0x9908b0df
xor edi, ecx
imul ecx, edx, 0x10dcd

Function at 0x436320
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, 0x40
jb 0x436352
mov edx, dword [esi + 0x3c]
cmp word [esi], 0x5a4d
jne 0x436352
sub ecx, edx
jb 0x436352
sub ecx, 0x78
jb 0x436352
cmp dword [esi + edx], 0x4550
jne 0x436352
mov eax, dword [esi + edx + 8]
xor esi, esi
neg esi
pop esi
ret 8
Function at 0x4364e6
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x24]
mov edi, dword [ebp + 0x20]
cmp ecx, 3
jb 0x436647
push 0x27f
wait
fninit
fldcw word [ebp - 4]
mov eax, 0x400
cmp eax, ecx
jb 0x43650e
mov eax, ecx
mov dword [ebp + 0x24], eax
mov esi, ecx
movsx ebx, cl
shr ecx, 1
movsx ecx, cl
movsx eax, byte [edi]
movsx edx, byte [edi + 1]
xor eax, ebx
xor edx, ecx
mov ecx, dword [ebp + 0x1c]
push eax
push edx
push 0
movzx edx, word [ecx + 2]
shl edx, 0xe
cmp esi, edx
je 0x436596
imul esi, esi, 0x5d588b65
inc esi
mov dl, byte [ecx]
cmp dl, 1
mov ecx, dword [ebp + 0x18]
mov eax, 0xc27e
jb 0x43655f
add ecx, eax
mov eax, 0x829e
cmp dl, 4
jb 0x43655f
mov eax, 0x8fac
mul esi
movzx eax, byte [ecx + edx + 0x2400]
add eax, esi
push eax
call fcn.0043669b
mov ecx, 0x80
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0x24], ecx
jbe 0x436593
lea eax, [edi + 4]
sub dword [ebp + 0x24], ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
call fcn.004366e9
sub edi, 0xffffff80
mov eax, dword [ebp - 8]
test eax, eax
jns 0x43659c
neg eax
push eax
fild dword [esp]
pop eax
call fcn.004368ff
mov eax, 0x5f5e100
call fcn.00436682
cmp dword [ebp - 8], 0
jns 0x4365b8
neg eax
xor esi, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov edx, ecx
imul eax, eax
imul edx, edx
add eax, edx
push eax
fild dword [esp]
pop eax
je 0x4365fd
fsqrt
fidivr dword [ebp - 8]
fld1
fadd st(1)
fld1
fsub st(2)
fmulp st(1)
fsqrt
fxch st(1)
fpatan
fldpi
fdivp st(1)
test ecx, ecx
jns 0x4365f4
fld1
fadd st(0)
fsubrp st(1)
push 0x43340000
fmul dword [esp]
pop ecx
call fcn.00436a27
mov eax, pe_nt_image_headers32
call fcn.00436682
add eax, dword [ebp - 0x10]
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
lea ecx, [ebx + 2]
jne 0x43664e
and eax, 0x3f
imul esi, esi, 0x5d588b65
xchg edx, eax
inc esi
mov eax, esi
shr eax, 0x18
xor al, byte [edi + ecx]
ror al, 1
xor al, byte [ebx + 0x436b6d]
xor al, byte [edx + 0x436b6d]
mov byte [edi + ecx], al
inc ebx
inc ecx
and ebx, 0x3f
cmp ecx, dword [ebp + 0x24]
jb 0x436619
leave
pop edi
pop esi
pop ebx
ret 0x14
and eax, 0x3f
imul esi, esi, 0x5d588b65
xchg edx, eax
inc esi
mov eax, esi
shr eax, 0x10
mov dl, byte [edx + 0x436b6d]
mov al, byte [edi + ecx]
xor dl, byte [ebx + 0x436b6d]
xor dl, al
rol dl, 1
xor dl, ah
mov byte [edi + ecx], dl
inc ebx
inc ecx
and ebx, 0x3f
cmp ecx, dword [ebp + 0x24]
jb 0x43664e
jmp 0x436647
Function at 0x4366e9
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
enter 0x168, 0
push 0x10
mov esi, dword [ebp + 0x1c]
pop ecx
add esi, 0x28
mov edi, esp
lodsd eax, dword [esi]
bswap eax
stosd dword es:[edi], eax
dec ecx
jne 0x4366fb
mov cl, 0x40
mov eax, dword [edi - 0x40]
xor eax, dword [edi - 0x38]
xor eax, dword [edi - 0x20]
xor eax, dword [edi - 0xc]
rol eax, 1
stosd dword es:[edi], eax
dec ecx
jne 0x436704
mov esi, dword [ebp + 0x14]
lea edi, [ebp - 0x28]
lodsd eax, dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
cmp ecx, 0x10
jae 0x436746
mov eax, edi
xor eax, ebx
xor eax, esi
jmp 0x436797
cmp ecx, 0x20
jae 0x43675e
mov edx, esi
not edx
mov eax, ebx
and edx, edi
and eax, esi
or eax, edx
add eax, 0x5a827999
jmp 0x436797
cmp ecx, 0x30
jae 0x436772
mov eax, ebx
not eax
or eax, esi
xor eax, edi
add eax, 0x6ed9eba1
jmp 0x436797
cmp ecx, 0x40
jae 0x43678a
mov edx, edi
not edx
mov eax, edi
and edx, ebx
and eax, esi
or eax, edx
add eax, 0x8f1bbcdc
jmp 0x436797
mov eax, edi
not eax
or eax, ebx
xor eax, esi
add eax, 0xa953fd4e
mov edx, dword [ebp - 0x14]
add eax, dword [esp + ecx*4]
rol edx, 5
ror esi, 2
add edx, eax
add edx, dword [ebp - 0x10]
mov eax, edi
mov edi, ebx
mov ebx, esi
mov esi, dword [ebp - 0x14]
inc ecx
cmp ecx, 0x50
jb 0x436733
add dword [ebp - 0x28], edx
add dword [ebp - 0x24], esi
add dword [ebp - 0x20], ebx
add dword [ebp - 0x1c], edi
add dword [ebp - 0x18], eax
pop eax
pop ecx
lea esp, [ebp - 0x28]
shr ecx, 8
test al, 0x78
jne 0x4367d8
or al, 0x18
bswap eax
push ecx
push eax
push dword [ebp + 0x18]
call fcn.00436830
xchg ebx, eax
mov eax, dword [ebp - 0x28]
and eax, 0x7fffffff
push eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x14]
mov eax, esp
push ecx
push eax
call sub.KERNEL32.DLL_FileTimeToSystemTime
mov eax, dword [ebp - 0x1c]
imul dword [ebp - 0x20]
shrd eax, edx, 8
mov edx, dword [ebp + 0x14]
cmp byte [edx], 1
jb 0x436811
add ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 0x1c]
xor ecx, ecx
mov eax, dword [ebp + ecx*4 - 0x28]
xor dword [edi + ecx*4], eax
inc ecx
cmp ecx, 0xa
jb 0x43681c
leave
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x436830
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov ebx, dword [ebp + 0x18]
mov al, byte [ebp + 0x1b]
mov ecx, 0x1ff
mov edx, ebx
shr ebx, 0xc
and edx, ecx
and ebx, ecx
test al, 0x10
jne 0x436850
xor ebx, ebx
test al, 8
jne 0x436859
mov edx, pe_nt_image_headers32
mov dword [ebp + 0x18], ebx
push edx
xor edx, edx
lea ecx, [edx + 4]
lea ebx, [edx + 0x30]
mov esi, dword [ebp + 0x14]
test al, 0x40
je 0x436874
add edx, ebx
lea esi, [esi + ebx*4 - 4]
neg ecx
test al, 0x20
je 0x436880
sub edx, ebx
imul ebx, ebx, 0x2f
lea esi, [esi + ebx*4]
shl edx, 3
xor ebx, ebx
push edx
push ecx
push 0x30
push ecx
sub esp, 0x400
xor ecx, ecx
mov eax, ecx
push 8
pop edx
ror eax, 1
jb 0x4368a0
xor eax, 0x6db88320
dec edx
jne 0x436897
mov dword [esp + ecx*4], eax
inc cl
jne 0x436892
push 0x30
pop dword [ebp - 0x14]
movzx edi, byte [esi + 3]
imul edi, dword [ebp - 4]
shr edi, 8
xor ecx, ecx
movzx edx, byte [esi + ecx]
movzx eax, byte [ebp + ecx + 0x1c]
sub eax, edx
imul eax, dword [ebp + 0x18]
shr eax, 8
add eax, edx
movzx eax, al
imul eax, edi
movzx eax, ah
xor al, bl
shr ebx, 8
inc ecx
xor ebx, dword [esp + eax*4]
cmp ecx, 3
jb 0x4368bc
add esi, dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x4368af
add esi, dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x4368aa
xchg ebx, eax
leave
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x436bcc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
xor ecx, ecx
dec eax
jns 0x436c0f
push 0xfea61ebd
push 0xc287e33a
push 0xa834df9
push 0x1c7b49fa
mov al, byte [esp + ecx]
add al, byte [esp + ecx + 8]
mov byte [esp + ecx], al
inc ecx
xor byte [edi], al
inc edi
and ecx, 7
dec ebx
jne 0x436bf3
add esp, 0x10
pop edi
pop ebx
ret 8
mov edx, eax
shl edx, 5
add edx, 0x436c5c
cmp al, 3
jae 0x436c34
shr ebx, 2
je 0x436c0a
mov eax, dword [edx + ecx*4]
inc ecx
xor dword [edi], eax
add edi, 4
and ecx, 7
dec ebx
jne 0x436c23
jmp 0x436c0a
shr ebx, 1
je 0x436c0a
push dword [edx + 4]
push dword [edx]
movzx eax, word [esp + ecx*2]
add ax, word [edx + ecx*2 + 8]
mov word [esp + ecx*2], ax
inc ecx
xor word [edi], ax
inc edi
inc edi
and ecx, 3
dec ebx
jne 0x436c3d
pop ecx
pop ecx
jmp 0x436c0a
Function at 0x436d7c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
xor ecx, ecx
cmp dword [ebp + 0x28], 0
jne 0x436dad
mov eax, dword [ebp + 0x24]
inc ecx
cmp eax, 0x6373
je 0x436dad
inc ecx
cmp eax, 0x67676f
je 0x436dad
cmp eax, 0x666173
je 0x436dad
inc ecx
cmp eax, 0x676e70
jne 0x436e29
mov edx, dword [ebp + 0x2c]
lea ecx, [edx + ecx*8 + 3]
mov dword [ebp + 0x24], ecx
mov edi, dword [ebp + 0x1c]
mov esi, edi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + 0x12]
and al, 0xfc
push 0
sub esp, eax
mov edi, esp
rep movsb byte es:[edi], byte [esi]
mov byte [edi], cl
push esp
call fcn.00431153
mov al, 0x20
stosb byte es:[edi], al
mov eax, dword [ebp + 0x20]
push 8
pop ecx
rol eax, 4
push eax
and al, 0xf
add al, 0xf6
sbb ah, ah
add al, 0x3a
and ah, 7
add al, ah
stosb byte es:[edi], al
dec ecx
pop eax
jne 0x436de4
mov al, 0x20
stosb byte es:[edi], al
mov esi, dword [ebp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, esp
sub edi, esp
mov ebx, dword [ebp + 0x28]
test ebx, ebx
jne 0x436e30
sub esp, 0x104
mov ebx, esp
push edi
push esi
push ebx
call fcn.004338dc
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
call fcn.0043392c
leave
pop edi
pop esi
pop ebx
ret 0x1c
mov edi, pe_nt_image_headers32
sub esp, edi
xor edx, edx
xor ecx, ecx
mov al, byte [esi + ecx]
inc ecx
test al, al
je 0x436e39
xor al, byte [ebx + edx]
mov byte [esp + edx], al
inc dl
jne 0x436e3b
mov esi, esp
sub esp, 0x104
mov ebx, esp
push edi
push esi
push ebx
call fcn.004338dc
shl edi, 8
push edi
call fcn.00430880
jb 0x436e29
xchg esi, eax
push edi
push esi
push ebx
call fcn.0043392c
xor ebx, ebx
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov al, byte [esi + ebx]
xor byte [edi], al
inc edi
inc bx
dec ecx
jne 0x436e7b
push esi
call fcn.004308ae
jmp 0x436e29
Function at 0x437ec3
Capabilities:
Encode data using xor

Disassembly:
pop eax
call 0x437e44
popaw
je 0x437dd1
add byte [ebx + 0x77], dh
popal
outsb dx, byte [esi]
add byte [ebx + 0x65], dh
imul esi, dword [ebp + 0x6e], 0x696b6f00
bound esp, qword [ecx]
jae 0x437de9
imul esp, dword [ebp + 0x6e], 0x6e696c00
imul esi, dword [ebx], 0x78
outsd dx, dword [esi]
jb 0x437d90
popal
jbe 0x437df4
je 0x437df6
jb 0x437d97
imul ebp, dword [edi + 0x6e], 0x6b
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [ebx + 0x64], dh
pop edi
push 0x656d69
jae 0x437e0d
imul edi, dword [ecx + 0x75], 0x61630075
jae 0x437e22
jne 0x437e27
imul esi, dword [edx + 0x65], 0x6d696800
jae 0x437e38
outsd dx, dword [esi]
add byte [edi + ebp*2 + 0x63], ch
popal
je 0x437e30
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [ecx + 0x74], ah
popal
jb 0x437e30
js 0x437e3a
popal
add byte [ebx + 0x6d], dh
imul ebp, dword [ebp], 0x736e6574
push 0x66006e69
jne 0x437e58
jne 0x437e58
add byte [ebx + 0x69], ch
arpl word [ebx + 0x69], bp
outsb dx, byte [esi]
push 0x6573726f
add byte [ecx + 0x71], ah
popal
jno 0x437e6c
jne 0x437e59
popal
add byte [edx + 0x65], dh
insb byte es:[edi], dx
popal
je 0x437e68
outsd dx, dword [esi]
outsb dx, byte [esi]
jae 0x437e03
popal
imul esp, dword [ecx + 0x7a], 0x75
imul ebp, dword [ecx + 0x6e], 0
jae 0x437e76
push 0x6b757369
outsd dx, dword [esi]
imul eax, dword [eax], 0x6f68637a
jae 0x437e8b
imul esi, dword [ebx + 0x75], 0x696f6b
jp 0x437e7a
push 0x6970736f
jb 0x437e7f
imul esi, dword [edx + 0x61], 0x6d69006c
insb byte es:[edi], dx
add byte [ecx + 0x6d], ch
outsd dx, dword [esi]
jae 0x437e99
jns 0x437e93
add byte gs:[ebp + 0x61], ch
push 0x5f6f796f
je 0x437ea4
imul esp, dword [ecx + 0x6c], 0x61736f00
popal
outsb dx, byte [esi]
popal
add byte [ebp + 0x61], ch
push 0x6f796f
add byte [eax - 0x17], dl
aas
xchg edx, eax
invalid
and byte [ebx + 0x7848245d], cl
and eax, 0x2174ff85
mov ebx, dword [ebp + 0x24]
dec eax
js 0x437e84
test edi, edi
je 0x437e84
test ebx, ebx
je 0x437e84
sub eax, 0xe
sbb ecx, ecx
call 0x240c997b
enter 0xffffffffffffc3be, 0x7e
inc ebx
add byte [ebp + 0x4d8b4a14], cl
sbb al, 0xf
and ecx, eax
mov esi, 0x437ec3
lea edx, [edx + ecx*2]
mov ecx, dword [ebp + 0x1c]
movzx edx, word [esi + edx*2]
mov bh, 0x14
push esi
add esi, edx
mov edx, dword [ebp + 0x28]
call esi
leave
pop edi
pop esi
pop ebx
ret 0x18
add al, 0
add al, 0
and al, byte [eax]
aaa
add byte [eax + eax - 0x6f], cl
add dh, dl
add dh, dl
dec esp
add byte [ecx - 0x29ff2a00], dl
salc
add byte [ebx], bl
add dword [ebx], ebx
add dword [ebx], ebp
add dword [ebx], ebp
add dword [ecx + eax + 0x54], edx
add dword [ebx + 1], ebx
pop ebx
add dword [edi + 1], ecx
dec edi
add dword [edx + 1], ecx
dec edx
add esp, ebp
add dword [ecx + eax + 0x5b], edx
add dword [ebx + 1], ebx
dec edi
add dword [edi + 1], ecx
dec edx
add dword [edx + 1], ecx
in al, dx
add eax, ebp
add dword [ebp + 1], eax
inc ebp
add dword [eax + 2], ecx
dec eax
add al, byte [eax]
add dword [eax], eax
add dword [ebp - 0x47fd4afe], esi
sub edx, ebp
add al, byte [eax]
cmp ebx, 0x13
jbe 0x437edd
xor byte [edi + 0x13], 1
cmp ebx, eax
jbe 0x437edd
xor byte [edi + eax], 3
xor byte [edi], 0x36
inc edi
dec ebx
jne 0x437edd
ret
Function at 0x438054
Capabilities:
Encode data using xor

Disassembly:
call fcn.004310bf
jae 0x438099
push 2
call fcn.004352ba
jb 0x438099
push eax
xor esi, esi
mov edx, dword [ebp - 8]
movzx eax, si
mov ecx, esi
shr eax, 3
and ecx, 7
mov edx, dword [edx + eax*4]
mov eax, dword [ebp - 4]
shl ecx, 2
xor eax, edx
shr edx, cl
shl ecx, 1
and ecx, 0x1f
and edx, 0xf
shr eax, cl
xor al, byte [edx + 0x43809b]
inc esi
xor byte [edi], al
inc edi
dec ebx
jne 0x438067
leave
ret

Function at 0x4380ee
Capabilities:
Encode data using xor

Disassembly:
call fcn.004380de
imul eax, ecx
xor byte [edi], al
inc edi
dec esi
jne 0x4380f6
ret

Function at 0x438135
Capabilities:
Encode data using xor

Disassembly:
call fcn.004310bf
jae 0x438176
push 0xffffffffffffffff
call fcn.004311ce
cmp eax, 0x736b
je 0x438162
cmp eax, 0x736a74
je 0x438162
cmp eax, 0x647361
je 0x438162
mov eax, pe_nt_image_headers32
cmp ebx, eax
jb 0x438162
xchg ebx, eax
xor ecx, ecx
mov eax, ecx
and eax, 3
mov al, byte [ebp + eax - 4]
xor al, cl
inc ecx
xor byte [edi], al
inc edi
dec ebx
jne 0x438164
leave
ret

Function at 0x4381c7
Capabilities:
Encode data using xor

Disassembly:
push ecx
push 0
push ecx
call fcn.00438331
pop ecx
test al, al
jne 0x4381d7
mov al, 1
ror eax, 8
push eax
push 0xffffffffffffffff
push ecx
call fcn.00438331
pop ecx
movzx edx, ax
shr eax, 0x10
cmp edx, eax
jne 0x4381ef
inc edx
sub eax, esi
cmp eax, ebx
jae 0x4381f8
xor byte [edi + eax], cl
sub edx, esi
cmp edx, ebx
jae 0x438201
xor byte [edi + edx], ch
rol ecx, 8
xor byte [edi], cl
inc edi
dec ebx
jne 0x438204
ret

Function at 0x4385f1
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, esp
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
sub ebx, 0x20
jb 0x438674
mov edi, 0x43867d
push 9
pop ecx
repe cmpsb byte [esi], byte es:[edi]
jne 0x438674
lodsb al, byte [esi]
mov cl, 6
repe cmpsb byte [esi], byte es:[edi]
jne 0x438674
cmp al, 0x56
je 0x438667
cmp al, 0x58
jne 0x438674
mov ecx, dword [esi + 8]
shl ecx, 3
sub ebx, ecx
jb 0x438674
lea esi, [esi + ecx + 0xc]
lodsd eax, dword [esi]
sub ebx, eax
jb 0x438674
test eax, eax
je 0x438667
xchg ebx, eax
sub esp, 0x400
xor ecx, ecx
mov edi, esp
mov eax, ecx
push 8
pop edx
shr eax, 1
jae 0x43864d
xor eax, 0xedb88320
dec edx
jne 0x438644
stosd dword es:[edi], eax
inc cl
jne 0x43863f
xor ecx, ecx
mov al, byte [esp + ecx]
inc ecx
xor byte [esi], al
inc esi
and ecx, 0x3ff
dec ebx
jne 0x438657
mov esi, dword [ebp + 0x14]
movzx eax, byte [esi + 9]
mov byte [esi + 9], 0x56
jmp 0x438676
xor eax, eax
leave
pop edi
pop esi
pop ebx
ret 8