joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1270
call fcn.00408710
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x413940
sar esi, 1
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44a878]
mov ebx, dword [esp + 0x30]
mov edi, 0xffffffff
test ebx, ebx
jns 0x413974
mov eax, 0xffffffff
jmp 0x413977
lea eax, [ebx + ebx]
push eax
call fcn.00408740
add esp, 4
lea ecx, [esp + 0x30]
push ecx
push ebx
mov dword [esp + 0x2c], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44a878]
mov eax, dword [esp + 0x30]
mov ecx, eax
add ecx, 0xd
js 0x4139ac
lea edi, [eax*2 + 0x1a]
push edi
call fcn.00408740
add esp, 4
mov esi, eax
mov dword [esp + 0x26c], 0x398e3b98
mov dword [esp + 0x270], 0x25bb2797
mov dword [esp + 0x274], 0x21c223b8
mov dword [esp + 0x278], 0x2d852f9a
mov dword [esp + 0x27c], 0x29b72bb2
mov dword [esp + 0x280], 0x158717bf
mov dword [esp + 0x284], 0x11121386
mov dword [esp + 0x288], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x26c]
lea ecx, [eax + 0x3682c24b]
mov edi, 0x7d3db4
sub edi, eax
and edi, 0x7d34ad
and ecx, 0x26024012
or ecx, edi
xor ecx, edx
mov edx, ecx
not edx
mov edi, 1
sub edi, ecx
and edx, 1
and edi, 1
xor ecx, 0xd0fdb6ed
sub ecx, edi
add ecx, 0x2f723489
mov edi, ecx
and edi, edx
xor ecx, edx
lea ecx, [ecx + edi*2]
mov byte [esp + eax + 0x26c], cl
add eax, 0x2bd46aad
mov ecx, eax
and ecx, 0x54
or eax, 0xd42b9554
add eax, ecx
cmp eax, 0x20
jb 0x413a20
mov eax, dword [esp + 0x24]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x413ac1
mov eax, dword [esp + 0x24]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413ab0
mov word [eax], 0
movzx ecx, word [esp + 0x26c]
test cx, cx
je 0x413af1
lea edx, [esp + 0x26e]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413ae0
mov word [eax], 0
lea eax, [esp + 0x150]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043cd70
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x443adc]
Function at 0x41f8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0x17d719c5
mov dword [esp + 8], 0x13821584
mov dword [esp + 0xc], 0xfef11ec
mov dword [esp + 0x10], 0xbeb0d80
mov dword [esp + 0x14], 0x7e209d5
mov dword [esp + 0x18], 0x39a05e8
mov dword [esp + 0x1c], 0x3fac018d
mov dword [esp + 0x20], 0x3ba73da0
mov dword [esp + 0x24], 0x37a839b6
mov dword [esp + 0x28], 0x33bc35ad
mov dword [esp + 0x2c], 0x2fca31ac
mov dword [esp + 0x30], 0x2ba42ddc
mov dword [esp + 0x34], 0x27bc29bb
mov dword [esp + 0x38], 0x23b625bd
mov dword [esp + 0x3c], 0xdf5121bd
lea ebp, [esp + 0x40]
mov word [esp + 0x40], 0xdddc
mov dword [esp + 0x42], 0
mov ecx, 0x4fed8446
mov esi, 0x30127bb9
nop
movzx ebx, byte [esp + ecx - 0x4fed8442]
mov eax, esi
or eax, ebx
lea edx, [esi - 0x30127b00]
and edx, ebx
xor edx, eax
and edx, ecx
mov eax, edx
not eax
mov edi, edx
and edi, 0xfd
and eax, 2
imul eax, edi
sub bl, al
mov eax, edx
shr al, 1
and al, 1
or dl, 2
mul dl
add al, al
sub bl, al
movzx eax, bl
add eax, ecx
add al, 0xa2
mov byte [esp + ecx - 0x4fed8442], al
inc ecx
dec esi
cmp ecx, 0x4fed8488
jne 0x41f950
lea ebx, [esp + 0x4a]
lea eax, [esp + 4]
mov edi, ebx
mov ecx, 0xf
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
mov edi, esp
push edi
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x44a878]
mov ebp, dword [esp]
test ebp, ebp
jns 0x41f9e9
mov eax, 0xffffffff
jmp 0x41f9f0
lea eax, [ebp*2]
push eax
call fcn.00408740
add esp, 4
mov esi, eax
push edi
push ebp
push eax
push 0x1e
push ebx
push 0
call dword [0x44a878]
mov dword [esp + 4], 0xf36af11c
mov dword [esp + 8], 0xef78ed61
mov dword [esp + 0xc], 0xeb77e974
mov dword [esp + 0x10], 0xe704e576
mov dword [esp + 0x14], 0xe370e179
mov dword [esp + 0x18], 0x9f9e9d00
mov word [esp + 0x1c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 4]
mov edi, eax
and edi, 0x14
xor edi, 0xa0c284d4
mov ecx, eax
and ecx, 0xb
sub ecx, edi
mov edi, ecx
and edi, edx
add ecx, edx
add edi, edi
sub ecx, edi
mov edx, ecx
and edx, 0x21
mov edi, ecx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, edx
or edx, 2
imul edx, edi
xor ecx, 0x23
add ecx, ebx
add ecx, edx
inc cl
mov byte [esp + eax + 4], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x1a
jb 0x41fa50
push 0
push 0
lea eax, [esp + 0xc]
push eax
push esi
push dword [esp + 0xac]
call fcn.0041b0e0
add esp, 0x14
jmp dword [0x444838]
Function at 0x41fae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x21e8
call fcn.00408710
push eax
sub esp, 0x10
mov ebx, esp
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], eax
sub esp, 0x28
mov edi, esp
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1df4], 0xf74809ac
mov dword [ebp - 0x1df0], 0xf339f539
mov dword [ebp - 0x1dec], 0xff41f139
mov dword [ebp - 0x1de8], 0xfb44fd40
mov dword [ebp - 0x1de4], 0xe742f941
mov dword [ebp - 0x1de0], 0xe35de559
mov dword [ebp - 0x1ddc], 0xef50e12d
mov word [ebp - 0x1dd8], 0xedec
mov dword [ebp - 0x1dd6], 0
mov byte [ebp - 0x1dd2], 0
xor eax, eax
nop
nop
movzx ecx, byte [ebp + eax - 0x1df4]
mov esi, eax
and esi, 2
xor esi, 0xb417f502
mov edx, eax
and edx, 0x3d
sub edx, esi
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add dl, cl
add dl, 0xa
mov byte [ebp + eax - 0x1df4], dl
inc eax
cmp eax, 0x23
jne 0x41fb70
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x1df4]
push 0
push 0
push 0x20019
push eax
mov dword [ebp - 0x18], ecx
push ecx
call fcn.0043d5c0
add esp, 0x14
mov ecx, dword [0x444848]
nop
nop
nop
nop
nop
nop
nop
jmp ecx
Function at 0x422d3c
Capabilities:
Copy file

Disassembly:
push esi
call fcn.00408750
add esp, 4
xor eax, eax
cmp word [ebx], 0x2a
sete al
jmp dword [eax*4 + 0x4450c4]

Function at 0x422d55
Capabilities:
Copy file
Encode data using xor

Disassembly:
xor eax, eax
cmp word [ebx], 0x2a
sete al
jmp dword [eax*4 + 0x4450c4]

Function at 0x423213
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
not eax
shr eax, 0x1f
xor ebp, ebp
xor esi, esi
jmp dword [eax*4 + 0x4450ec]

Function at 0x42332c
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 0x14]
call fcn.00408750
add esp, 4

Function at 0x4233c8
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
cmp esi, ebp
sete al
jmp dword [eax*4 + 0x445124]

Function at 0x423c81
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [esp + 0x18], 0x77447e53
mov dword [esp + 0x1c], 0x42744473
mov dword [esp + 0x20], 0x477b6f87
mov dword [esp + 0x24], 0x6c81784a
mov dword [esp + 0x28], 0x4e737444
mov dword [esp + 0x2c], 0x4949968b
mov dword [esp + 0x30], 0x5f696c56
mov dword [esp + 0x34], 0x576d6c8f
mov dword [esp + 0x38], 0xc165
mov byte [esp + 0x3c], 0
mov eax, 0x1f7b8e58
mov ecx, 0x8471a7
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x1f7b8e40]
mov esi, ecx
and esi, 0x84110d
mov edi, eax
and edi, 0x1e2a0cf2
or edi, esi
xor edi, edx
xor edi, 0x61d5930d
add edi, 0x82963847
mov edx, edi
and edx, 1
xor edi, 1
lea edx, [edi + edx*2]
mov byte [esp + eax - 0x1f7b8e40], dl
inc eax
dec ecx
cmp eax, 0x1f7b8e7d
jne 0x423ce0
mov ecx, dword [esp + 0x6c]
lea eax, [esp + 0x18]
push eax
call fcn.00425930
jmp dword [0x445168]

Function at 0x423da4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov dword [esp + 0x6c], ebx
movzx eax, al
mov dword [esp + 8], 0
mov ecx, dword [esp + 4]
mov dword [esp], ecx
jmp dword [eax*4 + 0x445154]
Function at 0x424e40
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xb8
mov dword [esp + 0x18], 0xc303c125
mov dword [esp + 0x1c], 0xc756c554
mov dword [esp + 0x20], 0xcb6bc90c
mov dword [esp + 0x24], 0xcf6fcd58
mov dword [esp + 0x28], 0xb30eb155
mov dword [esp + 0x2c], 0xb719b57a
mov dword [esp + 0x30], 0xbb1fb92c
mov dword [esp + 0x34], 0xbf1fbd2c
mov dword [esp + 0x38], 0xa349a104
mov dword [esp + 0x3c], 0xa71aa54f
mov dword [esp + 0x40], 0xab0fa93b
mov dword [esp + 0x44], 0xaf3dad3f
mov dword [esp + 0x48], 0x933d9139
mov dword [esp + 0x4c], 0x9778953a
mov dword [esp + 0x50], 0x9b379900
mov dword [esp + 0x54], 0x9f9e9d30
xor eax, eax
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x18]
mov ecx, 0x4a33374f
sub ecx, eax
or ecx, edx
mov esi, 0x4f
sub esi, eax
and esi, edx
not ecx
or ecx, esi
mov edx, ecx
xor edx, 0x71
and ecx, 0xe
add ecx, ecx
sub ecx, edx
inc cl
mov byte [esp + eax + 0x18], cl
mov ecx, eax
or ecx, 1
add ecx, eax
not eax
or eax, 1
add eax, ecx
inc eax
cmp eax, 0x40
jb 0x424ed0
lea ebx, [esp + 0x78]
lea eax, [esp + 0x18]
mov edi, ebx
mov ecx, 0x10
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xb8]
lea eax, [esp + 0x58]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x74]
push esi
push 0
push 0
push 0x1f
push ebx
push 0
call dword [0x44a878]
mov edi, dword [esp + 0x74]
test edi, edi
jns 0x424f59
mov eax, 0xffffffff
jmp 0x424f5c
lea eax, [edi + edi]
push eax
call fcn.00408740
add esp, 4
mov ebp, eax
push esi
push edi
push eax
push 0x1f
push ebx
push 0
call dword [0x44a878]
lea eax, [esp + 0x14]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.0043cd70
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44533c]
Function at 0x42e310
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x44]
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x42e4c4
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov esi, eax
jmp 0x42e366
cmp esi, 0
setne al
jmp 0x42e36e
xor ebx, ebx
test al, 1
jne 0x42e379
jmp 0x42e4be
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov ebp, eax
mov dword [esp], ebp
call fcn.00429a90
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x42e3a1
jmp 0x42e4b2
mov dword [esp + 0x2c], eax
mov ebx, eax
add ebx, 1
mov dword [esp], ebx
call fcn.00408740
mov dword [esp + 0x28], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.004211f0
mov al, byte [esp + 0xc]
mov byte [esp + 0x10], al
mov byte [esp + 0x14], 0x5f
mov byte [esp + 0x15], 0x75
mov byte [esp + 0x16], 0x77
mov byte [esp + 0x17], 0x6f
mov byte [esp + 0x18], 0x7a
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x43
mov byte [esp + 0x1b], 0x55
mov byte [esp + 0x1c], 0x44
mov byte [esp + 0x1d], 0x93
mov byte [esp + 0x1e], 0x52
mov byte [esp + 0x1f], 0x5f
mov byte [esp + 0x20], 0x50
mov byte [esp + 0x21], 0xa5
mov eax, 0xe
mov byte [esp + eax + 0x14], 0
add eax, 1
cmp eax, 0x11
jne 0x42e419
xor eax, eax
cmp eax, 0x11
jae 0x42e47e
movzx edi, byte [esp + eax + 0x14]
mov ecx, eax
add ecx, 0x6e5262da
mov ebp, edi
add ebp, 1
mov edx, edi
xor edx, 0xffffffff
mov ebx, ecx
or ebx, edx
add ebx, ebp
mov edx, ebx
and edx, 0xfd
mov ebp, ebx
and ebp, 2
xor ebp, 2
imul ebp, edx
mov edx, ebx
and edx, 2
or ebx, 2
imul ebx, edx
add ebx, ebp
add ecx, edi
mov edi, dword [esp + 0x44]
sub ecx, ebx
add cl, 0xbe
mov byte [esp + eax + 0x14], cl
add eax, 1
jmp 0x42e428
lea eax, [esp + 0x14]
mov ecx, edi
mov dword [esp], eax
mov edi, dword [esp + 0x28]
mov dword [esp + 4], edi
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.004094c0
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x42e4a6
mov dword [esp], edi
call fcn.00408750
jmp 0x42e4b0
jmp 0x42e4b2
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4346c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x44]
call fcn.0043cd70
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446a64]

Function at 0x434970
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.0043d5c0
add esp, 0x14
test eax, eax
js 0x434ae6
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.0043dab0
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x434a0a
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x4349d8
mov eax, 0xffffffff
jmp 0x4349df
lea eax, [eax*2 + 2]
push eax
call fcn.00408740
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.0043e1c0
add esp, 0x14
test eax, eax
jns 0x434a0a
push esi
call fcn.00408750
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x80b0a0d
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, edi
xor edx, 0x3fedfc
mov ecx, edi
or ecx, 3
and ecx, edx
mov ebx, edi
and ebx, 2
mov edx, ecx
or ecx, 2
imul ecx, ebx
xor ebx, 2
and edx, 5
imul edx, ebx
lea ebp, [edi + edi]
and ebp, 6
mov ebx, edi
sub ebx, ebp
add ebx, edx
add ebx, ecx
add bl, 3
xor bl, byte [esp + edi + 4]
add bl, 0xf1
mov byte [esp + edi + 4], bl
mov ecx, 1
sub ecx, edi
add edi, 2
and ecx, 1
and edi, 0xe
sub edi, ecx
cmp edi, 7
jb 0x434a30
mov ecx, dword [0x44a87c]
test ecx, ecx
je 0x434aca
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44a880]
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x434ab0
inc edi
cmp ecx, edi
jne 0x434aa0
jmp 0x434aca
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x434aca
push eax
push 4
push ecx
push dword [0x44a884]
call fcn.004395d0
add esp, 0x10
test esi, esi
jne 0x434ae8
lea eax, [esp + 4]
push eax
call fcn.0043cb50
add esp, 4
test al, al
je 0x434ae6
cmp dword [esp + 4], 1
je 0x434ae8
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
mov dword [esp], 0x9f9e99a8
mov dword [esp + 4], 0
mov ecx, 0xeb6545da
mov edx, 0x149aba25
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x149aba26]
mov esi, edx
or esi, ebx
mov ebp, edx
and ebp, 0x14083829
mov edi, ecx
and edi, 0xe0604156
or edi, ebp
xor edi, ebx
xor edi, 0xa9
and edi, esi
lea ebx, [esi + esi]
not ebx
add ebx, esi
xor ebx, edi
add bl, 0xbe
mov byte [esp + ecx + 0x149aba26], bl
inc ecx
dec edx
cmp ecx, 0xeb6545e2
jne 0x4366c0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x4528a0]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x436720
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x446e90]
Function at 0x4367a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, ecx
mov dword [esp + 8], 0
mov dword [esp], 0x14151a1b
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x86
xor cl, byte [esp + eax]
add cl, 0x62
mov byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x4367d0
mov edi, dword [esp]
mov eax, dword [0x44a87c]
test eax, eax
je 0x436836
xor ecx, ecx
mov edx, dword [0x44a880]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x436810
inc ecx
cmp eax, ecx
jne 0x436800
jmp 0x436836
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x436836
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x44a884]
call fcn.004395d0
add esp, 0x1c
mov edi, eax
mov dword [esp], 0x296a6b60
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xbeb0617
mov ecx, 0x7414f9e8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0xbeb0617]
mov edx, ebx
xor edx, eax
or edx, ecx
add dl, dl
add dl, bl
movzx edx, dl
add edx, eax
add dl, 0x8f
mov byte [esp + eax - 0xbeb0617], dl
inc eax
dec ecx
cmp eax, 0xbeb061e
jne 0x436860
cmp edi, dword [esp]
jne 0x436996
push dword [esp + 8]
call fcn.00436690
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp], 0x14151a1b
mov dword [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x86
xor bl, byte [esp + edx]
add bl, 0x62
mov byte [esp + edx], bl
inc edx
cmp edx, 8
jne 0x4368c0
mov edi, dword [esp]
mov edx, dword [0x44a87c]
test edx, edx
je 0x436929
mov ebx, ebp
xor ebp, ebp
mov esi, dword [0x44a880]
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x436902
inc ebp
cmp edx, ebp
jne 0x4368f0
mov ebp, ebx
jmp 0x436929
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
mov ebp, ebx
je 0x436929
push 0
push ecx
push eax
push 5
push 0x10
push edx
push dword [0x44a884]
mov esi, eax
call fcn.004395d0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43698d
mov ebx, ebp
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
mov ebp, dword [esp + 0x20]
movzx ebp, word [ebp + edi]
test si, si
je 0x43696a
add edi, 2
cmp si, bp
je 0x436950
cmp si, bp
je 0x43697c
mov esi, dword [ecx]
test esi, esi
jne 0x436940
mov edi, 0xc0000225
jmp 0x43698d
mov edx, dword [ecx + 0x44]
mov dword [ebx + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [ebx + 0xc], ecx
xor edi, edi
push eax
call fcn.00436720
add esp, 4
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4369d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x436a80
xor eax, eax
cmp dword [ecx], 0
jne 0x436aaa
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x14151a1b
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
mov ebx, eax
add bl, 0x86
xor bl, byte [esp + eax]
add bl, 0x62
mov byte [esp + eax], bl
inc eax
cmp eax, 8
jne 0x436a40
mov eax, dword [esp]
mov esi, dword [0x44a87c]
test esi, esi
je 0x436aaa
xor edi, edi
mov ebx, dword [0x44a880]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x436ab3
inc edi
cmp esi, edi
jne 0x436a70
jmp 0x436aaa
mov dword [esp + 8], 0xf9babbbc
mov byte [esp + 0xc], 0
xor eax, eax
nop
mov ecx, eax
add cl, 0xdf
xor cl, byte [esp + eax + 8]
add cl, 0xa5
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 5
jne 0x436a90
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x436aaa
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44a884]
call fcn.004395d0
add esp, 0x1c
jmp 0x436aaa

Function at 0x436ae0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x436b7a
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x14151a1b
mov dword [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x86
xor bl, byte [esp + edx]
add bl, 0x62
mov byte [esp + edx], bl
inc edx
cmp edx, 8
jne 0x436b10
mov edx, dword [0x44a87c]
test edx, edx
je 0x436b6e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44a880]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x436b50
inc edi
cmp edx, edi
jne 0x436b40
jmp 0x436b6e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x436b6e
push eax
push 4
push edx
push dword [0x44a884]
mov esi, ecx
call fcn.004395d0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x437160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x437179
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43718a
cmp eax, 2
je 0x437200
jmp 0x43722a
push 0xbbf966b4
push dword [0x44a870]
call fcn.0043c370
add esp, 8
test eax, eax
je 0x4371cb
mov ecx, dword [esi]
test ecx, ecx
je 0x4371f8
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x4371d4
cmp dword [esp + 4], 0
je 0x4371d4
mov dword [esi + 4], 3
jmp 0x4371f8
mov dword [esi + 4], 1
jmp 0x43722a
lea eax, [esp + 0xc]
push eax
call fcn.0043cb50
add esp, 4
test al, al
je 0x4371f8
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x4371f5
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43722a
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x452898]
call fcn.0043c370
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x4372a4
mov ecx, dword [esi]
mov dword [esp + 4], 0x14151a1b
mov dword [esp + 8], 0
xor eax, eax
nop
nop
mov edx, eax
add dl, 0x86
xor dl, byte [esp + eax + 4]
add dl, 0x62
mov byte [esp + eax + 4], dl
inc eax
cmp eax, 8
jne 0x437240
mov eax, dword [esp + 4]
mov edx, dword [0x44a87c]
test edx, edx
je 0x4372a4
xor esi, esi
mov ebx, dword [0x44a880]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x437280
inc esi
cmp edx, esi
jne 0x437270
jmp 0x4372a4
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x4372a4
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 0x14
push edx
push dword [0x44a884]
call fcn.004395d0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18