joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bcc40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0xc]
cmp eax, dword [ecx + 8]
jbe 0x4bce0a
sub esp, 0x8c
xor ebx, ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov ecx, dword [esp + 0x94]
mov dword [esp], 0x5c3dc0
mov eax, ecx
cdq
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, ecx
cdq
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
call fcn.0043c2d0
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x3c], ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov edx, dword [esp + 0x90]
mov ecx, dword [esp + 0x94]
mov ebx, dword [esp + 0x98]
mov dword [esp + 0x4c], ebx
xor eax, eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x44], edx
mov ecx, edx
mov ebp, dword [esp + 0x24]
cmp eax, ebp
jge 0x4bcdc3
mov ebx, ecx
mov dword [esp + 0x2c], ecx
cmp ecx, 0
je 0x4bce03
mov esi, dword [ecx]
mov ebp, dword [ecx + 4]
mov dword [esp + 0x68], ebp
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov edi, dword [ebx + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x64], esi
mov ebp, dword [esp + 0x68]
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], edi
mov dword [esp + 0x50], esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x54], ebp
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x58], edx
mov dword [esp + 0x80], edx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x60], edi
mov dword [esp + 0x88], edi
mov dword [esp], 0x5d1080
lea ebx, [esp + 0x78]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
call fcn.0040baf0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x3c]
cmp ebx, ebp
jae 0x4bcdfc
mov ebp, dword [esp + 0x38]
shl ebx, 3
add ebp, ebx
mov dword [esp + 0x30], edx
mov dword [ebp], edx
mov dword [esp + 0x34], ecx
cmp byte [0x6d9e38], 0
jne 0x4bcdeb
mov dword [ebp + 4], ecx
mov ecx, dword [esp + 0x2c]
add ecx, 0x14
mov eax, dword [esp + 0x28]
inc eax
mov ebp, dword [esp + 0x24]
cmp eax, ebp
jl 0x4bcced
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x9c], ebx
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0xa0], ebx
mov ebx, dword [esp + 0x40]
mov dword [esp + 0xa4], ebx
add esp, 0x8c
ret
lea esi, [ebp + 4]
mov dword [esp], esi
mov dword [esp + 4], ecx
call fcn.0040f3d0
jmp 0x4bcdab
call fcn.00428880
ud2
mov dword [ecx], eax
jmp 0x4bccfc
call fcn.00450fb0
jmp fcn.004bcc40
Function at 0x4c3040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c325b
sub esp, 0x70
xor ebx, ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp], ebx
call fcn.004b3ed0
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [esp + 0x64], edx
mov dword [esp + 0x60], ecx
cmp ecx, 0
je 0x4c30a2
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], edx
nop
call fcn.00429a30
add esp, 0x70
ret
mov ebx, dword [esp + 0x74]
mov dword [esp + 8], ebx
mov dword [esp], 4
mov eax, 0x619938
mov dword [esp + 4], eax
call fcn.00428b60
cmp eax, 0
jne 0x4c3251
mov ebx, dword [esp + 0x78]
mov edx, dword [esp + 0x7c]
add ebx, 0xf423f
adc edx, 0
mov dword [esp + 0x78], ebx
mov dword [esp], ebx
mov dword [esp + 0x7c], edx
mov dword [esp + 4], edx
mov dword [esp + 8], 0xf4240
mov dword [esp + 0xc], 0
call fcn.0044b5b0
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, ecx
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov ecx, 1
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x2c], 0
mov eax, 0xc
mov ebx, dword [esp + 0x74]
mov ebp, dword [ebx + 0x10]
mov dword [esp], ebp
mov dword [esp + 4], 0x98000004
lea ebx, [esp + 0x30]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
lea ebx, [esp + 0x2c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.00459ea0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov ebx, 0x5f6c35
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 8
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], edx
mov dword [esp + 0x54], edx
xor ebx, ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x50], ecx
cmp ecx, 0
jne 0x4c31da
xor ecx, ecx
mov edx, ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x80], edx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x84], ecx
nop
call fcn.00429a30
add esp, 0x70
ret
mov dword [esp], 0x5d1980
call fcn.0040ea00
mov ecx, dword [esp + 4]
mov dword [esp + 0x3c], ecx
mov ebp, dword [esp + 0x4c]
mov dword [ecx + 4], ebp
mov ebp, dword [esp + 0x48]
cmp byte [0x6d9e38], 0
jne 0x4c323f
mov dword [ecx], ebp
mov ebp, dword [esp + 0x50]
mov dword [ecx + 8], ebp
mov ebp, dword [esp + 0x54]
cmp byte [0x6d9e38], 0
jne 0x4c322a
mov dword [ecx + 0xc], ebp
mov edx, 0x6b0cb0
mov dword [esp + 0x68], edx
mov dword [esp + 0x6c], ecx
jmp 0x4c31ba
lea esi, [ecx + 0xc]
mov dword [esp], esi
mov dword [esp + 4], ebp
call fcn.0040f3d0
mov ecx, dword [esp + 0x3c]
jmp 0x4c321b
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.0040f3d0
mov ecx, dword [esp + 0x3c]
jmp 0x4c3204
nop
call fcn.00429a30
add esp, 0x70
ret
call fcn.00450fb0
jmp fcn.004c3040
Function at 0x4c3830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c3943
sub esp, 0x54
xor ebx, ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov ebx, dword [esp + 0x58]
mov dword [esp], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x64]
mov dword [esp + 0xc], ebx
mov eax, 0x6b32c0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov eax, 0x6b32c0
mov dword [esp + 0x4c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x50], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], 2
mov dword [esp + 0x24], 0
mov ebx, 0x5f5fb9
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 4
call fcn.004bc3d0
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x48], edx
mov dword [esp + 0x44], eax
cmp eax, 0
je 0x4c38ef
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], edx
add esp, 0x54
ret
mov dword [esp + 0x3c], ecx
mov dword [esp], 0x5cc8e0
call fcn.0040ea00
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x40], ecx
cmp ecx, 0
je 0x4c393f
cmp byte [0x6d9e38], 0
jne 0x4c392d
mov dword [ecx], eax
mov dword [esp + 0x70], ecx
xor ebx, ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
add esp, 0x54
ret
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0040f3d0
mov ecx, dword [esp + 0x40]
jmp 0x4c391b
mov dword [ecx], eax
jmp 0x4c3910
call fcn.00450fb0
jmp fcn.004c3830
Function at 0x516af0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x516ce6
mov edx, dword [esp + 8]
movzx ecx, byte [esp + 4]
cmp cl, 0x41
jb 0x516b1f
cmp cl, 0x5a
ja 0x516b1f
mov byte [esp + 0xc], 0
ret
cmp cl, 0x61
jb 0x516b29
cmp cl, 0x7a
jbe 0x516b19
cmp cl, 0x30
jb 0x516b33
cmp cl, 0x39
jbe 0x516b19
cmp edx, 2
je 0x516c34
cmp edx, 3
je 0x516c34
cmp cl, 0x2f
ja 0x516be7
cmp cl, 0x2b
ja 0x516bc2
cmp cl, 0x24
jne 0x516bb6
cmp edx, 4
jg 0x516ba0
cmp edx, 1
jne 0x516b74
cmp cl, 0x3f
je 0x516b6d
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
jmp 0x516b6c
cmp edx, 4
jne 0x516b9a
cmp cl, 0x40
je 0x516b93
cmp cl, 0x2f
je 0x516b93
cmp cl, 0x3f
je 0x516b93
cmp cl, 0x3a
je 0x516b93
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
jmp 0x516b92
mov byte [esp + 0xc], 1
ret
cmp edx, 5
jne 0x516bab
mov byte [esp + 0xc], 1
ret
cmp edx, 6
jne 0x516b9a
mov byte [esp + 0xc], 0
ret
cmp cl, 0x26
je 0x516b58
cmp cl, 0x2b
je 0x516b58
jmp 0x516b9a
cmp cl, 0x2d
ja 0x516bd7
cmp cl, 0x2c
je 0x516b58
cmp cl, 0x2d
jne 0x516b9a
mov byte [esp + 0xc], 0
ret
cmp cl, 0x2e
je 0x516bd1
cmp cl, 0x2f
je 0x516b58
jmp 0x516b9a
cmp cl, 0x3d
ja 0x516c09
cmp cl, 0x3a
je 0x516b58
cmp cl, 0x3b
je 0x516b58
cmp cl, 0x3d
je 0x516b58
jmp 0x516b9a
cmp cl, 0x40
ja 0x516c25
cmp cl, 0x3f
je 0x516b58
cmp cl, 0x40
je 0x516b58
jmp 0x516b9a
cmp cl, 0x5f
je 0x516bd1
cmp cl, 0x7e
je 0x516bd1
jmp 0x516b9a
cmp cl, 0x2a
ja 0x516c8a
cmp cl, 0x26
ja 0x516c67
cmp cl, 0x22
ja 0x516c58
cmp cl, 0x21
jne 0x516c4e
mov byte [esp + 0xc], 0
ret
cmp cl, 0x22
je 0x516c48
jmp 0x516b45
cmp cl, 0x24
je 0x516c48
cmp cl, 0x26
je 0x516c48
jmp 0x516b45
cmp cl, 0x28
ja 0x516c7b
cmp cl, 0x27
je 0x516c48
cmp cl, 0x28
je 0x516c48
jmp 0x516b45
cmp cl, 0x29
je 0x516c48
cmp cl, 0x2a
je 0x516c48
jmp 0x516b45
cmp cl, 0x3b
ja 0x516cb2
cmp cl, 0x2c
ja 0x516ca3
cmp cl, 0x2b
je 0x516c48
cmp cl, 0x2c
je 0x516c48
jmp 0x516b45
cmp cl, 0x3a
je 0x516c48
cmp cl, 0x3b
je 0x516c48
jmp 0x516b45
cmp cl, 0x3d
ja 0x516cc6
cmp cl, 0x3c
je 0x516c48
cmp cl, 0x3d
je 0x516c48
jmp 0x516b45
cmp cl, 0x3e
je 0x516c48
cmp cl, 0x5b
je 0x516c48
cmp cl, 0x5d
je 0x516c48
jmp 0x516b45
call fcn.00450fb0
jmp fcn.00516af0
Function at 0x5193e0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x519529
sub esp, 0x10
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, ecx
cmp ecx, edx
jge 0x519434
cmp ecx, edx
jae 0x519522
mov ebp, esi
add ebp, ecx
movzx ebx, byte [ebp]
cmp bl, 0x2a
ja 0x5194b7
cmp bl, 0x26
ja 0x519496
cmp bl, 0x24
ja 0x51948a
cmp bl, 0x21
jne 0x51943d
inc ecx
cmp ecx, edx
jl 0x519407
mov byte [esp + 0x1c], 1
add esp, 0x10
ret
cmp bl, 0x24
je 0x51942f
mov dword [esp + 0xc], ecx
cmp ecx, edx
jae 0x519483
mov ebp, esi
add ebp, ecx
movzx ebx, byte [ebp]
mov byte [esp], bl
mov dword [esp + 4], 1
call fcn.00516af0
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
movzx ebx, byte [esp + 8]
cmp bl, 0
je 0x519481
mov byte [esp + 0x1c], 0
add esp, 0x10
ret
jmp 0x51942f
call fcn.00428880
ud2
cmp bl, 0x25
je 0x51942f
cmp bl, 0x26
je 0x51942f
jmp 0x519442
cmp bl, 0x28
ja 0x5194a7
cmp bl, 0x27
je 0x51942f
cmp bl, 0x28
je 0x51942f
jmp 0x519442
cmp bl, 0x29
je 0x51942f
cmp bl, 0x2a
je 0x51942f
jmp 0x519442
cmp bl, 0x3b
ja 0x5194ef
cmp bl, 0x2c
ja 0x5194d8
cmp bl, 0x2b
je 0x51942f
cmp bl, 0x2c
je 0x51942f
jmp 0x519442
cmp bl, 0x3a
je 0x51942f
cmp bl, 0x3b
je 0x51942f
jmp 0x519442
cmp bl, 0x40
ja 0x51950b
cmp bl, 0x3d
je 0x51942f
cmp bl, 0x40
je 0x51942f
jmp 0x519442
cmp bl, 0x5b
je 0x51942f
cmp bl, 0x5d
je 0x51942f
jmp 0x519442
call fcn.00428880
ud2
call fcn.00450fb0
jmp fcn.005193e0
Function at 0x5299b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x529bb9
sub esp, 0x6c
xor ebx, ebx
xor ebx, ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp], 0x5e5500
call fcn.0040ea00
mov ebx, dword [esp + 4]
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x70]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x20], ebx
xor ebx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp], 0x5ba380
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.004045a0
mov eax, dword [esp + 0xc]
xor ebx, ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x4c], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], eax
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x30], ebx
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x58]
mov ebp, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x68]
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x4c], ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x40], edx
mov dword [esp + 0x60], edx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x48], eax
mov dword [esp + 0x68], eax
mov ebx, dword [esp + 0x18]
cmp ebx, 0
je 0x529bb2
lea ebp, [esp + 0x4c]
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov ebp, 0x5e5500
mov dword [esp], ebp
call fcn.0040f4d0
mov ecx, dword [esp + 0x18]
cmp ecx, 0
je 0x529bab
mov ebx, dword [esp + 0x70]
mov dword [esp], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp + 4], ebx
mov eax, 0x6b1a90
mov dword [esp + 0x24], eax
mov dword [esp + 8], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0xc], ecx
call fcn.00529bd0
mov ebx, dword [esp + 0x18]
cmp ebx, 0
je 0x529ba7
mov dword [esp + 0x14], ebx
mov dword [esp], 0x5cb1a0
call fcn.0040ea00
mov esi, dword [esp + 4]
mov eax, 0x52b070
mov dword [esi], eax
mov eax, dword [esp + 0x18]
cmp eax, 0
je 0x529ba3
mov dword [esp + 0x10], esi
cmp byte [0x6d9e38], 0
jne 0x529b8e
mov dword [esi + 4], eax
mov edx, dword [esp + 0x14]
mov ecx, 0x6b2940
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x80], esi
add esp, 0x6c
ret
lea esi, [esi + 4]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0040f3d0
mov esi, dword [esp + 0x10]
jmp 0x529b72
mov dword [eax], eax
jmp 0x529b62
mov dword [ebx], eax
jmp 0x529b3e
mov dword [ecx], eax
jmp 0x529b0c
mov dword [ebx], eax
jmp 0x529ae6
call fcn.00450fb0
jmp fcn.005299b0
Function at 0x558130
Capabilities:
Encrypt data using des

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5582dd
sub esp, 0x3c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 8
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
cmp ebx, ebp
jge 0x55829b
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x1c], ebx
xor ecx, ecx
cmp ecx, 4
jge 0x558282
xor eax, eax
cmp eax, 0x10
jge 0x558278
mov ebx, dword [esp + 0x1c]
mov edi, 7
sub edi, ebx
mov ebx, dword [esp + 0x1c]
mov ebp, 0x6b7fc0
cmp ebx, 8
jae 0x5582d6
shl ebx, 6
add ebp, ebx
mov dword [esp + 0x24], ecx
mov ebx, ecx
mov esi, ebp
cmp ecx, 4
jae 0x5582cf
shl ebx, 4
add esi, ebx
mov dword [esp + 0x20], eax
mov ebp, esi
cmp eax, 0x10
jae 0x5582c8
add ebp, eax
movzx ebx, byte [ebp]
xor edx, edx
mov eax, ebx
mov ecx, edi
shl ecx, 2
cmp ecx, 0x40
jae 0x5582bf
cmp ecx, 0x20
jae 0x5582b4
shld edx, eax, cl
shl eax, cl
mov ecx, edx
mov edx, 0x6b2400
cmp edx, 0
je 0x5582ad
mov edi, 0x20
mov esi, 0x20
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 8], edx
mov dword [esp + 0x34], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x10], esi
call fcn.00558030
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, esi
shl esi, 4
add esi, edi
mov ebx, dword [esp + 0x1c]
mov ebp, 0x6db6e0
cmp ebx, 8
jae 0x5582a6
shl ebx, 8
add ebp, ebx
mov ebx, esi
mov esi, ebp
cmp ebx, 0x40
jae 0x55829f
shl ebx, 2
add esi, ebx
mov dword [esi], edx
mov eax, edi
inc eax
cmp eax, 0x10
jl 0x558187
inc ecx
cmp ecx, 4
jl 0x55817c
mov ebx, dword [esp + 0x2c]
inc ebx
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
cmp ebx, ebp
jl 0x558169
add esp, 0x3c
ret
call fcn.00428880
ud2
call fcn.00428880
ud2
mov dword [edx], eax
jmp 0x558204
mov edx, eax
shl edx, cl
xor eax, eax
jmp 0x5581f4
xor edx, edx
xor eax, eax
jmp 0x5581e6
call fcn.00428880
ud2
call fcn.00428880
ud2
call fcn.00428880
ud2
call fcn.00450fb0
jmp fcn.00558130
Function at 0x3b3440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [esp + 0x14], edx
lea esi, [ecx + 4]
mov edx, dword [ecx]
add esi, 4
xor eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
push edi
movd xmm0, edx
mov edi, eax
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x20], xmm0
test al, 3
je 0x3b3480
and edi, 0xfffffffc
add edi, 4
mov eax, dword [0x3be0bc]
test eax, eax
jne 0x3b34a4
mov ecx, 0xf05fc174
call fcn.003b4190
mov edx, 0x93231e3
mov ecx, eax
call fcn.003b40f0
mov dword [0x3be0bc], eax
call eax
mov ebx, eax
mov eax, dword [0x3bdddc]
test eax, eax
jne 0x3b34cc
mov ecx, 0xf05fc174
call fcn.003b4190
mov edx, 0xe96e8f4f
mov ecx, eax
call fcn.003b40f0
mov dword [0x3bdddc], eax
push edi
push 8
push ebx
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x3b3582
shr edi, 2
xor edx, edx
lea ecx, [esi + edi*4]
mov edi, eax
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
mov ecx, eax
cmova ebx, edx
test ebx, ebx
je 0x3b3572
cmp ebx, 8
jb 0x3b3557
lea eax, [esi - 4]
lea eax, [eax + ebx*4]
cmp ecx, eax
ja 0x3b3516
lea eax, [ecx - 4]
lea eax, [eax + ebx*4]
cmp eax, esi
jae 0x3b3557
movdqa xmm1, xmmword [esp + 0x20]
mov eax, ebx
and eax, 7
mov dword [esp + 0xc], ebx
sub dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea ecx, [ecx]
movdqu xmm0, xmmword [esi]
add edx, 8
pxor xmm0, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
add esi, 0x20
pxor xmm0, xmm1
movdqu xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, eax
jb 0x3b3530
cmp edx, ebx
jae 0x3b3572
sub edi, esi
lea ecx, [ecx]
mov eax, dword [esi]
lea esi, [esi + 4]
xor eax, dword [esp + 0x14]
inc edx
mov dword [edi + esi - 4], eax
cmp edx, ebx
jb 0x3b3560
mov edx, dword [esp + 0x18]
test edx, edx
je 0x3b3580
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3b35f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], edx
lea ebx, [eax + 1]
mov dword [esp + 0x10], eax
add esi, 4
push edi
test bl, 3
je 0x3b3619
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x3be0bc]
test eax, eax
jne 0x3b363d
mov ecx, 0xf05fc174
call fcn.003b4190
mov edx, 0x93231e3
mov ecx, eax
call fcn.003b40f0
mov dword [0x3be0bc], eax
call eax
mov edi, eax
mov eax, dword [0x3bdddc]
test eax, eax
jne 0x3b3665
mov ecx, 0xf05fc174
call fcn.003b4190
mov edx, 0xe96e8f4f
mov ecx, eax
call fcn.003b40f0
mov dword [0x3bdddc], eax
lea ecx, [ebx + ebx]
push ecx
push 8
push edi
call eax
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x3b36e5
shr ebx, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, edi
lea ecx, [esi + ebx*4]
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x3b36da
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [edx + 8]
xor ecx, edi
lea esi, [esi + 4]
movzx eax, cl
inc ebp
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [edx - 4], ax
shr ecx, 8
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, ebx
jb 0x3b36a0
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
pop ebp
mov word [edi + eax*2], cx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x3b36f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 4]
mov dword [esp + 0xc], edx
lea ebx, [eax + 1]
mov dword [esp + 0x14], eax
add esi, 4
push edi
test bl, 3
je 0x3b371a
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x3be0bc]
test eax, eax
jne 0x3b373e
mov ecx, 0xf05fc174
call fcn.003b4190
mov edx, 0x93231e3
mov ecx, eax
call fcn.003b40f0
mov dword [0x3be0bc], eax
call eax
mov edi, eax
mov eax, dword [0x3bdddc]
test eax, eax
jne 0x3b3766
mov ecx, 0xf05fc174
call fcn.003b4190
mov edx, 0xe96e8f4f
mov ecx, eax
call fcn.003b40f0
mov dword [0x3bdddc], eax
push ebx
push 8
push edi
call eax
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x3b37d2
shr ebx, 2
xor eax, eax
xor edi, edi
mov ecx, ebp
lea edx, [esi + ebx*4]
mov ebx, edx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, edx
cmova ebx, eax
test ebx, ebx
je 0x3b37ca
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
lea ecx, [ecx + 4]
xor edx, ebp
lea esi, [esi + 4]
mov byte [ecx - 4], dl
mov eax, edx
shr eax, 8
inc edi
shr edx, 0x10
mov byte [ecx - 3], al
mov byte [ecx - 2], dl
shr edx, 8
mov byte [ecx - 1], dl
cmp edi, ebx
jb 0x3b37a0
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x3b3ce0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp + 4], 0x3d42
shr dword [esp + 4], 4
imul eax, dword [esp + 4], 0x5d
push ebx
mov ebx, ecx
mov dword [esp + 8], eax
imul eax, dword [esp + 8], 0x57
mov dword [esp + 8], eax
xor dword [esp + 8], 0x4ecad597
or dword [esp + 8], 0x3c04465
mov eax, dword [esp + 8]
shl eax, 6
mov dword [esp + 8], eax
shr dword [esp + 8], 7
add dword [esp + 8], 0xffff768f
xor dword [esp + 8], 0x1f8ad06
mov dword [esp + 4], 0x727d
imul eax, dword [esp + 4], 0x6d
mov dword [esp + 4], eax
mov eax, 0x6c16c16d
shl dword [esp + 4], 0xf
xor dword [esp + 4], 0xf3d1e7b4
mov ecx, dword [esp + 4]
mul ecx
mov eax, 0xf0f0f0f1
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov dword [esp + 4], ecx
shr dword [esp + 4], 1
add dword [esp + 4], 0xb65
mov ecx, dword [esp + 4]
mul ecx
shr edx, 5
mov dword [esp + 4], edx
xor dword [esp + 4], 0xe6a8e
mov dword [esp + 4], 0x5917
add dword [esp + 4], 0xac1f
shr dword [esp + 4], 3
shl dword [esp + 4], 0xa
xor dword [esp + 4], 0xbfc66964
xor dword [esp + 4], 0x8e435246
shl dword [esp + 4], 0xc
imul eax, dword [esp + 4], 0x35
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov ecx, eax
shl ecx, 5
add ecx, eax
mov dword [esp + 4], ecx
xor dword [esp + 4], 0xd874a010
cmp byte [ebx], 0
je 0x3b3ed7
push esi
push edi
jmp 0x3b3df0
mov edi, dword [esp + 0x10]
lea ebx, [ebx + 1]
mov dword [esp + 0xc], 0x727d
imul eax, dword [esp + 0xc], 0x6d
mov dword [esp + 0xc], eax
mov eax, 0x6c16c16d
shl dword [esp + 0xc], 0xf
xor dword [esp + 0xc], 0xf3d1e7b4
mov ecx, dword [esp + 0xc]
mul ecx
mov eax, 0xf0f0f0f1
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov dword [esp + 0xc], ecx
shr dword [esp + 0xc], 1
add dword [esp + 0xc], 0xb65
mov ecx, dword [esp + 0xc]
mul ecx
shr edx, 5
mov dword [esp + 0xc], edx
xor dword [esp + 0xc], 0xe6a8e
movzx ecx, byte [esp + 0xc]
mov esi, dword [esp + 0x10]
mov dword [esp + 0xc], 0x5917
add dword [esp + 0xc], 0xac1f
shr dword [esp + 0xc], 3
shl dword [esp + 0xc], 0xa
xor dword [esp + 0xc], 0xbfc66964
xor dword [esp + 0xc], 0x8e435246
shl dword [esp + 0xc], 0xc
imul eax, dword [esp + 0xc], 0x35
shl esi, cl
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ecx, eax
shl ecx, 5
add ecx, eax
mov dword [esp + 0xc], ecx
xor dword [esp + 0xc], 0xd874a010
movzx ecx, byte [esp + 0xc]
mov edx, dword [esp + 0x10]
movsx eax, byte [ebx - 1]
mov dword [esp + 0x10], eax
add dword [esp + 0x10], esi
shl edx, cl
add dword [esp + 0x10], edx
sub dword [esp + 0x10], edi
cmp byte [ebx], 0
jne 0x3b3df0
pop edi
pop esi
mov eax, dword [esp + 8]
pop ebx
add esp, 8
ret