joyce8/EMBER2024-capa huggingface dataset:
Function at 0x541930
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6db3f0]
jne 0x54193a
repz ret
jmp fcn.0054c2dc

Function at 0x55d0d0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0054af45
and dword [ebp - 4], 0
cmp dword [0x730794], 0
mov ebx, eax
jne 0x55d181
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x55d232
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6b3508
push edi
call esi
test eax, eax
je 0x55d232
push eax
call fcn.0054aed3
mov dword [esp], 0x6b34f8
push edi
mov dword [0x730794], eax
call esi
push eax
call fcn.0054aed3
mov dword [esp], 0x6b34e4
push edi
mov dword [0x730798], eax
call esi
push eax
call fcn.0054aed3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x73079c], eax
call esi
push eax
call fcn.0054aed3
pop ecx
mov dword [0x7307a4], eax
test eax, eax
je 0x55d181
push 0x6b34b0
push edi
call esi
push eax
call fcn.0054aed3
pop ecx
mov dword [0x7307a0], eax
mov eax, dword [0x7307a0]
cmp eax, ebx
je 0x55d1d9
cmp dword [0x7307a4], ebx
je 0x55d1d9
push eax
call fcn.0054af4e
push dword [0x7307a4]
mov esi, eax
call fcn.0054af4e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x55d1d9
test edi, edi
je 0x55d1d9
call esi
test eax, eax
je 0x55d1d0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x55d1d0
test byte [ebp - 0xc], 1
jne 0x55d1d9
or dword [ebp + 0x10], 0x200000
jmp 0x55d212
mov eax, dword [0x730798]
cmp eax, ebx
je 0x55d212
push eax
call fcn.0054af4e
pop ecx
test eax, eax
je 0x55d212
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x55d212
mov eax, dword [0x73079c]
cmp eax, ebx
je 0x55d212
push eax
call fcn.0054af4e
pop ecx
test eax, eax
je 0x55d212
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x730794]
call fcn.0054af4e
pop ecx
test eax, eax
je 0x55d232
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x55d234
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x56b660
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x10
push ebx
mov bl, byte [edx + 8]
cmp bl, 3
je 0x56b80a
mov ecx, dword [esp + 0x20]
push ebp
mov ebp, dword [edx]
push esi
xor esi, esi
push edi
mov dword [esp + 0x24], esi
test bl, 2
je 0x56b6b8
movzx eax, byte [edx + 9]
movzx esi, byte [ecx]
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 1]
mov dword [esp + 0x10], edi
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 2]
sub eax, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov edi, 3
jmp 0x56b6cb
movzx eax, byte [ecx + 3]
movzx edi, byte [edx + 9]
sub edi, eax
mov dword [esp + 0x10], edi
mov edi, 1
test bl, 4
je 0x56b6df
movzx ecx, byte [ecx + 4]
movzx eax, byte [edx + 9]
sub eax, ecx
mov dword [esp + edi*4 + 0x10], eax
inc edi
xor ecx, ecx
xor eax, eax
cmp edi, ecx
jle case.0x56b726.3
jmp 0x56b6f0
cmp dword [esp + eax*4 + 0x10], ecx
jg 0x56b6fc
mov dword [esp + eax*4 + 0x10], ecx
jmp 0x56b701
mov esi, 1
inc eax
cmp eax, edi
jl 0x56b6f0
cmp si, cx
je case.0x56b726.3
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x56b726.3
movzx eax, byte [eax + 0x56b824]
jmp dword [eax*4 + 0x56b810]
mov edx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp edx, ecx
jbe case.0x56b726.3
lea esp, [esp]
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x56b740
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [edx + 4]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov ecx, edx
mov eax, 0xf0
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x56b726.3
mov edi, edi
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x56b780
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x56b726.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [esp + edx*4 + 0x10]
shr byte [esi - 1], cl
cmp ebx, ebp
jb 0x56b7a6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x56b726.3
mov edi, edi
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, pe_nt_image_headers32
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [esp + edx*4 + 0x10]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, ebp
jb 0x56b7d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x5718d0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [0x6db3f0]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
cmp eax, 3
jne 0x57195a
movzx eax, word [esi + 0x118]
test ax, ax
jne 0x571906
test byte [esi + 0x230], 1
jne 0x57192e
movzx cx, byte [edi]
cmp cx, ax
jbe 0x57192e
push str.Invalid_background_palette_index
push esi
call fcn.00564eb0
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00541930
add esp, 0xc
ret
mov dl, byte [edi]
push 1
lea eax, [esp + 0xc]
push eax
push str.bKGD
push esi
mov byte [esp + 0x18], dl
call fcn.00570ab0
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00541930
add esp, 0xc
ret
test al, 2
je 0x5719ee
movzx ecx, word [edi + 2]
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.0056fac0
movzx eax, word [edi + 4]
push eax
lea ecx, [esp + 0x16]
push ecx
call fcn.0056fac0
movzx edx, word [edi + 6]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.0056fac0
add esp, 0x18
cmp byte [esi + 0x127], 8
jne 0x5719c8
mov cl, byte [esp + 0xc]
or cl, byte [esp + 0xa]
or cl, byte [esp + 8]
je 0x5719c8
push str.Ignoring_attempt_to_write_16_bit_bKGD_chunk_when_bit_depth_is_8
push esi
call fcn.00564eb0
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00541930
add esp, 0xc
ret
push 6
lea edx, [esp + 0xc]
push edx
push str.bKGD
push esi
call fcn.00570ab0
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00541930
add esp, 0xc
ret
mov cl, byte [esi + 0x127]
movzx eax, word [edi + 8]
mov edx, 1
shl edx, cl
cmp eax, edx
jl 0x571a22
push str.Ignoring_attempt_to_write_bKGD_chunk_out_of_range_for_bit_depth
push esi
call fcn.00564eb0
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00541930
add esp, 0xc
ret
push eax
lea eax, [esp + 0xc]
push eax
call fcn.0056fac0
push 2
lea ecx, [esp + 0x14]
push ecx
push str.bKGD
push esi
call fcn.00570ab0
mov ecx, dword [esp + 0x28]
add esp, 0x18
pop edi
pop esi
xor ecx, esp
call fcn.00541930
add esp, 0xc
ret
Function at 0x5753a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x24]
push ebp
push esi
mov ebp, dword [edi + 0x34]
sub ebp, dword [edi + 0x6c]
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x24]
lea edx, [ebx + ecx - 0x106]
sub ebp, eax
cmp eax, edx
jb 0x57541e
mov eax, dword [edi + 0x30]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.005422d0
mov edx, dword [edi + 0x44]
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], ebx
sub dword [edi + 0x64], ebx
add esp, 0xc
sub dword [edi + 0x54], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x5753f1
sub eax, ebx
jmp 0x5753f3
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x5753e2
mov ecx, dword [edi + 0x38]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x575412
sub eax, ebx
jmp 0x575414
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x575403
add ebp, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x575479
mov edx, dword [edi + 0x6c]
add edx, dword [edi + 0x64]
mov ecx, ebp
add edx, dword [edi + 0x30]
push edx
call fcn.005750a0
add dword [edi + 0x6c], eax
mov edx, dword [edi + 0x6c]
add esp, 4
cmp edx, 3
jb 0x575465
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [edi + 0x50]
mov dword [edi + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x4c]
mov dword [edi + 0x40], eax
cmp edx, 0x106
jae 0x575479
mov edx, dword [edi]
cmp dword [edx + 4], 0
jne 0x5753a6
pop esi
pop ebp
pop ebx
ret
Function at 0x5768d0
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x5768ea
pop edi
lea eax, [esi + 1]
pop esi
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x5769fa
push ebp
jmp 0x576900
mov eax, ebx
cmp ebx, 0x15b0
jb 0x57690f
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x5769bb
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x576930
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x576930
test eax, eax
je 0x5769cd
nop
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
sub eax, 1
jne 0x5769c0
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x576900
pop ebp
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x69cd1b6e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..tls
nop
nop
nop
nop
cmp eax, 0
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x10f972af
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x436008]
jne 0x401010
repz ret
jmp fcn.004015e2

Function at 0x405845
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040300f
and dword [ebp - 4], 0
cmp dword [0x4397d4], 0
mov ebx, eax
jne 0x4058f6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4059a7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4059a7
push eax
call fcn.00402f9d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4397d4], eax
call esi
push eax
call fcn.00402f9d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4397d8], eax
call esi
push eax
call fcn.00402f9d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4397dc], eax
call esi
push eax
call fcn.00402f9d
pop ecx
mov dword [0x4397e4], eax
test eax, eax
je 0x4058f6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402f9d
pop ecx
mov dword [0x4397e0], eax
mov eax, dword [0x4397e0]
cmp eax, ebx
je 0x40594e
cmp dword [0x4397e4], ebx
je 0x40594e
push eax
call fcn.00403018
push dword [0x4397e4]
mov esi, eax
call fcn.00403018
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40594e
test edi, edi
je 0x40594e
call esi
test eax, eax
je 0x405945
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405945
test byte [ebp - 0xc], 1
jne 0x40594e
or dword [ebp + 0x10], 0x200000
jmp 0x405987
mov eax, dword [0x4397d8]
cmp eax, ebx
je 0x405987
push eax
call fcn.00403018
pop ecx
test eax, eax
je 0x405987
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405987
mov eax, dword [0x4397dc]
cmp eax, ebx
je 0x405987
push eax
call fcn.00403018
pop ecx
test eax, eax
je 0x405987
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4397d4]
call fcn.00403018
pop ecx
test eax, eax
je 0x4059a7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4059a9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42d7d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x404
mov eax, dword [0x436008]
xor eax, esp
mov dword [esp + 0x400], eax
cmp dword [0x80c534], 0x114e
mov eax, dword [esp + 0x408]
mov dword [0x80c378], eax
jne 0x42d811
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00401006
add esp, 0x404
ret
Function at 0x42d840
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push edi
cmp ebp, 0x182
jne 0x42d867
push 0
push 0
push 0
push str.bojeduvugetocoyayuweyukelibari
push str.zabusegagelapacedowi
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
xor edi, edi
test ebp, ebp
jle 0x42d8a7
push esi
mov edi, edi
lea esi, [esp + 0xc]
mov dword [esp + 0x14], 5
mov dword [esp + 0xc], 0
call fcn.0042d830
mov eax, dword [esp + 0xc]
add eax, 0x46
mov dword [esp + 0x14], eax
nop
sub dword [esp + 0x14], 0x46
mov al, byte [esp + 0x14]
xor byte [edi + ebx], al
inc edi
cmp edi, ebp
jl 0x42d870
pop esi
pop edi
cmp ebp, 0x2d
pop ebp
jne 0x42d8c2
mov dword [0x80c668], 0xa62e7790
mov dword [0x80c66c], 0xffffffff
pop ecx
ret

Function at 0x42d8d0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x804
mov eax, dword [0x436008]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [0x436ff0]
push ebx
mov ebx, dword [0x80c37c]
push esi
mov esi, dword [0x80c534]
push eax
call fcn.0042d7d0
add esp, 4
cmp dword [0x80c534], 0x2f
jne 0x42d90f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
call fcn.0042d840
add esp, 4
cmp dword [0x80c534], 0x568
pop esi
pop ebx
jne 0x42d935
push 0
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00401006
add esp, 0x804
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x78b94da4
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x7f227861
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4033d4
Capabilities:
Encode data using xor

Disassembly:
push 0xac
mov eax, 0x450f69
call fcn.00421b9a
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov ebx, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x24]
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ebx
call fcn.004021db
mov edi, ebx
xor eax, eax
xor ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
xor eax, eax
mov dword [ebp - 0x2c], ecx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
push 3
push dword [ebp - 0x24]
lea eax, [ebp - 0xb4]
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xb8], eax
call fcn.00403870
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
push dword [ebp - 0xb8]
call fcn.00402197
call fcn.004104f4
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 2
pop ecx
pop ecx
cmp dword [ebp - 0xb8], eax
je 0x40348b
push dword [ebp - 0xb8]
call fcn.0041ecf3
pop ecx
mov ebx, dword [ebp - 0x18]
xor edi, edi
mov eax, dword [ebp - 0x1c]
sub ebx, eax
je 0x4034c0
mov al, byte [eax + edi]
xor al, byte [esi + section..data]
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 0x1d], al
lea eax, [ebp - 0x1d]
push eax
call fcn.0041ce2a
inc esi
xor eax, eax
cmp esi, 0x1e
cmovge esi, eax
mov eax, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x403497
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x1d]
push eax
mov byte [ebp - 0x1d], 0
call fcn.0041ce2a
lea ecx, [ebp - 0x1c]
call fcn.00404a45
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00403c62
mov eax, dword [ebp - 0x28]
call fcn.00421b49
ret
Function at 0x4034ec
Capabilities:
Encode data using xor

Disassembly:
push 0xa8
mov eax, 0x450648
call fcn.00421b9a
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov ebx, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x24]
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ebx
call fcn.0040221f
mov edi, ebx
xor eax, eax
xor ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
xor eax, eax
mov dword [ebp - 0x2c], ecx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
push 3
push dword [ebp - 0x24]
lea eax, [ebp - 0xb0]
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0xb4], eax
call fcn.00403870
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
push dword [ebp - 0xb4]
call fcn.00402197
call fcn.004104f4
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 2
pop ecx
pop ecx
cmp dword [ebp - 0xb4], eax
je 0x4035a3
push dword [ebp - 0xb4]
call fcn.0041ecf3
pop ecx
mov edi, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
sub edi, eax
je 0x4035e1
movzx ecx, byte [eax + ebx]
movsx ax, byte [esi + section..data]
xor cx, ax
movzx eax, cx
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040677c
inc esi
xor eax, eax
cmp esi, 0x1e
cmovge esi, eax
mov eax, dword [ebp - 0x1c]
inc ebx
cmp ebx, edi
jb 0x4035af
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
and dword [ebp - 0x20], 0
push eax
call fcn.0040677c
lea ecx, [ebp - 0x1c]
call fcn.00404a45
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00403c62
mov eax, dword [ebp - 0x28]
call fcn.00421b49
ret
Function at 0x407841
Capabilities:
Encode data using xor

Disassembly:
push 0xac
mov eax, 0x450f69
call fcn.00421b9a
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov ebx, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x24]
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ebx
call fcn.004021db
mov edi, ebx
xor eax, eax
xor ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
xor eax, eax
mov dword [ebp - 0x2c], ecx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
push 3
push dword [ebp - 0x24]
lea eax, [ebp - 0xb4]
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xb8], eax
call fcn.00403870
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
push dword [ebp - 0xb8]
call fcn.00402197
call fcn.004104f4
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 2
pop ecx
pop ecx
cmp dword [ebp - 0xb8], eax
je 0x4078f8
push dword [ebp - 0xb8]
call fcn.0041ecf3
pop ecx
mov ebx, dword [ebp - 0x18]
xor edi, edi
mov eax, dword [ebp - 0x1c]
sub ebx, eax
je 0x40792d
mov al, byte [eax + edi]
xor al, byte [esi + 0x46d02c]
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 0x1d], al
lea eax, [ebp - 0x1d]
push eax
call fcn.0041ce2a
inc esi
xor eax, eax
cmp esi, 0x1e
cmovge esi, eax
mov eax, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x407904
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x1d]
push eax
mov byte [ebp - 0x1d], 0
call fcn.0041ce2a
lea ecx, [ebp - 0x1c]
call fcn.00404a45
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00403c62
mov eax, dword [ebp - 0x28]
call fcn.00421b49
ret
Function at 0x407959
Capabilities:
Encode data using xor

Disassembly:
push 0xa8
mov eax, 0x450648
call fcn.00421b9a
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov ebx, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x24]
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ebx
call fcn.0040221f
mov edi, ebx
xor eax, eax
xor ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
xor eax, eax
mov dword [ebp - 0x2c], ecx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
push 3
push dword [ebp - 0x24]
lea eax, [ebp - 0xb0]
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0xb4], eax
call fcn.00403870
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
push dword [ebp - 0xb4]
call fcn.00402197
call fcn.004104f4
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 2
pop ecx
pop ecx
cmp dword [ebp - 0xb4], eax
je 0x407a10
push dword [ebp - 0xb4]
call fcn.0041ecf3
pop ecx
mov edi, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
sub edi, eax
je 0x407a4e
movzx ecx, byte [eax + ebx]
movsx ax, byte [esi + 0x46d02c]
xor cx, ax
movzx eax, cx
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040677c
inc esi
xor eax, eax
cmp esi, 0x1e
cmovge esi, eax
mov eax, dword [ebp - 0x1c]
inc ebx
cmp ebx, edi
jb 0x407a1c
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
and dword [ebp - 0x20], 0
push eax
call fcn.0040677c
lea ecx, [ebp - 0x1c]
call fcn.00404a45
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00403c62
mov eax, dword [ebp - 0x28]
call fcn.00421b49
ret