joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x415340
mov edi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x415360
sar esi, 1
sar eax, 1
lea ecx, [esi + eax]
add ecx, 2
test ecx, ecx
jns 0x415380
mov eax, 0xffffffff
jmp 0x415387
add eax, esi
add eax, eax
add eax, 4
push eax
call fcn.00408d40
add esp, 4
movzx ecx, word [edi]
mov ebx, eax
test cx, cx
je 0x4153b1
add edi, 2
mov ebx, eax
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4153a0
mov word [ebx], 0x5c
add ebx, 2
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x4153e1
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4153d0
mov word [ebx], 0
lea ecx, [esp + 8]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x34], eax
push eax
call fcn.0043afe0
add esp, 0x14
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x4424a8]
mov ecx, 0x9712347a
xor ecx, dword [0x4424b0]
add eax, ecx
inc eax
jmp eax
cmp al, ah
cmp cl, al
cmp cl, ah
cmp dl, al
cmp dl, ah
cmp bl, al
cmp bl, ah
cmp ah, al
cmp ah, ah
cmp ch, al
cmp ch, ah
cmp dh, al
cmp dh, ah
cmp bh, al
cmp bh, ah
cmp al, byte [eax]
cmp eax, dword [ebx + edi]
or byte [ebx], bh
or al, 0x3b
adc byte [ebx], bh
adc al, 0x3b
sbb byte [ebx], bh
sbb al, 0x3b
and byte [ebx], bh
and al, 0x3b
sub byte [ebx], bh
sub al, 0x3b
xor byte [ebx], bh
xor al, 0x3b
cmp byte [ebx], bh
cmp al, 0x3b
inc eax
cmp eax, dword [ebx + edi + 0x48]
cmp ecx, dword [ebx + edi + 0x50]
cmp edx, dword [ebx + edi + 0x58]
cmp ebx, dword [ebx + edi + 0x60]
cmp esp, dword [ebx + edi + 0x68]
cmp ebp, dword [ebx + edi + 0x70]
cmp esi, dword [ebx + edi + 0x78]
cmp edi, dword [ebx + edi - 0x80]
cmp eax, dword [ebx + edi + 0x3b8c3b88]
nop
cmp edx, dword [ebx + edi + 0x3b9c3b98]
mov al, byte [0xa83ba43b]
cmp ebp, dword [ebx + edi + 0x3bb43bb0]
mov eax, 0xc43bc03b
cmp edx, esp
cmp ebx, eax
cmp esp, dword [eax]
cmp al, 0x24
cmp al, 0x2c
cmp al, 0x30
cmp al, 0x38
cmp al, 0x3c
cmp al, 0x4c
cmp al, 0x50
cmp al, 0x58
cmp al, 0x5c
cmp al, 0x6c
cmp al, 0x70
cmp al, 0x78
cmp al, 0x7c
cmp al, 0x84
cmp al, 0x88
cmp al, 0x90
cmp al, 0x94
cmp al, 0x9c
cmp al, 0xa0
cmp al, 0xb8
cmp al, 0xbc
cmp al, 0xec
cmp al, 0xf0
cmp al, 0x10
cmp eax, 0x3d243d14
sub byte [0x3d643d60], bh
insb byte es:[edi], dx
cmp eax, 0x3d883d70
invalid
Function at 0x415700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x415720
sar esi, 1
lea edi, [esp + 0x84]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x449de0]
mov ebx, dword [esp + 0x84]
test ebx, ebx
jns 0x415755
mov eax, 0xffffffff
jmp 0x415758
lea eax, [ebx + ebx]
push eax
call fcn.00408d40
add esp, 4
push edi
push ebx
mov dword [esp + 0x20], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x449de0]
mov dword [esp + 0x20], 0xbbf4b9ea
mov dword [esp + 0x24], 0xbfc9bdd9
mov dword [esp + 0x28], 0xc3e0c1ca
mov dword [esp + 0x2c], 0xc7a3c594
mov dword [esp + 0x30], 0xcbbdc9b4
mov dword [esp + 0x34], 0xcfbdcda1
mov dword [esp + 0x38], 0xd3d0d1a0
lea eax, [esp + 0x3c]
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x90], 0
mov ecx, dword [esp + 0x90]
cmp ecx, 0x23
ja 0x415836
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x90]
movzx edx, byte [esp + edx + 0x20]
lea esi, [ecx + edx]
add ecx, 0xb7
and ecx, edx
add ecx, ecx
sub esi, ecx
add esi, 0x8d9a3eb7
mov dword [esp + 0xac], esi
mov ecx, dword [esp + 0xac]
dec cl
mov edx, dword [esp + 0x90]
mov byte [esp + edx + 0x20], cl
inc dword [esp + 0x90]
mov ecx, dword [esp + 0x90]
cmp ecx, 0x24
jb 0x4157e0
lea edi, [esp + 0x90]
lea edx, [esp + 0x20]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xac]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x84]
mov ecx, eax
add ecx, 0xd
jns 0x41586f
mov eax, 0xffffffff
jmp 0x415874
add eax, eax
add eax, 0x1a
push eax
call fcn.00408d40
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x18]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x4158b1
mov eax, dword [esp + 0x18]
lea edx, [eax + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4158a0
mov word [eax], 0
movzx ecx, word [esp + 0x90]
test cx, cx
je 0x4158e1
lea edx, [esp + 0x92]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4158d0
mov word [eax], 0
lea eax, [esp + 0x54]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043afe0
add esp, 0x14
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x442724]
mov ecx, 0xe31938a1
xor ecx, dword [0x44272c]
add eax, ecx
inc eax
jmp eax
Function at 0x41a580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov dword [esp + 8], 0xb7d0d68
mov dword [esp + 0xc], 0x78f0975
mov dword [esp + 0x10], 0x3300548
mov dword [esp + 0x14], 0x1f60017c
lea eax, [esp + 0x18]
mov word [esp + 0x18], 0x1d1c
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov word [esp + 0x22], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x1b
ja 0x41a631
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
mov esi, ecx
and esi, 0x34911c82
xor ecx, 0x34911c82
lea ecx, [ecx + esi*2]
lea esi, [ecx + edx]
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 0x28], esi
mov ecx, dword [esp + 0x28]
mov edx, ecx
xor edx, 0x71
and ecx, 0x71
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x1c
jb 0x41a5e0
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x38]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x41a660
mov edi, esi
cmp eax, 0xffffffed
jge 0x41a679
mov eax, 0xffffffff
jmp 0x41a67c
add eax, 0x12
push eax
call fcn.00408d40
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x41a6b1
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41a6a0
mov word [eax], 0
movzx ecx, word [esp + 0x28]
test cx, cx
je 0x41a6e1
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a6d0
mov word [eax], 0
push edi
push esi
call fcn.0043b1b0
add esp, 8
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x442fb8]
mov ecx, 0x5ad7af53
xor ecx, dword [0x442fc0]
add eax, ecx
inc eax
jmp eax
Function at 0x42db11
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov edi, esp
push eax
mov dword [esi + 0x18], esp
push eax
mov dword [esi + 0x14], esp
push eax
mov dword [esi + 0x10], esp
sub esp, 0x18
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
mov dword [esi + 0x24], esp
mov dword [esi + 0x28], eax
jmp 0x42daf3
jmp 0x42daf5
mov byte [esi + 7], 0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x42db0d
cmp eax, 0
setne al
jmp 0x42db15
test al, 1
jne 0x42db1e
jmp 0x42dc84
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [edi], eax
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, dword [esi + 0x18]
mov dword [edi], eax
cmp dword [edi], 0
setne al
test al, 1
jne 0x42db5e
jmp 0x42dc7a
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi + 0x14]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.00408f70
add esp, 4
mov ecx, dword [esi + 0x10]
mov dword [ecx], eax
cmp dword [ecx], 0
setne al
test al, 1
jne 0x42db95
jmp 0x42dc6a
call fcn.0040fbc0
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x10]
mov edx, dword [eax]
mov eax, dword [esi + 0x14]
mov eax, dword [eax]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x24]
mov al, byte [eax]
mov byte [esi + 0xc], al
mov byte [ebx], 0xb
mov byte [ebx + 1], 0xd1
mov byte [ebx + 2], 0xdb
mov byte [ebx + 3], 0xd3
mov byte [ebx + 4], 0xe6
mov byte [ebx + 5], 0xd2
mov byte [ebx + 6], 0xe7
mov byte [ebx + 7], 0xd1
mov byte [ebx + 8], 0xe0
mov byte [ebx + 9], 0x17
mov byte [ebx + 0xa], 0x2e
mov byte [ebx + 0xb], 0x33
mov byte [ebx + 0xc], 0x2c
mov byte [ebx + 0xd], 0xb9
mov byte [ebx + 0x12], 0
mov dword [ebx + 0xe], 0
mov dword [esi + 8], 0
mov eax, dword [esi + 8]
cmp eax, 0x13
jae 0x42dc4d
mov dword [esi + 0x20], edx
jmp 0x42dc08
mov edx, dword [esi + 8]
mov eax, dword [esi + 8]
movzx eax, byte [ebx + eax]
mov edi, edx
add edi, 0xf6
and edi, eax
add edx, eax
add edi, edi
sub edx, edi
add edx, 0x60fc39f6
mov dword [esi + 0x2c], edx
mov eax, dword [esi + 0x2c]
add al, 0x46
mov edx, dword [esi + 8]
mov byte [ebx + edx], al
mov eax, dword [esi + 8]
inc eax
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
cmp eax, 0x13
jb 0x42dc08
mov edi, dword [esi + 0x18]
mov edx, dword [esi + 0x20]
jmp 0x42dc4d
sub esp, 0xc
mov dword [esp], ebx
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.00409640
and al, 1
mov byte [esi + 7], al
jmp 0x42dc6a
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x42dc7a
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42dc82
jmp 0x42dc84
mov al, byte [esi + 7]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4340f0
Capabilities:
Encode data using xor
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x10], 0xc3d2e1f0
mov dword [esp + 0xc], 0x10325476
mov dword [esp + 8], 0x98badcfe
mov dword [esp + 4], 0xefcdab89
mov dword [esp], 0x67452301
cmp ebp, 0x40
jb 0x4341ad
mov edi, ebp
shr edi, 6
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
add esi, 4
cmp esi, 0x40
jne 0x434150
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 4]
push eax
call fcn.00434a00
add esp, 8
inc ebx
lea eax, [esi + ebp]
cmp ebx, edi
jne 0x434140
add ebp, esi
mov eax, ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov ecx, ebp
not ecx
or ecx, 0x3f
lea edx, [ecx + ebp]
inc edx
je 0x4342a6
xor edi, edi
add ecx, ebp
je 0x43428e
mov dword [esp + 0x14], edx
and edx, 0xfffffffe
mov dword [esp + 0x18], edx
xor edx, edx
xor edi, edi
nop
movzx esi, byte [eax + edi]
mov ecx, edx
and cl, 0x10
shl esi, cl
mov ebp, edi
and ebp, 0xfffffffc
xor esi, dword [esp + ebp + 0x1c]
mov dword [esp + ebp + 0x1c], esi
movzx ebx, byte [eax + edi + 1]
or cl, 8
shl ebx, cl
xor ebx, esi
mov dword [esp + ebp + 0x1c], ebx
add edi, 2
add edx, 0x10
cmp dword [esp + 0x18], edi
jne 0x434250
add eax, edi
mov ebp, dword [esp + 0x74]
mov edx, dword [esp + 0x14]
test dl, 1
je 0x4342a6
movzx eax, byte [eax]
lea ecx, [edi*8]
shl eax, cl
and edi, 0xfffffffc
xor dword [esp + edi + 0x1c], eax
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov esi, dword [esp + 0x78]
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x1c], eax
cmp edx, 0x37
jbe 0x4342f2
lea edi, [esp + 0x1c]
mov eax, esp
push edi
push eax
call fcn.00434a00
add esp, 8
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x5c]
xor eax, eax
xor ecx, ecx
rep stosw word es:[edi], ax
mov dword [esp + 0x54], ebx
shr ebp, 0x1d
mov dword [esp + 0x58], ebp
lea eax, [esp + 0x1c]
mov ecx, esp
push eax
push ecx
call fcn.00434a00
add esp, 8
mov eax, dword [esp]
mov dword [esi], eax
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov eax, dword [esp + 8]
mov dword [esi + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x10], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4362f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0xfcfdfeff
mov dword [esp + 0x14], 0
mov word [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x436376
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x90a70420
add eax, 0x90a70420
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov ecx, eax
xor ecx, 0x1f
and eax, 0x1f
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x436330
mov ebx, dword [esp + 0x10]
mov eax, dword [0x44adec]
test eax, eax
je 0x4363c6
xor ecx, ecx
mov edx, dword [0x44adf0]
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xe4aa2089
je 0x4363a0
inc ecx
cmp eax, ecx
jne 0x436390
jmp 0x4363c6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebx
je 0x4363c6
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x44adf4]
push eax
call fcn.00438160
add esp, 0x1c
mov ebx, eax
cmp ebx, 0xc0000004
jne 0x436518
push dword [esp + 8]
call fcn.004360c0
add esp, 4
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], 0xfcfdfeff
mov dword [esp + 0x14], 0
mov word [esp + 0x18], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 9
ja 0x436457
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x10]
lea esi, [ecx + edx]
add esi, 0x90a70420
add ecx, 0x90a70420
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 0xc], esi
mov ecx, dword [esp + 0xc]
mov edx, ecx
xor edx, 0x1f
and ecx, 0x1f
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esp]
mov byte [esp + edx + 0x10], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xa
jb 0x436410
mov ebx, dword [esp + 0x10]
mov ecx, dword [0x44adec]
test ecx, ecx
je 0x4364a4
xor edx, edx
mov esi, dword [0x44adf0]
nop
nop
nop
cmp dword [esi + edx*8], 0xe4aa2089
je 0x436480
inc edx
cmp ecx, edx
jne 0x436470
jmp 0x4364a4
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, ebx
je 0x4364a4
push 0
push eax
push dword [esp + 0xc]
push 5
push 4
push dword [0x44adf4]
push ecx
call fcn.00438160
add esp, 0x1c
mov ebx, eax
test ebx, ebx
js 0x43650c
mov dword [esp + 0x20], edi
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 4]
mov esi, dword [ecx]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebx]
movzx edi, word [eax + ebx]
test si, si
je 0x4364e5
add ebx, 2
cmp si, di
je 0x4364d0
cmp si, di
je 0x4364f7
mov esi, dword [ecx]
test esi, esi
jne 0x4364c0
mov ebx, 0xc0000225
jmp 0x43650c
mov eax, dword [ecx + 0x44]
mov edx, dword [esp + 0x20]
mov dword [edx + 4], eax
mov eax, dword [ecx + 0xdc]
mov dword [edx + 8], eax
xor ebx, ebx
push dword [esp + 4]
call fcn.00436180
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x436550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov edx, dword [ecx + 4]
test edx, edx
je 0x436650
xor eax, eax
cmp dword [ecx], 0
jne 0x436655
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], edx
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 8], 0xfcfdfeff
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x436626
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea esi, [eax + edx]
add esi, 0x90a70420
add eax, 0x90a70420
and eax, edx
add eax, eax
sub esi, eax
mov dword [esp + 4], esi
mov eax, dword [esp + 4]
mov edx, eax
xor edx, 0x1f
and eax, 0x1f
lea eax, [edx + eax*2]
inc al
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x4365e0
mov eax, dword [esp + 8]
mov esi, dword [0x44adec]
test esi, esi
je 0x436655
mov edx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x44adf0]
nop
cmp dword [ebx + edi*8], 0x94b236a1
je 0x43665f
inc edi
cmp esi, edi
jne 0x436640
jmp 0x436655
mov eax, 0xc0000008
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x436655
lea eax, [esp + 0x1c]
lea edi, [esp + 0x24]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44adf4]
push esi
call fcn.00438160
add esp, 0x1c
jmp 0x436655

Function at 0x436690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
test eax, eax
je 0x436767
mov esi, ecx
mov dword [esp + 8], 0xfcfdfeff
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 9
ja 0x436717
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + edx]
add edi, 0x90a70420
add ecx, 0x90a70420
and ecx, edx
add ecx, ecx
sub edi, ecx
mov dword [esp + 4], edi
mov ecx, dword [esp + 4]
mov edx, ecx
xor edx, 0x1f
and ecx, 0x1f
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xa
jb 0x4366d0
mov ecx, dword [0x44adec]
test ecx, ecx
je 0x43675a
mov edx, dword [esp + 8]
xor edi, edi
mov ebx, dword [0x44adf0]
nop
nop
nop
cmp dword [ebx + edi*8], 0x11081610
je 0x436740
inc edi
cmp ecx, edi
jne 0x436730
jmp 0x43675a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43675a
push eax
push 1
push dword [0x44adf4]
push ecx
call fcn.00438160
add esp, 0x10
mov dword [esi], 0
mov dword [esi + 4], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov edi, 0xc0000008
cmp dword [ecx + 4], 0
je 0x4369a0
mov eax, dword [ecx]
test eax, eax
je 0x4369a0
mov dword [esp + 8], 0xfcfdfeff
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 9
ja 0x436807
nop
nop
nop
nop
nop
mov edi, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea esi, [edi + edx]
add esi, 0x90a70420
add edi, 0x90a70420
and edi, edx
add edi, edi
sub esi, edi
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x20]
mov edx, esi
xor edx, 0x1f
and esi, 0x1f
lea ebx, [edx + esi*2]
inc bl
mov edx, dword [esp]
mov byte [esp + edx + 8], bl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 0xa
jb 0x4367c0
mov dword [esp + 0x1c], ecx
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [esp + 8]
mov edx, dword [0x44adec]
test edx, edx
je 0x436865
xor ebx, ebx
mov ecx, dword [0x44adf0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0xac3673b8
je 0x436843
inc ebx
cmp edx, ebx
jne 0x436830
mov ebx, dword [ebp + 0xc]
jmp 0x436865
mov ecx, dword [ecx + ebx*8 + 4]
cmp ecx, edi
mov ebx, dword [ebp + 0xc]
je 0x436865
push dword [ebp + 8]
push eax
push 2
push dword [0x44adf4]
push ecx
call fcn.00438160
add esp, 0x14
mov edi, eax
cmp ebx, 1
mov eax, esi
sbb eax, 0
jl 0x436993
cmp edi, 0xc000010a
jne 0x436993
mov ecx, ebx
and ecx, 0x270f
mov edi, ebx
and edi, 0xffffd8f0
mov eax, edi
xor eax, 0xffffd8f0
not esi
imul esi, ecx
mul ecx
mov dword [esp + 0x28], eax
mov ecx, edx
add ecx, esi
or ebx, 0xffffd8f0
mov esi, dword [ebp + 0x10]
imul esi, ebx
mov eax, ebx
mul edi
add edx, esi
sub edx, edi
add eax, dword [esp + 0x28]
adc edx, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [esp + 8], 0xfcfdfeff
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp + 4], 0
Function at 0x4369b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x4369c7
lea edx, [esp + 0x18]
mov ecx, dword [ecx]
mov dword [esp + 8], 0xfcfdfeff
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x436a36
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 8]
lea edi, [eax + esi]
add edi, 0x90a70420
add eax, 0x90a70420
and eax, esi
add eax, eax
sub edi, eax
mov dword [esp + 4], edi
mov eax, dword [esp + 4]
mov esi, eax
xor esi, 0x1f
and eax, 0x1f
lea eax, [esi + eax*2]
inc al
mov esi, dword [esp]
mov byte [esp + esi + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x4369f0
mov eax, dword [esp + 8]
mov esi, dword [0x44adec]
test esi, esi
je 0x436a84
xor edi, edi
mov ebx, dword [0x44adf0]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xc99a73c4
je 0x436a60
inc edi
cmp esi, edi
jne 0x436a50
jmp 0x436a84
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x436a84
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push 5
push dword [0x44adf4]
push esi
call fcn.00438160
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x439d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov dword [esp + 0x30], 0x9b9a99a8
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov word [esp + 0x3c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xd
ja 0x439d7e
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x30]
mov edx, eax
and edx, 0xfb6e0394
xor eax, 0x7b6e0394
lea eax, [eax + edx*2]
xor eax, ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add al, 0xf4
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x30], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xe
jb 0x439d40
mov eax, dword [esp + 0x30]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
mov ecx, dword [ecx*4 + 0x448bb4]
mov edx, 0x2e50b0f3
xor edx, dword [0x448bbc]
add ecx, edx
inc ecx
jmp ecx