joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a4f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x190
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x10], 0xdb30d9f7
mov dword [esp + 0x14], 0xdf31dd2f
mov dword [esp + 0x18], 0xe3e2e10e
mov eax, 0x18
mov ecx, 0xe7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, ecx
and edi, 0x9a
mov edx, eax
and edx, 0x25
or edx, edi
xor dl, byte [esp + eax - 8]
xor dl, 0x9a
add dl, 0x40
mov byte [esp + eax - 8], dl
inc eax
dec ecx
cmp eax, 0x24
jne 0x41a530
mov dword [esp + 0x34], 0x6b9e6980
mov dword [esp + 0x38], 0x6f9e6d98
mov dword [esp + 0x3c], 0x735d714a
mov dword [esp + 0x40], 0x779a755b
mov dword [esp + 0x44], 0x7b997997
mov dword [esp + 0x48], 0x7f927d9d
mov dword [esp + 0x4c], 0x3ed01e8
mov dword [esp + 0x50], 0x7f205f7
mov dword [esp + 0x54], 0xb0a0932
mov edx, 0xdab23d28
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx + 0x254dc30c]
mov eax, ecx
mov edi, ecx
xor eax, edx
lea ebx, [eax + eax]
not ebx
add ebx, eax
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0x7d
mul cl
mov ecx, eax
mov eax, edi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0xc0
mov byte [esp + edx + 0x254dc30c], al
inc edx
cmp edx, 0xdab23d4c
jne 0x41a5b0
movzx ecx, word [esp + 0x34]
lea eax, [esp + 0x14c]
test cx, cx
je 0x41a631
lea edx, [esp + 0x36]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a620
mov word [eax], 0
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x41a661
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a650
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x41a691
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a680
mov word [eax], 0
mov ebx, dword [esi]
mov dword [esp + 0x34], 0xd0d5d72b
mov byte [esp + 0x38], 0x35
mov eax, 0x795946f9
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x795946c5]
mov ecx, eax
and ecx, edx
mov edi, ecx
and edi, 0xfffffffd
mov esi, ecx
and esi, 2
or ecx, 2
imul ecx, esi
xor esi, 2
imul esi, edi
add ecx, esi
add edx, eax
mov esi, ecx
xor esi, edx
not ecx
and ecx, edx
add ecx, ecx
sub ecx, esi
mov edx, ecx
not edx
add ecx, 0x3535c837
or edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
mov byte [esp + eax - 0x795946c5], cl
inc eax
cmp eax, 0x795946fe
jne 0x41a6b0
movzx eax, byte [esp + 0x34]
test al, al
je 0x41a72b
lea ecx, [esp + 0x35]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41a720
mov byte [ebx], 0
lea eax, [esp + 0x13c]
lea ecx, [esp + 0x140]
lea edx, [esp + 0x28]
lea esi, [esp + 0x14c]
push eax
push ecx
push edx
push esi
call fcn.0040af60
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x442658]
mov ecx, 0x74bf0c65
xor ecx, dword [0x442660]
add eax, ecx
inc eax
jmp eax
Function at 0x41e560
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x14
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov dword [esp], 0x7372715a
mov ecx, 0x823379f0
movzx edx, byte [esp + ecx + 0x7dcc8610]
xor edx, ecx
lea esi, [edx + 0x7f]
not edx
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + ecx + 0x7dcc8610], dl
inc ecx
cmp ecx, 0x823379f4
jne 0x41e590
lea ecx, [esp + 4]
mov edx, esp
push ecx
push 0x41fdc0
push edx
push dword [eax + 8]
call fcn.00420400
add esp, 0x10
jmp dword [0x44290c]
Function at 0x4222cf
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp], 0x2bd006a
mov dword [esp + 4], 0x6a6049c
mov dword [esp + 8], 0x7ae578a6
mov dword [esp + 0xc], 0x7eed7c3a
mov dword [esp + 0x10], 0x723570ef
mov dword [esp + 0x14], 0x76e174d2
mov dword [esp + 0x18], 0x6a0c68d6
lea eax, [esp + 0x1c]
mov word [esp + 0x1c], 0x6c6b
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0xb7
xor dl, byte [esp + ecx]
add dl, 0x48
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x1e
jne 0x422250
lea ebp, [esp + 0x6a]
mov edx, esp
mov edi, ebp
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x50]
push edi
push 0
push 0
push 0xe
push ebp
push 0
call dword [0x448330]
mov dword [esp], 0xb3727153
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x70
xor byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne case.default.0x4222c8
xor ecx, ecx
cmp eax, dword [esp]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x442f60]
mov ebx, dword [esp + 0x50]
test ebx, ebx
jns 0x4222de
mov eax, 0xffffffff
jmp 0x4222e1
lea eax, [ebx + ebx]
push eax
call fcn.00407fb0
add esp, 4
mov esi, eax
push edi
push ebx
push eax
push 0xe
push ebp
push 0
call dword [0x448330]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442f68]
jmp dword [0x442f7c]
mov eax, ebx
add esp, 0x88
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x50]
mov ecx, eax
add ecx, 9
jns 0x422346
mov eax, 0xffffffff
jmp 0x42234d
lea eax, [eax*2 + 0x12]
push eax
call fcn.00407fb0
add esp, 4
mov edi, eax
mov dword [esp], 0x32813093
mov dword [esp + 4], 0x36963492
mov dword [esp + 8], 0x2a8828ac
mov dword [esp + 0xc], 0x2e882c8c
mov dword [esp + 0x10], 0x222120bc
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
lea edx, [eax + 0x142e1c07]
mov ebx, edx
and ebx, ecx
lea ebp, [eax + ecx]
add ebp, 0x142e1c07
not ebp
lea ebx, [ebx*2]
add ebx, ebp
and ebx, edx
add ebx, ebx
neg ebx
lea edx, [eax + ebx]
add edx, 0x142e1c07
add edx, ecx
mov ecx, edx
or ecx, 0xfe
add ecx, edx
not edx
and edx, 1
add ecx, edx
add cl, 0xc9
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x14
jb 0x422390
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x422411
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x422400
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x422441
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x422430
mov word [eax], 0
lea eax, [esp + 0x64]
push eax
push edi
call fcn.0043c360
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442f88]
Function at 0x424540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
cmp byte [esp + 0x60], 0
je 0x424590
mov edi, dword [esp + 0x68]
mov ebx, dword [esp + 0x5c]
mov ebp, dword [edi + 4]
mov eax, 0xfffffffe
nop
nop
cmp word [ebp + eax + 2], 0
lea eax, [eax + 2]
jne 0x424560
mov ecx, 0xfffffffe
cmp word [ebx + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x424570
sar eax, 1
sar ecx, 1
lea edx, [eax + ecx]
add edx, 0x1f
test edx, edx
jns 0x424597
mov eax, 0xffffffff
jmp 0x4245a0
xor ebx, ebx
jmp 0x4247c1
add eax, ecx
lea eax, [eax*2 + 0x3e]
push eax
call fcn.00407fb0
add esp, 4
mov esi, eax
movzx ecx, word [ebp]
test cx, cx
je 0x4245d2
add ebp, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebp]
add ebp, 2
test cx, cx
jne 0x4245c0
mov word [eax], 0x5c
mov dword [esp], 0x845f826d
mov dword [esp + 4], 0x9864867a
mov dword [esp + 8], 0x9c679a78
mov dword [esp + 0xc], 0x906b9e4e
mov dword [esp + 0x10], 0x94679270
mov dword [esp + 0x14], 0xa87b9670
mov dword [esp + 0x18], 0xac55aa70
mov dword [esp + 0x1c], 0xa04aae49
mov dword [esp + 0x20], 0xa446a229
mov dword [esp + 0x24], 0xb84ba641
mov dword [esp + 0x28], 0xbc42ba65
mov dword [esp + 0x2c], 0xb05abe4b
mov dword [esp + 0x30], 0xb44cb272
mov dword [esp + 0x34], 0x484ab648
mov dword [esp + 0x38], 0x4c4b4aa5
xor ecx, ecx
movzx edx, byte [esp + ecx]
lea ebp, [ecx - 0x37aa6437]
xor ebp, edx
mov edx, ebp
and edx, 0x37
xor ebp, 0xb7
lea edx, [edx*2]
add edx, ebp
inc dl
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x3c
jb 0x424650
add eax, 2
movzx ecx, word [ebx]
test cx, cx
je 0x4246b1
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x4246a0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4246e1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4246d0
mov word [eax], 0
mov dword [esp + 0x3c], 0xdbf4d9f2
mov dword [esp + 0x40], 0xdf33dd39
mov dword [esp + 0x44], 0xe3e2e10c
xor eax, eax
mov ecx, eax
add cl, 0x18
xor cl, byte [esp + eax + 0x3c]
add cl, 0x40
mov byte [esp + eax + 0x3c], cl
inc eax
cmp eax, 0xc
jne 0x424700
mov dword [esp], 0x6505632f
mov dword [esp + 4], 0x6904670f
mov dword [esp + 8], 0x6d436bf9
mov dword [esp + 0xc], 0x91f96f19
mov dword [esp + 0x10], 0x95f093fc
mov dword [esp + 0x14], 0x990f97f9
mov dword [esp + 0x18], 0x9dbc9b09
mov dword [esp + 0x1c], 0x81e19fd3
mov dword [esp + 0x20], 0x85e883eb
mov word [esp + 0x24], 0x8786
mov eax, 0x9de32bf2
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x621cd40e]
xor ecx, eax
add ecx, 0x10e6a06f
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax + 0x621cd40e], cl
inc eax
cmp eax, 0x9de32c18
jne 0x424770
lea eax, [esp + 0x3c]
mov ecx, esp
push 0
push 4
push 0xc00000
push eax
push esi
push ecx
push dword [edi]
call fcn.00420050
add esp, 0x1c
mov ebx, eax
push esi
call fcn.00407fc0
add esp, 4
mov eax, ebx
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x425d11
Capabilities:
Encode data using xor

Disassembly:
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
add ecx, 2
cmp word [esi], 0
jne 0x425d20
sub esi, eax
sar esi, 1
mov ecx, esi
and ecx, 0x13
mov edx, esi
or esi, 0x13
imul esi, ecx
xor ecx, 0x13
and edx, 0xffffffec
imul edx, ecx
add esi, edx
jns 0x425d57
mov esi, 0xffffffff
jmp 0x425d59
add esi, esi
push esi
call fcn.00407fb0
add esp, 4
mov dword [esp + 0x6e], 0x52f250f3
mov dword [esp + 0x72], 0x56cb54cc
mov dword [esp + 0x76], 0x4ad048f1
mov dword [esp + 0x7a], 0x4ee14cec
mov dword [esp + 0x7e], 0x42de40ec
mov dword [esp + 0x82], 0x46e344dd
mov dword [esp + 0x86], 0xba1eb8de
mov dword [esp + 0x8a], 0xbe2bbce5
mov dword [esp + 0x8e], 0xb217b01b
mov word [esp + 0x92], 0xb4b3
mov ecx, 0x67
mov edx, 0xfbf8e198
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 7]
mov esi, ecx
xor esi, edx
and esi, ebx
xor esi, edx
mov ebx, esi
and ebx, 0xc7
xor ebx, 0x4070cc7
not esi
or esi, 0xdfc70cc7
add esi, ebx
lea ebx, [esi + esi]
and ebx, 2
sub esi, ebx
inc esi
mov ebp, esi
and ebp, ebx
xor esi, ebx
lea ebx, [esi + ebp*2]
mov byte [esp + ecx + 7], bl
inc ecx
dec edx
cmp ecx, 0x8d
jne 0x425dd0
mov edx, dword [esp + 4]
movzx ecx, word [edx]
test cx, cx
je 0x425e41
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425e30
mov word [eax], 0
movzx ecx, word [esp + 0x6e]
test cx, cx
je 0x425e71
lea edx, [esp + 0x70]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425e60
mov word [eax], 0
mov eax, dword [esp + 4]
mov ecx, eax
jmp case.0x425cfe.1

Function at 0x425ff6
Capabilities:
Copy file

Disassembly:
mov dword [esp + 0x6e], 0xef14ed2f
mov dword [esp + 0x72], 0xf351f12c
mov dword [esp + 0x76], 0xf758f55b
mov dword [esp + 0x7a], 0xfb53f95e
mov dword [esp + 0x7e], 0xff22fd5b
mov dword [esp + 0x82], 0xc36dc163
mov dword [esp + 0x86], 0xc760c56a
mov dword [esp + 0x8a], 0xcb6dc961
mov dword [esp + 0x8e], 0xcf78cd22
mov dword [esp + 0x92], 0xd374d174
mov word [esp + 0x96], 0xd5d4
mov eax, 0x86feec8c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x790113e2]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xa0
mov byte [esp + eax + 0x790113e2], cl
inc eax
cmp eax, 0x86feecb6
jne 0x426070
push 0
lea eax, [esp + 0x72]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp dword [0x443808]
Function at 0x4261f0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x6e], 0x8499816e
mov dword [esp + 0x72], 0x91819386
mov dword [esp + 0x76], 0xb496604a
mov dword [esp + 0x7a], 0x5f74afbf
mov dword [esp + 0x7e], 0xbdaeabb9
mov dword [esp + 0x82], 0xa7a0437e
mov dword [esp + 0x86], 0xacb9b3ba
mov word [esp + 0x8a], 0x1aaa
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x95
xor cl, byte [esp + eax + 0x6e]
add cl, 0x58
mov byte [esp + eax + 0x6e], cl
inc eax
cmp eax, 0x1e
jne case.default.0x42626f
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x6e]
push eax
call fcn.00428e50
xor ecx, ecx
test eax, eax
setne cl
xor ebp, ebp
xor esi, esi
jmp dword [ecx*4 + 0x443838]

Function at 0x426360
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], esi
mov dword [esp + 0x30], 0xb9f4b7d3
mov dword [esp + 0x34], 0xbd1fbb15
mov dword [esp + 0x38], 0xa10cbf1f
mov dword [esp + 0x3c], 0xa534a3e3
mov dword [esp + 0x40], 0xa9eca736
mov dword [esp + 0x44], 0xad38ab0b
mov dword [esp + 0x48], 0x91f5af0f
mov dword [esp + 0x4c], 0x9527932e
mov dword [esp + 0x50], 0x993d9702
mov dword [esp + 0x54], 0x9d319b3b
mov dword [esp + 0x58], 0x812c9f22
mov dword [esp + 0x5c], 0x8527832d
mov dword [esp + 0x60], 0x89248727
mov dword [esp + 0x64], 0x8d1a8be4
mov dword [esp + 0x68], 0xf1568f2a
lea eax, [esp + 0x6c]
mov word [esp + 0x6c], 0xf3f2
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x86
xor dl, byte [esp + ecx + 0x30]
add dl, 0xd0
mov byte [esp + ecx + 0x30], dl
inc ecx
cmp ecx, 0x3e
jne 0x4263f0
lea edx, [esp + 0x30]
lea ebx, [esp + 0x6e]
mov edi, ebx
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xaa]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0xd8]
push esi
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x448330]
mov dword [esp + 0x30], 0x428180ec
xor ecx, ecx
jmp dword [0x44386c]

Function at 0x426453
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor ecx, ecx
cmp ecx, 3
ja 0x426483
nop
nop
nop
nop
nop
nop
mov edi, ecx
and edi, 1
xor edi, 0xc9
mov edx, ecx
and edx, 2
sub edx, edi
xor dl, byte [esp + ecx + 0x30]
add dl, 0x48
mov byte [esp + ecx + 0x30], dl
inc ecx
cmp ecx, 3
jbe 0x426460
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x429a90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x429aea
cmp edi, 1
je 0x429aea
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x429ac1
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x429ac0
cmp ecx, 0x20
je 0x429ac0
cmp ecx, 0x2b
mov edx, edi
je 0x429ae0
cmp ecx, 0x2d
jne 0x429aff
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x429b04
xor edi, edi
test eax, eax
je 0x429cbd
mov dword [eax], 0x16
jmp 0x429cbd
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x429b2d
cmp edx, 0x10
jne 0x429b45
cmp byte [ebx], 0x30
jne 0x429b26
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x429b47
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x429b47
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x429ba0
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x429c58
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x429bc7
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x429c88
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x429c88
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x429b80
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x429c10
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x429c19
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x429c3d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x429c6d
test bl, bl
jne 0x429c6d
mov ebx, dword [esp + 0x10]
jmp 0x429b93
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x429b75
mov esi, edi
test bl, bl
jne 0x429c7b
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x429b75
mov eax, dword [esp + 0x38]
test eax, eax
je 0x429c96
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x429ca4
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x429cb4
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x429cbd
cmp byte [esp + 3], 0
jne 0x429cbd
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4365b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x44]
call fcn.0043c1e0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x444e8c]

Function at 0x4368a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.0043c7d0
add esp, 0x14
test eax, eax
js 0x4369f6
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.0043cb90
add esp, 0x24
xor esi, esi
test eax, eax
js 0x436939
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x436905
mov eax, 0xffffffff
jmp 0x43690c
lea eax, [eax*2 + 2]
push eax
call fcn.00407fb0
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x14]
call fcn.0043d140
add esp, 0x14
test eax, eax
js 0x436930
mov esi, edi
jmp 0x436939
push edi
call fcn.00407fc0
add esp, 4
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov dword [esp], 0x898a8b8c
mov ecx, esp
mov edx, 0xa4
nop
movzx ebx, byte [ecx]
lea edi, [edx - 0x7260ba00]
or edi, ebx
and ebx, edx
not edi
or edi, ebx
mov ebp, edi
and ebp, 0x60603125
mov eax, edi
and eax, 2
mov ebx, eax
xor ebx, 2
imul ebx, ebp
or ebp, 2
imul ebp, eax
xor edi, 0x6cfa3527
add ebx, edi
add ebx, ebp
and edi, 1
xor ebx, 1
lea eax, [ebx + edi*2]
mov byte [ecx], al
inc ecx
dec edx
cmp edx, 0xa0
jne 0x436950
mov ecx, dword [0x448334]
test ecx, ecx
je 0x4369dd
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0x448338]
cmp dword [ebx + edi*8], 0xb430e561
je 0x4369c0
inc edi
cmp ecx, edi
jne 0x4369b0
jmp 0x4369dd
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x4369dd
push dword [esp + 8]
push 4
push ecx
push dword [0x44833c]
call fcn.0043a070
add esp, 0x10
test esi, esi
jne 0x4369f8
mov eax, esp
push eax
call fcn.0043c010
add esp, 4
test al, al
je 0x4369f6
cmp dword [esp], 1
je 0x4369f8
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4386f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 4], 0
mov dword [esp], 0x898a8b8c
mov eax, 0x7260b95b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x7260b95b]
xor ecx, eax
mov edx, ecx
not edx
and edx, 0xd9
and ecx, 0x26
sub ecx, edx
inc cl
mov byte [esp + eax - 0x7260b95b], cl
inc eax
cmp eax, 0x7260b95f
jne 0x438720
mov ebp, dword [esp]
mov eax, dword [0x448334]
test eax, eax
je 0x438796
xor ecx, ecx
mov edx, dword [0x448338]
nop
nop
cmp dword [edx + ecx*8], 0x67f3d776
je 0x438770
inc ecx
cmp eax, ecx
jne 0x438760
jmp 0x438796
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebp
je 0x438796
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x44833c]
call fcn.0043a070
add esp, 0x1c
mov ebp, eax
mov dword [esp], 0x2d6c6b6e
mov eax, 0x45
mov ecx, 0xba
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0xba]
mov edx, eax
xor edx, ecx
and edx, esi
xor edx, ecx
add dl, 0x30
mov byte [esp + ecx - 0xba], dl
dec eax
inc ecx
cmp eax, 0x41
jne 0x4387b0
cmp ebp, dword [esp]
jne 0x438924
mov dword [esp + 0xc], edi
push dword [esp + 4]
call fcn.00438690
add esp, 4
mov ebp, dword [esp + 4]
mov dword [esp], 0x898a8b8c
mov edx, 0x7260b95b
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx - 0x7260b95b]
xor ecx, edx
mov esi, ecx
not esi
and esi, 0xd9
and ecx, 0x26
sub ecx, esi
inc cl
mov byte [esp + edx - 0x7260b95b], cl
inc edx
cmp edx, 0x7260b95f
jne 0x438800
mov edi, dword [esp]
mov edx, dword [0x448334]
test edx, edx
je 0x438875
xor ecx, ecx
mov esi, dword [0x448338]
cmp dword [esi + ecx*8], 0x67f3d776
je 0x438850
inc ecx
cmp edx, ecx
jne 0x438840
jmp 0x438875
mov edx, dword [esi + ecx*8 + 4]
cmp edx, edi
je 0x438875
push 0
push ebp
push eax
push 5
push 0x10
push edx
push dword [0x44833c]
mov esi, eax
call fcn.0043a070
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
mov ebp, edi
js 0x43891b
mov dword [esp], 0xb3727355
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + edi]
mov esi, edi
or esi, 0x70
and esi, edx
add esi, esi
mov ecx, edi
sub ecx, esi
add cl, dl
add cl, 0x70
mov byte [esp + edi], cl
add edi, 0x1f833775
mov ecx, edi
and ecx, 0xc
or edi, 0xe07cc88c
add edi, ecx
cmp edi, 4
jb 0x438890
mov ecx, dword [esp]
mov dword [esp + 8], ecx
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebp]
movzx edi, word [ebx + ebp]
test si, si
je 0x4388f5
add ebp, 2
cmp si, di
je 0x4388e0
cmp si, di
je 0x438906
mov esi, dword [ecx]
test esi, esi
jne 0x4388d0
mov ebp, dword [esp + 8]
jmp 0x43891b
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor ebp, ebp
push eax
call fcn.004386c0
add esp, 4
mov eax, ebp
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4