joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401858
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401897
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401897
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401897
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401897
cmp dword [ecx + 0x74], 0xe
jbe 0x401897
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4d3e90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x91000]
push edi
jmp 0x4d3eaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4d3eb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d3ea0
mov eax, 1
add ebx, ebx
jne 0x4d3ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4d3ed4
jne 0x4d3ef3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d3ef3
dec eax
add ebx, ebx
jne 0x4d3ee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4d3eb8
add ebx, ebx
jne 0x4d3eef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4d3f45
xor ecx, ecx
sub eax, 3
jb 0x4d3f0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4d3f7a
sar eax, 1
mov ebp, eax
jmp 0x4d3f16
add ebx, ebx
jne 0x4d3f16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d3ee4
inc ecx
add ebx, ebx
jne 0x4d3f24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d3ee4
add ebx, ebx
jne 0x4d3f31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4d3f26
jne 0x4d3f42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4d3f26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4d3f64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4d3f56
jmp 0x4d3ea6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4d3f64
add edi, ecx
jmp 0x4d3ea6
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4d3f82
cmp byte [edi], 0x13
jne 0x4d3f82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4d3f87
lea edi, [esi + 0xcf000]
mov eax, dword [edi]
or eax, eax
je 0x4d3fff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf633c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf6490]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4d3fb4
mov ecx, edi
jns 0x4d3fe3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf6494]
or eax, eax
je 0x4d3ff9
mov dword [ebx], eax
add ebx, 4
jmp 0x4d3fd1
call dword [esi + 0xf64a4]
mov ebp, dword [esi + 0xf6498]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4d4033
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x406645
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40669b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40669b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x40668d
cmp esi, ecx
jae 0x40669b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x40667b
cmp esi, ecx
jae 0x40669b
cmp word [esi], 0
je 0x40669b
mov eax, esi
jmp 0x40669d
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x406993
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
lea ecx, [ebp - 4]
call fcn.00406eeb
lea eax, [ebp - 4]
mov ebx, 0x104
or esi, 0xffffffff
mov dword [ebp - 0x1c], eax
push ebx
mov ecx, eax
mov dword [ebp - 0x14], esi
call fcn.00406f12
push ebx
push eax
xor ebx, ebx
mov dword [ebp - 0x18], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.00406e2a
test edi, edi
je 0x406ae8
cmp edi, 0x104
ja 0x406ae8
mov edi, dword [ebp - 4]
call fcn.0040675b
mov ecx, eax
test ecx, ecx
je 0x406af7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc], eax
test edi, edi
je 0x406a29
test edi, 0xffff0000
jne 0x406a20
movzx eax, di
lea ecx, [ebp - 0xc]
push eax
call fcn.0040709a
jmp 0x406a35
push edi
call fcn.0040bbb2
pop ecx
jmp 0x406a2b
mov eax, ebx
push eax
push edi
lea ecx, [ebp - 0xc]
call fcn.00406fbb
lea ecx, [ebp - 0xc]
call fcn.00406dda
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.00407117
add eax, 0x10
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00406e8a
lea ecx, [ebp - 0x10]
call fcn.0040707f
lea ecx, [ebp - 8]
call fcn.00406eeb
lea eax, [ebp - 8]
mov dword [ebp - 0x14], esi
push 0x104
mov ecx, eax
mov dword [ebp - 0x1c], eax
call fcn.00406f12
push eax
push ebx
push ebx
push 0x26
push ebx
mov dword [ebp - 0x18], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x1c]
mov ebx, eax
call fcn.00406e2a
shr ebx, 0x1f
test bl, bl
je 0x406aa3
xor ebx, ebx
jmp 0x406ad8
lea ecx, [ebp - 8]
call fcn.00406e50
lea ecx, [ebp - 4]
call fcn.00406e50
mov edx, dword [ebp - 8]
test edx, edx
je 0x406ad3
mov ecx, dword [ebp - 4]
cmp dword [ecx - 0xc], 0
jl 0x406ad3
call fcn.004072fe
test eax, eax
je 0x406ad3
mov esi, eax
sub esi, dword [ebp - 4]
sar esi, 1
test esi, esi
sete bl
lea ecx, [ebp - 8]
call fcn.0040707f
lea ecx, [ebp - 0xc]
call fcn.0040707f
lea ecx, [ebp - 4]
call fcn.0040707f
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
push 0x80004005
call fcn.004065b1
int3
Function at 0x406b02
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x20019
push edi
movzx eax, cl
mov esi, edx
push 0x405d08
sub eax, 0x7fffffff
mov dword [ebp - 4], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406b3f
jle 0x406b9c
movzx eax, ax
or eax, 0x80070000
jmp 0x406b9c
or dword [ebp - 0x10], 0xffffffff
mov ecx, esi
push 0x32
pop eax
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], esi
call fcn.00406f12
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x14], eax
push ecx
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x405cf0
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00406e2a
test esi, esi
je 0x406b8f
jle 0x406b8b
movzx esi, si
or esi, 0x80070000
mov eax, esi
jmp 0x406b9c
mov eax, dword [ebp - 8]
dec eax
neg eax
sbb eax, eax
and eax, 0x8000ffff
pop edi
pop esi
leave
ret

Function at 0x407fc4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408003
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408003
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408003
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408003
cmp dword [ecx + 0x74], 0xe
jbe 0x408003
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40e25e
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x416040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x40e2a9
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0040e47b
test al, al
jne 0x40e2a3
sub edx, 2
cmp edx, edi
jne 0x40e289
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x40e2cb
lea eax, [edi + 2]
cmp edx, eax
je 0x40e2cb
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0040e1aa
add esp, 0x10
jmp 0x40e3c5
push esi
lea ecx, [ebp - 0x255]
call fcn.0040e47b
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40e30e
push dword [ebp - 0x25c]
jmp 0x40e2bb
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x40e34b
cmp word [ebp - 0x226], 0
je 0x40e36c
cmp word [ebp - 0x226], ax
jne 0x40e34b
cmp word [ebp - 0x224], 0
je 0x40e36c
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0040e1aa
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x40e3b8
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x40e325
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x40e3a0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x40e3c5
push 0x40dfda
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00410fa0
add esp, 0x10
jmp 0x40e395
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004074a6
leave
ret

Function at 0x40f1ae
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4028fc
push 0x4028f4
push 0x401b64
push 0x1f
call fcn.0040f0e9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f1e2
push dword [ebp + 8]
mov ecx, esi
call dword [0x41815c]
call esi
jmp 0x40f1e8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40f22c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40290c
push 0x402904
push 0x401b88
push 0x21
call fcn.0040f0e9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f263
push dword [ebp + 8]
mov ecx, esi
call dword [0x41815c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40f26b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x402914
push 0x40290c
push 0x401b9c
push 0x22
call fcn.0040f0e9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f2a5
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41815c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x414c20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x414c4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x414c4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x144550
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x144640
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x144640
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x14459a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x1445a1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x144580
jmp 0x1445a3
mov esi, 0x1505
jmp 0x1445a3
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
mov edx, ebx
sub edx, 1
jb 0x144640
mov ecx, esi
not ecx
or edx, ecx
mov eax, ebx
and eax, 0xfffffffe
add eax, eax
mov ecx, ebx
xor ecx, 1
sub eax, ecx
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
lea ebp, [esi + edx]
inc ebp
jmp 0x1445e4
inc ebp
dec ebx
je 0x14463e
mov eax, ebp
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x14463e
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x1445e0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp], eax
push eax
call fcn.0014c9c0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x1445e0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0014c9e0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x1445e0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x144640
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x168090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x1c
mov ebx, esp
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x5c], 0xf935fbd7
mov dword [ebp - 0x58], 0xe576e768
mov dword [ebp - 0x54], 0xe10de328
mov dword [ebp - 0x50], 0xed01ef7c
mov dword [ebp - 0x4c], 0xe90eebc7
mov dword [ebp - 0x48], 0x957e9714
mov dword [ebp - 0x44], 0x9100930f
mov dword [ebp - 0x40], 0x9d759f7c
mov dword [ebp - 0x3c], 0x99749b02
mov dword [ebp - 0x38], 0x8518870f
mov dword [ebp - 0x34], 0x81668368
mov dword [ebp - 0x30], 0x8d108f70
mov dword [ebp - 0x2c], 0x89608b1d
mov dword [ebp - 0x28], 0xb522b71f
mov dword [ebp - 0x24], 0xb12fb35f
lea eax, [ebp - 0x20]
mov word [ebp - 0x20], 0xbfb0
mov dword [ebp - 0x1e], 0
mov byte [ebp - 0x1a], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xab
xor dl, byte [ebp + ecx - 0x5c]
add dl, 0xa9
mov byte [ebp + ecx - 0x5c], dl
inc ecx
cmp ecx, 0x43
jne 0x168130
lea esi, [ebp - 0x9a]
lea edx, [ebp - 0x5c]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [ebp - 0x5e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, dword [ebp - 0x10]
push edi
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x190370]
mov edi, dword [edi]
test edi, edi
jns 0x168189
mov eax, 0xffffffff
jmp 0x16818c
lea eax, [edi + edi]
push eax
call fcn.0014c880
add esp, 4
push dword [ebp - 0x10]
push edi
mov dword [ebp - 0x14], eax
push eax
push 0x1e
lea eax, [ebp - 0x9a]
push eax
push 0
call dword [0x190370]
mov dword [ebx], 0x137a116c
mov dword [ebx + 4], 0x1f881d81
mov dword [ebx + 8], 0x1b771974
mov dword [ebx + 0xc], 0x7640596
mov dword [ebx + 0x10], 0x3900169
mov dword [ebx + 0x14], 0xf0e0d60
mov word [ebx + 0x18], 0
mov byte [ebx + 0x1a], 0
xor edx, edx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx + ecx]
mov dword [ebp - 0x10], eax
mov edi, ecx
xor edi, 0x3cfb82b2
mov esi, edx
and esi, 0x1a
sub esi, edi
lea ebx, [esi + 0x1ed585b6]
and ebx, eax
mov eax, ebx
and eax, 0xfffffffd
mov edi, ebx
or edi, 0xfd
inc edi
imul edi, eax
mov eax, ebx
and eax, 2
or ebx, 2
imul ebx, eax
sub edi, ebx
mov ebx, dword [ebp - 0x18]
lea eax, [edi + esi]
add eax, 0x1ed585b6
add al, byte [ebp - 0x10]
add al, 0xec
mov byte [ebx + ecx], al
inc ecx
add edx, 2
cmp ecx, 0x1b
jne 0x1681f0
push 0
push 0
push ebx
mov esi, dword [ebp - 0x14]
push esi
push dword [ebp + 8]
call fcn.001635b0
add esp, 0x14
jmp dword [0x18bfc8]
Function at 0x19d090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x460
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x5c], 0x49c64bc1
mov dword [esp + 0x60], 0x45d947d3
mov dword [esp + 0x64], 0x419043d7
mov dword [esp + 0x68], 0x7df67fdb
mov dword [esp + 0x6c], 0x797a7be7
mov byte [esp + 0x70], 0
xor eax, eax
nop
nop
movzx ecx, byte [esp + eax + 0x5c]
mov edx, eax
and edx, 0xd
xor edx, 0x76d8c3ed
mov esi, eax
and esi, 0x12
sub esi, edx
mov edx, esi
not edx
lea edx, [esi + edx*2]
inc edx
xor edx, esi
and edx, ecx
xor edx, esi
mov ecx, edx
and ecx, 0x8243418
xor edx, 0xfc74b418
lea ecx, [edx + ecx*2]
add ecx, 0x523bd3a0
mov edx, ecx
xor edx, 0xe7
and ecx, 0x67
lea ecx, [edx + ecx*2]
add cl, 2
mov byte [esp + eax + 0x5c], cl
inc eax
cmp eax, 0x15
jne 0x19d0f0
lea ebx, [esp + 0x5c]
lea ecx, [esp + 0x40]
push ebx
call fcn.001b02c0
shr eax, 0x1f
jmp dword [eax*4 + 0x18c6e0]
Function at 0x1b02c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0xf4f5f6f7
mov eax, 0x92bb3fd4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x6d44c02c]
xor ecx, eax
mov edx, ecx
not edx
add ecx, 0x2257c0db
or edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
mov byte [esp + eax + 0x6d44c02c], cl
inc eax
cmp eax, 0x92bb3fd8
jne 0x1b02f0
mov edi, dword [esp]
mov eax, dword [0x190374]
test eax, eax
je 0x1b0376
xor ecx, ecx
mov edx, dword [0x190378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x1b0350
inc ecx
cmp eax, ecx
jne 0x1b0340
jmp 0x1b0376
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x1b0376
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x19037c]
push eax
call fcn.001b2f10
add esp, 0x1c
mov edi, eax
mov dword [esp], 0xff3e393c
mov byte [esp + 4], 0
mov eax, 0x7302b58a
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x7302b58a]
xor ecx, eax
mov edx, ecx
and edx, 0x4d
xor ecx, 0x4d
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x7302b58a], cl
inc eax
cmp eax, 0x7302b58f
jne 0x1b0390
cmp edi, dword [esp]
jne 0x1b04c5
mov dword [esp + 0xc], esi
push dword [esp + 8]
call fcn.001b01b0
add esp, 4
mov ebp, dword [esp + 8]
mov dword [esp], 0xf4f5f6f7
mov edx, 0x92bb3fd4
nop
movzx ecx, byte [esp + edx + 0x6d44c02c]
xor ecx, edx
mov esi, ecx
not esi
add ecx, 0x2257c0db
or esi, ecx
and esi, 1
or ecx, 1
add ecx, esi
mov byte [esp + edx + 0x6d44c02c], cl
inc edx
cmp edx, 0x92bb3fd8
jne 0x1b03e0
mov edi, dword [esp]
mov edx, dword [0x190374]
test edx, edx
je 0x1b0465
xor ecx, ecx
mov esi, dword [0x190378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ecx*8], 0x9abdb589
je 0x1b0440
inc ecx
cmp edx, ecx
jne 0x1b0430
jmp 0x1b0465
mov edx, dword [esi + ecx*8 + 4]
cmp edx, edi
je 0x1b0465
push 0
push ebp
push eax
push 5
push 4
push dword [0x19037c]
push edx
mov esi, eax
call fcn.001b2f10
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x1b04bc
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x1b0495
add edi, 2
cmp si, bp
je 0x1b0480
cmp si, bp
je 0x1b04a7
mov esi, dword [ecx]
test esi, esi
jne 0x1b0470
mov edi, 0xc0000225
jmp 0x1b04bc
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.001b0210
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x1b0eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x1b0ec9
lea edi, [esp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x1b0eda
cmp eax, 2
je 0x1b0f4c
jmp 0x1b0f79
push 0xbbf966b4
push dword [0x190368]
call fcn.001b5a90
add esp, 8
test eax, eax
je 0x1b0f17
mov ecx, dword [esi]
test ecx, ecx
je 0x1b0f44
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x1b0f20
cmp dword [esp], 0
je 0x1b0f20
mov dword [esi + 4], 3
jmp 0x1b0f44
mov dword [esi + 4], 1
jmp 0x1b0f79
lea eax, [esp + 4]
push eax
call fcn.001b6320
add esp, 4
test al, al
je 0x1b0f44
mov eax, dword [esp + 4]
mov ecx, 2
cmp eax, 3
je 0x1b0f41
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x1b0f79
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x198390]
call fcn.001b5a90
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x1b1014
mov ecx, dword [esi]
mov dword [esp], 0xf4f5f6f7
mov eax, 0x92bb3fd4
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x6d44c02c]
xor edx, eax
mov esi, edx
not esi
add edx, 0x2257c0db
or esi, edx
and esi, 1
or edx, 1
add edx, esi
mov byte [esp + eax + 0x6d44c02c], dl
inc eax
cmp eax, 0x92bb3fd8
jne 0x1b0f90
mov eax, dword [esp]
mov edx, dword [0x190374]
test edx, edx
je 0x1b1014
xor esi, esi
mov ebx, dword [0x190378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x1b0ff0
inc esi
cmp edx, esi
jne 0x1b0fe0
jmp 0x1b1014
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x1b1014
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x19037c]
push edx
call fcn.001b2f10
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x1b44e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
adc eax, 0
xor edx, edx
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, eax
mov esi, dword [esp + 0x28]
jb 0x1b4550
mov ecx, ebx
shr ecx, 2
mov eax, ebp
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0x1b46ee
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x1b46ee
mov dword [esp], 0x282b2a25
mov byte [esp + 4], 0
nop
nop
nop
nop
mov ebp, edx
shr ebp, 1
and ebp, 1
movzx ecx, byte [esp + edx]
mov edi, edx
and edi, 5
mov eax, edx
or eax, 0xfffffffd
inc eax
imul eax, edi
mov edi, edx
or edi, 2
imul edi, ebp
add edi, edi
sub eax, edi
add eax, edx
add eax, 0x3773c848
xor eax, ecx
mov ecx, eax
not ecx
and ecx, 1
xor eax, 0xfe
lea eax, [eax + ecx*2]
add al, 0x6c
mov byte [esp + edx], al
inc edx
cmp edx, 5
jne 0x1b4560
mov eax, dword [esp]
mov ecx, dword [0x190374]
test ecx, ecx
je 0x1b45e0
xor edx, edx
mov edi, dword [0x190378]
mov ebp, dword [esp + 0x20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x1b45e6
inc edx
cmp ecx, edx
jne 0x1b45d0
jmp 0x1b4610
mov ebp, dword [esp + 0x20]
jmp 0x1b4610
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x1b4610
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x19037c]
push ecx
call fcn.001b2f10
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x24]
js 0x1b46ee
push 0x732f71fd
push dword [0x198390]
call fcn.001b5a90
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x282b2a25
mov byte [esp + 4], 0
xor edx, edx
nop
mov edi, edx
shr edi, 1
and edi, 1
movzx esi, byte [esp + edx]
mov ebx, edx
and ebx, 5
mov ebp, edx
or ebp, 0xfffffffd
inc ebp
imul ebp, ebx
mov ebx, edx
or ebx, 2
imul ebx, edi
add ebx, ebx
sub ebp, ebx
lea edi, [edx + ebp]
add edi, 0x3773c848
xor edi, esi
mov esi, edi
not esi
and esi, 1
xor edi, 0xfe
lea ebx, [edi + esi*2]
add bl, 0x6c
mov byte [esp + edx], bl
inc edx
cmp edx, 5
jne 0x1b4650
mov edx, dword [0x190374]
test edx, edx
je 0x1b46ee
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x190378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x1b46d0
inc edi
cmp edx, edi
jne 0x1b46c0
jmp 0x1b46ee
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x1b46ee
push ecx
push 1
push dword [0x19037c]
push edx
mov esi, eax
call fcn.001b2f10
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret