joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f339
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x44f50d
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x4762a0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x44f50d
test cl, 0x48
je 0x44f3a4
cmp byte [eax + 5], 0xa
je 0x44f3a4
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x44f3f6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x44f3de
call fcn.0044532d
mov dword [eax], 9
call fcn.00445336
mov dword [eax], esi
jmp 0x44f3ee
cmp eax, 0x6d
je 0x44f50d
push eax
call fcn.0044533f
pop ecx
or eax, 0xffffffff
jmp 0x44f50f
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x44f508
test eax, eax
je 0x44f41d
cmp byte [ebx], 0xa
jne 0x44f41d
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x44f426
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x44f502
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x44f4f2
cmp al, 0xd
je 0x44f458
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x44f4e4
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x44f472
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x44f46d
add dword [ebp + 0x10], 2
jmp 0x44f4c6
mov dword [ebp + 0x10], eax
jmp 0x44f4e0
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x44f49a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x44f4e0
cmp dword [ebp - 0xc], 0
je 0x44f4e0
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x44f4bb
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x44f4c6
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x44f4e3
cmp ebx, dword [ebp + 0xc]
jne 0x44f4cb
cmp byte [ebp - 1], 0xa
jne 0x44f4cb
mov byte [ebx], 0xa
jmp 0x44f4e3
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0044cbd6
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x44f4e4
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x44f43c
jmp 0x44f502
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x44f502
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x44f50f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44ff45
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x45cff0
call fcn.00444868
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x4749e0], edi
jne 0x44ff89
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x44ff74
mov dword [0x4749e0], ebx
jmp 0x44ff89
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x78
jne 0x44ff89
mov dword [0x4749e0], 2
mov eax, dword [0x4749e0]
cmp eax, ebx
jne 0x44ffa9
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
jmp 0x45006c
cmp eax, 2
je 0x44ffb2
cmp eax, edi
jne 0x44ffda
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x44ffc5
mov eax, dword [0x474870]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x44ffe1
xor eax, eax
jmp 0x45006c
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.004452f0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x450014
cmp esi, edi
jne 0x45002a
push dword [ebp - 0x20]
call fcn.0043f3e7
pop ecx
mov esi, eax
cmp esi, edi
je 0x44ffda
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
test eax, eax
je 0x45005d
cmp dword [ebp + 0x14], edi
jne 0x450047
push edi
push edi
jmp 0x45004d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x450069
push esi
call fcn.0043f3f9
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.004448a3
ret
Function at 0x450075
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x45d000
call fcn.00444868
xor esi, esi
cmp dword [0x4749e4], esi
jne 0x4500b9
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x4500a4
mov dword [0x4749e4], edi
jmp 0x4500b9
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x78
jne 0x4500b9
mov dword [0x4749e4], 2
mov eax, dword [0x4749e4]
cmp eax, 2
je 0x45019a
cmp eax, esi
je 0x45019a
cmp eax, 1
jne 0x4500fe
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x4500e7
mov eax, dword [0x474870]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x450105
xor eax, eax
jmp 0x4501ac
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.004452f0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x45013b
cmp edi, esi
jne 0x450156
lea eax, [ebx + ebx]
push eax
call fcn.0043f3e7
pop ecx
mov edi, eax
cmp edi, esi
je 0x4500fe
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x450189
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x450173
push esi
push esi
jmp 0x450179
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x450195
push edi
call fcn.0043f3f9
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x4501ac
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.004448a3
ret
Function at 0x450c3b
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x450c54
or eax, 0xffffffff
jmp 0x450cb5
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x450cb1
push 0x3d
push esi
call fcn.00450e10
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x450cb1
cmp esi, eax
je 0x450cb1
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x4746ec]
sete cl
cmp eax, dword [0x4746f0]
mov dword [ebp - 8], ecx
jne 0x450c97
mov edi, eax
call fcn.00450bda
mov dword [0x4746ec], eax
cmp eax, ebx
jne 0x450cf0
cmp dword [ebp + 0xc], ebx
je 0x450cb9
cmp dword [0x4746f4], ebx
je 0x450cb9
call fcn.00450614
test eax, eax
je 0x450cf0
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x450cc2
xor eax, eax
jmp 0x450cb4
push 4
call fcn.0043f3e7
cmp eax, ebx
pop ecx
mov dword [0x4746ec], eax
je 0x450cb1
mov dword [eax], ebx
cmp dword [0x4746f4], ebx
jne 0x450cf0
push 4
call fcn.0043f3e7
cmp eax, ebx
pop ecx
mov dword [0x4746f4], eax
je 0x450cb1
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x4746ec]
call fcn.00450b8d
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x450d51
cmp dword [esi], ebx
je 0x450d51
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0043f3f9
cmp dword [ebp - 8], ebx
pop ecx
jne 0x450d34
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x450d92
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x450d2b
mov eax, edi
shl eax, 2
push eax
push dword [0x4746ec]
call fcn.00445fa6
cmp eax, ebx
pop ecx
pop ecx
je 0x450d92
jmp 0x450d8d
cmp dword [ebp - 8], ebx
jne 0x450dfd
cmp edi, ebx
jge 0x450d60
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x4746ec]
call fcn.00445fa6
cmp eax, ebx
pop ecx
pop ecx
je 0x450cb1
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x4746ec], eax
cmp dword [ebp + 0xc], ebx
je 0x450de7
push dword [ebp - 4]
call fcn.0043fb10
inc eax
inc eax
push eax
call fcn.0043f3e7
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x450de7
push dword [ebp - 4]
push esi
call fcn.00440c60
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
test eax, eax
jne 0x450de0
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0043f3f9
pop ecx
cmp dword [ebp - 8], ebx
je 0x450df5
push dword [ebp - 4]
call fcn.0043f3f9
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x450cb4
push dword [ebp - 4]
call fcn.0043f3f9
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x450cbe
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x49334538
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x55624149
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x352260
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x35229a
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0x3522a1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0x352280
jmp 0x3522a3
mov eax, 0x1505
jmp 0x3522a3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x352990
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x352b56
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test ebp, ebp
je 0x352b4f
mov edx, 0x5e6ea9af
mov eax, ebp
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebp
sub edx, eax
jmp 0x352a33
mov edx, dword [esp]
mov eax, edx
sub eax, dword [esp + 4]
add ebx, eax
mov ebp, edx
not ebp
mov esi, dword [esp + 0xc]
and ebp, esi
not esi
mov eax, ecx
mov edx, 0x80078071
mul edx
and esi, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
mov dword [esp], eax
mov eax, edi
mov edx, 0x80078071
mul edx
sub ecx, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov edx, 0x15b0
sub ebp, esi
je 0x352b4f
xor eax, eax
cmp edx, 8
mov dword [esp], edx
jb 0x352ab4
and edx, 0x1ff8
mov dword [esp + 4], edx
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add eax, 8
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 4]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 5]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 6]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 7]
add edi, esi
mov esi, ecx
xor esi, edi
and ecx, edi
lea ecx, [esi + ecx*2]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x352a50
add ebx, eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], ebp
mov esi, eax
sub esi, edx
jae 0x3529eb
mov ebp, edx
and ebp, 3
mov dword [esp + 4], eax
je 0x352b02
mov dword [esp + 8], esi
neg ebp
xor eax, eax
mov edx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec eax
cmp ebp, eax
jne 0x352ae0
mov ebp, dword [esp + 4]
sub ebp, eax
mov esi, dword [esp + 8]
cmp esi, 0xfffffffc
ja 0x3529e0
jmp 0x352b0f
mov ebp, eax
mov edx, ebx
cmp esi, 0xfffffffc
ja 0x3529e0
mov eax, dword [esp]
sub eax, ebp
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + ebp]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + ebp + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 3]
add edi, esi
add ecx, edi
add ebp, 4
cmp eax, ebp
jne 0x352b20
jmp 0x3529e0
shl ecx, 0x10
or ecx, edi
jmp 0x352b5b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x352b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x352bc8
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x352bca
not eax
xor esi, esi
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x38f80c]
mov eax, edi
shr eax, 4
shr ebx, 4
mov ebp, ebx
and ebp, edi
and edi, 0xf
or edi, ebx
xor edi, ebp
xor eax, dword [edi*4 + 0x38f80c]
inc esi
cmp edx, esi
jne 0x352b90
not eax
jmp 0x352bca
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x357c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x357c5b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x357c63
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x357cfb
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x357ca9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x357d0a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x357cbe
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x357cd0
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x357c90
jmp 0x357cd9
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x357c90
cmp edi, ebx
jge 0x357cf0
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x357c94
jmp 0x357cf4
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x357c9d
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x357d92
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x357d92
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x357d44
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x357d30
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x357d92
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x357d50
dec eax
mov ecx, 1
xor esi, esi
jmp 0x357dac
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x357c5b
test edx, edx
mov dword [esp], ecx
js 0x357de0
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x357df0
inc ebp
dec edx
cmp edi, ebp
jne 0x357dc0
mov edx, 0xffffffff
jmp 0x357df2
xor edi, edi
jmp 0x357df5
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x357da0
and ebp, 3
je 0x357e28
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x357e10
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x357e2a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x357da0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x357e40
jmp 0x357da0
Function at 0x358990
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x3589f5
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x3589b0
mov eax, 0x270
jmp 0x358acf
cmp eax, 0x4e0
jb 0x358acf
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x358a10
mov esi, dword [ecx + 0xd50]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0xd54]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 4]
xor edi, edx
mov dword [ecx + eax*4 + 0x390], edi
inc eax
cmp eax, 0x18c
jne 0x358a60
mov eax, dword [ecx + 4]
mov esi, eax
and esi, 0x7ffffffe
mov edx, 0x80000000
and edx, dword [ecx + 0x1380]
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
ret
Function at 0x36b020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x20], 0xbf14bd53
mov dword [esp + 0x24], 0x832d8133
mov dword [esp + 0x28], 0x8786852a
mov eax, 0xff5cd55c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xa32ac4]
xor ecx, eax
mov edx, ecx
not edx
and edx, 0xe5
and ecx, 0x1a
sub ecx, edx
add cl, 5
mov byte [esp + eax + 0xa32ac4], cl
inc eax
cmp eax, 0xff5cd568
jne 0x36b060
mov dword [esp + 0x48], 0x61f47fd6
mov dword [esp + 0x4c], 0x65f463f6
mov dword [esp + 0x50], 0x698767bc
mov dword [esp + 0x54], 0x6dc06b85
mov dword [esp + 0x58], 0x51f36fc1
mov dword [esp + 0x5c], 0x55f853f3
mov dword [esp + 0x60], 0x59f757fe
mov dword [esp + 0x64], 0x5dc85bc9
mov dword [esp + 0x68], 0x41405f84
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe
xor cl, byte [esp + eax + 0x48]
add cl, 0x90
mov byte [esp + eax + 0x48], cl
inc eax
cmp eax, 0x24
jne 0x36b0e0
movzx ecx, word [esp + 0x48]
lea eax, [esp + 0x15c]
test cx, cx
je 0x36b121
lea edx, [esp + 0x4a]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x36b110
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0x36b151
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x36b140
mov word [eax], 0
movzx ecx, word [esp + 0x20]
test cx, cx
je 0x36b181
lea edx, [esp + 0x22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x36b170
mov word [eax], 0
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 0x48], 0x6f6c6c82
mov byte [esp + 0x4c], 0x8c
mov eax, 0xc8
mov ecx, 0xf6d85a37
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x80]
mov edi, eax
xor edi, ecx
and edi, edx
xor edi, ecx
mov edx, 0xbe
sub edx, edi
lea esi, [edi + 0x493d2e41]
or esi, 1
sub esi, edi
lea ebx, [esi - 0x493d2e41]
neg esi
and esi, 2
mov edi, ebx
and edi, 0xfd
imul edi, esi
mov esi, ebx
and esi, 2
or ebx, 2
imul ebx, esi
xor edx, 1
add edx, edi
add edx, ebx
mov byte [esp + eax - 0x80], dl
inc eax
dec ecx
cmp eax, 0xcd
jne 0x36b1b0
movzx eax, byte [esp + 0x48]
test al, al
je 0x36b22d
lea ecx, [esp + 0x49]
mov edi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x36b220
jmp 0x36b231
mov edi, dword [esp + 4]
mov byte [edi], 0
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x150]
lea edx, [esp + 0x38]
lea esi, [esp + 0x15c]
push eax
push ecx
push edx
push esi
call fcn.0035ae40
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x393794]
mov ecx, 0xae6ce794
xor ecx, dword [0x39379c]
add eax, ecx
inc eax
jmp eax