joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002d9b1
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x10080060]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x144], 0
push esi
push edi
push 0x3f
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x4b]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x4c], 0
call fcn.10035590
lea edi, [ebp - 0x4c]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsw word es:[edi], word [esi]
xor eax, eax
mov cl, byte [ebp + eax - 0x4c]
mov dl, cl
xor dl, 0x36
xor cl, 0x5c
mov byte [ebp + eax - 0x8c], dl
mov byte [ebp + eax - 0xcc], cl
inc eax
cmp eax, 0x40
jb 0x1002d9f4
lea eax, [ebp - 0x13c]
call fcn.1002f53a
lea eax, [ebp - 0x8c]
push 0x40
push eax
lea eax, [ebp - 0x13c]
call fcn.1002f57e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1002f57e
lea edi, [ebp - 0x6c]
call fcn.1002f5bc
lea eax, [ebp - 0x13c]
call fcn.1002f53a
lea eax, [ebp - 0xcc]
push 0x40
push eax
lea eax, [ebp - 0x13c]
call fcn.1002f57e
mov eax, edi
push 0x20
push eax
lea eax, [ebp - 0x13c]
call fcn.1002f57e
add esp, 0x20
lea edi, [ebp - 0x2c]
call fcn.1002f5bc
mov esi, dword [ebp - 0x140]
push 0x20
mov eax, edi
push eax
call fcn.1001b999
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10033d61
leave
ret

Function at 0x1002dec2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x1002dedc
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x1002ded8
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002dff9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10080060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.1002e1bf
mov bl, al
mov al, dl
call fcn.1002e1bf
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.1002e1bf
mov bl, al
mov al, byte [esi - 4]
call fcn.1002e1bf
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.1002e1bf
mov bl, al
mov al, byte [esi]
call fcn.1002e1bf
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.1002e1bf
mov bl, al
mov al, byte [esi - 0xc]
call fcn.1002e1bf
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x1002e021
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10033d61
leave
ret 4
Function at 0x1002e0ae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10080060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.1002e23b
push ebx
mov dl, al
call fcn.1002e214
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.1002e1cf
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.1002e1ed
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.1002e1cf
push ebx
mov byte [ebp - 0x15], al
call fcn.1002e1ed
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.1002e214
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.1002e23b
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.1002e214
mov bl, al
mov al, byte [edi + 4]
call fcn.1002e23b
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.1002e1ed
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.1002e1cf
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.1002e1ed
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.1002e1cf
xor bl, al
mov al, dl
call fcn.1002e23b
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.1002e214
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x1002e0da
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10033d61
leave
ret 4
Function at 0x1002e72d
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x1004bb13
call fcn.100352ea
mov ebx, ecx
mov eax, dword [ebp + 8]
and dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x14]
mov esi, edx
mov dword [ebp - 0x34], esi
test al, 0xf
je 0x1002e762
push 0x10053b0f
mov ecx, esi
call fcn.10002c0b
jmp 0x1002e882
push 0
mov edi, eax
lea esi, [ebp - 0x2c]
call fcn.10023cc3
and dword [ebp - 4], 0
cmp dword [ebx + 0x18], 0x10
mov eax, dword [ebx + 0x14]
jb 0x1002e780
mov ebx, dword [ebx + 4]
jmp 0x1002e783
add ebx, 4
cmp dword [ebp - 0x14], 0x10
mov esi, dword [ebp - 0x28]
jae 0x1002e78f
lea esi, [ebp - 0x28]
mov edi, dword [ebp + 0xc]
cmp eax, 0x10
jb 0x1002e7da
shr eax, 4
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x3c]
cmp dword [edx + 0x18], 0x10
mov ecx, dword [edx + 0x14]
lea eax, [edx + 4]
jb 0x1002e7ae
mov eax, dword [eax]
push 0
push eax
push esi
push ebx
call fcn.1002e410
add esp, 0x10
mov ecx, edi
push 0x10
mov eax, esi
sub ecx, esi
pop edi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec edi
jne 0x1002e7c4
mov edi, ebx
add ebx, 0x10
add esi, 0x10
dec dword [ebp - 0x38]
jne 0x1002e79d
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jae 0x1002e803
mov ecx, dword [ebp - 0x34]
push 0x10053b0f
call fcn.10002c0b
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10003081
mov eax, dword [ebp - 0x34]
jmp 0x1002e884
lea esi, [eax - 1]
cmp eax, esi
ja 0x1002e812
call fcn.10033d29
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [ebp - 0x28]
jae 0x1002e81e
lea ecx, [ebp - 0x28]
mov bl, byte [ecx + esi]
cmp bl, 0x10
ja 0x1002e7e2
mov byte [ebp - 0x2d], 0
test bl, bl
jbe 0x1002e862
movzx edi, bl
movzx ecx, byte [ebp - 0x2d]
mov esi, eax
sub esi, ecx
dec esi
cmp eax, esi
ja 0x1002e846
call fcn.10033d29
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [ebp - 0x28]
jae 0x1002e852
lea ecx, [ebp - 0x28]
movsx ecx, byte [ecx + esi]
cmp ecx, edi
jne 0x1002e7e2
inc byte [ebp - 0x2d]
cmp byte [ebp - 0x2d], bl
jb 0x1002e831
mov esi, dword [ebp - 0x34]
movzx ecx, bl
sub eax, ecx
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.10002c7b
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10003081
mov eax, esi
call fcn.1003536d
ret
Function at 0x1002ea0e
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x1004bae6
call fcn.100352ea
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, edi
mov dword [ebp - 0x30], esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002ea2d
sub eax, ecx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.100034bf
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x30], 0
mov dword [ebp - 4], esi
jbe 0x1002eb32
jmp 0x1002ea5e
mov edi, dword [ebp + 0xc]
movsx eax, byte [esi + edi]
mov al, byte [eax + 0x10057e10]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x1002ea72
cmp al, 0xff
je 0x1002ea5e
cmp al, 0xff
je 0x1002eb32
movsx ecx, byte [esi + edi]
mov cl, byte [ecx + 0x10057e10]
inc esi
mov byte [ebp - 0x32], cl
cmp esi, dword [ebp - 0x30]
jae 0x1002ea92
cmp cl, 0xff
je 0x1002ea7a
cmp cl, 0xff
je 0x1002eb32
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.1001bc73
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x1002eb32
movsx eax, al
mov al, byte [eax + 0x10057e10]
mov byte [ebp - 0x31], al
cmp esi, dword [ebp - 0x30]
jae 0x1002ead2
cmp al, 0xff
je 0x1002eab2
cmp al, 0xff
je 0x1002eb32
mov cl, al
mov al, byte [ebp - 0x32]
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.1001bc73
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x1002eb32
movsx eax, al
mov cl, byte [eax + 0x10057e10]
cmp esi, dword [ebp - 0x30]
jae 0x1002eb10
cmp cl, 0xff
je 0x1002eaf2
cmp cl, 0xff
je 0x1002eb32
mov al, byte [ebp - 0x31]
shl al, 6
or al, cl
movzx eax, al
push eax
lea edi, [ebp - 0x2c]
call fcn.1001bc73
cmp esi, dword [ebp - 0x30]
jb 0x1002ea5b
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.10002c2d
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.10003081
mov eax, dword [ebp - 0x38]
call fcn.1003536d
ret

Function at 0x1002f265
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x1002f394
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
xor edx, edx
inc ecx
push edi
movzx esi, byte [ecx - 1]
movzx edi, byte [ecx]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 2]
shl esi, 8
or esi, edi
mov dword [ebp + edx*4 - 0x120], esi
inc edx
add ecx, 4
cmp edx, 0x10
jb 0x1002f3a3
push 0x40
pop esi
cmp edx, esi
jae 0x1002f41e
sub esi, edx
lea ecx, [ebp + edx*4 - 0x128]
mov dword [ebp - 4], esi
mov esi, dword [ecx]
mov edx, dword [ecx - 0x34]
mov edi, esi
rol edi, 0xf
mov ebx, esi
shr esi, 0xa
rol ebx, 0xd
xor edi, ebx
xor edi, esi
mov esi, edx
rol esi, 0xe
mov ebx, edx
ror ebx, 7
xor esi, ebx
shr edx, 3
xor esi, edx
add edi, esi
add edi, dword [ecx - 0x38]
add ecx, 4
add edi, dword [ecx - 0x18]
dec dword [ebp - 4]
mov dword [ecx + 4], edi
jne 0x1002f3e4
mov ecx, dword [eax + 0x54]
mov edi, dword [eax + 0x50]
mov ebx, dword [eax + 0x68]
mov esi, dword [eax + 0x60]
and dword [ebp - 0x14], 0
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 0x58]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x5c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 0x64]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 0x6c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ecx
mov ecx, esi
ror ecx, 0xb
mov edx, esi
rol edx, 7
xor ecx, edx
mov edx, esi
ror edx, 6
xor ecx, edx
mov edx, esi
not edx
and edx, ebx
mov ebx, dword [ebp - 0x10]
and ebx, esi
xor edx, ebx
add ecx, edx
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + 0x10057cc8]
mov ebx, edi
add ecx, dword [ebp + edx - 0x120]
mov edx, edi
add ecx, dword [ebp - 4]
ror edx, 0xd
rol ebx, 0xa
xor edx, ebx
mov ebx, edi
add dword [ebp - 0x14], 4
ror ebx, 2
xor edx, ebx
mov ebx, dword [ebp - 8]
xor ebx, edi
and ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
and edi, dword [ebp - 0x18]
xor ebx, edi
mov edi, dword [ebp - 0x20]
add edx, ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 8], edi
add esi, ecx
cmp dword [ebp - 0x14], 0x100
lea edi, [edx + ecx]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
jb 0x1002f44f
mov ecx, dword [eax + 0x50]
mov edx, dword [ebp - 8]
add ecx, edi
mov dword [eax + 0x50], ecx
mov ecx, dword [eax + 0x54]
add ecx, edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x54], ecx
mov ecx, dword [eax + 0x58]
add ecx, edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x58], ecx
mov ecx, dword [eax + 0x5c]
add ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x5c], ecx
mov ecx, dword [eax + 0x60]
add ecx, esi
mov dword [eax + 0x60], ecx
mov ecx, dword [eax + 0x64]
add ecx, edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x64], ecx
mov ecx, dword [eax + 0x68]
add ecx, ebx
mov dword [eax + 0x68], ecx
mov ecx, dword [eax + 0x6c]
pop edi
add ecx, edx
pop esi
mov dword [eax + 0x6c], ecx
pop ebx
leave
ret
Function at 0x10033d61
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10080060]
jne 0x10033d6b
repz ret
jmp fcn.1003538b

Function at 0x1003b4c4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1003567c
and dword [ebp - 4], 0
cmp dword [0x1008788c], 0
mov ebx, eax
jne 0x1003b575
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1003b626
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1003b626
push eax
call fcn.1003560a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1008788c], eax
call esi
push eax
call fcn.1003560a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10087890], eax
call esi
push eax
call fcn.1003560a
mov dword [esp], 0x10051e58
push edi
mov dword [0x10087894], eax
call esi
push eax
call fcn.1003560a
pop ecx
mov dword [0x1008789c], eax
test eax, eax
je 0x1003b575
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1003560a
pop ecx
mov dword [0x10087898], eax
mov eax, dword [0x10087898]
cmp eax, ebx
je 0x1003b5cd
cmp dword [0x1008789c], ebx
je 0x1003b5cd
push eax
call fcn.10035685
push dword [0x1008789c]
mov esi, eax
call fcn.10035685
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1003b5cd
test edi, edi
je 0x1003b5cd
call esi
test eax, eax
je 0x1003b5c4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1003b5c4
test byte [ebp - 0xc], 1
jne 0x1003b5cd
or dword [ebp + 0x10], 0x200000
jmp 0x1003b606
mov eax, dword [0x10087890]
cmp eax, ebx
je 0x1003b606
push eax
call fcn.10035685
pop ecx
test eax, eax
je 0x1003b606
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1003b606
mov eax, dword [0x10087894]
cmp eax, ebx
je 0x1003b606
push eax
call fcn.10035685
pop ecx
test eax, eax
je 0x1003b606
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1008788c]
call fcn.10035685
pop ecx
test eax, eax
je 0x1003b626
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1003b628
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415b90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
jmp 0x415baa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x415bb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x415ba0
mov eax, 1
add ebx, ebx
jne 0x415bc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x415bb8
jne 0x415bd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415bb8
xor ecx, ecx
sub eax, 3
jb 0x415be8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x415c5a
mov ebp, eax
add ebx, ebx
jne 0x415bf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x415c00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x415c24
inc ecx
add ebx, ebx
jne 0x415c10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x415c05
jne 0x415c21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415c05
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x415c44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x415c35
jmp 0x415ba6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x415c44
add edi, ecx
jmp 0x415ba6
pop esi
mov edi, esi
mov ecx, 0x128
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x415c62
cmp byte [edi], 2
jne 0x415c62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x415c67
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x415cd6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x155f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15670]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x415c94
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15678]
or eax, eax
je 0x415cd0
mov dword [ebx], eax
add ebx, 4
jmp 0x415cb1
call dword [esi + 0x15674]
mov ebp, dword [esi + 0x1567c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x415d0a
sub esp, 0xffffff80
jmp 0x4059d0

Function at 0x43b639
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
sub esi, 0x4bd1dbe1
mov esi, esi
sub ecx, 0x6ac5c92f
call fcn.0043b66f
mov ecx, ecx
xor dword [eax], edi
sub esi, esi
inc eax
mov ecx, ecx
sub esi, 0x5ba4b6f7
cmp eax, edx
jne fcn.0043b639
add esi, ecx
add ecx, ecx
ret
Function at 0x83646a
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
xor ebx, ebx
push esi
xor ecx, ecx
inc ebx
push edi
mov eax, ebx
mov esi, 0xff
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea edi, [eax + eax]
xor edx, edi
mov dword [ebp + ecx*4 - 0x80c], eax
mov dword [ebp + eax*4 - 0x40c], ecx
xor eax, edx
and eax, esi
inc ecx
cmp ecx, 0x100
jl 0x836482
mov eax, ebx
mov ecx, 0x83bd48
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov dword [ecx], eax
add eax, eax
and edx, 0x1b
xor eax, edx
add ecx, 4
and eax, esi
cmp ecx, 0x83bd70
jl 0x8364b8
mov byte [0x83b448], 0x63
mov byte [0x83d5d3], 0
mov eax, dword [ebp + ebx*4 - 0x40c]
shl eax, 2
lea ecx, [ebp - 0x410]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, esi
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, esi
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, esi
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, esi
xor eax, edx
mov byte [ebx + 0x83b448], al
mov byte [eax + 0x83d570], bl
inc ebx
cmp ebx, 0x100
jl 0x8364e8
xor edi, edi
movzx edx, byte [edi + 0x83b448]
mov eax, edx
and al, 0x80
movsx ecx, al
neg ecx
sbb ecx, ecx
and ecx, 0x1b
lea eax, [edx + edx]
xor ecx, eax
and ecx, esi
mov eax, ecx
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, ecx
mov ecx, edi
mov dword [ecx*4 + 0x83d170], eax
rol eax, 8
mov dword [ecx*4 + 0x83cd70], eax
rol eax, 8
mov dword [ecx*4 + 0x83c970], eax
rol eax, 8
mov dword [ecx*4 + 0x83c570], eax
movzx eax, byte [edi + 0x83d570]
test eax, eax
je 0x8365ca
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3d4]
mov ebx, esi
cdq
idiv ebx
mov eax, dword [ebp + edx*4 - 0x80c]
mov dword [ebp - 4], eax
jmp 0x8365ce
and dword [ebp - 4], 0
movzx eax, byte [edi + 0x83d570]
test eax, eax
je 0x8365f7
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3e8]
mov ebx, esi
cdq
idiv ebx
mov eax, dword [ebp + edx*4 - 0x80c]
mov dword [ebp - 0xc], eax
jmp 0x8365fb
and dword [ebp - 0xc], 0
movzx eax, byte [edi + 0x83d570]
test eax, eax
je 0x836624
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3d8]
mov ebx, esi
cdq
idiv ebx
mov eax, dword [ebp + edx*4 - 0x80c]
mov dword [ebp - 8], eax
jmp 0x836628
and dword [ebp - 8], 0
movzx eax, byte [edi + 0x83d570]
test eax, eax
je 0x83664e
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3e0]
mov ebx, esi
cdq
idiv ebx
mov edx, dword [ebp + edx*4 - 0x80c]
jmp 0x836650
xor edx, edx
shl edx, 8
xor edx, dword [ebp - 8]
shl edx, 8
xor edx, dword [ebp - 0xc]
shl edx, 8
xor edx, dword [ebp - 4]
inc edi
mov dword [ecx*4 + 0x83c170], edx
rol edx, 8
mov eax, edx
mov dword [ecx*4 + 0x83bd70], eax
rol eax, 8
mov dword [ecx*4 + 0x83b948], eax
rol eax, 8
mov dword [ecx*4 + 0x83b548], eax
cmp edi, 0x100
jl 0x83654b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x8368ee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push esi
push edi
push 0x128
lea eax, [ebp - 0x134]
push 0
push eax
call fcn.00838fa9
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
lea eax, [ebp - 0x134]
lea ebx, [esi + 0x18]
push eax
mov dword [esi + 4], ebx
call fcn.0083669b
add esp, 0x18
mov dword [ebp - 8], eax
test eax, eax
jne 0x8369fc
mov ecx, dword [ebp - 0x134]
mov dword [esi], ecx
lea edi, [esi + 8]
lea esi, [ebp - 0x12c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
shl ecx, 4
add ecx, dword [ebp - 0x130]
push 4
mov eax, dword [ecx]
mov dword [ebx], eax
pop esi
add ecx, esi
mov eax, dword [ecx]
add ebx, esi
mov dword [ebx], eax
add ecx, esi
mov eax, dword [ecx]
add ebx, esi
mov dword [ebx], eax
add ecx, esi
mov eax, dword [ecx]
add ebx, esi
mov dword [ebx], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
add ebx, esi
dec edx
sub ecx, 0x1c
jmp 0x8369de
mov dword [ebp + 8], esi
movzx eax, byte [ecx + 3]
movzx eax, byte [eax + 0x83b448]
movzx edi, byte [ecx + 2]
movzx edi, byte [edi + 0x83b448]
mov eax, dword [eax*4 + 0x83b548]
xor eax, dword [edi*4 + 0x83b948]
movzx edi, byte [ecx + 1]
movzx edi, byte [edi + 0x83b448]
xor eax, dword [edi*4 + 0x83bd70]
mov edi, dword [ecx]
and edi, 0xff
movzx edi, byte [edi + 0x83b448]
xor eax, dword [edi*4 + 0x83c170]
add ecx, esi
mov dword [ebx], eax
add ebx, esi
dec dword [ebp + 8]
jne 0x836983
dec edx
sub ecx, 0x20
test edx, edx
jg 0x836980
mov eax, dword [ecx]
mov dword [ebx], eax
add ebx, esi
add ecx, esi
mov eax, dword [ecx]
mov dword [ebx], eax
mov eax, dword [ecx + esi]
mov dword [ebx + esi], eax
mov eax, dword [ecx + esi + 4]
mov dword [ebx + esi + 4], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret