joyce8/EMBER2024-capa huggingface dataset:
Function at 0x836201
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00822070
mov eax, dword [0x8e31bc]
xor eax, dword [ebp + 4]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0082b912
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x83632b
push 2
push esi
push dword [ebp + 8]
call fcn.0082b912
add esp, 0xc
cmp eax, ebx
je 0x83632b
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x8362ce
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x100c]
push esi
push eax
call fcn.0082d4c0
push 0x8000
push dword [ebp + 8]
call fcn.008369f1
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp edi, ebx
mov eax, ebx
jge 0x836287
mov eax, edi
push eax
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.0082b6c2
add esp, 0xc
cmp eax, 0xffffffff
je 0x8362a7
sub edi, eax
test edi, edi
jg 0x83627f
jmp 0x8362bf
call fcn.0082b18a
cmp dword [eax], 5
jne 0x8362bc
call fcn.0082b181
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.008369f1
pop ecx
pop ecx
jmp 0x836316
jge 0x836316
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0082b912
push dword [ebp + 8]
call fcn.00833d2c
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x836316
call fcn.0082b181
mov dword [eax], 0xd
call fcn.0082b18a
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0082b912
add esp, 0xc
mov eax, esi
pop edi
jmp 0x83632d
mov eax, ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.0082aad4
leave
ret
Function at 0x836712
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x88ded8
call fcn.008286e0
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0xc9b0a0], edi
jne 0x836756
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x836741
mov dword [0xc9b0a0], ebx
jmp 0x836756
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x836756
mov dword [0xc9b0a0], 2
mov eax, dword [0xc9b0a0]
cmp eax, ebx
jne 0x836776
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x836839
cmp eax, 2
je 0x83677f
cmp eax, edi
jne 0x8367a7
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
cmp dword [ebp + 0x18], edi
jne 0x836792
mov eax, dword [0xc9af40]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x24], eax
cmp eax, edi
jne 0x8367ae
xor eax, eax
jmp 0x836839
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.00822070
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x8367e1
cmp esi, edi
jne 0x8367f7
push dword [ebp - 0x24]
call fcn.00824257
pop ecx
mov esi, eax
cmp esi, edi
je 0x8367a7
mov dword [ebp - 0x20], ebx
push dword [ebp - 0x24]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x83682a
cmp dword [ebp + 0x14], edi
jne 0x836814
push edi
push edi
jmp 0x83681a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], edi
je 0x836836
push esi
call fcn.0082413f
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.0082871b
ret
Function at 0x836842
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x88dee8
call fcn.008286e0
xor esi, esi
cmp dword [0xc9b0a4], esi
jne 0x836886
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x836871
mov dword [0xc9b0a4], edi
jmp 0x836886
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x836886
mov dword [0xc9b0a4], 2
mov eax, dword [0xc9b0a4]
cmp eax, 2
je 0x836967
cmp eax, esi
je 0x836967
cmp eax, 1
jne 0x8368cb
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x8368b4
mov eax, dword [0xc9af40]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x8368d2
xor eax, eax
jmp 0x836979
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.00822070
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x836908
cmp edi, esi
jne 0x836923
lea eax, [ebx + ebx]
push eax
call fcn.00824257
pop ecx
mov edi, eax
cmp edi, esi
je 0x8368cb
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x836956
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x836940
push esi
push esi
jmp 0x836946
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x836962
push edi
call fcn.0082413f
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x836979
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.0082871b
ret
Function at 0x836da3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x8e31bc]
xor eax, dword [ebp + 4]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x836e1e
push ebx
call fcn.00836d6c
test eax, eax
pop ecx
jne 0x836df0
call fcn.0082b18a
mov dword [eax], 0xf
call fcn.0082b181
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop ebx
call fcn.0082aad4
leave
ret
and byte [ebp + 0xb], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x836e30
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x836de0
inc eax
cmp eax, 0x104
ja 0x836de0
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x836e68
cmp eax, dword [ebp + 0x10]
jg 0x836e4b
mov eax, dword [ebp + 0x10]
push eax
call fcn.00824257
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x836e7d
call fcn.0082b181
mov dword [eax], 0xc
jmp 0x836de0
cmp eax, dword [ebp + 0x10]
jle 0x836e7d
call fcn.0082b181
mov dword [eax], 0x22
jmp 0x836de0
lea eax, [ebp - 0x10c]
push eax
push ecx
call fcn.00826590
pop ecx
pop ecx
jmp 0x836de2

Function at 0xcb73e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
push dword [esp + 0x28]
push dword [esp + 0x28]
call dword [fcn.01422ea0]
add esp, 8
push ss
pop ss
pushfd
mov edx, dword [esp]
shl edx, 0x17
shr edx, 0x1f
imul edx, edx, 0x28
add eax, edx
popfd
mov dword [esp + 0x1c], eax
popal
ret 8

Function at 0xcb79a0
Capabilities:
Encode data using xor

Disassembly:
push 0x104a
jae 0xcb79b7
add dword [esp], 0xc28264
add dword [esp], 0x8e7c3
jmp 0xcb79b1
ret
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xcb79c8
mov ecx, 0x7be
xor eax, eax
je 0xcb79cd
call 0x171bd26e
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xcb79e0
mov ecx, 0x7be
xor eax, eax
je 0xcb79e5
call 0x171bd286
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xcb79f8
mov ecx, 0x7be
xor eax, eax
je 0xcb79fd
call 0xed4ed29e
and al, 0xc7
inc esp
and al, 0x20
out dx, eax
pop ecx
lds ebp, [ebx]
popfd
pop eax
sub esp, 0x24
mov dword [esp + 0x20], 0x2bc559ef
mov dword [esp + 0x1c], 0x20079
mov dword [esp + 0x18], ecx
mov ecx, 0xcb7984
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ecx
xor ecx, ecx
lea eax, [eax]
mov edx, dword [esp + 0x20]
mov edx, dword [edx]
xchg edi, edi
xor ecx, edx
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0xcb7a27
clc
sbb ecx, 0xb36
lea edi, [edi]
jbe 0xcb7a53
mov edi, edi
mov esp, 0
jmp esp
mov eax, eax
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add esp, 0x24
add dword [esp], 0xbef662
add dword [esp], 0xc77c3
jmp 0xcb7a6a
ret
Function at 0xcbd166
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xae
push dword [esp]
sub dword [esp], 0xad
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xcbd190
mov ecx, 0x7be
xor eax, eax
je 0xcbd195
call 0x171c2a36
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xcbd1a8
mov ecx, 0x7be
xor eax, eax
je 0xcbd1ad
call 0xed4f2a4e
sbb bh, al
inc esp
and al, 0x14
sub bl, byte [ecx - 0x66]
lcall 0x68, 0x102444c7
add al, byte [eax]
popfd
pop eax
sub esp, 0x18
mov dword [esp + 0x14], 0x9a9a592a
mov dword [esp + 0x10], 0x20068
mov dword [esp + 0xc], eax
mov eax, 0xcbd134
mov dword [esp + 8], ecx
nop
mov dword [esp + 0x14], eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov edi, edi
mov ecx, dword [ecx]
xor eax, ecx
nop
add dword [esp + 0x14], 4
nop
dec word [esp + 0x10]
jne 0xcbd1d6
nop
nop
mov ecx, dword [esp + 8]
add ebx, eax
mov eax, dword [esp + 0xc]
add esp, 0x18
xchg edi, edi
xchg dword [esp], ebx
mov dword [esp + 4], 0x9f0004c2
jmp 0xcbd206
ret 4

Function at 0xcbe17c
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xa9
push dword [esp]
sub dword [esp], 0xa7
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xcbe1a6
mov ecx, 0x7be
xor eax, eax
je 0xcbe1ab
call 0x171c3a4c
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xcbe1be
mov ecx, 0x7be
xor eax, eax
je 0xcbe1c3
call 0xed4f3a64
and bh, al
inc esp
and al, 0x1c
stosb byte es:[edi], al
xchg ebp, eax
rol bh, 1
inc esp
and al, 0x18
xor byte [eax], al
add al, byte [eax]
popfd
pop eax
sub esp, 0x20
mov dword [esp + 0x1c], 0xd0953eaa
mov dword [esp + 0x18], 0x20030
mov dword [esp + 0x14], edi
mov edi, 0xcbe14c
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], edi
nop
xor edi, edi
mov ebp, dword [esp + 0x1c]
mov ebp, dword [ebp]
lea edi, [edi]
xor edi, ebp
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
nop
jne 0xcbe1ec
mov ebp, dword [esp + 0x10]
add edx, edi
mov edi, dword [esp + 0x14]
add esp, 0x20
xchg dword [esp], edx
mov dword [esp + 4], 0xbc0004c2
jmp 0xcbe218
ret 4
Function at 0xd52af7
Capabilities:
Encode data using xor

Disassembly:
jae 0xd52ace
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
sub esp, 4
mov dword [esp], ecx
mov dword [ebp - 4], ecx
mov ecx, 0xfff562d9
mov ecx, dword [ecx + ebp + 0xa9d23]
call fcn.00d52a8c
cmpsb byte [esi], byte es:[edi]
invalid
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
sub esp, 4
mov dword [esp], ecx
mov dword [ebp - 4], ecx
mov ecx, 0xfff7f3cf
mov ecx, dword [ecx + ebp + 0x80c2d]
call 0xd52af7
wait
pop esp
xlatb
push ds
aad 0
in al, 0x81
add al, 0x24
test eax, 0xff000000
xor al, 0x24
sub dword [esp], 0xa7
push dword [esp]
xchg dword [esp], ebx
mov ebx, dword [ebx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xd52b21
mov ecx, 0x7be
xor eax, eax
je 0xd52b26
call 0x172583c7
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xd52b39
mov ecx, 0x7be
xor eax, eax
je 0xd52b3e
call 0xed5883df
sbb bh, al
inc esp
and al, 0x14
mov eax, 0xc75c92cd
inc esp
and al, 0x10
cmp byte [eax], al
add al, byte [eax]
popfd
pop eax
sub esp, 0x18
mov dword [esp + 0x14], 0x5c92cdb8
mov dword [esp + 0x10], 0x20038
mov dword [esp + 0xc], ecx
mov ecx, 0xd52ac4
mov dword [esp + 8], esi
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov esi, dword [esp + 0x14]
nop
mov esi, dword [esi]
xor ecx, esi
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0xd52b66
mov esi, dword [esp + 8]
add ebx, ecx
nop
mov ecx, dword [esp + 0xc]
nop
add esp, 0x18
nop
xchg dword [esp], ebx
mov dword [esp + 4], 0x4b0004c2
jmp 0xd52b92
ret 4
Function at 0xd52ece
Capabilities:
Encode data using xor

Disassembly:
js 0xd52e31
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x12b0610
mov eax, dword fs:[0]
sub esp, 4
mov dword [esp], eax
mov dword fs:[0], esp
sub esp, 4
mov dword [esp], 0x157
xor dword [esp], 0x113
sub esp, dword [esp]
mov dword [ebp - 0x54], ecx
push 0x15393b4
mov ecx, 0xfff8fe55
lea ecx, [ecx + ebp + 0x7015b]
call fcn.00cc1420
mov dword [ebp - 4], 0
mov eax, 0xfffc7fe3
lea eax, [eax + ebp + 0x37fcd]
sub esp, 4
mov dword [esp], eax
mov ecx, 0xffffec03
lea ecx, [ecx + ebp + 0x13c9]
call fcn.00cc0f70
push 0x154f4a4
mov ecx, 0xfff43d91
lea ecx, [ecx + ebp + 0xbc23b]
sub esp, 4
mov dword [esp], ecx
call 0xd52d43
clc
test bl, dh
mov byte [0x15240115], al
add dword [esp], 0x34
push dword [esp]
sub dword [esp], 0x32
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
add edx, 0x1adb
xchg dword [esp], edx
mov dword [esp + 4], 0xf90004c2
jmp 0xd52d69
ret 4
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x12b0610
mov eax, dword fs:[0]
sub esp, 4
mov dword [esp], eax
mov dword fs:[0], esp
sub esp, 4
mov dword [esp], 0x14d
xor dword [esp], 0x109
dec ebp
add dword [eax], eax
add byte [ecx + 0x1092434], al
add byte [eax], al
sub esp, dword [esp]
mov dword [ebp - 0x54], ecx
push 0x15393b4
mov ecx, 0xfffb2aaf
lea ecx, [ecx + ebp + 0x4d501]
call fcn.00cc1420
mov dword [ebp - 4], 0
mov eax, 0xfff98def
lea eax, [eax + ebp + 0x671c1]
sub esp, 4
mov dword [esp], eax
mov ecx, 0xfff57d27
lea ecx, [ecx + ebp + 0xa82a5]
call fcn.00cc0f70
push 0x154f4a4
mov ecx, 0xfff2549d
lea ecx, [ecx + ebp + 0xdab2f]
sub esp, 4
mov dword [esp], ecx
call 0xd52ece
cmpsb byte [esi], byte es:[edi]
loop 0xd52e59
adc eax, 0x70aee001
add dword [esp], 0xac
push dword [esp]
sub dword [esp], 0xab
push dword [esp]
xor al, 0x24
xchg dword [esp], ecx
mov ecx, dword [ecx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xd52ef8
mov ecx, 0x7be
xor eax, eax
je 0xd52efd
call 0x1725879e
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xd52f10
mov ecx, 0x7be
xor eax, eax
je 0xd52f15
call 0xed5887b6
sbb al, 0xc7
inc esp
and al, 0x18
cwde
jae 0xd52ee0
popfd
pop eax
sub esp, 0x1c
mov dword [esp + 0x18], 0xf8bf7398
clc
mov dword [esp + 0x14], 0x20036
mov dword [esp + 0x10], edi
mov edi, 0xd52e9c
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], edi
xor edi, edi
lea eax, [eax]
mov ebx, dword [esp + 0x18]
mov ebx, dword [ebx]
xor edi, ebx
nop
add dword [esp + 0x18], 4
nop
dec word [esp + 0x14]
jne 0xd52f3d
mov ebx, dword [esp + 0xc]
nop
add ecx, edi
mov edi, dword [esp + 0x10]
nop
add esp, 0x1c
xchg dword [esp], ecx
mov dword [esp + 4], 0x8c0004c2
jmp 0xd52f6b
ret 4
Function at 0xd53cb9
Capabilities:
Encode data using xor

Disassembly:
jg 0xd53c8d
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
mov eax, 0xffffe971
mov eax, dword [eax + ebp + 0x1697]
imul eax, eax, 0x138
sub esp, 4
mov dword [esp], eax
call fcn.00d53bc2
jmp 0x1eaf735
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
mov eax, 0xfff7c927
mov eax, dword [eax + ebp + 0x836e1]
imul eax, eax, 0x138
sub esp, 4
mov dword [esp], eax
call 0xd53cb9
movsd dword es:[edi], dword [esi]
fld xword [esi - 0x5c]
adc eax, 0x481de01
and al, 0xae
add byte [eax], al
add bh, bh
xor al, 0x24
sub dword [esp], 0xac
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xd53ce3
mov ecx, 0x7be
xor eax, eax
je 0xd53ce8
call 0x17259589
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xd53cfb
mov ecx, 0x7be
xor eax, eax
je 0xd53d00
call 0xed5895a1
and al, 0xc7
inc esp
and al, 0x20
mov ebx, 0xc7f304ca
inc esp
and al, 0x1c
dec edx
add byte [edx], al
add byte [ecx - 0x45e7dbac], cl
mov byte [edx*8 + 0x245c8900], bh
adc al, 0x89
push esp
and al, 0x20
popfd
pop eax
sub esp, 0x24
mov dword [esp + 0x20], 0xf304cabb
mov dword [esp + 0x1c], 0x2004a
mov dword [esp + 0x18], edx
mov edx, 0xd53c88
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], edx
nop
xor edx, edx
mov ebx, dword [esp + 0x20]
xchg edi, edi
mov ebx, dword [ebx]
xor edx, ebx
nop
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
mov edi, edi
jne 0xd53d29
nop
mov ebx, dword [esp + 0x14]
lea ecx, [ecx]
add eax, edx
mov edx, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], eax
mov dword [esp + 4], 0x60004c2
jmp 0xd53d59
ret 4
Function at 0xd66670
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xad
push dword [esp]
sub dword [esp], 0xab
push dword [esp]
xchg dword [esp], ebp
mov ebp, dword [ebp]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xd6669b
mov ecx, 0x7be
xor eax, eax
je 0xd666a0
call 0x1726bf41
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xd666b3
mov ecx, 0x7be
xor eax, eax
je 0xd666b8
call 0xed59bf59
sbb bh, al
inc esp
and al, 0x14
salc
test dword [ebx + 8], esp
popfd
pop eax
sub esp, 0x18
mov dword [esp + 0x14], 0x86385d6
mov dword [esp + 0x10], 0x20062
mov dword [esp + 0xc], ebx
mov ebx, 0xd66640
mov dword [esp + 8], esi
nop
mov dword [esp + 0x14], ebx
xor ebx, ebx
mov esi, dword [esp + 0x14]
nop
mov esi, dword [esi]
nop
xor ebx, esi
add dword [esp + 0x14], 4
dec word [esp + 0x10]
jne 0xd666e1
xchg ecx, ecx
mov esi, dword [esp + 8]
nop
add ebp, ebx
mov ebx, dword [esp + 0xc]
add esp, 0x18
xchg dword [esp], ebp
mov dword [esp + 4], 0xa20004c2
jmp 0xd6670e
ret 4

Function at 0xd6673a
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xa8
push dword [esp]
sub dword [esp], 0xa6
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xd66764
mov ecx, 0x7be
xor eax, eax
je 0xd66769
call 0x1726c00a
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xd6677c
mov ecx, 0x7be
xor eax, eax
je 0xd66781
call 0xed59c022
and al, 0xc7
inc esp
and al, 0x20
adc al, 0x87
cmp eax, 0x2444c72f
sbb al, 0x6c
add byte [edx], al
add byte [ecx - 0x44e7dba4], cl
or byte [edi - 0x2a], ah
add byte [ecx - 0x76ebdbb4], cl
pop esp
and al, 0x20
popfd
pop eax
sub esp, 0x24
mov dword [esp + 0x20], 0x2f3d8714
mov dword [esp + 0x1c], 0x2006c
mov dword [esp + 0x18], ebx
mov ebx, 0xd66708
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], ebx
xor ebx, ebx
nop
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx]
xor ebx, ecx
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0xd667a9
mov ebp, ebp
mov ecx, dword [esp + 0x14]
nop
add edx, ebx
mov ebx, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], edx
mov dword [esp + 4], 0xaa0004c2
jmp 0xd667d5
ret 4
Function at 0xe38e40
Capabilities:
Encode data using xor

Disassembly:
ret
and al, 4
ret 0xc
js 0xe38ecb
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
sub esp, 4
mov dword [esp], ecx
mov dword [ebp - 4], ecx
mov ecx, 0xfffb1cf1
mov ecx, dword [ecx + ebp + 0x4e30b]
sub esp, 4
mov dword [esp], ecx
mov ecx, 0xe1d10c50
shl ecx, 1
jae 0xe38e6c
xor ecx, 0xc3a218ac
add dword [esp], ecx
pop ecx
call 0xe38e89
mov al, byte [0x7d161f77]
jecxz 0xe38e86
jo 0xe38e1e
jne 0xe38e0b
add al, 0x24
aaa
add byte [eax], al
add bh, bh
xor al, 0x24
sub dword [esp], 0x34
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
add eax, 0x12da
xchg dword [esp], eax
mov dword [esp + 4], 0x9f0004c2
jmp 0xe38eae
ret 4
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xe38edc
mov ecx, 0x7be
xor eax, eax
je 0xe38ee1
call 0x1733e782
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xe38ef4
mov ecx, 0x7be
xor eax, eax
je 0xe38ef9
call 0x1733e79a
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xe38f0c
mov ecx, 0x7be
xor eax, eax
je 0xe38f11
call 0xed66e7b2
and al, 0xc7
inc esp
and al, 0x20
push ds
xchg ecx, eax
mov byte [0x2444c7ee], al
sbb al, 0x6d
add eax, 0x54890002
and al, 0x18
popfd
pop eax
sub esp, 0x24
mov dword [esp + 0x20], 0xeea2911e
mov dword [esp + 0x1c], 0x2056d
mov dword [esp + 0x18], edx
mov edx, 0xe38e98
mov dword [esp + 0x14], ebx
nop
mov dword [esp + 0x20], edx
xor edx, edx
nop
mov ebx, dword [esp + 0x20]
mov ebx, dword [ebx]
xor edx, ebx
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0xe38f3b
xor edx, 0x21e0d
cmp edx, 0x21567
je 0xe38f5e
ret
mov ebx, dword [esp + 0x14]
nop
mov edx, dword [esp + 0x18]
add esp, 0x24
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
sub esp, 4
mov dword [esp], ecx
mov dword [ebp - 4], ecx
mov ecx, 0xfffccf83
mov ecx, dword [ecx + ebp + 0x33079]
sub esp, 4
mov dword [esp], ecx
mov ecx, 0xe1d10035
shl ecx, 1
jae 0xe38f90
xor ecx, 0xc3a20066
add dword [esp], ecx
pop ecx
call 0xe38fac
aas
mov ah, 0x39
outsd dx, dword [esi]
jecxz 0xe38fa9
dec ebx
mov al, 0xf5
add dword [esp], 0x36
push dword [esp]
sub dword [esp], 0x34
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
add edi, 0x20b7
xchg dword [esp], edi
mov dword [esp + 4], 0xc40004c2
jmp 0xe38fd2
ret 4
Function at 0xe3ab96
Capabilities:
Encode data using xor

Disassembly:
jb 0xe3ac54
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
sub esp, 4
mov dword [esp], ecx
mov dword [ebp - 4], ecx
mov ecx, 0xfff49851
mov ecx, dword [ecx + ebp + 0xb67ab]
sub esp, 4
mov dword [esp], ecx
mov ecx, 0xe1d10d14
shl ecx, 1
jae 0xe3ab7c
xor ecx, 0xc3a21a24
add dword [esp], ecx
pop ecx
call 0xe3ab96
push ebx
add ebx, 0xc100e357
add dword [esp], 0xb0
push dword [esp]
sub dword [esp], 0xae
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xe3abc0
mov ecx, 0x7be
xor eax, eax
je 0xe3abc5
call 0x17340466
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xe3abd8
mov ecx, 0x7be
xor eax, eax
je 0xe3abdd
call 0xed67047e
and al, 0xc7
inc esp
and al, 0x20
mov dword [0xc7e57556], eax
inc esp
and al, 0x1c
jns 0xe3abf0
popfd
pop eax
sub esp, 0x24
mov dword [esp + 0x20], 0xe57556a3
mov dword [esp + 0x1c], 0x20079
add al, byte [eax]
mov dword [esp + 0x18], ecx
mov ecx, 0xe3ab64
mov dword [esp + 0x14], ebp
nop
mov dword [esp + 0x20], ecx
nop
xor ecx, ecx
mov ebp, dword [esp + 0x20]
nop
mov ebp, dword [ebp]
xor ecx, ebp
add dword [esp + 0x20], 4
lea ecx, [ecx]
dec word [esp + 0x1c]
nop
jne 0xe3ac07
mov ebp, dword [esp + 0x14]
xchg ebx, ebx
add edi, ecx
nop
mov ecx, dword [esp + 0x18]
add esp, 0x24
xchg dword [esp], edi
mov dword [esp + 4], 0x5f0004c2
jmp 0xe3ac37
ret 4
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xe3ac65
mov ecx, 0x7be
xor eax, eax
je 0xe3ac6a
call 0x1734050b
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xe3ac7d
mov ecx, 0x7be
xor eax, eax
je 0xe3ac82
call 0x17340523
popfd
pop eax
push eax
push ss
pop ss
pushfd
mov eax, dword [esp]
test ah, 1
je 0xe3ac95
mov ecx, 0x7be
xor eax, eax
je 0xe3ac9a
call 0xed67053b
adc al, 0xc7
inc esp
and al, 0x10
sub dword [ebx + 0x44c75ce9], edi
and al, 0xc
int1
or byte [edx], al
add byte [ecx - 0x42f7db94], cl
and al, 0xac
jecxz 0xe3acb8
popfd
pop eax
sub esp, 0x14
mov dword [esp + 0x10], 0x5ce9bb29
mov dword [esp + 0xc], 0x208f1
mov dword [esp + 8], ebp
mov ebp, 0xe3ac24
mov dword [esp + 4], ecx
mov dword [esp + 0x10], ebp
nop
xor ebp, ebp
nop
mov ecx, dword [esp + 0x10]
mov edi, edi
mov ecx, dword [ecx]
xor ebp, ecx
add dword [esp + 0x10], 4
dec word [esp + 0xc]
jne 0xe3acc4
mov edi, edi
cmp ebp, 0x2c1
je 0xe3aceb
nop
add esp, 0x10
jmp ebx
mov ecx, dword [esp + 4]
nop
mov ebp, dword [esp + 8]
nop
add esp, 0x14
nop
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
sub esp, 4
mov dword [esp], ecx
mov dword [ebp - 4], ecx
mov ecx, 0xfffa2523
mov ecx, dword [ecx + ebp + 0x5dad9]
sub esp, 4
mov dword [esp], ecx
mov ecx, 0xe1d103f5
shl ecx, 1
jae 0xe3ad1f
xor ecx, 0xc3a207e6
add dword [esp], ecx
pop ecx
call 0xe3ad3a
call 0x1c717a2
je 0xe3ad1c
lodsb al, byte [esi]
add dword [esp], 0x35
push dword [esp]
sub dword [esp], 0x34
push dword [esp]
xchg dword [esp], edi
mov edi, dword [edi]
add edi, 0x2585
xchg dword [esp], edi
mov dword [esp + 4], 0xb10004c2
jmp 0xe3ad60
ret 4