joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b750
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov esi, dword [esp + 0x450]
mov dword [esp + 0x38], 0xe117e733
mov dword [esp + 0x3c], 0xfd19e36a
mov dword [esp + 0x40], 0xf90aff08
mov dword [esp + 0x44], 0xf5cbfb1b
mov dword [esp + 0x48], 0xf1c0f73b
mov dword [esp + 0x4c], 0x8dd2f3c0
mov dword [esp + 0x50], 0x89678fb4
mov dword [esp + 0x54], 0x857c8b73
mov dword [esp + 0x58], 0x81778778
mov dword [esp + 0x5c], 0x9d0f8309
mov dword [esp + 0x60], 0x99489fbc
mov dword [esp + 0x64], 0x95ba9b74
mov dword [esp + 0x68], 0x91a697a7
mov dword [esp + 0x6c], 0xada293a6
mov dword [esp + 0x70], 0xa98eaf69
mov dword [esp + 0x74], 0xa551ab41
mov dword [esp + 0x78], 0xa168a752
mov dword [esp + 0x7c], 0xbd67a36c
mov dword [esp + 0x80], 0xb936bf9c
mov dword [esp + 0x84], 0xb576bb76
mov dword [esp + 0x88], 0xb196b78f
mov dword [esp + 0x8c], 0x4d42b373
mov dword [esp + 0x90], 0x49ba4fbc
mov dword [esp + 0x94], 0x45a34bb7
mov dword [esp + 0x98], 0x41a447bb
mov dword [esp + 0x9c], 0x5db94395
mov dword [esp + 0xa0], 0x596f5fd0
mov dword [esp + 0xa4], 0x55975b97
mov dword [esp + 0xa8], 0x5160579d
mov dword [esp + 0xac], 0x6d9c539d
mov dword [esp + 0xb0], 0x69566f4c
mov dword [esp + 0xb4], 0x65b26bbd
mov dword [esp + 0xb8], 0x61b16788
mov dword [esp + 0xbc], 0x7d5663b4
mov dword [esp + 0xc0], 0x798a7f5c
mov dword [esp + 0xc4], 0x758f7b83
mov dword [esp + 0xc8], 0x7156778b
mov dword [esp + 0xcc], 0xd8d73a9
mov dword [esp + 0xd0], 0x9fb0ff1
mov dword [esp + 0xd4], 0x5310bf9
mov dword [esp + 0xd8], 0x1db0724
mov dword [esp + 0xdc], 0x1df003f8
mov dword [esp + 0xe0], 0x19e91fed
mov dword [esp + 0xe4], 0x152b1be7
mov dword [esp + 0xe8], 0x11251727
mov dword [esp + 0xec], 0x2d2413db
mov dword [esp + 0xf0], 0x29182f1c
mov dword [esp + 0xf4], 0x251c2b18
mov dword [esp + 0xf8], 0x21062714
mov dword [esp + 0xfc], 0x3dc123cd
mov dword [esp + 0x100], 0x39dd3fc2
mov dword [esp + 0x104], 0x35c13bca
mov dword [esp + 0x108], 0x31f93705
mov dword [esp + 0x10c], 0xcdfb33fd
mov dword [esp + 0x110], 0xc903cffa
mov dword [esp + 0x114], 0xc5cacb06
mov dword [esp + 0x118], 0
mov eax, dword [0x447d9c]
mov edi, 0x54759c29
mov edx, 0x2b8a63d6
nop
nop
nop
movzx ebx, byte [esp + edi - 0x54759bf1]
mov ebp, edx
and ebp, 0x20884373
mov ecx, edi
and ecx, 0x4471988c
or ecx, ebp
xor ecx, ebx
mov ebx, ecx
not ebx
and ebx, 0x32
xor ecx, 0x41
lea ecx, [ecx + ebx*2]
inc cl
mov byte [esp + edi - 0x54759bf1], cl
inc edi
dec edx
cmp edi, 0x54759d0d
jne 0x40b9b0
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
mov eax, dword [eax*4 + 0x441f10]
mov ecx, 0x8f2cb83b
xor ecx, dword [0x441f18]
add eax, ecx
inc eax
jmp eax
Function at 0x40c0b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov dword [esp + 0x38], 0x3745396d
mov dword [esp + 0x3c], 0x334b35b2
mov dword [esp + 0x40], 0x4f3a3144
mov dword [esp + 0x44], 0x4b794d2d
mov dword [esp + 0x48], 0x47744905
mov dword [esp + 0x4c], 0x43624574
mov dword [esp + 0x50], 0x5f354178
mov dword [esp + 0x54], 0x5b285d25
mov dword [esp + 0x58], 0x57255924
mov dword [esp + 0x5c], 0x53dd55df
mov dword [esp + 0x60], 0x6f3c5170
mov dword [esp + 0x64], 0x6b4a6d00
mov dword [esp + 0x68], 0x67566959
mov dword [esp + 0x6c], 0x63526556
mov dword [esp + 0x70], 0x7f5e6127
mov dword [esp + 0x74], 0x7b037d17
mov dword [esp + 0x78], 0x773c790a
mov dword [esp + 0x7c], 0x73357538
mov dword [esp + 0x80], 0x8f067150
mov dword [esp + 0x84], 0x8bc68dc6
mov dword [esp + 0x88], 0x87a689b1
mov dword [esp + 0x8c], 0x83f285c5
mov dword [esp + 0x90], 0x9fea81f0
mov dword [esp + 0x94], 0x9bf19de1
mov dword [esp + 0x98], 0x97e899e5
mov dword [esp + 0x9c], 0x93eb95c3
mov dword [esp + 0xa0], 0xaf9d911c
mov dword [esp + 0xa4], 0xabe5ade1
mov dword [esp + 0xa8], 0xa794a9e3
mov dword [esp + 0xac], 0xa3e8a5eb
mov dword [esp + 0xb0], 0xbf86a180
mov dword [esp + 0xb4], 0xbbe2bdeb
mov dword [esp + 0xb8], 0xb7e3b9d4
mov dword [esp + 0xbc], 0xb386b5e0
mov dword [esp + 0xc0], 0xcfbab190
mov dword [esp + 0xc4], 0xcbbdcdb5
mov dword [esp + 0xc8], 0xc7e6c9b5
mov dword [esp + 0xcc], 0xc3bfc59f
mov dword [esp + 0xd0], 0xdfa9c1bf
mov dword [esp + 0xd4], 0xdbe3ddaf
mov dword [esp + 0xd8], 0xd789d9f8
mov dword [esp + 0xdc], 0xd35cd5ac
mov dword [esp + 0xe0], 0xef9bd1a3
mov dword [esp + 0xe4], 0xebd9ed91
mov dword [esp + 0xe8], 0xe7d7e9d9
mov dword [esp + 0xec], 0xe3d0e5ad
mov dword [esp + 0xf0], 0xffcce1d0
mov dword [esp + 0xf4], 0xfbc8fdcc
mov dword [esp + 0xf8], 0xf7d6f9c8
mov dword [esp + 0xfc], 0xf393f59b
mov dword [esp + 0x100], 0xf6ff18a
mov dword [esp + 0x104], 0xb730d82
mov dword [esp + 0x108], 0x74b093b
mov dword [esp + 0x10c], 0x349054b
mov dword [esp + 0x110], 0x1f510132
mov dword [esp + 0x114], 0x1b1a1d56
mov eax, dword [0x447d9c]
mov ecx, 0xef978f27
mov edx, 0x3be5e3d8
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0x10687111]
lea ebx, [ecx - 0x2b7d72f1]
and ebx, edi
add ebx, ebx
mov esi, edi
sub esi, ebx
add esi, ecx
mov ebp, esi
not ebp
and esi, 1
sub ebx, edi
add ebx, edx
or ebx, ebp
not ebx
or ebx, 1
add ebx, esi
mov byte [esp + ecx + 0x10687111], bl
inc ecx
dec edx
cmp ecx, 0xef979007
jne 0x40c300
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
mov ebp, eax
xor eax, eax
test ebp, ebp
setne al
mov eax, dword [eax*4 + 0x4420ec]
mov ecx, 0x85f47ccc
xor ecx, dword [0x4420f4]
add eax, ecx
inc eax
jmp eax
Function at 0x413530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2f8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x413550
sar esi, 1
lea ecx, [esp + 0xcc]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x4490f0]
mov ebx, dword [esp + 0xcc]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41358a
mov eax, 0xffffffff
jmp 0x41358d
lea eax, [ebx + ebx]
push eax
call fcn.004081b0
add esp, 4
lea ecx, [esp + 0xcc]
push ecx
push ebx
mov dword [esp + 0x30], eax
push eax
push esi
mov esi, dword [ebp + 0xc]
push dword [esi + 4]
push 0
call dword [0x4490f0]
mov eax, dword [esp + 0xcc]
mov ecx, eax
add ecx, 0xd
js 0x4135c8
lea edi, [eax*2 + 0x1a]
push edi
call fcn.004081b0
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x130], 0xc97ecb68
mov dword [esp + 0x134], 0xc54bc757
mov dword [esp + 0x138], 0xc122c348
mov dword [esp + 0x13c], 0xbd25bf6a
mov dword [esp + 0x140], 0xb937bb32
mov dword [esp + 0x144], 0xb527b72f
mov dword [esp + 0x148], 0xb1b2b326
mov word [esp + 0x14c], 0
mov eax, 0xb3
mov ecx, 0x4c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x7d]
mov ebx, eax
and ebx, 0xb3
mov edx, ecx
and edx, 0x4c
or edx, ebx
mov ebx, ecx
and ebx, edi
xor edx, edi
xor edx, 0x4c
or edx, ebx
add dl, 0x81
mov byte [esp + eax + 0x7d], dl
inc eax
dec ecx
cmp eax, 0xd1
jne 0x413640
mov eax, dword [esp + 0x28]
movzx ecx, word [eax]
mov edi, dword [esp + 4]
mov eax, edi
test cx, cx
je 0x4136a1
mov eax, dword [esp + 0x28]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413690
mov word [eax], 0
movzx ecx, word [esp + 0x130]
test cx, cx
je 0x4136d1
lea edx, [esp + 0x132]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4136c0
mov word [eax], 0
lea eax, [esp + 0x34]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.0043c4c0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442a4c]
Function at 0x41b690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x34]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x41b6a0
sar ebp, 1
lea eax, [esp + 4]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x4490f0]
mov edi, dword [esp + 4]
test edi, edi
jns 0x41b6cf
mov eax, 0xffffffff
jmp 0x41b6d2
lea eax, [edi + edi]
push eax
call fcn.004081b0
add esp, 4
mov esi, eax
lea eax, [esp + 4]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x4490f0]
lea ebx, [esp + 8]
push ebx
push esi
call fcn.0043c670
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442ff4]
Function at 0x41d2e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41d2f0
cmp eax, 0xffffffed
jge 0x41d307
mov eax, 0xffffffff
jmp 0x41d30a
add eax, 0x12
push eax
call fcn.004081b0
add esp, 4
mov esi, eax
mov dword [esp], 0x996f9b78
mov dword [esp + 4], 0xa521a773
mov dword [esp + 8], 0xa190a398
mov dword [esp + 0xc], 0xad40af4c
mov dword [esp + 0x10], 0xabac
mov byte [esp + 0x14], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x5b
xor cl, byte [esp + eax]
add cl, 0x39
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 0xd
or eax, 0x2341236d
add eax, ecx
add eax, 0xdcbedc94
cmp eax, 0x15
jb 0x41d350
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41d3a1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41d390
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41d3d1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d3c0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043c670
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x4430ac]
Function at 0x422340
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x54], 0x139e11a3
mov dword [esp + 0x58], 0x6fcf6dd1
mov dword [esp + 0x5c], 0x6b1c69dd
mov dword [esp + 0x60], 0x67ee65d9
mov dword [esp + 0x64], 0x636261dd
mov word [esp + 0x68], 0
mov eax, 0x8f5552bc
mov ecx, 0x43
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x70aaad98]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
mov esi, edx
not esi
and esi, 1
mov edi, 0xac
sub edi, edx
and edx, 1
and edi, 0xfe
or edi, edx
xor edi, 0xfe
lea edx, [edi + esi*2]
mov byte [esp + eax + 0x70aaad98], dl
inc eax
dec ecx
cmp eax, 0x8f5552d2
jne 0x4223b0
lea eax, [esp + 0x54]
lea ecx, [esp + 0x34]
push eax
call fcn.00436090
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x443c8c]
Function at 0x42e950
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
call fcn.00413160
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x42e975
cmp eax, 0
setne al
jmp 0x42e97d
xor ebx, ebx
test al, 1
jne 0x42e988
jmp 0x42eb64
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x42eb5e
sub esp, 4
mov dword [ebp - 0x34], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.004296a0
add esp, 4
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x42e9ee
jmp 0x42eb4d
mov ebx, eax
add ebx, 1
mov dword [ebp - 0x30], eax
sub esp, 4
mov dword [esp], ebx
call fcn.004081b0
add esp, 4
mov dword [ebp - 0x10], eax
jmp 0x42ea09
sub esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00421db0
add esp, 0xc
mov ecx, dword [ebp + 8]
jmp 0x42ea27
jmp 0x42ea29
mov al, byte [edi]
mov byte [ebp - 0x14], al
mov byte [ebp - 0x28], 0x89
mov byte [ebp - 0x27], 0xd3
mov byte [ebp - 0x26], 0xad
mov byte [ebp - 0x25], 0xd1
mov byte [ebp - 0x24], 0xa2
mov byte [ebp - 0x23], 0xd2
mov byte [ebp - 0x22], 0xa1
mov byte [ebp - 0x21], 0xdf
mov byte [ebp - 0x20], 0xa0
mov byte [ebp - 0x1f], 0x99
mov byte [ebp - 0x1e], 0xd2
mov byte [ebp - 0x1d], 0xd1
mov byte [ebp - 0x1c], 0xd4
mov byte [ebp - 0x1b], 0x4b
mov eax, 0xe
mov byte [ebp + eax - 0x28], 0
add eax, 1
cmp eax, 0x13
jne 0x42ea6b
xor edi, edi
cmp edi, 0x13
jae 0x42eb11
movzx edx, byte [ebp + edi - 0x28]
mov eax, edi
and eax, 0x2ce5fe11
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov ecx, edi
and ecx, 0xd31a01ee
xor ecx, 0xd31a01ee
mov esi, edi
and esi, 0xd31a01ee
xor esi, 0xd31a01ee
or esi, ecx
mov eax, esi
sub eax, ebx
mov ecx, edx
or eax, ecx
mov edx, ecx
xor edx, 0xffffffff
mov ebx, esi
sub ebx, dword [ebp - 0x2c]
and ebx, edx
sub esi, dword [ebp - 0x2c]
xor esi, ecx
xor ecx, 0xffffffff
add esi, ecx
sub esi, ebx
and eax, esi
mov edx, eax
shl edx, 1
xor edx, 0xffffffff
add eax, edx
mov edx, eax
shl edx, 1
and edx, 2
mov esi, eax
shl esi, 1
and esi, 2
sub eax, esi
mov ecx, dword [ebp + 8]
add eax, 0xab
add eax, edx
mov byte [ebp + edi - 0x28], al
mov eax, edi
xor eax, 0xfffffffe
mov edx, edi
or edx, 1
and edx, eax
or edi, 1
add edi, edx
jmp 0x42ea7a
lea eax, [ebp - 0x28]
sub esp, 0xc
mov dword [esp], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], eax
call fcn.00409090
mov bl, al
and bl, 1
jmp 0x42eb34
jmp 0x42eb36
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004081c0
add esp, 4
jmp 0x42eb49
jmp 0x42eb4b
jmp 0x42eb4d
sub esp, 4
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x42eb5e
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
sub esp, 0xc
mov esi, esp
lea ecx, [ebp - 0x20]
push 0x68
push 7
push 0x100080
push ecx
push eax
call fcn.0043c4c0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x445594]

Function at 0x434200
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.0043cbd0
add esp, 0x14
test eax, eax
js 0x434336
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.0043cfc0
add esp, 0x24
xor esi, esi
test eax, eax
js 0x434297
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x434263
mov eax, 0xffffffff
jmp 0x43426a
lea eax, [eax*2 + 2]
push eax
call fcn.004081b0
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.0043d650
add esp, 0x14
test eax, eax
js 0x43428e
mov esi, edi
jmp 0x434297
push edi
call fcn.004081c0
add esp, 4
mov eax, dword [esp]
mov dword [esp + 4], 0xd8dbdac5
mov dword [esp + 8], 0
mov ecx, 0xeb3b672f
nop
movzx edx, byte [esp + ecx + 0x14c498d5]
xor edx, ecx
mov edi, edx
and edi, 1
xor edx, 1
add edx, 0x14
or edx, edi
add edx, edi
mov byte [esp + ecx + 0x14c498d5], dl
inc ecx
cmp ecx, 0xeb3b6737
jne 0x4342b0
mov ecx, dword [0x4490f4]
test ecx, ecx
je 0x43431a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x4490f8]
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x434300
inc edi
cmp ecx, edi
jne 0x4342f0
jmp 0x43431a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43431a
push eax
push 4
push ecx
push dword [0x4490fc]
call fcn.00438910
add esp, 0x10
test esi, esi
jne 0x434338
lea eax, [esp + 4]
push eax
call fcn.0043c2d0
add esp, 4
test al, al
je 0x434336
cmp dword [esp + 4], 1
je 0x434338
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435f50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0x514e4f7c
mov dword [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xd
xor dl, byte [esp + ecx]
add dl, 0xbf
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 8
jne 0x435f70
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x451118]
mov ecx, dword [0x4458d4]
nop
nop
nop
nop
jmp ecx

Function at 0x435fb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x4458d8]
Function at 0x436340
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edx, dword [ecx + 8]
test edx, edx
je 0x436430
mov ebp, ecx
xor eax, eax
cmp dword [ecx], 0
jne 0x43648d
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], edx
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xd8dbdac5
mov dword [esp + 4], 0
mov esi, 0xeb3b672f
mov edi, 0x14c498d0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi + 0x14c498d1]
mov ebx, edx
xor ebx, esi
or ebx, edi
mov eax, ebx
shr al, 1
and al, 1
mov ecx, ebx
not cl
mov ah, cl
and ah, 0x3d
mul ah
add al, al
sub dl, al
test bl, 2
sete al
or cl, 2
mul cl
add al, al
sub dl, al
movzx eax, dl
add eax, esi
add al, 0x15
mov byte [esp + esi + 0x14c498d1], al
inc esi
dec edi
cmp esi, 0xeb3b6737
jne 0x4363c0
mov eax, dword [esp]
mov edx, dword [0x4490f4]
test edx, edx
je 0x43648d
xor ecx, ecx
mov esi, dword [0x4490f8]
nop
cmp dword [esi + ecx*8], 0xef01f5a1
je 0x436497
inc ecx
cmp edx, ecx
jne 0x436420
jmp 0x43648d
mov dword [esp + 8], 0xff3e3930
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 8]
mov edx, eax
and edx, 4
mov edi, ecx
xor edi, edx
and edx, ecx
xor edi, 0xf605428a
lea edx, [edi + edx*2]
xor edx, esi
mov esi, edx
not esi
and esi, 0xb3
and edx, 0x4c
sub edx, esi
inc dl
mov byte [esp + ecx + 8], dl
inc ecx
add eax, 2
cmp ecx, 7
jne 0x436450
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov edx, dword [esi + ecx*8 + 4]
cmp edx, eax
je 0x43648d
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
push ecx
push dword [esp + 0x44]
push ebp
push 0x10
push edx
push dword [0x4490fc]
call fcn.00438910
add esp, 0x1c
jmp 0x43648d

Function at 0x4364d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43659b
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, ecx
mov dword [esp + 8], eax
mov dword [esp], 0xd8dbdac5
mov dword [esp + 4], 0
mov esi, 0xeb3b672f
mov edi, 0x14c498d0
movzx edx, byte [esp + esi + 0x14c498d1]
mov ebx, edx
xor ebx, esi
or ebx, edi
mov eax, ebx
shr al, 1
and al, 1
mov ecx, ebx
not cl
mov ah, cl
and ah, 0x3d
mul ah
add al, al
sub dl, al
test bl, 2
sete al
or cl, 2
mul cl
add al, al
sub dl, al
movzx eax, dl
add eax, esi
add al, 0x15
mov byte [esp + esi + 0x14c498d1], al
inc esi
dec edi
cmp esi, 0xeb3b6737
jne 0x436500
mov eax, dword [0x4490f4]
test eax, eax
je 0x43658d
mov edx, dword [esp]
xor ecx, ecx
mov esi, dword [0x4490f8]
nop
nop
cmp dword [esi + ecx*8], 0xb62b8d10
je 0x436570
inc ecx
cmp eax, ecx
jne 0x436560
jmp 0x43658d
mov eax, dword [esi + ecx*8 + 4]
cmp eax, edx
je 0x43658d
push dword [esp + 8]
push 4
push eax
push dword [0x4490fc]
call fcn.00438910
add esp, 0x10
mov dword [ebp], 0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4365a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 0xc], ecx
cmp dword [ecx + 8], 0
je 0x436670
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x436670
mov dword [esp + 8], eax
mov dword [esp], 0xd8dbdac5
mov dword [esp + 4], 0
mov edi, 0xeb3b672f
mov esi, 0x14c498d0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edi + 0x14c498d1]
mov edx, ecx
xor edx, edi
or edx, esi
mov eax, edx
shr al, 1
and al, 1
mov ebx, edx
not bl
mov ah, bl
and ah, 0x3d
mul ah
add al, al
sub cl, al
test dl, 2
sete al
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edi
add al, 0x15
mov byte [esp + edi + 0x14c498d1], al
inc edi
dec esi
cmp edi, 0xeb3b6737
jne 0x4365f0
mov eax, dword [esp]
mov ecx, dword [0x4490f4]
test ecx, ecx
je 0x43669c
xor edx, edx
mov esi, dword [0x4490f8]
mov edi, dword [ebp + 0x10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x2dedf0b8
je 0x4366a1
inc edx
cmp ecx, edx
jne 0x436660
jmp 0x4366c1
mov dword [esp], 0xb3727148
mov byte [esp + 4], 0
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0xec
xor cl, byte [esp + eax]
add cl, 0x64
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x436680
mov eax, dword [esp]
jmp 0x4367f5
mov edi, dword [ebp + 0x10]
jmp 0x4366c1
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x4366c1
push dword [ebp + 8]
push dword [esp + 0xc]
push 8
push ecx
push dword [0x4490fc]
call fcn.00438910
add esp, 0x14
cmp dword [ebp + 0xc], 1
mov ecx, edi
sbb ecx, 0
jl 0x4367e4
cmp eax, 0xc000010a
jne 0x4367e4
mov ecx, dword [ebp + 0xc]
mov ebx, ecx
and ebx, 0xffffd8f0
mov eax, ebx
xor eax, 0xffffd8f0
mov esi, edi
not esi
mov edx, ecx
and edx, 0x270f
imul esi, edx
mul edx
mov dword [esp + 8], eax
add edx, esi
mov esi, edx
or ecx, 0xffffd8f0
mov eax, ecx
mul ebx
imul edi, ecx
add edx, edi
sub edx, ebx
add eax, dword [esp + 8]
adc edx, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp], 0xd8dbdac5
mov dword [esp + 4], 0
mov esi, 0xeb3b672f
mov edi, 0x14c498d0
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + esi + 0x14c498d1]
mov ebx, ecx
xor ebx, esi
or ebx, edi
mov eax, ebx
shr al, 1
and al, 1
mov edx, ebx
not dl
mov ah, dl
and ah, 0x3d
mul ah
add al, al
sub cl, al
test bl, 2
sete al
or dl, 2
mul dl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0x15
mov byte [esp + esi + 0x14c498d1], al
inc esi
dec edi
cmp esi, 0xeb3b6737
jne 0x436750
mov eax, dword [esp]
mov ecx, dword [0x4490f4]
test ecx, ecx
je 0x4367e4
xor edx, edx
mov esi, dword [0x4490f8]
nop
cmp dword [esi + edx*8], 0x4e66b5a3
je 0x4367c0
inc edx
cmp ecx, edx
jne 0x4367b0
jmp 0x4367e4
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x4367e4
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x10]
push 0xc
push ecx
push dword [0x4490fc]
call fcn.00438910
add esp, 0x18
test eax, eax
js 0x4367f5
mov ecx, dword [esp + 0xc]
mov esi, eax
call fcn.004364d0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc