joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4029d0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402b76
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x402b6f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x402a65
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ecx
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, edi
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub ecx, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x402b6f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x402ade
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x402a80
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x402a2d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x402b20
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x402b00
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402a20
jmp 0x402b2f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402a20
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x402b40
jmp 0x402a20
shl ecx, 0x10
or ecx, edi
jmp 0x402b7b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402b90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402bbe
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x402c5c
not eax
test bl, 1
jne 0x402bc5
mov edx, ebx
cmp ebx, 1
jne 0x402bf6
jmp 0x402c5a
xor eax, eax
jmp 0x402c5c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x43b80c]
inc ecx
mov eax, edi
shr eax, 4
shr esi, 4
and edi, 0xf
xor edi, esi
xor eax, dword [edi*4 + 0x43b80c]
cmp ebx, 1
je 0x402c5a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x43b80c]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0x43b80c]
movzx ebx, byte [ecx + esi + 1]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x43b80c]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0x43b80c]
add esi, 2
cmp edx, esi
jne 0x402c00
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x407c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x407c6b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x407c73
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x407d0b
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x407cb9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x407d1a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x407cce
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x407ce0
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x407ca0
jmp 0x407ce9
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x407ca0
cmp edi, ebx
jge 0x407d00
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x407ca4
jmp 0x407d04
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x407cad
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x407da2
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x407da2
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x407d54
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x407d40
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x407da2
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x407d60
dec eax
mov ecx, 1
xor esi, esi
jmp 0x407dbc
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x407c6b
test edx, edx
mov dword [esp], ecx
js 0x407df0
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x407e00
inc ebp
dec edx
cmp edi, ebp
jne 0x407dd0
mov edx, 0xffffffff
jmp 0x407e02
xor edi, edi
jmp 0x407e05
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x407db0
and ebp, 3
je 0x407e38
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x407e20
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x407e3a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x407db0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x407e50
jmp 0x407db0
Function at 0x408690
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, dword [esp + 8]
mov dword [0x442c1c], edx
mov eax, 0xfffffd91
mov ecx, edx
shr ecx, 0x1e
mov esi, ecx
and esi, edx
add esi, esi
sub ecx, esi
add ecx, edx
mov edx, ecx
and edx, 0x93f8769a
mov esi, ecx
and esi, 0x6c078965
or ecx, 0x6c078965
imul ecx, esi
xor esi, 0x6c078965
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x270
mov dword [eax*4 + 0x4435dc], edx
inc eax
jne 0x4086a0
mov dword [0x442c18], 0x270
pop esi
ret

Function at 0x408700
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov eax, dword [0x442c18]
cmp eax, 0x270
jne 0x40875f
mov eax, 0xfffff640
mov edx, dword [0x442c1c]
nop
nop
nop
nop
nop
nop
nop
nop
and edx, 0x80000000
mov esi, dword [eax + 0x4435e0]
mov ecx, esi
and ecx, 0x7ffffffe
or ecx, edx
mov edx, esi
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, dword [eax + 0x443c10]
shr ecx, 1
xor esi, ecx
mov dword [eax + 0x443f9c], esi
add eax, 4
jne 0x408720
mov eax, 0x270
jmp 0x408775
cmp eax, 0x4e0
jb 0x408775
mov ecx, 0x442c18
call fcn.00408970
mov eax, dword [0x442c18]
lea ecx, [eax + 1]
mov dword [0x442c18], ecx
mov eax, dword [eax*4 + 0x442c1c]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [0x443f9c]
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc40000
xor ecx, eax
shr ecx, 0x12
and eax, 0x7fff
xor eax, ecx
pop esi
ret
Function at 0x4087e0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
call fcn.00436d20
test al, al
je 0x408962
call fcn.004304e0
test al, al
je 0x40895d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov ebp, 0xfaf3e14e
mov edi, 0x894572a0
shrd edi, ebp, cl
shr ebp, cl
test cl, 0x20
je 0x40882b
mov edi, ebp
xor ebp, ebp
xor edi, 0x894572a0
xor ebp, 0xfaf3e14e
mov eax, edi
and eax, 0x85213a31
mov dword [esp], eax
mov ecx, ebp
and ecx, 0x2cd0ba2a
mov esi, edi
and esi, 0x7adec5ce
mov ebx, esi
xor ebx, 0x7adec5ce
mov eax, ebx
imul ebx, ecx
mul dword [esp]
mov dword [esp + 8], eax
mov ecx, ebp
and ecx, 0xd32f45d5
or edi, 0x7adec5ce
mov eax, edi
imul edi, ecx
xor ecx, 0xd32f45d5
imul ecx, dword [esp]
add ecx, edx
add ecx, ebx
mul esi
add edi, edx
or ebp, 0xd32f45d5
imul ebp, esi
add ebp, edi
add eax, dword [esp + 8]
adc ebp, ecx
mov ebx, ebp
shr ebx, 0xa
xor ebx, ebp
mov edi, ebp
shld edi, eax, 0x16
xor edi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x408939
mov eax, dword [esp + 4]
lea ecx, [eax + eax]
not ecx
add ecx, eax
not ecx
or ecx, eax
and cl, 0xf
mov eax, ebx
shr eax, cl
mov ebp, edi
shrd ebp, ebx, cl
xor ebp, edi
mov edi, eax
xor edi, ebx
mov eax, ebp
or eax, 0xdb1bafaf
mov esi, ebp
and esi, 0xdb1bafaf
mov ebx, edi
and ebx, 0x6d2db7de
mov ecx, eax
imul ecx, ebx
mul esi
mov dword [esp], eax
add edx, ecx
mov ecx, edi
or ecx, 0x6d2db7de
imul ecx, esi
add ecx, edx
and ebp, 0x24e45050
mov eax, edi
and eax, 0x92d24821
xor ebx, 0x6d2db7de
xor esi, 0xdb1bafaf
imul eax, esi
mov edi, eax
mov eax, esi
mul ebp
imul ebx, ebp
add ebx, edx
add ebx, edi
mov edi, eax
add edi, dword [esp]
adc ebx, ecx
or ebx, 0x1010101
or edi, 0x1010101
push ebx
push edi
call fcn.00409bd0
add esp, 8
test al, al
je 0x40895d
call fcn.0040c880
call fcn.0040b530
call fcn.00437100
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408970
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov esi, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 - 0x630]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4]
xor edi, edx
mov dword [ecx + eax*4 - 0xff4], edi
inc eax
cmp eax, 0x4e1
jne 0x408980
mov eax, 0x353
mov edx, SysReAllocString
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edi, [eax - 0x270]
mov esi, dword [ecx + eax*4 + 4]
and esi, edx
and edi, 1
mov ebx, eax
or ebx, 1
add ebx, edi
mov edi, dword [ecx + ebx*4 + 4]
mov ebx, edi
and ebx, 1
neg ebx
and ebx, 0x9908b0df
and edi, 0x7ffffffe
or edi, esi
shr edi, 1
xor edi, dword [ecx + eax*4 - 0xd48]
xor edi, ebx
mov dword [ecx + eax*4 - 0x9bc], edi
inc eax
cmp eax, 0x4df
jne 0x4089d0
mov eax, dword [ecx + 0x1380]
mov edx, eax
not edx
or edx, 0x80000000
add eax, edx
inc eax
mov ebx, SysReAllocString
and ebx, dword [ecx + 4]
or ebx, eax
mov eax, ebx
shr eax, 1
mov edx, 0x7ba2dd20
test bl, 1
je 0x408a49
mov edx, 0xe2aa6dff
xor eax, dword [ecx + 0x634]
xor eax, edx
xor eax, 0x7ba2dd20
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
ret
Function at 0x40a770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40a9d8
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40a7ac
cmp edx, esi
jae 0x40a9d8
test edi, edi
je 0x40a9d8
movzx ebp, bl
test bl, bl
js 0x40a7e0
lea ecx, [eax + 2]
inc edx
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40a7a0
jmp 0x40a9d8
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40a818
cmp bl, 0xc2
jb 0x40a7d0
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40a881
and ebp, 0x1f
shl ebp, 6
and esi, 0x3f
or esi, ebp
add edx, 2
jmp 0x40a8d3
mov ecx, ebp
not ecx
or ecx, 0xf0
add ecx, ebp
cmp ecx, 0xdf
jne 0x40a849
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40a88b
cmp ebp, 0xe0
jne 0x40a894
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40a7cc
jmp 0x40a894
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40a9b3
cmp bl, 0xf4
ja 0x40a7d0
movzx ecx, byte [edx + 1]
je 0x40a8de
cmp ebp, 0xf0
jne 0x40a8e7
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40a7cc
jmp 0x40a8e7
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40a7d2
cmp cl, 0x9f
ja 0x40a7cc
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40a9ba
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40a9c0
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40a7c2
cmp cl, 0x8f
ja 0x40a7cc
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40a9ba
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40a9c0
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40a9cc
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov esi, dword [esp]
and esi, 0x3f
or esi, ebp
cmp esi, 0x10000
jb 0x40a7cc
mov ecx, esi
not ecx
or ecx, 0xfffff800
add ecx, esi
inc ecx
cmp ecx, 0xd800
je 0x40a7cc
cmp edi, 2
jb 0x40a9b3
mov ecx, esi
xor ecx, 0x10000
and esi, 0x1effff
add esi, esi
sub esi, ecx
mov ecx, esi
shr ecx, 0xa
and ecx, 0x3ff
or ecx, 0xd800
mov word [eax], cx
and esi, 0x3ff
or esi, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], si
jmp 0x40a7c2
mov ecx, eax
jmp 0x40a7c2
inc edx
jmp 0x40a7cc
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40a7d2
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40a7d2
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b560
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov ebx, dword [esp + 0x450]
mov esi, dword [esp + 0x44c]
mov dword [esp + 0x38], 0xe181e060
mov dword [esp + 0x3c], 0xe189e1b5
mov dword [esp + 0x40], 0xe18ee18d
mov dword [esp + 0x44], 0xe04be192
mov dword [esp + 0x48], 0xe048e040
mov dword [esp + 0x4c], 0xe068e047
mov dword [esp + 0x50], 0xe05de071
mov dword [esp + 0x54], 0xe1b2e1b2
mov dword [esp + 0x58], 0xe1b1e1a9
mov dword [esp + 0x5c], 0xe1b3e1b8
mov dword [esp + 0x60], 0xe05ce061
mov dword [esp + 0x64], 0xe064e057
mov dword [esp + 0x68], 0xe076e074
mov dword [esp + 0x6c], 0xe068e079
mov dword [esp + 0x70], 0xe07ae052
mov dword [esp + 0x74], 0xe1a5e04c
mov dword [esp + 0x78], 0xe068e1a3
mov dword [esp + 0x7c], 0xe05be06b
mov dword [esp + 0x80], 0xe19ae071
mov dword [esp + 0x84], 0xe060e065
mov dword [esp + 0x88], 0xe076e06c
mov dword [esp + 0x8c], 0xe1d8e056
mov dword [esp + 0x90], 0xe1d6e1d9
mov dword [esp + 0x94], 0xe03be1ce
mov dword [esp + 0x98], 0xe1cce1c8
mov dword [esp + 0x9c], 0xe1d9e034
mov dword [esp + 0xa0], 0xe01de1d5
mov dword [esp + 0xa4], 0xe017e016
mov dword [esp + 0xa8], 0xe018e012
mov dword [esp + 0xac], 0xe00ee014
mov dword [esp + 0xb0], 0xe002e019
mov dword [esp + 0xb4], 0xe024e020
mov dword [esp + 0xb8], 0xe023e029
mov dword [esp + 0xbc], 0xe00ce023
mov dword [esp + 0xc0], 0xe1cee011
mov dword [esp + 0xc4], 0xe1cfe1ca
mov dword [esp + 0xc8], 0xe016e1d0
mov dword [esp + 0xcc], 0xe1ede030
mov dword [esp + 0xd0], 0xe1f1e1ea
mov dword [esp + 0xd4], 0xe035e1f4
mov dword [esp + 0xd8], 0xe00de02d
mov dword [esp + 0xdc], 0xe1f2e1f7
mov dword [esp + 0xe0], 0xe1ffe1fe
mov dword [esp + 0xe4], 0xe03be1e6
mov dword [esp + 0xe8], 0xe037e034
mov dword [esp + 0xec], 0xe026e00e
mov dword [esp + 0xf0], 0xe024e029
mov dword [esp + 0xf4], 0xe022e02b
mov dword [esp + 0xf8], 0xe03ee02d
mov dword [esp + 0xfc], 0xe1f1e00c
mov dword [esp + 0x100], 0xe1f3e1f7
mov dword [esp + 0x104], 0xe1ede1e1
mov dword [esp + 0x108], 0xe023e02a
mov dword [esp + 0x10c], 0xe1dfe024
mov dword [esp + 0x110], 0xe1d9e1d7
mov dword [esp + 0x114], 0xe1ace1dd
mov eax, dword [0x443fc8]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ecx - 0x3b6b]
xor dx, word [esp + ecx*2 + 0x38]
add edx, 0xffffdb58
mov word [esp + ecx*2 + 0x38], dx
inc ecx
cmp ecx, 0x70
jne 0x40b7c0
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x43e7a4]
mov ecx, 0xe7549fb9
xor ecx, dword [0x43e7ac]
add ecx, edx
inc ecx
jmp ecx
Function at 0x40bfc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0x1217122a
mov dword [esp + 0x40], 0x12131203
mov dword [esp + 0x44], 0x12101217
mov dword [esp + 0x48], 0x1251122c
mov dword [esp + 0x4c], 0x125e125a
mov dword [esp + 0x50], 0x12621251
mov dword [esp + 0x54], 0x1233125b
mov dword [esp + 0x58], 0x1218121c
mov dword [esp + 0x5c], 0x11e71223
mov dword [esp + 0x60], 0x11e911ee
mov dword [esp + 0x64], 0x11c2119b
mov dword [esp + 0x68], 0x119e11c9
mov dword [esp + 0x6c], 0x11a011ae
mov dword [esp + 0x70], 0x11a211af
mov dword [esp + 0x74], 0x119411b8
mov dword [esp + 0x78], 0x11ef11c2
mov dword [esp + 0x7c], 0x11be11e9
mov dword [esp + 0x80], 0x11a111bd
mov dword [esp + 0x84], 0x11e4118b
mov dword [esp + 0x88], 0x11ba11bb
mov dword [esp + 0x8c], 0x118011b6
mov dword [esp + 0x90], 0x11f211a0
mov dword [esp + 0x94], 0x11f811f3
mov dword [esp + 0x98], 0x11d111c0
mov dword [esp + 0x9c], 0x11fa11c2
mov dword [esp + 0xa0], 0x11c311e2
mov dword [esp + 0xa4], 0x118311cf
mov dword [esp + 0xa8], 0x118d1188
mov dword [esp + 0xac], 0x118e1188
mov dword [esp + 0xb0], 0x11841182
mov dword [esp + 0xb4], 0x118c11b3
mov dword [esp + 0xb8], 0x11ee11ee
mov dword [esp + 0xbc], 0x11f511e3
mov dword [esp + 0xc0], 0x119611f5
mov dword [esp + 0xc4], 0x11d011ab
mov dword [esp + 0xc8], 0x11d511d4
mov dword [esp + 0xcc], 0x11a011ea
mov dword [esp + 0xd0], 0x11e71186
mov dword [esp + 0xd4], 0x11df11e0
mov dword [esp + 0xd8], 0x119f11da
mov dword [esp + 0xdc], 0x11fb11a7
mov dword [esp + 0xe0], 0x11a811a1
mov dword [esp + 0xe4], 0x11a111a4
mov dword [esp + 0xe8], 0x11e11198
mov dword [esp + 0xec], 0x11e111ee
mov dword [esp + 0xf0], 0x11ec11f8
mov dword [esp + 0xf4], 0x11ea11e3
mov dword [esp + 0xf8], 0x11e811e5
mov dword [esp + 0xfc], 0x11c811e7
mov dword [esp + 0x100], 0x118b119a
mov dword [esp + 0x104], 0x118d118d
mov dword [esp + 0x108], 0x11b711bf
mov dword [esp + 0x10c], 0x11f511f0
mov dword [esp + 0x110], 0x11f511f2
mov dword [esp + 0x114], 0x11f711fd
mov dword [esp + 0x118], 0x112611f3
mov eax, dword [0x443fc8]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ecx - 0x211]
xor dx, word [esp + ecx*2 + 0x3c]
add edx, 0x1088
mov word [esp + ecx*2 + 0x3c], dx
inc ecx
cmp ecx, 0x70
jne 0x40c210
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x43e9dc]
mov ecx, 0xf3c9bbff
xor ecx, dword [0x43e9e4]
add ecx, edx
inc ecx
jmp ecx
Function at 0x413fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x428
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x413fe0
mov eax, ebx
sar eax, 1
mov dword [esp + 0xe8], eax
cmp eax, 0xfffffff2
jge 0x414002
mov eax, 0xffffffff
jmp 0x414005
lea eax, [ebx + 0x1c]
push eax
call fcn.00408000
add esp, 4
mov dword [esp + 0x2a0], 0x99c4992b
mov dword [esp + 0x2a4], 0x99e999d8
mov dword [esp + 0x2a8], 0x999c99ef
mov dword [esp + 0x2ac], 0x99db99cb
mov dword [esp + 0x2b0], 0x99e399ed
mov dword [esp + 0x2b4], 0x99ed99e8
mov dword [esp + 0x2b8], 0x9e7499ed
xor edx, edx
nop
nop
nop
lea ecx, [edx + 0x357f]
xor cx, word [esp + edx*2 + 0x2a0]
add ecx, 0x5408
mov word [esp + edx*2 + 0x2a0], cx
inc edx
cmp edx, 0xe
jne 0x414060
movzx ecx, word [edi]
mov esi, eax
test cx, cx
je 0x4140b1
add edi, 2
mov esi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [esi], cx
add esi, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4140a0
mov dword [esp], eax
mov word [esi], 0
movzx ecx, word [esp + 0x2a0]
test cx, cx
je 0x4140e1
lea edx, [esp + 0x2a2]
nop
nop
nop
mov word [esi], cx
add esi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4140d0
mov word [esi], 0
lea eax, [esp + 0x110]
push 0x60
push 3
push 0x120089
push eax
push dword [esp + 0x10]
call fcn.00439290
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43f514]
Function at 0x419ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x190
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x10], 0x868586c1
mov dword [esp + 0x14], 0x86be8683
mov dword [esp + 0x18], 0x871386bc
xor eax, eax
nop
lea ecx, [eax - 0x3622]
xor cx, word [esp + eax*2 + 0x10]
add ecx, 0xffffb110
mov word [esp + eax*2 + 0x10], cx
inc eax
cmp eax, 6
jne 0x419ae0
mov dword [esp + 0x3c], 0xbb22bb2d
mov dword [esp + 0x40], 0xbbd8bb23
mov dword [esp + 0x44], 0xbb95bba3
mov dword [esp + 0x48], 0xbbd0bb94
mov dword [esp + 0x4c], 0xbbcdbbd2
mov dword [esp + 0x50], 0xbbdcbbce
mov dword [esp + 0x54], 0xbbddbbd9
mov dword [esp + 0x58], 0xbbd0bbd0
mov dword [esp + 0x5c], 0xbc66bbaf
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [eax + 0x77d]
mov edx, 0x3882
sub edx, eax
and edx, 0x3025
and ecx, 0x4da
or ecx, edx
xor cx, word [esp + eax*2 + 0x3c]
xor ecx, 0xffffb325
add ecx, 0xffffc418
mov word [esp + eax*2 + 0x3c], cx
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x12
jb 0x419b50
movzx ecx, word [esp + 0x3c]
lea eax, [esp + 0x14c]
test cx, cx
je 0x419bc1
lea edx, [esp + 0x3e]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419bb0
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x419bf1
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419be0
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x419c21
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419c10
mov word [eax], 0
mov edx, dword [edi]
mov dword [esp + 0x3c], 0x18b61b65
mov word [esp + 0x40], 0xbc11
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
lea ecx, [eax + 0x1527]
xor cx, word [esp + eax*2 + 0x3c]
add ecx, 0x56c8
mov word [esp + eax*2 + 0x3c], cx
inc eax
cmp eax, 3
jne 0x419c40
movzx eax, byte [esp + 0x3c]
test al, al
je 0x419c7b
lea ecx, [esp + 0x3d]
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x419c70
mov edi, edx
mov byte [edx], 0
lea eax, [esp + 0x144]
lea ecx, [esp + 0x148]
lea edx, [esp + 0x2c]
lea ebx, [esp + 0x14c]
push eax
push ecx
push edx
push ebx
call fcn.0040aec0
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x43f824]
mov ecx, dword [0x43f82c]
mov edx, ecx
and edx, 0x1ae135b8
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0xe51eca48
jmp eax