joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408555
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40d950
cmp edx, dword [eax]
je 0x408577
add eax, 8
inc ecx
cmp eax, 0x40d9e0
jl 0x408568
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40d950]
jne 0x4086a5
mov eax, dword [0xf0c6b8]
cmp eax, 1
je 0x40867f
test eax, eax
jne 0x4085a8
cmp dword [0x40d278], 1
je 0x40867f
cmp edx, 0xfc
je 0x4086a5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4085df
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00405340
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x408622
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40c48c
push edi
call fcn.00405fe0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00405340
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00405350
lea eax, [ebp - 0xa0]
push 0x40c46c
push eax
call fcn.00405350
push dword [esi + 0x40d954]
lea eax, [ebp - 0xa0]
push eax
call fcn.00405350
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040a721
add esp, 0x2c
pop edi
jmp 0x4086a5
lea eax, [ebp + 8]
lea esi, [esi + 0x40d954]
push 0
push eax
push dword [esi]
call fcn.00405490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4318ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4318e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4318e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x43b645
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop ecx
and ebx, ebx
mov eax, 0xfe52062f
add eax, eax
call fcn.0043b68a
and eax, eax
sub ebx, ebx
sub ebx, 0x6201c526
xor dword [esi], ecx
inc ebx
inc esi
sub eax, 0x74b16794
cmp esi, edi
jne fcn.0043b645
add ebx, 0xcfb5df85
push 0x1a8a7000
pop ebx
ret
Function at 0x401087
Capabilities:
Create process on windows

Disassembly:
jmp 0x4022d0
sub esp, 0x54
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
mov esi, dword [esp + 0x60]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
push esi
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x64]
test eax, eax
jne 0x40232c
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.MSVCRT.dll__unlink]
add esp, 4
pop edi
pop esi
add esp, 0x54
ret

Function at 0x40894c
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
call fcn.00408969
inc eax
inc ecx
xor dword [edx], edi
inc eax
sub eax, ecx
inc edx
cmp edx, esi
jne fcn.0040894c
sub eax, 0x15a4f18f
ret

Function at 0x432006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x6bfd6d83
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x404a309c
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40124f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push edi
push 0x7f00
xor edi, edi
push edi
mov dword [ebp - 0x24], str.construct
mov dword [ebp - 0x44], 0x401000
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x4c], 0x30
call esi
push 0x7f00
push edi
mov dword [ebp - 0x34], eax
call esi
push 0x7f00
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
call esi
push edi
mov dword [0x403100], eax
mov dword [ebp - 0x38], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x40136e
push 1
push dword [0x403100]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push edi
push edi
call esi
push eax
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.displayed
push str.construct
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push eax
mov dword [0x403108], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x403108]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x40136e
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x401351
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4037d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.0043ca80
mov eax, dword [0x468740]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x46c9fc
call fcn.0043bf2d
add esp, 4
test eax, eax
jne 0x403903
cmp dword [0x46ca28], 0x7fffffff
je 0x40390a
cmp dword [0x46c9d8], eax
je 0x4038e3
push 0x2000
push eax
lea eax, [ebp - 0x2004]
push eax
call fcn.0043d910
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x2004]
push 0xfff
push eax
call fcn.00401240
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004443bf
mov ecx, eax
add esp, 0x1c
or eax, 0xffffffff
mov edx, 0x1000
test ecx, ecx
cmovs ecx, eax
test ecx, ecx
js 0x403888
cmp ecx, 0xfff
ja 0x403888
jne 0x403882
xor eax, eax
mov word [ebp - 6], ax
mov eax, 1
jmp 0x403897
mov eax, edx
sub eax, ecx
jmp 0x403897
xor eax, eax
mov word [ebp - 6], ax
mov word [ebp - 0x2004], ax
mov eax, edx
add eax, eax
shr eax, 1
sub edx, eax
mov eax, 0xa
add edx, edx
mov word [ebp + edx - 0x2004], ax
add edx, 2
cmp edx, 0x2000
jae 0x4038fe
xor eax, eax
push eax
mov word [ebp + edx - 0x2004], ax
mov dword [ebp - 0x2008], eax
lea eax, [ebp - 0x2008]
push eax
push edx
lea eax, [ebp - 0x2004]
push eax
push dword [0x46c9d8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x46c9fc
call fcn.0043bf3e
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.0043c260
mov esp, ebp
pop ebp
ret
call fcn.0043c3f1
push 5
call fcn.0043b492
push 6
mov dword [0x46ca28], 0x7ffffffe
call fcn.0043b492
int3
Function at 0x40c9c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov al, byte [ecx]
test al, al
je 0x40c9e8
cmp al, 0x5c
je 0x40c9db
cmp al, 0x2f
jne 0x40c9de
lea edx, [ecx + 1]
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40c9d3
mov al, byte [edx]
mov esi, 0x7fed7fed
push edi
mov edi, 0xeeeeeeee
test al, al
je 0x40ca21
movzx eax, al
lea edx, [edx + 1]
add esi, edi
movzx ecx, byte [eax + 0x466188]
mov eax, edi
shl eax, 5
add eax, ecx
add eax, edi
xor esi, dword [ecx*4 + 0x46a058]
lea edi, [esi + 3]
add edi, eax
mov al, byte [edx]
test al, al
jne 0x40c9f7
test dword [ebp + 0x18], 0x20000
pop edi
je 0x40ca35
lea eax, [esi + ebx]
xor eax, dword [ebp + 0x14]
pop esi
pop ebx
pop ebp
ret
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x40ca40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0xeeeeeeee
push edi
shr esi, 2
xor edi, edi
test esi, esi
je 0x40ca95
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
nop dword [eax]
movzx ecx, al
add edx, dword [ecx*4 + 0x46a458]
lea ecx, [edx + eax]
xor dword [ebx + edi*4], ecx
mov ecx, eax
not ecx
shr eax, 0xb
shl ecx, 0x15
add ecx, 0x11111111
or eax, ecx
mov ecx, edx
shl ecx, 5
add edx, 3
add ecx, dword [ebx + edi*4]
inc edi
add edx, ecx
cmp edi, esi
jb 0x40ca60
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x40cbb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
shr edi, 2
mov esi, 0xeeeeeeee
mov dword [ebp + 0xc], edi
test edi, edi
je 0x40cc0f
mov eax, dword [ebp + 0x10]
nop dword [eax]
mov edi, dword [ebp + 8]
movzx ecx, al
add esi, dword [ecx*4 + 0x46a458]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + ebx*4]
lea ecx, [esi + eax]
xor ecx, edx
mov dword [edi + ebx*4], ecx
mov ecx, eax
not ecx
shr eax, 0xb
shl ecx, 0x15
inc ebx
add ecx, 0x11111111
or eax, ecx
mov ecx, esi
shl ecx, 5
add esi, 3
add ecx, edx
add esi, ecx
cmp ebx, dword [ebp + 0xc]
jb 0x40cbd0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40d970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 4]
mov edi, dword [esi + 0x38]
mov ecx, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ebx
mov edx, dword [edi]
test dword [eax + 0x20], 0x10000
mov dword [ebp - 4], edx
je 0x40da13
mov eax, dword [ebp - 4]
mov edx, dword [esi + 0x24]
shr eax, 2
dec edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, dword [esi + 0x38]
mov dword [ebp - 8], edi
mov edi, 0xeeeeeeee
jbe 0x40da0e
xor ebx, ebx
mov esi, dword [ebp - 8]
movzx eax, dl
add edi, dword [eax*4 + 0x46a458]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + ebx*4]
lea eax, [edi + edx]
xor eax, ecx
mov dword [esi + ebx*4], eax
mov eax, edx
not eax
shr edx, 0xb
shl eax, 0x15
inc ebx
add eax, 0x11111111
or edx, eax
mov eax, edi
shl eax, 5
add edi, 3
add eax, ecx
add edi, eax
cmp ebx, dword [ebp - 0xc]
jb 0x40d9c2
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edi, dword [esi + 0x38]
jmp 0x40da10
mov edi, eax
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x34]
test eax, eax
je 0x40da25
add ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
adc ebx, 0
mov dword [ebp - 0x18], ebx
push edx
push edi
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push dword [eax]
call fcn.0040b790
add esp, 0x10
pop edi
pop esi
pop ebx
test al, al
jne 0x40da49
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x411c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
dec edx
add edx, eax
cmp eax, edx
jae 0x411cb5
movzx ecx, byte [edx]
xor byte [eax], cl
movzx ecx, byte [eax]
xor byte [edx], cl
movzx ecx, byte [edx]
dec edx
xor byte [eax], cl
inc eax
cmp eax, edx
jb 0x411ca0
pop ebp
ret
Function at 0x414030
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x414052
push 0xeb
push str.e:eurekawow_stormlib_9.22_srclibtomcrypt_srchashesmd5.c
push str.md___NULL
call fcn.00423f20
add esp, 0xc
mov dword [esi + 8], 0x67452301
xor eax, eax
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0
mov dword [esi], 0
mov dword [esi + 4], 0
pop esi
pop ebp
ret
Function at 0x414c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [edx - 0x21524111]
mov eax, dword [eax]
add ecx, eax
mov eax, dword [ebp + 0x14]
push esi
push edi
mov esi, ecx
mov edi, ecx
add ecx, dword [eax]
mov dword [ebp - 4], esi
cmp edx, 0xc
jbe switch.0x00414da0
add edx, 0xfffffff3
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
shr eax, 3
inc eax
mov dword [ebp - 8], eax
movzx esi, byte [ebx + 7]
movzx eax, byte [ebx + 6]
movzx edx, byte [ebx + 0xb]
shl esi, 8
add esi, eax
shl edx, 8
movzx eax, byte [ebx + 5]
shl esi, 8
add esi, eax
movzx eax, byte [ebx + 4]
add edi, eax
shl esi, 8
movzx eax, byte [ebx + 0xa]
add edi, esi
movzx esi, byte [ebx + 8]
add edx, eax
movzx eax, byte [ebx + 9]
add esi, ecx
shl edx, 8
add edx, eax
shl edx, 8
add esi, edx
mov edx, dword [ebp + 8]
mov ebx, esi
rol ebx, 4
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx]
shl ecx, 8
add ecx, eax
sub ecx, esi
add esi, edi
add ecx, dword [ebp - 4]
xor ebx, ecx
sub edi, ebx
mov eax, ebx
add ebx, esi
rol eax, 6
xor eax, edi
sub esi, eax
mov edx, eax
rol edx, 8
add eax, ebx
xor edx, esi
sub ebx, edx
mov esi, edx
rol esi, 0x10
add edx, eax
xor esi, ebx
mov ebx, dword [ebp + 8]
mov edi, esi
sub eax, esi
ror edi, 0xd
add esi, edx
xor edi, eax
mov dword [ebp - 4], esi
sub edx, edi
mov ecx, edi
rol ecx, 4
add ebx, 0xc
xor ecx, edx
mov dword [ebp + 8], ebx
mov edx, dword [ebp + 0xc]
add edi, esi
sub edx, 0xc
sub dword [ebp - 8], 1
mov dword [ebp + 0xc], edx
jne 0x414cd4
cmp edx, 0xc
ja 0x414e0c
jmp dword [edx*4 + 0x414e64]
movzx eax, byte [ebx + 0xb]
shl eax, 0x18
add ecx, eax
movzx eax, byte [ebx + 0xa]
shl eax, 0x10
add ecx, eax
movzx eax, byte [ebx + 9]
shl eax, 8
add ecx, eax
movzx eax, byte [ebx + 8]
add ecx, eax
movzx eax, byte [ebx + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebx + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebx + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ebx + 4]
add edi, eax
movzx eax, byte [ebx + 3]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebx + 2]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebx + 1]
shl eax, 8
add esi, eax
movzx eax, byte [ebx]
add esi, eax
mov dword [ebp - 4], esi
xor ecx, edi
mov eax, edi
rol eax, 0xe
sub ecx, eax
mov eax, ecx
mov esi, ecx
xor esi, dword [ebp - 4]
rol eax, 0xb
sub esi, eax
xor edi, esi
mov eax, esi
ror eax, 7
sub edi, eax
mov eax, edi
xor ecx, edi
rol eax, 0x10
sub ecx, eax
mov eax, ecx
mov edx, ecx
rol eax, 4
xor edx, esi
sub edx, eax
mov eax, edx
xor edi, edx
rol eax, 0xe
sub edi, eax
mov eax, edi
xor ecx, edi
ror eax, 8
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416b90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x416b9c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00416bb0

Function at 0x419c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
mov dword [ebp - 8], eax
lea edx, [ecx + 0x32550]
mov dword [ebp - 0xc], edx
push edi
nop word [eax + eax]
xor ebx, ebx
mov dword [ebp - 4], 4
mov edi, eax
lea eax, [ebx + 1]
nop
movzx edx, word [ecx + eax*2 + 0x32bf4]
mov esi, edi
and esi, 1
shr edx, 4
mov ecx, esi
shr edi, 1
neg ecx
add eax, eax
sar ecx, 4
or eax, esi
and ecx, 0x7f
xor edx, ecx
mov ecx, dword [ebp + 8]
add ebx, dword [ecx + edx*4 + 0x30ea0]
sub dword [ebp - 4], 1
jne 0x419c60
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov dword [edx], ebx
add edx, 4
mov dword [ebp - 0xc], edx
cmp eax, 0x10
jb 0x419c50
pop edi
pop esi
mov dword [ecx + 0x32590], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x468740]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, 4
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x208], ebx
nop dword [eax]
nop dword [eax + eax]
movzx ecx, byte [edi + ebx + 0x306a0]
mov esi, 1
mov eax, ecx
mov dword [ebp - 0x218], ecx
mov edx, ecx
shr eax, 1
dec eax
mov dword [ebp - 0x20c], 0
and edx, 1
mov dword [ebp - 0x210], eax
or edx, 2
mov ecx, eax
shl edx, cl
mov ecx, ebx
sub ecx, edx
mov dword [ebp - 0x214], edx
test eax, eax
je 0x419d90
mov ebx, eax
mov eax, esi
mov edx, ecx
sub eax, dword [ebp - 0x218]
and edx, 1
add eax, dword [ebp - 0x214]
add esi, esi
shr ecx, 1
or esi, edx
mov dword [ebp - 0x210], ecx
movzx ecx, word [edi + eax*2 + 0x32b0e]
mov eax, edx
neg eax
shr ecx, 4
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp - 0x20c]
add eax, dword [edi + ecx*4 + 0x30ea0]
mov ecx, dword [ebp - 0x210]
mov dword [ebp - 0x20c], eax
sub ebx, 1
jne 0x419d34
mov ebx, dword [ebp - 0x208]
jmp 0x419d92
xor eax, eax
mov dword [ebp + ebx*4 - 0x204], eax
inc ebx
mov dword [ebp - 0x208], ebx
cmp ebx, 0x80
jb 0x419cf0
lea ecx, [ebp - 0x204]
mov dword [ebp - 0x210], 4
sub ecx, edi
lea esi, [edi + 0x31950]
lea eax, [edi + 0x32910]
mov dword [ebp - 0x208], esi
lea edx, [edi + 0x31d58]
mov dword [ebp - 0x21c], eax
sub ecx, 0x31d50
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x218], ecx
nop
mov eax, dword [edi + 0x32594]
xor ebx, ebx
mov dword [ebp - 0x214], ebx
test eax, eax
je 0x419e62
mov eax, ebx
xor esi, esi
mov ebx, dword [ebp - 0x21c]
or eax, 0x40
nop
mov edx, eax
and eax, 1
shr edx, 1
neg eax
sar eax, 4
and eax, 0x7f
movzx ecx, word [ebx + edx*2]
shr ecx, 4
xor ecx, eax
mov eax, edx
add esi, dword [edi + ecx*4 + 0x30ea0]
cmp eax, 1
jne 0x419e10
mov ebx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x208]
mov dword [eax + ebx*4], esi
inc ebx
mov eax, dword [edi + 0x32594]
mov dword [ebp - 0x214], ebx
cmp ebx, eax
jb 0x419e02
mov esi, dword [ebp - 0x208]
mov edx, dword [ebp - 0x20c]
mov ecx, 0xe
cmp eax, ecx
jbe 0x419e86
nop dword [eax + eax]
mov eax, ecx
shr eax, 1
shl eax, 4
sub eax, 0x50
add dword [esi + ecx*4], eax
inc ecx
cmp ecx, dword [edi + 0x32594]
jb 0x419e70
mov eax, dword [esi]
mov ecx, 4
mov ebx, dword [ebp - 0x218]
mov dword [edx - 8], eax
mov eax, dword [esi + 4]
mov dword [edx - 4], eax
mov eax, dword [esi + 8]
mov dword [edx], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 4], eax
add edx, 8
nop word [eax + eax]
movzx eax, byte [edi + ecx + 0x306a0]
lea edx, [edx + 4]
inc ecx
mov eax, dword [esi + eax*4]
add eax, dword [edx + ebx - 4]
mov dword [edx - 4], eax
cmp ecx, 0x80
jb 0x419eb0
mov edx, dword [ebp - 0x20c]
add esi, 0x100
sub dword [ebp - 0x21c], 0xffffff80
add edx, 0x200
sub ebx, 0x200
mov dword [ebp - 0x208], esi
sub dword [ebp - 0x210], 1
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x218], ebx
jne 0x419df0
mov ecx, dword [ebp - 4]
mov dword [edi + 0x3bcf8], 0
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0043c260
mov esp, ebp
pop ebp
ret
Function at 0x41b960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 8]
movzx ecx, word [edi]
mov eax, ecx
xor ecx, 0x7f0
shr eax, 4
shr ecx, 4
mov eax, dword [ebx + eax*4]
mov edx, dword [ebx + ecx*4]
movzx ecx, word [edi + 2]
mov dword [ebp - 8], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
mov eax, dword [ebx + eax*4]
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + ecx*4]
add eax, edx
xor esi, esi
mov dword [ebp - 0x10], eax
mov dword [ebp + 0x18], esi
cmp esi, dword [ebp + 0x10]
jae 0x41bad4
mov edx, esi
mov dword [ebp - 4], 0
mov esi, dword [ebp - 4]
or edx, 8
mov eax, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 1
and edx, 1
neg edx
sar edx, 4
and edx, 0x7f
lea eax, [ecx + eax*8]
movzx eax, word [edi + eax*2 + 4]
shr eax, 4
xor eax, edx
mov edx, ecx
add esi, dword [ebx + eax*4]
cmp edx, 1
jne 0x41b9c8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
add eax, esi
mov esi, dword [ebp + 0x18]
mov dword [ecx + esi*4], eax
inc esi
mov dword [ebp + 0x18], esi
cmp esi, 8
jb 0x41b9b0
cmp esi, 0x10
jae 0x41ba6d
lea eax, [esi - 8]
mov dword [ebp - 4], eax
cmp esi, dword [ebp + 0x10]
jae 0x41bad4
mov edx, eax
xor esi, esi
or edx, 8
mov eax, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 1
and edx, 1
neg edx
sar edx, 4
and edx, 0x7f
lea eax, [ecx + eax*8]
movzx eax, word [edi + eax*2 + 0x104]
shr eax, 4
xor eax, edx
mov edx, ecx
add esi, dword [ebx + eax*4]
cmp edx, 1
jne 0x41ba23
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x14]
add eax, esi
mov esi, dword [ebp + 0x18]
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp + 0x18], esi
mov dword [ebp - 4], eax
cmp esi, 0x10
jb 0x41ba13
cmp esi, dword [ebp + 0x10]
jae 0x41bad4
lea eax, [esi - 0x10]
mov dword [ebp - 4], eax
nop dword [eax + eax]
mov esi, dword [ebp + 8]
xor edi, edi
or eax, 0x100
nop word [eax + eax]
mov edx, eax
and eax, 1
shr edx, 1
neg eax
sar eax, 4
and eax, 0x7f
movzx ecx, word [esi + edx*2 + 0x204]
shr ecx, 4
xor ecx, eax
mov eax, edx
add edi, dword [ebx + ecx*4]
cmp eax, 1
jne 0x41ba90
mov esi, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x10]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp + 0x18], esi
mov dword [ebp - 4], eax
cmp esi, dword [ebp + 0x10]
jb 0x41ba80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41bbc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
or ecx, 0x100
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 8
movzx esi, word [edx + eax*2]
mov edx, ecx
shr edx, 7
add ecx, ecx
and edx, 1
shr esi, 4
neg edx
sar edx, 4
and edx, 0x7f
xor esi, edx
add edi, dword [ebx + esi*4]
cmp ecx, 0x10000
jb 0x41bbd4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41bc10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, 0x100
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
or ecx, esi
add edi, edi
mov edx, esi
and edx, edi
mov eax, ecx
add edx, esi
shr eax, 8
add eax, edx
mov edx, dword [ebp + 8]
movzx edx, word [edx + eax*2]
mov eax, ecx
shr eax, 7
add ecx, ecx
and eax, 1
shr edx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor edx, eax
mov eax, dword [ebp + 0x14]
add ebx, dword [eax + edx*4]
mov edx, ecx
xor edx, edi
not edx
and esi, edx
cmp ecx, 0x10000
jb 0x41bc25
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret