joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c960
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x234
mov dword [esp + 0x34], 0xc95bcb7f
mov dword [esp + 0x38], 0xc551c74e
mov dword [esp + 0x3c], 0xc156c350
mov dword [esp + 0x40], 0xbd6fbf5f
mov dword [esp + 0x44], 0xb968bb77
mov dword [esp + 0x48], 0xb556b768
mov dword [esp + 0x4c], 0xb11bb36c
mov dword [esp + 0x50], 0xad3caf27
mov dword [esp + 0x54], 0xa93bab30
mov dword [esp + 0x58], 0xa52ba721
mov dword [esp + 0x5c], 0xa110a344
mov dword [esp + 0x60], 0x9d7e9f0c
mov dword [esp + 0x64], 0x994a9b53
mov dword [esp + 0x68], 0x9546974a
mov dword [esp + 0x6c], 0x91729351
mov dword [esp + 0x70], 0x8d198f39
mov dword [esp + 0x74], 0x89408b1e
mov dword [esp + 0x78], 0x85438744
mov dword [esp + 0x7c], 0x810a8364
mov dword [esp + 0x80], 0x7db27f4a
mov dword [esp + 0x84], 0x799a7bab
mov dword [esp + 0x88], 0x75e677c7
mov dword [esp + 0x8c], 0x71e673e4
mov dword [esp + 0x90], 0x6dc76feb
mov dword [esp + 0x94], 0x69f46bf7
mov dword [esp + 0x98], 0x65f167dd
mov dword [esp + 0x9c], 0x61b363e8
mov dword [esp + 0xa0], 0x5d935fab
mov dword [esp + 0xa4], 0x59885b95
mov dword [esp + 0xa8], 0x559c5795
mov dword [esp + 0xac], 0x518a53b4
mov dword [esp + 0xb0], 0x4df64fe5
mov dword [esp + 0xb4], 0x49f94be0
mov dword [esp + 0xb8], 0x459247fc
mov dword [esp + 0xbc], 0x41d643a4
mov dword [esp + 0xc0], 0x3dab3fd7
mov dword [esp + 0xc4], 0x39da3ba7
mov dword [esp + 0xc8], 0x35ad3781
mov dword [esp + 0xcc], 0x31a733a9
mov dword [esp + 0xd0], 0x2df92fa1
mov dword [esp + 0xd4], 0x29972bcc
mov dword [esp + 0xd8], 0x25a827b0
mov dword [esp + 0xdc], 0x21b123b5
mov dword [esp + 0xe0], 0x1dcf1fbb
mov dword [esp + 0xe4], 0x19d51bd3
mov dword [esp + 0xe8], 0x15c417df
mov dword [esp + 0xec], 0x11c013c4
mov dword [esp + 0xf0], 0xddc0fc0
mov dword [esp + 0xf4], 0x9ea0bdc
mov dword [esp + 0xf8], 0x59907a5
mov dword [esp + 0xfc], 0x19d039e
mov dword [esp + 0x100], 0xfd69ff8e
mov dword [esp + 0x104], 0xf931fb2d
mov dword [esp + 0x108], 0xf53ff735
mov dword [esp + 0x10c], 0xf13ff326
mov dword [esp + 0x110], 0xedeeef3a
mov eax, dword [0x44bb0c]
xor ecx, ecx
mov edx, ecx
not edx
movzx esi, byte [esp + ecx + 0x34]
mov edi, ecx
and edi, 0x33
and edx, 0xcc
sub edx, edi
lea edi, [ecx + 0x33]
xor edx, edi
and edx, esi
xor edx, edi
inc dl
mov byte [esp + ecx + 0x34], dl
inc ecx
cmp ecx, 0xe0
jne 0x40cba0
lea ebx, [esp + 0x34]
push 0
push 0
push 0
push 0
push ebx
call eax
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x445f8c]
mov ecx, 0x3937b821
xor ecx, dword [0x445f94]
add ecx, edx
inc ecx
jmp ecx
Function at 0x418930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
movzx eax, byte [esp + 0x20]
movzx ecx, byte [esp + 0x1c]
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [esi + 8], cl
mov byte [esi + 9], al
movzx edx, byte [ebx]
test dl, dl
je 0x4189c4
lea ecx, [ebx + 1]
xor eax, eax
jmp 0x418979
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x4189b8
test dl, dl
jns 0x418970
movsx edx, dl
mov ebp, edx
and ebp, 0xf0
cmp ebp, 0xe0
je 0x418970
mov ebp, edx
not ebp
or ebp, 0xe0
add ebp, edx
inc ebp
cmp ebp, 0xc0
je 0x418970
and edx, 0xf8
cmp edx, 0xf0
jne 0x418971
add eax, 2
jmp 0x418971
mov ebp, eax
inc ebp
jns 0x4189d0
mov eax, 0xffffffff
jmp 0x4189d7
mov eax, 2
mov ebp, 1
jmp 0x4189d7
lea eax, [eax*2 + 2]
push eax
call fcn.00408730
add esp, 4
mov dword [esi], eax
push 0
push ebx
push ebp
push eax
call fcn.0040af70
add esp, 0x10
movzx edx, byte [edi]
test dl, dl
je 0x418a48
lea ecx, [edi + 1]
xor eax, eax
jmp 0x418a09
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x418a4a
test dl, dl
jns 0x418a00
movsx edx, dl
mov ebx, edx
and ebx, 0xf0
cmp ebx, 0xe0
je 0x418a00
mov ebx, edx
not ebx
or ebx, 0xe0
add ebx, edx
inc ebx
cmp ebx, 0xc0
je 0x418a00
and edx, 0xf8
cmp edx, 0xf0
jne 0x418a01
add eax, 2
jmp 0x418a01
xor eax, eax
mov ecx, eax
and ecx, 1
xor eax, 1
lea ebx, [eax + ecx*2]
test ebx, ebx
jns 0x418a60
mov eax, 0xffffffff
jmp 0x418a63
lea eax, [ebx + ebx]
push eax
call fcn.00408730
add esp, 4
mov dword [esi + 4], eax
push 0
push edi
push ebx
push eax
call fcn.0040af70
add esp, 0x10
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x418c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ebp, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x418c40
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x418c60
sar ebp, 1
mov ecx, eax
sar ecx, 1
xor ecx, 1
and eax, 2
add eax, ebp
lea edx, [ecx + eax]
inc edx
test edx, edx
jns 0x418c88
mov eax, 0xffffffff
jmp 0x418c91
add eax, ecx
lea eax, [eax*2 + 2]
push eax
call fcn.00408730
add esp, 4
movzx ecx, word [esi]
mov ebx, eax
test cx, cx
je 0x418cc1
add esi, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x418cb0
mov word [ebx], 0x5c
add ebx, 2
movzx ecx, word [edi]
test cx, cx
je 0x418cf1
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418ce0
mov word [ebx], 0
mov ecx, esp
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x20], eax
push eax
call fcn.0043fc50
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4463e8]
Function at 0x418fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x478
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
sub esp, 0xc
mov dword [esi + 0x74], esp
push eax
mov dword [esi + 0x11c], esp
push eax
mov dword [esi + 0x140], esp
sub esp, 8
mov dword [esi + 0xe8], esp
sub esp, 8
mov ecx, esp
and ecx, 0xfffffff8
mov dword [esi + 0x110], ecx
mov esp, ecx
push eax
sub esp, 8
mov ecx, esp
mov dword [esi + 0xe4], ecx
mov dword [esi + 0x90], ecx
sub esp, 8
mov ecx, esp
and ecx, 0xfffffff8
mov dword [esi + 0x114], ecx
mov esp, ecx
push eax
sub esp, 8
mov ecx, esp
mov dword [esi + 0xe0], ecx
mov dword [esi + 0xf0], ecx
sub esp, 0xc
mov dword [esi + 0x13c], esp
sub esp, 8
mov ecx, esp
and ecx, 0xfffffff8
mov dword [esi + 0x124], ecx
mov esp, ecx
push eax
sub esp, 8
mov ecx, esp
mov dword [esi + 0x120], ecx
mov dword [esi + 0x94], ecx
sub esp, 0xc
mov ecx, esp
mov dword [esi + 0xec], ecx
mov dword [esi + 0x12c], ecx
sub esp, 8
mov dword [esi + 0x20], esp
sub esp, 0x88
mov ecx, esp
and ecx, 0xfffffff8
mov dword [esi + 0x78], ecx
mov esp, ecx
push eax
sub esp, 0x18
mov dword [esi + 0x68], esp
sub esp, 0x14
mov dword [esi + 0x84], esp
push eax
mov dword [esi + 0x128], esp
sub esp, 0xc
mov dword [esi + 0x14c], esp
sub esp, 0x10
mov dword [esi + 0x148], esp
sub esp, 0x14
mov dword [esi + 0x118], esp
sub esp, 0xc
mov dword [esi + 0x144], esp
mov eax, dword [eax + 4]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [eax + edi + 2], 0
lea edi, [edi + 2]
jne 0x4190c0
sar edi, 1
lea ecx, [esi + 0x70]
push ecx
push 0
push 0
push edi
push eax
push 0
call dword [0x44ce60]
mov dword [esi + 0x2f0], 0x43020123
mov word [esi + 0x2f4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + ecx + 0x2f0]
lea ebx, [ecx - 0x23f529c0]
and ebx, edx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
mov byte [esi + ecx + 0x2f0], dl
inc ecx
cmp ecx, 6
jne case.default.0x419133
xor ecx, ecx
cmp eax, dword [esi + 0x2f0]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4468a0]
mov ebx, dword [esi + 0x70]
test ebx, ebx
jns 0x419148
mov eax, 0xffffffff
jmp 0x41914b
lea eax, [ebx + ebx]
push eax
call fcn.00408730
add esp, 4
lea ecx, [esi + 0x70]
push ecx
push ebx
mov ebx, eax
push eax
push edi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44ce60]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4468a8]
xor eax, eax
jmp dword [0x4468b0]
jmp dword [0x4468bc]
jmp dword [0x4468cc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push ebx
call fcn.00408740
add esp, 4
push ebx
call fcn.00408740
add esp, 4
xor eax, eax
jmp dword [0x4468c4]
Function at 0x41d590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [esp + 8], 0xb924bb55
mov dword [esp + 0xc], 0xbd2fbf2d
mov dword [esp + 0x10], 0xb1b2b32e
mov word [esp + 0x14], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 8]
lea esi, [eax + 0x5530905f]
mov ecx, 0xa0
sub ecx, eax
xor ecx, esi
and ecx, edx
xor ecx, esi
add ecx, 0x560d2e24
mov edx, ecx
xor edx, 0x3e
and ecx, 0x3e
lea ecx, [edx + ecx*2]
add cl, 0xc3
mov byte [esp + eax + 8], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0xe
jb 0x41d5d0
mov dword [esp + 0x34], 0xe376e178
mov dword [esp + 0x38], 0xe776e570
mov dword [esp + 0x3c], 0xdb85d992
mov dword [esp + 0x40], 0xdf42dd83
mov dword [esp + 0x44], 0xd371d14f
mov dword [esp + 0x48], 0xd74ad575
mov dword [esp + 0x4c], 0xcb55c950
mov dword [esp + 0x50], 0xcf5acd5f
mov dword [esp + 0x54], 0xc3c2c18a
mov word [esp + 0x58], 0
mov eax, 0x387ae658
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x387ae624]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x48
mov byte [esp + eax - 0x387ae624], cl
inc eax
cmp eax, 0x387ae67e
jne 0x41d670
movzx ecx, word [esp + 0x34]
lea eax, [esp + 0x15c]
test cx, cx
je 0x41d6c1
lea edx, [esp + 0x36]
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d6b0
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0x41d6f1
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d6e0
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x41d721
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d710
mov word [eax], 0
mov ebx, dword [ebx]
mov dword [esp + 0x34], 0xa7a4a44a
mov byte [esp + 0x38], 0x44
mov dword [esp + 0x39], 0
mov word [esp + 0x3d], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x34]
mov ecx, eax
or ecx, 0x10
and ecx, edx
mov edi, 0xef
sub edi, eax
and edi, edx
mov esi, 0x3baf0ef
sub esi, eax
xor esi, edx
sub esi, edx
add esi, edi
or esi, ecx
lea ecx, [esi + esi]
not ecx
add ecx, esi
add cl, 0xb0
mov byte [esp + eax + 0x34], cl
add eax, 0xd922ea73
mov ecx, eax
xor ecx, 0xd922ea72
and eax, 0x8d
add eax, eax
sub eax, ecx
cmp eax, 0xb
jb 0x41d750
movzx eax, byte [esp + 0x34]
test al, al
je 0x41d7bd
lea ecx, [esp + 0x35]
mov edi, ebx
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41d7b0
jmp 0x41d7bf
mov edi, ebx
mov byte [edi], 0
lea eax, [esp + 0x144]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x15c]
push eax
push ecx
push edx
call fcn.0040b710
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x446bf0]
mov ecx, 0xe5b42007
xor ecx, dword [0x446bf8]
add eax, ecx
inc eax
mov ecx, dword [ebp + 0xc]
jmp eax
Function at 0x421830
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x421840
sar ebp, 1
lea esi, [esp + 0x1c]
push esi
push 0
push 0
push ebp
push edi
push 0
call dword [0x44ce60]
mov dword [esp + 8], 0x418687e9
mov word [esp + 0xc], 0
mov ecx, 0x26af79a1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x26af7999]
xor edx, ecx
mov ebx, edx
and ebx, 1
or edx, 1
add edx, ebx
add dl, 0xda
mov byte [esp + ecx - 0x26af7999], dl
inc ecx
cmp ecx, 0x26af79a7
jne 0x421880
xor ecx, ecx
cmp eax, dword [esp + 8]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x446edc]
Function at 0x423280
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov ecx, 0xfffffffe
nop
cmp word [edi + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x423290
mov eax, ecx
sar eax, 1
and ecx, 0x12
xor eax, 9
add eax, ecx
jns 0x4232b0
mov eax, 0xffffffff
jmp 0x4232b2
add eax, eax
push eax
call fcn.00408730
add esp, 4
mov esi, eax
mov dword [esp], 0xf967fba8
mov dword [esp + 4], 0xfd71ff63
mov dword [esp + 8], 0xf120f328
mov dword [esp + 0xc], 0xf550f754
mov word [esp + 0x10], 0xebf4
mov dword [esp + 0x12], 0
mov word [esp + 0x16], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
dec cl
xor cl, byte [esp + eax]
add cl, 5
mov byte [esp + eax], cl
inc eax
cmp eax, 0x18
jne 0x423300
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x423341
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x423330
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x423371
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423360
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043fe10
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x446f9c]
Function at 0x425460
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x98
mov dword [esp + 4], 0xe926ebcf
mov dword [esp + 8], 0xed0bef19
mov dword [esp + 0xc], 0xf11ef30b
mov dword [esp + 0x10], 0xf506f737
mov dword [esp + 0x14], 0xf93efb04
mov dword [esp + 0x18], 0xfd0aff1f
mov dword [esp + 0x1c], 0x81a9831b
lea eax, [esp + 0x20]
mov word [esp + 0x20], 0x8780
mov dword [esp + 0x22], 0
mov word [esp + 0x26], 0
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0xa7
xor dl, byte [esp + ecx + 4]
add dl, 0xbd
mov byte [esp + ecx + 4], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x24
jb 0x4254c0
lea esi, [esp + 0x7a]
lea edx, [esp + 4]
mov edi, esi
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x96]
mov ebp, 1
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0x54]
push eax
push 0
push 0
push 0xe
push esi
push 0
call dword [0x44ce60]
mov dword [esp + 4], 0x418687e9
mov word [esp + 8], 0
mov ebx, 0x5e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ebp + 3]
mov edx, ebx
or edx, edi
mov ecx, ebx
and ecx, 0x55
mov esi, ebp
and esi, 0xa
or esi, ecx
xor esi, 0xa
and esi, edi
not edx
or edx, esi
add dl, 0xdb
mov byte [esp + ebp + 3], dl
inc ebp
dec ebx
cmp ebp, 7
jne case.default.0x425575
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
jmp dword [ecx*4 + 0x4474f0]
mov esi, dword [esp + 0x54]
test esi, esi
jns 0x4255a5
mov eax, 0xffffffff
jmp 0x4255a8
xor ebx, ebx
jmp dword [0x447504]
mov eax, ebx
add esp, 0x98
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + esi]
push eax
call fcn.00408730
add esp, 4
mov ebp, eax
lea eax, [esp + 0x54]
push eax
push esi
push ebp
push 0xe
lea eax, [esp + 0x8a]
push eax
push 0
call dword [0x44ce60]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447508]
xor ebx, ebx
jmp dword [0x447510]
jmp dword [0x447524]
Function at 0x425cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp], 0x1c5072b
mov dword [esp + 4], 0xdf203f0
mov dword [esp + 8], 0x9ed0fc0
mov dword [esp + 0xc], 0x15e90bf4
mov dword [esp + 0x10], 0x11f2173b
mov dword [esp + 0x14], 0x1dfa13cc
mov dword [esp + 0x18], 0x19e81fe3
mov dword [esp + 0x1c], 0x25f51bf4
mov dword [esp + 0x20], 0x21c427d6
mov dword [esp + 0x24], 0x2dd023cb
mov dword [esp + 0x28], 0x29ca2fc0
mov dword [esp + 0x2c], 0x35d82bf8
mov dword [esp + 0x30], 0x31d837c5
mov dword [esp + 0x34], 0x3dc633db
mov dword [esp + 0x38], 0x39c33fd3
lea eax, [esp + 0x3c]
mov word [esp + 0x3c], 0x3b38
mov dword [esp + 0x3e], 0
mov ecx, 0x41
mov edx, 0xbe
nop
nop
movzx ebx, byte [esp + ecx - 0x41]
mov esi, ecx
or esi, ebx
not ebx
or ebx, edx
and ebx, esi
add bl, 0xbb
mov byte [esp + ecx - 0x41], bl
inc ecx
dec edx
cmp ecx, 0x83
jne 0x425d50
lea esi, [esp + 0x4a]
mov edx, esp
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea ebx, [esp + 0x44]
push ebx
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x44ce60]
mov dword [esp], 0x511e1f39
mov dword [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xc5
xor dl, byte [esp + ecx]
add dl, 0x27
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 8
jne case.default.0x425ddc
xor ecx, ecx
cmp eax, dword [esp]
setne cl
jmp dword [ecx*4 + 0x447590]
mov ebp, dword [esp + 0x44]
test ebp, ebp
jns 0x425e02
mov eax, 0xffffffff
jmp 0x425e09
mov ecx, dword [case.0x425ddc.4]
xor eax, eax
nop
nop
nop
nop
nop
nop
jmp ecx
lea eax, [ebp*2]
push eax
call fcn.00408730
add esp, 4
mov edi, eax
push ebx
push ebp
push eax
push 0x1e
push esi
push 0
call dword [0x44ce60]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4475a8]
xor ebx, ebx
xor eax, eax
jmp dword [0x4475b0]
mov dword [esp], 0xff609dc
mov dword [esp + 4], 0x3f00df9
mov dword [esp + 8], 0x7e301e4
mov dword [esp + 0xc], 0x1bfc05f2
mov dword [esp + 0x10], 0x1fe819e1
mov dword [esp + 0x14], 0x13121df8
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [eax + eax]
mov esi, ecx
and esi, 4
mov edx, eax
xor edx, 0x42
add edx, esi
xor dl, byte [esp + eax]
add dl, 0xb6
mov byte [esp + eax], dl
and ecx, 2
xor eax, 1
add eax, ecx
cmp eax, 0x1b
jb 0x425e80
push 0
push 0
lea eax, [esp + 8]
push eax
push edi
push dword [esp + 0xac]
call fcn.00421830
add esp, 0x14
mov ebx, eax
jmp dword [0x4475b0]
push edi
call fcn.00408740
add esp, 4
mov eax, ebx
add esp, 0x88
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4283e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x450
mov ebp, dword [esp + 0x464]
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x50], 0x7fea79ef
mov dword [esp + 0x54], 0x63037d19
mov dword [esp + 0x58], 0x6734610d
mov dword [esp + 0x5c], 0x6bf26501
mov dword [esp + 0x60], 0x6f6e690d
mov eax, 0xb1c589ea
mov ecx, 0xe3a7615
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x4e3a7666]
lea edx, [ecx - 0xe3a7600]
mov ebx, ecx
and ebx, 0xe083091
mov edi, eax
and edi, 0xb144036e
or edi, ebx
xor edi, 0x6e
or edi, edx
or edx, esi
not edi
lea ebx, [esi + esi]
not ebx
add ebx, esi
or ebx, edi
and ebx, edx
mov dl, 0x6d
sub dl, bl
mov byte [esp + eax + 0x4e3a7666], dl
inc eax
dec ecx
cmp eax, 0xb1c589fe
jne 0x428450
lea edi, [esp + 0x50]
lea ecx, [esp + 0x28]
push edi
call fcn.0043a7f0
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x447bd0]
Function at 0x429c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xf0
mov dword [esp + 4], 0x33f331ed
mov dword [esp + 8], 0x2fbe2dbc
mov dword [esp + 0xc], 0x2b8b2994
mov dword [esp + 0x10], 0x278725a8
mov dword [esp + 0x14], 0x232221fd
lea eax, [esp + 0x18]
mov byte [esp + 0x18], 0
xor ecx, ecx
nop
nop
nop
movzx esi, byte [esp + ecx + 4]
lea edi, [ecx + 0x4c]
mov edx, 0xb3
sub edx, ecx
xor edx, edi
and edx, esi
xor edx, edi
add dl, 0x84
mov byte [esp + ecx + 4], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x15
jb 0x429cd0
lea esi, [esp + 0xaa]
lea ebp, [esp + 4]
mov edx, ebp
mov edi, esi
mov ecx, 5
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xbe]
xor ebx, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x48]
push edi
push 0
push 0
push 9
push esi
push 0
call dword [0x44ce60]
mov dword [esp + 4], 0x31feff99
mov word [esp + 8], 0
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
add cl, 0x55
xor cl, byte [esp + ebx + 4]
add cl, 0x57
mov byte [esp + ebx + 4], cl
mov ecx, ebx
or ecx, 0xa69a91d5
and ebx, 5
add ebx, ecx
add ebx, 0x59656e2c
cmp ebx, 6
jb case.default.0x429d83
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x447da8]
Function at 0x42ad30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xd0
mov dword [esp + 0x10], 0x3f7f395d
mov dword [esp + 0x14], 0x23b23dac
mov dword [esp + 0x18], 0x27872164
mov dword [esp + 0x1c], 0x2b8b25b0
mov dword [esp + 0x20], 0x2f92294d
mov dword [esp + 0x24], 0x13812d9e
mov dword [esp + 0x28], 0x17b31184
mov dword [esp + 0x2c], 0x1bbb1584
mov dword [esp + 0x30], 0x1f7119bc
mov dword [esp + 0x34], 0x3be1d73
mov dword [esp + 0x38], 0x7a30197
mov dword [esp + 0x3c], 0xb9d0593
mov dword [esp + 0x40], 0xf9d09a1
mov dword [esp + 0x44], 0x73200d9e
mov dword [esp + 0x48], 0x77db71e8
mov dword [esp + 0x4c], 0x7b7a75d8
xor eax, eax
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x10]
mov edx, 0x4a5a3675
sub edx, eax
mov ecx, edx
or ecx, esi
lea edi, [esi + esi]
not edi
add edi, esi
mov esi, edi
and esi, edx
xor edx, edi
sub edx, edi
add edx, esi
mov esi, edx
and esi, ecx
xor ecx, edx
not ecx
add ecx, edx
sub ecx, esi
mov edx, ecx
not edx
add ecx, 0x73c3104d
or edx, ecx
and edx, 1
add edx, edx
mov esi, edx
and esi, ecx
or edx, ecx
xor edx, 1
add edx, esi
mov byte [esp + eax + 0x10], dl
mov ecx, eax
or ecx, 0xd28d868f
and eax, 0xf
add eax, ecx
add eax, 0x2d727972
cmp eax, 0x40
jb 0x42adc0
lea ebp, [esp + 0x90]
lea eax, [esp + 0x10]
mov edi, ebp
mov ecx, 0x10
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea eax, [esp + 0x50]
lea edi, [esp + 0xd0]
xor ebx, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x88]
push esi
push 0
push 0
push 0x1f
push ebp
push 0
call dword [0x44ce60]
mov dword [esp + 0x10], 0x17564967
nop
nop
nop
mov ecx, ebx
add cl, 0xe
xor cl, byte [esp + ebx + 0x10]
add cl, 0xba
mov byte [esp + ebx + 0x10], cl
inc ebx
cmp ebx, 4
jne case.default.0x42ae91
xor ecx, ecx
cmp eax, dword [esp + 0x10]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x447e70]