joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4091a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx eax, word [esi]
lea edx, [esp + 4]
test ax, ax
je 0x4092f8
mov edi, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea eax, [esi + 2]
cmp bx, 0x7f
ja 0x4091f0
lea ebp, [edx + 1]
mov byte [edx], bl
jmp 0x4092a0
cmp ebx, 0x7ff
ja 0x409220
cmp edi, 2
jb 0x409220
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [edx], cl
and bl, 0x3f
or bl, 0x80
lea ebp, [edx + 2]
mov byte [edx + 1], bl
jmp 0x4092a0
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x4092ba
cmp edi, 4
jb 0x4092ba
movzx eax, word [esi + 2]
add esi, 4
shl ebx, 0xa
mov ecx, eax
xor ecx, 0xdc00
and eax, 0x23ff
add eax, eax
sub eax, ecx
lea ecx, [ebx + eax]
add ecx, 0xfca00000
mov ebp, edx
lea edx, [ebx + eax]
add edx, 0xfca10000
mov ebx, edx
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
shr edx, 0xc
and dl, 0x3f
or dl, 0x80
mov byte [ebp + 1], dl
mov edx, ebp
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 2], cl
and al, 0x3f
or al, 0x80
add ebp, 4
mov byte [edx + 3], al
mov eax, esi
nop
nop
nop
add edi, edx
sub edi, ebp
mov esi, eax
mov edx, ebp
movzx eax, word [esi]
test ax, ax
je 0x4092f8
test edi, edi
jne 0x4091d0
jmp 0x4092f8
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x4092c9
mov esi, eax
jmp 0x4092a8
cmp edi, 3
jb 0x4092f4
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [edx], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [edx + 1], cl
and bl, 0x3f
or bl, 0x80
lea ebp, [edx + 3]
mov byte [edx + 2], bl
jmp 0x4092a0
mov ebp, edx
jmp 0x4092a0
mov esi, dword [esp + 0x420]
mov eax, edx
mov edx, dword [esp + 0x41c]
mov byte [eax], 0
xor eax, eax
jmp 0x409318
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x409310
test ecx, ecx
je 0x40932c
mov ebx, ecx
jmp 0x409310
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00404e70
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40b560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x448514]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40b60e
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x441e2c]
xor eax, eax
jmp 0x40bc76
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40bcb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov ebx, dword [esp + 0x464]
mov ebp, dword [esp + 0x44c]
mov dword [esp + 0x38], 0xf745f9ad
mov dword [esp + 0x3c], 0xf34bf572
mov dword [esp + 0x40], 0xcf7af144
mov dword [esp + 0x44], 0xcbb9cd6d
mov dword [esp + 0x48], 0xc7b4c985
mov dword [esp + 0x4c], 0xc3a2c5b4
mov dword [esp + 0x50], 0xdf75c1b8
mov dword [esp + 0x54], 0xdb68dd65
mov dword [esp + 0x58], 0xd765d964
mov dword [esp + 0x5c], 0xd35dd55f
mov dword [esp + 0x60], 0x2f7cd1b0
mov dword [esp + 0x64], 0x2b4a2d80
mov dword [esp + 0x68], 0x27562959
mov dword [esp + 0x6c], 0x23522556
mov dword [esp + 0x70], 0x3f5e2167
mov dword [esp + 0x74], 0x3b833d97
mov dword [esp + 0x78], 0x377c398a
mov dword [esp + 0x7c], 0x33753578
mov dword [esp + 0x80], 0xf863150
mov dword [esp + 0x84], 0xb460d46
mov dword [esp + 0x88], 0x7660971
mov dword [esp + 0x8c], 0x3b20545
mov dword [esp + 0x90], 0x1faa01b0
mov dword [esp + 0x94], 0x1bb11da1
mov dword [esp + 0x98], 0x17a819a5
mov dword [esp + 0x9c], 0x13ab1543
mov dword [esp + 0xa0], 0x6f1d119c
mov dword [esp + 0xa4], 0x6b256d21
mov dword [esp + 0xa8], 0x67146923
mov dword [esp + 0xac], 0x6328652b
mov dword [esp + 0xb0], 0x7f066100
mov dword [esp + 0xb4], 0x7b227d2b
mov dword [esp + 0xb8], 0x772379d4
mov dword [esp + 0xbc], 0x73067520
mov dword [esp + 0xc0], 0x4ffa7110
mov dword [esp + 0xc4], 0x4bfd4df5
mov dword [esp + 0xc8], 0x472649f5
mov dword [esp + 0xcc], 0x43ff451f
mov dword [esp + 0xd0], 0x5fe941ff
mov dword [esp + 0xd4], 0x5b235def
mov dword [esp + 0xd8], 0x57095938
mov dword [esp + 0xdc], 0x53dc55ec
mov dword [esp + 0xe0], 0xaf1b51e3
mov dword [esp + 0xe4], 0xabd9ad11
mov dword [esp + 0xe8], 0xa7d7a9d9
mov dword [esp + 0xec], 0xa3d0a5ed
mov dword [esp + 0xf0], 0xbfcca1d0
mov dword [esp + 0xf4], 0xbbc8bdcc
mov dword [esp + 0xf8], 0xb7d6b9c8
mov dword [esp + 0xfc], 0xb313b51b
mov dword [esp + 0x100], 0x8f2fb10a
mov dword [esp + 0x104], 0x8b338d02
mov dword [esp + 0x108], 0x87cb89fb
mov dword [esp + 0x10c], 0x83c985cb
mov dword [esp + 0x110], 0x9fd181f2
mov dword [esp + 0x114], 0x9b9a9dd6
mov byte [esp + 0x118], 0
mov eax, dword [0x448508]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x38]
lea esi, [ecx - 0x434666aa]
xor esi, edx
add esi, 0x50f55959
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
add dl, 0xf8
mov byte [esp + ecx + 0x38], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0xe1
jb 0x40bf10
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x441edc]
mov ecx, dword [0x441ee4]
mov edx, ecx
and edx, 0x3fe59a4d
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0x401a65b3
mov dword [esp], 0
xor edi, edi
jmp eax
Function at 0x40c670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x240
mov dword [esp + 0x40], 0x97b0b5f
mov dword [esp + 0x44], 0x571078e
mov dword [esp + 0x48], 0x1760370
mov dword [esp + 0x4c], 0x1d2f1f7f
mov dword [esp + 0x50], 0x19281b57
mov dword [esp + 0x54], 0x15361728
mov dword [esp + 0x58], 0x117b132c
mov dword [esp + 0x5c], 0x2d5c2f67
mov dword [esp + 0x60], 0x295b2b50
mov dword [esp + 0x64], 0x25ab27a1
mov dword [esp + 0x68], 0x21702304
mov dword [esp + 0x6c], 0x3d1e3f4c
mov dword [esp + 0x70], 0x390a3b73
mov dword [esp + 0x74], 0x3506370a
mov dword [esp + 0x78], 0x31123371
mov dword [esp + 0x7c], 0x4d394f59
mov dword [esp + 0x80], 0x49004b3e
mov dword [esp + 0x84], 0x45034704
mov dword [esp + 0x88], 0x41ca4364
mov dword [esp + 0x8c], 0x5d125f0a
mov dword [esp + 0x90], 0x597a5b6b
mov dword [esp + 0x94], 0x55265707
mov dword [esp + 0x98], 0x51265324
mov dword [esp + 0x9c], 0x6d076f2b
mov dword [esp + 0xa0], 0x69146b17
mov dword [esp + 0xa4], 0x6511673d
mov dword [esp + 0xa8], 0x615363e8
mov dword [esp + 0xac], 0x7d337f2b
mov dword [esp + 0xb0], 0x79487b35
mov dword [esp + 0xb4], 0x753c7735
mov dword [esp + 0xb8], 0x714a7354
mov dword [esp + 0xbc], 0x8dd68f25
mov dword [esp + 0xc0], 0x89d98be0
mov dword [esp + 0xc4], 0x85b287dc
mov dword [esp + 0xc8], 0x81f683a4
mov dword [esp + 0xcc], 0x9deb9ff7
mov dword [esp + 0xd0], 0x99ba9be7
mov dword [esp + 0xd4], 0x95ed97c1
mov dword [esp + 0xd8], 0x91e793e9
mov dword [esp + 0xdc], 0xad99afe1
mov dword [esp + 0xe0], 0xa9f7ab8c
mov dword [esp + 0xe4], 0xa528a7d0
mov dword [esp + 0xe8], 0xa1d1a3d5
mov dword [esp + 0xec], 0xbd8fbfdb
mov dword [esp + 0xf0], 0xb9f5bbf3
mov dword [esp + 0xf4], 0xb584b7ff
mov dword [esp + 0xf8], 0xb180b384
mov dword [esp + 0xfc], 0xcdfccf80
mov dword [esp + 0x100], 0xc9eacbfc
mov dword [esp + 0x104], 0xc5b9c7a5
mov dword [esp + 0x108], 0xc1bdc3be
mov dword [esp + 0x10c], 0xdda9df4e
mov dword [esp + 0x110], 0xd991dbed
mov dword [esp + 0x114], 0xd59fd795
mov dword [esp + 0x118], 0xd19fd3e6
mov dword [esp + 0x11c], 0xedeeef9a
mov word [esp + 0x120], 0
mov eax, dword [0x448508]
mov ecx, 0xab17bf03
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x54e8413d]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0xf1
mov byte [esp + ecx + 0x54e8413d], dl
inc ecx
cmp ecx, 0xab17bfe5
jne 0x40c8d0
lea ecx, [esp + 0x40]
push 0
push 0
push 0
push 0
push ecx
call eax
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
mov eax, dword [eax*4 + 0x4420d8]
mov ecx, 0xdc1c3b36
xor ecx, dword [0x4420e0]
add eax, ecx
inc eax
jmp eax
Function at 0x413250
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ebp, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x413270
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x413290
sar ebp, 1
sar eax, 1
lea ecx, [eax + ebp]
add ecx, 2
test ecx, ecx
jns 0x4132b0
mov eax, 0xffffffff
jmp 0x4132b9
add eax, ebp
lea eax, [eax*2 + 4]
push eax
call fcn.004084c0
add esp, 4
movzx ecx, word [esi]
mov ebx, eax
test cx, cx
je 0x4132f1
add esi, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x4132e0
mov word [ebx], 0
mov word [ebx], 0x5c
add ebx, 2
movzx ecx, word [edi]
test cx, cx
je 0x413321
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413310
mov word [ebx], 0
mov ecx, esp
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x20], eax
push eax
call fcn.0043cbd0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4424e8]
Function at 0x4135b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2f0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x4135d0
sar esi, 1
lea ecx, [esp + 0xbc]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44985c]
mov ebx, dword [esp + 0xbc]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41360a
mov eax, 0xffffffff
jmp 0x41360d
lea eax, [ebx + ebx]
push eax
call fcn.004084c0
add esp, 4
lea ecx, [esp + 0xbc]
push ecx
push ebx
mov dword [esp + 0x2c], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44985c]
mov eax, dword [esp + 0xbc]
mov ecx, eax
and ecx, 0xd
xor eax, 0xd
lea eax, [eax + ecx*2]
test eax, eax
js 0x41364d
add eax, eax
mov edi, eax
push edi
call fcn.004084c0
add esp, 4
mov esi, eax
mov dword [esp + 0x128], 0x81528720
mov dword [esp + 0x12c], 0x8d3f8323
mov dword [esp + 0x130], 0x896e8f30
mov dword [esp + 0x134], 0x95258b56
mov dword [esp + 0x138], 0x912b9726
mov dword [esp + 0x13c], 0x9d23933b
mov dword [esp + 0x140], 0x999e9f2a
mov byte [esp + 0x144], 0
xor ecx, ecx
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x128]
lea edi, [ecx + ecx]
and edi, 2
mov ebx, ecx
xor ebx, edi
and edi, ecx
xor ebx, 0xcc2d3b61
lea edi, [ebx + edi*2]
xor edi, edx
mov edx, edi
and edx, 0x1a
add edx, edx
xor edi, 0xe5
sub edx, edi
mov byte [esp + ecx + 0x128], dl
and eax, 1
not ecx
or ecx, 1
sub eax, ecx
mov ecx, eax
cmp eax, 0x1d
jb 0x4136c0
mov eax, dword [esp + 0x24]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x413731
mov eax, dword [esp + 0x24]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413720
mov word [eax], 0
movzx ecx, word [esp + 0x128]
test cx, cx
je 0x413761
lea edx, [esp + 0x12a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413750
mov word [eax], 0
lea eax, [esp + 0x28]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043cbd0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44298c]
Function at 0x417660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x198
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [esp + 8], 0xb924bb55
mov dword [esp + 0xc], 0xbd2fbf2d
mov dword [esp + 0x10], 0xb1b2b32e
mov word [esp + 0x14], 0
mov eax, 0xde6433df
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x219bcc29]
xor ecx, eax
mov edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
add cl, 0xa4
mov byte [esp + eax + 0x219bcc29], cl
inc eax
cmp eax, 0xde6433ed
jne 0x4176a0
mov dword [esp + 0x2c], 0x931e91e8
mov dword [esp + 0x30], 0xafdead20
mov dword [esp + 0x34], 0xab9da9e2
mov dword [esp + 0x38], 0xa7d2a593
mov dword [esp + 0x3c], 0xa3c1a1d7
mov dword [esp + 0x40], 0xbfcabddd
mov dword [esp + 0x44], 0xbbcdb9c0
mov dword [esp + 0x48], 0xb73ab5c7
mov dword [esp + 0x4c], 0xb3b2b1fa
mov byte [esp + 0x50], 0
mov eax, 0x9c
mov ecx, 0x63
nop
nop
nop
movzx esi, byte [esp + eax - 0x70]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0xf4
mov byte [esp + eax - 0x70], dl
inc eax
dec ecx
cmp eax, 0xc1
jne 0x417720
movzx ecx, word [esp + 0x2c]
lea eax, [esp + 0x154]
test cx, cx
je 0x417771
lea edx, [esp + 0x2e]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417760
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0x4177a1
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417790
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x4177d1
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4177c0
mov word [eax], 0
mov esi, dword [ebx]
mov dword [esp + 0x2c], 0x9b949c36
mov byte [esp + 0x30], 0x3c
mov dword [esp + 0x31], 0
mov dword [esp + 0x34], 0
mov eax, 0x9d6218ca
mov ecx, 0x35
nop
movzx edi, byte [esp + eax + 0x629de762]
mov edx, ecx
xor edx, eax
and edx, edi
xor edx, eax
neg edx
mov edi, edx
and edi, 0x73
add edi, edi
xor edx, 0xc
sub edx, edi
add dl, 2
mov byte [esp + eax + 0x629de762], dl
inc eax
dec ecx
cmp eax, 0x9d6218d6
jne 0x417800
movzx eax, byte [esp + 0x2c]
test al, al
je 0x41784b
lea ecx, [esp + 0x2d]
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x417840
mov byte [esi], 0
lea eax, [esp + 0x130]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x154]
push eax
push ecx
push edx
call fcn.0040b560
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x442c84]
mov ecx, 0x5f7555f0
xor ecx, dword [0x442c8c]
add eax, ecx
inc eax
jmp eax
Function at 0x41b2c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x41b2d0
sar ebp, 1
mov eax, esp
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x44985c]
mov edi, dword [esp]
test edi, edi
jns 0x41b2fc
mov eax, 0xffffffff
jmp 0x41b2ff
lea eax, [edi + edi]
push eax
call fcn.004084c0
add esp, 4
mov esi, eax
mov eax, esp
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x44985c]
lea ebx, [esp + 0xc]
push ebx
push esi
call fcn.0043cd70
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442f24]
Function at 0x41d190
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41d1a0
cmp eax, 0xffffffed
jge 0x41d1b7
mov eax, 0xffffffff
jmp 0x41d1ba
add eax, 0x12
push eax
call fcn.004084c0
add esp, 4
mov dword [esp], eax
mov dword [esp + 4], 0x59e75be8
mov dword [esp + 8], 0x5dd15fe3
mov dword [esp + 0xc], 0x51205328
mov dword [esp + 0x10], 0x55f057f4
mov dword [esp + 0x14], 0xab54
mov byte [esp + 0x18], 0
lea eax, [esp + 4]
mov ecx, 0x7b6c0610
nop
nop
nop
nop
movzx ebx, byte [eax]
lea ebp, [ecx - 0x60000000]
and ebp, 0x1040043f
mov edx, ecx
and edx, 0x6b2c03c0
or edx, ebp
mov ebp, ebx
xor ebp, 0x3f
mov esi, edx
xor esi, 0xc0
xor ebx, 0xc0
and ebx, esi
xor edx, 0x3f
and edx, ebp
or edx, ebx
add dl, 0x55
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x7b6c05fb
jne 0x41d200
movzx ecx, word [edi]
mov esi, dword [esp]
mov eax, esi
test cx, cx
je 0x41d271
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41d260
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x41d2a1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d290
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.0043cd70
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x44300c]
Function at 0x422760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x54], 0x8f3a893f
mov dword [esp + 0x58], 0x83238d29
mov dword [esp + 0x5c], 0x87f4813d
mov dword [esp + 0x60], 0x9b128521
mov dword [esp + 0x64], 0x9f9e993d
mov word [esp + 0x68], 0
mov eax, 0x1bf80422
mov ecx, 0xc80ff7dd
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x1bf803ce]
lea esi, [ecx + 0x1bf80400]
mov edi, eax
and edi, 0x1af80061
and esi, 0x8002221e
or esi, edi
xor esi, edx
xor esi, 0xe1
lea edi, [ecx + 0x37f00900]
mov ebx, edi
and ebx, edx
or ebx, esi
and edi, 0xa5
mov esi, eax
and esi, 0x5a
or esi, edi
xor esi, 0x5a
or esi, ecx
and esi, edx
not ebx
or ebx, esi
add bl, 0x56
mov byte [esp + eax - 0x1bf803ce], bl
inc eax
dec ecx
cmp eax, 0x1bf80438
jne 0x4227d0
lea ebx, [esp + 0x54]
lea ecx, [esp + 0x34]
push ebx
call fcn.00436480
shr eax, 0x1f
xor edx, edx
jmp dword [eax*4 + 0x443d90]
Function at 0x434610
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.0043d310
add esp, 0x14
test eax, eax
js 0x434746
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.0043d700
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x4346aa
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x434678
mov eax, 0xffffffff
jmp 0x43467f
lea eax, [eax*2 + 2]
push eax
call fcn.004084c0
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.0043dd10
add esp, 0x14
test eax, eax
jns 0x4346aa
push esi
call fcn.004084d0
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x94959697
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
add cl, 0x24
xor cl, byte [esp + ebx + 4]
add cl, 0x4c
mov byte [esp + ebx + 4], cl
inc ebx
cmp ebx, 7
jne 0x4346d0
mov ecx, dword [0x449860]
test ecx, ecx
je 0x43472a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x449864]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x434710
inc edi
cmp ecx, edi
jne 0x434700
jmp 0x43472a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43472a
push eax
push 4
push ecx
push dword [0x449868]
call fcn.00439510
add esp, 0x10
test esi, esi
jne 0x434748
lea eax, [esp + 4]
push eax
call fcn.0043c9d0
add esp, 4
test al, al
je 0x434746
cmp dword [esp + 4], 1
je 0x434748
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436390
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0xe3e2e1b0
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
add dl, 0x58
xor dl, byte [esp + ecx]
add dl, 0x48
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 7
jne 0x4363b0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
mov edx, dword [0x445d78]
jmp edx

Function at 0x4363f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x18]
xor eax, eax
test esi, esi
setne al
jmp dword [eax*4 + 0x445dac]
Function at 0x436480
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x10], 0
mov dword [esp], 0x94959697
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x24
xor cl, byte [esp + eax]
add cl, 0x4c
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x4364b0
mov edi, dword [esp]
mov eax, dword [0x449860]
test eax, eax
je 0x436516
xor ecx, ecx
mov edx, dword [0x449864]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x4364f0
inc ecx
cmp eax, ecx
jne 0x4364e0
jmp 0x436516
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x436516
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x449868]
call fcn.00439510
add esp, 0x1c
mov edi, eax
mov dword [esp], 0x19dadbc0
mov word [esp + 4], 0
mov eax, 0xc2b1094f
mov ecx, 0xb0
nop
nop
movzx edx, byte [esp + eax + 0x3d4ef6b1]
mov esi, ecx
xor esi, eax
and esi, edx
xor esi, eax
add esi, 0xc270ebd9
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov esi, edx
xor esi, 0x65
and edx, 0x1a
add edx, edx
sub edx, esi
mov byte [esp + eax + 0x3d4ef6b1], dl
inc eax
dec ecx
cmp eax, 0xc2b10955
jne 0x436530
cmp edi, dword [esp]
jne 0x436688
push dword [esp + 0x10]
call fcn.00436390
add esp, 4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [esp], 0x94959697
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
mov ecx, edx
add cl, 0x24
xor cl, byte [esp + edx]
add cl, 0x4c
mov byte [esp + edx], cl
inc edx
cmp edx, 7
jne 0x4365a0
mov edi, dword [esp]
mov edx, dword [0x449860]
test edx, edx
je 0x436617
mov dword [esp + 8], eax
mov eax, ebp
xor ebp, ebp
mov esi, dword [0x449864]
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x4365ed
mov ecx, ebp
and ecx, 1
xor ebp, 1
lea ebp, [ebp + ecx*2]
cmp ebp, edx
jb 0x4365d0
mov ebp, eax
jmp 0x436617
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
mov ebp, eax
je 0x436617
push 0
push dword [esp + 0xc]
mov eax, dword [esp + 0x14]
push eax
push 5
push 0x10
push edx
push dword [0x449868]
call fcn.00439510
add esp, 0x1c
mov edi, eax
test edi, edi
js 0x43667c
mov dword [esp + 8], ebp
mov ecx, dword [esp + 0xc]
mov esi, dword [ecx]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [edx + esi]
movzx ebp, word [ebx + esi]
test di, di
je 0x436655
add esi, 2
cmp di, bp
je 0x436640
cmp di, bp
je 0x436667
mov esi, dword [ecx]
test esi, esi
jne 0x436630
mov edi, 0xc0000225
jmp 0x43667c
mov edx, dword [ecx + 0x44]
mov eax, dword [esp + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [eax + 0xc], ecx
xor edi, edi
push dword [esp + 0xc]
call fcn.004363f0
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4