joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4086f0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.00439450
test al, al
je 0x408924
call fcn.00432690
test al, al
je 0x40891f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov eax, 0xd7ae6f60
mov edx, 0xd275ef87
shrd edx, eax, cl
shr eax, cl
test cl, 0x20
je 0x40873b
mov edx, eax
xor eax, eax
lea ecx, [edx + edx]
mov esi, eax
shld esi, edx, 1
and esi, 0xaf5cdec1
and ecx, 0xa4ebdf0e
sub edx, ecx
sbb eax, esi
mov ecx, edx
add ecx, 0xd275ef87
mov esi, eax
adc esi, 0x57ae6f60
mov edi, edx
add edi, 0xd275ef87
mov ecx, eax
adc ecx, 0xd7ae6f60
mov dword [esp + 4], ecx
mov ebp, 0x2d8a1078
sub ebp, edx
mov ecx, 0x2851909f
sbb ecx, eax
mov eax, ecx
xor eax, 0x630c6904
mov edx, ebp
xor edx, 0x6d8dbe3c
or ecx, 0x9cf396fb
and ecx, eax
or ebp, 0x927241c3
and ebp, edx
mov edx, edi
and edx, 0x6d8dbe3c
imul ecx, edx
mov eax, ebp
mul edx
mov dword [esp], eax
mov ebx, edx
mov eax, esi
and eax, 0x630c6904
imul eax, ebp
add ebx, eax
add ebx, ecx
mov edx, dword [esp + 4]
and edx, 0x9cf396fb
mov ecx, edi
and ecx, 0x927241c3
or edi, 0x927241c3
mov eax, edi
imul edi, edx
mul ecx
add edi, edx
or esi, 0x9cf396fb
imul esi, ecx
add esi, edi
add eax, dword [esp]
adc esi, ebx
mov ebp, esi
shr ebp, 0xc
xor ebp, esi
shld esi, eax, 0x14
xor esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x4088fb
mov ecx, dword [esp + 8]
mov eax, ecx
xor eax, 0xf0
or ecx, 0xf
and ecx, eax
mov edx, esi
shrd edx, ebp, cl
mov ebx, ebp
shr ebx, cl
test cl, 0x20
je 0x408835
mov edx, ebx
xor ebx, ebx
xor edx, esi
xor ebx, ebp
mov ebp, edx
and ebp, 0x749d6372
mov esi, edx
and esi, 0x8b629c8d
mov dword [esp], esi
mov edi, edx
mov ecx, ebx
and ecx, 0x53f3cd0
mov dword [esp + 4], ecx
xor esi, 0x8b629c8d
mov eax, esi
mul ebp
mov dword [esp + 8], eax
xor ecx, 0x53f3cd0
imul ecx, ebp
add ecx, edx
mov eax, ebx
and eax, 0xfac0c32f
imul esi, eax
add ecx, esi
mov dword [esp + 0x10], ecx
mov edx, edi
xor edi, 0x8b629c8d
mov ecx, ebx
xor ecx, 0x53f3cd0
add edi, edx
adc ecx, ebx
sub edi, ebp
sbb ecx, eax
mov eax, dword [esp]
mov ebx, eax
not ebx
mov ebp, dword [esp + 4]
not ebp
and ebx, edi
mov esi, edi
not esi
and esi, eax
mov eax, esi
mul ebx
and ebp, ecx
imul ebp, esi
add edx, ebp
mov ebp, ecx
not ebp
mov esi, dword [esp + 4]
and ebp, esi
imul ebp, ebx
add ebp, edx
mov edx, ecx
and edx, esi
mov dword [esp + 0xc], edx
or ecx, esi
mov ebx, edi
mov edx, dword [esp]
and ebx, edx
or edi, edx
mov esi, eax
mov eax, edi
mul ebx
imul edi, dword [esp + 0xc]
add edi, edx
imul ecx, ebx
add ecx, edi
add esi, dword [esp + 8]
adc ebp, dword [esp + 0x10]
add esi, eax
adc ebp, ecx
or ebp, 0x1010101
or esi, 0x1010101
push ebp
push esi
call fcn.00409b60
add esp, 8
test al, al
je 0x40891f
call fcn.0040cc50
call fcn.0040ba40
call fcn.00439a60
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408930
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x408995
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x408950
mov eax, 0x270
jmp 0x408a6f
cmp eax, 0x4e0
jb 0x408a6f
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x4089b0
mov esi, dword [ecx + 0xd50]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0xd54]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 4]
xor edi, edx
mov dword [ecx + eax*4 + 0x390], edi
inc eax
cmp eax, 0x18c
jne 0x408a00
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov edx, dword [ecx + 4]
mov eax, edx
and eax, 0x7ffffffe
or eax, esi
shr eax, 1
and edx, 1
neg edx
xor eax, dword [ecx + 0x634]
and edx, 0x9908b0df
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
mov ecx, eax
and ecx, edx
add eax, edx
add ecx, ecx
sub eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov edx, ecx
shr edx, 0x12
xor eax, ecx
not eax
and eax, edx
xor eax, ecx
pop esi
pop edi
ret
Function at 0x408c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx eax, word [esi]
lea ebp, [esp + 4]
test ax, ax
je 0x408d55
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x408c70
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x408d00
cmp ebx, 0x7ff
ja 0x408ca0
cmp edx, 2
jb 0x408ca0
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
mov eax, ebx
xor eax, 0xc0
or ebx, 0x3f
and ebx, eax
add bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x408d00
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x408d1a
cmp edx, 4
jb 0x408d1a
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx eax, word [esi]
test ax, ax
je 0x408d55
test edx, edx
jne 0x408c50
jmp 0x408d55
movzx eax, ax
cmp eax, 0xdc00
jne 0x408d28
mov esi, edi
jmp 0x408d08
cmp edx, 3
jb 0x408d51
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x408d00
mov eax, ebp
jmp 0x408d00
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ebp], 0
xor eax, eax
jmp 0x408d78
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x408d70
test ecx, ecx
je 0x408d8c
mov ebx, ecx
jmp 0x408d70
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00404b80
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x408dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx ecx, word [esi]
test cx, cx
je 0x408f05
mov edx, dword [esp + 0x18]
dec edx
je 0x408f05
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x408e20
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x408eb0
cmp ebx, 0x7ff
ja 0x408e50
cmp edx, 2
jb 0x408e50
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
mov eax, ebx
xor eax, 0xc0
or ebx, 0x3f
and ebx, eax
add bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x408eb0
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x408eca
cmp edx, 4
jb 0x408eca
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
je 0x408f05
test edx, edx
jne 0x408e00
jmp 0x408f05
movzx eax, ax
cmp eax, 0xdc00
jne 0x408ed8
mov esi, edi
jmp 0x408eb8
cmp edx, 3
jb 0x408f01
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x408eb0
mov eax, ebp
jmp 0x408eb0
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40ba70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x434
mov dword [esp + 0x34], 0x748c72ac
mov dword [esp + 0x38], 0x88e76ff
mov dword [esp + 0x3c], 0xcf70af5
mov dword [esp + 0x40], 0x300eec
mov dword [esp + 0x44], 0x43d0234
mov dword [esp + 0x48], 0x18270635
mov dword [esp + 0x4c], 0x1ccc1a21
mov dword [esp + 0x50], 0x10e11ee4
mov dword [esp + 0x54], 0x14ec12f5
mov dword [esp + 0x58], 0x28e416e2
mov dword [esp + 0x5c], 0x2cf52a09
mov dword [esp + 0x60], 0x200f2ef9
mov dword [esp + 0x64], 0x24132210
mov dword [esp + 0x68], 0x3817261b
mov dword [esp + 0x6c], 0x3c1b3af2
mov dword [esp + 0x70], 0x30c63eea
mov dword [esp + 0x74], 0x340532cf
mov dword [esp + 0x78], 0xc8fc3601
mov dword [esp + 0x7c], 0xcc43cae9
mov dword [esp + 0x80], 0xc0fbcefb
mov dword [esp + 0x84], 0xc4e3c2f8
mov dword [esp + 0x88], 0xd837c604
mov dword [esp + 0x8c], 0xdc27da29
mov dword [esp + 0x90], 0xd008de38
mov dword [esp + 0x94], 0xd431d234
mov dword [esp + 0x98], 0xe82ed60e
mov dword [esp + 0x9c], 0xecd4ea1d
mov dword [esp + 0xa0], 0xe0dceed8
mov dword [esp + 0xa4], 0xe4dde2d6
mov dword [esp + 0xa8], 0xf8d1e6d6
mov dword [esp + 0xac], 0xfcc3fad9
mov dword [esp + 0xb0], 0xf027fe26
mov dword [esp + 0xb4], 0xf42ef225
mov dword [esp + 0xb8], 0x88cbf629
mov dword [esp + 0xbc], 0x8c778aa9
mov dword [esp + 0xc0], 0x80748e74
mov dword [esp + 0xc4], 0x84a38264
mov dword [esp + 0xc8], 0x98628642
mov dword [esp + 0xcc], 0x9c609a7a
mov dword [esp + 0xd0], 0x90a69e62
mov dword [esp + 0xd4], 0x945092b1
mov dword [esp + 0xd8], 0xa865966d
mov dword [esp + 0xdc], 0xac56aa56
mov dword [esp + 0xe0], 0xa090ae48
mov dword [esp + 0xe4], 0xa492a290
mov dword [esp + 0xe8], 0xb899a66c
mov dword [esp + 0xec], 0xbc85ba89
mov dword [esp + 0xf0], 0xb081be8d
mov dword [esp + 0xf4], 0xb493b281
mov dword [esp + 0xf8], 0x4856b666
mov dword [esp + 0xfc], 0x4caa4aaf
mov dword [esp + 0x100], 0x40b64ebf
mov dword [esp + 0x104], 0x4476427e
mov dword [esp + 0x108], 0x58704676
mov dword [esp + 0x10c], 0x5c685a67
mov dword [esp + 0x110], 0x505f5e6b
mov eax, dword [0x447228]
mov dword [esp + 4], eax
mov ecx, 0xfffffff1
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 0x43]
lea edx, [ecx + 0xc8]
and edx, eax
lea edi, [ecx + eax]
mov ebp, 4
sub ebp, edi
sub ebp, edi
not ebp
and ebp, 2
add dl, dl
neg dl
movzx edx, dl
add al, bl
movzx eax, al
and eax, 1
add edx, edi
add edx, ebp
add eax, eax
sub edx, eax
mov byte [esp + ecx + 0x43], dl
inc ecx
inc bl
cmp ecx, 0xd1
jne 0x40bcc0
lea eax, [esp + 0x34]
push 0
push 0
push 0
push 0
push eax
call dword [esp + 0x18]
xor ecx, ecx
mov dword [esp + 4], eax
test eax, eax
setne cl
mov eax, dword [ecx*4 + 0x4417b0]
mov ecx, 0xcf25852f
xor ecx, dword [0x4417b8]
add eax, ecx
inc eax
jmp eax
Function at 0x40c4e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0xe58be3af
mov dword [esp + 0x40], 0xe981e77c
mov dword [esp + 0x44], 0xed80eb86
mov dword [esp + 0x48], 0x113fef8f
mov dword [esp + 0x4c], 0x153a1347
mov dword [esp + 0x50], 0x19381746
mov dword [esp + 0x54], 0x1d6b1b32
mov dword [esp + 0x58], 0x16e1f77
mov dword [esp + 0x5c], 0x56b0366
mov dword [esp + 0x60], 0x99b0791
mov dword [esp + 0x64], 0xd420b2a
mov dword [esp + 0x68], 0x31100f7a
mov dword [esp + 0x6c], 0x35643363
mov dword [esp + 0x70], 0x39683718
mov dword [esp + 0x74], 0x3d1c3b61
mov dword [esp + 0x78], 0x21493f49
mov dword [esp + 0x7c], 0x2572234c
mov dword [esp + 0x80], 0x29732772
mov dword [esp + 0x84], 0x2db42b0a
mov dword [esp + 0x88], 0x51042f78
mov dword [esp + 0x8c], 0x5574537b
mov dword [esp + 0x90], 0x59c85717
mov dword [esp + 0x94], 0x5d305bca
mov dword [esp + 0x98], 0x41375f3b
mov dword [esp + 0x9c], 0x45264327
mov dword [esp + 0xa0], 0x4921470d
mov dword [esp + 0xa4], 0x4d634bde
mov dword [esp + 0xa8], 0x71234f1b
mov dword [esp + 0xac], 0x755a7325
mov dword [esp + 0xb0], 0x792e7725
mov dword [esp + 0xb4], 0x7d547b5a
mov dword [esp + 0xb8], 0x61287f35
mov dword [esp + 0xbc], 0x65296316
mov dword [esp + 0xc0], 0x6944672a
mov dword [esp + 0xc4], 0x6d006b4a
mov dword [esp + 0xc8], 0x91fb6f07
mov dword [esp + 0xcc], 0x95b493f7
mov dword [esp + 0xd0], 0x99fd97d1
mov dword [esp + 0xd4], 0x9df79bf9
mov dword [esp + 0xd8], 0x81a99ff1
mov dword [esp + 0xdc], 0x85c783a2
mov dword [esp + 0xe0], 0x891a87ee
mov dword [esp + 0xe4], 0x8de18be5
mov dword [esp + 0xe8], 0xb19f8feb
mov dword [esp + 0xec], 0xb5e5b3e3
mov dword [esp + 0xf0], 0xb996b7ef
mov dword [esp + 0xf4], 0xbd92bbea
mov dword [esp + 0xf8], 0xa18ebfee
mov dword [esp + 0xfc], 0xa584a3f2
mov dword [esp + 0x100], 0xa9c9a7d5
mov dword [esp + 0x104], 0xadcdabcc
mov dword [esp + 0x108], 0xd1b9af3c
mov dword [esp + 0x10c], 0xd581d3fd
mov dword [esp + 0x110], 0xd98fd785
mov dword [esp + 0x114], 0xdd8fdbf4
mov dword [esp + 0x118], 0xc1c0df88
mov eax, dword [0x447228]
lea ecx, [esp + 0x3c]
mov edx, 0xfa367f8d
nop
nop
nop
movzx esi, byte [ecx]
not esi
lea edi, [edx + 0x5c98100]
or edi, esi
and esi, edx
xor esi, edi
mov edi, esi
and edi, 0x6f
xor esi, 0x6f
lea ebx, [esi + edi*2]
inc bl
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0xfa367ead
jne 0x40c730
lea esi, [esp + 0x3c]
push 0
push 0
push 0
push 0
push esi
call eax
mov ebp, eax
xor eax, eax
test ebp, ebp
setne al
mov eax, dword [eax*4 + 0x4419e4]
mov ecx, 0x4a718aa1
xor ecx, dword [0x4419ec]
add eax, ecx
inc eax
jmp eax
Function at 0x414940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x448
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x414960
mov eax, ebx
sar eax, 1
mov dword [esp + 0xec], eax
cmp eax, 0xfffffff2
jge 0x414982
mov eax, 0xffffffff
jmp 0x414985
lea eax, [ebx + 0x1c]
push eax
call fcn.00407fc0
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x2c0], 0xfa45f8ab
mov dword [esp + 0x2c4], 0xfe6efc5a
mov dword [esp + 0x2c8], 0xf211f06b
mov dword [esp + 0x2cc], 0xf650f445
mov dword [esp + 0x2d0], 0xea7ae865
mov dword [esp + 0x2d4], 0xee72ec72
mov dword [esp + 0x2d8], 0xe2e1e071
mov eax, 0x7f
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, esi
and ecx, 0x90
mov edx, eax
and edx, 0x6f
or edx, ecx
xor dl, byte [esp + eax + 0x241]
xor dl, 0x90
add dl, 8
mov byte [esp + eax + 0x241], dl
inc eax
dec esi
cmp eax, 0x9b
jne 0x4149f0
movzx ecx, word [edi]
mov eax, dword [esp + 4]
test cx, cx
je 0x414a41
add edi, 2
mov eax, dword [esp + 4]
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x414a30
mov word [eax], 0
movzx ecx, word [esp + 0x2c0]
test cx, cx
je 0x414a71
lea edx, [esp + 0x2c2]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414a60
mov word [eax], 0
lea eax, [esp + 0x130]
push 0x60
push 3
push 0x120089
push eax
push dword [esp + 0x14]
call fcn.0043bda0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442538]
Function at 0x41a560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x198
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x10], 0x30853e42
mov dword [esp + 0x14], 0x348c3282
mov dword [esp + 0x18], 0x837368b
xor eax, eax
nop
movzx edx, byte [esp + eax + 0x10]
lea ecx, [eax - 0x571a346b]
xor ecx, edx
mov edx, ecx
and edx, 0x57
xor ecx, 0xb8d1a357
lea edx, [ecx + edx*2]
and ecx, 1
or edx, 1
xor edx, ecx
lea ecx, [edx + ecx*2]
mov byte [esp + eax + 0x10], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0xc
jb 0x41a590
mov dword [esp + 0x38], 0x94679269
mov dword [esp + 0x3c], 0xa8679661
mov dword [esp + 0x40], 0xac94aa63
mov dword [esp + 0x44], 0xa053ae92
mov dword [esp + 0x48], 0xa440a25e
mov dword [esp + 0x4c], 0xb85ba644
mov dword [esp + 0x50], 0xbc44ba41
mov dword [esp + 0x54], 0xb04bbe4e
mov dword [esp + 0x58], 0xb4b3b27b
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x59
xor cl, byte [esp + eax + 0x38]
add cl, 0x38
mov byte [esp + eax + 0x38], cl
inc eax
cmp eax, 0x24
jne 0x41a620
movzx ecx, word [esp + 0x38]
lea eax, [esp + 0x154]
test cx, cx
je 0x41a661
lea edx, [esp + 0x3a]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a650
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x41a691
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a680
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x41a6c1
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a6b0
mov word [eax], 0
mov edx, dword [edi]
mov dword [esp + 0x38], 0xf0c0ce2
mov byte [esp + 0x3c], 0xec
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x38]
xor cl, al
xor cl, 0xa8
add cl, 0xc0
mov byte [esp + eax + 0x38], cl
inc eax
cmp eax, 5
jne 0x41a6e0
movzx eax, byte [esp + 0x38]
test al, al
je 0x41a71b
lea ecx, [esp + 0x39]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41a710
mov ebx, edx
mov byte [edx], 0
lea eax, [esp + 0x144]
lea ecx, [esp + 0x148]
lea edx, [esp + 0x24]
lea edi, [esp + 0x154]
push eax
push ecx
push edx
push edi
call fcn.0040b0a0
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x442888]
mov ecx, 0x538dbdf8
xor ecx, dword [0x442890]
add eax, ecx
inc eax
jmp eax
Function at 0x41ca50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
cmp dword [ecx], 0xffffffff
je 0x41cc12
mov esi, ecx
lea eax, [esp + 0x20]
push 0
push 0
push 2
push eax
call fcn.0041de30
test al, al
je 0x41cc12
movzx eax, byte [esp + 0x21]
mov ecx, eax
not cl
or cl, 0x7f
add cl, al
inc cl
movzx eax, cl
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
cmp cl, 0x7f
je 0x41caeb
cmp eax, 0x7e
jne 0x41cbeb
mov word [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esi
push 0
push 0
push 2
push eax
call fcn.0041de30
movzx ecx, word [esp + 8]
rol cx, 8
mov ebx, eax
movzx eax, cx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
cmp byte [esp + 0x21], 0
jns 0x41cb2e
jmp 0x41cbf8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esi
push 0
push 0
push 8
push eax
call fcn.0041de30
mov ebx, eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
bswap ecx
bswap eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ecx
cmp byte [esp + 0x21], 0
js 0x41cbf8
xor eax, eax
test bl, bl
je 0x41cc12
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
push edi
mov dword [esp + 0x3c], eax
call fcn.00407fc0
add esp, 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
lea edx, [esp + 0x18]
mov ecx, esi
push edx
push ebx
push edi
push eax
call fcn.0041de30
mov ebx, eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
xor eax, edx
mov edi, dword [esp + 0x28]
xor edi, ecx
or edi, eax
sete byte [esp + 7]
or ecx, edx
setne cl
mov eax, dword [esp + 0x38]
and al, cl
cmp al, 1
jne 0x41cbcb
xor eax, eax
xor edx, edx
mov edi, dword [esp + 0x34]
mov ecx, eax
and ecx, 3
movzx ecx, byte [esp + ecx + 0x30]
xor byte [edi + eax], cl
lea ecx, [eax + eax]
and ecx, 2
xor eax, 1
add eax, ecx
adc edx, 0
cmp eax, dword [esp + 0x18]
mov ecx, edx
sbb ecx, dword [esp + 0x1c]
jb 0x41cba0
mov edi, dword [ebp + 8]
and bl, byte [esp + 7]
cmp byte [esi + 4], 0
je 0x41cc20
lea eax, [esp + 8]
mov ecx, esi
lea edx, [esp + 0x20]
push edx
push eax
call fcn.0041e0c0
jmp 0x41cc31
xor ebx, ebx
cmp byte [esp + 0x21], 0
jns 0x41cb2e
lea eax, [esp + 0x30]
mov ecx, esi
push 0
push 0
push 4
push eax
call fcn.0041de30
test bl, bl
jne 0x41cb38
xor ebx, ebx
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [esp + 8]
mov ecx, esi
lea edx, [esp + 0x20]
push edx
push eax
call fcn.0041df30
mov eax, dword [esp + 0x14]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [edi + 8], eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [edi + 4], ecx
mov dword [edi], eax
jmp 0x41cc14
Function at 0x41e280
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov dword [esp], 0x382726df
xor ecx, ecx
nop
movzx esi, byte [esp + ecx]
mov edx, 0x122e74b2
sub edx, ecx
or edx, esi
mov edi, 0xb2
sub edi, ecx
and edi, esi
not edx
or edx, edi
mov ebx, edx
xor ebx, 0x68
or edx, 0x97
and ebx, edx
add ebx, edx
inc bl
mov byte [esp + ecx], bl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 4
jb 0x41e2b0
lea ecx, [esp + 4]
mov edx, esp
push ecx
push 0x41ff10
push edx
push dword [eax + 8]
call fcn.00420310
add esp, 0x24
pop esi
pop edi
pop ebx
ret

Function at 0x420030
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x420040
cmp eax, 0xffffffed
jge 0x420057
mov eax, 0xffffffff
jmp 0x42005a
add eax, 0x12
push eax
call fcn.00407fc0
add esp, 4
mov esi, eax
mov dword [esp], 0x72ea70d3
mov dword [esp + 4], 0x76fc74d6
mov dword [esp + 8], 0x6a376823
mov dword [esp + 0xc], 0x6ecf6ccf
mov word [esp + 0x10], 0x606f
mov eax, 0xb8
mov ecx, 0xb0673147
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x4f98ceb9]
mov ebx, eax
xor ebx, ecx
and ebx, edx
xor ebx, ecx
mov edx, ebx
or edx, 0xfe
add edx, ebx
not ebx
and ebx, 1
add edx, ebx
add dl, 0xc9
mov byte [esp + ecx + 0x4f98ceb9], dl
dec eax
inc ecx
cmp eax, 0xa6
jne 0x4200a0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x420101
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4200f0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x420131
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420120
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043bf20
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x442bdc]