joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403ba0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x403cb2
mov esi, dword [esp + 0x28]
test esi, esi
je 0x403cb2
cmp dword [esp + 0x2c], 0
je 0x403cb2
push esi
call fcn.00409b80
add esp, 4
test eax, eax
je 0x403c0a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x403c11
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x403bf0
jmp 0x403c13
mov ebx, 0x1505
jmp 0x403c13
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x403cba
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x403c77
call fcn.00403db0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x403cb2
push ecx
call fcn.00409b80
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x403d2d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x403cd8
inc edi
dec esi
je 0x403c2c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x403c31
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x403cd0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.00409b80
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x403cd0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.00409ba0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x403cd0
mov eax, 0xffffffff
jmp 0x403cb2
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x403d48
inc edi
dec esi
je 0x403c72
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x403c77
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x403d40
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00409b80
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x403d40
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.00409ba0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x403d40
jmp 0x403c77
Function at 0x4044b0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x404666
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40465f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x404546
mov eax, dword [esp + 4]
sub eax, dword [esp]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 4]
mov ebx, 0x15b0
je 0x40465f
xor edx, edx
cmp ebx, 8
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
jb 0x4045c8
and ebx, 0x1ff8
mov dword [esp], ebx
xor eax, eax
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx edi, byte [ebp + edx + 2]
add edi, esi
mov eax, ecx
and eax, edi
xor ecx, edi
movzx ebx, byte [ebp + edx + 3]
add ebx, edi
movzx edi, byte [ebp + edx + 4]
add edi, ebx
add ebx, ecx
lea ecx, [ebx + eax*2]
mov ebx, dword [esp + 4]
movzx eax, byte [ebp + edx + 5]
add eax, edi
add ecx, edi
movzx esi, byte [ebp + edx + 6]
add esi, eax
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, esi
add ecx, esi
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, ebx
jb 0x404560
add ebp, eax
mov esi, dword [esp + 8]
mov edx, dword [esp]
mov eax, edx
sub eax, ebx
jae 0x40450d
mov dword [esp + 0xc], eax
mov eax, ebx
and eax, 3
mov dword [esp], edx
je 0x40460f
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x4045f0
mov eax, dword [esp]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x404500
jmp 0x40461e
mov eax, edx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x404500
mov ebx, dword [esp + 4]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x404630
jmp 0x404500
shl ecx, 0x10
or ecx, edi
jmp 0x40466b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404680
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4046e8
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
lea eax, [esi + esi]
not eax
add eax, esi
test edx, edx
je 0x4046e4
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44380c]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
or edi, ebp
xor edi, ebx
xor eax, dword [edi*4 + 0x44380c]
inc esi
cmp edx, esi
jne 0x4046b0
not eax
jmp 0x4046ea
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4099a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x409a0c
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x4099ee
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x4099f0
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 2
mov ebp, ebx
or ebx, 2
imul ebx, edx
xor edx, 2
and ebp, 0xfffffffd
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x4099d0
jmp 0x4099f0
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x409a0a
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x409a0c
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x220]
movzx ecx, word [eax]
test cx, cx
je 0x40a3b0
mov ebp, eax
add eax, 2
xor ebx, ebx
jmp 0x40a2bd
add ebx, edx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x40a2df
movzx esi, cx
cmp esi, 0x800
mov ecx, 3
sbb ecx, 0
mov edx, 1
cmp esi, 0x80
jb 0x40a2b0
mov edx, ecx
jmp 0x40a2b0
lea esi, [ebx + 1]
push esi
call fcn.00409a50
add esp, 4
test ebx, ebx
jle 0x40a3ba
add ebx, eax
add esi, eax
mov edi, eax
mov edx, ebp
mov dword [esp], esi
jmp 0x40a314
mov byte [edi], cl
mov esi, 1
add edx, 2
add edi, esi
cmp edi, ebx
jae 0x40a3bc
movzx ecx, word [edx]
test cx, cx
je 0x40a3bc
cmp cx, 0x7f
jbe 0x40a300
mov esi, edi
not esi
mov ebp, esi
and ebp, dword [esp]
xor esi, dword [esp]
lea ebp, [esi + ebp*2]
movzx esi, cx
cmp ebp, 2
jb 0x40a370
cmp esi, 0x7ff
ja 0x40a370
mov esi, edx
mov edx, ecx
shr edx, 6
add dl, 0xc0
mov byte [edi], dl
mov edx, esi
and cl, 0x3f
or cl, 0x80
mov byte [edi + 1], cl
mov esi, 2
jmp 0x40a307
mov dword [esp + 8], esi
xor esi, esi
cmp ebp, 3
jb 0x40a307
mov esi, edx
mov ebp, dword [esp + 8]
mov edx, ebp
shr edx, 0xc
or dl, 0xe0
mov byte [edi], dl
mov edx, esi
shr ebp, 6
mov esi, eax
mov eax, ebp
and al, 0x3f
or al, 0x80
mov byte [edi + 1], al
mov eax, esi
and cl, 0x3f
or cl, 0x80
mov byte [edi + 2], cl
mov esi, 3
jmp 0x40a307
push 1
call fcn.00409a50
add esp, 4
mov edi, eax
mov ebp, dword [esp + 0x228]
mov esi, dword [esp + 0x224]
mov byte [edi], 0
xor ecx, ecx
jmp 0x40a3e5
mov byte [esp + ecx + 0xc], dl
inc ecx
movzx ebx, byte [eax + ecx]
mov dl, 0x2f
cmp ebx, 0x5c
je 0x40a3e0
test ebx, ebx
je 0x40a3f8
mov edx, ebx
jmp 0x40a3e0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0x10]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push ebp
push esi
push eax
push ecx
call fcn.00406720
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x413b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebp, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x413b40
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x413b60
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x413b80
mov eax, 0xffffffff
jmp 0x413b89
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.00409a50
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x413bc1
add esi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x413bb0
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0x413bf1
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413be0
mov word [eax], 0
mov dword [esp + 0x14], ebx
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00441b10
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447868]
Function at 0x413e80
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x7c
mov eax, dword [esp + 0x94]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x413ea0
sar esi, 1
lea ebx, [esp + 0x64]
push ebx
push 0
push 0
push esi
push eax
push 0
call dword [0x44d0a4]
mov ebp, dword [esp + 0x64]
mov edi, 0xffffffff
test ebp, ebp
jns 0x413ed4
mov eax, 0xffffffff
jmp 0x413edb
lea eax, [ebp*2]
push eax
call fcn.00409a50
add esp, 4
push ebx
push ebp
mov ebp, eax
push eax
push esi
push dword [esp + 0xa4]
push 0
call dword [0x44d0a4]
mov eax, dword [esp + 0x64]
mov ecx, eax
add ecx, 0xd
js 0x413f0b
lea edi, [eax*2 + 0x1a]
push edi
call fcn.00409a50
add esp, 4
mov ebx, eax
mov dword [esp + 0x14], 0x1aa91cbb
mov dword [esp + 0x18], 0x68618ba
mov dword [esp + 0x1c], 0x265049b
mov dword [esp + 0x20], 0xeac00b9
mov dword [esp + 0x24], 0xa920c91
mov dword [esp + 0x28], 0x769a08a2
mov dword [esp + 0x2c], 0x727574e5
mov byte [esp + 0x30], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x1c
ja 0x413f9e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x14]
add eax, 0xb1627a29
xor eax, ecx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
add al, 0xca
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1d
jb 0x413f70
movzx ecx, word [ebp]
mov eax, ebx
test cx, cx
je 0x413fc1
lea edx, [ebp + 2]
mov eax, ebx
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413fb0
mov word [eax], 0
movzx ecx, word [esp + 0x14]
test cx, cx
je 0x413ff1
lea edx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413fe0
mov word [eax], 0
lea eax, [esp + 8]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00441b10
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447a94]
Function at 0x4165e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x40]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x4165f0
sar ebp, 1
lea eax, [esp + 0xc]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x44d0a4]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41661f
mov eax, 0xffffffff
jmp 0x416622
lea eax, [edi + edi]
push eax
call fcn.00409a50
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x44d0a4]
lea ebx, [esp + 0x14]
push ebx
push esi
call fcn.00441cc0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447db0]
Function at 0x419a00
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov ebx, dword [esp + 0x80]
mov ebp, dword [esp + 0x7c]
mov edi, dword [esp + 0x78]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x419a20
cmp eax, 0xffffffdd
jge 0x419a37
mov eax, 0xffffffff
jmp 0x419a3a
add eax, 0x22
push eax
call fcn.00409a50
add esp, 4
mov esi, eax
mov dword [esp + 8], 0x2696208f
mov dword [esp + 0xc], 0x3a962493
mov dword [esp + 0x10], 0x3e98388d
mov dword [esp + 0x14], 0x32983c84
mov dword [esp + 0x18], 0x3695309f
mov dword [esp + 0x1c], 0xa8f3492
mov dword [esp + 0x20], 0xebc08aa
mov dword [esp + 0x24], 0x2b90cb3
mov byte [esp + 0x28], 3
mov dword [esp + 0x29], 0
mov dword [esp + 0x2c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x27
ja 0x419ade
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x52b7e609
xor eax, ecx
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x50]
add al, 0xd6
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x28
jb 0x419ab0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x419b01
add ecx, 2
mov eax, esi
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x419af0
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x419b31
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419b20
mov word [eax], 0
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebx
mov eax, dword [esp + 0x84]
mov dword [esp + 0x60], eax
mov dword [esp + 8], 0x5aee5cea
mov dword [esp + 0xc], 0xa62c58dd
mov dword [esp + 0x10], 0xa21da40a
mov dword [esp + 0x14], 0xae0ca01f
mov dword [esp + 0x18], 0xaa12ac1d
mov dword [esp + 0x1c], 0xb61aa802
mov dword [esp + 0x20], 0xb2c2b405
mov dword [esp + 0x24], 0xbec6b0c4
mov dword [esp + 0x28], 0xba1fbcc9
mov dword [esp + 0x2c], 0x8606b806
mov dword [esp + 0x30], 0x823b842a
mov dword [esp + 0x34], 0x8e3280cc
mov dword [esp + 0x38], 0x8a318c3d
mov dword [esp + 0x3c], 0x96318826
mov dword [esp + 0x40], 0x92dc942b
mov dword [esp + 0x44], 0x9ed4903f
mov dword [esp + 0x48], 0x9a9d9ce9
mov dword [esp + 0x4c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x47
ja 0x419c31
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x36444979
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xda
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x48
jb 0x419c00
lea eax, [esp + 0x50]
lea ecx, [esp + 8]
push eax
push 0x419ef0
push ecx
push esi
call fcn.0041a570
add esp, 0x10
jmp dword [0x447e98]
Function at 0x419db3
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x419d90
cmp eax, 0xffffffed
jge 0x419da7
mov eax, 0xffffffff
jmp 0x419daa
add eax, 0x12
push eax
call fcn.00409a50
add esp, 4
mov esi, eax
mov dword [esp + 4], 0x3b501a2
mov dword [esp + 8], 0x1f971dbd
mov dword [esp + 0xc], 0x1bee19d2
mov dword [esp + 0x10], 0x17b615a6
mov dword [esp + 0x14], 0x1116
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x14
ja 0x419e39
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
and edx, 0xeb1fb06b
xor eax, 0x6b1fb06b
lea eax, [eax + edx*2]
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0x93
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x15
jb 0x419e00
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x419e61
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x419e50
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x419e91
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419e80
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.00441cc0
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x447ea0]

Function at 0x41a3f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov ebp, dword [esp + 0x64]
mov edi, dword [esp + 0x5c]
mov esi, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x6c]
movzx ecx, byte [esp + 0x68]
mov dword [esp + 0x30], ebp
mov byte [esp + 0x34], cl
mov dword [esp + 0x38], eax
test ebp, ebp
setg al
and al, cl
movzx eax, al
jmp dword [eax*4 + 0x447f84]
Function at 0x41d8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [0x44d0a4]
mov dword [esp + 8], 0x7ebc7c9e
mov dword [esp + 0xc], 0x62f160ef
mov dword [esp + 0x10], 0x66c464a7
mov dword [esp + 0x14], 0x6ac868f3
mov dword [esp + 0x18], 0x6ed16c8e
mov dword [esp + 0x1c], 0x52f950db
mov dword [esp + 0x20], 0x56fb54c6
mov dword [esp + 0x24], 0x5afc58f3
mov dword [esp + 0x28], 0x5eff5cc9
mov dword [esp + 0x2c], 0x42d340f6
mov dword [esp + 0x30], 0x46f944e7
mov dword [esp + 0x34], 0x4adb48f7
mov dword [esp + 0x38], 0x4eeb4ce4
mov dword [esp + 0x3c], 0x329d30e6
mov dword [esp + 0x40], 0x36a63496
mov word [esp + 0x44], 0x3837
mov dword [esp + 0x46], 0
mov word [esp + 0x4a], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x43
ja 0x41d990
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
add ecx, 0x83873b0b
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x90
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x44
jb 0x41d960
lea ebx, [esp + 0x4c]
lea edi, [esp + 8]
push ebx
push 0
push 0
push 0x1e
push edi
push 0
call eax
mov ebp, dword [esp + 0x4c]
test ebp, ebp
jns 0x41d9b3
mov eax, 0xffffffff
jmp 0x41d9ba
lea eax, [ebp*2]
push eax
call fcn.00409a50
add esp, 4
mov esi, eax
mov eax, dword [0x44d0a4]
mov dword [esp + 8], 0xb270b05a
mov dword [esp + 0xc], 0xb625b423
mov dword [esp + 0x10], 0xaa08a873
mov dword [esp + 0x14], 0xae0cac3f
mov dword [esp + 0x18], 0xa20da04a
mov dword [esp + 0x1c], 0xa63da417
mov dword [esp + 0x20], 0x9a079832
mov dword [esp + 0x24], 0x9e389c3f
mov dword [esp + 0x28], 0x9233900d
mov dword [esp + 0x2c], 0x9607940a
mov dword [esp + 0x30], 0x8a258833
mov dword [esp + 0x34], 0x8e1f8c3b
mov dword [esp + 0x38], 0x82278010
mov dword [esp + 0x3c], 0x8619841a
mov dword [esp + 0x40], 0x7aea7822
mov word [esp + 0x44], 0x7c7b
mov dword [esp + 0x46], 0
mov word [esp + 0x4a], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x43
ja 0x41daa0
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
add ecx, 0xc10c8a47
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 8
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x44
jb 0x41da70
push ebx
push ebp
push esi
push 0x1e
push edi
push 0
call eax
mov dword [esp + 8], 0xf69ff481
mov dword [esp + 0xc], 0xfa95f86e
mov dword [esp + 0x10], 0xfe98fc99
mov dword [esp + 0x14], 0xe281e073
mov dword [esp + 0x18], 0xe675e48e
mov dword [esp + 0x1c], 0xeaebe88d
mov byte [esp + 0x20], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x18
ja 0x41db1e
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x8a0b0064
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x6f
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x19
jb 0x41daf0
push 0
push 0
push edi
push esi
push dword [esp + 0x74]
call fcn.004165e0
add esp, 0x14
jmp dword [0x448648]
Function at 0x4207c0
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.004207e0
add esp, 4
test al, al
je case.0x41f29b.152
mov al, 1
ret

Function at 0x4207e0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x45c
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x5c], 0x38c018b
mov dword [esp + 0x60], 0x1fbf1dbd
mov dword [esp + 0x64], 0x1bee19a9
mov dword [esp + 0x68], 0x179c15a5
mov dword [esp + 0x6c], 0x131011a9
mov byte [esp + 0x70], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x14
ja 0x42086e
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x5c]
add eax, 0x6b1fb06b
xor eax, ecx
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
add al, 0x93
mov ecx, dword [esp]
mov byte [esp + ecx + 0x5c], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x15
jb 0x420840
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x48]
mov edi, eax
push eax
call fcn.0043dbe0
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x448e84]
or byte [edx], al
imul ecx, dword [esi], 0x42
add byte [ebx + 14], ch
inc edx
add byte [esi - 0x6fffbdf8], ah