joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d890
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov edx, dword [esp + 0x78]
mov esi, dword [esp + 0x74]
mov dword [esp + 0x14], ecx
mov ecx, dword [ecx + 0x60]
mov word [esp], 0x2f2d
mov byte [esp + 2], 0x16
mov dword [esp + 3], 0
mov byte [esp + 7], 0
xor ebx, ebx
mov eax, ebx
add al, 0xc6
xor al, byte [esp + ebx]
add al, 0x22
mov byte [esp + ebx], al
inc ebx
cmp ebx, 8
jne 0x40d8c0
mov dword [esp + 8], 0x2e24203e
mov word [esp + 0xc], 0x132a
mov dword [esp + 0xe], 0
mov word [esp + 0x12], 0
mov ebx, 5
mov ebp, 0xfa
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ebx + 3]
mov edi, ebx
or edi, eax
not eax
or eax, ebp
and eax, edi
add al, 0xe7
mov byte [esp + ebx + 3], al
inc ebx
dec ebp
cmp ebx, 0x11
jne 0x40d900
mov dword [esp + 0x18], 0xaaa89495
mov dword [esp + 0x1c], 0xa6a69884
mov dword [esp + 0x20], 0xa3d6d895
mov dword [esp + 0x24], 0x9ee3a2d7
mov dword [esp + 0x28], 0xae9befee
mov dword [esp + 0x2c], 0xe0b54341
mov dword [esp + 0x30], 0xe593e5e2
mov dword [esp + 0x34], 0xf2aea8e0
mov dword [esp + 0x38], 0xf8fdf9ff
mov dword [esp + 0x3c], 0xf0fbf9f5
mov dword [esp + 0x40], 0xfd46aff2
mov dword [esp + 0x44], 0xc687f3f7
mov dword [esp + 0x48], 0xfe8af8fc
mov dword [esp + 0x4c], 0xf2803dd3
mov dword [esp + 0x50], 0x31dbf48d
mov byte [esp + 0x54], 0x14
mov dword [esp + 0x55], 0
mov ebx, 0xaaf83f12
mov ebp, 0xed
nop
nop
nop
nop
nop
movzx edi, byte [esp + ebx + 0x5507c106]
mov eax, ebp
xor eax, ebx
and eax, edi
xor eax, ebx
mov edi, eax
not edi
and eax, 0xa5
and edi, 0x5a
sub eax, edi
mov byte [esp + ebx + 0x5507c106], al
inc ebx
dec ebp
cmp ebx, 0xaaf83f53
jne 0x40d9b0
mov eax, dword [esp + 0x70]
add eax, ecx
movzx ebx, byte [esp + 0x18]
mov edi, eax
test bl, bl
je 0x40da0c
lea ebp, [esp + 0x19]
mov edi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [ebp]
inc ebp
test bl, bl
jne 0x40da00
mov byte [edi], 0
movzx ebx, byte [esi]
test bl, bl
je 0x40da2b
inc esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40da20
mov byte [edi], 0
movzx ebx, byte [esp + 8]
test bl, bl
je 0x40da4b
lea esi, [esp + 9]
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40da40
mov byte [edi], 0
movzx ebx, byte [edx]
test bl, bl
je 0x40da6b
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [edx]
inc edx
test bl, bl
jne 0x40da60
mov byte [edi], 0
movzx edx, byte [esp]
test dl, dl
je 0x40da8b
lea esi, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], dl
inc edi
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x40da80
mov byte [edi], 0
sub edi, eax
mov eax, dword [esp + 0x14]
add dword [eax + 0x60], edi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40ee20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
movzx eax, byte [ecx]
mov edx, ebp
test al, al
je 0x40f056
mov esi, dword [esp + 0x20]
mov edx, ebp
dec esi
je 0x40f056
mov edx, ebp
nop
nop
nop
nop
nop
movzx ebx, al
test al, al
js 0x40ee80
inc ecx
lea eax, [edx + 2]
mov word [edx], bx
mov edi, eax
sub edi, edx
sar edi, 1
sub esi, edi
mov edx, eax
movzx eax, byte [ecx]
test al, al
je 0x40f056
test esi, esi
jne 0x40ee50
jmp 0x40f056
mov eax, ebx
and eax, 0xffffffe0
cmp eax, 0xc0
jne 0x40eebf
cmp bl, 0xc2
jb 0x40ee68
movzx edi, byte [ecx + 1]
mov eax, edi
not eax
or eax, 0xc0
add eax, edi
cmp eax, 0x7f
jne 0x40f039
and ebx, 0x1f
shl ebx, 6
add ecx, 2
and edi, 0x3f
or edi, ebx
lea eax, [edx + 2]
mov word [edx], di
jmp 0x40ee5e
mov eax, ebx
and eax, 0xfffffff0
cmp eax, 0xe0
jne 0x40eef4
movzx eax, byte [ecx + 1]
cmp ebx, 0xed
mov dword [esp], eax
je 0x40ef36
cmp ebx, 0xe0
jne 0x40ef3e
mov eax, dword [esp]
add al, 0x40
cmp al, 0xe0
mov eax, dword [esp]
jb 0x40ee68
jmp 0x40ef3e
mov eax, ebx
and eax, 0xfffffff8
cmp eax, 0xf0
jne 0x40f03f
cmp bl, 0xf4
ja 0x40ee68
movzx eax, byte [ecx + 1]
cmp ebx, 0xf4
mov dword [esp], eax
je 0x40ef81
cmp ebx, 0xf0
jne 0x40ef89
mov eax, dword [esp]
add al, 0x40
cmp al, 0xd0
mov eax, dword [esp]
jb 0x40ee68
jmp 0x40ef89
cmp al, 0x9f
ja 0x40ee68
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x40f039
movzx edi, byte [ecx + 2]
mov eax, edi
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x40f046
shl ebx, 0xc
mov eax, dword [esp]
and eax, 0x3f
shl eax, 6
or eax, ebx
add eax, edi
add eax, 0xffffff80
mov word [edx], ax
lea eax, [edx + 2]
add ecx, 3
jmp 0x40ee5e
cmp al, 0x8f
ja 0x40ee68
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x40f039
movzx eax, byte [ecx + 2]
mov edi, eax
and edi, 0xffffffc0
cmp edi, 0x80
jne 0x40f046
movzx edi, byte [ecx + 3]
mov dword [esp + 4], edi
and edi, 0xffffffc0
cmp edi, 0x80
jne 0x40f04e
shl ebx, 0x12
shl eax, 6
or eax, ebx
mov edi, dword [esp]
shl edi, 0xc
mov dword [esp], edi
and edi, 0x3f000
and eax, 0x1c0fc0
or eax, edi
add ecx, 4
cmp eax, 0x10000
jb 0x40ee68
cmp esi, 2
jb 0x40f03f
mov ebx, dword [esp + 4]
and ebx, 0x3f
lea edi, [eax + 0xf0000]
or ebx, eax
shr edi, 0xa
and edi, 0x3ff
or edi, 0xd800
mov word [edx], di
mov eax, ebx
xor eax, 0x2000
mov ebx, dword [esp]
or ebx, 0x3ff
and ebx, eax
or ebx, 0xdc00
mov word [edx + 2], bx
lea eax, [edx + 4]
jmp 0x40ee5e
inc ecx
jmp 0x40ee68
mov eax, edx
jmp 0x40ee5e
add ecx, 2
jmp 0x40ee68
add ecx, 3
jmp 0x40ee68
mov word [edx], 0
mov eax, edx
xor eax, ebp
not ebp
and ebp, edx
add ebp, ebp
sub ebp, eax
sar ebp, 1
mov eax, ebp
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x450810]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40f60e
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44ad38]
xor eax, eax
jmp 0x40fbe9
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x410f90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x44b824]
Function at 0x41dfd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x10b8
call fcn.0040c960
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41dff0
sar esi, 1
lea ecx, [esp + 0x38]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x451b48]
mov ebx, dword [esp + 0x38]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41e024
mov eax, 0xffffffff
jmp 0x41e027
lea eax, [ebx + ebx]
push eax
call fcn.0040ca00
add esp, 4
lea ecx, [esp + 0x38]
push ecx
push ebx
mov dword [esp + 0x24], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x451b48]
mov eax, dword [esp + 0x38]
mov ecx, eax
add ecx, 0xd
js 0x41e05c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040ca00
add esp, 4
mov esi, eax
mov dword [esp + 0xb4], 0xe152e740
mov dword [esp + 0xb8], 0xdd6fe343
mov dword [esp + 0xbc], 0xd9bedf50
mov dword [esp + 0xc0], 0xd545db76
mov dword [esp + 0xc4], 0xd15bd746
mov dword [esp + 0xc8], 0xcd43d34b
mov dword [esp + 0xcc], 0xc9cecf5a
mov byte [esp + 0xd0], 0
mov eax, 0xcf125ed9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x30eda1db]
xor ecx, eax
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
add cl, 0xc2
mov byte [esp + eax + 0x30eda1db], cl
inc eax
cmp eax, 0xcf125ef6
jne 0x41e0d0
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x41e121
mov eax, dword [esp + 0x1c]
lea edx, [eax + 2]
mov eax, esi
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e110
mov word [eax], 0
movzx ecx, word [esp + 0xb4]
test cx, cx
je 0x41e151
lea edx, [esp + 0xb6]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e140
mov word [eax], 0
lea eax, [esp + 0x48]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00444ea0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c808]
Function at 0x423540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x423550
sar ebp, 1
mov eax, esp
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x451b48]
mov edi, dword [esp]
test edi, edi
jns 0x42357c
mov eax, 0xffffffff
jmp 0x42357f
lea eax, [edi + edi]
push eax
call fcn.0040ca00
add esp, 4
mov esi, eax
mov eax, esp
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x451b48]
lea ebx, [esp + 0xc]
push ebx
push esi
call fcn.00445030
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44cb88]
Function at 0x425300
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x425310
cmp eax, 0xffffffed
jge 0x425327
mov eax, 0xffffffff
jmp 0x42532a
add eax, 0x12
push eax
call fcn.0040ca00
add esp, 4
mov esi, eax
mov dword [esp], 0xc153c7a0
mov dword [esp + 4], 0xcd59c3af
mov dword [esp + 8], 0xc998cf90
mov dword [esp + 0xc], 0xf5a8cba4
mov dword [esp + 0x10], 0xf7f4
mov byte [esp + 0x14], 0
mov eax, 0x3a328651
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x3a328651]
xor ecx, eax
mov edx, ecx
and edx, 0x6a
xor ecx, 0x6a
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x3a328651], cl
inc eax
cmp eax, 0x3a328666
jne 0x425370
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x4253c1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4253b0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4253f1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4253e0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00445030
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44cc90]
Function at 0x427da0
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x70
mov eax, dword [0x451b48]
mov dword [esp + 4], 0x6132675b
mov dword [esp + 8], 0x7d1f6311
mov dword [esp + 0xc], 0x790a7f1f
mov dword [esp + 0x10], 0x750a7b3b
mov dword [esp + 0x14], 0x712a7704
mov dword [esp + 0x18], 0x8dfe7313
mov dword [esp + 0x1c], 0x89b18fef
mov dword [esp + 0x20], 0x8b88
mov byte [esp + 0x24], 0
mov edx, 0x8299e168
mov ecx, 0x7d661e96
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx + 0x7d661e9c]
lea esi, [edx + 1]
mov ebx, ecx
xor ebx, 0x34
mov ebp, ecx
or ebp, 0xcb
and ebp, ebx
mov ebx, esi
and ebx, 0x34
or ebx, ebp
xor ebx, edi
xor ebx, 0xcb
add bl, 0xf3
mov byte [esp + edx + 0x7d661e9c], bl
dec ecx
mov edx, esi
cmp esi, 0x8299e189
jne 0x427e00
lea edi, [esp + 0x64]
lea ebx, [esp + 4]
push edi
push 0
push 0
push 0xe
push ebx
push 0
call eax
mov ebp, dword [esp + 0x64]
test ebp, ebp
jns 0x427e61
mov eax, 0xffffffff
jmp 0x427e68
lea eax, [ebp*2]
push eax
call fcn.0040ca00
add esp, 4
mov dword [esp], eax
mov eax, dword [0x451b48]
mov dword [esp + 4], 0xd906db3f
mov dword [esp + 8], 0xdd7bdf69
mov dword [esp + 0xc], 0xd16ed37b
mov dword [esp + 0x10], 0xd566d717
mov dword [esp + 0x14], 0xa96eab64
mov dword [esp + 0x18], 0xad1aaf0f
mov dword [esp + 0x1c], 0xa159a30b
mov word [esp + 0x20], 0xa7a0
mov dword [esp + 0x22], 0
mov word [esp + 0x26], 0
mov ecx, 0x3ec24a2f
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x3ec24a2b]
lea esi, [ecx - 0x3ec24a00]
and esi, edx
or edx, ecx
xor edx, esi
mov esi, edx
xor esi, 0xec
and edx, 0x13
add edx, edx
sub edx, esi
inc dl
mov byte [esp + ecx - 0x3ec24a2b], dl
inc ecx
cmp ecx, 0x3ec24a53
jne 0x427ed0
push edi
push ebp
push dword [esp + 8]
push 0xe
push ebx
push 0
call eax
mov eax, dword [esp + 0x64]
mov ecx, eax
add ecx, 9
jns 0x427f24
mov eax, 0xffffffff
jmp 0x427f2b
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040ca00
add esp, 4
mov edi, eax
mov dword [esp + 4], 0xf74609ac
mov dword [esp + 8], 0xf35df555
mov dword [esp + 0xc], 0xff5ff167
mov dword [esp + 0x10], 0xfb57fd57
mov dword [esp + 0x14], 0xe7e6f967
mov dword [esp + 0x18], 0
mov eax, 0xad8ffffe
mov ecx, 0x52700001
movzx edx, byte [esp + eax + 0x52700006]
mov esi, ecx
and esi, 0x4034fbb2
mov ebp, eax
and ebp, 0x880b044d
or ebp, esi
xor ebp, edx
mov edx, ebp
and edx, 9
xor ebp, 0xbb
lea edx, [edx*2]
add edx, ebp
inc dl
mov byte [esp + eax + 0x52700006], dl
inc eax
dec ecx
cmp eax, 0xad900016
jne 0x427f70
mov eax, dword [esp]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x427fe1
mov eax, dword [esp]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x427fd0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x428011
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428000
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.00445030
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d3d8]
Function at 0x4285a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [0x451b48]
mov dword [esp], eax
mov dword [esp + 8], 0xb14d8fab
mov dword [esp + 0xc], 0xb522b320
mov dword [esp + 0x10], 0xb955b770
mov dword [esp + 0x14], 0xbd59bb2c
mov dword [esp + 0x18], 0xa142bf9b
mov dword [esp + 0x1c], 0xa54aa354
mov dword [esp + 0x20], 0xa948a733
mov dword [esp + 0x24], 0xad4dab4c
mov dword [esp + 0x28], 0x514caf3e
mov dword [esp + 0x2c], 0x55c053bb
mov dword [esp + 0x30], 0x59aa57b0
mov dword [esp + 0x34], 0x5dc85ba8
mov dword [esp + 0x38], 0x41b85fcd
mov dword [esp + 0x3c], 0x45ae43ab
mov dword [esp + 0x40], 0x49d347a3
mov word [esp + 0x44], 0x4b48
mov dword [esp + 0x46], 0
mov word [esp + 0x4a], 0
mov ebx, 0xee05cddd
mov edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ebx + 0x11fa322b]
mov edi, esi
not edi
mov eax, ebx
and eax, edi
mov ebp, edx
and ebp, 3
mov ecx, ebx
and ecx, 0xfc
or ecx, ebp
xor ecx, 0xfc
or ecx, edi
add ecx, esi
inc ecx
or ecx, eax
add cl, 0xaf
mov byte [esp + ebx + 0x11fa322b], cl
inc ebx
dec edx
cmp ebx, 0xee05ce21
jne 0x428650
lea eax, [esp + 4]
lea ebp, [esp + 8]
push eax
push 0
push 0
push 0x1e
push ebp
push 0
call dword [esp + 0x18]
mov edi, dword [esp + 4]
test edi, edi
jns 0x4286b5
mov eax, 0xffffffff
jmp 0x4286b8
lea eax, [edi + edi]
push eax
call fcn.0040ca00
add esp, 4
mov esi, eax
mov eax, dword [0x451b48]
mov dword [esp], eax
mov dword [esp + 8], 0x97579945
mov dword [esp + 0xc], 0x93029504
mov dword [esp + 0x10], 0x8f2f912c
mov dword [esp + 0x14], 0x8b2b8d00
mov dword [esp + 0x18], 0x87228955
mov dword [esp + 0x1c], 0x831a8528
mov dword [esp + 0x20], 0x7fec810d
mov dword [esp + 0x24], 0x7be77de0
mov dword [esp + 0x28], 0x77e879f6
mov dword [esp + 0x2c], 0x73fc75ed
mov dword [esp + 0x30], 0x6fca71ec
mov dword [esp + 0x34], 0x6be46ddc
mov dword [esp + 0x38], 0x67fc69fb
mov dword [esp + 0x3c], 0x63f665fd
mov dword [esp + 0x40], 0x5fd161fd
mov word [esp + 0x44], 0x5d5c
mov dword [esp + 0x46], 0
mov word [esp + 0x4a], 0
mov ecx, 0x4c0ab719
nop
nop
movzx edx, byte [ebp]
mov ebx, ecx
or ebx, edx
lea eax, [ecx - 0x4c0ab700]
and eax, edx
sub eax, ebx
add eax, 0x7c359380
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
mov byte [ebp], al
inc ebp
dec ecx
cmp ecx, 0x4c0ab6d5
jne 0x428760
lea ebp, [esp + 8]
lea eax, [esp + 4]
push eax
push edi
push esi
push 0x1e
push ebp
push 0
call dword [esp + 0x18]
mov dword [esp + 8], 0xf962fbb0
mov dword [esp + 0xc], 0xfd6cff73
mov dword [esp + 0x10], 0xf169f358
mov dword [esp + 0x14], 0xf550f766
mov dword [esp + 0x18], 0xe97ceb6b
mov dword [esp + 0x1c], 0xedeeef4c
mov byte [esp + 0x20], 0
mov eax, 0x81e530ff
xor ecx, ecx
nop
movzx edx, byte [esp + eax + 0x7e1acf09]
mov edi, ecx
xor edi, eax
and edi, edx
xor edi, eax
mov edx, edi
and edx, 4
xor edi, 4
lea edx, [edi + edx*2]
inc dl
mov byte [esp + eax + 0x7e1acf09], dl
inc eax
dec ecx
cmp eax, 0x81e53118
jne 0x4287e0
push 0
push 0
push ebp
push esi
push dword [esp + 0x70]
call fcn.00423540
add esp, 0x14
jmp dword [0x44d430]
Function at 0x42b090
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.0042b0b0
add esp, 4
test al, al
je 0x42b7e0
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xbc
mov dword [esp + 0x94], 0x69186b2b
mov dword [esp + 0x98], 0x6d1a6f1d
mov dword [esp + 0x9c], 0x711e730b
mov dword [esp + 0xa0], 0x7526771c
mov dword [esp + 0xa4], 0x790e7b13
mov dword [esp + 0xa8], 0x7d7e7f10
mov dword [esp + 0xac], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
mov esi, ecx
xor esi, 0x99
mov edx, eax
and edx, 0xc
sub edx, esi
xor dl, byte [esp + ecx + 0x94]
add dl, 0xfd
mov byte [esp + ecx + 0x94], dl
inc ecx
add eax, 2
cmp ecx, 0x1c
jne 0x42b840
mov dword [esp + 0xc], 0x912c9f30
mov dword [esp + 0x10], 0x952b9357
mov dword [esp + 0x14], 0x8923972f
mov dword [esp + 0x18], 0x8d388b3c
mov dword [esp + 0x1c], 0x81228f27
mov dword [esp + 0x20], 0x8541833f
mov dword [esp + 0x24], 0x793e8741
mov dword [esp + 0x28], 0x7dc47bc3
mov dword [esp + 0x2c], 0x71d27fbb
mov dword [esp + 0x30], 0x75c373c5
mov dword [esp + 0x34], 0x69c277b2
mov dword [esp + 0x38], 0x6da96bc1
mov dword [esp + 0x3c], 0x61a96fde
mov dword [esp + 0x40], 0x65d463cc
mov dword [esp + 0x44], 0x59fa67c7
mov dword [esp + 0x48], 0x5dfd5bce
mov dword [esp + 0x4c], 0x51eb5ff0
mov dword [esp + 0x50], 0x55f553c4
mov dword [esp + 0x54], 0x49c957f7
mov dword [esp + 0x58], 0x4b48
mov eax, 0x65
mov ecx, 0x9a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x59]
mov esi, eax
or esi, edx
not edx
or edx, ecx
and edx, esi
add dl, 7
mov byte [esp + eax - 0x59], dl
inc eax
dec ecx
cmp eax, 0xb5
jne case.default.0x42b95d
lea ecx, [esp + 0x94]
lea eax, [esp + 0xc]
push ecx
push eax
call fcn.0043c1e0
add esp, 8
mov edi, eax
xor eax, eax
test edi, edi
sete al
jmp dword [eax*4 + 0x44db6c]
mov ecx, 0xb9890042
inc edx
add byte [edx + edi*4 - 0x4549ffbe], bl
inc edx
add byte [ebx + edi*4 + 0x42], dl
add bh, al
mov edx, 0xbb7e0042
inc edx
add byte [ecx + 0x400042bb], dh
mov ebp, 0xbbd70042
inc edx
add byte [ecx], dh
mov ebp, 0xbc0c0042
inc edx
add byte [edx], dl
mov ebp, 0xbc610042
inc edx
add byte [edx], al
Function at 0x42cd5b
Capabilities:
Encode data using xor

Disassembly:
push 0
push esi
mov dword [ebp - 0x6c], eax
push eax
mov eax, dword [ebp - 0x2c]
push dword [eax]
call fcn.004452a0
add esp, 0x10
not eax
shr eax, 0x1f
xor ebx, ebx
mov ecx, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x34]
jmp dword [eax*4 + 0x44dd04]

Function at 0x42dcb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov eax, dword [0x451b48]
mov dword [esp + 0x2c], 0x21e527db
mov dword [esp + 0x30], 0x3d922390
mov dword [esp + 0x34], 0x399d3fe0
mov dword [esp + 0x38], 0x35993bb4
mov dword [esp + 0x3c], 0x319237cb
mov dword [esp + 0x40], 0xd8333e6
mov dword [esp + 0x44], 0x9b10f80
mov dword [esp + 0x48], 0x5a90bb8
mov dword [esp + 0x4c], 0x1f307b8
mov dword [esp + 0x50], 0x1da603f5
mov dword [esp + 0x54], 0x19a11f91
mov dword [esp + 0x58], 0x15971b95
mov dword [esp + 0x5c], 0x11a717af
mov dword [esp + 0x60], 0xede413a6
mov dword [esp + 0x64], 0xe959ef64
mov dword [esp + 0x68], 0xe5eaeb5c
mov dword [esp + 0x6c], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 0x2c]
mov edi, ecx
and edi, 0x92
mov ebx, edx
xor ebx, 0xc4584c9
add ebx, edi
mov edi, esi
not edi
lea edi, [esi + edi*2]
inc edi
xor edi, esi
and edi, ebx
xor edi, esi
mov esi, edi
and esi, 1
xor edi, 1
lea ebx, [edi + esi*2]
add bl, 0x12
mov byte [esp + edx + 0x2c], bl
inc edx
add ecx, 2
cmp edx, 0x44
jne 0x42dd50
lea edx, [esp + 0x88]
lea ecx, [esp + 0x2c]
push edx
push 0
push 0
push 0x1f
push ecx
push 0
call eax
mov edi, dword [esp + 0x88]
test edi, edi
jns 0x42ddb9
mov eax, 0xffffffff
jmp 0x42ddbc
lea eax, [edi + edi]
push eax
call fcn.0040ca00
add esp, 4
mov dword [esp + 0x80], eax
mov eax, dword [0x451b48]
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], 0x77b77985
mov dword [esp + 0x30], 0x73c275c4
mov dword [esp + 0x34], 0x4fef71ac
mov dword [esp + 0x38], 0x4beb4dc0
mov dword [esp + 0x3c], 0x47e249b5
mov dword [esp + 0x40], 0x43f14596
mov dword [esp + 0x44], 0x5fe341cc
mov dword [esp + 0x48], 0x5bfb5dec
mov dword [esp + 0x4c], 0x57a159e4
mov dword [esp + 0x50], 0x53f655a3
mov dword [esp + 0x54], 0x2f9351df
mov dword [esp + 0x58], 0x2ba52da3
mov dword [esp + 0x5c], 0x27952991
mov dword [esp + 0x60], 0x23d02596
mov dword [esp + 0x64], 0x3f8b21a8
mov dword [esp + 0x68], 0x3b3a3d88
mov ebx, 0xe1885916
mov ebp, 0xe9
nop
movzx esi, byte [esp + ebx + 0x1e77a716]
mov eax, ebx
or eax, esi
mov edx, esi
not edx
or edx, ebp
and edx, eax
not edx
and edx, ebx
mov eax, edx
or al, 0xfd
inc al
mov ecx, edx
and cl, 0x7d
mul cl
mov ecx, eax
mov eax, esi
add cl, al
mov eax, edx
shr al, 1
and al, 1
or dl, 2
mul dl
add al, al
sub cl, al
movzx eax, cl
add eax, ebx
add al, 0x92
mov byte [esp + ebx + 0x1e77a716], al
inc ebx
dec ebp
cmp ebx, 0xe1885956
jne 0x42de60
lea eax, [esp + 0x88]
push eax
push edi
mov edi, dword [esp + 0x88]
push edi
push 0x1f
lea eax, [esp + 0x3c]
push eax
push 0
call dword [esp + 0x24]
lea eax, [esp + 0x28]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00444ea0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44dd94]