joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408b60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
xor eax, eax
mov edx, SysReAllocString
nop
nop
nop
nop
nop
mov ebx, dword [ecx + eax*4 + 0x9c4]
and ebx, edx
mov esi, dword [ecx + eax*4 + 0x9c8]
mov edi, esi
and edi, 0x7ffffffe
or edi, ebx
shr edi, 1
and esi, 1
neg esi
and esi, 0x9908b0df
mov ebx, edi
and ebx, esi
add esi, edi
add ebx, ebx
sub esi, ebx
xor esi, dword [ecx + eax*4 + 0xff8]
mov dword [ecx + eax*4 + 4], esi
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
cmp eax, 0xe3
jb 0x408b70
mov eax, 0x353
mov edx, 0x1c6
mov esi, SysReAllocString
nop
nop
nop
mov ebp, dword [ecx + eax*4 + 4]
and ebp, esi
mov edi, eax
xor edi, 1
mov ebx, edx
and ebx, 2
add ebx, edi
mov edi, dword [ecx + ebx*4 + 4]
mov ebx, edi
and ebx, 0x7ffffffe
or ebx, ebp
shr ebx, 1
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 - 0xd48]
xor edi, ebx
mov dword [ecx + eax*4 - 0x9bc], edi
inc eax
add edx, 2
cmp eax, 0x4df
jne 0x408bd0
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x408e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
movzx edi, word [esi]
test di, di
je 0x408f9e
mov edx, dword [esp + 0x18]
dec edx
je 0x408f9e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, di
lea edi, [esi + 2]
cmp cx, 0x7f
ja 0x408e90
mov byte [eax], cl
lea ebp, [eax + 1]
jmp 0x408f40
cmp ecx, 0x7ff
ja 0x408ed0
cmp edx, 2
jb 0x408ed0
mov ebx, ecx
shr ebx, 6
mov esi, ecx
shr esi, 5
and esi, 0x80
xor ebx, 0xc0
add ebx, esi
mov byte [eax], bl
and cl, 0x3f
or cl, 0x80
lea ebp, [eax + 2]
mov byte [eax + 1], cl
jmp 0x408f40
mov ebx, ecx
and ebx, 0xfc00
cmp ebx, 0xd800
jne 0x408f5a
cmp edx, 4
jb 0x408f5a
movzx edi, word [esi + 2]
add esi, 4
shl ecx, 0xa
lea ebx, [ecx + edi]
add ebx, 0xfca02400
mov ecx, ebx
shr ecx, 0x12
add cl, 0xf0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 0xc
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
shr ebx, 6
mov ecx, ebx
not ecx
or ecx, 0x3f
add ecx, ebx
add cl, 0x81
mov byte [eax + 2], cl
mov ebx, 0x3f
sub ebx, edi
not ebx
or ebx, edi
and bl, 0x3f
or bl, 0x80
mov byte [eax + 3], bl
lea ebp, [eax + 4]
mov edi, esi
nop
nop
nop
nop
nop
add edx, eax
sub edx, ebp
mov esi, edi
mov eax, ebp
movzx edi, word [esi]
test di, di
je 0x408f9e
test edx, edx
jne 0x408e70
jmp 0x408f9e
movzx esi, bx
cmp esi, 0xdc00
jne 0x408f69
mov esi, edi
jmp 0x408f48
cmp edx, 3
jb 0x408f9a
mov ebx, ecx
shr ebx, 0xc
or bl, 0xe0
mov byte [eax], bl
mov esi, ecx
shr esi, 6
mov ebx, esi
not ebx
or ebx, 0x3f
add ebx, esi
add bl, 0x81
mov byte [eax + 1], bl
and cl, 0x3f
or cl, 0x80
lea ebp, [eax + 3]
mov byte [eax + 2], cl
jmp 0x408f40
mov ebp, eax
jmp 0x408f40
mov byte [eax], 0
sub eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409030
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov esi, dword [esp + 0x5c]
mov dword [esp + 0x10], ecx
mov eax, dword [ecx + 0x80]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xa0d
mov dword [esp + 2], 0x73197330
mov word [esp + 6], 0x7e1e
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebx + 0xe02]
xor ax, word [esp + ebx*2 + 2]
add eax, 0xffff8ff0
mov word [esp + ebx*2 + 2], ax
mov eax, ebx
xor eax, 0xfffffffe
mov ebp, ebx
or ebp, 1
and ebp, eax
mov eax, ebp
and eax, 2
or ebp, 2
imul ebp, eax
xor eax, 2
mov edi, ebx
and edi, 1
neg edi
and edi, eax
xor ebx, 1
add ebx, edi
add ebx, ebp
cmp ebx, 3
jb 0x409070
mov dword [esp + 0x1a], 0xaec4358b
mov dword [esp + 0x1e], 0xae2ca826
mov dword [esp + 0x22], 0x94cfd11e
mov dword [esp + 0x26], 0xab22ac1f
mov dword [esp + 0x2a], 0xaf26a827
mov dword [esp + 0x2e], 0x9991e25e
mov dword [esp + 0x32], 0xd15eaa5d
mov dword [esp + 0x36], 0x9d619d50
mov dword [esp + 0x3a], 0x9d59dfad
mov dword [esp + 0x3e], 0xdda49955
mov word [esp + 0x42], 0x3ffa
xor ecx, ecx
mov ebx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, word [esp + ecx*2 + 0x1a]
mov edi, ebx
or edi, 0x25d04e36
add edi, ecx
mov ebp, ecx
xor ebp, 0x25d04e36
lea edx, [edi*2]
add edx, ebp
lea edi, [edi*2 + 2]
add edi, ebp
and edi, eax
add eax, edx
add eax, 2
add edi, edi
sub eax, edi
add eax, 0xffff8e50
mov word [esp + ecx*2 + 0x1a], ax
lea eax, [ecx + 1]
dec ebx
mov ecx, eax
cmp eax, 0x15
jne 0x409120
mov ecx, dword [esp + 0x58]
add ecx, dword [esp + 0xc]
mov dword [esp + 0x16], 0x2d2d
xor eax, eax
mov edi, ecx
test al, al
jne 0x40919b
mov al, 0x2d
lea ebx, [esp + 0x17]
mov edi, ecx
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ebx]
inc ebx
test al, al
jne 0x409190
mov byte [edi], 0
mov eax, dword [esp + 0x10]
movzx ebx, byte [eax + 0x60]
test bl, bl
je 0x4091bc
lea ebp, [eax + 0x61]
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [ebp]
inc ebp
test bl, bl
jne 0x4091b0
mov byte [edi], 0
movzx ebx, byte [esp + 0x1a]
test bl, bl
mov edx, dword [esp + 0x60]
je 0x4091dc
lea ebp, [esp + 0x1b]
mov byte [edi], bl
inc edi
movzx ebx, byte [ebp]
inc ebp
test bl, bl
jne 0x4091d0
mov byte [edi], 0
movzx ebx, byte [esi]
test bl, bl
je 0x4091fb
inc esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x4091f0
mov byte [edi], 0
movzx ebx, byte [esp + 2]
test bl, bl
je 0x40921b
lea esi, [esp + 3]
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x409210
mov byte [edi], 0
movzx ebx, byte [edx]
test bl, bl
je 0x40923b
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [edx]
inc edx
test bl, bl
jne 0x409230
mov byte [edi], 0
movzx edx, byte [esp + 8]
test dl, dl
je 0x40925b
lea esi, [esp + 9]
nop
nop
nop
nop
nop
mov byte [edi], dl
inc edi
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x409250
mov byte [edi], 0
sub edi, ecx
add dword [eax + 0x80], edi
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x409b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x220
mov eax, dword [0x443f84]
mov dword [esp + 0x1a0], 0x6a6e626d
xor ecx, ecx
nop
nop
nop
nop
lea edx, [ecx + 0x2845]
xor dx, word [esp + ecx*2 + 0x1a0]
add edx, 0xffffbdd8
mov word [esp + ecx*2 + 0x1a0], dx
lea ecx, [ecx + ecx*2]
xor ecx, 0x2a71dc8d
add ecx, 0xd58e2374
cmp ecx, 2
jb 0x409b90
mov ecx, dword [esp + 0x1a0]
mov dword [esp + 0x10], 0x26e526e2
mov dword [esp + 0x14], 0x268726a5
mov dword [esp + 0x18], 0x26d826da
mov dword [esp + 0x1c], 0x268826d5
mov dword [esp + 0x20], 0x26922691
mov word [esp + 0x24], 0x252f
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + edx*2 + 0x10]
lea edi, [edx + 0x20bd]
and edi, esi
add esi, edx
add edi, edi
sub esi, edi
add esi, 0x436d1ad4
mov edi, esi
and edi, 1
xor esi, 1
lea esi, [esi + edi*2]
mov word [esp + edx*2 + 0x10], si
mov esi, edx
xor esi, 0xfffffffe
or edx, 1
and esi, edx
add edx, esi
cmp edx, 0xb
jb 0x409c00
lea edx, [esp + 0x10]
push ecx
push 0
push edx
call eax
mov ecx, 0x443f88
push eax
call fcn.00437180
movzx eax, al
mov eax, dword [eax*4 + 0x43e328]
mov ecx, 0xf9642cf1
xor ecx, dword [0x43e330]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x40a850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
movzx ecx, byte [eax]
test cl, cl
je 0x40aafb
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
dec edi
jmp 0x40a89c
inc eax
lea ecx, [edx + 2]
mov word [edx], bx
mov esi, ecx
sub esi, edx
sar esi, 1
sub edi, esi
mov edx, ecx
movzx ecx, byte [eax]
test cl, cl
je 0x40aafb
test ebp, ebp
je 0x40a8a8
cmp eax, ebp
jae 0x40aafb
test edi, edi
je 0x40aafb
movzx ebx, cl
test cl, cl
jns 0x40a880
mov ebp, ebx
and ebp, 0xffffffe0
cmp ebp, 0xc0
jne 0x40a8cf
cmp cl, 0xc2
jae 0x40a912
mov ebp, dword [esp + 0x2c]
jmp 0x40a891
mov esi, ebx
and esi, 0xfffffff0
cmp esi, 0xe0
jne 0x40a955
movzx esi, byte [eax + 1]
mov dword [esp], esi
cmp cl, 0xed
mov ebp, dword [esp + 0x2c]
je 0x40a9aa
cmp ebx, 0xe0
mov ecx, dword [esp]
jne 0x40a9b6
mov ecx, dword [esp]
add cl, 0x40
cmp cl, 0xe0
mov ecx, dword [esp]
jb 0x40a891
jmp 0x40a9b6
movzx esi, byte [eax + 1]
mov ebp, esi
xor ebp, 0xffffff3f
mov ecx, esi
or ecx, 0xc0
and ecx, ebp
cmp ecx, 0x80
jne 0x40a9a0
and ebx, 0x1f
shl ebx, 6
add eax, 2
mov ecx, esi
not ecx
or ecx, 0x3f
add ebx, esi
lea esi, [ecx + ebx]
inc esi
lea ecx, [edx + 2]
mov word [edx], si
mov ebp, dword [esp + 0x2c]
jmp 0x40a887
mov esi, ebx
and esi, 0xfffffff8
cmp esi, 0xf0
mov ebp, dword [esp + 0x2c]
jne 0x40aadb
cmp cl, 0xf4
ja 0x40a891
movzx ecx, byte [eax + 1]
mov dword [esp], ecx
je 0x40aa0b
cmp ebx, 0xf0
jne 0x40aa14
mov ecx, dword [esp]
add cl, 0x40
cmp cl, 0xd0
mov ecx, dword [esp]
jb 0x40a891
jmp 0x40aa14
inc eax
mov ebp, dword [esp + 0x2c]
jmp 0x40a891
mov ecx, dword [esp]
cmp cl, 0x9f
ja 0x40a891
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40aae2
movzx ebp, byte [eax + 2]
mov ecx, ebp
not ecx
or ecx, 0xc0
add ecx, ebp
cmp ecx, 0x7f
jne 0x40a9ff
shl ebx, 0xc
mov ecx, dword [esp]
and ecx, 0x3f
shl ecx, 6
or ecx, ebx
and ebp, 0x3f
or ebp, ecx
add eax, 3
lea ecx, [edx + 2]
mov word [edx], bp
mov ebp, dword [esp + 0x2c]
jmp 0x40a887
add eax, 2
mov ebp, dword [esp + 0x2c]
jmp 0x40a891
cmp cl, 0x8f
ja 0x40a891
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40aae2
movzx esi, byte [eax + 2]
mov ecx, esi
not ecx
or ecx, 0xc0
add ecx, esi
cmp ecx, 0x7f
jne 0x40aae8
mov dword [esp + 8], esi
movzx ecx, byte [eax + 3]
movzx esi, cl
mov dword [esp + 4], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40aaf0
shl ebx, 0x12
add ebx, 0xfc400000
mov ecx, dword [esp]
and ecx, 0x3f
shl ecx, 0xc
or ecx, ebx
mov esi, dword [esp + 8]
and esi, 0x3f
shl esi, 6
or esi, ecx
add eax, 4
mov ecx, esi
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x40a891
mov ebx, dword [esp + 4]
and ebx, 0x3f
or ebx, esi
cmp ebx, 0x10000
jb 0x40a891
cmp edi, 2
jb 0x40aadb
add esi, 0xf0000
shr esi, 0xa
and esi, 0x3ff
or esi, 0xd800
mov word [edx], si
and ebx, 0x3ff
or ebx, 0xdc00
lea ecx, [edx + 4]
mov word [edx + 2], bx
jmp 0x40a887
mov ecx, edx
jmp 0x40a887
inc eax
jmp 0x40a891
add eax, 2
jmp 0x40a891
add eax, 3
test cl, cl
jne 0x40a89c
mov word [edx], 0
mov ecx, dword [esp + 0x20]
mov eax, ecx
not eax
and eax, edx
not edx
and edx, ecx
sub eax, edx
sar eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b7d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov dword [esp + 0x38], 0xbf69bf08
mov dword [esp + 0x3c], 0xbf11bf5d
mov dword [esp + 0x40], 0xbf16bf15
mov dword [esp + 0x44], 0xbf53bf0a
mov dword [esp + 0x48], 0xbf50bf58
mov dword [esp + 0x4c], 0xbf40bf5f
mov dword [esp + 0x50], 0xbf75bf59
mov dword [esp + 0x54], 0xbf1abf1a
mov dword [esp + 0x58], 0xbf19bf01
mov dword [esp + 0x5c], 0xbf0bbf10
mov dword [esp + 0x60], 0xbf64bf59
mov dword [esp + 0x64], 0xbf5cbf6f
mov dword [esp + 0x68], 0xbf4ebf4c
mov dword [esp + 0x6c], 0xbf40bf41
mov dword [esp + 0x70], 0xbf52bf7a
mov dword [esp + 0x74], 0xbf0dbf64
mov dword [esp + 0x78], 0xbf40bf0b
mov dword [esp + 0x7c], 0xbf43bf43
mov dword [esp + 0x80], 0xbf02bf69
mov dword [esp + 0x84], 0xbf78bf7d
mov dword [esp + 0x88], 0xbf6ebf74
mov dword [esp + 0x8c], 0xbf30bf4e
mov dword [esp + 0x90], 0xbf3ebf31
mov dword [esp + 0x94], 0xbf53bf26
mov dword [esp + 0x98], 0xbf24bf20
mov dword [esp + 0x9c], 0xbf21bf5c
mov dword [esp + 0xa0], 0xbf65bf2d
mov dword [esp + 0xa4], 0xbf6fbf6e
mov dword [esp + 0xa8], 0xbf60bf6a
mov dword [esp + 0xac], 0xbf66bf6c
mov dword [esp + 0xb0], 0xbf6abf71
mov dword [esp + 0xb4], 0xbf4cbf48
mov dword [esp + 0xb8], 0xbf4bbf41
mov dword [esp + 0xbc], 0xbf94bf4b
mov dword [esp + 0xc0], 0xbfd6bf89
mov dword [esp + 0xc4], 0xbfd7bfd2
mov dword [esp + 0xc8], 0xbf8ebfc8
mov dword [esp + 0xcc], 0xbfc5bfa8
mov dword [esp + 0xd0], 0xbfd9bfc2
mov dword [esp + 0xd4], 0xbf9dbfdc
mov dword [esp + 0xd8], 0xbfa5bf85
mov dword [esp + 0xdc], 0xbfcabfdf
mov dword [esp + 0xe0], 0xbfc7bfc6
mov dword [esp + 0xe4], 0xbf83bfde
mov dword [esp + 0xe8], 0xbf8fbf8c
mov dword [esp + 0xec], 0xbf8ebfb6
mov dword [esp + 0xf0], 0xbf8cbf81
mov dword [esp + 0xf4], 0xbf8abf83
mov dword [esp + 0xf8], 0xbf96bf85
mov dword [esp + 0xfc], 0xbfe9bfa4
mov dword [esp + 0x100], 0xbfebbfef
mov dword [esp + 0x104], 0xbff5bff9
mov dword [esp + 0x108], 0xbfbbbfb2
mov dword [esp + 0x10c], 0xbfb7bfbc
mov dword [esp + 0x110], 0xbfb1bfbf
mov dword [esp + 0x114], 0xbc44bfb5
mov eax, dword [0x443f54]
mov dword [esp], eax
xor ecx, ecx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + ebx*2 + 0x38]
mov ebp, ecx
and ebp, 0x7a
mov edx, ebx
xor edx, 0x190a153d
add edx, ebp
mov ebp, edx
and ebp, esi
mov edi, ebp
or edi, 0xfffd
inc edi
mov eax, ebp
and eax, 0x15fd
imul eax, edi
mov edi, ebp
and edi, 2
or ebp, 2
imul ebp, edi
sub eax, ebp
add edx, esi
add eax, edx
add eax, 0x5618
mov word [esp + ebx*2 + 0x38], ax
inc ebx
add ecx, 2
cmp ebx, 0x70
jne 0x40ba20
lea eax, [esp + 0x38]
push 0
push 0
push 0
push 0
push eax
call dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x43e688]
mov ecx, 0xd5ca1c35
xor ecx, dword [str.7_t_]
add ecx, edx
inc ecx
jmp ecx
Function at 0x413d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x413db0
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x413dd0
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x413df0
mov eax, 0xffffffff
jmp 0x413df9
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.00407fa0
add esp, 4
movzx ecx, word [esi]
mov dword [esp + 4], eax
test cx, cx
je 0x413e31
add esi, 2
mov eax, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x413e20
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebx]
test cx, cx
je 0x413e61
lea edx, [ebx + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413e50
mov word [eax], 0
mov eax, esp
xor ebx, ebx
push 0x60
push 7
push 0x120089
push eax
push dword [esp + 0x14]
call fcn.00439770
add esp, 0x14
mov dword [esp + 8], 0x2a6e6a2e
mov cl, 1
xor edx, edx
nop
nop
nop
nop
movzx esi, word [esp + edx*2 + 8]
lea ebp, [edx + 0x6b572845]
xor ebp, esi
add ebp, 0xa546bdd7
mov esi, ebp
and esi, 1
xor ebp, 1
lea esi, [esi*2]
add esi, ebp
mov word [esp + edx*2 + 8], si
mov edx, 1
test cl, 1
mov ecx, 0
jne 0x413e90
xor ecx, ecx
cmp eax, dword [esp + 8]
sete cl
jmp dword [ecx*4 + 0x43ef30]
Function at 0x414330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x468
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x414350
mov eax, ebx
sar eax, 1
mov dword [esp + 0xd4], eax
cmp eax, 0xfffffff2
jge 0x414372
mov eax, 0xffffffff
jmp 0x414375
lea eax, [ebx + 0x1c]
push eax
call fcn.00407fa0
add esp, 4
mov dword [esp], eax
mov dword [esp + 0x2e4], 0x82d782e6
mov dword [esp + 0x2e8], 0x828e82fd
mov dword [esp + 0x2ec], 0x823f828a
mov dword [esp + 0x2f0], 0x82e482f6
mov dword [esp + 0x2f4], 0x82908290
mov dword [esp + 0x2f8], 0x82ea82ed
mov dword [esp + 0x2fc], 0x820782e8
mov eax, 0x804a
mov esi, 0x7fb5
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + eax*2 - 0xfdb0]
mov ecx, esi
xor ecx, eax
and ecx, edx
xor ecx, eax
add ecx, 0xfffffdb0
mov word [esp + eax*2 - 0xfdb0], cx
inc eax
dec esi
cmp eax, 0x8058
jne 0x4143e0
movzx ecx, word [edi]
mov esi, dword [esp]
mov eax, esi
test cx, cx
je 0x414431
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x414420
mov word [eax], 0
movzx ecx, word [esp + 0x2e4]
test cx, cx
je 0x414461
lea edx, [esp + 0x2e6]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414450
mov word [eax], 0
lea eax, [esp + 0x160]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00439770
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43f3d0]
Function at 0x41d330
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov dword [esp], 0x6a6e6a17
xor ecx, ecx
mov dl, 1
movzx edi, word [esp + ecx*2]
lea esi, [ecx + 0x6b572845]
xor esi, edi
add esi, 0xa546bdd7
mov edi, esi
xor edi, 0x9db1
and esi, 0x624e
add esi, esi
sub esi, edi
add esi, 0xffff9db2
mov word [esp + ecx*2], si
mov ecx, 1
test dl, 1
mov edx, 0
jne 0x41d360
lea ecx, [esp + 4]
mov edx, esp
push ecx
push 0x41eb90
push edx
push dword [eax + 8]
call fcn.0041f020
add esp, 0x24
pop esi
pop edi
ret

Function at 0x41ecd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x2c]
xor eax, eax
nop
nop
nop
cmp word [edi + eax], 0
lea eax, [eax + 2]
jne 0x41ece0
lea ecx, [edi + eax]
add ecx, 0xfffffffe
mov eax, edi
not eax
and eax, ecx
xor ecx, edi
add eax, eax
sub eax, ecx
cmp eax, 0xffffffed
jge 0x41ed08
mov eax, 0xffffffff
jmp 0x41ed0b
add eax, 0x12
push eax
call fcn.00407fa0
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp], 0xd1a8d1be
mov dword [esp + 4], 0xd05cd1a1
mov dword [esp + 8], 0xd1e9d192
mov dword [esp + 0xc], 0xd1abd1ac
mov word [esp + 0x10], 0xd1ca
mov eax, esp
mov ecx, 0x7f4d74ad
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [eax]
mov edx, ecx
or edx, ebx
lea ebp, [ecx - 0x7f4d0000]
and ebp, ebx
not edx
or edx, ebp
lea ebx, [edx - 0x5945a91]
mov ebp, ebx
and ebp, 1
mov esi, ebx
and esi, 0xfffe
xor ebx, 1
add edx, ebx
add edx, 0xfa6ba56f
mov ebx, edx
sub ebx, esi
and edx, ebp
xor ebx, ebp
lea edx, [ebx + edx*2]
mov word [eax], dx
add eax, 2
dec ecx
cmp ecx, 0x7f4d74a4
jne 0x41ed50
movzx ecx, word [edi]
mov esi, dword [esp + 0x14]
mov eax, esi
test cx, cx
je 0x41edc1
add edi, 2
mov eax, esi
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41edb0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41edf1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ede0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.004398e0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x43fa4c]
Function at 0x421495
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x98
mov dword [esp + 0x1c], 0x7d9d7dfe
mov dword [esp + 0x20], 0x7d4e7d4d
mov dword [esp + 0x24], 0x7db17d9b
mov dword [esp + 0x28], 0x7db37d45
mov dword [esp + 0x2c], 0x7db87df6
mov dword [esp + 0x30], 0x7d4e7da1
mov dword [esp + 0x34], 0x7d567d42
mov dword [esp + 0x38], 0x7daf7dad
mov dword [esp + 0x3c], 0x7dae7d59
mov dword [esp + 0x40], 0x7d5c7d54
mov dword [esp + 0x44], 0x7dac7dab
mov dword [esp + 0x48], 0x7d507db1
mov dword [esp + 0x4c], 0x7da27d5c
mov dword [esp + 0x50], 0x7d5a7d5c
mov dword [esp + 0x54], 0x7d6b7da2
lea eax, [esp + 0x58]
mov word [esp + 0x58], 0x7df9
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [esp + edx*2 + 0x1c]
mov ebx, ecx
and ebx, 6
mov esi, edx
xor esi, 0x62cb63c3
add esi, ebx
mov ebx, esi
and ebx, edi
add esi, edi
add ebx, ebx
sub esi, ebx
add esi, 0xe9a4e1e7
mov edi, esi
and edi, 1
xor esi, 1
lea esi, [esi + edi*2]
mov word [esp + edx*2 + 0x1c], si
inc edx
add ecx, 2
cmp edx, 0x1f
jne 0x421420
lea esi, [esp + 0x5a]
lea edx, [esp + 0x1c]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x96]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, esp
push eax
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x4452a8]
mov dword [esp + 0x1c], 0x5ba91b8b
xor edi, edi
mov cl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [esp + edi*2 + 0x1c]
mov ebx, 0x317
sub ebx, edi
mov edx, edi
or edx, 0x9fb6fce8
xor ebx, edx
and ebx, ebp
xor ebx, edx
mov edx, ebx
xor edx, 0xe741
and ebx, 0x18be
add ebx, ebx
sub ebx, edx
inc ebx
mov word [esp + edi*2 + 0x1c], bx
mov edi, 1
test cl, 1
mov ecx, 0
jne 0x4214b0
xor ecx, ecx
cmp eax, dword [esp + 0x1c]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x44002c]
Function at 0x423df9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
push eax
sub esp, 0x28
mov edi, esp
sub esp, 0x400
mov eax, esp
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x38], eax
push eax
mov dword [ebp - 0x48], esp
push eax
mov dword [ebp - 0x34], esp
sub esp, 0x20
mov dword [ebp - 0x64], esp
mov dword [ebp - 0x60], 0xa2afa2a9
mov dword [ebp - 0x5c], 0xa2dca2d9
mov dword [ebp - 0x58], 0xa211a2d3
mov dword [ebp - 0x54], 0xa2b9a2c5
mov dword [ebp - 0x50], 0xa223a2c7
mov eax, 0x696b
mov ecx, 0x1efd1695
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [ebp + eax*2 - 0xd336]
mov esi, ecx
xor esi, edx
lea ebx, [ecx - 0x1efd0000]
or ebx, esi
add ebx, eax
add ebx, ebx
sub edx, ebx
add edx, eax
add edx, 0x34af
mov word [ebp + eax*2 - 0xd336], dx
inc eax
dec ecx
cmp eax, 0x6975
jne 0x423e50
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x74], 0
lea eax, [ebp - 0x60]
lea esi, [ebp - 0x74]
mov ecx, esi
push eax
call fcn.00435c40
mov ecx, esi
push 0x410
call fcn.00435fb0
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x440784]