joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ad0
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x402ca8
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx ebp, cx
shr ecx, 0x10
test edi, edi
je 0x402ca1
mov edx, 0x5e6ea9af
mov eax, edi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, edi
sub edx, eax
jmp 0x402b64
mov esi, dword [esp + 0x10]
add esi, dword [esp + 0xc]
mov edi, dword [esp + 8]
mov eax, ebp
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub ebp, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub edi, dword [esp]
mov edx, 0x15b0
je 0x402ca1
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], edi
jb 0x402c05
and edx, 0x1ff8
mov dword [esp + 4], edx
xor eax, eax
mov edi, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
movzx eax, byte [esi + eax]
add eax, edi
add ecx, eax
movzx edi, byte [esi + edx + 1]
add edi, eax
add ecx, edi
movzx eax, byte [esi + edx + 2]
add eax, edi
add ecx, eax
movzx edi, byte [esi + edx + 3]
add edi, eax
mov eax, ecx
and eax, edi
xor ecx, edi
movzx ebx, byte [esi + edx + 4]
add ebx, edi
add ecx, ebx
movzx edi, byte [esi + edx + 5]
add edi, ebx
add ecx, edi
movzx ebx, byte [esi + edx + 6]
add ebx, edi
movzx edi, byte [esi + edx + 7]
mov ebp, esi
mov esi, ebx
and esi, edi
xor edi, ebx
lea edi, [edi + esi*2]
mov esi, ebp
lea ecx, [ecx + eax*2]
add ecx, ebx
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x402b90
mov ebp, edi
add esi, eax
mov edi, dword [esp + 8]
mov ebx, dword [esp + 4]
mov eax, edx
sub eax, ebx
jbe 0x402b2c
mov dword [esp + 0xc], eax
mov eax, ebx
or eax, 1
test dl, 1
mov dword [esp + 0x10], esi
jne 0x402c40
mov dword [esp + 4], ebx
mov ebx, esi
cmp edx, eax
je 0x402b20
jmp 0x402c61
lea ebx, [esi + 1]
movzx esi, byte [esi]
mov edx, ebp
and edx, esi
xor ebp, esi
lea ebp, [ebp + edx*2]
mov edx, dword [esp]
add ecx, ebp
mov dword [esp + 4], eax
cmp edx, eax
je 0x402b20
mov eax, dword [esp]
sub eax, dword [esp + 4]
xor esi, esi
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + esi]
mov edi, ebp
and edi, edx
xor ebp, edx
lea edx, [edi*2]
add edx, ebp
add ecx, edx
movzx edi, byte [ebx + esi + 1]
mov ebp, edx
and ebp, edi
xor edx, edi
lea ebp, [edx + ebp*2]
add ecx, ebp
add esi, 2
cmp eax, esi
jne 0x402c70
jmp 0x402b20
shl ecx, 0x10
or ecx, ebp
jmp 0x402cad
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402cc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402cee
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x402d8c
not eax
test bl, 1
jne 0x402cf5
mov edx, ebx
cmp ebx, 1
jne 0x402d26
jmp 0x402d8a
xor eax, eax
jmp 0x402d8c
lea edx, [ebx - 1]
mov esi, eax
shr esi, 4
movzx edi, byte [ecx]
xor eax, edi
and eax, 0xf
xor esi, dword [eax*4 + 0x43c80c]
inc ecx
mov eax, esi
shr eax, 4
and esi, 0xf
shr edi, 4
xor edi, esi
xor eax, dword [edi*4 + 0x43c80c]
cmp ebx, 1
je 0x402d8a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
shr edi, 4
movzx ebx, byte [ecx + esi]
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x43c80c]
mov eax, edi
shr eax, 4
and edi, 0xf
shr ebx, 4
xor ebx, edi
xor eax, dword [ebx*4 + 0x43c80c]
mov edi, eax
shr edi, 4
movzx ebx, byte [ecx + esi + 1]
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x43c80c]
mov eax, edi
shr eax, 4
and edi, 0xf
shr ebx, 4
xor ebx, edi
xor eax, dword [ebx*4 + 0x43c80c]
add esi, 2
cmp edx, esi
jne 0x402d30
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x408e10
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + 4]
mov dword [0x444840], ecx
mov eax, 0xfffffd92
nop
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x26f
mov dword [eax*4 + 0x4451fc], ecx
test eax, eax
je 0x408e61
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x270
mov dword [eax*4 + 0x445200], ecx
add eax, 2
jmp 0x408e20
mov dword [0x44483c], 0x270
ret
Function at 0x409230
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x4092b3
mov eax, 0x270
mov edx, SysReAllocString
jmp 0x40927f
shr esi, 1
xor esi, edi
mov edi, dword [ecx + eax*4 - 0x388]
mov ebx, esi
and ebx, edi
add esi, edi
add ebx, ebx
sub esi, ebx
mov dword [ecx + eax*4 + 4], esi
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
cmp eax, 0x4e0
jae 0x409396
mov esi, dword [ecx + eax*4 - 0x9bc]
mov edi, esi
not edi
or edi, 0x80000000
add edi, esi
inc edi
mov esi, dword [ecx + eax*4 - 0x9b8]
and esi, edx
or esi, edi
mov ebx, esi
or ebx, 1
mov edi, esi
xor edi, 0xfffffffe
and edi, ebx
je 0x409250
mov edi, 0x9908b0df
jmp 0x409250
cmp eax, 0x4e0
jb 0x40939b
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x4092d0
mov edi, dword [ecx + 0xd50]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [ecx + eax*4 + 0xd54]
and edi, 0x80000000
mov edx, esi
and edx, 0x7ffffffe
or edx, edi
shr edx, 1
mov edi, esi
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, dword [ecx + eax*4 + 4]
xor esi, edx
mov dword [ecx + eax*4 + 0x390], esi
inc eax
cmp eax, 0x18c
jne 0x409320
mov eax, SysReAllocString
and eax, dword [ecx + 0x1380]
mov edx, dword [ecx + 4]
mov esi, edx
and esi, 0x7fffffff
or eax, esi
shr eax, 1
xor edx, 0x7ffffffe
and edx, esi
je 0x409384
mov edx, 0x9908b0df
xor eax, dword [ecx + 0x634]
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
jmp 0x40939b
mov eax, 0x270
lea edx, [eax + 1]
mov dword [ecx], edx
mov edx, dword [ecx + eax*4 + 4]
mov eax, edx
shr eax, 0xb
and eax, dword [ecx + 0x1384]
mov ecx, eax
and ecx, edx
add eax, edx
add ecx, ecx
sub eax, ecx
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
xor ecx, eax
mov edx, ecx
shl edx, 0xf
and edx, 0xefc60000
xor edx, ecx
mov eax, edx
shr eax, 0x12
and ecx, eax
or eax, edx
xor eax, ecx
pop esi
pop edi
pop ebx
ret
Function at 0x409550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx eax, word [esi]
lea ebp, [esp + 4]
test ax, ax
je 0x409695
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x4095a0
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x409640
cmp ebx, 0x7ff
ja 0x4095d0
cmp edx, 2
jb 0x4095d0
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x409640
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x40965a
cmp edx, 4
jb 0x40965a
movzx edi, word [esi + 2]
add esi, 4
mov eax, ebx
xor eax, 0xd800
and ebx, 0x27ff
add ebx, ebx
sub ebx, eax
shl ebx, 0xa
lea ecx, [ebx + edi]
add ecx, 0xffff2400
lea eax, [ebx + edi]
add eax, 0x2400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 2], cl
mov eax, edi
and al, 0x3f
or al, 0x80
mov ecx, eax
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx eax, word [esi]
test ax, ax
je 0x409695
test edx, edx
jne 0x409580
jmp 0x409695
movzx eax, ax
cmp eax, 0xdc00
jne 0x409668
mov esi, edi
jmp 0x409648
cmp edx, 3
jb 0x409691
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x409640
mov eax, ebp
jmp 0x409640
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ebp], 0
xor eax, eax
jmp 0x4096b8
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x4096b0
test ecx, ecx
je 0x4096cc
mov ebx, ecx
jmp 0x4096b0
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00404e00
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40a3e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x230
push eax
mov dword [ebp - 0x1c], esp
sub esp, 0x70
mov dword [ebp - 0x18], esp
sub esp, 0x28
mov dword [ebp - 0x2c], esp
sub esp, 0xc
mov dword [ebp - 0x14], esp
sub esp, 0x40
mov dword [ebp - 0x24], esp
sub esp, 0x80
mov dword [ebp - 0x28], esp
mov eax, dword [0x445c24]
mov dword [ebp - 0xac], 0x393a333c
mov byte [ebp - 0xa8], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x8b
xor dl, byte [ebp + ecx - 0xac]
add dl, 0x49
mov byte [ebp + ecx - 0xac], dl
inc ecx
cmp ecx, 5
jne 0x40a430
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 0x23c], 0xb7298913
mov dword [ebp - 0x238], 0xb3d1b5ea
mov dword [ebp - 0x234], 0xbfe0b1ef
mov dword [ebp - 0x230], 0xbbd6bdee
mov dword [ebp - 0x22c], 0xa732b92c
mov word [ebp - 0x228], 0xa5a4
mov dword [ebp - 0x226], 0
mov edx, 0x104cb01e
nop
nop
nop
nop
movzx esi, byte [ebp + edx - 0x104cb25a]
lea ebx, [edx - 0x104cb000]
and ebx, esi
add esi, edx
add ebx, ebx
mov edi, esi
sub edi, ebx
add edi, 0xae808f69
add esi, esi
and esi, 2
mov ebx, esi
xor ebx, 2
and ebx, edi
xor esi, edi
xor esi, 3
lea ebx, [esi + ebx*2]
mov byte [ebp + edx - 0x104cb25a], bl
inc edx
cmp edx, 0x104cb038
jne 0x40a4a0
lea esi, [ebp - 0x23c]
push ecx
push 0
push esi
call eax
mov ecx, 0x445c28
push eax
call fcn.00435ea0
movzx eax, al
mov eax, dword [eax*4 + 0x43fa30]
mov ecx, dword [0x43fa38]
mov edx, ecx
and edx, 0x1a186b80
add edx, edx
sub edx, ecx
lea ecx, [eax + edx]
add ecx, 0x65e79480
xor eax, eax
jmp ecx

Function at 0x40b500
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x445c00]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40b5ae
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x43fd48]
jmp dword [0x43fd5c]
Function at 0x40c750
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov edi, dword [esp + 0x24c]
mov dword [esp + 0x38], 0x21b72753
mov dword [esp + 0x3c], 0x5db923aa
mov dword [esp + 0x40], 0x59ca5fc8
mov dword [esp + 0x44], 0x550b5b3b
mov dword [esp + 0x48], 0x5100571b
mov dword [esp + 0x4c], 0x4d725300
mov dword [esp + 0x50], 0x49274f14
mov dword [esp + 0x54], 0x45dc4bd3
mov dword [esp + 0x58], 0x41d747d8
mov dword [esp + 0x5c], 0x7dcf43c9
mov dword [esp + 0x60], 0x79087f5c
mov dword [esp + 0x64], 0x755a7b14
mov dword [esp + 0x68], 0x71267727
mov dword [esp + 0x6c], 0x6d227326
mov dword [esp + 0x70], 0x694e6f29
mov dword [esp + 0x74], 0x65f16b01
mov dword [esp + 0x78], 0x612867f2
mov dword [esp + 0x7c], 0x9d27632c
mov dword [esp + 0x80], 0x99169fbc
mov dword [esp + 0x84], 0x95d69bd6
mov dword [esp + 0x88], 0x91b697cf
mov dword [esp + 0x8c], 0x8d0293d3
mov dword [esp + 0x90], 0x891a8f1c
mov dword [esp + 0x94], 0x85e38b17
mov dword [esp + 0x98], 0x81e4871b
mov dword [esp + 0x9c], 0xbd1983f5
mov dword [esp + 0xa0], 0xb9efbf30
mov dword [esp + 0xa4], 0xb5f7bbf7
mov dword [esp + 0xa8], 0xb1e0b7fd
mov dword [esp + 0xac], 0xadfcb3fd
mov dword [esp + 0xb0], 0xa9f6af8c
mov dword [esp + 0xb4], 0xa5d2abdd
mov dword [esp + 0xb8], 0xa1d1a7c8
mov dword [esp + 0xbc], 0xddf6a3d4
mov dword [esp + 0xc0], 0xd94adffc
mov dword [esp + 0xc4], 0xd54fdb43
mov dword [esp + 0xc8], 0xd1f6d74b
mov dword [esp + 0xcc], 0xcd4dd3a9
mov dword [esp + 0xd0], 0xc95bcf51
mov dword [esp + 0xd4], 0xc591cb59
mov dword [esp + 0xd8], 0xc1bbc7e4
mov dword [esp + 0xdc], 0xfd50c358
mov dword [esp + 0xe0], 0xf969ff6d
mov dword [esp + 0xe4], 0xf5abfb67
mov dword [esp + 0xe8], 0xf1a5f7a7
mov dword [esp + 0xec], 0xeda4f3bb
mov dword [esp + 0xf0], 0xe9b8efbc
mov dword [esp + 0xf4], 0xe5bcebb8
mov dword [esp + 0xf8], 0xe1c6e7b4
mov dword [esp + 0xfc], 0x1d81e38d
mov dword [esp + 0x100], 0x197d1f82
mov dword [esp + 0x104], 0x15811b8a
mov dword [esp + 0x108], 0x11591745
mov dword [esp + 0x10c], 0xd5b135d
mov dword [esp + 0x110], 0x9430f5a
mov dword [esp + 0x114], 0x50a0b46
mov byte [esp + 0x11a], 0
mov word [esp + 0x118], 0
mov eax, dword [0x445bf4]
xor ecx, ecx
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x38]
lea esi, [ecx + 0x39]
and esi, edx
lea ebx, [ecx - 0x3174c6c7]
or ebx, edx
sub ebx, esi
mov edx, ebx
and edx, 0x62
xor ebx, 0xe2
lea edx, [ebx + edx*2]
inc dl
mov byte [esp + ecx + 0x38], dl
mov edx, ecx
not edx
or edx, 1
add edx, ecx
inc edx
mov ebx, edx
and ebx, 2
mov esi, edx
or edx, 2
imul edx, ebx
xor ebx, 2
and esi, 0xfffffffd
imul esi, ebx
xor ecx, 1
add ecx, edx
add ecx, esi
cmp ecx, 0xe3
jb 0x40c9b0
lea ebx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ebx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x440020]
mov ecx, 0xd83a8855
xor ecx, dword [0x440028]
add eax, ecx
inc eax
jmp eax
Function at 0x413bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ebp, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x413be0
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x413c00
sar ebp, 1
sar eax, 1
inc eax
mov ecx, eax
and ecx, ebp
xor eax, ebp
lea edx, [eax + ecx*2]
inc edx
test edx, edx
jns 0x413c25
mov eax, 0xffffffff
jmp 0x413c2f
lea eax, [eax + ecx*2]
lea eax, [eax*2 + 2]
push eax
call fcn.00408680
add esp, 4
movzx ecx, word [esi]
mov dword [esp + 0x10], eax
test cx, cx
je 0x413c61
add esi, 2
mov eax, dword [esp + 0x10]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x413c50
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [edi]
test cx, cx
je 0x413c91
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413c80
mov word [eax], 0
lea eax, [esp + 0xc]
push 0x60
push 3
push 0x120089
push eax
push dword [esp + 0x20]
call fcn.0043aa80
add esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 8], 0
jmp dword [eax*4 + 0x4405c4]
Function at 0x413fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x11b8
call fcn.00408650
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x413fd0
sar esi, 1
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x446f40]
mov ebx, dword [esp + 0x30]
mov edi, 0xffffffff
test ebx, ebx
jns 0x414004
mov eax, 0xffffffff
jmp 0x414007
lea eax, [ebx + ebx]
push eax
call fcn.00408680
add esp, 4
lea ecx, [esp + 0x30]
push ecx
push ebx
mov ebx, eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x446f40]
mov eax, dword [esp + 0x30]
mov ecx, eax
add ecx, 0xd
js 0x41403a
lea edi, [eax*2 + 0x1a]
push edi
call fcn.00408680
add esp, 4
mov dword [esp + 0x1b4], 0x4ff249e4
mov dword [esp + 0x1b8], 0x43d54ded
mov dword [esp + 0x1bc], 0x472641d4
mov dword [esp + 0x1c0], 0xbb1f45ee
mov dword [esp + 0x1c4], 0xbf29b92e
mov dword [esp + 0x1c8], 0xb321bd25
mov dword [esp + 0x1cc], 0xb7b6b122
mov word [esp + 0x1d0], 0
xor esi, esi
nop
nop
nop
nop
lea ecx, [esi + 0xe]
mov edx, 0x11
sub edx, esi
and edx, 0x1c
and ecx, 0x23
sub ecx, edx
xor cl, byte [esp + esi + 0x1b4]
add cl, 0x46
mov byte [esp + esi + 0x1b4], cl
lea ecx, [esi + esi]
and ecx, 2
mov edx, ecx
and edx, esi
or ecx, esi
xor ecx, 1
add ecx, edx
mov esi, ecx
cmp ecx, 0x1e
jb 0x4140a0
movzx ecx, word [ebx]
mov esi, eax
test cx, cx
je 0x414101
lea edx, [ebx + 2]
mov esi, eax
nop
nop
nop
nop
nop
nop
mov word [esi], cx
add esi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4140f0
mov word [esi], 0
movzx ecx, word [esp + 0x1b4]
test cx, cx
je 0x414131
lea edx, [esp + 0x1b6]
nop
nop
nop
nop
nop
nop
mov word [esi], cx
add esi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414120
mov word [esi], 0
lea ecx, [esp + 0xa8]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x14], eax
push eax
call fcn.0043aa80
add esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x24], ebx
jmp dword [eax*4 + 0x4409e4]
Function at 0x4172c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x188
mov dword [esp + 0x10], 0x51a44f7d
mov dword [esp + 0x14], 0x55a353a5
mov dword [esp + 0x18], 0x595657ba
mov dword [esp + 0x1c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x10]
lea ecx, [eax + 0xe1c70d]
mov esi, edx
and esi, 8
xor esi, 0x4c233208
mov edi, edx
xor edi, 0x4c233208
or edx, 0xf7
and edx, edi
or edx, esi
mov esi, 2
sub esi, eax
and esi, 8
and ecx, 0xc0c517
or ecx, esi
mov esi, edx
and esi, ecx
add ecx, edx
add esi, esi
sub ecx, esi
add cl, 0xbf
mov byte [esp + eax + 0x10], cl
mov ecx, eax
xor ecx, 0x3c82953a
and eax, 0xa
lea eax, [ecx + eax*2]
add eax, 0xc37d6ac7
cmp eax, 0x10
jb 0x417300
mov dword [esp + 0x34], 0x51ba4fa4
mov dword [esp + 0x38], 0x55a253a4
mov dword [esp + 0x3c], 0x5967576e
mov dword [esp + 0x40], 0x5db65b69
mov dword [esp + 0x44], 0x61bb5fad
mov dword [esp + 0x48], 0x658e6383
mov dword [esp + 0x4c], 0x6997678c
mov dword [esp + 0x50], 0x6d9e6b9d
mov dword [esp + 0x54], 0x716e6f56
mov word [esp + 0x58], 0
xor ecx, ecx
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
or edx, 0x2cd2230d
add edx, ecx
inc edx
mov esi, edx
and esi, 0xfd
mov edi, edx
and edi, 2
or edx, 2
imul edx, edi
xor edi, 2
imul edi, esi
mov ebx, ecx
xor ebx, 0xd
add ebx, edx
add ebx, edi
xor bl, byte [esp + ecx + 0x34]
add bl, 0xbf
mov byte [esp + ecx + 0x34], bl
inc ecx
dec eax
cmp ecx, 0x26
jne 0x4173c0
movzx ecx, word [esp + 0x34]
lea eax, [esp + 0x14e]
test cx, cx
je 0x417431
lea edx, [esp + 0x36]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417420
mov word [eax], 0
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x417463
add edx, 2
mov esi, dword [ebp + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417450
jmp 0x417466
mov esi, dword [ebp + 0xc]
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x417491
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417480
mov word [eax], 0
mov edi, dword [esi]
mov dword [esp + 0x34], 0x5f5c5c3a
mov byte [esp + 0x38], 0x3c
mov dword [esp + 0x39], 0
mov word [esp + 0x3d], 0
lea eax, [esp + 0x34]
mov ecx, 0xdfcd84b
nop
nop
nop
movzx esi, byte [eax]
mov edx, ecx
or edx, esi
lea ebx, [ecx - 0xdfcd800]
and ebx, esi
not edx
or edx, ebx
lea esi, [edx + 0xe0]
xor esi, 0x65
and edx, 0x1a
add edx, edx
sub edx, esi
inc dl
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0xdfcd840
jne 0x4174c0
movzx eax, byte [esp + 0x34]
test al, al
je 0x41750b
lea ecx, [esp + 0x35]
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x417500
mov byte [edi], 0
lea eax, [esp + 0x144]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x14e]
push eax
push ecx
push edx
call fcn.0040b500
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x440c64]
mov ecx, 0xd3a00683
xor ecx, dword [0x440c6c]
add eax, ecx
inc eax
jmp eax
Function at 0x41c950
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
xor eax, eax
nop
nop
nop
nop
cmp word [edi + eax], 0
lea eax, [eax + 2]
jne 0x41c960
lea ecx, [edi + eax]
add ecx, 0xfffffffe
mov eax, edi
not eax
and eax, ecx
xor ecx, edi
add eax, eax
sub eax, ecx
cmp eax, 0xffffffed
jge 0x41c988
mov eax, 0xffffffff
jmp 0x41c98b
add eax, 0x12
push eax
call fcn.00408680
add esp, 4
mov esi, eax
mov dword [esp], 0x63f961cc
mov dword [esp + 4], 0x67ef65c1
mov dword [esp + 8], 0x5b84598c
mov dword [esp + 0xc], 0x5ffc5df8
mov word [esp + 0x10], 0x5150
mov dword [esp + 0x12], 0
mov eax, 0xe144f498
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x1ebb0b68]
xor ecx, eax
lea edx, [ecx*2 + 0x334e720e]
add ecx, 0x99a73907
and edx, 2
mov ebx, edx
and ebx, ecx
xor edx, ecx
xor edx, 1
lea ecx, [edx + ebx*2]
mov byte [esp + eax + 0x1ebb0b68], cl
inc eax
cmp eax, 0xe144f4ae
jne 0x41c9d0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41ca31
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41ca20
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41ca61
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ca50
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043ac60
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x440ff0]