joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, esi
jbe 0x40809e
lea ecx, [esi + ebx]
cmp ecx, eax
jbe 0x40809e
test ebx, ebx
je 0x40813d
mov edx, ebx
and edx, 0xfffffffe
add edx, edx
mov ecx, ebx
xor ecx, 1
sub edx, ecx
lea ecx, [eax + edx]
add esi, edx
mov edi, ebx
and edi, 7
je 0x4080d9
mov ebp, ebx
neg edi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esi + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x408080
add esi, edx
add ecx, edx
mov ebx, ebp
add edx, ebp
cmp ebx, 8
jae 0x4080e0
jmp 0x40813d
mov ecx, ebx
shr ecx, 2
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, eax
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, esi
mov edi, edx
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x40813d
and ebx, 2
movzx ecx, byte [esi + ebx]
mov byte [edx + ebx], cl
jmp 0x40813d
mov edx, ebx
cmp ebx, 8
jb 0x40813d
neg edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esi + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [esi + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [esi + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [esi + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [esi + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [esi + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [esi + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [esi + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x4080f0
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x408770
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, dword [esp + 8]
mov dword [0x445c30], edx
mov eax, 0xfffffd92
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x93f8769a
mov esi, ecx
and esi, 0x6c078965
or ecx, 0x6c078965
imul ecx, esi
xor esi, 0x6c078965
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x26f
mov dword [eax*4 + 0x4465ec], edx
test eax, eax
je 0x4087ff
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x93f8769a
mov esi, ecx
and esi, 0x6c078965
or ecx, 0x6c078965
imul ecx, esi
xor esi, 0x6c078965
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x270
mov dword [eax*4 + 0x4465f0], edx
add eax, 2
jmp 0x408780
mov dword [0x445c2c], 0x270
pop esi
ret
Function at 0x408840
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.00439970
test al, al
je 0x408a96
call fcn.00432c00
test al, al
je 0x408a91
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x7a528b7d
mov eax, 0xef77d76f
shrd eax, edx, cl
shr edx, cl
mov edi, 0x85ad7482
mov esi, 0x10882890
shrd esi, edi, cl
sar edi, cl
and cl, 0x20
xor ebx, ebx
test cl, cl
je 0x4088a0
mov eax, edx
xor edx, edx
mov esi, edi
and eax, 0x10882890
and edx, 0x5ad7482
neg cl
sbb ebx, ebx
or ebx, edi
mov edi, ebx
not edi
mov ecx, esi
not ecx
and ecx, 0x10882890
and edi, 0x5ad7482
and ebx, 0x7a528b7d
or ebx, edx
or ebx, edi
and esi, 0xef77d76f
or esi, eax
or esi, ecx
mov ecx, 0x82d404d0
mov eax, esi
mul ecx
mov edi, eax
mov dword [esp + 4], eax
imul eax, esi, 0xa8a09d8b
add eax, edx
imul ebp, ebx, 0x82d404d0
add ebp, eax
mov dword [esp], ebp
mov ecx, 0x5a809a0
mov eax, esi
mul ecx
shld ebp, edi, 0x12
imul ecx, esi, 0x51413b17
add ecx, edx
mov edx, dword [esp]
mov esi, edx
shl esi, 0x12
imul edi, ebx, 0x5a809a0
add edi, ecx
mov ebx, edx
shr edx, 0xe
mov ecx, dword [esp + 4]
not ecx
or eax, 1
add eax, ecx
mov ecx, ebx
not ecx
adc edi, ecx
mov ecx, edi
shld ecx, eax, 1
lea ebx, [eax + eax]
not ebx
add ebx, eax
not ecx
adc ecx, edi
shrd esi, edx, 0x1f
not esi
lea eax, [ebp*2]
not eax
add eax, ebp
adc esi, edx
mov edi, ebp
not edi
and edi, eax
or edi, ebx
mov ebx, edx
not ebx
and ebx, esi
or ebx, ecx
or edx, dword [esp]
mov eax, ebx
not eax
or ebp, dword [esp + 4]
mov ecx, edi
not ecx
xor ebx, edx
and edx, eax
xor edi, ebp
and ebp, ecx
add edi, ecx
adc ebx, eax
sub edi, ebp
sbb ebx, edx
mov esi, ebx
shld esi, edi, 1
lea ebp, [edi + edi]
not esi
not ebp
add ebp, edi
adc esi, ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x408a6d
mov ecx, dword [esp + 8]
and cl, 0xf
mov edx, ebp
shrd edx, esi, cl
mov eax, esi
shr eax, cl
and edi, 0xa67ce260
and ebx, 0x3c999677
mov ecx, ebp
and ecx, 0x59831d9f
or ecx, edi
mov dword [esp + 4], ebp
mov ebp, esi
and ebp, 0xc3666988
or ebp, ebx
mov dword [esp + 8], edx
xor ecx, edx
mov dword [esp], eax
xor ebp, eax
xor ebp, 0xc3666988
xor ecx, 0x59831d9f
and ecx, edx
and ebp, eax
mov edx, ecx
and edx, 0xfffffffd
mov ebx, ecx
and ebx, 2
mov edi, ebx
xor edi, 2
mov eax, edi
mul edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
imul edi, ebp
or ecx, 2
mov eax, ecx
mul ebx
add edi, dword [esp + 0xc]
imul ebx, ebp
or ebx, edx
add eax, dword [esp + 0x10]
adc ebx, edi
mov ecx, eax
mov edx, dword [esp + 8]
xor ecx, edx
not edx
and edx, eax
mov edi, ebx
mov eax, dword [esp]
xor edi, eax
not eax
and eax, ebx
add ecx, dword [esp + 4]
adc edi, esi
shld eax, edx, 1
add edx, edx
sub ecx, edx
sbb edi, eax
mov edx, 0x6f1562bc
mov eax, ecx
mul edx
imul esi, ecx, 0x5db8dae5
add esi, edx
imul ecx, edi, 0x6f1562bc
add esi, ecx
mov ebp, eax
or esi, 0x1010101
or ebp, 0x1010101
push esi
push ebp
call fcn.00409d10
add esp, 8
test al, al
je 0x408a91
call fcn.0040ca50
call fcn.0040b960
call fcn.00439fe0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408aa0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x408b02
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x408ac0
mov eax, 0x270
jmp 0x408b14
cmp eax, 0x4e0
jb 0x408b14
mov esi, ecx
call fcn.00408b60
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
mov esi, edx
not esi
or esi, dword [ecx + 0x1384]
lea ecx, [edx + esi]
inc ecx
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
mov edx, eax
and edx, ecx
add eax, ecx
add edx, edx
sub eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
ret

Function at 0x408b60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov esi, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 - 0x630]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4]
xor edi, edx
mov dword [ecx + eax*4 - 0xff4], edi
inc eax
cmp eax, 0x4e1
jne 0x408b70
mov esi, dword [ecx + 0xd50]
mov eax, 0x355
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 - 0xd50]
xor edi, edx
mov dword [ecx + eax*4 - 0x9c4], edi
inc eax
cmp eax, 0x4e1
jne 0x408bc0
mov eax, dword [ecx + 0x1380]
mov edx, eax
not edx
or edx, 0x80000000
lea esi, [eax + edx]
add eax, edx
inc eax
mov edx, SysReAllocString
and edx, dword [ecx + 4]
mov edi, edx
not edi
and edi, eax
xor edx, eax
lea eax, [edx + esi]
inc eax
sub eax, edi
mov edx, eax
shr edx, 1
and eax, 1
neg eax
xor edx, dword [ecx + 0x634]
and eax, 0x9908b0df
xor edx, eax
mov dword [ecx + 0x9c0], edx
mov dword [ecx], 0
pop esi
pop edi
ret
Function at 0x408df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov edi, dword [esp + 0x418]
movzx eax, word [edi]
lea ebp, [esp + 4]
test ax, ax
je 0x408f3a
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea esi, [edi + 2]
cmp bx, 0x7f
ja 0x408e40
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x408ed0
cmp ebx, 0x7ff
ja 0x408e70
cmp edx, 2
jb 0x408e70
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
lea eax, [ebp + 2]
jmp 0x408ed0
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x408ef8
cmp edx, 4
jb 0x408ef8
movzx ecx, word [edi + 2]
add edi, 4
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov esi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
sub ecx, ebp
mov edi, ecx
xor edi, edx
not ecx
and ecx, edx
add ecx, ecx
sub ecx, edi
mov edi, esi
mov ebp, eax
mov edx, ecx
movzx eax, word [edi]
test ax, ax
je 0x408f3a
test edx, edx
jne 0x408e20
jmp 0x408f3a
movzx eax, ax
cmp eax, 0xdc00
jne 0x408f06
mov edi, esi
jmp 0x408ee6
cmp edx, 3
jb 0x408f36
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov ecx, ebx
shr ecx, 6
mov eax, ecx
not eax
or eax, 0x3f
add eax, ecx
add al, 0x81
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 2], bl
lea eax, [ebp + 3]
jmp 0x408ed0
mov eax, ebp
jmp 0x408ed0
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ebp], 0
xor eax, eax
jmp 0x408f58
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x408f50
test ecx, ecx
je 0x408f6c
mov ebx, ecx
jmp 0x408f50
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00404b30
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x408fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx ecx, word [esi]
test cx, cx
je 0x4090fa
mov edx, dword [esp + 0x18]
dec edx
je 0x4090fa
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x409000
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x409090
cmp ebx, 0x7ff
ja 0x409030
cmp edx, 2
jb 0x409030
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
lea eax, [ebp + 2]
jmp 0x409090
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x4090b8
cmp edx, 4
jb 0x4090b8
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
sub ecx, ebp
mov esi, ecx
xor esi, edx
not ecx
and ecx, edx
add ecx, ecx
sub ecx, esi
mov esi, edi
mov ebp, eax
mov edx, ecx
movzx ecx, word [esi]
test cx, cx
je 0x4090fa
test edx, edx
jne 0x408fe0
jmp 0x4090fa
movzx eax, ax
cmp eax, 0xdc00
jne 0x4090c6
mov esi, edi
jmp 0x4090a6
cmp edx, 3
jb 0x4090f6
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov ecx, ebx
shr ecx, 6
mov eax, ecx
not eax
or eax, 0x3f
add eax, ecx
add al, 0x81
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 2], bl
lea eax, [ebp + 3]
jmp 0x409090
mov eax, ebp
jmp 0x409090
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x230
push eax
sub esp, 0x20
mov dword [ebp - 0x18], esp
sub esp, 8
mov dword [ebp - 0x10], esp
sub esp, 0x40
mov dword [ebp - 0x1c], esp
sub esp, 0x80
mov dword [ebp - 0x28], esp
mov eax, dword [0x44700c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x23c], 0x6c6b7269
mov ecx, 0x61
mov edx, 0x9e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebp + ecx - 0x29d]
mov ebx, ecx
xor ebx, edx
and ebx, esi
xor ebx, edx
mov al, 0xf7
sub al, bl
mov byte [ebp + ecx - 0x29d], al
inc ecx
dec edx
cmp ecx, 0x65
jne 0x409d60
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 0x1bc], 0x7c087a0e
mov dword [ebp - 0x1b8], 0x70107e4f
mov dword [ebp - 0x1b4], 0x74417242
mov dword [ebp - 0x1b0], 0x8813764b
mov dword [ebp - 0x1ac], 0x8cf78af5
mov word [ebp - 0x1a8], 0x8e8d
mov edx, 0x3f8198f1
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebp + edx - 0x3f819aad]
mov edi, edx
and edi, esi
add esi, edx
add edi, edi
mov ebx, esi
sub ebx, edi
and esi, 1
or ebx, 1
add ebx, esi
add ebx, 0x87bb0fda
mov esi, ebx
not esi
and esi, 0x63
and ebx, 0x9c
sub ebx, esi
mov byte [ebp + edx - 0x3f819aad], bl
inc edx
cmp edx, 0x3f819907
jne 0x409dd0
lea esi, [ebp - 0x1bc]
push ecx
push 0
push esi
call dword [ebp - 0x14]
mov ecx, 0x447010
push eax
call fcn.00439930
movzx eax, al
mov eax, dword [eax*4 + 0x441348]
mov ecx, 0xc1f3634b
xor ecx, dword [0x441350]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x40b990
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov ebx, dword [esp + 0x468]
mov ebp, dword [esp + 0x464]
mov dword [esp + 0x3c], 0x40f04e10
mov dword [esp + 0x40], 0x44fa42cb
mov dword [esp + 0x44], 0x58fb46f9
mov dword [esp + 0x48], 0x5c245af8
mov dword [esp + 0x4c], 0x50215e28
mov dword [esp + 0x50], 0x54335221
mov dword [esp + 0x54], 0xa800562d
mov dword [esp + 0x58], 0xac15aa10
mov dword [esp + 0x5c], 0xa010ae09
mov dword [esp + 0x60], 0xa410a216
mov dword [esp + 0x64], 0xb8f9a6c5
mov dword [esp + 0x68], 0xbcdbbaed
mov dword [esp + 0x6c], 0xb0cfbecc
mov dword [esp + 0x70], 0xb4c3b2cf
mov dword [esp + 0x74], 0x88d7b6fe
mov dword [esp + 0x78], 0x8c328ade
mov dword [esp + 0x7c], 0x80f98e33
mov dword [esp + 0x80], 0x84c882f5
mov dword [esp + 0x84], 0x980f86e5
mov dword [esp + 0x88], 0x9cef9aef
mov dword [esp + 0x8c], 0x90ff9ee4
mov dword [esp + 0x90], 0x942392d0
mov dword [esp + 0x94], 0xe82b9625
mov dword [esp + 0x98], 0xecbcea4c
mov dword [esp + 0x9c], 0xe04dee48
mov dword [esp + 0xa0], 0xe45ae2ba
mov dword [esp + 0xa4], 0xf898e651
mov dword [esp + 0xa8], 0xfc88fa8c
mov dword [esp + 0xac], 0xf081fe8a
mov dword [esp + 0xb0], 0xf485f282
mov dword [esp + 0xb4], 0xc88ff695
mov dword [esp + 0xb8], 0xcc93ca92
mov dword [esp + 0xbc], 0xc092ce99
mov dword [esp + 0xc0], 0xc4bfc29d
mov dword [esp + 0xc4], 0xd87bc6a5
mov dword [esp + 0xc8], 0xdc60da60
mov dword [esp + 0xcc], 0xd0bfde78
mov dword [esp + 0xd0], 0xd476d296
mov dword [esp + 0xd4], 0x286cd676
mov dword [esp + 0xd8], 0x2c522a96
mov dword [esp + 0xdc], 0x206c2e4d
mov dword [esp + 0xe0], 0x24912299
mov dword [esp + 0xe4], 0x389a269a
mov dword [esp + 0xe8], 0x3c443a9c
mov dword [esp + 0xec], 0x304e3e4c
mov dword [esp + 0xf0], 0x344d3278
mov dword [esp + 0xf4], 0x8493645
mov dword [esp + 0xf8], 0xc750a79
mov dword [esp + 0xfc], 0x6f0e7d
mov dword [esp + 0x100], 0x4a20252
mov dword [esp + 0x104], 0x18a606a3
mov dword [esp + 0x108], 0x1ca21aab
mov dword [esp + 0x10c], 0x106a1e62
mov dword [esp + 0x110], 0x14641262
mov dword [esp + 0x114], 0x6864166b
mov dword [esp + 0x118], 0x6c6b6a1f
mov eax, dword [0x446fdc]
mov ecx, 0x65
mov esi, 0x9a
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x29]
mov edx, esi
xor edx, ecx
and edx, edi
xor edx, ecx
add dl, 0xd8
mov byte [esp + ecx - 0x29], dl
inc ecx
dec esi
cmp ecx, 0x145
jne 0x40bbf0
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov ecx, 0x69f2ee9d
xor ecx, dword [0x441738]
mov eax, dword [eax*4 + 0x441730]
add eax, ecx
inc eax
xor edi, edi
mov dword [esp], 0
jmp eax
Function at 0x40c2b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov dword [esp + 0x38], 0x8a16882a
mov dword [esp + 0x3c], 0x8e148c01
mov dword [esp + 0x40], 0x821d8013
mov dword [esp + 0x44], 0x865a8422
mov dword [esp + 0x48], 0x7aa77852
mov dword [esp + 0x4c], 0x7e9d7cab
mov dword [esp + 0x50], 0x72c670a7
mov dword [esp + 0x54], 0x76eb74ea
mov dword [esp + 0x58], 0x6af668d3
mov dword [esp + 0x5c], 0x6efe6cfc
mov dword [esp + 0x60], 0x62df608f
mov dword [esp + 0x64], 0x668564d7
mov dword [esp + 0x68], 0x5a8958b6
mov dword [esp + 0x6c], 0x5e8d5c85
mov dword [esp + 0x70], 0x52b15094
mov dword [esp + 0x74], 0x56cc54e4
mov dword [esp + 0x78], 0x4a9f48c9
mov dword [esp + 0x7c], 0x4e864c9f
mov dword [esp + 0x80], 0x42c940af
mov dword [esp + 0x84], 0x46914495
mov dword [esp + 0x88], 0x3ad9389e
mov dword [esp + 0x8c], 0x3ead3cfa
mov dword [esp + 0x90], 0x32ad30af
mov dword [esp + 0x94], 0x36823496
mov dword [esp + 0x98], 0x2a8b2892
mov dword [esp + 0x9c], 0x2eb42c90
mov dword [esp + 0xa0], 0x22fe20bb
mov dword [esp + 0xa4], 0x26f624f6
mov dword [esp + 0xa8], 0x1ac718f0
mov dword [esp + 0xac], 0x1ecb1cc8
mov dword [esp + 0xb0], 0x12c910ff
mov dword [esp + 0xb4], 0x16ad14a8
mov dword [esp + 0xb8], 0xab408a3
mov dword [esp + 0xbc], 0xed10cb7
mov dword [esp + 0xc0], 0x29d00ef
mov dword [esp + 0xc4], 0x69e049a
mov dword [esp + 0xc8], 0xfa19f8a2
mov dword [esp + 0xcc], 0xfe58fc3c
mov dword [esp + 0xd0], 0xf26af05c
mov dword [esp + 0xd4], 0xf62cf46c
mov dword [esp + 0xd8], 0xea2ae817
mov dword [esp + 0xdc], 0xee7fec73
mov dword [esp + 0xe0], 0xe27ce070
mov dword [esp + 0xe4], 0xe63ae446
mov dword [esp + 0xe8], 0xda08d836
mov dword [esp + 0xec], 0xde03dc12
mov dword [esp + 0xf0], 0xd20fd00f
mov dword [esp + 0xf4], 0xd60bd403
mov dword [esp + 0xf8], 0xca29c807
mov dword [esp + 0xfc], 0xce6ccc78
mov dword [esp + 0x100], 0xc260c069
mov dword [esp + 0x104], 0xc65cc451
mov dword [esp + 0x108], 0xba6cb818
mov dword [esp + 0x10c], 0xbe6abc68
mov dword [esp + 0x110], 0xb262b061
mov dword [esp + 0x114], 0xb6b5b465
mov eax, dword [0x446fdc]
mov ecx, 0x2140f1ef
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x2140f1b7]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov esi, edx
and esi, 0x85
mov edi, edx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, edi
xor edx, 0x87
add edx, ebx
add edx, esi
inc dl
mov byte [esp + ecx - 0x2140f1b7], dl
inc ecx
cmp ecx, 0x2140f2cf
jne 0x40c500
lea esi, [esp + 0x38]
push 0
push 0
push 0
push 0
push esi
call eax
mov edi, eax
xor eax, eax
test edi, edi
setne al
mov eax, dword [eax*4 + 0x4418bc]
mov ecx, 0xd9182e5
xor ecx, dword [0x4418c4]
add eax, ecx
inc eax
jmp eax
Function at 0x4140e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edi + 2], 0
lea edi, [edi + 2]
jne 0x414100
mov esi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x414120
sar edi, 1
sar eax, 1
add eax, edi
add eax, 0x844c8ad9
mov ecx, eax
and ecx, 1
or eax, 1
lea edx, [eax + ecx]
add edx, 0x7bb37528
test edx, edx
jns 0x414152
mov eax, 0xffffffff
jmp 0x41415b
add eax, ecx
lea eax, [eax*2 - 0x89915b0]
push eax
call fcn.00407fb0
add esp, 4
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
je 0x414191
add esi, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x414180
mov word [esp + 8], 0xdf62
xor ecx, ecx
mov dl, 1
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 8]
mov ebx, ecx
or ebx, 0xae
and ebx, esi
add esi, ecx
add ebx, ebx
sub esi, ebx
add esi, 0xd5b5773d
mov ebx, esi
and ebx, 1
xor esi, 1
lea ebx, [esi + ebx*2]
mov byte [esp + ecx + 8], bl
mov ecx, 1
test dl, 1
mov edx, 0
jne 0x4141a0
movzx ecx, word [esp + 8]
mov word [eax], cx
add eax, 2
mov edx, dword [esp + 0x4c]
movzx ecx, word [edx]
test cx, cx
je 0x414211
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414200
mov word [eax], 0
lea esi, [esp + 0x1c]
xor ebx, ebx
push 0x60
push 7
push 0x120089
push esi
push ebp
call fcn.0043c1e0
add esp, 0x14
nop
mov dword [esp + 8], 0xb3727133
xor ecx, ecx
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x70
xor byte [esp + ecx + 8], dl
inc ecx
cmp ecx, 4
jne case.default.0x414258
xor ecx, ecx
cmp eax, dword [esp + 8]
sete cl
jmp dword [ecx*4 + 0x441ec4]
mov dword [esp], 0x9e5d5c2f
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x43
xor dl, byte [esp + ecx]
add dl, 0xe8
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne case.default.0x41428c
xor ecx, ecx
cmp eax, dword [esp]
sete cl
jmp dword [ecx*4 + 0x441ecc]
mov ecx, eax
not ecx
shr ecx, 0x1f
jmp dword [ecx*4 + 0x441ed4]
push 0x1388
push ebp
call fcn.004365b0
add esp, 8
push 0x60
push 7
push 0x120089
push esi
push ebp
call fcn.0043c1e0
add esp, 0x14
mov ecx, eax
not ecx
shr ecx, 0x1f
jmp dword [ecx*4 + 0x441ed4]
xor ecx, ecx
cmp ebx, 0xa
setb cl
jmp dword [ecx*4 + 0x441edc]
mov ecx, dword [esp + 0x44]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
test edx, edx
setne cl
jmp dword [ecx*4 + 0x441ee4]
Function at 0x414780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x460
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 8]
mov ecx, 0xfffffffe
nop
nop
nop
nop
nop
nop
mov eax, ecx
cmp word [edx + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x4147a0
mov eax, ecx
sar eax, 1
mov dword [esp + 0x124], eax
cmp eax, 0xfffffff2
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
jge 0x4147cc
mov eax, 0xffffffff
jmp 0x4147cf
lea eax, [ecx + 0x1c]
push eax
call fcn.00407fb0
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x2c0], 0xcc97caa5
mov dword [esp + 0x2c4], 0xc0bcceac
mov dword [esp + 0x2c8], 0xc4e3c2b5
mov dword [esp + 0x2cc], 0xd8a2c693
mov dword [esp + 0x2d0], 0xdca8daab
mov dword [esp + 0x2d4], 0xd0a0dea4
mov dword [esp + 0x2d8], 0xd4d3d2af
lea eax, [esp + 0x2c0]
mov ecx, 0x3e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [eax]
lea edx, [ecx - 0x74e67200]
or edx, esi
mov ebx, esi
not ebx
or ebx, ecx
add esi, ebx
inc esi
not edx
or edx, esi
mov esi, edx
and esi, 0xf5
mov edi, edx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, edi
xor edx, 0xf7
add edx, ebx
add edx, esi
inc dl
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x22
jne 0x414840
mov edx, dword [esp + 0xc]
movzx ecx, word [edx]
mov edi, dword [esp + 4]
mov eax, edi
test cx, cx
je 0x4148b1
add edx, 2
mov eax, edi
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4148a0
mov word [eax], 0
movzx ecx, word [esp + 0x2c0]
test cx, cx
je 0x4148e1
lea edx, [esp + 0x2c2]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4148d0
mov word [eax], 0
lea eax, [esp + 0x140]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.0043c1e0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442358]