joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408e90
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, dword [esp + 8]
mov dword [0x44cbb4], edx
mov eax, 0xfffffd92
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x6c078965
mov esi, ecx
or ecx, 0x6c078965
imul ecx, edx
xor edx, 0x6c078965
and esi, 0x93f8769a
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x26f
mov dword [eax*4 + 0x44d570], edx
test eax, eax
je 0x408f1f
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x6c078965
mov esi, ecx
or ecx, 0x6c078965
imul ecx, edx
xor edx, 0x6c078965
and esi, 0x93f8769a
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x270
mov dword [eax*4 + 0x44d574], edx
add eax, 2
jmp 0x408ea0
mov dword [0x44cbb0], 0x270
pop esi
ret

Function at 0x408f40
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x218
call fcn.0043deb0
test al, al
je 0x4090d9
lea eax, [esp + 0x10]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00437700
test al, al
je 0x4090d4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 0x92d07f78
mov esi, 0x7cd42f9
mov ecx, ebx
shrd esi, edx, cl
mov dword [esp + 8], eax
shr edx, cl
test bl, 0x20
je 0x408fa1
mov esi, edx
xor edx, edx
mov edi, esi
and edi, 0x7cd42f9
mov ebx, edx
and ebx, 0x92d07f78
mov eax, edi
not eax
mov dword [esp + 4], eax
mov ecx, ebx
not ecx
mov dword [esp], ecx
add esi, 0x7cd42f9
adc edx, 0x92d07f78
add esi, 1
adc edx, 0
mov ecx, esi
add ecx, eax
mov ebp, edx
adc ebp, dword [esp]
mov eax, edi
sub eax, esi
mov esi, ebx
sbb esi, edx
and esi, ebx
and eax, edi
and ebp, dword [esp]
and ecx, dword [esp + 4]
sub ecx, eax
sbb ebp, esi
mov edi, ebp
and edi, 0x28c25460
mov edx, ecx
and edx, 0x469ed64b
mov eax, ebp
and eax, 0xd73dab9f
mov dword [esp + 0xc], eax
mov esi, ecx
and esi, 0xb96129b4
mov dword [esp], esi
mov esi, eax
xor esi, 0xd73dab9f
mov ebx, dword [esp]
xor ebx, 0xb96129b4
imul esi, edx
mov eax, ebx
mul edx
mov dword [esp + 4], eax
imul edi, ebx
add edx, edi
add edx, esi
mov edi, edx
or ebp, 0xd73dab9f
or ecx, 0xb96129b4
mov edx, dword [esp]
imul ebp, edx
mov eax, ecx
mul edx
mov esi, dword [esp + 0xc]
imul esi, ecx
add edx, esi
add edx, ebp
add eax, dword [esp + 4]
adc edx, edi
mov edi, edx
shr edi, 0x15
xor edi, edx
mov esi, edx
shld esi, eax, 0xb
xor esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x4090b0
mov ecx, 0x1ed807d1
mov eax, esi
mul ecx
imul ecx, esi, 0x7ba91d1c
imul ebx, edi, 0x1ed807d1
add ebx, edx
add ebx, ecx
mov esi, eax
mov ecx, dword [esp + 8]
shrd esi, ebx, cl
mov edi, ebx
shr edi, cl
test cl, 0x20
je 0x4090ac
mov esi, edi
xor edi, edi
xor edi, ebx
xor esi, eax
or edi, 0x1010101
or esi, 0x1010101
push edi
push esi
call fcn.0040a350
add esp, 8
test al, al
je 0x4090d4
call fcn.0040d420
call fcn.0040c0c0
call fcn.0043f3b0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4090f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x409168
xor eax, eax
mov edx, SysReAllocString
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea esi, [eax + 0x270]
mov edi, esi
not edi
and edi, 0x270
and esi, 0x58f
sub esi, edi
mov ebp, dword [ecx + esi*4 + 4]
and ebp, edx
mov edi, dword [ecx + esi*4 + 8]
mov ebx, edi
and ebx, 0x7ffffffe
or ebx, ebp
shr ebx, 1
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + esi*4 + 0x638]
xor edi, ebx
mov dword [ecx + eax*4 + 0x9c4], edi
inc eax
cmp eax, 0x270
jne 0x409110
mov eax, 0x270
jmp 0x40917a
cmp eax, 0x4e0
jb 0x40917a
mov esi, ecx
call fcn.004091d0
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
mov ecx, eax
not ecx
or ecx, 0x9d2c5680
add ecx, eax
inc ecx
xor ecx, edx
mov edx, ecx
shl edx, 0xf
and edx, 0xefc60000
xor edx, ecx
mov eax, edx
shr eax, 0x12
and ecx, eax
or eax, edx
xor eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4091d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
xor eax, eax
mov edx, SysReAllocString
nop
nop
nop
nop
nop
lea edi, [eax + 0x270]
mov esi, dword [ecx + eax*4 + 0x9c4]
and esi, edx
mov ebx, eax
and ebx, 1
or edi, 1
add edi, ebx
mov edi, dword [ecx + edi*4 + 4]
mov ebx, edi
not ebx
or ebx, 0x7fffffff
add edi, ebx
inc edi
or esi, edi
shr esi, 1
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, esi
mov esi, dword [ecx + eax*4 + 0xff8]
mov ebx, edi
and ebx, esi
add edi, esi
add ebx, ebx
sub edi, ebx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x4091e0
mov edi, dword [ecx + 0xd50]
mov eax, 0xe4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea esi, [eax - 1]
mov edx, edi
or edx, 0x80000000
xor edi, 0x7fffffff
and edi, edx
mov edx, dword [ecx + eax*4 + 0x9c4]
mov ebx, edx
not ebx
or ebx, 0x7fffffff
add ebx, edx
inc ebx
or ebx, edi
mov edi, ebx
shr edi, 1
and ebx, 1
neg ebx
and ebx, 0x9908b0df
mov ebp, esi
or ebp, 0x3ffffd8f
and esi, 0x18f
add esi, ebp
xor edi, dword [ecx + esi*4 + 0x63c]
xor edi, ebx
mov dword [ecx + eax*4], edi
inc eax
mov edi, edx
cmp eax, 0x270
jne 0x409250
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cc60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0x4fdd49f5
mov dword [esp + 0x40], 0x43db4dc2
mov dword [esp + 0x44], 0x47da41dc
mov dword [esp + 0x48], 0xbbe945e5
mov dword [esp + 0x4c], 0xbfecb9ed
mov dword [esp + 0x50], 0xb3d2bdec
mov dword [esp + 0x54], 0xb71db1e8
mov dword [esp + 0x58], 0xab38b52d
mov dword [esp + 0x5c], 0xaf3da90c
mov dword [esp + 0x60], 0xa335ad27
mov dword [esp + 0x64], 0xa714a1c0
mov dword [esp + 0x68], 0x9bfaa510
mov dword [esp + 0x6c], 0x9fce99c9
mov dword [esp + 0x70], 0x93c29dce
mov dword [esp + 0x74], 0x97f691df
mov dword [esp + 0x78], 0x8b13953f
mov dword [esp + 0x7c], 0x8fc4891a
mov dword [esp + 0x80], 0x83cd8dd8
mov dword [esp + 0x84], 0x870e81e0
mov dword [esp + 0x88], 0xfbae85ce
mov dword [esp + 0x8c], 0xff9ef9a1
mov dword [esp + 0x90], 0xf362fdbd
mov dword [esp + 0x94], 0xf76af160
mov dword [esp + 0x98], 0xeb41f551
mov dword [esp + 0x9c], 0xef48e94d
mov dword [esp + 0xa0], 0xe37bed53
mov dword [esp + 0xa4], 0xe7b5e174
mov dword [esp + 0xa8], 0xdb8de5b1
mov dword [esp + 0xac], 0xdf8cd993
mov dword [esp + 0xb0], 0xd398dd8b
mov dword [esp + 0xb4], 0xd78ed1b0
mov dword [esp + 0xb8], 0xcb72d56b
mov dword [esp + 0xbc], 0xcf73c97c
mov dword [esp + 0xc0], 0xc39ecd70
mov dword [esp + 0xc4], 0xc75ac1a0
mov dword [esp + 0xc8], 0x3ba5c55d
mov dword [esp + 0xcc], 0x3f5e399d
mov dword [esp + 0xd0], 0x33973d87
mov dword [esp + 0xd4], 0x37a93197
mov dword [esp + 0xd8], 0x2b7335a7
mov dword [esp + 0xdc], 0x2f692948
mov dword [esp + 0xe0], 0x23b42db4
mov dword [esp + 0xe4], 0x27bb21b3
mov dword [esp + 0xe8], 0x1b492581
mov dword [esp + 0xec], 0x1f4f1949
mov dword [esp + 0xf0], 0x13401d55
mov dword [esp + 0xf4], 0x17441140
mov dword [esp + 0xf8], 0xb581544
mov dword [esp + 0xfc], 0xf6e0958
mov dword [esp + 0x100], 0x3a30dbb
mov dword [esp + 0x104], 0x7a7019a
mov dword [esp + 0x108], 0x7be30592
mov dword [esp + 0x10c], 0x7f2b792b
mov dword [esp + 0x110], 0x73397d2b
mov dword [esp + 0x114], 0x77217122
mov dword [esp + 0x118], 0x6b6a753e
mov dword [esp + 0x11c], 0
mov eax, dword [0x44df5c]
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx + 0x3c]
mov esi, edx
and esi, 0x70
mov edi, edx
and edi, 2
mov ebp, edi
xor ebp, 2
imul ebp, esi
or esi, 2
imul esi, edi
add esi, ebp
mov edi, ecx
and edi, 0xe4
neg edi
add edi, edx
add edi, 0xee752a72
mov ebp, esi
and ebp, edi
xor esi, edi
lea esi, [esi + ebp*2]
mov edi, ebx
xor edi, 0x26
mov ebp, esi
xor ebp, 0x26
xor esi, 0xd9
and esi, edi
xor ebx, 0xd9
and ebx, ebp
or ebx, esi
add bl, 0xc6
mov byte [esp + edx + 0x3c], bl
inc edx
add ecx, 2
cmp edx, 0xe4
jne 0x40cec0
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x447f30]
mov ecx, 0x8e866b4a
xor ecx, dword [0x447f38]
add eax, ecx
inc eax
jmp eax
Function at 0x419570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [esp + 0x14]
movzx eax, byte [esp + 0x20]
movzx ecx, byte [esp + 0x1c]
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [esi + 8], cl
mov byte [esi + 9], al
movzx edx, byte [ebx]
test dl, dl
je 0x4195f7
lea ecx, [ebx + 1]
xor eax, eax
jmp 0x4195b9
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x4195f9
test dl, dl
jns 0x4195b0
movsx edx, dl
mov edi, edx
and edi, 0xe0
cmp edi, 0xc0
je 0x4195b0
mov edi, edx
not edi
or edi, 0xf0
add edi, edx
cmp edi, 0xdf
je 0x4195b0
and edx, 0xf8
cmp edx, 0xf0
jne 0x4195b1
add eax, 2
jmp 0x4195b1
xor eax, eax
mov edi, dword [esp + 0x18]
mov ecx, eax
and ecx, 1
xor eax, 1
lea ebp, [eax + ecx*2]
test ebp, ebp
jns 0x419613
mov eax, 0xffffffff
jmp 0x41961a
lea eax, [ebp*2]
push eax
call fcn.00408810
add esp, 4
mov dword [esi], eax
push 0
push ebx
push ebp
push eax
call fcn.0040afc0
add esp, 0x10
movzx edx, byte [edi]
test dl, dl
je 0x419693
lea ecx, [edi + 1]
xor eax, eax
jmp 0x419649
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x419687
test dl, dl
jns 0x419640
movsx edx, dl
mov ebx, edx
and ebx, 0xe0
cmp ebx, 0xc0
je 0x419640
mov ebx, edx
not ebx
or ebx, 0xf0
add ebx, edx
cmp ebx, 0xdf
je 0x419640
and edx, 0xf8
cmp edx, 0xf0
jne 0x419641
add eax, 2
jmp 0x419641
mov ebx, eax
inc ebx
jns 0x41969f
mov eax, 0xffffffff
jmp 0x4196a6
mov eax, 2
mov ebx, 1
jmp 0x4196a6
lea eax, [eax*2 + 2]
push eax
call fcn.00408810
add esp, 4
mov dword [esi + 4], eax
push 0
push edi
push ebx
push eax
call fcn.0040afc0
add esp, 0x10
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x419860
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edi + 2], 0
lea edi, [edi + 2]
jne 0x419880
mov esi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4198a0
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x4198c0
mov eax, 0xffffffff
jmp 0x4198c9
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.00408810
add esp, 4
movzx ecx, word [esi]
mov ebx, eax
test cx, cx
je 0x419901
add esi, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x4198f0
mov word [ebx], 0x5c
add ebx, 2
mov edx, dword [esp + 0x34]
movzx ecx, word [edx]
test cx, cx
je 0x419931
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419920
mov word [ebx], 0
lea ecx, [esp + 4]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x10], eax
push eax
call fcn.00441cc0
add esp, 0x14
mov dword [esp + 8], 0xfcec98f
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
xor ebp, ebp
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi + 8]
mov ecx, ebp
and ecx, 4
mov edx, esi
xor edx, 0xde880ed2
add edx, ecx
xor edx, ebx
mov ecx, edx
xor ecx, 0x1b
and edx, 0x64
add edx, edx
sub edx, ecx
inc dl
mov byte [esp + esi + 8], dl
inc esi
add ebp, 2
cmp esi, 7
jne case.default.0x4199aa
xor ecx, ecx
cmp eax, dword [esp + 8]
sete cl
jmp dword [ecx*4 + 0x448514]
mov dword [esp + 0x10], 0xb97a7bb0
mov byte [esp + 0x14], 0
xor ecx, ecx
mov dl, 0xc0
mov ebp, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dh, byte [esp + ecx + 0x10]
xor dh, dl
mov bl, 0xc4
sub bl, dh
mov byte [esp + ecx + 0x10], bl
inc ecx
dec dl
cmp ecx, 5
jne case.default.0x4199f3
xor ecx, ecx
cmp eax, dword [esp + 0x10]
sete cl
lea ebx, [esp + 4]
jmp dword [ecx*4 + 0x44851c]
mov ebp, dword [esp]
lea ebx, [esp + 4]
push 0
push 0x1388
push ebp
mov esi, eax
call fcn.0043a940
add esp, 0xc
mov ecx, eax
mov eax, esi
movzx ecx, cl
jmp dword [ecx*4 + 0x448524]
jmp dword [0x44852c]
mov ecx, dword [0x448548]
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
push 0x60
push 3
push 0x120089
push ebx
push ebp
call fcn.00441cc0
add esp, 0x14
push 0x60
push 3
push 0x120089
push ebx
push ebp
call fcn.00441cc0
add esp, 0x14
jmp dword [0x448534]
Function at 0x4199b1
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edi + 2], 0
lea edi, [edi + 2]
jne 0x419880
mov esi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4198a0
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x4198c0
mov eax, 0xffffffff
jmp 0x4198c9
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.00408810
add esp, 4
movzx ecx, word [esi]
mov ebx, eax
test cx, cx
je 0x419901
add esi, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x4198f0
mov word [ebx], 0x5c
add ebx, 2
mov edx, dword [esp + 0x34]
movzx ecx, word [edx]
test cx, cx
je 0x419931
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419920
mov word [ebx], 0
lea ecx, [esp + 4]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x10], eax
push eax
call fcn.00441cc0
add esp, 0x14
mov dword [esp + 8], 0xfcec98f
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
xor ebp, ebp
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi + 8]
mov ecx, ebp
and ecx, 4
mov edx, esi
xor edx, 0xde880ed2
add edx, ecx
xor edx, ebx
mov ecx, edx
xor ecx, 0x1b
and edx, 0x64
add edx, edx
sub edx, ecx
inc dl
mov byte [esp + esi + 8], dl
inc esi
add ebp, 2
cmp esi, 7
jne case.default.0x4199aa
xor ecx, ecx
cmp eax, dword [esp + 8]
sete cl
jmp dword [ecx*4 + 0x448514]
mov dword [esp + 0x10], 0xb97a7bb0
mov byte [esp + 0x14], 0
xor ecx, ecx
mov dl, 0xc0
mov ebp, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dh, byte [esp + ecx + 0x10]
xor dh, dl
mov bl, 0xc4
sub bl, dh
mov byte [esp + ecx + 0x10], bl
inc ecx
dec dl
cmp ecx, 5
jne case.default.0x4199f3
xor ecx, ecx
cmp eax, dword [esp + 0x10]
sete cl
lea ebx, [esp + 4]
jmp dword [ecx*4 + 0x44851c]
mov ebp, dword [esp]
lea ebx, [esp + 4]
push 0
push 0x1388
push ebp
mov esi, eax
call fcn.0043a940
add esp, 0xc
mov ecx, eax
mov eax, esi
movzx ecx, cl
jmp dword [ecx*4 + 0x448524]
jmp dword [0x44852c]
mov ecx, dword [0x448548]
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
push 0x60
push 3
push 0x120089
push ebx
push ebp
call fcn.00441cc0
add esp, 0x14
push 0x60
push 3
push 0x120089
push ebx
push ebp
call fcn.00441cc0
add esp, 0x14
jmp dword [0x448534]
Function at 0x419cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x419ce0
sar esi, 1
lea ecx, [esp + 0xa0]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44f2b0]
mov dword [esp + 0x118], 0x692a2b01
mov word [esp + 0x11c], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x118]
mov edi, ecx
xor edi, 0x2fb51477
lea edx, [ecx + ecx]
lea edi, [edi + ecx*2]
xor edi, ebx
mov ebx, edi
and ebx, 0x2c
xor edi, 0xac
lea ebx, [edi + ebx*2]
inc bl
mov byte [esp + ecx + 0x118], bl
and edx, 2
xor ecx, 1
add ecx, edx
cmp ecx, 6
jb case.default.0x419d6a
xor ecx, ecx
cmp eax, dword [esp + 0x118]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4489fc]
mov ebx, dword [esp + 0xa0]
test ebx, ebx
mov edi, dword [ebp + 0xc]
jns 0x419d86
mov eax, 0xffffffff
jmp 0x419d89
lea eax, [ebx + ebx]
push eax
call fcn.00408810
add esp, 4
lea ecx, [esp + 0xa0]
push ecx
push ebx
mov dword [esp + 0x68], eax
push eax
push esi
push dword [edi + 4]
push 0
call dword [0x44f2b0]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448a04]
xor eax, eax
jmp dword [0x448a0c]
push dword [esp + 0x60]
jmp 0x41a21f
mov eax, dword [esp + 0xa0]
mov ecx, eax
add ecx, 0xd
jns 0x419dde
mov eax, 0xffffffff
jmp 0x419de5
lea eax, [eax*2 + 0x1a]
push eax
call fcn.00408810
add esp, 4
mov ebx, eax
mov dword [esp + 0x118], 0x19ce1bb8
mov dword [esp + 0x11c], 0xe55be7b7
mov dword [esp + 0x120], 0xe102e358
mov dword [esp + 0x124], 0xed45ef3a
mov dword [esp + 0x128], 0xe957eb52
mov dword [esp + 0x12c], 0xf547f75f
mov dword [esp + 0x130], 0xf1f2f346
mov word [esp + 0x134], 0
mov byte [esp + 0x136], 0
mov eax, 0x928399fb
mov ecx, 0x2d7c6604
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x6d7c671d]
mov edx, esi
not edx
or edx, 0xc93ee107
add edx, esi
inc edx
and esi, 0xfffffff8
xor esi, 0x36c11ef8
or edx, esi
mov edi, eax
xor edi, 0x36c11ef8
mov esi, eax
or esi, 0x80028107
and esi, edi
mov edi, ecx
and edi, 0x244006f8
or esi, edi
xor esi, edx
add esi, 0x86db6a61
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
add dl, 0xb7
mov byte [esp + eax + 0x6d7c671d], dl
inc eax
dec ecx
cmp eax, 0x92839a1a
jne 0x419e60
mov eax, dword [esp + 0x60]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x419ef1
mov eax, dword [esp + 0x60]
lea edx, [eax + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419ee0
mov word [eax], 0
movzx ecx, word [esp + 0x118]
test cx, cx
je 0x419f21
lea edx, [esp + 0x11a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419f10
mov word [eax], 0
lea eax, [esp + 0x2b8]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00441cc0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448a14]
jmp dword [0x448a4c]
call fcn.00408820
add esp, 4
xor eax, eax
jmp case.0x419d6a.1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x419d71
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x419ce0
sar esi, 1
lea ecx, [esp + 0xa0]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44f2b0]
mov dword [esp + 0x118], 0x692a2b01
mov word [esp + 0x11c], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x118]
mov edi, ecx
xor edi, 0x2fb51477
lea edx, [ecx + ecx]
lea edi, [edi + ecx*2]
xor edi, ebx
mov ebx, edi
and ebx, 0x2c
xor edi, 0xac
lea ebx, [edi + ebx*2]
inc bl
mov byte [esp + ecx + 0x118], bl
and edx, 2
xor ecx, 1
add ecx, edx
cmp ecx, 6
jb case.default.0x419d6a
xor ecx, ecx
cmp eax, dword [esp + 0x118]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4489fc]
mov ebx, dword [esp + 0xa0]
test ebx, ebx
mov edi, dword [ebp + 0xc]
jns 0x419d86
mov eax, 0xffffffff
jmp 0x419d89
lea eax, [ebx + ebx]
push eax
call fcn.00408810
add esp, 4
lea ecx, [esp + 0xa0]
push ecx
push ebx
mov dword [esp + 0x68], eax
push eax
push esi
push dword [edi + 4]
push 0
call dword [0x44f2b0]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448a04]
xor eax, eax
jmp dword [0x448a0c]
push dword [esp + 0x60]
jmp 0x41a21f
mov eax, dword [esp + 0xa0]
mov ecx, eax
add ecx, 0xd
jns 0x419dde
mov eax, 0xffffffff
jmp 0x419de5
lea eax, [eax*2 + 0x1a]
push eax
call fcn.00408810
add esp, 4
mov ebx, eax
mov dword [esp + 0x118], 0x19ce1bb8
mov dword [esp + 0x11c], 0xe55be7b7
mov dword [esp + 0x120], 0xe102e358
mov dword [esp + 0x124], 0xed45ef3a
mov dword [esp + 0x128], 0xe957eb52
mov dword [esp + 0x12c], 0xf547f75f
mov dword [esp + 0x130], 0xf1f2f346
mov word [esp + 0x134], 0
mov byte [esp + 0x136], 0
mov eax, 0x928399fb
mov ecx, 0x2d7c6604
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x6d7c671d]
mov edx, esi
not edx
or edx, 0xc93ee107
add edx, esi
inc edx
and esi, 0xfffffff8
xor esi, 0x36c11ef8
or edx, esi
mov edi, eax
xor edi, 0x36c11ef8
mov esi, eax
or esi, 0x80028107
and esi, edi
mov edi, ecx
and edi, 0x244006f8
or esi, edi
xor esi, edx
add esi, 0x86db6a61
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
add dl, 0xb7
mov byte [esp + eax + 0x6d7c671d], dl
inc eax
dec ecx
cmp eax, 0x92839a1a
jne 0x419e60
mov eax, dword [esp + 0x60]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x419ef1
mov eax, dword [esp + 0x60]
lea edx, [eax + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419ee0
mov word [eax], 0
movzx ecx, word [esp + 0x118]
test cx, cx
je 0x419f21
lea edx, [esp + 0x11a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419f10
mov word [eax], 0
lea eax, [esp + 0x2b8]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00441cc0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448a14]
jmp dword [0x448a4c]
call fcn.00408820
add esp, 4
xor eax, eax
jmp case.0x419d6a.1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret