joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4028c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x4029c8
mov esi, edx
test edx, edx
je 0x4029c8
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x4029c8
push esi
call fcn.00408a00
add esp, 4
test eax, eax
je 0x40291a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402921
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402900
jmp 0x402923
mov ebp, 0x1505
jmp 0x402923
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x4029d0
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x40298a
call fcn.00402ac0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x4029c8
push ecx
call fcn.00408a00
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x402a3f
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x4029e8
inc ebx
dec esi
je 0x40293f
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402944
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x4029e0
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00408a00
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4029e0
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00408a20
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4029e0
mov eax, 0xffffffff
jmp 0x4029c8
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402a58
inc ebx
dec esi
je 0x402985
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x40298a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402a50
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00408a00
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402a50
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00408a20
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402a50
jmp 0x40298a
Function at 0x4031a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x4032b7
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4032b0
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
nop
xor eax, eax
cmp ebx, 8
mov dword [esp], ebx
jb 0x403274
mov dword [esp + 4], esi
mov eax, ebx
and eax, 0x1ff8
mov edx, 7
nop
movzx ebx, byte [ebp]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + 1]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + 2]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + 3]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + 4]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + 5]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + 6]
mov esi, edi
xor esi, ebx
and edi, ebx
mov ebx, dword [esp]
lea esi, [esi + edi*2]
add ecx, esi
movzx edi, byte [ebp + 7]
add edi, esi
add ecx, edi
add ebp, 8
add edx, 8
cmp edx, ebx
jb 0x403200
mov esi, dword [esp + 4]
jmp 0x403274
movzx edx, byte [ebp]
add edi, edx
add ecx, edi
inc ebp
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, ebx
jb 0x403260
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov ebx, 0x15b0
jne 0x4031e0
shl ecx, 0x10
or ecx, edi
jmp 0x4032bc
mov ecx, 1
mov eax, ecx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4032d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x403331
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x403333
not eax
xor esi, esi
nop dword [eax]
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x439948]
mov ebp, ebx
not ebp
mov eax, ebx
shr eax, 4
shr edi, 4
or ebp, edi
not edi
or edi, ebx
or ebp, 0x3ffffff0
and ebp, edi
not ebp
xor eax, dword [ebp*4 + 0x439948]
inc esi
cmp edx, esi
jne 0x4032f0
not eax
jmp 0x403333
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408f00
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
call fcn.00408fb0
sub esp, 0x208
mov edi, esp
sub esp, 0x100
mov esi, esp
call fcn.00434380
test al, 1
jne 0x408f25
jmp 0x408f77
call fcn.0042f220
test al, 1
jne 0x408f30
jmp 0x408f70
sub esp, 8
mov dword [esp], edi
mov dword [esp + 4], 0x104
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, str.primarily_often_on_modified_in_or_uses_the_on_the_play_of_is_that_eleet_replacements_leetspeak__ways_other_via_used_resemblance_spellings_similarity_a_internet._glyphs_of_it_system_or_their_character_reflection
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00408f90
add esp, 8
call fcn.0040a0f0
test al, 1
jne 0x408f67
jmp 0x408f6e
call fcn.0040f180
jmp 0x408f6e
jmp 0x408f70
call fcn.00434ac0
jmp 0x408f77
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x409020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x40914e
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40905c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x40908d
cmp cx, 0x7f
jbe 0x409050
movzx ecx, cx
cmp ecx, 0x7ff
ja 0x409080
add ebx, 2
jmp 0x409051
mov ecx, ebx
and ecx, 3
xor ebx, 3
lea ebx, [ebx + ecx*2]
jmp 0x409051
lea ebp, [ebx + 1]
push ebp
call fcn.004088f0
add esp, 4
mov esi, eax
test ebx, ebx
jle 0x40915c
add ebx, esi
add ebp, esi
mov eax, esi
mov dword [esp + 8], ebp
jmp 0x4090c8
mov byte [eax], dl
mov ebp, 1
add edi, 2
add eax, ebp
cmp eax, ebx
mov ebp, dword [esp + 8]
jae 0x40915e
movzx edx, word [edi]
test dx, dx
je 0x40915e
cmp dx, 0x7f
jbe 0x4090b0
mov ecx, eax
not ecx
add ecx, ebp
movzx ebp, dx
cmp ebp, 0x7ff
ja 0x409110
cmp ecx, 2
jb 0x409110
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov ebp, 2
jmp 0x4090b7
mov dword [esp + 4], ebp
xor ebp, ebp
cmp ecx, 3
jb 0x4090b7
mov ebp, dword [esp + 4]
mov ecx, ebp
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
shr ebp, 6
mov ecx, ebp
not ecx
or ecx, 0x3f
add ecx, ebp
add cl, 0x81
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov ebp, 3
jmp 0x4090b7
push 1
call fcn.004088f0
add esp, 4
mov esi, eax
jmp 0x40915e
mov eax, esi
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x409187
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [esi + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x409182
test eax, eax
jne 0x409180
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00405300
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x413a90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop word [eax + eax]
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x413ab0
mov edi, dword [ecx + 4]
mov eax, 0xfffffffe
nop word cs:[eax + eax]
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x413ad0
sar esi, 1
sar eax, 1
lea ecx, [esi + eax]
add eax, esi
add eax, 2
add ecx, ecx
add ecx, 4
test eax, eax
mov eax, 0xffffffff
cmovns eax, ecx
push eax
call fcn.004088f0
add esp, 4
mov ebx, eax
movzx ecx, word [edi]
test cx, cx
je 0x413b21
add edi, 2
mov eax, ebx
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x413b10
mov word [eax], 0x5c
add eax, 2
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x413b51
add edx, 2
nop word [eax + eax]
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413b40
mov word [eax], 0
lea eax, [esp + 8]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.004377f0
add esp, 0x14
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x43ede4]
mov ecx, 0xebfd955
xor ecx, dword [0x43edec]
add eax, ecx
inc eax
mov dword [esp + 0x28], ebx
jmp eax
Function at 0x413f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd0
mov eax, dword [ebp + 0xc]
mov edi, 0xfffffffe
nop word [eax + eax]
cmp word [eax + edi + 2], 0
lea edi, [edi + 2]
jne 0x413f40
sar edi, 1
lea ecx, [esp + 0x64]
push ecx
push 0
push 0
push edi
push eax
push 0
call dword [0x446390]
mov ebx, dword [esp + 0x64]
lea eax, [ebx + ebx]
test ebx, ebx
mov esi, 0xffffffff
cmovs eax, esi
push eax
call fcn.004088f0
add esp, 4
lea ecx, [esp + 0x64]
push ecx
push ebx
mov dword [esp + 0x28], eax
push eax
push edi
push dword [ebp + 0xc]
push 0
call dword [0x446390]
movaps xmm0, xmmword [0x43ab70]
movups xmmword [esp + 0x30], xmm0
movsd xmm0, qword [0x43ab80]
movsd qword [esp + 0x40], xmm0
movaps xmm0, xmmword [0x43ab90]
movups xmmword [esp + 0x48], xmm0
lea eax, [esp + 0x4c]
mov dword [esp + 0x88], 0
mov ecx, dword [esp + 0x88]
cmp ecx, 0x27
ja 0x414033
nop word cs:[eax + eax]
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x88]
movzx edx, byte [esp + edx + 0x30]
lea edi, [ecx + edx]
add edi, 0x49ab4dcf
add ecx, 0xcf
and ecx, edx
add ecx, ecx
mov edx, ecx
xor edx, edi
not ecx
and ecx, edi
add ecx, ecx
sub ecx, edx
add cl, 0x57
mov edx, dword [esp + 0x88]
mov byte [esp + edx + 0x30], cl
inc dword [esp + 0x88]
mov ecx, dword [esp + 0x88]
cmp ecx, 0x28
jb 0x413fe0
lea edi, [esp + 0xb0]
lea edx, [esp + 0x30]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xcc]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x64]
mov ecx, eax
add ecx, 0xd
lea eax, [eax + eax + 0x1a]
cmovns esi, eax
push esi
call fcn.004088f0
add esp, 4
mov ebx, eax
mov edx, dword [esp + 0x20]
movzx ecx, word [edx]
test cx, cx
je 0x4140a1
add edx, 2
mov eax, ebx
nop word cs:[eax + eax]
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414090
mov word [eax], 0
movzx ecx, word [esp + 0xb0]
test cx, cx
je 0x4140d1
lea edx, [esp + 0xb2]
nop word [eax + eax]
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4140c0
mov word [eax], 0
lea eax, [esp + 0x28]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.004377f0
add esp, 0x14
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x43f300]
mov ecx, 0x269ea77c
xor ecx, dword [0x43f308]
add eax, ecx
inc eax
jmp eax
Function at 0x418e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
movaps xmm0, xmmword [0x43ae20]
movups xmmword [esp + 0x40], xmm0
movaps xmm0, xmmword [0x43ae30]
movups xmmword [esp + 0x50], xmm0
lea eax, [esp + 0x60]
mov word [esp + 0x60], 0x5150
mov dword [esp + 0x62], 0
mov dword [esp + 0x65], 0
mov dword [esp + 8], 0
mov ecx, dword [esp + 8]
cmp ecx, 0x28
ja 0x418f29
nop word cs:[eax + eax]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx esi, byte [esp + ecx + 0x40]
mov ecx, 0x7b201c17
sub ecx, edx
add edx, 0xe8
and edx, esi
or ecx, esi
not ecx
add ecx, esi
sub ecx, edx
mov edx, ecx
xor edx, 0xa7
and ecx, 0x27
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esp + 8]
mov byte [esp + edx + 0x40], cl
inc dword [esp + 8]
mov ecx, dword [esp + 8]
cmp ecx, 0x29
jb 0x418ee0
lea edi, [esp + 8]
lea ebx, [esp + 0x40]
mov edx, ebx
mov ecx, 8
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x28]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 4]
xor eax, eax
nop word cs:[eax + eax]
cmp word [edi + eax], 0
lea eax, [eax + 2]
jne 0x418f60
add eax, edi
add eax, 0xfffffffe
mov ecx, edi
not ecx
and ecx, eax
xor eax, edi
add ecx, ecx
sub ecx, eax
lea eax, [ecx + 0x22]
cmp ecx, 0xffffffdd
mov ecx, 0xffffffff
cmovge ecx, eax
push ecx
call fcn.004088f0
add esp, 4
mov esi, eax
movzx ecx, word [edi]
test cx, cx
je 0x418fc1
add edi, 2
mov eax, esi
nop word cs:[eax + eax]
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x418fb0
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x418ff1
lea edx, [esp + 0xa]
nop word cs:[eax + eax]
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418fe0
mov word [eax], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], esi
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x3c], eax
movaps xmm0, xmmword [0x43ae40]
movups xmmword [esp + 0x40], xmm0
movaps xmm0, xmmword [0x43ae50]
movups xmmword [esp + 0x50], xmm0
movaps xmm0, xmmword [0x43ae60]
movups xmmword [esp + 0x60], xmm0
movaps xmm0, xmmword [0x43ae70]
movups xmmword [esp + 0x70], xmm0
mov dword [esp + 0x80], 0x1b1a19e2
mov dword [esp + 0x84], 0
mov byte [esp + 0x88], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x48
ja 0x4190af
nop word cs:[eax + eax]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x40]
lea edx, [eax + 0x34]
and edx, ecx
add eax, ecx
add edx, edx
sub eax, edx
add al, 0xc8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x40], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x49
jb 0x419080
lea eax, [esp + 0x2c]
push eax
push 0x419470
push ebx
push esi
call fcn.00419c10
add esp, 0x10
mov ebx, eax
mov eax, dword [0x43fe2c]
mov ecx, 0xf41057c6
xor ecx, dword [0x43fe34]
add eax, ecx
inc eax
jmp eax
Function at 0x419270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
movaps xmm0, xmmword [0x43ae80]
movups xmmword [esp + 0x18], xmm0
lea eax, [esp + 0x28]
mov word [esp + 0x28], 0xe9f6
mov dword [esp + 0x2e], 0
mov dword [esp + 0x2a], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x1f
ja 0x41930e
nop word [eax + eax]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x18]
add ecx, 0x20de291f
mov esi, ecx
xor esi, edx
mov edi, ecx
and edi, edx
or ecx, edx
xor ecx, esi
lea edx, [esi + edi*2]
add ecx, edi
sub edx, ecx
add dl, 0x27
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], dl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x20
jb 0x4192d0
lea edi, [esp + 4]
lea edx, [esp + 0x18]
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x14]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
nop word cs:[eax + eax]
cmp word [ebx + eax], 0
lea eax, [eax + 2]
jne 0x419340
add eax, ebx
add eax, 0xfffffffe
mov ecx, ebx
not ecx
and ecx, eax
add ecx, ecx
xor eax, ebx
sub ecx, eax
lea eax, [ecx + 0x12]
cmp ecx, 0xffffffed
mov ecx, 0xffffffff
cmovge ecx, eax
push ecx
call fcn.004088f0
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x4193a1
add ebx, 2
mov eax, esi
nop word cs:[eax + eax]
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x419390
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x4193d1
lea edx, [esp + 6]
nop word cs:[eax + eax]
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4193c0
mov word [eax], 0
lea eax, [esp + 0x18]
push eax
push esi
call fcn.004379d0
add esp, 8
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x43fed0]
mov ecx, 0xd1bed854
xor ecx, dword [0x43fed8]
add eax, ecx
inc eax
jmp eax
Function at 0x41c400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
movaps xmm0, xmmword [0x43b080]
movups xmmword [esp + 8], xmm0
movaps xmm0, xmmword [0x43b090]
movups xmmword [esp + 0x18], xmm0
movaps xmm0, xmmword [0x43b0a0]
movups xmmword [esp + 0x28], xmm0
movsd xmm0, qword [0x43b0b0]
movsd qword [esp + 0x38], xmm0
mov dword [esp + 0x40], 0xcb5dc561
lea eax, [esp + 0x44]
mov word [esp + 0x44], 0xc9c8
mov dword [esp + 0x4a], 0
mov dword [esp + 0x46], 0
mov word [esp + 0x4e], 0
mov dword [esp + 0x54], 0
mov ecx, dword [esp + 0x54]
cmp ecx, 0x47
ja 0x41c4bd
nop dword [eax]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x54]
movzx esi, byte [esp + edx + 8]
lea edx, [ecx - 0x22e4f042]
mov edi, edx
xor edi, esi
and edx, esi
lea edx, [edi + edx*2]
add ecx, 0x3e
and ecx, esi
add ecx, ecx
sub edx, ecx
add dl, 0xce
mov ecx, dword [esp + 0x54]
mov byte [esp + ecx + 8], dl
inc dword [esp + 0x54]
mov ecx, dword [esp + 0x54]
cmp ecx, 0x48
jb 0x41c480
lea edi, [esp + 0x54]
lea edx, [esp + 8]
mov ecx, 0xf
mov esi, edi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x90]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 4]
push edi
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x446390]
mov ebx, dword [esp + 4]
lea eax, [ebx + ebx]
test ebx, ebx
mov ecx, 0xffffffff
cmovns ecx, eax
push ecx
call fcn.004088f0
add esp, 4
mov esi, eax
push edi
push ebx
push eax
push 0x1e
lea eax, [esp + 0x64]
push eax
push 0
call dword [0x446390]
movaps xmm0, xmmword [0x43b0c0]
movups xmmword [esp + 8], xmm0
movsd xmm0, qword [0x43b0d0]
movsd qword [esp + 0x18], xmm0
mov byte [esp + 0x20], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x18
ja 0x41c5a7
nop word cs:[eax + eax]
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax - 0x46ee5931]
lea edi, [eax + 0xcf]
or edx, edi
and edi, ecx
and edx, ecx
add edx, edi
add eax, ecx
add eax, 0xb911a6cf
sub eax, edx
mov ecx, eax
xor ecx, 0x56
and eax, 0x56
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x19
jb 0x41c560
push 0
push 0
lea eax, [esp + 0x10]
push eax
push esi
push dword [ebp + 8]
call fcn.00416680
add esp, 0x14
mov ebx, eax
jmp dword [0x44085c]
Function at 0x41c5e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x13d0
call fcn.004088c0
mov esi, esp
push eax
sub esp, 0xac
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x84], eax
push eax
sub esp, 0xa0
mov dword [esi + 0x80], esp
sub esp, 0xb0
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x7c], eax
mov esp, eax
push eax
sub esp, 0x10
mov dword [esi + 0x78], esp
push eax
mov dword [esi + 0x5c], esp
push eax
mov dword [esi + 0x58], esp
sub esp, 0x200
mov dword [esi + 0x40], esp
push eax
mov dword [esi + 0x64], esp
sub esp, 0x20
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x3c], eax
mov esp, eax
push eax
mov dword [esi + 0x60], esp
push eax
mov dword [esi + 0x44], esp
push eax
mov dword [esi + 0x6c], esp
sub esp, 0x800
mov dword [esi + 0x20], esp
push eax
mov dword [esi + 0x70], esp
push eax
mov dword [esi + 0x2c], esp
sub esp, 0x400
mov dword [esi + 0x30], esp
push eax
mov dword [esi + 0x28], esp
push eax
mov dword [esi + 0x48], esp
sub esp, 0x18
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x38], eax
mov esp, eax
push eax
sub esp, 0x1c
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 4], eax
mov esp, eax
push eax
mov dword [esi + 0x50], esp
push eax
mov dword [esi + 0x54], esp
sub esp, 0x30
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x34], eax
mov esp, eax
movaps xmm0, xmmword [str.h_rd_vU_t__a_]
movups xmmword [esi + 0x3c8], xmm0
movsd xmm0, qword [0x43b0f0]
movsd qword [esi + 0x3d8], xmm0
mov dword [esi + 0x3e0], 0x137c1549
mov dword [esi + 0x3e4], 0x1110
mov byte [esi + 0x3e8], 0
mov dword [esi + 0xa8], 0
mov eax, dword [esi + 0xa8]
cmp eax, 0x20
ja 0x41c75b
nop dword [eax + eax]
mov eax, dword [esi + 0xa8]
mov ecx, dword [esi + 0xa8]
movzx ecx, byte [esi + ecx + 0x3c8]
mov edx, eax
and edx, 0x1300302
xor eax, 0x81300302
lea edx, [eax + edx*2]
lea eax, [edx + ecx]
and edx, ecx
add edx, edx
sub eax, edx
mov ecx, eax
xor ecx, 0xf1
and eax, 0x71
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esi + 0xa8]
mov byte [esi + ecx + 0x3c8], al
inc dword [esi + 0xa8]
mov eax, dword [esi + 0xa8]
cmp eax, 0x21
jb 0x41c700
lea eax, [esi + 0x4c]
lea edi, [esi + 0x3c8]
push 0
push 0
push 0x20019
push eax
push edi
call fcn.00438020
add esp, 0x14
shr eax, 0x1f
mov eax, dword [eax*4 + 0x440884]
mov ecx, 0x9eb0b26e
xor ecx, dword [0x44088c]
add eax, ecx
inc eax
jmp eax
Function at 0x41f310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x120
mov esi, esp
push eax
mov dword [esi + 0x1c], esp
push eax
mov dword [esi + 0x24], esp
push eax
mov dword [esi + 0x4c], esp
push eax
mov dword [esi + 0x28], esp
push eax
mov dword [esi + 0x30], esp
sub esp, 0x40
mov dword [esi + 0x2c], esp
sub esp, 0x48
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x114], eax
mov esp, eax
push eax
mov dword [esi + 0x48], esp
push eax
mov dword [esi + 0x60], esp
push eax
mov dword [esi + 0x20], esp
push eax
mov dword [esi + 0x14], esp
push eax
mov dword [esi + 0xd0], esp
push eax
mov dword [esi + 0x50], esp
sub esp, 0x30
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x44], eax
mov esp, eax
push eax
mov dword [esi + 0x5c], esp
push eax
mov dword [esi + 0x40], esp
push eax
mov dword [esi + 0x64], esp
sub esp, 8
mov dword [esi + 0xcc], esp
sub esp, 8
mov dword [esi + 0xc8], esp
sub esp, 8
mov dword [esi + 0x3c], esp
sub esp, 0x28
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0xd4], eax
mov esp, eax
lea ebx, [esi + 0xb6]
mov dword [esi + 0xc], 0
mov eax, 0x20219
mov ecx, 1
jmp dword [ecx*4 + 0x4414dc]