joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403950
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x403b06
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x403aff
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x4039e5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x403aff
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x403a65
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 7]
mov edi, eax
and edi, esi
xor eax, esi
lea edi, [eax + edi*2]
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x403a00
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x4039ad
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x403ab0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x403a90
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4039a0
jmp 0x403abf
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4039a0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x403ad0
jmp 0x4039a0
shl ecx, 0x10
or ecx, edi
jmp 0x403b0b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x403b7a
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x403b7c
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x438a14]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
add edi, ebp
add ebx, ebx
sub edi, ebx
xor eax, dword [edi*4 + 0x438a14]
inc esi
cmp edx, esi
jne 0x403b40
not eax
jmp 0x403b7c
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4050b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [esi + 8], edi
mov eax, edi
and eax, 0xfff
imul ecx, eax, 0x5556
add ecx, 0xaaac
mov edx, ecx
shr edx, 0x10
shr ecx, 0xf
and ecx, 2
xor edx, 1
add edx, ecx
mov dword [esi + 0xc], edx
mov ecx, edi
shr ecx, 0xe
and ecx, 1
mov dword [esi + 0x14], ecx
shr eax, 2
mov ecx, edi
shr ecx, 1
and ecx, 4
xor eax, 2
add eax, ecx
imul eax, eax, 0x5556
shr eax, 0x10
inc eax
movzx eax, ax
mov dword [esi + 0x10], eax
test di, di
js 0x405135
lea eax, [esi + 0x29272]
push 0x10000
push 0
push eax
call fcn.004091b0
add esp, 0xc
lea ecx, [esi + 0x9272]
lea edx, [esi + 0x9273]
lea eax, [esi + 0x39272]
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], ecx
mov byte [esi + 0x9272], 0
mov dword [esi + 0x38], 8
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x6c], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x18], 1
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
test di, di
js 0x405237
lea eax, [esi + 0x90]
push 0x8101
push 0
push eax
call fcn.004091b0
add esp, 0xc
add esi, 0x8192
push 0x280
push 0
push esi
call fcn.004091b0
add esp, 0xc
xor eax, eax
pop esi
pop edi
ret
Function at 0x40e600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x170
mov word [esp + 0x50], 0x658b
mov dword [esp + 0x52], 0
mov dword [esp + 0x56], 0
mov dword [esp + 0x5a], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xd
ja 0x40e67f
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x50]
mov edx, 0xce
sub edx, eax
add eax, 0xb8e1c831
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 0xe8], edx
mov eax, dword [esp + 0xe8]
add al, 0xa9
mov ecx, dword [esp]
mov byte [esp + ecx + 0x50], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xe
jb 0x40e640
lea ebx, [esp + 0x50]
push ebx
push dword [ebp + 8]
call fcn.00402990
add esp, 8
mov esi, eax
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x43c2b8]
Function at 0x414040
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x414060
sar esi, 1
lea edi, [esp + 0x88]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x441328]
mov ebx, dword [esp + 0x88]
test ebx, ebx
jns 0x414095
mov eax, 0xffffffff
jmp 0x414098
lea eax, [ebx + ebx]
push eax
call fcn.004090a0
add esp, 4
push edi
push ebx
mov ebx, eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x441328]
mov dword [esp + 0x18], 0xb30eb11c
mov dword [esp + 0x1c], 0xb725b515
mov dword [esp + 0x20], 0xab4aa93c
mov dword [esp + 0x24], 0xaf0bad1a
mov dword [esp + 0x28], 0xa331a132
mov dword [esp + 0x2c], 0xa739a53d
mov dword [esp + 0x30], 0x9b9a9906
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x90], 0
mov ecx, dword [esp + 0x90]
cmp ecx, 0x27
ja 0x414175
nop
nop
nop
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x90]
movzx edx, byte [esp + edx + 0x18]
mov esi, 0xb7
sub esi, ecx
add ecx, 0x2e04ec48
xor esi, ecx
and esi, edx
xor esi, ecx
mov dword [esp + 0xac], esi
mov ecx, dword [esp + 0xac]
add cl, 8
mov edx, dword [esp + 0x90]
mov byte [esp + edx + 0x18], cl
inc dword [esp + 0x90]
mov ecx, dword [esp + 0x90]
cmp ecx, 0x28
jb 0x414120
lea edi, [esp + 0x90]
lea edx, [esp + 0x18]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xac]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x88]
mov ecx, eax
add ecx, 0xd
mov dword [esp + 0x74], ebx
jns 0x4141b2
mov eax, 0xffffffff
jmp 0x4141b9
lea eax, [eax*2 + 0x1a]
push eax
call fcn.004090a0
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x74]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x4141f1
mov eax, dword [esp + 0x74]
lea edx, [eax + 2]
mov eax, ebx
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4141e0
mov word [eax], 0
movzx ecx, word [esp + 0x90]
test cx, cx
je 0x414221
lea edx, [esp + 0x92]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414210
mov word [eax], 0
lea eax, [esp + 0xc]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00435c70
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43cabc]
Function at 0x415200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov esi, esp
mov ebx, dword [ebp + 0x14]
push eax
sub esp, 0x34
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
push eax
sub esp, 0x1c
mov ecx, esp
and ecx, 0xfffffff8
mov esp, ecx
push eax
sub esp, 0x1c
mov edx, esp
sub esp, 0x28
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
mov dword [esi + 0xac], ecx
mov dword [esi + 0xb0], eax
push eax
sub esp, 0x44
mov ecx, esp
and ecx, 0xfffffff8
mov esp, ecx
push eax
sub esp, 0x2c
mov dword [esi + 0xa0], esp
sub esp, 0x38
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x94], eax
mov esp, eax
mov dword [esi + 0x2c], edx
push eax
sub esp, 0x14
mov dword [esi + 0xa4], esp
sub esp, 0x20
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x90], eax
mov esp, eax
push eax
push eax
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x9c], eax
mov esp, eax
xor eax, eax
cmp dword [ebp + 0x10], 0
setne al
xor edx, edx
mov dword [esi + 0x40], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x84], ecx
mov dword [esi + 0xa8], edi
jmp dword [eax*4 + 0x43cc2c]
Function at 0x416a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edi, dword [ebp + 0xc]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x416a60
sar ebx, 1
lea eax, [esp + 8]
push eax
push 0
push 0
push ebx
push edi
push 0
call dword [0x441328]
mov esi, dword [esp + 8]
test esi, esi
jns 0x416a8f
mov eax, 0xffffffff
jmp 0x416a92
lea eax, [esi + esi]
push eax
call fcn.004090a0
add esp, 4
lea ecx, [esp + 8]
push ecx
push esi
mov esi, eax
push eax
push ebx
push edi
push 0
call dword [0x441328]
lea edi, [esp + 0x20]
push edi
push esi
call fcn.00435e50
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43cdb8]
Function at 0x41c080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0xf333cde9
mov dword [esp + 0x14], 0xf766f160
mov dword [esp + 0x18], 0xfb1bf530
mov dword [esp + 0x1c], 0xff1ff96c
mov dword [esp + 0x20], 0xe31efdd9
mov dword [esp + 0x24], 0xe70ee114
mov dword [esp + 0x28], 0xeb78e571
mov dword [esp + 0x2c], 0xef0be90c
mov dword [esp + 0x30], 0x9374ed7a
mov dword [esp + 0x34], 0x97009179
mov dword [esp + 0x38], 0x9b669570
mov dword [esp + 0x3c], 0x9f089968
mov dword [esp + 0x40], 0x83689d0f
mov dword [esp + 0x44], 0x876a8169
mov dword [esp + 0x48], 0x8b1d8561
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 0x8988
mov byte [esp + 0x50], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x40
ja 0x41c170
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
mov esi, 0xe1
sub esi, ecx
add ecx, 0x2763c51e
xor esi, ecx
and esi, edx
xor esi, ecx
mov dword [esp + 0x5c], esi
mov ecx, dword [esp + 0x5c]
add cl, 0x2e
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x41
jb 0x41c130
lea esi, [esp + 0x5c]
lea edx, [esp + 0x10]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0xc]
push edi
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x441328]
mov ebx, dword [esp + 0xc]
test ebx, ebx
jns 0x41c1b9
mov eax, 0xffffffff
jmp 0x41c1bc
lea eax, [ebx + ebx]
push eax
call fcn.004090a0
add esp, 4
mov esi, eax
push edi
push ebx
push eax
push 0x1e
lea eax, [esp + 0x6c]
push eax
push 0
call dword [0x441328]
mov dword [esp + 0x10], 0x7bc079b2
mov dword [esp + 0x14], 0x7fc27dcd
mov dword [esp + 0x18], 0x73d771da
mov dword [esp + 0x1c], 0x77d675c0
mov dword [esp + 0x20], 0x4bfa49cd
mov dword [esp + 0x24], 0x4f4c4dee
mov word [esp + 0x28], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x19
ja 0x41c26e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, 0x70
sub edx, eax
add eax, 0xed8f
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0x17
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1a
jb 0x41c230
push 0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.00416a40
add esp, 0x14
jmp dword [0x43d59c]
Function at 0x41e240
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x860
xor ebx, ebx
mov dword [esp + 4], 0
mov edi, 0x20219
mov eax, 1
mov dword [esp + 0xc], 0
xor esi, esi
jmp dword [eax*4 + 0x43db84]
Function at 0x429370
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
jmp 0x429393
xor ebx, ebx
cmp eax, 0
je 0x429504
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
jmp 0x4293cc
cmp edi, 0
setne al
jmp 0x4293d4
jmp 0x4293d6
jmp 0x4293d8
xor ebx, ebx
test al, 1
jne 0x4293e3
jmp 0x4294fc
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [esp + 0x34], eax
mov dword [esp], eax
call fcn.00409240
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x42940d
jmp 0x4294f0
mov cl, byte [esp + 0x10]
mov byte [esp + 0x14], cl
mov byte [esp + 0x18], 0x73
mov byte [esp + 0x19], 0xad
mov byte [esp + 0x1a], 0xab
mov byte [esp + 0x1b], 0xa3
mov byte [esp + 0x1c], 0x56
mov byte [esp + 0x1d], 0xaa
mov byte [esp + 0x1e], 0x57
mov byte [esp + 0x1f], 0xa5
mov byte [esp + 0x20], 0x4c
mov byte [esp + 0x21], 0x77
mov byte [esp + 0x22], 0xbe
mov byte [esp + 0x23], 0xa3
mov byte [esp + 0x24], 0xb8
mov byte [esp + 0x25], 0x2d
mov ecx, 0xe
mov byte [esp + ecx + 0x18], 0
add ecx, 1
cmp ecx, 0x12
jne 0x429460
mov dword [esp + 0x30], eax
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0xc]
cmp ecx, 0x12
jae 0x4294c6
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
movzx edx, byte [esp + edx + 0x18]
mov ebx, ecx
add ebx, 0xf0fbb028
mov eax, esi
mov esi, 0xd7
sub esi, ecx
xor esi, ebx
and esi, edx
xor esi, ebx
mov dword [esp + 0x38], esi
mov esi, eax
mov ecx, dword [esp + 0x38]
add cl, 0xe8
mov edx, dword [esp + 0xc]
mov byte [esp + edx + 0x18], cl
mov ecx, dword [esp + 0xc]
inc ecx
mov dword [esp + 0xc], ecx
jmp 0x429479
lea edx, [esp + 0x18]
mov ecx, esi
mov dword [esp], edx
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
call fcn.00409d00
sub esp, 0xc
mov bl, al
jmp 0x4294eb
and bl, 1
jmp 0x4294f0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x429504
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42eb80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov edx, 0xfffffffe
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x42eb90
test edx, edx
je 0x42ec0a
sar edx, 1
lea esi, [edx - 1]
mov edi, edx
and edi, 3
je 0x42ebc2
nop
nop
nop
nop
nop
dec edx
movzx ebx, word [ecx]
add ecx, 2
xor ebx, eax
imul eax, ebx, 0x1000193
dec edi
jne 0x42ebb0
cmp esi, 3
jb 0x42ec0a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 4]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 6]
xor edi, eax
imul eax, edi, 0x1000193
add esi, 4
cmp edx, esi
jne 0x42ebd0
pop esi
pop edi
pop ebx
ret
Function at 0x42f2b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
lea eax, [esp + 0x18]
push 0x68
push 7
push 0x100080
push eax
push dword [ebp + 8]
call fcn.00435c70
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43f110]

Function at 0x42f580
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x44]
mov ebx, 0xffffffff
mov esi, ebx
cmp byte [edi + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x42f590
mov eax, ebx
and eax, 0xfffffffc
mov ecx, ebx
and ecx, 3
mov edx, ebx
or edx, 3
imul edx, ecx
xor ecx, 3
imul ecx, eax
add edx, ecx
shr edx, 2
movzx eax, byte [edi + ebx - 1]
cmp eax, 0x3d
je 0x42f5c8
cmp eax, 0x2e
jne 0x42f5c9
dec edx
movzx eax, byte [edi + ebx - 2]
cmp eax, 0x3d
je 0x42f5d8
cmp eax, 0x2e
jne 0x42f5d9
dec edx
mov dword [esp + 4], edx
mov edx, 0
test ebx, ebx
je 0x42f6d9
xor ecx, ecx
mov ebp, 2
mov dword [esp + 8], ebx
jmp 0x42f616
mov edx, ebx
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp + 4]
add ebp, 2
mov ecx, edx
mov ebx, dword [esp + 8]
cmp ebp, ebx
mov ebp, eax
jae 0x42f6d9
mov dword [esp + 0xc], ecx
mov esi, dword [esp + 0x44]
movzx eax, byte [esi + ebp - 2]
push eax
call fcn.00416920
add esp, 4
mov edi, ebx
mov bh, al
movzx eax, byte [esi + ebp - 1]
mov esi, dword [esp + 0xc]
push eax
call fcn.00416920
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
lea edx, [esi + 1]
mov ecx, dword [esp + 0x48]
mov byte [ecx + esi], al
cmp ebp, edi
jae 0x42f600
mov eax, dword [esp + 0x44]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 4], edx
call fcn.00416920
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x42f600
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea ebx, [esi + 2]
mov edx, dword [esp + 0x48]
mov byte [edx + esi + 1], cl
lea ecx, [ebp + 1]
cmp ecx, dword [esp + 8]
jae 0x42f5f7
mov ecx, dword [esp + 0x44]
movzx ecx, byte [ecx + ebp + 1]
push ecx
mov byte [esp + 4], al
call fcn.00416920
add esp, 4
movzx ecx, byte [esp]
cmp al, 0x40
mov edx, ebx
je 0x42f600
shl cl, 6
add al, cl
mov ecx, dword [esp + 0x48]
mov byte [ecx + esi + 2], al
add esi, 3
mov edx, esi
jmp 0x42f600
mov ebx, dword [esp + 4]
cmp edx, ebx
mov eax, 0
jne 0x42f736
mov esi, dword [esp + 0x48]
lea edx, [esi + 0x20]
lea edi, [esp + 0x10]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x30]
xor eax, eax
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
add ebx, 0xffffffe0
je 0x42f730
mov ecx, eax
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0x10]
xor cl, byte [esi + eax + 0x20]
mov byte [esi + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, ebx
jb 0x42f710
mov byte [esi + ebx], 0
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x431ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov dword [esp + 8], 0x13101146
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x13], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xe
ja 0x432069
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, 0x7c
sub edx, eax
add eax, 0x1a433e83
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0x6b
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xf
jb 0x432030
mov ecx, dword [ebp + 8]
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
push ecx
push 0
push dword [eax + 0x18]
call dword [0x44934c]
mov esp, ebp
pop ebp
ret

Function at 0x432090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ebp + 8]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x43f43c]
Function at 0x432140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0xead5d4d7
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x4321b9
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, 0x62
sub edx, eax
add eax, 0x8f1efc9d
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
add al, 0xb5
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x432180
mov edi, dword [esp + 0x10]
mov eax, dword [0x44132c]
test eax, eax
je 0x432206
xor ecx, ecx
mov edx, dword [0x441330]
nop
nop
cmp dword [edx + ecx*8], 0x10def2fc
je 0x4321e0
inc ecx
cmp eax, ecx
jne 0x4321d0
jmp 0x432206
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x432206
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x441334]
push eax
call fcn.00433920
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x432358
mov dword [esp + 0x20], esi
push dword [esp + 8]
call fcn.00431ff0
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x10], 0xead5d4d7
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x432299
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x10]
mov esi, 0x62
sub esi, eax
add eax, 0x8f1efc9d
xor esi, eax
and esi, edx
xor esi, eax
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0xc]
add al, 0xb5
mov edx, dword [esp]
mov byte [esp + edx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x432260
mov edi, dword [esp + 0x10]
mov edx, dword [0x44132c]
test edx, edx
je 0x4322e5
xor ebx, ebx
mov esi, dword [0x441330]
nop
cmp dword [esi + ebx*8], 0x10def2fc
je 0x4322c0
inc ebx
cmp edx, ebx
jne 0x4322b0
jmp 0x4322e5
mov edx, dword [esi + ebx*8 + 4]
cmp edx, edi
je 0x4322e5
push 0
push ecx
mov eax, dword [esp + 0xc]
push eax
push 5
push 4
push dword [0x441334]
push edx
call fcn.00433920
add esp, 0x1c
mov edi, eax
test edi, edi
js 0x43234c
mov ecx, dword [ebp + 8]
mov eax, dword [esp + 4]
mov esi, dword [eax]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [eax + esi + 0x3c]
add eax, esi
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edi + ebx]
movzx edx, word [ecx + ebx]
test si, si
je 0x432325
add ebx, 2
cmp si, dx
je 0x432310
cmp si, dx
je 0x432337
mov esi, dword [eax]
test esi, esi
jne 0x432300
mov edi, 0xc0000225
jmp 0x43234c
mov ecx, dword [eax + 0x44]
mov edx, dword [esp + 0x20]
mov dword [edx + 4], ecx
mov eax, dword [eax + 0xdc]
mov dword [edx + 8], eax
xor edi, edi
push dword [esp + 4]
call fcn.00432090
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4