joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407687
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4160a8]
jne 0x407691
repz ret
jmp fcn.0040a6e7

Function at 0x40fa3c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409af6
and dword [ebp - 4], 0
cmp dword [0x417998], 0
mov ebx, eax
jne 0x40faed
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40fb9e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x414a78
push edi
call esi
test eax, eax
je 0x40fb9e
push eax
call fcn.00409a84
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x417998], eax
call esi
push eax
call fcn.00409a84
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41799c], eax
call esi
push eax
call fcn.00409a84
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4179a0], eax
call esi
push eax
call fcn.00409a84
pop ecx
mov dword [0x4179a8], eax
test eax, eax
je 0x40faed
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00409a84
pop ecx
mov dword [0x4179a4], eax
mov eax, dword [0x4179a4]
cmp eax, ebx
je 0x40fb45
cmp dword [0x4179a8], ebx
je 0x40fb45
push eax
call fcn.00409aff
push dword [0x4179a8]
mov esi, eax
call fcn.00409aff
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40fb45
test edi, edi
je 0x40fb45
call esi
test eax, eax
je 0x40fb3c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40fb3c
test byte [ebp - 0xc], 1
jne 0x40fb45
or dword [ebp + 0x10], 0x200000
jmp 0x40fb7e
mov eax, dword [0x41799c]
cmp eax, ebx
je 0x40fb7e
push eax
call fcn.00409aff
pop ecx
test eax, eax
je 0x40fb7e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40fb7e
mov eax, dword [0x4179a0]
cmp eax, ebx
je 0x40fb7e
push eax
call fcn.00409aff
pop ecx
test eax, eax
je 0x40fb7e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x417998]
call fcn.00409aff
pop ecx
test eax, eax
je 0x40fb9e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40fba0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x480609
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0xc]
call fcn.00466a9e
xor esi, esi
pop ecx
cmp dword [ebp + 0xc], esi
mov ebx, eax
jle 0x480641
push edi
mov edi, dword [ebp + 8]
sub edi, ebx
mov eax, esi
lea ecx, [esi + ebx]
cdq
idiv dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov al, byte [edx + eax]
xor al, byte [edi + ecx]
inc esi
cmp esi, dword [ebp + 0xc]
mov byte [ecx], al
jl 0x480626
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x50125848
Capabilities:
Encode data using xor

Disassembly:
pop es
add eax, 0x6f634954
outsb dx, byte [esi]
mov al, 0x56
adc dl, byte [eax - 0x14]
dec esi
adc dl, byte [eax]
add byte [eax], cl
inc edi
jb 0x501257a2
jo 0x501257ab
imul esp, dword [ebx + 0x73], 0xc0850000
nop
mov ah, 0x57
adc dl, byte [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi + edx*2 + 0x57bc5012], dh
adc dl, byte [eax + 0x28]
add byte [eax], al
add byte [eax], dl
jl 0x501257ab
push eax
loopne 0x5012579a
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
adc dword [edx], edx
push eax
dec eax
adc dl, byte [eax + 0x48]
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
adc dl, byte [eax + 0x38]
adc dword [edx], edx
push eax
mov al, 0x10
adc dl, byte [eax - 0x48]
adc byte [edx], dl
push eax
cwde
push eax
mov eax, 0x98501210
pop eax
adc dl, byte [eax + 1]
add bh, bh
push esp
pop edx
adc dl, byte [eax + 0x10]
push esp
push edx
jae 0x50125831
jne 0x50125836
arpl word [ebp + 0x4d], sp
popal
outsb dx, byte [esi]
popal
jb 0x5012575b
inc eax
add byte [eax], ch
pop eax
adc dl, byte [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ch
pop eax
adc dl, byte [eax + 0x30]
pop eax
adc dl, byte [eax + 0x28]
add byte [eax], al
add byte [edi + edx*2 + 0x12], bl
push eax
loopne 0x5012580e
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
adc dword [edx], edx
push eax
dec eax
adc dl, byte [eax + 0x48]
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x98501210
pop eax
adc dl, byte [eax + 1]
add bh, bh
jmp dword [ebx + ebx*2 + 0x12]
push esp
inc edx
jb 0x501258aa
jae 0x5012589f
push 0x6f736552
push edx
jae 0x501258aa
jne 0x501258af
arpl word [ebp + 0x4d], sp
popal
outsb dx, byte [esi]
popal
jb 0x501257d2
ror byte [ecx + 0x31c289d1], 0xc0
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x5012584e
ret
mov ebx, edx
mov esi, eax
lea eax, [esi + 8]
push eax
call sub.kernel32.dll_DeleteCriticalSection
test bl, bl
jle 0x501258b7
invalid
pop es
mov eax, esi
call sub.rtl120.bpl__System__ClassDestroy_qqrp14System_TObject
pop esi
pop ebx
ret

Function at 0x501267eb
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [0x50243d9d]
mov ecx, dword fs:[0x30]
mov ecx, dword [ecx + 0xc]
add ecx, 0xc
mov edx, ecx
jmp sym.vcl120.bpl__Graphics_GetCharsetValues_qqrynpqqrx20System_UnicodeString_v
Function at 0x50126814
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, edi
mov edx, dword [edx]
mov dword [esp + 0x10], 0
cmp edx, ecx
je 0x50126859
mov esi, dword [edx + 0x30]
movzx ebx, word [esi]
test bx, bx
je 0x5012680b
add esi, 2
xor edi, edi
jmp 0x5012684b
xor ebp, ebp
jmp 0x50126860

Function at 0x50126964
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc al, 0x24
mov edx, dword [ebp + 0x3c]
add edx, ebp
mov ecx, dword [edx + ecx*8 + 0x78]
mov ebx, dword [ebp + ecx + 0x20]
add ebx, ebp
mov edx, dword [ebp + ecx + 0x1c]
mov dword [esp + 0xc], edx
mov ecx, dword [ebp + ecx + 0x24]
mov dword [esp + 8], ecx
xor edx, edx
nop
nop
nop
nop

Function at 0x501269c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [ebx + edx*4]
add edi, ebp
mov ebp, 0xffffffff
xor ecx, ecx
nop
nop
nop
nop
mov esi, ecx
cmp byte [edi + ebp + 1], 0
lea ebp, [ebp + 1]
lea ecx, [ecx + 1]
jne 0x5012699b
test ebp, ebp
je 0x501269db
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul ebp, eax
movzx ecx, byte [edi]
add ebp, ecx
inc edi
dec esi
jne 0x501269bb
cmp ebp, dword [esp]
jne 0x501269e2
jmp 0x501269e9
xor ebp, ebp
cmp ebp, dword [esp]
je 0x501269e9
inc edx
mov ebp, dword [esp + 4]
jmp 0x5012698b
mov ebp, dword [esp + 4]
mov ecx, dword [esp + 0xc]
add ecx, ebp
mov eax, dword [esp + 8]
add eax, ebp
call 0xa017210c

Function at 0x501269f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0xa017210c
mov ecx, dword [ecx + eax*4]
add ecx, ebp
push 0x104
mov edi, dword [esp + 0x18]
push edi
push 0
call ecx
mov ecx, dword [str.rjyejp]
and al, 0x50

Function at 0x50126b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [ebx + edx*4]
add edi, ebp
mov ebp, 0xffffffff
xor ecx, ecx
nop
nop
nop
nop
mov esi, ecx
cmp byte [edi + ebp + 1], 0
lea ebp, [ebp + 1]
lea ecx, [ecx + 1]
jne 0x50126abb
test ebp, ebp
je 0x50126afb
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul ebp, eax
movzx ecx, byte [edi]
add ebp, ecx
inc edi
dec esi
jne 0x50126adb
cmp ebp, dword [esp]
jne 0x50126b02
jmp 0x50126b09
xor ebp, ebp
cmp ebp, dword [esp]
je 0x50126b09
inc edx
mov ebp, dword [esp + 4]
jmp 0x50126aab
mov esi, dword [esp + 4]
mov ecx, dword [esp + 0xc]
add ecx, esi
mov eax, dword [esp + 8]
add eax, esi
movzx eax, word [eax + edx*2]
mov ecx, dword [ecx + eax*4]
add ecx, esi
push 0
push dword [0x50243d81]
push dword [0x50243d75]
push 0
push 1
push dword [0x50243d99]
push dword [esp + 0x2c]
call ecx
mov dword [esp + 0xc], eax
mov ecx, dword [0x50243d7d]
mov eax, dword [0x50243d91]
mov edx, dword [0x50243d8d]
adc eax, 0x50243d8d

Function at 0x50126b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc eax, 0x50243d8d
mov dword [esp], edx
mov edx, dword [esi + 0x3c]
add edx, esi
mov ecx, dword [edx + ecx*8 + 0x78]
mov ebx, dword [esi + ecx + 0x20]
add ebx, esi
mov edx, dword [esi + ecx + 0x1c]
mov dword [esp + 8], edx
mov ecx, dword [esi + ecx + 0x24]
mov dword [esp + 0x1c], ecx
xor edx, edx
nop
nop
Function at 0x50126dac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x20], esi
mov edx, dword [ebx + edx + 0x24]
add edx, ebx
mov dword [esp + 0x2c], edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x50126ec4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add edx, ebx
mov esi, dword [esp]
mov edx, dword [edx + esi*8 + 0x78]
mov esi, dword [ebx + edx + 0x18]
mov dword [esp], esi
test esi, esi
je 0x50126f6b
mov esi, dword [ebx + edx + 0x20]

Function at 0x5012c63c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov ebx, eax
push 0xe
call sub.user32.dll_GetClipboardData
mov edi, eax
test edi, edi
jne 0x5012c65e
mov eax, dword [sym.vcl120.bpl__Consts__SUnknownClipboardFormat]
call fcn.50128bbc
mov eax, ebx
call sym.vcl120.bpl__Graphics_TMetafile_NewImage_qqrv
mov esi, dword [ebx + 0x28]
push 0
push edi
call sub.gdi32.dll_CopyEnhMetaFileW
mov dword [esi + 8], eax
lea eax, [ebp - 0x64]
push eax
push 0x64
mov eax, dword [esi + 8]
push eax
call sub.gdi32.dll_GetEnhMetaFileHeader
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x4c]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x48]
mov dword [esi + 0x10], eax
mov word [esi + 0x18], 0
mov byte [ebx + 0x2c], 1
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x28]
test eax, eax
setne al
mov byte [ebx + 0x22], al
mov edx, ebx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x501fc900
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x501fc9a8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x501fc97b
mov edx, ebx
mov eax, dword [sym.vcl120.bpl__Graphics_TPicture_]
call sym.vcl120.bpl__Graphics_TPicture_SupportsClipboardFormat_qqrus
test al, al
je 0x501fc96b
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
mov edi, eax
push edi
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call sym.vcl120.bpl__Graphics_TPicture_LoadFromClipboardFormat_qqrusuip10HPALETTE__
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x501fc9af
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x501fc933
mov ecx, dword [0x50243dc8]
mov dl, 1
mov eax, dword [sym.vcl120.bpl__Clipbrd_EClipboardException_]
call sub.rtl120.bpl__Sysutils_Exception__bctr_qqrp20System_TResStringRec
call sub.rtl120.bpl__System__RaiseExcept_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501fc9af
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x501fc9b8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x501fca14
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
mov edi, eax
push edi
mov ecx, esi
mov dx, 2
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501fca1b
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x501fca24
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x501fca79
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501fca80
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x5021ce14
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5021cf90
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp byte [eax + 0x18], 0
jne 0x5021cf6a
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
je 0x5021cf6a
mov eax, dword [ebp - 8]
mov byte [eax + 0x18], 1
xor eax, eax
push ebp
push 0x5021cf63
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0xc]
mov ecx, 0x5021cf9c
call sub.rtl120.bpl__System__IntfCast_qqrr45System__DelphiInterface_t17System_IInterface_x45System__DelphiInterface_t17System_IInte
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call 0x50126e14
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call sub.rtl120.bpl__System__WStrFromUStr_qqrr17System_WideStringx20System_UnicodeString
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call sym.vcl120.bpl__Graphics_TFont_GetSize_qqrv
mov dword [ebp - 0x14], eax
fild dword [ebp - 0x14]
fmul dword [0x5021cfac]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.50126f00
test al, 1
setne al
neg al
sbb eax, eax
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.50126f00
test al, 2
setne al
neg al
sbb eax, eax
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.50126f00
test al, 4
setne al
neg al
sbb eax, eax
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.50126f00
test al, 8
setne al
neg al
sbb eax, eax
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call sym.vcl120.bpl__Graphics_TFont_GetCharset_qqrv
movzx eax, al
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x48]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5021cf6a
mov eax, dword [ebp - 8]
mov byte [eax + 0x18], 0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5021cf97
lea eax, [ebp - 0x10]
call sub.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 0xc]
call sub.rtl120.bpl__System__WStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__IntfClear_qqrr45System__DelphiInterface_t17System_IInterface_
ret
Function at 0x41fe90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x8cecc0]
xor edx, edx
cmp eax, edx
jne 0x41feb6
xor eax, eax
mov byte [eax + 0x8cebc0], al
inc eax
cmp eax, 0x100
jl 0x41fe9e
mov dword [0x8cecc0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x8cebc0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41ff47
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41ff1a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41fee8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41ffc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x420013
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41fffa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4242b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x4244d1
cmp eax, 8
jg 0x4244d1
cmp dword [esp + 0x8c], 2
jl 0x4244d1
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x4244d1
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x4244d1
mov eax, dword [esp + 0x80]
test eax, eax
je 0x424337
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x4244ba
mov ebp, dword [0x474500]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x424369
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x4244a1
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x424389
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [0x4744f0]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4243c8
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x4744f4]
lea ecx, [esp + 0x28]
push ecx
call dword [0x474534]
test eax, eax
jne 0x424488
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.004238c0
cmp eax, 1
jne 0x4244b2
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.00424170
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x42437d
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x4244ba
jmp 0x424354
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.004234c0
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c