joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402280
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4022ba
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0x4022c1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0x4022a0
jmp 0x4022c3
mov eax, 0x1505
jmp 0x4022c3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x4029e0
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402b96
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov eax, ecx
not eax
or eax, 0xffff
lea edi, [ecx + eax]
inc edi
shr ecx, 0x10
test esi, esi
je 0x402b8f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x402a75
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x402b8f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x402afc
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 7]
mov edi, eax
and edi, esi
xor eax, esi
lea edi, [eax + edi*2]
mov eax, edi
and eax, ecx
xor ecx, edi
lea ecx, [ecx + eax*2]
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x402a90
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x402a3d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x402b40
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x402b20
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402a30
jmp 0x402b4f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402a30
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x402b60
jmp 0x402a30
shl ecx, 0x10
add ecx, edi
jmp 0x402b9b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x402c28
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x402c2a
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, edi
xor ebx, 0xfffffff0
mov ebp, edi
or ebp, 0xf
and ebp, ebx
mov ebx, eax
shr ebx, 4
and eax, 0xf
not ebp
or ebp, eax
not eax
or eax, edi
and eax, ebp
not eax
mov eax, dword [eax*4 + 0x43980c]
mov ebp, eax
and ebp, ebx
add ebx, eax
add ebp, ebp
sub ebx, ebp
mov eax, ebx
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
or edi, ebp
xor edi, ebx
shr eax, 4
xor eax, dword [edi*4 + 0x43980c]
inc esi
cmp edx, esi
jne 0x402bd0
not eax
jmp 0x402c2a
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x407f6b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x407f73
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x40800b
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x407fb9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x40801a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x407fce
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x407fe0
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x407fa0
jmp 0x407fe9
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x407fa0
cmp edi, ebx
jge 0x408000
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x407fa4
jmp 0x408004
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x407fad
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x4080a2
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x4080a2
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x408054
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x408040
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x4080a2
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x408060
dec eax
mov ecx, 1
xor esi, esi
jmp 0x4080bc
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x407f6b
test edx, edx
mov dword [esp], ecx
js 0x4080f0
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x408100
inc ebp
dec edx
cmp edi, ebp
jne 0x4080d0
mov edx, 0xffffffff
jmp 0x408102
xor edi, edi
jmp 0x408105
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x4080b0
and ebp, 3
je 0x408138
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x408120
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x40813a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x4080b0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x408150
jmp 0x4080b0
Function at 0x408a20
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + 4]
mov dword [0x440e4c], ecx
mov eax, 0xfffffd92
nop
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x26f
mov dword [eax*4 + 0x441808], ecx
test eax, eax
je 0x408a71
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x270
mov dword [eax*4 + 0x44180c], ecx
add eax, 2
jmp 0x408a30
mov dword [0x440e48], 0x270
ret

Function at 0x408a80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov eax, dword [0x440e48]
cmp eax, 0x270
jne 0x408adf
mov eax, 0xfffff640
mov edx, dword [0x440e4c]
nop
nop
nop
nop
nop
nop
nop
nop
and edx, 0x80000000
mov esi, dword [eax + 0x441810]
mov ecx, esi
and ecx, 0x7ffffffe
or ecx, edx
mov edx, esi
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, dword [eax + 0x441e40]
shr ecx, 1
xor esi, ecx
mov dword [eax + 0x4421cc], esi
add eax, 4
jne 0x408aa0
mov eax, 0x270
jmp 0x408af5
cmp eax, 0x4e0
jb 0x408af5
mov ecx, 0x440e48
call fcn.00408d00
mov eax, dword [0x440e48]
lea ecx, [eax + 1]
mov dword [0x440e48], ecx
mov eax, dword [eax*4 + 0x440e4c]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [0x4421cc]
mov edx, ecx
and edx, eax
add edx, edx
sub ecx, edx
add ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc40000
xor ecx, eax
shr ecx, 0x12
and eax, 0x7fff
xor eax, ecx
pop esi
ret
Function at 0x408b60
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
call fcn.00435ac0
test al, al
je 0x408ce9
call fcn.0042ff50
test al, al
je 0x408ce4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov ebx, 0x2dee0931
mov edi, 0x3e18b0f1
shrd edi, ebx, cl
shr ebx, cl
test cl, 0x20
je 0x408bab
mov edi, ebx
xor ebx, ebx
xor edi, 0x3e18b0f1
xor ebx, 0x2dee0931
mov ecx, 0x2a602b1e
mov eax, edi
mul ecx
mov esi, eax
imul eax, edi, 0x6e81f900
imul edi, ebx, 0x2a602b1e
add edi, edx
add edi, eax
mov edx, edi
shld edx, esi, 0xb
mov ebx, edi
shr ebx, 0x15
mov eax, edi
not eax
mov ecx, esi
not ecx
or eax, ebx
or ecx, edx
sub esi, edx
sbb edi, ebx
add esi, ecx
adc edi, eax
and edi, eax
and esi, ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
jne 0x408c05
not edi
not esi
jmp 0x408c7e
mov ebp, esi
and ebp, 0x74f3e943
mov ebx, edi
mov eax, ebp
xor eax, 0x74f3e943
and esi, 0x8b0c16bc
and edi, 0x6e01f315
mov ecx, eax
mul esi
mov dword [esp], eax
imul ecx, edi
add edx, ecx
and ebx, 0x91fe0cea
mov ecx, ebx
xor ecx, 0x91fe0cea
imul ecx, esi
add ecx, edx
xor esi, 0x8b0c16bc
not ebx
not ebp
mov eax, esi
mul ebp
imul ebx, esi
add ebx, edx
xor edi, 0x6e01f315
imul ebp, edi
add ebp, ebx
add eax, dword [esp]
adc ebp, ecx
mov esi, eax
mov ecx, dword [esp + 4]
shrd esi, ebp, cl
mov edi, ebp
shr edi, cl
test cl, 0x20
je 0x408c7a
mov esi, edi
xor edi, edi
xor edi, ebp
xor esi, eax
mov edx, edi
and edx, 0x75a203cc
mov ebx, esi
and ebx, 0xf5d8e3fe
xor ebx, 0xfefffeff
xor edx, 0xfefffeff
mov ecx, edi
and ecx, 0x8a5dfc33
mov eax, esi
and eax, 0xa271c01
xor eax, 0xfffefffe
and eax, ebx
xor ecx, 0xfffefffe
and ecx, edx
and esi, 0x1010101
and edi, 0x1010101
not eax
or eax, esi
not ecx
or ecx, edi
push ecx
push eax
call fcn.00409c50
add esp, 8
test al, al
je 0x408ce4
call fcn.0040c820
call fcn.0040b6a0
call fcn.00436010
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408d00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov edx, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
nop
mov esi, edx
not esi
or esi, 0x80000000
lea edi, [edx + esi]
inc edi
mov edx, dword [ecx + eax*4 - 0x630]
mov esi, edx
and esi, 0x7fffffff
or esi, edi
mov edi, esi
shr edi, 1
and esi, 1
neg esi
and esi, 0x9908b0df
xor edi, dword [ecx + eax*4]
xor edi, esi
mov dword [ecx + eax*4 - 0xff4], edi
inc eax
cmp eax, 0x4e1
jne 0x408d10
mov edi, dword [ecx + 0xd50]
mov eax, 0x355
nop
nop
nop
mov esi, dword [ecx + eax*4]
and edi, 0x80000000
mov edx, esi
and edx, 0x7ffffffe
or edx, edi
shr edx, 1
mov edi, esi
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, edx
mov edx, dword [ecx + eax*4 - 0xd50]
mov ebx, esi
and ebx, edx
add esi, edx
add ebx, ebx
sub esi, ebx
mov dword [ecx + eax*4 - 0x9c4], esi
inc eax
cmp eax, 0x4e1
jne 0x408d60
mov edx, dword [ecx + 0x1380]
mov esi, edx
not esi
or esi, 0x80000000
mov eax, SysReAllocString
and eax, dword [ecx + 4]
add edx, esi
inc edx
or eax, edx
mov edx, eax
shr edx, 1
and eax, 1
neg eax
xor edx, dword [ecx + 0x634]
and eax, 0x9908b0df
xor edx, eax
mov dword [ecx + 0x9c0], edx
mov dword [ecx], 0
pop esi
pop edi
pop ebx
ret
Function at 0x409c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x224
mov eax, dword [0x442228]
mov dword [esp + 0x14], 0xf381f187
mov dword [esp + 0x18], 0xf7a9f5c6
mov dword [esp + 0x1c], 0xfbc8f9cb
mov dword [esp + 0x20], 0xff9afdd2
mov dword [esp + 0x24], 0x36e016c
mov word [esp + 0x28], 0x504
mov ecx, 0x21be3a70
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x21be3a5c]
lea esi, [ecx - 0x21be3a00]
mov edi, edx
not edi
or edi, esi
add edi, edx
inc edi
mov ebx, edi
and ebx, 0xfffffffd
mov ebp, edi
and ebp, 2
mov esi, edi
or esi, 0xfffffffd
inc esi
imul esi, ebx
or edi, 2
imul edi, ebp
add esi, edx
sub esi, edi
add esi, ecx
lea edx, [esi + esi]
xor esi, 0x80
sub edx, esi
mov byte [esp + ecx - 0x21be3a5c], dl
inc ecx
cmp ecx, 0x21be3a86
jne 0x409ca0
lea esi, [esp + 0x14]
push 0x800
push 0
push esi
call eax
mov ecx, 0x44222c
push eax
call fcn.00435a80
movzx eax, al
mov eax, dword [eax*4 + 0x43c63c]
mov ecx, 0xd45bcb49
xor ecx, dword [0x43c644]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x40b6d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x434
mov ebx, dword [esp + 0x448]
mov dword [esp + 0x34], 0x920e9022
mov dword [esp + 0x38], 0x960c9419
mov dword [esp + 0x3c], 0x8a15880b
mov dword [esp + 0x40], 0x8ed28c2a
mov dword [esp + 0x44], 0x82df80da
mov dword [esp + 0x48], 0x86e584d3
mov dword [esp + 0x4c], 0xfa4ef8df
mov dword [esp + 0x50], 0xfe63fc62
mov dword [esp + 0x54], 0xf26ef05b
mov dword [esp + 0x58], 0xf666f464
mov dword [esp + 0x5c], 0xea57e897
mov dword [esp + 0x60], 0xee8dec5f
mov dword [esp + 0x64], 0xe2b1e0be
mov dword [esp + 0x68], 0xe6b5e4bd
mov dword [esp + 0x6c], 0xdab9d8ac
mov dword [esp + 0x70], 0xde44dc6c
mov dword [esp + 0x74], 0xd287d041
mov dword [esp + 0x78], 0xd69ed487
mov dword [esp + 0x7c], 0xca41c8b7
mov dword [esp + 0x80], 0xce99cc9d
mov dword [esp + 0x84], 0xc2a1c096
mov dword [esp + 0x88], 0xc655c482
mov dword [esp + 0x8c], 0x3aa53857
mov dword [esp + 0x90], 0x3e8a3c9e
mov dword [esp + 0x94], 0x3293309a
mov dword [esp + 0x98], 0x36ac3488
mov dword [esp + 0x9c], 0x2a7628a3
mov dword [esp + 0xa0], 0x2e7e2c7e
mov dword [esp + 0xa4], 0x227f2078
mov dword [esp + 0xa8], 0x26732470
mov dword [esp + 0xac], 0x1a411847
mov dword [esp + 0xb0], 0x1ea51ca0
mov dword [esp + 0xb4], 0x12ac10ab
mov dword [esp + 0xb8], 0x164914af
mov dword [esp + 0xbc], 0xa950877
mov dword [esp + 0xc0], 0xe960c92
mov dword [esp + 0xc4], 0x26100aa
mov dword [esp + 0xc8], 0x6a00444
mov dword [esp + 0xcc], 0x7ae278a4
mov dword [esp + 0xd0], 0x7e247ce4
mov dword [esp + 0xd4], 0x7232701f
mov dword [esp + 0xd8], 0x76e774eb
mov dword [esp + 0xdc], 0x6af468e8
mov dword [esp + 0xe0], 0x6e326cce
mov dword [esp + 0xe4], 0x6230603e
mov dword [esp + 0xe8], 0x663b642a
mov dword [esp + 0xec], 0x5a075837
mov dword [esp + 0xf0], 0x5e035c0b
mov dword [esp + 0xf4], 0x5231500f
mov dword [esp + 0xf8], 0x56f454e0
mov dword [esp + 0xfc], 0x4ae848f1
mov dword [esp + 0x100], 0x4ed44cd9
mov dword [esp + 0x104], 0x42144010
mov dword [esp + 0x108], 0x46124410
mov dword [esp + 0x10c], 0xbaeab819
mov dword [esp + 0x110], 0xbebdbced
mov eax, dword [0x4421f8]
mov ecx, 0x4715bda7
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x4715bd73]
xor edx, ecx
mov esi, edx
or esi, 0xc6
and edx, 0xc6
add edx, esi
add dl, 2
mov byte [esp + ecx - 0x4715bd73], dl
inc ecx
cmp ecx, 0x4715be87
jne 0x40b920
lea ebp, [esp + 0x34]
push 0
push 0
push 0
push 0
push ebp
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x43c974]
mov ecx, 0xc8bb0d9b
xor ecx, dword [0x43c97c]
add eax, ecx
inc eax
jmp eax
Function at 0x4141b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x420
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x4141d0
mov eax, ebx
sar eax, 1
mov dword [esp + 0xdc], eax
cmp eax, 0xfffffff2
jge 0x4141f2
mov eax, 0xffffffff
jmp 0x4141f5
lea eax, [ebx + 0x1c]
push eax
call fcn.00408300
add esp, 4
mov esi, eax
mov dword [esp + 0x298], 0x5ae558cb
mov dword [esp + 0x29c], 0x5ece5cfa
mov dword [esp + 0x2a0], 0x52b150cb
mov dword [esp + 0x2a4], 0x56f054e5
mov dword [esp + 0x2a8], 0x4ada48c5
mov dword [esp + 0x2ac], 0x4ed24cd2
mov dword [esp + 0x2b0], 0x424140d1
xor eax, eax
nop
mov ecx, eax
add cl, 0x9f
xor cl, byte [esp + eax + 0x298]
add cl, 8
mov byte [esp + eax + 0x298], cl
inc eax
cmp eax, 0x1c
jne 0x414250
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x414291
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x414280
mov word [eax], 0
movzx ecx, word [esp + 0x298]
test cx, cx
je 0x4142c1
lea edx, [esp + 0x29a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4142b0
mov word [eax], 0
lea eax, [esp + 0x108]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00437c70
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43d578]
Function at 0x41e850
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
xor ecx, ecx
nop
nop
nop
nop
cmp word [edi + ecx], 0
lea ecx, [ecx + 2]
jne 0x41e860
lea edx, [edi + ecx]
add edx, 0xfffffffe
mov eax, edi
not eax
and eax, edx
add ecx, edi
mov edx, 1
sub edx, ecx
and edx, edi
sub eax, edx
mov ecx, eax
sar ecx, 1
and eax, 0x12
xor ecx, 9
add ecx, eax
jns 0x41e898
mov ecx, 0xffffffff
jmp 0x41e89a
add ecx, ecx
push ecx
call fcn.00408300
add esp, 4
mov esi, eax
mov dword [esp], 0xb913b70a
mov dword [esp + 4], 0xbd25bb1f
mov dword [esp + 8], 0xa1cebfea
mov dword [esp + 0xc], 0xa506a306
mov word [esp + 0x10], 0xa7a6
xor eax, eax
xor ecx, ecx
nop
mov ebx, eax
and ebx, 0xc
mov edx, ecx
xor edx, 0x86
add edx, ebx
xor dl, byte [esp + ecx]
add dl, 0xd0
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0x12
jne 0x41e8d0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41e911
add edi, 2
mov eax, esi
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41e900
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41e941
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e930
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00437dc0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x43db90]
Function at 0x42520f
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 2], 0x2eb42c6f
mov dword [esp + 6], 0x224220bc
mov dword [esp + 0xa], 0x26b724bc
mov dword [esp + 0xe], 0x5a595843
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xb3
xor cl, byte [esp + eax + 2]
add cl, 0x68
mov byte [esp + eax + 2], cl
inc eax
cmp eax, 0x10
jne 0x425240
lea edi, [esp + 0xa6]
lea edx, [esp + 2]
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xb6]
lea edx, [esp + 0x12]
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov dword [esp + 2], 0xa45aa265
mov dword [esp + 6], 0xb844a656
mov dword [esp + 0xa], 0xbc49ba46
mov dword [esp + 0xe], 0xb07cbe59
mov dword [esp + 0x12], 0xb44db250
mov dword [esp + 0x16], 0x4845b654
mov dword [esp + 0x1a], 0x4c4b4ac0
mov ecx, 0x80f7bce9
nop
nop
nop
movzx edx, byte [esp + ecx + 0x7f084319]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov esi, edx
and esi, 0x804218b5
mov edi, edx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, edi
add esi, ebx
xor edx, 0xf84218b7
mov edi, esi
and edi, edx
xor edx, esi
lea edx, [edx + edi*2]
inc dl
mov byte [esp + ecx + 0x7f084319], dl
inc ecx
cmp ecx, 0x80f7bd05
jne 0x4252c0
lea edx, [esp + 0xcc]
lea esi, [esp + 2]
mov edi, edx
mov ecx, 7
xchg esi, esi
rep movsd dword es:[edi], dword [esi]
xchg esi, esi
lea edi, [esp + 0xe8]
lea ebx, [esp + 0x1e]
xor esi, esi
xor ecx, ecx
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov dword [esp + 2], 0x731b7134
mov dword [esp + 6], 0x77157507
mov dword [esp + 0xa], 0x7b087917
mov dword [esp + 0xe], 0x7f2e7d18
mov dword [esp + 0x12], 0x83c081d4
lea ebx, [esp + 0x16]
mov word [esp + 0x16], 0x8584
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 2]
mov ebp, esi
and ebp, 0x20
mov ecx, eax
xor ecx, 0xa57df5f0
add ecx, ebp
xor ecx, edi
add ecx, 0xd410507f
mov edi, ecx
and edi, 1
xor ecx, 1
lea ecx, [ecx + edi*2]
mov byte [esp + eax + 2], cl
inc eax
add esi, 2
cmp eax, 0x16
jne 0x425380
lea esi, [esp + 0xb6]
lea eax, [esp + 2]
mov edi, esi
mov ecx, 5
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xca]
mov ecx, 1
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
lea eax, [esp + 0xa6]
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], esi
nop
nop
nop
nop
nop
nop
nop
Function at 0x42686f
Capabilities:
Encode data using xor

Disassembly:
push eax
sub esp, 0x3c
mov eax, esp
sub esp, 0x40
mov edx, esp
push eax
mov dword [ebp - 0x1c], esp
mov dword [edx], 0x99d997f3
mov dword [edx + 4], 0x9d0c9b0a
mov dword [edx + 8], 0x81219fda
mov dword [edx + 0xc], 0x85258316
mov dword [edx + 0x10], 0x893487e3
mov dword [edx + 0x14], 0x8d238bc4
mov dword [edx + 0x18], 0xf1558f1a
mov dword [edx + 0x1c], 0xf555f362
mov dword [edx + 0x20], 0xf993f752
mov dword [edx + 0x24], 0xfd40fb91
mov dword [edx + 0x28], 0xe145ff6d
mov dword [edx + 0x2c], 0xe577e371
mov dword [edx + 0x30], 0xe947e74f
mov dword [edx + 0x34], 0xed82eb44
mov dword [edx + 0x38], 0xd17def76
mov dword [edx + 0x3c], 0xd5d4d37e
mov ecx, 0xa79fd02
mov esi, 0x14f3fa04
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, esi
and edi, 0x4c
mov ebx, ecx
xor ebx, 0xa6
add ebx, edi
add bl, 0xfe
xor bl, byte [edx + ecx - 0xa79fd02]
add bl, 0xd0
mov byte [edx + ecx - 0xa79fd02], bl
inc ecx
add esi, 2
cmp ecx, 0xa79fd42
jne 0x426900
mov esi, edx
mov edi, eax
mov ecx, 0x10
xchg esi, esi
rep movsd dword es:[edi], dword [esi]
xchg esi, esi
mov edi, eax
add edi, 0x40
add edx, 0x40
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
push dword [ebp - 0x1c]
push 0
push 0
push 0x1f
push eax
push 0
call dword [0x44354c]
jmp case.0x425de0.37