joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4021b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x4022c2
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4022c2
cmp dword [esp + 0x2c], 0
je 0x4022c2
push esi
call fcn.00408a50
add esp, 4
test eax, eax
je 0x40221a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x402221
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x402200
jmp 0x402223
mov ebx, 0x1505
jmp 0x402223
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x4022ca
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x402287
call fcn.004023c0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x4022c2
push ecx
call fcn.00408a50
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x40233d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4022e8
inc edi
dec esi
je 0x40223c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x402241
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4022e0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.00408a50
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4022e0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.00408a70
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4022e0
mov eax, 0xffffffff
jmp 0x4022c2
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x402358
inc edi
dec esi
je 0x402282
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x402287
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x402350
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408a50
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x402350
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.00408a70
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402350
jmp 0x402287
Function at 0x402af0
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402ca6
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
mov ecx, edi
shr ecx, 0x10
mov eax, edi
or eax, 0xffff
xor edi, 0xffff0000
and edi, eax
test esi, esi
je 0x402c9f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x402b85
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x402c9f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x402c0c
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
mov esi, edi
and esi, eax
xor edi, eax
lea eax, [edi + esi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
mov edi, esi
and edi, eax
xor esi, eax
lea eax, [esi + edi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x402ba0
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x402b4d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x402c50
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x402c30
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402b40
jmp 0x402c5f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402b40
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x402c70
jmp 0x402b40
shl ecx, 0x10
add ecx, edi
jmp 0x402cab
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x402d1c
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x402d1e
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebp, eax
shr ebp, 4
xor eax, edi
and eax, 0xf
mov ebx, dword [eax*4 + 0x43f80c]
mov eax, ebx
and eax, ebp
add eax, eax
sub ebx, eax
add ebx, ebp
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43f80c]
inc esi
cmp edx, esi
jne 0x402ce0
not eax
jmp 0x402d1e
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409000
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov edx, dword [esp + 0xc]
mov dword [0x447e94], edx
mov eax, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
shr ecx, 0x1e
mov esi, ecx
and esi, edx
add ecx, edx
add esi, esi
sub ecx, esi
imul ecx, ecx, 0x6c078965
mov edx, ecx
and edx, eax
xor ecx, eax
lea edx, [ecx + edx*2]
mov dword [eax*4 + 0x447e94], edx
lea ecx, [eax + 1]
cmp ecx, 0x270
je 0x40907a
mov esi, edx
shr esi, 0x1e
mov edi, esi
and edi, edx
add esi, edx
add edi, edi
sub esi, edi
imul edx, esi, 0x6c078965
mov esi, edx
and esi, ecx
xor edx, ecx
lea edx, [edx + esi*2]
mov dword [eax*4 + 0x447e98], edx
inc ecx
mov eax, ecx
jmp 0x409020
mov dword [0x447e90], 0x270
pop esi
pop edi
ret
Function at 0x409440
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x4094c0
mov edi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, edi
xor edx, 0x7fffffff
or edi, 0x80000000
and edi, edx
mov edx, dword [ecx + eax + 0x9c8]
mov esi, edx
and esi, 0x7fffffff
or esi, edi
mov edi, esi
shr edi, 1
and esi, 1
neg esi
and esi, 0x9908b0df
mov ebx, esi
and ebx, edi
add esi, edi
add ebx, ebx
sub esi, ebx
mov edi, dword [ecx + eax + 0xff8]
mov ebx, esi
and ebx, edi
add esi, edi
add ebx, ebx
sub esi, ebx
mov dword [ecx + eax + 0x1384], esi
mov edi, edx
add eax, 4
jne 0x409460
mov eax, 0x270
jmp 0x4094d2
cmp eax, 0x4e0
jb 0x4094d2
mov esi, ecx
call fcn.00409530
mov ecx, esi
mov eax, dword [esi]
mov edx, eax
and edx, 1
mov esi, eax
xor esi, 1
lea edx, [esi + edx*2]
mov dword [ecx], edx
mov edx, dword [ecx + eax*4 + 4]
mov eax, edx
shr eax, 0xb
and eax, dword [ecx + 0x1384]
xor eax, edx
mov ecx, eax
shl ecx, 7
mov edx, ecx
not edx
or edx, 0x9d2c5680
add ecx, edx
inc ecx
mov edx, ecx
and edx, eax
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
shl edx, 0xf
and edx, 0xefc60000
xor edx, ecx
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
pop edi
pop ebx
ret

Function at 0x409530
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
xor eax, eax
mov edx, SysReAllocString
nop
nop
nop
nop
nop
mov esi, eax
and esi, 0x70
mov edi, eax
xor edi, 0x270
lea esi, [edi + esi*2]
mov ebp, dword [ecx + esi*4 + 4]
and ebp, edx
mov edi, dword [ecx + esi*4 + 8]
mov ebx, edi
and ebx, 0x7ffffffe
or ebx, ebp
shr ebx, 1
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + esi*4 + 0x638]
xor edi, ebx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x409540
mov esi, dword [ecx + 0xd50]
mov eax, 0x355
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 - 0xd50]
xor edi, edx
mov dword [ecx + eax*4 - 0x9c4], edi
inc eax
cmp eax, 0x4e1
jne 0x4095a0
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4097a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov edi, dword [esp + 0x418]
movzx ecx, word [edi]
lea eax, [esp + 4]
test cx, cx
je 0x4098ec
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea esi, [edi + 2]
cmp bx, 0x7f
ja 0x4097f0
lea ebp, [eax + 1]
mov byte [eax], bl
jmp 0x409880
cmp ebx, 0x7ff
ja 0x409820
cmp edx, 2
jb 0x409820
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and bl, 0x3f
or bl, 0x80
lea ebp, [eax + 2]
mov byte [eax + 1], bl
jmp 0x409880
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x4098ae
cmp edx, 4
jb 0x4098ae
movzx esi, word [edi + 2]
add edi, 4
shl ebx, 0xa
lea ecx, [ebx + esi]
add ecx, 0xfca02400
mov ebx, ecx
shr ebx, 0x12
add bl, 0xf0
mov byte [eax], bl
mov ebx, ecx
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [eax + 1], bl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 2], cl
mov ecx, esi
and cl, 0x3f
or cl, 0x80
lea ebp, [eax + 4]
mov byte [eax + 3], cl
mov esi, edi
nop
nop
nop
nop
mov ecx, ebp
xor ecx, eax
not eax
and eax, ebp
add eax, eax
sub eax, ecx
mov ecx, edx
not ecx
and ecx, eax
not eax
and edx, eax
sub edx, ecx
mov edi, esi
mov eax, ebp
movzx ecx, word [edi]
test cx, cx
je 0x4098ec
test edx, edx
jne 0x4097d0
jmp 0x4098ec
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x4098bd
mov edi, esi
jmp 0x40989c
cmp edx, 3
jb 0x4098e8
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and bl, 0x3f
or bl, 0x80
lea ebp, [eax + 3]
mov byte [eax + 2], bl
jmp 0x409880
mov ebp, eax
jmp 0x409880
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [eax], 0
xor eax, eax
jmp 0x409918
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x409910
test ecx, ecx
je 0x40992c
mov ebx, ecx
jmp 0x409910
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00404de0
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40a720
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x449278]
mov dword [esp + 4], eax
mov dword [esp + 0x1a8], 0x23221920
mov byte [esp + 0x1ac], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x1a8]
mov esi, ecx
or esi, 0x1c1b53b8
lea edi, [esi + esi]
neg edi
add edi, ecx
add edi, 0x1c1b53b7
and edi, 0x63248c51
and esi, 0xb0326
or esi, edi
mov edi, edx
and edi, 0xffffffd1
or edi, 0xacd00008
and edx, 0x2e
xor edx, edi
xor edx, esi
xor edx, 0xd3e4dcd1
lea esi, [edx*2 - 0x19114532]
add edx, 0x73775d67
and esi, 2
mov edi, esi
and edi, edx
xor esi, edx
xor esi, 1
lea edx, [esi + edi*2]
mov byte [esp + ecx + 0x1a8], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 5
jb 0x40a750
mov ecx, dword [esp + 0x1a8]
mov dword [esp + 0x18], 0x29bf2bbd
mov dword [esp + 0x1c], 0x2dcf2ffe
mov dword [esp + 0x20], 0xd104d3f9
mov dword [esp + 0x24], 0xd532d702
mov dword [esp + 0x28], 0xd936db38
mov word [esp + 0x2c], 0xdfd8
mov dword [esp + 0x2e], 0
mov byte [esp + 0x32], 0
xor eax, eax
mov edx, 0xffffffff
movzx edi, byte [esp + eax + 0x18]
mov ebx, edx
or ebx, 0xb3da577
lea ebp, [eax + ebx]
mov esi, eax
or esi, 0xf4c25a88
and esi, ebx
not esi
lea esi, [esi + ebp*2]
add esi, 2
xor esi, edi
mov edi, esi
and edi, 0x2c
mov ebx, esi
xor ebx, 0xac
lea ebx, [ebx + edi*2]
and esi, 1
or ebx, 1
add ebx, esi
mov byte [esp + eax + 0x18], bl
lea esi, [eax + 1]
dec edx
mov eax, esi
cmp esi, 0x1b
jne 0x40a810
lea esi, [esp + 0x18]
push ecx
push 0
push esi
call dword [esp + 0x10]
mov ecx, 0x44927c
push eax
call fcn.00437e70
movzx eax, al
mov eax, dword [eax*4 + 0x442afc]
mov ecx, 0x34471779
xor ecx, dword [0x442b04]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x40b340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40b5a2
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40b37c
cmp edx, esi
jae 0x40b5a2
test edi, edi
je 0x40b5a2
movzx ebp, bl
test bl, bl
js 0x40b3b0
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40b370
jmp 0x40b5a2
mov ecx, ebp
not ecx
or ecx, 0xe0
add ecx, ebp
cmp ecx, 0xbf
jne 0x40b3ef
cmp bl, 0xc2
jb 0x40b3a0
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40b451
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40b49f
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40b419
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40b45b
cmp ebp, 0xe0
jne 0x40b464
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40b39c
jmp 0x40b464
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40b581
cmp bl, 0xf4
ja 0x40b3a0
movzx ecx, byte [edx + 1]
je 0x40b4b6
cmp ebp, 0xf0
jne 0x40b4bf
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40b39c
jmp 0x40b4bf
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40b3a2
cmp cl, 0x9f
ja 0x40b39c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b588
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b4aa
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40b392
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40b3a2
cmp cl, 0x8f
ja 0x40b39c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b588
movzx ebp, byte [edx + 2]
mov esi, ebp
not esi
or esi, 0xc0
add esi, ebp
cmp esi, 0x7f
jne 0x40b58e
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b596
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ecx, ebp
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x40b39c
mov ecx, dword [esp]
and ecx, 0x3f
or ecx, ebp
cmp ecx, 0x10000
jb 0x40b39c
cmp edi, 2
jb 0x40b581
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
mov esi, 0x3ff
sub esi, ecx
and esi, 0x3ff
xor esi, 0xdfff
lea ecx, [eax + 4]
mov word [eax + 2], si
jmp 0x40b392
mov ecx, eax
jmp 0x40b392
inc edx
jmp 0x40b39c
add edx, 2
jmp 0x40b39c
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40b3a2
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40bae0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x449254]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40bb8e
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x442f7c]
xor eax, eax
jmp 0x40c193
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40c1d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x440
mov dword [esp + 0x40], 0x93059125
mov dword [esp + 0x44], 0x9f379d06
mov dword [esp + 0x48], 0x9b0e990c
mov dword [esp + 0x4c], 0x87518525
mov dword [esp + 0x50], 0x8354815d
mov dword [esp + 0x54], 0x8f6e8d5c
mov dword [esp + 0x58], 0x8b358960
mov dword [esp + 0x5c], 0x77e075dd
mov dword [esp + 0x60], 0x73e571dc
mov dword [esp + 0x64], 0x7fed7de3
mov dword [esp + 0x68], 0x7bcc7998
mov dword [esp + 0x6c], 0x678665d8
mov dword [esp + 0x70], 0x63b261b1
mov dword [esp + 0x74], 0x6fbe6dba
mov dword [esp + 0x78], 0x6b8a69b3
mov dword [esp + 0x7c], 0x57ff55eb
mov dword [esp + 0x80], 0x538c51c6
mov dword [esp + 0x84], 0x5f855d80
mov dword [esp + 0x88], 0x5bc259b8
mov dword [esp + 0x8c], 0x479a459a
mov dword [esp + 0x90], 0x43a241a9
mov dword [esp + 0x94], 0x4fde4d8d
mov dword [esp + 0x98], 0x4bde49d8
mov dword [esp + 0x9c], 0x37893599
mov dword [esp + 0xa0], 0x3390319d
mov dword [esp + 0xa4], 0x3f973df7
mov dword [esp + 0xa8], 0x3bed39a4
mov dword [esp + 0xac], 0x27f525f9
mov dword [esp + 0xb0], 0x23f421ff
mov dword [esp + 0xb4], 0x2ff02dff
mov dword [esp + 0xb8], 0x2bc229c8
mov dword [esp + 0xbc], 0x17de15df
mov dword [esp + 0xc0], 0x13a711ac
mov dword [esp + 0xc4], 0x1fca1da8
mov dword [esp + 0xc8], 0x1b8e19f8
mov dword [esp + 0xcc], 0x7ad05ad
mov dword [esp + 0xd0], 0x3e201ad
mov dword [esp + 0xd4], 0xfa30dc3
mov dword [esp + 0xd8], 0xba109ab
mov dword [esp + 0xdc], 0xf71ff563
mov dword [esp + 0xe0], 0xf331f110
mov dword [esp + 0xe4], 0xff6cfd54
mov dword [esp + 0xe8], 0xfb6ff96f
mov dword [esp + 0xec], 0xe731e549
mov dword [esp + 0xf0], 0xe333e131
mov dword [esp + 0xf4], 0xef38ed35
mov dword [esp + 0xf8], 0xeb3ce938
mov dword [esp + 0xfc], 0xd700d504
mov dword [esp + 0x100], 0xd332d100
mov dword [esp + 0x104], 0xdf7fdd6f
mov dword [esp + 0x108], 0xdb7bd976
mov dword [esp + 0x10c], 0xc76fc556
mov dword [esp + 0x110], 0xc31fc117
mov dword [esp + 0x114], 0xcf11cd1f
mov dword [esp + 0x118], 0xcb19c91e
mov dword [esp + 0x11c], 0xb7b6b56a
mov word [esp + 0x120], 0
mov eax, dword [0x449248]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xe4
xor dl, byte [esp + ecx + 0x40]
add dl, 0x8c
mov byte [esp + ecx + 0x40], dl
inc ecx
cmp ecx, 0xe2
jne 0x40c430
lea ebx, [esp + 0x40]
push 0
push 0
push 0
push 0
push ebx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov ecx, 0x905a24f2
xor ecx, dword [0x443024]
mov eax, dword [eax*4 + 0x44301c]
add eax, ecx
inc eax
xor ebp, ebp
xor edi, edi
jmp eax
Function at 0x413a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ebp, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x413aa0
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x413ac0
sar ebp, 1
sar eax, 1
lea ecx, [eax + ebp]
add ecx, 2
test ecx, ecx
jns 0x413ae0
mov eax, 0xffffffff
jmp 0x413ae9
add eax, ebp
lea eax, [eax*2 + 4]
push eax
call fcn.00408940
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x413b21
add esi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x413b10
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [edi]
test cx, cx
je 0x413b51
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413b40
mov word [eax], 0
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043cf90
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x443708]
Function at 0x4179a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x180
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x10], 0x97c0b3d
mov dword [esp + 0x14], 0x5770785
mov dword [esp + 0x18], 0x1020376
mov word [esp + 0x1c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 3
xor cl, byte [esp + eax + 0x10]
add cl, 0xf1
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0xe
jne 0x4179e0
mov dword [esp + 0x38], 0xb92ebb1c
mov dword [esp + 0x3c], 0xbd2ebf2c
mov dword [esp + 0x40], 0xb163b372
mov dword [esp + 0x44], 0xb52ab761
mov dword [esp + 0x48], 0xa94fab25
mov dword [esp + 0x4c], 0xad32af4f
mov dword [esp + 0x50], 0xa133a334
mov dword [esp + 0x54], 0xa532a735
mov dword [esp + 0x58], 0x595a5b6a
mov word [esp + 0x5c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [eax + 0xdf]
mov edx, eax
neg edx
and edx, 0x15
and ecx, 0xea
or ecx, edx
xor cl, byte [esp + eax + 0x38]
xor cl, 0x15
add cl, 0xa5
mov byte [esp + eax + 0x38], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x26
jb 0x417a50
movzx ecx, word [esp + 0x38]
lea eax, [esp + 0x146]
test cx, cx
je 0x417ab1
lea edx, [esp + 0x3a]
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417aa0
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0x417ae1
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417ad0
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x417b11
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417b00
mov word [eax], 0
mov esi, dword [esi]
mov dword [esp + 0x38], 0xd0000ea
mov byte [esp + 0x3c], 0xe8
mov dword [esp + 0x3d], 0
xor eax, eax
nop
movzx ecx, byte [esp + eax + 0x38]
mov edi, eax
and edi, 5
mov edx, eax
and edx, 2
mov ebx, edx
xor ebx, 2
imul ebx, edi
or edi, 2
imul edi, edx
mov edx, eax
xor edx, 0x67cc2827
add edx, ebx
add edx, edi
mov edi, ecx
and edi, edx
add edi, edi
mov ebx, edi
xor ebx, edx
not edx
and edx, edi
add edx, edx
sub ebx, edx
add bl, cl
add bl, 0x3d
mov byte [esp + eax + 0x38], bl
inc eax
cmp eax, 9
jne 0x417b30
movzx eax, byte [esp + 0x38]
test al, al
je 0x417b9b
lea ecx, [esp + 0x39]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x417b90
mov byte [esi], 0
lea eax, [esp + 0x13c]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x146]
push eax
push ecx
push edx
call fcn.0040bae0
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x443e3c]
mov ecx, 0x1d136e53
xor ecx, dword [0x443e44]
add eax, ecx
inc eax
jmp eax