joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0x1a], 0xab879ebb
xor ecx, ecx
mov dword [ebp - 0x16], 0x95b99a88
mov dword [ebp - 0x12], 0x9b9a8183
mov word [ebp - 0xe], 0x9b
mov byte [ebp - 0xc], 1
nop word [eax + eax]
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 0x1a], al
inc ecx
cmp ecx, 0xd
jb 0x40c950
mov byte [ebp - 0xc], 0
xor ecx, ecx
mov dword [ebp - 0xb], 0x808f9ea7
mov dword [ebp - 7], 0x9c8bc081
mov word [ebp - 3], 0x9d
mov byte [ebp - 1], 1
nop dword [eax + eax]
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x40c980
lea eax, [ebp - 0xb]
mov byte [ebp - 1], 0
push eax
call dword [0x50c064]
lea ecx, [ebp - 0x1a]
push ecx
push eax
call dword [0x50c0d8]
test eax, eax
je 0x40c9b5
lea ecx, [ebp - 0xb8]
push ecx
call eax
jmp 0x40c9c2
lea eax, [ebp - 0xb8]
push eax
call dword [0x50c0ac]
mov eax, dword [ebp - 0xb4]
cmp eax, 0xb
je 0x40c9d2
cmp eax, 0xa
jne 0x40c9e1
cmp dword [ebp - 0xb0], 0
je 0x40c9fb
xor al, al
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x40c9db
mov eax, dword [ebp - 0xb0]
cmp eax, 3
je 0x40c9fb
cmp eax, 2
sete al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x40cab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x100889b
xor ecx, ecx
nop dword [eax]
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 2
jb 0x40cac0
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 4]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.004e3620
add esp, 8
test eax, eax
je 0x40cafb
push eax
call fcn.004e6ea8
add esp, 4
mov bl, 1
jmp 0x40cafd
xor bl, bl
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x40cb2d
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40cb23
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cb34
push ecx
push edx
call fcn.004dd7d1
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004e2a70
int3
Function at 0x40d3d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x68
push esi
push edi
push 0
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], ecx
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], 0x64
push eax
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call dword [0x50c350]
test eax, eax
jne 0x40d5d7
mov esi, dword [0x50c2f4]
push 1
call esi
push 0
mov edi, eax
call esi
push 0
mov esi, eax
call dword [0x50c304]
mov dword [esp + 0x14], eax
test eax, eax
je 0x40d5cd
push eax
call dword [0x50c03c]
mov dword [esp + 0x10], eax
test eax, eax
je 0x40d5c1
push edi
push esi
push dword [esp + 0x1c]
call dword [0x50c034]
mov dword [esp + 0x20], eax
test eax, eax
je 0x40d5b7
push eax
push dword [esp + 0x14]
call dword [0x50c038]
push 0xcc0020
push 0
push 0
push dword [esp + 0x20]
push edi
push esi
push 0
push 0
push dword [esp + 0x30]
call dword [0x50c044]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 0
push dword [esp + 0x28]
call dword [0x50c364]
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0
push eax
call dword [0x50c360]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40d561
push eax
call fcn.004ec1ec
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
test edi, edi
je 0x40d561
push edi
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [0x50c368]
xor esi, esi
cmp dword [esp + 8], esi
jbe 0x40d558
add edi, 0x30
nop dword [eax]
mov eax, dword [edi]
mov ecx, 0x520d78
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40d53d
test dx, dx
je 0x40d539
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40d53d
add eax, 4
add ecx, 4
test dx, dx
jne 0x40d517
xor eax, eax
jmp 0x40d542
sbb eax, eax
or eax, 1
test eax, eax
je 0x40d5df
inc esi
add edi, 0x4c
cmp esi, dword [esp + 8]
jb 0x40d510
mov edi, dword [esp + 0x18]
push edi
call fcn.004eba96
add esp, 4
movups xmm0, xmmword [0x50dab8]
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x24]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
mov dword [esp + 0x54], 1
push eax
push dword [esp + 0x30]
movups xmmword [esp + 0x60], xmm0
push esi
mov dword [esp + 0x78], 4
mov dword [esp + 0x74], 1
call dword [0x50c35c]
push dword [esp + 0x20]
call dword [0x50c040]
push esi
call dword [0x50c358]
push dword [esp + 0x10]
call dword [0x50c040]
push dword [esp + 0x14]
push 0
call dword [0x50c314]
push dword [esp + 0x2c]
call dword [0x50c354]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x18]
imul eax, esi, 0x4c
push ecx
movups xmm0, xmmword [eax + ecx]
movups xmmword [esp + 0x44], xmm0
jmp 0x40d559
Function at 0x40e5b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x40e5d2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0xb
jb 0x40e5c0
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret
Function at 0x40f9c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x40f9e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x40f9d0
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret

Function at 0x40f9f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x40fa12
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x40fa00
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
ret

Function at 0x40fa20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x40fa42
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x40fa30
mov byte [esi + 9], 0
mov eax, esi
pop esi
ret

Function at 0x40fa50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x40fa72
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x40fa60
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret

Function at 0x40fa80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x40faa2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0x40fa90
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret

Function at 0x40fab0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x40fad2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x40fac0
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
ret

Function at 0x40fae0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x40fb02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x40faf0
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
ret

Function at 0x40fb10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
je 0x40fb32
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x1b
jb 0x40fb20
mov byte [esi + 0x1c], 0
mov eax, esi
pop esi
ret

Function at 0x40fb40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x40fb62
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0x40fb50
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
ret

Function at 0x40fb70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x40fb92
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x40fb80
mov byte [esi + 0x15], 0
mov eax, esi
pop esi
ret
Function at 0x40fba0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x40fbc2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x21
jb 0x40fbb0
mov byte [esi + 0x22], 0
mov eax, esi
pop esi
ret

Function at 0x40fbd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x40fbf2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x40fbe0
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret
Function at 0x411100
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x411122
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0x411110
mov byte [esi + 7], 0
mov eax, esi
pop esi
ret
Function at 0x414c10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x414c32
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0x414c20
mov byte [esi + 0x1d], 0
mov eax, esi
pop esi
ret
Function at 0x415850
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
call dword [0x50c120]
test eax, eax
movzx ecx, bl
mov edx, 1
cmovne ecx, edx
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
movzx eax, cl
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push 0x100
lea eax, [ebp - 0x118]
mov dword [ebp - 0x10], 0x100
push 0
push eax
mov dword [ebp - 0x14], 0x100
call fcn.004df7b0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [0x50c020]
push 0x100
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004df7b0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [0x50c128]
mov dword [ebp - 9], 0x828385a3
xor ecx, ecx
mov dword [ebp - 5], 0x8a81a9
mov byte [ebp - 1], 1
nop dword [eax]
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 9], al
inc ecx
cmp ecx, 7
jb 0x415910
lea eax, [ebp - 9]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004dee20
add esp, 8
test eax, eax
jne 0x415976
mov dword [ebp - 8], 0xd5a7aba1
xor ecx, ecx
mov dword [ebp - 4], 0x100a6b9
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 8], al
inc ecx
cmp ecx, 6
jb 0x415948
lea eax, [ebp - 8]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004dee20
add esp, 8
test eax, eax
jne 0x415976
xor al, al
mov esp, ebp
pop ebp
ret
push 0
call dword [0x50c1e4]
push eax
call dword [0x50c1d8]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4159d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, 1
lea edi, [ebp - 0x10]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x10], xmm0
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov ebx, dword [ebp - 8]
shr ebx, 0x1f
and bl, 1
mov dword [ebp - 0xe], 0x82998f82
mov dword [ebp - 0xa], 0xc2dc8288
xor eax, eax
mov dword [ebp - 6], 0x989f96df
mov word [ebp - 2], 0x100
lea ecx, [eax - 0x17]
xor byte [ebp + eax - 0xe], cl
inc eax
cmp eax, 0xc
jb 0x415a21
lea eax, [ebp - 0xe]
mov byte [ebp - 1], 0
push eax
call dword [0x50c064]
test eax, eax
movzx ecx, bl
mov eax, 1
pop edi
cmove ecx, eax
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
xor bl, bl
call dword [0x50c120]
test eax, eax
jne 0x415a81
push 0x15
call dword [0x50c0e4]
test eax, eax
je 0x415a83
mov bl, 1
movaps xmm0, xmmword [0x526290]
xor ecx, ecx
movups xmmword [ebp - 0x4d], xmm0
mov dword [ebp - 0x2d], 0x617d567a
movaps xmm0, xmmword [str.EXCEPT]
movups xmmword [ebp - 0x3d], xmm0
mov dword [ebp - 0x29], 0x63696965
mov word [ebp - 0x25], 0x100
nop
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 0x4d], al
inc ecx
cmp ecx, 0x28
jb 0x415ab0
mov esi, dword [0x50c004]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x4d]
mov byte [ebp - 0x24], 0
push eax
push 0x80000002
call esi
test eax, eax
je 0x415b3d
movaps xmm0, xmmword [0x526290]
xor ecx, ecx
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x30], 0x4e5d567a
movaps xmm0, xmmword [str.EXCEPT]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0x65487662
mov dword [ebp - 0x28], 0x676174
mov byte [ebp - 0x24], 1
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 0x50], al
inc ecx
cmp ecx, 0x2b
jb 0x415b12
lea eax, [ebp - 4]
mov byte [ebp - 0x24], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x50]
push eax
push 0x80000002
call esi
test eax, eax
jne 0x415b48
push dword [ebp - 4]
mov bl, 1
call dword [0x50c00c]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x10
push eax
lea eax, [ebp - 0x20]
push eax
call dword [0x50c128]
test eax, eax
je 0x415c72
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x3c], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415b80
sub ecx, edx
lea eax, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.00403410
mov dword [ebp - 0xe], 0xb4a4a8bf
xor ecx, ecx
mov word [ebp - 0xa], 0x100
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 0xe], al
inc ecx
cmp ecx, 4
jb 0x415ba5
lea edx, [ebp - 0xe]
mov byte [ebp - 9], 0
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x415bc0
mov edi, dword [ebp - 0x3c]
lea eax, [ebp - 0xe]
sub edx, ecx
cmp dword [ebp - 0x28], 0x10
push edx
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
push eax
cmovae ecx, edi
push 0
call fcn.0046bc50
add esp, 0xc
cmp eax, 0xffffffff
jne 0x415c41
mov dword [ebp - 0x10], 0xadbca7bf
xor ecx, ecx
mov dword [ebp - 0xc], 0x100abbf
nop dword [eax]
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 6
jb 0x415c00
lea esi, [ebp - 0x10]
mov byte [ebp - 9], 0
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x415c17
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
sub esi, ecx
cmp dword [ebp - 0x28], 0x10
push esi
push eax
lea ecx, [ebp - 0x3c]
cmovae ecx, edi
push 0
call fcn.0046bc50
add esp, 0xc
cmp eax, 0xffffffff
je 0x415c43
mov bl, 1
mov eax, dword [ebp - 0x28]
cmp eax, 0x10
jb 0x415c72
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x415c68
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415c7b
push ecx
push edi
call fcn.004dd7d1
add esp, 8
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004e2a70
int3
Function at 0x415c90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x29], 0
je 0x415cb2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x28
jb 0x415ca0
mov byte [esi + 0x29], 0
mov eax, esi
pop esi
ret

Function at 0x415cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
xor bl, bl
call dword [0x50c120]
test eax, eax
jne 0x415ce2
push 0x15
call dword [0x50c0e4]
test eax, eax
je 0x415ce4
mov bl, 1
mov dword [ebp - 5], 0xb7d0aa
xor ecx, ecx
mov byte [ebp - 1], 1
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 5], al
inc ecx
cmp ecx, 3
jb 0x415cf1
push 0x105
lea eax, [ebp - 0x120]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x105
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 5]
push eax
call dword [0x50c054]
test eax, eax
je 0x415e60
mov dword [ebp - 9], 0x9484a8bf
xor ecx, ecx
mov dword [ebp - 5], 0x999ca9
mov byte [ebp - 1], 1
nop dword [eax]
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 9], al
inc ecx
cmp ecx, 7
jb 0x415d50
mov byte [ebp - 1], 0
lea ecx, [ebp - 9]
lea eax, [ebp - 0x120]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x415d90
test dl, dl
je 0x415d8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x415d90
add eax, 2
add ecx, 2
test dl, dl
jne 0x415d70
xor eax, eax
jmp 0x415d95
sbb eax, eax
or eax, 1
test eax, eax
je 0x415e59
mov dword [ebp - 8], 0x9484a8bf
xor ecx, ecx
mov dword [ebp - 4], 0x100a8be
nop dword [eax]
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 8], al
inc ecx
cmp ecx, 6
jb 0x415db0
mov byte [ebp - 1], 0
lea ecx, [ebp - 8]
lea eax, [ebp - 0x120]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x415df0
test dl, dl
je 0x415dec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x415df0
add eax, 2
add ecx, 2
test dl, dl
jne 0x415dd0
xor eax, eax
jmp 0x415df5
sbb eax, eax
or eax, 1
test eax, eax
je 0x415e59
mov dword [ebp - 0xb], 0x9484a8bf
xor ecx, ecx
mov dword [ebp - 7], 0x838a9baa
mov word [ebp - 3], 0x85
mov byte [ebp - 1], 1
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x415e13
mov byte [ebp - 1], 0
lea ecx, [ebp - 0xb]
lea eax, [ebp - 0x120]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x415e50
test dl, dl
je 0x415e4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x415e50
add eax, 2
add ecx, 2
test dl, dl
jne 0x415e30
xor eax, eax
jmp 0x415e55
sbb eax, eax
or eax, 1
test eax, eax
jne 0x415e60
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416c70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x416c92
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x2a
jb 0x416c80
mov byte [esi + 0x2b], 0
mov eax, esi
pop esi
ret

Function at 0x416ca0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x416cc2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x19
jb 0x416cb0
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
ret
Function at 0x4170f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
push edi
push 0x200
lea eax, [ebp - 0x230]
push 0
push eax
call fcn.004df7b0
add esp, 0xc
lea eax, [ebp - 0x230]
push 0x200
push eax
push 0
call dword [0x50c24c]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417144
sub ecx, edx
lea eax, [ebp - 0x230]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00403410
mov dword [ebp - 0xd], 0x8d8c8fa5
xor ecx, ecx
mov dword [ebp - 9], 0x9c8aa681
mov dword [ebp - 5], 0x819781
mov byte [ebp - 1], 1
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 0xd], al
inc ecx
cmp ecx, 0xb
jb 0x417178
lea edx, [ebp - 0xd]
mov byte [ebp - 1], 0
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x417190
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0xd]
mov edi, dword [ebp - 0x28]
sub edx, ecx
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push edx
cmp ebx, 0x10
mov edx, esi
push eax
cmovae ecx, edi
push 0
call fcn.0046bc50
add esp, 0xc
cmp eax, 0xffffffff
jne 0x41728d
mov dword [ebp - 0xe], 0x9e8e9aa6
xor ecx, ecx
mov dword [ebp - 0xa], 0x9e80ad8c
mov dword [ebp - 6], 0x8090979f
mov word [ebp - 2], 0x100
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 0xe], al
inc ecx
cmp ecx, 0xc
jb 0x4171e2
lea edx, [ebp - 0xe]
mov byte [ebp - 1], 0
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x417200
sub edx, ecx
lea eax, [ebp - 0xe]
push edx
cmp ebx, 0x10
lea ecx, [ebp - 0x28]
push eax
cmovae ecx, edi
mov edx, esi
push 0
call fcn.0046bc50
add esp, 0xc
cmp eax, 0xffffffff
jne 0x41728d
mov dword [ebp - 0xb], 0x9cbeafa0
xor ecx, ecx
mov dword [ebp - 7], 0x959b8f89
mov word [ebp - 3], 0x83
mov byte [ebp - 1], 1
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x417242
lea esi, [ebp - 0xb]
mov byte [ebp - 1], 0
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x417260
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xb]
sub esi, ecx
cmp ebx, 0x10
push esi
push eax
lea ecx, [ebp - 0x28]
cmovae ecx, edi
push 0
call fcn.0046bc50
add esp, 0xc
cmp eax, 0xffffffff
jne 0x41728d
xor bl, bl
jmp 0x41728f
mov bl, 1
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x4172bc
inc ecx
mov eax, edi
cmp ecx, 0x1000
jb 0x4172b2
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4172c5
push ecx
push edi
call fcn.004dd7d1
add esp, 8
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004e2a70
int3
Function at 0x418de0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2e], 0
je 0x418e02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x2d
jb 0x418df0
mov byte [esi + 0x2e], 0
mov eax, esi
pop esi
ret
Function at 0x41e670
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x41e692
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0x41e680
mov byte [esi + 0x17], 0
mov eax, esi
pop esi
ret

Function at 0x41e6a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x23], 0
je 0x41e6c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x22
jb 0x41e6b0
mov byte [esi + 0x23], 0
mov eax, esi
pop esi
ret
Function at 0x41fce0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5044d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x24
push esi
push 0x536080
mov dword [ebp - 4], 0
call fcn.004dcad2
add esp, 4
test eax, eax
jne 0x41fe86
mov dword [ebp - 0x1c], 0x90bbaba4
xor ecx, ecx
mov word [ebp - 0x18], 0xb1
mov byte [ebp - 0x16], 1
nop
mov al, cl
sub al, 0x17
xor byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 5
jb 0x41fd40
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x16], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41fd58
sub ecx, edx
mov eax, 0x7fffffff
mov edx, dword [ebx + 0x18]
sub eax, edx
cmp eax, ecx
jb 0x41fe8c
cmp dword [ebx + 0x1c], 0x10
lea eax, [ebx + 8]
push edx
cmovae eax, dword [ebx + 8]
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
push ecx
push dword [ebp - 0x19]
lea ecx, [ebp - 0x34]
call fcn.0046e020
mov byte [ebp - 4], 1
mov eax, dword [0x536178]
cmp eax, dword [0x53617c]
je 0x41fdc5
movups xmm0, xmmword [ebp - 0x34]
mov ecx, 0xf
mov byte [ebp - 0x34], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x24]
movq qword [eax + 0x10], xmm0
add dword [0x536178], 0x18
jmp 0x41fdd7
lea ecx, [ebp - 0x34]
push ecx
push eax
mov ecx, 0x536174
call fcn.004731d0
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 4], 0
cmp ecx, 0x10
jb 0x41fe0c
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41fe02
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fe91
push ecx
push edx
call fcn.004dd7d1
add esp, 8
push 0x536080
call fcn.004dcae3
mov esi, dword [0x533aac]
lea eax, [ebx + 8]
sub esp, 0x14
mov ecx, esp
push eax
call fcn.00466660
mov edx, 0x2714
mov ecx, esi
call fcn.0041ec60
mov ecx, dword [ebx + 0x1c]
add esp, 0x18
test al, al
setne al
mov byte [ebp - 0x11], al
cmp ecx, 0x10
jb 0x41fe74
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41fe67
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fe91
push ecx
push edx
call fcn.004dd7d1
mov al, byte [ebp - 0x11]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push eax
call fcn.004dc77b
call fcn.00402c40
call fcn.004e2a70
int3