joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2f8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x413d60
sar esi, 1
lea ecx, [esp + 0xc8]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44a3a0]
mov ebx, dword [esp + 0xc8]
mov edi, 0xffffffff
test ebx, ebx
jns 0x413d9a
mov eax, 0xffffffff
jmp 0x413d9d
lea eax, [ebx + ebx]
push eax
call fcn.00408420
add esp, 4
lea ecx, [esp + 0xc8]
push ecx
push ebx
mov dword [esp + 0x34], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44a3a0]
mov eax, dword [esp + 0xc8]
mov ecx, eax
and ecx, 0xd
xor eax, 0xd
lea eax, [eax + ecx*2]
test eax, eax
js 0x413ddd
add eax, eax
mov edi, eax
push edi
call fcn.00408420
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x138], 0x21722780
mov dword [esp + 0x13c], 0x3daf2383
mov dword [esp + 0x140], 0x395e3fb0
mov dword [esp + 0x144], 0x35853b96
mov dword [esp + 0x148], 0x31bb3786
mov dword [esp + 0x14c], 0xd83338b
mov dword [esp + 0x150], 0x90e0fba
mov dword [esp + 0x154], 0
mov eax, 0xb709d989
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x48f627af]
lea esi, [eax + 0x48f62700]
and esi, edx
mov edi, esi
and edi, 0xffffffbd
mov ecx, esi
or ecx, 0xfffffffd
inc ecx
imul ecx, edi
mov edi, esi
and edi, 2
or esi, 2
imul esi, edi
add ecx, edx
sub ecx, esi
add edx, eax
add ecx, eax
and edx, 1
or ecx, 1
add ecx, edx
add cl, 0x52
mov byte [esp + eax + 0x48f627af], cl
inc eax
cmp eax, 0xb709d9a9
jne 0x413e50
mov eax, dword [esp + 0x2c]
movzx ecx, word [eax]
mov esi, dword [esp + 0x10]
mov eax, esi
test cx, cx
je 0x413ed1
mov eax, dword [esp + 0x2c]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413ec0
mov word [eax], 0
movzx ecx, word [esp + 0x138]
test cx, cx
je 0x413f01
lea edx, [esp + 0x13a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413ef0
mov word [eax], 0
lea eax, [esp + 0x34]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043d140
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4439a4]
Function at 0x4183c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x198
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], 0x812c8775
mov dword [esp + 0x14], 0x8d33833d
mov dword [esp + 0x18], 0x898e8f3a
mov byte [esp + 0x1c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x10]
mov ecx, eax
xor ecx, 0xd785d4df
lea esi, [ecx + eax*2]
mov edi, 0x2b83bbfd
sub edi, esi
lea ecx, [ecx + eax*2]
add ecx, 0x47c4402
and edi, 0x50dc44bf
and ecx, 0xc020140
or ecx, edi
xor ecx, edx
mov edx, ecx
and edx, 0xd4019a
xor edx, 0xa0d4009a
mov esi, ecx
and esi, 2
mov edi, edx
and edi, 0xa0d40198
imul edi, esi
mov esi, edx
and esi, 2
or edx, 2
imul edx, esi
add edx, edi
xor ecx, 0x5329df25
mov esi, edx
and esi, ecx
xor ecx, edx
lea ecx, [ecx + esi*2]
inc cl
mov byte [esp + eax + 0x10], cl
lea ecx, [eax + eax]
and ecx, 2
xor eax, 1
add eax, ecx
cmp eax, 0xd
jb 0x418400
mov dword [esp + 0x2c], 0x19a61bb4
mov dword [esp + 0x30], 0x65d667a4
mov dword [esp + 0x34], 0x61136322
mov dword [esp + 0x38], 0x6dda6f11
mov dword [esp + 0x3c], 0x69c76bdd
mov dword [esp + 0x40], 0x75c277c7
mov dword [esp + 0x44], 0x71c373dc
mov dword [esp + 0x48], 0x7dc27fcd
mov dword [esp + 0x4c], 0x797a7b3a
mov byte [esp + 0x50], 0
xor eax, eax
nop
mov ecx, eax
add cl, 0xbb
xor cl, byte [esp + eax + 0x2c]
add cl, 0x59
mov byte [esp + eax + 0x2c], cl
inc eax
cmp eax, 0x25
jne 0x4184d0
movzx ecx, word [esp + 0x2c]
lea eax, [esp + 0x154]
test cx, cx
je 0x418511
lea edx, [esp + 0x2e]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418500
mov word [eax], 0
movzx ecx, word [ebx]
test cx, cx
je 0x418541
lea edx, [ebx + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418530
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x418571
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418560
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
mov dword [esp + 0x2c], 0xdd2020ba
mov byte [esp + 0x30], 0xb8
mov dword [esp + 0x31], 0
mov word [esp + 0x35], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 1
xor edx, 0x61
mov ecx, eax
and ecx, 0xe
sub ecx, edx
xor cl, byte [esp + eax + 0x2c]
add cl, 0xe5
mov byte [esp + eax + 0x2c], cl
inc eax
cmp eax, 0xb
jne 0x4185a0
movzx eax, byte [esp + 0x2c]
test al, al
je 0x4185db
lea ecx, [esp + 0x2d]
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x4185d0
mov byte [esi], 0
lea eax, [esp + 0x130]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x154]
push eax
push ecx
push edx
call fcn.0040b330
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x443ca4]
mov ecx, 0xf36edaba
xor ecx, dword [0x443cac]
add eax, ecx
inc eax
jmp eax
Function at 0x41c1b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x41c1c0
sar ebp, 1
mov eax, esp
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x44a3a0]
mov edi, dword [esp]
test edi, edi
jns 0x41c1ec
mov eax, 0xffffffff
jmp 0x41c1ef
lea eax, [edi + edi]
push eax
call fcn.00408420
add esp, 4
mov esi, eax
mov eax, esp
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x44a3a0]
lea ebx, [esp + 0xc]
push ebx
push esi
call fcn.0043d300
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x444030]

Function at 0x41e2d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41e2e0
cmp eax, 0xffffffed
jge 0x41e2f7
mov eax, 0xffffffff
jmp 0x41e2fa
add eax, 0x12
push eax
call fcn.00408420
add esp, 4
mov esi, eax
mov dword [esp], 0xe319e10c
mov dword [esp + 4], 0xe76fe501
mov dword [esp + 8], 0xfbc4f9cc
mov dword [esp + 0xc], 0xff1cfd18
mov dword [esp + 0x10], 0xf1f0
mov byte [esp + 0x14], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x28
xor cl, byte [esp + eax]
add cl, 0x38
mov byte [esp + eax], cl
inc eax
cmp eax, 0x15
jne 0x41e340
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41e381
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41e370
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41e3b1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e3a0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043d300
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x444138]
Function at 0x420e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x84
push eax
sub esp, 0x18
mov ebx, esp
mov dword [ebp - 0x50], 0xb1cd8fab
mov dword [ebp - 0x4c], 0xb522b320
mov dword [ebp - 0x48], 0xb9d5b7f0
mov dword [ebp - 0x44], 0xbdd9bb2c
mov dword [ebp - 0x40], 0xa1c2bf9b
mov dword [ebp - 0x3c], 0xa5caa3d4
mov dword [ebp - 0x38], 0xa9c8a733
mov dword [ebp - 0x34], 0xadcdabcc
mov dword [ebp - 0x30], 0xd1ccaf3e
mov dword [ebp - 0x2c], 0xd540d3bb
mov dword [ebp - 0x28], 0xd9aad7b0
mov dword [ebp - 0x24], 0xdd48dba8
mov dword [ebp - 0x20], 0xc1b8df4d
mov dword [ebp - 0x1c], 0xc5aec3ab
mov dword [ebp - 0x18], 0xc953c7a3
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0xcbc8
mov byte [ebp - 0x10], 0
xor ecx, ecx
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x9d
xor dl, byte [ebp + ecx - 0x50]
add dl, 0xef
mov byte [ebp + ecx - 0x50], dl
inc ecx
cmp ecx, 0x41
jne 0x420e90
lea edi, [ebp - 0x8e]
lea esi, [ebp - 0x50]
mov edx, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [ebp - 0x52]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
push esi
push 0
push 0
push 0x1e
lea eax, [ebp - 0x8e]
push eax
push 0
call dword [0x44a3a0]
mov edi, dword [ebp - 0x50]
test edi, edi
jns 0x420eed
mov eax, 0xffffffff
jmp 0x420ef0
lea eax, [edi + edi]
push eax
call fcn.00408420
add esp, 4
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push edi
push esi
push 0x1e
lea eax, [ebp - 0x8e]
push eax
push 0
call dword [0x44a3a0]
mov dword [ebx], 0x178e19f4
mov dword [ebx + 4], 0x13801599
mov dword [ebx + 8], 0xf93118c
mov dword [ebx + 0xc], 0xb940d82
mov dword [ebx + 0x10], 0x7880991
mov dword [ebx + 0x14], 0x3020598
mov word [ebx + 0x18], 0
mov byte [ebx + 0x1a], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
neg ecx
lea edx, [ecx + ecx]
and edx, 0x74
xor ecx, 0xc5
sub ecx, edx
inc cl
xor cl, byte [ebx + eax]
add cl, 0x22
mov byte [ebx + eax], cl
mov ecx, eax
and ecx, 1
or eax, 1
add eax, ecx
add eax, 0xa6586b5a
mov ecx, eax
and ecx, 0xa6
xor eax, 0x59a794a6
lea eax, [eax + ecx*2]
cmp eax, 0x1b
jb 0x420f50
push 0
push 0
push ebx
push esi
push dword [ebp + 8]
call fcn.0041c1b0
add esp, 0x14
jmp dword [0x444748]
Function at 0x42420b
Capabilities:
Encode data using xor

Disassembly:
mov eax, edi
nop
nop
nop
mov ecx, eax
add eax, 2
cmp word [ecx], 0
jne 0x424210
sub ecx, edi
mov eax, ecx
sar eax, 1
and ecx, 0x26
xor eax, 0x13
add eax, ecx
jns 0x42424d
mov eax, 0xffffffff
jmp 0x42424f
add eax, eax
push eax
call fcn.00408420
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0x69cf6bd8
mov dword [esp + 0x20], 0x6dfc6ff9
mov dword [esp + 0x24], 0x51fd53c6
mov dword [esp + 0x28], 0x55ea57f9
mov dword [esp + 0x2c], 0x59cb5bf1
mov dword [esp + 0x30], 0x5df45fca
mov dword [esp + 0x34], 0x41eb43f3
mov dword [esp + 0x38], 0x45dc4792
mov dword [esp + 0x3c], 0x49e04be0
mov dword [esp + 0x40], 0x4f48
mov byte [esp + 0x44], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, ecx
xor ebx, 0x69
mov edx, eax
and edx, 0x2c
sub edx, ebx
xor dl, byte [esp + ecx + 0x1c]
add dl, 0xd
mov byte [esp + ecx + 0x1c], dl
inc ecx
add eax, 2
cmp ecx, 0x29
jne 0x4242c0
movzx ecx, word [edi]
mov ebx, dword [esp + 0x10]
mov eax, ebx
test cx, cx
je 0x424311
mov edx, edi
add edx, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424300
mov word [eax], 0
movzx ecx, word [esp + 0x1c]
test cx, cx
je 0x424341
lea edx, [esp + 0x1e]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424330
mov word [eax], 0
jmp dword [0x444fc8]

Function at 0x424386
Capabilities:
Copy file
Encode data using xor

Disassembly:
mov dword [esp + 0x1c], 0x8fc089cf
mov dword [esp + 0x20], 0x83258d20
mov dword [esp + 0x24], 0x87348133
mov dword [esp + 0x28], 0x9b23853e
mov dword [esp + 0x2c], 0x9f329923
mov dword [esp + 0x30], 0x93219d3b
mov dword [esp + 0x34], 0x972c9122
mov dword [esp + 0x38], 0xeb51952d
mov dword [esp + 0x3c], 0xef64e99a
mov dword [esp + 0x40], 0xe358ed48
mov dword [esp + 0x44], 0xe1e0
mov byte [esp + 0x48], 0
xor ecx, ecx
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop

Function at 0x424b27
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp esi, ebx
sete al
jmp dword [eax*4 + 0x445060]

Function at 0x424d8e
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x1c], 0xada0aa91
mov dword [esp + 0x20], 0xa6a8b8d1
mov dword [esp + 0x24], 0xadb5b96d
mov dword [esp + 0x28], 0x8067acda
mov dword [esp + 0x2c], 0x9a8d90a0
mov dword [esp + 0x30], 0x888ba859
mov dword [esp + 0x34], 0x9590e89d
mov word [esp + 0x38], 0x6795
mov dword [esp + 0x3a], 0
mov word [esp + 0x3e], 0
mov eax, 0xf
mov ecx, 0x30
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, ecx
and edi, 0x23
mov edx, eax
and edx, 0x5c
or edx, edi
xor dl, byte [esp + eax + 0xd]
xor dl, 0xa3
add dl, 0x35
mov byte [esp + eax + 0xd], dl
inc eax
dec ecx
cmp eax, 0x33
jne case.default.0x424e24
mov ecx, dword [esp + 0x74]
push esi
call fcn.00426ec0
xor ecx, ecx
test eax, eax
setne cl
xor edx, edx
jmp dword [ecx*4 + 0x445028]
push ecx
inc edx
add byte [ebx], ch
Function at 0x424e78
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
mov dword [edx + eax + 4], ecx
add ebx, 8
mov ecx, dword [esp + 0x70]
add ecx, 4
mov ecx, dword [ecx]
xor eax, eax
test ecx, ecx
setne al
mov edi, edx
jmp dword [eax*4 + 0x445030]
mov eax, dword [ecx]
mov dword [esp], eax
mov eax, ebx
sub eax, edi
mov edx, dword [esp + 0x18]
cmp ebx, edx
mov dword [esp + 4], eax
mov dword [esp + 0x70], ecx
je 0x424e95
mov esi, edi
jmp 0x424f06
sar eax, 3
inc eax
mov ecx, edx
sub ecx, edi
sar ecx, 3
mov ebp, ecx
shr ebp, 1
add ebp, ecx
cmp ebp, eax
ja 0x424eac
mov ebp, eax
lea eax, [ebp*8]
push eax
call fcn.00408420
add esp, 4
mov esi, eax
test edi, edi
je 0x424efb
mov edx, dword [esp + 0x18]
cmp edi, edx
je 0x424ef2
xor eax, eax
nop
nop
nop
nop
mov ecx, dword [edi + eax]
mov dword [esi + eax], ecx
mov ecx, dword [edi + eax + 4]
mov dword [esi + eax + 4], ecx
mov dword [edi + eax], 0
lea ecx, [edi + eax]
add ecx, 8
add eax, 8
cmp ecx, edx
jne 0x424ed0
push edi
call fcn.00408430
add esp, 4
lea edx, [esi + ebp*8]
mov ebx, esi
mov eax, dword [esp + 4]
add ebx, eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], edx
mov dword [esi + eax], 0
mov dword [esi + eax + 4], 0
xor ebp, ebp
mov edi, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [edi + ebp], 0
lea ebp, [ebp + 1]
jne 0x424f30
push ebp
call fcn.00408420
add esp, 4
mov ebx, eax
mov dword [esp + 8], esi
mov eax, dword [esp + 4]
mov dword [esi + eax], ebx
mov ecx, ebp
shr ecx, 2
mov edx, edi
mov eax, edi
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebp
and edx, 0xfffffffc
add ebx, edx
add edx, eax
mov ecx, ebp
and ecx, 3
mov esi, ecx
not esi
or esi, 1
add esi, ecx
shr ecx, 1
mov eax, edx
mov dword [esp + 0x78], ebx
mov edi, ebx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
inc esi
je 0x424fa1
mov eax, ebp
and eax, 2
add edx, eax
mov ecx, dword [esp + 0x78]
add ecx, eax
push esi
push edx
push ecx
call fcn.00408450
add esp, 0xc
xor ecx, ecx
cmp ebp, 1
mov ebx, dword [esp + 0xc]
je 0x424e50
mov ecx, 0xffffffff
mov eax, 1
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
movzx edi, byte [edx + eax - 1]
xor edi, ecx
mov ecx, edi
shr ecx, 1
mov edx, edi
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov esi, edx
shr esi, 1
mov ecx, edi
shl ecx, 0x1e
sar ecx, 0x1f
and ecx, 0xedb88320
xor ecx, esi
mov ebx, edi
shl ebx, 0x1d
sar ebx, 0x1f
and ebx, 0x76dc419
mov esi, edi
shl esi, 0x1c
sar esi, 0x1f
and esi, 0xedb8832
xor esi, ebx
mov ebx, edi
shl ebx, 0x1b
sar ebx, 0x1f
and ebx, 0x1db71064
shl edi, 0x1a
sar edi, 0x1f
and edi, 0x3b6e20c8
xor edi, ebx
xor edi, esi
mov esi, ecx
shr esi, 6
xor edi, esi
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
xor edx, edi
shl ecx, 0x1a
sar ecx, 0x1f
and ecx, 0xedb88320
xor ecx, edx
inc eax
cmp ebp, eax
jne 0x424fc0
not ecx
mov ebx, dword [esp + 0xc]
jmp 0x424e50
Function at 0x4256ee
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [esp + ecx + 0x8c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4256d0
mov dword [esp + 0x80], ecx
mov dword [esp + 0x7c], eax
mov ebp, eax
sar ebp, 1
mov dword [esp + 0x60], ebp
mov eax, dword [esp + 0x6c]
inc eax
mov ecx, eax
and ecx, ebp
xor eax, ebp
lea edx, [eax + ecx*2]
lea ecx, [eax + ecx*2]
add ecx, 0xc
lea eax, [edx*2 + 0x18]
test ecx, ecx
jns 0x425712
mov eax, 0xffffffff
push eax
call fcn.00408420
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x40]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x425751
mov edx, dword [esp + 0x78]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425740
mov dword [esp + 0x64], esi
mov word [eax], 0x5c
mov dword [esp + 0xc], 0x430e41fc
mov dword [esp + 0x10], 0x47e545eb
mov dword [esp + 0x14], 0x4be649e9
mov dword [esp + 0x18], 0x4ffd4d2c
mov dword [esp + 0x1c], 0xb313b124
mov dword [esp + 0x20], 0xb713b520
mov word [esp + 0x24], 0xb9b8
lea ecx, [esp + 0xc]
mov word [ecx + 0x1e], 0
mov dword [ecx + 0x1a], 0
mov ecx, 0xf0
mov edx, 0xf
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0xe4]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0x50
mov byte [esp + ecx - 0xe4], bl
inc ecx
dec edx
cmp ecx, 0x110
jne 0x4257b0
add eax, 2
movzx ecx, word [edi]
test cx, cx
je 0x425801
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4257f0
mov word [eax], 0
movzx ecx, word [esp + 0xc]
test cx, cx
mov esi, dword [esp + 0x64]
je 0x425831
lea edx, [esp + 0xe]
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425820
mov word [eax], 0
lea eax, [esp + 0x44]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043d140
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4451b8]

Function at 0x425b07
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x445208]
Function at 0x42635e
Capabilities:
Encode data using xor

Disassembly:
movzx eax, bl
jmp dword [eax*4 + 0x445260]

Function at 0x426390
Capabilities:
Encode data using xor

Disassembly:
not eax
shr eax, 0x1f
xor ebp, ebp
xor ebx, ebx
mov dword [esp + 0x54], edi
jmp dword [eax*4 + 0x4451d0]

Function at 0x426a96
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 0x20], 0x20272625
mov byte [esp + 0x24], 0
xor eax, eax
xor edx, edx
nop
nop
movzx ebx, byte [esp + edx + 0x20]
mov ecx, eax
and ecx, 2
mov ebp, edx
xor ebp, 0xdc89
add ebp, ecx
mov ecx, ebx
xor ecx, 0xcc19
mov esi, ebp
xor esi, 0x79
xor ebp, 0x3f693186
and ebp, ecx
xor ebx, 0x3f693186
and ebx, esi
or ebx, ebp
mov ecx, ebx
and ecx, 1
or ebx, 1
add ebx, 0x52
xor ebx, ecx
lea ecx, [ebx + ecx*2]
mov byte [esp + edx + 0x20], cl
inc edx
add eax, 2
cmp edx, 5
jne 0x426ab0
mov ecx, dword [0x44a3a4]
test ecx, ecx
lea esi, [esp + 0x20]
je 0x426b39
mov edx, dword [esp + 0x20]
xor ebx, ebx
mov ebp, dword [0x44a3a8]
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xb62b8d10
je 0x426b31
inc ebx
cmp ecx, ebx
jne 0x426b20
jmp 0x426b39
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, edx
jne 0x426b54
mov ebp, edi
jmp dword [0x445370]
push dword [esp]
push 4
push ecx
push dword [0x44a3ac]
call fcn.00439600
add esp, 0x10
mov ebp, edi
jmp dword [0x445370]

Function at 0x426ba0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], 0x20272625
mov byte [esp + 0x24], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x20]
mov ebx, esi
and ebx, 2
mov edi, ecx
xor edi, 0xdc89
add edi, ebx
mov ebx, edx
xor ebx, 0xcc19
mov ebp, edi
xor ebp, 0x79
xor edi, 0x3f693186
and edi, ebx
xor edx, 0x3f693186
and edx, ebp
or edx, edi
mov edi, edx
and edi, 1
or edx, 1
add edx, 0x52
xor edx, edi
lea edx, [edx + edi*2]
mov byte [esp + ecx + 0x20], dl
inc ecx
add esi, 2
cmp ecx, 5
jne 0x426bc0
mov ecx, dword [0x44a3a4]
test ecx, ecx
mov ebp, dword [esp + 0x78]
mov ebx, dword [esp + 8]
je 0x426c48
mov edx, dword [esp + 0x20]
xor esi, esi
mov edi, dword [0x44a3a8]
nop
nop
cmp dword [edi + esi*8], 0xb62b8d10
je 0x426c40
inc esi
cmp ecx, esi
jne 0x426c30
jmp 0x426c48
mov ecx, dword [edi + esi*8 + 4]
cmp ecx, edx
jne 0x426c51
and bl, 1
jmp dword [0x445390]
push eax
push 4
push ecx
push dword [0x44a3ac]
call fcn.00439600
add esp, 0x10
and bl, 1
jmp dword [0x445390]
Function at 0x427be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x427c3a
cmp edi, 1
je 0x427c3a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x427c11
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x427c10
cmp ecx, 0x20
je 0x427c10
cmp ecx, 0x2b
mov edx, edi
je 0x427c30
cmp ecx, 0x2d
jne 0x427c4f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x427c54
xor edi, edi
test eax, eax
je 0x427e0d
mov dword [eax], 0x16
jmp 0x427e0d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x427c7d
cmp edx, 0x10
jne 0x427c95
cmp byte [ebx], 0x30
jne 0x427c76
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x427c97
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x427c97
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x427cf0
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x427da8
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x427d17
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x427dd8
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x427dd8
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x427cd0
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x427d60
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x427d69
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x427d8d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x427dbd
test bl, bl
jne 0x427dbd
mov ebx, dword [esp + 0x10]
jmp 0x427ce3
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x427cc5
mov esi, edi
test bl, bl
jne 0x427dcb
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x427cc5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x427de6
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x427df4
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x427e04
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x427e0d
cmp byte [esp + 3], 0
jne 0x427e0d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret