joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4053b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov esi, edx
mov edi, dword [ebp + 0xc]
xor edx, edx
mov dword [edi], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x10]
cmp dword [ecx], ecx
call fcn.0045c0a0
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax + 4]
push 0
call sub.KERNEL32.dll_SetLastError
push dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push esi
push ebx
lea ecx, [ebp - 0x2c]
mov edx, 0x14
call fcn.004f4f20
call sub.KERNEL32.dll_WriteFile
mov esi, eax
lea ecx, [ebp - 0x2c]
call fcn.004f4f51
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor ecx, ecx
mov dword [ebp - 0x18], ecx
cmp byte [ebp - 0x10], 0
je 0x405430
mov ecx, dword [ebp - 0x14]
cmp byte [ecx], cl
xor edx, edx
call fcn.0045c0e0
call fcn.004f2f69
mov dword [eax + 4], edi
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x405460
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
xor eax, eax
mov dword [ebp - 0x14], eax
mov esi, edx
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x10]
cmp dword [ecx], ecx
call fcn.0045c0a0
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + 4]
push 0
call sub.KERNEL32.dll_SetLastError
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push esi
push edi
lea ecx, [ebp - 0x28]
mov edx, 0x14
call fcn.004f4f20
call sub.KERNEL32.dll_WriteFile
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.004f4f51
call sub.KERNEL32.dll_GetLastError
mov edi, eax
cmp byte [ebp - 0x10], 0
je 0x4054d2
mov ecx, dword [ebp - 0x14]
cmp byte [ecx], cl
xor edx, edx
call fcn.0045c0e0
call fcn.004f2f69
mov dword [eax + 4], edi
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x4055a0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov esi, ecx
mov edi, edx
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 0x30], 0
mov ecx, 0x628324
call fcn.004ed6b0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x4055d9
xor esi, esi
jmp 0x4055dc
add esi, 8
mov dword [ebp - 0x18], esi
push 0
call sub.KERNEL32.dll_SetLastError
push ebx
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
push edi
push esi
lea ecx, [ebp - 0x2c]
mov edx, 0x20
call fcn.004f4f20
call sub.KERNEL32.dll_CreateNamedPipeW
mov esi, eax
lea ecx, [ebp - 0x2c]
call fcn.004f4f51
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov byte [ebp - 0x30], 1
mov eax, dword [ebp - 0x34]
mov dword [eax + 4], esi
mov esi, eax
call fcn.004f2f69
mov dword [eax + 4], edi
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x18

Function at 0x40ab40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, ecx
mov ebx, esi
cmp byte [ebx], bl
lea edi, [esi + 4]
mov ecx, edi
mov ebx, dword [ecx]
mov eax, dword [ecx + 4]
push 0
push 1
mov dword [ebp - 0x10], eax
push eax
push ebx
mov ecx, edi
call fcn.004f6410
xor eax, ebx
mov ecx, dword [ebp - 0x10]
xor edx, ecx
or eax, edx
jne 0x40ab52
mov dword [ebp - 0x10], ecx
mov eax, ebx
or eax, ecx
je 0x40ab97
mov ecx, esi
call fcn.0040aaa0
mov edi, dword [ebp - 0x10]
and edi, 0x7fffffff
push edi
mov ecx, esi
mov edx, ebx
mov eax, dword [esi]
call dword [eax + 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40bc50
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
push 2
push edx
push ecx
push 0
lea ecx, [ebp - 0x20]
mov edx, 0x10
call fcn.004f4f20
call sub.bcrypt.dll_BCryptGenRandom
mov esi, eax
lea ecx, [ebp - 0x20]
call fcn.004f4f51
test esi, esi
jne 0x40bc87
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp esi, 0xc0000017
je 0x40bcaa
mov ecx, 0x62d4e0
call fcn.004f3f00
mov esi, eax
mov ecx, esi
call fcn.00420bf0
mov ecx, esi
call fcn.004f44bb
int3
mov ecx, 0x62d91c
call fcn.004f3f00
mov esi, eax
mov ecx, esi
call fcn.00424460
mov ecx, esi
call fcn.004f44bb
int3
Function at 0x40eec0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x40
xorps xmm4, xmm4
movups xmmword [ebp - 0x28], xmm4
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov eax, dword [0x600600]
mov dword [ebp - 0x48], eax
mov esi, ecx
mov eax, 0xffffff00
add eax, esp
jb 0x40eef0
xor eax, eax
test dword [esp], esp
sub esp, 0x1000
cmp esp, eax
jae 0x40eef0
mov esp, eax
lea eax, [esp]
mov dword [ebp - 0x10], esp
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x80
mov dword [ebp - 0x1c], edx
jmp 0x40ef29
mov edx, esi
mov esi, dword [ebp - 0x44]
sub edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
call fcn.00450780
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x24], edi
test esi, esi
jne 0x40ef3d
xor eax, eax
mov dword [ebp - 0x44], esi
jmp 0x40ef43
mov dword [ebp - 0x44], esi
lea eax, [esi + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], eax
push 0
call sub.KERNEL32.dll_SetLastError
push ebx
push edi
push dword [ebp - 0x40]
lea ecx, [ebp - 0x3c]
mov edx, 0xc
call fcn.004f4f20
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov esi, eax
lea ecx, [ebp - 0x3c]
call fcn.004f4f51
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
call fcn.004f2f69
mov dword [eax + 4], edi
mov edx, dword [ebp - 0x14]
mov ecx, edx
sar ecx, 0x1f
cmp edx, esi
mov edx, ecx
sbb edx, 0
jge 0x40efa7
cmp esi, dword [ebp - 0x14]
ja 0x40ef19
mov esi, dword [ebp - 0x44]
jmp 0x40ef29
test esi, esi
je 0x40efd2
lea ecx, [esi - 1]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x20]
call fcn.00450580
mov ecx, 0x600600
mov ecx, dword [ecx]
cmp dword [ebp - 0x48], ecx
je 0x40efca
call fcn.004ff3a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, 0x60b030
call fcn.00456560
mov ecx, eax
call fcn.004f44bb
int3
Function at 0x40f200
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x40
xorps xmm4, xmm4
movups xmmword [ebp - 0x28], xmm4
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov eax, dword [0x600600]
mov dword [ebp - 0x48], eax
mov esi, ecx
mov eax, 0xffffff00
add eax, esp
jb 0x40f230
xor eax, eax
test dword [esp], esp
sub esp, 0x1000
cmp esp, eax
jae 0x40f230
mov esp, eax
lea eax, [esp]
mov dword [ebp - 0x10], esp
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x80
mov dword [ebp - 0x1c], edx
jmp 0x40f269
mov edx, esi
mov esi, dword [ebp - 0x44]
sub edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
call fcn.00450780
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x24], edi
test esi, esi
jne 0x40f27d
xor eax, eax
mov dword [ebp - 0x44], esi
jmp 0x40f283
mov dword [ebp - 0x44], esi
lea eax, [esi + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], eax
push 0
call sub.KERNEL32.dll_SetLastError
push ebx
push edi
push dword [ebp - 0x40]
lea ecx, [ebp - 0x3c]
mov edx, 0xc
call fcn.004f4f20
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov esi, eax
lea ecx, [ebp - 0x3c]
call fcn.004f4f51
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
call fcn.004f2f69
mov dword [eax + 4], edi
mov edx, dword [ebp - 0x14]
mov ecx, edx
sar ecx, 0x1f
cmp edx, esi
mov edx, ecx
sbb edx, 0
jge 0x40f2e7
cmp esi, dword [ebp - 0x14]
ja 0x40f259
mov esi, dword [ebp - 0x44]
jmp 0x40f269
test esi, esi
jne 0x40f2f9
call fcn.004f2f69
cmp dword [eax + 4], 0xcb
je 0x40f306
mov dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x20]
call fcn.00450580
jmp 0x40f335
mov esi, dword [ebp - 0x20]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
test esi, esi
je 0x40f333
mov ecx, 0x628f7c
cmp dword [ecx - 4], 0
jne 0x40f34e
mov ecx, dword [0x5ff9ac]
mov ecx, dword [ecx + 4]
push 0
mov edx, esi
cmp dword [ecx], ecx
call fcn.004b4bc0
xor eax, eax
mov ecx, 0x600600
mov ecx, dword [ecx]
cmp dword [ebp - 0x48], ecx
je 0x40f346
call fcn.004ff3a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004f2d8f
jmp 0x40f31f

Function at 0x411220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push eax
xor eax, eax
mov dword [ebp - 0xc], eax
cmp byte [ecx], cl
lea eax, [ecx + 8]
mov dword [ebp - 0xc], eax
mov eax, 0x15051505
mov edx, 0x15051505
mov esi, dword [ebp - 0xc]
mov ecx, dword [ecx + 4]
cmp ecx, 2
jle 0x41126e
nop
nop
nop
nop
nop
nop
nop
nop
add ecx, 0xfffffffc
mov edi, eax
rol edi, 5
add eax, edi
xor eax, dword [esi]
mov edi, edx
rol edi, 5
add edx, edi
xor edx, dword [esi + 4]
add esi, 8
cmp ecx, 2
jg 0x411250
test ecx, ecx
jle 0x41127d
mov ecx, edx
rol ecx, 5
add ecx, edx
mov edx, ecx
xor edx, dword [esi]
imul edx, edx, 0x5d588b65
add eax, edx
pop ecx
pop esi
pop edi
pop ebp
ret
Function at 0x4113a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov eax, dword [0x600600]
mov dword [ebp - 0x24], eax
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 0xc]
xor eax, eax
cmp ebx, 0x100
jb 0x411407
mov ecx, 0x628f7c
cmp dword [ecx - 4], 0
jne 0x4114f8
mov ecx, dword [0x5ff9ac]
mov ecx, dword [ecx + 4]
lea edx, [ebx + 1]
cmp dword [ecx], ecx
call fcn.004b4a00
test eax, eax
jne 0x4113f6
xor edx, edx
xor ecx, ecx
jmp 0x411402
lea edx, [eax + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x41142f
mov edx, 0xfffffe00
add edx, esp
jb 0x411412
xor edx, edx
test dword [esp], esp
sub esp, 0x1000
cmp esp, edx
jae 0x411412
mov esp, edx
lea edx, [esp]
mov dword [ebp - 0x10], esp
mov ecx, pe_nt_image_headers32
mov dword [ebp - 0x1c], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [ebp - 0x18], ecx
push ecx
mov dword [ebp - 0x20], edx
push edx
call fcn.00434ee0
mov ecx, dword [ebp - 0x18]
cmp ebx, ecx
jae 0x411509
mov edx, dword [ebp - 0x20]
mov word [edx + ebx*2], 0
xor eax, eax
test ecx, ecx
cmovne eax, edx
mov dword [ebp - 0x14], eax
mov ecx, eax
cmp ebx, 2
jle 0x411495
add ebx, 0xfffffffc
mov edx, edi
rol edx, 5
add edi, edx
mov edx, dword [ecx]
or edx, 0x200020
xor edi, edx
mov edx, esi
rol edx, 5
add esi, edx
mov edx, dword [ecx + 4]
or edx, 0x200020
xor esi, edx
add ecx, 8
cmp ebx, 2
jg 0x411467
test ebx, ebx
jle 0x4114aa
mov edx, esi
rol edx, 5
add edx, esi
mov esi, dword [ecx]
or esi, 0x200020
xor esi, edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4114d5
mov ecx, 0x628f7c
cmp dword [ecx - 4], 0
jne 0x411502
mov ecx, dword [0x5ff9ac]
mov ecx, dword [ecx + 4]
push 0
mov edx, ebx
cmp dword [ecx], ecx
call fcn.004b4bc0
imul eax, esi, 0x5d588b65
add eax, edi
mov ecx, 0x600600
mov ecx, dword [ecx]
cmp dword [ebp - 0x24], ecx
je 0x4114ee
call fcn.004ff3a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
call fcn.004f2d8f
jmp 0x4113d9
call fcn.004f2d8f
jmp 0x4114c1
call fcn.004763a0
int3
Function at 0x419920
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
xor eax, eax
mov dword [ebp - 0x1c], eax
mov esi, edx
mov edi, dword [ebp + 0xc]
mov edx, 0x55555556
mov eax, edx
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*2]
mov edx, edi
sub edx, eax
mov dword [ebp - 0x10], edx
sub edi, edx
add edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
xor eax, eax
xor edx, edx
mov ebx, 0x581be8
mov dword [ebp - 0x1c], ebx
mov ebx, 0x581be8
mov edi, dword [ebp + 0x10]
cmp edi, dword [ebp - 0x14]
jge 0x419a63
cmp byte [ebp + 8], 0
je 0x419a5b
cmp edx, 0x4c
jne 0x419999
lea edx, [eax + 1]
mov word [ecx + eax*2], 0xd
mov eax, edx
lea edx, [eax + 1]
mov word [ecx + eax*2], 0xa
xor eax, eax
xchg edx, eax
add edx, 4
mov dword [ebp - 0x18], edx
movzx edx, byte [esi + edi]
and edx, 0xfc
sar edx, 2
movzx edx, byte [edx + ebx]
mov word [ecx + eax*2], dx
movzx edx, byte [esi + edi]
and edx, 3
shl edx, 4
mov dword [ebp - 0x20], edx
movzx edx, byte [esi + edi + 1]
and edx, 0xf0
sar edx, 4
or edx, dword [ebp - 0x20]
movzx edx, byte [edx + ebx]
mov word [ecx + eax*2 + 2], dx
movzx edx, byte [esi + edi + 1]
and edx, 0xf
shl edx, 2
mov dword [ebp - 0x20], edx
movzx edx, byte [esi + edi + 2]
and edx, 0xc0
sar edx, 6
or edx, dword [ebp - 0x20]
movzx edx, byte [edx + ebx]
mov word [ecx + eax*2 + 4], dx
movzx edx, byte [esi + edi + 2]
and edx, 0x3f
movzx edx, byte [edx + ebx]
mov word [ecx + eax*2 + 6], dx
add eax, 4
add edi, 3
mov edx, dword [ebp - 0x14]
cmp edi, edx
jl 0x419a53
cmp byte [ebp + 8], 0
je 0x419a49
cmp dword [ebp - 0x10], 0
je 0x419a49
cmp dword [ebp - 0x18], 0x4c
jne 0x419a49
lea edi, [eax + 1]
mov word [ecx + eax*2], 0xd
mov eax, edi
lea edi, [eax + 1]
mov word [ecx + eax*2], 0xa
mov eax, edi
mov edi, dword [ebp - 0x10]
cmp edi, 1
je 0x419a6b
jmp 0x419a9f
mov edx, dword [ebp - 0x18]
jmp 0x419972
mov dword [ebp - 0x18], edx
jmp 0x41999f
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x14]
jmp 0x419a21
movzx edx, byte [esi + edx]
and edx, 0xfc
sar edx, 2
movzx edx, byte [edx + ebx]
mov word [ecx + eax*2], dx
mov edx, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
and edx, 3
shl edx, 4
movzx edx, byte [edx + ebx]
mov word [ecx + eax*2 + 2], dx
mov word [ecx + eax*2 + 4], 0x3d
jmp 0x419af7
cmp edi, 2
jne 0x419b01
movzx edx, byte [esi + edx]
and edx, 0xfc
sar edx, 2
movzx edx, byte [edx + ebx]
mov word [ecx + eax*2], dx
mov edx, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
and edx, 3
shl edx, 4
mov dword [ebp - 0x20], edx
mov edi, dword [ebp - 0x14]
movzx edx, byte [esi + edi + 1]
and edx, 0xf0
sar edx, 4
or edx, dword [ebp - 0x20]
movzx edx, byte [edx + ebx]
mov word [ecx + eax*2 + 2], dx
movzx edx, byte [esi + edi + 1]
and edx, 0xf
movzx edx, byte [ebx + edx*4]
mov word [ecx + eax*2 + 4], dx
mov word [ecx + eax*2 + 6], 0x3d
add eax, 4
xor edx, edx
mov dword [ebp - 0x1c], edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x420590
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov esi, ecx
mov edi, dword [esi + 0x1c]
mov ebx, edi
and ebx, 3
cmp edi, 4
jae 0x4205c1
mov edx, 0x628c94
mov dword [ebp - 0x10], edx
cmp dword [edx - 4], 0
jne 0x42064b
mov eax, dword [edx]
add eax, 0x165667b1
jmp 0x4205dd
mov eax, dword [esi]
rol eax, 1
mov edx, dword [esi + 4]
rol edx, 7
add eax, edx
mov edx, dword [esi + 8]
rol edx, 0xc
add eax, edx
mov edx, dword [esi + 0xc]
rol edx, 0x12
add eax, edx
lea eax, [eax + edi*4]
test ebx, ebx
je 0x420624
imul edx, dword [esi + 0x10], 0xc2b2ae3d
add eax, edx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp ebx, 1
jbe 0x420624
imul edx, dword [esi + 0x14], 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
cmp ebx, 2
jbe 0x420624
imul edx, dword [esi + 0x18], 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor edx, eax
imul eax, edx, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004f251f
mov edx, dword [ebp - 0x10]
jmp 0x4205b8

Function at 0x420d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp edx, 8
jb 0x420dbc
mov edi, edx
shr edi, 3
add eax, dword [ecx]
mov ebx, dword [ecx + 4]
xor esi, eax
rol eax, 0x14
add eax, esi
rol esi, 9
xor esi, eax
rol eax, 0x1b
add eax, esi
rol esi, 0x13
add ebx, eax
mov eax, esi
xor eax, ebx
rol ebx, 0x14
add ebx, eax
rol eax, 9
xor eax, ebx
rol ebx, 0x1b
add ebx, eax
rol eax, 0x13
mov esi, ebx
add ecx, 8
dec edi
mov ebx, eax
mov eax, esi
mov esi, ebx
jne 0x420d76
test dl, 4
je 0x420dd7
jmp 0x420dc1
cmp edx, 4
jb 0x420df4
add eax, dword [ecx]
xor esi, eax
rol eax, 0x14
add eax, esi
rol esi, 9
xor esi, eax
rol eax, 0x1b
add eax, esi
rol esi, 0x13
mov edi, edx
and edi, 7
mov edi, dword [ecx + edi - 4]
shr edi, 8
or edi, 0x80000000
mov ecx, edx
not ecx
shl ecx, 3
shr edi, cl
jmp 0x420e1c
mov edi, 0x80
test dl, 1
je 0x420e0f
mov edi, edx
and edi, 2
movzx ebx, byte [ecx + edi]
mov edi, ebx
or edi, 0x8000
test dl, 2
je 0x420e1c
shl edi, 0x10
movzx edx, word [ecx]
or edi, edx
add eax, edi
mov edx, esi
xor edx, eax
rol eax, 0x14
add eax, edx
rol edx, 9
xor edx, eax
rol eax, 0x1b
add eax, edx
rol edx, 0x13
xor edx, eax
rol eax, 0x14
add eax, edx
rol edx, 9
xor edx, eax
rol eax, 0x1b
add eax, edx
rol edx, 0x13
xor eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x42da00
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x42da23
mov ecx, 0x653000
mov edx, 0x55
call fcn.004f4060
lea edx, [esi + 8]
call fcn.004f4268
mov eax, esi
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [esi + 0xc], edx
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0x50
jbe 0x42da91
mov dword [eax + 0x148], 0x67452301
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0x51
jbe 0x42da91
mov dword [eax + 0x14c], 0xefcdab89
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0x52
jbe 0x42da91
mov dword [eax + 0x150], 0x98badcfe
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0x53
jbe 0x42da91
mov dword [eax + 0x154], 0x10325476
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0x54
jbe 0x42da91
mov dword [eax + 0x158], 0xc3d2e1f0
pop esi
pop ebp
ret
call fcn.004763a0
int3

Function at 0x42dfc0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, 0x1505
mov edx, dword [ecx + 4]
test edx, edx
jle 0x42dff2
add ecx, 8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
shl esi, 5
add eax, esi
movzx esi, word [ecx]
xor eax, esi
add ecx, 2
dec edx
jne 0x42dfe0
pop esi
pop ebp
ret

Function at 0x434e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, 2
jb 0x434e71
mov edi, dword [ecx + esi]
mov dword [ebp - 0x10], edx
mov ebx, dword [edx + esi]
mov edx, edi
or edx, ebx
test edx, 0xff80ff80
jne 0x434e76
xor ebx, edi
shl ebx, 2
add edi, 0x50005
or edi, 0xa000a0
add edi, 0x1a001a
or edi, 0xff7fff7f
test edi, ebx
jne 0x434ebc
add esi, 4
add eax, 0xfffffffe
cmp eax, 2
jae 0x434e6c
test eax, eax
je 0x434ea4
movzx edi, word [ecx + esi]
mov edx, dword [ebp - 0x10]
movzx ebx, word [edx + esi]
mov edx, edi
or edx, ebx
cmp edx, 0x7f
ja 0x434e76
jmp 0x434ea0
mov edx, dword [ebp - 0x10]
jmp 0x434e11
mov dword [ebp - 0x10], edx
jmp 0x434e52
test edi, 0xff80ff80
je 0x434ebc
test ebx, 0xff80ff80
je 0x434ebc
mov edx, esi
add edx, dword [ebp - 0x10]
push edx
push eax
add ecx, esi
mov edx, eax
call fcn.00434d40
test eax, eax
sete dl
movzx edx, dl
jmp 0x434ed3
cmp edi, ebx
jne 0x434eb1
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
ret 4
or edi, 0x20
lea eax, [edi - 0x61]
cmp eax, 0x19
jbe 0x434ec6
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov edx, ebx
or edx, 0x20
cmp edi, edx
sete dl
movzx edx, dl
movzx eax, dl
pop ecx
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x439dee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], edx
lea eax, [ecx + 0xc]
xor edx, edx
mov ebx, edx
xchg dword [eax], ebx
mov dword [ebp - 0x28], ebx
test ebx, ebx
je 0x439dd9
call fcn.00436990
mov dword [ebx + 0x20], eax
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
jmp 0x439dee
mov ecx, dword [ebp - 0x24]
add ecx, 0x10
mov eax, 2
xchg dword [ecx], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [ebp - 0x28]
lea ecx, [ebx + 0x24]
mov eax, 1
xchg byte [ecx], al
movzx eax, al
test eax, eax
je 0x439e07
call fcn.0047c880
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x439e42
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x439e1a
xor edx, edx
mov dword [ecx + 0x10], edx
lea edx, [ebx + 0x18]
call fcn.004f41af
lea ecx, [esi + 4]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
lea edx, [ebx + 0xc]
mov dword [edx], eax
mov dword [edx + 4], ecx
lea ecx, [esi + 4]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov byte [ebx + 0x24], 0
jmp 0x439e4b
mov ecx, esp
call fcn.00439f03
jmp 0x439eab
mov edi, dword [esi + 0x24]
test edi, edi
jne 0x439e5b
mov ecx, esi
call fcn.0047c8b0
jmp 0x439dee
mov ecx, dword [0x5ff7e4]
mov edx, dword [ecx + 0xc]
test edx, edx
jne 0x439e96
mov ecx, 0x62f070
call fcn.004f3f00
mov edx, eax
mov dword [ebp - 0x34], edx
mov ecx, edx
mov edx, 0x627fa4
call fcn.004f309e
mov edx, dword [0x5ff7e4]
lea edx, [edx + 0xc]
mov ecx, dword [ebp - 0x34]
call fcn.004f41af
mov edx, ecx
push esi
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x20]
call fcn.00436990
mov dword [ebx + 0x20], eax
jmp 0x439dee
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x10], 2
mov ebx, dword [ebp - 0x28]
add ebx, 0xc
mov ecx, ebx
mov esi, dword [ecx]
mov edi, dword [ecx + 4]
push 0
push 0
push edi
push esi
mov ecx, ebx
call fcn.004f6410
xor eax, esi
xor edx, edi
or eax, edx
jne 0x439ebb
cmp dword [ebp - 0x2c], 0
jne 0x439ee5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, 0x62c90c
call fcn.004f3f00
mov ebx, eax
mov ecx, ebx
mov edx, dword [ebp - 0x2c]
call fcn.00417eb0
mov ecx, ebx
call fcn.004f44bb
int3