joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7fc45c
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10125210]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], esi
push edi
mov edi, dword [ebp + 0xc]
cmp ebx, 0x40
jle 0x7fc496
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
call fcn.007fc09c
add esp, 0xc
lea edi, [ebp - 0x24]
mov ebx, 0x20
push 0x40
lea eax, [esi + 0x68]
push 0x36
push eax
call fcn.0080929c
push 0x40
add esi, 0xa8
push 0x5c
push esi
call fcn.0080929c
add esp, 0x18
test ebx, ebx
jle 0x7fc4d4
nop
movzx eax, byte [edi]
lea edi, [edi + 1]
xor byte [esi - 0x40], al
lea esi, [esi + 1]
movzx eax, byte [edi - 1]
xor byte [esi - 1], al
sub ebx, 1
jne 0x7fc4bc
mov esi, dword [ebp - 0x28]
push 0
push esi
call fcn.007fc51c
push 0x40
lea eax, [esi + 0x68]
push eax
push esi
call fcn.007fc55c
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00805fd1
mov esp, ebp
pop ebp
ret

Function at 0x80529c
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov edx, dword [ecx]
mov ebx, 0x20
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 8], edx
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
mov edi, 0xc6ef3720
mov dword [ebp + 0xc], edx
mov dword [ebp - 0xc], ecx
mov edx, esi
dec ebx
shr edx, 5
add edx, ecx
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp + 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
sub eax, edx
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [ebp - 4]
shl ecx, 4
add ecx, dword [ebp - 8]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
lea edi, [edi + 0x61c88647]
mov ecx, dword [ebp - 0xc]
sub esi, edx
test ebx, ebx
jg 0x8052d1
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x80546c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov edx, dword [ecx]
mov ebx, 0x20
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 4]
mov dword [ebp + 0xc], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov edx, eax
lea edi, [edi - 0x61c88647]
shr edx, 5
mov ecx, eax
add edx, dword [ebp + 0xc]
dec ebx
shl ecx, 4
add ecx, dword [ebp - 4]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shr edx, 5
add edx, dword [ebp - 8]
shl ecx, 4
add ecx, dword [ebp - 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
add eax, edx
test ebx, ebx
jg 0x80549e
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x84de6c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0084da53
Function at 0x84de77
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0084dbe2

Function at 0x8659dc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x865a09
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x865a09
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4026c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push 0x4102c8
mov dword [ebp - 0xc], esi
call dword [0x4100e8]
cmp eax, esi
je 0x40276b
push ebx
push 0x4102e8
push eax
call dword [0x410130]
mov ebx, eax
cmp ebx, esi
je 0x40276a
push edi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push esi
jmp 0x40271c
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0040f7ed
pop ecx
pop ecx
cmp eax, esi
je 0x402729
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 4], eax
push eax
push esi
push esi
push 2
call ebx
mov edi, eax
cmp edi, 0x6f
je 0x402703
cmp edi, esi
jne 0x40275b
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x402769
mov edi, dword [eax + 0x34]
xor edx, edx
cmp edi, esi
jbe 0x402754
movzx ebx, byte [eax + edx + 0x2c]
mov ecx, edx
and ecx, 3
shl ecx, 3
shl ebx, cl
xor dword [ebp - 0xc], ebx
inc edx
cmp edx, edi
jb 0x40273d
mov eax, dword [eax + 8]
cmp eax, esi
jne 0x402734
cmp dword [ebp - 4], esi
je 0x402769
push dword [ebp - 4]
call fcn.0040f82e
pop ecx
pop edi
pop ebx
mov eax, dword [ebp - 0xc]
pop esi
leave
ret

Function at 0x4027df
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x18], bl
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor esi, esi
mov dword [ebp - 8], ebx
stosb byte es:[edi], al
mov dword [ebp - 4], 0xf
call fcn.004026c3
cmp eax, ebx
jne 0x40285a
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [0x41008c]
test eax, eax
je 0x402845
xor eax, eax
cmp dword [ebp - 4], ebx
jbe 0x402845
movsx edx, byte [ebp + eax - 0x18]
mov ecx, eax
and ecx, 3
shl ecx, 3
shl edx, cl
xor esi, edx
inc eax
cmp eax, dword [ebp - 4]
jb 0x402826
cmp esi, ebx
je 0x402845
mov eax, esi
jmp 0x40285a
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push 4
push ebx
push ebx
call dword [0x410088]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4030c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
xor ecx, ecx
not eax
cmp dword [ebp + 0xc], ecx
jne 0x4030d5
xor eax, eax
pop ebp
ret
jbe 0x403104
mov edx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
xor eax, edx
mov edx, eax
and edx, 0xf
shr eax, 4
xor eax, dword [edx*4 + 0x4103b0]
mov edx, eax
and edx, 0xf
shr eax, 4
xor eax, dword [edx*4 + 0x4103b0]
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x4030d7
not eax
pop ebp
ret

Function at 0x403108
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0x10]
inc ecx
test esi, esi
je 0x40313e
mov edx, dword [ebp + 0xc]
sub edx, eax
push edi
mov di, word [edx + eax]
xor di, word [ebp + 0x14]
mov word [eax], di
mov edi, dword [ebp + 0x18]
add edi, ecx
add dword [ebp + 0x14], edi
neg ecx
add eax, 2
dec esi
movzx ecx, cx
jne 0x40311f
pop edi
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x403144
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov cl, 1
test edi, edi
je 0x403171
push esi
mov esi, dword [ebp + 0xc]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [ebp + 0x14]
mov byte [eax], dl
mov dl, cl
add dl, byte [ebp + 0x18]
neg cl
add byte [ebp + 0x14], dl
inc eax
dec edi
jne 0x40315a
pop esi
mov eax, dword [ebp + 8]
pop edi
pop ebp
ret

Function at 0x406eb7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov edi, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [edi], ax
je 0x406ed2
xor eax, eax
jmp 0x406f75
mov ecx, dword [edi + 0x3c]
add ecx, edi
cmp dword [ecx], 0x4550
jne 0x406ecb
mov eax, dword [ebp + 0xc]
sub eax, dword [ecx + 0x34]
mov edx, dword [ecx + 0xa4]
and dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0xa0]
push ebx
add eax, edi
push esi
mov dword [ebp - 0x14], edx
test edx, edx
je 0x406f6a
mov edx, dword [eax + 4]
add dword [ebp - 8], edx
mov esi, dword [eax]
and dword [ebp - 4], 0
add edx, 0xfffffff8
shr edx, 1
add esi, edi
test edx, edx
jle 0x406f5f
mov edi, dword [ebp - 4]
movzx edi, word [eax + edi*2 + 8]
mov ebx, edi
shr ebx, 0xc
test ebx, ebx
je 0x406f54
cmp ebx, 3
je 0x406f35
cmp ebx, 0xa
jne 0x406f78
and edi, 0xfff
add edi, esi
mov dword [ebp - 0x10], edi
mov edi, dword [edi]
mov ebx, edi
sub ebx, dword [ecx + 0x34]
cmp ebx, dword [ecx + 0x50]
ja 0x406f78
add edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
mov dword [ebx], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x406f1a
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 8]
add eax, dword [eax + 4]
cmp edx, dword [ebp - 0x14]
jb 0x406f03
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x34], eax
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
leave
ret
xor eax, eax
jmp 0x406f73
Function at 0x407587
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 0x3c]
add eax, edi
movzx esi, word [eax + 6]
movzx ecx, word [eax + 0x14]
dec esi
imul esi, esi, 0x28
lea ecx, [ecx + eax + 0x18]
mov eax, dword [ebp + 0x14]
add esi, ecx
mov ebx, dword [esi + 0x14]
sub eax, ebx
mov dword [ebp - 4], eax
cmp ebx, dword [ebp + 0x10]
jae 0x4075e0
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4075e0
xor edx, edx
div ecx
mov dword [ebp - 8], ecx
mov dword [ebp + 0x14], eax
xor eax, eax
inc eax
cmp dword [ebp + 0x14], eax
jge 0x4075d5
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x14]
imul eax, ecx
mov dword [esi + 0x10], eax
jmp 0x4075e4
and dword [ebp + 0x14], 0
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push ebx
push edi
push dword [ebp + 8]
mov edi, dword [0x4100cc]
call edi
test eax, eax
je 0x40764d
cmp dword [ebp - 4], ebx
jne 0x40764d
cmp dword [ebp + 0x14], 0
je 0x40763c
mov eax, dword [ebp - 8]
mov dword [esi + 0x10], eax
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x14]
push dword [ebp - 8]
add eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call edi
test eax, eax
mov eax, dword [ebp - 4]
je 0x407640
cmp eax, dword [ebp - 8]
jne 0x407640
add ebx, eax
dec dword [ebp + 0x14]
jne 0x407610
mov eax, ebx
jmp 0x40765b
add ebx, eax
cmp ebx, dword [ebp + 0x10]
sbb eax, eax
not eax
and eax, ebx
jmp 0x40765b
cmp dword [ebp + 0x14], 0
je 0x407659
mov eax, dword [ebp - 8]
mov dword [esi + 0x10], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40786f
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
push 7
xor ecx, ecx
mov eax, edx
pop esi
mov edi, edx
and edi, 0xf
xor ecx, edi
shr edx, 4
dec esi
jne 0x40787c
and eax, 0xfffffff
shl ecx, 0x1c
pop edi
or eax, ecx
pop esi
ret

Function at 0x407896
Capabilities:
Encode data using xor

Disassembly:
push 8
xor eax, eax
pop ecx
mov edx, dword [esp + 4]
shr dword [esp + 4], 4
and edx, 0xf
xor eax, edx
dec ecx
jne 0x40789b
ret

Function at 0x409b53
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [esi + eax]
mov dl, 0xc6
cmp esi, edi
jae 0x409b84
push ebx
mov al, byte [esi]
movzx ecx, al
mov ebx, ecx
shr ebx, 3
shl cl, 5
or bl, cl
xor bl, dl
xor al, 0xc6
mov byte [esi], bl
inc esi
mov dl, al
cmp esi, edi
jb 0x409b67
pop ebx
pop edi
pop esi
ret
Function at 0x40b2ca
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push ebx
xor ebx, ebx
xor edx, edx
mov dword [ebp + 0x10], ecx
cmp dword [ebp + 0xc], ebx
jle 0x40b394
mov al, byte [ebp + 0xf]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
sub edi, 0
je 0x40b331
dec edi
je 0x40b318
dec edi
jne 0x40b33f
movzx edi, byte [esi]
movzx eax, al
shl eax, 2
shr edi, 6
or edi, eax
and edi, 0x3f
mov al, byte [edi + 0x410a50]
mov byte [ecx], al
movzx eax, byte [esi]
inc ecx
and eax, 0x3f
jmp 0x40b337
movzx edi, byte [esi]
movzx eax, al
shl eax, 4
shr edi, 4
or edi, eax
and edi, 0x3f
mov al, byte [edi + 0x410a50]
jmp 0x40b33d
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + 0x410a50]
mov byte [ecx], al
lea eax, [edx + 1]
cdq
push 3
pop edi
idiv edi
mov al, byte [esi]
inc ecx
inc esi
inc ebx
cmp ebx, dword [ebp + 0xc]
jl 0x40b2e9
pop edi
pop esi
test edx, edx
jle 0x40b394
movzx eax, al
cmp edx, 1
jne 0x40b36e
and eax, 3
shl eax, 4
mov al, byte [eax + 0x410a50]
jmp 0x40b378
and eax, 0xf
mov al, byte [eax*4 + 0x410a50]
mov byte [ecx], al
inc ecx
sub edx, 0
je 0x40b388
dec edx
je 0x40b38c
dec edx
je 0x40b390
jmp 0x40b394
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
lea eax, [ecx + 1]
sub eax, dword [ebp + 0x10]
mov word [ecx], 0xa0d
inc eax
pop ebx
pop ebp
ret
Function at 0x4017f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x4018e0
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x4018e0
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40183a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x401841
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x401820
jmp 0x401843
mov esi, 0x1505
jmp 0x401843
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x4018e0
mov eax, edi
not eax
and eax, 1
mov ebx, edi
and ebx, 0xfffffffe
sub ebx, eax
and ebx, esi
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x401884
inc ebx
dec edi
je 0x4018de
mov eax, ebx
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x4018de
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x401880
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.004087b0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x401880
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.004087e0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x401880
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x4018e0
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401d50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x401eb3
mov esi, dword [esp + 0x28]
test esi, esi
je 0x401eb3
cmp dword [esp + 0x2c], 0
je 0x401eb3
push esi
call fcn.004087b0
add esp, 4
test eax, eax
je 0x401dba
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x401dc1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x401da0
jmp 0x401dc3
mov ebx, 0x1505
jmp 0x401dc3
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x401e55
mov dword [esp], eax
mov eax, edi
not eax
and eax, 1
mov esi, edi
and esi, 0xfffffffe
sub esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x401e04
inc esi
dec edi
je 0x401e55
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x401e5a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x401e00
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.004087b0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x401e00
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.004087e0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401e00
mov eax, 0xffffffff
jmp 0x401eb3
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jae 0x401e9f
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
jmp 0x401eb3
call fcn.00401f70
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
je 0x401ebb
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push ecx
call fcn.004087b0
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x401f5e
mov eax, edi
not eax
and eax, 1
mov esi, edi
and esi, 0xfffffffe
sub esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x401f04
inc esi
dec edi
je 0x401f5e
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x401e62
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x401f00
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.004087b0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x401f00
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.004087e0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401f00
jmp 0x401e62
mov ebp, 0xffffffff
jmp 0x401e62
Function at 0x4026e0
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4028a6
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
movzx edi, si
shr esi, 0x10
test ebx, ebx
je 0x40289f
mov ecx, 0x5e6ea9af
mov eax, ebx
mul ecx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ecx, ebx
sub ecx, eax
jmp 0x402776
mov ecx, dword [esp + 4]
mov eax, ecx
sub eax, dword [esp]
add ebp, eax
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, esi
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub esi, eax
mov ebx, dword [esp + 0xc]
sub ebx, ecx
mov ecx, 0x15b0
je 0x40289f
xor edx, edx
cmp ecx, 8
mov dword [esp + 4], ecx
mov dword [esp + 0xc], ebx
jb 0x402812
and ecx, 0x1ff8
mov dword [esp], ecx
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add esi, eax
movzx ecx, byte [ebp + edx + 1]
add ecx, eax
mov eax, esi
and eax, ecx
xor esi, ecx
movzx edi, byte [ebp + edx + 2]
add edi, ecx
movzx ecx, byte [ebp + edx + 3]
add ecx, edi
add edi, esi
lea eax, [edi + eax*2]
add eax, ecx
movzx edi, byte [ebp + edx + 4]
add edi, ecx
mov esi, eax
and esi, edi
xor eax, edi
movzx ecx, byte [ebp + edx + 5]
mov ebx, edi
and ebx, ecx
xor edi, ecx
lea ecx, [edi + ebx*2]
movzx ebx, byte [ebp + edx + 6]
add ebx, ecx
add eax, ecx
mov ecx, dword [esp + 4]
lea esi, [eax + esi*2]
movzx edi, byte [ebp + edx + 7]
add edi, ebx
add esi, ebx
add esi, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, ecx
jb 0x4027a0
add ebp, eax
mov edx, dword [esp]
mov ebx, edx
sub ebx, ecx
jae 0x40273b
mov eax, ecx
and eax, 3
mov dword [esp], edx
je 0x402851
mov dword [esp + 8], ebx
neg eax
xor ebx, ebx
mov edx, ebp
movzx ecx, byte [edx]
inc edx
add edi, ecx
add esi, edi
dec ebx
cmp eax, ebx
jne 0x402830
mov eax, dword [esp]
sub eax, ebx
mov ebx, dword [esp + 8]
cmp ebx, 0xfffffffc
ja 0x402730
jmp 0x40285e
mov eax, edx
mov edx, ebp
cmp ebx, 0xfffffffc
ja 0x402730
mov ebx, dword [esp + 4]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + eax]
add ecx, edi
add esi, ecx
movzx edi, byte [edx + eax + 1]
add edi, ecx
add esi, edi
movzx ecx, byte [edx + eax + 2]
add ecx, edi
add esi, ecx
movzx edi, byte [edx + eax + 3]
add edi, ecx
add esi, edi
add eax, 4
cmp ebx, eax
jne 0x402870
jmp 0x402730
shl esi, 0x10
or esi, edi
jmp 0x4028ab
mov esi, 1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4028c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x402921
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x402923
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
mov ebp, eax
and ebp, edi
or eax, edi
and eax, 0xf
and ebp, 0xf
sub eax, ebp
xor ebx, dword [eax*4 + 0x44280c]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
or ebp, edi
and edi, ebx
sub ebp, edi
xor eax, dword [ebp*4 + 0x44280c]
inc esi
cmp edx, esi
jne 0x4028e0
not eax
jmp 0x402923
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408340
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x4083ac
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x40838e
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x408390
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 2
mov ebp, ebx
or ebx, 2
imul ebx, edx
xor edx, 2
and ebp, 0xfffffffd
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x408370
jmp 0x408390
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x4083aa
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x4083ac
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x408610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, esi
jbe 0x40866c
lea ecx, [esi + ebx]
cmp ecx, eax
jbe 0x40866c
test ebx, ebx
je 0x40870d
lea ecx, [esi + ebx]
dec ecx
lea edx, [eax + ebx]
dec edx
mov edi, ebx
and edi, 7
je 0x4086b1
neg edi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ecx + esi]
mov byte [edx + esi], al
dec esi
cmp edi, esi
jne 0x408650
add ecx, esi
add edx, esi
add esi, ebx
cmp ebx, 8
jae 0x4086b8
jmp 0x40870d
mov ecx, ebx
shr ecx, 2
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ebp, ebx
and ebp, 0xfffffffc
add eax, ebp
add ebp, esi
mov ecx, ebx
xor ecx, 0xfffffffc
mov esi, ebx
or esi, 3
and esi, ecx
mov ecx, esi
shr ecx, 1
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
test bl, 1
je 0x40870d
and esi, 0xfffffffe
movzx ecx, byte [ebp + esi]
mov byte [eax + esi], cl
jmp 0x40870d
mov esi, ebx
cmp ebx, 8
jb 0x40870d
neg esi
xor edi, edi
nop
nop
nop
nop
movzx eax, byte [ecx + edi]
mov byte [edx + edi], al
movzx eax, byte [ecx + edi - 1]
mov byte [edx + edi - 1], al
movzx eax, byte [ecx + edi - 2]
mov byte [edx + edi - 2], al
movzx eax, byte [ecx + edi - 3]
mov byte [edx + edi - 3], al
movzx eax, byte [ecx + edi - 4]
mov byte [edx + edi - 4], al
movzx eax, byte [ecx + edi - 5]
mov byte [edx + edi - 5], al
movzx eax, byte [ecx + edi - 6]
mov byte [edx + edi - 6], al
movzx eax, byte [ecx + edi - 7]
mov byte [edx + edi - 7], al
add edi, 0xfffffff8
cmp esi, edi
jne 0x4086c0
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x408d30
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + 4]
mov dword [0x44a838], ecx
mov eax, 0xfffffd92
nop
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x26f
mov dword [eax*4 + 0x44b1f4], ecx
test eax, eax
je 0x408d81
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x270
mov dword [eax*4 + 0x44b1f8], ecx
add eax, 2
jmp 0x408d40
mov dword [0x44a834], 0x270
ret