joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e4df0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x516406
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x544354]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5e16e8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5b8af4]
cmp eax, dword [ecx + 4]
jle 0x4e4e79
push 0x5b8af4
call fcn.004f8d29
add esp, 4
cmp dword [0x5b8af4], 0xffffffff
jne 0x4e4e79
mov dword [ebp - 4], 0
mov ecx, 0x5b89f2
call fcn.004919e0
mov byte [ebp - 4], 0
push 0x516d10
call fcn.004f8a9b
mov dword [ebp - 4], 0xffffffff
push 0x5b8af4
call fcn.004f8cea
add esp, 8
mov esi, dword [ebp + 8]
mov ecx, 0x5b49d0
push 1
push esi
call fcn.004e6570
mov bl, byte [ebp + 0xc]
push 0
push 0x5b49d0
test bl, bl
sete al
movzx eax, al
push eax
push 0
push 0
push esi
push 0
call fcn.004e75d0
test al, al
jne 0x4e4ef6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x5b49d8]
mov esi, eax
cmp edx, 0xffffffff
je 0x4e4ed0
push edx
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x5b49d8], 0xffffffff
mov ecx, 0x5b89f2
call fcn.00491b40
cmp esi, 0x4c7
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test bl, bl
je 0x4e4f13
push 0x5b49d0
push 0x10000
push 0x4e5430
call fcn.004ff56c
add esp, 0xc
jmp 0x4e4f38
mov eax, dword [0x5b49d8]
cmp eax, 0xffffffff
je 0x4e4f2e
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x5b49d8], 0xffffffff
mov ecx, 0x5b89f2
call fcn.00491b40
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4e5f30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5164ec
mov eax, dword fs:[0]
push eax
mov eax, 0x1004
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x4e5fa5
push 0x52b0e8
push esi
call fcn.0047bcd0
test al, al
jne 0x4e5f80
push esi
call fcn.004e62c0
test al, al
je 0x4e5fa5
push 0x30
push 0x65
call fcn.0048e4c0
push eax
push 0x596
call fcn.0048e4c0
push eax
push dword [0x54b9c8]
call fcn.004cd560
jmp 0x4e60fa
cmp byte [0x54ba54], 0
jne 0x4e5fe1
push 0
push 0
push 1
push 0
push 0
push esi
push 0
call fcn.004e75d0
test al, al
jne 0x4e60fa
push esi
push 0x201
call fcn.0048e4c0
push eax
call fcn.004d1700
add esp, 8
jmp 0x4e60fa
push 1
call fcn.004c73a0
push 1
push 0x800
push 0x5594de
push str.Rar_EX
call fcn.004cc310
test al, al
je 0x4e60fa
push 0x800
push 0x562a1a
mov ecx, 0x56e128
call fcn.00405080
mov eax, dword [0x56e12c]
mov ecx, 0x563a1c
push 0x517a54
mov dword [0x55f9c0], eax
call fcn.004948c0
push 0x800
lea eax, [ebp - 0x1010]
mov dword [0x55e9ac], 2
push eax
push esi
push 0x5594de
call fcn.0047d340
push 0
push 0
mov ecx, 0x56e128
call fcn.00404c20
cmp byte [0x54ba57], 0
jne 0x4e60fa
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5e16e8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5bcc1c]
cmp eax, dword [ecx + 4]
jle 0x4e60d0
push 0x5bcc1c
call fcn.004f8d29
add esp, 4
cmp dword [0x5bcc1c], 0xffffffff
jne 0x4e60d0
mov dword [ebp - 4], 0
mov ecx, 0x5b8af8
call fcn.004e4b80
push 0x516db0
call fcn.004f8a9b
mov dword [ebp - 4], 0xffffffff
push 0x5bcc1c
call fcn.004f8cea
add esp, 8
push 0
lea eax, [ebp - 0x1010]
mov ecx, 0x5b8af8
push eax
call fcn.004e6570
push 0x5b8af8
push 0x10000
push 0x4e5430
call fcn.004ff56c
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f833c
mov esp, ebp
pop ebp
ret 4
Function at 0x4e6360
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x6064]
mov eax, 0x6064
call fcn.004f8350
push 0xffffffffffffffff
push 0x516530
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x544354]
xor eax, ebp
mov dword [ebp + 0x6060], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x6074]
mov ebx, dword [ebp + 0x606c]
mov esi, dword [ebp + 0x6070]
push eax
call fcn.0047d830
mov edx, esi
mov edi, eax
lea eax, [edx + 2]
lea ebx, [ebx]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4e63c0
mov ecx, edi
sub edx, eax
sar edx, 1
lea eax, [ecx + 2]
mov dword [ebp - 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e63d7
sub ecx, dword [ebp - 0x10]
lea eax, [edx + 1]
sar ecx, 1
add eax, ecx
cmp eax, 0x1000
jb 0x4e63fa
xor al, al
jmp 0x4e6543
push 0x1000
lea eax, [ebp + 0x60]
push eax
push edi
push esi
call fcn.0047d340
lea ecx, [ebp]
call fcn.00494820
mov dword [ebp - 4], 0
lea eax, [ebp + 0x2060]
push 0x1000
push 0x51787c
push eax
push str.ViewerIgnoreModifications
push 0x518320
call fcn.004a5ee0
cmp word [ebp + 0x2060], 0
je 0x4e6457
push 0
push 0
lea eax, [ebp]
push eax
lea eax, [ebp + 0x2060]
push eax
call fcn.004ae220
push 0x800
lea eax, [ebp + 0x4060]
push eax
lea ecx, [ebp]
call fcn.004949c0
test al, al
je 0x4e6513
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea esp, [esp]
push 0x800
lea eax, [ebp + 0x5060]
push eax
lea eax, [ebp + 0x4060]
push eax
call edi
test eax, eax
je 0x4e64f7
cmp eax, 0x800
jae 0x4e64f7
lea eax, [ebp + 0x5062]
push 0x52af40
push eax
call fcn.004fae43
mov esi, eax
add esp, 8
test esi, esi
je 0x4e64e1
xor eax, eax
mov word [esi], ax
add esi, 4
cmp word [esi], ax
jne 0x4e64cc
mov esi, 0x517a54
push 5
push ebx
lea eax, [ebp + 0x5060]
push eax
call fcn.004711a0
test al, al
je 0x4e64f7
jmp 0x4e64e7
lea esi, [ebp + 0x5060]
push 5
lea eax, [ebp + 0x60]
push eax
push esi
call fcn.004711a0
test al, al
jne 0x4e6568
push 0x800
lea eax, [ebp + 0x4060]
push eax
lea ecx, [ebp]
call fcn.004949c0
test al, al
jne 0x4e6480
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp]
test ecx, ecx
je 0x4e6541
cmp byte [ebp + 0x10], 0
je 0x4e6538
mov eax, dword [ebp + 8]
add eax, eax
push eax
push ecx
call fcn.00491e00
mov ecx, dword [ebp]
push ecx
call fcn.004fe8b9
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x6060]
xor ecx, ebp
call fcn.004f833c
lea esp, [ebp + 0x6064]
pop ebp
ret 0xc
mov bl, 1
jmp 0x4e6515
Function at 0x4e75d0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x2044
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x2040], eax
mov eax, dword [esp + 0x2054]
push ebx
mov ebx, dword [esp + 0x2060]
push ebp
mov ebp, dword [esp + 0x2058]
push esi
mov esi, dword [esp + 0x2058]
push edi
mov edi, dword [esp + 0x2070]
push 0x3c
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push 0
push eax
call fcn.004fa860
add esp, 0xc
mov dword [esp + 0x14], 0x3c
cmp byte [esp + 0x2068], 0
mov dword [esp + 0x18], 0x500
jne 0x4e7646
mov dword [esp + 0x18], 0x540
push esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edi
call fcn.0047cbe0
test eax, eax
je 0x4e7665
cmp word [eax], 0x2e
jne 0x4e7672
cmp word [eax + 2], 0
jne 0x4e7672
or dword [esp + 0x18], 1
mov dword [esp + 0x3c], 0x517c80
mov eax, dword [esp + 0x10]
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], eax
call fcn.0047d830
cmp eax, esi
jne 0x4e76b7
push 0x517a74
push esi
call fcn.0047bcd0
test al, al
jne 0x4e76b7
push esi
push str.._s
lea eax, [esp + 0x58]
push 0x1000
push eax
call fcn.00402720
lea eax, [esp + 0x60]
add esp, 0x10
mov dword [esp + 0x24], eax
mov ebp, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x34], 1
mov byte [0x54ba55], 1
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x4e7711
call edi
cmp eax, 0x4c7
jne 0x4e76f9
test ebx, ebx
je 0x4e76f2
mov dword [ebx], 0
mov al, 1
jmp 0x4e77c1
cmp dword [esp + 0x20], 0
je 0x4e7711
lea eax, [esp + 0x14]
mov dword [esp + 0x20], 0
push eax
call ebp
mov esi, eax
mov byte [0x54ba55], 0
test esi, esi
je 0x4e77bf
call edi
cmp eax, 0x483
je 0x4e77bf
cmp byte [esp + 0x2068], 0
jne 0x4e77bb
mov edx, dword [esp + 0x4c]
test edx, edx
je 0x4e7771
mov ecx, dword [0x5b08a0]
mov eax, dword [esp + 0x34]
mov dword [ecx*4 + 0x5b0860], eax
lea eax, [ecx + 1]
mov dword [ecx*4 + 0x5b0820], edx
and eax, 0x8000000f
jns 0x4e776a
dec eax
or eax, 0xfffffff0
inc eax
mov dword [0x5b08a0], eax
jmp 0x4e77b5
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor esi, esi
lea esp, [esp]
mov eax, dword [esi + 0x5b0860]
cmp eax, dword [esp + 0x34]
jne 0x4e77ad
push 0
push dword [esi + 0x5b0820]
call edi
cmp eax, 0x102
jne 0x4e77a9
mov edx, dword [esi + 0x5b0820]
mov dword [esp + 0x4c], edx
jmp 0x4e77ad
mov edx, dword [esp + 0x4c]
add esi, 4
cmp esi, 0x40
jl 0x4e7780
test ebx, ebx
je 0x4e77bb
mov dword [ebx], edx
mov al, 1
jmp 0x4e77c1
xor al, al
mov ecx, dword [esp + 0x2050]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x2044
ret 0x1c
Function at 0x4ee7a0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push 0x5e0b70
mov esi, ecx
call fcn.00461e90
mov ebx, dword [esp + 0xc]
mov dword [esi + 0x1e8], 0x12345678
mov dword [esi + 0x1ec], 0x23456789
mov dword [esi + 0x1f0], 0x34567890
mov cl, byte [ebx]
test cl, cl
je 0x4ee836
mov eax, dword [esi + 0x1e8]
mov edx, 0x34567890
push edi
mov edi, dword [esi + 0x1ec]
movsx ecx, cl
lea ebx, [ebx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5e0b70]
movzx ecx, al
add ecx, edi
mov dword [esi + 0x1e8], eax
imul edi, ecx, 0x8088405
inc edi
mov ecx, edi
mov dword [esi + 0x1ec], edi
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x5e0b70]
mov dword [esi + 0x1f0], edx
mov cl, byte [ebx]
test cl, cl
jne 0x4ee7e8
pop edi
pop esi
pop ebx
ret 4

Function at 0x4ee840
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
cmp byte [0x55c5f0], 0
mov edx, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
mov ecx, dword [esp + 0x10]
je 0x4ee928
cmp byte [esi + 4], 0
je 0x4ee88c
lea eax, [esi + 8]
push eax
mov eax, ecx
imul eax, edi
push eax
push edx
call fcn.004bc2f0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
push edi
push ecx
push edx
mov ecx, esi
call fcn.004ed0c0
pop edi
pop esi
ret 0xc
push ebx
mov ebx, ecx
imul ebx, edi
push ebp
mov ebp, edx
test ebx, ebx
je 0x4ee926
lea ecx, [ecx]
movsx eax, byte [ebp]
lea ebp, [ebp + 1]
xor eax, dword [esi + 0x1e8]
mov ecx, dword [esi + 0x1e8]
mov edx, dword [esi + 0x1f0]
mov edi, edx
movzx eax, al
and edi, 0xfffd
shr ecx, 8
or edi, 2
mov eax, dword [eax*4 + 0x5e0b70]
xor eax, ecx
mov dword [esi + 0x1e8], eax
movzx eax, al
add eax, dword [esi + 0x1ec]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x1ec], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x5e0b70]
mov eax, edi
xor eax, 1
mov dword [esi + 0x1f0], edx
imul eax, edi
shr eax, 8
xor byte [ebp - 1], al
sub ebx, 1
jne 0x4ee8a0
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
pop ebp
pop ebx
push 0
push edi
push ecx
push edx
mov ecx, esi
call fcn.004ed0c0
pop edi
pop esi
ret 0xc
Function at 0x4f6f90
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4f6fbe
test al, 0x10
jne 0x4f6fb7
and eax, 0xffffffdf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4f6fbe
pop edi
mov al, 1
pop esi
ret 4
push esi
push dword [edi + 0x64b5dc]
push 0x11
call fcn.00403f00
pop edi
xor al, al
pop esi
ret 4

Function at 0x50822b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005080aa

Function at 0x509ebc
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00509b7c
Function at 0x402290
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4022ca
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0x4022d1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0x4022b0
jmp 0x4022d3
mov eax, 0x1505
jmp 0x4022d3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x402a10
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402bc6
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
movzx edi, si
shr esi, 0x10
test ebx, ebx
je 0x402bbf
mov ecx, 0x5e6ea9af
mov eax, ebx
mul ecx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ecx, ebx
sub ecx, eax
jmp 0x402aa6
mov ecx, dword [esp + 4]
mov eax, ecx
sub eax, dword [esp]
add ebp, eax
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, esi
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub esi, eax
mov ebx, dword [esp + 0xc]
sub ebx, ecx
mov ecx, 0x15b0
je 0x402bbf
xor edx, edx
cmp ecx, 8
mov dword [esp + 4], ecx
mov dword [esp + 0xc], ebx
jb 0x402b2b
and ecx, 0x1ff8
mov dword [esp], ecx
xor eax, eax
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add esi, eax
movzx ecx, byte [ebp + edx + 1]
add ecx, eax
add esi, ecx
movzx eax, byte [ebp + edx + 2]
add eax, ecx
add esi, eax
movzx ecx, byte [ebp + edx + 3]
add ecx, eax
mov eax, esi
and eax, ecx
xor esi, ecx
movzx edi, byte [ebp + edx + 4]
add edi, ecx
add esi, edi
lea eax, [esi + eax*2]
movzx ecx, byte [ebp + edx + 5]
add ecx, edi
mov esi, eax
and esi, ecx
xor eax, ecx
movzx ebx, byte [ebp + edx + 6]
add ebx, ecx
mov ecx, dword [esp + 4]
movzx edi, byte [ebp + edx + 7]
add edi, ebx
add ebx, edi
add ebx, eax
lea esi, [ebx + esi*2]
lea eax, [edx + 8]
add edx, 0xf
cmp edx, ecx
jb 0x402ac0
add ebp, eax
mov edx, dword [esp]
mov ebx, edx
sub ebx, ecx
jae 0x402a6b
mov eax, ecx
and eax, 3
mov dword [esp], edx
je 0x402b71
mov dword [esp + 8], ebx
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx]
inc edx
add edi, ecx
add esi, edi
dec ebx
cmp eax, ebx
jne 0x402b50
mov eax, dword [esp]
sub eax, ebx
mov ebx, dword [esp + 8]
cmp ebx, 0xfffffffc
ja 0x402a60
jmp 0x402b7e
mov eax, edx
mov edx, ebp
cmp ebx, 0xfffffffc
ja 0x402a60
mov ebx, dword [esp + 4]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + eax]
add ecx, edi
add esi, ecx
movzx edi, byte [edx + eax + 1]
add edi, ecx
add esi, edi
movzx ecx, byte [edx + eax + 2]
add ecx, edi
add esi, ecx
movzx edi, byte [edx + eax + 3]
add edi, ecx
add esi, edi
add eax, 4
cmp ebx, eax
jne 0x402b90
jmp 0x402a60
shl esi, 0x10
or esi, edi
jmp 0x402bcb
mov esi, 1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402be0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402c0e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x402cac
not eax
test bl, 1
jne 0x402c15
mov edx, ebx
cmp ebx, 1
jne 0x402c46
jmp 0x402caa
xor eax, eax
jmp 0x402cac
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x44080c]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x44080c]
cmp ebx, 1
je 0x402caa
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44080c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44080c]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44080c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44080c]
add esi, 2
cmp edx, esi
jne 0x402c50
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x407d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x407d5b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x407d63
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x407dfb
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x407da9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x407e0a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x407dbe
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x407dd0
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x407d90
jmp 0x407dd9
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x407d90
cmp edi, ebx
jge 0x407df0
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x407d94
jmp 0x407df4
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x407d9d
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x407e92
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x407e92
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x407e44
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x407e30
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x407e92
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x407e50
dec eax
mov ecx, 1
xor esi, esi
jmp 0x407eac
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x407d5b
test edx, edx
mov dword [esp], ecx
js 0x407ee0
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x407ef0
inc ebp
dec edx
cmp edi, ebp
jne 0x407ec0
mov edx, 0xffffffff
jmp 0x407ef2
xor edi, edi
jmp 0x407ef5
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x407ea0
and ebp, 3
je 0x407f28
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x407f10
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x407f2a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x407ea0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x407f40
jmp 0x407ea0
Function at 0x408800
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, dword [esp + 8]
mov dword [0x447ddc], edx
mov eax, 0xfffffd92
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x93f8769a
mov esi, ecx
and esi, 0x6c078965
or ecx, 0x6c078965
imul ecx, esi
xor esi, 0x6c078965
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x26f
mov dword [eax*4 + 0x448798], edx
test eax, eax
je 0x40888f
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x93f8769a
mov esi, ecx
and esi, 0x6c078965
or ecx, 0x6c078965
imul ecx, esi
xor esi, 0x6c078965
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x270
mov dword [eax*4 + 0x44879c], edx
add eax, 2
jmp 0x408810
mov dword [0x447dd8], 0x270
pop esi
ret
Function at 0x408b90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x408bf2
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
xor edx, dword [ecx + eax + 0xff8]
and edi, 0x9908b0df
xor edx, edi
mov dword [ecx + eax + 0x1384], edx
add eax, 4
jne 0x408bb0
mov eax, 0x270
jmp 0x408c04
cmp eax, 0x4e0
jb 0x408c04
mov esi, ecx
call fcn.00408c50
mov ecx, esi
mov eax, dword [esi]
mov edx, eax
and edx, 1
mov esi, eax
xor esi, 1
lea edx, [esi + edx*2]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
mov ecx, eax
not ecx
or ecx, 0x9d2c5680
add eax, ecx
inc eax
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
ret

Function at 0x408c50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
xor eax, eax
mov edx, SysReAllocString
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 0x70
mov edi, eax
xor edi, 0x270
lea esi, [edi + esi*2]
mov edi, dword [ecx + esi*4 + 4]
mov ebx, edi
not ebx
or ebx, 0x80000000
add ebx, edi
inc ebx
mov edi, dword [ecx + esi*4 + 8]
and edi, edx
or edi, ebx
mov ebx, edi
shr ebx, 1
and edi, 1
neg edi
and edi, 0x9908b0df
xor ebx, dword [ecx + esi*4 + 0x638]
xor ebx, edi
mov dword [ecx + eax*4 + 4], ebx
inc eax
cmp eax, 0xe3
jne 0x408c60
mov esi, dword [ecx + 0xd50]
mov eax, 0x355
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 - 0xd50]
xor edi, edx
mov dword [ecx + eax*4 - 0x9c4], edi
inc eax
cmp eax, 0x4e1
jne 0x408cc0
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov edx, dword [ecx + 4]
mov eax, edx
and eax, 0x7ffffffe
or eax, esi
shr eax, 1
and edx, 1
neg edx
xor eax, dword [ecx + 0x634]
and edx, 0x9908b0df
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
ret
Function at 0x408f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
movzx edi, word [esi]
test di, di
je 0x4090c4
mov edx, dword [esp + 0x18]
dec edx
je 0x4090c4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, di
lea edi, [esi + 2]
cmp cx, 0x7f
ja 0x408fc0
lea ebp, [eax + 1]
mov byte [eax], cl
jmp 0x409060
cmp ecx, 0x7ff
ja 0x408ff0
cmp edx, 2
jb 0x408ff0
mov ebx, ecx
shr ebx, 6
add bl, 0xc0
mov byte [eax], bl
mov ebx, ecx
not ebx
or ebx, 0x3f
add ebx, ecx
add bl, 0x81
lea ebp, [eax + 2]
mov byte [eax + 1], bl
jmp 0x409060
mov ebp, ecx
and ebp, 0xfc00
cmp ebp, 0xd800
jne 0x409086
cmp edx, 4
jb 0x409086
movzx edi, word [esi + 2]
shl ecx, 0xa
lea ebx, [ecx + edi]
add ebx, 0xfca02400
mov ecx, ebx
shr ecx, 0x12
add cl, 0xf0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 0xc
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
shr ebx, 6
add esi, 4
and bl, 0x3f
or bl, 0x80
mov byte [eax + 2], bl
mov ebx, 0x3f
sub ebx, edi
not ebx
or ebx, edi
and bl, 0x3f
or bl, 0x80
lea ebp, [eax + 4]
mov byte [eax + 3], bl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebp
xor ecx, eax
not eax
and eax, ebp
add ecx, edx
add eax, eax
sub ecx, eax
mov esi, edi
mov eax, ebp
mov edx, ecx
movzx edi, word [esi]
test di, di
je 0x4090c4
test edx, edx
jne 0x408fa0
jmp 0x4090c4
movzx esi, bp
cmp esi, 0xdc00
jne 0x409095
mov esi, edi
jmp 0x409074
cmp edx, 3
jb 0x4090c0
mov ebx, ecx
shr ebx, 0xc
or bl, 0xe0
mov byte [eax], bl
mov ebx, ecx
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [eax + 1], bl
and cl, 0x3f
or cl, 0x80
lea ebp, [eax + 3]
mov byte [eax + 2], cl
jmp 0x409060
mov ebp, eax
jmp 0x409060
mov byte [eax], 0
sub eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret