joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9df800
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0xa3d0a8]
mov edi, eax
add esp, 4
test edi, edi
jne 0x9df82d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x9df877
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 0x10], ebx
jmp 0x9df87d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x9df8db
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop dword [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x9df8a0
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x9df907
mov eax, dword [esi + 4]
push 1
push 0xa2a280
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0xa2a281
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x9df8e0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x9df960
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000040
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9df992
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x800c
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
pop esi
pop ebp
ret

Function at 0x9e0f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9e0fc0
push ebx
mov ebx, dword [ebp + 8]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
and dl, 2
movzx ecx, cl
cmp dl, 2
cmovb ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x9e0f82
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x9e1010
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9e104f
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
pop ebp
ret

Function at 0x9f9982
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009f95ff

Function at 0x9ffda5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009ffc1b
Function at 0x4017a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x40188c
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x40188c
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4017ea
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x4017f1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x4017d0
jmp 0x4017f3
mov esi, 0x1505
jmp 0x4017f3
mov esi, ecx
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 0x20]
lea edi, [ecx - 1]
mov dword [esp + 8], ecx
sub ecx, 1
mov dword [esp + 0xc], ecx
jb 0x40188c
and edi, esi
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
xor ebp, ebp
jmp 0x401827
inc ebp
cmp dword [esp + 8], ebp
je 0x40188a
mov eax, ebp
and eax, edi
mov ecx, ebp
xor ecx, edi
lea eax, [ecx + eax*2]
and eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov ebx, dword [ecx + eax*4]
cmp ebx, 0xffffffff
je 0x40188a
mov eax, dword [edx + 8]
cmp dword [eax + ebx*4], esi
jne 0x401820
mov eax, dword [edx + 0xc]
mov eax, dword [eax + ebx*4]
mov dword [esp], eax
push eax
call fcn.00408520
mov edx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x401820
push dword [esp + 0x2c]
push dword [esp + 4]
push dword [esp + 0x30]
call fcn.00408540
mov edx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401820
mov eax, dword [edx + 0x10]
mov eax, dword [eax + ebx*4]
jmp 0x40188c
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402650
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4027f6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4027ef
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x4026e5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ecx
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, edi
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub ecx, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x4027ef
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x40275e
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x402700
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x4026ad
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x4027a0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x402780
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4026a0
jmp 0x4027af
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4026a0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x4027c0
jmp 0x4026a0
shl ecx, 0x10
or ecx, edi
jmp 0x4027fb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402810
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x402871
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x402873
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44280c]
mov ebp, ebx
not ebp
mov eax, ebx
shr eax, 4
shr edi, 4
or ebp, edi
not edi
or edi, ebx
or ebp, 0x3ffffff0
and ebp, edi
not ebp
xor eax, dword [ebp*4 + 0x44280c]
inc esi
cmp edx, esi
jne 0x402830
not eax
jmp 0x402873
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, esi
jbe 0x4083dc
lea ecx, [esi + ebx]
cmp ecx, eax
jbe 0x4083dc
test ebx, ebx
je 0x40847d
lea ecx, [esi + ebx]
dec ecx
lea edx, [eax + ebx]
dec edx
mov edi, ebx
and edi, 7
je 0x408421
neg edi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ecx + esi]
mov byte [edx + esi], al
dec esi
cmp edi, esi
jne 0x4083c0
add ecx, esi
add edx, esi
add esi, ebx
cmp ebx, 8
jae 0x408428
jmp 0x40847d
mov ecx, ebx
shr ecx, 2
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ebp, ebx
and ebp, 0xfffffffc
add eax, ebp
add ebp, esi
mov ecx, ebx
xor ecx, 0xfffffffc
mov esi, ebx
or esi, 3
and esi, ecx
mov ecx, esi
shr ecx, 1
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
test bl, 1
je 0x40847d
and esi, 0xfffffffe
movzx ecx, byte [ebp + esi]
mov byte [eax + esi], cl
jmp 0x40847d
mov esi, ebx
cmp ebx, 8
jb 0x40847d
neg esi
xor edi, edi
nop
nop
nop
nop
movzx eax, byte [ecx + edi]
mov byte [edx + edi], al
movzx eax, byte [ecx + edi - 1]
mov byte [edx + edi - 1], al
movzx eax, byte [ecx + edi - 2]
mov byte [edx + edi - 2], al
movzx eax, byte [ecx + edi - 3]
mov byte [edx + edi - 3], al
movzx eax, byte [ecx + edi - 4]
mov byte [edx + edi - 4], al
movzx eax, byte [ecx + edi - 5]
mov byte [edx + edi - 5], al
movzx eax, byte [ecx + edi - 6]
mov byte [edx + edi - 6], al
movzx eax, byte [ecx + edi - 7]
mov byte [edx + edi - 7], al
add edi, 0xfffffff8
cmp esi, edi
jne 0x408430
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x408b00
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov edx, dword [esp + 0xc]
mov dword [0x44a61c], edx
mov eax, 1
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
shr esi, 0x1e
lea edi, [esi + edx]
and esi, edx
add esi, esi
sub edi, esi
imul edx, edi, 0x6c078965
lea esi, [ecx + edx]
inc esi
mov dword [ecx*4 + 0x44a620], esi
cmp ecx, 0x26e
je 0x408b75
mov edi, esi
shr edi, 0x1e
and edi, esi
add edi, edi
add edx, eax
mov esi, edx
shr esi, 0x1e
add esi, edx
sub esi, edi
imul edx, esi, 0x6c078965
add edx, ecx
add edx, 2
mov dword [ecx*4 + 0x44a624], edx
add eax, 2
add ecx, 2
jmp 0x408b20
mov dword [0x44a618], 0x270
pop esi
pop edi
ret
Function at 0x408b90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov eax, dword [0x44a618]
cmp eax, 0x270
jne 0x408bef
mov eax, 0xfffff640
mov edx, dword [0x44a61c]
nop
nop
nop
nop
nop
nop
nop
nop
and edx, 0x80000000
mov esi, dword [eax + 0x44afe0]
mov ecx, esi
and ecx, 0x7ffffffe
or ecx, edx
mov edx, esi
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, dword [eax + 0x44b610]
shr ecx, 1
xor esi, ecx
mov dword [eax + 0x44b99c], esi
add eax, 4
jne 0x408bb0
mov eax, 0x270
jmp 0x408c05
cmp eax, 0x4e0
jb 0x408c05
mov ecx, 0x44a618
call fcn.00408db0
mov eax, dword [0x44a618]
lea ecx, [eax + 1]
mov dword [0x44a618], ecx
mov eax, dword [eax*4 + 0x44a61c]
mov ecx, eax
shr ecx, 0xb
mov edx, ecx
not edx
or edx, dword [0x44b99c]
add ecx, edx
inc ecx
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc40000
xor ecx, eax
shr ecx, 0x12
and eax, 0x7fff
xor eax, ecx
pop esi
ret

Function at 0x408c50
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x210
call fcn.0043cce0
test al, al
je 0x408da2
lea eax, [esp + 8]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.004368e0
test al, al
je 0x408d9d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, 0xe897e22c
mov esi, 0x2d1987a1
mov ecx, ebx
shrd esi, edi, cl
mov dword [esp], eax
shr edi, cl
test bl, 0x20
je 0x408cb0
mov esi, edi
xor edi, edi
lea eax, [esi + esi]
lea ecx, [edi + edi]
and eax, 0x5a330f42
and ecx, 0xd12fc458
add esi, 0x2d1987a1
adc edi, 0xe897e22c
sub esi, eax
sbb edi, ecx
mov ebx, esi
and ebx, 0xcb2cbcc0
mov eax, ebx
xor eax, 0xcb2cbcc0
mov ebp, esi
and ebp, 0x34d3433f
mov ecx, edi
and ecx, 0x1683036
imul ecx, eax
mul ebp
mov dword [esp + 4], eax
add edx, ecx
mov ecx, edi
and ecx, 0xfe97cfc9
or esi, 0xcb2cbcc0
mov eax, esi
imul esi, ecx
xor ecx, 0xfe97cfc9
imul ebp, ecx
add ebp, edx
mul ebx
add esi, edx
or edi, 0xfe97cfc9
imul edi, ebx
add edi, esi
add eax, dword [esp + 4]
adc edi, ebp
mov ebx, edi
shr ebx, 0x15
xor ebx, edi
mov esi, edi
shld esi, eax, 0xb
xor esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x408d79
mov ecx, 0x43cedfde
mov eax, esi
mul ecx
imul ecx, esi, 0x19a92b3
imul edi, ebx, 0x43cedfde
add edi, edx
add edi, ecx
mov esi, eax
mov ecx, dword [esp]
shrd esi, edi, cl
mov ebx, edi
shr ebx, cl
test cl, 0x20
je 0x408d75
mov esi, ebx
xor ebx, ebx
xor ebx, edi
xor esi, eax
or ebx, 0x1010101
or esi, 0x1010101
push ebx
push esi
call fcn.00409ed0
add esp, 8
test al, al
je 0x408d9d
call fcn.0040cf60
call fcn.0040ba50
call fcn.0043dff0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408db0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov edx, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
nop
mov esi, edx
not esi
or esi, 0x80000000
add esi, edx
inc esi
mov edx, dword [ecx + eax*4 - 0x630]
mov edi, edx
not edi
or edi, 0x7fffffff
add edi, edx
inc edi
or edi, esi
mov esi, edi
shr esi, 1
and edi, 1
neg edi
and edi, 0x9908b0df
xor esi, dword [ecx + eax*4]
xor esi, edi
mov dword [ecx + eax*4 - 0xff4], esi
inc eax
cmp eax, 0x4e1
jne 0x408dc0
mov edi, dword [ecx + 0xd50]
mov eax, 0x355
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and edi, 0x80000000
mov edx, dword [ecx + eax*4]
mov ebx, edx
and ebx, 0x7ffffffe
or ebx, edi
shr ebx, 1
mov esi, edx
and esi, 1
neg esi
and esi, 0x9908b0df
mov edi, esi
and edi, ebx
add esi, ebx
add edi, edi
sub esi, edi
xor esi, dword [ecx + eax*4 - 0xd50]
mov edi, edx
mov dword [ecx + eax*4 - 0x9c4], esi
inc eax
cmp eax, 0x4e1
jne 0x408e20
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
ret
Function at 0x418cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edi + 2], 0
lea edi, [edi + 2]
jne 0x418cd0
mov esi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x418cf0
sar edi, 1
sar eax, 1
add eax, edi
add eax, 2
test eax, eax
jns 0x418d0f
mov eax, 0xffffffff
jmp 0x418d11
add eax, eax
push eax
call fcn.00408300
add esp, 4
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
je 0x418d41
add esi, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x418d30
mov word [eax], 0x5c
add eax, 2
mov edx, dword [esp + 0x30]
movzx ecx, word [edx]
test cx, cx
je 0x418d71
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418d60
mov word [eax], 0
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.00440530
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446434]

Function at 0x418fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x428
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x419000
sar esi, 1
lea ecx, [esp + 0x70]
push ecx
push 0
push 0
mov dword [esp + 0x10], esi
push esi
push eax
push 0
call dword [0x44cd1c]
mov dword [esp], eax
mov dword [esp + 0xe8], 0x599a9bb1
mov byte [esp + 0xec], 0
mov ebx, 0xf871319b
mov edi, 0x78ece64
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ebx + 0x78ecf4d]
mov eax, ebx
and eax, esi
add eax, eax
mov ecx, esi
sub ecx, eax
add ecx, ebx
or ecx, edi
mov eax, ecx
or al, 0x42
inc al
mov edx, ecx
shr dl, 1
and dl, 1
mul dl
mov edx, eax
add dl, al
mov eax, esi
add dl, al
test cl, 2
sete al
not cl
or cl, 2
mul cl
add al, al
sub dl, al
movzx eax, dl
add eax, ebx
add al, 0xf9
mov byte [esp + ebx + 0x78ecf4d], al
inc ebx
dec edi
cmp ebx, 0xf87131a0
jne 0x419050
xor ecx, ecx
mov eax, dword [esp]
cmp eax, dword [esp + 0xe8]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4468e0]
Function at 0x421c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x421ca0
sar ebp, 1
lea esi, [esp + 0x1c]
push esi
push 0
push 0
push ebp
push edi
push 0
call dword [0x44cd1c]
mov dword [esp + 8], 0x89cacb11
mov dword [esp + 0xc], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xb3
xor dl, byte [esp + ecx + 8]
add dl, 0x81
mov byte [esp + ecx + 8], dl
inc ecx
cmp ecx, 8
jne case.default.0x421d01
xor ecx, ecx
cmp eax, dword [esp + 8]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x446ef4]
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jns 0x421d17
mov eax, 0xffffffff
jmp 0x421d1a
lea eax, [ebx + ebx]
push eax
call fcn.00408300
add esp, 4
push esi
mov esi, eax
push ebx
push eax
push ebp
push edi
push 0
call dword [0x44cd1c]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446efc]
xor ebx, ebx
jmp dword [0x446f04]
push esi
call fcn.00408310
add esp, 4
xor ebx, ebx
jmp case.0x421d01.0
lea ebp, [esp + 8]
push ebp
push esi
call fcn.004406c0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446f0c]
xor ecx, ecx
test byte [esp + 8], 0x10
sete cl
mov eax, 1
jmp dword [ecx*4 + 0x446f14]
xor eax, eax
jmp dword [0x446f1c]
xor ebx, ebx
jmp dword [eax*4 + 0x446f24]
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x423750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x423760
cmp eax, 0xffffffed
jge 0x423777
mov eax, 0xffffffff
jmp 0x42377a
add eax, 0x12
push eax
call fcn.00408300
add esp, 4
mov esi, eax
mov dword [esp], 0x29472b58
mov dword [esp + 4], 0x2db12f43
mov dword [esp + 8], 0x51005378
mov dword [esp + 0xc], 0x55305734
mov dword [esp + 0x10], 0x5b54
mov byte [esp + 0x14], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x37
xor cl, byte [esp + eax]
add cl, 0xed
mov byte [esp + eax], cl
inc eax
cmp eax, 0x15
jne 0x4237c0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x423801
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4237f0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x423831
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423820
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.004406c0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x446fa4]

Function at 0x42376b
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x423760
cmp eax, 0xffffffed
jge 0x423777
mov eax, 0xffffffff
jmp 0x42377a
add eax, 0x12
push eax
call fcn.00408300
add esp, 4
mov esi, eax
mov dword [esp], 0x29472b58
mov dword [esp + 4], 0x2db12f43
mov dword [esp + 8], 0x51005378
mov dword [esp + 0xc], 0x55305734
mov dword [esp + 0x10], 0x5b54
mov byte [esp + 0x14], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x37
xor cl, byte [esp + eax]
add cl, 0xed
mov byte [esp + eax], cl
inc eax
cmp eax, 0x15
jne 0x4237c0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x423801
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4237f0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x423831
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423820
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.004406c0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x446fa4]
Function at 0x426370
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0x21e527db
mov dword [esp + 8], 0x3d922390
mov dword [esp + 0xc], 0x399d3fe0
mov dword [esp + 0x10], 0x35993bb4
mov dword [esp + 0x14], 0x319237cb
mov dword [esp + 0x18], 0xd8a339c
mov dword [esp + 0x1c], 0x9b80f83
mov dword [esp + 0x20], 0x5b50bb4
mov dword [esp + 0x24], 0x1a407b6
mov dword [esp + 0x28], 0x1db003bb
mov dword [esp + 0x2c], 0x19ba1fa0
mov dword [esp + 0x30], 0x15a81bc8
mov dword [esp + 0x34], 0x11a817a5
mov dword [esp + 0x38], 0xeda613ab
mov dword [esp + 0x3c], 0xe963ef53
lea eax, [esp + 0x40]
mov word [esp + 0x40], 0xebe8
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
xor ecx, ecx
nop
nop
movzx edx, byte [esp + ecx + 4]
lea edi, [ecx + 0x49]
and edi, edx
mov esi, edi
and esi, 0xfffffffd
mov ebx, edi
and ebx, 2
or edi, 2
imul edi, ebx
xor ebx, 2
imul ebx, esi
sub edi, ecx
mov esi, 0x48
sub esi, edi
sub esi, ebx
add edi, ebx
add edi, 0xd38c2ab7
xor edi, edx
and esi, edx
add esi, esi
sub esi, edi
mov edx, esi
not edx
or edx, 0x21bcd592
add edx, esi
lea edx, [edx*2 + 2]
xor esi, 0x21bcd592
mov edi, edx
and edi, esi
xor esi, edx
lea edx, [esi + edi*2]
inc dl
mov byte [esp + ecx + 4], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x44
jb 0x426410
lea esi, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, esp
push eax
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x44cd1c]
mov dword [esp + 4], 0x19dadbe1
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x4f
xor dl, byte [esp + ecx + 4]
add dl, 0x75
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 7
jne case.default.0x426501
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x44760c]

Function at 0x426640
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x21e4
call fcn.004081e0
mov dword [esp + 0x11e4], 0x73007114
mov dword [esp + 0x11e8], 0x6f116d11
mov dword [esp + 0x11ec], 0x6b196911
mov dword [esp + 0x11f0], 0x67146508
mov dword [esp + 0x11f4], 0x63066109
mov dword [esp + 0x11f8], 0x9fed9df1
mov dword [esp + 0x11fc], 0x9be899e5
mov dword [esp + 0x1200], 0x9594
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x11e4]
mov edi, eax
and edi, 0x18
mov edx, ecx
xor edx, 0xc608f86c
add edx, edi
xor edx, esi
mov esi, 0x4e
sub esi, edx
add edx, 0x29dbd7b1
and esi, 0xce
mov ebx, edx
and ebx, 0x30
and edx, 1
or ebx, 1
sub ebx, esi
add ebx, edx
mov byte [esp + ecx + 0x11e4], bl
inc ecx
add eax, 2
cmp ecx, 0x20
jne case.default.0x42671c
lea eax, [esp + 0x38]
lea ebp, [esp + 0x11e4]
push 0
push 0
push 0x20019
push eax
push ebp
call fcn.00440b70
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0x447644]