joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403bc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x403bee
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x403c8c
not eax
test bl, 1
jne 0x403bf5
mov edx, ebx
cmp ebx, 1
jne 0x403c26
jmp 0x403c8a
xor eax, eax
jmp 0x403c8c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x43ea18]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x43ea18]
cmp ebx, 1
je 0x403c8a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43ea18]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43ea18]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43ea18]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43ea18]
add esi, 2
cmp edx, esi
jne 0x403c30
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x4099f0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x124
call fcn.00438f00
test al, 1
jne 0x409a04
jmp 0x409adb
call fcn.00431930
test al, 1
jne 0x409a12
jmp 0x409ad4
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
sub esp, 8
cmp eax, 0
setge al
test al, 1
jne 0x409a3b
jmp 0x409ad2
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
sub esp, 0x24
jmp 0x409a8f
cmp eax, 0
setge al
test al, 1
jne 0x409a9b
jmp 0x409aca
call fcn.0040ab50
test al, 1
jne 0x409aa6
jmp 0x409ac8
lea eax, [esp + 0x24]
lea ecx, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00409af0
call fcn.0040f760
call fcn.0040ca50
jmp 0x409ac8
jmp 0x409aca
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x409ad2
jmp 0x409ad4
call fcn.00439490
jmp 0x409adb
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x409c8c
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x409b9d
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x409bc1
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x409b90
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x409b90
lea esi, [ebx + 1]
push esi
call fcn.00409310
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x409c9a
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x409c08
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x409c9c
movzx edx, word [edi]
test dx, dx
je 0x409c9c
cmp dx, 0x7f
jbe 0x409bf0
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
mov dword [esp + 4], esi
cmp esi, 0x7ff
ja 0x409c50
cmp ecx, 2
jb 0x409c50
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x409bf7
xor esi, esi
cmp ecx, 3
jb 0x409bf7
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
mov ecx, edx
not ecx
or ecx, 0x3f
add ecx, edx
add cl, 0x81
mov byte [eax + 2], cl
mov esi, 3
jmp 0x409bf7
push 1
call fcn.00409310
add esp, 4
mov ebp, eax
jmp 0x409c9c
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x409cc7
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x409cc2
test eax, eax
jne 0x409cc0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00405e00
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40c330
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x54], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0x3c
mov dword [esi + 0x24], 0xffffffff
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x4c], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x4476f4]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40c3e0
sar edx, 1
lea edi, [esi + 0x1c]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x441d80]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x415fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x415ff0
mov edi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x416010
sar esi, 1
sar eax, 1
lea ecx, [esi + eax]
add ecx, 2
test ecx, ecx
jns 0x416030
mov eax, 0xffffffff
jmp 0x416037
add eax, esi
add eax, eax
add eax, 4
push eax
call fcn.00409310
add esp, 4
movzx ecx, word [edi]
mov ebx, eax
test cx, cx
je 0x416061
add edi, 2
mov ebx, eax
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x416050
mov word [ebx], 0x5c
add ebx, 2
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x416091
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416080
mov word [ebx], 0
lea ecx, [esp + 8]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x34], eax
push eax
call fcn.0043bc70
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442cb0]
Function at 0x41ed20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0xbb7bb951
mov dword [esp + 0x14], 0xbf2cbd2a
mov dword [esp + 0x18], 0xa303a17a
mov dword [esp + 0x1c], 0xa707a536
mov dword [esp + 0x20], 0xab14a941
mov dword [esp + 0x24], 0xaf04ad1e
mov dword [esp + 0x28], 0x933e9139
mov dword [esp + 0x2c], 0x97339536
mov dword [esp + 0x30], 0x9b3a9904
mov dword [esp + 0x34], 0x9f0e9d31
mov dword [esp + 0x38], 0x833c813a
mov dword [esp + 0x3c], 0x87168532
mov dword [esp + 0x40], 0x8b2e8917
mov dword [esp + 0x44], 0x8f208d21
mov dword [esp + 0x48], 0x73e57129
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0x7572
mov dword [esp + 0x4e], 0
mov dword [esp + 0x51], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x44
ja 0x41ee34
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx esi, byte [esp + edx + 0x10]
lea edi, [ecx + 0x3df79ac7]
lea edx, [ecx + esi]
add edx, 0x3df79ac7
and edi, esi
add ecx, 0xc7
and ecx, esi
add ecx, edi
mov esi, ecx
xor esi, edx
not ecx
and ecx, edx
add ecx, ecx
sub ecx, esi
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x5c]
add cl, 0x8f
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x45
jb 0x41ede0
lea ebx, [esp + 0x5c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x448a2c]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41ee7d
mov eax, 0xffffffff
jmp 0x41ee80
lea eax, [edi + edi]
push eax
call fcn.00409310
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x1e
push ebx
push 0
call dword [0x448a2c]
mov dword [esp + 0x10], 0xf39acdb8
mov dword [esp + 0x14], 0xf764f165
mov dword [esp + 0x18], 0xfb9ff590
mov dword [esp + 0x1c], 0xff98f96e
mov dword [esp + 0x20], 0xe374fd95
mov dword [esp + 0x24], 0xe7e6e184
mov dword [esp + 0x28], 0
mov word [esp + 0x2c], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1d
ja 0x41ef3a
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0xb9cd1d5e
add eax, 0xb9cd1d5e
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x6e
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1e
jb 0x41eef0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.00418ed0
add esp, 0x14
mov ebx, eax
jmp dword [0x443dd4]

Function at 0x422620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.00422640
add esp, 4
test al, al
je 0x422633
mov al, 1
ret
jmp fcn.004230d0
Function at 0x42df80
Capabilities:
Encode data using xor
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov eax, dword [ebp + 8]
jmp 0x42df91
mov byte [esp + 0xf], 0
jmp 0x42df98
jmp 0x42df9a
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
jmp 0x42dfae
cmp eax, 0
setne al
jmp 0x42dfb6
test al, 1
jne 0x42dfbf
jmp 0x42e16b
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp + 0x50], eax
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
setne al
test al, 1
jne 0x42e002
jmp 0x42e165
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.00409420
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x3c], 0
setne al
test al, 1
jne 0x42e037
jmp 0x42e151
mov edi, dword [ebp + 8]
mov esi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
jmp 0x42e044
mov al, byte [esp + 0x14]
mov byte [esp + 0x1c], al
mov byte [esp + 0x20], 0x2b
mov byte [esp + 0x21], 0xf1
mov byte [esp + 0x22], 0xf3
mov byte [esp + 0x23], 0xf3
mov byte [esp + 0x24], 0xcc
mov byte [esp + 0x25], 0xf0
mov byte [esp + 0x26], 0xcf
mov byte [esp + 0x27], 0xf1
mov byte [esp + 0x28], 0xc2
mov byte [esp + 0x29], 0x3f
mov byte [esp + 0x2a], 0xf0
mov byte [esp + 0x2b], 0xf3
mov byte [esp + 0x2c], 0xf6
mov byte [esp + 0x2d], 0x69
lea eax, [esp + 0x20]
add eax, 0xe
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 7
call fcn.00409390
jmp 0x42e0b5
jmp 0x42e0b7
jmp 0x42e0b9
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 0x15
jae 0x42e132
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], esi
jmp 0x42e0d4
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
movzx ecx, byte [esp + ecx + 0x20]
mov edx, edi
add edx, 0xda2091d1
mov eax, edi
add eax, 0xd1
mov esi, edx
and esi, ecx
xor eax, edx
and eax, ecx
lea ecx, [edi + ecx - 0x25df6e2f]
lea eax, [eax + esi*2]
sub ecx, eax
mov dword [esp + 0x4c], ecx
mov eax, dword [esp + 0x4c]
add al, 0x49
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x20], al
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0x15
jb 0x42e0d4
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x44]
jmp 0x42e132
lea eax, [esp + 0x20]
mov ecx, edi
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00409d20
sub esp, 0xc
and al, 1
mov byte [esp + 0xf], al
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x42e163
jmp 0x42e165
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, byte [esp + 0xf]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433190
Capabilities:
Encode data using xor
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x14], 0xc3d2e1f0
mov dword [esp + 0x10], 0x10325476
mov dword [esp + 0xc], 0x98badcfe
mov dword [esp + 8], 0xefcdab89
mov dword [esp + 4], 0x67452301
cmp ebp, 0x40
jb 0x43324d
mov edi, ebp
shr edi, 6
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
add esi, 4
cmp esi, 0x40
jne 0x4331f0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.00436380
add esp, 8
inc ebx
lea eax, [esi + ebp]
cmp ebx, edi
jne 0x4331e0
add ebp, esi
mov eax, ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov ecx, ebp
and ecx, 0x3f
mov dword [esp], ecx
je 0x433344
mov ecx, ebp
and ecx, 1
xor edi, edi
cmp dword [esp], 1
je 0x43332d
mov dword [esp + 0x18], ecx
sub dword [esp], ecx
xor ebx, ebx
xor edi, edi
nop
movzx ebp, byte [eax + edi]
mov ecx, ebx
and cl, 0x10
shl ebp, cl
mov edx, edi
and edx, 0xfffffffc
xor ebp, dword [esp + edx + 0x1c]
mov dword [esp + edx + 0x1c], ebp
movzx esi, byte [eax + edi + 1]
or cl, 8
shl esi, cl
xor esi, ebp
mov dword [esp + edx + 0x1c], esi
add edi, 2
add ebx, 0x10
cmp dword [esp], edi
jne 0x4332f0
add eax, edi
mov ebp, dword [esp + 0x74]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x433344
movzx eax, byte [eax]
lea ecx, [edi*8]
shl eax, cl
and edi, 0xfffffffc
xor dword [esp + edi + 0x1c], eax
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x1c], eax
mov esi, dword [esp + 0x78]
mov eax, ebp
not eax
test al, 0x38
jne 0x433395
lea edi, [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
call fcn.00436380
add esp, 8
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x5c]
xor eax, eax
xor ecx, ecx
rep stosw word es:[edi], ax
mov dword [esp + 0x54], ebx
shr ebp, 0x1d
mov dword [esp + 0x58], ebp
lea eax, [esp + 0x1c]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.00436380
add esp, 8
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4340d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov eax, 0xfffffffe
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x4340e0
test eax, eax
je 0x434103
mov ebx, eax
sar ebx, 1
test al, 2
jne 0x43410a
mov edx, ebx
cmp ebx, 1
jne 0x43413f
jmp 0x4341aa
mov eax, edi
jmp 0x4341aa
lea edx, [ebx - 1]
movzx eax, word [ecx]
add ecx, 2
xor eax, edi
mov esi, eax
and esi, 0xfefffe6c
mov edi, eax
and edi, 0x1000193
or eax, 0x1000193
imul eax, edi
xor edi, 0x1000193
imul edi, esi
add eax, edi
mov edi, eax
cmp ebx, 1
je 0x4341aa
xor esi, esi
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
mov eax, edi
and eax, 0xfefffe6c
mov ebx, edi
and ebx, 0x1000193
or edi, 0x1000193
imul edi, ebx
xor ebx, 0x1000193
imul ebx, eax
add edi, ebx
movzx eax, word [ecx + esi*2 + 2]
xor eax, edi
mov edi, eax
and edi, 0xfefffe6c
mov ebx, eax
and ebx, 0x1000193
or eax, 0x1000193
imul eax, ebx
xor ebx, 0x1000193
imul ebx, edi
add eax, ebx
add esi, 2
cmp edx, esi
jne 0x434150
pop esi
pop edi
pop ebx
ret

Function at 0x4344b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
lea eax, [esp + 0x20]
push 0x68
push 7
push 0x100080
push eax
push dword [ebp + 8]
call fcn.0043bc70
add esp, 0x14
not eax
shr eax, 0x1f
xor ecx, ecx
jmp dword [eax*4 + 0x4460c8]

Function at 0x4349a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x434aa0
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x4349e9
mov ecx, dword [esp + 0x1c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [edi + 4]
add edi, 2
mov eax, dword [esp]
mov esi, eax
cmp edi, ecx
mov edi, edx
mov ebp, dword [esp + 0x18]
jae 0x434aa2
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.00418db0
add esp, 4
mov ebx, eax
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.00418db0
mov ecx, dword [esp + 0x20]
add esp, 4
mov bh, al
shl bl, 2
shr al, 4
and al, 3
or al, bl
lea edx, [esi + 1]
mov dword [esp], edx
mov edx, dword [esp + 0x20]
mov byte [edx + esi], al
cmp edi, ecx
jae 0x4349d0
movzx eax, byte [ebp + edi]
push eax
call fcn.00418db0
mov ecx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x4349d0
mov bl, al
shl bh, 4
shr al, 2
and al, 0xf
or al, bh
lea edx, [esi + 2]
mov dword [esp], edx
mov edx, dword [esp + 0x20]
mov byte [edx + esi + 1], al
lea eax, [edi + 1]
cmp eax, ecx
jae 0x4349d0
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.00418db0
add esp, 4
cmp al, 0x40
je 0x4349be
shl bl, 6
add al, bl
mov ecx, esi
and ecx, 1
mov edx, dword [esp]
xor edx, 1
lea edx, [edx + ecx*2]
mov dword [esp], edx
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi + 2], al
jmp 0x4349be
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0x20212e2f
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x437d23
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax - 0x28ef967a]
add eax, 0x86
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov ecx, eax
xor ecx, 0x55
and eax, 0x55
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x437ce0
mov ebx, dword [esp + 0x10]
mov eax, dword [0x448a30]
test eax, eax
je 0x437d76
xor ecx, ecx
mov edx, dword [0x448a34]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x8bca30fc
je 0x437d50
inc ecx
cmp eax, ecx
jne 0x437d40
jmp 0x437d76
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebx
je 0x437d76
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x448a38]
push eax
call fcn.004395d0
add esp, 0x1c
mov ebx, eax
cmp ebx, 0xc0000004
jne 0x437ec8
push dword [esp + 8]
call fcn.00437b10
add esp, 4
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], 0x20212e2f
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 8
ja 0x437e04
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x10]
lea esi, [ecx - 0x28ef967a]
add ecx, 0x86
and ecx, edx
or esi, edx
sub esi, ecx
mov dword [esp + 0xc], esi
mov ecx, dword [esp + 0xc]
mov edx, ecx
xor edx, 0x55
and ecx, 0x55
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esp]
mov byte [esp + edx + 0x10], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 9
jb 0x437dc0
mov ebx, dword [esp + 0x10]
mov ecx, dword [0x448a30]
test ecx, ecx
je 0x437e54
xor edx, edx
mov esi, dword [0x448a34]
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x8bca30fc
je 0x437e30
inc edx
cmp ecx, edx
jne 0x437e20
jmp 0x437e54
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, ebx
je 0x437e54
push 0
push eax
push dword [esp + 0xc]
push 5
push 4
push dword [0x448a38]
push ecx
call fcn.004395d0
add esp, 0x1c
mov ebx, eax
test ebx, ebx
js 0x437ebc
mov dword [esp + 0x20], edi
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 4]
mov esi, dword [ecx]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebx]
movzx edi, word [eax + ebx]
test si, si
je 0x437e95
add ebx, 2
cmp si, di
je 0x437e80
cmp si, di
je 0x437ea7
mov esi, dword [ecx]
test esi, esi
jne 0x437e70
mov ebx, 0xc0000225
jmp 0x437ebc
mov eax, dword [ecx + 0x44]
mov edx, dword [esp + 0x20]
mov dword [edx + 4], eax
mov eax, dword [ecx + 0xdc]
mov dword [edx + 8], eax
xor ebx, ebx
push dword [esp + 4]
call fcn.00437bc0
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4