joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4049cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404af0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404943
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404af0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404943
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404b0c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4049cc
xor eax, eax
push ebp
push 0x4049c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404708
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4049aa
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404b2c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4049aa
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4049cc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404ae6
cmp byte [ebp - 0xd], 0
jne 0x404a13
cmp byte [ebp - 0x12], 0
je 0x404ae6
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404a2c
dec ebx
cmp byte [ebx], 0x2e
je 0x404a3b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404a2b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404ae6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404a78
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404ae6
cmp byte [ebp - 0xd], 0
je 0x404ae6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404ae6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404c7c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404ce2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004042cc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c08
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404ccc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ce9
lea eax, [ebp - 0x10]
call fcn.00404084
ret

Function at 0x406a80
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406ab9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404174
jmp 0x406ac2
mov eax, ebx
mov edx, esi
call fcn.004040d8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406acc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406aed
mov al, byte [esp]
jmp 0x406aef
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x407174
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x406fec
mov eax, dword [0x4093dc]
cmp byte [eax], 0
je 0x4071f0
mov eax, dword [0x409330]
call fcn.004029cc
call fcn.0040262c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00405f74
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x407238
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x407226
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x409310]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x40a660]
call fcn.004046cc
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x407be4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x407c48
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004042cc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00405e48
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407c4f
lea eax, [ebp - 0xc]
call fcn.00404084
ret
Function at 0x408fbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f70
test al, al
jne 0x408fdd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x409029
xor eax, eax
push ebp
push 0x409019
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409020
lea eax, [ebp - 0xc]
call fcn.00408fac
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409330
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40941f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406cf4
mov edx, dword [ebp - 8]
mov ecx, 0x409438
xor eax, eax
call fcn.00409224
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4093ed
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409350
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x35
call fcn.00408dd8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c84
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407284
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x67
call fcn.00408da8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404650
call fcn.00405880
call fcn.00402eb4
jmp 0x409350
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409426
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x4094d8
Capabilities:
Encode data using xor

Disassembly:
mov esi, ecx
dec esi
mov edx, dword [esi + 1]
xor edx, ebx
mov dword [edi], edx
mov edx, 4
add ecx, edx
mov edx, 0xfffffffc
sub edi, edx
xlatb
xlatb
mov eax, 0x1779647d
shr eax, 2
mov edx, 0x59e796d
xor edx, eax
xor edx, ecx
push 0x1668f97
mov esi, 0x59a3e5fd
shr esi, 6
pop eax
xor esi, eax
sub edx, esi
jne 0x4094bf
lea esp, [esp + 4]
jmp dword [esp - 4]
Function at 0x402b90
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x402caf
mov ecx, dword [eax + 4]
cmp ecx, 2
je 0x402ca3
cmp ecx, 5
je 0x402c73
cmp ecx, 4
jne 0x402caf
mov esi, dword [eax + 8]
cmp dword [esi + 0x18], 0
je 0x402bfd
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0xc]
push dword [eax + edi*4]
call dword [section..data]
add esp, 4
mov eax, dword [esi + 0x10]
push dword [eax + edi*4]
call fcn.00402b90
add esp, 4
mov eax, edi
and eax, 1
xor edi, 1
lea edi, [edi + eax*2]
cmp edi, dword [esi + 0x18]
jb 0x402bd0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
push dword [esi + 4]
call dword [section..data]
add esp, 4
push dword [esi + 0xc]
call dword [section..data]
add esp, 4
push dword [esi + 0x10]
call dword [section..data]
add esp, 4
push dword [esi + 0x14]
call dword [section..data]
add esp, 4
push dword [esi + 8]
call dword [section..data]
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
jmp 0x402ca0
mov esi, dword [eax + 8]
cmp dword [esi + 8], 0
je 0x402c94
xor edi, edi
nop
nop
mov eax, dword [esi + 4]
push dword [eax + edi*4]
call fcn.00402b90
add esp, 4
inc edi
cmp edi, dword [esi + 8]
jb 0x402c80
push dword [esi + 4]
call dword [section..data]
add esp, 4
push esi
jmp 0x402ca6
push dword [eax + 8]
call dword [section..data]
add esp, 4
pop esi
pop edi
jmp dword [section..data]

Function at 0x402e90
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402eca
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0x402ed1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0x402eb0
jmp 0x402ed3
mov eax, 0x1505
jmp 0x402ed3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x403750
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, dword [esp + 0x18]
test edx, edx
je 0x4037d0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test ecx, ecx
je 0x4037d2
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [edx + esi]
mov ebx, eax
and eax, 0xf
mov ebp, edi
not ebp
or ebp, 0xf
mov ecx, edx
lea edx, [edi + ebp]
add ebp, edi
inc ebp
and ebp, eax
add eax, edx
inc eax
shr ebx, 4
add ebp, ebp
sub eax, ebp
xor ebx, dword [eax*4 + 0x43f80c]
mov eax, ebx
mov edx, ebx
and edx, 0xf
shr edi, 4
and ebx, edi
add edi, edx
shr eax, 4
add ebx, ebx
sub edi, ebx
mov edx, dword [edi*4 + 0x43f80c]
mov edi, eax
and edi, edx
add eax, edx
mov edx, ecx
mov ecx, dword [esp + 0x1c]
add edi, edi
sub eax, edi
inc esi
cmp ecx, esi
jne 0x403770
not eax
jmp 0x4037d2
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40878b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x408793
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x40882b
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x4087d9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x40883a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x4087ee
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x408800
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x4087c0
jmp 0x408809
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x4087c0
cmp edi, ebx
jge 0x408820
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x4087c4
jmp 0x408824
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x4087cd
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x4088c2
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x4088c2
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x408874
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x408860
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x4088c2
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x408880
dec eax
mov ecx, 1
xor esi, esi
jmp 0x4088dc
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x40878b
test edx, edx
mov dword [esp], ecx
js 0x408910
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x408920
inc ebp
dec edx
cmp edi, ebp
jne 0x4088f0
mov edx, 0xffffffff
jmp 0x408922
xor edi, edi
jmp 0x408925
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x4088d0
and ebp, 3
je 0x408958
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x408940
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x40895a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x4088d0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x408970
jmp 0x4088d0
Function at 0x4094a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x409518
xor eax, eax
mov edx, 0x80000000
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea esi, [eax + 0x270]
mov edi, esi
not edi
and edi, 0x270
and esi, 0x58f
sub esi, edi
mov ebp, dword [ecx + esi*4 + 4]
and ebp, edx
mov edi, dword [ecx + esi*4 + 8]
mov ebx, edi
and ebx, 0x7ffffffe
or ebx, ebp
shr ebx, 1
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + esi*4 + 0x638]
xor edi, ebx
mov dword [ecx + eax*4 + 0x9c4], edi
inc eax
cmp eax, 0x270
jne 0x4094c0
mov eax, 0x270
jmp 0x40952a
cmp eax, 0x4e0
jb 0x40952a
mov esi, ecx
call fcn.00409570
mov ecx, esi
mov eax, dword [esi]
mov edx, eax
and edx, 1
mov esi, eax
xor esi, 1
lea edx, [esi + edx*2]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x409570
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 - 0x630]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4]
xor edi, edx
mov dword [ecx + eax*4 - 0xff4], edi
inc eax
cmp eax, 0x4e1
jne 0x409580
mov edi, dword [ecx + 0xd50]
mov eax, 0xe4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [eax - 1]
and edi, 0x80000000
mov ebx, dword [ecx + eax*4 + 0x9c4]
mov esi, ebx
and esi, 0x7ffffffe
or esi, edi
shr esi, 1
mov edi, ebx
and ebx, 1
neg ebx
and ebx, 0x9908b0df
mov ebp, edx
or ebp, 0x3ffffd8f
and edx, 0x18f
add edx, ebp
xor ebx, dword [ecx + edx*4 + 0x63c]
xor ebx, esi
mov dword [ecx + eax*4], ebx
inc eax
cmp eax, 0x270
jne 0x4095d0
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 1
neg edx
and edx, 0x9908b0df
mov esi, 0x80000000
and esi, dword [ecx + 0x1380]
and eax, 0x7ffffffe
or eax, esi
shr eax, 1
xor eax, edx
mov edx, dword [ecx + 0x634]
mov esi, eax
and esi, edx
add eax, edx
add esi, esi
sub eax, esi
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4159e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x430
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 8]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x415a00
add eax, esi
add eax, 0xfffffffe
mov ecx, esi
not ecx
and ecx, eax
add ecx, ecx
xor eax, esi
sub ecx, eax
mov eax, ecx
sar eax, 1
mov dword [esp + 0xe8], eax
cmp eax, 0xfffffff2
mov dword [esp + 4], ecx
jge 0x415a36
mov eax, 0xffffffff
jmp 0x415a39
lea eax, [ecx + 0x1c]
push eax
call fcn.00408b20
add esp, 4
mov dword [esp], eax
mov dword [esp + 0x2a8], 0x9669947f
mov dword [esp + 0x2ac], 0x8a1a8876
mov dword [esp + 0x2b0], 0x8ead8c1f
mov dword [esp + 0x2b4], 0x82648079
mov dword [esp + 0x2b8], 0x86168411
mov dword [esp + 0x2bc], 0xba26b81e
mov dword [esp + 0x2c0], 0xbebdbc25
mov eax, 0xcb
mov ecx, 0x34
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x1dd]
mov edi, ecx
or edi, edx
not edx
or edx, eax
and edx, edi
mov bl, 0xa7
sub bl, dl
mov byte [esp + eax + 0x1dd], bl
inc eax
dec ecx
cmp eax, 0xe7
jne 0x415aa0
movzx ecx, word [esi]
mov ebx, dword [esp]
mov eax, ebx
test cx, cx
je 0x415af1
add esi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x415ae0
mov word [eax], 0
movzx ecx, word [esp + 0x2a8]
test cx, cx
je 0x415b21
lea edx, [esp + 0x2aa]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415b10
mov word [eax], 0
lea eax, [esp + 0x110]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043dbb0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4434b4]
Function at 0x41bb10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x198
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], 0x4ad34888
mov dword [esp + 0x14], 0x4ed24cd8
mov dword [esp + 0x18], 0x424140d1
xor eax, eax
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x10]
mov edx, eax
and edx, 0xc
xor edx, 0x821cc23c
mov esi, eax
and esi, 3
sub esi, edx
mov edx, 0x94
sub edx, esi
add esi, 0x6b
xor edx, esi
and edx, ecx
xor edx, esi
add dl, 0x88
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 0xc
jne 0x41bb40
mov dword [esp + 0x3c], 0xda4dd87f
mov dword [esp + 0x40], 0xde4ddc4f
mov dword [esp + 0x44], 0xd20ed015
mov dword [esp + 0x48], 0xd649d40c
mov dword [esp + 0x4c], 0xca6ac848
mov dword [esp + 0x50], 0xce51cc6a
mov dword [esp + 0x54], 0xc25ec057
mov dword [esp + 0x58], 0xc651c450
mov dword [esp + 0x5c], 0xbab9b80d
lea eax, [esp + 0x3c]
mov esi, 0x1a398be0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
mov edi, edx
xor edi, 0x2a
mov ecx, esi
xor ecx, 0xd5
xor edx, 0xd5
and edx, ecx
mov ecx, esi
xor ecx, 0x2a
and ecx, edi
or ecx, edx
add cl, 8
mov byte [eax], cl
inc eax
dec esi
cmp esi, 0x1a398bbc
jne 0x41bbd0
movzx ecx, word [esp + 0x3c]
lea eax, [esp + 0x154]
test cx, cx
je 0x41bc31
lea edx, [esp + 0x3e]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bc20
mov word [eax], 0
movzx ecx, word [ebx]
test cx, cx
je 0x41bc61
lea edx, [ebx + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bc50
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x41bc91
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bc80
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
mov dword [esp + 0x3c], 0xeeefedad
mov byte [esp + 0x40], 0x4b
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x2f
xor cl, byte [esp + eax + 0x3c]
add cl, 0x88
mov byte [esp + eax + 0x3c], cl
inc eax
cmp eax, 5
jne 0x41bcb0
movzx eax, byte [esp + 0x3c]
test al, al
je 0x41bceb
lea ecx, [esp + 0x3d]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41bce0
mov byte [edi], 0
lea eax, [esp + 0x30]
lea ecx, [esp + 0x148]
lea edx, [esp + 0x2c]
lea esi, [esp + 0x154]
push eax
push ecx
push edx
push esi
call fcn.0040b890
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x44382c]
mov ecx, 0xc7e5135e
xor ecx, dword [0x443834]
add eax, ecx
inc eax
jmp eax
Function at 0x4368f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + ebx], 0
lea ebx, [ebx + 2]
jne 0x436910
lea esi, [ebx - 2]
mov dword [esp + 8], 0x222220b3
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
and al, 0xcf
or al, 0x20
xor byte [esp + edx + 8], al
inc edx
cmp edx, 4
jne 0x436930
cmp ebx, 2
je 0x436967
mov edi, dword [esp + 8]
mov eax, esi
mov edx, esi
sar edx, 1
mov dword [esp + 4], edx
mov edx, edi
not edi
test al, 2
jne 0x43696e
mov eax, edx
cmp ebx, 4
jne 0x4369a3
jmp 0x4369f6
mov esi, ebp
jmp 0x4369f6
dec dword [esp + 4]
movzx esi, word [ecx]
add ecx, 2
xor esi, ebp
mov ebp, esi
and ebp, edi
mov dword [esp], ebp
mov ebp, esi
not ebp
and ebp, edx
imul ebp, dword [esp]
mov eax, esi
and eax, edx
mov dword [esp], eax
mov eax, edx
or esi, edx
imul esi, dword [esp]
add esi, ebp
mov ebp, esi
cmp ebx, 4
je 0x4369f6
mov edx, eax
xor ebx, ebx
mov esi, ebp
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [ecx + ebx*2]
xor ebp, esi
mov eax, ebp
and eax, edi
mov esi, ebp
not esi
and esi, edx
imul esi, eax
mov eax, ebp
and eax, edx
or ebp, edx
imul ebp, eax
add ebp, esi
movzx esi, word [ecx + ebx*2 + 2]
xor esi, ebp
mov eax, esi
and eax, edi
mov ebp, esi
not ebp
and ebp, edx
imul ebp, eax
mov eax, esi
and eax, edx
or esi, edx
imul esi, eax
add esi, ebp
add ebx, 2
cmp dword [esp + 4], ebx
jne 0x4369b0
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a1b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
test esi, esi
setne al
jmp dword [eax*4 + 0x44636c]

Function at 0x43a670
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43a72b
push ebp
push ebx
push edi
push esi
push eax
mov dword [esp], 0xd1d2d3d4
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
mov ebx, edx
and ebx, 2
mov edi, edx
or edi, 2
imul edi, ebx
xor ebx, 2
mov ebp, edx
and ebp, 1
neg ebp
and ebp, ebx
mov ebx, edx
xor ebx, 0xfa2b9fc3
add ebx, ebp
add ebx, edi
xor ebx, esi
mov esi, ebx
and esi, 0x67
xor ebx, 0xe7
lea ebx, [ebx + esi*2]
inc bl
mov byte [esp + edx], bl
inc edx
cmp edx, 4
jne 0x43a690
mov edx, dword [0x4494c0]
test edx, edx
je 0x43a71e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x4494c4]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb430e561
je 0x43a700
inc edi
cmp edx, edi
jne 0x43a6f0
jmp 0x43a71e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43a71e
push eax
push 4
push edx
push dword [0x4494c8]
mov esi, ecx
call fcn.0043ba90
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret