joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409db1
Capabilities:
Set registry value

Disassembly:
push 0x1c
mov eax, 0x464b69
call fcn.00460433
call fcn.00408426
xor ebx, ebx
cmp eax, ebx
jne 0x409dcf
xor al, al
jmp 0x409f3c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.uninstaller.exe
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004054e9
add esp, 0x24
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], ebx
jne 0x409e01
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
je 0x409dc8
call fcn.00401000
jmp 0x409dc8
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.C1C3E833_420E_4D78_9BA7_86AEBB272384
lea eax, [ebp - 0x28]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push eax
call fcn.004054e9
add esp, 0x24
cmp dword [ebp - 0x28], ebx
jne 0x409e33
mov byte [ebp - 4], bl
mov esi, dword [ebp - 0x24]
cmp esi, ebx
je 0x409def
call fcn.00401000
jmp 0x409def
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
push dword [ebp - 0x28]
call fcn.00405040
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp dword [ebp - 0x14], ebx
je 0x409e22
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0xd
push 0x46b638
xor edi, edi
inc edi
push edi
push ebx
push str.DisplayName
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp - 0x20]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x409e74
sub eax, ecx
push eax
push dword [ebp - 0x20]
push edi
push ebx
push str.DisplayIcon
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp - 0x20]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x409e93
sub eax, ecx
push eax
push dword [ebp - 0x20]
push edi
push ebx
push str.UninstallString
push dword [ebp - 0x14]
call esi
push 0xd
push 0x46b638
push edi
push ebx
push str.Publisher
push dword [ebp - 0x14]
call esi
push 0x1c
push str.http:__www.toparcadehits.com
push edi
push ebx
push str.URLInfoAbout
push dword [ebp - 0x14]
call esi
push 0x1c
push str.http:__www.toparcadehits.com
push edi
push ebx
push str.HelpLink
push dword [ebp - 0x14]
call esi
push 4
mov dword [ebp - 0x18], edi
pop edi
push edi
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push str.NoModify
push dword [ebp - 0x14]
call esi
push edi
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push str.NoRepair
push dword [ebp - 0x14]
call esi
cmp dword [ebp - 0x14], ebx
je 0x409f1b
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
mov esi, dword [ebp - 0x24]
cmp esi, ebx
je 0x409f2a
call fcn.00401000
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
je 0x409f3a
call fcn.00401000
mov al, 1
call fcn.004604d2
ret

Function at 0x40ec48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 8], eax
jle 0x40ec71
push esi
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x467758]
mov esi, eax
shl esi, 3
xor edx, esi
xor eax, edx
inc ecx
dec dword [ebp + 8]
cmp dword [ebp + 8], 0
jg 0x40ec53
pop esi
pop ebp
ret
Function at 0x4500ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x474194]
jne 0x4500b6
repz ret
jmp fcn.00452ab3

Function at 0x458f8b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x458fb2
call fcn.00451b13
mov dword [eax], esi
call fcn.00451b00
push 0x16
pop esi
mov dword [eax], esi
call fcn.00453ff3
mov eax, esi
jmp 0x459007
test dword [ebp + 0xc], 0xfffffff9
jne 0x458f98
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x458fdf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00451b26
pop ecx
call fcn.00451b00
mov eax, dword [eax]
jmp 0x459007
test al, 0x10
jne 0x459005
test al, 1
je 0x459005
test byte [ebp + 0xc], 2
je 0x459005
call fcn.00451b13
mov dword [eax], 5
call fcn.00451b00
mov dword [eax], 0xd
jmp 0x458fd6
xor eax, eax
pop esi
pop ebp
ret
Function at 0x45b0ef
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x474194]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00456bf3
and dword [ebp - 0x14], 0
cmp dword [0x4772e0], 0
mov dword [ebp - 0x18], eax
jne 0x45b1a2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x45b24a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x45b24a
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4772e0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4772e4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4772e8], eax
call edi
push eax
call esi
mov dword [0x4772f0], eax
test eax, eax
je 0x45b1a2
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4772ec], eax
mov eax, dword [0x4772ec]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x45b1fb
cmp dword [0x4772f0], ecx
je 0x45b1fb
push eax
call esi
push dword [0x4772f0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x45b1fb
test ebx, ebx
je 0x45b1fb
call edi
test eax, eax
je 0x45b1f2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x45b1f2
test byte [ebp - 8], 1
jne 0x45b1fb
or dword [ebp + 0x10], 0x200000
jmp 0x45b22e
mov eax, dword [0x4772e4]
cmp eax, dword [ebp - 0x18]
je 0x45b22e
push eax
call esi
test eax, eax
je 0x45b22e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x45b22e
mov eax, dword [0x4772e8]
cmp eax, dword [ebp - 0x18]
je 0x45b22e
push eax
call esi
test eax, eax
je 0x45b22e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4772e0]
call esi
test eax, eax
je 0x45b24a
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x45b24c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004500ac
leave
ret
Function at 0xd70058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd701a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd7007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd7006a
add dl, dl
jne 0xd70089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd700dc
xor eax, eax
add dl, dl
jne 0xd70096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd7017d
add dl, dl
jne 0xd700a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd700b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd700bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd700c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd700d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd70075
mov eax, 1
add dl, dl
jne 0xd700ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd700f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd700e1
sub eax, ebx
mov ebx, 1
jne 0xd70128
mov ecx, 1
add dl, dl
jne 0xd7010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd70119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd70105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd70075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd7013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd7014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd70136
cmp eax, 0x7d00
jae 0xd7016d
cmp eax, 0x500
jb 0xd70168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd70075
cmp eax, 0x7f
ja 0xd70170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd70075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd7019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd70075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x406450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4e1654]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
cmp esi, edi
je 0x40660f
mov edx, 0x3b67
mov dword [ebp - 0x4c], 0x3b63
mov dword [ebp - 0x50], 0x3b76
mov dword [ebp - 0x54], 0x3b77
mov dword [ebp - 0x58], 0x3b6d
lea eax, [edx - 0x32]
nop dword [eax]
nop dword [eax + eax]
mov dword [ebp - 0x48], 0x3b15
mov ecx, 0x3b41
mov word [ebp - 0x44], cx
mov ecx, 0x3b6c
mov word [ebp - 0x42], dx
mov edx, 0x3b7a
mov word [ebp - 0x40], cx
mov ecx, 0x3b7c
mov word [ebp - 0x3e], cx
mov ecx, 0x3b7b
mov word [ebp - 0x3c], cx
mov ecx, 0x3b72
mov word [ebp - 0x3a], cx
mov ecx, 0x3b61
mov word [ebp - 0x38], ax
mov word [ebp - 0x36], cx
mov word [ebp - 0x34], dx
mov edx, 0x3b66
mov word [ebp - 0x32], ax
mov word [ebp - 0x30], dx
mov word [ebp - 0x2e], cx
mov ecx, 0x3b7a
mov word [ebp - 0x2c], cx
mov ecx, 0x3b65
mov word [ebp - 0x2a], cx
mov ecx, 0x3b70
mov word [ebp - 0x28], ax
mov word [ebp - 0x26], dx
mov edx, 0x3b67
mov word [ebp - 0x24], cx
mov word [ebp - 0x22], dx
mov edx, dword [ebp - 0x4c]
mov word [ebp - 0x20], dx
mov edx, 0x3b7c
mov word [ebp - 0x1e], dx
mov edx, dword [ebp - 0x50]
mov word [ebp - 0x1c], dx
mov edx, dword [ebp - 0x54]
mov word [ebp - 0x1a], cx
mov word [ebp - 0x18], ax
mov word [ebp - 0x16], dx
mov edx, 0x3b6c
mov word [ebp - 0x14], dx
mov edx, 0x3b67
mov word [ebp - 0x12], ax
mov eax, 0x3b72
mov word [ebp - 0x10], dx
mov word [ebp - 0xe], cx
mov word [ebp - 0xc], ax
mov eax, dword [ebp - 0x58]
mov word [ebp - 0xa], cx
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
mov ax, word [ebp - 0x44]
xor eax, eax
nop dword [eax + eax]
movzx ecx, word [ebp + eax*2 - 0x44]
mov edx, dword [ebp - 0x48]
xor edx, ecx
mov word [ebp + eax*2 - 0x44], dx
inc eax
cmp eax, 0x1f
jb 0x406590
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x5c], eax
call fcn.00425d60
push esi
mov dword [ebp - 0x68], 0
xor edx, edx
mov dword [ebp - 0x64], 0
mov ecx, dword [eax + 0x114]
lea eax, [ebp - 0x5c]
movq xmm0, qword [ebp - 0x68]
push eax
push 7
push 0x4b99bc
push 2
sub esp, 0xc
mov dword [ebp - 0x60], edx
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], edx
call fcn.0040ac00
push esi
call fcn.00434e40
mov eax, 0x3b35
add esi, 0x18
add esp, 4
lea edx, [eax + 0x32]
cmp esi, edi
jne 0x4064a0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
xor ecx, ebp
pop edi
pop esi
call fcn.0048af00
mov esp, ebp
pop ebp
ret
Function at 0x419a40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b15b5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4e1654]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov edx, edi
cmp dword [edi + 0x14], 0x10
jb 0x419a77
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x419a95
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x419a83
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.004025e0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x419b65
cmp dword [ebx + 8], 0x6666666
je 0x419b7c
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.0048aa51
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
push edi
lea edi, [ecx + 8]
mov ecx, edi
call fcn.00416ba0
xorps xmm0, xmm0
movq qword [edi + 0x18], xmm0
mov dword [edi + 0x1c], 0
mov eax, dword [ebx + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4ba030]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4ba030]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x419b56
mov ecx, ebx
call fcn.0041e0f0
push esi
push edi
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.004025e0
mov ecx, dword [eax]
jmp 0x419b59
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push esi
mov ecx, ebx
call fcn.0041df70
add eax, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.00473bf5
int3
Function at 0x41da10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x41db59
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.0041d6f0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x41db2c
movzx eax, byte [ecx + 8]
mov edi, dword [ebx + 0x18]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul eax, eax, 0x1000193
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
mov dword [ebp - 4], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 0xc], eax
cmp ebx, esi
jne 0x41daa5
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x41db1f
mov eax, dword [eax + 4]
mov bl, byte [ecx + 8]
cmp bl, byte [eax + 8]
mov ebx, dword [ebp - 4]
jne 0x41dae2
mov eax, dword [eax]
mov dword [ebp + 8], eax
cmp eax, ecx
je 0x41dada
mov ebx, dword [ecx + 4]
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], ecx
jmp 0x41db1f
mov edi, eax
cmp ebx, eax
je 0x41dafc
mov eax, dword [eax + 4]
mov edi, eax
mov bl, byte [ecx + 8]
cmp bl, byte [eax + 8]
mov ebx, dword [ebp - 4]
je 0x41db35
cmp ebx, eax
jne 0x41dae8
mov eax, dword [ecx + 4]
mov dword [ebp + 8], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp + 8]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
mov ebx, dword [ebp - 0x10]
mov ecx, edx
cmp edx, esi
jne 0x41da72
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x41db1f
push str.invalid_hash_bucket_count
call fcn.00473bf5
int3
Function at 0x41f8e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x31
jb 0x41f8e4
pop esi
mov byte [ecx + 0x35], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x41f910
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x1b
jb 0x41f914
pop esi
mov byte [ecx + 0x1f], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x41f980
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea edx, [ecx + 4]
mov esi, 0x2c
nop dword [eax + eax]
mov bl, byte [edx]
lea edx, [edx + 1]
mov eax, dword [ecx]
xor al, bl
mov byte [edx - 1], al
sub esi, 1
jne 0x41f990
pop edi
pop esi
mov byte [ecx + 0x30], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x41f9b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea edx, [ecx + 4]
mov esi, 0x41
nop dword [eax + eax]
mov bl, byte [edx]
lea edx, [edx + 1]
mov eax, dword [ecx]
xor al, bl
mov byte [edx - 1], al
sub esi, 1
jne 0x41f9c0
pop edi
pop esi
mov byte [ecx + 0x45], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x4201e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov esi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x4201fc
mov esi, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x420218
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x420207
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push edi
push edx
push eax
mov ecx, ebx
call fcn.004025e0
mov esi, dword [eax + 4]
test esi, esi
je 0x420290
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x420257
cmp eax, esi
jne 0x42024f
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x42025f
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x42025f
cmp eax, esi
jne 0x42025f
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [ebx + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 8]
call fcn.00418cd0
push 0x28
push esi
call fcn.0048aa81
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x425e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
movzx eax, ax
push esi
mov esi, eax
mov dword [ebp - 4], eax
push edi
shr esi, 8
xor eax, eax
xor edi, edi
mov dword [ebp - 8], esi
cmp dword [ebp + 0x10], eax
jbe 0x425e6c
mov ecx, dword [ebp + 0xc]
movzx ebx, word [ecx + edi*2]
mov edx, ebx
movzx ecx, bl
shr edx, 8
add edx, eax
cmp esi, ecx
jb 0x425e6c
movzx ecx, bl
cmp esi, ecx
jne 0x425e64
cmp eax, edx
jge 0x425e64
mov ecx, dword [ebp + 8]
movzx esi, cl
nop dword [eax]
mov ecx, dword [ebp + 0x14]
movzx ecx, byte [eax + ecx]
cmp cx, si
je 0x425e98
inc eax
cmp eax, edx
jl 0x425e50
mov esi, dword [ebp - 8]
inc edi
mov eax, edx
cmp edi, dword [ebp + 0x10]
jb 0x425e23
mov edi, dword [ebp + 0x1c]
xor eax, eax
mov bl, 1
test edi, edi
je 0x425eb0
mov esi, dword [ebp + 0x18]
nop word [eax + eax]
movzx ecx, byte [eax + esi]
test cl, cl
jns 0x425ea1
movzx edx, byte [eax + esi + 1]
inc eax
and ecx, 0x7f
shl ecx, 8
or edx, ecx
jmp 0x425ea3
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ecx
sub dword [ebp - 4], edx
js 0x425eb0
inc eax
xor bl, 1
cmp eax, edi
jb 0x425e80
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438600
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x43862b
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x438614
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret

Function at 0x439690
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
lea edx, [edi + 4]
nop word [eax + eax]
mov ax, word [edx]
lea edx, [edx + 2]
mov ecx, dword [edi]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edx - 2], cx
cmp esi, 7
jb 0x4396a0
xor eax, eax
mov word [edi + 0x12], ax
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x4396d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
lea edx, [edi + 4]
nop word [eax + eax]
mov ax, word [edx]
lea edx, [edx + 2]
mov ecx, dword [edi]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edx - 2], cx
cmp esi, 0x14
jb 0x4396e0
xor eax, eax
mov word [edi + 0x2c], ax
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x4397d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x439801
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4397f0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x43ab40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b2f64
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4e1654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov dword [ebx], 0
mov eax, dword [edi]
mov dword [ebp - 0x2c], 0x4e93
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x4c], eax
mov eax, 0x4ec1
mov word [ebp - 0x28], ax
mov eax, 0x4edc
mov word [ebp - 0x26], ax
mov word [ebp - 0x24], ax
mov eax, 0x4ec7
mov word [ebp - 0x22], ax
mov eax, 0x4ecf
mov word [ebp - 0x20], ax
mov eax, 0x4ed0
mov word [ebp - 0x1e], ax
mov eax, 0x4eda
mov word [ebp - 0x1c], ax
mov eax, 0x4ede
mov word [ebp - 0x1a], ax
mov eax, 0x4ec5
mov word [ebp - 0x18], ax
mov eax, 0x4ea1
mov word [ebp - 0x16], ax
xor eax, eax
mov word [ebp - 0x14], ax
xor edx, edx
mov ax, word [ebp - 0x28]
movzx eax, word [ebp + edx*2 - 0x28]
mov ecx, dword [ebp - 0x2c]
xor ecx, eax
mov word [ebp + edx*2 - 0x28], cx
inc edx
cmp edx, 0xa
jb 0x43abe6
xor eax, eax
push 0xc
mov word [ebp - 0x14], ax
call fcn.0048aa51
mov esi, eax
add esp, 4
mov dword [ebp - 0x48], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x43ac3f
lea eax, [ebp - 0x28]
mov dword [esi + 4], 0
push eax
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x43acda
jmp 0x43ac41
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x48], esi
test esi, esi
je 0x43ace4
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esi]
mov dword [ebp - 4], 1
push edi
call dword [ebp - 0x4c]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x43acb6
mov ecx, dword [esi]
test ecx, ecx
je 0x43ac94
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x43acab
push eax
call fcn.0048aaa1
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0048aa81
add esp, 8
test edi, edi
js 0x43acee
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048af00
mov esp, ebp
pop ebp
ret 4
push 0x8007000e
call fcn.0048bec0
push 0x8007000e
call fcn.0048bec0
call fcn.0043a3f0
mov ecx, eax
lea edx, [ebp - 0x44]
push edi
push edx
mov eax, dword [ecx]
call dword [eax + 8]
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 2
call fcn.0043a690
push 0x4da040
lea eax, [ebp - 0x58]
push eax
call fcn.0048c287
int3

Function at 0x43afb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x15
jb 0x43afb4
pop esi
mov byte [ecx + 0x19], 0
lea eax, [ecx + 4]
pop ebx
ret