joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4048c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x4049c4
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4049c4
push ebx
call fcn.0040cd80
add esp, 4
test eax, eax
je 0x40491a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x404921
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x404900
jmp 0x404923
mov esi, 0x1505
jmp 0x404923
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x4049c4
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404954
inc ebp
dec ebx
je 0x4049bf
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x4049bf
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x404950
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cd80
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404950
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cda0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404950
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x4049bf
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x4049c4
mov edi, dword [eax + 8]
jmp 0x4049c4
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4049d0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
push 0x2e
push ebp
call fcn.0040cdf0
add esp, 8
test eax, eax
je 0x404a34
mov esi, eax
jmp 0x404a14
mov ebp, esi
inc ebp
push 0x2e
push ebp
call fcn.0040cdf0
add esp, 8
mov esi, eax
test eax, eax
je 0x404a34
mov eax, esi
sub eax, ebp
push eax
push ebp
push edi
call fcn.00404440
add esp, 0xc
xor edi, edi
test eax, eax
je 0x404a00
cmp dword [eax + 4], 4
jne 0x404a00
mov edi, dword [eax + 8]
jmp 0x404a00
xor eax, eax
test edi, edi
je 0x404a9b
test ebp, ebp
je 0x404a9b
push ebp
call fcn.0040cd80
add esp, 4
test eax, eax
je 0x404a7b
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ebx]
test edx, edx
je 0x404a82
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebx
mov ecx, esi
cmp eax, ebx
jne 0x404a60
jmp 0x404a84
mov esi, 0x1505
jmp 0x404a84
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [edi + 0x20]
lea ebx, [ecx - 1]
mov eax, ecx
sub eax, 1
mov dword [esp + 0x14], eax
jae 0x404aa3
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, esi
mov dword [esp], edi
mov eax, dword [edi + 4]
mov dword [esp + 0x10], eax
jmp 0x404ac4
inc ebx
dec ecx
je 0x404a99
mov eax, ebx
and eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x404a99
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + edi*4], esi
jne 0x404ac0
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], ecx
call fcn.0040cd80
mov ecx, dword [esp + 0xc]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x404ac0
push dword [esp + 4]
push dword [esp + 0x10]
push ebp
call fcn.0040cda0
mov ecx, dword [esp + 0x14]
add esp, 0xc
test eax, eax
jne 0x404ac0
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x404a9b
Function at 0x404bc0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x404c2d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x404c2d
push esi
call fcn.0040cd80
add esp, 4
test eax, eax
je 0x404c0a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x404c11
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x404bf0
jmp 0x404c13
mov ebx, 0x1505
jmp 0x404c13
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x404c35
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404c44
inc ebp
dec edi
je 0x404c2b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x404c2b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x404c40
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cd80
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404c40
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cda0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404c40
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x404c2d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x404c2d
Function at 0x404f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x18]
xor eax, eax
test ebp, ebp
je 0x405188
mov edi, dword [esp + 0x1c]
test edi, edi
jle 0x405136
lea eax, [edi + ebp]
mov dword [esp], eax
mov edx, ebp
jmp 0x404f90
mov ebx, 1
add edx, ebx
cmp edx, dword [esp]
jae 0x405136
movzx ebx, byte [edx]
cmp ebx, 0xf4
ja 0x405186
mov ecx, ebx
and cl, 0xfe
cmp cl, 0xc0
je 0x405186
mov ecx, ebx
and ecx, 0xffffffc0
cmp ecx, 0x80
je 0x405186
mov ecx, ebx
xor ecx, 0xffffff7f
mov esi, ebx
or esi, 0x80
test esi, ecx
je 0x404f80
mov esi, ebx
and esi, 0xffffffe0
cmp esi, 0xc0
jne 0x405020
movzx eax, byte [edx + 1]
mov ecx, eax
not ecx
or ecx, 0xc0
add ecx, eax
cmp ecx, 0x7f
jne 0x405186
and ebx, 0x1f
shl ebx, 6
and eax, 0x3f
or eax, ebx
mov ebx, 2
xor ecx, ecx
cmp eax, 0x80
jae 0x4050f9
jmp 0x405186
mov ecx, ebx
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x405074
movzx ecx, byte [edx + 1]
mov edi, ecx
and edi, 0xffffffc0
cmp edi, 0x80
jne 0x405186
movzx edi, byte [edx + 2]
mov ebp, edi
and ebp, 0xffffffc0
cmp ebp, 0x80
jne 0x405186
and ebx, 0xf
shl ebx, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebx
lea eax, [edi + ecx]
add eax, 0xffffff80
mov ebx, 3
xor ecx, ecx
jmp 0x4050e6
mov ecx, ebx
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x405186
movzx ecx, byte [edx + 1]
mov edi, ecx
and edi, 0xffffffc0
cmp edi, 0x80
jne 0x405186
movzx ebp, byte [edx + 2]
mov edi, ebp
and edi, 0xffffffc0
cmp edi, 0x80
jne 0x405186
movzx eax, byte [edx + 3]
mov edi, eax
and edi, 0xffffffc0
cmp edi, 0x80
jne 0x405186
and ebx, 7
shl ebx, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebx
and ebp, 0x3f
or ebp, ecx
shl ebp, 6
and eax, 0x3f
or eax, ebp
mov cl, 1
mov ebx, 4
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
cmp eax, 0x80
jb 0x405186
cmp eax, 0x7ff
ja 0x405110
cmp esi, 0xc0
je 0x405124
jmp 0x405186
cmp eax, 0xffff
ja 0x40511d
test cl, cl
je 0x405124
jmp 0x405186
cmp eax, 0x10ffff
ja 0x405186
and eax, 0x1ff800
cmp eax, 0xd800
jne 0x404f85
jmp 0x405186
lea eax, [edi + 1]
push eax
call dword [0x44f008]
add esp, 4
test eax, eax
je 0x405186
mov esi, eax
mov byte [eax + edi], 0
push edi
push ebp
push eax
call fcn.0040cbf0
add esp, 0xc
push 0x10
call dword [0x44f008]
add esp, 4
test eax, eax
je 0x40517c
mov dword [eax], 0
mov dword [eax + 4], 2
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
jmp 0x405188
push esi
call dword [0x44f004]
add esp, 4
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405190
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x4052a2
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4052a2
cmp dword [esp + 0x2c], 0
je 0x4052a2
push esi
call fcn.0040cd80
add esp, 4
test eax, eax
je 0x4051fa
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x405201
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x4051e0
jmp 0x405203
mov ebx, 0x1505
jmp 0x405203
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x4052aa
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405267
call fcn.00405ec0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x4052a2
push ecx
call fcn.0040cd80
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x40531d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4052c8
inc edi
dec esi
je 0x40521c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405221
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4052c0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040cd80
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4052c0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040cda0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4052c0
mov eax, 0xffffffff
jmp 0x4052a2
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405338
inc edi
dec esi
je 0x405262
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405267
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405330
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040cd80
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405330
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040cda0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405330
jmp 0x405267
Function at 0x405c10
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405dfa
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405dfa
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405dfa
cmp dword [ecx], 0
jne 0x405dfa
push esi
call fcn.0040cd80
add esp, 4
test eax, eax
je 0x405c7a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405c81
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405c60
jmp 0x405c83
mov edi, 0x1505
jmp 0x405c83
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x405d54
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405ce1
call fcn.00405ec0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405dfa
push esi
call fcn.0040cd80
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405e10
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040cd80
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x44f008]
add esp, 4
test eax, eax
je 0x405df5
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040cbf0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405dfa
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405d78
inc ebx
dec edx
je 0x405c9c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405ca1
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405d70
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040cd80
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405d70
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040cda0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405d70
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404d20
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405d49
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406ef0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x407096
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40708f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406f85
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x40708f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406ffe
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406fa0
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406f4d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x407040
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x407020
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406f40
jmp 0x40704f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406f40
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x407060
jmp 0x406f40
shl ecx, 0x10
or ecx, edi
jmp 0x40709b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4070b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x407109
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x40710b
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44cc50]
mov eax, ebx
shr eax, 4
mov ebp, ebx
not ebp
or ebp, 0xf
add ebx, ebp
inc ebx
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44cc50]
inc esi
cmp edx, esi
jne 0x4070d0
not eax
jmp 0x40710b
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cbf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov esi, ecx
mov edx, ecx
not edx
or edx, 3
lea ebx, [ecx + edx]
inc ebx
shr ecx, 2
and esi, 0xfffffffc
mov edx, eax
add edx, esi
add esi, edi
mov ebp, edi
mov edi, eax
xchg esi, ebp
rep movsd dword es:[edi], dword [esi]
xchg esi, ebp
mov ecx, ebx
shr ecx, 1
mov ebp, esi
mov edi, edx
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
mov edi, ebx
xor edi, 0xfffffffe
mov ebp, ebx
or ebp, 1
and ebp, edi
je 0x40ccdd
and ebx, 0xfffffffe
add esi, ebx
add edx, ebx
mov edi, ebp
and edi, 7
je 0x40cc7b
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esi + ebx]
mov byte [edx + ebx], cl
inc ebx
cmp edi, ebx
jne 0x40cc60
add esi, ebx
add edx, ebx
mov edi, ebp
sub edi, ebx
cmp ebp, 8
jae 0x40cc82
jmp 0x40ccdd
mov edi, ebp
cmp ebp, 8
jb 0x40ccdd
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esi + ecx]
mov byte [edx + ecx], bl
movzx ebx, byte [esi + ecx + 1]
mov byte [edx + ecx + 1], bl
movzx ebx, byte [esi + ecx + 2]
mov byte [edx + ecx + 2], bl
movzx ebx, byte [esi + ecx + 3]
mov byte [edx + ecx + 3], bl
movzx ebx, byte [esi + ecx + 4]
mov byte [edx + ecx + 4], bl
movzx ebx, byte [esi + ecx + 5]
mov byte [edx + ecx + 5], bl
movzx ebx, byte [esi + ecx + 6]
mov byte [edx + ecx + 6], bl
movzx ebx, byte [esi + ecx + 7]
mov byte [edx + ecx + 7], bl
add ecx, 8
cmp edi, ecx
jne 0x40cc90
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d2c0
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00444380
test al, al
je 0x40d4ae
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043bca0
test al, al
je 0x40d4a9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0xbe854845
mov dword [esp + 8], 0x6a609e62
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40d346
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d4c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40d320
mov dword [esp + 4], 0x862f65a5
mov dword [esp + 8], 0x982f4aa3
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40d396
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d540
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40d370
test esi, esi
je 0x40d446
mov dword [esp + 4], 0x4f4e4929
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x40d3f6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d5d0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x40d3d0
mov dword [esp + 4], 0x37a10771
mov dword [esp + 8], 0xe9fcd02a
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40d446
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d650
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40d420
mov dword [esp + 4], 0x76757473
mov dword [esp + 8], 0x7a797877
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40d496
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d6e0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40d470
call fcn.0040eda0
test al, al
je 0x40d4a9
call fcn.00412410
call fcn.004107f0
call fcn.00445bb0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40e460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov al, byte [esp + 0x1c]
test esi, esi
sets bl
mov edi, esi
sub edi, 1
sete bh
or bl, bh
mov edi, esi
sub edi, 0x25
setge bh
or bl, bh
test bl, 1
jne 0x40e496
jmp 0x40e49b
jmp 0x40e5f3
movzx ebx, al
mov edi, ecx
add edi, edx
add edi, 0xffffffff
mov byte [ecx + edx - 1], 0
cmp ebx, 0
sete cl
test cl, 1
jne 0x40e4b7
jmp 0x40e4c5
mov ecx, edi
add ecx, 0xffffffff
mov byte [edi - 1], 0x30
jmp 0x40e5f3
cmp esi, 0xa
jne 0x40e56b
jmp 0x40e4d0
movzx esi, al
cmp esi, 0x64
setae al
test al, 1
jne 0x40e4df
jmp 0x40e532
mov ecx, 0x64
mov eax, esi
xor edx, edx
div ecx
mov eax, edx
xor eax, 0xffffffff
and eax, 2
mov ecx, edx
and ecx, 0xfffffffd
imul ecx, eax
mov eax, edx
and eax, 2
or edx, 2
imul edx, eax
add edx, ecx
mov al, byte [edx + 0x44d761]
mov ecx, edi
add ecx, 0xffffffff
mov byte [edi - 1], al
mov al, byte [edx + 0x44d760]
add ecx, 0xffffffff
mov byte [edi - 2], al
mov edi, 0x64
mov eax, esi
xor edx, edx
div edi
mov edi, ecx
jmp 0x40e4d0
cmp esi, 0xa
jae 0x40e548
mov al, byte [esi + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov ecx, edi
add ecx, 0xffffffff
mov byte [edi - 1], al
jmp 0x40e566
shl esi, 1
mov al, byte [esi + 0x44d761]
mov ecx, edi
add ecx, 0xffffffff
mov byte [edi - 1], al
mov al, byte [esi + 0x44d760]
add ecx, 0xffffffff
mov byte [edi - 2], al
jmp 0x40e5f3
cmp esi, 0x10
sete cl
test cl, 1
jne 0x40e57a
jmp 0x40e578
jmp 0x40e5c2
movzx eax, al
cmp eax, 0x10
setl cl
jmp 0x40e585
test cl, 1
jne 0x40e58c
jmp 0x40e59d
mov al, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov ecx, edi
add ecx, 0xffffffff
mov byte [edi - 1], al
jmp 0x40e5f3
shl eax, 1
jmp 0x40e5a1
lea edx, str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF
add edx, eax
mov al, byte [eax + 0x44d82a]
mov ecx, edi
add ecx, 0xffffffff
mov byte [edi - 1], al
mov al, byte [edx]
add ecx, 0xffffffff
mov byte [edi - 2], al
jmp 0x40e5f3
movzx ecx, al
cmp ecx, 0
seta al
test al, 1
jne 0x40e5d1
jmp 0x40e5ef
mov eax, ecx
xor edx, edx
div esi
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
add edi, 0xffffffff
jmp 0x40e5e3
mov byte [edi], al
mov eax, ecx
xor edx, edx
div esi
jmp 0x40e5ed
jmp 0x40e5c2
mov ecx, edi
jmp 0x40e5f3
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
ret