joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4095d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, esi
jbe 0x40962e
lea ecx, [esi + ebx]
cmp ecx, eax
jbe 0x40962e
test ebx, ebx
je 0x4096cd
lea ecx, [eax + ebx]
dec ecx
lea edx, [esi + ebx]
dec edx
mov edi, ebx
and edi, 7
je 0x409672
mov ebp, ebx
neg edi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
mov byte [ecx + esi], bl
dec esi
cmp edi, esi
jne 0x409610
add edx, esi
add ecx, esi
mov ebx, ebp
add esi, ebp
cmp ebx, 8
jae 0x409679
jmp 0x4096cd
mov ecx, ebx
shr ecx, 2
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, ebx
xor ecx, 3
mov ebp, ebx
or ebp, 0xfffffffc
and ebp, ecx
lea edx, [eax + ebp]
add ebp, esi
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov esi, ebp
mov edi, edx
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
je 0x4096cd
and ebx, 2
movzx ecx, byte [ebp + ebx]
mov byte [edx + ebx], cl
jmp 0x4096cd
mov esi, ebx
cmp ebx, 8
jb 0x4096cd
neg esi
xor edi, edi
nop
nop
nop
movzx ebx, byte [edx + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [edx + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [edx + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [edx + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [edx + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [edx + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [edx + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [edx + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp esi, edi
jne 0x409680
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x409d50
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, dword [esp + 8]
mov dword [0x4495cc], edx
mov eax, 0xfffffd92
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x6c078965
mov esi, ecx
or ecx, 0x6c078965
imul ecx, edx
xor edx, 0x6c078965
and esi, 0x93f8769a
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x26f
mov dword [eax*4 + 0x449f88], edx
test eax, eax
je 0x409ddf
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x6c078965
mov esi, ecx
or ecx, 0x6c078965
imul ecx, edx
xor edx, 0x6c078965
and esi, 0x93f8769a
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x270
mov dword [eax*4 + 0x449f8c], edx
add eax, 2
jmp 0x409d60
mov dword [0x4495c8], 0x270
pop esi
ret
Function at 0x409df0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [0x4495c8]
cmp eax, 0x270
jne 0x409e54
mov eax, 0xfffff640
mov edx, dword [0x4495cc]
jmp 0x409e3d
and edx, 0x80000000
mov edi, ecx
and edi, 0x7ffffffe
or edi, edx
shr edi, 1
xor esi, dword [eax + 0x44a5c0]
xor esi, edi
xor esi, 0x663bb6b0
mov dword [eax + 0x44a94c], esi
mov edx, ecx
add eax, 4
je 0x409e6c
mov ecx, dword [eax + 0x449f90]
mov esi, 0x663bb6b0
test cl, 1
je 0x409e10
mov esi, 0xff33066f
jmp 0x409e10
cmp eax, 0x4e0
jb 0x409e71
mov ecx, 0x4495c8
call fcn.0040a060
mov eax, dword [0x4495c8]
jmp 0x409e71
mov eax, 0x270
lea ecx, [eax + 1]
mov dword [0x4495c8], ecx
mov eax, dword [eax*4 + 0x4495cc]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [0x44a94c]
xor ecx, eax
mov eax, ecx
shl eax, 7
mov edx, eax
not edx
or edx, 0x9d2c5680
add eax, edx
inc eax
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc40000
xor ecx, eax
shr ecx, 0x12
and eax, 0x7fff
xor eax, ecx
pop esi
pop edi
ret

Function at 0x409ec0
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x214
call fcn.0043ad70
test al, al
je 0x40a04e
lea eax, [esp + 0xc]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.004342b0
test al, al
je 0x40a049
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, 0x52ed6a30
mov esi, 0x3de61c72
mov ecx, ebx
shrd esi, ebp, cl
mov dword [esp + 8], eax
shr ebp, cl
test bl, 0x20
je 0x409f21
mov esi, ebp
xor ebp, ebp
xor esi, 0x3de61c72
xor ebp, 0x52ed6a30
mov eax, esi
and eax, 0x7e1cb1b4
mov dword [esp], eax
mov ecx, ebp
and ecx, 0x71e2ffca
mov ebx, esi
and ebx, 0x81e34e4b
mov edi, ebx
xor edi, 0x81e34e4b
mov eax, edi
imul edi, ecx
mul dword [esp]
mov dword [esp + 4], eax
mov ecx, ebp
and ecx, 0xe1d0035
or esi, 0x81e34e4b
mov eax, esi
imul esi, ecx
xor ecx, 0xe1d0035
imul ecx, dword [esp]
add ecx, edx
add ecx, edi
mul ebx
add esi, edx
or ebp, 0xe1d0035
imul ebp, ebx
add ebp, esi
add eax, dword [esp + 4]
adc ebp, ecx
mov edi, ebp
shr edi, 0x15
xor edi, ebp
mov esi, ebp
shld esi, eax, 0xb
xor esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40a025
mov eax, esi
and eax, 0xec88ffdc
mov dword [esp], eax
mov ebp, edi
and ebp, 0x8f74d447
mov ebx, esi
and ebx, 0x13770023
mov ecx, edi
and ecx, 0x708b2bb8
mov eax, ebx
xor eax, 0x13770023
imul ebp, eax
mul dword [esp]
mov dword [esp + 4], eax
or esi, 0x13770023
mov eax, esi
imul esi, ecx
xor ecx, 0x708b2bb8
imul ecx, dword [esp]
add ecx, edx
mul ebx
add ecx, ebp
add esi, edx
or edi, 0x708b2bb8
imul edi, ebx
add edi, esi
add eax, dword [esp + 4]
adc edi, ecx
mov esi, eax
mov ecx, dword [esp + 8]
shrd esi, edi, cl
mov edx, edi
shr edx, cl
test cl, 0x20
je 0x40a021
mov esi, edx
xor edx, edx
xor edi, edx
xor esi, eax
or edi, 0x1010101
or esi, 0x1010101
push edi
push esi
call fcn.0040b1c0
add esp, 8
test al, al
je 0x40a049
call fcn.0040e2b0
call fcn.0040cf20
call fcn.0043c2b0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40a060
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
and edi, 0x80000000
mov esi, dword [ecx + eax*4 - 0x630]
mov edx, esi
and edx, 0x7ffffffe
or edx, edi
shr edx, 1
mov edi, esi
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, edx
mov edx, dword [ecx + eax*4]
mov ebx, esi
and ebx, edx
add esi, edx
add ebx, ebx
sub esi, ebx
mov dword [ecx + eax*4 - 0xff4], esi
inc eax
cmp eax, 0x4e1
jne 0x40a070
mov eax, 0xe3
mov edx, SysReAllocString
nop
nop
mov ebx, dword [ecx + eax*4 + 0x9c4]
and ebx, edx
mov esi, dword [ecx + eax*4 + 0x9c8]
mov edi, esi
and edi, 0x7ffffffe
or edi, ebx
and esi, 1
neg esi
and esi, 0x9908b0df
mov ebx, eax
or ebx, 0x3ffffd8f
mov ebp, eax
and ebp, 0x18f
add ebp, ebx
xor esi, dword [ecx + ebp*4 + 0x63c]
shr edi, 1
xor esi, edi
mov dword [ecx + eax*4 + 4], esi
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
cmp eax, 0x26f
jb 0x40a0c0
mov edx, SysReAllocString
and edx, dword [ecx + 4]
mov eax, dword [ecx + 0x1380]
mov esi, eax
not esi
or esi, 0x80000000
add eax, esi
inc eax
or eax, edx
mov edx, eax
shr edx, 1
and eax, 1
neg eax
xor edx, dword [ecx + 0x634]
and eax, 0x9908b0df
xor edx, eax
mov dword [ecx + 0x9c0], edx
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx eax, word [esi]
lea edx, [esp + 4]
test ax, ax
je 0x40a462
mov edi, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea eax, [esi + 2]
cmp bx, 0x7f
ja 0x40a350
lea ebp, [edx + 1]
mov byte [edx], bl
jmp 0x40a400
cmp ebx, 0x7ff
ja 0x40a380
cmp edi, 2
jb 0x40a380
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [edx], cl
lea ebp, [edx + 2]
and bl, 0x3f
or bl, 0x80
mov byte [edx + 1], bl
jmp 0x40a400
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x40a41a
cmp edi, 4
jb 0x40a41a
movzx eax, word [esi + 2]
add esi, 4
shl ebx, 0xa
mov ecx, eax
xor ecx, 0xdc00
and eax, 0x23ff
add eax, eax
sub eax, ecx
lea ecx, [ebx + eax]
add ecx, 0xfca00000
mov ebp, edx
lea edx, [ebx + eax]
add edx, 0xfca10000
mov ebx, edx
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
shr edx, 0xc
and dl, 0x3f
or dl, 0x80
mov byte [ebp + 1], dl
mov edx, ebp
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 2], cl
and al, 0x3f
or al, 0x80
add ebp, 4
mov byte [edx + 3], al
mov eax, esi
nop
nop
nop
add edi, edx
sub edi, ebp
mov esi, eax
mov edx, ebp
movzx eax, word [esi]
test ax, ax
je 0x40a462
test edi, edi
jne 0x40a330
jmp 0x40a462
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x40a429
mov esi, eax
jmp 0x40a408
cmp edi, 3
jb 0x40a45e
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [edx], cl
mov esi, edx
mov edx, ebx
shr edx, 6
mov ecx, edx
not ecx
or ecx, 0x3f
add ecx, edx
mov edx, esi
add cl, 0x81
mov byte [esi + 1], cl
and bl, 0x3f
or bl, 0x80
lea ebp, [esi + 3]
mov byte [esi + 2], bl
jmp 0x40a400
mov ebp, edx
jmp 0x40a400
mov esi, dword [esp + 0x420]
mov eax, edx
mov edx, dword [esp + 0x41c]
mov byte [eax], 0
xor eax, eax
jmp 0x40a488
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x40a480
test ecx, ecx
je 0x40a49c
mov ebx, ecx
jmp 0x40a480
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00404e20
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40b1c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1bc
push eax
sub esp, 0xfc
mov eax, esp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], eax
push eax
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x18], esp
sub esp, 0x70
mov ebx, esp
sub esp, 0x28
mov dword [ebp - 0x20], esp
sub esp, 0xc
mov dword [ebp - 0x30], esp
sub esp, 0x40
mov dword [ebp - 0x34], esp
sub esp, 0x80
mov dword [ebp - 0x38], esp
mov eax, dword [0x44a9a8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], 0x23223920
mov word [ebp - 0x28], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx edi, byte [ebp + ecx - 0x2c]
mov esi, ecx
or esi, 0xc1fbda08
mov edx, esi
or edx, edi
and esi, edi
sub edx, esi
add dl, 0xd8
mov byte [ebp + ecx - 0x2c], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 6
jb 0x40b220
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c8], 0x31cb3fb5
mov dword [ebp - 0x1c4], 0x35d33302
mov dword [ebp - 0x1c0], 0xc9043701
mov dword [ebp - 0x1bc], 0xcd2ecbf6
mov dword [ebp - 0x1b8], 0xc132cf30
mov word [ebp - 0x1b4], 0xc3c0
mov dword [ebp - 0x1b2], 0
mov word [ebp - 0x1ae], 0
xor edx, edx
nop
mov eax, edx
add al, 0x75
xor al, byte [ebp + edx - 0x1c8]
add al, 0xb7
mov byte [ebp + edx - 0x1c8], al
mov eax, edx
not eax
or eax, 1
add eax, edx
or edx, 1
add edx, eax
inc edx
cmp edx, 0x1c
jb 0x40b2a0
lea eax, [ebp - 0x1c8]
push ecx
push 0
push eax
call dword [ebp - 0x10]
mov ecx, 0x44a9ac
push eax
call fcn.0043ace0
movzx eax, al
mov eax, dword [eax*4 + 0x444a38]
mov ecx, 0xac31e54
xor ecx, dword [0x444a40]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x40bd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
movzx ebx, byte [edx]
test bl, bl
je 0x40bfab
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40bd7c
cmp edx, esi
jae 0x40bfab
test edi, edi
je 0x40bfab
movzx ebp, bl
test bl, bl
js 0x40bdb0
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x28]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40bd70
jmp 0x40bfab
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40bdec
cmp bl, 0xc2
jb 0x40bda0
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40be5b
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40bead
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40be16
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40be65
cmp ebp, 0xe0
jne 0x40be6e
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40bd9c
jmp 0x40be6e
mov ecx, ebp
xor ecx, 0xffffff07
mov esi, ebp
or esi, 0xf8
and esi, ecx
cmp esi, 0xf0
jne 0x40bf8a
cmp bl, 0xf4
ja 0x40bd9c
movzx ecx, byte [edx + 1]
je 0x40beb8
cmp ebp, 0xf0
jne 0x40bec1
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40bd9c
jmp 0x40bec1
inc edx
mov esi, dword [esp + 0x28]
jmp 0x40bda2
cmp cl, 0x9f
ja 0x40bd9c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40bf91
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40bf97
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40bd92
cmp cl, 0x8f
ja 0x40bd9c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40bf91
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40bf97
mov dword [esp], ebp
movzx ebp, byte [edx + 3]
mov esi, ebp
not esi
or esi, 0xc0
mov dword [esp + 4], ebp
add esi, ebp
cmp esi, 0x7f
jne 0x40bfa3
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
mov ebp, dword [esp]
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ecx, ebp
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x40bd9c
mov ebx, dword [esp + 4]
and ebx, 0x3f
or ebx, ebp
cmp ebx, 0x10000
mov esi, dword [esp + 0x28]
jb 0x40bda0
cmp edi, 2
jb 0x40bf8a
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
and ebx, 0x3ff
or ebx, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bx
jmp 0x40bd92
mov ecx, eax
jmp 0x40bd92
inc edx
jmp 0x40bd9c
add edx, 2
mov esi, dword [esp + 0x28]
jmp 0x40bda2
add edx, 3
jmp 0x40bd9c
mov word [eax], 0
sub eax, dword [esp + 0x1c]
sar eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cf50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov dword [esp + 0x38], 0x118f1fe3
mov dword [esp + 0x3c], 0x1589139a
mov dword [esp + 0x40], 0x98a1788
mov dword [esp + 0x44], 0xddb0beb
mov dword [esp + 0x48], 0x1d00fdb
mov dword [esp + 0x4c], 0x52203d0
mov dword [esp + 0x50], 0x39ef07dc
mov dword [esp + 0x54], 0x3da43ba3
mov dword [esp + 0x58], 0x31af3fd8
mov dword [esp + 0x5c], 0x35a733b9
mov dword [esp + 0x60], 0x29c83714
mov dword [esp + 0x64], 0x2d0a2bdc
mov dword [esp + 0x68], 0x21fe2fff
mov dword [esp + 0x6c], 0x25f223fe
mov dword [esp + 0x70], 0xd90627e9
mov dword [esp + 0x74], 0xdd41db31
mov dword [esp + 0x78], 0xd108df42
mov dword [esp + 0x7c], 0xd51fd304
mov dword [esp + 0x80], 0xc95ed7f4
mov dword [esp + 0x84], 0xcd1ecb1e
mov dword [esp + 0x88], 0xc1eecf17
mov dword [esp + 0x8c], 0xc552c303
mov dword [esp + 0x90], 0xf95ac754
mov dword [esp + 0x94], 0xfd13fb1f
mov dword [esp + 0x98], 0xf11cff1b
mov dword [esp + 0x9c], 0xf569f30d
mov dword [esp + 0xa0], 0xe927f760
mov dword [esp + 0xa4], 0xed3feb3f
mov dword [esp + 0xa8], 0xe130ef25
mov dword [esp + 0xac], 0xe534e335
mov dword [esp + 0xb0], 0x993ee7c4
mov dword [esp + 0xb4], 0x9d629b65
mov dword [esp + 0xb8], 0x91619f68
mov dword [esp + 0xbc], 0x954e936c
mov dword [esp + 0xc0], 0x890a97b4
mov dword [esp + 0xc4], 0x8d178b13
mov dword [esp + 0xc8], 0x81ae8f6b
mov dword [esp + 0xcc], 0x85658379
mov dword [esp + 0xd0], 0xb91b8761
mov dword [esp + 0xd4], 0xbd61bb29
mov dword [esp + 0xd8], 0xb17bbf9c
mov dword [esp + 0xdc], 0xb520b328
mov dword [esp + 0xe0], 0xa929b725
mov dword [esp + 0xe4], 0xad7bab4f
mov dword [esp + 0xe8], 0xa17daf7f
mov dword [esp + 0xec], 0xa57ca36b
mov dword [esp + 0xf0], 0x5978a774
mov dword [esp + 0xf4], 0x5d845b88
mov dword [esp + 0xf8], 0x517e5f8c
mov dword [esp + 0xfc], 0x55b153a5
mov dword [esp + 0x100], 0x49b557b2
mov dword [esp + 0x104], 0x4dd14bda
mov dword [esp + 0x108], 0x41994f9d
mov dword [esp + 0x10c], 0x458b4395
mov dword [esp + 0x110], 0x7993479a
mov dword [esp + 0x114], 0x7d7a7bae
mov word [esp + 0x118], 0
mov eax, dword [0x44a978]
mov dword [esp], eax
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx + 0x38]
mov eax, ecx
and eax, 0x18a
mov esi, edx
xor esi, 0xb64af0c5
add esi, eax
mov ebp, ebx
and ebp, esi
mov edi, ebp
and edi, 0xfffffffd
mov eax, ebp
or eax, 0xfd
inc eax
imul eax, edi
mov edi, ebp
and edi, 2
or ebp, 2
imul ebp, edi
sub eax, ebp
add eax, esi
add al, bl
add al, 0x27
mov byte [esp + edx + 0x38], al
inc edx
add ecx, 2
cmp edx, 0xe2
jne 0x40d1b0
lea ebp, [esp + 0x38]
push 0
push 0
push 0
push 0
push ebp
call dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x444e28]
mov ecx, 0xbafc402c
xor ecx, dword [0x444e30]
add ecx, edx
inc ecx
jmp ecx
Function at 0x415430
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edi + 2], 0
lea edi, [edi + 2]
jne 0x415450
mov esi, dword [ecx]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x415470
sar edi, 1
mov ecx, eax
sar ecx, 1
and eax, 2
xor ecx, 1
add eax, edi
lea edx, [ecx + eax]
inc edx
test edx, edx
jns 0x415498
mov eax, 0xffffffff
jmp 0x4154a1
add eax, ecx
lea eax, [eax*2 + 2]
push eax
call fcn.00409550
add esp, 4
movzx ecx, word [esi]
mov ebx, eax
test cx, cx
je 0x4154d1
add esi, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x4154c0
mov word [ebx], 0x5c
add ebx, 2
mov edx, dword [esp + 0x3c]
movzx ecx, word [edx]
test cx, cx
mov dword [esp + 0xc], eax
je 0x415501
add edx, 2
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4154f0
mov word [ebx], 0
lea eax, [esp + 0x10]
xor ebx, ebx
push 0x60
push 7
push 0x120089
push eax
push dword [esp + 0x1c]
call fcn.0043ec70
add esp, 0x14
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 4], 0x713e3ff9
mov dword [esp + 8], 0
xor ecx, ecx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, ecx
and ebp, 0xa
mov edx, esi
xor edx, 0x75
add edx, ebp
xor dl, byte [esp + esi + 4]
add dl, 0xb7
mov byte [esp + esi + 4], dl
inc esi
add ecx, 2
cmp esi, 8
jne case.default.0x415579
xor ecx, ecx
cmp eax, dword [esp + 4]
sete cl
jmp dword [ecx*4 + 0x4454d0]
mov dword [esp + 0x14], 0xe3222174
mov word [esp + 0x18], 0
jmp dword [0x4454e4]
xor ecx, ecx
cmp ecx, 5
ja 0x4155e2
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x14]
mov edx, ecx
or edx, 8
and edx, esi
add edx, edx
add esi, ecx
add esi, 0xc1fbda08
mov ebp, esi
not ebp
and ebp, edx
not edx
and edx, esi
sub edx, ebp
add dl, 0xd8
mov byte [esp + ecx + 0x14], dl
add ecx, 0xe974dfc7
mov edx, ecx
and edx, 0xa
xor ecx, 0x168b203a
lea ecx, [ecx + edx*2]
cmp ecx, 5
jbe 0x4155a0
xor ecx, ecx
cmp eax, dword [esp + 0x14]
sete cl
jmp dword [ecx*4 + 0x4454e8]
mov ecx, eax
not ecx
shr ecx, 0x1f
jmp dword [ecx*4 + 0x4454f0]
push 0x1388
mov esi, dword [esp + 0x10]
push esi
call fcn.00437a30
add esp, 8
push 0x60
push 7
push 0x120089
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.0043ec70
add esp, 0x14
mov ecx, eax
not ecx
shr ecx, 0x1f
jmp dword [ecx*4 + 0x4454f0]
xor edx, edx
cmp ebx, 0xa
setb dl
jmp dword [edx*4 + 0x4454f8]
inc ebx
jmp 0x415530
jmp dword [ecx*4 + 0x445500]
Function at 0x4158b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x438
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax], 0
lea eax, [eax + 2]
jne 0x4158d0
add eax, edi
add eax, 0xfffffffe
mov ecx, edi
not ecx
and ecx, eax
xor eax, edi
add ecx, ecx
sub ecx, eax
mov eax, ecx
sar eax, 1
mov dword [esp + 0xe4], eax
cmp eax, 0xfffffff2
mov dword [esp + 0xe0], ecx
jge 0x415909
mov eax, 0xffffffff
jmp 0x41590c
lea eax, [ecx + 0x1c]
push eax
call fcn.00409550
add esp, 4
mov ebx, eax
mov dword [esp + 0x10c], 0x34e015c
mov dword [esp + 0x110], 0x7750565
mov dword [esp + 0x114], 0xb2a097c
mov dword [esp + 0x118], 0xf6b0d5a
mov dword [esp + 0x11c], 0x13611162
mov dword [esp + 0x120], 0x1779157d
mov dword [esp + 0x124], 0x1b1a1976
mov word [esp + 0x128], 0
mov byte [esp + 0x12a], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x10c]
mov edx, eax
xor edx, 0x80
mov esi, ecx
and esi, eax
add esi, esi
sub edx, esi
add dl, cl
add dl, 0x80
mov byte [esp + eax + 0x10c], dl
inc eax
cmp eax, 0x1f
jne 0x415980
movzx ecx, word [edi]
mov eax, ebx
test cx, cx
je 0x4159d1
add edi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4159c0
mov word [eax], 0
movzx ecx, word [esp + 0x10c]
test cx, cx
je 0x415a01
lea edx, [esp + 0x10e]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4159f0
mov word [eax], 0
lea eax, [esp + 0x2b0]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043ec70
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4459fc]
Function at 0x41f760
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp], 0x2322215a
mov word [esp + 4], 0
mov ecx, 0xc1fbda08
mov edx, 0x3e0425f7
nop
nop
movzx esi, byte [esp + ecx + 0x3e0425f8]
lea ebx, [edx - 0x3e042500]
or ebx, esi
mov edi, ecx
and edi, esi
xor esi, edx
sub edi, esi
add edi, edx
not ebx
or ebx, edi
add bl, 0xd8
mov byte [esp + ecx + 0x3e0425f8], bl
inc ecx
dec edx
cmp ecx, 0xc1fbda0e
jne 0x41f7a0
lea ecx, [esp + 8]
mov edx, esp
push ecx
push 0x421200
push edx
push dword [eax + 8]
call fcn.004215f0
add esp, 0x28
pop esi
pop edi
pop ebx
ret
Function at 0x421320
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x421330
cmp eax, 0xffffffed
jge 0x421347
mov eax, 0xffffffff
jmp 0x42134a
add eax, 0x12
push eax
call fcn.00409550
add esp, 4
mov esi, eax
mov dword [esp], 0x8f318924
mov dword [esp + 4], 0x830b8d29
mov dword [esp + 8], 0x87f481f4
mov dword [esp + 0xc], 0x9b3c8520
mov word [esp + 0x10], 0x9998
mov dword [esp + 0x12], 0
mov word [esp + 0x16], 0
xor eax, eax
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa2
xor cl, byte [esp + eax]
add cl, 0xd6
mov byte [esp + eax], cl
inc eax
cmp eax, 0x18
jne 0x421390
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x4213d1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4213c0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x421401
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4213f0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043ee10
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x446120]