joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53a120
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x53a15f
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
pop ebp
ret

Function at 0x53dacc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x552800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x624500]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x552830
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053a175
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x55286c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x55286c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053a175
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x552951
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x552894
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5528c7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00597168
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053a175
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x552951
cmp eax, 1
jle 0x552924
cmp eax, 3
jne 0x552951
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00551840
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053a175
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x552941
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.005963e1
add esp, 0x10
cmp edi, eax
jne 0x552951
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x552857
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053a175
mov esp, ebp
pop ebp
ret 4
Function at 0x553390
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x5533b4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00553480
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x5533d5
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x5533d7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x55345f
jg 0x5533ea
test esi, esi
je 0x55345f
test ecx, ecx
jl 0x55342c
jg 0x5533f4
test eax, eax
je 0x55342c
cmp ebx, ecx
jg 0x553406
jl 0x5533fe
cmp esi, eax
jae 0x553406
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0058cfa0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x553432
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x55345f
jg 0x55343c
test esi, esi
je 0x55345f
cmp dword [edi + 0x4c], 0
je 0x55345f
mov ecx, edi
call fcn.00552170
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.005a435b
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x553550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x553574
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00553630
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x553595
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x553597
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x553614
jg 0x5535aa
test esi, esi
je 0x553614
test ecx, ecx
jl 0x5535ee
jg 0x5535b4
test eax, eax
je 0x5535ee
cmp edi, ecx
jg 0x5535c6
jl 0x5535be
cmp esi, eax
jae 0x5535c6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.0058cfa0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x5535f1
mov edx, dword [ebp + 8]
test edi, edi
jl 0x553614
jg 0x5535fb
test esi, esi
je 0x553614
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x553614
push eax
push esi
push 1
push edx
call fcn.005963e1
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x586430
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov eax, dword [ebx - 4]
test ebp, ebp
jle 0x58649a
mov ecx, dword [esp + 0xc]
sub ecx, ebx
push esi
mov dword [esp + 0x10], ecx
push edi
nop dword [eax]
mov esi, dword [ecx + ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov edi, esi
and edi, 0xffff00ff
and ecx, 0xffff00ff
add edi, ecx
mov edx, esi
movzx ecx, ax
and edx, 0xff00
add edx, ecx
and eax, 0xff00ffff
mov ecx, dword [esp + 0x14]
xor edi, edx
and esi, 0xff00ff00
and edi, 0xff00ff
add eax, esi
xor eax, edi
mov dword [ebx - 4], eax
sub ebp, 1
jne 0x586450
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x5864a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jle 0x586514
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
sub ecx, eax
sub dword [esp + 0x14], eax
push ebx
push esi
mov dword [esp + 0x14], ecx
push edi
nop
mov ebx, dword [ecx + eax]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov ecx, ebx
and ecx, 0xffff00ff
mov edi, esi
and edi, 0xffff00ff
mov edx, esi
add edi, ecx
and edx, 0xff00
movzx ecx, bx
and esi, 0xff00ff00
add edx, ecx
and ebx, 0xff00ffff
mov ecx, dword [esp + 0x20]
xor edi, edx
and edi, 0xff00ff
add ebx, esi
xor edi, ebx
mov dword [ecx + eax - 4], edi
mov ecx, dword [esp + 0x18]
sub ebp, 1
jne 0x5864c0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5b5e12
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005b5c91

Function at 0x5b90cd
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005b8d8d
Function at 0x402e60
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402e9a
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0x402ea1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0x402e80
jmp 0x402ea3
mov eax, 0x1505
jmp 0x402ea3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x403570
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x403726
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40371f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x403605
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x40371f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x403685
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
mov edi, eax
and edi, esi
xor eax, esi
lea eax, [eax + edi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 2]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 3]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 4]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 5]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 6]
add esi, eax
add ecx, esi
movzx edi, byte [ebp + edx + 7]
add edi, esi
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x403620
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x4035cd
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x4036d0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x4036b0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4035c0
jmp 0x4036df
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4035c0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x4036f0
jmp 0x4035c0
shl ecx, 0x10
or ecx, edi
jmp 0x40372b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403740
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4037b5
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x4037b7
not eax
xor esi, esi
nop
nop
nop
nop
movzx edx, byte [ecx + esi]
mov ebx, eax
xor ebx, 0x3ffffff0
mov ebp, eax
or ebp, 0xf
and ebp, ebx
mov edi, edx
and edi, 0xf
or ebp, edi
and edi, eax
mov ebx, eax
shr ebx, 4
sub ebp, edi
xor ebx, dword [ebp*4 + 0x43f80c]
mov eax, ebx
mov edi, ebx
xor edi, 0x3ffffff0
or ebx, 0xf
and ebx, edi
shr edx, 4
xor edx, ebx
shr eax, 4
xor eax, dword [edx*4 + 0x43f80c]
mov edx, dword [esp + 0x1c]
inc esi
cmp edx, esi
jne 0x403760
not eax
jmp 0x4037b7
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40878b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x408793
mov word [ebx], 1
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x40882b
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x4087d9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x40883a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x4087ee
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x408800
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x4087c0
jmp 0x408809
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x4087c0
cmp edi, ebx
jge 0x408820
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x4087c4
jmp 0x408824
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x4087cd
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp fcn.004088c2
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl fcn.004088c2
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x408874
mov esi, edi

Function at 0x409390
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov eax, dword [0x446f48]
cmp eax, 0x270
jne 0x4093fc
mov eax, 0x270
mov ecx, 0x80000000
mov edx, 0x270
nop
nop
mov ebx, dword [edx*4 + 0x44658c]
and ebx, ecx
mov esi, dword [edx*4 + 0x446590]
mov edi, esi
and edi, 0x7ffffffe
or edi, ebx
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, dword [edx*4 + 0x446bc0]
shr edi, 1
xor esi, edi
mov dword [edx*4 + 0x446f4c], esi
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
cmp edx, 0x4e0
jb 0x4093b0
jmp 0x409412
cmp eax, 0x4e0
jb 0x409412
mov ecx, 0x446f48
call fcn.00409750
mov eax, dword [0x446f48]
lea ecx, [eax + 1]
mov dword [0x446f48], ecx
mov eax, dword [eax*4 + 0x446f4c]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [0x4482cc]
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc40000
xor ecx, eax
shr ecx, 0x12
and eax, 0x7fff
xor eax, ecx
pop esi
pop edi
pop ebx
ret
Function at 0x409750
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
xor eax, eax
mov edx, 0x80000000
nop
nop
nop
nop
nop
mov edi, eax
and edi, 0x70
mov esi, eax
or esi, 0x270
add esi, edi
mov ebp, dword [ecx + esi*4 + 4]
and ebp, edx
mov ebx, dword [ecx + esi*4 + 8]
mov edi, ebx
and edi, 0x7ffffffe
or edi, ebp
shr edi, 1
and ebx, 1
neg ebx
and ebx, 0x9908b0df
xor edi, dword [ecx + esi*4 + 0x638]
xor edi, ebx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x409760
mov esi, dword [ecx + 0xd50]
xor eax, eax
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0xd54]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 4]
xor edi, edx
mov dword [ecx + eax*4 + 0x390], edi
inc eax
cmp eax, 0x18c
jne 0x4097b0
mov edx, 0x80000000
and edx, dword [ecx + 0x1380]
mov ebx, dword [ecx + 4]
mov eax, ebx
and eax, 0x7ffffffe
or eax, edx
shr eax, 1
mov edx, 0x359254f5
test bl, 1
je 0x409813
mov edx, 0xac9ae42a
xor edx, dword [ecx + 0x634]
xor edx, eax
xor edx, 0x359254f5
mov dword [ecx + 0x9c0], edx
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40a910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x230
push eax
sub esp, 0x20
mov dword [ebp - 0x2c], esp
sub esp, 8
mov dword [ebp - 0x14], esp
sub esp, 0x40
mov dword [ebp - 0x1c], esp
sub esp, 0x80
mov dword [ebp - 0x28], esp
mov eax, dword [0x448328]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x23c], 0xf8e7fee5
mov esi, 0x6864f38d
mov edi, 0x979b0c72
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + esi - 0x6864f5c9]
mov ebx, esi
and ebx, edx
add ebx, ebx
sub ebx, edx
add ebx, edi
and ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0x9d
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0x98
mov byte [ebp + esi - 0x6864f5c9], al
inc esi
dec edi
cmp esi, 0x6864f391
jne 0x40a960
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x1bc], 0xad3fab3d
mov dword [ebp - 0x1b8], 0x51afaf7c
mov dword [ebp - 0x1b4], 0x55865381
mov dword [ebp - 0x1b0], 0x59bc5778
mov dword [ebp - 0x1ac], 0x5db05bb6
mov word [ebp - 0x1a8], 0x5f5e
xor ecx, ecx
nop
mov edx, ecx
add dl, 0x7a
xor dl, byte [ebp + ecx - 0x1bc]
add dl, 0x30
mov byte [ebp + ecx - 0x1bc], dl
inc ecx
cmp ecx, 0x16
jne 0x40a9f0
lea esi, [ebp - 0x1bc]
push eax
push 0
push esi
call dword [ebp - 0x10]
mov ecx, 0x44832c
push eax
call fcn.0043ba60
movzx eax, al
mov eax, dword [eax*4 + 0x4423dc]
mov ecx, 0x9cc5038d
xor ecx, dword [0x4423e4]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x40b710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40b98d
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40b74c
cmp edx, esi
jae 0x40b98d
test edi, edi
je 0x40b98d
movzx ebp, bl
test bl, bl
js 0x40b790
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
not esi
and esi, eax
not eax
and eax, ecx
sub eax, esi
sar eax, 1
sub edi, eax
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40b740
jmp 0x40b98d
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40b7cc
cmp bl, 0xc2
jb 0x40b778
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40b839
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40b891
mov ecx, ebp
not ecx
or ecx, 0xf0
add ecx, ebp
cmp ecx, 0xdf
jne 0x40b801
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40b843
cmp ebp, 0xe0
jne 0x40b84c
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40b774
jmp 0x40b84c
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40b968
cmp bl, 0xf4
ja 0x40b778
movzx ecx, byte [edx + 1]
je 0x40b89c
cmp ebp, 0xf0
jne 0x40b8a5
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40b774
jmp 0x40b8a5
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40b77a
cmp cl, 0x9f
ja 0x40b774
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b96f
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b975
shl ebp, 0xc
shl ecx, 6
add ecx, 0xe000
or ecx, ebp
add edx, 3
mov esi, dword [esp]
add esi, 0xff80
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40b762
cmp cl, 0x8f
ja 0x40b774
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b96f
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b975
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b981
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ebx, dword [esp]
and ebx, 0x3f
or ebx, ebp
cmp ebx, 0x10000
jb 0x40b774
mov ecx, ebx
xor ecx, 0x7ff
mov esi, ebx
or esi, 0x7ffff800
and esi, ecx
cmp esi, 0xd800
je 0x40b774
cmp edi, 2
jb 0x40b968
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
and ebx, 0x3ff
or ebx, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bx
jmp 0x40b762
mov ecx, eax
jmp 0x40b762
inc edx
jmp 0x40b774
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40b77a
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40b77a
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x416490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x450
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
mov ecx, 0xfffffffe
nop
nop
nop
nop
nop
nop
mov eax, ecx
cmp word [edi + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x4164b0
mov eax, ecx
sar eax, 1
mov dword [esp + 4], ecx
and ecx, 0x1c
mov dword [esp + 0xbc], eax
xor eax, 0xe
add eax, ecx
jns 0x4164dd
mov eax, 0xffffffff
jmp 0x4164df
add eax, eax
push eax
call fcn.00408b20
add esp, 4
mov dword [esp + 0x2c8], 0xa659a44f
mov dword [esp + 0x2cc], 0x5aca5846
mov dword [esp + 0x2d0], 0x5e7d5ccf
mov dword [esp + 0x2d4], 0x52b450a9
mov dword [esp + 0x2d8], 0x56c654c1
mov dword [esp + 0x2dc], 0x4ad648ce
mov dword [esp + 0x2e0], 0x4e4d4cd5
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
add cl, 0x7b
xor cl, byte [esp + edx + 0x2c8]
add cl, 0x28
mov byte [esp + edx + 0x2c8], cl
inc edx
cmp edx, 0x1c
jne 0x416540
movzx ecx, word [edi]
mov esi, eax
test cx, cx
je 0x416581
add edi, 2
mov esi, eax
nop
nop
nop
nop
nop
mov word [esi], cx
add esi, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x416570
mov word [esi], 0
movzx ecx, word [esp + 0x2c8]
test cx, cx
je 0x4165b1
lea edx, [esp + 0x2ca]
nop
nop
nop
nop
nop
nop
mov word [esi], cx
add esi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4165a0
mov word [esi], 0
lea ecx, [esp + 0x140]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x1c], eax
push eax
call fcn.0043e330
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4435c4]
Function at 0x425410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x9c
push eax
sub esp, 0x10
mov ebx, esp
mov dword [ebp - 0x52], 0x9490763
mov dword [ebp - 0x4e], 0xd9c0b9a
mov dword [ebp - 0x4a], 0x71d10f4a
mov dword [ebp - 0x46], 0x75d573e6
mov dword [ebp - 0x42], 0x79c47713
mov dword [ebp - 0x3e], 0x7dd47bce
mov dword [ebp - 0x3a], 0x61ce7feb
mov dword [ebp - 0x36], 0x65c163c6
mov dword [ebp - 0x32], 0x69ca67f4
mov dword [ebp - 0x2e], 0x6dfe6bc3
mov dword [ebp - 0x2a], 0x51ec6fca
mov dword [ebp - 0x26], 0x55c653e2
mov dword [ebp - 0x22], 0x59fe57f9
mov dword [ebp - 0x1e], 0x5df05bf3
mov dword [ebp - 0x1a], 0x41d35ffb
lea eax, [ebp - 0x16]
mov word [ebp - 0x16], 0x4342
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xb6
xor dl, byte [ebp + ecx - 0x52]
add dl, 0x50
mov byte [ebp + ecx - 0x52], dl
inc ecx
cmp ecx, 0x3e
jne 0x4254a0
lea esi, [ebp - 0xa8]
lea edx, [ebp - 0x52]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [ebp - 0x6c]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [ebp - 0x10]
push edi
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x44964c]
mov dword [ebp - 0x52], 0x1f5e5dbf
mov ecx, 0xfdf47bc
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebp + ecx - 0xfdf480e]
xor esi, ecx
mov edx, esi
or edx, 0xfe
add edx, esi
not esi
and esi, 1
add edx, esi
add dl, 0x21
mov byte [ebp + ecx - 0xfdf480e], dl
inc ecx
cmp ecx, 0xfdf47c0
jne 0x425500
xor ecx, ecx
cmp eax, dword [ebp - 0x52]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4442b8]