joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419940
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push eax
push ecx
push ebp
call fcn.00419420
lea esi, [eax*4]
add esp, 0xc
xor edi, edi
mov dword [esp + 0x10], eax
test esi, esi
jle 0x4199b4
lea edx, [ebp + esi*4 + 8]
lea ecx, [ebp + 8]
mov eax, dword [edx - 8]
mov ebx, dword [ecx - 8]
mov dword [ecx - 8], eax
mov eax, dword [edx - 4]
mov dword [edx - 8], ebx
mov ebx, dword [ecx - 4]
mov dword [ecx - 4], eax
mov eax, dword [edx]
mov dword [edx - 4], ebx
mov ebx, dword [ecx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [edx], ebx
mov ebx, dword [ecx + 4]
mov dword [ecx + 4], eax
mov dword [edx + 4], ebx
add edi, 4
sub esi, 4
add ecx, 0x10
sub edx, 0x10
cmp edi, esi
jl 0x419974
mov eax, dword [esp + 0x10]
cmp eax, 1
jle 0x419b7d
lea ecx, [ebp + 2]
lea esi, [eax - 1]
jmp 0x4199d0
mov edx, dword [ecx + 0xe]
movzx ebx, byte [ecx + 0xf]
mov ebx, dword [ebx*4 + str.ccccwwww]
add ecx, 0x10
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x436800]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x437000]
movzx ebx, byte [ecx]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x436c00]
movzx ebx, byte [ecx + 3]
and edx, 0xff
mov edx, dword [edx*4 + str.ccccwwww]
and edx, 0xff
xor edi, dword [edx*4 + 0x437400]
mov edx, dword [ecx + 2]
mov dword [ecx - 2], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x436800]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x437000]
movzx ebx, byte [ecx + 4]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x436c00]
movzx ebx, byte [ecx + 7]
and edx, 0xff
mov edx, dword [edx*4 + str.ccccwwww]
and edx, 0xff
xor edi, dword [edx*4 + 0x437400]
mov edx, dword [ecx + 6]
mov dword [ecx + 2], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x436800]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x437000]
movzx ebx, byte [ecx + 8]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x436c00]
movzx ebx, byte [ecx + 0xb]
and edx, 0xff
mov edx, dword [edx*4 + str.ccccwwww]
and edx, 0xff
xor edi, dword [edx*4 + 0x437400]
mov edx, dword [ecx + 0xa]
mov dword [ecx + 6], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x436800]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x437000]
movzx ebx, byte [ecx + 0xc]
mov ebx, dword [ebx*4 + str.ccccwwww]
and edx, 0xff
mov edx, dword [edx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x436c00]
and edx, 0xff
xor edi, dword [edx*4 + 0x437400]
dec esi
mov dword [ecx + 0xa], edi
jne 0x4199d0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x41aa80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebp
mov ebp, dword [esp + 0x34]
mov eax, ebp
cdq
and edx, 0xf
add eax, edx
push esi
mov esi, dword [esp + 0x30]
sar eax, 4
and ebp, 0x8000000f
push edi
mov edi, dword [esp + 0x38]
jns 0x41aaaa
dec ebp
or ebp, 0xfffffff0
inc ebp
mov dword [esp + 0x34], ebp
je 0x41aabc
test eax, eax
jne 0x41aabb
pop edi
pop esi
pop ebp
add esp, 0x20
ret
dec eax
mov edx, dword [esp + 0x40]
push ebx
mov ebx, dword [esp + 0x34]
mov ecx, edx
test eax, eax
je 0x41ab1f
mov ebp, eax
lea ecx, [ecx]
mov eax, dword [esi]
xor eax, dword [ecx]
mov edx, dword [ecx + 4]
xor edx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 8]
xor eax, dword [esi + 8]
mov ecx, dword [ecx + 0xc]
xor ecx, dword [esi + 0xc]
mov dword [esp + 0x14], edx
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 4]
lea edx, [esp + 0x14]
push edx
push eax
lea eax, [ebx + 8]
push eax
mov dword [esp + 0x2c], ecx
call fcn.00419b90
mov ecx, edi
add esp, 0x10
add esi, 0x10
add edi, 0x10
dec ebp
jne 0x41aad0
mov ebp, dword [esp + 0x38]
mov edx, dword [esp + 0x44]
test ebp, ebp
je 0x41abd4
mov eax, dword [esi]
xor eax, dword [ecx]
mov edx, dword [esi + 4]
xor edx, dword [ecx + 4]
mov ebp, dword [esi + 8]
mov dword [esp + 0x18], ebp
mov ebp, dword [esi + 0xc]
xor ebp, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [ecx + 8]
xor dword [esp + 0x18], edx
mov edx, dword [ebx + 4]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x24], ebp
lea ebp, [ebx + 8]
push edx
push ebp
mov dword [esp + 0x4c], ebp
call fcn.00419b90
xor eax, eax
add esp, 0x10
cmp dword [esp + 0x38], eax
jbe 0x41ab9c
lea ebp, [edi + 0x10]
sub esi, edi
lea esp, [esp]
mov cl, byte [esp + eax + 0x20]
mov dl, byte [esi + ebp]
xor dl, cl
mov byte [esp + eax + 0x20], dl
mov byte [ebp], cl
inc eax
inc ebp
cmp eax, dword [esp + 0x38]
jb 0x41ab80
mov ebp, dword [esp + 0x3c]
mov edx, dword [ebx + 4]
lea eax, [esp + 0x20]
push eax
mov ecx, eax
push ecx
push edx
push ebp
call fcn.00419b90
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov dword [edi], eax
mov eax, dword [esp + 0x3c]
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov edx, dword [esp + 0x54]
add esp, 0x10
mov dword [edi + 0xc], eax
lea ecx, [esp + 0x20]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
pop ebx
pop edi
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov eax, dword [esp + 0x38]
pop esi
mov dword [edx + 0xc], ecx
pop ebp
add esp, 0x20
ret
Function at 0x41ac00
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x10]
mov eax, ecx
cdq
sub esp, 0x34
and edx, 0xf
add eax, edx
push esi
mov esi, dword [esp + 0x44]
sar eax, 4
and ecx, 0x8000000f
push edi
mov edi, dword [esp + 0x44]
jns 0x41ac29
dec ecx
or ecx, 0xfffffff0
inc ecx
mov dword [esp + 0x44], ecx
je 0x41ac3a
test eax, eax
jne 0x41ac39
pop edi
pop esi
add esp, 0x34
ret
dec eax
push ebx
mov ebx, dword [esp + 0x54]
mov edx, dword [ebx]
mov dword [esp + 0x10], edx
mov edx, dword [ebx + 4]
mov dword [esp + 0x14], edx
mov edx, dword [ebx + 8]
mov dword [esp + 0x18], edx
mov edx, dword [ebx + 0xc]
push ebp
mov ebp, dword [esp + 0x48]
mov dword [esp + 0x20], edx
test eax, eax
je 0x41acd0
mov ecx, edi
sub ecx, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x50], eax
nop
mov eax, dword [ebp + 4]
push esi
push eax
mov ecx, edi
lea eax, [ebp + 0xf8]
call fcn.0041a190
mov ecx, dword [esp + 0x1c]
xor dword [esi], ecx
mov edx, dword [esp + 0x20]
xor dword [esi + 4], edx
mov eax, dword [esp + 0x24]
xor dword [esi + 8], eax
mov ecx, dword [esp + 0x28]
xor dword [esi + 0xc], ecx
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], edx
mov edx, dword [ecx + esi + 8]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0xc]
add esp, 8
add edi, 0x10
add esi, 0x10
dec dword [esp + 0x50]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
jne 0x41ac70
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x41ad94
mov edx, dword [edi + 8]
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [esp + 0x2c], edx
mov edx, dword [edi + 0xc]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], ecx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
lea ecx, [esp + 0x34]
mov dword [esp + 0x30], edx
mov edx, dword [ebp + 4]
push ecx
lea ebx, [ebp + 0xf8]
push edx
lea ecx, [esp + 0x2c]
mov eax, ebx
mov dword [esp + 0x58], ebx
call fcn.0041a190
add esp, 8
cmp dword [esp + 0x4c], 0
jbe 0x41ad5a
mov ebx, esi
lea ecx, [edi + 0x10]
sub ebx, edi
mov edi, dword [esp + 0x4c]
lea ebp, [esp + 0x34]
lea esp, [esp]
mov dl, byte [ecx]
mov al, byte [ebp]
xor al, dl
mov byte [ebp], dl
mov byte [ebx + ecx], al
inc ecx
inc ebp
dec edi
jne 0x41ad40
mov ebp, dword [esp + 0x48]
mov ebx, dword [esp + 0x50]
mov eax, dword [ebp + 4]
push esi
push eax
lea ecx, [esp + 0x3c]
mov eax, ebx
call fcn.0041a190
mov ecx, dword [esp + 0x1c]
xor dword [esi], ecx
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
xor dword [esi + 8], eax
xor dword [esi + 4], edx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x5c]
add esp, 8
xor dword [esi + 0xc], ecx
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x34
ret
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [ebx], edx
mov edx, dword [esp + 0x20]
pop ebp
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x50]
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
pop ebx
pop edi
pop esi
add esp, 0x34
ret
Function at 0x41c240
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x5c], ecx
ret

Function at 0x41d870
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x43fea8], ecx
inc edx
cmp edx, 0x100
jb 0x41d872
cmp edx, 0x800
jae 0x41d949
lea esp, [esp]
mov eax, dword [edx*4 + 0x43faa8]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x43fea8]
inc edx
mov dword [edx*4 + 0x43fea4], eax
cmp edx, 0x800
jb 0x41d920
mov dword [0x43f978], 0x420890
call fcn.00420ad0
test eax, eax
jne 0x41d966
mov dword [0x43f978], 0x420930
ret

Function at 0x41dac0
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi]
test esi, esi
je 0x41db22
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov dword [edi], 0
lea esp, [esp]
mov eax, 0x400000
cmp esi, 0x400000
ja 0x41daef
mov eax, esi
mov edx, dword [ebp]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x41db27
test ecx, ecx
je 0x41db20
test esi, esi
jne 0x41dae0
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret
pop ebp
pop ebx
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x421d90
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x421da0
pop edi
pop ebx
ret
Function at 0x421dd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x421de0
pop esi
pop ebp
pop ebx
ret

Function at 0x422170
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor edx, edx
push edi
cmp edx, dword [esp + 0x1c]
jae 0x4222e1
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x4221fa
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x4221d0
add edi, dword [esp + 8]
mov ecx, dword [esp + 0x20]
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x4221b4
cmp edx, 0x10
jae 0x42227b
lea eax, [edx - 8]
mov dword [esp + 8], eax
jmp 0x422220
cmp edx, dword [esp + 0x1c]
jae 0x4222e1
or eax, 8
xor edi, edi
cmp eax, 1
je 0x422261
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x422234
add edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, 0x10
jb 0x422220
cmp edx, dword [esp + 0x1c]
jae 0x4222e1
lea eax, [edx - 0x10]
mov dword [esp + 8], eax
jmp 0x422290
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x4222c6
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x4222a0
add edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, dword [esp + 0x1c]
jb 0x422290
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x423f20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32350]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x423f40
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x329f4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ca0]
add ecx, ecx
shr esi, 1
or ecx, eax
dec dword [esp + 0xc]
jne 0x423f50
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
cmp esi, 0x10
jb 0x423f40
pop esi
pop ebp
mov dword [edi + 0x32390], 0
pop ebx
add esp, 0xc
ret
Function at 0x423fb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
mov eax, 4
push edi
mov dword [esp + 0x18], eax
movzx ebp, byte [edx + eax + 0x304a0]
mov ecx, ebp
mov esi, ebp
and esi, 1
shr ecx, 1
dec ecx
or esi, 2
shl esi, cl
mov edi, eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x10], 0
sub edi, esi
mov ebx, 1
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x424041
jmp 0x424004
mov ebp, dword [esp + 0x1c]
mov ecx, ebx
sub ecx, ebp
mov eax, edi
and eax, 1
add ecx, esi
movzx ecx, word [edx + ecx*2 + 0x3290e]
mov ebp, eax
neg ebp
sar ebp, 4
shr ecx, 4
and ebp, 0x7f
xor ecx, ebp
mov ecx, dword [edx + ecx*4 + 0x30ca0]
add dword [esp + 0x10], ecx
add ebx, ebx
shr edi, 1
or ebx, eax
dec dword [esp + 0x14]
jne 0x424000
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x20], ecx
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x80
jb 0x423fc3
lea eax, [edx + 0x32710]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
sub eax, edx
lea ebp, [edx + 0x31b58]
sub eax, 0x31b50
lea edi, [edx + 0x31750]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 4
lea ebx, [ebx]
xor ebx, ebx
cmp dword [edx + 0x32394], ebx
jbe 0x4240eb
lea ebx, [ebx]
mov eax, ebx
or eax, 0x40
xor esi, esi
cmp eax, 1
je 0x4240df
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add esi, dword [edx + ebp*4 + 0x30ca0]
mov eax, ecx
cmp eax, 1
jne 0x4240b0
mov ebp, dword [esp + 0x18]
mov dword [edi + ebx*4], esi
inc ebx
cmp ebx, dword [edx + 0x32394]
jb 0x4240a0
mov eax, 0xe
cmp dword [edx + 0x32394], eax
jbe 0x42410e
mov ecx, eax
shr ecx, 1
sub ecx, 5
shl ecx, 4
add dword [edi + eax*4], ecx
inc eax
cmp eax, dword [edx + 0x32394]
jb 0x4240f8
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov ecx, dword [edi + 4]
mov dword [ebp - 4], ecx
mov eax, dword [edi + 8]
mov dword [ebp], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp + 4], ecx
mov eax, 4
lea ecx, [ebp + 8]
lea ecx, [ecx]
movzx esi, byte [edx + eax + 0x304a0]
mov esi, dword [edi + esi*4]
mov ebx, dword [esp + 0x14]
add esi, dword [ebx + ecx]
inc eax
mov dword [ecx], esi
add ecx, 4
cmp eax, 0x80
jb 0x424130
sub dword [esp + 0x10], 0xffffff80
sub dword [esp + 0x14], 0x200
add ebp, 0x200
add edi, 0x100
dec dword [esp + 0x1c]
mov dword [esp + 0x18], ebp
jne 0x424090
pop edi
pop esi
pop ebp
mov dword [edx + 0x3baf8], 0
pop ebx
add esp, 0x210
ret
Function at 0x427690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push ebp
xor ebp, ebp
and eax, 7
cmp ecx, 5
jae 0x4276ab
xor eax, eax
pop ebp
pop ecx
ret
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [edx + ecx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], edx
lea ecx, [ecx]
mov ecx, dword [esp + 0x18]
lea edi, [ecx + ebp]
cmp edi, edx
jae 0x4276ef
jmp 0x4276e0
mov bl, byte [edi]
and bl, 0xfe
cmp bl, 0xe8
je 0x4276ef
inc edi
cmp edi, edx
jb 0x4276e0
mov ebp, edi
sub ebp, ecx
mov ecx, ebp
sub ecx, dword [esp + 0x1c]
cmp edi, edx
jae 0x427804
cmp ecx, 3
jbe 0x427723
xor eax, eax
mov cl, byte [edi + 4]
mov dword [esp + 0x1c], ebp
test cl, cl
je 0x42775d
cmp cl, 0xff
je 0x42775d
and eax, 3
add eax, eax
or eax, 1
inc ebp
jmp 0x4276d0
dec ecx
shl eax, cl
and eax, 7
je 0x427708
movzx ecx, byte [eax + 0x43811c]
mov ebx, edi
sub ebx, ecx
cmp byte [eax + 0x438114], 0
mov cl, byte [ebx + 4]
je 0x42774b
test cl, cl
je 0x42774b
cmp cl, 0xff
jne 0x427708
and eax, 3
add eax, eax
mov dword [esp + 0x1c], ebp
or eax, 1
inc ebp
jmp 0x4276d0
movzx edx, cl
movzx ecx, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
jmp 0x427780
cmp dword [esp + 0x28], 0
je 0x42778e
lea ebx, [edx + ebp]
add ebx, esi
jmp 0x427794
sub edx, ebp
sub edx, esi
mov ebx, edx
test eax, eax
je 0x4277d6
movzx esi, byte [eax + 0x43811c]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
mov cl, dl
test cl, cl
je 0x4277bb
cmp cl, 0xff
jne 0x4277d2
mov ecx, 0x20
sub ecx, esi
mov esi, dword [esp + 0x20]
mov edx, 1
shl edx, cl
dec edx
xor edx, ebx
jmp 0x427780
mov esi, dword [esp + 0x20]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov edx, ebx
shr edx, 0x10
mov ecx, ebx
shr ecx, 8
mov byte [edi + 3], dl
mov edx, dword [esp + 0x10]
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add ebp, 5
jmp 0x4276d0
pop edi
pop esi
pop ebx
cmp ecx, 3
jbe 0x427819
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [edx], eax
mov eax, ebp
pop ebp
pop ecx
ret
mov edx, dword [esp + 0x18]
dec ecx
shl eax, cl
and eax, 7
mov dword [edx], eax
mov eax, ebp
pop ebp
pop ecx
ret
Function at 0x4279e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
push esi
mov dword [eax + 0x30], edx
mov dword [eax + 0x4c], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x2c], 0x20
mov dword [eax + 0x54], 1
mov dword [eax + 0x48], 4
mov dword [eax + 0x58], edx
lea esi, [eax + 0x70]
jmp 0x427a10
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x427a10
pop esi
ret
Function at 0x42f530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 0x10], 0xc
jge 0x42f546
mov eax, 0
jmp 0x42f6e9
mov eax, dword [0x43d948]
lea eax, [eax + 1]
mov dword [0x43d948], eax
cmp eax, 1
jne 0x42f570
push 0
call sub.MSVCRT.dll_time
add esp, 4
xor eax, 0xbb40e64e
push eax
call sub.MSVCRT.dll_srand
add esp, 4
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0042f4ea
add esp, 0xc
mov dword [ebp - 4], 0
call sub.MSVCRT.dll_rand
sar eax, 7
and eax, 0xff
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.0042f440
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.0042f46e
add esp, 0xc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor edx, dword [ebp - 0xc]
mov byte [ebp + eax - 0x16], dl
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xa
jl 0x42f58b
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0042f4ea
add esp, 0xc
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.0042f440
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [ebp + eax - 0x16]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.0042f46e
add esp, 0xc
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
movzx ecx, byte [ebp + ecx - 0x16]
xor ecx, dword [ebp - 8]
mov byte [eax + edx], cl
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xa
jl 0x42f5f3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
lea edx, [eax + 1]
mov dword [ebp - 4], edx
mov edx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push edx
call fcn.0042f440
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
shr eax, 0x10
and eax, 0xff
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.0042f46e
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 0x1c]
shr ecx, 0x10
and ecx, 0xff
xor edx, ecx
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + eax], dl
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
lea edx, [eax + 1]
mov dword [ebp - 4], edx
mov edx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push edx
call fcn.0042f440
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
shr eax, 0x18
and eax, 0xff
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.0042f46e
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 0x1c]
shr ecx, 0x18
and ecx, 0xff
xor edx, ecx
mov ecx, dword [ebp - 0x20]
mov byte [ecx + eax], dl
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4072fc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x79c008], 0x8088405
inc edx
mov dword [ebx + 0x79c008], edx
mul edx
mov eax, edx
pop ebx
ret