joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4021e0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x4022f2
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4022f2
cmp dword [esp + 0x2c], 0
je 0x4022f2
push esi
call fcn.00408900
add esp, 4
test eax, eax
je 0x40224a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x402251
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x402230
jmp 0x402253
mov ebx, 0x1505
jmp 0x402253
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x4022fa
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x4022b7
call fcn.004023f0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x4022f2
push ecx
call fcn.00408900
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x40236d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x402318
inc edi
dec esi
je 0x40226c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x402271
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x402310
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.00408900
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x402310
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.00408930
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402310
mov eax, 0xffffffff
jmp 0x4022f2
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x402388
inc edi
dec esi
je 0x4022b2
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x4022b7
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x402380
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408900
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x402380
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.00408930
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402380
jmp 0x4022b7
Function at 0x402b10
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402ca6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x402c9f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x402ba5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov ebx, 0x15b0
je 0x402c9f
xor eax, eax
cmp ebx, 8
mov dword [esp], ebx
mov dword [esp + 8], esi
jb 0x402c28
and ebx, 0x1ff8
mov dword [esp + 4], ebx
xor eax, eax
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx ebx, byte [ebp + edx + 2]
add ebx, esi
mov eax, ecx
and eax, ebx
xor ecx, ebx
movzx edi, byte [ebp + edx + 3]
add edi, ebx
mov ebx, dword [esp]
movzx esi, byte [ebp + edx + 4]
add esi, edi
add edi, ecx
lea ecx, [edi + eax*2]
movzx eax, byte [ebp + edx + 5]
add eax, esi
add ecx, esi
movzx esi, byte [ebp + edx + 6]
add esi, eax
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, esi
add ecx, esi
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, ebx
jb 0x402bc0
add ebp, eax
mov esi, dword [esp + 8]
mov eax, dword [esp + 4]
mov edx, eax
sub edx, ebx
jae 0x402b6d
mov dword [esp + 0xc], edx
mov esi, ebx
and esi, 3
mov dword [esp + 4], eax
mov edx, ebp
je 0x402c5c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
movzx ebx, byte [edx]
add edi, ebx
add ecx, edi
inc edx
dec esi
jne 0x402c50
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402b60
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x402c70
jmp 0x402b60
shl ecx, 0x10
or ecx, edi
jmp 0x402cab
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402cc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402cee
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x402d8c
not eax
test bl, 1
jne 0x402cf5
mov edx, ebx
cmp ebx, 1
jne 0x402d26
jmp 0x402d8a
xor eax, eax
jmp 0x402d8c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x44280c]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x44280c]
cmp ebx, 1
je 0x402d8a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44280c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44280c]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44280c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44280c]
add esi, 2
cmp edx, esi
jne 0x402d30
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x408ea0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + 4]
mov dword [0x44a61c], ecx
mov eax, 0xfffffd92
nop
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x26f
mov dword [eax*4 + 0x44afd8], ecx
test eax, eax
je 0x408ef1
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x270
mov dword [eax*4 + 0x44afdc], ecx
add eax, 2
jmp 0x408eb0
mov dword [0x44a618], 0x270
ret
Function at 0x408f20
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x214
call fcn.0043ced0
test al, al
je 0x409146
lea eax, [esp + 0xc]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00436070
test al, al
je 0x409141
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, 0x84cd5880
mov edi, 0xc87a87b0
mov ecx, ebx
shrd edi, ebp, cl
mov dword [esp + 8], eax
shr ebp, cl
test bl, 0x20
je 0x408f81
mov edi, ebp
xor ebp, ebp
mov ecx, edi
xor ecx, 0xc87a87b0
mov ebx, ebp
xor ebx, 0x84cd5880
mov edx, ebx
and edx, 0x690ec1e9
mov dword [esp], edi
and edi, 0x650d1c2b
xor edi, 0x2505180b
mov eax, edi
imul edi, edx
mov esi, ecx
and esi, 0x9af2e3d4
mul esi
mov dword [esp + 4], eax
add edi, edx
mov eax, ebp
and ebp, 0x96f13e16
xor ebp, 0x12302616
imul ebp, esi
add ebp, edi
mov edi, ecx
and edi, 0x650d1c2b
mov edx, dword [esp]
and edx, 0x9af2e3d4
xor edx, 0xed7f9fbb
or ecx, 0x650d1c2b
and ecx, edx
mov esi, ebx
and esi, 0x96f13e16
and eax, 0x690ec1e9
xor eax, 0x96fd7e96
or ebx, 0x96f13e16
and ebx, eax
imul esi, ecx
mov eax, ecx
mul edi
imul ebx, edi
add ebx, edx
add ebx, esi
add eax, dword [esp + 4]
adc ebx, ebp
mov edi, ebx
shr edi, 0x15
xor edi, ebx
mov esi, ebx
shld esi, eax, 0xb
xor esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x4090d9
mov eax, esi
and eax, 0x939b05ec
mov dword [esp], eax
mov ebx, edi
and ebx, 0xf81647b1
xor eax, 0x939b05ec
mov ebp, esi
and ebp, 0x6c64fa13
mov ecx, edi
and ecx, 0x7e9b84e
imul ecx, eax
mul ebp
mov dword [esp + 4], eax
or esi, 0x939b05ec
mov eax, esi
imul esi, ebx
xor ebx, 0xf81647b1
imul ebp, ebx
add ebp, edx
mov ebx, dword [esp]
mul ebx
add ebp, ecx
add esi, edx
or edi, 0xf81647b1
imul edi, ebx
add edi, esi
add eax, dword [esp + 4]
adc edi, ebp
mov edx, eax
mov ecx, dword [esp + 8]
shrd edx, edi, cl
mov ebx, edi
shr ebx, cl
test cl, 0x20
je 0x4090b0
mov edx, ebx
xor ebx, ebx
not edx
not ebx
mov ecx, eax
or ecx, edx
mov ebp, edi
or ebp, ebx
and edx, eax
and ebx, edi
mov edi, ebx
shld edi, edx, 1
lea esi, [edx + edx]
not edi
not esi
add esi, edx
adc edi, ebx
and edi, ebp
and esi, ecx
not edi
not esi
mov edx, edi
shld edx, esi, 1
lea ebx, [esi + esi]
not edx
not ebx
add ebx, esi
adc edx, edi
mov eax, edx
not eax
mov ecx, ebx
not ecx
and edx, 0xc3d24a8d
and ebx, 0xd7bfe322
xor esi, 0xd7bfe322
or esi, ebx
xor edi, 0xc3d24a8d
or edi, edx
xor edi, 0xc2d34b8c
xor esi, 0xd6bee223
and eax, 0x1010101
or eax, edi
and ecx, 0x1010101
or ecx, esi
push eax
push ecx
call fcn.0040a2f0
add esp, 8
test al, al
je 0x409141
call fcn.0040ce90
call fcn.0040bd80
call fcn.0043e3b0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409150
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x4091bc
mov eax, 0x270
mov edx, SysReAllocString
mov esi, 0x270
nop
nop
nop
nop
mov ebp, dword [ecx + esi*4 - 0x9bc]
and ebp, edx
mov edi, dword [ecx + esi*4 - 0x9b8]
mov ebx, edi
and ebx, 0x7ffffffe
or ebx, ebp
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + esi*4 - 0x388]
shr ebx, 1
xor edi, ebx
mov dword [ecx + esi*4 + 4], edi
mov edi, esi
and edi, 1
xor esi, 1
lea esi, [esi + edi*2]
cmp esi, 0x4e0
jb 0x409170
jmp 0x40928f
cmp eax, 0x4e0
jb 0x40928f
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
mov edi, dword [ecx + eax*4 + 0x9c8]
and esi, 0x80000000
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x4091d0
mov esi, dword [ecx + 0xd50]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0xd54]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edx, dword [ecx + eax*4 + 4]
xor edx, edi
mov dword [ecx + eax*4 + 0x390], edx
inc eax
cmp eax, 0x18c
jne 0x409220
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
mov edx, ecx
and edx, eax
add ecx, eax
add edx, edx
sub ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a2f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x224
mov eax, dword [0x44b9f4]
mov dword [esp], eax
mov dword [esp + 0x1a4], 0x4f4e3148
mov word [esp + 0x1a8], 0
mov byte [esp + 0x1aa], 0
xor edx, edx
mov ecx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, ecx
or edi, 0xaae75072
lea esi, [edx + edi]
inc esi
mov eax, esi
and eax, 0xfffffffd
mov ebx, esi
and ebx, 2
or esi, 2
imul esi, ebx
mov ebp, ebx
xor ebp, 2
imul ebp, eax
movzx ebx, byte [esp + edx + 0x1a4]
add esi, ebp
mov ebp, edx
or ebp, 0x5518af8d
and ebp, edi
mov edi, ebp
not edi
add edi, esi
sub ebp, esi
and ebp, ebx
mov eax, edi
and edi, ebx
add edi, ebp
xor eax, ebx
add eax, ebx
sub eax, edi
add al, 0xc6
mov byte [esp + edx + 0x1a4], al
inc edx
dec ecx
cmp edx, 7
jne 0x40a330
mov ecx, dword [esp + 0x1a4]
mov dword [esp + 0x14], 0xf790983
mov dword [esp + 0x18], 0x3610d3a
mov dword [esp + 0x1c], 0x7300137
mov dword [esp + 0x20], 0x1b7e0536
mov dword [esp + 0x24], 0x1f621964
mov word [esp + 0x28], 0x1d1c
mov dword [esp + 0x2a], 0
mov word [esp + 0x2e], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
add al, 2
xor al, byte [esp + edx + 0x14]
add al, 0xf6
mov byte [esp + edx + 0x14], al
inc edx
cmp edx, 0x1c
jne 0x40a3e0
lea eax, [esp + 0x14]
push ecx
push 0
push eax
call dword [esp + 0xc]
mov ecx, 0x44b9f8
push eax
call fcn.0043ce40
movzx eax, al
mov eax, dword [eax*4 + 0x445938]
mov ecx, dword [0x445940]
mov edx, ecx
and edx, 0x240de555
add edx, edx
sub edx, ecx
lea ecx, [eax + edx]
add ecx, 0xdbf21aab
xor eax, eax
jmp ecx
Function at 0x40bdb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov ebx, dword [esp + 0x44c]
mov dword [esp + 0x38], 0x719f0f43
mov dword [esp + 0x3c], 0x75d973ea
mov dword [esp + 0x40], 0x79da77d8
mov dword [esp + 0x44], 0x7d2b7bdb
mov dword [esp + 0x48], 0x61107f2b
mov dword [esp + 0x4c], 0x65026330
mov dword [esp + 0x50], 0x69df670c
mov dword [esp + 0x54], 0x6dc46bc3
mov dword [esp + 0x58], 0x51ff6fc8
mov dword [esp + 0x5c], 0x55c753c9
mov dword [esp + 0x60], 0x59185734
mov dword [esp + 0x64], 0x5d3a5bec
mov dword [esp + 0x68], 0x410e5f0f
mov dword [esp + 0x6c], 0x4512432e
mov dword [esp + 0x70], 0x49264719
mov dword [esp + 0x74], 0x4de14bf1
mov dword [esp + 0x78], 0xb1184fe2
mov dword [esp + 0x7c], 0xb5efb3e4
mov dword [esp + 0x80], 0xb92eb7d4
mov dword [esp + 0x84], 0xbdeebbee
mov dword [esp + 0x88], 0xa1debfd7
mov dword [esp + 0x8c], 0xa532a3e3
mov dword [esp + 0x90], 0xa90aa734
mov dword [esp + 0x94], 0xad13ab0f
mov dword [esp + 0x98], 0x910caf0b
mov dword [esp + 0x9c], 0x953993dd
mov dword [esp + 0xa0], 0x99c79700
mov dword [esp + 0xa4], 0x9dcf9bcf
mov dword [esp + 0xa8], 0x81f09fc5
mov dword [esp + 0xac], 0x85d483d5
mov dword [esp + 0xb0], 0x89ee87e4
mov dword [esp + 0xb4], 0x8dc28bc5
mov dword [esp + 0xb8], 0xf1c18f38
mov dword [esp + 0xbc], 0xf59ef3bc
mov dword [esp + 0xc0], 0xf95af794
mov dword [esp + 0xc4], 0xfd57fb53
mov dword [esp + 0xc8], 0xe19eff5b
mov dword [esp + 0xcc], 0xe545e3a9
mov dword [esp + 0xd0], 0xe94be741
mov dword [esp + 0xd4], 0xed81eb79
mov dword [esp + 0xd8], 0xd1abef8c
mov dword [esp + 0xdc], 0xd540d378
mov dword [esp + 0xe0], 0xd979d745
mov dword [esp + 0xe4], 0xdd8bdb7f
mov dword [esp + 0xe8], 0xc18ddf8f
mov dword [esp + 0xec], 0xc5acc39b
mov dword [esp + 0xf0], 0xc9a8c794
mov dword [esp + 0xf4], 0xcda4cb98
mov dword [esp + 0xf8], 0x31aecf9c
mov dword [esp + 0xfc], 0x35913385
mov dword [esp + 0x100], 0x39953792
mov dword [esp + 0x104], 0x3d913baa
mov dword [esp + 0x108], 0x21693f6d
mov dword [esp + 0x10c], 0x257b2375
mov dword [esp + 0x110], 0x2973274a
mov dword [esp + 0x114], 0x2d2a2b7e
mov word [esp + 0x118], 0
mov eax, dword [0x44b9c4]
mov ecx, 0x3d
mov esi, 0xc2
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 5]
mov edx, esi
xor edx, ecx
and edx, edi
xor edx, ecx
add dl, 0xcf
mov byte [esp + ecx - 5], dl
inc ecx
dec esi
cmp ecx, 0x11f
jne 0x40c010
lea ebp, [esp + 0x38]
push 0
push 0
push 0
push 0
push ebp
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x445c68]
mov ecx, dword [0x445c70]
mov edx, ecx
and edx, 0xd5efe52
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0xf2a101ae
jmp eax
Function at 0x40c660
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov dword [esp + 0x38], 0xe117e733
mov dword [esp + 0x3c], 0xfd19e36a
mov dword [esp + 0x40], 0xf90aff08
mov dword [esp + 0x44], 0xf5cbfb1b
mov dword [esp + 0x48], 0xf1c0f73b
mov dword [esp + 0x4c], 0x8dd2f3c0
mov dword [esp + 0x50], 0x89678fb4
mov dword [esp + 0x54], 0x857c8b73
mov dword [esp + 0x58], 0x81778778
mov dword [esp + 0x5c], 0x9d0f8309
mov dword [esp + 0x60], 0x99489fbc
mov dword [esp + 0x64], 0x95ba9b74
mov dword [esp + 0x68], 0x91a697a7
mov dword [esp + 0x6c], 0xada293a6
mov dword [esp + 0x70], 0xa98eaf69
mov dword [esp + 0x74], 0xa551ab41
mov dword [esp + 0x78], 0xa168a752
mov dword [esp + 0x7c], 0xbd67a36c
mov dword [esp + 0x80], 0xb936bf9c
mov dword [esp + 0x84], 0xb576bb76
mov dword [esp + 0x88], 0xb196b78f
mov dword [esp + 0x8c], 0x4d42b373
mov dword [esp + 0x90], 0x49ba4fbc
mov dword [esp + 0x94], 0x45a34bb7
mov dword [esp + 0x98], 0x41a447bb
mov dword [esp + 0x9c], 0x5db94395
mov dword [esp + 0xa0], 0x596f5fd0
mov dword [esp + 0xa4], 0x55975b97
mov dword [esp + 0xa8], 0x5160579d
mov dword [esp + 0xac], 0x6d9c539d
mov dword [esp + 0xb0], 0x69566f4c
mov dword [esp + 0xb4], 0x65b26bbd
mov dword [esp + 0xb8], 0x61b16788
mov dword [esp + 0xbc], 0x7d5663b4
mov dword [esp + 0xc0], 0x798a7f5c
mov dword [esp + 0xc4], 0x758f7b83
mov dword [esp + 0xc8], 0x7156778b
mov dword [esp + 0xcc], 0xd8d73a9
mov dword [esp + 0xd0], 0x9fb0ff1
mov dword [esp + 0xd4], 0x5310bf9
mov dword [esp + 0xd8], 0x1db0724
mov dword [esp + 0xdc], 0x1df003f8
mov dword [esp + 0xe0], 0x19e91fed
mov dword [esp + 0xe4], 0x152b1be7
mov dword [esp + 0xe8], 0x11251727
mov dword [esp + 0xec], 0x2d2413db
mov dword [esp + 0xf0], 0x29182f1c
mov dword [esp + 0xf4], 0x251c2b18
mov dword [esp + 0xf8], 0x21062714
mov dword [esp + 0xfc], 0x3dc123cd
mov dword [esp + 0x100], 0x39dd3fc2
mov dword [esp + 0x104], 0x35c13bca
mov dword [esp + 0x108], 0x31f93705
mov dword [esp + 0x10c], 0xcdfb33fd
mov dword [esp + 0x110], 0xc903cffa
mov dword [esp + 0x114], 0xc5cacb06
mov eax, dword [0x44b9c4]
mov ecx, 0x928eaa29
mov edx, 0xd6
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x6d71560f]
mov edi, ecx
or edi, esi
not esi
or esi, edx
and esi, edi
mov edi, esi
and edi, 1
xor esi, 1
lea ebx, [esi + edi*2]
add bl, 0x32
mov byte [esp + ecx + 0x6d71560f], bl
inc ecx
dec edx
cmp ecx, 0x928eab09
jne 0x40c8b0
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x445de8]
mov ecx, dword [0x445df0]
mov edx, ecx
and edx, 0xf5daf6bd
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0xa250943
jmp eax
Function at 0x418670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [esp + 0x14]
movzx eax, byte [esp + 0x20]
movzx ecx, byte [esp + 0x1c]
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [esi + 8], cl
mov byte [esi + 9], al
movzx edx, byte [ebx]
test dl, dl
je 0x4186ea
lea ecx, [ebx + 1]
xor eax, eax
jmp 0x4186b9
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x4186ec
movzx edi, dl
mov ebp, edi
and ebp, 0xfffffff0
cmp ebp, 0xe0
je 0x4186b0
test dl, dl
jns 0x4186b0
mov edx, edi
and edx, 0xffffffe0
cmp edx, 0xc0
je 0x4186b0
and edi, 0xfffffff8
cmp edi, 0xf0
jne 0x4186b1
add eax, 2
jmp 0x4186b1
xor eax, eax
mov edi, dword [esp + 0x18]
mov ecx, eax
and ecx, 1
xor eax, 1
lea ebp, [eax + ecx*2]
test ebp, ebp
jns 0x418706
mov eax, 0xffffffff
jmp 0x41870d
lea eax, [ebp*2]
push eax
call fcn.004086e0
add esp, 4
mov dword [esi], eax
push 0
push ebx
push ebp
push eax
call fcn.0040afb0
add esp, 0x10
movzx edx, byte [edi]
test dl, dl
je 0x418786
lea ecx, [edi + 1]
xor eax, eax
jmp 0x418749
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x41877a
movzx ebx, dl
mov ebp, ebx
and ebp, 0xfffffff0
cmp ebp, 0xe0
je 0x418740
test dl, dl
jns 0x418740
mov edx, ebx
and edx, 0xffffffe0
cmp edx, 0xc0
je 0x418740
and ebx, 0xfffffff8
cmp ebx, 0xf0
jne 0x418741
add eax, 2
jmp 0x418741
mov ebx, eax
inc ebx
jns 0x418792
mov eax, 0xffffffff
jmp 0x418799
mov eax, 2
mov ebx, 1
jmp 0x418799
lea eax, [eax*2 + 2]
push eax
call fcn.004086e0
add esp, 4
mov dword [esi + 4], eax
push 0
push edi
push ebx
push eax
call fcn.0040afb0
add esp, 0x10
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x418940
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebp, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x418960
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x418980
sar ebx, 1
sar eax, 1
lea ecx, [ebx + eax]
add ecx, 2
test ecx, ecx
jns 0x4189a0
mov eax, 0xffffffff
jmp 0x4189a9
add eax, ebx
lea eax, [eax*2 + 4]
push eax
call fcn.004086e0
add esp, 4
mov edi, eax
movzx ecx, word [esi]
test cx, cx
je 0x4189e1
add esi, 2
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x4189d0
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0x418a11
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418a00
mov word [eax], 0
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.004409e0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4461c0]