joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016a113
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov dword [0x10180814], 0x77
mov dword [ebp - 0x10], eax
call fcn.1016aa69
xor ecx, ecx
mov edx, eax
mov dword [0x10180818], 0x265c
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1016a163
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov dword [0x10180814], 0x16b1
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x1016a266
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], bh
mov byte [ebp - 0x4e], cl
je 0x1016a21a
mov al, byte [ebp - 0x4d]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x4c]
add edx, 1
mov ah, byte [ebp - 0x4e]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x48], edx
jne 0x1016a1c8
mov al, byte [ebp - 0x4e]
test al, 1
jne 0x1016a24d
jmp 0x1016a223
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov edx, dword [ebp - 0x3c]
add edx, 2
mov esi, dword [ebp - 0x2c]
cmp ecx, esi
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], eax
jb 0x1016a1ae
jmp 0x1016a266
mov eax, dword [ebp - 0x3c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1016a831
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10180818], 0x102f
mov dword [0x10180820], 0
mov byte [0x10180824], 0
mov dword [0x10180814], 0x194
mov dword [0x1018081c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1016a8bd
mov eax, dword [0x10180818]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x1016a8ef
xor eax, eax
mov ecx, 0x225b
mov dword [0x10180818], 0x225b
mov dword [0x1018081c], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x1016a8ef
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x10180814], 0x540
mov eax, dword [0x1018081c]
add eax, 1
mov dword [0x1018081c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1016a8bd
jmp 0x1016a892
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov esi, eax
add esi, 0x8b2
mov dword [0x10180828], 0
mov dword [ebp - 0x2c], eax
mov eax, ecx
xor edi, edi
mov dword [ebp - 0x30], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov ebx, dword [ebp - 0x2c]
add ebx, 0xffffeb81
mov dword [0x10180818], ebx
mov ebx, dword [0x10180820]
mov edi, dword [ebp - 0x18]
movzx edi, byte [edi + ecx]
add edi, ebx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x10180828], edi
mov eax, edi
cdq
mov edi, dword [ebp - 0x30]
idiv edi
mov dword [0x10180820], edx
mov dword [0x10180814], esi
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov byte [0x10180824], bl
mov dword [0x10180818], 0xf5e
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov ecx, dword [0x10180814]
add ecx, 0xffffe36b
mov dword [0x10180814], ecx
mov bl, byte [0x10180824]
mov ecx, dword [0x10180820]
mov byte [esi + ecx], bl
mov ecx, dword [0x1018081c]
add ecx, 1
mov dword [0x1018081c], ecx
cmp ecx, 0x100
mov dword [ebp - 0x20], ecx
jl 0x1016a882
jmp 0x1016a8b5
Function at 0x1016abdf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x2d17
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov eax, 0xb8c
mov dword [0x1018081c], 0
mov dword [0x10180820], 0
mov dword [0x1018082c], 0
mov dword [ebp - 0x14], eax
mov eax, dword [0x10180814]
add eax, 0xffffdbca
mov dword [0x10180818], eax
mov dword [0x10180814], 0xb8c
mov eax, dword [ebp - 0x10]
cmp eax, 0
mov eax, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], edi
je 0x1016ada2
jmp 0x1016aca0
mov eax, dword [0x1018081c]
mov ecx, dword [0x10180814]
mov edx, dword [0x10180820]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], esi
jmp 0x1016aca0
mov eax, dword [0x10180814]
add eax, 0x218b
mov dword [ebp - 0x34], eax
jmp 0x1016ada2
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edi, 0x100
mov ebx, eax
add ebx, 1
add ecx, 1
add edx, 0xffffe6cf
mov dword [ebp - 0x3c], eax
mov eax, ecx
mov dword [ebp - 0x40], edx
cdq
idiv edi
mov dword [0x1018081c], edx
mov dword [0x10180818], 0x2089
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ecx + edx]
add ecx, esi
mov eax, ecx
mov dword [ebp - 0x44], edx
cdq
idiv edi
mov dword [0x10180820], edx
mov ecx, dword [ebp - 0x40]
mov dword [0x10180818], ecx
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x44]
mov cl, byte [ecx + esi]
mov byte [0x10180824], cl
mov dword [0x10180814], 0x136f
mov edi, dword [ebp - 0x2c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x10180818], 0xf56
mov cl, byte [0x10180824]
mov edx, dword [0x10180820]
mov byte [edi + edx], cl
mov dword [0x10180814], 0x2311
mov edx, dword [0x1018081c]
movzx edx, byte [edi + edx]
mov ecx, dword [0x10180820]
movzx ecx, byte [edi + ecx]
add ecx, edx
mov dword [0x10180818], 0xa5a
and ecx, 0xff
mov dword [0x1018082c], ecx
mov cl, byte [edi + ecx]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x3c]
mov ch, byte [edx + esi]
mov dword [0x10180814], 0x6f8
xor ch, cl
mov edx, dword [ebp - 0x28]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x1016ac8e
jmp 0x1016ac6c
mov eax, dword [ebp - 0x34]
mov dword [0x10180818], eax
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1016adb2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [0x10180814], 0x1c0e
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1016a3d9
lea ecx, [0x1016a6ef]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x74], 0x136a00
mov edx, dword [0x10180800]
mov dword [esp + 0x5c], edx
mov edx, dword [0x10180804]
mov dword [esp + 0x8c], edx
mov edx, dword [0x10180808]
mov dword [esp + 0x40], edx
mov edx, dword [0x1018080c]
mov dword [esp + 0x64], edx
mov edx, dword [0x10180810]
mov dword [esp + 0x48], edx
mov dword [0x10180814], 0x1fcb
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1016ae7b
lea eax, [esp + 0x30]
mov dword [0x10180814], 0x1c67
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10169e31
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x10180814], 0x1592
mov dword [esp + 0x10], eax
jmp 0x1016aef0
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
jne 0x1016ae9e
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 8], ecx
je 0x1016aeb2
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1016ae7b
mov eax, dword [esp + 0xc]
mov dword [esp + 0x60], eax
mov dword [0x10180814], 0xe25
mov dword [0x10180818], 0x265c
mov ecx, dword [esp + 8]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x50], edx
call fcn.10169f8e
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x1016ae3b
mov eax, dword [esp + 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x405b08
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
mov byte [ebp - 8], dl
test dl, dl
jle 0x405b1b
call fcn.0083584c
mov ebx, ecx
mov byte [ebp - 0x29], dl
mov dword [ebp - 4], eax
mov eax, 0x8383b0
call fcn.0082cbe8
mov word [ebp - 0x18], 0xc
mov ecx, ebx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004f60d4
add dword [ebp - 0xc], 2
mov edx, dword [ebp - 4]
add edx, 0x30
push edx
call fcn.00405b70
pop ecx
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, dword [ebp - 4]
cmp byte [ebp - 0x29], 0
je 0x405b6b
call fcn.00835859
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408594
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], eax
mov eax, 0x83919c
call fcn.0082cbe8
mov dword [ebp - 0x1c], 1
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 4]
push ecx
call fcn.00835288
add esp, 8
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 0xc
mov word [ebp - 0x28], 0x18
push 0x838e99
lea eax, [ebp - 8]
push eax
call fcn.0083524c
add esp, 8
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 0xc
lea edx, [ebp - 4]
push edx
call fcn.00403a78
pop ecx
mov edi, eax
mov ebx, 1
mov word [ebp - 0x28], 0xc
cmp edi, ebx
jb 0x40866a
mov word [ebp - 0x28], 0x24
push ebx
mov esi, ebx
lea eax, [ebp - 4]
dec esi
push eax
call fcn.004086f0
mov cl, byte [eax]
mov eax, esi
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x3c]
add esp, 8
xor cl, byte [eax + edx]
lea edx, [ebp - 0xc]
push ecx
push edx
call fcn.00408448
add esp, 8
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
call fcn.00835460
add esp, 8
dec dword [ebp - 0x1c]
push 2
lea eax, [ebp - 0xc]
push eax
call fcn.00835424
add esp, 8
inc ebx
cmp edi, ebx
jae 0x40860b
mov word [ebp - 0x28], 0x30
lea edx, [ebp - 0x10]
push edx
call fcn.00403a48
pop ecx
mov edx, eax
inc dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.0040848c
lea ecx, [ebp - 0x10]
push ecx
mov eax, dword [ebp - 0x14]
push eax
call fcn.00835448
mov eax, dword [ebp - 0x14]
add esp, 8
mov word [ebp - 0x28], 0x3c
push eax
lea edx, [ebp - 0x10]
dec dword [ebp - 0x1c]
push 2
push edx
call fcn.00835424
add esp, 8
dec dword [ebp - 0x1c]
push 2
lea ecx, [ebp - 8]
push ecx
call fcn.00835424
add esp, 8
dec dword [ebp - 0x1c]
push 2
lea eax, [ebp - 4]
push eax
call fcn.00835424
add esp, 8
pop eax
mov word [ebp - 0x28], 0x30
inc dword [ebp - 0x1c]
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40871c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], eax
mov eax, 0x839250
call fcn.0082cbe8
mov dword [ebp - 0x1c], 1
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 4]
push ecx
call fcn.00835288
add esp, 8
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 0xc
mov word [ebp - 0x28], 0x18
push 0x838e9a
lea eax, [ebp - 8]
push eax
call fcn.0083524c
add esp, 8
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 0xc
mov word [ebp - 0x28], 0x24
lea edx, [ebp - 0xc]
push edx
call fcn.00403a48
pop ecx
mov edx, eax
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00408258
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 4]
push eax
call fcn.00835448
add esp, 8
dec dword [ebp - 0x1c]
push 2
lea edx, [ebp - 0xc]
push edx
call fcn.00835424
add esp, 8
lea ecx, [ebp - 4]
push ecx
call fcn.00403a78
pop ecx
mov edi, eax
mov word [ebp - 0x28], 0xc
mov ebx, 1
mov word [ebp - 0x28], 0xc
cmp edi, ebx
jbe 0x408836
mov word [ebp - 0x28], 0x30
push ebx
mov esi, ebx
lea eax, [ebp - 4]
dec esi
push eax
call fcn.004086f0
mov cl, byte [eax]
mov eax, esi
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x3c]
add esp, 8
xor cl, byte [eax + edx]
lea edx, [ebp - 0x10]
push ecx
push edx
call fcn.00408448
add esp, 8
inc dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
call fcn.00835460
add esp, 8
dec dword [ebp - 0x1c]
push 2
lea eax, [ebp - 0x10]
push eax
call fcn.00835424
add esp, 8
inc ebx
cmp edi, ebx
ja 0x4087d7
mov word [ebp - 0x28], 0x3c
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.00835448
mov eax, dword [ebp - 0x14]
add esp, 8
mov word [ebp - 0x28], 0x48
push eax
lea edx, [ebp - 8]
dec dword [ebp - 0x1c]
push 2
push edx
call fcn.00835424
add esp, 8
dec dword [ebp - 0x1c]
push 2
lea ecx, [ebp - 4]
push ecx
call fcn.00835424
add esp, 8
pop eax
mov word [ebp - 0x28], 0x3c
inc dword [ebp - 0x1c]
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414948
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 0x83cf64
call fcn.0082cbe8
dec ebx
sub ebx, 2
jb 0x414971
dec ebx
je 0x414993
sub ebx, 3
je 0x414971
jmp 0x4149db
mov ebx, esi
push edi
push ebx
call fcn.004149f0
add esp, 8
test eax, eax
jne 0x414985
mov al, 1
jmp 0x414987
xor eax, eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x4149e7
mov ebx, esi
mov word [ebp - 0x18], 0xc
push edi
lea eax, [ebp - 4]
push eax
call fcn.0083524c
add esp, 8
inc dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.004448cc
cmp eax, dword [ebx]
jne 0x4149ba
mov al, 1
jmp 0x4149bc
xor eax, eax
push eax
lea edx, [ebp - 4]
dec dword [ebp - 0xc]
push 2
push edx
call fcn.00835424
add esp, 8
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x4149e7
xor eax, eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419ab8
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, 0x83dbe4
call fcn.0082cbe8
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 0xc
test ebx, ebx
jbe 0x419afb
push esi
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.0041a848
add esp, 0xc
dec ebx
add dword [ebp + 8], 0x30
test ebx, ebx
ja 0x419ae1
mov word [ebp - 0x14], 0
jmp 0x419b3e
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4437d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x44382d
test eax, edx
je 0x443830
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x4437eb
movzx eax, word [eax]
sub eax, ecx
jmp 0x443812
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x443813
add ecx, 4
js 0x443803
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x443810
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x443812
xor eax, eax
ret
test eax, eax
je 0x44383c
test edx, edx
jne 0x4437dc
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x44cb04
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0042a188
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.004304c8
mov edi, eax
cmp edi, 0x104
jbe 0x44caaf
mov eax, edi
add eax, eax
call fcn.004269e0
mov esi, eax
jmp 0x44cab1
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.004304c8
push esi
call fcn.008362a8
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x44caea
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x44cad4
mov eax, esp
cmp esi, eax
je 0x44caf7
mov eax, esi
call fcn.004269fc
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x44cb30
cmp bl, 0
je 0x44cb2c
cmp bl, 0x41
jl 0x44cb27
cmp bl, 0x5a
jg 0x44cb27
or bl, 0x20
xor al, bl
inc esi
jmp 0x44cb0b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x44ca70
Function at 0x4502bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x4502dc
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x4502f6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x4502f1
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x4502fb
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x450369
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x4503b2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x450327
inc dword [ebp - 0xc]
jmp 0x45033f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x45033f
cmp dword [ebp - 0xc], 0
jle 0x45033f
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x450361
xor eax, eax
jmp 0x45035d
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x45035c
mov eax, esi
jmp 0x4503b5
inc eax
cmp eax, ecx
jle 0x450349
inc esi
cmp esi, dword [ebp - 8]
jl 0x450313
jmp 0x4503b2
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x4503b2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x45038a
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x4503ac
xor eax, eax
jmp 0x4503a8
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x4503a7
mov eax, esi
jmp 0x4503b5
inc eax
cmp eax, ecx
jle 0x450394
inc esi
cmp esi, dword [ebp - 8]
jl 0x450372
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4507e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x450807
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x450817
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x450939
test ebx, ebx
jl 0x450939
test esi, esi
jle 0x450939
mov eax, dword [ebp - 8]
call fcn.0042aa10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0042aa10
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x4508d6
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x450939
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x4508bb
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x45088a
inc dword [ebp - 0x14]
jmp 0x45089a
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x45089a
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x4508a5
or eax, 0xffffffff
jmp 0x4508bb
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x4508b8
inc eax
jmp 0x4508bb
or eax, 0xffffffff
test eax, eax
jl 0x4508c3
cmp esi, eax
jg 0x450878
cmp esi, eax
jg 0x4508ce
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x45093c
inc edx
dec dword [ebp - 0x1c]
jne 0x450874
jmp 0x450939
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x450939
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x450920
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x4508ff
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x45090a
or eax, 0xffffffff
jmp 0x450920
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x45091d
inc eax
jmp 0x450920
or eax, 0xffffffff
test eax, eax
jl 0x450928
cmp esi, eax
jg 0x4508e8
cmp esi, eax
jg 0x450933
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x45093c
inc edx
dec dword [ebp - 0x1c]
jne 0x4508e4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4af448
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x4af450
mov eax, edx
pop esi
pop ebx
ret
Function at 0x5bb808
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor eax, eax
push ebp
push 0x5baed3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov ecx, dword [ecx]
mov eax, ecx
test eax, eax
je 0x5bb82f
sub eax, 4
mov eax, dword [eax]
mov edx, eax
test edx, edx
jns 0x5bb83a
call fcn.00427b9c
mov eax, ecx
mov ecx, edx
add ecx, ecx
add ecx, eax
cmp ecx, eax
jbe 0x5bb858
movzx ebx, word [eax]
xor edx, ebx
imul edx, edx, 0x1000193
add eax, 2
cmp ecx, eax
ja 0x5bb846
mov ebx, edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.005c09e4
test al, al
je 0x5bb8a3
lea ecx, [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.005bfe40
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx]
call fcn.0042ae10
jne 0x5bb8bb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
call fcn.0042a098
jmp 0x5bb8bb
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov ecx, dword [ecx]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.005c05ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5baeda
lea eax, [ebp - 4]
call fcn.00429cb8
pop eax
jmp eax