joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409210
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x409292
mov eax, 0x270
mov edx, SysReAllocString
mov esi, 0x270
nop
nop
nop
nop
mov edi, dword [ecx + esi*4 - 0x9bc]
mov ebx, edi
not ebx
or ebx, 0x80000000
add ebx, edi
inc ebx
mov edi, dword [ecx + esi*4 - 0x9b8]
and edi, edx
or edi, ebx
mov ebx, edi
shr ebx, 1
and edi, 1
neg edi
and edi, 0x9908b0df
mov ebp, edi
and ebp, ebx
add ebp, ebp
sub edi, ebp
add edi, ebx
mov ebx, dword [ecx + esi*4 - 0x388]
mov ebp, edi
and ebp, ebx
add edi, ebx
add ebp, ebp
sub edi, ebp
mov dword [ecx + esi*4 + 4], edi
mov edi, esi
and edi, 1
xor esi, 1
lea esi, [esi + edi*2]
cmp esi, 0x4e0
jb 0x409230
jmp 0x4092a4
cmp eax, 0x4e0
jb 0x4092a4
mov esi, ecx
call fcn.004092f0
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
mov edx, ecx
and edx, eax
add ecx, eax
add edx, edx
sub ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4092f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov edi, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
nop
and edi, 0x80000000
mov edx, dword [ecx + eax*4 - 0x630]
mov ebx, edx
and ebx, 0x7ffffffe
or ebx, edi
shr ebx, 1
mov esi, edx
and esi, 1
neg esi
and esi, 0x9908b0df
mov edi, ebx
and edi, esi
add esi, ebx
add edi, edi
sub esi, edi
xor esi, dword [ecx + eax*4]
mov edi, edx
mov dword [ecx + eax*4 - 0xff4], esi
inc eax
cmp eax, 0x4e1
jne 0x409300
mov esi, dword [ecx + 0xd50]
mov eax, 0x355
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 - 0xd50]
xor edi, edx
mov dword [ecx + eax*4 - 0x9c4], edi
inc eax
cmp eax, 0x4e1
jne 0x409350
mov edx, dword [ecx + 4]
mov eax, edx
and eax, 1
neg eax
and edx, 0x7ffffffe
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
or esi, edx
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr esi, 1
xor eax, esi
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
ret
Function at 0x40a440
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x44918c]
mov dword [esp + 8], eax
mov dword [esp + 0x1a8], 0xc1c6cfc4
mov byte [esp + 0x1ac], 0
mov ecx, 0x51
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 0x157]
mov edx, eax
and edx, ecx
add dl, dl
sub al, dl
movzx eax, al
add eax, ecx
add al, 0x6b
mov byte [esp + ecx + 0x157], al
inc ecx
cmp ecx, 0x56
jne 0x40a470
mov eax, dword [esp + 0x1a8]
mov dword [esp], eax
mov dword [esp + 0x18], 0xcf59c943
mov dword [esp + 0x1c], 0xc361cd1a
mov dword [esp + 0x20], 0xc710c117
mov dword [esp + 0x24], 0xbb1ec516
mov dword [esp + 0x28], 0xbf22b924
mov word [esp + 0x2c], 0xbdbc
mov dword [esp + 0x2e], 0
mov byte [esp + 0x32], 0
xor edx, edx
xor esi, esi
nop
nop
movzx ebx, byte [esp + esi + 0x18]
mov eax, esi
xor eax, 0x49a6a1ce
mov edi, edx
and edi, 0x22
sub edi, eax
mov ebp, edi
and ebp, ebx
mov ecx, ebp
and ecx, 0x7d
mov eax, ebp
or eax, 0xfffffffd
inc eax
imul eax, ecx
mov ecx, ebp
and ecx, 2
or ebp, 2
imul ebp, ecx
sub eax, ebp
add edi, ebx
lea ebx, [eax + edi]
add ebx, 0x814592cd
mov eax, ebx
and eax, 0xfe
mov ecx, 1
sub ecx, ebx
and ecx, 1
add eax, ecx
add eax, 0x38
lea ecx, [edi*2 + 0x28b259a]
and ecx, 2
and ebx, ecx
or eax, ecx
add eax, ebx
mov byte [esp + esi + 0x18], al
inc esi
add edx, 2
cmp esi, 0x1b
jne 0x40a4e0
lea edi, [esp + 0x18]
push dword [esp]
push 0
push edi
call dword [esp + 0x14]
mov ecx, 0x449190
push eax
call fcn.00438410
movzx eax, al
mov eax, dword [eax*4 + 0x442a20]
mov ecx, 0x8e2e9fc8
xor ecx, dword [0x442a28]
add eax, ecx
inc eax
jmp eax
Function at 0x40b170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40b3c5
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40b1ac
cmp edx, esi
jae 0x40b3c5
test edi, edi
je 0x40b3c5
movzx ebp, bl
test bl, bl
js 0x40b1e0
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40b1a0
jmp 0x40b3c5
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40b218
cmp bl, 0xc2
jb 0x40b1d0
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40b27a
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40b2cc
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40b242
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40b284
cmp ebp, 0xe0
jne 0x40b28d
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40b1cc
jmp 0x40b28d
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40b3a0
cmp bl, 0xf4
ja 0x40b1d0
movzx ecx, byte [edx + 1]
je 0x40b2d7
cmp ebp, 0xf0
jne 0x40b2e0
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40b1cc
jmp 0x40b2e0
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40b1d2
cmp cl, 0x9f
ja 0x40b1cc
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b3a7
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b3ad
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40b1c2
cmp cl, 0x8f
ja 0x40b1cc
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b3a7
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b3ad
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b3b9
and ecx, 0x3f
shl ecx, 0xc
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
and bl, 7
movzx ecx, bl
shl ecx, 0x12
or ecx, ebp
add edx, 4
mov esi, ecx
and esi, 0x1ff800
cmp esi, 0xd800
je 0x40b1cc
mov ebx, dword [esp]
and ebx, 0x3f
or ebx, ecx
cmp ebx, 0x10000
jb 0x40b1cc
cmp edi, 2
jb 0x40b3a0
add ecx, 0xf0000
shr ecx, 0xa
and ecx, 0x3ff
or ecx, 0xd800
mov word [eax], cx
mov esi, 0x3ff
sub esi, ebx
and esi, 0x3ff
xor esi, 0xdfff
lea ecx, [eax + 4]
mov word [eax + 2], si
jmp 0x40b1c2
mov ecx, eax
jmp 0x40b1c2
inc edx
jmp 0x40b1cc
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40b1d2
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40b1d2
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x449168]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40b98e
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x442e48]
jmp dword [0x442e5c]
Function at 0x40c070
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov dword [esp + 0x38], 0x813787d3
mov dword [esp + 0x3c], 0x8d29833a
mov dword [esp + 0x40], 0x893a8f38
mov dword [esp + 0x44], 0x95fb8b2b
mov dword [esp + 0x48], 0x91e097eb
mov dword [esp + 0x4c], 0x9df293e0
mov dword [esp + 0x50], 0x99c79ff4
mov dword [esp + 0x54], 0xe52c9b33
mov dword [esp + 0x58], 0xe157e748
mov dword [esp + 0x5c], 0xed5fe359
mov dword [esp + 0x60], 0xe9b8ef8c
mov dword [esp + 0x64], 0xf58aebb4
mov dword [esp + 0x68], 0xf186f787
mov dword [esp + 0x6c], 0xfd82f386
mov dword [esp + 0x70], 0xf99effb9
mov dword [esp + 0x74], 0xc551fba1
mov dword [esp + 0x78], 0xc1b8c772
mov dword [esp + 0x7c], 0xcd87c3bc
mov dword [esp + 0x80], 0xc976cfac
mov dword [esp + 0x84], 0xd5b6cbb6
mov dword [esp + 0x88], 0xd1b6d7bf
mov dword [esp + 0x8c], 0xdd62d393
mov dword [esp + 0x90], 0xd96adf6c
mov dword [esp + 0x94], 0x2583db77
mov dword [esp + 0x98], 0x2184278b
mov dword [esp + 0x9c], 0x2d892375
mov dword [esp + 0xa0], 0x295f2f90
mov dword [esp + 0xa4], 0x35572b57
mov dword [esp + 0xa8], 0x3140374d
mov dword [esp + 0xac], 0x3d4c334d
mov dword [esp + 0xb0], 0x39563f5c
mov dword [esp + 0xb4], 0x5723b6d
mov dword [esp + 0xb8], 0x1510758
mov dword [esp + 0xbc], 0xd760354
mov dword [esp + 0xc0], 0x9ba0f6c
mov dword [esp + 0xc4], 0x15bf0ba3
mov dword [esp + 0xc8], 0x117617bb
mov dword [esp + 0xcc], 0x1dbd1359
mov dword [esp + 0xd0], 0x19ab1fb1
mov dword [esp + 0xd4], 0x65711ba9
mov dword [esp + 0xd8], 0x612b6704
mov dword [esp + 0xdc], 0x6dd063c8
mov dword [esp + 0xe0], 0x69d96fdd
mov dword [esp + 0xe4], 0x751b6bc7
mov dword [esp + 0xe8], 0x71057707
mov dword [esp + 0xec], 0x7d04730b
mov dword [esp + 0xf0], 0x79087f0c
mov dword [esp + 0xf4], 0x450c7b08
mov dword [esp + 0xf8], 0x41264734
mov dword [esp + 0xfc], 0x4de1431d
mov dword [esp + 0x100], 0x49ed4fe2
mov dword [esp + 0x104], 0x55e14bfa
mov dword [esp + 0x108], 0x51295725
mov dword [esp + 0x10c], 0x5d2b532d
mov dword [esp + 0x110], 0x59235f2a
mov dword [esp + 0x114], 0xa55a5b26
mov word [esp + 0x118], 0
mov ebx, dword [0x44915c]
xor ecx, ecx
nop
nop
movzx edx, byte [esp + ecx + 0x38]
lea eax, [ecx - 0x16c5b5df]
mov edi, edx
and edi, eax
mov ebp, edi
and ebp, 0xfffffffd
mov esi, edi
and esi, 2
or edi, 2
imul edi, esi
xor esi, 2
imul esi, ebp
add edi, esi
xor eax, edi
mov esi, 0x16c5b5de
sub esi, ecx
and esi, edi
add esi, esi
sub eax, esi
add al, dl
add al, 0x5b
mov byte [esp + ecx + 0x38], al
mov eax, ecx
and eax, 1
and ecx, 0xfe
mov edx, ecx
xor edx, 0xfe
xor ecx, 0xfffffffe
or ecx, edx
not ecx
add ecx, eax
cmp ecx, 0xe2
jb 0x40c2c0
lea eax, [esp + 0x38]
push 0
push 0
push 0
push 0
push eax
call ebx
xor ecx, ecx
mov dword [esp + 4], eax
test eax, eax
setne cl
mov eax, dword [ecx*4 + 0x442ed8]
mov ecx, 0x730159cb
xor ecx, dword [0x442ee0]
add eax, ecx
inc eax
jmp eax
Function at 0x40ca80
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov edi, dword [esp + 0x268]
mov dword [esp + 0x3c], 0x118f1f63
mov dword [esp + 0x40], 0x1589139a
mov dword [esp + 0x44], 0x98a1788
mov dword [esp + 0x48], 0xd5b0b6b
mov dword [esp + 0x4c], 0x1500f5b
mov dword [esp + 0x50], 0x5220350
mov dword [esp + 0x54], 0x396f075c
mov dword [esp + 0x58], 0x3da43ba3
mov dword [esp + 0x5c], 0x31af3f58
mov dword [esp + 0x60], 0x35a733b9
mov dword [esp + 0x64], 0x29483714
mov dword [esp + 0x68], 0x2d0a2b5c
mov dword [esp + 0x6c], 0x217e2f7f
mov dword [esp + 0x70], 0x2572237e
mov dword [esp + 0x74], 0x59062769
mov dword [esp + 0x78], 0x5dc15b31
mov dword [esp + 0x7c], 0x51085fc2
mov dword [esp + 0x80], 0x551f5304
mov dword [esp + 0x84], 0x49de5774
mov dword [esp + 0x88], 0x4d1e4b1e
mov dword [esp + 0x8c], 0x416e4f17
mov dword [esp + 0x90], 0x45d24303
mov dword [esp + 0x94], 0x79da47d4
mov dword [esp + 0x98], 0x7d137b1f
mov dword [esp + 0x9c], 0x711c7f1b
mov dword [esp + 0xa0], 0x75e9730d
mov dword [esp + 0xa4], 0x692777e0
mov dword [esp + 0xa8], 0x6d3f6b3f
mov dword [esp + 0xac], 0x61306f25
mov dword [esp + 0xb0], 0x65346335
mov dword [esp + 0xb4], 0x993e6744
mov dword [esp + 0xb8], 0x9de29be5
mov dword [esp + 0xbc], 0x91e19fe8
mov dword [esp + 0xc0], 0x95ce93ec
mov dword [esp + 0xc4], 0x890a97b4
mov dword [esp + 0xc8], 0x8d178b13
mov dword [esp + 0xcc], 0x81ae8feb
mov dword [esp + 0xd0], 0x85e583f9
mov dword [esp + 0xd4], 0xb91b87e1
mov dword [esp + 0xd8], 0xbde1bb29
mov dword [esp + 0xdc], 0xb1fbbf9c
mov dword [esp + 0xe0], 0xb520b328
mov dword [esp + 0xe4], 0xa929b725
mov dword [esp + 0xe8], 0xadfbabcf
mov dword [esp + 0xec], 0xa1fdafff
mov dword [esp + 0xf0], 0xa5fca3eb
mov dword [esp + 0xf4], 0xd9f8a7f4
mov dword [esp + 0xf8], 0xdd84db88
mov dword [esp + 0xfc], 0xd1fedf8c
mov dword [esp + 0x100], 0xd5b1d3a5
mov dword [esp + 0x104], 0xc9b5d7b2
mov dword [esp + 0x108], 0xcd51cb5a
mov dword [esp + 0x10c], 0xc199cf9d
mov dword [esp + 0x110], 0xc58bc395
mov dword [esp + 0x114], 0xf993c79a
mov dword [esp + 0x118], 0xfdfafbae
mov esi, dword [0x44915c]
xor ecx, ecx
xor edx, edx
movzx ebx, byte [esp + edx + 0x3c]
mov eax, ecx
and eax, 0x10a
mov ebp, edx
xor ebp, 0xd3c64a85
add ebp, eax
mov eax, ebp
and eax, ebx
add eax, eax
sub eax, ebp
mov ebp, ebx
not ebp
and ebp, eax
not eax
and eax, ebx
sub eax, ebp
add al, 0x67
mov byte [esp + edx + 0x3c], al
inc edx
add ecx, 2
cmp edx, 0xe0
jne 0x40ccd0
lea ebp, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ebp
call esi
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
mov eax, dword [eax*4 + 0x4430b0]
mov ecx, 0xf3a9fc34
xor ecx, dword [0x4430b8]
add eax, ecx
inc eax
jmp eax
Function at 0x4136d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + esi + 2], 0
lea esi, [esi + 2]
jne 0x4136f0
mov edi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x413710
sar esi, 1
sar eax, 1
lea ecx, [esi + eax]
add ecx, 2
test ecx, ecx
jns 0x413730
mov eax, 0xffffffff
jmp 0x413739
add eax, esi
lea eax, [eax*2 + 4]
push eax
call fcn.004086b0
add esp, 4
mov ebp, eax
movzx ecx, word [edi]
test cx, cx
je 0x413771
add edi, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x413760
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebx]
test cx, cx
je 0x4137a1
lea edx, [ebx + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413790
mov word [eax], 0
lea eax, [esp + 8]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.0043d410
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x443538]
Function at 0x413a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1280
call fcn.00408680
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
xor ecx, ecx
nop
nop
nop
nop
nop
cmp word [eax + ecx], 0
lea ecx, [ecx + 2]
jne 0x413a50
lea edx, [eax + ecx]
add edx, 0xfffffffe
add ecx, eax
mov edi, 1
sub edi, ecx
and edi, eax
mov esi, eax
not esi
and esi, edx
sub esi, edi
sar esi, 1
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44a4a8]
mov ebx, dword [esp + 0x34]
mov edi, 0xffffffff
test ebx, ebx
jns 0x413a9c
mov eax, 0xffffffff
jmp 0x413a9f
lea eax, [ebx + ebx]
push eax
call fcn.004086b0
add esp, 4
lea ecx, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x2c], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44a4a8]
mov eax, dword [esp + 0x34]
mov ecx, eax
add ecx, 0xd
js 0x413ad4
lea edi, [eax*2 + 0x1a]
push edi
call fcn.004086b0
add esp, 4
mov edi, eax
mov dword [esp + 0x27c], 0xc9becba8
mov dword [esp + 0x280], 0xc54bc757
mov dword [esp + 0x284], 0xc1e2c348
mov dword [esp + 0x288], 0xfd65ffaa
mov dword [esp + 0x28c], 0xf977fb72
mov dword [esp + 0x290], 0xf567f76f
mov dword [esp + 0x294], 0xf1f2f366
mov byte [esp + 0x298], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
not edx
mov esi, ecx
shr esi, 1
and esi, 1
mov ebx, ecx
and ebx, 0x11
and edx, 2
imul edx, ebx
or ebx, 2
imul ebx, esi
movzx esi, byte [esp + ecx + 0x27c]
lea edx, [edx + ebx*2]
mov ebx, eax
and ebx, 0x26
sub edx, ebx
lea ebx, [ecx + edx]
add ebx, 0x9a9cb053
mov edx, ebx
or edx, esi
and ebx, esi
sub edx, ebx
mov esi, 0x35f54747
sub esi, edx
add edx, 0xca0ab8ba
mov ebx, edx
and ebx, 1
xor edx, 1
add edx, 0xa6
or edx, ebx
not esi
and esi, 1
add edx, esi
mov byte [esp + ecx + 0x27c], dl
inc ecx
add eax, 2
cmp ecx, 0x1d
jne 0x413b40
mov eax, dword [esp + 0x24]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x413be1
mov eax, dword [esp + 0x24]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413bd0
mov word [eax], 0
movzx ecx, word [esp + 0x27c]
test cx, cx
je 0x413c11
lea edx, [esp + 0x27e]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413c00
mov word [eax], 0
lea eax, [esp + 0x150]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.0043d410
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x443a34]
Function at 0x41b0f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, ecx
mov esi, dword [esp + 0x2c]
mov byte [esp + 2], 0
mov dword [esp + 0xc], ecx
jmp 0x41b15c
mov eax, dword [esp + 0x2c]
push dword [eax]
call fcn.004086c0
add esp, 4
mov ebx, dword [esp + 8]
mov esi, dword [esp + 0x2c]
mov dword [esi], ebx
mov edx, dword [esp + 4]
lea eax, [ebx + edx]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x10]
add eax, ebx
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x14]
movzx eax, byte [esp + 3]
mov ebp, ebx
mov ebx, dword [esp + 0xc]
mov byte [ebp + edx], al
inc dword [esi + 4]
cmp byte [esp + 2], 0xa
je 0x41b2f8
push 0x1006c792
push dword [0x449190]
call fcn.0043ca10
add esp, 8
push 8
push 1
lea ecx, [esp + 0xa]
push ecx
push dword [ebx]
call eax
test eax, eax
setg cl
jg 0x41b18c
cmp dword [ebx], 0xffffffff
jne 0x41b2c0
test eax, eax
jle 0x41b2f6
movzx eax, byte [esp + 2]
mov ebp, dword [esi]
mov edi, dword [esi + 4]
mov edx, edi
sub edx, ebp
cmp edi, dword [esi + 8]
jne 0x41b14a
mov byte [esp + 3], al
mov dword [esp + 0x14], ecx
lea eax, [edx + 1]
mov esi, edx
shr esi, 1
mov dword [esp + 4], edx
lea ecx, [esi + edx]
cmp ecx, eax
ja 0x41b1c3
mov ecx, eax
mov dword [esp + 0x10], ecx
push ecx
call fcn.004086b0
add esp, 4
mov ebx, eax
test ebp, ebp
je 0x41b122
cmp ebx, ebp
mov edx, dword [esp + 4]
mov dword [esp + 8], ebx
jbe 0x41b27f
cmp edi, ebx
jbe 0x41b27f
test edx, edx
je 0x41b110
mov edx, dword [esp + 4]
mov eax, edx
and eax, 0xfffffffe
add eax, eax
mov ecx, edx
xor ecx, 1
sub eax, ecx
lea ecx, [eax + ebp]
add eax, dword [esp + 8]
mov esi, edx
and esi, 3
je 0x41b234
neg esi
xor edx, edx
nop
nop
movzx ebx, byte [ecx + edx]
mov byte [eax + edx], bl
dec edx
cmp esi, edx
jne 0x41b220
add ecx, edx
add eax, edx
add edx, dword [esp + 4]
sub ebp, edi
cmp ebp, 0xfffffffc
ja 0x41b110
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + esi*2]
mov byte [eax + esi*2], bl
movzx ebx, byte [ecx + esi*2 - 1]
mov byte [eax + esi*2 - 1], bl
movzx ebx, byte [ecx + esi*2 - 2]
mov byte [eax + esi*2 - 2], bl
movzx ebx, byte [ecx + esi*2 - 3]
mov byte [eax + esi*2 - 3], bl
add esi, 0xfffffffe
add edx, 0xfffffffc
jne 0x41b250
jmp 0x41b110
mov ecx, edx
shr ecx, 2
mov eax, ebp
mov edi, ebx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, edx
and edx, 0xfffffffc
add ebx, edx
add edx, ebp
and esi, 1
mov ebp, edx
mov ecx, esi
mov edi, ebx
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test al, 1
je 0x41b110
mov ecx, dword [esp + 4]
and ecx, 2
movzx edx, byte [edx + ecx]
mov byte [ebx + ecx], dl
jmp 0x41b110
push 0xea8d1240
push dword [0x449190]
call fcn.0043ca10
add esp, 8
push 2
push dword [ebx]
call eax
push 0xa3d60213
push dword [0x449190]
call fcn.0043ca10
add esp, 8
push dword [ebx]
call eax
mov dword [ebx], 0xffffffff
xor ecx, ecx
mov eax, ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x426b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x426b9a
cmp edi, 1
je 0x426b9a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x426b71
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x426b70
cmp ecx, 0x20
je 0x426b70
cmp ecx, 0x2b
mov edx, edi
je 0x426b90
cmp ecx, 0x2d
jne 0x426baf
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x426bb4
xor edi, edi
test eax, eax
je 0x426d6d
mov dword [eax], 0x16
jmp 0x426d6d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x426bdd
cmp edx, 0x10
jne 0x426bf5
cmp byte [ebx], 0x30
jne 0x426bd6
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x426bf7
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x426bf7
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x426c50
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x426d08
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x426c77
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x426d38
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x426d38
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x426c30
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x426cc0
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x426cc9
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x426ced
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x426d1d
test bl, bl
jne 0x426d1d
mov ebx, dword [esp + 0x10]
jmp 0x426c43
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x426c25
mov esi, edi
test bl, bl
jne 0x426d2b
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x426c25
mov eax, dword [esp + 0x38]
test eax, eax
je 0x426d46
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x426d54
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x426d64
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x426d6d
cmp byte [esp + 3], 0
jne 0x426d6d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret