joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54eba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [0x566964], 0x1994
mov dword [ebp - 0x10], eax
call fcn.0054e5d0
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov esi, dword [eax + esi + 0x78]
mov dword [0x566964], 0x2010
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x54ed00
jmp 0x54ec21
mov eax, dword [ebp - 0x28]
movzx eax, word [eax]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x1c]
mov esi, dword [ebp - 0x1c]
add esi, dword [ecx + eax*4]
mov dword [0x566968], 0x2690
mov dword [ebp - 0x24], esi
jmp 0x54ed00
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov bl, cl
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
mov byte [ebp - 0x47], bl
je 0x54ecba
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
cmp eax, 0x20
setb dl
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], ch
mov byte [ebp - 0x4e], dl
mov al, byte [ebp - 0x4d]
mov cl, byte [ebp - 0x4e]
and al, cl
test al, 1
mov edx, dword [ebp - 0x4c]
mov al, byte [ebp - 0x46]
mov dword [ebp - 0x40], edx
mov byte [ebp - 0x47], al
jne 0x54ec4d
mov al, byte [ebp - 0x47]
test al, 1
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x28], ecx
jne 0x54ebf9
mov eax, dword [ebp - 0x38]
add eax, 2
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
jb 0x54ec33
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x54ed00
mov eax, dword [ebp - 0x24]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x54ed10
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [0x566964], 0xe24
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
je 0x54ed81
mov dword [0x566968], 0xd66
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], eax
jl 0x54ed4a
mov eax, dword [ebp - 0x1c]
mov dword [0x566964], 0xf30
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
jne 0x54ee4d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x54ee4d
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff5
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x61
jne 0x54ee4d
mov dword [0x566964], 0x15e2
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x54ee4d
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff7
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp word [eax], 0x64
jne 0x54ee4d
mov dword [0x566964], 0x1882
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x54ee4d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
mov dx, word [eax + ecx*2 - 0xe]
mov word [ebp - 0x2a], dx
mov ax, word [ebp - 0x2a]
cmp ax, 0x6c
jne 0x54ee4d
mov eax, 1
mov dword [0x566968], 0xfeb
mov dword [ebp - 0x30], eax
jmp 0x54ee5c
xor eax, eax
mov dword [0x566964], 0x177
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add esp, 0x30
pop ebp
ret
Function at 0x54f690
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa0
call fcn.004010a0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x2c], ecx
je 0x54f6d4
jmp 0x54f839
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
cmp word [ecx], 0x5a4d
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
je 0x54f787
jmp 0x54f79f
lea eax, [esp + 0x40]
mov dword [0x566964], 0x2038
mov dword [0x566968], 0x2318
mov dword [esp + 0x18], eax
call fcn.0054ed10
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x14], ecx
jne 0x54f831
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.0054ef30
lea ecx, [0x54dd70]
mov edx, dword [0x566968]
mov esi, dword [esp + 0x30]
mov dword [esp + 0x78], esi
mov dword [esp + 0x64], 0x119600
mov esi, dword [0x566950]
mov dword [esp + 0x74], esi
mov esi, dword [0x566954]
mov dword [esp + 0x6c], esi
mov esi, dword [0x566958]
mov dword [esp + 0x48], esi
mov esi, dword [0x56695c]
mov dword [esp + 0x50], esi
mov esi, dword [0x566960]
mov dword [esp + 0x5c], esi
add edx, 0xfffff8dd
mov dword [0x566964], edx
mov dword [0x566968], 0x22a3
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
jmp 0x54f6b4
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
je 0x54f7ca
mov eax, dword [esp + 0x1c]
add eax, 0xfffff000
and eax, 0xfffff000
mov ecx, dword [esp + 0x20]
add ecx, 0xffffdab2
mov dword [0x566964], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
jmp 0x54f6b4
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x40]
mov dword [esp + 0x40], eax
mov dword [0x566968], 0x1c92
mov dword [0x566964], 0x14d5
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x38]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0054e8f0
mov ecx, dword [0x566968]
add ecx, 0x1f82
mov dword [0x566964], ecx
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x402770
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40d02c], 0x8088405
inc edx
mov dword [0x40d02c], edx
mul edx
mov eax, edx
ret

Function at 0x40782c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40d558
mov eax, esi
mov edx, 8
test al, 1
je 0x407848
shr eax, 1
xor eax, 0xedb88320
jmp 0x40784a
shr eax, 1
dec edx
jne 0x40783b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407834
pop esi
ret

Function at 0x407877
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40d554], 0
jne 0x407883
call fcn.0040782c
push 1
push 0x40d554
call fcn.00404398
mov eax, edi
test esi, esi
je 0x4078ae
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40d558]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x407889
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x402460
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test ecx, ecx
je 0x40256c
test edx, edx
je 0x40256c
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp], ecx
mov ebp, dword [esp + 0x30]
test ebp, ebp
je 0x4024aa
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x4024b1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x402490
jmp 0x4024b3
mov esi, 0x1505
jmp 0x4024b3
mov esi, ecx
mov ebx, dword [esp]
mov ecx, dword [ebx + 0x20]
lea ebp, [ecx - 1]
mov dword [esp + 0x14], ecx
sub ecx, 1
mov dword [esp + 0x18], ecx
jb 0x402565
mov dword [esp + 8], edx
and ebp, esi
mov eax, dword [ebx + 4]
mov dword [esp + 0x10], eax
xor edi, edi
mov edx, ebp
mov dword [esp + 4], ebp
jmp 0x4024f7
inc edi
cmp dword [esp + 0x14], edi
je 0x402563
mov eax, edi
and eax, edx
mov ecx, edi
xor ecx, edx
lea eax, [ecx + eax*2]
and eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov ebp, dword [ecx + eax*4]
cmp ebp, 0xffffffff
je 0x402563
mov eax, dword [ebx + 8]
cmp dword [eax + ebp*4], esi
jne 0x4024f0
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408d20
mov edx, dword [esp + 8]
mov ebx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x30]
jne 0x4024f0
push dword [esp + 0x30]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00408d40
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4024f0
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x402565
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4034c0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x403676
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40366f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x403556
mov eax, dword [esp + 4]
sub eax, dword [esp]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 4]
mov ebx, 0x15b0
je 0x40366f
xor edx, edx
cmp ebx, 8
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
jb 0x4035d8
and ebx, 0x1ff8
mov dword [esp], ebx
xor eax, eax
mov edx, eax
movzx esi, byte [ebp + eax]
add esi, edi
mov eax, esi
and eax, ecx
xor ecx, esi
movzx ebx, byte [ebp + edx + 1]
add ebx, esi
movzx edi, byte [ebp + edx + 2]
add edi, ebx
add ebx, ecx
lea ecx, [ebx + eax*2]
mov ebx, dword [esp + 4]
movzx eax, byte [ebp + edx + 3]
add eax, edi
add ecx, edi
movzx esi, byte [ebp + edx + 4]
add esi, eax
add ecx, eax
movzx eax, byte [ebp + edx + 5]
add eax, esi
add ecx, esi
movzx esi, byte [ebp + edx + 6]
add esi, eax
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, esi
add ecx, esi
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, ebx
jb 0x403570
add ebp, eax
mov esi, dword [esp + 8]
mov edx, dword [esp]
mov eax, edx
sub eax, ebx
jae 0x40351d
mov dword [esp + 0xc], eax
mov eax, ebx
and eax, 3
mov dword [esp], edx
je 0x40361f
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x403600
mov eax, dword [esp]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x403510
jmp 0x40362e
mov eax, edx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x403510
mov ebx, dword [esp + 4]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x403640
jmp 0x403510
shl ecx, 0x10
or ecx, edi
jmp 0x40367b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403690
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4036be
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x40375c
not eax
test bl, 1
jne 0x4036c5
mov edx, ebx
cmp ebx, 1
jne 0x4036f6
jmp 0x40375a
xor eax, eax
jmp 0x40375c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x444a14]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x444a14]
cmp ebx, 1
je 0x40375a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x444a14]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x444a14]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x444a14]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x444a14]
add esi, 2
cmp edx, esi
jne 0x403700
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x4170b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov edi, dword [ebp + 0x10]
push eax
mov dword [esi + 8], esp
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax], 0
lea eax, [eax + 2]
jne 0x4170d0
lea ecx, [edi + eax]
add ecx, 0xfffffffe
add eax, edi
mov edx, 1
sub edx, eax
and edx, edi
mov ebx, edi
not ebx
and ebx, ecx
sub ebx, edx
sar ebx, 1
mov dword [esi + 0x10], ebx
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 4]
xor ecx, ecx
cmp word [edi + ecx], 0
lea ecx, [ecx + 2]
jne 0x417100
lea edx, [edi + ecx]
add edx, 0xfffffffe
mov eax, edi
not eax
and eax, edx
add ecx, edi
mov edx, 1
sub edx, ecx
and edx, edi
sub eax, edx
sar eax, 1
lea ecx, [ebx + eax]
add ecx, 2
test ecx, ecx
jns 0x417136
mov eax, 0xffffffff
jmp 0x41713f
add eax, ebx
lea eax, [eax*2 + 4]
push eax
call fcn.00408c10
add esp, 4
mov ebx, eax
movzx ecx, word [edi]
test cx, cx
je 0x417171
add edi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x417160
mov word [eax], 0x5c
add eax, 2
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x4171a1
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417190
mov word [eax], 0
lea eax, [esi + 0x14]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00441bc0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448fd8]
Function at 0x4174a0
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x4174c0
sar esi, 1
lea edi, [esp + 0x74]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x44ed8c]
mov ebx, dword [esp + 0x74]
test ebx, ebx
jns 0x4174ef
mov eax, 0xffffffff
jmp 0x4174f2
lea eax, [ebx + ebx]
push eax
call fcn.00408c10
add esp, 4
push edi
mov edi, eax
push ebx
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x44ed8c]
mov dword [esp + 0x10], 0xebc815ba
mov dword [esp + 0x14], 0xef5de94d
mov dword [esp + 0x18], 0xe30ced5a
mov dword [esp + 0x1c], 0xe75be148
mov dword [esp + 0x20], 0xfb51e550
mov dword [esp + 0x24], 0xff49f945
mov dword [esp + 0x28], 0xf3fcfd4c
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x2f], 0
mov ecx, 0x8b29ac7d
nop
nop
nop
movzx edx, byte [esp + ecx + 0x74d65393]
xor edx, ecx
mov dword [esp + 0x8c], edx
mov edx, dword [esp + 0x8c]
add dl, 0x95
mov byte [esp + ecx + 0x74d65393], dl
cmp ecx, 0x8b29ac9f
je 0x4175b4
movzx edx, byte [esp + ecx + 0x74d65394]
lea esi, [ecx + 1]
xor esi, edx
mov dword [esp + 0x8c], esi
mov edx, dword [esp + 0x8c]
add dl, 0x95
mov byte [esp + ecx + 0x74d65394], dl
add ecx, 2
jmp 0x417560
mov dword [esp + 0x48], edi
lea edi, [esp + 0xb8]
lea edx, [esp + 0x10]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xd4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x74]
mov ecx, eax
add ecx, 0xd
jns 0x4175ee
mov eax, 0xffffffff
jmp 0x4175f5
lea eax, [eax*2 + 0x1a]
mov esi, dword [esp + 0x48]
push eax
call fcn.00408c10
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x417631
lea edx, [esi + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417620
mov word [eax], 0
movzx ecx, word [esp + 0xb8]
test cx, cx
je 0x417661
lea edx, [esp + 0xba]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417650
mov word [eax], 0
lea eax, [esp + 0x54]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00441bc0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4492a8]

Function at 0x4188a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe8
mov ebx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ebp + 0x10], 0
setne al
jmp dword [eax*4 + 0x4493e8]
Function at 0x41cf20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov dword [esp + 8], 0xf31dcd30
mov dword [esp + 0xc], 0xf76ff115
mov dword [esp + 0x10], 0xfb28f520
mov dword [esp + 0x14], 0xff18f91c
lea eax, [esp + 0x18]
mov dword [esp], eax
mov word [esp + 0x18], 0xfdfc
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov byte [esp + 0x22], 0
xor eax, eax
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 8]
mov dword [esp + 4], edx
mov edi, esi
not edi
and edi, 0x628123c
mov ecx, eax
xor ecx, 0x314091e
add ecx, edi
mov edi, ecx
and edi, edx
mov edx, edi
and edx, 0x7d
mov ebx, edi
or ebx, 0xfffffffd
inc ebx
imul ebx, edx
mov edx, edi
and edx, 2
or edi, 2
imul edi, edx
sub ebx, edi
add ecx, dword [esp + 4]
add ecx, ebx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
add cl, 0x2e
mov byte [esp + eax + 8], cl
inc eax
add esi, 0xfffffffe
cmp esi, 0xffffffc8
jne 0x41cf80
lea edi, [esp + 0x28]
lea ebx, [esp + 8]
mov eax, ebx
mov ecx, 4
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x38]
mov ecx, 1
mov eax, dword [esp]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
mov edi, dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41d010
cmp eax, 0xffffffed
jge 0x41d027
mov eax, 0xffffffff
jmp 0x41d02a
add eax, 0x12
push eax
call fcn.00408c10
add esp, 4
mov esi, eax
movzx ecx, word [edi]
test cx, cx
je 0x41d061
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41d050
mov word [eax], 0
movzx ecx, word [esp + 0x28]
test cx, cx
je 0x41d091
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d080
mov word [eax], 0
push ebx
push esi
call fcn.00441e10
add esp, 8
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x449718]
Function at 0x421d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0x33eb350d
mov dword [esp + 0x14], 0xcfc031c2
mov dword [esp + 0x18], 0xcb33cd12
mov dword [esp + 0x1c], 0xc737c946
mov dword [esp + 0x20], 0xc320c5fd
mov dword [esp + 0x24], 0xdf38c12e
mov dword [esp + 0x28], 0xdb2edd55
mov dword [esp + 0x2c], 0xd723d926
mov dword [esp + 0x30], 0xd32ad558
mov dword [esp + 0x34], 0xef5ed125
mov dword [esp + 0x38], 0xeb08ed12
mov dword [esp + 0x3c], 0xe766e93a
mov dword [esp + 0x40], 0xe31ee517
mov dword [esp + 0x44], 0xff14e115
mov dword [esp + 0x48], 0xfb71fd05
lea eax, [esp + 0x4c]
mov dword [esp + 4], eax
mov word [esp + 0x4c], 0xf9fa
mov dword [esp + 0x4e], 0
mov byte [esp + 0x52], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 0x10]
mov ebx, edx
xor ebx, 0x1a095507
mov edi, ecx
and edi, 0xf0
sub edi, ebx
lea ebx, [esi + esi]
not ebx
add ebx, esi
lea eax, [edi + edi]
not eax
add eax, edi
or eax, ebx
or edi, esi
and edi, eax
mov dword [esp + 0x5c], edi
mov eax, dword [esp + 0x5c]
add al, 0x31
mov byte [esp + edx + 0x10], al
inc edx
add ecx, 2
cmp edx, 0x43
jne 0x421e20
lea esi, [esp + 0x5c]
lea eax, [esp + 0x10]
mov edi, esi
mov ecx, 0xf
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x98]
mov ecx, 1
mov eax, dword [esp + 4]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 8]
push edi
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x44ed8c]
mov ebx, dword [esp + 8]
test ebx, ebx
jns 0x421ead
mov eax, 0xffffffff
jmp 0x421eb0
lea eax, [ebx + ebx]
push eax
call fcn.00408c10
add esp, 4
push edi
push ebx
mov dword [esp + 0xc], eax
push eax
push 0x1e
push esi
push 0
call dword [0x44ed8c]
mov dword [esp + 0x10], 0xb32cb51a
mov dword [esp + 0x14], 0xaf22b139
mov dword [esp + 0x18], 0xab37ad32
mov dword [esp + 0x1c], 0xa736a924
mov dword [esp + 0x20], 0xa32aa531
mov dword [esp + 0x24], 0x9fa0a13e
mov dword [esp + 0x28], 0
mov dword [esp + 0x2b], 0
xor eax, eax
nop
nop
nop
movzx ecx, byte [esp + eax + 0x10]
mov edx, eax
and edx, 0x1399249
mov edi, eax
or edi, 0x81399249
add edi, edx
mov edx, edi
and edx, ecx
mov ebx, edx
and ebx, 0xfffffffd
mov esi, edx
and esi, 2
or edx, 2
imul edx, esi
xor esi, 2
imul esi, ebx
add edx, esi
mov esi, edx
not esi
and esi, edi
not edi
and edx, edi
sub edx, esi
mov esi, ecx
not esi
and esi, edx
not edx
and edx, ecx
sub edx, esi
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0xc]
inc cl
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x1f
jne 0x421f10
push 0
push 0
lea eax, [esp + 0x18]
push eax
mov esi, dword [esp + 0x10]
push esi
push dword [ebp + 8]
call fcn.0041a070
add esp, 0x14
jmp dword [0x44a11c]
Function at 0x424f90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x460
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x58], 0x4bd045d3
mov dword [esp + 0x5c], 0x4fef49e1
mov dword [esp + 0x60], 0x339e4ddd
mov dword [esp + 0x64], 0x37a83199
mov dword [esp + 0x68], 0x3b34359d
mov dword [esp + 0x6c], 0
mov word [esp + 0x70], 0
mov eax, 0x3cf94135
mov ecx, 0x4306beca
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x3cf940dd]
mov esi, ecx
and esi, 0x430682b5
mov edi, eax
and edi, 0x2c28004a
or edi, esi
xor edi, edx
xor edi, 0xd3d7c3b5
mov dword [esp + 0x20], edi
mov edx, dword [esp + 0x20]
mov esi, edx
xor esi, 0x73
and edx, 0xc
add edx, edx
sub edx, esi
mov byte [esp + eax - 0x3cf940dd], dl
inc eax
dec ecx
cmp eax, 0x3cf9414f
jne 0x425000
lea edi, [esp + 0x58]
lea ecx, [esp + 0x34]
push edi
call fcn.0043c7e0
shr eax, 0x1f
jmp dword [eax*4 + 0x44a9c8]