joyce8/EMBER2024-capa huggingface dataset:
Function at 0x90c4770
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d4bd2
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb20
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb2c], eax
call fcn.090054d5
add esp, 4
lea ecx, [ebp - 0xb24]
push eax
call fcn.090054d5
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push dword [ebp - 0xb24]
mov dword [ebp - 4], 0
push esi
call fcn.09009307
add esp, 0x3c
lea ecx, [ebp - 0xb20]
push eax
call fcn.090054d5
mov byte [ebp - 4], 1
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x90c4820
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0x918]
push 0
push 0x5058595a
push 0x67386b30
push 0x100
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.090054d5
movzx ecx, word [ebp - 0x11c]
movzx edi, word [ebp - 0x914]
mov dword [ebp - 0xb28], ecx
cmp ecx, edi
jbe 0x90c499a
mov edx, ecx
sub edx, edi
xor esi, esi
mov dword [ebp - 0xb1c], edx
movzx eax, word [ebp + esi*8 - 0x914]
cmp eax, edi
ja 0x90c4891
xor eax, eax
jmp 0x90c48be
cmp eax, ecx
jb 0x90c489c
mov eax, 0x8000
jmp 0x90c48be
sub eax, edi
mov ecx, edx
shl eax, 0xf
xor edx, edx
shr ecx, 1
add eax, ecx
mov ecx, dword [ebp - 0xb28]
div dword [ebp - 0xb1c]
mov edx, dword [ebp - 0xb1c]
movzx eax, ax
mov word [ebp + esi*2 - 0xb18], ax
inc esi
cmp esi, 0x100
jb 0x90c4881
lea ecx, [ebp - 0xb20]
mov byte [ebp - 4], 0
call fcn.090198a7
lea ecx, [ebp - 0xb24]
mov dword [ebp - 4], 0xffffffff
call fcn.0901e58a
mov esi, dword [ebp - 0xb2c]
lea eax, [esi + 8]
push eax
push 0x280
mov dword [ebp - 0xb2c], eax
call fcn.090054d5
add esp, 8
mov dword [ebp - 0xb28], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x90c492a
push esi
mov ecx, eax
call fcn.090054d5
mov edx, eax
jmp 0x90c492c
xor edx, edx
movsd xmm1, qword [ebx + 0x10]
xorps xmm0, xmm0
mov eax, dword [ebx + 0xc]
mulsd xmm1, qword [0x90e7a70]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
comisd xmm0, xmm1
mov dword [edx + 0x70], ecx
mov dword [edx + 0x74], eax
jbe 0x90c495a
subsd xmm1, qword [0x90dd3d8]
jmp 0x90c4962
addsd xmm1, qword [0x90dd3d8]
cvttsd2si eax, xmm1
lea edi, [edx + 0x7a]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x78], ax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x6250726f
call fcn.090054d5
int3
Function at 0x401690
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x4016c5
push str.._srclibtomcrypt_srchashesmd5.c
push 0xeb
push str.md___NULL
push str.LTC_ARGCHK__s_failure_on_line__d_of_file__s_n
call fcn.0057f72f
add eax, 0x40
push eax
call fcn.0057f8e4
push 0x16
call fcn.0057f57f
add esp, 0x18
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0
mov dword [esi], 0
mov dword [esi + 4], 0
xor eax, eax
pop esi
ret

Function at 0x401810
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
cmp esi, ebx
jne 0x401848
push str.._srclibtomcrypt_srchashesmd5.c
push 0x108
push str.md___NULL
push str.LTC_ARGCHK__s_failure_on_line__d_of_file__s_n
call fcn.0057f72f
add eax, 0x40
push eax
call fcn.0057f8e4
push 0x16
call fcn.0057f57f
add esp, 0x18
cmp dword [esp + 0x10], ebx
jne 0x40187a
push str.._srclibtomcrypt_srchashesmd5.c
push 0x109
push str.out___NULL
push str.LTC_ARGCHK__s_failure_on_line__d_of_file__s_n
call fcn.0057f72f
add eax, 0x40
push eax
call fcn.0057f8e4
push 0x16
call fcn.0057f57f
add esp, 0x18
mov eax, dword [esi + 0x18]
cmp eax, 0x40
jb 0x40188a
pop esi
mov eax, 0x10
pop ebx
ret
lea ecx, [eax*8]
add dword [esi], ecx
push edi
mov edi, 1
adc dword [esi + 4], ebx
mov byte [eax + esi + 0x1c], 0x80
add dword [esi + 0x18], edi
mov eax, dword [esi + 0x18]
mov ecx, 0x38
cmp eax, ecx
jbe 0x4018d8
cmp eax, 0x40
jae 0x4018c4
mov byte [eax + esi + 0x1c], bl
add dword [esi + 0x18], edi
mov eax, dword [esi + 0x18]
cmp eax, 0x40
jb 0x4018b5
lea eax, [esi + 0x1c]
push esi
call fcn.00401000
add esp, 4
mov dword [esi + 0x18], ebx
mov ecx, 0x38
cmp dword [esi + 0x18], ecx
jae 0x4018ef
lea ecx, [ecx]
mov edx, dword [esi + 0x18]
mov byte [esi + edx + 0x1c], bl
add dword [esi + 0x18], edi
cmp dword [esi + 0x18], ecx
jb 0x4018e0
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x5a], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x58], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x59], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x57], cl
movzx ecx, byte [esi]
mov byte [esi + 0x55], al
lea eax, [esi + 0x1c]
push esi
mov byte [esi + 0x56], dl
mov byte [esi + 0x54], cl
call fcn.00401000
mov edx, dword [esi + 8]
mov eax, dword [esp + 0x18]
mov dword [eax], edx
mov ecx, dword [esi + 0xc]
mov dword [eax + 4], ecx
mov edx, dword [esi + 0x10]
add esp, 4
mov dword [eax + 8], edx
mov ecx, dword [esi + 0x14]
pop edi
pop esi
mov dword [eax + 0xc], ecx
xor eax, eax
pop ebx
ret
Function at 0x405df0
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
push 0
mov eax, edi
and eax, 0x200
push 0
or eax, 0x100
mov ecx, edi
and ecx, 0x100
shr eax, 8
neg ecx
push 3
sbb ecx, ecx
push 0
and ecx, 0x70000000
push eax
add ecx, 0x10000000
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [esi + 0x268], eax
cmp eax, 0xffffffff
jne 0x405e3c
xor al, al
add esp, 0xc
ret
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ecx, dword [esi + 0x268]
mov edx, dword [esp + 4]
mov dword [esp], eax
mov dword [esi + 0x250], eax
lea eax, [esi + 0x260]
push eax
push 0
push 0
push ecx
mov dword [esi + 0x254], edx
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
mov dword [esi + 0x230], 0x405b10
mov dword [esi + 0x234], 0x405bc0
mov dword [esi + 0x238], 0x405f60
mov dword [esi + 0x23c], 0x405f80
mov dword [esi + 0x240], 0x405c90
mov dword [esi + 0x244], 0x405fa0
mov dword [esi + 0x248], 0x405d20
mov dword [esi + 0x258], 0
mov dword [esi + 0x25c], 0
mov dword [esi + 0x22c], edi
mov al, 1
add esp, 0xc
ret

Function at 0x405ff0
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
test edi, edi
je 0x4060a6
lea ecx, [esp + 0x14]
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [esp + 0x10], eax
or eax, dword [esp + 0x14]
je 0x40609b
lea edx, [esi + 0x260]
push edx
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
je 0x40609b
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
xor ecx, ecx
mov dword [esi + 0x268], eax
cmp eax, ecx
je 0x406094
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x250], eax
mov dword [esi + 0x254], edx
mov dword [esi + 0x258], ecx
mov dword [esi + 0x25c], ecx
mov bl, 1
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test bl, bl
jne 0x4060af
xor al, al
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x1c]
pop edi
pop ebp
mov dword [esi + 0x22c], eax
mov dword [esi + 0x230], 0x405ee0
mov dword [esi + 0x238], 0x405f60
mov dword [esi + 0x23c], 0x405f80
mov dword [esi + 0x244], 0x405fa0
mov dword [esi + 0x248], 0x405fc0
mov al, 1
pop ebx
add esp, 0xc
ret
Function at 0x406350
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request
Get http content length
Send data
Send http request

Disassembly:
sub esp, 0x234
mov eax, dword [0x65f810]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
push ebp
push edi
xor ebx, ebx
push ebx
lea eax, [esp + 0x30]
push eax
mov edi, ecx
mov dword [esp + 0x34], ebx
mov byte [esp + 0x1b], bl
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov ebp, dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x406393
call ebp
cmp eax, ebx
jne 0x40652b
push ebx
push ebx
push ebx
push ebx
push str.StormLib_HTTP_MPQ_reader
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 0x268], eax
cmp eax, ebx
jne 0x4063b6
call ebp
cmp eax, ebx
jne 0x40652b
lea eax, [esp + 0x30]
mov ecx, edi
call fcn.00406100
mov edx, dword [esi + 0x268]
push ebx
push 0x4400200
push 3
push ebx
push ebx
push 0x50
lea ecx, [esp + 0x48]
push ecx
push edx
mov edi, eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 0x26c], eax
cmp eax, ebx
jne 0x4063f5
call ebp
cmp eax, ebx
jne 0x40652b
mov eax, dword [esi + 0x26c]
push ebx
push 0x4000000
push ebx
push ebx
push ebx
push edi
push 0x61da84
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edi, eax
cmp edi, ebx
je 0x40652b
push ebx
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x4064c3
mov ebp, dword [sym.imp.WININET.dll_HttpQueryInfoW]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x28]
push eax
push 0x4000000b
push edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], 8
call ebp
test eax, eax
je 0x40647b
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esi + 0x260], ecx
mov dword [esi + 0x264], edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x20000005
push edi
mov dword [esp + 0x28], 4
call ebp
test eax, eax
je 0x4064c3
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4064c3
mov dword [esi + 0x250], eax
mov dword [esi + 0x254], ebx
mov dword [esi + 0x258], ebx
mov dword [esi + 0x25c], ebx
mov byte [esp + 0x13], 1
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
cmp byte [esp + 0x13], bl
je 0x406531
mov eax, dword [esp + 0x244]
mov dword [esi + 0x22c], eax
mov dword [esi + 0x230], 0x406170
mov dword [esi + 0x238], 0x405f60
mov dword [esi + 0x23c], 0x405f80
mov dword [esi + 0x244], 0x405fa0
mov dword [esi + 0x248], 0x406310
mov al, 1
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.005792fc
add esp, 0x234
ret
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [esi + 0x26c]
cmp eax, ebx
je 0x40653e
push eax
call edi
mov eax, dword [esi + 0x268]
mov dword [esi + 0x26c], ebx
cmp eax, ebx
je 0x406551
push eax
call edi
mov ecx, dword [esp + 0x23c]
pop edi
pop ebp
mov dword [esi + 0x268], ebx
pop ebx
xor ecx, esp
xor al, al
call fcn.005792fc
add esp, 0x234
ret
Function at 0x4075f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, eax
mov al, byte [ebx]
push esi
push edi
mov edi, 0x7fed7fed
mov esi, 0xeeeeeeee
test al, al
je 0x40763c
lea ebx, [ebx]
movzx eax, al
push eax
call fcn.0057c6e7
mov edx, esi
shl edx, 5
add edi, esi
inc ebx
lea ecx, [eax + ebp]
xor edi, dword [ecx*4 + 0x67fdd0]
add edx, eax
mov al, byte [ebx]
add edx, esi
add esp, 4
lea esi, [edx + edi + 3]
test al, al
jne 0x407610
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x407b10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push edi
mov edi, eax
shr edi, 2
mov eax, 0xeeeeeeee
test edi, edi
jbe 0x407b60
push ebx
push esi
mov esi, ecx
and esi, 0xff
add eax, dword [esi*4 + 0x680dd0]
mov esi, dword [edx]
lea ebx, [eax + ecx]
xor ebx, esi
mov dword [edx], ebx
mov ebx, ecx
not ebx
shl ebx, 0x15
add ebx, 0x11111111
shr ecx, 0xb
or ecx, ebx
mov ebx, eax
shl ebx, 5
dec edi
add ebx, esi
add edx, 4
lea eax, [eax + ebx + 3]
test edi, edi
ja 0x407b21
pop esi
pop ebx
pop edi
ret

Function at 0x407b70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, eax
shr edi, 2
mov esi, ecx
mov eax, 0xeeeeeeee
test edi, edi
jbe 0x407bcc
push ebx
jmp 0x407b90
mov ecx, edx
and ecx, 0xff
add eax, dword [ecx*4 + 0x680dd0]
mov ebx, edx
not ebx
shl ebx, 0x15
lea ecx, [eax + edx]
xor ecx, dword [esi]
add ebx, 0x11111111
shr edx, 0xb
or edx, ebx
mov ebx, eax
shl ebx, 5
dec edi
add ebx, ecx
mov dword [esi], ecx
add esi, 4
lea eax, [eax + ebx + 3]
test edi, edi
ja 0x407b90
pop ebx
pop edi
pop esi
ret

Function at 0x408750
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x80
mov eax, dword [0x65f810]
xor eax, esp
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x84]
push ebx
mov ebx, dword [esp + 0x98]
push ebp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x98]
push esi
mov esi, edx
mov dword [esp + 0x10], eax
xor edx, edx
lea eax, [ebx - 1]
div esi
push edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 0
mov ebp, eax
inc ebp
shl ebp, 4
push ebp
call fcn.0057a5f1
mov edi, eax
xor eax, eax
add esp, 4
mov dword [esp + 0x18], edi
cmp edi, eax
jne 0x4087bc
mov eax, 8
jmp 0x408892
cmp ebx, eax
je 0x408822
cmp ebx, esi
jae 0x4087c6
mov esi, ebx
mov edx, dword [esp + 0x14]
push esi
mov dword [esp + 0x44], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
push edx
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x3c], 0x67452301
mov dword [esp + 0x40], 0xefcdab89
mov dword [esp + 0x44], 0x98badcfe
mov dword [esp + 0x48], 0x10325476
call fcn.00401700
add esp, 0xc
lea ecx, [esp + 0x28]
push edi
push ecx
call fcn.00401810
add dword [esp + 0x1c], esi
sub ebx, esi
add esp, 8
add edi, 0x10
xor eax, eax
test ebx, ebx
jne 0x4087c0
mov edx, dword [esp + 0xa4]
add dword [esp + 0x98], edx
adc dword [esp + 0x9c], eax
mov eax, dword [esp + 0x1c]
test dword [eax + 0x22c], 0x100
jne 0x408862
mov ecx, dword [esp + 0x18]
push ebp
push ecx
lea edx, [esp + 0xa0]
push edx
push eax
mov eax, dword [eax + 4]
call eax
add esp, 0x10
test al, al
jne 0x40886c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
jmp 0x408870
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x408883
mov ecx, dword [esp + 0xa4]
add ebp, ecx
mov dword [eax], ebp
mov edx, dword [esp + 0x18]
push edx
call fcn.00579483
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005792fc
add esp, 0x80
ret
Function at 0x40ca60
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x40ca99
push str.._srclibtomcrypt_srchashes_sha1.c
push 0xc5
push str.md___NULL
push str.LTC_ARGCHK__s_failure_on_line__d_of_file__s_n
call fcn.0057f72f
add eax, 0x40
push eax
call fcn.0057f8e4
push 0x16
call fcn.0057f57f
add esp, 0x18
mov edi, dword [esp + 0x14]
cmp edi, ebx
jne 0x40cacd
push str.._srclibtomcrypt_srchashes_sha1.c
push 0xc6
push str.out___NULL
push str.LTC_ARGCHK__s_failure_on_line__d_of_file__s_n
call fcn.0057f72f
add eax, 0x40
push eax
call fcn.0057f8e4
push 0x16
call fcn.0057f57f
add esp, 0x18
mov eax, dword [esi + 0x1c]
cmp eax, 0x40
jb 0x40cade
pop edi
pop esi
mov eax, 0x10
pop ebx
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebp
mov ebp, 1
adc dword [esi + 4], ebx
mov byte [eax + esi + 0x20], 0x80
add dword [esi + 0x1c], ebp
mov eax, dword [esi + 0x1c]
mov ecx, 0x38
cmp eax, ecx
jbe 0x40cb32
mov ecx, 0x40
cmp eax, ecx
jae 0x40cb1e
lea ecx, [ecx]
mov byte [eax + esi + 0x20], bl
add dword [esi + 0x1c], ebp
mov eax, dword [esi + 0x1c]
cmp eax, ecx
jb 0x40cb10
lea edx, [esi + 0x20]
push esi
call fcn.0040c420
add esp, 4
mov dword [esi + 0x1c], ebx
mov ecx, 0x38
cmp dword [esi + 0x1c], ecx
jae 0x40cb4f
jmp 0x40cb40
mov edx, dword [esi + 0x1c]
mov byte [esi + edx + 0x20], bl
add dword [esi + 0x1c], ebp
cmp dword [esi + 0x1c], ecx
jb 0x40cb40
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x58], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x59], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x5a], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x5c], cl
movzx ecx, byte [esi]
mov byte [esi + 0x5d], dl
lea edx, [esi + 0x20]
push esi
mov byte [esi + 0x5e], al
mov byte [esi + 0x5f], cl
call fcn.0040c420
movzx edx, byte [esi + 0xb]
mov byte [edi], dl
movzx eax, byte [esi + 0xa]
mov byte [edi + 1], al
movzx ecx, byte [esi + 9]
mov byte [edi + 2], cl
movzx edx, byte [esi + 8]
mov byte [edi + 3], dl
movzx eax, byte [esi + 0xf]
mov byte [edi + 4], al
movzx ecx, byte [esi + 0xe]
mov byte [edi + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [edi + 6], dl
movzx eax, byte [esi + 0xc]
mov byte [edi + 7], al
movzx ecx, byte [esi + 0x13]
mov byte [edi + 8], cl
movzx edx, byte [esi + 0x12]
mov byte [edi + 9], dl
movzx eax, byte [esi + 0x11]
mov byte [edi + 0xa], al
movzx ecx, byte [esi + 0x10]
mov byte [edi + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [edi + 0xc], dl
movzx eax, byte [esi + 0x16]
mov byte [edi + 0xd], al
movzx ecx, byte [esi + 0x15]
mov byte [edi + 0xe], cl
movzx edx, byte [esi + 0x14]
mov byte [edi + 0xf], dl
movzx eax, byte [esi + 0x1b]
mov byte [edi + 0x10], al
movzx ecx, byte [esi + 0x1a]
mov byte [edi + 0x11], cl
movzx edx, byte [esi + 0x19]
add esp, 4
mov byte [edi + 0x12], dl
movzx eax, byte [esi + 0x18]
pop ebp
mov byte [edi + 0x13], al
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x40cd30
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x40cd37
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.0040cd40
Function at 0x40fcc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebp
push esi
push edi
lea edi, [ecx + eax - 0x21524111]
mov ecx, dword [esp + 0x10]
mov esi, edi
mov ebp, edi
add edi, dword [edx]
cmp eax, 0xc
jbe switch.0x0040fdc6
lea edx, [eax - 0xd]
mov eax, 0xaaaaaaab
mul edx
shr edx, 3
inc edx
mov dword [esp + 0x10], edx
push ebx
mov edi, edi
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 4]
add edx, esi
movzx esi, byte [ecx + 0xa]
shl eax, 8
add edx, eax
movzx eax, byte [ecx + 0xb]
shl eax, 8
add eax, esi
movzx esi, byte [ecx + 9]
shl eax, 8
add eax, esi
movzx esi, byte [ecx + 8]
add esi, edi
movzx edi, byte [ecx + 2]
shl eax, 8
lea ebx, [esi + eax]
movzx esi, byte [ecx + 3]
shl esi, 8
add esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
add esi, edi
movzx edi, byte [ecx]
shl esi, 8
add esi, edi
sub esi, ebx
add esi, ebp
mov eax, ebx
rol eax, 4
xor eax, esi
add ebx, edx
sub edx, eax
mov esi, eax
rol esi, 6
xor esi, edx
sub dword [esp + 0x18], 0xc
add eax, ebx
sub ebx, esi
mov edi, esi
rol edi, 8
xor edi, ebx
add esi, eax
sub eax, edi
mov edx, edi
rol edx, 0x10
xor edx, eax
add edi, esi
mov ebp, edx
sub esi, ebp
mov eax, ebp
ror eax, 0xd
xor esi, eax
add ebp, edi
mov edx, esi
sub edi, esi
rol edx, 4
xor edi, edx
add esi, ebp
add ecx, 0xc
sub dword [esp + 0x14], 1
jne 0x40fd00
cmp dword [esp + 0x18], 0xc
pop ebx
ja case.default.0x40fdc6
mov eax, dword [esp + 0x14]
jmp dword [eax*4 + 0x40fe84]
movzx eax, byte [ecx + 0xb]
shl eax, 0x18
add edi, eax
movzx edx, byte [ecx + 0xa]
shl edx, 0x10
add edi, edx
movzx eax, byte [ecx + 9]
shl eax, 8
add edi, eax
movzx edx, byte [ecx + 8]
add edi, edx
movzx eax, byte [ecx + 7]
shl eax, 0x18
add esi, eax
movzx edx, byte [ecx + 6]
shl edx, 0x10
add esi, edx
movzx eax, byte [ecx + 5]
shl eax, 8
add esi, eax
movzx edx, byte [ecx + 4]
add esi, edx
movzx eax, byte [ecx + 3]
shl eax, 0x18
add ebp, eax
movzx edx, byte [ecx + 2]
shl edx, 0x10
add ebp, edx
movzx eax, byte [ecx + 1]
shl eax, 8
add ebp, eax
movzx ecx, byte [ecx]
add ebp, ecx
xor edi, esi
mov ecx, esi
rol ecx, 0xe
sub edi, ecx
mov edx, edi
rol edx, 0xb
mov eax, edi
xor eax, ebp
sub eax, edx
xor esi, eax
mov ecx, eax
ror ecx, 7
sub esi, ecx
xor edi, esi
mov edx, esi
rol edx, 0x10
sub edi, edx
mov edx, edi
mov ecx, edi
xor ecx, eax
rol edx, 4
sub ecx, edx
mov eax, ecx
xor esi, ecx
rol eax, 0xe
sub esi, eax
mov ecx, esi
ror ecx, 8
xor edi, esi
sub edi, ecx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dword [edx], edi
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret
Function at 0x415100
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [eax + 0x34]
push ebx
push esi
xor esi, esi
cmp dword [eax + 0x38], esi
lea ebx, [esi + 1]
jle 0x41513a
push ebp
push edi
movzx edi, dl
mov ecx, dword [eax + 0x260]
mov ebp, ecx
shr ebp, 0x18
xor ebp, edi
shl ecx, 8
xor ecx, dword [ebp*4 + 0x66ab50]
add esi, ebx
mov dword [eax + 0x260], ecx
cmp esi, dword [eax + 0x38]
jl 0x415114
pop edi
pop ebp
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], bl
mov esi, dword [eax + 0x38]
mov ecx, esi
sub ecx, ebx
je 0x4151c2
sub ecx, ebx
je 0x4151a7
sub ecx, ebx
je 0x41519b
mov byte [esi + eax + 0x54], bl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret

Function at 0x416ac0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x416ad0
pop edi
pop ebx
ret

Function at 0x416b00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x416b10
pop esi
pop ebp
pop ebx
ret

Function at 0x416c70
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, ecx
xor eax, eax
lea edx, [eax + 1]
test edi, edi
je 0x416cb2
push ebx
push ebp
mov ebx, dword [esp + 0x14]
movzx ebx, word [ebx + edx*2]
mov ecx, esi
and ecx, 1
mov ebp, ecx
neg ebp
sar ebp, 4
and ebp, 0x7f
shr ebx, 4
xor ebx, ebp
mov ebp, dword [esp + 0x18]
add eax, dword [ebp + ebx*4]
add edx, edx
shr esi, 1
or edx, ecx
sub edi, 1
jne 0x416c81
pop ebp
pop ebx
pop edi
pop esi
ret