joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414cde
Capabilities:
Accept command line arguments
Set current directory

Disassembly:
push 0x7c
mov eax, 0x43af52
call fcn.00438496
mov esi, ecx
cmp dword [esi], 0
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x78], eax
jne 0x414d01
xor eax, eax
jmp 0x414ea6
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.00423eb0
add esp, 0xc
mov dword [ebp - 0x64], ebx
lea eax, [ebp - 0x74]
xor ebx, ebx
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
call dword [esi]
test eax, eax
je 0x414d4a
push dword [ebp - 0x74]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x70]
call esi
jmp 0x414ea3
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
jne 0x414d73
push 5
push dword [ebp - 0x78]
push eax
push edi
push str.open
push eax
call dword [esi + 4]
jmp 0x414ea3
cmp dword [ebp - 0x1c], 0
je 0x414ea3
push dword [ebx]
xor edi, edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], edi
call fcn.0040372d
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
call fcn.00403aa5
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
call fcn.00403aa5
mov byte [ebp - 4], 2
inc edi
cmp dword [ebp - 0x1c], 1
jle 0x414e6f
push dword [ebx + edi*4]
lea ecx, [ebp - 0x14]
call fcn.0040179f
push ecx
push 0x4431f0
lea ecx, [ebp - 0x14]
call fcn.00402a32
test eax, eax
jle 0x414e14
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x80]
call fcn.004026ee
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7c]
mov edx, eax
mov dword [esp], 0x4421bc
call fcn.00402755
pop ecx
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.00402a97
lea ecx, [ebp - 0x7c]
call fcn.00403a8a
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.00403a8a
push 0x4431f0
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x88]
call fcn.00402755
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
push ecx
mov edx, eax
lea ecx, [ebp - 0x84]
call fcn.004027db
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.00402a97
lea ecx, [ebp - 0x84]
call fcn.00403a8a
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 2
call fcn.00403a8a
inc edi
cmp edi, dword [ebp - 0x1c]
jl 0x414db4
push 5
push dword [ebp - 0x78]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push str.open
push 0
call dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x18]
call fcn.00403a8a
lea ecx, [ebp - 0x14]
call fcn.00403a8a
lea ecx, [ebp - 0x20]
call fcn.00403a8a
xor eax, eax
inc eax
call fcn.00438445
ret 8
Function at 0x414ed0
Capabilities:
Get common file path

Disassembly:
push 0x10
mov eax, 0x43af99
call fcn.00438496
mov edi, ecx
push 0x800
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x414f9e
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.00403aa5
mov dword [ebp - 4], ebx
xor ecx, ecx
mov esi, dword [ebp - 0x14]
inc ecx
mov ebx, 0x104
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, ebx
or eax, ecx
jge 0x414f28
push ebx
lea ecx, [ebp - 0x14]
call fcn.0040157d
mov esi, dword [ebp - 0x14]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push dword [esi - 8]
push esi
call fcn.0042ac0c
pop ecx
pop ecx
test eax, eax
js 0x414fa6
cmp eax, dword [esi - 8]
jg 0x414fa6
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea edx, [ebp - 0x14]
push 0x4427c0
lea ecx, [ebp - 0x1c]
call fcn.00402755
push edi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00402755
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00402a97
lea ecx, [ebp - 0x18]
call fcn.00403a8a
lea ecx, [ebp - 0x1c]
call fcn.00403a8a
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.00403a8a
mov eax, esi
call fcn.00438445
ret
push 0x80070057
call fcn.00401694
int3

Function at 0x416055
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
test edx, edx
jne 0x416068
push 0xd
pop eax
jmp 0x4160ac
push esi
xor eax, eax
push edi
mov dword [ebp + 0xc], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp + 0xc]
jne 0x41607b
sub ecx, dword [ebp - 4]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x416073
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4166fc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x448008]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
mov ebx, ecx
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 4]
push esi
or eax, 0x2001f
mov dword [esp + 0xc], ecx
push eax
push ecx
push dword [ebx]
lea ecx, [esp + 0x1c]
call fcn.00416685
jmp 0x416754
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.004166fc
mov esi, eax
test esi, esi
jne 0x4167a8
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x416746
cmp dword [esp + 0x10], esi
je 0x416797
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], esi
push dword [esp + 0xc]
mov ecx, ebx
mov dword [esp + 0x18], esi
call fcn.0041688d
mov esi, eax
cmp dword [esp + 0x10], 0
je 0x4167b9
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.004219ad
mov esp, ebp
pop ebp
ret 4
Function at 0x417211
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x43b183
call fcn.00438502
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x20], esi
push 0x404
lea eax, [ebp - 0x424]
mov dword [ebp - 4], esi
push esi
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], esi
call fcn.00423eb0
add esp, 0xc
mov dword [ebp - 0x424], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x430], edi
test edi, edi
jne 0x41729a
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x430], eax
test edi, edi
jne 0x41729a
call fcn.00415ab6
mov esi, eax
jmp 0x41739d
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x4172bd
call fcn.00415ab6
jmp 0x417390
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x4172b3
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x42c], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x4172f0
mov esi, 0x8007000e
jmp 0x417392
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x4173c0
jb 0x41730b
cmp eax, 0xffffffff
ja 0x4173c0
cmp eax, 0x400
jbe 0x417320
push eax
lea ecx, [ebp - 0x424]
call fcn.00415a91
jmp 0x417342
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
jmp 0x417342
mov dword [ebp - 4], 1
cmp dword [ebp - 0x424], 0
je 0x4172e6
push ebx
push dword [ebp - 0x424]
push ebx
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x4172b3
mov eax, dword [ebp - 0x424]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x424]
call fcn.004170ca
mov esi, eax
test edi, edi
je 0x41739d
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x4173b6
lea ecx, [ebp - 0x424]
call fcn.00415a7c
mov eax, esi
call fcn.00438454
ret 0x10
push 0x80070216
call fcn.00401694
int3
Function at 0x4177db
Capabilities:
Identify system language via api

Disassembly:
push 8
mov eax, 0x43b257
call fcn.00438463
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [ebp - 4], ebx
lea ecx, [esi + 0x24]
mov dword [esi + 0x20], vtable.IArkEvent.0
mov dword [esi], vtable.CMainDlg.1.0
mov dword [esi + 0x20], vtable.CMainDlg.0
call fcn.00403aa5
mov byte [ebp - 4], 1
call fcn.0040547a
mov edi, eax
cmp dword [edi], ebx
jne 0x417834
mov ecx, str.msftedit.dll
call fcn.00414ed0
mov dword [edi], eax
or dword [esi + 0x64], 0xffffffff
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], 0x1f4
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
or dword [esi + 0x6c], 0xffffffff
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
lea edi, [esi + 0x78]
mov ecx, edi
call fcn.0040eb5e
lea ebx, [esi + 0x10c]
xor eax, eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
add esi, 0x11c
mov ecx, esi
call fcn.00403aa5
lea ecx, [esi + 4]
call fcn.00403aa5
lea ecx, [esi + 8]
call fcn.00403aa5
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x10]
push 0x3b0
mov dword [eax + 0x9c], 1
call fcn.00421e38
mov esi, eax
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 5
mov dword [esp], 0x3b0
push 0
push esi
call fcn.00423eb0
add esp, 0xc
mov ecx, esi
push edi
call fcn.00410b57
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
push 0x78
mov dword [ecx + 0x28], eax
call fcn.00421e38
push 0x78
mov esi, eax
push 0
push esi
mov dword [ebp - 0x14], esi
call fcn.00423eb0
add esp, 0x10
mov ecx, esi
push edi
call fcn.0040bde9
mov esi, dword [ebp - 0x10]
mov dword [esi + 0x2c], eax
xor eax, eax
mov byte [esi + 0x108], al
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x74], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor edx, edx
mov ecx, 0x412
cmp ax, cx
push 0x6b
push dword [0x449164]
sete dl
mov dword [0x449e40], edx
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [esi + 0x44], eax
mov ecx, ebx
call fcn.00414c2c
mov eax, esi
call fcn.00438431
ret
Function at 0x418fd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x300
cmp dword [0x452e98], 0
jne 0x419217
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov eax, 1
nop
mov ecx, eax
mov byte [esp + ebx + 0x110], al
and cl, 0x80
mov byte [esp + ebx + 0x20f], al
mov byte [esp + eax + 0x10], bl
inc ebx
movzx edx, cl
lea ecx, [eax + eax]
neg edx
sbb edx, edx
and edx, 0x11b
xor edx, ecx
xor eax, edx
cmp eax, 1
jne 0x418ff0
xor ecx, ecx
mov dword [ecx + 0x44ee60], eax
test eax, eax
je 0x41903c
movzx eax, byte [esp + eax + 0x10]
movzx eax, byte [esp + eax + 0x129]
jmp 0x41903e
xor eax, eax
add ecx, 4
cmp ecx, 0x28
jb 0x419023
xor ebx, ebx
test bl, bl
je 0x419061
movzx esi, bl
lea ecx, [esp + 0x20f]
movzx eax, byte [esp + esi + 0x10]
sub ecx, eax
mov al, byte [ecx]
jmp 0x419065
xor esi, esi
xor al, al
movzx eax, al
lea ecx, [eax + eax]
xor ecx, eax
add ecx, ecx
xor ecx, eax
add ecx, ecx
xor ecx, eax
add ecx, ecx
xor ecx, eax
mov eax, ecx
shr eax, 8
xor al, cl
xor al, 0x63
je 0x4190a3
movzx edx, al
movzx eax, byte [esp + edx + 0x10]
movzx edi, byte [esp + eax + 0x129]
movzx eax, byte [esp + edx + 0x10]
movzx ecx, byte [esp + eax + 0x111]
jmp 0x4190a9
xor edx, edx
xor edi, edi
xor ecx, ecx
shl ecx, 8
or ecx, edx
mov dword [ebx*4 + 0x44ce60], edx
shl ecx, 8
or ecx, edx
shl ecx, 8
or ecx, edi
mov eax, ecx
mov dword [ebx*4 + 0x44de60], ecx
rol eax, 8
mov dword [ebx*4 + 0x44e260], eax
mov eax, ecx
rol eax, 0x10
mov dword [ebx*4 + 0x44e660], eax
mov eax, edx
rol eax, 8
mov dword [ebx*4 + 0x44d260], eax
mov eax, edx
rol eax, 0x10
mov dword [ebx*4 + 0x44d660], eax
lea eax, [esi*8]
xor eax, esi
ror edx, 8
shl eax, 2
xor eax, esi
ror ecx, 8
mov dword [ebx*4 + 0x44da60], edx
mov dword [ebx*4 + 0x44ea60], ecx
lea edx, [eax + eax]
mov ecx, edx
shr ecx, 8
mov al, cl
xor al, dl
cmp al, 5
je 0x419173
movzx eax, dl
xor eax, 5
xor eax, ecx
lea ecx, [esp + 0x20f]
movzx eax, byte [esp + eax + 0x10]
sub ecx, eax
mov al, byte [ecx]
test al, al
je 0x419173
movzx edi, al
movzx eax, byte [esp + edi + 0x10]
movzx ecx, byte [esp + eax + 0x1fe]
movzx edx, byte [esp + eax + 0x1d7]
movzx ebp, byte [esp + eax + 0x1ef]
movzx eax, byte [esp + edi + 0x10]
movzx esi, byte [esp + eax + 0x178]
jmp 0x41917d
xor edi, edi
xor ecx, ecx
xor edx, edx
xor ebp, ebp
xor esi, esi
shl esi, 8
or esi, ecx
mov dword [ebx*4 + 0x44ae60], edi
shl esi, 8
or esi, edx
shl esi, 8
or esi, ebp
mov eax, esi
mov dword [edi*4 + 0x449e60], esi
ror eax, 8
mov edx, esi
mov dword [edi*4 + 0x44aa60], eax
mov ecx, esi
mov dword [ebx*4 + 0x44ca60], eax
mov eax, edi
rol eax, 8
rol edx, 8
rol ecx, 0x10
mov dword [ebx*4 + 0x44b260], eax
mov eax, edi
mov dword [edi*4 + 0x44a260], edx
mov dword [edi*4 + 0x44a660], ecx
rol eax, 0x10
ror edi, 8
mov dword [ebx*4 + 0x44be60], esi
mov dword [ebx*4 + 0x44c260], edx
mov dword [ebx*4 + 0x44c660], ecx
mov dword [ebx*4 + 0x44b660], eax
mov dword [ebx*4 + 0x44ba60], edi
inc ebx
cmp ebx, 0x100
jb 0x419048
pop edi
pop esi
pop ebp
mov dword [0x452e98], 1
pop ebx
xor eax, eax
add esp, 0x300
ret
Function at 0x41da60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x2c
mov eax, dword [0x448008]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
xor edx, edx
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [edx*4 + 0x44ee90], eax
inc edx
cmp edx, 0x100
jb 0x41da74
mov eax, 0x44ee94
mov esi, 0x1c0
nop dword [eax + eax]
mov edx, dword [eax - 4]
lea eax, [eax + 0x10]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x44ee90]
mov dword [eax + 0x3ec], edx
mov edx, dword [eax - 0x10]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x44ee90]
mov dword [eax + 0x3f0], edx
mov edx, dword [eax - 0xc]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x44ee90]
mov dword [eax + 0x3f4], edx
mov edx, dword [eax - 8]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x44ee90]
mov dword [eax + 0x3f8], edx
sub esi, 1
jne 0x41db20
lea ecx, [esp + 0x14]
mov dword [0x449e44], 0x41dc80
call fcn.00420ed0
test eax, eax
je 0x41dc6c
mov ecx, dword [esp + 0x24]
mov edx, ecx
mov ebp, dword [esp + 0x1c]
mov eax, ecx
shr edx, 8
and eax, 0xf00
mov edi, edx
and ecx, 0xf0
and edi, 0xff000
and edx, 0xf00
or edi, eax
or edx, ecx
shr edi, 8
mov eax, 0x442688
shr edx, 4
xor ecx, ecx
mov ebx, dword [esp + 0x18]
cmp dword [eax - 8], ebx
mov ebx, dword [esp + 0x20]
jne 0x41dbea
cmp dword [eax - 4], ebp
jne 0x41dbea
cmp dword [eax], ebx
je 0x41dc09
add esi, 0xc
inc ecx
add eax, 0xc
cmp esi, 0x24
jb 0x41dbd4
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004219ad
add esp, 0x2c
ret
sub ecx, 0
je 0x41dc42
sub ecx, 1
je 0x41dc26
sub ecx, 1
jne 0x41dc6c
cmp edi, 6
jb 0x41dc37
jne 0x41dc62
cmp edx, 0xf
jae 0x41dc62
jmp 0x41dc37
cmp edi, 5
jb 0x41dc37
jne 0x41dc62
cmp edx, 6
jb 0x41dc37
cmp edx, 0xa
jne 0x41dc62
mov eax, 1
test eax, eax
jne 0x41dc6c
jmp 0x41dc62
cmp edi, 6
jb 0x41dc6c
jne 0x41dc62
cmp edx, 0x1c
je 0x41dc6c
cmp edx, 0x26
je 0x41dc6c
cmp edx, 0x27
je 0x41dc6c
cmp edx, 0x35
je 0x41dc6c
cmp edx, 0x36
je 0x41dc6c
mov dword [0x449e44], fcn.0041dd20
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004219ad
add esp, 0x2c
ret
Function at 0x41dd20
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], edx
push edi
mov edi, dword [esp + 0x14]
test esi, esi
je 0x41dd50
test dl, 7
je 0x41dd4c
movzx eax, byte [edx]
inc edx
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [edi + eax*4]
sub esi, 1
jne 0x41dd33
mov dword [esp + 8], edx
cmp esi, 8
jb 0x41ddde
push ebx
push ebp
mov ebp, esi
shr ebp, 3
xor ecx, dword [edx]
sub esi, 8
mov ebx, dword [edx + 4]
mov eax, ecx
shr eax, 8
movzx edx, al
mov eax, ecx
shr eax, 0x10
movzx eax, al
mov edx, dword [edi + edx*4 + 0x1800]
xor edx, dword [edi + eax*4 + 0x1400]
mov eax, ebx
shr eax, 8
movzx eax, al
xor edx, dword [edi + eax*4 + 0x800]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor edx, dword [edi + eax*4 + 0x400]
mov eax, ecx
shr eax, 0x18
xor edx, dword [edi + eax*4 + 0x1000]
movzx eax, cl
xor edx, dword [edi + eax*4 + 0x1c00]
movzx eax, bl
shr ebx, 0x18
xor edx, dword [edi + eax*4 + 0xc00]
xor edx, dword [edi + ebx*4]
mov ecx, edx
mov edx, dword [esp + 0x10]
add edx, 8
mov dword [esp + 0x10], edx
sub ebp, 1
jne 0x41dd60
pop ebp
pop ebx
test esi, esi
je 0x41ddf8
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [edi + eax*4]
sub esi, 1
jne 0x41dde2
pop edi
mov eax, ecx
pop esi
pop ecx
ret 8

Function at 0x41ece0
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x10]
mov ebx, edx
mov ebp, ecx
mov edx, dword [edi + 0x9c]
cmp edx, 0xffffffff
jne 0x41ecfc
pop edi
pop ebp
or eax, edx
pop ebx
ret
lea eax, [edx + ebx]
cmp eax, 0x40
jbe 0x41ed68
push esi
lea esi, [edi + 0x40]
cmp edx, 0x40
ja 0x41ed4e
mov dword [esi + 4], 0
mov ecx, edi
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
mov edx, dword [edi + 0x9c]
push esi
call fcn.00421120
add esp, 4
push esi
mov edx, ebx
mov ecx, ebp
call fcn.00421120
add dword [edi + 0x9c], ebx
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebp
pop ebx
ret
push ebx
lea eax, [edx + edi]
push ebp
push eax
call fcn.00423930
add dword [edi + 0x9c], ebx
add esp, 0xc
xor eax, eax
pop edi
pop ebp
pop ebx
ret
Function at 0x41ed90
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebp, ecx
mov ebx, edx
mov ecx, dword [edi + 0x9c]
lea esi, [edi + 0x40]
cmp ecx, 0xffffffff
je 0x41ee63
cmp ecx, 0x40
jbe 0x41edcb
mov edx, esi
mov ecx, edi
call fcn.00421330
mov dword [edi + 0x9c], 0x14
mov ecx, 0x14
mov eax, 0x40
sub eax, ecx
push eax
lea eax, [ecx + edi]
push 0
push eax
call fcn.00423eb0
movups xmm0, xmmword [edi]
mov edx, 0x40
mov ecx, edi
movaps xmm2, xmmword [str.6666666666666666]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi], xmm1
push esi
movups xmm0, xmmword [edi + 0x10]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi + 0x10], xmm1
movups xmm0, xmmword [edi + 0x20]
pxor xmm0, xmm2
movups xmmword [edi + 0x20], xmm0
movups xmm0, xmmword [edi + 0x30]
pxor xmm2, xmm0
movups xmmword [edi + 0x30], xmm2
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
call fcn.00421120
add esp, 0x10
mov dword [edi + 0x9c], 0xffffffff
test ebx, ebx
je 0x41ee74
push esi
mov edx, ebx
mov ecx, ebp
call fcn.00421120
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x41ee80
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x18
mov eax, dword [0x448008]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push edi
mov edi, dword [esp + 0x28]
mov ebx, edx
mov ebp, ecx
cmp dword [edi + 0x9c], 0xffffffff
je 0x41eeaf
push edi
xor edx, edx
xor ecx, ecx
call fcn.0041ed90
add esp, 4
push esi
lea esi, [edi + 0x40]
mov edx, esi
lea ecx, [esp + 0x10]
call fcn.00421330
movups xmm0, xmmword [edi]
mov edx, 0x40
mov ecx, edi
movaps xmm2, xmmword [0x443a00]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi], xmm1
push esi
movups xmm0, xmmword [edi + 0x10]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [edi + 0x20]
pxor xmm1, xmm0
movups xmmword [edi + 0x20], xmm1
movups xmm0, xmmword [edi + 0x30]
pxor xmm0, xmm2
movups xmmword [edi + 0x30], xmm0
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
call fcn.00421120
push esi
mov edx, 0x14
lea ecx, [esp + 0x18]
call fcn.00421120
add esp, 8
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.00421330
pop esi
test ebx, ebx
je 0x41ef67
push ebx
lea eax, [esp + 0x10]
push eax
push ebp
call fcn.00423930
add esp, 0xc
mov ecx, dword [esp + 0x20]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004219ad
add esp, 0x18
ret
Function at 0x420060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x18]
mov ebx, ecx
push edi
xor edi, edi
mov dword [esp + 0x10], ebx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x420085
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
add dword [esp + 0x18], 5
push ebp
lea ebp, [edx - 4]
add ebp, ebx
lea eax, [edi + ebx]
cmp eax, ebp
jae 0x4200a6
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x4200a6
inc eax
cmp eax, ebp
jb 0x420097
mov edx, eax
sub edx, edi
mov edi, eax
sub edx, ebx
sub edi, ebx
cmp eax, ebp
jae 0x4201a8
cmp edx, 2
jbe 0x420135
xor esi, esi
movzx edx, byte [eax + 4]
lea ecx, [edx + 1]
test cl, 0xfe
jne 0x420197
movzx ecx, byte [eax + 3]
mov ebx, dword [esp + 0x1c]
shl edx, 8
add ebx, edi
or edx, ecx
movzx ecx, byte [eax + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
add edx, ebx
sub ecx, ebx
cmp dword [esp + 0x24], 0
cmove edx, ecx
mov dword [esp + 0x10], edx
mov ebx, edx
test esi, esi
je 0x420169
and esi, 6
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x420167
mov ebx, 0x100
shl ebx, cl
mov ecx, dword [esp + 0x1c]
dec ebx
xor ebx, dword [esp + 0x10]
add ecx, edi
cmp dword [esp + 0x24], 0
je 0x420165
add ebx, ecx
jmp 0x420167
mov ecx, edx
shr esi, cl
test esi, esi
je 0x4200bf
cmp esi, 4
ja 0x42015a
cmp esi, 3
je 0x42015a
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x4200bf
or esi, 8
shr esi, 1
inc edi
jmp 0x420090
sub ebx, ecx
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov eax, 5
mov ebx, dword [esp + 0x14]
add edi, eax
jmp 0x420090
or esi, 8
mov eax, 1
shr esi, 1
add edi, eax
jmp 0x420090
mov eax, dword [esp + 0x20]
mov ecx, edx
shr esi, cl
xor ecx, ecx
cmp edx, 2
pop ebp
cmovbe ecx, esi
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x420760
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx], 0x4207b0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret