joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403310
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x40337b
mov esi, dword [esp + 0x30]
test esi, esi
je 0x40337b
push esi
call fcn.00409b60
add esp, 4
test eax, eax
je 0x40335a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x403361
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x403340
jmp 0x403363
mov ebp, 0x1505
jmp 0x403363
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x403387
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4033a4
inc ebx
dec edi
je 0x40337b
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x40337b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x4033a0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.00409b60
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x4033a0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.00409b80
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x4033a0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x40337b
cmp dword [eax + 4], 3
jne 0x40337b
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x40337b

Function at 0x403440
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x403541
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x403541
push ebx
call fcn.00409b60
add esp, 4
test eax, eax
je 0x40349a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x4034a1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x403480
jmp 0x4034a3
mov esi, 0x1505
jmp 0x4034a3
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x403541
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4034d4
inc ebp
dec ebx
je 0x40353f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40353f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4034d0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.00409b60
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4034d0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00409b80
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4034d0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40353f
cmp dword [eax + 4], 5
mov edi, 0
jne 0x403541
mov edi, dword [eax + 8]
jmp 0x403541
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403570
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x403674
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x403674
push ebx
call fcn.00409b60
add esp, 4
test eax, eax
je 0x4035ca
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x4035d1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x4035b0
jmp 0x4035d3
mov esi, 0x1505
jmp 0x4035d3
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x403674
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x403604
inc ebp
dec ebx
je 0x40366f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40366f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x403600
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.00409b60
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x403600
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00409b80
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x403600
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40366f
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x403674
mov edi, dword [eax + 8]
jmp 0x403674
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403680
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
push 0x2e
push ebp
call fcn.00409bd0
add esp, 8
test eax, eax
je 0x4036e4
mov esi, eax
jmp 0x4036c4
mov ebp, esi
inc ebp
push 0x2e
push ebp
call fcn.00409bd0
add esp, 8
mov esi, eax
test eax, eax
je 0x4036e4
mov eax, esi
sub eax, ebp
push eax
push ebp
push edi
call fcn.004030f0
add esp, 0xc
xor edi, edi
test eax, eax
je 0x4036b0
cmp dword [eax + 4], 4
jne 0x4036b0
mov edi, dword [eax + 8]
jmp 0x4036b0
xor eax, eax
test edi, edi
je 0x40374b
test ebp, ebp
je 0x40374b
push ebp
call fcn.00409b60
add esp, 4
test eax, eax
je 0x40372b
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ebx]
test edx, edx
je 0x403732
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebx
mov ecx, esi
cmp eax, ebx
jne 0x403710
jmp 0x403734
mov esi, 0x1505
jmp 0x403734
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [edi + 0x20]
lea ebx, [ecx - 1]
mov eax, ecx
sub eax, 1
mov dword [esp + 0x14], eax
jae 0x403753
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, esi
mov dword [esp], edi
mov eax, dword [edi + 4]
mov dword [esp + 0x10], eax
jmp 0x403774
inc ebx
dec ecx
je 0x403749
mov eax, ebx
and eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x403749
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + edi*4], esi
jne 0x403770
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], ecx
call fcn.00409b60
mov ecx, dword [esp + 0xc]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x403770
push dword [esp + 4]
push dword [esp + 0x10]
push ebp
call fcn.00409b80
mov ecx, dword [esp + 0x14]
add esp, 0xc
test eax, eax
jne 0x403770
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x40374b
Function at 0x403870
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x4038dd
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4038dd
push esi
call fcn.00409b60
add esp, 4
test eax, eax
je 0x4038ba
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x4038c1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x4038a0
jmp 0x4038c3
mov ebx, 0x1505
jmp 0x4038c3
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x4038e5
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4038f4
inc ebp
dec edi
je 0x4038db
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x4038db
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x4038f0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.00409b60
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4038f0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00409b80
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4038f0
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x4038dd
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x4038dd
Function at 0x403b00
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x403c12
mov esi, dword [esp + 0x28]
test esi, esi
je 0x403c12
cmp dword [esp + 0x2c], 0
je 0x403c12
push esi
call fcn.00409b60
add esp, 4
test eax, eax
je 0x403b6a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x403b71
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x403b50
jmp 0x403b73
mov ebx, 0x1505
jmp 0x403b73
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x403c1a
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x403bd7
call fcn.00403d10
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x403c12
push ecx
call fcn.00409b60
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x403c8d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x403c38
inc edi
dec esi
je 0x403b8c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x403b91
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x403c30
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.00409b60
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x403c30
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.00409b80
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x403c30
mov eax, 0xffffffff
jmp 0x403c12
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x403ca8
inc edi
dec esi
je 0x403bd2
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x403bd7
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x403ca0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00409b60
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x403ca0
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.00409b80
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x403ca0
jmp 0x403bd7
Function at 0x404440
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4045d3
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
movzx edi, si
shr esi, 0x10
test ebx, ebx
je 0x4045cc
mov ecx, 0x5e6ea9af
mov eax, ebx
mul ecx
shr edx, 0xb
imul eax, edx, 0x15b0
mov dword [esp + 0xc], ebx
mov edx, ebx
sub edx, eax
jmp 0x4044cc
add ebp, dword [esp + 8]
mov eax, edi
mov ecx, 0x80078071
mul ecx
mov ebx, edx
shr ebx, 0xf
mov eax, esi
mul ecx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub esi, eax
mov eax, dword [esp + 4]
sub dword [esp + 0xc], eax
mov edx, 0x15b0
je 0x4045cc
xor eax, eax
cmp edx, 8
mov dword [esp + 4], edx
jb 0x40453e
mov eax, edx
and eax, 0x1ff8
xor ecx, ecx
mov edx, ecx
movzx ebx, byte [ebp + ecx]
add ebx, edi
movzx ecx, byte [ebp + ecx + 1]
add ecx, ebx
add ebx, esi
movzx esi, byte [ebp + edx + 2]
add esi, ecx
add ebx, ecx
movzx ecx, byte [ebp + edx + 3]
add ecx, esi
add ebx, esi
movzx esi, byte [ebp + edx + 4]
add esi, ecx
add ebx, ecx
movzx ecx, byte [ebp + edx + 5]
add ecx, esi
add ebx, esi
movzx esi, byte [ebp + edx + 6]
add esi, ecx
add ebx, ecx
add ebx, esi
movzx edi, byte [ebp + edx + 7]
add edi, esi
mov esi, ebx
add esi, edi
lea ecx, [edx + 8]
add edx, 0xf
cmp edx, dword [esp + 4]
mov edx, dword [esp + 4]
jb 0x4044e0
add ebp, ecx
mov ecx, edx
sub ecx, eax
jbe 0x404494
mov dword [esp + 8], ecx
mov ecx, eax
or ecx, 1
test dl, 1
jne 0x404570
mov ebx, ebp
cmp edx, ecx
je 0x404490
jmp 0x404591
lea ebx, [ebp + 1]
movzx eax, byte [ebp]
mov dword [esp], eax
mov eax, edi
and eax, dword [esp]
xor edi, dword [esp]
lea edi, [edi + eax*2]
add esi, edi
mov eax, ecx
cmp edx, ecx
je 0x404490
mov ecx, dword [esp + 4]
sub ecx, eax
mov dword [esp], ecx
xor eax, eax
nop
nop
nop
nop
movzx edx, byte [ebx + eax]
mov ecx, edi
and ecx, edx
xor edi, edx
lea ecx, [edi + ecx*2]
add esi, ecx
movzx edx, byte [ebx + eax + 1]
mov edi, ecx
and edi, edx
xor ecx, edx
lea edi, [ecx + edi*2]
add esi, edi
add eax, 2
cmp dword [esp], eax
jne 0x4045a0
jmp 0x404490
shl esi, 0x10
or esi, edi
jmp 0x4045d8
mov esi, 1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4045f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x404659
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
not ecx
test edx, edx
je 0x404650
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [eax + esi]
mov ebx, ecx
shr ebx, 4
xor ecx, edi
and ecx, 0xf
xor ebx, dword [ecx*4 + 0x44180c]
mov ecx, ebx
shr ecx, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
add edi, ebp
add ebx, ebx
sub edi, ebx
mov edi, dword [edi*4 + 0x44180c]
mov ebx, ecx
and ebx, edi
add ecx, edi
add ebx, ebx
sub ecx, ebx
inc esi
cmp edx, esi
jne 0x404610
lea eax, [ecx + ecx]
not eax
add eax, ecx
jmp 0x40465b
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x411180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x508
push dword [ebp + 8]
call fcn.00403550
add esp, 4
mov esi, eax
xor ecx, ecx
test eax, eax
sete cl
xor edi, edi
xor eax, eax
jmp dword [ecx*4 + 0x44555c]
Function at 0x419af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
xor ecx, ecx
nop
nop
nop
nop
cmp word [edi + ecx], 0
lea ecx, [ecx + 2]
jne 0x419b00
lea edx, [edi + ecx]
add edx, 0xfffffffe
mov eax, edi
not eax
and eax, edx
add ecx, edi
mov edx, 1
sub edx, ecx
and edx, edi
sub eax, edx
cmp eax, 0xffffffed
jge 0x419b2f
mov eax, 0xffffffff
jmp 0x419b32
add eax, 0x12
push eax
call fcn.00409a50
add esp, 4
mov esi, eax
mov dword [esp + 4], 0xbb4dbd58
mov dword [esp + 8], 0xb73fb945
mov dword [esp + 0xc], 0xb380b578
mov dword [esp + 0x10], 0x4fb0b14c
mov word [esp + 0x14], 0x4d4c
mov dword [esp + 0x16], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x15
ja 0x419bae
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0x724e5ef2
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0xb2
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x16
jb 0x419b80
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x419bd1
add edi, 2
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x419bc0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x419c01
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419bf0
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.0043f0f0
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x445ef0]
Function at 0x419b0a
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
xor ecx, ecx
nop
nop
nop
nop
cmp word [edi + ecx], 0
lea ecx, [ecx + 2]
jne 0x419b00
lea edx, [edi + ecx]
add edx, 0xfffffffe
mov eax, edi
not eax
and eax, edx
add ecx, edi
mov edx, 1
sub edx, ecx
and edx, edi
sub eax, edx
cmp eax, 0xffffffed
jge 0x419b2f
mov eax, 0xffffffff
jmp 0x419b32
add eax, 0x12
push eax
call fcn.00409a50
add esp, 4
mov esi, eax
mov dword [esp + 4], 0xbb4dbd58
mov dword [esp + 8], 0xb73fb945
mov dword [esp + 0xc], 0xb380b578
mov dword [esp + 0x10], 0x4fb0b14c
mov word [esp + 0x14], 0x4d4c
mov dword [esp + 0x16], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x15
ja 0x419bae
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0x724e5ef2
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0xb2
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x16
jb 0x419b80
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x419bd1
add edi, 2
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x419bc0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x419c01
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419bf0
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.0043f0f0
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x445ef0]
Function at 0x41d8d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [0x44ab94]
mov dword [esp + 8], 0x4181bf9b
mov dword [esp + 0xc], 0x45b443b2
mov dword [esp + 0x10], 0x49a94782
mov dword [esp + 0x14], 0x4dad4bbe
mov dword [esp + 0x18], 0x518c4f6b
mov dword [esp + 0x1c], 0x55bc5386
mov dword [esp + 0x20], 0x59b657a3
mov dword [esp + 0x24], 0x5db95bbe
mov dword [esp + 0x28], 0x61825fac
mov dword [esp + 0x2c], 0x6596638b
mov dword [esp + 0x30], 0x69b46782
mov dword [esp + 0x34], 0x6d9e6bba
mov dword [esp + 0x38], 0x71966f81
mov dword [esp + 0x3c], 0x7598739b
mov dword [esp + 0x40], 0x798b7793
mov word [esp + 0x44], 0x7b7a
mov dword [esp + 0x46], 0
mov word [esp + 0x4a], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x43
ja 0x41d9b0
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
add ecx, 0x5426e7e
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x40
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x44
jb 0x41d980
lea ebx, [esp + 0x4c]
lea edi, [esp + 8]
push ebx
push 0
push 0
push 0x1e
push edi
push 0
call eax
mov ebp, dword [esp + 0x4c]
test ebp, ebp
jns 0x41d9d3
mov eax, 0xffffffff
jmp 0x41d9da
lea eax, [ebp*2]
push eax
call fcn.00409a50
add esp, 4
mov esi, eax
mov eax, dword [0x44ab94]
mov dword [esp + 8], 0x87c781e9
mov dword [esp + 0xc], 0x8b348536
mov dword [esp + 0x10], 0x8f2f89ce
mov dword [esp + 0x14], 0x932b8d3a
mov dword [esp + 0x18], 0x97cc91f9
mov dword [esp + 0x1c], 0x9b3c95c2
mov dword [esp + 0x20], 0x9f2a9921
mov dword [esp + 0x24], 0xe3379d3a
mov dword [esp + 0x28], 0xe746e154
mov dword [esp + 0x2c], 0xeb52e549
mov dword [esp + 0x30], 0xefb4e94e
mov dword [esp + 0x34], 0xf35aedbe
mov dword [esp + 0x38], 0xf75af143
mov dword [esp + 0x3c], 0xfb58f559
mov dword [esp + 0x40], 0xff4df951
mov word [esp + 0x44], 0xfdfe
mov dword [esp + 0x46], 0
mov word [esp + 0x4a], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x43
ja 0x41dac0
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
add ecx, 0x1cb9eca1
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xdd
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x44
jb 0x41da90
push ebx
push ebp
push esi
push 0x1e
push edi
push 0
call eax
mov dword [esp + 8], 0x4fd651bc
mov dword [esp + 0xc], 0x4bd84dc1
mov dword [esp + 0x10], 0x47db49d4
mov dword [esp + 0x14], 0x43dc45ca
mov dword [esp + 0x18], 0x7ff041d9
mov dword [esp + 0x1c], 0x7b7a7de0
mov byte [esp + 0x20], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x18
ja 0x41db3e
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xf127398e
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x22
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x19
jb 0x41db10
push 0
push 0
push edi
push esi
push dword [esp + 0x74]
call fcn.00415d70
add esp, 0x14
jmp dword [0x4466bc]
Function at 0x4365a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebp, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + ebx], 0
lea ebx, [ebx + 2]
jne 0x4365c0
mov dword [esp + 8], 0x464a44d1
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43661e
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
add eax, 0x3fa2292b
xor eax, edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add al, 0x99
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x4365f0
cmp ebx, 2
je 0x436640
mov dword [esp + 4], ecx
lea eax, [ebx - 2]
mov esi, eax
sar esi, 1
mov edi, dword [esp + 8]
mov edx, edi
not edx
test al, 2
mov dword [esp + 0x14], edx
jne 0x436647
jmp 0x436672
mov eax, ebp
jmp 0x4366e0
dec esi
mov ecx, dword [esp + 0x30]
movzx eax, word [ecx]
add ecx, 2
mov dword [esp + 4], ecx
xor eax, ebp
mov ebp, eax
not ebp
and ebp, edi
mov ecx, eax
and ecx, edx
imul ecx, ebp
mov ebp, eax
and ebp, edi
or eax, edi
imul eax, ebp
add eax, ecx
mov ebp, eax
cmp ebx, 4
mov ecx, dword [esp + 4]
je 0x4366e0
xor ebx, ebx
mov eax, ebp
mov dword [esp + 0x10], esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [ecx + ebx*2]
xor ebp, eax
mov eax, ebp
not eax
and eax, edi
mov edx, ebp
mov esi, ecx
mov ecx, dword [esp + 0x14]
and edx, ecx
imul edx, eax
mov eax, ebp
and eax, edi
or ebp, edi
imul ebp, eax
add ebp, edx
movzx eax, word [esi + ebx*2 + 2]
xor eax, ebp
mov edx, eax
not edx
and edx, edi
mov ebp, eax
and ebp, ecx
mov ecx, esi
imul ebp, edx
mov edx, eax
and edx, edi
or eax, edi
imul eax, edx
mov esi, dword [esp + 0x10]
add eax, ebp
add ebx, 2
cmp esi, ebx
jne 0x436690
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ae30
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], 0xf3f2f1a0
mov word [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 5
ja 0x43aea1
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add edx, 0xa1833164
mov esi, edx
and esi, ecx
mov edi, edx
xor edi, ecx
not ecx
or edx, ecx
sub ecx, edx
add ecx, esi
lea ecx, [edi + ecx*2]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0x6c
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 6
jb 0x43ae60
mov ecx, dword [esp + 4]
mov ecx, dword fs:[ecx]
mov edx, dword [0x4489ec]
nop
nop
jmp edx