joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403600
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x403704
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x403704
push ebx
call fcn.00409e20
add esp, 4
test eax, eax
je 0x40365a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x403661
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x403640
jmp 0x403663
mov esi, 0x1505
jmp 0x403663
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x403704
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x403694
inc ebp
dec ebx
je 0x4036ff
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x4036ff
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x403690
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.00409e20
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x403690
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00409e40
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x403690
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x4036ff
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x403704
mov edi, dword [eax + 8]
jmp 0x403704
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403710
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
push 0x2e
push ebp
call fcn.00409e90
add esp, 8
test eax, eax
je 0x40377e
mov esi, eax
jmp 0x403754
mov ebp, esi
inc ebp
push 0x2e
push ebp
call fcn.00409e90
add esp, 8
mov esi, eax
test eax, eax
je 0x40377e
mov eax, esi
not eax
and eax, ebp
mov ecx, ebp
not ecx
and ecx, esi
sub ecx, eax
push ecx
push ebp
push edi
call fcn.00403180
add esp, 0xc
xor edi, edi
test eax, eax
je 0x403740
cmp dword [eax + 4], 4
jne 0x403740
mov edi, dword [eax + 8]
jmp 0x403740
xor eax, eax
test edi, edi
je 0x4037db
test ebp, ebp
je 0x4037db
push ebp
call fcn.00409e20
add esp, 4
test eax, eax
je 0x4037bb
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [ebp + ebx]
test edx, edx
je 0x4037c2
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebx
mov ecx, esi
cmp eax, ebx
jne 0x4037a0
jmp 0x4037c4
mov esi, 0x1505
jmp 0x4037c4
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [edi + 0x20]
lea ebx, [ecx - 1]
mov eax, ecx
sub eax, 1
mov dword [esp + 0x14], eax
jae 0x4037e3
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, esi
mov dword [esp], edi
mov eax, dword [edi + 4]
mov dword [esp + 0x10], eax
jmp 0x403804
inc ebx
dec ecx
je 0x4037d9
mov eax, ebx
and eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x4037d9
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + edi*4], esi
jne 0x403800
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], ecx
call fcn.00409e20
mov ecx, dword [esp + 0xc]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x403800
push dword [esp + 4]
push dword [esp + 0x10]
push ebp
call fcn.00409e40
mov ecx, dword [esp + 0x14]
add esp, 0xc
test eax, eax
jne 0x403800
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x4037db
Function at 0x403900
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x40396d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x40396d
push esi
call fcn.00409e20
add esp, 4
test eax, eax
je 0x40394a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x403951
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x403930
jmp 0x403953
mov ebx, 0x1505
jmp 0x403953
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x403975
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x403984
inc ebp
dec edi
je 0x40396b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x40396b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x403980
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.00409e20
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x403980
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00409e40
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x403980
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x40396d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x40396d
Function at 0x403b90
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x403ca2
mov esi, dword [esp + 0x28]
test esi, esi
je 0x403ca2
cmp dword [esp + 0x2c], 0
je 0x403ca2
push esi
call fcn.00409e20
add esp, 4
test eax, eax
je 0x403bfa
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x403c01
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x403be0
jmp 0x403c03
mov ebx, 0x1505
jmp 0x403c03
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x403caa
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x403c67
call fcn.00403da0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x403ca2
push ecx
call fcn.00409e20
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x403d1d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x403cc8
inc edi
dec esi
je 0x403c1c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x403c21
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x403cc0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.00409e20
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x403cc0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.00409e40
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x403cc0
mov eax, 0xffffffff
jmp 0x403ca2
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x403d38
inc edi
dec esi
je 0x403c62
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x403c67
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x403d30
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00409e20
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x403d30
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.00409e40
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x403d30
jmp 0x403c67
Function at 0x4044c0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x404666
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40465f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x404555
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ecx
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, edi
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub ecx, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x40465f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x4045ce
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x404570
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x40451d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x404610
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x4045f0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x404510
jmp 0x40461f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x404510
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x404630
jmp 0x404510
shl ecx, 0x10
or ecx, edi
jmp 0x40466b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x404680
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4046dc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x4046de
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
and eax, 0xf
mov ebp, edi
not ebp
or ebp, 0xf
add ebp, edi
inc ebp
xor ebp, eax
xor ebx, dword [ebp*4 + 0x44280c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44280c]
inc esi
cmp edx, esi
jne 0x4046a0
not eax
jmp 0x4046de
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x409c7c
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x409c5e
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x409c60
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 0xfffffffd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x409c40
jmp 0x409c60
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x409c7a
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x409c7c
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40ebc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x168
mov esi, esp
push eax
mov dword [esi + 0x120], esp
push eax
mov dword [esi + 0x11c], esp
sub esp, 8
mov eax, esp
mov dword [esi + 0xac], eax
mov dword [esi + 0x9c], eax
push eax
mov dword [esi + 0x98], esp
sub esp, 8
mov dword [esi + 0x114], esp
sub esp, 8
mov dword [esi + 0x110], esp
sub esp, 8
mov dword [esi + 0x78], esp
sub esp, 8
mov eax, esp
mov dword [esi + 0xa8], eax
mov dword [esi + 0x94], eax
push eax
mov dword [esi + 0x90], esp
sub esp, 0x68
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x74], eax
mov esp, eax
push eax
mov ecx, esp
sub esp, 8
mov eax, esp
mov dword [esi + 0xb4], eax
mov dword [esi + 0x130], eax
mov dword [esi + 0x134], ecx
sub esp, 8
mov dword [esi + 0xb0], esp
sub esp, 8
mov dword [esi + 0x68], esp
push eax
mov dword [esi + 0x118], esp
sub esp, 8
mov dword [esi + 0xa4], esp
sub esp, 8
mov dword [esi + 0x10c], esp
sub esp, 8
mov dword [esi + 0xa0], esp
sub esp, 8
mov dword [esi + 0x108], esp
push eax
mov dword [esi + 0x104], esp
push eax
mov dword [esi + 0x100], esp
sub esp, 8
mov dword [esi + 0xfc], esp
sub esp, 0xc
mov dword [esi + 0x4c], esp
push eax
mov dword [esi + 0x70], esp
sub esp, 0x68
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x60], eax
mov esp, eax
push eax
mov edi, esp
sub esp, 8
mov dword [esi + 0xcc], esp
sub esp, 8
mov dword [esi + 0xbc], esp
push eax
mov dword [esi + 0x144], esp
sub esp, 8
mov dword [esi + 0xc4], esp
sub esp, 8
mov dword [esi + 0xd0], esp
sub esp, 0x68
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x7c], eax
mov esp, eax
push eax
sub esp, 8
mov dword [esi + 0x12c], esp
sub esp, 8
mov dword [esi + 0x50], esp
sub esp, 0x50
mov dword [esi + 0x64], esp
push eax
mov dword [esi + 0x13c], esp
push eax
mov dword [esi + 0x138], esp
sub esp, 8
mov dword [esi + 0xb8], esp
sub esp, 8
mov dword [esi + 0x80], esp
push eax
mov dword [esi + 0xdc], esp
sub esp, 8
mov dword [esi + 0xd8], esp
sub esp, 0x68
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0xc0], eax
mov esp, eax
mov word [esi + 0xc], 0x43f9
mov dword [esi + 0xe], 0
mov dword [esi + 0x1c], 0
mov eax, dword [esi + 0x1c]
cmp eax, 5
ja 0x40eda5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x1c]
movzx ecx, byte [esi + ecx + 0xc]
mov edx, eax
and edx, 0xfceadd2b
xor eax, 0x7ceadd2b
lea eax, [eax + edx*2]
xor eax, ecx
mov dword [esi], eax
mov eax, dword [esi]
add al, 0x91
mov ecx, dword [esi + 0x1c]
mov byte [esi + ecx + 0xc], al
inc dword [esi + 0x1c]
mov eax, dword [esi + 0x1c]
cmp eax, 6
jb 0x40ed70
lea eax, [esi + 0xc]
push eax
push dword [ebp + 8]
call fcn.004034d0
add esp, 8
mov edx, eax
xor ecx, ecx
test eax, eax
sete cl
xor ebx, ebx
xor eax, eax
mov dword [esi + 0x38], edi
mov dword [esi + 0xc8], edx
jmp dword [ecx*4 + 0x44626c]
Function at 0x413c80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebp, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x413ca0
sar edi, 1
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x413cc0
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x413cde
mov eax, 0xffffffff
jmp 0x413ce7
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.00409cc0
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x413d11
add esi, 2
mov eax, ebx
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x413d00
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0x413d41
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413d30
mov word [eax], 0
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043fd00
add esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x14], ebx
jmp dword [eax*4 + 0x44675c]
Function at 0x413fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x78
mov ecx, dword [esp + 0x90]
xor eax, eax
cmp word [ecx + eax], 0
lea eax, [eax + 2]
jne 0x413fe0
add eax, ecx
add eax, 0xfffffffe
mov esi, ecx
not esi
and esi, eax
xor eax, ecx
add esi, esi
sub esi, eax
sar esi, 1
lea ebx, [esp + 0x60]
push ebx
push 0
push 0
push esi
push ecx
push 0
call dword [0x44ba94]
mov ebp, dword [esp + 0x60]
mov edi, 0xffffffff
test ebp, ebp
jns 0x414024
mov eax, 0xffffffff
jmp 0x41402b
lea eax, [ebp*2]
push eax
call fcn.00409cc0
add esp, 4
push ebx
push ebp
mov ebp, eax
push eax
push esi
push dword [esp + 0xa0]
push 0
call dword [0x44ba94]
mov eax, dword [esp + 0x60]
mov ecx, eax
add ecx, 0xd
js 0x41405b
lea edi, [eax*2 + 0x1a]
push edi
call fcn.00409cc0
add esp, 4
mov ebx, eax
mov dword [esp + 0x14], 0x441f42ed
mov dword [esp + 0x18], 0x58f446e4
mov dword [esp + 0x1c], 0x5c3b5aed
mov dword [esp + 0x20], 0x50fa5e0b
mov dword [esp + 0x24], 0x54e052e3
mov dword [esp + 0x28], 0xa8e856ec
mov dword [esp + 0x2c], 0xacabaa17
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x1b
ja 0x4140de
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x14]
add eax, 0x401a6669
xor eax, ecx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
add al, 0xd8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1c
jb 0x4140b0
movzx ecx, word [ebp]
mov eax, ebx
test cx, cx
je 0x414101
lea edx, [ebp + 2]
mov eax, ebx
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4140f0
mov word [eax], 0
movzx ecx, word [esp + 0x14]
test cx, cx
je 0x414131
lea edx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414120
mov word [eax], 0
lea eax, [esp + 8]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043fd00
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446a10]

Function at 0x4162f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x40]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x416300
sar ebp, 1
lea eax, [esp + 4]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x44ba94]
mov edi, dword [esp + 4]
test edi, edi
jns 0x41632f
mov eax, 0xffffffff
jmp 0x416332
lea eax, [edi + edi]
push eax
call fcn.00409cc0
add esp, 4
mov esi, eax
lea eax, [esp + 4]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x44ba94]
lea ebx, [esp + 0x14]
push ebx
push esi
call fcn.0043fed0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446d78]
Function at 0x419a00
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x419a20
cmp eax, 0xffffffdd
jge 0x419a37
mov eax, 0xffffffff
jmp 0x419a3a
add eax, 0x22
push eax
call fcn.00409cc0
add esp, 4
mov esi, eax
mov dword [esp + 8], 0x73e17114
mov dword [esp + 0xc], 0x7fe97de0
mov dword [esp + 0x10], 0x7b1b79ea
mov dword [esp + 0x14], 0x670b650b
mov dword [esp + 0x18], 0x630e6104
mov dword [esp + 0x1c], 0x6f006d01
mov dword [esp + 0x20], 0x6bf76909
mov dword [esp + 0x24], 0x970a9500
mov word [esp + 0x28], 0x9190
mov dword [esp + 0x2a], 0
mov word [esp + 0x2e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x27
ja 0x419ade
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xa7c0b1e4
xor eax, ecx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x4c]
add al, 0x6c
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x28
jb 0x419ab0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x419b01
add ecx, 2
mov eax, esi
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x419af0
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x419b31
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419b20
mov word [eax], 0
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x5c], eax
mov dword [esp + 8], 0x3f8d3d85
mov dword [esp + 0xc], 0x3bcf3984
mov dword [esp + 0x10], 0x7bc0595
mov dword [esp + 0x14], 0x3af01ba
mov dword [esp + 0x18], 0xfb10db4
mov dword [esp + 0x1c], 0xbb909a5
mov dword [esp + 0x20], 0x17e115bc
mov dword [esp + 0x24], 0x13e511e3
mov dword [esp + 0x28], 0x1fba1df8
mov dword [esp + 0x2c], 0x1ba519a1
mov dword [esp + 0x30], 0xe756e5b5
mov dword [esp + 0x34], 0xe351e12b
mov dword [esp + 0x38], 0xef50ed54
mov dword [esp + 0x3c], 0xeb50e941
mov dword [esp + 0x40], 0xf73ff556
mov dword [esp + 0x44], 0xf337f15a
mov dword [esp + 0x48], 0xfffcfd18
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x43
ja 0x419c21
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x2eb303d7
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x1b
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x44
jb 0x419bf0
lea eax, [esp + 0x4c]
lea ecx, [esp + 8]
push eax
push 0x419ed0
push ecx
push esi
call fcn.0041a580
add esp, 0x10
jmp dword [0x446e40]
Function at 0x419d80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x2c]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x419d90
cmp eax, 0xffffffed
jge 0x419da7
mov eax, 0xffffffff
jmp 0x419daa
add eax, 0x12
push eax
call fcn.00409cc0
add esp, 4
mov esi, eax
mov dword [esp + 4], 0x7ee67cd7
mov dword [esp + 8], 0x72f870da
mov dword [esp + 0xc], 0x76ab74a7
mov dword [esp + 0x10], 0x6acb68d3
mov dword [esp + 0x14], 0x6c6b
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x13
ja 0x419e1e
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0xc2b37e03
xor eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add al, 0x88
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x14
jb 0x419df0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x419e41
add edi, 2
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x419e30
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x419e71
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419e60
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.0043fed0
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x446e58]

Function at 0x41a400
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov ebp, dword [esp + 0x60]
mov edi, dword [esp + 0x58]
mov esi, dword [esp + 0x54]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x68]
movzx ecx, byte [esp + 0x64]
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x30], cl
mov dword [esp + 0x34], eax
test ebp, ebp
setg al
and al, cl
movzx eax, al
jmp dword [eax*4 + 0x446f68]
Function at 0x41fc00
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84c
lea esi, [esp + 0xd8]
mov dword [esp + 0xc], 0
xor edi, edi
mov ebx, 0x20219
mov eax, 1
mov dword [esp + 8], 0
jmp dword [eax*4 + 0x447d5c]