joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418dda
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x41d174]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0xb0], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xac], 0x50
test eax, eax
jne 0x418e1c
mov esi, 0x8000ffff
jmp 0x418f0f
push 2
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
push eax
mov dword [ebp - 0xa8], eax
call dword [sym.imp.msvcrt.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x418ee6
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
jmp 0x418e9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x418e73
cmp dword [ebp - 0xac], 0x50
ja 0x418edf
push dword [ebp - 0xa8]
push ebx
call dword [sym.imp.msvcrt.dll_realloc]
pop ecx
pop ecx
test eax, eax
je 0x418ee6
mov ebx, eax
jmp 0x418e9e
cmp dword [ebp - 0xb0], 0
jne 0x418eed
push 0x5c
push edi
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
mov dword [ebp - 0xb0], 1
test eax, eax
je 0x418eed
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov edi, eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xa8]
push eax
push ebx
push edi
push 0
call esi
test eax, eax
je 0x418e44
mov eax, dword [ebp - 0xb4]
mov dword [eax], ebx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412cc0
leave
ret 4
mov esi, 0x80070057
jmp 0x418f03
mov esi, 0x8007000e
jmp 0x418f03
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x418f01
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test ebx, ebx
je 0x418f0f
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, esi
jmp 0x418ece
Function at 0x419519
Capabilities:
Impersonate user

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_LogonUserW]
push esi
push edi
lea eax, [ebp - 8]
push eax
xor edi, edi
push edi
push 3
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp + 8]
mov dword [ebp - 8], edi
push dword [ebp + 0xc]
call ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, edi
jne 0x41962b
cmp eax, 0x569
je 0x419565
cmp eax, 0x544
jne 0x419639
xor esi, esi
cmp dword [ebp + 8], edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
je 0x41957a
push dword [ebp + 8]
call edi
mov esi, eax
inc esi
push dword [ebp + 0xc]
call edi
lea esi, [esi + eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040928d
mov edi, eax
pop ecx
test edi, edi
jne 0x4195a7
xor eax, eax
jmp 0x41963b
cmp dword [ebp + 8], 0
je 0x4195c4
push dword [ebp + 8]
push 0x406f64
push esi
push edi
call fcn.00413e9b
add esp, 0x10
mov dword [ebp - 4], eax
jmp 0x4195c9
xor eax, eax
mov word [edi], ax
cmp dword [ebp - 4], 0
jl 0x4195dd
push dword [ebp + 0xc]
push esi
push edi
call fcn.00409da8
test eax, eax
jge 0x4195e6
push edi
call fcn.004092a2
pop ecx
jmp 0x4195a0
push 0x407f54
push edi
call fcn.00418f18
mov dword [ebp - 4], eax
test eax, eax
jl 0x4195dd
lea eax, [ebp - 8]
push eax
push 0
push 4
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp + 0xc]
call ebx
cmp dword [ebp - 4], 0
mov esi, eax
jne 0x41961e
push 0x407f54
push edi
call fcn.004190ea
push edi
call fcn.004092a2
pop ecx
test esi, esi
je 0x419639
xor edi, edi
cmp dword [ebp - 8], edi
je 0x419639
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x419ef6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41d174]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
push 0x408640
push dword [ebp + 0x14]
xor eax, eax
push dword [ebp + 0x18]
mov word [ecx], ax
call fcn.00409cfe
mov ecx, dword [ebp + 0x20]
push dword [ebp + 8]
xor eax, eax
mov word [ecx], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x41a036
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41a036
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41a036
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x41a036
movzx esi, word [edi]
mov eax, esi
shr eax, 1
add eax, esi
call fcn.0041b630
mov ebx, esp
push esi
push edi
push ebx
call fcn.00412cd6
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x40860c
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x419fd0
mov ecx, dword [ebp - 0xc]
movzx ecx, word [ecx]
xor eax, eax
cmp cx, word [eax*8 + 0x408308]
je 0x419fbe
inc eax
cmp eax, 0x27
jb 0x419fac
jmp 0x419fd0
push dword [eax*8 + 0x40830c]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.00409cfe
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x4026c8
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41a036
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0xffffffff
je 0x41a01a
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push 0x4085f4
push dword [ebp + 0x14]
push dword [ebp + 0x18]
call fcn.00413e9b
mov eax, dword [ebp - 8]
add esp, 0x1c
test byte [eax + 0x1c], 1
mov eax, 0x4085ec
jne 0x41a02a
mov eax, 0x4085e4
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x20]
call fcn.00409cfe
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412cc0
leave
ret 0x1c
Function at 0x41a0ea
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
shr eax, 0x1e
push esi
push edi
cmp eax, 1
jbe 0x41a10a
push 2
pop ebx
cmp eax, ebx
je 0x41a10d
xor ebx, ebx
inc ebx
jmp 0x41a10d
push 4
pop ebx
lea eax, [ebp - 4]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.0041986d
mov esi, dword [ebp - 4]
cmp esi, edi
je 0x41a147
movzx ecx, word [ebp + 0x18]
mov eax, dword [esi]
push edi
push dword [ebp + 0x1c]
push edi
push ecx
movzx ecx, word [ebp + 8]
push edi
push dword [ebp + 0xc]
push ecx
movzx ecx, bx
push ecx
push esi
call dword [eax + 0xc]
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x41a177
push 0x4086c4
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
cmp esi, edi
je 0x41a177
push edi
push dword [ebp + 0x1c]
push edi
push dword [ebp + 0x18]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
pop ebx
leave
ret 0x18

Function at 0x41ae57
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x41d174]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0
push 0
push ebx
push edi
mov dword [ebp - 0xf8], pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0x41aecb
cmp dword [ebp - 0xf8], 2
jb 0x41aefc
mov eax, dword [ebp - 0xf4]
and eax, 0xffdf
cmp eax, 0x4e
je 0x41aec6
cmp eax, 0x59
jne 0x41aefc
mov dword [esi], 1
jmp 0x41aefc
and dword [esi], 0
jmp 0x41aefc
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, 0xb
add eax, 0x4e
mov word [ebp - 0xf4], ax
xor eax, eax
push 4
mov word [ebp - 0xf2], ax
lea eax, [ebp - 0xf4]
push eax
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412cc0
leave
ret 0xc

Function at 0x40892d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
add esi, ecx
call fcn.00408959
dec ecx
xor dword [edi], eax
add esi, esi
mov ecx, 0x5a660b37
add edi, 1
inc ecx
cmp edi, ebx
jne fcn.0040892d
sub ecx, esi
and esi, ecx
ret
Function at 0x40cb90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
imul eax, dword [0x4457fc], 0x1112a04
mov dword [0x4457fc], eax
xor dword [0x447544], 0x82daa12
dec dword [0x445554]
mov eax, dword [0x445554]
imul eax, eax, 0xcf8c9939
or eax, 0x96ba1274
cmp eax, 0x2d57ba3e
je 0x40cbd5
and dword [0x44c560], 0x6c31f55d
jmp 0x40cbe4
imul eax, dword [0x44b550], 0xcd79abc8
mov dword [0x44b550], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
test ebx, ebx
jle 0x40ccfa
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
sub edx, esi
mov eax, dword [0x450f68]
mov ecx, 0xb8922ca0
sub ecx, eax
movzx eax, word [0x436b1a]
xor ecx, 0x311ae8a1
add eax, ecx
mov word [0x436b1a], ax
cmp dword [esi], edi
mov eax, dword [0x44c6bc]
sbb ecx, ecx
imul eax, dword [0x44a134]
neg ecx
imul eax, eax, 0x244a90c2
mov dword [0x44c6bc], eax
inc dword [0x44a134]
sub dword [esi], edi
add dword [0x445a84], 0x103d9436
mov eax, dword [esi]
cmp eax, dword [edx + esi]
sbb edi, edi
xor dword [0x44e5ec], 0xdefffffa
mov eax, dword [edx + esi]
neg edi
sub dword [esi], eax
add edi, ecx
mov eax, dword [0x44d42c]
add esi, 4
add eax, 0xd53d5b15
and dword [0x4510ac], eax
dec ebx
jne 0x40cbfc
test edi, edi
je 0x40ccf9
imul eax, dword [0x44bbe4], 0x8500aa58
mov dword [0x44bbe4], eax
cmp dword [esi], edi
mov eax, dword [0x4445dc]
sbb edx, edx
or eax, 0x86b7b9df
mov dword [0x4445b4], eax
neg edx
sub dword [esi], edi
mov edi, edx
add dword [0x44e15c], 0xee381c00
lea esi, [esi + 4]
dec dword [0x443198]
mov ecx, dword [0x443198]
mov eax, dword [0x4424a4]
lea eax, [eax*2 + 0x255d3e82]
or eax, ecx
sub dword [0x43f8d4], eax
mov eax, dword [0x44fdec]
add eax, 0x54cd5f64
or dword [0x442850], eax
mov eax, dword [0x447120]
sub eax, dword [0x4455d0]
mov dword [0x447120], eax
test edx, edx
jne 0x40cc80
pop esi
imul eax, dword [0x442740], 0x3ab9f715
pop edi
pop ebx
mov dword [0x442740], eax
pop ebp
ret
Function at 0x4136d2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movsx eax, word [0x436aba]
not eax
imul eax, eax, 0x1926b918
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
or dword [0x442bec], eax
add dword [0x449058], 0xd821d4f3
inc dword [0x441c48]
mov eax, dword [0x441c48]
imul ecx, dword [0x44fbec], 0x60c1fec5
or ecx, eax
xor dword [0x4504fc], ecx
cmp dword [ebp + 8], ebx
jle 0x41388f
mov edx, dword [ebp + 0xc]
sub edx, edi
mov dword [ebp + 0xc], edx
push esi
mov eax, dword [0x442e9c]
add eax, 0x45ec8de8
cmp eax, 0x2271c3b9
jle 0x41375b
inc dword [0x44c2bc]
mov eax, dword [0x44c2bc]
add eax, 0x7fca47cc
or eax, 0x46731c2d
and eax, dword [0x44a730]
mov dword [0x44a730], eax
imul eax, dword [0x44b5d8], 0x5726bf6e
mov dword [0x44b5d8], eax
mov eax, dword [0x43d724]
not eax
and eax, 0x1944cb0e
xor dword [0x440944], eax
mov ecx, dword [0x448f80]
mov eax, dword [0x447104]
and ecx, 0xd39ed1c9
sar eax, 5
or eax, ecx
inc dword [0x448f80]
cmp eax, 0x9e5564aa
jge 0x4137a9
xor dword [0x43ed30], 0x1dabf015
push 0
push dword [ebp + 0x14]
push 0
push dword [edx + edi]
call fcn.0040be9d
mov dword [0x43dd8c], 0x3951cdb3
xor dword [0x44bc04], 0x941945ea
mov ecx, dword [0x448450]
add ecx, dword [0x44337c]
lea esi, [eax + ebx]
mov dword [0x44337c], ecx
cmp esi, ebx
mov eax, 0xffffbb5d
mov word [0x4380d4], ax
sbb ebx, ebx
mov ax, word [0x439378]
neg ebx
mov ecx, dword [0x44b884]
add ebx, edx
cwde
xor ecx, eax
mov word [0x439378], cx
dec dword [0x44b884]
movsx eax, word [0x43aec6]
add esi, dword [edi]
sar eax, 7
xor eax, 0xf2706093
or dword [0x4446d4], eax
cmp esi, dword [edi]
sbb eax, eax
add dword [0x44d980], 0xc8437f79
neg eax
add ebx, eax
mov eax, dword [0x447f70]
and eax, 0x80351
shl eax, 0xa
mov dword [0x447988], eax
mov dword [edi], esi
add edi, 4
xor dword [0x4444d8], 0xf23fdf64
mov eax, dword [0x4479f0]
xor eax, dword [0x443f68]
inc dword [0x4479f0]
cmp eax, 0xec3a0d6f
jge 0x41387c
mov dword [0x44e6d0], 0xe6ff3b5c
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 8], eax
test eax, eax
jg 0x41372a
pop esi
imul eax, dword [0x443510], 0xdcd5ef57
mov dword [0x443510], eax
inc word [0x439750]
mov ax, word [0x439750]
cwde
xor eax, 0x1cc0f43c
cmp eax, 0x9ffffde9
jg 0x4138c2
or dword [0x441650], 0xa064e2ea
add dword [0x44b9f0], 0x71201cc0
add dword [edi], ebx
movsx ecx, word [0x43523e]
mov eax, dword [0x45117c]
not ecx
xor eax, ecx
xor eax, 0xf2f9389c
mov dword [0x45117c], eax
cmp dword [edi], ebx
lea edi, [edi + 4]
sbb ebx, ebx
add dword [0x44ae34], 0x89ba515a
mov ecx, dword [0x4502e0]
mov eax, dword [0x444d60]
shl ecx, 4
sar eax, 6
add ecx, eax
movsx eax, word [0x43b0e0]
add eax, ecx
mov ecx, dword [0x43f550]
add ecx, eax
mov word [0x43b0e0], cx
dec dword [0x43f550]
neg ebx
jne 0x4138c2
xor dword [0x43e668], 0x2e2277c0
pop edi
pop ebx
pop ebp
ret
Function at 0x4152c2
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x44b1c0]
push esi
xor eax, 0x2b19da4c
add dword [0x44ac20], eax
dec dword [0x44b1c0]
add dword [0x44232c], 0x9223fa13
push edi
mov edi, dword [ebp + 8]
mov esi, edi
cmp byte [edi], 0
je 0x415328
mov eax, dword [0x43fa60]
mov ecx, dword [0x447220]
add eax, 0xa2d662e0
imul ecx, eax
inc esi
mov dword [0x447220], ecx
mov ecx, 0x15d04d6
mov eax, dword [0x44f11c]
sub ecx, eax
or ecx, 0xf0ed9149
xor dword [0x43fb28], ecx
cmp byte [esi], 0
jne 0x4152f1
mov edx, dword [ebp + 0xc]
sub esi, edx
mov cl, byte [edx]
mov byte [esi + edx], cl
inc edx
test cl, cl
jne 0x41532d
imul ecx, dword [0x43dec0], 0xa54917f1
mov eax, edi
pop edi
pop esi
mov dword [0x43dec0], ecx
pop ebp
ret

Function at 0x415873
Capabilities:
Hash data with md5

Disassembly:
imul eax, dword [0x447240], 0x80d6ebf7
push esi
mov esi, ecx
mov dword [0x447240], eax
and dword [esi], 0
movsx eax, word [0x435cee]
mov edx, dword [0x450340]
add eax, 0xfba93b11
or edx, eax
mov dword [0x4441dc], edx
and dword [esi + 4], 0
mov eax, dword [0x4418d8]
shl eax, 7
or eax, 0xb77721b6
and dword [0x43fe6c], eax
mov dword [esi + 8], 0x67452301
add dword [0x44cf54], 0xe962b450
mov dword [esi + 0xc], 0xefcdab89
imul eax, dword [0x4426a0], 0xa39aab8e
mov dword [0x4426a0], eax
mov eax, 0xf1ce5fc2
mov dword [esi + 0x10], 0x98badcfe
mov ecx, dword [0x44c844]
sar ecx, 1
sub eax, ecx
add dword [0x4461b4], eax
mov dword [esi + 0x14], 0x10325476
mov ax, word [0x4376aa]
movsx ecx, ax
mov eax, dword [0x44d230]
add eax, ecx
mov ecx, dword [0x43d2c0]
sar ecx, 6
and ecx, eax
sub dword [0x44bce8], ecx
pop esi
ret
Function at 0x41eefa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
inc dword [0x43d658]
mov ecx, dword [0x43d658]
mov eax, dword [0x43d3e0]
xor eax, 0x486f639e
sar eax, 1
cmp eax, ecx
jge 0x41ef36
mov eax, dword [0x44abc4]
mov ecx, 0x90b88005
sub ecx, eax
movzx eax, word [0x4356f4]
xor eax, ecx
mov word [0x4356f4], ax
mov eax, dword [0x450c34]
sub eax, 0x24e97ad7
cmp eax, 0x5f0a3be4
jg 0x41ef51
or dword [0x444378], 0xf0f6f62a
push ebx
push esi
push edi
push 0
call fcn.00406108
pop ecx
mov cx, word [0x43977a]
mov edi, eax
movsx esi, word [0x43af8a]
mov ebx, edx
movsx ecx, cx
imul esi, ecx
movzx ecx, word [0x43acb6]
and ecx, esi
mov word [0x43acb6], cx
dec word [0x43977a]
cmp dword [0x451ab4], 0
jne 0x41f030
xor esi, esi
cmp dword [0x4522cc], esi
jne 0x41f030
or dword [0x43fe9c], 0x63083d0c
push esi
call fcn.00406108
sub eax, edi
pop ecx
sbb edx, ebx
cmp edx, esi
jg 0x41f019
jge 0x41f015
imul eax, dword [0x4450b0], 0x3a57f9fe
push 0x3e8
mov dword [0x4450b0], eax
call dword [0x4524d4]
mov eax, dword [0x440fcc]
mov edx, dword [0x4447f8]
movsx ecx, word [0x435db2]
not edx
shl eax, 7
and edx, eax
mov eax, dword [0x445ed4]
xor ecx, edx
imul eax, ecx
push esi
mov dword [0x445ed4], eax
call fcn.00406108
sub eax, edi
pop ecx
sbb edx, ebx
mov dword [ebp - 4], edx
js 0x41efc1
jg 0x41f019
cmp eax, esi
jb 0x41efc1
mov eax, dword [0x448748]
not eax
add eax, 0x57b40478
xor eax, 0xecd5c1eb
add dword [0x44ed20], eax
mov eax, dword [0x44c01c]
pop edi
sar eax, 6
pop esi
pop ebx
cmp eax, 0xde21f5f6
jl 0x41f05b
mov eax, dword [0x441a44]
inc dword [0x441a44]
cmp eax, 0x42c40050
jle 0x41f074
mov eax, dword [0x4465d4]
jmp 0x41f074
movsx eax, word [0x433254]
xor eax, 0xae8c4a16
and dword [0x4517e8], eax
inc word [0x433254]
mov esp, ebp
pop ebp
ret

Function at 0x422b7e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov dword [0x447544], 0x40328718
imul eax, dword [0x4454f4], 0x82200330
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [0x4454f4], eax
mov bl, byte [ecx]
movzx edx, byte [esi]
movzx eax, bl
sub edx, eax
jne 0x422bc2
sub esi, ecx
test bl, bl
je 0x422bc2
inc ecx
mov bl, byte [ecx]
movzx edx, byte [esi + ecx]
movzx eax, bl
sub edx, eax
je 0x422bb0
or dword [0x44caa8], 0x34a020
pop esi
pop ebx
test edx, edx
jns 0x422bf3
add dword [0x4473cc], 0xae4aed99
or edx, 0xffffffff
mov eax, dword [0x450670]
sar eax, 1
xor eax, 0xa133f6bd
mov word [0x43736e], ax
jmp 0x422c6c
jle 0x422c6c
inc dword [0x44534c]
mov eax, dword [0x44534c]
cmp eax, 0xaa4ec57e
jne 0x422c37
dec dword [0x44971c]
mov ecx, dword [0x44971c]
movsx eax, word [0x433136]
sar eax, 2
imul eax, eax, 0x63a9f333
and eax, ecx
cmp eax, 0xe049b5e4
jl 0x422c37
mov eax, dword [0x43d9b0]
inc dword [0x43d9b0]
movsx eax, word [0x438800]
mov ecx, 0x3f2a6e22
sub ecx, eax
xor edx, edx
mov eax, dword [0x450388]
inc edx
and eax, ecx
cmp eax, 0x75933fb9
jle 0x422c62
mov dword [0x44a534], 0xfc30581c
jmp 0x422c6c
mov dword [0x442d24], 0x96498480
add dword [0x440cc4], 0x23ede581
mov eax, edx
pop ebp
ret
Function at 0x428ccb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
xor dword [0x43e990], 0x4d04ece0
movsx eax, word [0x433bc6]
push esi
add eax, 0x9dcc4f5a
xor esi, esi
add dword [0x450430], eax
push edi
mov edi, dword [ebp + 8]
cmp dword [ebp + 0xc], esi
je 0x428e2e
push ebx
push 0xa
pop ebx
mov eax, dword [0x441244]
not eax
mov dword [0x4494ac], eax
test esi, esi
je 0x428d7f
call fcn.00409df4
movzx eax, al
cdq
idiv ebx
test edx, edx
jne 0x428d7f
mov eax, dword [0x4401ec]
mov ecx, 0x7fe41841
sub ecx, eax
mov eax, dword [0x44bfb8]
and eax, ecx
inc dword [0x4401ec]
cmp eax, 0xe49f4be7
jge 0x428d5a
movsx ecx, word [0x4343cc]
movzx eax, word [0x43ced8]
and ecx, 0x708a701e
imul eax, ecx
mov word [0x43ced8], ax
call fcn.00409df4
movzx eax, al
cdq
idiv ebx
add dl, 0x30
mov byte [esi + edi], dl
imul eax, dword [0x44e718], 0xa315ad8b
mov dword [0x44e718], eax
jmp 0x428e19
inc word [0x43bd2a]
mov ax, word [0x43bd2a]
cwde
xor eax, 0x422200e0
cmp eax, 0xf44a2b67
jne 0x428da5
or dword [0x44fac8], 0xe3410741
jmp 0x428dbd
movsx eax, word [0x43b560]
cmp eax, 0x99623145
jne 0x428dbd
mov eax, dword [0x442640]
mov eax, dword [0x4424e0]
call fcn.00409df4
movzx eax, al
cdq
push 0x1a
pop ecx
idiv ecx
add dl, 0x61
mov byte [esi + edi], dl
inc dword [0x43fcac]
mov eax, dword [0x43fcac]
and eax, 0xaf2cebf3
cmp eax, 0xc63bbf99
jl 0x428df4
mov dword [0x43dad4], 0x2ae25037
jmp 0x428e19
movsx eax, word [0x43b18c]
not eax
imul ecx, eax, 0xe1c0af9e
movzx eax, word [0x4362ce]
or ecx, 0xd0d6f54f
imul eax, ecx
mov word [0x4362ce], ax
or dword [0x44c3a4], 0x7edfbedc
inc esi
cmp esi, dword [ebp + 0xc]
jne 0x428cfe
pop ebx
mov eax, dword [0x4445a4]
mov ecx, 0x20ecffe6
sub ecx, eax
add dword [0x44737c], ecx
mov byte [esi + edi], 0
movzx eax, word [0x4379e2]
xor eax, 0x925e1c69
pop edi
mov word [0x4379e2], ax
pop esi
pop ebp
ret
Function at 0x42a306
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor dword [0x440514], 0x7abc274
xor dword [0x44a830], 0xdd9ffc5f
mov eax, dword [0x44a94c]
shl eax, 7
or eax, 0xcf9d150a
and dword [0x44787c], eax
mov eax, dword [0x448014]
push esi
sar eax, 4
xor esi, esi
add eax, 0x2748656b
push edi
mov edi, ecx
mov dword [0x44ae1c], eax
add dword [0x449394], 0x35b4ff6d
and dword [0x44129c], 0x6fd38afd
mov cl, byte [edi + esi + 0x58]
add dword [0x44ba04], 0x54959c7d
movzx eax, word [0x43b910]
xor eax, 0x26c1e987
mov word [0x43b910], ax
movzx eax, cl
shr eax, 4
mov al, byte [eax + edi + 0xa8]
mov byte [edi + esi*2 + 0xb9], al
movzx eax, word [0x4391f2]
and eax, 0xa75f633a
mov word [0x4391f2], ax
add dword [0x443430], 0xe9fefefd
mov ecx, dword [0x44f950]
mov eax, dword [0x441520]
mov dl, byte [edi + esi + 0x58]
add eax, 0x4fc28276
add eax, ecx
mov dword [0x441520], eax
imul eax, dword [0x44dcfc], 0xdb194d2b
mov dword [0x44dcfc], eax
movzx eax, dl
and eax, 0x8000000f
jns 0x42a3e2
dec eax
or eax, 0xfffffff0
inc eax
movzx eax, al
mov al, byte [eax + edi + 0xa8]
mov byte [edi + esi*2 + 0xba], al
dec dword [0x44e7b0]
mov ecx, dword [0x44e7b0]
movzx eax, word [0x438f7e]
add ecx, 0x4318763
or ecx, eax
inc esi
mov word [0x438f7e], cx
and dword [0x440cd4], 0x260b95c7
cmp esi, 0x10
jne 0x42a345
dec dword [0x4487b4]
mov eax, dword [0x4487b4]
movzx ecx, word [0x4376c6]
and ecx, eax
pop edi
mov word [0x4376c6], cx
pop esi
ret
Function at 0x42c679
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add dword [0x4481ac], 0xb19e7b89
inc dword [0x446184]
mov eax, dword [0x446184]
imul eax, eax, 0x36869c7e
or eax, 0xb18c50c9
cmp eax, 0xbd46fbb9
jg 0x42c6c0
inc dword [0x451074]
mov eax, dword [0x451074]
add eax, 0x593643c0
cmp eax, 0x1c5a6b8a
jl 0x42c6c0
mov ax, word [0x43868e]
mov eax, dword [0x446090]
xor eax, 0x8bca5b72
inc dword [0x446090]
cmp eax, 0xa746e606
jg 0x42c6e1
xor dword [0x4408ac], 0x94cefd45
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00424190
pop ecx
movsx ecx, word [0x43a87c]
and ecx, 0x2ed4a8a8
sub dword [0x44cbf4], ecx
lea edx, [eax - 1]
dec word [0x43a87c]
add dword [0x450318], 0x25f4c11e
cmp byte [edx + esi], 0x22
jne 0x42c814
mov ecx, dword [0x44b324]
movzx eax, word [0x43a5ea]
not ecx
add eax, ecx
mov word [0x43a5ea], ax
mov byte [esi], 0x22
xor dword [0x44e814], 0x3301e1d6
mov byte [edx + esi], 0
inc dword [0x447a14]
mov ecx, dword [0x447a14]
movzx eax, word [0x43694e]
xor ecx, 0x96a4ab2e
or ecx, eax
mov word [0x43694e], cx
mov eax, dword [0x43d728]
xor eax, 0xa36b64b9
cmp eax, 0x7dd9351c
jg 0x42c784
mov dword [0x43eea4], 0xf7f159df
jmp 0x42c79a
mov eax, dword [0x447048]
sub eax, dword [0x44d7dc]
mov dword [0x447048], eax
inc dword [0x44d7dc]
movsx eax, word [0x4398c6]
dec edx
or eax, 0xcf5bbab7
cmp eax, 0xfff6febe
je 0x42c7c5
dec dword [0x44dfc0]
mov eax, dword [0x44dfc0]
xor eax, 0xf31a9bf6
mov dword [0x440750], eax
jmp 0x42c7e3
cmp dword [0x44817c], 0x7513225a
jge 0x42c7e3
movzx eax, word [0x434b0a]
or eax, 0xb66055c9
mov word [0x434b0a], ax
cmp byte [edx + esi], 0x22
jne 0x42c767
movsx eax, word [0x439f00]
inc esi
imul eax, eax, 0xa4520ae2
add esi, edx
and dword [0x44baf4], eax
imul eax, dword [0x43f2ac], 0xb17058bb
mov dword [0x43f2ac], eax
jmp 0x42c885
xor dword [0x443d5c], 0xcd316084
mov byte [esi], 0x20
mov eax, dword [0x444650]
and eax, 0xf53ae243
add eax, eax
xor dword [0x44e1ac], eax
dec edx
mov dword [0x448898], 0x85523311
xor dword [0x446c2c], 0xa9311b11
cmp byte [edx + esi], 0x20
jne 0x42c833
movsx eax, word [0x43cda8]
not eax
imul ecx, eax, 0x4036f665
mov eax, dword [0x442270]
not eax
imul eax, eax, 0xa99316d7
cmp eax, ecx
je 0x42c878
xor dword [0x4460c0], 0x4331dc51
inc esi
mov dword [0x449c24], 0x1fb8ffff
add esi, edx
mov edx, dword [0x44a84c]
mov eax, esi
movzx ecx, word [0x43b0b6]
sar edx, 0xa
imul ecx, edx
pop esi
imul ecx, ecx, 0xb67d1db3
mov word [0x43b0b6], cx
pop ebp
ret