joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x4096aa
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x4095bc
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4095ed
cmp cx, 0x7f
jbe 0x4095b0
movzx ecx, cx
cmp ecx, 0x7ff
ja 0x4095e0
add ebx, 2
jmp 0x4095b1
mov ecx, ebx
and ecx, 3
xor ebx, 3
lea ebx, [ebx + ecx*2]
jmp 0x4095b1
lea esi, [ebx + 1]
push esi
call fcn.00408d80
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x4096b8
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x409628
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x4096ba
movzx edx, word [edi]
test dx, dx
je 0x4096ba
cmp dx, 0x7f
jbe 0x409610
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp ecx, 2
jb 0x409670
cmp esi, 0x7ff
ja 0x409670
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x409617
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x409617
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x409617
push 1
call fcn.00408d80
add esp, 4
mov ebp, eax
jmp 0x4096ba
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x4096d7
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x4096d2
test eax, eax
jne 0x4096d0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00405950
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40c1d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x450
mov dword [esp + 0x48], 0xb790d59
mov dword [esp + 0x4c], 0x77f098e
mov dword [esp + 0x50], 0x3760570
mov dword [esp + 0x54], 0x1f2d0161
mov dword [esp + 0x58], 0x1b281d51
mov dword [esp + 0x5c], 0x17361928
mov dword [esp + 0x60], 0x1379152c
mov dword [esp + 0x64], 0x2f5c1169
mov dword [esp + 0x68], 0x2b592d50
mov dword [esp + 0x6c], 0x27a929a3
mov dword [esp + 0x70], 0x23702504
mov dword [esp + 0x74], 0x3f1e214c
mov dword [esp + 0x78], 0x3b0a3d0d
mov dword [esp + 0x7c], 0x3706390a
mov dword [esp + 0x80], 0x33123573
mov dword [esp + 0x84], 0x4f37315b
mov dword [esp + 0x88], 0x4b004d3e
mov dword [esp + 0x8c], 0x47014904
mov dword [esp + 0x90], 0x43ca4564
mov dword [esp + 0x94], 0x5f12410a
mov dword [esp + 0x98], 0x5b7a5d65
mov dword [esp + 0x9c], 0x57265919
mov dword [esp + 0xa0], 0x53265524
mov dword [esp + 0xa4], 0x6f05512d
mov dword [esp + 0xa8], 0x6b146d11
mov dword [esp + 0xac], 0x671f693f
mov dword [esp + 0xb0], 0x635165e8
mov dword [esp + 0xb4], 0x7f31612d
mov dword [esp + 0xb8], 0x7b487d37
mov dword [esp + 0xbc], 0x773c7937
mov dword [esp + 0xc0], 0x734a7554
mov dword [esp + 0xc4], 0x8fd67127
mov dword [esp + 0xc8], 0x8bdf8de0
mov dword [esp + 0xcc], 0x87b289dc
mov dword [esp + 0xd0], 0x83f685a4
mov dword [esp + 0xd4], 0x9fe981f9
mov dword [esp + 0xd8], 0x9bba9de1
mov dword [esp + 0xdc], 0x97eb99c3
mov dword [esp + 0xe0], 0x93e595eb
mov dword [esp + 0xe4], 0xaf9791e3
mov dword [esp + 0xe8], 0xabf5ad8c
mov dword [esp + 0xec], 0xa728a9d0
mov dword [esp + 0xf0], 0xa3d7a5d7
mov dword [esp + 0xf4], 0xbf8da1dd
mov dword [esp + 0xf8], 0xbb8bbd8d
mov dword [esp + 0xfc], 0xb784b9f1
mov dword [esp + 0x100], 0xb380b584
mov dword [esp + 0x104], 0xcffcb180
mov dword [esp + 0x108], 0xcbeacdfc
mov dword [esp + 0x10c], 0xc7a7c9a7
mov dword [esp + 0x110], 0xc3a3c5be
mov dword [esp + 0x114], 0xdfa7c14e
mov dword [esp + 0x118], 0xdb97ddef
mov dword [esp + 0x11c], 0xd79dd997
mov dword [esp + 0x120], 0xd39dd5e6
mov dword [esp + 0x124], 0xefeed19a
mov word [esp + 0x128], 0
mov ebx, dword [ebp + 8]
mov eax, dword [0x44abf0]
mov ecx, 0xbc47e482
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x43b81bc6]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 0x72
mov byte [esp + ecx + 0x43b81bc6], dl
movzx edx, byte [esp + ecx + 0x43b81bc7]
lea esi, [ecx + 1]
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
inc edx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 0x72
mov byte [esp + ecx + 0x43b81bc7], dl
add ecx, 2
cmp ecx, 0xbc47e564
jne 0x40c440
lea ecx, [esp + 0x48]
push 0
push 0
push 0
push 0
push ecx
call eax
xor ecx, ecx
test eax, eax
setne cl
xor edi, edi
xor esi, esi
jmp dword [ecx*4 + 0x445064]
Function at 0x40ece0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x168
mov word [esp + 0x18], 0x56b
mov dword [esp + 0x1e], 0
mov dword [esp + 0x1a], 0
mov dword [esp + 0x88], 0x38a3d1ea
mov eax, dword [esp + 0x88]
add al, 0x79
mov byte [esp + 0x18], al
movzx eax, byte [esp + 0x19]
lea ecx, [eax + eax]
and ecx, 0x104
neg ecx
add eax, ecx
add eax, 0x38a3d182
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x88]
add al, 0x79
mov byte [esp + 0x19], al
movzx eax, byte [esp + 0x1a]
lea ecx, [eax + eax]
and ecx, 0x106
neg ecx
add eax, ecx
add eax, 0x38a3d183
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x88]
add al, 0x79
mov byte [esp + 0x1a], al
movzx eax, byte [esp + 0x1b]
lea ecx, [eax + eax]
and ecx, 0x108
neg ecx
add eax, ecx
add eax, 0x38a3d184
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x88]
add al, 0x79
mov byte [esp + 0x1b], al
movzx eax, byte [esp + 0x1c]
lea ecx, [eax + eax]
and ecx, 0x10a
neg ecx
add eax, ecx
add eax, 0x38a3d185
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x88]
add al, 0x79
mov byte [esp + 0x1c], al
movzx eax, byte [esp + 0x1d]
lea ecx, [eax + eax]
and ecx, 0x10c
neg ecx
add eax, ecx
add eax, 0x38a3d186
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x88]
add al, 0x79
mov byte [esp + 0x1d], al
movzx eax, byte [esp + 0x1e]
lea ecx, [eax + eax]
and ecx, 0x10e
neg ecx
add eax, ecx
add eax, 0x38a3d187
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x88]
add al, 0x79
mov byte [esp + 0x1e], al
movzx eax, byte [esp + 0x1f]
lea ecx, [eax + eax]
and ecx, 0x110
neg ecx
add eax, ecx
add eax, 0x38a3d188
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x88]
add al, 0x79
mov byte [esp + 0x1f], al
movzx eax, byte [esp + 0x20]
lea ecx, [eax + eax]
and ecx, 0x112
neg ecx
add eax, ecx
add eax, 0x38a3d189
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x88]
add al, 0x79
mov byte [esp + 0x20], al
movzx eax, byte [esp + 0x21]
lea ecx, [eax + eax]
and ecx, 0x114
neg ecx
add eax, ecx
add eax, 0x38a3d18a
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x88]
add al, 0x79
mov byte [esp + 0x21], al
lea ecx, [esp + 0x18]
push ecx
push dword [ebp + 8]
call fcn.004028d0
add esp, 8
mov esi, eax
xor ecx, ecx
test eax, eax
sete cl
xor edi, edi
xor eax, eax
mov dword [esp + 0x148], esi
jmp dword [ecx*4 + 0x445a28]
Function at 0x416f10
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x416f30
sar esi, 1
lea edi, [esp + 0x74]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x44bf34]
mov ebx, dword [esp + 0x74]
test ebx, ebx
jns 0x416f5f
mov eax, 0xffffffff
jmp 0x416f62
lea eax, [ebx + ebx]
push eax
call fcn.00408d80
add esp, 4
push edi
push ebx
mov dword [esp + 0x44], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x44bf34]
mov dword [esp + 8], 0x13c411f2
mov dword [esp + 0xc], 0x1fe11df1
mov dword [esp + 0x10], 0x1b3819e2
mov dword [esp + 0x14], 0x27cb25c4
mov dword [esp + 0x18], 0x23dd21d4
mov dword [esp + 0x1c], 0x2fdd2dc9
mov dword [esp + 0x20], 0x2b2829d8
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov byte [esp + 0x2c], 0
mov ecx, 0x657b2053
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x657b204b]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov dword [esp + 0x90], edx
mov edx, dword [esp + 0x90]
add dl, 0xbb
mov byte [esp + ecx - 0x657b204b], dl
cmp ecx, 0x657b2077
je 0x417043
movzx edx, byte [esp + ecx - 0x657b204a]
lea esi, [ecx + 1]
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
inc edx
mov dword [esp + 0x90], edx
mov edx, dword [esp + 0x90]
add dl, 0xbb
mov byte [esp + ecx - 0x657b204a], dl
add ecx, 2
jmp 0x416fe0
lea edi, [esp + 0xb8]
lea edx, [esp + 8]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xd4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x74]
mov ecx, eax
and ecx, 0xe
xor eax, 0xe
lea edx, [eax + ecx*2]
dec edx
test edx, edx
jns 0x417082
mov eax, 0xffffffff
jmp 0x41708a
lea eax, [eax + ecx*2]
add eax, eax
add eax, 0xfffffffe
push eax
call fcn.00408d80
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x3c]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x4170c1
mov eax, dword [esp + 0x3c]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4170b0
mov word [eax], 0
movzx ecx, word [esp + 0xb8]
test cx, cx
je 0x4170f1
lea edx, [esp + 0xba]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4170e0
mov word [eax], 0
lea eax, [esp + 0x5c]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043ec30
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446240]

Function at 0x418080
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe0
xor eax, eax
cmp dword [ebp + 0x10], 0
setne al
xor esi, esi
xor edx, edx
xor ecx, ecx
jmp dword [eax*4 + 0x446340]
Function at 0x422b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x468
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x60], 0x23ac21ab
mov dword [esp + 0x64], 0x1fbf1dbd
mov dword [esp + 0x68], 0x1bce1989
mov dword [esp + 0x6c], 0x179c1585
mov dword [esp + 0x70], 0x13101189
mov dword [esp + 0x78], 0
mov dword [esp + 0x74], 0
mov eax, 0x72a575dc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x72a5757c]
lea edx, [eax - 1]
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
dec ecx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 8]
add cl, 3
mov byte [esp + eax - 0x72a5757c], cl
movzx ecx, byte [esp + eax - 0x72a5757b]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov dword [esp + 8], ecx
mov ecx, dword [esp + 8]
add cl, 3
mov byte [esp + eax - 0x72a5757b], cl
add eax, 2
cmp eax, 0x72a575f8
jne 0x422b90
lea edi, [esp + 0x60]
lea ecx, [esp + 0x40]
push edi
call fcn.0043a1c0
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x447850]
Function at 0x42f290
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
call fcn.00409520
push eax
mov ecx, esp
push eax
mov eax, esp
push eax
mov ebx, esp
push eax
mov dword [esi + 0xc], esp
push eax
mov dword [esi + 8], esp
push eax
mov dword [esi + 0x24], esp
sub esp, 0x18
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
mov dword [esi + 0x20], esp
mov dword [esi + 0x28], ecx
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov dword [esi + 0x10], eax
mov byte [eax], 0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
test al, 1
jne 0x42f2f5
jmp 0x42f45a
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebx], eax
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, dword [esi + 0xc]
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x42f44e
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi + 8]
mov dword [ecx], eax
mov eax, ecx
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00408fb0
add esp, 4
mov ecx, dword [esi + 0x24]
mov dword [ecx], eax
jmp 0x42f35b
mov eax, dword [ecx]
jmp 0x42f35f
jmp 0x42f361
cmp eax, 0
setne al
test al, 1
jne 0x42f370
jmp 0x42f43e
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
mov eax, dword [ecx]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x20]
mov al, byte [eax]
mov byte [esi + 4], al
mov byte [edi], 0x5b
mov byte [edi + 1], 0x35
mov byte [edi + 2], 0x3b
mov byte [edi + 3], 0x33
mov byte [edi + 4], 0x20
mov byte [edi + 5], 0x2c
mov byte [edi + 6], 0x3f
mov byte [edi + 7], 0x2d
mov byte [edi + 8], 0x22
mov byte [edi + 9], 0x6f
mov byte [edi + 0xa], 0x14
mov byte [edi + 0xb], 0x13
mov byte [edi + 0xc], 0x16
mov byte [edi + 0xd], 0x95
mov eax, edi
add eax, 0xe
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 7
call fcn.00408f10
add esp, 0xc
xor eax, eax
movzx ecx, byte [edi + eax]
mov edx, eax
add edx, 0x6f4b9feb
lea ebx, [eax + ecx + 0x6f4b9feb]
and edx, ecx
add edx, edx
sub ebx, edx
mov dword [esi + 0x2c], ebx
mov ecx, dword [esi + 0x2c]
add cl, 0x93
mov byte [edi + eax], cl
add eax, 1
cmp eax, 0x15
jne 0x42f3eb
sub esp, 0xc
mov ecx, dword [esi + 0x14]
mov dword [esp], edi
mov eax, dword [esi + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x1c]
mov dword [esp + 8], eax
call fcn.00409730
and al, 1
mov ecx, dword [esi + 0x10]
mov byte [ecx], al
mov ebx, dword [esi + 0xc]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x42f44e
jmp 0x42f450
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42f458
jmp 0x42f45a
mov eax, dword [esi + 0x10]
mov al, byte [eax]
jmp 0x42f461
jmp 0x42f463
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4366c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov edx, 0xfffffffe
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x4366d0
test edx, edx
je 0x43674a
sar edx, 1
lea esi, [edx - 1]
mov edi, edx
and edi, 3
je 0x436702
nop
nop
nop
nop
nop
dec edx
movzx ebx, word [ecx]
add ecx, 2
xor ebx, eax
imul eax, ebx, 0x1000193
dec edi
jne 0x4366f0
cmp esi, 3
jb 0x43674a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 4]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 6]
xor edi, eax
imul eax, edi, 0x1000193
add esi, 4
cmp edx, esi
jne 0x436710
pop esi
pop edi
pop ebx
ret
Function at 0x43ddb0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov edx, dword [ebp + 8]
push eax
mov eax, esp
push eax
mov ecx, esp
sub esp, 8
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
mov dword [esi + 8], esp
sub esp, 0x10
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
mov dword [esi + 4], eax
mov dword [eax], edx
mov dword [esi + 0xc], ecx
mov dword [ecx], edx
movzx edx, word [edx]
mov dword [ebx], 0x3b38e3f9
mov dword [ebx + 4], 0
mov dword [esi], 0x3e05d92e
mov eax, dword [esi]
add al, 0x1f
mov byte [ebx], al
movzx eax, byte [ebx + 1]
lea ecx, [eax + eax]
and ecx, 0xffffffb0
neg ecx
add eax, ecx
add eax, 0x3e05d9d8
mov dword [esi], eax
mov eax, dword [esi]
add al, 0x1f
mov byte [ebx + 1], al
movzx eax, byte [ebx + 2]
lea ecx, [eax + eax]
and ecx, 0xffffffb2
neg ecx
add eax, ecx
add eax, 0x3e05d9d9
mov dword [esi], eax
mov eax, dword [esi]
add al, 0x1f
mov byte [ebx + 2], al
movzx eax, byte [ebx + 3]
lea ecx, [eax + eax]
and ecx, 0xffffffb4
neg ecx
add eax, ecx
add eax, 0x3e05d9da
mov dword [esi], eax
mov eax, dword [esi]
add al, 0x1f
mov byte [ebx + 3], al
movzx eax, byte [ebx + 4]
lea ecx, [eax + eax]
and ecx, 0xffffffb6
neg ecx
add eax, ecx
add eax, 0x3e05d9db
mov dword [esi], eax
mov eax, dword [esi]
add al, 0x1f
mov byte [ebx + 4], al
movzx eax, byte [ebx + 5]
lea ecx, [eax + eax]
and ecx, 0xffffffb8
neg ecx
add eax, ecx
add eax, 0x3e05d9dc
mov dword [esi], eax
mov eax, dword [esi]
add al, 0x1f
mov byte [ebx + 5], al
movzx eax, byte [ebx + 6]
lea ecx, [eax + eax]
and ecx, 0xffffffba
neg ecx
add eax, ecx
add eax, 0x3e05d9dd
mov dword [esi], eax
mov eax, dword [esi]
add al, 0x1f
mov byte [ebx + 6], al
movzx eax, byte [ebx + 7]
lea ecx, [eax + eax]
and ecx, 0xffffffbc
neg ecx
add eax, ecx
add eax, 0x3e05d9de
mov dword [esi], eax
mov eax, dword [esi]
xor eax, eax
cmp dword [ebx], edx
setne al
jmp dword [eax*4 + 0x44a980]
Function at 0x43ec30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + edi + 2], 0
lea edi, [edi + 2]
jne 0x43ec50
sar edi, 1
lea ebx, [edi + 4]
mov ecx, edi
and ecx, 1
mov eax, ebx
or eax, 1
add eax, ecx
jns 0x43ec75
mov eax, 0xffffffff
jmp 0x43ec77
add eax, eax
push eax
call fcn.00408d80
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ecx, word [esi]
test cx, cx
je 0x43ecc1
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], cx
add edx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x43ecb0
mov word [edx], 0
mov edx, ebx
and edx, 0xfffd
and edi, 2
mov ecx, edi
xor ecx, 2
imul ecx, edx
or ebx, 2
imul ebx, edi
lea edx, [ebx + ecx]
mov word [esp + 0x1c], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0x1e], cx
mov esi, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 8], 0x88898e8f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x13], 0
mov eax, 0xcc57fbea
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x33a8041e]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x9a
mov byte [esp + eax + 0x33a8041e], cl
cmp eax, 0xcc57fbf8
je 0x43eda6
movzx ecx, byte [esp + eax + 0x33a8041f]
lea edx, [eax + 1]
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
inc ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x9a
mov byte [esp + eax + 0x33a8041f], cl
add eax, 2
jmp 0x43ed50
mov edi, dword [esp + 8]
mov eax, dword [0x44bf38]
test eax, eax
je 0x43ee01
xor ecx, ecx
mov edx, dword [0x44bf3c]
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xcd669f2f
je 0x43edd0
inc ecx
cmp eax, ecx
jne 0x43edc0
jmp 0x43ee01
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43ee01
lea ecx, [esp + 8]
lea edx, [esp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x44bf40]
push eax
call fcn.0043bff0
add esp, 0x24
mov edi, eax
push esi
call fcn.00408d90
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ee20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + edi + 2], 0
lea edi, [edi + 2]
jne 0x43ee40
sar edi, 1
lea ebx, [edi + 4]
mov ecx, edi
and ecx, 1
mov eax, ebx
or eax, 1
add eax, ecx
jns 0x43ee65
mov eax, 0xffffffff
jmp 0x43ee67
add eax, eax
push eax
call fcn.00408d80
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ecx, word [esi]
test cx, cx
je 0x43eeb1
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], cx
add edx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x43eea0
mov word [edx], 0
mov edx, ebx
and edx, 0xfffd
and edi, 2
mov ecx, edi
xor ecx, 2
imul ecx, edx
or ebx, 2
imul ebx, edi
lea edx, [ebx + ecx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov esi, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x88898e8f
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x33], 0
mov eax, 0xcc57fbea
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x33a8043e]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x9a
mov byte [esp + eax + 0x33a8043e], cl
cmp eax, 0xcc57fbf8
je 0x43ef96
movzx ecx, byte [esp + eax + 0x33a8043f]
lea edx, [eax + 1]
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
inc ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x9a
mov byte [esp + eax + 0x33a8043f], cl
add eax, 2
jmp 0x43ef40
mov edi, dword [esp + 0x28]
mov eax, dword [0x44bf38]
test eax, eax
je 0x43efe5
xor ecx, ecx
mov edx, dword [0x44bf3c]
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xdcc9f508
je 0x43efc0
inc ecx
cmp eax, ecx
jne 0x43efb0
jmp 0x43efe5
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43efe5
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push ecx
push edx
push 2
push dword [0x44bf40]
push eax
call fcn.0043bff0
add esp, 0x14
mov edi, eax
push esi
call fcn.00408d90
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43effb
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret