joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408ad0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x408b54
xor eax, eax
mov edx, SysReAllocString
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edi, [eax + 0x270]
mov ebx, edi
not ebx
and ebx, 0x270
mov esi, edi
and esi, 0x58f
sub esi, ebx
mov ebp, dword [ecx + esi*4 + 4]
and ebp, edx
and edi, 1
mov ebx, esi
or ebx, 1
add ebx, edi
mov ebx, dword [ecx + ebx*4 + 4]
mov edi, ebx
and edi, 0x7ffffffe
or edi, ebp
shr edi, 1
and ebx, 1
neg ebx
and ebx, 0x9908b0df
xor edi, dword [ecx + esi*4 + 0x638]
xor edi, ebx
mov dword [ecx + eax*4 + 0x9c4], edi
inc eax
cmp eax, 0x270
jne 0x408af0
mov eax, 0x270
jmp 0x408b66
cmp eax, 0x4e0
jb 0x408b66
mov esi, ecx
call fcn.00408bb0
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x408bb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
xor eax, eax
mov edx, SysReAllocString
jmp 0x408bff
mov ebp, dword [ecx + eax*4 + 0x9c4]
and ebp, edx
or edi, ebp
shr edi, 1
xor edi, ebx
mov ebx, dword [ecx + eax*4 + 0xff8]
mov ebp, edi
xor edi, 0xcc100de0
or edi, ebx
not ebx
xor ebp, 0x33eff21f
or ebp, ebx
and edi, ebp
not edi
mov dword [ecx + eax*4 + 4], edi
xor eax, 1
lea eax, [eax + esi*2]
cmp eax, 0xe3
jae 0x408c31
lea edi, [eax + 0x270]
mov esi, eax
and esi, 1
or edi, 1
add edi, esi
mov ebp, dword [ecx + edi*4 + 4]
mov edi, ebp
and edi, 0x7fffffff
xor ebp, 0x7ffffffe
mov ebx, 0x33eff21f
test ebp, edi
je 0x408bc0
mov ebx, 0xaae742c0
jmp 0x408bc0
mov esi, dword [ecx + 0xd50]
mov eax, 0x355
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4]
lea ebx, [edi - 0x80000000]
mov edx, edi
or edx, 0x7ffffffe
and edx, ebx
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 - 0xd50]
xor edi, edx
mov dword [ecx + eax*4 - 0x9c4], edi
inc eax
cmp eax, 0x4e1
jne 0x408c40
mov eax, SysReAllocString
and eax, dword [ecx + 0x1380]
mov esi, dword [ecx + 4]
lea edx, [esi - 0x80000000]
or esi, 0x7fffffff
and esi, edx
or eax, esi
mov edx, eax
shr edx, 1
xor eax, 0xfffffffe
and eax, esi
je 0x408cb0
mov eax, 0x9908b0df
xor edx, dword [ecx + 0x634]
xor edx, eax
mov dword [ecx + 0x9c0], edx
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408e30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx ecx, word [esi]
lea ebp, [esp + 4]
test cx, cx
je 0x408f6a
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x408e80
lea ecx, [ebp + 1]
mov byte [ebp], bl
jmp 0x408f10
cmp ebx, 0x7ff
ja 0x408eb0
cmp edx, 2
jb 0x408eb0
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea ecx, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x408f10
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x408f2a
cmp edx, 4
jb 0x408f2a
movzx ecx, word [esi + 2]
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
mov edi, ebx
xor edi, 0xc0
or ebx, 0x3f
and ebx, edi
add bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 3], cl
lea ecx, [ebp + 4]
add esi, 4
mov edi, esi
add edx, ebp
sub edx, ecx
mov esi, edi
mov ebp, ecx
movzx ecx, word [esi]
test cx, cx
je 0x408f6a
test edx, edx
jne 0x408e60
jmp 0x408f6a
movzx eax, ax
cmp eax, 0xdc00
jne 0x408f38
mov esi, edi
jmp 0x408f18
cmp edx, 3
jb 0x408f66
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
mov eax, ebx
not eax
or eax, 0x3f
add eax, ebx
add al, 0x81
lea ecx, [ebp + 3]
mov byte [ebp + 2], al
jmp 0x408f10
mov ecx, ebp
jmp 0x408f10
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ebp], 0
xor eax, eax
jmp 0x408f88
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x408f80
test ecx, ecx
je 0x408f9c
mov ebx, ecx
jmp 0x408f80
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00404c20
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x408fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
movzx eax, word [esi]
test ax, ax
je 0x40911b
mov edx, dword [esp + 0x18]
dec edx
je 0x40911b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x409030
lea eax, [ecx + 1]
mov byte [ecx], bl
jmp 0x4090c0
cmp ebx, 0x7ff
ja 0x409060
cmp edx, 2
jb 0x409060
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ecx], al
and bl, 0x3f
or bl, 0x80
lea eax, [ecx + 2]
mov byte [ecx + 1], bl
jmp 0x4090c0
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x4090da
cmp edx, 4
jb 0x4090da
movzx ebp, word [esi + 2]
shl ebx, 0xa
lea eax, [ebx + ebp]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
mov edi, ebx
xor edi, 0xc0
or ebx, 0x3f
and ebx, edi
add bl, 0x80
mov byte [ecx + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ecx + 2], al
mov eax, ebp
and al, 0x3f
or al, 0x80
mov byte [ecx + 3], al
lea eax, [ecx + 4]
add esi, 4
mov edi, esi
nop
add edx, ecx
sub edx, eax
mov esi, edi
mov ecx, eax
movzx eax, word [esi]
test ax, ax
je 0x40911b
test edx, edx
jne 0x409010
jmp 0x40911b
movzx eax, ax
cmp eax, 0xdc00
jne 0x4090e8
mov esi, edi
jmp 0x4090c8
cmp edx, 3
jb 0x409117
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ecx], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ecx + 1], al
mov eax, ebx
not eax
or eax, 0x3f
add eax, ebx
add al, 0x81
mov ebx, eax
lea eax, [ecx + 3]
mov byte [ecx + 2], bl
jmp 0x4090c0
mov eax, ecx
jmp 0x4090c0
mov byte [ecx], 0
mov edx, ecx
not edx
mov eax, dword [esp + 0x14]
and edx, eax
not eax
and eax, ecx
sub eax, edx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409e70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x224
push eax
sub esp, 0x7c
mov ebx, esp
mov eax, dword [0x444e5c]
mov dword [ebp - 0x230], 0xab00a30f
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [ebp + ecx*2 - 0x230]
lea edi, [ecx + 0x5f565eb7]
mov edx, 0xa148
sub edx, ecx
xor edx, edi
and edx, esi
xor edx, edi
add edx, 0x54d0a47
mov esi, edx
xor esi, 0xcc37
and edx, 0x33c8
add edx, edx
sub edx, esi
add edx, 0xffffcc38
mov word [ebp + ecx*2 - 0x230], dx
lea ecx, [ecx + ecx*2]
xor ecx, 1
cmp ecx, 2
jb 0x409ea0
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 0x1b0], 0x11401145
mov dword [ebp - 0x1ac], 0x11aa1186
mov dword [ebp - 0x1a8], 0x11851185
mov dword [ebp - 0x1a4], 0x11bd11f6
mov dword [ebp - 0x1a0], 0x11b711b6
mov word [ebp - 0x19c], 0x11dc
xor edx, edx
nop
mov esi, 0x127d
sub esi, edx
xor si, word [ebp + edx*2 - 0x1b0]
xor esi, 0x7dbf
add esi, 0xffff81f0
mov word [ebp + edx*2 - 0x1b0], si
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
cmp edx, 0xb
jb 0x409f30
lea edi, [ebp - 0x1b0]
push ecx
push 0
push edi
call eax
mov ecx, 0x444e60
push eax
call fcn.00438460
movzx eax, al
mov eax, dword [eax*4 + 0x43f33c]
mov ecx, 0xa6b87a83
xor ecx, dword [0x43f344]
add eax, ecx
inc eax
jmp eax
Function at 0x40aab0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
movzx ebx, byte [ecx]
test bl, bl
je 0x40ad09
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40aaec
cmp ecx, esi
jae 0x40ad09
test edi, edi
je 0x40ad09
movzx ebp, bl
test bl, bl
js 0x40ab20
inc ecx
lea eax, [edx + 2]
mov word [edx], bp
mov esi, eax
sub esi, edx
sar esi, 1
sub edi, esi
mov edx, eax
mov esi, dword [esp + 0x28]
mov bh, byte [ecx]
mov bl, bh
test bh, bh
jne 0x40aae0
jmp 0x40ad09
mov eax, ebp
and eax, 0xffffffe0
cmp eax, 0xc0
jne 0x40ab5a
cmp bl, 0xc2
jb 0x40ab10
mov bh, byte [ecx + 1]
movzx esi, bh
mov eax, esi
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x40abc7
and ebp, 0x1f
shl ebp, 6
add ecx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40ac10
mov eax, ebp
and eax, 0xfffffff0
cmp eax, 0xe0
jne 0x40ab83
movzx eax, byte [ecx + 1]
cmp bl, 0xed
je 0x40abd1
cmp ebp, 0xe0
jne 0x40abd9
mov ebx, eax
add bl, 0x40
cmp bl, 0xe0
jb 0x40ab0c
jmp 0x40abd9
mov eax, ebp
and eax, 0xfffffff8
cmp eax, 0xf0
jne 0x40acec
cmp bl, 0xf4
ja 0x40ab10
movzx eax, byte [ecx + 1]
mov dword [esp], eax
je 0x40ac2d
cmp ebp, 0xf0
jne 0x40ac35
mov eax, dword [esp]
add al, 0x40
cmp al, 0xd0
mov eax, dword [esp]
jb 0x40ab10
jmp 0x40ac35
inc ecx
mov esi, dword [esp + 0x28]
jmp 0x40ab12
cmp al, 0x9f
ja 0x40ab0c
mov esi, eax
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ac1b
mov bh, byte [ecx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ac21
shl ebp, 0xc
and eax, 0x3f
shl eax, 6
or eax, ebp
mov esi, dword [esp]
and esi, 0x3f
or esi, eax
add ecx, 3
lea eax, [edx + 2]
mov word [edx], si
jmp 0x40ab02
inc ecx
jmp 0x40ab0c
add ecx, 2
mov esi, dword [esp + 0x28]
jmp 0x40ab12
cmp al, 0x8f
ja 0x40ab10
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x40acf3
mov bh, byte [ecx + 2]
movzx ebp, bh
mov eax, ebp
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x40acf9
mov bh, byte [ecx + 3]
movzx eax, bh
mov dword [esp + 4], eax
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x40ad01
and bl, 7
movzx eax, bl
shl eax, 0x12
mov ebx, dword [esp]
and ebx, 0x3f
shl ebx, 0xc
or ebx, eax
and ebp, 0x3f
shl ebp, 6
or ebp, ebx
add ecx, 4
mov eax, ebp
and eax, 0x1ff800
cmp eax, 0xd800
je 0x40ab10
mov ebx, dword [esp + 4]
and ebx, 0x3f
or ebx, ebp
cmp ebx, 0x10000
jb 0x40ab10
cmp edi, 2
jb 0x40acec
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [edx], bp
and ebx, 0x3ff
or ebx, 0xdc00
lea eax, [edx + 4]
mov word [edx + 2], bx
jmp 0x40ab02
mov eax, edx
jmp 0x40ab02
inc ecx
jmp 0x40ab10
add ecx, 2
jmp 0x40ab12
add ecx, 3
jmp 0x40ab12
mov word [edx], 0
mov ecx, edx
mov eax, dword [esp + 0x1c]
xor ecx, eax
not eax
and eax, edx
add eax, eax
sub eax, ecx
sar eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40baf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov edi, dword [esp + 0x44c]
mov dword [esp + 0x38], 0x14bd149c
mov dword [esp + 0x3c], 0x14bd14c9
mov dword [esp + 0x40], 0x14ba14b9
mov dword [esp + 0x44], 0x146714a6
mov dword [esp + 0x48], 0x1464146c
mov dword [esp + 0x4c], 0x147c146b
mov dword [esp + 0x50], 0x14891465
mov dword [esp + 0x54], 0x14ae14a6
mov dword [esp + 0x58], 0x14ad14b5
mov dword [esp + 0x5c], 0x14a714a4
mov dword [esp + 0x60], 0x14881475
mov dword [esp + 0x64], 0x14481483
mov dword [esp + 0x68], 0x145a1458
mov dword [esp + 0x6c], 0x145c1455
mov dword [esp + 0x70], 0x144e14a6
mov dword [esp + 0x74], 0x149914b8
mov dword [esp + 0x78], 0x1454149f
mov dword [esp + 0x7c], 0x14af1457
mov dword [esp + 0x80], 0x14ee1445
mov dword [esp + 0x84], 0x144c1451
mov dword [esp + 0x88], 0x145a1440
mov dword [esp + 0x8c], 0x148c14ba
mov dword [esp + 0x90], 0x1482148d
mov dword [esp + 0x94], 0x14a7149a
mov dword [esp + 0x98], 0x14901494
mov dword [esp + 0x9c], 0x148d14a8
mov dword [esp + 0xa0], 0x14491481
mov dword [esp + 0xa4], 0x143b1442
mov dword [esp + 0xa8], 0x1434143e
mov dword [esp + 0xac], 0x143a1438
mov dword [esp + 0xb0], 0x1436142d
mov dword [esp + 0xb4], 0x14d814d4
mov dword [esp + 0xb8], 0x14df14d5
mov dword [esp + 0xbc], 0x143814df
mov dword [esp + 0xc0], 0x14fa1425
mov dword [esp + 0xc4], 0x14e314fe
mov dword [esp + 0xc8], 0x143a14fc
mov dword [esp + 0xcc], 0x14f914dc
mov dword [esp + 0xd0], 0x14e514fe
mov dword [esp + 0xd4], 0x142914e0
mov dword [esp + 0xd8], 0x14d11431
mov dword [esp + 0xdc], 0x14e614eb
mov dword [esp + 0xe0], 0x14eb14ea
mov dword [esp + 0xe4], 0x141714f2
mov dword [esp + 0xe8], 0x141b1418
mov dword [esp + 0xec], 0x141214e2
mov dword [esp + 0xf0], 0x1410141d
mov dword [esp + 0xf4], 0x141e141f
mov dword [esp + 0xf8], 0x14021411
mov dword [esp + 0xfc], 0x14c514f0
mov dword [esp + 0x100], 0x14c714c3
mov dword [esp + 0x104], 0x14c114d5
mov dword [esp + 0x108], 0x140f1406
mov dword [esp + 0x10c], 0x140b1408
mov dword [esp + 0x110], 0x140d1403
mov dword [esp + 0x114], 0x14301409
mov eax, dword [0x444e2c]
lea ecx, [esp + 0x38]
mov edx, 0x36994bf6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx]
mov esi, edx
or esi, ebx
lea ebp, [edx - 0x36990000]
and ebp, ebx
not esi
or esi, ebp
add esi, 0x59cc3729
mov ebx, esi
xor ebx, 0xd772
and esi, 0x288d
add esi, esi
sub esi, ebx
inc esi
mov word [ecx], si
add ecx, 2
dec edx
cmp edx, 0x36994b86
jne 0x40bd50
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
xor edx, edx
test eax, eax
setne dl
mov ecx, 0x11b74926
xor ecx, dword [0x43f68c]
mov edx, dword [edx*4 + 0x43f684]
add ecx, edx
inc ecx
xor ebx, ebx
xor ebp, ebp
jmp ecx
Function at 0x40c510
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x234
mov dword [esp + 0x34], 0x25d12530
mov dword [esp + 0x38], 0x25d925e5
mov dword [esp + 0x3c], 0x25de25dd
mov dword [esp + 0x40], 0x251b25c2
mov dword [esp + 0x44], 0x25182510
mov dword [esp + 0x48], 0x25182517
mov dword [esp + 0x4c], 0x252d2501
mov dword [esp + 0x50], 0x25c225c2
mov dword [esp + 0x54], 0x25c125d9
mov dword [esp + 0x58], 0x25c325c8
mov dword [esp + 0x5c], 0x252c2511
mov dword [esp + 0x60], 0x25142527
mov dword [esp + 0x64], 0x25062504
mov dword [esp + 0x68], 0x25382509
mov dword [esp + 0x6c], 0x252a2502
mov dword [esp + 0x70], 0x25f5251c
mov dword [esp + 0x74], 0x253825f3
mov dword [esp + 0x78], 0x250b253b
mov dword [esp + 0x7c], 0x25ca2521
mov dword [esp + 0x80], 0x25302535
mov dword [esp + 0x84], 0x2526253c
mov dword [esp + 0x88], 0x25e82506
mov dword [esp + 0x8c], 0x25e625e9
mov dword [esp + 0x90], 0x250b25fe
mov dword [esp + 0x94], 0x25fc25f8
mov dword [esp + 0x98], 0x25e92504
mov dword [esp + 0x9c], 0x252d25e5
mov dword [esp + 0xa0], 0x25272526
mov dword [esp + 0xa4], 0x25282522
mov dword [esp + 0xa8], 0x25de2524
mov dword [esp + 0xac], 0x25d225c9
mov dword [esp + 0xb0], 0x25f425f0
mov dword [esp + 0xb4], 0x25f325f9
mov dword [esp + 0xb8], 0x25dc25f3
mov dword [esp + 0xbc], 0x251e25c1
mov dword [esp + 0xc0], 0x251f251a
mov dword [esp + 0xc4], 0x25c62500
mov dword [esp + 0xc8], 0x251d25e0
mov dword [esp + 0xcc], 0x2501251a
mov dword [esp + 0xd0], 0x25c52504
mov dword [esp + 0xd4], 0x25fd25dd
mov dword [esp + 0xd8], 0x25022507
mov dword [esp + 0xdc], 0x250f250e
mov dword [esp + 0xe0], 0x25cb2516
mov dword [esp + 0xe4], 0x25c725c4
mov dword [esp + 0xe8], 0x25f625fe
mov dword [esp + 0xec], 0x25f425f9
mov dword [esp + 0xf0], 0x25f225fb
mov dword [esp + 0xf4], 0x25ee25fd
mov dword [esp + 0xf8], 0x252125dc
mov dword [esp + 0xfc], 0x25232527
mov dword [esp + 0x100], 0x253d2531
mov dword [esp + 0x104], 0x25f325fa
mov dword [esp + 0x108], 0x25ef25f4
mov dword [esp + 0x10c], 0x25e925e7
mov dword [esp + 0x110], 0x259c25ed
mov eax, dword [0x444e2c]
xor ecx, ecx
movzx edx, word [esp + ecx*2 + 0x34]
lea esi, [ecx - 0xabc20bb]
xor esi, edx
mov edx, esi
and edx, 0x5d7
xor esi, 0x5d7
lea edx, [esi + edx*2]
inc edx
mov word [esp + ecx*2 + 0x34], dx
mov edx, ecx
not edx
or edx, 1
add edx, ecx
or ecx, 1
add ecx, edx
inc ecx
cmp ecx, 0x70
jb 0x40c750
lea ecx, [esp + 0x34]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x43f850]
mov ecx, 0x4d79865d
xor ecx, dword [0x43f858]
add eax, ecx
inc eax
jmp eax
Function at 0x413720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
movzx eax, byte [esp + 0x20]
movzx ecx, byte [esp + 0x1c]
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [esi + 8], cl
mov byte [esi + 9], al
movzx edx, byte [ebx]
test dl, dl
je 0x4137b4
lea ecx, [ebx + 1]
xor eax, eax
jmp 0x413769
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x4137a8
test dl, dl
jns 0x413760
movsx edx, dl
mov ebp, edx
and ebp, 0xf0
cmp ebp, 0xe0
je 0x413760
mov ebp, edx
not ebp
or ebp, 0xe0
add ebp, edx
inc ebp
cmp ebp, 0xc0
je 0x413760
and edx, 0xf8
cmp edx, 0xf0
jne 0x413761
add eax, 2
jmp 0x413761
mov ebp, eax
inc ebp
jns 0x4137c0
mov eax, 0xffffffff
jmp 0x4137c7
mov eax, 2
mov ebp, 1
jmp 0x4137c7
lea eax, [eax*2 + 2]
push eax
call fcn.00408130
add esp, 4
mov dword [esi], eax
push 0
push ebx
push ebp
push eax
call fcn.0040aab0
add esp, 0x10
movzx edx, byte [edi]
test dl, dl
je 0x413838
lea ecx, [edi + 1]
xor eax, eax
jmp 0x4137f9
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x41383a
test dl, dl
jns 0x4137f0
movsx edx, dl
mov ebx, edx
and ebx, 0xf0
cmp ebx, 0xe0
je 0x4137f0
mov ebx, edx
not ebx
or ebx, 0xe0
add ebx, edx
inc ebx
cmp ebx, 0xc0
je 0x4137f0
and edx, 0xf8
cmp edx, 0xf0
jne 0x4137f1
add eax, 2
jmp 0x4137f1
xor eax, eax
mov ecx, eax
and ecx, 1
xor eax, 1
lea ebx, [eax + ecx*2]
test ebx, ebx
jns 0x413850
mov eax, 0xffffffff
jmp 0x413853
lea eax, [ebx + ebx]
push eax
call fcn.00408130
add esp, 4
mov dword [esi + 4], eax
push 0
push edi
push ebx
push eax
call fcn.0040aab0
add esp, 0x10
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x413a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
cmp word [edi + edx + 2], 0
lea edx, [edx + 2]
jne 0x413a60
mov esi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x413a80
sar edx, 1
mov ecx, eax
sar ecx, 1
and eax, 2
xor ecx, 1
mov dword [esp + 0x28], edx
add eax, edx
lea edx, [ecx + eax]
inc edx
test edx, edx
jns 0x413aac
mov eax, 0xffffffff
jmp 0x413ab5
add eax, ecx
lea eax, [eax*2 + 2]
push eax
call fcn.00408130
add esp, 4
movzx ecx, word [esi]
mov dword [esp + 8], eax
test cx, cx
je 0x413af1
add esi, 2
mov eax, dword [esp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x413ae0
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [edi]
test cx, cx
je 0x413b21
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413b10
mov word [eax], 0
lea eax, [esp + 0xc]
push 0x60
push 7
push 0x120089
push eax
push dword [esp + 0x18]
call fcn.0043aaa0
add esp, 0x14
mov dword [esp], eax
mov eax, dword [0x43fee0]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], eax
jmp eax
Function at 0x4140c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x428
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x4140e0
mov eax, ebx
sar eax, 1
mov ecx, ebx
and ecx, 0x1c
mov dword [esp + 0xe0], eax
xor eax, 0xe
add eax, ecx
jns 0x414109
mov eax, 0xffffffff
jmp 0x41410b
add eax, eax
push eax
call fcn.00408130
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x2a0], 0xe560e577
mov dword [esp + 0x2a4], 0xe58de57c
mov dword [esp + 0x2a8], 0xe530e58b
mov dword [esp + 0x2ac], 0xe577e567
mov dword [esp + 0x2b0], 0xe587e581
mov dword [esp + 0x2b4], 0xe589e58c
mov dword [esp + 0x2b8], 0xe508e589
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + eax*2 + 0x2a0]
lea esi, [eax + 0x7c838d03]
mov ecx, 0x72fc
sub ecx, eax
xor ecx, esi
and ecx, edx
xor ecx, esi
add ecx, 0x1be397e7
mov edx, ecx
xor edx, 0x1e03
and ecx, 0x61fc
add ecx, ecx
sub ecx, edx
add ecx, 0x1e04
mov word [esp + eax*2 + 0x2a0], cx
lea ecx, [eax + eax]
and ecx, 2
xor eax, 1
add eax, ecx
cmp eax, 0xe
jb 0x414170
movzx ecx, word [edi]
mov esi, dword [esp + 4]
mov eax, esi
test cx, cx
je 0x4141f1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4141e0
mov word [eax], 0
movzx ecx, word [esp + 0x2a0]
test cx, cx
je 0x414221
lea edx, [esp + 0x2a2]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414210
mov word [eax], 0
lea eax, [esp + 0x120]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043aaa0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4403b8]
Function at 0x419b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov dword [esp + 0x18], 0x68d26888
mov dword [esp + 0x1c], 0x68d568da
mov dword [esp + 0x20], 0x684c68d5
mov eax, 0x612f
mov ecx, 0x7f149ed0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + eax*2 - 0xc246]
lea edi, [eax - 0x7f150000]
mov ebx, ecx
and ebx, esi
mov edx, ecx
xor edx, esi
sub edx, ecx
add edx, ebx
mov ebx, ecx
and ebx, 0x7804020c
and edi, 0x634133
or edi, ebx
xor edi, esi
xor edi, 0x220c
and esi, eax
or esi, edi
not edx
and edx, esi
add edx, 0xfffff688
mov word [esp + eax*2 - 0xc246], dx
inc eax
dec ecx
cmp eax, 0x6135
jne 0x419b80
mov dword [esp + 0x44], 0xa207a2fa
mov dword [esp + 0x48], 0xa205a200
mov dword [esp + 0x4c], 0xa2b8a2cc
mov dword [esp + 0x50], 0xa2f5a2b7
mov dword [esp + 0x54], 0xa2f8a2f5
mov dword [esp + 0x58], 0xa2f1a2fd
mov dword [esp + 0x5c], 0xa2f0a2f6
mov dword [esp + 0x60], 0xa215a213
mov dword [esp + 0x64], 0xa283a2d8
mov eax, 0xf7521682
nop
nop
movzx ecx, word [esp + eax*2 + 0x115bd340]
xor ecx, eax
mov edx, ecx
not edx
add ecx, 0x4bef
and edx, 1
or ecx, 1
add ecx, edx
mov word [esp + eax*2 + 0x115bd340], cx
inc eax
cmp eax, 0xf7521694
jne 0x419c20
movzx ecx, word [esp + 0x44]
lea eax, [esp + 0x15c]
test cx, cx
je 0x419c83
lea edx, [esp + 0x46]
mov ebx, dword [ebp + 0x10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419c70
jmp 0x419c86
mov ebx, dword [ebp + 0x10]
mov word [eax], 0
movzx ecx, word [ebx]
test cx, cx
je 0x419cb1
lea edx, [ebx + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419ca0
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x419ce1
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419cd0
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
mov dword [esp + 0x44], 0x688557e8
mov word [esp + 0x48], 0xcce4
mov eax, 0x7772
nop
movzx ecx, word [esp + eax*2 - 0xeea0]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
add ecx, 0xc791626d
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
add ecx, 0xffffe202
mov word [esp + eax*2 - 0xeea0], cx
inc eax
cmp eax, 0x7775
jne 0x419d00
movzx eax, byte [esp + 0x44]
test al, al
je 0x419d5b
lea ecx, [esp + 0x45]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x419d50
mov edi, esi
mov byte [esi], 0
lea eax, [esp + 0x14c]
lea ecx, [esp + 0x150]
lea edx, [esp + 0x38]
lea esi, [esp + 0x15c]
push eax
push ecx
push edx
push esi
call fcn.0040b1d0
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x4406f8]
mov ecx, 0x8ece2365
xor ecx, dword [0x440700]
add eax, ecx
inc eax
jmp eax