joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4626b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46279f
sub esp, 0x54
mov eax, dword [0x715520]
mov dword [esp], eax
call fcn.0045c920
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 8
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
call fcn.0043ed10
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x46277b
xor eax, eax
mov ecx, eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], eax
add esp, 0x54
ret
mov dword [esp + 0x38], eax
lea eax, [0x6e6510]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040bf00
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
jmp 0x46276f
call fcn.0044a1d0
jmp fcn.004626b0

Function at 0x462c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x462d1c
sub esp, 0x4c
mov eax, dword [0x715574]
mov dword [esp], eax
call fcn.0045c920
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 9
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x28], eax
call fcn.0043ed10
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
cmp eax, 0xffffffff
jne 0x462d16
test ecx, ecx
je 0x462d08
cmp ecx, 0x3e5
jne 0x462ce4
mov eax, dword [0x711480]
mov ecx, dword [0x711484]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x4c
ret
mov dword [esp + 0x38], ecx
lea eax, [0x6e6510]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040bf00
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
jmp 0x462cd8
lea ecx, [0x624f90]
lea eax, [0x6e6510]
jmp 0x462cd8
xor ecx, ecx
mov eax, ecx
jmp 0x462cd8
call fcn.0044a1d0
jmp fcn.00462c10
Function at 0x4a85d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a8674
sub esp, 0xc
lea eax, [0x5c0bc0]
mov dword [esp], eax
call fcn.0040e440
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call fcn.004a8510
mov eax, dword [esp + 8]
xor ecx, ecx
jmp 0x4a8642
mov ebp, ebx
shl ebx, 0xa
lea esi, [eax + ebx]
mov dword [esi + ecx*4], edx
lea ebx, [ebp + 1]
cmp ebx, 8
jge 0x4a8641
mov ebp, edx
and edx, 0xff
mov edx, dword [eax + edx*4]
shr ebp, 8
xor edx, ebp
cmp ebx, 8
jb 0x4a8617
jmp 0x4a8666
inc ecx
cmp ecx, 0x100
jge 0x4a865e
test byte [eax], al
cmp ecx, 0x100
jae 0x4a866d
mov edx, dword [eax + ecx*4]
mov ebx, 1
jmp 0x4a8625
mov dword [esp + 0x14], eax
add esp, 0xc
ret
call fcn.00425900
ud2
call fcn.00425900
ud2
call fcn.0044a1d0
jmp fcn.004a85d0
Function at 0x4c72d0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c7378
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x4c733f
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
jmp 0x4c7329
call fcn.0044a1d0
jmp fcn.004c72d0
Function at 0x4eb510
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4eb72d
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x4eb5c7
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x4eb640
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x4eb5a8
cmp ecx, 0xf
jne 0x4eb6b9
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x4eb5a8
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x4eb5a8
call fcn.0044a1d0
jmp fcn.004eb510
Function at 0x53a370
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x53a52c
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x53a399
mov byte [esp + 0xc], 0
ret
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x53a393
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x53a393
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x53a51e
cmp al, 0x2c
ja 0x53a4fb
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x53a3cd
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x53a3c7
lea edx, [eax - 0x26]
cmp dl, 6
jbe 0x53a3c7
cmp al, 0x2f
ja 0x53a4c1
cmp al, 0x26
ja 0x53a499
cmp al, 0x24
jne 0x53a48e
cmp ecx, 2
jg 0x53a444
cmp ecx, 1
je 0x53a439
cmp ecx, 2
jne 0x53a433
cmp al, 0x2f
jne 0x53a413
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
jne 0x53a41f
mov eax, 1
jmp 0x53a40e
cmp al, 0x2c
jne 0x53a42b
mov eax, 1
jmp 0x53a40e
cmp al, 0x3f
sete al
jmp 0x53a40e
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x53a478
cmp al, 0x40
jne 0x53a458
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
jne 0x53a464
mov eax, 1
jmp 0x53a453
cmp al, 0x3f
jne 0x53a470
mov eax, 1
jmp 0x53a453
cmp al, 0x3a
sete al
jmp 0x53a453
cmp ecx, 6
je 0x53a488
cmp ecx, 7
jne 0x53a433
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x53a3f5
jmp 0x53a433
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x53a3f5
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x53a4b3
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x53a3f5
jmp 0x53a433
cmp al, 0x3d
ja 0x53a4e0
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x53a3f5
cmp al, 0x3d
je 0x53a3f5
jmp 0x53a433
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x53a3f5
cmp al, 0x5f
je 0x53a4ad
cmp al, 0x7e
je 0x53a4ad
jmp 0x53a433
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x53a3c7
cmp al, 0x5b
je 0x53a3c7
cmp al, 0x5d
je 0x53a3c7
jmp 0x53a3da
cmp ecx, 4
je 0x53a3b6
jmp 0x53a3da
call fcn.0044a1d0
jmp fcn.0053a370
Function at 0x56f3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56f545
sub esp, 0x74
mov eax, dword [esp + 0x78]
test eax, eax
je 0x56f53e
mov ecx, dword [eax]
lea eax, [0x5e8a40]
mov dword [esp], eax
mov dword [esp + 4], ecx
sar ecx, 0x1f
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.00406470
mov eax, dword [esp + 0x14]
mov dword [esp + 0x40], eax
lea edi, [esp + 0x44]
xor eax, eax
call fcn.0044bde4
lea eax, [0x5e8a40]
mov dword [esp], eax
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 8], ecx
call fcn.00407820
jmp 0x56f43f
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.00407c50
mov eax, dword [esp + 0x44]
test eax, eax
je 0x56f532
mov ecx, dword [esp + 0x48]
mov edx, dword [eax + 4]
mov dword [esp + 0x30], edx
mov ebx, dword [ecx + 8]
mov dword [esp + 0x2c], ebx
mov ebp, dword [ecx + 4]
mov dword [esp + 0x28], ebp
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
mov ecx, dword [ecx]
mov dword [esp + 0x38], ecx
lea esi, [0x5be160]
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
call fcn.00438580
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], edx
lea ebx, [0x5be160]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], ebp
call fcn.0040efb0
lea eax, [0x5e8a40]
mov dword [esp], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], edx
call fcn.0040a570
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [0x728500]
test ecx, ecx
jne 0x56f51d
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
jmp 0x56f433
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.0040ec50
jmp 0x56f433
mov eax, dword [esp + 0x40]
mov dword [esp + 0x7c], eax
add esp, 0x74
ret
xor ecx, ecx
jmp 0x56f3d7
call fcn.0044a1d0
jmp fcn.0056f3b0
Function at 0x56ff50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5700e5
sub esp, 0x74
mov eax, dword [esp + 0x78]
test eax, eax
je 0x5700de
mov ecx, dword [eax]
lea eax, [0x5e8a40]
mov dword [esp], eax
mov dword [esp + 4], ecx
sar ecx, 0x1f
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.00406470
mov eax, dword [esp + 0x14]
mov dword [esp + 0x40], eax
lea edi, [esp + 0x44]
xor eax, eax
call fcn.0044bde4
lea eax, [0x5e8a40]
mov dword [esp], eax
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 8], ecx
call fcn.00407820
jmp 0x56ffdf
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.00407c50
mov eax, dword [esp + 0x44]
test eax, eax
je 0x5700d2
mov ecx, dword [esp + 0x48]
mov edx, dword [eax + 4]
mov dword [esp + 0x30], edx
mov ebx, dword [ecx + 8]
mov dword [esp + 0x2c], ebx
mov ebp, dword [ecx + 4]
mov dword [esp + 0x28], ebp
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
mov ecx, dword [ecx]
mov dword [esp + 0x38], ecx
lea esi, [0x5be160]
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
call fcn.00438580
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], edx
lea ebx, [0x5be160]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], ebp
call fcn.0040efb0
lea eax, [0x5e8a40]
mov dword [esp], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], edx
call fcn.0040a570
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [0x728500]
test ecx, ecx
jne 0x5700bd
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
jmp 0x56ffd3
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.0040ec50
jmp 0x56ffd3
mov eax, dword [esp + 0x40]
mov dword [esp + 0x7c], eax
add esp, 0x74
ret
xor ecx, ecx
jmp 0x56ff77
call fcn.0044a1d0
jmp fcn.0056ff50
Function at 0x4010d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
xor ebx, ebx
push edi
xor edi, edi
lea esi, [ebx + 0x6f]
mov dword [ebp - 8], edi
mov dword [ebp - 4], 0x29f6
lea ebx, [ebx]
inc ebx
mov eax, 0x66666667
imul ebx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, ebx
lea eax, [eax + eax*4]
sub ecx, eax
jne 0x40110b
inc ebx
cmp ebx, 0x733d
jl 0x4010f0
mov eax, dword [ebp + 8]
test eax, eax
je 0x40120e
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x40120e
cmp eax, ecx
jae 0x40120e
mov esi, eax
sub ecx, esi
mov dword [ebp + 0xc], ecx
mov edi, 0x6a79
lea ecx, [ecx]
mov eax, 0x66666667
imul edi
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x401140
xor ebx, ebx
inc ebx
mov eax, 0x38e38e39
imul ebx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, ebx
lea eax, [eax + eax*8]
sub ecx, eax
jne 0x401170
inc ebx
cmp ebx, 0x5c1e
jl 0x401155
mov edi, 0x1074
lea ecx, [ecx]
mov eax, 0x66666667
imul edi
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x401180
mov edi, dword [ebp - 8]
inc edi
mov eax, 0x66666667
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*4]
add ecx, ecx
mov eax, edi
sub eax, ecx
jne 0x4011b4
inc edi
cmp edi, 0x14c4
jl 0x401196
mov edx, dword [ebp + 0xc]
xor ecx, ecx
test edx, edx
je 0x4011d3
mov al, byte [ecx + esi + 1]
add al, 0x2f
xor byte [ecx + esi], al
inc ecx
cmp ecx, edx
jb 0x4011c5
mov ecx, 0xbd4
mov edx, 0xa0
mov eax, 0xe6
cmp eax, 0xa0
cmovg eax, edx
dec ecx
jne 0x4011e2
lea ecx, [ecx]
mov eax, 0x43b3d5b
imul dword [ebp - 4]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 4], eax
jne 0x4011f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x1741
mov ecx, 0x7c
cmp esi, ecx
cmovg esi, ecx
dec eax
jne 0x401218
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
add eax, 0xa
push edi
mov ebx, 0x303a
mov ecx, 0x32c9
mov dword [ebp - 4], eax
mov esi, 0x69df
nop
mov eax, 0x2aaaaaab
imul esi
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x402ae0
mov eax, 0x8ca29c05
imul ebx
add edx, ebx
sar edx, 7
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x402af3
jmp 0x402b10
mov eax, 0xb60b60b7
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x402b10
mov eax, dword [ebp + 8]
mov edi, 0x4403
inc byte [eax + 2]
mov cl, byte [eax + 2]
mov eax, 0x4bda12f7
imul edi
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x402b33
mov edx, dword [ebp + 8]
movzx ebx, cl
add ebx, dword [ebp - 4]
movzx eax, byte [edx + 7]
movzx ecx, byte [ebx]
add ecx, eax
mov byte [edx + 7], cl
mov edi, 0x44fd
mov esi, 0x69cd
mov eax, 0x214d0215
imul esi
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x402b65
mov dl, byte [ebx]
movzx eax, cl
mov ecx, dword [ebp - 4]
add ecx, eax
mov byte [ebp + 0xb], dl
mov al, byte [ecx]
mov byte [ebx], al
mov byte [ecx], dl
mov esi, 0x5e9d
mov eax, 0xad602b59
imul edi
add edx, edi
sar edx, 7
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x402b90
mov al, byte [ebx]
add al, byte [ebp + 0xb]
mov ecx, dword [ebp - 4]
movzx eax, al
mov cl, byte [eax + ecx]
mov eax, 0x939a85c5
imul esi
add edx, esi
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x402bb3
movzx eax, cl
movzx ecx, byte [ebp + 0xc]
pop edi
pop esi
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4040f3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, 0x9c99b327
mov dword [ebp - 0x20], 0x3c361985
xor dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x52e556ab
xor dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x7b8187a3
xor dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x398413bc
xor dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x331842dd
xor dword [ebp - 0x10], eax
xor eax, eax
lea ebx, [ebx]
xor byte [ebp + eax - 0x20], 0x4c
inc eax
cmp eax, 0x14
jb 0x404143
mov ecx, dword [ebp + 8]
push 0x14
lea eax, [ebp - 0x20]
push eax
push ecx
call fcn.0042e073
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x404173
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, 0x6c487650
mov dword [ebp - 0x20], 0x39c2ead1
xor dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x95ce8af3
xor dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x2cede98
xor dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x2119cb5a
xor dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x17f3535d
xor dword [ebp - 0x10], eax
xor eax, eax
lea ebx, [ebx]
xor byte [ebp + eax - 0x20], 0x47
inc eax
cmp eax, 0x14
jb 0x4041c3
mov ecx, dword [ebp + 8]
push 0x14
lea eax, [ebp - 0x20]
push eax
push ecx
call fcn.0042e073
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x404373
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, 0x6d4b5f0c
mov dword [ebp - 0x20], 0x299a22c9
xor dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0xf0758885
xor dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x414e7a5d
xor dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x401feaa7
xor dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x9e3a5c5a
xor dword [ebp - 0x10], eax
xor eax, eax
lea ebx, [ebx]
xor byte [ebp + eax - 0x20], 0x8a
inc eax
cmp eax, 0x14
jb 0x4043c3
mov ecx, dword [ebp + 8]
push 0x14
lea eax, [ebp - 0x20]
push eax
push ecx
call fcn.0042e073
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x4044e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
xor eax, eax
lea ecx, [ebp - 0x18]
push ecx
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
call fcn.004040f3
mov cl, byte [ebp + 0xc]
add esp, 4
xor eax, eax
xor byte [ebp + eax - 0x18], cl
inc eax
cmp eax, 0x14
jb 0x404515
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp + 8]
push 4
push eax
call fcn.00417053
mov eax, dword [ebp + 8]
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x405033
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 0x18], 0
call fcn.00404173
add esp, 4
xor eax, eax
lea esp, [esp]
xor byte [ebp + eax - 0x18], bl
inc eax
cmp eax, 0x14
jb 0x405063
movzx edx, byte [ebp + 0xc]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
push edx
push eax
call fcn.00416133
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x40a403
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov byte [ebp - 0x18], 0xeb
mov byte [ebp - 0x17], 0x96
mov byte [ebp - 0x16], 0x99
mov byte [ebp - 0x15], 0x5a
mov byte [ebp - 0x14], 0x9f
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x1e
mov byte [ebp - 0x10], 0x44
mov byte [ebp - 0xf], 0xc5
mov byte [ebp - 0xe], 0x21
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 0xc], 0x48
mov byte [ebp - 0xb], 1
mov byte [ebp - 0xa], 0x9e
mov byte [ebp - 9], 0x4c
mov byte [ebp - 8], 0x1c
mov byte [ebp - 7], 0x7a
mov byte [ebp - 6], 0x28
mov byte [ebp - 5], 0xc6
xor eax, eax
mov byte [ebp - 4], al
mov dword [ebp - 0x1c], 0
jmp 0x40a470
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0x14
jae 0x40a48e
mov edx, dword [ebp - 0x1c]
movzx eax, byte [ebp + edx - 0x18]
movzx ecx, byte [ebp + 0xc]
xor eax, ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x1c]
mov byte [edx], al
jmp 0x40a467
mov esp, ebp
pop ebp
ret
Function at 0x40dcd3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 0x18
mov eax, edx
push ebx
mov ebx, dword [ebp + 0xc]
shr eax, 4
push esi
mov ecx, ebx
test eax, eax
je 0x40dd45
add ebx, 8
mov dword [ebp - 4], eax
nop
mov eax, dword [ecx]
xor dword [edi], eax
mov edx, dword [ebx - 4]
xor dword [edi + 4], edx
mov edx, dword [ebx]
xor dword [edi + 8], edx
mov edx, dword [ebx + 4]
xor dword [edi + 0xc], edx
add ecx, 0x10
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
add ebx, 0x10
call fcn.0040dc43
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 8]
add esp, 4
dec dword [ebp - 4]
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
jne 0x40dcf3
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
lea eax, [ebx + edx]
cmp eax, ecx
jbe 0x40ddb8
sub ebx, ecx
add ebx, edx
test ebx, ebx
jle 0x40dd62
push ebx
push ecx
lea ecx, [ebp - 0x18]
push ecx
call fcn.0042e0c3
add esp, 0xc
mov eax, 0x10
sub eax, ebx
lea ecx, [ebp + ebx - 0x18]
je 0x40dd7b
push eax
push 0
push ecx
call fcn.0042e0f3
add esp, 0xc
mov edx, dword [ebp - 0x18]
xor dword [edi], edx
mov ecx, dword [ebp - 0x14]
xor dword [edi + 4], ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor dword [edi + 8], edx
xor dword [edi + 0xc], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
call fcn.0040dc43
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [edi], edx
mov edx, dword [ebp - 0xc]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov dword [edi + 0xc], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret