joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408da0
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x214
call fcn.0043c870
test al, al
je 0x408fd3
lea eax, [esp + 0xc]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00435490
test al, al
je 0x408fce
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, 0x519b
mov edx, 0xb8e70f15
mov ecx, ebx
shrd edx, esi, cl
mov dword [esp], edx
shr esi, cl
mov ebp, 0xffffae64
mov edi, 0x4718f0ea
shrd edi, ebp, cl
mov dword [esp + 8], eax
mov edx, 0xffffae64
sar edx, cl
test bl, 0x20
jne 0x408e19
mov ebx, dword [esp]
jmp 0x408e24
sar ebp, 0x1f
mov ebx, esi
xor esi, esi
mov edi, edx
mov edx, ebp
mov eax, edi
xor eax, 0x4718f0ea
mov ecx, edx
xor ecx, 0xffffae64
mov ebp, edi
or ebp, 0xb8e70f15
and ebp, eax
mov eax, edx
or eax, 0x519b
and eax, ecx
or edi, 0x4718f0ea
or edx, 0xffffae64
add edi, ebx
adc edx, esi
add edi, 1
adc edx, 0
mov ecx, edi
xor ecx, ebp
not ebp
mov ebx, edx
xor ebx, eax
not eax
and eax, edx
and ebp, edi
add ecx, edi
adc ebx, edx
sub ecx, ebp
sbb ebx, eax
mov edi, ecx
and edi, 0xea1d1068
mov eax, edi
xor eax, 0xea1d1068
mov esi, ebx
and esi, 0x44cc96a9
mov ebp, ecx
and ebp, 0x15e2ef97
imul esi, eax
mul ebp
mov dword [esp], eax
add edx, esi
mov esi, edx
mov edx, ebx
and edx, 0xbb336956
or ecx, 0xea1d1068
mov eax, ecx
imul ecx, edx
xor edx, 0xbb336956
imul ebp, edx
add ebp, esi
mul edi
add ecx, edx
or ebx, 0xbb336956
imul ebx, edi
add ebx, ecx
add eax, dword [esp]
adc ebx, ebp
mov edi, ebx
shr edi, 0x15
xor edi, ebx
mov esi, ebx
shld esi, eax, 0xb
xor esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x408f7d
mov eax, esi
and eax, 0x7e44cf6
mov dword [esp], eax
mov ebp, edi
and ebp, 0x66512dd2
mov ebx, esi
and ebx, 0xf81bb309
mov ecx, edi
and ecx, 0x99aed22d
mov eax, ebx
xor eax, 0xf81bb309
imul ebp, eax
mul dword [esp]
mov dword [esp + 4], eax
or esi, 0xf81bb309
mov eax, esi
imul esi, ecx
xor ecx, 0x99aed22d
imul ecx, dword [esp]
add ecx, edx
mul ebx
add ecx, ebp
add esi, edx
or edi, 0x99aed22d
imul edi, ebx
add edi, esi
add eax, dword [esp + 4]
adc edi, ecx
mov esi, eax
mov ecx, dword [esp + 8]
shrd esi, edi, cl
mov edx, edi
shr edx, cl
test cl, 0x20
je 0x408f65
mov esi, edx
xor edx, edx
mov ecx, esi
and ecx, eax
mov ebx, edx
and ebx, edi
add esi, eax
adc edx, edi
shld ebx, ecx, 1
add ecx, ecx
sub esi, ecx
sbb edx, ebx
mov edi, edx
mov eax, edi
and eax, 0xfefefefe
mov ecx, esi
and ecx, 0xfefefefe
shld edi, esi, 1
add esi, esi
mov edx, edi
and edx, 0x2020202
mov ebx, esi
and ebx, 0x2020202
add ebx, ecx
adc edx, eax
sub esi, ebx
sbb edi, edx
add esi, 0x1010101
adc edi, 0x1010101
push edi
push esi
call fcn.0040a180
add esp, 8
test al, al
je 0x408fce
call fcn.0040c970
call fcn.0040b8f0
call fcn.0043de50
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408fe0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x409045
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x409000
mov eax, 0x270
jmp 0x40911f
cmp eax, 0x4e0
jb 0x40911f
mov esi, dword [ecx + 0x9c4]
xor eax, eax
jmp 0x40908f
and esi, 0x80000000
mov ebx, edx
and ebx, 0x7ffffffe
or ebx, esi
shr ebx, 1
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, ebx
xor edi, 0x58e9006c
mov dword [ecx + eax*4 + 4], edi
inc eax
mov esi, edx
cmp eax, 0xe3
je 0x4090a7
mov edx, dword [ecx + eax*4 + 0x9c8]
mov edi, 0x58e9006c
test dl, 1
je 0x409060
mov edi, 0xc1e1b0b3
jmp 0x409060
mov esi, dword [ecx + 0xd50]
xor eax, eax
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0xd54]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 4]
xor edi, edx
mov dword [ecx + eax*4 + 0x390], edi
inc eax
cmp eax, 0x18c
jne 0x4090b0
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
pop ebx
ret
Function at 0x40a180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x230
push eax
sub esp, 0x3c
mov dword [ebp - 0x20], esp
sub esp, 0x80
mov dword [ebp - 0x28], esp
mov eax, dword [0x44bc14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x23c], 0xd9dac3c4
mov byte [ebp - 0x238], 0
mov ecx, 0xcd0a5f2f
xor edx, edx
nop
nop
nop
nop
movzx esi, byte [ebp + ecx + 0x32f59e95]
mov ebx, ecx
or ebx, esi
lea eax, [edx + 0x32f5a0d0]
or eax, esi
mov esi, ebx
sub esi, eax
lea edi, [edx + esi]
add edi, 0xe4
sub eax, ebx
add eax, ecx
add eax, 0x133dbec
mov ebx, eax
and eax, 0x1d
and edi, 0xe2
or edi, eax
not ebx
and ebx, 1
or ebx, edi
lea eax, [edx + esi]
and eax, 1
xor ebx, 0x1c
add ebx, eax
mov byte [ebp + ecx + 0x32f59e95], bl
inc ecx
dec edx
cmp edx, 0xfffffffb
jne 0x40a1c0
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 0x1bc], 0x4fd949c3
mov dword [ebp - 0x1b8], 0x43e14d1a
mov dword [ebp - 0x1b4], 0x47104117
mov dword [ebp - 0x1b0], 0xbb1e4516
mov dword [ebp - 0x1ac], 0xbf22b924
mov dword [ebp - 0x1a8], 0xbdbc
xor edx, edx
nop
nop
nop
nop
nop
mov eax, edx
add al, 0x72
xor al, byte [ebp + edx - 0x1bc]
add al, 0xc6
mov byte [ebp + edx - 0x1bc], al
inc edx
cmp edx, 0x18
jne 0x40a260
lea edi, [ebp - 0x1bc]
push ecx
push 0
push edi
call dword [ebp - 0x18]
mov ecx, 0x44bc18
push eax
call fcn.0043c7e0
movzx eax, al
mov eax, dword [eax*4 + 0x445990]
mov ecx, 0x172c8614
xor ecx, dword [0x445998]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x40ab80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40adde
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40abbc
cmp edx, esi
jae 0x40adde
test edi, edi
je 0x40adde
movzx ebp, bl
test bl, bl
js 0x40abf0
mov word [eax], bp
lea ecx, [eax + 2]
inc edx
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40abb0
jmp 0x40adde
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40ac28
cmp bl, 0xc2
jb 0x40abe0
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40ac8a
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40acd8
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40ac52
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40ac94
cmp ebp, 0xe0
jne 0x40ac9d
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40abdc
jmp 0x40ac9d
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40adbd
cmp bl, 0xf4
ja 0x40abe0
movzx ecx, byte [edx + 1]
je 0x40acef
cmp ebp, 0xf0
jne 0x40acf8
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40abdc
jmp 0x40acf8
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40abe2
cmp cl, 0x9f
ja 0x40abdc
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40adc4
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ace3
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40abd2
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40abe2
cmp cl, 0x8f
ja 0x40abdc
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40adc4
movzx ebp, byte [edx + 2]
mov esi, ebp
not esi
or esi, 0xc0
add esi, ebp
cmp esi, 0x7f
jne 0x40adca
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40add2
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ebx, dword [esp]
and ebx, 0x3f
or ebx, ebp
cmp ebx, 0x10000
jb 0x40abdc
mov ecx, ebx
xor ecx, 0x7ff
mov esi, ebx
or esi, 0x7ffff800
and esi, ecx
cmp esi, 0xd800
je 0x40abdc
cmp edi, 2
jb 0x40adbd
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
and ebx, 0x3ff
or ebx, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bx
jmp 0x40abd2
mov ecx, eax
jmp 0x40abd2
inc edx
jmp 0x40abdc
add edx, 2
jmp 0x40abdc
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40abe2
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b2d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44bbf0]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40b37e
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x445ba8]
mov eax, dword [0x445bb8]
nop
nop
nop
nop
nop
nop
jmp eax
Function at 0x40b920
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x440
mov edi, dword [esp + 0x46c]
mov ebx, dword [esp + 0x468]
mov dword [esp + 0x40], 0xb92bbb77
mov dword [esp + 0x44], 0xbd21bf36
mov dword [esp + 0x48], 0xb12eb320
mov dword [esp + 0x4c], 0xb567b757
mov dword [esp + 0x50], 0xa978ab7f
mov dword [esp + 0x54], 0xad8eaf78
mov dword [esp + 0x58], 0xa14ba374
mov dword [esp + 0x5c], 0xa534a73f
mov dword [esp + 0x60], 0x59cb5b40
mov dword [esp + 0x64], 0x5dcb5fd1
mov dword [esp + 0x68], 0x51a0537c
mov dword [esp + 0x6c], 0x557657a4
mov dword [esp + 0x70], 0x499a4b83
mov dword [esp + 0x74], 0x4d9e4f9a
mov dword [esp + 0x78], 0x41624381
mov dword [esp + 0x7c], 0x45d947a9
mov dword [esp + 0x80], 0x79b07bd6
mov dword [esp + 0x84], 0x7db37fac
mov dword [esp + 0x88], 0x71fa735c
mov dword [esp + 0x8c], 0x75a277ba
mov dword [esp + 0x90], 0x694a6bab
mov dword [esp + 0x94], 0x6dfe6faf
mov dword [esp + 0x98], 0x61fe63fc
mov dword [esp + 0x9c], 0x658f67fb
mov dword [esp + 0xa0], 0x19fc1bff
mov dword [esp + 0xa4], 0x1d811fe5
mov dword [esp + 0xa8], 0x11c31388
mov dword [esp + 0xac], 0x15c317db
mov dword [esp + 0xb0], 0x9d80bdd
mov dword [esp + 0xb4], 0xdc40fdd
mov dword [esp + 0xb8], 0x1da032c
mov dword [esp + 0xbc], 0x5fe07fd
mov dword [esp + 0xc0], 0x39c93bf0
mov dword [esp + 0xc4], 0x3de23fc4
mov dword [esp + 0xc8], 0x31ae331c
mov dword [esp + 0xcc], 0x35ab37af
mov dword [esp + 0xd0], 0x290a2baf
mov dword [esp + 0xd4], 0x2db52fd1
mov dword [esp + 0xd8], 0x21bf23c9
mov dword [esp + 0xdc], 0x25f927b1
mov dword [esp + 0xe0], 0xd91fdb04
mov dword [esp + 0xe4], 0xdd48df40
mov dword [esp + 0xe8], 0xd141d34d
mov dword [esp + 0xec], 0xd507d74b
mov dword [esp + 0xf0], 0xc91dcb03
mov dword [esp + 0xf4], 0xcd1ccf07
mov dword [esp + 0xf8], 0xc110c31c
mov dword [esp + 0xfc], 0xc514c710
mov dword [esp + 0x100], 0xf9dafb14
mov dword [esp + 0x104], 0xfd19ff0d
mov dword [esp + 0x108], 0xf115f366
mov dword [esp + 0x10c], 0xf569f766
mov dword [esp + 0x110], 0xe921eb25
mov dword [esp + 0x114], 0xed27ef3d
mov dword [esp + 0x118], 0xe137e33e
mov dword [esp + 0x11c], 0xe5e6e72a
mov eax, dword [0x44bbe4]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x5f
xor dl, byte [esp + ecx + 0x40]
add dl, 0x25
mov byte [esp + ecx + 0x40], dl
inc ecx
cmp ecx, 0xe0
jne 0x40bb80
lea esi, [esp + 0x40]
push 0
push 0
push 0
push 0
push esi
call eax
xor ecx, ecx
mov dword [esp + 8], eax
test eax, eax
setne cl
mov eax, dword [ecx*4 + 0x445c28]
mov ecx, 0xb661fb27
xor ecx, dword [0x445c30]
add eax, ecx
inc eax
jmp eax
Function at 0x40c1f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x240
mov dword [esp + 0x40], 0xe97beb57
mov dword [esp + 0x44], 0xed41ef76
mov dword [esp + 0x48], 0xd17ed340
mov dword [esp + 0x4c], 0xd587d777
mov dword [esp + 0x50], 0xd988db8f
mov dword [esp + 0x54], 0xddbedf88
mov dword [esp + 0x58], 0xc17bc3b4
mov dword [esp + 0x5c], 0xc554c76f
mov dword [esp + 0x60], 0xc95bcb60
mov dword [esp + 0x64], 0xcd5bcf51
mov dword [esp + 0x68], 0x318033ac
mov dword [esp + 0x6c], 0x35563784
mov dword [esp + 0x70], 0x396a3b63
mov dword [esp + 0x74], 0x3d6e3f6a
mov dword [esp + 0x78], 0x21422361
mov dword [esp + 0x7c], 0x25892799
mov dword [esp + 0x80], 0x29702bb6
mov dword [esp + 0x84], 0x2d732f7c
mov dword [esp + 0x88], 0x118a134c
mov dword [esp + 0x8c], 0x1542174a
mov dword [esp + 0x90], 0x197a1b7b
mov dword [esp + 0x94], 0x1d8e1f5f
mov dword [esp + 0x98], 0x1ae038c
mov dword [esp + 0x9c], 0x5bf07ab
mov dword [esp + 0xa0], 0x9ac0baf
mov dword [esp + 0xa4], 0xda10f45
mov dword [esp + 0xa8], 0x71237398
mov dword [esp + 0xac], 0x7523772b
mov dword [esp + 0xb0], 0x79287b2d
mov dword [esp + 0xb4], 0x7d247f2d
mov dword [esp + 0xb8], 0x610a631c
mov dword [esp + 0xbc], 0x652e672d
mov dword [esp + 0xc0], 0x69d96bd0
mov dword [esp + 0xc4], 0x6d026f24
mov dword [esp + 0xc8], 0x51fe530c
mov dword [esp + 0xcc], 0x55fb57ff
mov dword [esp + 0xd0], 0x593a5bff
mov dword [esp + 0xd4], 0x5df55f11
mov dword [esp + 0xd8], 0x41ef43f9
mov dword [esp + 0xdc], 0x452947d1
mov dword [esp + 0xe0], 0x490f4b24
mov dword [esp + 0xe4], 0x4dd84fe0
mov dword [esp + 0xe8], 0xb121b3dd
mov dword [esp + 0xec], 0xb5e7b71b
mov dword [esp + 0xf0], 0xb9edbbe3
mov dword [esp + 0xf4], 0xbdecbfe7
mov dword [esp + 0xf8], 0xa1f0a3ec
mov dword [esp + 0xfc], 0xa5f4a7f0
mov dword [esp + 0x100], 0xa9caabf4
mov dword [esp + 0x104], 0xad09af1d
mov dword [esp + 0x108], 0x91359306
mov dword [esp + 0x10c], 0x95399706
mov dword [esp + 0x110], 0x99c19bc5
mov dword [esp + 0x114], 0x9dc79fcd
mov dword [esp + 0x118], 0x81d783ce
mov dword [esp + 0x11c], 0x858687da
mov byte [esp + 0x122], 0
mov word [esp + 0x120], 0
mov eax, dword [0x44bbe4]
xor ecx, ecx
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x57
xor dl, byte [esp + ecx + 0x40]
add dl, 0x4d
mov byte [esp + ecx + 0x40], dl
inc ecx
cmp ecx, 0xe3
jne 0x40c450
lea ecx, [esp + 0x40]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x445dc8]
mov ecx, 0x2d03f0a
xor ecx, dword [0x445dd0]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x417880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebp, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x4178a0
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4178c0
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x4178e0
mov eax, 0xffffffff
jmp 0x4178e9
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.00408590
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x417921
add esi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x417910
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0x417951
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417940
mov word [eax], 0
lea eax, [esp + 0xc]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00440330
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446240]

Function at 0x4178cb
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebp, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x4178a0
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4178c0
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x4178e0
mov eax, 0xffffffff
jmp 0x4178e9
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.00408590
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x417921
add esi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x417910
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0x417951
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417940
mov word [eax], 0
lea eax, [esp + 0xc]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00440330
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446240]
Function at 0x41be60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x198
mov dword [esp + 0x10], 0xff0093b
mov dword [esp + 0x14], 0x3f10dfb
mov dword [esp + 0x18], 0x70601f2
mov dword [esp + 0x1c], 0
mov eax, 0x321e6dc2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x321e6db2]
xor edx, eax
mov ecx, edx
and ecx, 0x35
add ecx, ecx
xor edx, 0xca
sub ecx, edx
mov byte [esp + eax - 0x321e6db2], cl
inc eax
cmp eax, 0x321e6dd2
jne 0x41bea0
mov dword [esp + 0x28], 0x118a1f84
mov dword [esp + 0x2c], 0x15821384
mov dword [esp + 0x30], 0x947175e
mov dword [esp + 0x34], 0xd960b59
mov dword [esp + 0x38], 0x16b0f9d
mov dword [esp + 0x3c], 0x59e0363
mov dword [esp + 0x40], 0x3997079c
mov dword [esp + 0x44], 0x3dae3bad
mov dword [esp + 0x48], 0x313e3f76
mov dword [esp + 0x4c], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x28]
mov esi, ecx
xor esi, 0xfb
mov edi, eax
and edi, 8
sub edi, esi
lea esi, [edx + edx]
not esi
add esi, edx
xor edx, esi
and edx, edi
xor edx, esi
mov bl, 0xe6
sub bl, dl
mov byte [esp + ecx + 0x28], bl
inc ecx
add eax, 2
cmp ecx, 0x28
jne 0x41bf20
movzx ecx, word [esp + 0x28]
lea eax, [esp + 0x154]
test cx, cx
je 0x41bf83
lea edx, [esp + 0x2a]
mov esi, dword [ebp + 0x10]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bf70
jmp 0x41bf86
mov esi, dword [ebp + 0x10]
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x41bfb3
lea edx, [esi + 2]
mov esi, dword [ebp + 0xc]
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bfa0
jmp 0x41bfb6
mov esi, dword [ebp + 0xc]
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x41bfe1
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bfd0
mov word [eax], 0
mov edi, dword [esi]
mov dword [esp + 0x28], 0xb0c046e
mov byte [esp + 0x2c], 0x94
mov dword [esp + 0x2d], 0
mov dword [esp + 0x30], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x66
xor cl, byte [esp + eax + 0x28]
add cl, 2
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0xc
jne 0x41c010
movzx eax, byte [esp + 0x28]
test al, al
je 0x41c04b
lea ecx, [esp + 0x29]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41c040
mov byte [edi], 0
mov eax, dword [0x446a64]
mov ecx, 0x639f947d
xor ecx, dword [0x446a6c]
add eax, ecx
inc eax
jmp eax
Function at 0x41fd90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x34]
mov ebp, 0xfffffffe
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x41fda0
sar ebp, 1
lea esi, [esp + 0x18]
push esi
push 0
push 0
push ebp
push edi
push 0
call dword [0x44cf38]
mov dword [esp + 4], 0x23e2e183
xor ecx, ecx
nop
nop
nop
nop
nop
nop
mov edx, ecx
and dl, 0xc7
xor dl, byte [esp + ecx + 4]
xor dl, 0xd8
add dl, 0xc8
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 4
jne case.default.0x41fdf4
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x446db4]
mov ebx, dword [esp + 0x18]
test ebx, ebx
jns 0x41fe0a
mov eax, 0xffffffff
jmp 0x41fe0d
lea eax, [ebx + ebx]
push eax
call fcn.00408590
add esp, 4
push esi
mov esi, eax
push ebx
push eax
push ebp
push edi
push 0
call dword [0x44cf38]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446dbc]
xor ebx, ebx
jmp dword [0x446dc4]
push esi
call fcn.004085a0
add esp, 4
xor ebx, ebx
jmp case.0x41fdf4.0
lea edi, [esp + 4]
push edi
push esi
call fcn.004404d0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446dcc]
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret