joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ee0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x407096
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40708f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406f75
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x40708f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406ff5
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
mov edi, eax
and edi, esi
xor eax, esi
lea eax, [eax + edi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 4]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 5]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 6]
add esi, eax
add ecx, esi
movzx edi, byte [ebp + edx + 7]
add edi, esi
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406f90
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406f3d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x407040
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x407020
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406f30
jmp 0x40704f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406f30
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x407060
jmp 0x406f30
shl ecx, 0x10
or ecx, edi
jmp 0x40709b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4070b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40711b
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x40711d
xor esi, esi
nop
nop
nop
nop
nop
nop
mov ebp, eax
not ebp
movzx edi, byte [ecx + esi]
mov ebx, ebp
shr ebx, 4
and eax, 0xc
and ebp, 3
or ebp, eax
mov eax, edi
and eax, 0xf
xor eax, ebp
xor eax, 0xc
xor ebx, dword [eax*4 + 0x44bc50]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
add edi, ebp
add ebx, ebx
sub edi, ebx
xor eax, dword [edi*4 + 0x44bc50]
not eax
inc esi
cmp edx, esi
jne 0x4070d0
jmp 0x40711d
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40c9e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x40ca4c
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x40ca2e
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x40ca30
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 2
mov ebp, ebx
or ebx, 2
imul ebx, edx
xor edx, 2
and ebp, 0xfffffffd
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x40ca10
jmp 0x40ca30
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40ca4a
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40ca4c
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d150
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00443d70
test al, al
je 0x40d34e
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043bec0
test al, al
je 0x40d349
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0x2225706d
mov dword [esp + 8], 0x76780276
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40d1d6
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d360
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40d1b0
mov dword [esp + 4], 0xd6b97333
mov dword [esp + 8], 0xccb11239
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40d236
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d3c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40d210
mov dword [esp + 4], 0xc1c6c727
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x40d286
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d410
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x40d260
test esi, esi
je 0x40d2e6
mov dword [esp + 4], 0xfb198329
mov dword [esp + 8], 0x51ac589e
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40d2e6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d470
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40d2c0
mov dword [esp + 4], 0x42454447
mov dword [esp + 8], 0x4e414043
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d336
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d4c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d310
call fcn.0040e960
test al, al
je 0x40d349
call fcn.004125a0
call fcn.00410590
call fcn.00444d30
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40fee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x4543c4]
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40ff8e
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44f034]
xor eax, eax
jmp 0x41057d
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4105a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov esi, dword [0x4543b8]
mov dword [esp + 0x3c], 0x299b2b77
mov dword [esp + 0x40], 0x2d812f96
mov dword [esp + 0x44], 0x319e3380
mov dword [esp + 0x48], 0x35473797
mov dword [esp + 0x4c], 0x39483b4f
mov dword [esp + 0x50], 0x3d5e3f48
mov dword [esp + 0x54], 0x15b0354
mov dword [esp + 0x58], 0x5b407af
mov dword [esp + 0x5c], 0x9bb0ba0
mov dword [esp + 0x60], 0xdbb0fb1
mov dword [esp + 0x64], 0x1140136c
mov dword [esp + 0x68], 0x15761744
mov dword [esp + 0x6c], 0x196a1b63
mov dword [esp + 0x70], 0x1d6e1f6a
mov dword [esp + 0x74], 0x61026361
mov dword [esp + 0x78], 0x65c96739
mov dword [esp + 0x7c], 0x69106bd6
mov dword [esp + 0x80], 0x6d136f1c
mov dword [esp + 0x84], 0x71ca730c
mov dword [esp + 0x88], 0x7502770a
mov dword [esp + 0x8c], 0x791a7b1b
mov dword [esp + 0x90], 0x7dce7f3f
mov dword [esp + 0x94], 0x41ee43cc
mov dword [esp + 0x98], 0x451f47eb
mov dword [esp + 0x9c], 0x49ec4bef
mov dword [esp + 0xa0], 0x4de14f05
mov dword [esp + 0xa4], 0x512353f8
mov dword [esp + 0xa8], 0x5523572b
mov dword [esp + 0xac], 0x59285b2d
mov dword [esp + 0xb0], 0x5d245f2d
mov dword [esp + 0xb4], 0xa1caa33c
mov dword [esp + 0xb8], 0xa5eea7ed
mov dword [esp + 0xbc], 0xa9f9abf0
mov dword [esp + 0xc0], 0xadc2afe4
mov dword [esp + 0xc4], 0xb11eb3cc
mov dword [esp + 0xc8], 0xb51bb71f
mov dword [esp + 0xcc], 0xb9dabb1f
mov dword [esp + 0xd0], 0xbd15bff1
mov dword [esp + 0xd4], 0x812f8319
mov dword [esp + 0xd8], 0x85e98731
mov dword [esp + 0xdc], 0x89cf8be4
mov dword [esp + 0xe0], 0x8d388f20
mov dword [esp + 0xe4], 0x9121933d
mov dword [esp + 0xe8], 0x95e7973b
mov dword [esp + 0xec], 0x99ed9be3
mov dword [esp + 0xf0], 0x9dec9fe7
mov dword [esp + 0xf4], 0xe190e3ec
mov dword [esp + 0xf8], 0xe594e790
mov dword [esp + 0xfc], 0xe98aeb94
mov dword [esp + 0x100], 0xed49efbd
mov dword [esp + 0x104], 0xf155f346
mov dword [esp + 0x108], 0xf559f746
mov dword [esp + 0x10c], 0xf981fb85
mov dword [esp + 0x110], 0xfd87ff8d
mov dword [esp + 0x114], 0xc1b7c38e
mov dword [esp + 0x118], 0xc5c6c7ba
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0xdf
ja 0x41082d
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
movzx eax, byte [esp + eax + 0x3c]
push dword [esp + 8]
push eax
call fcn.00412070
add esp, 8
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x3c], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0xe0
jb 0x410800
mov ebx, dword [esp + 0x468]
mov edi, dword [esp + 0x464]
lea ebp, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ebp
call esi
xor ecx, ecx
mov dword [esp + 0x34], eax
test eax, eax
setne cl
mov eax, dword [ecx*4 + 0x44f0c4]
mov ecx, 0x22706ae0
xor ecx, dword [0x44f0cc]
add eax, ecx
inc eax
jmp eax
Function at 0x410f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov esi, dword [0x4543b8]
mov dword [esp + 0x38], 0xb11f8fc3
mov dword [esp + 0x3c], 0xb5d9b32a
mov dword [esp + 0x40], 0xb9dab7d8
mov dword [esp + 0x44], 0xbdebbbdb
mov dword [esp + 0x48], 0xa190bfeb
mov dword [esp + 0x4c], 0xa582a3f0
mov dword [esp + 0x50], 0xa9dfa78c
mov dword [esp + 0x54], 0xadc4abc3
mov dword [esp + 0x58], 0xd13fafc8
mov dword [esp + 0x5c], 0xd547d349
mov dword [esp + 0x60], 0xd998d7f4
mov dword [esp + 0x64], 0xddfadbac
mov dword [esp + 0x68], 0xc18edf8f
mov dword [esp + 0x6c], 0xc592c3ee
mov dword [esp + 0x70], 0xc9e6c799
mov dword [esp + 0x74], 0xcda1cbb1
mov dword [esp + 0x78], 0xf198cfa2
mov dword [esp + 0x7c], 0xf5aff3a4
mov dword [esp + 0x80], 0xf96ef7d4
mov dword [esp + 0x84], 0xfdaefbae
mov dword [esp + 0x88], 0xe1deffd7
mov dword [esp + 0x8c], 0xe572e3a3
mov dword [esp + 0x90], 0xe98ae774
mov dword [esp + 0x94], 0xed93eb8f
mov dword [esp + 0x98], 0x118cef8b
mov dword [esp + 0x9c], 0x1579135d
mov dword [esp + 0xa0], 0x19471780
mov dword [esp + 0xa4], 0x1d4f1b4f
mov dword [esp + 0xa8], 0x1301f45
mov dword [esp + 0xac], 0x5540355
mov dword [esp + 0xb0], 0x92e0724
mov dword [esp + 0xb4], 0xd420b45
mov dword [esp + 0xb8], 0x31410f78
mov dword [esp + 0xbc], 0x351e337c
mov dword [esp + 0xc0], 0x395a3714
mov dword [esp + 0xc4], 0x3d573b53
mov dword [esp + 0xc8], 0x211e3f5b
mov dword [esp + 0xcc], 0x25452369
mov dword [esp + 0xd0], 0x294b2741
mov dword [esp + 0xd4], 0x2d012bb9
mov dword [esp + 0xd8], 0x516b2f0c
mov dword [esp + 0xdc], 0x55c05338
mov dword [esp + 0xe0], 0x593957c5
mov dword [esp + 0xe4], 0x5d0b5b3f
mov dword [esp + 0xe8], 0x410d5f0f
mov dword [esp + 0xec], 0x456c431b
mov dword [esp + 0xf0], 0x49684714
mov dword [esp + 0xf4], 0x4d644b18
mov dword [esp + 0xf8], 0x716e4f1c
mov dword [esp + 0xfc], 0x75117305
mov dword [esp + 0x100], 0x79157712
mov dword [esp + 0x104], 0x7d117bea
mov dword [esp + 0x108], 0x61297f2d
mov dword [esp + 0x10c], 0x653b6335
mov dword [esp + 0x110], 0x6933674a
mov dword [esp + 0x114], 0x6d6a6b3e
mov dword [esp + 0x118], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0xe3
ja 0x4111dd
mov eax, dword [esp + 8]
movzx eax, byte [esp + eax + 0x38]
push dword [esp + 8]
push eax
call fcn.00412270
add esp, 8
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x38], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0xe4
jb 0x4111b0
lea ebp, [esp + 0x38]
push 0
push 0
push 0
push 0
push ebp
call esi
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x44f284]
mov ecx, 0xd156081f
xor ecx, dword [0x44f28c]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x423fe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x424000
cmp eax, 0xffffffdd
jge 0x424017
mov eax, 0xffffffff
jmp 0x42401a
add eax, 0x22
push eax
call fcn.0040cb00
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0x13a111b4
mov dword [esp + 0x1c], 0xef59ed60
mov dword [esp + 0x20], 0xeb4be95a
mov dword [esp + 0x24], 0xe75be55b
mov dword [esp + 0x28], 0xe35ee144
mov dword [esp + 0x2c], 0xff40fd41
mov dword [esp + 0x30], 0xfb77f959
mov dword [esp + 0x34], 0xf77af540
mov word [esp + 0x38], 0xf1f0
mov dword [esp + 0x3a], 0
mov word [esp + 0x3e], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x27
ja 0x4240bb
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.00424cf0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x28
jb 0x424090
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x4240e1
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4240d0
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x424111
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424100
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0xd9abdbb7
mov dword [esp + 0x1c], 0xddeddf56
mov dword [esp + 0x20], 0xd15ad3a7
mov dword [esp + 0x24], 0xd5add7a4
mov dword [esp + 0x28], 0xe99feba6
mov dword [esp + 0x2c], 0xed9fef97
mov dword [esp + 0x30], 0xe1dfe39e
mov dword [esp + 0x34], 0xe5dbe7dd
mov dword [esp + 0x38], 0xf998fbda
mov dword [esp + 0x3c], 0xfd8bff73
mov dword [esp + 0x40], 0xf184f387
mov dword [esp + 0x44], 0xf587f7b5
mov dword [esp + 0x48], 0x97e0b86
mov dword [esp + 0x4c], 0xd860f73
mov dword [esp + 0x50], 0x15d0378
mov dword [esp + 0x54], 0x5450764
mov dword [esp + 0x58], 0x191a1b3a
mov word [esp + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x45
ja 0x4241f6
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.00424d60
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x46
jb 0x4241d0
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x4244c0
push ecx
push esi
call fcn.004251e0
add esp, 0x10
jmp dword [0x45083c]
Function at 0x427e40
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x74
mov esi, dword [0x4556fc]
mov dword [esp + 0x14], 0x91229ffb
mov dword [esp + 0x18], 0x95379301
mov dword [esp + 0x1c], 0x890a9737
mov dword [esp + 0x20], 0x8d1a8bcb
mov dword [esp + 0x24], 0x81ca8f1c
mov dword [esp + 0x28], 0x85168323
mov dword [esp + 0x2c], 0xf9e18727
mov word [esp + 0x30], 0xfbf8
mov dword [esp + 0x32], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x21
ja 0x427edb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042a470
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x22
jb 0x427eb0
lea edi, [esp + 0x68]
lea eax, [esp + 0x14]
push edi
push 0
push 0
push 0xe
push eax
push 0
call esi
mov ebx, dword [esp + 0x68]
test ebx, ebx
jns 0x427efe
mov eax, 0xffffffff
jmp 0x427f01
lea eax, [ebx + ebx]
push eax
call fcn.0040cb00
add esp, 4
mov esi, eax
mov ebp, dword [0x4556fc]
mov dword [esp + 0x14], 0x99ce9bb7
mov dword [esp + 0x18], 0xa5cba7e9
mov dword [esp + 0x1c], 0xa1d6a3cb
mov dword [esp + 0x20], 0xaddeafef
mov dword [esp + 0x24], 0xa9e6abdc
mov dword [esp + 0x28], 0xb5cab7c7
mov dword [esp + 0x2c], 0xb199b3db
mov word [esp + 0x30], 0xbfb0
mov dword [esp + 0x32], 0
mov byte [esp + 0x36], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x22
ja 0x427f9b
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042a4c0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x23
jb 0x427f70
push edi
push ebx
push esi
push 0xe
lea eax, [esp + 0x24]
push eax
push 0
call ebp
mov eax, dword [esp + 0x68]
mov ecx, eax
add ecx, 9
jns 0x427fbb
mov eax, 0xffffffff
jmp 0x427fc2
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040cb00
add esp, 4
mov edi, eax
mov dword [esp + 0x14], 0xf3a2f154
mov dword [esp + 0x18], 0xff5dfd5d
mov dword [esp + 0x1c], 0xfb5bf953
mov dword [esp + 0x20], 0xc76bc56b
mov dword [esp + 0x24], 0xc3c2c173
mov byte [esp + 0x28], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x14
ja 0x42803b
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042a500
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x15
jb 0x428010
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x428061
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428050
mov word [eax], 0
movzx ecx, word [esp + 0x14]
test cx, cx
je 0x428091
lea edx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428080
mov ebp, dword [esp + 0x88]
mov word [eax], 0
lea eax, [esp + 0x70]
push eax
push edi
call fcn.00448b10
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x45108c]
Function at 0x430110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x43016a
cmp edi, 1
je 0x43016a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x430141
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x430140
cmp ecx, 0x20
je 0x430140
cmp ecx, 0x2b
mov edx, edi
je 0x430160
cmp ecx, 0x2d
jne 0x43017f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x430184
xor edi, edi
test eax, eax
je 0x43033d
mov dword [eax], 0x16
jmp 0x43033d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x4301ad
cmp edx, 0x10
jne 0x4301c5
cmp byte [ebx], 0x30
jne 0x4301a6
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x4301c7
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x4301c7
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x430220
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x4302d8
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x430247
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x430308
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x430308
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x430200
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x430290
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x430299
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x4302bd
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x4302ed
test bl, bl
jne 0x4302ed
mov ebx, dword [esp + 0x10]
jmp 0x430213
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x4301f5
mov esi, edi
test bl, bl
jne 0x4302fb
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x4301f5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x430316
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x430324
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x430334
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x43033d
cmp byte [esp + 3], 0
jne 0x43033d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret