joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c76
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c4
and dword [esp + 0x30], 0
xor eax, eax
push ebx
push esi
push edi
mov esi, 0x42c5e0
mov dword [esp + 0x40], ecx
lea edi, [esp + 0x44]
mov dword [esp + 0x10], 0x550a02d4
mov dword [esp + 0x14], 0x8346ca1
mov dword [esp + 0x18], 0x7744a492
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x1c], 0x608cd20c
mov dword [esp + 0x20], 0xb1e9ab82
mov dword [esp + 0x24], 0xeeeae690
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x28], 0xacfedfda
mov dword [esp + 0x2c], 0x8d84b0ae
mov dword [esp + 0x30], 0x34379e99
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x34], 0x10725867
mov dword [esp + 0x38], 0x9e2b13b9
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov byte [esp + eax + 0x88], al
inc eax
cmp eax, 0x100
jb 0x405cf7
mov edi, dword [0x4340bc]
xor esi, esi
cmp byte [str.hresult], 0
mov dword [esp + 0xc], edi
je 0x405d2d
lea ebx, [edi + 0x3f461a03]
inc esi
cmp byte [esi + str.hresult], 0
jne 0x405d21
jmp 0x405d33
mov ebx, dword [0x4340dc]
push 0x42d160
push ecx
mov ecx, edi
call fcn.00404591
pop ecx
pop ecx
cmp dword [esp + 0xc], esi
jae 0x405d6d
mov edi, ebx
xor edi, 0xa5bb3086
mov dword [esp + 0xc], edi
sub esi, dword [esp + 0xc]
mov dword [0x4340bc], edi
call fcn.004048d1
call fcn.0040488c
sub esi, 1
jne 0x405d5e
mov edi, dword [esp + 0x3c]
xor esi, esi
xor edx, edx
mov bl, byte [esp + esi + 0x88]
push 0x11
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [esp + edx + 0x44]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x88]
mov byte [esp + esi + 0x88], al
inc esi
mov byte [esp + edi + 0x88], bl
cmp esi, 0x100
jb 0x405d73
and dword [esp + 0x3c], 0
xor ebx, ebx
mov eax, dword [esp + 0xc]
xor esi, esi
mov edi, dword [esp + 0x3c]
add eax, 0x884c1c50
mov dword [0x4340dc], eax
lea eax, [ebx + 1]
movzx ebx, al
mov cl, byte [esp + ebx + 0x88]
movzx edx, cl
lea eax, [edx + edi]
movzx edi, al
mov al, byte [esp + edi + 0x88]
mov byte [esp + ebx + 0x88], al
mov byte [esp + edi + 0x88], cl
movzx eax, byte [esp + ebx + 0x88]
add eax, edx
movzx eax, al
mov al, byte [esp + eax + 0x88]
xor al, byte [esp + esi + 0x10]
mov byte [esp + esi + 0x58], al
inc esi
cmp esi, 0x2c
jb 0x405dcb
push 1
lea eax, [esp + 0x8c]
mov byte [esp + 0x88], 0
push eax
push 0
push 0
push 2
lea edx, [esp + 0x6c]
mov dword [esp + 0x9c], 0x348
pop ecx
call fcn.0040a2e6
call eax
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0xcc]
call fcn.0040b929
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405e5e
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
push ebx
push esi
push edi
push 0x19
pop eax
push 6
pop ecx
mov esi, 0x42c500
mov dword [ebp - 0x2c], 0xa06e3b6e
lea edi, [ebp - 0x68]
mov dword [ebp - 0x28], 0xbadcea62
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x24], 0x78c759d2
mov dword [ebp - 0x20], 0x75457079
mov dword [ebp - 0x1c], 0xa7a07aab
movsw word es:[edi], word [esi]
mov esi, dword [0x4340c0]
mov edx, esi
mov ecx, esi
mov dword [ebp - 0x18], 0x5dcba77a
mov dword [ebp - 0x14], 0x8e63a2bf
mov dword [ebp - 0x10], 0x24c4d427
mov dword [ebp - 0xc], 0x4d4d2de9
mov word [ebp - 8], 0x6cc2
mov byte [ebp - 6], 3
mov byte [ebp - 5], al
mov dword [ebp - 4], 0x6ef61184
call fcn.004047d2
mov ecx, str.iostream_stream_error
xor ebx, ebx
mov eax, ecx
lea eax, [eax + 2]
add esi, 0xc94ad1af
cmp word [eax], bx
jne 0x405ee7
push ecx
push ecx
mov ecx, esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], ebx
call fcn.00404591
pop ecx
pop ecx
cmp byte [str.state_not_recoverable], bl
je 0x405f26
mov edi, str.state_not_recoverable
call fcn.0040488c
or esi, 0x8bcdb247
inc edi
cmp byte [edi], bl
jne 0x405f13
mov dword [ebp - 0x48], esi
mov eax, ebx
mov byte [ebp + eax - 0x178], al
inc eax
cmp eax, 0x100
jb 0x405f28
mov edi, ebx
xor edx, edx
mov bl, byte [ebp + edi - 0x178]
push 0x19
mov eax, edi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x68]
add eax, dword [ebp - 0x44]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 0x44], ecx
mov al, byte [ebp + ecx - 0x178]
mov byte [ebp + edi - 0x178], al
inc edi
mov byte [ebp + ecx - 0x178], bl
cmp edi, 0x100
jb 0x405f39
xor eax, eax
mov esi, eax
mov ebx, eax
mov edi, eax
lea eax, [ebx + 1]
movzx ebx, al
mov cl, byte [ebp + ebx - 0x178]
movzx edx, cl
lea eax, [edx + esi]
movzx esi, al
mov al, byte [ebp + esi - 0x178]
mov byte [ebp + ebx - 0x178], al
mov byte [ebp + esi - 0x178], cl
movzx eax, byte [ebp + ebx - 0x178]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x178]
xor al, byte [ebp + edi - 0x2c]
mov byte [ebp + edi - 0x78], al
inc edi
cmp edi, 0x2c
jb 0x405f82
mov esi, dword [ebp - 0x48]
push str.iostream_stream_error
push ecx
mov ecx, esi
call fcn.00404591
pop ecx
pop ecx
mov eax, 0x42d2f0
xor ecx, ecx
lea eax, [eax + 2]
imul esi, esi, 0x25a5bbf2
cmp word [eax], cx
jne 0x405fe8
mov byte [ebp - 0x4c], cl
lea eax, [ebp - 0x40]
xor ecx, ecx
mov dword [0x4340c0], esi
push eax
lea edx, [ebp - 0x78]
mov dword [ebp - 0x40], 0x40
inc ecx
call fcn.0040a2e6
call eax
pop edi
pop esi
pop ebx
test eax, eax
jne 0x406020
leave
ret
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
shrd eax, ecx, 0x14
leave
ret
Function at 0x406822
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
push ebx
push esi
push edi
mov esi, str.SrchCommon
mov dword [ebp - 0x1c], 0x7084239d
lea edi, [ebp - 0x38]
mov dword [ebp - 0x18], 0x159adc71
mov dword [ebp - 0x14], 0x5e318089
mov dword [ebp - 0x10], 0x1afe5589
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], 0xe4ef0724
mov dword [ebp - 8], 0x1f2054b2
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.004045e1
mov ebx, dword [0x43411c]
mov esi, 0x42d054
mov edx, ebx
mov ecx, ebx
call fcn.004047d2
or ebx, 0xb8350c48
inc esi
mov dword [0x43411c], ebx
cmp byte [esi], 0
jne 0x406875
xor ecx, ecx
mov dword [ebp - 4], ebx
mov edi, ecx
mov eax, ecx
mov byte [ebp + eax - 0x178], al
inc eax
cmp eax, 0x100
jb 0x406899
mov esi, ecx
xor edx, edx
mov bl, byte [ebp + esi - 0x178]
push 0xa
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x38]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x178]
mov byte [ebp + esi - 0x178], al
inc esi
mov byte [ebp + edi - 0x178], bl
cmp esi, 0x100
jb 0x4068aa
mov ebx, dword [ebp - 4]
xor eax, eax
push 0x64
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], eax
pop edx
jmp 0x4068fc
xor eax, eax
push 9
pop ecx
mov esi, 0x42cf98
lea edi, [ebp - 0x78]
rep movsd dword es:[edi], dword [esi]
cmp dx, word [ebp - 0x78]
jne 0x406973
xor esi, esi
mov ecx, esi
test dx, dx
je 0x406931
cmp word [ebp + ecx - 0x78], si
je 0x406931
inc eax
lea ecx, [eax + eax]
movzx edx, word [ecx + 0x42d360]
cmp dx, word [ebp + ecx - 0x78]
je 0x406913
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
cmp esi, eax
jae 0x406973
mov edi, eax
cmp esi, 0x1510
jne 0x406950
imul ebx, ebx, 0x1e39ef69
call fcn.004045e1
push 0x42d360
xor ebx, 0xa5ea8351
push ecx
mov ecx, ebx
call fcn.00404591
inc esi
pop ecx
pop ecx
cmp esi, edi
jb 0x40693d
mov dword [0x43411c], ebx
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x20]
inc eax
movzx esi, al
mov eax, dword [ebp - 0x24]
push 0x64
mov dword [ebp - 0x20], esi
mov cl, byte [ebp + esi - 0x178]
movzx edx, cl
add eax, edx
movzx edi, al
mov dword [ebp - 0x24], edi
mov al, byte [ebp + edi - 0x178]
mov byte [ebp + esi - 0x178], al
mov byte [ebp + edi - 0x178], cl
movzx eax, byte [ebp + esi - 0x178]
add eax, edx
mov edx, dword [ebp - 0x28]
movzx eax, al
mov al, byte [ebp + eax - 0x178]
xor al, byte [ebp + edx - 0x1c]
mov byte [ebp + edx - 0x54], al
inc edx
mov dword [ebp - 0x28], edx
cmp edx, 0x18
pop edx
jb 0x4068fa
xor ecx, ecx
lea edx, [ebp - 0x54]
xor eax, eax
inc ecx
mov byte [ebp - 0x3c], al
call fcn.0040a2e6
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40717c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
lea edi, [ebp - 0x20]
push 5
pop ecx
mov esi, 0x42d45c
mov ebx, edx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov edx, eax
movzx eax, word [ebx]
mov ecx, eax
movsw word es:[edi], word [esi]
xor esi, esi
mov dword [ebp - 8], ecx
cmp ax, word [ebp - 0x20]
jne 0x4071cd
movzx ecx, cx
mov eax, esi
test cx, cx
je 0x4071cd
cmp word [ebp + eax - 0x20], si
je 0x4071cd
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + ebx]
cmp cx, word [ebp + eax - 0x20]
je 0x4071b2
movzx ecx, byte [ebx + edx*2]
movzx eax, byte [ebp + edx*2 - 0x20]
sub ecx, eax
cmp ecx, 0x1786
je 0x4071ec
imul edx, dword [0x434230], 0xad8b303
jmp 0x4071f2
mov edx, dword [0x434190]
mov eax, esi
lea edi, [ebp - 0x14]
mov esi, 0x42c4bc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x14], 0x4d
jne 0x407234
mov cl, 0x4d
test cl, cl
je 0x407221
cmp byte [ebp + eax - 0x14], 0
je 0x407221
mov cl, byte [eax + 0x42daa1]
inc eax
cmp cl, byte [ebp + eax - 0x14]
je 0x407209
cmp dword [ebp - 4], eax
jae 0x407234
sub eax, dword [ebp - 4]
or edx, 0xeee63210
sub eax, 1
jne 0x407229
mov edx, dword [ebp - 4]
lea edi, [ebp - 0x34]
mov eax, edx
mov esi, 0x42d480
push 0xb
xor eax, 0xb3c8f9f8
add edx, 0x83bbc28b
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 8]
mov dword [0x434190], eax
xor eax, eax
mov dword [0x434230], edx
cmp cx, word [ebp - 0x34]
jne 0x40728f
xor esi, esi
movzx edx, cx
mov ecx, esi
test dx, dx
je 0x407289
cmp word [ebp + ecx - 0x34], si
je 0x407289
inc eax
lea ecx, [eax + eax]
movzx edx, word [ecx + ebx]
cmp dx, word [ebp + ecx - 0x34]
je 0x40726e
mov edx, dword [0x434230]
movzx ecx, byte [ebx + eax*2]
movzx eax, byte [ebp + eax*2 - 0x34]
pop edi
sub ecx, eax
pop esi
pop ebx
cmp ecx, 0x152b
je 0x4072b0
imul eax, edx, 0xf49297aa
mov dword [0x434190], eax
leave
ret
Function at 0x4072b2
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, 0x42dcb0
imul edx, dword [0x43417c], 0x7ae958a5
xor edx, 0x46e6ce27
inc eax
cmp byte [eax], 0
jne 0x4072c7
push ebx
push esi
push edi
mov esi, 0x42d4bc
lea edi, [ebp - 0x18]
add edx, 0xe5c9cbdd
xor eax, eax
mov ebx, edx
or ebx, 0x1f76cd77
movsd dword es:[edi], dword [esi]
add ebx, 0x3725a5c3
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x53
jne 0x407337
mov cl, 0x53
test cl, cl
je 0x407319
cmp byte [ebp + eax - 0x18], 0
je 0x407319
mov cl, byte [eax + 0x42dac1]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x407301
mov ecx, dword [ebp - 4]
jmp 0x407333
cmp ecx, 0x1ed3
jne 0x40732c
lea edx, [ebx + 0x3206e2a1]
add ebx, 0x755e203a
inc ecx
cmp ecx, eax
jb 0x40731e
push 5
pop ecx
mov esi, 0x42d4d0
lea edi, [ebp - 0x1c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x1c], 0x6e
jne 0x407366
mov cl, 0x6e
test cl, cl
je 0x407366
cmp byte [ebp + eax - 0x1c], 0
je 0x407366
mov cl, byte [eax + 0x42dd0d]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0x40734e
movzx ecx, byte [eax + 0x42dd0c]
movzx eax, byte [ebp + eax - 0x1c]
sub ecx, eax
cmp ecx, 0xa30
jbe 0x407384
mov edx, ebx
or edx, 0xedc648b3
push 9
pop ecx
mov esi, 0x42d4e4
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
push 0x63
mov ebx, edx
xor eax, eax
and ebx, 0x63de63fe
movsw word es:[edi], word [esi]
pop esi
xor edi, edi
cmp si, word [ebp - 0x2c]
jne 0x4073c8
mov ecx, edi
test si, si
je 0x4073c8
cmp word [ebp + ecx - 0x2c], di
je 0x4073c8
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + 0x42dae0]
cmp si, word [ebp + ecx - 0x2c]
je 0x4073aa
movzx ecx, byte [eax*2 + 0x42dae0]
movzx eax, byte [ebp + eax*2 - 0x2c]
sub ecx, eax
cmp ecx, 0x14b0
jbe 0x4073e9
mov edx, ebx
or edx, 0xf2f5d678
jmp 0x4073ef
lea ebx, [edx + 0x571ed581]
and edx, 0x6e5d0cb1
mov esi, edi
imul eax, ebx, 0x98094294
and eax, 0xfdf58134
inc esi
cmp word [esi*2 + 0x42d9e0], di
jne 0x4073fd
mov ecx, dword [ebp - 4]
jmp 0x407429
cmp ecx, 0xcf2
jne 0x407422
mov edx, eax
or edx, 0x80d83809
imul eax, edx, 0x87c05036
inc ecx
cmp ecx, esi
jb 0x407412
pop edi
or eax, 0x7e7969fc
and edx, 0x59c4765a
pop esi
mov dword [0x43414c], eax
mov dword [0x43417c], edx
pop ebx
leave
ret
Function at 0x407448
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
imul edx, dword [0x434144], 0xa5cdb30a
lea edi, [ebp - 0x20]
push 5
pop ecx
mov esi, 0x42cf00
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
push 0x66
pop ecx
mov dword [ebp - 8], edx
mov eax, ebx
movsw word es:[edi], word [esi]
cmp cx, word [ebp - 0x20]
jne 0x4074a3
mov edx, ebx
test cx, cx
je 0x40749a
cmp word [ebp + eax - 0x20], bx
je 0x40749a
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + 0x42db60]
cmp cx, word [ebp + eax - 0x20]
je 0x40747c
mov dword [ebp - 4], edx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [eax*2 + 0x42db60]
movzx eax, byte [ebp + eax*2 - 0x20]
sub ecx, eax
cmp ecx, 0x1ed6
jbe 0x4074c2
imul edx, edx, 0xea190af9
jmp 0x4074c8
or edx, 0x666669b0
push 0xb
pop ecx
mov esi, 0x42d480
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
push 0x53
pop esi
mov eax, ebx
cmp si, word [ebp - 0x34]
jne 0x407523
mov ecx, ebx
test si, si
je 0x407500
cmp word [ebp + ecx - 0x34], bx
je 0x407500
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.SrchCollatorCxnMgr]
cmp si, word [ebp + ecx - 0x34]
je 0x4074e2
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
jmp 0x40751f
cmp eax, 0x1ee0
jne 0x407518
imul edx, edx, 0xa6c8ba52
xor edx, 0xde674aa0
inc eax
cmp eax, ecx
jb 0x40750b
mov eax, ebx
xor edx, 0x32e9317f
inc eax
cmp word [eax*2 + 0x42d970], bx
jne 0x407525
mov esi, dword [ebp - 8]
cmp esi, eax
jae 0x407566
mov edi, edx
mov ecx, edx
cmp esi, 0xe1b
jne 0x407551
mov ecx, edi
and ecx, 0xcd869ad7
imul edx, ecx, 0x2f2e72ac
inc esi
mov dword [0x434144], edx
mov edi, edx
mov ecx, edi
cmp esi, eax
jb 0x407541
add edx, 0xd12c7b58
and edx, 0x73f076be
add edx, 0x6203bd20
add edx, 0x62bf2e58
inc ebx
cmp byte [ebx + 0x42da80], 0
jne 0x407578
mov eax, edx
mov ecx, 0x237b9a82
xor eax, 0x1c8b0166
or edx, 0x5b2efbd2
cmp ebx, 0x1a14
pop edi
cmovne edx, eax
imul eax, edx, 0x3765f3de
pop esi
pop ebx
sub ecx, eax
and ecx, 0xc8e9268f
mov dword [0x434144], ecx
leave
ret
Function at 0x407992
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, dword [0x434184]
push esi
push edi
mov esi, 0x42cd98
imul eax, ebx, 0x59f86971
lea edi, [ebp - 0x18]
mov dword [ebp - 8], edx
xor edx, edx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], eax
mov eax, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
mov cl, byte [esi]
mov byte [ebp - 1], cl
cmp cl, byte [ebp - 0x18]
jne 0x407a02
test cl, cl
je 0x4079dd
cmp byte [ebp + eax - 0x18], dl
je 0x4079dd
inc eax
mov cl, byte [esi + eax]
cmp cl, byte [ebp + eax - 0x18]
je 0x4079c9
mov ecx, dword [ebp + 0xc]
cmp ecx, eax
jae 0x407a02
mov esi, dword [ebp - 0xc]
cmp ecx, 0x1cd2
jne 0x4079f7
mov ebx, esi
or ebx, 0xb6af93f4
imul ebx, ebx, 0x833b87bf
inc ecx
cmp ecx, eax
jb 0x4079e7
mov eax, dword [ebp - 8]
lea edi, [ebp - 0x34]
push 0xa
pop ecx
mov esi, 0x42d54c
or eax, 0x582ad3f
rep movsd dword es:[edi], dword [esi]
push 0x74
pop esi
mov ebx, edx
cmp si, word [ebp - 0x34]
jne 0x407a62
mov ecx, edx
test si, si
je 0x407a42
cmp word [ebp + ecx - 0x34], dx
je 0x407a42
inc ebx
lea ecx, [ebx + ebx]
movzx esi, word [ecx + 0x42d940]
cmp si, word [ebp + ecx - 0x34]
je 0x407a24
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
jae 0x407a62
mov edx, dword [ebp - 8]
cmp ecx, 0x2265
jne 0x407a5b
mov eax, edx
xor eax, 0x106aaa5
inc ecx
cmp ecx, ebx
jb 0x407a4c
xor edx, edx
mov ecx, edx
xor eax, 0xfcd23df1
inc ecx
cmp word [ecx*2 + 0x42d940], dx
jne 0x407a64
mov esi, dword [ebp - 8]
lea edi, [ebp - 0x24]
mov ebx, esi
and ebx, 0x5474ff89
cmp ecx, 0x6c
push 5
lea eax, [esi - 0x6def0099]
cmovne ebx, eax
or esi, 0x410dd25c
mov dword [0x434184], esi
mov esi, 0x42c140
mov al, byte [ebp - 1]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [0x434200], ebx
movsw word es:[edi], word [esi]
cmp al, byte [ebp - 0x24]
jne 0x407afa
mov ecx, dword [ebp + 0xc]
test al, al
je 0x407acc
cmp byte [ebp + edx - 0x24], 0
je 0x407acc
inc edx
mov al, byte [ecx + edx]
cmp al, byte [ebp + edx - 0x24]
je 0x407ab7
mov ecx, dword [ebp + 0xc]
cmp ecx, edx
jae 0x407afa
mov esi, dword [ebp - 8]
cmp ecx, 0x1027
jne 0x407ae9
lea eax, [ebx + 0x6be3493d]
mov dword [0x434184], eax
inc ecx
lea ebx, [esi + 0x870ff0d]
cmp ecx, edx
jb 0x407ad6
mov dword [0x434200], ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407aff
Capabilities:
Encode data using xor

Disassembly:
imul ecx, dword [0x4341c8], 0xa9979b68
xor edx, edx
push ebx
mov bl, byte [0x434218]
push esi
mov esi, edx
push edi
test bl, bl
je 0x407b29
add ecx, 0xa4a0ec0d
inc esi
cmp byte [esi + 0x434218], dl
jne 0x407b1a
mov eax, ecx
add ecx, 0x6c0d1d18
and eax, 0x4d4a8edc
cmp esi, 0x1a05
mov esi, 0x434218
cmovbe ecx, eax
test bl, bl
je 0x407b5b
mov eax, esi
add ecx, 0x6be2a1f2
inc eax
cmp byte [eax], dl
jne 0x407b4a
mov dword [0x4341c8], ecx
mov edi, edx
or ecx, 0x7b3c2f2c
and ecx, 0x4ec7a6a8
inc edi
cmp byte [edi + 0x42db58], dl
jne 0x407b63
lea eax, [ecx + 0x3301cbf7]
or ecx, 0xdfa25b2b
cmp edi, 0x807
cmovae ecx, eax
imul eax, ecx, 0xfd74dddc
or eax, 0xee1dfc0a
test bl, bl
je 0x407ba0
xor eax, 0xa6e46799
inc esi
cmp byte [esi], dl
jne 0x407b96
pop edi
xor eax, 0xb60f3e2c
pop esi
sub eax, 0x11f8bc11
pop ebx
imul eax, eax, 0x22aff986
inc edx
cmp byte [edx + 0x42db9c], 0
jne 0x407bad
mov ecx, eax
or eax, 0xfd6f9f61
xor ecx, 0x75214899
cmp edx, 0x1dd0
cmovne eax, ecx
mov dword [0x4341c8], eax
ret
Function at 0x4082d5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 6
pop ecx
mov esi, 0x42cb3c
lea edi, [ebp - 0x2c]
push 0x53
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x4341f0]
xor edx, edx
pop eax
mov ebx, edx
mov dword [ebp - 0xc], edi
cmp ax, word [ebp - 0x2c]
jne 0x408351
mov ecx, eax
mov eax, edx
test cx, cx
je 0x408323
cmp word [ebp + eax - 0x2c], dx
je 0x408323
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + 0x42dbd0]
cmp cx, word [ebp + eax - 0x2c]
je 0x408305
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
jae 0x408351
mov eax, dword [0x434160]
mov esi, dword [0x4341fc]
cmp ecx, 0x24fc
jne 0x408344
mov eax, edi
and eax, 0x3ba9ce05
imul esi, esi, 0x98c370ec
inc ecx
cmp ecx, ebx
jb 0x408335
jmp 0x408356
mov eax, dword [0x434160]
mov ecx, edi
xor eax, 0xc627f828
or ecx, 0x487ec4b5
mov esi, edx
mov dword [ebp - 0x10], ecx
cmp byte [0x434218], dl
je 0x408389
inc esi
cmp byte [esi + 0x434218], dl
jne 0x408370
cmp esi, 0x1186
jne 0x408389
lea ebx, [ecx + 0x42df9a8]
jmp 0x408391
mov ebx, ecx
and ebx, 0x52e06bb0
mov dword [ebp - 4], ebx
mov esi, edx
add eax, 0xd868310d
inc esi
cmp byte [esi + 0x42dc50], dl
jne 0x408396
mov ecx, dword [ebp - 0x10]
cmp ecx, esi
jae 0x4083cb
or eax, 0xde6876ca
cmp ecx, 0x1378
jne 0x4083c1
add ebx, 0x8e04e5a7
mov dword [ebp - 0xc], ebx
inc ecx
mov ebx, eax
cmp ecx, esi
jb 0x4083b0
mov dword [ebp - 4], ebx
push 0xb
pop ecx
push 0x53
mov esi, str.SearchProtocolHandler
mov dword [ebp - 8], edx
lea edi, [ebp - 0x40]
pop eax
rep movsd dword es:[edi], dword [esi]
cmp ax, word [ebp - 0x40]
jne 0x40840e
mov ecx, eax
mov ebx, edx
mov eax, edx
test cx, cx
je 0x408408
cmp word [ebp + eax - 0x40], dx
je 0x408408
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + 0x42db10]
cmp cx, word [ebp + eax - 0x40]
je 0x4083ea
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax*2 + 0x42db10]
movzx eax, byte [ebp + eax*2 - 0x40]
sub ecx, eax
cmp ecx, 0x181b
jae 0x40842f
imul ebx, dword [ebp - 0x10], 0x62d0ceab
push 0xe
pop ecx
mov esi, 0x42d704
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x4c], 0x53
jne 0x408484
push 0x53
pop eax
test al, al
je 0x408460
cmp byte [ebp + edx - 0x4c], 0
je 0x408460
mov al, byte [edx + 0x42dbb1]
inc edx
cmp al, byte [ebp + edx - 0x4c]
je 0x408448
mov eax, dword [ebp - 0x10]
cmp eax, edx
jae 0x408484
mov ecx, dword [ebp - 0xc]
cmp eax, 0x9c9
jne 0x408479
mov ebx, ecx
and ebx, 0xab6e1f42
and ebx, 0xb4939872
inc eax
cmp eax, edx
jb 0x40846a
mov edx, dword [ebp - 0x10]
mov ecx, edx
xor ecx, 0xfaae1182
or edx, 0x8a76f6cd
pop edi
pop esi
mov dword [0x434160], edx
lea eax, [ecx - 0x7446806a]
or ecx, 0xcfd7fefe
mov dword [0x4341d4], eax
imul eax, edx, 0xb61b1bea
mov dword [0x4341f0], ecx
pop ebx
mov dword [0x4341fc], eax
leave
ret
Function at 0x4091be
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov esi, str.too_many_links
mov dword [ebp - 0xc], edx
lea edi, [ebp - 0x20]
mov dword [ebp - 4], ecx
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x20], 0x63
jne 0x40922d
mov cl, 0x63
test cl, cl
je 0x4091fd
cmp byte [ebp + eax - 0x20], 0
je 0x4091fd
mov cl, byte [eax + 0x42e489]
inc eax
cmp cl, byte [ebp + eax - 0x20]
je 0x4091e5
mov ecx, dword [ebp - 0x10]
cmp ecx, eax
jae 0x40922d
mov esi, dword [0x434284]
mov edx, dword [0x434268]
cmp ecx, 0x164a
jne 0x409220
mov esi, edx
or esi, 0x2174f6de
inc ecx
lea edx, [esi - 0x16207a3]
cmp ecx, eax
jb 0x409210
jmp 0x409233
mov edx, dword [0x434268]
mov esi, str.__LOG_
lea edi, [ebp - 0x20]
xor eax, eax
lea ebx, [edx + 0x29c0a774]
mov ecx, eax
mov dword [ebp - 8], ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 0xc]
movzx eax, word [edi]
mov esi, eax
cmp ax, word [ebp - 0x20]
jne 0x409283
xor eax, eax
xor ebx, ebx
test si, si
je 0x40927a
cmp word [ebp + eax - 0x20], bx
je 0x40927a
inc ecx
lea eax, [ecx + ecx]
movzx esi, word [eax + edi]
cmp si, word [ebp + eax - 0x20]
je 0x40925f
mov dword [ebp - 8], ecx
lea ebx, [edx + 0x29c0a774]
mov eax, dword [ebp - 8]
movzx ecx, byte [edi + ecx*2]
movzx eax, byte [ebp + eax*2 - 0x20]
sub ecx, eax
cmp ecx, 0x1085
je 0x40929f
imul ebx, edx, 0xe07c75f8
push 8
pop ecx
mov esi, 0x42de60
imul eax, edx, 0x2739fdc4
lea edi, [ebp - 0x44]
and ebx, 0x2b799c76
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
lea edx, [eax + 0x3921e31f]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], edx
movsw word es:[edi], word [esi]
movzx esi, word [ecx]
cmp si, word [ebp - 0x44]
jne 0x40931c
mov edx, dword [ebp - 4]
xor ecx, ecx
mov edi, esi
xor eax, eax
mov esi, ecx
test di, di
je 0x4092f8
cmp word [ebp + ecx - 0x44], ax
je 0x4092f8
inc esi
lea ecx, [esi + esi]
movzx edi, word [ecx + edx]
cmp di, word [ebp + ecx - 0x44]
je 0x4092dd
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
jmp 0x409318
cmp ecx, 0x25e0
jne 0x409311
imul ebx, eax, 0x6a2fbd84
xor edx, 0x1004038e
inc ecx
cmp ecx, esi
jb 0x409303
mov edi, dword [ebp - 4]
xor ecx, ecx
mov esi, ecx
movzx ecx, word [edi]
test cx, cx
je 0x40935f
mov ecx, edi
xor edi, edi
add ebx, 0x9872843c
inc esi
cmp word [ecx + esi*2], di
jne 0x40932f
mov ecx, dword [ebp - 0x10]
cmp ecx, esi
jae 0x40935f
mov edx, ebx
and edx, 0x32f42a2c
cmp ecx, 0x6a6
jne 0x40935a
mov eax, ebx
and eax, 0x2608c39c
inc ecx
cmp ecx, esi
jb 0x40934b
and eax, 0xf8f93469
xor edx, 0x23129988
add eax, 0x39d865b6
mov dword [0x434284], edx
mov dword [0x43426c], eax
and eax, 0x9d5bdef1
pop edi
pop esi
mov dword [0x434268], eax
mov eax, edx
pop ebx
leave
ret