joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b7d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov edi, dword [esp + 0x468]
mov dword [esp + 0x3c], 0x41d747b3
mov dword [esp + 0x40], 0x4da943da
mov dword [esp + 0x44], 0x49da4fd8
mov dword [esp + 0x48], 0x759b4bab
mov dword [esp + 0x4c], 0x71a077ab
mov dword [esp + 0x50], 0x7d5273a0
mov dword [esp + 0x54], 0x79877f54
mov dword [esp + 0x58], 0x65ec7b93
mov dword [esp + 0x5c], 0x61f76788
mov dword [esp + 0x60], 0x6dff63f9
mov dword [esp + 0x64], 0x69986f4c
mov dword [esp + 0x68], 0x154a6b94
mov dword [esp + 0x6c], 0x11c617c7
mov dword [esp + 0x70], 0x1dc213c6
mov dword [esp + 0x74], 0x193e1fd9
mov dword [esp + 0x78], 0x5f11be1
mov dword [esp + 0x7c], 0x1d80792
mov dword [esp + 0x80], 0xdc703dc
mov dword [esp + 0x84], 0x9960f2c
mov dword [esp + 0x88], 0x35d60bd6
mov dword [esp + 0x8c], 0x3116371f
mov dword [esp + 0x90], 0x3da233f3
mov dword [esp + 0x94], 0x39aa3fac
mov dword [esp + 0x98], 0x25c33bd7
mov dword [esp + 0x9c], 0x21c427cb
mov dword [esp + 0xa0], 0x2dc923d5
mov dword [esp + 0xa4], 0x29ff2fb0
mov dword [esp + 0xa8], 0xd5f72bf7
mov dword [esp + 0xac], 0xd100d70d
mov dword [esp + 0xb0], 0xdd0cd30d
mov dword [esp + 0xb4], 0xd9f6dffc
mov dword [esp + 0xb8], 0xc512db2d
mov dword [esp + 0xbc], 0xc131c738
mov dword [esp + 0xc0], 0xcd16c334
mov dword [esp + 0xc4], 0xc95acfec
mov dword [esp + 0xc8], 0xf55fcb23
mov dword [esp + 0xcc], 0xf1d6f71b
mov dword [esp + 0xd0], 0xfd1df339
mov dword [esp + 0xd4], 0xf96bff11
mov dword [esp + 0xd8], 0xe5d1fb69
mov dword [esp + 0xdc], 0xe12be7c4
mov dword [esp + 0xe0], 0xed70e308
mov dword [esp + 0xe4], 0xe979ef7d
mov dword [esp + 0xe8], 0x953beb07
mov dword [esp + 0xec], 0x91459747
mov dword [esp + 0xf0], 0x9d44934b
mov dword [esp + 0xf4], 0x99489f4c
mov dword [esp + 0xf8], 0x854c9b48
mov dword [esp + 0xfc], 0x81a68754
mov dword [esp + 0x100], 0x8d61837d
mov dword [esp + 0x104], 0x896d8f62
mov dword [esp + 0x108], 0xb5618b1a
mov dword [esp + 0x10c], 0xb169b765
mov dword [esp + 0x110], 0xbd6bb36d
mov dword [esp + 0x114], 0xb963bf6a
mov dword [esp + 0x118], 0xa5babb66
mov word [esp + 0x11c], 0
mov eax, dword [0x44baf8]
mov ecx, 0x39cb0c91
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x39cb0c55]
xor edx, ecx
mov esi, edx
and esi, 1
or edx, 1
add edx, esi
add dl, 0x2a
mov byte [esp + ecx - 0x39cb0c55], dl
inc ecx
cmp ecx, 0x39cb0d73
jne 0x40ba30
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
xor ecx, ecx
mov dword [esp + 8], eax
test eax, eax
setne cl
mov eax, dword [ecx*4 + 0x445b6c]
mov ecx, 0x3bf147d8
xor ecx, dword [0x445b74]
add eax, ecx
inc eax
jmp eax
Function at 0x418750
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + eax], 0
lea eax, [eax + 2]
jne 0x418770
lea ecx, [eax + ebp]
add ecx, 0xfffffffe
add eax, ebp
mov edx, 1
sub edx, eax
and edx, ebp
mov edi, ebp
not edi
and edi, ecx
sub edi, edx
mov esi, dword [esi + 4]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + ecx], 0
lea ecx, [ecx + 2]
jne 0x4187a0
sar edi, 1
lea edx, [esi + ecx]
add edx, 0xfffffffe
mov eax, esi
not eax
and eax, edx
add ecx, esi
mov edx, 1
sub edx, ecx
and edx, esi
sub eax, edx
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x4187d8
mov eax, 0xffffffff
jmp 0x4187e1
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.00408220
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x418811
add esi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x418800
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0x418841
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418830
mov word [eax], 0
lea eax, [esp + 0xc]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043fca0
add esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x14], ebx
jmp dword [eax*4 + 0x446204]
Function at 0x418b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x430
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x418b30
sar esi, 1
lea edi, [esp + 0x84]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x44ce4c]
mov dword [esp + 0x110], 0x713e3f19
mov word [esp + 0x114], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xf5
xor dl, byte [esp + ecx + 0x110]
add dl, 0x37
mov byte [esp + ecx + 0x110], dl
inc ecx
cmp ecx, 6
jne case.default.0x418b9a
xor ecx, ecx
cmp eax, dword [esp + 0x110]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4466b4]
mov ebx, dword [esp + 0x84]
test ebx, ebx
jns 0x418bb3
mov eax, 0xffffffff
jmp 0x418bb6
lea eax, [ebx + ebx]
push eax
call fcn.00408220
add esp, 4
push edi
push ebx
mov edi, eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44ce4c]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4466bc]
xor eax, eax
jmp dword [0x4466c4]
push edi
jmp 0x41c7dd
mov eax, dword [esp + 0x84]
mov ecx, eax
add ecx, 0xd
jns 0x418c02
mov eax, 0xffffffff
jmp 0x418c09
lea eax, [eax*2 + 0x1a]
push eax
call fcn.00408220
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x110], 0x63de61cc
mov dword [esp + 0x114], 0x67f565c5
mov dword [esp + 0x118], 0x5bba59cc
mov dword [esp + 0x11c], 0x5ffb5dea
mov dword [esp + 0x120], 0x53c151c2
mov dword [esp + 0x124], 0x57c955cd
mov dword [esp + 0x128], 0x4b4a49d6
mov word [esp + 0x12c], 0
xor ecx, ecx
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x110]
mov edx, 0x67
sub edx, ecx
mov ebx, esi
not ebx
or ebx, edx
mov edx, 0x39fcd567
sub edx, ecx
or edx, esi
add esi, ebx
inc esi
not edx
or edx, esi
lea esi, [edx + edx]
and esi, 0x43e0560e
sub edx, esi
add edx, 0x21f02b07
mov ebx, edx
and ebx, esi
xor edx, esi
lea edx, [edx + ebx*2]
inc dl
mov byte [esp + ecx + 0x110], dl
mov edx, ecx
xor eax, 1
add eax, ecx
and ecx, 1
and edx, 0x1e
sub eax, edx
add eax, ecx
mov ecx, eax
cmp eax, 0x1e
jb 0x418c80
movzx ecx, word [edi]
mov esi, dword [esp + 4]
mov eax, esi
test cx, cx
je 0x418d11
lea edx, [edi + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418d00
mov word [eax], 0
movzx ecx, word [esp + 0x110]
test cx, cx
je 0x418d43
mov dword [esp + 0x28], edi
lea edx, [esp + 0x112]
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418d30
jmp 0x418d47
mov dword [esp + 0x28], edi
mov word [eax], 0
lea eax, [esp + 0x2a8]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043fca0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4466cc]
jmp dword [0x446704]
call fcn.00408230
add esp, 4
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x418ba1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x430
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x418b30
sar esi, 1
lea edi, [esp + 0x84]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x44ce4c]
mov dword [esp + 0x110], 0x713e3f19
mov word [esp + 0x114], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xf5
xor dl, byte [esp + ecx + 0x110]
add dl, 0x37
mov byte [esp + ecx + 0x110], dl
inc ecx
cmp ecx, 6
jne case.default.0x418b9a
xor ecx, ecx
cmp eax, dword [esp + 0x110]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4466b4]
mov ebx, dword [esp + 0x84]
test ebx, ebx
jns 0x418bb3
mov eax, 0xffffffff
jmp 0x418bb6
lea eax, [ebx + ebx]
push eax
call fcn.00408220
add esp, 4
push edi
push ebx
mov edi, eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44ce4c]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4466bc]
xor eax, eax
jmp dword [0x4466c4]
push edi
jmp 0x41c7dd
mov eax, dword [esp + 0x84]
mov ecx, eax
add ecx, 0xd
jns 0x418c02
mov eax, 0xffffffff
jmp 0x418c09
lea eax, [eax*2 + 0x1a]
push eax
call fcn.00408220
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x110], 0x63de61cc
mov dword [esp + 0x114], 0x67f565c5
mov dword [esp + 0x118], 0x5bba59cc
mov dword [esp + 0x11c], 0x5ffb5dea
mov dword [esp + 0x120], 0x53c151c2
mov dword [esp + 0x124], 0x57c955cd
mov dword [esp + 0x128], 0x4b4a49d6
mov word [esp + 0x12c], 0
xor ecx, ecx
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x110]
mov edx, 0x67
sub edx, ecx
mov ebx, esi
not ebx
or ebx, edx
mov edx, 0x39fcd567
sub edx, ecx
or edx, esi
add esi, ebx
inc esi
not edx
or edx, esi
lea esi, [edx + edx]
and esi, 0x43e0560e
sub edx, esi
add edx, 0x21f02b07
mov ebx, edx
and ebx, esi
xor edx, esi
lea edx, [edx + ebx*2]
inc dl
mov byte [esp + ecx + 0x110], dl
mov edx, ecx
xor eax, 1
add eax, ecx
and ecx, 1
and edx, 0x1e
sub eax, edx
add eax, ecx
mov ecx, eax
cmp eax, 0x1e
jb 0x418c80
movzx ecx, word [edi]
mov esi, dword [esp + 4]
mov eax, esi
test cx, cx
je 0x418d11
lea edx, [edi + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418d00
mov word [eax], 0
movzx ecx, word [esp + 0x110]
test cx, cx
je 0x418d43
mov dword [esp + 0x28], edi
lea edx, [esp + 0x112]
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418d30
jmp 0x418d47
mov dword [esp + 0x28], edi
mov word [eax], 0
lea eax, [esp + 0x2a8]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043fca0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4466cc]
jmp dword [0x446704]
call fcn.00408230
add esp, 4
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41cf20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x198
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [esp], 0x1ec0735
mov dword [esp + 4], 0xdf303fd
mov dword [esp + 8], 0x90e0ffa
mov word [esp + 0xc], 0
mov eax, 0x739b88c1
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x739b88c1]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x3b
mov byte [esp + eax - 0x739b88c1], cl
inc eax
cmp eax, 0x739b88cf
jne 0x41cf60
mov dword [esp + 0x2c], 0xd9aedbbc
mov dword [esp + 0x30], 0xddaedfac
mov dword [esp + 0x34], 0xd1e3d392
mov dword [esp + 0x38], 0xd5aad7e1
mov dword [esp + 0x3c], 0xe98feba5
mov dword [esp + 0x40], 0xed92ef8f
mov dword [esp + 0x44], 0xe193e394
mov dword [esp + 0x48], 0xe592e795
mov dword [esp + 0x4c], 0xf9fafbaa
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x2c]
mov edx, eax
and edx, 0x31
xor edx, 0xd0c24131
mov ecx, eax
and ecx, 0xe
sub ecx, edx
mov edx, esi
not edx
or edx, 0x681084b4
add edx, esi
inc edx
and esi, 0x4b
xor esi, 0x97ef7b4b
or edx, esi
mov esi, ecx
not esi
or esi, 0x681084b4
add esi, ecx
inc esi
and ecx, 0x14b
xor ecx, 0x90c2414b
or esi, ecx
xor esi, edx
mov ecx, esi
not ecx
or ecx, 0x74
add ecx, esi
add ecx, ecx
xor esi, 0xb
sub ecx, esi
add cl, 2
mov byte [esp + eax + 0x2c], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x24
jb 0x41cfe0
movzx ecx, word [esp + 0x2c]
lea eax, [esp + 0x154]
test cx, cx
je 0x41d081
lea edx, [esp + 0x2e]
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d070
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0x41d0b1
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d0a0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41d0e1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d0d0
mov word [eax], 0
mov edi, dword [ebx]
mov dword [esp + 0x2c], 0xbda0a05a
mov byte [esp + 0x30], 0x58
mov dword [esp + 0x31], 0
mov eax, 0x8f
mov ecx, 0x70
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x63]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0x35
mov byte [esp + eax - 0x63], dl
inc eax
dec ecx
cmp eax, 0x98
jne 0x41d110
movzx eax, byte [esp + 0x2c]
test al, al
je 0x41d14b
lea ecx, [esp + 0x2d]
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41d140
mov byte [edi], 0
lea eax, [esp + 0x13c]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x154]
push eax
push ecx
push edx
call fcn.0040b0b0
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x446a14]
mov ecx, 0xba959313
xor ecx, dword [0x446a1c]
add eax, ecx
inc eax
jmp eax
Function at 0x420940
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x420950
sar ebp, 1
lea esi, [esp + 0x1c]
push esi
push 0
push 0
push ebp
push edi
push 0
call dword [0x44ce4c]
mov dword [esp + 8], 0xf18e8fa9
mov byte [esp + 0xc], 0
xor ecx, ecx
nop
mov edx, ecx
add dl, 0x5d
xor dl, byte [esp + ecx + 8]
add dl, 0x2f
mov byte [esp + ecx + 8], dl
mov edx, ecx
xor edx, 0xfffffffe
or ecx, 1
and edx, ecx
add ecx, edx
cmp ecx, 5
jb case.default.0x4209ac
xor ecx, ecx
cmp eax, dword [esp + 8]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x446d34]
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jns 0x4209c2
mov eax, 0xffffffff
jmp 0x4209c5
lea eax, [ebx + ebx]
push eax
call fcn.00408220
add esp, 4
push esi
mov esi, eax
push ebx
push eax
push ebp
push edi
push 0
call dword [0x44ce4c]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446d3c]
jmp dword [0x446d44]
push esi
call fcn.00408230
add esp, 4
nop
nop
nop
nop
nop
nop
nop
nop
xor ebx, ebx
jmp dword [0x446d58]
lea edi, [esp + 8]
push edi
push esi
call fcn.0043fe50
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446d5c]
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4209b3
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x420950
sar ebp, 1
lea esi, [esp + 0x1c]
push esi
push 0
push 0
push ebp
push edi
push 0
call dword [0x44ce4c]
mov dword [esp + 8], 0xf18e8fa9
mov byte [esp + 0xc], 0
xor ecx, ecx
nop
mov edx, ecx
add dl, 0x5d
xor dl, byte [esp + ecx + 8]
add dl, 0x2f
mov byte [esp + ecx + 8], dl
mov edx, ecx
xor edx, 0xfffffffe
or ecx, 1
and edx, ecx
add ecx, edx
cmp ecx, 5
jb case.default.0x4209ac
xor ecx, ecx
cmp eax, dword [esp + 8]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x446d34]
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jns 0x4209c2
mov eax, 0xffffffff
jmp 0x4209c5
lea eax, [ebx + ebx]
push eax
call fcn.00408220
add esp, 4
push esi
mov esi, eax
push ebx
push eax
push ebp
push edi
push 0
call dword [0x44ce4c]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446d3c]
jmp dword [0x446d44]
push esi
call fcn.00408230
add esp, 4
nop
nop
nop
nop
nop
nop
nop
nop
xor ebx, ebx
jmp dword [0x446d58]
lea edi, [esp + 8]
push edi
push esi
call fcn.0043fe50
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446d5c]
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422670
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x422680
cmp eax, 0xffffffed
jge 0x422697
mov eax, 0xffffffff
jmp 0x42269a
add eax, 0x12
push eax
call fcn.00408220
add esp, 4
mov esi, eax
mov dword [esp], 0x77c179dc
mov dword [esp + 4], 0x73fb75c9
mov dword [esp + 8], 0x4fbc71bc
mov dword [esp + 0xc], 0x4bf44df0
mov word [esp + 0x10], 0x4948
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
mov eax, 0x78c0c717
mov ecx, 0xe9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x78c0c717]
mov ebx, ecx
and ebx, edx
not edx
or edx, ecx
add edx, eax
or edx, ebx
mov ebx, edx
not ebx
or ebx, 0x11
add ebx, edx
xor edx, 0x91
lea edx, [edx + ebx*2]
add dl, 3
mov byte [esp + eax - 0x78c0c717], dl
inc eax
dec ecx
cmp eax, 0x78c0c72e
jne 0x4226f0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x422751
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x422740
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x422781
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x422770
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043fe50
add esp, 8
mov ebx, dword [esp]
mov edi, eax
jmp dword [0x446e14]
Function at 0x42bb70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x42bbca
cmp edi, 1
je 0x42bbca
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x42bba1
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x42bba0
cmp ecx, 0x20
je 0x42bba0
cmp ecx, 0x2b
mov edx, edi
je 0x42bbc0
cmp ecx, 0x2d
jne 0x42bbdf
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x42bbe4
xor edi, edi
test eax, eax
je 0x42bd9d
mov dword [eax], 0x16
jmp 0x42bd9d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42bc0d
cmp edx, 0x10
jne 0x42bc25
cmp byte [ebx], 0x30
jne 0x42bc06
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x42bc27
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x42bc27
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x42bc80
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x42bd38
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x42bca7
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x42bd68
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x42bd68
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x42bc60
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x42bcf0
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x42bcf9
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x42bd1d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x42bd4d
test bl, bl
jne 0x42bd4d
mov ebx, dword [esp + 0x10]
jmp 0x42bc73
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x42bc55
mov esi, edi
test bl, bl
jne 0x42bd5b
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x42bc55
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42bd76
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x42bd84
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x42bd94
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x42bd9d
cmp byte [esp + 3], 0
jne 0x42bd9d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42bdb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, edx
mov edi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov ebx, 0xffffffff
nop
nop
nop
cmp byte [ebp + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x42bdd0
lea esi, [ebx + 1]
push esi
call fcn.00408220
add esp, 4
mov dword [esp + 4], edi
mov dword [edi], eax
mov ecx, esi
shr ecx, 2
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, esi
and edx, 0xfffffffc
add eax, edx
add edx, ebp
mov dword [esp], esi
mov ecx, esi
shr ecx, 1
and ecx, 1
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
jne 0x42be33
mov esi, dword [esp]
and esi, 2
movzx ecx, byte [edx + esi]
mov byte [eax + esi], cl
test ebx, ebx
je 0x42bee4
neg ebx
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp]
xor eax, edx
mov edx, eax
shr edx, 1
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov esi, ecx
shr esi, 1
mov edx, eax
shl edx, 0x1e
sar edx, 0x1f
and edx, 0xedb88320
xor edx, esi
mov edi, eax
shl edi, 0x1d
sar edi, 0x1f
and edi, 0x76dc419
mov esi, eax
shl esi, 0x1c
sar esi, 0x1f
and esi, 0xedb8832
xor esi, edi
mov edi, eax
shl edi, 0x1b
sar edi, 0x1f
and edi, 0x1db71064
shl eax, 0x1a
sar eax, 0x1f
and eax, 0x3b6e20c8
xor eax, edi
xor eax, esi
mov esi, edx
shr esi, 6
xor eax, esi
shl ecx, 0x1a
sar ecx, 0x1f
and ecx, 0x76dc4190
xor ecx, eax
shl edx, 0x1a
sar edx, 0x1f
and edx, 0xedb88320
xor edx, ecx
inc ebp
inc ebx
jne 0x42be40
not edx
mov eax, dword [esp + 4]
mov dword [eax + 4], edx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor edx, edx
jmp 0x42bed5
Function at 0x42ee70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx ecx, word [esi]
test cx, cx
je 0x42efb1
mov eax, dword [esp + 0x18]
mov edx, eax
not edx
lea edx, [edx + eax*2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test edx, edx
je 0x42efb1
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x42eec0
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x42ef60
cmp ebx, 0x7ff
ja 0x42eef0
cmp edx, 2
jb 0x42eef0
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
lea eax, [ebp + 2]
jmp 0x42ef60
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x42ef76
cmp edx, 4
jb 0x42ef76
movzx edi, word [esi + 2]
add esi, 4
mov eax, ebx
xor eax, 0xd800
and ebx, 0x27ff
add ebx, ebx
sub ebx, eax
shl ebx, 0xa
lea ecx, [ebx + edi]
add ecx, 0xffff2400
lea eax, [ebx + edi]
add eax, 0x2400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 2], cl
mov eax, edi
and al, 0x3f
or al, 0x80
mov ecx, eax
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
jne 0x42eea0
jmp 0x42efb1
movzx eax, ax
cmp eax, 0xdc00
jne 0x42ef84
mov esi, edi
jmp 0x42ef68
cmp edx, 3
jb 0x42efad
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
lea eax, [ebp + 3]
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 2], bl
jmp 0x42ef60
mov eax, ebp
jmp 0x42ef60
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret