joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405de0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405fca
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405fca
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405fca
cmp dword [ecx], 0
jne 0x405fca
push esi
call fcn.0040cea0
add esp, 4
test eax, eax
je 0x405e4a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405e51
inc ebx
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
mov ecx, edi
cmp eax, ebx
jne 0x405e30
jmp 0x405e53
mov edi, 0x1505
jmp 0x405e53
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x405f24
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405eb1
call fcn.00406090
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405fca
push esi
call fcn.0040cea0
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405fe0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040cea0
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x444004]
add esp, 4
test eax, eax
je 0x405fc5
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040ccb0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405fca
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405f48
inc ebx
dec edx
je 0x405e6c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405e71
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405f40
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040cea0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405f40
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040cec0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405f40
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404eb0
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405f19
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407060
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4071f6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4071ef
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x4070f5
mov eax, dword [esp]
sub eax, dword [esp + 0xc]
add ebp, eax
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x4071ef
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 4], esi
jb 0x40717c
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
mov esi, edi
and esi, eax
xor edi, eax
lea eax, [edi + esi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
mov esi, ecx
and esi, eax
xor ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea ecx, [ecx + esi*2]
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x407110
add ebp, eax
mov esi, dword [esp + 4]
mov eax, ebx
sub eax, edx
jae 0x4070bd
mov dword [esp + 8], eax
mov esi, edx
and esi, 3
mov dword [esp + 0xc], ebx
mov eax, ebx
mov edx, ebp
je 0x4071ac
nop
nop
nop
nop
nop
nop
nop
inc eax
movzx ebx, byte [edx]
add edi, ebx
add ecx, edi
inc edx
dec esi
jne 0x4071a0
cmp dword [esp + 8], 0xfffffffc
ja 0x4070b0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x4071c0
jmp 0x4070b0
shl ecx, 0x10
or ecx, edi
jmp 0x4071fb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x407210
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x407276
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x407278
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
mov eax, dword [eax*4 + 0x441c50]
mov ebp, eax
and ebp, ebx
add ebx, eax
add ebp, ebp
sub ebx, ebp
mov eax, ebx
shr eax, 4
mov ebp, ebx
xor ebp, 0x3ffffff0
or ebx, 0xf
and ebx, ebp
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x441c50]
inc esi
cmp edx, esi
jne 0x407230
not eax
jmp 0x407278
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d400
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push eax
call fcn.0043a040
test al, al
je 0x40d478
call fcn.00432aa0
test al, al
je 0x40d473
mov dword [esp], 0x89a16659
mov eax, 0x9b2f5ba0
nop
movzx ecx, byte [esp + eax + 0x64d0a460]
xor ecx, eax
mov edx, ecx
xor edx, 0xde
and ecx, 0x5e
lea ecx, [edx + ecx*2]
add cl, 2
mov byte [esp + eax + 0x64d0a460], cl
inc eax
cmp eax, 0x9b2f5ba4
jne 0x40d420
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40d460
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e490
test al, al
je 0x40d473
call fcn.00410bd0
call fcn.0040fb90
call fcn.0043b530
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40d540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx ecx, word [esi]
lea ebp, [esp + 4]
test cx, cx
je 0x40d697
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx eax, cx
lea edi, [esi + 2]
cmp ax, 0x7f
ja 0x40d590
lea ecx, [ebp + 1]
mov byte [ebp], al
jmp 0x40d640
cmp eax, 0x7ff
ja 0x40d5c0
cmp edx, 2
jb 0x40d5c0
mov ecx, eax
shr ecx, 6
add cl, 0xc0
mov byte [ebp], cl
mov ebx, eax
not ebx
or ebx, 0x3f
add ebx, eax
add bl, 0x81
lea ecx, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x40d640
mov ecx, eax
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x40d65a
cmp edx, 4
jb 0x40d65a
movzx edi, word [esi + 2]
mov ecx, eax
not ecx
and ecx, 0xd800
and eax, 0x27ff
sub eax, ecx
shl eax, 0xa
lea ecx, [eax + edi]
add ecx, 0xffff2400
lea ebx, [eax + edi]
add ebx, 0x2400
mov eax, ebx
shr eax, 0x12
add al, 0xf0
mov byte [ebp], al
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 2], cl
mov al, 0x3f
mov ecx, edi
sub al, cl
and al, 0x3f
xor al, 0xbf
mov byte [ebp + 3], al
lea ecx, [ebp + 4]
add esi, 4
mov edi, esi
nop
nop
add edx, ebp
sub edx, ecx
mov esi, edi
mov ebp, ecx
movzx ecx, word [esi]
test cx, cx
je 0x40d697
test edx, edx
jne 0x40d570
jmp 0x40d697
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x40d669
mov esi, edi
jmp 0x40d648
cmp edx, 3
jb 0x40d693
mov ecx, eax
shr ecx, 0xc
or cl, 0xe0
mov byte [ebp], cl
mov ecx, eax
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 1], cl
and al, 0x3f
or al, 0x80
lea ecx, [ebp + 3]
mov byte [ebp + 2], al
jmp 0x40d640
mov ecx, ebp
jmp 0x40d640
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ebp], 0
xor eax, eax
jmp 0x40d6b8
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x40d6b0
test ecx, ecx
je 0x40d6cc
mov ebx, ecx
jmp 0x40d6b0
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.004092b0
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40e490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
push eax
sub esp, 0x7c
mov dword [ebp - 0x1c], esp
sub esp, 0x100
mov eax, esp
mov dword [ebp - 0x20], eax
mov ebx, eax
push eax
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x34], esp
sub esp, 0x70
mov dword [ebp - 0x14], esp
sub esp, 0x24
mov esi, esp
sub esp, 0xc
mov dword [ebp - 0x18], esp
sub esp, 0x40
mov dword [ebp - 0x28], esp
sub esp, 0x80
mov dword [ebp - 0x38], esp
mov eax, dword [0x449d18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], 0x717e677c
mov ecx, 0x95
mov edi, 0x6a
nop
nop
movzx eax, byte [ebp + ecx - 0xc5]
mov edx, edi
xor edx, ecx
and edx, eax
xor edx, ecx
add dl, 0x17
mov byte [ebp + ecx - 0xc5], dl
inc ecx
dec edi
cmp ecx, 0x99
jne 0x40e4f0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x54], 0x219d27ad
mov dword [ebp - 0x50], 0x3d9a2396
mov dword [ebp - 0x4c], 0x39b23fb0
mov dword [ebp - 0x48], 0x354c3b88
mov dword [ebp - 0x44], 0x31823788
mov dword [ebp - 0x40], 0xd323384
mov dword [ebp - 0x3c], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
mov eax, edx
add al, 0x89
xor al, byte [ebp + edx - 0x54]
add al, 0x53
mov byte [ebp + edx - 0x54], al
inc edx
cmp edx, 0x1c
jne case.default.0x40e591
lea eax, [ebp - 0x54]
push ecx
push 0
push eax
call dword [ebp - 0x10]
mov ecx, 0x449ce0
push eax
call fcn.00439ce0
movzx eax, al
mov eax, dword [eax*4 + 0x444a38]
mov ecx, 0x7a5a2e15
xor ecx, dword [0x444a40]
add eax, ecx
inc eax
jmp eax
xor ebp, dword [ebp + 0x202444c7]
cmp dword [edi + 0x44c7514b], ebp
scasd eax, dword es:[edi]
dec ebx
push ecx
mov dword [esp + 0x24], 0x55bd53c1
scasd eax, dword es:[edi]
dec ebx
push ecx
mov dword [esp + 0x24], 0x55bd53c1
mov dword [esp + 0x28], 0x59c157bb
mov dword [esp + 0x2c], 0x5db15bb6
mov dword [esp + 0x30], 0x41bd5fb9
mov dword [esp + 0x34], 0x45a943d4
mov dword [esp + 0x38], 0x49a847d5
mov dword [esp + 0x3c], 0x4da94bdd
mov dword [esp + 0x40], 0x71de4fdc
mov dword [esp + 0x44], 0x755873e5
mov word [esp + 0x48], 0x7774
mov byte [esp + 0x4e], 0
mov dword [esp + 0x4a], 0
mov eax, 0xee40205d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x11bfdfa3]
xor ecx, eax
mov edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
add cl, 0x2e
mov byte [esp + eax + 0x11bfdfa3], cl
inc eax
cmp eax, 0xee4020ac
jne 0x421f00
lea eax, [esp + 0x54]
push eax
push 0x423ac0
lea eax, [esp + 8]
push eax
push edi
call fcn.0041fdf0
add esp, 0x10
mov ebx, eax
jmp dword [0x4464a0]
Function at 0x40ee30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40f09b
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40ee6c
cmp edx, esi
jae 0x40f09b
test edi, edi
je 0x40f09b
movzx ebp, bl
test bl, bl
js 0x40eea0
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40ee60
jmp 0x40f09b
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40eed8
cmp bl, 0xc2
jb 0x40ee90
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40ef3a
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40ef90
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40ef02
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40ef44
cmp ebp, 0xe0
jne 0x40ef4d
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40ee8c
jmp 0x40ef4d
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40f076
cmp bl, 0xf4
ja 0x40ee90
movzx ecx, byte [edx + 1]
je 0x40ef9b
cmp ebp, 0xf0
jne 0x40efa4
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40ee8c
jmp 0x40efa4
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40ee92
cmp cl, 0x9f
ja 0x40ee8c
mov esi, ecx
not esi
or esi, 0xc0
add esi, ecx
cmp esi, 0x7f
jne 0x40f07d
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f083
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40ee82
cmp cl, 0x8f
ja 0x40ee8c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f07d
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f083
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f08f
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
shl ebp, 6
lea esi, [ecx + ebp]
add esi, 0xffffe000
add edx, 4
and esi, 0x1ff800
cmp esi, 0xd800
je 0x40ee8c
add ebp, ecx
mov ecx, dword [esp]
and ecx, 0x3f
lea ebx, [ecx + ebp]
add ebx, 0xffffe000
cmp ebx, 0x10000
jb 0x40ee8c
cmp edi, 2
jb 0x40f076
mov ecx, ebx
xor ecx, 0x10000
and ebx, 0x1feffff
add ebx, ebx
sub ebx, ecx
mov ecx, ebx
shr ecx, 0xa
and ecx, 0x3ff
or ecx, 0xd800
mov word [eax], cx
and ebx, 0x3ff
or ebx, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bx
jmp 0x40ee82
mov ecx, eax
jmp 0x40ee82
inc edx
jmp 0x40ee8c
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40ee92
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40ee92
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x140
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0x3c
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x44], 0xffffffff
xor edi, edi
mov ecx, dword [0x449cf4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edi], 0
lea edi, [edi + 2]
jne case.default.0x40f626
lea ebx, [eax + edi]
add ebx, 0xfffffffe
mov edx, eax
not edx
and edx, ebx
add edi, eax
mov ebx, 1
sub ebx, edi
and ebx, eax
sub edx, ebx
sar edx, 1
lea edi, [esi + 0x14]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x444d5c]
jmp dword [0x444d70]
Function at 0x410490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0x31cf3fe3
mov dword [esp + 0x40], 0x35c933ba
mov dword [esp + 0x44], 0xc9ca37c8
mov dword [esp + 0x48], 0xcdfbcb2b
mov dword [esp + 0x4c], 0xc1f0cffb
mov dword [esp + 0x50], 0xc5e2c3f0
mov dword [esp + 0x54], 0xd92fc7fc
mov dword [esp + 0x58], 0xdd24db23
mov dword [esp + 0x5c], 0xd12fdf38
mov dword [esp + 0x60], 0xd527d359
mov dword [esp + 0x64], 0xe908d7f4
mov dword [esp + 0x68], 0xedcaeb3c
mov dword [esp + 0x6c], 0xe1deefdf
mov dword [esp + 0x70], 0xe5d2e3de
mov dword [esp + 0x74], 0xf9c6e729
mov dword [esp + 0x78], 0xfd01fb11
mov dword [esp + 0x7c], 0xf1c8ff02
mov dword [esp + 0x80], 0xf53ff3c4
mov dword [esp + 0x84], 0x897ef7d4
mov dword [esp + 0x88], 0x8dbe8bbe
mov dword [esp + 0x8c], 0x81ae8fb7
mov dword [esp + 0x90], 0x85728343
mov dword [esp + 0x94], 0x997a8774
mov dword [esp + 0x98], 0x9d739b7f
mov dword [esp + 0x9c], 0x917c9f7b
mov dword [esp + 0xa0], 0x9569934d
mov dword [esp + 0xa4], 0xa9a79760
mov dword [esp + 0xa8], 0xad9fab9f
mov dword [esp + 0xac], 0xa190af65
mov dword [esp + 0xb0], 0xa594a395
mov dword [esp + 0xb4], 0xb99ea784
mov dword [esp + 0xb8], 0xbd62bb65
mov dword [esp + 0xbc], 0xb161bf68
mov dword [esp + 0xc0], 0xb58eb36c
mov dword [esp + 0xc4], 0x494ab794
mov dword [esp + 0xc8], 0x4db74bb3
mov dword [esp + 0xcc], 0x416e4fab
mov dword [esp + 0xd0], 0x45a54399
mov dword [esp + 0xd4], 0x59bb47a1
mov dword [esp + 0xd8], 0x5d615ba9
mov dword [esp + 0xdc], 0x519b5f7c
mov dword [esp + 0xe0], 0x55a053a8
mov dword [esp + 0xe4], 0x69a957a5
mov dword [esp + 0xe8], 0x6d5b6b8f
mov dword [esp + 0xec], 0x615d6f5f
mov dword [esp + 0xf0], 0x655c63ab
mov dword [esp + 0xf4], 0x79586754
mov dword [esp + 0xf8], 0x7d447b48
mov dword [esp + 0xfc], 0x715e7f4c
mov dword [esp + 0x100], 0x759173a5
mov dword [esp + 0x104], 0x9957792
mov dword [esp + 0x108], 0xdf10bfa
mov dword [esp + 0x10c], 0x1390f3d
mov dword [esp + 0x110], 0x5cb0335
mov dword [esp + 0x114], 0x1933073a
mov dword [esp + 0x118], 0x1d1a1b2e
mov dword [esp + 0x11c], 0
mov ebp, dword [0x449ce8]
mov esi, 0x7064cc75
mov edi, 0x8f9b338a
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi - 0x7064cc39]
mov ebx, esi
and ebx, edx
add ebx, ebx
sub ebx, edx
add ebx, edi
and ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xfd
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0xb7
mov byte [esp + esi - 0x7064cc39], al
inc esi
dec edi
cmp esi, 0x7064cd59
jne 0x4106f0
lea edi, [esp + 0x3c]
push 0
push 0
push 0
push 0
push edi
call ebp
mov ebp, eax
xor eax, eax
test ebp, ebp
setne al
mov eax, dword [eax*4 + 0x444fb8]
mov ecx, 0xc6ee6494
xor ecx, dword [0x444fc0]
add eax, ecx
inc eax
jmp eax
Function at 0x417000
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x417020
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x417040
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x417060
mov eax, 0xffffffff
jmp 0x417069
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.0040cc80
add esp, 4
movzx ecx, word [esi]
mov ebx, eax
test cx, cx
je 0x4170a1
add esi, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x417090
mov word [ebx], 0x5c
add ebx, 2
movzx ecx, word [ebp]
test cx, cx
je 0x4170d1
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4170c0
mov word [ebx], 0
mov ecx, esp
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x20], eax
push eax
call fcn.0043f0b0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x445560]
Function at 0x417340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1140
call fcn.0040cbe0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x417360
sar esi, 1
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44b02c]
mov ebx, dword [esp + 0x2c]
mov edi, 0xffffffff
test ebx, ebx
jns 0x417394
mov eax, 0xffffffff
jmp 0x417397
lea eax, [ebx + ebx]
push eax
call fcn.0040cc80
add esp, 4
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov dword [esp + 0x30], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44b02c]
mov eax, dword [esp + 0x2c]
mov ecx, eax
add ecx, 0xd
js 0x4173cc
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040cc80
add esp, 4
mov edi, eax
mov dword [esp + 0x13c], 0x77c209ac
mov dword [esp + 0x140], 0x73ed75d5
mov dword [esp + 0x144], 0x7f1e71ec
mov dword [esp + 0x148], 0x7bd77dc6
mov dword [esp + 0x14c], 0x67f979e6
mov dword [esp + 0x150], 0x63f165cd
mov dword [esp + 0x154], 0x6f6e61f2
mov word [esp + 0x158], 0
xor ecx, ecx
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x13c]
lea ebx, [ecx + 0x3e]
mov edx, 0xc1
sub edx, ecx
xor edx, ebx
and edx, esi
xor edx, ebx
add dl, 0xca
mov byte [esp + ecx + 0x13c], dl
mov edx, ecx
xor eax, 1
add eax, ecx
and ecx, 1
and edx, 0x1e
add eax, ecx
sub eax, edx
mov ecx, eax
cmp eax, 0x1e
jb 0x417440
mov edx, dword [esp + 0x28]
movzx ecx, word [edx]
mov eax, edi
test cx, cx
je 0x4174a1
add edx, 2
mov eax, edi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417490
mov word [eax], 0
movzx ecx, word [esp + 0x13c]
test cx, cx
je 0x4174d1
lea edx, [esp + 0x13e]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4174c0
mov word [eax], 0
lea eax, [esp + 0xb0]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.0043f0b0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x445960]
Function at 0x41f840
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41f850
cmp eax, 0xffffffed
jge 0x41f867
mov eax, 0xffffffff
jmp 0x41f86a
add eax, 0x12
push eax
call fcn.0040cc80
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp], 0x77c179dc
mov dword [esp + 4], 0x73fb75c9
mov dword [esp + 8], 0x4fbc71bc
mov dword [esp + 0xc], 0x4bf44df0
mov word [esp + 0x10], 0x4948
mov dword [esp + 0x12], 0
mov word [esp + 0x16], 0
xor ebp, ebp
xor ecx, ecx
movzx esi, byte [esp + ecx]
mov eax, ebp
and eax, 0x2c
mov ebx, ecx
xor ebx, 0xd5a04796
add ebx, eax
mov edx, esi
and edx, ebx
add edx, edx
mov eax, edx
not eax
and eax, ebx
not ebx
and ebx, edx
sub eax, ebx
mov edx, esi
add al, dl
add al, 0x12
mov byte [esp + ecx], al
inc ecx
add ebp, 2
cmp ecx, 0x18
jne 0x41f8b0
movzx ecx, word [edi]
mov esi, dword [esp + 0x18]
mov eax, esi
test cx, cx
je 0x41f911
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41f900
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41f941
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41f930
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043f260
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x445f04]