joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445d60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x445ddd
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp + 8]
push eax
push 0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x445ddd
cmp dword [ebp + 8], 1
jne 0x445ddd
mov eax, dword [ebp - 4]
push esi
inc eax
push 1
push eax
call fcn.004060a0
add esp, 8
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push 0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x445dcc
cmp dword [ebp + 8], 1
jne 0x445dcc
mov eax, dword [ebp - 4]
mov byte [esi + eax], 0
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push esi
call fcn.00406080
add esp, 4
xor eax, eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x445df0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4ba7e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x105
push eax
push 0
push esi
call edi
test eax, eax
jne 0x445e83
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop word [eax + eax]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x445e5f
push dword [ebp - 0x110]
call fcn.00445df0
add esp, 4
push dword [ebp - 0x110]
call ebx
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x105
lea eax, [ebp - 0x10c]
push eax
push 0
push esi
call edi
test eax, eax
je 0x445e30
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00448c15
mov esp, ebp
pop ebp
ret

Function at 0x445ec0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445ed0
sub ecx, edx
mov edx, dword [ebp + 0x10]
lea esi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x445ee0
sub edx, esi
lea eax, [ecx + 5]
add eax, edx
push 1
lea eax, [eax + eax*2]
push eax
call fcn.004060a0
push dword [ebp + 0x10]
mov esi, eax
push dword [ebp + 0xc]
push edi
push esi
call fcn.004458b0
add esp, 0x18
lea eax, [ebp - 4]
push eax
push str.SoftwareSimonTathamPuTTYSshHostKeys
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x445f55
mov edx, dword [ebp + 0x14]
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445f30
sub ecx, edi
lea eax, [ecx + 1]
push eax
push edx
push 1
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.00406080
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4461f0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x44623c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x44622f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x44622f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043fb90
push eax
push dword [ebp + 8]
push str.Unable_to_delete__s:__s
call fcn.00443a10
add esp, 0x10
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xffffffff
xor eax, eax
pop ebp
ret
xor eax, eax
mov edx, 0x80
push 0
cmp ecx, 2
cmove eax, edx
push eax
xor eax, eax
cmp ecx, 2
setne al
xor edx, edx
add eax, 2
cmp ecx, 2
push eax
push 0
mov eax, 3
cmove eax, edx
mov edx, 0x40000000
push eax
mov eax, 0x80000000
cmove eax, edx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp + 0x10]
mov edx, eax
xor eax, eax
cmp edx, 0xffffffff
setne al
mov dword [ecx], edx
pop ebp
ret
Function at 0x4465e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
call fcn.004452a0
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x446610
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x47cab7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047c69e

Function at 0x47cac2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047c828

Function at 0x486a6c
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00486940

Function at 0x48937a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00488d3c
Function at 0x918170
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x40b000]
push edi
jmp 0x91818a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x918191
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x918180
mov eax, 1
add ebx, ebx
jne 0x9181a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9181b4
jne 0x9181d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9181d3
dec eax
add ebx, ebx
jne 0x9181c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x918198
add ebx, ebx
jne 0x9181cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x918225
xor ecx, ecx
sub eax, 3
jb 0x9181eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x91825a
sar eax, 1
mov ebp, eax
jmp 0x9181f6
add ebx, ebx
jne 0x9181f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9181c4
inc ecx
add ebx, ebx
jne 0x918204
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9181c4
add ebx, ebx
jne 0x918211
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x918206
jne 0x918222
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x918206
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x918244
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x918236
jmp 0x918186
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x918244
add edi, ecx
jmp 0x918186
pop esi
mov edi, esi
mov ecx, 0x250b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x918262
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x918267
lea edi, [esi + 0x516000]
mov eax, dword [edi]
or eax, eax
je 0x9182d8
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5187ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5187e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x91828d
mov ecx, edi
jns 0x9182bc
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5187f0]
or eax, eax
je 0x9182d2
mov dword [ebx], eax
add ebx, 4
jmp 0x9182aa
call dword [esi + 0x5187ec]
mov ebp, dword [esi + 0x5187f4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x91830c
sub esp, 0xffffff80
jmp 0x401310
Function at 0x419ec44
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x419ed87
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [sym.imp.adortl60.bpl__Adodb_TADOQuery_]
call sub.adortl60.bpl__Adodb_TADOQuery__bctr_qqrp18Classes_TComponent
mov dword [ebp - 4], eax
call sub.VEDatasets.bpl__Vedataset_Connection_qqrv
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x268]
xor eax, eax
push ebp
push 0x419ed6a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
call sub.VEDatasets.bpl__Vedataset_FirmaNo_qqrv
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x419ed9c
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
mov edx, 0x419ede4
mov eax, dword [ebp - 4]
call sub.dbrtl60.bpl__Db_TDataSet_FieldByName_qqrx17System_AnsiString
mov edx, dword [eax]
call dword [edx + 0x84]
test al, al
je 0x419ecf3
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], 0x40000000
jmp 0x419ed08
mov edx, 0x419ede4
mov eax, dword [ebp - 4]
call sub.dbrtl60.bpl__Db_TDataSet_FieldByName_qqrx17System_AnsiString
mov edx, dword [eax]
call dword [edx + 0x50]
fstp qword [ebx]
wait
mov edx, 0x419edf8
mov eax, dword [ebp - 4]
call sub.dbrtl60.bpl__Db_TDataSet_FieldByName_qqrx17System_AnsiString
mov edx, dword [eax]
call dword [edx + 0x84]
test al, al
je 0x419ed3f
call sub.rtl60.bpl__Sysutils_Now_qqrv
fadd dword [0x419ee00]
call sub.rtl60.bpl__System__TRUNC_qqrv
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
fild qword [ebp - 0x10]
fstp qword [esi]
wait
jmp 0x419ed54
mov edx, 0x419edf8
mov eax, dword [ebp - 4]
call sub.dbrtl60.bpl__Db_TDataSet_FieldByName_qqrx17System_AnsiString
mov edx, dword [eax]
call dword [edx + 0x50]
fstp qword [esi]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419ed71
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System_TObject_Free_qqrv
ret
Function at 0x419f750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x419f804
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx], eax
lea eax, [ebx + 4]
call sub.rtl60.bpl__System__WStrClr_qqrpv
lea eax, [ebx + 8]
call sub.rtl60.bpl__System__WStrClr_qqrpv
lea eax, [ebp - 4]
call fcn.0419a1f4
mov edx, dword [ebp - 4]
lea eax, [ebx + 0xc]
call sub.rtl60.bpl__System__WStrFromLStr_qqrr17System_WideStringx17System_AnsiString
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
xor eax, eax
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
mov byte [ebx + 0x28], 0
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 1
mov byte [ebx + 0x34], 0
lea eax, [ebx + 0x3c]
call sub.rtl60.bpl__System__WStrClr_qqrpv
xor eax, eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], eax
xor eax, eax
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
lea eax, [ebx + 0x38]
call sub.rtl60.bpl__System__WStrClr_qqrpv
mov byte [ebx + 0x58], 0
mov byte [ebx + 0x59], 0
mov byte [ebx + 0x5a], 0
mov byte [ebx + 0x5b], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419f80b
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41a0d48
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x41a0ddf
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.adortl60.bpl__Adodb_TADOQuery_]
call sub.adortl60.bpl__Adodb_TADOQuery__bctr_qqrp18Classes_TComponent
mov ebx, eax
call sub.VEDatasets.bpl__Vedataset_Connection_qqrv
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x268]
lea eax, [ebp - 4]
push eax
call sub.VEDatasets.bpl__Vedataset_FirmaNo_qqrv
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.VEDatasets.bpl__Vedataset_DonemNo_qqrv
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x41a0df8
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a0de6
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x41ac7d8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41ac849
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x41ac860
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
mov al, byte [0x41aca38]
push eax
lea eax, [ebp - 8]
push eax
push ebp
lea eax, [ebp - 0xc]
call fcn.041ac5ec
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebx]
mov edx, 0x41aca44
call sub.rtl60.bpl__Sysutils_StringReplace_qqrx17System_AnsiStringt1t149System__Set_t21Sysutils_SysUtils__54_iuc_0_iuc_1_
mov edx, dword [ebp - 8]
mov eax, ebx
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ac850
lea eax, [ebp - 0xc]
mov edx, 2
call sub.rtl60.bpl__System__LStrArrayClr_qqrpvi
ret

Function at 0x41b9880
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
and edx, edx
je 0x41b989e
and ecx, ecx
jle 0x41b989e
push ebx
xor al, byte [edx]
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
shr ebx, 0x18
mov byte [edx], bl
inc edx
dec ecx
jne 0x41b9889
pop ebx
ret

Function at 0x41b9b0c
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x41b9b2f
and ecx, ecx
jle 0x41b9b2f
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x41b9b35]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x41b9b1f
pop edi
pop ebx
ret

Function at 0x41c6090
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
lea ebx, [esi + 0x1c]
mov eax, edx
lea edx, [ebx + 0x20]
mov ecx, 0x20
call sub.rtl60.bpl__System_Move_qqrpxvpvi
mov eax, dword [esi + 0x14]
dec eax
test eax, eax
jb 0x41c6175
inc eax
mov dword [esp + 8], eax
mov dword [esp], 0
mov dword [esp + 4], 4
mov eax, 0x41e77f4
mov dword [esp + 0xc], eax
xor eax, eax
mov edx, dword [esp]
add edx, edx
mov ecx, eax
shr ecx, 1
and ecx, 1
add edx, ecx
shl edx, 7
lea ecx, [edx*8 + 0x41e02ec]
mov edx, dword [ebx + eax*4]
and edx, 0xff
mov esi, dword [ecx + edx*4]
lea edx, [eax + 1]
and edx, 0xf
xor dword [ebx + edx*4], esi
lea edx, [eax + 0xf]
and edx, 0xf
xor dword [ebx + edx*4], esi
inc eax
mov edx, dword [ebx + eax*4]
and edx, 0xff
mov esi, dword [ecx + edx*4]
lea edx, [eax + 1]
and edx, 0xf
xor dword [ebx + edx*4], esi
lea edx, [eax + 0xf]
and edx, 0xf
xor dword [ebx + edx*4], esi
inc eax
cmp eax, 0x10
jb 0x41c60d6
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
mov esi, 0x20
sub esi, edx
xor eax, eax
mov ecx, edx
mov edi, dword [ebx + eax*4]
shr edi, cl
mov ecx, esi
mov ebp, dword [ebx + eax*4]
shl ebp, cl
or edi, ebp
mov dword [ebx + eax*4], edi
inc eax
cmp eax, 0x10
jne 0x41c6140
add dword [esp + 0xc], 4
dec dword [esp + 4]
jne 0x41c60d4
inc dword [esp]
dec dword [esp + 8]
jne 0x41c60c3
xor eax, eax
mov edx, 0xf
sub edx, eax
mov edx, dword [ebx + edx*4]
xor dword [ebx + eax*4], edx
inc eax
cmp eax, 8
jne 0x41c6177
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41ca5a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov edi, dword [0x41f6334]
mov edi, dword [edi]
mov esi, dword [ebp - 8]
mov eax, dword [esi]
call edi
mov dword [ebp - 4], eax
movzx edi, word [ebp - 2]
movzx eax, word [ebp - 4]
mov dword [ebp - 0xc], eax
mov edx, dword [0x41f6334]
mov edx, dword [edx]
mov eax, dword [esi + 4]
call edx
mov dword [ebp - 4], eax
movzx eax, word [ebp - 2]
mov dword [ebp - 0x10], eax
movzx eax, word [ebp - 4]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 4], eax
movzx edx, word [ebx]
mov eax, edi
call fcn.041ca570
mov edi, eax
movzx eax, word [ebx + 2]
add dword [ebp - 0xc], eax
movzx eax, word [ebx + 4]
add dword [ebp - 0x10], eax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.041ca570
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x10]
xor esi, edi
movzx edx, word [ebx + 8]
mov eax, esi
call fcn.041ca570
mov esi, eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
add eax, esi
movzx edx, word [ebx + 0xa]
call fcn.041ca570
add esi, eax
xor edi, eax
xor dword [ebp - 0x14], esi
xor esi, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
add ebx, 0xc
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
jne 0x41ca5ee
movzx edx, word [ebx]
mov eax, edi
call fcn.041ca570
mov word [ebp - 2], ax
mov ax, word [ebp - 0x10]
add ax, word [ebx + 2]
mov word [ebp - 4], ax
mov edi, dword [0x41f6334]
mov edi, dword [edi]
mov eax, dword [ebp - 4]
call edi
mov esi, dword [ebp - 8]
mov dword [esi], eax
mov ax, word [ebp - 0xc]
add ax, word [ebx + 4]
mov word [ebp - 2], ax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.041ca570
mov word [ebp - 4], ax
mov ebx, dword [0x41f6334]
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call ebx
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41cad14
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov esi, eax
mov edx, dword [ebp + 8]
mov edi, eax
add edi, 0x100
mov ecx, 1
xor ebx, ebx
mov eax, ecx
and al, 0xff
mov byte [esi], al
mov eax, ecx
and eax, 0xff
mov byte [edi + eax], bl
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*8]
mov ecx, 0x101
cdq
idiv ecx
mov ecx, edx
inc esi
inc ebx
cmp ebx, 0x100
jne 0x41cad37
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41cc6cc
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x41cc6e2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x41cc6db
mov edx, esp
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xff
mov ebx, dword [ebp - 4]
shr ebx, 8
and ebx, 0xff
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xff
mov esi, dword [ebp - 4]
shr esi, 0x18
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x20
jne 0x41cc76d
movzx ecx, byte [ecx + 0x41ea950]
mov esi, dword [edx + 0xc]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x41ea850]
mov esi, dword [edx + 0xc]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x41ea850]
mov esi, dword [edx + 0xc]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x41ea950]
mov edi, dword [edx + 0xc]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x18
jl 0x41cc7ca
movzx ecx, byte [ecx + 0x41ea950]
mov esi, dword [edx + 8]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x41ea950]
mov esi, dword [edx + 8]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x41ea850]
mov esi, dword [edx + 8]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x41ea850]
mov edi, dword [edx + 8]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x41ea850]
mov esi, dword [edx + 4]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x41ea950]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x41ea850]
mov esi, dword [edx + 4]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x41ea950]
mov edi, dword [edx + 4]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x41ea850]
mov esi, dword [edx]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x41ea850]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x41ea950]
mov esi, dword [edx]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x41ea950]
mov edx, dword [edx]
shr edx, 0x18
xor esi, edx
mov dword [ebp - 8], esi
mov edx, dword [ecx*4 + 0x41eaa50]
xor edx, dword [ebx*4 + 0x41eae50]
xor edx, dword [eax*4 + 0x41eb250]
mov eax, dword [ebp - 8]
xor edx, dword [eax*4 + 0x41eb650]
mov eax, edx
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x41cc9cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
and ecx, 0xff
imul ecx, ecx, 0x1010101
xor ebx, ebx
mov esi, dword [edx + ebx*4]
xor esi, ecx
mov dword [eax + ebx*4], esi
inc ebx
cmp ebx, 0x40
jne 0x41cc9dc
pop esi
pop ebx
ret
Function at 0x41cc9f0
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
mov edx, 0x41ea850
lea eax, [ebp - 0x100]
call fcn.041cc9cc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x18]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x41ea850]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x41eaa50]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x41cca21
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 8
mov edx, 0x41ea950
lea eax, [ebp - 0x100]
call fcn.041cc9cc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x17]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x41ea850]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x41eae50]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0x400], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x41cca70
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x10
mov edx, 0x41ea850
lea eax, [ebp - 0x100]
call fcn.041cc9cc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x16]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x41ea950]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x41eb250]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0x800], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x41ccac3
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x18
mov edx, 0x41ea950
lea eax, [ebp - 0x100]
call fcn.041cc9cc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x15]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x41ea950]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x41eb650]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0xc00], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x41ccb16
pop esi
pop ebx
mov esp, ebp
pop ebp
ret