joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402610
Capabilities:
Compute adler32 checksum
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4027b6
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
mov ecx, edi
shr ecx, 0x10
mov eax, edi
or eax, 0xffff
xor edi, 0xffff0000
and edi, eax
test esi, esi
je 0x4027af
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x4026a5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x4027af
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x40271e
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x4026c0
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x40266d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x402760
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x402740
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402660
jmp 0x40276f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402660
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x402780
jmp 0x402660
shl ecx, 0x10
add ecx, edi
jmp 0x4027bb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4027d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4027fe
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x40289c
not eax
test bl, 1
jne 0x402805
mov edx, ebx
cmp ebx, 1
jne 0x402836
jmp 0x40289a
xor eax, eax
jmp 0x40289c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x44280c]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x44280c]
cmp ebx, 1
je 0x40289a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44280c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44280c]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44280c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44280c]
add esi, 2
cmp edx, esi
jne 0x402840
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x408110
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x40817c
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x40815e
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x408160
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
or edx, 2
mov ebp, ebx
and ebp, 2
imul edx, ebp
xor ebp, 2
and ebx, 0xfffffffd
imul ebx, ebp
add ebx, edx
cmp ebx, eax
jb 0x408140
jmp 0x408160
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40817a
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40817c
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x408930
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + 4]
mov dword [0x44a95c], ecx
mov eax, 0xfffffd92
nop
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x26f
mov dword [eax*4 + 0x44b318], ecx
test eax, eax
je 0x408981
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x270
mov dword [eax*4 + 0x44b31c], ecx
add eax, 2
jmp 0x408940
mov dword [0x44a958], 0x270
ret
Function at 0x408cc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x408d30
xor eax, eax
mov edx, SysReAllocString
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea esi, [eax + 0x270]
mov ebx, dword [ecx + eax*4 + 4]
and ebx, edx
and esi, 1
mov edi, eax
or edi, 1
add edi, esi
mov edi, dword [ecx + edi*4 + 4]
mov esi, edi
and esi, 0x7ffffffe
or esi, ebx
shr esi, 1
and edi, 1
neg edi
and edi, 0x9908b0df
xor esi, dword [ecx + eax*4 + 0x638]
xor esi, edi
mov dword [ecx + eax*4 + 0x9c4], esi
inc eax
cmp eax, 0x270
jne 0x408ce0
mov eax, 0x270
jmp 0x408d42
cmp eax, 0x4e0
jb 0x408d42
mov esi, ecx
call fcn.00408d90
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
mov edx, ecx
not edx
or edx, 0xefc60000
add ecx, edx
inc ecx
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
pop ebx
ret

Function at 0x408d90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov edi, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
nop
and edi, 0x80000000
mov edx, dword [ecx + eax*4 - 0x630]
mov ebx, edx
and ebx, 0x7ffffffe
or ebx, edi
shr ebx, 1
mov esi, edx
and esi, 1
neg esi
and esi, 0x9908b0df
mov edi, ebx
and edi, esi
add esi, ebx
add edi, edi
sub esi, edi
xor esi, dword [ecx + eax*4]
mov edi, edx
mov dword [ecx + eax*4 - 0xff4], esi
inc eax
cmp eax, 0x4e1
jne 0x408da0
mov esi, dword [ecx + 0xd50]
mov eax, 0x355
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 - 0xd50]
xor edi, edx
mov dword [ecx + eax*4 - 0x9c4], edi
inc eax
cmp eax, 0x4e1
jne 0x408df0
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
ret
Function at 0x409ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x44bd34]
mov dword [esp + 0x1a8], 0x1f1e1118
mov word [esp + 0x1ac], 0
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi + 0x1a8]
lea edx, [esi + esi]
mov edi, edx
and edi, 4
mov ecx, esi
xor ecx, 0x8ce7327a
add ecx, edi
mov edi, ebx
and edi, ecx
add edi, edi
sub ecx, edi
add cl, bl
add cl, 0x9e
mov byte [esp + esi + 0x1a8], cl
and edx, 2
xor esi, 1
add esi, edx
cmp esi, 6
jb 0x409f00
mov ecx, dword [esp + 0x1a8]
mov dword [esp + 0x18], 0x9301910f
mov dword [esp + 0x1c], 0x9f399d4e
mov dword [esp + 0x20], 0x9b48994b
mov dword [esp + 0x24], 0x872a8552
mov dword [esp + 0x28], 0x83168114
mov dword [esp + 0x2c], 0x8d8c
mov byte [esp + 0x30], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 0x18]
mov edi, 0x175ba01b
sub edi, edx
mov ebp, edi
and ebp, 0x1448264a
or edi, 0x2b13d9b5
lea ebx, [edx + edi]
add ebx, 0x28a45fe5
or ebx, ebp
mov edi, esi
and edi, 0x4a
or edi, 0xc81140a0
and esi, 0xffffffb5
xor esi, edi
and ebx, 0x3f4affff
xor ebx, esi
mov esi, ebx
xor esi, 0x2302999f
xor ebx, 0x5cfd66ea
and ebx, 0xa
add ebx, ebx
sub ebx, esi
inc bl
mov byte [esp + edx + 0x18], bl
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
cmp edx, 0x19
jb 0x409f80
lea edx, [esp + 0x18]
push ecx
push 0
push edx
call eax
mov ecx, 0x44bd38
push eax
call fcn.0043cae0
movzx eax, al
mov eax, dword [eax*4 + 0x445908]
mov ecx, 0xa900d42c
xor ecx, dword [str.IVaVi__f__a_]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx

Function at 0x40b210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
xor edx, edx
mov ecx, dword [0x44bd10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx], 0
lea edx, [edx + 2]
jne case.default.0x40b2cf
lea edi, [eax + edx]
add edi, 0xfffffffe
mov edx, eax
not edx
and edx, edi
xor edi, eax
add edx, edx
sub edx, edi
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x445c58]
xor eax, eax
jmp 0x40b8d8
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b960
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x440
mov esi, dword [esp + 0x46c]
mov dword [esp + 0x40], 0x93059125
mov dword [esp + 0x44], 0x9f379d06
mov dword [esp + 0x48], 0x9b0e990c
mov dword [esp + 0x4c], 0x87518525
mov dword [esp + 0x50], 0x8354815d
mov dword [esp + 0x54], 0x8f6e8d5c
mov dword [esp + 0x58], 0x8b358960
mov dword [esp + 0x5c], 0x77e075dd
mov dword [esp + 0x60], 0x73e571dc
mov dword [esp + 0x64], 0x7fed7de3
mov dword [esp + 0x68], 0x7bcc7998
mov dword [esp + 0x6c], 0x678665d8
mov dword [esp + 0x70], 0x63b261b1
mov dword [esp + 0x74], 0x6fbe6dba
mov dword [esp + 0x78], 0x6b8a69b3
mov dword [esp + 0x7c], 0x57ff55eb
mov dword [esp + 0x80], 0x538c51c6
mov dword [esp + 0x84], 0x5f855d80
mov dword [esp + 0x88], 0x5bc259b8
mov dword [esp + 0x8c], 0x479a459a
mov dword [esp + 0x90], 0x43a241a9
mov dword [esp + 0x94], 0x4fde4d8d
mov dword [esp + 0x98], 0x4bde49d8
mov dword [esp + 0x9c], 0x37893599
mov dword [esp + 0xa0], 0x3390319d
mov dword [esp + 0xa4], 0x3f973df7
mov dword [esp + 0xa8], 0x3bed39a4
mov dword [esp + 0xac], 0x27f525f9
mov dword [esp + 0xb0], 0x23f421ff
mov dword [esp + 0xb4], 0x2ff02dff
mov dword [esp + 0xb8], 0x2bc229c8
mov dword [esp + 0xbc], 0x17de15df
mov dword [esp + 0xc0], 0x13a711ac
mov dword [esp + 0xc4], 0x1fca1da8
mov dword [esp + 0xc8], 0x1b8e19f8
mov dword [esp + 0xcc], 0x7ad05ad
mov dword [esp + 0xd0], 0x3e201ad
mov dword [esp + 0xd4], 0xfa30dc3
mov dword [esp + 0xd8], 0xba109ab
mov dword [esp + 0xdc], 0xf71ff563
mov dword [esp + 0xe0], 0xf331f110
mov dword [esp + 0xe4], 0xff6cfd54
mov dword [esp + 0xe8], 0xfb6ff96f
mov dword [esp + 0xec], 0xe731e549
mov dword [esp + 0xf0], 0xe333e131
mov dword [esp + 0xf4], 0xef38ed35
mov dword [esp + 0xf8], 0xeb3ce938
mov dword [esp + 0xfc], 0xd700d504
mov dword [esp + 0x100], 0xd332d100
mov dword [esp + 0x104], 0xdf7fdd6f
mov dword [esp + 0x108], 0xdb7bd976
mov dword [esp + 0x10c], 0xc76fc556
mov dword [esp + 0x110], 0xc31fc117
mov dword [esp + 0x114], 0xcf11cd1f
mov dword [esp + 0x118], 0xcb19c91e
mov dword [esp + 0x11c], 0xb7b6b56a
mov word [esp + 0x120], 0
mov eax, dword [0x44bd04]
mov ecx, 0xd26fbd64
nop
nop
nop
movzx ebp, byte [esp + ecx + 0x2d9042dc]
xor ebp, ecx
mov edx, ebp
mov edi, ebp
mov ebx, ebp
xor ebx, 0xe3d14d0b
add ebx, ebp
xor ebp, 0x1c2eb2f4
or edx, 0xc2410d0b
and edx, ebp
and edi, 0x102eb2f4
sub ebx, edi
add ebx, edx
mov edx, ebx
and edx, 1
xor ebx, 1
lea edx, [ebx + edx*2]
mov byte [esp + ecx + 0x2d9042dc], dl
inc ecx
cmp ecx, 0xd26fbe46
jne 0x40bbc0
lea ecx, [esp + 0x40]
push 0
push 0
push 0
push 0
push ecx
call eax
mov edi, eax
xor eax, eax
test edi, edi
setne al
mov eax, dword [eax*4 + 0x445d08]
mov ecx, 0x1221179f
xor ecx, dword [0x445d10]
add eax, ecx
inc eax
jmp eax
Function at 0x419530
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
mov esi, esp
sub esp, 8
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0x20], esp
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edi + 2], 0
lea edi, [edi + 2]
jne 0x419560
mov ebx, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x419580
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x4195a0
mov eax, 0xffffffff
jmp 0x4195a9
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.004082b0
add esp, 4
movzx ecx, word [ebx]
mov dword [ebp - 0x14], eax
test cx, cx
je 0x4195e1
add ebx, 2
mov eax, dword [ebp - 0x14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x4195d0
mov word [eax], 0x5c
add eax, 2
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x419613
add edx, 2
mov ebx, dword [ebp - 0x14]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419600
jmp 0x419616
mov ebx, dword [ebp - 0x14]
mov word [eax], 0
lea eax, [ebp - 0x18]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00440480
add esp, 0x14
mov dword [esi], 0x31feffb9
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
add cl, 0x55
xor cl, byte [esi + edx]
add cl, 0x57
mov byte [esi + edx], cl
inc edx
cmp edx, 4
jne case.default.0x41965b
xor ecx, ecx
cmp eax, dword [esi]
sete cl
jmp dword [ecx*4 + 0x446408]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x10]
mov dword [esi], 0xb9fafb00
mov word [esi + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esi + eax]
lea edx, [eax + 0x261dd8ab]
mov esi, edx
and esi, ecx
or edx, ecx
lea ecx, [esi + esi]
not ecx
add ecx, esi
mov esi, dword [ebp - 0x10]
and ecx, edx
add cl, 0xa9
mov byte [esi + eax], cl
lea ecx, [eax + 7]
neg eax
and eax, 6
and ecx, 9
sub ecx, eax
mov eax, ecx
cmp ecx, 6
jb case.default.0x4196c3
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [esi]
sete cl
mov esi, dword [ebp - 0x20]
jmp dword [ecx*4 + 0x446410]
mov ecx, dword [case.0x4196c3.1]
jmp ecx
mov esi, eax
jmp dword [0x44642c]
push 0
push 0x1388
push ebx
call fcn.00439800
add esp, 0xc
nop
nop
nop
nop
nop
nop
push 0
push 0x1388
push ebx
call fcn.00439800
add esp, 0xc
jmp dword [0x446430]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446440]
Function at 0x41ec70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
mov esi, dword [esp + 0x5c]
xor eax, eax
test esi, esi
setne al
mov dword [esp + 8], 0
xor ebx, ebx
jmp dword [eax*4 + 0x446d60]
Function at 0x4217f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x34]
mov ebp, 0xfffffffe
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x4217a0
sar ebp, 1
lea esi, [esp + 0x18]
push esi
push 0
push 0
push ebp
push edi
push 0
call dword [0x44d058]
mov dword [esp + 4], 0x5f1e19ff
mov word [esp + 8], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x7a
xor dl, byte [esp + ecx + 4]
add dl, 0x9e
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 6
jne case.default.0x421801
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x446f28]
mov ebx, dword [esp + 0x18]
test ebx, ebx
jns 0x421817
mov eax, 0xffffffff
jmp 0x42181a
lea eax, [ebx + ebx]
push eax
call fcn.004082b0
add esp, 4
push esi
mov esi, eax
push ebx
push eax
push ebp
push edi
push 0
call dword [0x44d058]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446f30]
xor ebx, ebx
jmp dword [0x446f38]
push esi
call fcn.004082c0
add esp, 4
xor ebx, ebx
jmp case.0x421801.0
lea edi, [esp + 4]
push edi
push esi
call fcn.00440610
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446f40]
xor eax, eax
jmp dword [0x446f50]
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x423790
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x2c]
mov ecx, 0xfffffffe
cmp word [edi + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x4237a0
mov eax, ecx
sar eax, 1
and ecx, 0x12
xor eax, 9
add eax, ecx
jns 0x4237c0
mov eax, 0xffffffff
jmp 0x4237c2
add eax, eax
push eax
call fcn.004082b0
add esp, 4
mov esi, eax
mov dword [esp], 0x33a93194
mov dword [esp + 4], 0x2fa72db1
mov dword [esp + 8], 0x2b7c2964
mov dword [esp + 0xc], 0x278425b8
mov dword [esp + 0x10], 0x2120
mov byte [esp + 0x14], 0
xor ecx, ecx
mov eax, ecx
nop
nop
nop
movzx edx, byte [esp + ecx]
mov ebx, ecx
and ebx, 0xc
mov ebp, ecx
xor ebp, 0x7d4cbc8c
lea ebx, [ebx*2]
add ebx, ebp
mov ebp, ebx
or ebp, edx
not edx
or ebx, edx
sub edx, ebx
add edx, ebp
mov ebx, edx
and ebx, 0x8d805143
and edx, 0x727faebc
xor edx, 0x727faebd
sub edx, ebx
lea ebx, [edx + edx]
sub edx, ebx
inc dl
mov byte [esp + ecx], dl
and eax, 1
not ecx
or ecx, 1
sub eax, ecx
mov ecx, eax
cmp eax, 0x15
jb 0x423800
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x423881
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x423870
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4238b1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4238a0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00440610
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x447038]
Function at 0x425e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
push eax
sub esp, 0x40
mov edi, esp
push eax
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x1c
mov esi, esp
mov dword [edi], 0x81c587eb
mov dword [edi + 4], 0x8d328330
mov dword [edi + 8], 0x892d8fc0
mov dword [edi + 0xc], 0x95298b34
mov dword [edi + 0x10], 0x913297fb
mov dword [edi + 0x14], 0x9d3a93cc
mov dword [edi + 0x18], 0x99289f23
mov dword [edi + 0x1c], 0xe5359b34
mov dword [edi + 0x20], 0xe144e756
mov dword [edi + 0x24], 0xed50e34b
mov dword [edi + 0x28], 0xe94aef40
mov dword [edi + 0x2c], 0xf558ebb8
mov dword [edi + 0x30], 0xf158f745
mov dword [edi + 0x34], 0xfd46f35b
mov dword [edi + 0x38], 0xf943ff53
lea eax, [edi + 0x3c]
mov dword [ebp - 0x18], eax
mov dword [edi + 0x3c], 0xfbf8
mov byte [edi + 0x40], 0
mov ecx, 0x5e
mov ebx, edi
nop
nop
nop
nop
movzx edx, byte [edi]
lea eax, [ecx - 0x57405d00]
or eax, edx
and edx, ecx
sub eax, edx
lea edx, [eax + eax]
not edx
add edx, eax
add dl, 0xdb
mov byte [edi], dl
inc edi
dec ecx
cmp ecx, 0x1d
jne 0x425f30
lea eax, [ebp - 0x56]
mov edi, eax
mov ecx, 0xf
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
lea edi, [ebp - 0x1a]
mov ecx, 1
mov edx, dword [ebp - 0x18]
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
push dword [ebp - 0x14]
push 0
push 0
push 0x1e
push eax
push 0
call dword [0x44d058]
mov edx, dword [ebp - 0x10]
mov dword [edx], 0x498a8bf1
xor ecx, ecx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [edx + ebx]
mov edx, ebx
xor edx, 0x211cd423
add edx, ecx
xor edx, edi
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
add dl, 0x50
mov edi, dword [ebp - 0x10]
mov byte [edi + ebx], dl
mov edx, dword [ebp - 0x10]
inc ebx
add ecx, 2
cmp ebx, 4
jne case.default.0x425fd9
xor ecx, ecx
cmp eax, dword [edx]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x447558]

Function at 0x4262d0
Capabilities:
Encode data using xor

Disassembly:
inc esi
xor eax, eax
cmp esi, dword [esp + 0x38]
setb al
jmp dword [eax*4 + 0x4475a0]
Function at 0x42750a
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x2c]
cmp ecx, 2
jb 0x427501
shr ecx, 1
mov eax, ecx
and eax, 3
je 0x427487
xor edx, edx
lea ebp, [esp + 0xde8]
mov edi, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [ebp]
xor ebx, ebx
test si, si
setne bl
lea ebp, [ebp + ebx*2]
mov word [edi], si
add edi, 2
inc edx
cmp eax, edx
jne 0x4273e0
mov dword [esp], edi
mov eax, ecx
sub eax, edx
mov esi, dword [esp + 4]
jmp 0x427489
mov eax, ecx
dec ecx
cmp ecx, 3
jb 0x427501
mov esi, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebp]
xor edx, edx
test cx, cx
setne dl
lea edi, [edx*2]
add edi, ebp
mov word [esi], cx
movzx ecx, word [ebp + edx*2]
xor edx, edx
test cx, cx
setne dl
lea ebx, [edi + edx*2]
mov word [esi + 2], cx
movzx ecx, word [edi + edx*2]
xor edx, edx
test cx, cx
setne dl
lea edi, [ebx + edx*2]
mov word [esi + 4], cx
movzx edx, word [ebx + edx*2]
xor ecx, ecx
test dx, dx
setne cl
mov word [esi + 6], dx
add esi, 8
lea ebp, [edi + ecx*2]
add eax, 0xfffffffc
jne 0x4274a0
mov dword [esp], esi
mov esi, dword [esp + 4]
mov eax, dword [esp]
mov dword [eax], 0x20003a
add eax, 4
mov dword [esp], eax
mov al, 1
mov dword [esp + 8], eax
jmp case.0x4258b7.69

Function at 0x428d51
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [esp + 0x2c]
push 0x410
call fcn.0043bb20
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x447ca8]

Function at 0x428ee0
Capabilities:
Encode data using xor

Disassembly:
add edi, 4
xor eax, eax
cmp edi, ebx
setne al
jmp dword [eax*4 + 0x447cb8]

Function at 0x428f38
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 1
mov esi, dword [esp + 0x14]
jmp dword [eax*4 + 0x447cd0]

Function at 0x428f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor eax, eax
mov esi, dword [esp + 0x14]
jmp dword [eax*4 + 0x447cd0]

Function at 0x42914f
Capabilities:
Encode data using xor

Disassembly:
push ebx
call fcn.00401930
add esp, 4
xor ecx, ecx
test eax, eax
setne cl
lea ebp, [esp + 0x50]
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x14]
jmp dword [ecx*4 + 0x447d00]

Function at 0x4291c0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], 0xe3407473
lea ecx, [esp + 8]
mov byte [ecx + 2], 0
mov word [ecx], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dl, 0x27
sub dl, cl
xor dl, byte [esp + ecx + 4]
mov dh, 0xc7
sub dh, dl
mov byte [esp + ecx + 4], dh
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 7
jb 0x4291e0
jmp dword [0x447d10]

Function at 0x429abb
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov edi, dword [eax + 4]
xor eax, eax
cmp edx, edi
sete al
mov esi, dword [ebp - 0x1c]
jmp dword [eax*4 + 0x447de8]