joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419a97
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e9ba
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0
push 0x425260
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::TrimRight_1
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00417280
push eax
lea edx, [ebp - 0x18]
push edx
call fcn.0041971e
add esp, 8
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.00412e60
and eax, 0xff
test eax, eax
jne 0x419b3b
lea ecx, [ebp - 0x10]
call fcn.00417280
push eax
call fcn.00419c3e
add esp, 4
xor edx, edx
cmp eax, 0xffffffff
sete dl
mov byte [ebp - 0x1c], dl
mov eax, dword [ebp - 0x1c]
and eax, 0xff
test eax, eax
jne 0x419b3b
mov dword [ebp - 0x40], 0
jmp 0x419b42
mov dword [ebp - 0x40], 1
mov cl, byte [ebp - 0x40]
mov byte [ebp - 0x14], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
mov edx, dword [ebp - 0x14]
and edx, 0xff
test edx, edx
je 0x419b7c
mov byte [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov al, byte [ebp - 0x20]
jmp 0x419c30
lea ecx, [ebp - 0x10]
call fcn.00417280
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041971e
add esp, 8
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x48]
call fcn.00417280
push eax
call fcn.00419a97
add esp, 4
and eax, 0xff
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x24], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call sub.MFC42.DLL_CString::CString
mov edx, dword [ebp - 0x24]
and edx, 0xff
test edx, edx
je 0x419bed
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov al, byte [ebp - 0x2c]
jmp 0x419c30
push 0
lea ecx, [ebp - 0x10]
call fcn.00417280
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x419c1a
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov al, byte [ebp - 0x30]
jmp 0x419c30
mov byte [ebp - 0x34], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov al, byte [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41a948
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ea48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0041a9bd
add esp, 8
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
call fcn.00417280
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor ecx, ecx
cmp eax, 2
sete cl
mov byte [ebp - 0x10], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov al, byte [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x41c901
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ed5d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x34], ecx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0xc
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 0xc]
call dword [eax + 0x20]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x3c]
call fcn.00417280
push eax
lea edx, [ebp - 0x30]
push edx
call fcn.0041a9bd
add esp, 8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x44]
call fcn.00417280
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x28], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0x28]
and ecx, 0xff
test ecx, ecx
je 0x41c9b7
xor eax, eax
jmp 0x41c9cd
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x18]
imul edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x19e80cfc
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6ff0187a
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x402280
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4022ba
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0x4022c1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0x4022a0
jmp 0x4022c3
mov eax, 0x1505
jmp 0x4022c3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x402a10
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402bb6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x402baf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x402aa5
mov eax, dword [esp]
sub eax, dword [esp + 0xc]
add ebp, eax
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x402baf
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 4], esi
jb 0x402b43
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
mov esi, edi
and esi, eax
xor edi, eax
lea eax, [edi + esi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
mov edi, esi
and edi, eax
xor esi, eax
lea eax, [esi + edi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 7]
mov edi, eax
and edi, esi
xor eax, esi
lea edi, [eax + edi*2]
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x402ad0
add ebp, eax
mov esi, dword [esp + 4]
mov eax, ebx
sub eax, edx
jae 0x402a6d
mov dword [esp + 8], eax
mov esi, edx
and esi, 3
mov dword [esp + 0xc], ebx
mov eax, ebx
mov edx, ebp
je 0x402b6c
inc eax
movzx ebx, byte [edx]
add edi, ebx
add ecx, edi
inc edx
dec esi
jne 0x402b60
cmp dword [esp + 8], 0xfffffffc
ja 0x402a60
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x402b80
jmp 0x402a60
shl ecx, 0x10
or ecx, edi
jmp 0x402bbb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402bd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402bfe
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x402c9c
not eax
test bl, 1
jne 0x402c05
mov edx, ebx
cmp ebx, 1
jne 0x402c36
jmp 0x402c9a
xor eax, eax
jmp 0x402c9c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x43e80c]
inc ecx
mov eax, edi
shr eax, 4
shr esi, 4
and edi, 0xf
xor edi, esi
xor eax, dword [edi*4 + 0x43e80c]
cmp ebx, 1
je 0x402c9a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x43e80c]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0x43e80c]
movzx ebx, byte [ecx + esi + 1]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x43e80c]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0x43e80c]
add esi, 2
cmp edx, esi
jne 0x402c40
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x407bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x407bcb
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x407bd3
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x407c6b
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x407c19
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x407c7a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x407c2e
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x407c40
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x407c00
jmp 0x407c49
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x407c00
cmp edi, ebx
jge 0x407c60
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x407c04
jmp 0x407c64
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x407c0d
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x407d02
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x407d02
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x407cb4
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x407ca0
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x407d02
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x407cc0
dec eax
mov ecx, 1
xor esi, esi
jmp 0x407d1c
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x407bcb
test edx, edx
mov dword [esp], ecx
js 0x407d50
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x407d60
inc ebp
dec edx
cmp edi, ebp
jne 0x407d30
mov edx, 0xffffffff
jmp 0x407d62
xor edi, edi
jmp 0x407d65
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x407d10
and ebp, 3
je 0x407d98
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x407d80
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x407d9a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x407d10
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x407db0
jmp 0x407d10
Function at 0x408660
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + 4]
mov dword [0x445fa4], ecx
mov eax, 0xfffffd92
nop
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x26f
mov dword [eax*4 + 0x446960], ecx
test eax, eax
je 0x4086b1
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x270
mov dword [eax*4 + 0x446964], ecx
add eax, 2
jmp 0x408670
mov dword [0x445fa0], 0x270
ret

Function at 0x4086c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov eax, dword [0x445fa0]
cmp eax, 0x270
jne 0x40871f
mov eax, 0xfffff640
mov edx, dword [0x445fa4]
nop
nop
nop
nop
nop
nop
nop
nop
and edx, 0x80000000
mov esi, dword [eax + 0x446968]
mov ecx, esi
and ecx, 0x7ffffffe
or ecx, edx
mov edx, esi
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, dword [eax + 0x446f98]
shr ecx, 1
xor esi, ecx
mov dword [eax + 0x447324], esi
add eax, 4
jne 0x4086e0
mov eax, 0x270
jmp 0x408735
cmp eax, 0x4e0
jb 0x408735
mov ecx, 0x445fa0
call fcn.00408980
mov eax, dword [0x445fa0]
lea ecx, [eax + 1]
mov dword [0x445fa0], ecx
mov eax, dword [eax*4 + 0x445fa4]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [0x447324]
xor ecx, eax
mov eax, ecx
shl eax, 7
mov edx, eax
xor edx, 0x62d3a97f
or eax, 0x9d2c5680
and eax, edx
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc40000
xor ecx, eax
shr ecx, 0x12
and eax, 0x7fff
xor eax, ecx
pop esi
ret
Function at 0x408790
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x214
call fcn.0043a360
test al, al
je 0x408970
call fcn.004336c0
test al, al
je 0x40896b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov ebp, 0xa4226598
mov esi, 0xf254f9c9
shrd esi, ebp, cl
shr ebp, cl
test cl, 0x20
je 0x4087de
mov esi, ebp
xor ebp, ebp
xor esi, 0xf254f9c9
xor ebp, 0xa4226598
mov eax, esi
and eax, 0x5f15a8c5
mov dword [esp], eax
mov ecx, ebp
and ecx, 0x612c51bd
mov ebx, esi
and ebx, 0xa0ea573a
mov edi, ebx
xor edi, 0xa0ea573a
mov eax, edi
mul dword [esp]
mov dword [esp + 4], eax
imul edi, ecx
mov ecx, ebp
and ecx, 0x9ed3ae42
or esi, 0xa0ea573a
mov eax, esi
imul esi, ecx
xor ecx, 0x9ed3ae42
imul ecx, dword [esp]
add ecx, edx
add ecx, edi
mul ebx
mov edi, eax
add esi, edx
or ebp, 0x9ed3ae42
imul ebp, ebx
add ebp, esi
add edi, dword [esp + 4]
adc ebp, ecx
lea eax, [esp + 0xc]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, ebp
shld esi, edi, 0x1e
mov ebx, ebp
shr ebx, 2
xor ebx, ebp
xor esi, edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x4088f3
mov ecx, dword [esp + 8]
and cl, 0xf
mov edi, esi
shrd edi, ebx, cl
mov ebp, ebx
shr ebp, cl
xor edi, esi
xor ebp, ebx
mov ebx, edi
and ebx, 0x7ecb9020
mov eax, ebx
xor eax, 0x7ecb9020
mov ecx, edi
and ecx, 0x81346fdf
mov esi, ebp
and esi, 0xfa97312d
imul esi, eax
mul ecx
mov dword [esp], eax
mov dword [esp + 4], edx
mov edx, ebp
and edx, 0x568ced2
or edi, 0x7ecb9020
mov eax, edi
imul edi, edx
xor edx, 0x568ced2
imul ecx, edx
mul ebx
add ecx, dword [esp + 4]
add ecx, esi
add edi, edx
or ebp, 0x568ced2
imul ebp, ebx
add ebp, edi
mov esi, eax
add esi, dword [esp]
adc ebp, ecx
mov ebx, ebp
mov ecx, ebx
shld ecx, esi, 1
lea eax, [esi + esi]
not ecx
not eax
add eax, esi
adc ecx, ebx
and ecx, 0x8e414be4
and eax, 0xc2c84a83
mov edi, ebx
xor edi, 0x8e414be4
mov ebp, esi
xor ebp, 0xc2c84a83
mov edx, ebx
or edx, 0x71beb41b
and edx, edi
or edx, ecx
mov ecx, esi
or ecx, 0x3d37b57c
and ecx, ebp
or ecx, eax
xor ecx, 0xc3c94b82
xor edx, 0x8f404ae5
and esi, 0x1010101
or esi, ecx
and ebx, 0x1010101
or ebx, edx
push ebx
push esi
call fcn.00409bc0
add esp, 8
test al, al
je 0x40896b
call fcn.0040cb90
call fcn.0040b9d0
call fcn.0043a930
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408980
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov edi, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
nop
mov edx, edi
xor edx, 0x7fffffff
or edi, 0x80000000
and edi, edx
mov edx, dword [ecx + eax*4 - 0x630]
mov esi, edx
and esi, 0x7fffffff
or esi, edi
mov edi, esi
shr edi, 1
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, edi
mov edi, dword [ecx + eax*4]
mov ebx, esi
and ebx, edi
add esi, edi
add ebx, ebx
sub esi, ebx
mov dword [ecx + eax*4 - 0xff4], esi
inc eax
mov edi, edx
cmp eax, 0x4e1
jne 0x408990
mov esi, dword [ecx + 0xd50]
mov eax, 0x355
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 - 0xd50]
xor edi, edx
mov dword [ecx + eax*4 - 0x9c4], edi
inc eax
cmp eax, 0x4e1
jne 0x4089f0
mov edx, dword [ecx + 0x1380]
mov esi, edx
not esi
or esi, 0x80000000
mov eax, SysReAllocString
and eax, dword [ecx + 4]
add edx, esi
inc edx
or eax, edx
mov edx, eax
shr edx, 1
and eax, 1
neg eax
xor edx, dword [ecx + 0x634]
and eax, 0x9908b0df
xor edx, eax
mov dword [ecx + 0x9c0], edx
mov dword [ecx], 0
pop esi
pop edi
pop ebx
ret
Function at 0x409bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x447380]
mov dword [esp + 0x1a8], 0xa8d7ced5
xor edx, edx
mov ecx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
or esi, 0x22bdd03d
add esi, edx
inc esi
mov ebx, esi
and ebx, 2
mov edi, esi
or esi, 2
imul esi, ebx
xor ebx, 2
and edi, 0xfd
imul edi, ebx
mov ebx, edx
xor ebx, 0x3d
add ebx, esi
add ebx, edi
xor bl, byte [esp + edx + 0x1a8]
add bl, 0x18
mov byte [esp + edx + 0x1a8], bl
lea esi, [edx + 1]
dec ecx
mov edx, esi
cmp esi, 4
jne 0x409bf0
mov ecx, dword [esp + 0x1a8]
mov dword [esp + 0x18], 0xbd2fbb2d
mov dword [esp + 0x1c], 0xa15fbf6c
mov dword [esp + 0x20], 0xa576a371
mov dword [esp + 0x24], 0xa94ca788
mov dword [esp + 0x28], 0xad40ab46
mov word [esp + 0x2c], 0xafae
xor esi, esi
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi + 0x18]
mov ebx, edx
or ebx, 0xc7481dea
mov ebp, esi
or ebp, 0xc7481dea
add ebp, ebx
add ebp, esi
inc ebp
xor ebp, edi
mov ebx, ebp
xor ebx, 0x50
or ebp, 0xaf
and ebx, ebp
add ebx, ebp
inc bl
mov byte [esp + esi + 0x18], bl
lea edi, [esi + 1]
dec edx
mov esi, edi
cmp edi, 0x16
jne 0x409c80
lea edi, [esp + 0x18]
push ecx
push 0
push edi
call eax
mov ecx, 0x447384
push eax
call fcn.0043a320
movzx eax, al
mov eax, dword [eax*4 + 0x441378]
mov ecx, 0xf4341926
xor ecx, dword [0x441380]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x40a670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
movzx ebx, byte [edx]
mov dword [esp], eax
test bl, bl
je 0x40a91f
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x20]
dec ebp
mov dword [esp], eax
nop
nop
nop
nop
nop
nop
nop
test edi, edi
je 0x40a6ac
cmp edx, edi
jae 0x40a91f
test ebp, ebp
je 0x40a91f
mov eax, ebp
movzx ebp, bl
mov ecx, ebp
xor ecx, 0xffffff7f
mov esi, ebp
or esi, 0x80
test esi, ecx
je 0x40a6f0
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40a720
cmp bl, 0xc2
jae 0x40a755
mov ebp, eax
jmp 0x40a707
inc edx
mov ebx, dword [esp]
lea ecx, [ebx + 2]
mov word [ebx], bp
mov ebp, eax
mov esi, ecx
sub esi, ebx
sar esi, 1
sub ebp, esi
mov dword [esp], ecx
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40a6a0
jmp 0x40a91f
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40a784
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40a7d4
cmp ebp, 0xe0
jne 0x40a7dd
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40a6df
jmp 0x40a7dd
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40a7c2
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
mov ebx, dword [esp]
lea ecx, [ebx + 2]
mov word [ebx], si
jmp 0x40a6fa
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40a7ca
cmp bl, 0xf4
ja 0x40a6df
movzx ecx, byte [edx + 1]
je 0x40a830
cmp ebp, 0xf0
mov ebp, eax
jne 0x40a83b
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40a707
jmp 0x40a83b
inc edx
mov ebp, eax
jmp 0x40a709
mov ebx, dword [esp]
mov ecx, ebx
jmp 0x40a6fa
cmp cl, 0x9f
ja 0x40a6df
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40a828
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp + 4], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40a8fb
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
mov esi, dword [esp + 4]
and esi, 0x3f
or esi, ecx
mov ebx, dword [esp]
mov word [ebx], si
lea ecx, [ebx + 2]
add edx, 3
jmp 0x40a6fa
inc edx
mov ebp, eax
jmp 0x40a707
cmp cl, 0x8f
mov ebp, eax
ja 0x40a707
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40a905
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40a8fb
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp + 4], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40a90b
and ebp, 0x3f
shl ebp, 6
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
or ecx, ebp
add edx, 4
mov esi, ecx
and esi, 0x1ff800
cmp esi, 0xd800
je 0x40a6df
mov esi, dword [esp + 4]
and esi, 0x3f
or esi, ecx
cmp esi, 0x10000
mov ebp, eax
jb 0x40a707
cmp ebp, 2
jb 0x40a915
add ecx, 0xf0000
shr ecx, 0xa
and ecx, 0x3ff
or ecx, 0xd800
mov ebx, dword [esp]
mov word [ebx], cx
and esi, 0x3ff
or esi, 0xdc00
lea ecx, [ebx + 4]
mov word [ebx + 2], si
jmp 0x40a6fc
add edx, 2
mov ebp, eax
jmp 0x40a709
inc edx
jmp 0x40a707
add edx, 3
mov ebp, eax
jmp 0x40a709
mov ebx, dword [esp]
mov ecx, ebx
jmp 0x40a6fc
mov eax, dword [esp]
mov word [eax], 0
sub eax, dword [esp + 0x1c]
sar eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret