joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5e90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x34], edx
push edi
mov dword [esp + 0x34], esi
mov edi, dword [esi + 0x10]
cmp edi, 3
jae 0x4a5eb5
mov ecx, esi
call fcn.004a7f50
jmp 0x4a6023
mov ecx, dword [esi]
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0
movzx edx, byte [ecx]
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 1]
movzx eax, word [esi + eax*4 + 0x60]
xor edx, eax
mov eax, dword [esi + 0x24]
mov ebx, dword [eax + edx*4]
lea ecx, [eax + edx*4]
mov eax, dword [esi + 4]
mov dword [ecx], eax
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x24], edx
mov edx, dword [esi + 4]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
lea ecx, [ecx + eax*8]
mov eax, edx
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x20]
lea ebp, [ecx + 4]
sub eax, edx
mov dword [esp + 0x14], ebp
cmp edx, dword [esp + 0x1c]
sbb edx, edx
and edx, eax
mov dword [esp + 0x30], edx
cmp edx, ebx
mov edx, dword [esp + 0x24]
jae 0x4a5ffe
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x40]
sub esi, ebx
cmp dword [esp + 0x3c], esi
sbb eax, eax
and eax, dword [esp + 0x20]
sub eax, esi
neg esi
add eax, dword [esp + 0x3c]
lea ebp, [ecx + eax*8]
mov eax, dword [esp + 0x28]
lea ecx, [esi + edx]
mov dword [esp + 0x44], ecx
cmp eax, dword [esp + 0x18]
jb 0x4a5f77
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ecx]
cmp cl, byte [eax + edx]
jne 0x4a5faf
inc eax
cmp eax, edi
je 0x4a5f93
add edx, eax
mov cl, byte [edx + esi]
cmp cl, byte [edx]
jne 0x4a5fab
inc eax
inc edx
cmp eax, edi
jne 0x4a5f86
mov ecx, dword [esp + 0x10]
mov eax, dword [ebp]
mov esi, dword [esp + 0x34]
mov dword [ecx], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [ebp + 4]
mov dword [ecx], eax
jmp 0x4a600b
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x44]
mov cl, byte [eax + ecx]
cmp cl, byte [eax + edx]
jae 0x4a5fd4
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov dword [ecx], ebx
lea ecx, [ebp + 4]
mov ebx, dword [ecx]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
jmp 0x4a5fe9
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x28], eax
mov dword [ecx], ebx
mov ebx, dword [ebp]
mov ecx, dword [esp + 0x10]
sub dword [esp + 0x2c], 1
je 0x4a5ffa
cmp dword [esp + 0x30], ebx
jb 0x4a5f43
mov esi, dword [esp + 0x34]
mov dword [ecx], 0
mov dword [ebp], 0
mov eax, dword [esi + 4]
inc dword [esi + 0x14]
inc eax
inc dword [esi]
mov dword [esi + 4], eax
cmp eax, dword [esi + 8]
jne 0x4a6023
mov ecx, esi
call fcn.004a77f0
sub dword [esp + 0x38], 1
jne 0x4a5ea1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x4a6d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x28
push ebx
push ebp
mov ebp, ecx
push edi
mov edi, edx
mov dword [esp + 0x20], ebp
mov ebx, dword [ebp + 0x10]
cmp ebx, 3
jae 0x4a6d44
call fcn.004a7f50
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x28
ret
mov ecx, dword [ebp]
push esi
mov dword [esp + 0x10], 2
movzx edx, byte [ecx]
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 1]
movzx eax, word [ebp + eax*4 + 0x60]
xor edx, eax
mov eax, dword [ebp + 0x24]
mov esi, dword [eax + edx*4]
lea ecx, [eax + edx*4]
mov eax, dword [ebp + 4]
mov dword [ecx], eax
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp]
add ebx, ecx
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], edx
mov dword [esp + 0x18], ecx
mov dword [eax + edx*4], esi
mov eax, dword [esp + 0x14]
test esi, esi
je 0x4a6e5b
mov edx, dword [esp + 0x2c]
sub edx, esi
cmp edx, eax
jae 0x4a6e5b
cmp dword [esp + 0x30], edx
mov esi, dword [esp + 0x1c]
sbb eax, eax
mov ebp, dword [esp + 0x10]
and eax, dword [esp + 0x14]
sub eax, edx
add eax, dword [esp + 0x30]
mov eax, dword [esi + eax*4]
mov esi, edx
neg esi
mov dword [esp + 0x34], eax
lea eax, [esi + ecx]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
mov al, byte [ecx + eax]
mov ecx, dword [esp + 0x20]
cmp al, byte [ecx + ebp]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
jne 0x4a6e3c
mov ebp, dword [esp + 0x20]
mov eax, ecx
mov cl, byte [ecx]
cmp cl, byte [ebp]
mov ebp, dword [esp + 0x24]
jne 0x4a6e21
inc eax
cmp eax, ebx
je 0x4a6e4c
mov cl, byte [eax]
cmp cl, byte [eax + esi]
je 0x4a6e15
mov ecx, dword [esp + 0x18]
sub eax, ecx
cmp dword [esp + 0x10], eax
jae 0x4a6e3c
mov dword [edi], eax
mov dword [esp + 0x10], eax
lea eax, [edx - 1]
mov dword [edi + 4], eax
add edi, 8
sub dword [esp + 0x28], 1
je 0x4a6e5b
mov esi, dword [esp + 0x34]
jmp 0x4a6da8
sub ebx, dword [esp + 0x18]
lea eax, [edx - 1]
mov dword [edi], ebx
mov dword [edi + 4], eax
add edi, 8
mov ecx, dword [ebp + 4]
inc dword [ebp + 0x14]
inc ecx
inc dword [ebp]
mov dword [ebp + 4], ecx
pop esi
cmp ecx, dword [ebp + 8]
jne 0x4a6e75
mov ecx, ebp
call fcn.004a77f0
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x4a6e80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov esi, ecx
jmp 0x4a6e90
cmp dword [esi + 0x10], 3
jae 0x4a6ea3
mov ecx, esi
call fcn.004a7f50
dec ebx
jmp 0x4a6f31
mov ecx, dword [esi + 8]
mov eax, ebx
mov edi, dword [esi + 4]
sub ecx, edi
mov dword [esp + 0x10], eax
cmp ebx, ecx
jbe 0x4a6ebb
mov eax, ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x14]
sub ebx, eax
mov eax, dword [esi + 0x28]
mov ebp, dword [esi]
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x10]
lea eax, [eax + ecx*4]
mov dword [esp + 0x14], eax
lea eax, [ecx + ebx]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x24]
mov dword [esp + 0x10], eax
movzx eax, byte [ebp]
lea edx, [ebp + 1]
movzx ecx, byte [ebp + 2]
mov ebp, dword [esp + 0x10]
shl eax, 8
or ecx, eax
movzx eax, byte [edx]
movzx eax, word [esi + eax*4 + 0x60]
xor ecx, eax
mov eax, dword [ebp + ecx*4]
mov dword [ebp + ecx*4], edi
inc edi
mov ecx, dword [esp + 0x14]
mov ebp, edx
mov dword [ecx], eax
add ecx, 4
mov dword [esp + 0x14], ecx
sub ebx, 1
jne 0x4a6ee1
mov ebx, dword [esp + 0x18]
mov dword [esi], ebp
mov dword [esi + 4], edi
cmp edi, dword [esi + 8]
jne 0x4a6f31
mov ecx, esi
call fcn.004a77f0
test ebx, ebx
jne 0x4a6e90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x4a7890
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov dword [ecx], 0
lea esi, [ecx + 0x60]
mov dword [ecx + 0x34], 0
xor edx, edx
mov word [ecx + 0x1e], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x468], 0xffffffff
mov dword [ecx + 0x46c], 0xffffffff
mov dword [ecx + 0x30], 0x20
mov byte [ecx + 0x1d], 1
mov dword [ecx + 0x48], 4
mov word [ecx + 0x58], 2
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x4a78e3
pop esi
ret
Function at 0x4a89f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov eax, ecx
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
cmp edi, 0x1f
jb 0x4a8b90
test edx, 3
je 0x4a8a22
movzx esi, byte [edx]
movzx ebx, al
inc edx
shr eax, 8
xor esi, ebx
xor eax, dword [ebp + esi*4]
dec edi
jmp 0x4a8a07
xor eax, dword [edx]
lea edi, [edx + edi - 0x1b]
sub edx, edi
lea ebx, [ebx]
mov ecx, dword [edi + edx + 0xc]
mov ebx, dword [edi + edx + 8]
movzx esi, bl
xor ecx, dword [ebp + esi*4 + 0xc00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [ebp + esi*4 + 0x800]
movzx esi, bl
shr ebx, 8
xor ecx, dword [ebp + esi*4 + 0x400]
xor ecx, dword [ebp + ebx*4]
mov ebx, dword [edi + edx + 4]
movzx esi, bl
xor ecx, dword [ebp + esi*4 + 0x1c00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [ebp + esi*4 + 0x1800]
movzx esi, bl
shr ebx, 8
xor ecx, dword [ebp + esi*4 + 0x1400]
xor ecx, dword [ebp + ebx*4 + 0x1000]
movzx esi, al
mov ebx, eax
shr ebx, 0x18
xor ecx, dword [ebp + esi*4 + 0x2c00]
xor ecx, dword [ebp + ebx*4 + 0x2000]
ror eax, 0x10
movzx esi, al
shr eax, 0x18
xor ecx, dword [ebp + esi*4 + 0x2400]
xor ecx, dword [ebp + eax*4 + 0x2800]
mov eax, dword [edi + edx + 0x18]
mov ebx, dword [edi + edx + 0x14]
movzx esi, bl
xor eax, dword [ebp + esi*4 + 0xc00]
movzx esi, bh
shr ebx, 0x10
xor eax, dword [ebp + esi*4 + 0x800]
movzx esi, bl
shr ebx, 8
xor eax, dword [ebp + esi*4 + 0x400]
xor eax, dword [ebp + ebx*4]
mov ebx, dword [edi + edx + 0x10]
movzx esi, bl
xor eax, dword [ebp + esi*4 + 0x1c00]
movzx esi, bh
shr ebx, 0x10
xor eax, dword [ebp + esi*4 + 0x1800]
movzx esi, bl
shr ebx, 8
xor eax, dword [ebp + esi*4 + 0x1400]
xor eax, dword [ebp + ebx*4 + 0x1000]
movzx esi, cl
mov ebx, ecx
shr ebx, 0x18
xor eax, dword [ebp + esi*4 + 0x2c00]
xor eax, dword [ebp + ebx*4 + 0x2000]
ror ecx, 0x10
movzx esi, cl
shr ecx, 0x18
xor eax, dword [ebp + esi*4 + 0x2400]
xor eax, dword [ebp + ecx*4 + 0x2800]
add edx, 0x18
jae 0x4a8a30
add edi, 0x18
sub edx, 0x18
movzx ebx, al
movzx ecx, ah
shr eax, 0x10
movzx esi, al
shr eax, 8
mov eax, dword [ebp + eax*4]
xor eax, dword [ebp + ebx*4 + 0xc00]
xor eax, dword [ebp + ecx*4 + 0x800]
xor eax, dword [ebp + esi*4 + 0x400]
add edx, 4
jb 0x4a8b89
xor eax, dword [edi + edx]
jmp 0x4a8b57
add edx, edi
add edi, 3
sub edi, edx
test edi, edi
je 0x4a8ba7
movzx esi, byte [edx]
movzx ebx, al
inc edx
shr eax, 8
xor esi, ebx
xor eax, dword [ebp + esi*4]
dec edi
jne 0x4a8b94
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x406521
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
mov esi, dword [eax + edi + 0x78]
and dword [ebp + 8], 0
add esi, edi
cmp dword [esi + 0x18], 0
jbe 0x406569
mov ebx, dword [esi + 0x20]
add ebx, edi
test ebx, ebx
je 0x40655b
mov ecx, dword [ebx]
push dword [ebp + 0xc]
or eax, 0xffffffff
add ecx, edi
or edx, eax
call fcn.0040d9e1
test eax, eax
je 0x406572
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
add ebx, 4
cmp eax, dword [esi + 0x18]
jb 0x406542
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + edi]
mov ecx, dword [esi + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + edi]
add eax, edi
jmp 0x40656b

Function at 0x40658c
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, dword fs:[0x18]
mov ebx, dword [ebx + 0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x1c]
mov ebx, dword [ebx]
mov ebx, dword [ebx + 8]
cmp ebx, 0
je 0x4065c9
push dword [0x4019c8]
push ebx
call fcn.00406521
mov dword [0x412c80], eax
push dword [0x4019cc]
push ebx
call fcn.00406521
mov dword [0x412c1c], eax
pop ebx
ret

Function at 0x4067f9
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, eax
test esi, esi
jne 0x406844
push 4
push edi
call dword [0x412e28]
test eax, eax
jne 0x40686e
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x40686e
mov eax, dword [edi + 0x3c]
add eax, edi
cmp dword [eax], 0x4550
jne 0x40686e
lea esi, [eax + 0x80]
push 8
push esi
call dword [0x412e28]
test eax, eax
jne 0x40686e
cmp dword [esi + 4], eax
je 0x40686e
mov esi, dword [esi]
test esi, esi
je 0x40686e
add esi, edi
push ebx
push 0x14
push esi
xor bl, bl
call dword [0x412e28]
test eax, eax
jne 0x40689c
mov eax, dword [esi + 0xc]
test eax, eax
je 0x406898
push 2
add eax, edi
push eax
call dword [0x412e28]
test eax, eax
je 0x406872
mov bl, 1
jmp 0x406888
xor eax, eax
jmp 0x4068b5
mov eax, dword [esi + 0xc]
push dword [esp + 0xc]
add eax, edi
push eax
xor bl, bl
call dword [0x412d30]
test eax, eax
je 0x40689c
push 0x14
add esi, 0x14
push esi
call dword [0x412e28]
test eax, eax
je 0x406854
test bl, bl
jne 0x4068b2
push 0x14
push esi
call dword [0x412e28]
test eax, eax
jne 0x4068b2
cmp dword [esi + 0xc], eax
je 0x4068b2
mov eax, esi
jmp 0x4068b4
xor eax, eax
pop ebx
pop esi
ret 4
Function at 0x409b85
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and dword [0x412b68], 0
sub esp, 0x210
call fcn.0040912a
test al, al
jne 0x409ba0
leave
ret
or dword [0x412a60], 0xffffffff
push ebx
mov ebx, fcn.00409ad9
call fcn.0040a00b
xor ebx, ebx
push ebx
push 0x80000
push ebx
mov dword [0x412c18], eax
call dword [0x412d6c]
mov dword [0x413ec4], eax
cmp eax, ebx
jne 0x409be2
call dword [0x412cd4]
mov dword [0x413ec4], eax
mov byte [0x41275f], bl
jmp 0x409be9
mov byte [0x41275f], 1
call fcn.00410de6
mov eax, 0x188
mov dword [0x412ec4], ebx
mov byte [0x412786], bl
call fcn.0040d5a3
mov dword [0x412a64], eax
cmp eax, ebx
jne 0x409c14
xor al, al
jmp 0x409d6f
push esi
mov dword [ebp - 8], ebx
push edi
movzx edi, word [ebp - 8]
shl edi, 2
mov eax, dword [edi + 0x412020]
movzx eax, byte [eax]
inc eax
je 0x409c35
call fcn.0040d5a3
mov esi, eax
jmp 0x409c37
xor esi, esi
cmp esi, ebx
je 0x409c9f
mov edx, dword [edi + 0x412020]
cmp byte [edx], bl
mov byte [ebp - 1], bl
jle 0x409c67
xor ecx, ecx
mov al, 0xba
mov bl, byte [ecx + edx + 1]
add bl, al
inc byte [ebp - 1]
mov byte [ecx + esi], bl
movzx ecx, byte [ebp - 1]
movsx ebx, byte [edx]
add al, 2
cmp ecx, ebx
jl 0x409c4c
xor ebx, ebx
movzx eax, byte [ebp - 1]
mov byte [eax + esi], bl
cmp byte [esi], 0x57
jne 0x409ca6
mov eax, dword [edi + 0x412020]
movzx eax, byte [eax]
lea ecx, [esi + 1]
dec eax
push ecx
call fcn.0040d96e
mov ecx, dword [0x412a64]
push esi
mov dword [edi + ecx], eax
call fcn.0040d5b6
mov eax, dword [0x412a64]
cmp dword [edi + eax], ebx
jne 0x409caf
xor al, al
jmp 0x409d6d
mov eax, dword [0x412a64]
inc esi
mov dword [edi + eax], esi
inc dword [ebp - 8]
cmp word [ebp - 8], 0x62
jb 0x409c19
call dword [0x412df8]
mov ecx, dword [0x412c18]
mov dword [0x412c0c], eax
mov eax, dword [ecx + 0x3c]
add eax, ecx
movzx edx, word [eax + 6]
xor esi, esi
cmp dx, bx
jbe 0x409d03
movzx esi, word [eax + 0x14]
movzx edx, dx
imul edx, edx, 0x28
add edx, eax
lea eax, [esi + edx - 0x10]
mov esi, dword [eax + 0xc]
push dword [eax + 8]
add esi, ecx
push esi
call dword [0x412e28]
test eax, eax
je 0x409d03
xor esi, esi
mov dword [0x412afc], esi
call dword [0x412d00]
push 0x403574
mov word [0x412ae8], ax
call fcn.0040f884
test al, al
jne 0x409d2a
or dword [0x412b68], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 8], 0x103
call dword [0x412b04]
test eax, eax
je 0x409d61
mov eax, dword [ebp - 8]
add eax, eax
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0040d609
mov dword [0x412a5c], eax
cmp eax, ebx
jne 0x409d6b
mov dword [0x412a5c], 0x403598
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a00b
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ebx
and esi, 0xffff0000
push edi
je 0x40a061
push 0x40
push esi
call dword [0x412e28]
test eax, eax
jne 0x40a059
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x40a059
mov eax, dword [esi + 0x3c]
lea edi, [eax + esi]
cmp edi, ebx
jae 0x40a059
push 0xf8
push edi
call dword [0x412e28]
test eax, eax
jne 0x40a059
cmp dword [edi], 0x4550
jne 0x40a059
mov eax, dword [edi + 0x50]
add eax, esi
cmp eax, ebx
ja 0x40a066
sub esi, 0x10000
jne 0x40a017
xor eax, eax
pop edi
pop esi
ret
mov eax, esi
jmp 0x40a063

Function at 0x40ddb4
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
test byte [ebp + 0x18], 2
mov eax, 0x8404f300
je 0x40ddc7
mov eax, 0x8444f300
test byte [ebp + 0x18], 4
je 0x40ddd2
or eax, 0x800000
test byte [ebp + 0x18], 1
mov ecx, 0x4037e0
jne 0x40dde2
mov ecx, 0x4037e8
push esi
push edi
xor esi, esi
push esi
push eax
push section..data
push esi
push 0x4037d4
push dword [ebp + 0xc]
push ecx
push dword [ebp + 8]
call dword [0x412a80]
mov edi, eax
cmp edi, esi
je 0x40de50
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push esi
push edi
call dword [0x412a84]
test eax, eax
je 0x40de49
push esi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x18]
push eax
push 0x20000013
push edi
mov dword [ebp + 0x18], esi
mov dword [ebp + 0xc], 4
call dword [0x412a94]
test eax, eax
je 0x40de49
cmp dword [ebp + 0x18], 0xc8
jne 0x40de49
mov eax, edi
jmp 0x40de52
push edi
call dword [0x412a74]
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x40e4e6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x413ec0]
cmp eax, 0x270
jl 0x40e420
push esi
push edi
xor edx, edx
mov esi, 0x7fffffff
mov ecx, edx
shl ecx, 2
mov eax, dword [ecx + 0x4134fc]
xor eax, dword [ecx + 0x4134f8]
and eax, esi
xor eax, dword [ecx + 0x4134f8]
mov edi, eax
shr eax, 1
and edi, 1
xor eax, dword [edi*4 + 0x4124f8]
xor eax, dword [ecx + 0x413b2c]
inc edx
cmp edx, 0xe3
mov dword [ecx + 0x4134f8], eax
jl 0x40e37a
cmp edx, 0x26f
jge 0x40e3f2
lea ecx, [edx*4 + 0x4134f8]
mov eax, dword [ecx]
lea edx, [ecx + 4]
xor eax, dword [edx]
and eax, esi
xor eax, dword [ecx]
mov edi, eax
and edi, 1
mov edi, dword [edi*4 + 0x4124f8]
xor edi, dword [edx - 0x390]
shr eax, 1
xor edi, eax
mov dword [ecx], edi
mov ecx, edx
cmp ecx, 0x413eb4
jl 0x40e3c5
mov ecx, dword [0x413eb4]
mov eax, dword [0x4134f8]
xor eax, ecx
and eax, esi
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
xor eax, dword [ecx*4 + 0x4124f8]
pop edi
xor eax, dword [0x413b28]
pop esi
mov dword [0x413eb4], eax
xor eax, eax
mov ecx, dword [eax*4 + 0x4134f8]
inc eax
mov dword [0x413ec0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
call dword [0x412d90]
cmp eax, dword [0x412ec4]
je 0x40e52d
xor ecx, ecx
mov dword [0x412ec4], eax
mov dword [0x4134f8], eax
inc ecx
mov eax, 0x4134f8
push esi
mov edx, dword [eax]
mov esi, edx
shr esi, 0x1e
xor esi, edx
imul esi, esi, 0x6c078965
add esi, ecx
mov dword [eax + 4], esi
add eax, 4
inc ecx
cmp eax, 0x413eb4
jl 0x40e507
mov dword [0x413ec0], ecx
pop esi
jmp 0x40e361

Function at 0x40e556
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x412786], 0
jne 0x40e58f
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x40e573
shr eax, 1
xor eax, 0xedb88320
jmp 0x40e575
shr eax, 1
dec edx
jne 0x40e566
mov dword [ecx*4 + 0x412ec8], eax
inc ecx
cmp ecx, 0x100
jb 0x40e561
mov byte [0x412786], 1
xor ecx, ecx
or eax, 0xffffffff
cmp dword [esp + 8], ecx
jbe 0x40e5bb
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x412ec8]
inc ecx
cmp ecx, dword [esp + 8]
jb 0x40e59a
not eax
ret 8

Function at 0x40e5c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov cl, byte [eax + 0x100]
push edi
mov byte [ebp - 1], cl
mov cl, byte [eax + 0x101]
xor edi, edi
mov byte [ebp - 2], cl
cmp dword [ebp + 0xc], edi
jbe 0x40e61b
push ebx
push esi
inc byte [ebp - 1]
movzx ecx, byte [ebp - 1]
lea esi, [ecx + eax]
mov dl, byte [esi]
add byte [ebp - 2], dl
movzx ecx, byte [ebp - 2]
add ecx, eax
mov bl, byte [ecx]
mov byte [esi], bl
mov byte [ecx], dl
movzx esi, byte [esi]
mov ecx, dword [ebp + 8]
movzx edx, dl
add esi, edx
and esi, 0xff
mov dl, byte [esi + eax]
add ecx, edi
xor byte [ecx], dl
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x40e5e0
pop esi
pop ebx
mov cl, byte [ebp - 1]
mov byte [eax + 0x100], cl
mov cl, byte [ebp - 2]
mov byte [eax + 0x101], cl
pop edi
leave
ret 8
Function at 0x401000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42c63b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x439f34]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
mov dword [ecx], eax
xor edi, edi
push 0x43d580
mov dword [esp + 0x1c], edi
call fcn.00423905
lea ecx, [esp + 0xc]
or eax, 0xffffffff
push ecx
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
mov dword [esi + 8], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi], edi
call fcn.004226f6
lea edx, [esp + 0xc]
push edx
call fcn.004226f6
lea eax, [esp + 0xc]
push eax
call fcn.004226f6
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4010a0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42c660
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x20]
xor ebx, ebx
lea eax, [edi + 0x2c]
mov dword [esp + 0x18], ebx
push eax
push ecx
push edx
call fcn.00423a11
push eax
lea ecx, [esi + 4]
mov byte [esp + 0x1c], 1
call fcn.004238b5
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], bl
call fcn.004237c8
mov eax, dword [edi]
push 1
mov dword [esi + 8], eax
mov ecx, dword [edi + 0x1c]
push ebx
push ebx
push ecx
call fcn.00414380
mov ecx, dword [edi + 0x20]
xor ebp, ebp
add eax, ecx
mov dword [esi + 0x30], ebx
adc edx, ebp
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
lea edx, [esi + 0x18]
lea eax, [edi + 4]
push edx
push eax
mov dword [esi + 0x2c], ebx
call fcn.00401170
lea ecx, [esi + 0x1c]
lea edx, [edi + 0xc]
push ecx
push edx
call fcn.00401170
lea eax, [esi + 0x20]
add edi, 0x14
push eax
push edi
call fcn.00401170
mov ecx, dword [esp + 0x40]
add esp, 0x18
mov dword [esi], ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call fcn.004237c8
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x4032d0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x42ca28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov eax, dword [0x439f34]
mov dword [esp + 0x18], 0
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea esi, [ecx + 4]
push 0x5c
mov ecx, esi
mov byte [esp + 0x1c], 2
call fcn.004228b6
cmp eax, 0xffffffff
je 0x40334c
push eax
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0042283e
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 3
call fcn.004238b5
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 2
call fcn.004237c8
push 0x4380c0
lea ecx, [esp + 0xc]
call fcn.00422c71
push 0x5c
lea ecx, [esp + 0x24]
call fcn.004228b6
cmp eax, 0xffffffff
pop esi
je 0x4033bd
lea ecx, [esp + 8]
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.0042283e
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x18], 4
call fcn.004238b5
lea ecx, [esp + 8]
mov byte [esp + 0x14], 2
call fcn.004237c8
mov edx, dword [esp]
push 0
push edx
call fcn.00414d33
add esp, 8
test eax, eax
jne 0x4033bd
mov eax, dword [esp]
mov ecx, dword [esp + 4]
push eax
push ecx
call fcn.00414b25
add esp, 8
test eax, eax
je 0x4033bd
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 4]
mov byte [esp + 0x14], 1
call fcn.004237c8
lea ecx, [esp]
mov byte [esp + 0x14], 0
call fcn.004237c8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.004237c8
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4