joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44531c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x491094]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0xc
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], ebx
jge 0x445353
xor eax, eax
jmp 0x445469
mov eax, dword [0x491d30]
inc eax
push edi
xor edi, edi
mov dword [0x491d30], eax
mov dword [ebp - 0x24], edi
cmp eax, 1
jne 0x44537c
push edi
call fcn.00452104
xor eax, 0xbb40e64e
push eax
call fcn.0045bdaa
pop ecx
pop ecx
push ebx
push esi
push dword [ebp - 0x2c]
call fcn.0044549b
mov dword [ebp - 0x28], edi
add esp, 0xc
mov edi, ebx
call fcn.0045bd89
sar eax, 7
movzx edx, al
push edi
push esi
mov dword [ebp - 0x20], edx
call fcn.00445479
push edx
push edi
push esi
mov ebx, eax
call fcn.004454d7
mov ecx, dword [ebp - 0x28]
add esp, 0x14
mov eax, dword [ebp - 0x20]
xor al, bl
mov byte [ebp + ecx - 0x10], al
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0xa
jl 0x44538e
push edi
push esi
push dword [ebp - 0x2c]
call fcn.0044549b
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
mov edi, dword [ebp - 0x24]
add esp, 0xc
sub eax, ecx
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x18]
push edx
push esi
call fcn.00445479
movzx ecx, byte [ebp + edi - 0x10]
mov ebx, eax
push ecx
push edx
push esi
call fcn.004454d7
mov cl, byte [ebp + edi - 0x10]
add esp, 0x14
mov eax, dword [ebp - 0x20]
xor cl, bl
add eax, edi
inc edi
mov byte [ebp + eax - 0x10], cl
cmp edi, 0xa
jl 0x4453e0
mov edx, dword [ebp - 0x18]
push edx
push esi
call fcn.00445479
mov esi, dword [ebp + 0x1c]
mov ebx, esi
shr ebx, 0x10
movzx ecx, bl
push ecx
push edx
push dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
call fcn.004454d7
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x18]
xor bl, byte [ebp - 0x24]
mov edx, dword [ebp - 0x30]
push edx
mov byte [eax + edi], bl
call fcn.00445479
shr esi, 0x18
mov ebx, eax
push esi
push dword [ebp - 0x18]
push edx
call fcn.004454d7
mov ecx, dword [ebp - 0x1c]
mov eax, esi
add esp, 0x28
xor al, bl
mov byte [ecx + edi + 1], al
lea eax, [edi + 2]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00449be1
mov esp, ebp
pop ebp
ret

Function at 0x4454d7
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, ecx
xor eax, dword [ebp + 0x10]
mov edx, dword [edi + 8]
movzx eax, al
shr ecx, 8
mov eax, dword [esi + eax*4]
xor eax, ecx
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx ecx, al
mov eax, dword [ebp + 0x10]
xor edx, dword [esi + ecx*4]
mov dword [edi + 8], edx
pop edi
pop esi
pop ebp
ret
Function at 0x445521
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edi + 0x100b4], ebx
je 0x44558d
cmp dword [edi + 0x80], ebx
jbe 0x44558d
mov eax, 0xffffff54
lea ecx, [edi + 0x100d8]
sub eax, edi
lea esi, [edi + 0xac]
mov dword [ebp + 8], eax
mov edx, dword [edi + 0x100e4]
push edx
push ecx
call fcn.00445479
movzx ecx, byte [esi]
mov ebx, eax
push ecx
push edx
lea eax, [edi + 0x100d8]
push eax
call fcn.004454d7
xor byte [esi], bl
lea ecx, [edi + 0x100d8]
mov eax, dword [ebp + 8]
add esp, 0x14
inc esi
add eax, esi
cmp eax, dword [edi + 0x80]
jb 0x445552
xor ebx, ebx
mov esi, dword [edi + 0x80]
lea eax, [edi + 0xac]
push esi
push eax
push dword [edi + 0x2c]
push dword [edi + 0x1c]
call dword [edi + 8]
add esp, 0x10
mov dword [edi + 0x80], ebx
or ecx, 0xffffffff
mov edx, ebx
cmp eax, esi
cmovne edx, ecx
add dword [edi + 0x100c8], esi
mov ecx, dword [edi + 0x48]
mov eax, edx
adc dword [edi + 0x100cc], ebx
add dword [edi + 0x100d0], ecx
mov dword [edi + 0x48], ebx
adc dword [edi + 0x100d4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x464b0d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046498c

Function at 0x46848d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046814d
Function at 0x46ec3d
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x8c]
add ebx, ecx
cmp esi, 0x102
jae 0x46ed4a
test esi, esi
je 0x46ed4a
xor edx, edx
mov eax, 0x1505
mov dword [ebp - 4], edx
test esi, esi
je 0x46ec8d
mov edi, edx
movzx ecx, byte [edi + ebx]
imul eax, eax, 0x21
add eax, ecx
inc edi
cmp edi, esi
jb 0x46ec79
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
movzx eax, al
mov ebx, dword [edi + eax*4 + 0xb4]
mov dword [edi + eax*4 + 0xb4], ecx
mov dword [edi + 0x4c8], edx
test ebx, ebx
je 0x46ed4a
sub ecx, ebx
cmp ecx, esi
jbe 0x46ed4a
mov eax, dword [edi + 0x80]
sub eax, 0x106
cmp ecx, eax
jae 0x46ed4a
cmp esi, dword [edi + 0x4cc]
ja 0x46ed4a
test esi, esi
je 0x46ed20
mov ecx, dword [ebp + 0xc]
mov edx, ebx
mov eax, dword [edi + 0x8c]
add eax, ecx
sub edx, ecx
mov dword [ebp + 8], edx
mov edx, dword [ebp - 4]
mov dword [ebp + 0xc], eax
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov al, byte [eax]
cmp al, byte [esi + ecx]
mov esi, dword [ebp + 0x10]
jne 0x46ed4a
lea eax, [ebx + edx]
push eax
push edi
call fcn.0046eb55
pop ecx
pop ecx
cmp eax, 1
jne 0x46ed4a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
inc edx
inc eax
mov dword [ebp - 4], edx
mov dword [ebp + 0xc], eax
cmp edx, esi
jb 0x46eced
mov eax, dword [edi + 0x8c]
lea ecx, [ebx + esi]
cmp byte [ecx + eax - 1], 0x3b
je 0x46ed40
lea eax, [ebx + esi]
push eax
push edi
call fcn.0046eb55
pop ecx
pop ecx
test eax, eax
jne 0x46ed4a
mov dword [edi + 0x4c8], ebx
mov eax, esi
jmp 0x46ed4c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46f7e1
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x46f7ee
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0046f853
Function at 0x404510
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x404600
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x404600
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40455a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x404561
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x404540
jmp 0x404563
mov esi, 0x1505
jmp 0x404563
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x404600
mov eax, edi
xor eax, 1
mov ebx, edi
and ebx, 0xfffffffe
add ebx, ebx
sub ebx, eax
and ebx, esi
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4045a4
inc ebx
dec edi
je 0x4045fe
mov eax, ebx
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x4045fe
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x4045a0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040caf0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x4045a0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040cb10
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x4045a0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x404600
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404da0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x404f03
mov esi, dword [esp + 0x28]
test esi, esi
je 0x404f03
cmp dword [esp + 0x2c], 0
je 0x404f03
push esi
call fcn.0040caf0
add esp, 4
test eax, eax
je 0x404e0a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x404e11
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x404df0
jmp 0x404e13
mov ebx, 0x1505
jmp 0x404e13
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x404ea5
mov dword [esp], eax
mov eax, edi
xor eax, 1
mov esi, edi
and esi, 0xfffffffe
add esi, esi
sub esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404e54
inc esi
dec edi
je 0x404ea5
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404eaa
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x404e50
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040caf0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404e50
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040cb10
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404e50
mov eax, 0xffffffff
jmp 0x404f03
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jae 0x404eef
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
jmp 0x404f03
call fcn.00405b20
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
je 0x404f0b
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push ecx
call fcn.0040caf0
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x404fae
mov eax, edi
xor eax, 1
mov esi, edi
and esi, 0xfffffffe
add esi, esi
sub esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404f54
inc esi
dec edi
je 0x404fae
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404eb2
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x404f50
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040caf0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404f50
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040cb10
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404f50
jmp 0x404eb2
mov ebp, 0xffffffff
jmp 0x404eb2
Function at 0x405870
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405a51
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405a51
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405a51
cmp dword [ecx], 0
jne 0x405a51
push esi
call fcn.0040caf0
add esp, 4
test eax, eax
je 0x4058da
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x4058e1
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x4058c0
jmp 0x4058e3
mov edi, 0x1505
jmp 0x4058e3
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
test edx, edx
je 0x40599b
mov dword [esp], eax
mov eax, edx
xor eax, 1
mov esi, edx
and esi, 0xfffffffe
add esi, esi
sub esi, eax
and esi, edi
lea eax, [edx - 1]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405924
inc esi
dec edx
je 0x40599b
mov ebp, esi
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ebx, dword [eax + ebp*4]
cmp ebx, 0xffffffff
je 0x4059a0
mov eax, dword [ecx + 8]
cmp dword [eax + ebx*4], edi
jne 0x405920
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + ebx*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040caf0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405920
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040cb10
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405920
mov eax, dword [ecx + 0x10]
push dword [eax + ebx*4]
call fcn.00404930
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ebx*4], esi
jmp 0x405a44
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x4059e0
call fcn.00405b20
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405a51
push esi
call fcn.0040caf0
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405a60
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040caf0
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x449008]
add esp, 4
test eax, eax
je 0x405a4c
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c900
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405a51
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406be0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x406d86
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406d7f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x406c70
add ebp, dword [esp + 0x10]
mov esi, dword [esp]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 4]
mov ebx, 0x15b0
je 0x406d7f
mov dword [esp], esi
xor edx, edx
cmp ebx, 8
jb 0x406cda
xor eax, eax
nop
nop
nop
nop
movzx edx, byte [ebp + 4]
movzx esi, byte [ebp]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + 3]
add edi, esi
add ecx, edi
add edi, edx
add ecx, edi
movzx edx, byte [ebp + 5]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + 6]
add esi, edx
add ecx, esi
movzx edi, byte [ebp + 7]
add edi, esi
add ecx, edi
mov esi, eax
xor esi, 8
and eax, 8
lea edx, [esi + eax*2]
add ebp, 8
lea esi, [esi + eax*2]
add esi, 7
mov eax, edx
cmp esi, ebx
jb 0x406c80
mov eax, edx
sub eax, ebx
mov dword [esp + 4], ebx
jae 0x406c34
sub ebx, edx
mov dword [esp + 0x10], ebx
and ebx, 3
mov dword [esp + 8], ebx
je 0x406d30
mov dword [esp + 0xc], eax
neg dword [esp + 8]
xor esi, esi
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec esi
cmp dword [esp + 8], esi
jne 0x406d10
sub edx, esi
mov eax, dword [esp + 0xc]
cmp eax, 0xfffffffc
ja 0x406c30
jmp 0x406d3b
mov ebx, ebp
cmp eax, 0xfffffffc
ja 0x406c30
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x406d50
jmp 0x406c30
shl ecx, 0x10
or ecx, edi
jmp 0x406d8b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406da0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x406dce
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x406e6c
not eax
test bl, 1
jne 0x406dd5
mov edx, ebx
cmp ebx, 1
jne 0x406e06
jmp 0x406e6a
xor eax, eax
jmp 0x406e6c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x446c50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x446c50]
cmp ebx, 1
je 0x406e6a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x446c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x446c50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x446c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x446c50]
add esi, 2
cmp edx, esi
jne 0x406e10
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x40d1b0
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [esp], 0x514e1123
xor eax, eax
mov ecx, 0x72
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0x5e
mov edx, eax
and edx, 1
or edx, esi
or dl, 0xa0
xor dl, byte [esp + eax]
mov bl, 0xbe
sub bl, dl
mov byte [esp + eax], bl
inc eax
dec ecx
cmp eax, 4
jne 0x40d1d0
imul esi, dword [esp], 0x34a7ad07
call fcn.00440860
test al, al
je 0x40d3ed
call fcn.00438510
test al, al
je 0x40d3e8
mov eax, esi
shr eax, 7
mov ecx, eax
not ecx
or ecx, 0x9a5ad99d
add ecx, eax
inc ecx
mov edx, eax
and edx, 0x1a52662
xor edx, 0x65a52662
xor esi, 0x65a52662
mov eax, edx
xor eax, ecx
not ecx
and ecx, edx
add eax, edx
sub eax, ecx
mov ecx, eax
and ecx, esi
add ecx, ecx
sub eax, ecx
lea ebx, [eax + esi]
mov edi, ebx
and edi, 0xa51c8fe
mov ebp, edi
xor ebp, 0xa51c8fe
mov ecx, edi
not ecx
lea edx, [ecx + ebx]
add edx, 0xa51c8ff
and ebx, 0xf5ae3701
imul ebx, ebp
add eax, esi
add eax, 0xa51c8ff
mov esi, edi
sub esi, eax
and esi, edi
and ecx, edx
imul ecx, esi
add ecx, ebx
mov eax, edx
and eax, edi
or edi, edx
imul edi, eax
add edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp], 0x270f427b
mov eax, 0x6c2c1147
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x6c2c1147]
xor ecx, eax
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
add cl, 0x9c
mov byte [esp + eax - 0x6c2c1147], cl
inc eax
cmp eax, 0x6c2c114b
jne 0x40d2b0
cmp edi, dword [esp]
jne 0x40d3c5
mov dword [esp], 0x91019f39
mov dword [esp + 4], 0x954c9334
mov dword [esp + 8], 0x891e9733
mov dword [esp + 0xc], 0x8d6a8b2f
mov dword [esp + 0x10], 0x812b8f5d
mov dword [esp + 0x14], 0x8380
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe5
xor cl, byte [esp + eax]
add cl, 0x87
mov byte [esp + eax], cl
inc eax
cmp eax, 0x18
jne 0x40d320
mov dword [esp + 0x18], 0xb726891b
mov dword [esp + 0x1c], 0xb320b559
mov dword [esp + 0x20], 0xb1b0
mov dword [esp + 0x24], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x18]
lea edx, [eax + 0xde]
and edx, ecx
mov esi, edx
and esi, 2
mov edi, edx
or edi, 0xfd
inc edi
mov ebx, edx
and ebx, 0xfffffffd
imul ebx, edi
or edx, 2
imul edx, esi
sub ebx, edx
add ecx, eax
add ecx, 0xde
add ecx, ebx
add cl, 0xaa
mov byte [esp + eax + 0x18], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x10
jb 0x40d360
mov eax, esp
lea ecx, [esp + 0x18]
push 5
push 0
push eax
push 0x448050
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40d3d5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e360
test al, al
je 0x40d3e8
call fcn.00410dc0
call fcn.0040ff80
call fcn.00441a50
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx eax, word [esi]
lea ebp, [esp + 4]
test ax, ax
je 0x40d595
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x40d4a0
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x40d540
cmp ebx, 0x7ff
ja 0x40d4d0
cmp edx, 2
jb 0x40d4d0
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x40d540
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x40d55a
cmp edx, 4
jb 0x40d55a
movzx ecx, word [esi + 2]
add esi, 4
mov eax, ebx
xor eax, 0xd800
and ebx, 0x27ff
add ebx, ebx
sub ebx, eax
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0x2400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx eax, word [esi]
test ax, ax
je 0x40d595
test edx, edx
jne 0x40d480
jmp 0x40d595
movzx eax, ax
cmp eax, 0xdc00
jne 0x40d568
mov esi, edi
jmp 0x40d548
cmp edx, 3
jb 0x40d591
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x40d540
mov eax, ebp
jmp 0x40d540
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ebp], 0
xor eax, eax
jmp 0x40d5b8
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x40d5b0
test ecx, ecx
je 0x40d5cc
mov ebx, ecx
jmp 0x40d5b0
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00408ee0
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc