joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e4a
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, esi
call fcn.00401394
push 2
mov ecx, esi
call fcn.0040244c
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push eax
push 1
call edi
mov ecx, dword [esi]
and word [ecx], 0
and dword [esi + 4], 0
test eax, eax
jbe 0x403e9d
lea ebx, [eax + 1]
push ebx
mov ecx, esi
call fcn.0040244c
push eax
push ebx
call edi
mov edi, dword [esi]
push edi
call fcn.0040111b
and word [edi + eax*2], 0
pop ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
and dword [ebp + 8], 0
lea ecx, [eax + 0xf]
mov dword [ebp - 4], ecx
lea ebx, [eax + eax]
push dword [ebp - 4]
mov ecx, esi
call fcn.0040244c
push dword [ebp + 8]
add eax, ebx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [esi]
push edi
call fcn.0040111b
and word [edi + eax*2], 0
add esp, 0x10
push dword [esi]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x403ef2
inc dword [ebp + 8]
cmp dword [ebp + 8], 0xfff
jl 0x403ead
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x403ef9
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x41a34c], esi
jle 0x403f4d
mov eax, dword [0x41a350]
mov eax, dword [eax + esi*4]
add eax, 0xc
push eax
lea ecx, [ebp - 0xc]
call fcn.0040127a
lea eax, [ebp - 0xc]
push eax
call fcn.00403a88
mov eax, dword [0x41a350]
mov eax, dword [eax + esi*4]
pop ecx
push dword [ebp - 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push dword [ebp - 0xc]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
inc esi
cmp esi, dword [0x41a34c]
pop ecx
jl 0x403f0a
pop esi
leave
ret
Function at 0x4042ca
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
push ebx
push esi
push edi
call fcn.00401f00
push 3
call fcn.00401f56
push 2
mov dword [0x41a760], eax
call fcn.00401f56
push 5
mov dword [0x41a75c], eax
call fcn.00401f56
push 0x15
mov dword [0x41a758], eax
call fcn.00401f56
push 0x16
mov dword [0x41a754], eax
call fcn.00401f56
push 0x17
mov dword [0x41a750], eax
call fcn.00401f56
add esp, 0x18
xor ebx, ebx
mov dword [0x41a74c], eax
mov dword [0x41a744], ebx
mov dword [0x41a748], ebx
mov esi, 0x41a344
xor edi, edi
push edi
push ebx
lea eax, [ebp - 0x2a4]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4043e2
push ebx
lea eax, [ebp - 0x98]
push 0x417214
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.00401394
lea ecx, [ebp - 0xc]
call fcn.00401394
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x18]
call fcn.004012ac
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0xc]
call fcn.004012ac
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.00402e83
cmp dword [edi + 0x41a31c], ebx
jne 0x4043d2
push dword [edi + 0x41a320]
lea ecx, [ebp - 0x18]
call fcn.004012ac
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0xc]
call fcn.004012ac
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.00402e83
add edi, 8
cmp edi, 0x28
jb 0x4043a2
lea ecx, [ebp - 0x18]
call fcn.004023de
inc ebx
cmp ebx, 0x40
jl 0x404339
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404933
Capabilities:
Create process on windows
Get disk information
Self delete
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, dword [ebp + 8]
cmp word [esi + 2], 0x3a
jne 0x404ae5
movzx eax, word [esi + 4]
cmp ax, 0x5c
je 0x40495d
cmp ax, 0x2f
jne 0x404ae5
mov ax, word [esi]
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
mov word [ebp - 0xe], 0x3a
mov word [ebp - 0xc], 0x5c
mov word [ebp - 0xa], bx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x404ae5
lea eax, [ebp - 0x28]
push str.7ZSfx_03x.cmd
push eax
call fcn.00403e4a
pop ecx
pop ecx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x404aaf
push edi
lea ecx, [ebp - 0x1c]
call fcn.00401394
push str.:Repeat_r_n
lea ecx, [ebp - 0x1c]
call fcn.004012ac
mov edi, str.del__
push edi
lea ecx, [ebp - 0x1c]
call fcn.00402464
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401365
mov esi, 0x41729c
push esi
lea ecx, [ebp - 0x1c]
call fcn.00402464
push str.if_exist__
lea ecx, [ebp - 0x1c]
call fcn.00402464
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401365
push str.__goto_Repeat_r_n
lea ecx, [ebp - 0x1c]
call fcn.00402464
push edi
lea ecx, [ebp - 0x1c]
call fcn.00402464
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401365
push esi
lea ecx, [ebp - 0x1c]
call fcn.00402464
mov esi, dword [ebp - 0x18]
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0040268d
mov eax, dword [eax]
add esp, 0xc
push ebx
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x34]
mov esi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
pop edi
je 0x404ac0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jne 0x404ac0
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push dword [ebp - 0x28]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x1c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov esi, dword [ebp + 8]
pop ecx
push dword [ebp - 0x28]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x404aeb
push dword [ebp - 0x28]
call fcn.00402b9d
push dword [ebp - 0x1c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x28]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
jmp 0x404aec
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x406349
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ecx, dword [ebp + 8]
push eax
mov dword [ecx], eax
call fcn.0040630b
add esp, 0x1c
leave
ret
Function at 0x408389
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x408391
mov dword [ecx*4 + 0x41aa20], eax
inc ecx
cmp ecx, 0x100
jb 0x40838c
mov edx, 0x800
jmp 0x4083de
mov eax, dword [ecx*4 + 0x41a620]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x41aa20]
inc ecx
mov dword [ecx*4 + 0x41aa1c], eax
cmp ecx, edx
jb 0x4083bd
mov dword [0x41a7ec], 0x414d60
call fcn.0040d3f1
test eax, eax
pop esi
jne 0x408400
mov dword [0x41a7ec], 0x414c80
ret
Function at 0x40d590
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40d5b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40d5b6
xor al, al
jmp 0x40d5d6
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00414a40
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x41424e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x414267
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [edi + ecx - 4]
mov dword [ebp - 4], ecx
lea esi, [eax + edi]
jmp 0x41428a
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x41428f
inc esi
cmp esi, dword [ebp - 4]
jb 0x414281
mov eax, esi
sub eax, edi
cmp esi, dword [ebp - 4]
mov dword [ebp - 8], eax
jae 0x414384
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x4142e3
xor edx, edx
mov cl, byte [esi + 4]
test cl, cl
mov dword [ebp + 0xc], eax
je 0x4142ba
cmp cl, 0xff
jne 0x41430e
xor ebx, ebx
mov bh, cl
movzx ecx, byte [esi + 2]
mov bl, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
cmp dword [ebp + 0x18], 0
je 0x41431c
lea ebx, [edi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x414323
dec ecx
shl edx, cl
and edx, 7
je 0x4142ab
movzx ecx, byte [edx + 0x417bd0]
mov ebx, esi
sub ebx, ecx
cmp byte [edx + 0x417bc8], 0
mov cl, byte [ebx + 4]
je 0x41430b
test cl, cl
je 0x41430b
cmp cl, 0xff
jne 0x4142ab
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x41427c
sub edi, eax
sub edi, dword [ebp + 0x10]
mov ebx, edi
test edx, edx
je 0x414357
movzx edi, byte [edx + 0x417bd0]
push 0x18
shl edi, 3
pop ecx
sub ecx, edi
mov eax, ebx
shr eax, cl
test al, al
je 0x414342
cmp al, 0xff
jne 0x414354
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, edi
xor edi, edi
inc edi
shl edi, cl
dec edi
xor edi, ebx
jmp 0x4142d5
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
mov byte [esi + 1], bl
add eax, 5
jmp 0x41427c
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x15d3268
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.015d33b8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x15d328e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15d327a
add dl, dl
jne 0x15d3299
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15d32ec
xor eax, eax
add dl, dl
jne 0x15d32a6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15d338d
add dl, dl
jne 0x15d32b5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15d32c0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15d32cb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15d32d6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x15d32e2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x15d3285
mov eax, 1
add dl, dl
jne 0x15d32fa
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15d3305
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15d32f1
sub eax, ebx
mov ebx, 1
jne 0x15d3338
mov ecx, 1
add dl, dl
jne 0x15d331e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x15d3329
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15d3315
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x15d3285
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x15d334f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x15d335a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15d3346
cmp eax, 0x7d00
jae 0x15d337d
cmp eax, 0x500
jb 0x15d3378
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x15d3285
cmp eax, 0x7f
ja 0x15d3380
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x15d3285
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x15d33ae
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x15d3285
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403960
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x403b16
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0x403b0f
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0x4039f3
add ebp, dword [esp + 0xc]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov ebx, dword [esp + 0x10]
sub ebx, esi
mov esi, 0x15b0
je 0x403b0f
xor edx, edx
cmp esi, 8
mov dword [esp + 4], esi
jb 0x403a6d
and esi, 0x1ff8
mov dword [esp], esi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 6]
add edx, esi
mov esi, dword [esp + 4]
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, esi
jb 0x403a10
add ebp, edx
mov edx, dword [esp]
mov eax, esi
sub eax, edx
mov dword [esp + 0x10], ebx
jbe 0x4039b8
mov dword [esp], edx
not edx
add edx, esi
mov dword [esp + 8], edx
and esi, 3
mov dword [esp + 0xc], eax
je 0x403ac3
neg esi
xor edx, edx
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0x403aa0
mov eax, dword [esp]
sub eax, edx
mov edx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x4039b0
jmp 0x403ad5
mov ebx, ebp
mov eax, dword [esp + 8]
mov edx, dword [esp]
cmp eax, 3
jb 0x4039b0
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x403ae0
jmp 0x4039b0
shl ecx, 0x10
or ecx, edi
jmp 0x403b1b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x403b8a
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x403b8c
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43d938]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
add edi, ebp
add ebx, ebx
sub edi, ebx
xor eax, dword [edi*4 + 0x43d938]
inc esi
cmp edx, esi
jne 0x403b50
not eax
jmp 0x403b8c
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x270
mov eax, dword [0x449020]
mov dword [esp + 0x60], 0x13e111c1
mov dword [esp + 0x64], 0x1ff71de8
mov dword [esp + 0x68], 0x1bec19ea
mov dword [esp + 0x6c], 0x271525f9
mov dword [esp + 0x70], 0x23162119
mov dword [esp + 0x74], 0x2f0c2d12
mov dword [esp + 0x78], 0x2bf12906
mov dword [esp + 0x7c], 0x37c235c1
mov dword [esp + 0x80], 0x33c131da
mov dword [esp + 0x84], 0x3fc13dcb
mov dword [esp + 0x88], 0x3bee391e
mov dword [esp + 0x8c], 0xc7e4c5e6
mov dword [esp + 0x90], 0xc3f0c1f5
mov dword [esp + 0x94], 0xcffccdf4
mov dword [esp + 0x98], 0xcbe8c90b
mov dword [esp + 0x9c], 0xd73fd513
mov dword [esp + 0xa0], 0xd3eed120
mov dword [esp + 0xa4], 0xdf19ddee
mov dword [esp + 0xa8], 0xdb20d9fe
mov dword [esp + 0xac], 0xe7d8e5e4
mov dword [esp + 0xb0], 0xe3c0e1cd
mov dword [esp + 0xb4], 0xef1ced21
mov dword [esp + 0xb8], 0xeb1ce91e
mov dword [esp + 0xbc], 0xf72df505
mov dword [esp + 0xc0], 0xf312f119
mov dword [esp + 0xc4], 0xff17fd27
mov dword [esp + 0xc8], 0xfbc9f902
mov dword [esp + 0xcc], 0x87b985c5
mov dword [esp + 0xd0], 0x83b681bf
mov dword [esp + 0xd4], 0x8fb28dbf
mov dword [esp + 0xd8], 0x8ba089ae
mov dword [esp + 0xdc], 0x975c955f
mov dword [esp + 0xe0], 0x9347914a
mov dword [esp + 0xe4], 0x9fa89d46
mov dword [esp + 0xe8], 0x9b6c99be
mov dword [esp + 0xec], 0xa751a571
mov dword [esp + 0xf0], 0xa380a149
mov dword [esp + 0xf4], 0xaf43ad6b
mov dword [esp + 0xf8], 0xab5da943
mov dword [esp + 0xfc], 0xb79fb55b
mov dword [esp + 0x100], 0xb37db196
mov dword [esp + 0x104], 0xbf4ebd5a
mov dword [esp + 0x108], 0xbb4fb94f
mov dword [esp + 0x10c], 0x47754555
mov dword [esp + 0x110], 0x43734175
mov dword [esp + 0x114], 0x4f7a4d79
mov dword [esp + 0x118], 0x4b7e497e
mov dword [esp + 0x11c], 0x5762557a
mov dword [esp + 0x120], 0x53705166
mov dword [esp + 0x124], 0x5fbf5d8f
mov dword [esp + 0x128], 0x5bbb59b0
mov dword [esp + 0x12c], 0x678f65a8
mov dword [esp + 0x130], 0x635f6157
mov dword [esp + 0x134], 0x6f556d5f
mov dword [esp + 0x138], 0x6b556958
mov dword [esp + 0x13c], 0x77747554
mov dword [esp + 0x143], 0
mov dword [esp + 0x140], 0
mov dword [esp + 0x10], 0
mov ecx, dword [esp + 0x10]
cmp ecx, 0xe6
ja 0x40dbfd
nop
nop
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
movzx esi, byte [esp + ecx + 0x60]
lea ecx, [edx + esi]
add ecx, 0xab14f6d3
add edx, 0xab14f6d3
and edx, esi
add edx, edx
sub ecx, edx
add cl, 0x3b
mov edx, dword [esp + 0x10]
mov byte [esp + edx + 0x60], cl
inc dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
cmp ecx, 0xe7
jb 0x40dbc0
lea ebx, [esp + 0x60]
push 0
push 0
push 0
push 0
push ebx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x4408bc]
mov ecx, 0x34dbfb1f
xor ecx, dword [0x4408c4]
add eax, ecx
inc eax
jmp eax
Function at 0x413ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x413bc0
mov edi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x413be0
sar esi, 1
sar eax, 1
lea ecx, [esi + eax]
add ecx, 2
test ecx, ecx
jns 0x413c00
mov eax, 0xffffffff
jmp 0x413c07
add eax, esi
add eax, eax
add eax, 4
push eax
call fcn.00436a00
add esp, 4
movzx ecx, word [edi]
mov ebx, eax
test cx, cx
je 0x413c31
add edi, 2
mov ebx, eax
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x413c20
mov word [ebx], 0x5c
add ebx, 2
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x413c61
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413c50
mov word [ebx], 0
lea ecx, [esp + 4]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x1c], eax
push eax
call fcn.0043bb20
add esp, 0x14
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x441cfc]
mov ecx, 0xc4ad7a8e
xor ecx, dword [0x441d04]
add eax, ecx
inc eax
jmp eax
Function at 0x413fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x413fd0
sar esi, 1
lea edi, [esp + 0x7c]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x44945c]
mov ebx, dword [esp + 0x7c]
test ebx, ebx
jns 0x413fff
mov eax, 0xffffffff
jmp 0x414002
lea eax, [ebx + ebx]
push eax
call fcn.00436a00
add esp, 4
push edi
push ebx
mov dword [esp + 0x1c], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x44945c]
mov dword [esp + 0x30], 0x43fe4de0
mov dword [esp + 0x34], 0x47d141e1
mov dword [esp + 0x38], 0xbbda45d0
mov dword [esp + 0x3c], 0xbf1bb912
mov dword [esp + 0x40], 0xb325bd2a
mov dword [esp + 0x44], 0xb725b129
mov dword [esp + 0x48], 0xabaab526
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x90], 0
mov ecx, dword [esp + 0x90]
cmp ecx, 0x1f
ja 0x4140c3
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x90]
mov ecx, dword [esp + 0x90]
movzx esi, byte [esp + ecx + 0x30]
lea ecx, [edx + esi]
add ecx, 0x76
add edx, 0x76
and edx, esi
add edx, edx
sub ecx, edx
add cl, 0xc6
mov edx, dword [esp + 0x90]
mov byte [esp + edx + 0x30], cl
inc dword [esp + 0x90]
mov ecx, dword [esp + 0x90]
cmp ecx, 0x20
jb 0x414080
lea edi, [esp + 0xc0]
lea edx, [esp + 0x30]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xdc]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x7c]
mov ecx, eax
add ecx, 0xd
jns 0x4140f9
mov eax, 0xffffffff
jmp 0x4140fe
add eax, eax
add eax, 0x1a
push eax
call fcn.00436a00
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x14]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x414131
mov eax, dword [esp + 0x14]
lea edx, [eax + 2]
mov eax, ebx
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414120
mov word [eax], 0
movzx ecx, word [esp + 0xc0]
test cx, cx
je 0x414161
lea edx, [esp + 0xc2]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414150
mov word [eax], 0
mov eax, esp
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043bb20
add esp, 0x14
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x442054]
mov ecx, 0x77cb5ba6
xor ecx, dword [0x44205c]
add eax, ecx
inc eax
jmp eax
Function at 0x418d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov dword [esp + 0x20], 0x43dd4de0
mov dword [esp + 0x24], 0x47cf41e5
mov dword [esp + 0x28], 0xbbe84510
mov dword [esp + 0x2c], 0xbf18b91c
lea eax, [esp + 0x30]
mov word [esp + 0x30], 0xbdbc
mov dword [esp + 0x32], 0
mov dword [esp + 0x36], 0
mov dword [esp + 0x3a], 0
mov word [esp + 0x3e], 0
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0xc]
cmp ecx, 0x1f
ja 0x418dd4
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
movzx edx, byte [esp + edx + 0x20]
lea esi, [ecx + edx]
add esi, 0xb80ab476
add ecx, 0xb80ab476
and ecx, edx
add ecx, ecx
mov edx, ecx
xor edx, esi
not ecx
and ecx, esi
add ecx, ecx
sub ecx, edx
add cl, 0xc6
mov edx, dword [esp + 0xc]
mov byte [esp + edx + 0x20], cl
inc dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
cmp ecx, 0x20
jb 0x418d90
mov ebx, dword [ebp + 8]
lea edi, [esp + 0xc]
lea esi, [esp + 0x20]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x1c]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x418e00
mov edi, esi
cmp eax, 0xffffffed
jge 0x418e19
mov eax, 0xffffffff
jmp 0x418e1c
add eax, 0x12
push eax
call fcn.00436a00
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x418e51
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x418e40
mov word [eax], 0
movzx ecx, word [esp + 0xc]
test cx, cx
je 0x418e81
lea edx, [esp + 0xe]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418e70
mov word [eax], 0
push edi
push esi
call fcn.0043bd10
add esp, 8
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x442a6c]
mov ecx, 0x43600467
xor ecx, dword [0x442a74]
add eax, ecx
inc eax
jmp eax