joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405b30
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x18
mov eax, dword [0x422c40]
xor eax, esp
mov dword [esp + 0x14], eax
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x405bb8
lea eax, [esp + 8]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x405bb8
push eax
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004082ae
add esp, 0x18
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
xor ecx, esp
call fcn.004082ae
add esp, 0x18
ret

Function at 0x405bd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
movzx ecx, word [eax]
test cx, cx
je 0x405bf4
mov edx, ecx
nop
xor edx, 1
lea eax, [eax + 2]
mov word [eax - 2], dx
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x405be0
xor eax, eax
ret

Function at 0x405c00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
or esi, 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
test ecx, ecx
jle 0x405c30
movzx eax, word [edi]
lea edi, [edi + 2]
xor eax, esi
dec ecx
movzx eax, al
shr esi, 8
xor esi, dword [eax*4 + 0x422018]
test ecx, ecx
jg 0x405c16
not esi
pop edi
mov eax, esi
pop esi
ret
Function at 0x405e30
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push 0x423418
push 0
push esi
push str.Options
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x423418
test eax, eax
je 0x405e64
push 0x418924
push esi
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop esi
ret
push 0x418944
push esi
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop esi
ret

Function at 0x405e80
Capabilities:
Read .ini file

Disassembly:
push 0x423418
push 0
push str.Nosaver
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 2
push 0
test eax, eax
jne 0x405eaa
push 1
push 0x11
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
ret
push 0
push 0x11
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
ret

Function at 0x406f90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x20c
mov eax, dword [0x422c40]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x423e40
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.killproc.exe_1
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
push 0x4188b4
push 0x4188b4
lea eax, [esp + 0xc]
push eax
push str.open
push dword [0x42456c]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004082ae
add esp, 0x20c
ret

Function at 0x407000
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x423418
push 0
push 0x418928
push str.Options
call esi
mov dword [0x42419c], eax
sub eax, 0
je 0x4070c6
sub eax, 1
je 0x407096
sub eax, 1
jne 0x4070d4
push eax
push 0x423418
push 0xf
push str.Interval
push str.Options
call esi
imul eax, eax, 0xea60
push eax
push 2
push dword [0x42456c]
call dword [sym.imp.USER32.dll_SetTimer]
push 0x423418
push 1
push 0x4191ec
push str.Options
call esi
push 0x423418
push 0xf
push str.Reach
push str.Options
mov dword [0x424198], eax
call esi
mov dword [0x4241a0], eax
mov eax, 1
pop esi
ret
push 0
push 0x124f80
push 2
push dword [0x42456c]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x424198], 4
mov eax, 1
mov dword [0x4241a0], 0
pop esi
ret
push 2
push dword [0x42456c]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, 1
pop esi
ret
Function at 0x407140
Capabilities:
Create process on windows
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x422c40]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x423418
push 0
push str.MonCPU
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x4071c6
push 0x423e40
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.moncpu.exe
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
push 0x4188b4
push 0x4188b4
lea eax, [esp + 0xc]
push eax
push str.open
push dword [0x42456c]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004082ae
add esp, 0x20c
ret
push 0
push str.moncpuWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x4071e4
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004082ae
add esp, 0x20c
ret

Function at 0x407200
Capabilities:
Create process on windows
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x422c40]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x423418
push 0
push 0x41894c
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x407286
push 0x423e40
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.monram.exe
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
push 0x4188b4
push 0x4188b4
lea eax, [esp + 0xc]
push eax
push str.open
push dword [0x42456c]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004082ae
add esp, 0x20c
ret
push 0
push str.monramWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x4072a4
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004082ae
add esp, 0x20c
ret

Function at 0x4078b0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
lea eax, [esp + 4]
push eax
push 0
push 6
push 0
push 0
push 0
push str.SOFTWAREGodlike_DevelopersRAM_Saver_Pro
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40790b
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [esp + 0x14]
push 1
push 0
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp]
test eax, eax
je 0x407911
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 8
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 8
ret
Function at 0x408d45
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408d84
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408d84
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408d84
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408d84
cmp dword [ecx + 0x74], 0xe
jbe 0x408d84
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40b2c1
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040b138

Function at 0x417590
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4175bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4175bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x407ef8
nop
mov ecx, 0x173e3fd0
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x403e77f5
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10002662
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
jmp 0x10011410
push edx
call fcn.10017fc8
add esp, 0xc
lea eax, [ebp - 0x21]
push eax
mov ecx, dword [ebp - 8]
jmp 0x1000b183
lea eax, [ebp - 0x2c]
jmp 0x10006233
mov esp, ebp
pop ebp
ret
push eax
jmp 0x1001695f
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10011b0d
jmp 0x1000bc14
add esp, 8
jmp 0x10002898
mov byte [ebp - 0x22], 0x2d
lea eax, [ebp - 0x2c]
jmp 0x10006cd9
push edx
jmp 0x1000fb1f
push ecx
mov edx, dword [ebp + 8]
jmp 0x1000aed0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
jmp 0x10010658
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10011b0d
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10011b10
add esp, 0xc
jmp 0x1000aa86
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.1000b14b
add esp, 0xc
jmp 0x1000b646
call fcn.10017fc8
jmp 0x1000cff0
push edx
call fcn.10015c07
jmp 0x10008769
mov dword [ebp - 0xc], 0
push 0x20
jmp 0x1000f23e
mov eax, dword [ebp - 0xc]
jmp 0x10005a3d
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
jmp 0x10002883
Function at 0x1000c38e
Capabilities:
Create thread

Disassembly:
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000a509
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10005434
mov edx, dword [ebp - 8]
jmp 0x1001192c
ret
mov esp, ebp
pop ebp
jmp 0x10009a8c
push ebp
mov ebp, esp
sub esp, 0xc
jmp 0x10015058
mov ecx, dword [ebp + 8]
jmp 0x10017510
push 0
jmp 0x10008005
push edx
jmp 0x1000542e
lea eax, [ebp - 4]
push eax
push 0
jmp 0x1000e0ec
push ecx
push 0x10009a8d
jmp 0x1000f4ef

Function at 0x1000dda4
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x1001ecc0]
jmp 0x100086af
mov ecx, dword [eax*4 + 0x1001e300]
mov dword [ebp - 4], ecx
mov edx, dword [0x1001ecc0]
jmp 0x1000b686
mov ecx, dword [ebp - 4]
jmp 0x10017a03
add edx, 1
mov dword [0x1001ecc0], edx
jmp 0x10010e4a
xor ecx, dword [ebp - 4]
jmp 0x10014a59
cmp dword [0x1001ecc0], 0x270
jne 0x10002ed8
call fcn.10017ffe
jmp 0x10002ed8
push ebp
mov ebp, esp
jmp 0x10011495
xor edx, dword [ebp - 4]
jmp 0x1001260f
shr eax, 0xb
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
jmp 0x1000963b
mov eax, dword [ebp - 4]
jmp 0x1000e4fd
sub esp, 8
jmp 0x1000d647
shl edx, 0xf
and edx, 0xefc60000
jmp 0x1000e377
mov dword [ebp - 4], edx
jmp 0x10017ff1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
jmp 0x10012471
shl ecx, 7
and ecx, 0x9d2c5680
jmp 0x1000ca58
mov eax, dword [ebp - 4]
shr eax, 0x12
xor eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10015288
Capabilities:
Get hostname

Disassembly:
lea eax, [ebp - 0xc]
jmp 0x10003db5
push eax
lea ecx, [ebp - 0x30]
jmp 0x1000d0f2
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
jmp 0x1000fa3e
mov dword [ebp - 0x18], 0
push ecx
jmp 0x1000bba1
test eax, eax
je 0x1000ddad
mov dword [ebp - 0x14], 0
jmp 0x10017de8
push ebp
jmp 0x100187b2
jmp 0x10011ef5
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
jmp 0x1000cb9f
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0xc], 0x10
jmp 0x10001adf
Function at 0x10018e95
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [ebp + 0x10]
jmp 0x1000b427
call fcn.1000d5bc
add esp, 0x18
jmp 0x100181f8
mov cl, byte [eax]
mov byte [edx + ebp - 0xc], cl
mov edx, dword [ebp - 0x10]
jmp 0x1000879b
mov edx, dword [ebp - 0x14]
movsx eax, byte [edx]
jmp 0x1000bf95
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x25
je 0x10017638
jmp 0x10005d09
test eax, eax
je 0x10017638
jmp 0x10004e34
jmp 0x10012d66
mov ecx, dword [ebp + 8]
jmp 0x100122ba
movsx ecx, byte [eax]
cmp ecx, 0x61
jl 0x1000bf9e
jmp 0x10004e22
mov ebp, esp
sub esp, 0x18
jmp 0x10017bf4
cmp dword [ebp - 0x10], 0
je 0x10002005
mov ecx, dword [ebp - 0x10]
mov byte [ecx + ebp - 0xc], 0
mov edx, dword [ebp - 0x14]
movsx eax, byte [edx]
cmp eax, 0x25
jne 0x10002005
lea ecx, [ebp - 0xc]
push ecx
jmp 0x10011249
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x1000e9cd
push eax
jmp 0x100050fa
movsx eax, byte [edx]
jmp 0x10005066
add edx, 1
jmp 0x10014439
cmp dword [ebp - 0x10], 4
jl 0x100050de
jmp 0x10005926
movsx edx, byte [ecx]
test edx, edx
je 0x10005926
mov eax, dword [ebp - 0x14]
jmp 0x10018991
push eax
lea edx, [ebp - 0xc]
jmp 0x1000bcea
mov ecx, dword [ebp - 0x14]
movsx edx, byte [ecx]
jmp 0x10018017
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
jmp 0x10015a7a
push eax
jmp 0x1000dcb3
push edx
jmp 0x10012ea3
cmp eax, 0x66
jle 0x10013832
jmp 0x1000b2c0
add esp, 4
jmp 0x1000b29e
mov ecx, dword [ebp - 0x14]
jmp 0x1000960a
add esp, 8
jmp 0x1000f53b
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
jmp 0x10015343
mov byte [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 4]
jmp 0x10007556
mov dword [ebp - 0x10], 0
jmp 0x10005926
push eax
jmp 0x10011bc6
cmp edx, 0x25
jne 0x10005926
mov eax, dword [ebp - 4]
add eax, 1
jmp 0x100188da
cmp edx, 0x39
jle 0x10013832
jmp 0x1001796e
call fcn.10011406
jmp 0x1000cb72
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 4]
jmp 0x10012779
push ecx
jmp 0x1000375d
call fcn.10011406
add esp, 4
jmp 0x10015a81
add eax, 1
jmp 0x1000bc8c
mov edx, dword [ebp - 0x10]
jmp 0x10018f3f
call fcn.10009e70
jmp 0x1000dcab
push ebp
jmp 0x100057be
jmp 0x10008d13
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x100188dd
mov eax, dword [ebp - 4]
jmp 0x10005f4f
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
jmp 0x100102f5
mov eax, dword [ebp - 0x14]
jmp 0x10005752
mov eax, dword [ebp + 0xc]
jmp 0x1000e9bd
cmp edx, 0x41
jl 0x1000ed44
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
jmp 0x10018938
mov edx, dword [ebp + 0xc]
push edx
jmp 0x10012379
mov dword [ebp - 0x14], eax
jmp 0x1000cbe9
cmp ecx, 0x46
jle 0x10013832
jmp 0x1000ed44
movsx ecx, byte [eax]
cmp ecx, 0x25
je 0x10005926
mov edx, dword [ebp - 0x14]
movsx eax, byte [edx]
cmp eax, 0x30
jl 0x10010fc6
mov ecx, dword [ebp - 0x14]
movsx edx, byte [ecx]
jmp 0x10010fbd
jmp 0x100136dc
mov eax, dword [ebp - 0x14]
jmp 0x10003842
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x1f1477cf
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42e1d0
mov ecx, 0x3ad5402e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4030d0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x4031c0
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x4031c0
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40311a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x403121
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x403100
jmp 0x403123
mov esi, 0x1505
jmp 0x403123
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x4031c0
mov ebx, edi
and ebx, 0xfffffffe
add ebx, ebx
mov eax, edi
xor eax, 1
sub ebx, eax
and ebx, esi
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x403164
inc ebx
dec edi
je 0x4031be
mov eax, ebx
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x4031be
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x403160
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.00409800
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x403160
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.00409820
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x403160
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x4031c0
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403620
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x403783
mov esi, dword [esp + 0x28]
test esi, esi
je 0x403783
cmp dword [esp + 0x2c], 0
je 0x403783
push esi
call fcn.00409800
add esp, 4
test eax, eax
je 0x40368a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x403691
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x403670
jmp 0x403693
mov ebx, 0x1505
jmp 0x403693
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x403725
mov dword [esp], eax
mov esi, edi
and esi, 0xfffffffe
add esi, esi
mov eax, edi
xor eax, 1
sub esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4036d4
inc esi
dec edi
je 0x403725
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x40372a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4036d0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.00409800
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4036d0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.00409820
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4036d0
mov eax, 0xffffffff
jmp 0x403783
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jae 0x40376f
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
jmp 0x403783
call fcn.00403840
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
je 0x40378b
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push ecx
call fcn.00409800
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x40382e
mov esi, edi
and esi, 0xfffffffe
add esi, esi
mov eax, edi
xor eax, 1
sub esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4037d4
inc esi
dec edi
je 0x40382e
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x403732
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4037d0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00409800
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4037d0
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.00409820
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4037d0
jmp 0x403732
mov ebp, 0xffffffff
jmp 0x403732
Function at 0x403f40
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x30]
test ebp, ebp
je 0x404106
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4040ff
mov dword [esp], ebp
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x403fd1
mov eax, dword [esp + 4]
sub eax, ebp
add dword [esp], eax
mov esi, dword [esp + 0xc]
mov eax, edi
mov ebp, 0x80078071
mul ebp
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mul ebp
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 4]
mov ebx, 0x15b0
je 0x4040ff
xor ebp, ebp
cmp ebx, 8
mov dword [esp + 4], ebx
mov dword [esp + 0xc], esi
jb 0x404070
and ebx, 0x1ff8
mov dword [esp + 0x10], ebx
xor eax, eax
mov edx, eax
mov ebx, ecx
mov ecx, dword [esp]
movzx eax, byte [ecx + eax]
add eax, edi
add ebx, eax
movzx esi, byte [ecx + edx + 1]
add esi, eax
add ebx, esi
movzx edi, byte [ecx + edx + 2]
add edi, esi
add ebx, edi
movzx eax, byte [ecx + edx + 3]
add eax, edi
movzx esi, byte [ecx + edx + 4]
add esi, eax
mov dword [esp + 8], esi
movzx edi, byte [ecx + edx + 5]
add edi, esi
mov dword [esp + 0x14], edi
movzx ebp, byte [ecx + edx + 6]
add ebp, edi
movzx edi, byte [ecx + edx + 7]
mov esi, ebp
xor esi, edi
and edi, ebp
lea edi, [esi + edi*2]
add eax, ebx
add eax, dword [esp + 8]
add eax, dword [esp + 0x14]
mov ebx, dword [esp + 4]
add eax, ebp
mov ecx, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, ebx
jb 0x403ff0
mov edx, dword [esp]
add edx, eax
mov esi, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
jmp 0x404073
mov edx, dword [esp]
mov eax, ebp
sub eax, ebx
mov dword [esp], edx
jae 0x403f9d
mov dword [esp + 8], eax
mov eax, ebx
and eax, 3
je 0x4040ae
neg eax
xor ebx, ebx
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x404090
mov eax, ebp
sub eax, ebx
cmp dword [esp + 8], 0xfffffffc
ja 0x403f90
jmp 0x4040bb
mov eax, ebp
cmp dword [esp + 8], 0xfffffffc
ja 0x403f90
mov ebx, dword [esp + 4]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x4040d0
jmp 0x403f90
shl ecx, 0x10
or ecx, edi
jmp 0x40410b
mov ecx, 1
mov eax, ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404120
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40417c
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x40417e
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
mov eax, dword [eax*4 + 0x44380c]
mov ebp, eax
and ebp, ebx
add ebx, eax
add ebp, ebp
sub ebx, ebp
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44380c]
inc esi
cmp edx, esi
jne 0x404140
not eax
jmp 0x40417e
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4095b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x40961c
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x4095fe
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x409600
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 0xfffffffd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x4095e0
jmp 0x409600
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40961a
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40961c
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret