joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x417020]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004070e0
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [ebp - 0x234], edx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x23c], ecx
mov edx, dword [ebp - 0x234]
mov ax, word [edx]
mov word [ebp - 0x23e], ax
mov ecx, dword [ebp - 0x238]
mov dx, word [ebp - 0x23e]
mov word [ecx], dx
mov eax, dword [ebp - 0x234]
add eax, 2
mov dword [ebp - 0x234], eax
mov ecx, dword [ebp - 0x238]
add ecx, 2
mov dword [ebp - 0x238], ecx
cmp word [ebp - 0x23e], 0
jne 0x401ad4
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x210]
add eax, 0xfffffffe
mov dword [ebp - 0x244], eax
mov ecx, dword [ebp - 0x244]
mov dx, word [ecx + 2]
mov word [ebp - 0x246], dx
add dword [ebp - 0x244], 2
cmp word [ebp - 0x246], 0
jne 0x401b38
mov edi, dword [ebp - 0x244]
mov eax, dword [0x415634]
mov dword [edi], eax
mov ecx, dword [0x415638]
mov dword [edi + 4], ecx
mov dword [ebp - 0x230], 0
xor edx, edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], edx
mov word [ebp - 0x214], dx
mov dword [ebp - 0x22c], 3
lea eax, [ebp - 0x210]
mov dword [ebp - 0x228], eax
mov ecx, 0x614
mov word [ebp - 0x220], cx
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004060e7
mov esp, ebp
pop ebp
ret

Function at 0x401c00
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x401c29
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401a80
add esp, 4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x401c2b
xor eax, eax
pop ebp
ret
Function at 0x4060e7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417020]
jne 0x4060f1
repz ret
jmp fcn.0040748a

Function at 0x410063
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040af73
and dword [ebp - 4], 0
cmp dword [0x41b44c], 0
mov ebx, eax
jne 0x410114
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4101c5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4101c5
push eax
call fcn.0040af01
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41b44c], eax
call esi
push eax
call fcn.0040af01
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41b450], eax
call esi
push eax
call fcn.0040af01
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41b454], eax
call esi
push eax
call fcn.0040af01
pop ecx
mov dword [0x41b45c], eax
test eax, eax
je 0x410114
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040af01
pop ecx
mov dword [0x41b458], eax
mov eax, dword [0x41b458]
cmp eax, ebx
je 0x41016c
cmp dword [0x41b45c], ebx
je 0x41016c
push eax
call fcn.0040af7c
push dword [0x41b45c]
mov esi, eax
call fcn.0040af7c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41016c
test edi, edi
je 0x41016c
call esi
test eax, eax
je 0x410163
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x410163
test byte [ebp - 0xc], 1
jne 0x41016c
or dword [ebp + 0x10], 0x200000
jmp 0x4101a5
mov eax, dword [0x41b450]
cmp eax, ebx
je 0x4101a5
push eax
call fcn.0040af7c
pop ecx
test eax, eax
je 0x4101a5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4101a5
mov eax, dword [0x41b454]
cmp eax, ebx
je 0x4101a5
push eax
call fcn.0040af7c
pop ecx
test eax, eax
je 0x4101a5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41b44c]
call fcn.0040af7c
pop ecx
test eax, eax
je 0x4101c5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4101c7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x401443
pop dword [ebp - 0x18]
mov eax, 0x401443
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x5f7fb76d
sub dword [ebp - 0x28], 0x112d7222
mov dword [ebp - 0x24], 0x5f09e976
sub dword [ebp - 0x24], 0x2cd69d31
mov dword [ebp - 0x20], 0x4be4fb27
sub dword [ebp - 0x20], 0xff98b6f9
mov dword [ebp - 0x1c], 0xfdfe23e9
add dword [ebp - 0x1c], 0x201dc17
lea eax, [ebp - 0x28]
push eax
mov eax, 0x18bc2939
add eax, 0xe784573f
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xc18eefa2
sub dword [ebp - 0x28], 0x4d1c864c
mov dword [ebp - 0x24], 0x88f66a9e
sub dword [ebp - 0x24], 0x478a0929
mov dword [ebp - 0x20], 0x15fb4baa
add dword [ebp - 0x20], 0x4d7420c2
mov dword [ebp - 0x1c], 0xd5d85db9
sub dword [ebp - 0x1c], 0xd5d85db9
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3a3c1
push 0
call eax
mov ecx, 0x4f6f
xor edx, edx
add edx, eax
mov ebx, 0x451400
add ebx, dword [ebp - 0x18]
mov edi, 0xc6bd367e
xor dword [ebp - 0xc], 0x5c6da928
mov esi, dword [ebx]
mov dword [ebp - 0xc], 0xe5b6eec5
xor esi, edi
add dword [ebp - 0xc], 0x1847d64b
mov dword [edx], esi
sub dword [ebp - 0x10], ebx
add edx, 0x5d47cc5d
sub edx, 0x5d47cc59
add ebx, 4
loop 0x40154b
add eax, 0x53ce5705
sub eax, 0x53cd2676
xor ebx, ebx
add ebx, eax
add eax, 0x96d4e64e
sub eax, 0x96d4e649
mov ecx, 0x1cd65f30
sub ecx, 0x1c965f30
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x50540fec
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
test eax, eax
jle 0x50541011
and eax, 0xffff
or eax, 0x80070000
ret 8

Function at 0x5054eb3e
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x468
push ebx
push ebp
push esi
xor esi, esi
cmp dword [0x5055df98], esi
push edi
mov dword [esp + 0x10], esi
jne 0x5054ed0f
push 0x14
call sub.MSVCR70.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x5054eb6f
mov ecx, eax
call fcn.5054e63e
jmp 0x5054eb71
xor eax, eax
mov dword [0x5055df98], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov dword [esp + 0x14], esi
mov esi, 0x5055dfa0
push esi
call fcn.505574e1
test eax, eax
je 0x5054ed0f
mov ebx, dword [sym.imp.MSVCR70.dll_wcscat]
push 0x505342dc
push esi
call ebx
push esi
mov edi, str.file:__
push edi
call ebx
add esp, 0x10
lea eax, [esp + 0x10]
push eax
mov eax, 0x50537848
push eax
push eax
mov ecx, 0x5055df50
call fcn.50538f90
test eax, eax
mov ebp, dword [sym.imp.MSVCR70.dll_swprintf]
jl 0x5054ec07
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x5054ec07
push dword [esp + 0x1c]
push esi
push 0x505342c4
push esi
call ebp
push dword [esp + 0x2c]
push edi
push 0x505342b8
push edi
call ebp
add esp, 0x20
mov dword [esp + 0x14], 1
jmp 0x5054ec11
push 0x505342ac
push esi
call ebx
pop ecx
pop ecx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5054ec24
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esp + 0x10], 0
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x5054ecc7
cmp dword [esp + 0x14], 0
je 0x5054ed0f
push 0x5053429c
push edi
call dword [sym.imp.MSVCR70.dll_wcscpy]
pop ecx
pop ecx
push esi
call fcn.505574e1
push 0x505342dc
push esi
call ebx
push esi
push edi
call ebx
push 0x505342ac
push esi
call ebx
add esp, 0x18
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5054ed0f
lea eax, [esp + 0x4c]
push eax
push edi
lea eax, [esp + 0x278]
push 0x50534290
push eax
call ebp
mov eax, dword [0x5055df98]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [esp + 0x270]
push edx
push eax
call dword [ecx + 0x20]
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindNextFileW]
test eax, eax
jne 0x5054ec8a
jmp 0x5054ed0f
lea eax, [esp + 0x4c]
push eax
push edi
lea eax, [esp + 0x278]
push 0x50534290
push eax
call ebp
mov eax, dword [0x5055df98]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [esp + 0x270]
push edx
push eax
call dword [ecx + 0x20]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.vsansi.dll_FindNextFileW]
test eax, eax
jne 0x5054ecc7
push dword [esp + 0x18]
call dword [sym.imp.kernel32.dll_FindClose]
mov eax, dword [0x5055df98]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x468
ret
Function at 0x505574e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x505574f0
pop dword [ebp - 0x44]
mov eax, 0xb61121c8
add eax, 0x9a445328
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xaeae35c1
sub dword [ebp - 0x54], 0x605bf076
mov dword [ebp - 0x50], 0xde507b00
sub dword [ebp - 0x50], 0xac1d2ebb
mov dword [ebp - 0x4c], 0x54318593
sub dword [ebp - 0x4c], 0x7e54165
mov dword [ebp - 0x48], 0xc2fc815a
sub dword [ebp - 0x48], 0xc2fc815a
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xb73099f1
sub dword [ebp - 0x54], 0x42be309b
mov dword [ebp - 0x50], 0xa9cd792a
sub dword [ebp - 0x50], 0x686117b5
mov dword [ebp - 0x4c], 0xc25fba95
add dword [ebp - 0x4c], 0xa10fb1d7
mov dword [ebp - 0x48], 0xf9613f40
add dword [ebp - 0x48], 0x69ec0c0
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x3452cda3
sub eax, 0xe3ffbc6f
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3572a
push 0
call eax
mov ecx, 0xdb768247
sub ecx, 0xdb764a3e
xor edx, edx
add edx, eax
mov ebx, 0x112c70fe
sub ebx, 0xc0d620fe
add ebx, dword [ebp - 0x44]
mov edi, 0x8a895f91
add edi, 0x88c6f97
add dword [ebp - 4], esi
mov esi, dword [ebx]
mov dword [ebp - 0x20], 0xa1906a8a
add esi, edi
sub dword [ebp - 0x40], 0xc744ea0c
mov dword [edx], esi
xor dword [ebp - 0x40], 0x358b786e
add edx, 0xbdcf50ec
add edx, 0x4230af18
add ebx, 0xbda554a1
sub ebx, 0xbda5549d
loop 0x5055760f
add eax, 0xb951ae9
sub eax, 0xb9447f2
mov ebx, eax
add eax, 0xf89c837c
add eax, 0x7637c89
mov ecx, 0xad5497e5
add ecx, 0xa2fe681b
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x5055a599
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
mov esi, ecx
call fcn.5055a582
and byte [esi + 0xc], 0
mov eax, 0x50530000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [esi], 0x3c
call sub.MSVCR70.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x5055a5f3
cmp dword [ebp - 0x18], 5
jb 0x5055a60b
jmp 0x5055a607
cmp dword [ebp - 0xc], 1
jne 0x5055a60b
cmp dword [ebp - 0x18], 4
ja 0x5055a607
jne 0x5055a60b
cmp dword [ebp - 0x14], 0
jbe 0x5055a60b
mov byte [esi + 0xc], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x5055c050
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x401e30
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
xor eax, eax
test ecx, ecx
je 0x401f32
test edx, edx
je 0x401f32
cmp dword [esp + 0x2c], 0
mov dword [esp], ecx
je 0x401e7c
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x401e83
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp dword [esp + 0x2c], edi
jne 0x401e60
jmp 0x401e85
mov esi, 0x1505
jmp 0x401e85
mov esi, ecx
mov ecx, dword [esp]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov ebx, edi
sub ebx, 1
jb 0x401f32
mov dword [esp + 0x14], ebx
mov dword [esp + 8], edx
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
xor ebx, ebx
mov edx, edi
mov dword [esp + 4], edi
mov dword [esp + 0xc], ebp
jmp 0x401ed3
mov eax, ebx
and eax, 1
xor ebx, 1
lea ebx, [ebx + eax*2]
cmp ebx, edx
mov ebp, dword [esp + 0xc]
jae 0x401f30
lea eax, [ebx + ebp]
and eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x401f30
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x401ec0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + edi*4]
push ebp
call fcn.00408570
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x401ec0
push dword [esp + 0x2c]
push ebp
push dword [esp + 0x10]
call fcn.00408590
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x401ec0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x401f32
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402cb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x402dc9
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0x402dc2
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
nop
nop
nop
xor eax, eax
cmp esi, 8
mov dword [esp], ebx
jb 0x402d84
mov eax, esi
and eax, 0x1ff8
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
movzx ebx, byte [ebp + ebx]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 1]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 2]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 3]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 4]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 5]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 6]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 7]
add edi, ebx
add ecx, edi
lea ebx, [edx + 8]
add edx, 0xf
cmp edx, esi
jb 0x402d10
add ebp, ebx
jmp 0x402d84
movzx edx, byte [ebp]
inc ebp
add edi, edx
add ecx, edi
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp eax, esi
jb 0x402d70
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov ebx, dword [esp]
sub ebx, esi
mov esi, 0x15b0
jne 0x402cf0
shl ecx, 0x10
or ecx, edi
jmp 0x402dce
mov ecx, 1
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x402e56
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x402e58
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
not ebx
or ebx, 0xf
add ebx, eax
inc ebx
mov ebp, edi
and ebp, 0xf
xor ebp, ebx
mov ebx, dword [ebp*4 + 0x43d928]
shr eax, 4
mov ebp, ebx
and ebp, eax
add ebp, ebp
sub ebx, ebp
add ebx, eax
shr edi, 4
mov eax, edi
xor eax, edi
xor eax, 0xf
and eax, ebx
shr ebx, 4
xor eax, edi
mov eax, dword [eax*4 + 0x43d928]
mov edi, ebx
and edi, eax
add ebx, eax
add edi, edi
mov eax, ebx
sub eax, edi
inc esi
cmp edx, esi
jne 0x402e00
not eax
jmp 0x402e58
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408ba0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
call fcn.00408c60
push eax
mov ebx, esp
push eax
mov esi, esp
sub esp, 0x100
mov edi, esp
jmp 0x408bbb
call fcn.00437240
jmp 0x408bc2
jmp 0x408bc4
test al, 1
jne 0x408bca
jmp 0x408c22
call fcn.00431a40
test al, 1
jne 0x408bd5
jmp 0x408c1b
sub esp, 4
mov dword [esp], 0xfffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebx], eax
jmp 0x408be9
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [esi], eax
lea eax, str.of_system_that_leetspeak__reflection_primarily_the_of_other_modified_on_glyphs_resemblance_is_replacements_similarity_or_eleet_the_ways_used_character_a_often_spellings_on_play_uses_their_via_internet._or_it_in
sub esp, 8
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00408c40
add esp, 8
call fcn.0040a0c0
test al, 1
jne 0x408c14
jmp 0x408c19
call fcn.0040f780
jmp 0x408c1b
call fcn.00437c80
jmp 0x408c22
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x408cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x408dee
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x408cfd
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x408d21
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x408cf0
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x408cf0
lea ebp, [ebx + 1]
push ebp
call fcn.00435ac0
add esp, 4
mov esi, eax
test ebx, ebx
jle 0x408dfc
add ebx, esi
add ebp, esi
mov eax, esi
mov dword [esp + 8], ebp
jmp 0x408d68
mov byte [eax], dl
mov ebp, 1
add edi, 2
add eax, ebp
cmp eax, ebx
mov ebp, dword [esp + 8]
jae 0x408dfe
movzx edx, word [edi]
test dx, dx
je 0x408dfe
cmp dx, 0x7f
jbe 0x408d50
mov ecx, eax
not ecx
add ecx, ebp
movzx ebp, dx
cmp ebp, 0x7ff
ja 0x408db0
xor ebp, ebp
cmp ecx, 2
jb 0x408d57
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov ebp, 2
jmp 0x408d57
mov dword [esp + 4], ebp
xor ebp, ebp
cmp ecx, 3
jb 0x408d57
mov ebp, dword [esp + 4]
mov ecx, ebp
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
shr ebp, 6
mov ecx, ebp
not ecx
or ecx, 0x3f
add ecx, ebp
add cl, 0x81
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov ebp, 3
jmp 0x408d57
push 1
call fcn.00435ac0
add esp, 4
mov esi, eax
jmp 0x408dfe
mov eax, esi
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x408e27
mov eax, ebx
mov byte [esp + ecx + 0xc], al
inc ecx
movzx ebx, byte [esi + ecx]
mov al, 0x2f
cmp ebx, 0x5c
je 0x408e22
test ebx, ebx
jne 0x408e20
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00405050
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x409fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40a0b1
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x409ff9
lea ecx, [edi + 4]
add edi, 2
mov eax, dword [esp]
mov esi, eax
cmp edi, edx
mov edi, ecx
mov ebp, dword [esp + 0x18]
jae 0x40a0b3
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.0040f4d0
add esp, 4
mov ebx, eax
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.0040f4d0
mov edx, dword [esp + 0x20]
add esp, 4
mov bh, al
shl bl, 2
shr al, 4
and al, 3
or al, bl
lea ecx, [esi + 1]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi], al
cmp edi, edx
jae 0x409fe0
movzx eax, byte [ebp + edi]
push eax
call fcn.0040f4d0
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x409fe0
mov bl, al
shl bh, 4
shr al, 2
and al, 0xf
or al, bh
lea ecx, [esi + 2]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi + 1], al
lea eax, [edi + 1]
cmp eax, edx
jae 0x409fe0
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.0040f4d0
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x409fe0
shl bl, 6
mov ecx, eax
xor cl, bl
and bl, al
add bl, bl
add bl, cl
mov eax, dword [esp + 0x20]
mov byte [eax + esi + 2], bl
add esi, 3
mov dword [esp], esi
jmp 0x409fe0
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x414410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x414430
mov edi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x414450
sar esi, 1
sar eax, 1
lea ecx, [esi + eax]
add ecx, 2
test ecx, ecx
jns 0x414470
mov eax, 0xffffffff
jmp 0x414477
add eax, esi
add eax, eax
add eax, 4
push eax
call fcn.00435ac0
add esp, 4
movzx ecx, word [edi]
mov ebx, eax
test cx, cx
je 0x4144a1
add edi, 2
mov ebx, eax
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x414490
mov word [ebx], 0x5c
add ebx, 2
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x4144d1
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4144c0
mov word [ebx], 0
lea ecx, [esp + 0xc]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x44], eax
push eax
call fcn.0043ad70
add esp, 0x14
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x441d20]
mov ecx, 0x93b5080a
xor ecx, dword [0x441d28]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
mov byte [esp + 0x16c], 0x46
mov byte [esp + 0x16d], 0xb1
mov byte [esp + 0x16e], 0x64
mov byte [esp + 0x16f], 0xb7
mov byte [esp + 0x170], 0x59
mov byte [esp + 0x171], 0xb5
mov byte [esp + 0x172], 0x47
mov byte [esp + 0x173], 0xbb
mov byte [esp + 0x174], 0x51
mov byte [esp + 0x175], 0xb9
mov byte [esp + 0x176], 0x66
mov byte [esp + 0x177], 0xbf
mov byte [esp + 0x178], 0x4f
mov byte [esp + 0x179], 0xbd
mov byte [esp + 0x17a], 0x4e
mov byte [esp + 0x17b], 0x43
mov byte [esp + 0x17c], 0xa9
mov byte [esp + 0x17d], 0x41
mov byte [esp + 0x17e], 0x40
mov byte [esp + 0x17f], 0x47
mov word [esp + 0x180], 0
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x44]
cmp ecx, 0x22
jae 0x428c7b
jmp 0x428c34
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x44]
movzx edx, byte [esp + edx + 0x160]
mov esi, ecx
add esi, 0xc05eeae5
lea ecx, [ecx + edx - 0x3fa1151b]
and esi, edx
add esi, esi
sub ecx, esi
add cl, 0xbd
mov edx, dword [esp + 0x44]
mov byte [esp + edx + 0x160], cl
mov ecx, dword [esp + 0x44]
inc ecx
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x44]
cmp ecx, 0x22
jb 0x428c34
jmp 0x428c7b
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x10]
lea edx, [esp + 0x4b8]
mov dword [esp + 0xc], edx
lea edx, [esp + 0x160]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
call ecx
sub esp, 0x18
not eax
shr eax, 0x1f
mov dword [esp + 0x3cc], eax
mov eax, dword [esp + 0x3d0]
mov ecx, dword [esp + 0x3cc]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x445364]
xor ecx, 0x7077dd5f
sub eax, ecx
xor ebx, ebx
jmp eax
mov ecx, dword [esp + 0x300]
xor ecx, 0x19857c5c
mov eax, dword [esp + 0x3ac]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x445398]
xor ecx, 0x87b85de
sub eax, ecx
jmp eax