joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e5e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
cmp di, 0x76d
jb 0x4e5f65
cmp di, 0x801
ja 0x4e5f65
mov ebx, dword [esp + 0x28]
cmp bx, 1
jb 0x4e5f65
cmp bx, 0xc
ja 0x4e5f65
mov al, byte [esp + 0x30]
test al, al
je 0x4e5e64
push edi
call fcn.004e63a0
add esp, 4
cmp ax, bx
je 0x4e5e64
mov byte [esp + 0x30], 0
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x13]
lea ecx, [esp + 0x14]
mov word [esi], di
mov edi, dword [esp + 0x38]
push eax
lea edx, [esp + 0x1c]
mov word [edi], bx
mov ebx, dword [esp + 0x30]
push ecx
lea eax, [esp + 0x24]
mov word [ebp], bx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ebx
push ecx
push edx
call fcn.004e5f70
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x30]
push ebx
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
call fcn.004e5d90
add esp, 0x34
mov ebx, eax
xor eax, eax
inc eax
cmp eax, 0x64
mov dword [esp + 0x34], eax
jg 0x4e5f65
test ebx, ebx
jne 0x4e5ef9
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x30]
cmp al, cl
je 0x4e5f5b
test al, al
je 0x4e5eec
push 0xffffffffffffffe1
jmp 0x4e5eee
push 0x1f
push ebp
push edi
push esi
call fcn.004e5d40
add esp, 0x10
neg ebx
push ebx
push ebp
push edi
push esi
call fcn.004e5d40
lea edx, [esp + 0x23]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push eax
mov ax, word [ebp]
lea edx, [esp + 0x34]
push ecx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ecx
push edx
call fcn.004e5f70
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
push edx
call fcn.004e5d90
mov ebx, eax
mov eax, dword [esp + 0x78]
add esp, 0x44
jmp 0x4e5ec6
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
Function at 0x4e75f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x529038
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push 0xce6114
lea ecx, [esp + 4]
call fcn.00518f00
push 0xcac920
lea ecx, [esp + 8]
mov dword [esp + 0x40], 0
call fcn.00518f00
push 0xcac91c
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 1
call fcn.00518f00
push 0xcac918
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 2
call fcn.00518f00
push 0xcac914
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 3
call fcn.00518f00
push 0xcac910
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 4
call fcn.00518f00
push 0xcac90c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 5
call fcn.00518f00
push 0xcac908
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], 6
call fcn.00518f00
push 0xcac904
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 7
call fcn.00518f00
push 0xcac900
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], 8
call fcn.00518f00
push 0xcac8fc
lea ecx, [esp + 0x2c]
mov byte [esp + 0x40], 9
call fcn.00518f00
push 0xcac8f8
lea ecx, [esp + 0x30]
mov byte [esp + 0x40], 0xa
call fcn.00518f00
push 0xcac8f4
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 0xb
call fcn.00518f00
mov eax, dword [esp + 0x44]
mov byte [esp + 0x3c], 0xc
cmp eax, 1
jge 0x4e7720
cmp eax, 0xc
jle 0x4e7720
mov ecx, dword [esp + 0x48]
push 0xce6114
call fcn.00518fcf
jmp 0x4e772e
mov ecx, dword [esp + 0x48]
lea eax, [esp + eax*4]
push eax
call fcn.00518f7f
lea ecx, [esp + 0x30]
mov byte [esp + 0x3c], 0xb
call fcn.00518e92
lea ecx, [esp + 0x2c]
mov byte [esp + 0x3c], 0xa
call fcn.00518e92
lea ecx, [esp + 0x28]
mov byte [esp + 0x3c], 9
call fcn.00518e92
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 8
call fcn.00518e92
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 7
call fcn.00518e92
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 6
call fcn.00518e92
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 5
call fcn.00518e92
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 4
call fcn.00518e92
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 3
call fcn.00518e92
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 2
call fcn.00518e92
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 1
call fcn.00518e92
lea ecx, [esp + 4]
mov byte [esp + 0x3c], 0
call fcn.00518e92
lea ecx, [esp]
mov dword [esp + 0x3c], 0xffffffff
call fcn.00518e92
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x4ef610
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xcf32b0]
xor edx, edx
cmp eax, edx
jne 0x4ef636
xor eax, eax
mov byte [eax + 0xcf31b0], al
inc eax
cmp eax, 0x100
jl 0x4ef61e
mov dword [0xcf32b0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xcf31b0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4ef6c7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4ef69a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4ef668
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4ef740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4ef793
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4ef77a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f6110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5294be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004f6a30
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0xc44524
call fcn.00518bd3
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4f61a3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00518bd3
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4f619c
push 0
mov ecx, eax
call fcn.004ed240
mov dword [esi + 0xc], eax
jmp 0x4f61a5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4f61a5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x506b34
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x506b54
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00505ada
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x506b77
test byte [esp + 8], 2
je 0x506b77
call fcn.00505b4d
mov dword [eax], 0xd
call fcn.00505b56
mov dword [eax], 5
jmp 0x506b50
xor eax, eax
ret

Function at 0x51b272
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x51b2aa
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005192ed
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005192c5
jmp 0x51b2b6
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x51ca3c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x51ca7e
call fcn.00522bb8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x51ca7e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x51ca75
xor eax, eax
jmp 0x51ca86
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0051ca8c
pop edi
pop esi
pop ebx
ret 4

Function at 0x5230e8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x523116
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x523134
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0052304e
jmp 0x523134
mov eax, dword [esi + 0x14]
test eax, eax
je 0x523134
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0052304e
test edi, edi
mov eax, edi
jne 0x52311e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x51140155
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0xb3b3d8c
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x47ca35bc
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x56bd1e7e
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x303b603c
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x42894b78
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x3fb64aff
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x4ddb7f09
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x410e10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.fHUBmpzJ
lea edi, [esi - 0xd000]
push edi
or ebp, 0xffffffff
jmp 0x410e32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x410e39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x410e28
mov eax, 1
add ebx, ebx
jne 0x410e4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x410e40
jne 0x410e5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x410e40
xor ecx, ecx
sub eax, 3
jb 0x410e70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x410ee2
mov ebp, eax
add ebx, ebx
jne 0x410e7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x410e88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x410eac
inc ecx
add ebx, ebx
jne 0x410e98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x410e8d
jne 0x410ea9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x410e8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x410ecc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x410ebd
jmp 0x410e2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x410ecc
add edi, ecx
jmp 0x410e2e
pop esi
mov edi, esi
mov ecx, 0x1fd
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x410eea
cmp byte [edi], 1
jne 0x410eea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x410eef
lea edi, [esi + 0xe000]
mov eax, dword [edi]
or eax, eax
je 0x410f5e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x100b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10108]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x410f1c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10110]
or eax, eax
je 0x410f58
mov dword [ebx], eax
add ebx, 4
jmp 0x410f39
call dword [esi + 0x1010c]
mov ebp, dword [esi + 0x10114]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x410f92
sub esp, 0xffffff80
jmp 0x405884
Function at 0x40bb10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
mov edi, edi
mov edx, dword [edi + 0x3c]
sub edx, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
sub edx, dword [edi + 0x6c]
add eax, 0xfffffefa
add eax, esi
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], eax
jb 0x40bb9c
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.00471ba0
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
add esp, 0xc
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
mov edi, edi
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x40bb6f
sub eax, esi
jmp 0x40bb71
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x40bb60
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x40bb8f
sub eax, esi
jmp 0x40bb91
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x40bb80
mov edx, dword [ebp - 4]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x40bc58
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x40bbc9
xor eax, eax
jmp 0x40bc1c
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x40bbe6
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.0040c670
jmp 0x40bbfe
cmp eax, 2
jne 0x40bc04
mov edx, dword [ebx]
test edx, edx
jne 0x40bbf5
xor eax, eax
jmp 0x40bc01
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.0040cdd0
add esp, 4
mov dword [ebx + 0x30], eax
push dword [ebp - 4]
push dword [ebx]
push dword [ebp - 8]
call fcn.00471ba0
mov eax, dword [ebp - 4]
add dword [ebx], eax
add esp, 0xc
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x40bc44
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x40bc58
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x40bb20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40fc74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 4], 0x7863513
call dword [0x4b3338]
mov ebx, eax
push ebx
call fcn.00451f3f
mov edx, eax
pop ecx
test edx, edx
je 0x40fcba
push edi
xor edi, edi
test ebx, ebx
je 0x40fcb9
sub esi, edx
mov eax, edi
and eax, 3
lea ecx, [edi + edx]
mov al, byte [ebp + eax - 4]
xor al, byte [esi + ecx]
inc edi
mov byte [ecx], al
cmp edi, ebx
jb 0x40fca3
pop edi
pop esi
mov eax, edx
pop ebx
leave
ret
Function at 0x420c8a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x28
mov eax, 0x4a067e
call fcn.00472921
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x28], 0x74736e49
mov dword [ebp - 0x24], 0x536c6c61
mov dword [ebp - 0x20], 0x6c656968
mov word [ebp - 0x1c], 0x64
cmp byte [ebp + 0xc], bl
je 0x420ccf
mov dword [ebp - 0x1b], 0x7a695720
mov dword [ebp - 0x17], 0x647261
push 1
lea eax, [ebp - 0x29]
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.00411380
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], 1
mov eax, esi
call fcn.004728d0
ret 8
Function at 0x42dfa9
Capabilities:
Persist via run registry key

Disassembly:
push 0x434
mov eax, 0x4a3c1e
call fcn.00472921
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 4], ebx
push 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerRunOnceEntries
push 0x80000002
lea ecx, [ebp - 0x43c]
call fcn.004018f0
test eax, eax
jne 0x42e10c
push 0x40e
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push ebx
push eax
mov esi, ebx
call fcn.004738d0
add esp, 0xc
lea eax, [ebp - 0x440]
push ebx
push ebx
push eax
push ebx
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x420]
push eax
mov dword [ebp - 0x430], 0x208
push ebx
jmp 0x42e0e5
inc esi
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
mov byte [ebp - 4], 1
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
lea ecx, [ebp - 0x42c]
call fcn.004018f0
test eax, eax
jne 0x42e087
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x42c]
push eax
mov ecx, edi
call fcn.00436ad7
test eax, eax
jne 0x42e0fb
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000002
lea ecx, [ebp - 0x42c]
call fcn.004018f0
test eax, eax
jne 0x42e0be
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x42c]
push eax
mov ecx, edi
call fcn.00436ad7
test eax, eax
jne 0x42e0fb
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x42c]
call fcn.004018c0
push ebx
push ebx
lea eax, [ebp - 0x440]
push eax
push ebx
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
push dword [ebp - 0x43c]
call dword [0x4b3030]
test eax, eax
je 0x42e039
jmp 0x42e10c
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x42c]
call fcn.004018c0
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43c]
call fcn.004018c0
mov eax, ebx
call fcn.004728d0
ret 4