joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
xor eax, eax
cmp dword [esp + 0x18], 0
je 0x405247
cmp dword [esp + 0x1c], 0
jle 0x4051ee
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
lea ecx, [edx + eax]
mov dword [esp], ecx
jmp 0x405088
cmp esi, 0xc0
jne 0x405245
and ebx, 0x1ff800
cmp ebx, 0xd800
mov ecx, dword [esp]
je 0x405245
add edx, ebp
cmp edx, ecx
jae 0x4051ee
movzx ebx, byte [edx]
cmp ebx, 0xf4
ja 0x405245
mov eax, ebx
and al, 0xfe
cmp al, 0xc0
je 0x405245
mov eax, ebx
and eax, 0xffffffc0
cmp eax, 0x80
je 0x405245
mov ebp, 1
test bl, bl
jns 0x40507e
mov esi, ebx
and esi, 0xffffffe0
cmp esi, 0xc0
jne 0x4050f7
movzx edi, byte [edx + 1]
mov eax, edi
xor eax, 0xffffff3f
mov ecx, edi
or ecx, 0xc0
and ecx, eax
cmp ecx, 0x80
jne 0x405245
and ebx, 0x1f
shl ebx, 6
mov ebp, 2
jmp 0x405140
mov eax, ebx
and eax, 0xfffffff0
cmp eax, 0xe0
jne 0x405144
movzx eax, byte [edx + 1]
mov ecx, eax
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x405245
movzx edi, byte [edx + 2]
mov ecx, edi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x405245
and ebx, 0xf
shl ebx, 0xc
and eax, 0x3f
shl eax, 6
or ebx, eax
mov ebp, 3
xor ecx, ecx
jmp 0x4051b1
mov eax, ebx
and eax, 0xfffffff8
cmp eax, 0xf0
jne 0x405245
movzx ecx, byte [edx + 1]
mov eax, ecx
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x405245
movzx eax, byte [edx + 2]
mov edi, eax
and edi, 0xffffffc0
cmp edi, 0x80
jne 0x405245
movzx edi, byte [edx + 3]
mov ebp, edi
and ebp, 0xffffffc0
cmp ebp, 0x80
jne 0x405245
and ebx, 7
shl ebx, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebx
and eax, 0x3f
or eax, ecx
shl eax, 6
mov cl, 1
mov ebp, 4
mov ebx, eax
and edi, 0x3f
or edi, ebx
cmp edi, 0x80
jb 0x405245
cmp edi, 0x7ff
jbe 0x40505d
cmp edi, 0xffff
ja 0x4051e0
test cl, cl
je 0x405069
jmp 0x405245
cmp edi, 0x10ffff
jbe 0x405069
jmp 0x405245
mov edi, dword [esp + 0x1c]
lea eax, [edi + 1]
push eax
call dword [0x44a008]
add esp, 4
test eax, eax
je 0x405245
mov esi, eax
mov byte [eax + edi], 0
push edi
push dword [esp + 0x1c]
push eax
call fcn.0040ce40
add esp, 0xc
push 0x10
call dword [0x44a008]
add esp, 4
test eax, eax
je 0x40523b
mov dword [eax], 0
mov dword [eax + 4], 2
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
jmp 0x405247
push esi
call dword [0x44a004]
add esp, 4
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405250
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x405362
mov esi, dword [esp + 0x28]
test esi, esi
je 0x405362
cmp dword [esp + 0x2c], 0
je 0x405362
push esi
call fcn.0040d060
add esp, 4
test eax, eax
je 0x4052ba
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x4052c1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x4052a0
jmp 0x4052c3
mov ebx, 0x1505
jmp 0x4052c3
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x40536a
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405327
call fcn.00405f60
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x405362
push ecx
call fcn.0040d060
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x4053dd
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405388
inc edi
dec esi
je 0x4052dc
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x4052e1
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405380
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040d060
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405380
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040d080
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405380
mov eax, 0xffffffff
jmp 0x405362
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4053f8
inc edi
dec esi
je 0x405322
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405327
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4053f0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040d060
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4053f0
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040d080
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4053f0
jmp 0x405327
Function at 0x405cb0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405e9a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405e9a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405e9a
cmp dword [ecx], 0
jne 0x405e9a
push esi
call fcn.0040d060
add esp, 4
test eax, eax
je 0x405d1a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405d21
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405d00
jmp 0x405d23
mov edi, 0x1505
jmp 0x405d23
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x405df4
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405d81
call fcn.00405f60
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405e9a
push esi
call fcn.0040d060
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405eb0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040d060
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x44a008]
add esp, 4
test eax, eax
je 0x405e95
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040ce40
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405e9a
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405e18
inc ebx
dec edx
je 0x405d3c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405d41
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405e10
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040d060
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405e10
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040d080
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405e10
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404e00
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405de9
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406f90
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x407136
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40712f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x407025
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x40712f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x40709e
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x407040
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406fed
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x4070e0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x4070c0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406fe0
jmp 0x4070ef
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406fe0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x407100
jmp 0x406fe0
shl ecx, 0x10
or ecx, edi
jmp 0x40713b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407150
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40717e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x40721c
not eax
test bl, 1
jne 0x407185
mov edx, ebx
cmp ebx, 1
jne 0x4071b6
jmp 0x40721a
xor eax, eax
jmp 0x40721c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x447c50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x447c50]
cmp ebx, 1
je 0x40721a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x447c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x447c50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x447c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x447c50]
add esi, 2
cmp edx, esi
jne 0x4071c0
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x40ccf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, edx
mov eax, dword [esp + 0x14]
mov edx, dword [edx + 8]
mov esi, 1
cmp edx, eax
jae 0x40cd60
cmp dword [esp + 0x18], 0
je 0x40cd3e
cmp edx, 1
adc edx, 0
cmp edx, eax
jae 0x40cd42
mov ebx, edx
nop
nop
nop
nop
nop
nop
nop
mov ebp, edx
or ebp, 2
and ebx, 2
imul ebp, ebx
and edx, 0xfffffffd
xor ebx, 2
imul ebx, edx
add ebx, ebp
mov edx, ebx
cmp ebx, eax
jb 0x40cd20
jmp 0x40cd44
mov ebx, eax
jmp 0x40cd44
mov ebx, edx
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40cd5e
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40cd60
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d5f0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push edi
push esi
sub esp, 8
call fcn.00440300
test al, al
je 0x40d6c5
call fcn.00439430
test al, al
je 0x40d6c0
mov dword [esp], 0xcb2b6e3f
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x1e93d451
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x1e93d451]
lea edx, [eax - 0x1e93d400]
and edx, ecx
or ecx, eax
xor ecx, edx
mov edx, ecx
and edx, 0x96
xor edx, 0x80602196
and ecx, 0x610d069
sub ecx, edx
mov edx, ecx
not edx
or edx, 1
add edx, ecx
inc edx
mov esi, edx
and esi, 0xfffffffd
mov edi, edx
and edi, 2
or edx, 2
imul edx, edi
xor edi, 2
imul edi, esi
add edx, edi
mov esi, edx
and esi, ecx
xor edx, ecx
xor edx, 1
lea ecx, [edx + esi*2]
mov byte [esp + eax - 0x1e93d451], cl
inc eax
cmp eax, 0x1e93d458
jne 0x40d630
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40d6ad
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e610
test al, al
je 0x40d6c0
call fcn.00410f40
call fcn.0040ff10
call fcn.00441980
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx eax, word [esi]
lea ebp, [esp + 4]
test ax, ax
je 0x40d865
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x40d770
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x40d810
cmp ebx, 0x7ff
ja 0x40d7a0
cmp edx, 2
jb 0x40d7a0
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x40d810
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x40d82a
cmp edx, 4
jb 0x40d82a
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
mov edi, eax
xor edi, 0xc0
or eax, 0x3f
and eax, edi
add al, 0x80
mov byte [ebp + 2], al
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx eax, word [esi]
test ax, ax
je 0x40d865
test edx, edx
jne 0x40d750
jmp 0x40d865
movzx eax, ax
cmp eax, 0xdc00
jne 0x40d838
mov esi, edi
jmp 0x40d818
cmp edx, 3
jb 0x40d861
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x40d810
mov eax, ebp
jmp 0x40d810
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ebp], 0
xor eax, eax
jmp 0x40d888
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x40d880
test ecx, ecx
je 0x40d89c
mov ebx, ecx
jmp 0x40d880
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00409350
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40d960
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov esi, dword [esp + 0x78]
mov dword [esp + 0x18], ecx
mov eax, dword [ecx + 0x60]
mov dword [esp + 0x14], eax
mov word [esp], 0x7775
mov byte [esp + 2], 0x7e
mov dword [esp + 3], 0
mov edx, 0x6a
mov eax, 0x15
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx - 0x6a]
mov ebx, edx
and ebx, ecx
mov ebp, eax
and ebp, 0x15
mov edi, edx
and edi, 0x6a
or edi, ebp
xor edi, ecx
xor edi, 0x15
not ebx
and ebx, edi
add bl, 0xee
mov byte [esp + edx - 0x6a], bl
inc edx
dec eax
cmp edx, 0x71
jne 0x40d9a0
mov dword [esp + 8], 0xc2c0dce6
mov word [esp + 0xc], 0xd5c2
mov dword [esp + 0xe], 0
mov word [esp + 0x12], 0
xor ebx, ebx
xor ebp, ebp
nop
nop
mov eax, ebx
and eax, 0x1c
mov ecx, ebp
xor ecx, 0x4e
add ecx, eax
xor cl, byte [esp + ebp + 8]
add cl, 0x7a
mov byte [esp + ebp + 8], cl
inc ebp
add ebx, 2
cmp ebp, 0xc
jne 0x40d9f0
mov dword [esp + 0x1c], 0xb2b4e8ef
mov dword [esp + 0x20], 0x4e4a1ce0
mov dword [esp + 0x24], 0x4d52541f
mov dword [esp + 0x28], 0x46594251
mov dword [esp + 0x2c], 0x16415552
mov dword [esp + 0x30], 0x443be1fb
mov dword [esp + 0x34], 0x43594f46
mov dword [esp + 0x38], 0x4a320c4c
mov dword [esp + 0x3c], 0x444b4b41
mov dword [esp + 0x40], 0x74717b4f
mov dword [esp + 0x44], 0x6b220576
mov dword [esp + 0x48], 0x3e7d7171
mov dword [esp + 0x4c], 0x66766460
mov dword [esp + 0x50], 0x7a64370d
mov dword [esp + 0x54], 0x3f117867
mov byte [esp + 0x58], 0xd0
mov dword [esp + 0x59], 0
mov word [esp + 0x5d], 0
xor ebx, ebx
nop
nop
mov eax, ebx
add al, 0xfb
xor al, byte [esp + ebx + 0x1c]
add al, 0x19
mov byte [esp + ebx + 0x1c], al
inc ebx
cmp ebx, 0x43
jne 0x40daa0
mov eax, dword [esp + 0x74]
add eax, dword [esp + 0x14]
movzx ebx, byte [esp + 0x1c]
mov edi, eax
test bl, bl
mov ecx, dword [esp + 0x7c]
je 0x40daec
lea ebp, [esp + 0x1d]
mov edi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [ebp]
inc ebp
test bl, bl
jne 0x40dae0
mov byte [edi], 0
movzx ebx, byte [esi]
test bl, bl
je 0x40db0b
inc esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40db00
mov byte [edi], 0
movzx ebx, byte [esp + 8]
test bl, bl
je 0x40db2b
lea esi, [esp + 9]
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40db20
mov byte [edi], 0
movzx ebx, byte [ecx]
test bl, bl
je 0x40db4b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [ecx]
inc ecx
test bl, bl
jne 0x40db40
mov byte [edi], 0
movzx edx, byte [esp]
test dl, dl
je 0x40db6b
lea esi, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], dl
inc edi
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x40db60
mov byte [edi], 0
sub edi, eax
mov eax, dword [esp + 0x18]
add dword [eax + 0x60], edi
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40e610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
push eax
sub esp, 0x18
mov dword [ebp - 0x10], esp
sub esp, 0x80
mov dword [ebp - 0x18], esp
sub esp, 0x100
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 0x28], esp
push eax
mov dword [ebp - 0x34], esp
sub esp, 0x70
mov dword [ebp - 0x30], esp
sub esp, 0x28
mov dword [ebp - 0x24], esp
sub esp, 0xc
mov dword [ebp - 0x1c], esp
sub esp, 0x40
mov dword [ebp - 0x2c], esp
sub esp, 0x80
mov dword [ebp - 0x38], esp
mov eax, dword [0x450b30]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x44], 0x81868f84
mov dword [ebp - 0x40], 0
mov ecx, 0x1ea24a9e
lea edx, [ebp - 0x44]
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
mov edi, ecx
or edi, esi
and esi, ecx
lea eax, [esi + esi]
not eax
add eax, esi
and eax, edi
mov bl, 0x1a
sub bl, al
mov byte [edx], bl
dec ecx
inc edx
cmp ecx, 0x1ea24a96
jne 0x40e680
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 0xe31be117
mov dword [ecx + 4], 0xe71ee51a
mov dword [ecx + 8], 0xfb0ef90c
mov dword [ecx + 0xc], 0xffc0fd0c
mov dword [ecx + 0x10], 0xf30ef114
mov dword [ecx + 0x14], 0xf7f6f508
mov word [ecx + 0x18], 0
mov byte [ecx + 0x1a], 0
xor esi, esi
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ecx + eax]
mov edi, esi
and edi, 0x10
mov ecx, eax
xor ecx, 0xd862b5a8
add ecx, edi
lea ebx, [edx + edx]
not ebx
add ebx, edx
mov edi, ebx
xor edi, ecx
not edx
and edx, ecx
not ecx
and ecx, ebx
add edi, ebx
sub edi, ecx
lea ecx, [edi + edi]
not ecx
add ecx, edi
or ecx, edx
mov edx, ecx
not edx
and edx, 0xee
and ecx, 0x11
sub ecx, edx
add cl, 0xa6
mov edx, dword [ebp - 0x10]
mov byte [edx + eax], cl
mov ecx, dword [ebp - 0x10]
inc eax
add esi, 2
cmp eax, 0x1b
jne 0x40e6f0
push dword [ebp - 0x3c]
push 0
push ecx
call dword [ebp - 0x20]
mov ecx, 0x450af8
push eax
call fcn.0043ffd0
mov ecx, dword [0x44aaf0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
Function at 0x40f040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
movzx ebx, byte [edx]
test bl, bl
je 0x40f2b5
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40f07c
cmp edx, esi
jae 0x40f2b5
test edi, edi
je 0x40f2b5
movzx ebp, bl
test bl, bl
js 0x40f0c0
mov word [eax], bp
lea ecx, [eax + 2]
inc edx
mov esi, ecx
not esi
and esi, eax
not eax
and eax, ecx
sub eax, esi
sar eax, 1
sub edi, eax
mov eax, ecx
mov esi, dword [esp + 0x28]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40f070
jmp 0x40f2b5
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40f0f8
cmp bl, 0xc2
jb 0x40f0a8
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40f15a
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40f1b0
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40f122
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40f164
cmp ebp, 0xe0
jne 0x40f16d
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40f0a4
jmp 0x40f16d
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40f294
cmp bl, 0xf4
ja 0x40f0a8
movzx ecx, byte [edx + 1]
je 0x40f1bb
cmp ebp, 0xf0
jne 0x40f1c4
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40f0a4
jmp 0x40f1c4
inc edx
mov esi, dword [esp + 0x28]
jmp 0x40f0aa
cmp cl, 0x9f
ja 0x40f0a4
mov esi, ecx
not esi
or esi, 0xc0
add esi, ecx
cmp esi, 0x7f
jne 0x40f29b
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f2a1
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40f092
cmp cl, 0x8f
ja 0x40f0a4
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f29b
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f2a1
mov dword [esp], ebp
movzx ebp, byte [edx + 3]
mov esi, ebp
xor esi, 0xffffff3f
mov dword [esp + 4], ebp
or ebp, 0xc0
and ebp, esi
cmp ebp, 0x80
jne 0x40f2ad
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
mov ebp, dword [esp]
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ecx, ebp
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x40f0a4
mov ebx, dword [esp + 4]
and ebx, 0x3f
or ebx, ebp
cmp ebx, 0x10000
mov esi, dword [esp + 0x28]
jb 0x40f0a8
cmp edi, 2
jb 0x40f294
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
and ebx, 0x3ff
or ebx, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bx
jmp 0x40f092
mov ecx, eax
jmp 0x40f092
inc edx
jmp 0x40f0a4
add edx, 2
mov esi, dword [esp + 0x28]
jmp 0x40f0aa
add edx, 3
jmp 0x40f0a4
mov word [eax], 0
sub eax, dword [esp + 0x1c]
sar eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret