joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404760
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x4047cb
mov esi, dword [esp + 0x30]
test esi, esi
je 0x4047cb
push esi
call fcn.0040cf90
add esp, 4
test eax, eax
je 0x4047aa
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x4047b1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x404790
jmp 0x4047b3
mov ebp, 0x1505
jmp 0x4047b3
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x4047d7
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4047f4
inc ebx
dec edi
je 0x4047cb
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x4047cb
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x4047f0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cf90
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x4047f0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.0040cfb0
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x4047f0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x4047cb
cmp dword [eax + 4], 3
jne 0x4047cb
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x4047cb

Function at 0x404890
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x404991
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x404991
push ebx
call fcn.0040cf90
add esp, 4
test eax, eax
je 0x4048ea
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x4048f1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x4048d0
jmp 0x4048f3
mov esi, 0x1505
jmp 0x4048f3
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x404991
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404924
inc ebp
dec ebx
je 0x40498f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40498f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x404920
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cf90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404920
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cfb0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404920
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40498f
cmp dword [eax + 4], 5
mov edi, 0
jne 0x404991
mov edi, dword [eax + 8]
jmp 0x404991
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4049c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x404ac4
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x404ac4
push ebx
call fcn.0040cf90
add esp, 4
test eax, eax
je 0x404a1a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x404a21
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x404a00
jmp 0x404a23
mov esi, 0x1505
jmp 0x404a23
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x404ac4
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404a54
inc ebp
dec ebx
je 0x404abf
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x404abf
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x404a50
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cf90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404a50
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cfb0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404a50
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x404abf
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x404ac4
mov edi, dword [eax + 8]
jmp 0x404ac4
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404ad0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
push 0x2e
push ebp
call fcn.0040d000
add esp, 8
test eax, eax
je 0x404b34
mov esi, eax
jmp 0x404b14
mov ebp, esi
inc ebp
push 0x2e
push ebp
call fcn.0040d000
add esp, 8
mov esi, eax
test eax, eax
je 0x404b34
mov eax, esi
sub eax, ebp
push eax
push ebp
push edi
call fcn.00404540
add esp, 0xc
xor edi, edi
test eax, eax
je 0x404b00
cmp dword [eax + 4], 4
jne 0x404b00
mov edi, dword [eax + 8]
jmp 0x404b00
xor eax, eax
test edi, edi
je 0x404b9b
test ebp, ebp
je 0x404b9b
push ebp
call fcn.0040cf90
add esp, 4
test eax, eax
je 0x404b7b
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ebx]
test edx, edx
je 0x404b82
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebx
mov ecx, esi
cmp eax, ebx
jne 0x404b60
jmp 0x404b84
mov esi, 0x1505
jmp 0x404b84
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [edi + 0x20]
lea ebx, [ecx - 1]
mov eax, ecx
sub eax, 1
mov dword [esp + 0x14], eax
jae 0x404ba3
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, esi
mov dword [esp], edi
mov eax, dword [edi + 4]
mov dword [esp + 0x10], eax
jmp 0x404bc4
inc ebx
dec ecx
je 0x404b99
mov eax, ebx
and eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x404b99
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + edi*4], esi
jne 0x404bc0
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], ecx
call fcn.0040cf90
mov ecx, dword [esp + 0xc]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x404bc0
push dword [esp + 4]
push dword [esp + 0x10]
push ebp
call fcn.0040cfb0
mov ecx, dword [esp + 0x14]
add esp, 0xc
test eax, eax
jne 0x404bc0
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x404b9b
Function at 0x404cc0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x404d2d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x404d2d
push esi
call fcn.0040cf90
add esp, 4
test eax, eax
je 0x404d0a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x404d11
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x404cf0
jmp 0x404d13
mov ebx, 0x1505
jmp 0x404d13
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x404d35
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x404d44
inc ebp
dec edi
je 0x404d2b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x404d2b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x404d40
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040cf90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404d40
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040cfb0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404d40
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x404d2d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x404d2d
Function at 0x405050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
xor eax, eax
cmp dword [esp + 0x18], 0
je 0x4052ad
cmp dword [esp + 0x1c], 0
jle 0x405254
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
lea edi, [edx + eax]
jmp 0x4050a0
cmp esi, 0xc0
jne 0x4052ab
and eax, 0x1ff800
cmp eax, 0xd800
je 0x4052ab
add edx, ebp
cmp edx, edi
jae 0x405254
movzx ebx, byte [edx]
cmp ebx, 0xf4
ja 0x4052ab
mov ecx, ebx
and cl, 0xfe
cmp cl, 0xc0
je 0x4052ab
mov ecx, ebx
and ecx, 0xffffffc0
cmp ecx, 0x80
je 0x4052ab
mov ebp, 1
test bl, bl
jns 0x405096
mov esi, ebx
and esi, 0xffffffe0
cmp esi, 0xc0
jne 0x405128
mov dword [esp], esi
mov esi, edi
movzx ecx, byte [edx + 1]
mov edi, ecx
and edi, 0xffffffc0
cmp edi, 0x80
jne 0x4052ab
shl ebx, 6
and ecx, 0x3f
lea eax, [ebx + ecx]
add eax, 0xffffd000
mov ebp, 2
xor ebx, ebx
mov edi, esi
mov esi, dword [esp]
cmp eax, 0x80
jae 0x40522b
jmp 0x4052ab
mov ecx, ebx
not ecx
or ecx, 0xf0
add ecx, ebx
cmp ecx, 0xdf
jne 0x405190
movzx ebp, byte [edx + 1]
mov ecx, ebp
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x4052ab
movzx eax, byte [edx + 2]
mov ecx, eax
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x4052ab
and ebx, 0xf
shl ebx, 0xc
and ebp, 0x3f
shl ebp, 6
or ebp, ebx
and eax, 0x3f
or eax, ebp
mov ebp, 3
xor ebx, ebx
cmp eax, 0x80
jae 0x40522b
jmp 0x4052ab
mov ecx, ebx
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x4052ab
movzx ebp, byte [edx + 1]
mov ecx, ebp
not ecx
or ecx, 0xc0
add ecx, ebp
cmp ecx, 0x7f
jne 0x4052ab
mov dword [esp], edi
movzx ecx, byte [edx + 2]
mov edi, ecx
and edi, 0xffffffc0
cmp edi, 0x80
jne 0x4052ab
movzx eax, byte [edx + 3]
mov edi, eax
and edi, 0xffffffc0
cmp edi, 0x80
jne 0x4052ab
and ecx, 0x3f
and ebx, 7
shl ebx, 0xc
and ebp, 0x3f
shl ebp, 6
or ebp, ebx
or ebp, ecx
shl ebp, 6
mov ecx, 0x7f
sub ecx, eax
and ecx, 0x213a3582
and eax, 0x3d
or eax, ecx
xor eax, 0x213a3582
or eax, ebp
mov bl, 1
mov ebp, 4
mov edi, dword [esp]
cmp eax, 0x80
jb 0x4052ab
cmp eax, 0x7ff
jbe 0x40507a
cmp eax, 0xffff
ja 0x405247
test bl, bl
je 0x405086
jmp 0x4052ab
cmp eax, 0x10ffff
jbe 0x405086
jmp 0x4052ab
mov edi, dword [esp + 0x1c]
lea eax, [edi + 1]
push eax
call dword [0x449008]
add esp, 4
test eax, eax
je 0x4052ab
mov esi, eax
mov byte [eax + edi], 0
push edi
push dword [esp + 0x1c]
push eax
call fcn.0040ceb0
add esp, 0xc
push 0x10
call dword [0x449008]
add esp, 4
test eax, eax
je 0x4052a1
mov dword [eax], 0
mov dword [eax + 4], 2
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
jmp 0x4052ad
push esi
call dword [0x449004]
add esp, 4
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4052c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x4053d2
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4053d2
cmp dword [esp + 0x2c], 0
je 0x4053d2
push esi
call fcn.0040cf90
add esp, 4
test eax, eax
je 0x40532a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x405331
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x405310
jmp 0x405333
mov ebx, 0x1505
jmp 0x405333
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x4053da
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405397
call fcn.00406060
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x4053d2
push ecx
call fcn.0040cf90
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x40544d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4053f8
inc edi
dec esi
je 0x40534c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405351
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4053f0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040cf90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4053f0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040cfb0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4053f0
mov eax, 0xffffffff
jmp 0x4053d2
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405468
inc edi
dec esi
je 0x405392
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405397
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405460
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040cf90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405460
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040cfb0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405460
jmp 0x405397
Function at 0x405db0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405f9a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405f9a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405f9a
cmp dword [ecx], 0
jne 0x405f9a
push esi
call fcn.0040cf90
add esp, 4
test eax, eax
je 0x405e1a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405e21
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405e00
jmp 0x405e23
mov edi, 0x1505
jmp 0x405e23
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x405ef4
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405e81
call fcn.00406060
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405f9a
push esi
call fcn.0040cf90
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405fb0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040cf90
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x449008]
add esp, 4
test eax, eax
je 0x405f95
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040ceb0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405f9a
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405f18
inc ebx
dec edx
je 0x405e3c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405e41
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405f10
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040cf90
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405f10
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040cfb0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405f10
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404e20
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405ee9
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407110
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4072b6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4072af
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x4071a5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x4072af
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x40721e
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x4071c0
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x40716d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x407260
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x407240
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x407160
jmp 0x40726f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x407160
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x407280
jmp 0x407160
shl ecx, 0x10
or ecx, edi
jmp 0x4072bb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cd60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x40cdcc
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x40cdae
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x40cdb0
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 2
mov ebp, ebx
or ebx, 2
imul ebx, edx
xor edx, 2
and ebp, 0xfffffffd
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x40cd90
jmp 0x40cdb0
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40cdca
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40cdcc
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d500
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
call fcn.00440390
test al, al
je 0x40d701
mov dword [esp], 0x191a422f
mov dword [esp + 4], 0
mov eax, 0x7b
mov ecx, 0xca34b984
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x7b]
lea esi, [eax - 0x651a5d00]
or esi, edx
not edx
or edx, ecx
and edx, esi
add dl, 0x99
mov byte [esp + eax - 0x7b], dl
inc eax
dec ecx
cmp eax, 0x83
jne 0x40d530
mov eax, dword [esp]
mov dword [esp], 0x85b80a37
mov byte [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xdc
xor dl, byte [esp + ecx]
add dl, 0xb4
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 5
jne 0x40d570
mov ecx, eax
or ecx, 0xc97ed9
mov edx, eax
and edx, 0xc97ed9
imul ecx, edx
xor edx, 0xc97ed9
and eax, 0xff368126
imul eax, edx
mov edx, eax
xor edx, ecx
and eax, ecx
lea ecx, [edx + eax*2]
mov eax, ecx
shr eax, 7
xor eax, ecx
mov ecx, eax
and ecx, 0xb9fe1a8
mov edx, ecx
not edx
add edx, eax
add edx, 0xb9fe1a9
imul edx, ecx
and eax, 0xf4601e57
xor ecx, 0xb9fe1a8
imul ecx, eax
add ecx, edx
cmp ecx, dword [esp]
jne 0x40d6ca
mov dword [esp], 0x9ff399ff
mov dword [esp + 4], 0xa3909df8
mov dword [esp + 8], 0xa7dea1c5
mov dword [esp + 0xc], 0xab8aa5c1
mov dword [esp + 0x10], 0xafc9a99b
mov dword [esp + 0x14], 0xadac
mov eax, 0xcb247f1a
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x34db80e6]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x7e
mov byte [esp + eax + 0x34db80e6], cl
inc eax
cmp eax, 0xcb247f32
jne 0x40d620
mov dword [esp + 0x18], 0x97a0b7d
mov dword [esp + 0x1c], 0x5740773
mov dword [esp + 0x20], 0x304
mov word [esp + 0x24], 0
mov eax, 0x7807ed04
mov ecx, 0x87f812fb
lea esi, [eax - 1]
and esi, 2
xor esi, 0x875812c2
lea edi, [ecx + 1]
or edi, 0x28a32c3d
lea edx, [eax + edi]
mov ebx, ecx
sub ebx, edi
and ebx, esi
xor edx, esi
add edx, esi
sub edx, ebx
xor dl, byte [esp + eax - 0x7807ecec]
xor dl, 0xc2
add dl, 0xf1
mov byte [esp + eax - 0x7807ecec], dl
inc eax
dec ecx
cmp eax, 0x7807ed12
jne 0x40d670
mov eax, esp
lea ecx, [esp + 0x18]
push 5
push 0
push eax
push 0x4483da
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00438d90
test al, al
je 0x40d6fc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetInputState]
test eax, eax
je 0x40d6e9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e7c0
test al, al
je 0x40d6fc
call fcn.004114a0
call fcn.00410010
call fcn.004412f0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]