joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a9710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b68
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push 0
push dword [ebp + 8]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
mov dword [esi], vtable.icu_69::UnicodeSet.0
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10023880
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100a97c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [esi], vtable.icu_69::UnicodeSet.0
push dword [ebp + 8]
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [ebp - 4], 0
mov dword [eax], 0x110000
call fcn.10023880
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100ad890
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158f58
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0x18]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 0x14]
mov dword [esi], vtable.icu_69::UnicodeSet.0
push dword [ebp + 0x10]
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
push dword [ebp + 0xc]
mov dword [esi + 8], eax
push dword [ebp + 8]
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10023880
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x100ad950
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158f88
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0x14]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov dword [esi], vtable.icu_69::UnicodeSet.0
push dword [ebp + 0xc]
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
push dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10023880
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100ae130
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159098
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 8]
mov dword [esi], vtable.icu_69::UnicodeSet.0
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10023880
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4033a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
dec word [0x445a2e]
mov ax, word [0x445a2e]
cwde
xor dword [0x43e2bc], eax
movzx ecx, word [0x444c3c]
imul ecx, ecx, 0x14c58cf9
mov word [0x444c3c], cx
movzx edx, word [0x44441a]
push esi
or edx, 0x7d8921ae
xor esi, esi
mov word [0x44441a], dx
cmp dword [ebp + 8], esi
je 0x40347c
lea edx, [ebp + 8]
mov edi, edi
movzx eax, word [0x443dd6]
mov ecx, dword [ebp + 8]
and eax, 0x43641c37
mov word [0x443dd6], ax
mov dword [ecx], 1
mov eax, dword [0x43be10]
mov dword [0x43e18c], eax
inc dword [0x43be10]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], esi
mov ecx, dword [0x4384b0]
movzx eax, word [0x44634a]
cwde
sar ecx, 4
not eax
and eax, ecx
mov ecx, dword [0x438f10]
and ecx, eax
cmp ecx, 0x95b721be
jl 0x403450
mov dword [0x43ec00], 0x7fedd7fb
mov eax, dword [ebp + 8]
mov ecx, dword [edx + 4]
add edx, 4
mov dword [eax + 8], esi
add dword [0x439b74], 0xde89a49
mov dword [ebp + 8], ecx
add dword [0x438c90], 0x853d581c
cmp dword [ebp + 8], esi
jne 0x4033f0
mov edx, dword [0x43aa70]
add edx, 0x113f5651
cmp edx, 0x17a8acb8
pop esi
jl 0x4034b0
mov eax, 0x3062
mov word [0x444acc], ax
mov edx, dword [0x43e384]
imul edx, edx, 0x75def9fe
mov dword [0x43e384], edx
pop ebp
ret
mov ecx, dword [0x43dfac]
sub ecx, 0xaea5f12
or ecx, 0x61495bb7
cmp ecx, 0xc33c3e75
je 0x4034d4
or dword [0x437aac], 0x3be57aeb
mov edx, dword [0x43e384]
imul edx, edx, 0x75def9fe
mov dword [0x43e384], edx
pop ebp
ret
Function at 0x411310
Capabilities:
Hash data with md5

Disassembly:
push esi
or edx, 0xffffffff
add dword [0x43a9e0], edx
mov eax, dword [0x43cf54]
mov esi, dword [0x43a9e0]
xor eax, esi
xor eax, 0x77693ca8
mov dword [0x43cf54], eax
mov dword [ecx], 0
mov ax, word [0x442c8a]
mov esi, dword [0x43bd14]
cwde
sar eax, 6
and eax, 0xebff3ff7
or esi, eax
or esi, 0xa0cf2ee5
mov dword [0x43bd14], esi
mov dword [ecx + 4], 0
mov eax, dword [0x43bf58]
mov esi, dword [0x439070]
xor eax, esi
mov dword [0x43bf58], eax
mov dword [ecx + 8], 0x67452301
mov dword [0x43cd7c], 0xfbd440c1
mov dword [ecx + 0xc], 0xefcdab89
mov eax, dword [0x43beb4]
cmp eax, 0xe5f79fb3
jle 0x4113a2
mov eax, 0x3c69
mov word [0x442dee], ax
mov dword [ecx + 0x10], 0x98badcfe
mov ax, word [0x441a7e]
movzx esi, word [0x441872]
cwde
or eax, 0x1f32d6d9
xor esi, eax
mov word [0x441872], si
inc word [0x441a7e]
mov dword [ecx + 0x14], 0x10325476
mov ecx, dword [0x437710]
mov eax, 0x89824824
sub eax, ecx
or eax, 0x19ada39e
add dword [0x437a78], eax
add dword [0x437710], edx
pop esi
ret

Function at 0x411470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x438eb4]
mov ecx, dword [0x4388ac]
add eax, 0x1c8241cf
imul ecx, eax
mov dword [0x4388ac], ecx
mov dx, word [0x441854]
movzx ecx, word [0x4416c6]
movsx eax, dx
add eax, 0x54f46a16
and eax, 0x95663890
imul ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov word [0x4416c6], cx
test ebx, ebx
je 0x411590
jmp 0x4114d0
or dword [0x43e34c], 0xd210dcbf
test esi, esi
je 0x41153c
call fcn.00417190
movzx eax, al
cdq
mov ecx, 0xa
idiv ecx
test edx, edx
jne 0x41153c
movzx edx, word [0x4439ac]
add edx, 0x37aeb51b
mov word [0x4439ac], dx
call fcn.00417190
movzx eax, al
cdq
mov ecx, 0xa
idiv ecx
add dl, 0x30
mov byte [esi + edi], dl
movzx edx, word [0x445492]
mov ecx, dword [0x43dac0]
movsx eax, dx
add eax, 0x849721a6
add ecx, eax
mov word [0x445492], cx
jmp 0x41157d
movzx edx, word [0x441c48]
xor edx, 0xef45c0d6
mov word [0x441c48], dx
call fcn.00417190
movzx eax, al
cdq
mov ecx, 0x1a
idiv ecx
add dl, 0x61
mov byte [esi + edi], dl
dec dword [0x43dff4]
mov eax, dword [0x43dff4]
imul eax, eax, 0xda496542
and dword [0x43fce4], eax
add dword [0x43a340], 0x2eb572d4
inc esi
cmp esi, ebx
jne 0x4114d0
mov dword [0x4388b8], 0x8ffd4e13
mov byte [esi + edi], 0
or dword [0x43d960], 0x45c1b5f1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x416a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ax, word [0x441814]
cwde
imul eax, eax, 0x5a1eeefa
add dword [0x43eadc], eax
dec word [0x441814]
mov cx, word [0x445f34]
mov edx, dword [0x43c964]
movsx eax, cx
sub eax, edx
mov edx, dword [ebp + 8]
push ebx
sub eax, 0x30e47f8
push esi
mov esi, dword [ebp + 0xc]
mov word [0x445f34], ax
mov cl, byte [esi]
movzx eax, byte [edx]
movzx ebx, cl
sub eax, ebx
jne 0x416ae4
mov edi, edi
test cl, cl
je 0x416ae4
mov cl, byte [esi + 1]
movzx eax, byte [edx + 1]
inc esi
inc edx
movzx ebx, cl
sub eax, ebx
je 0x416ad0
mov ecx, dword [0x43bfb4]
mov dword [0x43c930], ecx
dec dword [0x43bfb4]
pop esi
pop ebx
test eax, eax
jge 0x416b5e
mov dx, word [0x441768]
movzx ecx, word [0x4456a0]
movsx eax, dx
not eax
add eax, 0xf060b638
or ecx, eax
mov word [0x4456a0], cx
mov edx, dword [0x436e18]
and edx, 0xedd25425
or eax, 0xffffffff
cmp edx, 0xbf3b04e8
jne 0x416b87
mov ecx, dword [0x43cc30]
xor ecx, 0x3ec216b0
cmp ecx, 0x4a2e6600
je 0x416b87
movzx edx, word [0x442eee]
or edx, 0xc5f70356
mov word [0x442eee], dx
jmp 0x416b87
jle 0x416b87
add dword [0x43f9d0], 0xd031244e
dec dword [0x441124]
mov ecx, dword [0x440d00]
add ecx, dword [0x441124]
mov eax, 1
mov dword [0x440d00], ecx
mov edx, dword [0x43b8a0]
mov ecx, 0x9cee0ee0
sub ecx, edx
or dword [0x43ea00], ecx
pop ebp
ret
Function at 0x425780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [0x4434ba]
movsx ecx, ax
and ecx, 0xb699ff73
mov dword [0x43fb80], ecx
mov edx, dword [0x43e69c]
mov eax, dword [0x43c6cc]
sub edx, eax
mov dword [0x43e69c], edx
mov eax, dword [0x440034]
movzx ecx, word [0x443460]
or eax, 0x4d80a5c2
imul ecx, eax
mov word [0x443460], cx
mov edx, dword [0x440bec]
mov eax, dword [0x4380d0]
mov ecx, dword [ebp + 8]
imul edx, eax
mov dword [0x440bec], edx
mov edx, dword [ebp + 0xc]
push esi
push edi
lea edi, [ecx + edx*4]
or edx, 0xffffffff
add word [0x442e68], dx
movzx eax, word [0x442e68]
mov esi, dword [0x43e2d4]
cwde
imul esi, eax
cmp esi, 0x27e6609
jle 0x425816
mov eax, 0xfffff718
mov word [0x442cde], ax
jmp 0x42583a
add dword [0x43f570], edx
mov esi, dword [0x437b88]
sar esi, 0xa
mov eax, 0xe1364b6a
sub eax, esi
mov esi, dword [0x43f570]
add eax, esi
or dword [0x437910], eax
movzx esi, word [0x4425ca]
mov eax, dword [ebp + 0x10]
sub esi, 0x560de805
mov word [0x4425ca], si
cmp ecx, edi
je 0x42590c
lea esp, [esp]
add dword [0x4385b4], 0x99e4f652
xor dword [ecx], eax
mov edx, dword [0x43bb60]
movzx esi, word [0x4448b2]
xor edx, 0x3c353050
sub esi, edx
ror eax, 4
mov edx, eax
mov word [0x4448b2], si
movzx eax, word [0x444224]
mov esi, dword [0x43f774]
cwde
xor eax, 0xd560e22
or esi, eax
mov dword [0x43d844], esi
movzx eax, word [0x446974]
mov esi, dword [0x439550]
cwde
sub eax, esi
sub eax, 0x41fff216
mov word [0x446974], ax
inc word [0x4468f6]
movzx esi, word [0x4468f6]
mov dword [ebp + 8], edx
mov eax, edx
mov dl, byte [ebp + 8]
shr eax, 8
add al, dl
movsx esi, si
add dword [0x43a218], esi
or dword [0x440b40], 0xb6fe2ebb
add dl, al
add ecx, 4
mov byte [ebp + 9], al
mov byte [ebp + 8], dl
mov eax, dword [ebp + 8]
cmp ecx, edi
jne 0x425860
mov edx, 0xffffffff
mov ecx, dword [0x437794]
add dword [0x437794], edx
cmp ecx, 0x71a3e62c
pop edi
pop esi
jg 0x425935
mov edx, dword [0x439170]
add edx, 0x57a1868c
mov word [0x442be8], dx
pop ebp
ret
Function at 0x430960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add dword [0x43d528], 0x175f7e6e
sub esp, 0x14
push ebx
push edi
mov edi, ecx
call fcn.00411740
test al, al
jne 0x430b43
mov dword [0x43c1e8], 0x18005d20
add dword [0x43e410], 0xdc392d4d
push esi
lea ecx, [ebp - 0x14]
call fcn.00421720
movzx eax, word [0x445456]
and eax, 0x59f79d19
mov word [0x445456], ax
mov cx, word [0x44381c]
movsx edx, cx
not edx
mov ecx, edi
mov dword [0x43ae28], edx
call fcn.0040f7d0
mov ecx, edi
mov esi, eax
call fcn.0040f7e0
cmp esi, eax
je 0x430aa3
lea ebx, [ebx]
or ebx, 0xffffffff
add dword [0x4379d8], ebx
add dword [0x43b804], ebx
mov ax, word [0x441fb8]
cwde
lea ecx, [eax + eax]
mov eax, dword [0x4379d8]
sub eax, ecx
mov ecx, dword [0x43b804]
add ecx, eax
cmp ecx, 0xf86894d7
je 0x430a2e
mov edx, dword [0x43bbcc]
sub edx, 0x6adfc57d
cmp edx, 0xf9754064
jg 0x430a2e
and dword [0x438878], 0xde0f32f8
mov ecx, esi
call fcn.004219d0
push eax
call dword [0x4470c0]
test eax, eax
je 0x430a5d
add dword [0x439258], 0x4dbf83d6
push esi
lea ecx, [ebp - 0x14]
call fcn.00426d80
add dword [0x43ed6c], 0xfbffdfef
mov ax, word [0x4437d4]
movsx ecx, ax
sar ecx, 7
cmp ecx, 0x1b40284a
jle 0x430a8f
mov eax, dword [0x4380c8]
mov edx, dword [0x43dac8]
add eax, 0xb12189e5
add edx, eax
mov dword [0x4380c8], edx
add dword [0x43dac8], ebx
mov ecx, edi
add esi, 0x14
call fcn.0040f7e0
cmp esi, eax
jne 0x4309e0
jmp 0x430aa6
or ebx, 0xffffffff
mov eax, dword [0x43c6a8]
or eax, 0x51f78ef4
xor dword [0x4398a0], eax
lea ecx, [ebp - 0x14]
call fcn.00428150
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.0041d670
cmp esi, eax
je 0x430b28
mov ebx, 1
dec word [0x445034]
mov ax, word [0x445034]
mov cx, word [0x446988]
cwde
movsx ecx, cx
and eax, 0x64f445d
xor ecx, eax
and dword [0x43da64], ecx
push esi
mov ecx, edi
call fcn.0041c860
mov edx, dword [0x43a1fc]
add edx, dword [0x439760]
lea ecx, [ebp - 0x14]
mov dword [0x43a1fc], edx
add dword [0x439760], ebx
add esi, 0x14
call fcn.0041d670
cmp esi, eax
jne 0x430ad1
or ebx, 0xffffffff
mov eax, dword [0x43b868]
imul eax, eax, 0x22df086e
lea ecx, [ebp - 0x14]
mov dword [0x43b868], eax
call fcn.00429470
pop esi
jmp 0x430b46
or ebx, 0xffffffff
mov eax, dword [0x43ab50]
mov ecx, dword [0x438950]
mov edx, dword [0x43d6d8]
imul eax, ecx
mov ecx, dword [0x43c854]
add dword [0x43ab50], ebx
or edx, ecx
xor eax, 0x79fa736c
or edx, 0x80cf3784
cmp edx, eax
jge 0x430b96
add dword [0x43e918], ebx
mov dx, word [0x441916]
mov ecx, dword [0x43e918]
movsx eax, dx
or ecx, eax
mov word [0x441916], cx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4e85b48
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x57924bbd
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x406c35
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x406c35
lcall 0x5de5, 0x8b10c483
jmp loc.009ad1e4

Function at 0x414dc9
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx], edi
mov ecx, esi
add esi, 0xdf697202
mov esi, esi
add edx, 4
inc esi
add ecx, 1
cmp edx, ebx
jne fcn.00414dc9
push 0x69b9e088
pop eax
push ecx
mov esi, dword [esp]
add esp, 4
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x417719
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
push dword [ebp + 8]
call fcn.00419d63
push 0xff
call fcn.00419a39
pop ecx
pop ecx
pop ebp
ret
imul esi, dword [0x96a93535], 0xffffffaf
lcall 0x9963, 0x96a29697
xchg edi, eax
xchg esi, eax
mov byte [0xa1996396], al
mov eax, dword [0x35353535]
xchg ecx, eax
xor eax, 0xa77b3535
lcall 0x96a7, 0x979e819a
cmpsd dword [esi], dword es:[edi]
scasb al, byte es:[edi]
xor eax, 0x969aa778
test eax, 0xa79e799a
lcall 0x76ae, 0xa7a4a998
xor eax, 0x7c353535
lcall 0xa499, 0xa39e8ca9
movsb byte es:[edi], byte [esi]
cmpsd dword [esi], dword es:[edi]
scasb al, byte es:[edi]
jbe 0x41773d
xor eax, 0x9a7c3535
test eax, 0x99a39e8c
movsb byte es:[edi], byte [esi]
lodsb al, byte [esi]
test al, 0x79
sahf
cmpsd dword [esi], dword es:[edi]
lcall 0x76ae, 0xa7a4a998
cwde
test eax, 0x76aea7a4
xor eax, 0x7c353535
lcall 0xa1aa, 0x99a482a9
lcall 0x9683, 0x9aa19e7b
mov byte [0x3535769a], al
jl 0x4176d3
test eax, 0x98a4a785
cwde
lcall 0xa596, 0x9a7da8a8
xor eax, 0x969a7d35
movsd dword es:[edi], dword [esi]
jnp 0x4176f4
lcall 0x7d35, 0x3535359a
lcall 0xa4a1, 0xa176a596
cwde
xor eax, 0x9a873535
xchg esi, eax
cdq
jnp 0x417703
mov eax, dword [0x3535359a]
xor eax, 0x7ba99a88
sahf
mov eax, dword [0x9ea4859a]
mov dword [0x35a79aa9], eax
xor eax, 0xa8a4a178
lcall 0x9aa1, 0x99a3967d
xor eax, 0xa99ea78c
lcall 0x3535, 0x9aa19e7b
xor eax, 0xa3a79aa0
lcall 0xa199, 0x636768a1
mov eax, dword [0x35353535]
test byte [ebp - 0x61845c66], ah
mov eax, dword [0x3535359a]
xor eax, 0x79916f78
movsb byte es:[edi], byte [esi]
cwde
stosb byte es:[edi], al
mov byte [0xa8a9a39a], al
push ebp
xchg esi, eax
mov dword [0x9a885599], eax
test eax, 0x9ca39ea9
test al, 0x35
xor eax, 0x35353535
xor eax, 0x35353535
xor eax, 0x55003535
invalid
push ebp
mov ebp, esp
sub esp, 0x6d8
push ebx
push esi
push edi
Function at 0x432003
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x6f6f6fa0], dl
nop
pushal
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x431feb
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4010c0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x42e618]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ecx, ecx
mov al, 1
push edi
lea ebx, [ebx]
movzx edx, al
mov byte [ebp + edx - 0x104], cl
mov dl, al
and dl, 0x80
mov byte [ebp + ecx - 0x204], al
inc ecx
neg dl
sbb dl, dl
mov bl, al
and dl, 0x1b
add bl, bl
xor dl, bl
xor al, dl
cmp ecx, 0x100
jl 0x4010e0
mov al, 1
mov ecx, 0x45e280
movzx edx, al
shl edx, 0x18
mov dword [ecx], edx
mov dl, al
and dl, 0x80
add ecx, 4
neg dl
sbb dl, dl
and dl, 0x1b
add al, al
xor al, dl
cmp ecx, 0x45e2a8
jl 0x401115
mov dword [0x45d680], 0x63
mov dword [0x46084c], 0
mov edx, 1
jmp 0x401160
movzx eax, byte [ebp + edx - 0x104]
lea ecx, [ebp - 0x105]
sub ecx, eax
mov cl, byte [ecx]
mov al, cl
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor al, cl
xor al, 0x63
movzx eax, al
mov dword [edx*4 + 0x45d680], eax
mov dword [eax*4 + 0x4606c0], edx
inc edx
cmp edx, 0x100
jl 0x401160
xor ecx, ecx
mov dl, byte [ecx + 0x45d680]
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
mov bl, dl
add bl, bl
xor al, bl
movzx esi, al
movzx edx, dl
mov eax, esi
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, esi
xor eax, edx
mov dword [ecx + 0x4602c0], eax
ror eax, 8
mov dword [ecx + 0x45fec0], eax
ror eax, 8
mov dword [ecx + 0x45fac0], eax
ror eax, 8
mov dword [ecx + 0x45f6c0], eax
mov al, byte [ecx + 0x4606c0]
test al, al
je 0x40126f
movzx edx, al
movzx esi, byte [ebp + edx - 0x104]
movzx eax, byte [ebp - 0xf9]
add eax, esi
cdq
mov edi, 0xff
idiv edi
movzx eax, byte [ebp + edx - 0x204]
mov dword [ebp - 0x208], eax
movzx eax, byte [ebp - 0xf7]
add eax, esi
cdq
idiv edi
movzx eax, byte [ebp - 0xfb]
add eax, esi
movzx ebx, byte [ebp + edx - 0x204]
cdq
idiv edi
movzx eax, byte [ebp - 0xf6]
add eax, esi
mov esi, 0xff
movzx edi, byte [ebp + edx - 0x204]
cdq
idiv esi
movzx eax, byte [ebp + edx - 0x204]
mov edx, dword [ebp - 0x208]
jmp 0x401277
xor edx, edx
jmp loc.0046fc20
shl eax, 8
xor eax, edi
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, edx
mov dword [ecx + 0x45f2c0], eax
ror eax, 8
mov dword [ecx + 0x45eec0], eax
ror eax, 8
mov dword [ecx + 0x45de80], eax
ror eax, 8
mov dword [ecx + 0x45da80], eax
add ecx, 4
cmp ecx, 0x400
jl 0x4011a2
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413878
mov esp, ebp
pop ebp
ret
Function at 0x406d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x45b480
call fcn.004122ab
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x406e24
test esi, esi
jne 0x406e24
mov eax, dword [ebp + 8]
shr eax, 4
inc eax
push esi
movzx ecx, ax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x406e08
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406e02
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406e02
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
add eax, esi
and ecx, 0xf
jbe 0x406df1
cmp esi, eax
jae 0x406df5
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x406de3
cmp esi, eax
jb 0x406df9
xor eax, eax
jmp 0x406e02
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x406e2d
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x45b480
call fcn.004122ab
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x406d95
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406f30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x406f48
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp loc.00471520