joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c5329
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x5c534b
cmp dword [edi + 0x3c], 0
jne 0x5c534b
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.005da7e6
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.005c5378
pop edi
pop esi
pop ebx
ret 8

Function at 0x5c53c6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.005da7e6
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5c53f7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.005c540a
pop edi
pop esi
pop ebx
ret 8

Function at 0x5c6a23
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5c6a5b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005c4386
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005c435e
jmp 0x5c6a67
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5c85b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5c85fa
call fcn.005da7e6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5c85fa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5c85f1
xor eax, eax
jmp 0x5c8602
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005c8608
pop edi
pop esi
pop ebx
ret 4

Function at 0x5d8f9d
Capabilities:
Create http request

Disassembly:
mov eax, 0x5fd7c0
call fcn.004afa40
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x5d8fd5
call fcn.005da7e6
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x5d8ffa
push eax
push dword [esi + 4]
call fcn.005d9e2c
jmp 0x5d9006
push esi
push eax
mov ecx, 0x1bb2b50
call fcn.005d9017
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x5d9313
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x5fd6d7
call fcn.004afa40
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.005caf61
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x1b55e58]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.005c4068
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.005c4068
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x5dad16
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5dad44
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5dad62
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005dac7c
jmp 0x5dad62
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5dad62
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005dac7c
test edi, edi
mov eax, edi
jne 0x5dad4c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
push edx
out dx, al
push 0xffffffffffffffa9
add al, byte [edi + 0x66072eee]
out 0xbf, eax
adc eax, 0xf1058f24
invalid
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x62ff74b2
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x3e224b9d
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402144
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.00516da0
add esp, 0xc
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
lea ebx, [ebp - 0x224]
mov ecx, esi
push ebx
call fcn.00428b20
test byte [ebx], 1
je 0x40219f
mov eax, dword [ebp - 0x21c]
jmp 0x4021a5
lea eax, [ebp - 0x222]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, ebx
call fcn.00428200
push 0x7fffffff
push 0xffffffffffffffff
push 1
push esi
call fcn.0043f160
add esp, 0x10
mov ebx, eax
test byte [esi], 1
je 0x4021d1
mov esi, dword [esi + 8]
jmp 0x4021d4
add esi, 2
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test edi, edi
je 0x4021f2
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, esi
mov edx, ebx
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403028
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx]
mov esi, dword [ecx + 8]
mov edi, dword [ecx + 4]
add edi, esi
mov edx, eax
shr edx, 1
test al, 1
lea edx, [ecx + edx + 1]
cmovne edx, edi
lea ecx, [ecx + 1]
cmovne ecx, esi
sub edx, ecx
mov eax, edx
cmp edx, 4
jb 0x40307d
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x403057
cmp edx, 1
je 0x40309e
cmp edx, 2
je 0x403095
cmp edx, 3
jne 0x4030a9
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x406050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm1, xmmword [ecx]
movdqu xmm2, xmmword [ecx + 0x10]
movdqu xmm4, xmmword [ecx + 0x20]
movdqu xmm3, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm1
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x40613e
nop word cs:[eax + eax]
movdqa xmm6, xmm0
movdqa xmm1, xmmword [0x53f9c0]
pclmulqdq xmm6, xmm1, 0
movdqa xmm5, xmmword [0x53f9d0]
pclmulqdq xmm0, xmm5, 0x11
movdqa xmm7, xmm0
pxor xmm7, xmm6
movdqa xmm0, xmm2
movdqa xmm1, xmmword [0x53f9c0]
pclmulqdq xmm0, xmm1, 0
pclmulqdq xmm2, xmm5, 0x11
movdqa xmm6, xmm2
pxor xmm6, xmm0
movdqa xmm0, xmm4
pclmulqdq xmm0, xmm1, 0
movdqa xmm2, xmm1
pclmulqdq xmm4, xmm5, 0x11
movdqa xmm1, xmm4
pxor xmm1, xmm0
movdqa xmm0, xmm3
pclmulqdq xmm0, xmm2, 0
pclmulqdq xmm3, xmm5, 0x11
movdqa xmm5, xmm3
pxor xmm5, xmm0
movdqu xmm0, xmmword [ecx]
pxor xmm0, xmm7
movdqu xmm2, xmmword [ecx + 0x10]
pxor xmm2, xmm6
movdqu xmm4, xmmword [ecx + 0x20]
pxor xmm4, xmm1
movdqu xmm3, xmmword [ecx + 0x30]
pxor xmm3, xmm5
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x406090
movdqa xmm1, xmmword [0x53f9e0]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm1, 0
pxor xmm5, xmm2
movdqa xmm2, xmmword [0x53f9f0]
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm1, 0
pxor xmm5, xmm4
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm5
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm3
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm4
cmp eax, 0x10
jb 0x406288
lea edx, [eax - 0x10]
mov esi, edx
shr esi, 4
add esi, 1
and esi, 3
je 0x4061e8
shl esi, 4
xor edi, edi
nop word cs:[eax + eax]
nop
movdqu xmm3, xmmword [ecx + edi]
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm3
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm4
add edi, 0x10
cmp esi, edi
jne 0x4061c0
add ecx, edi
sub eax, edi
movdqa xmm3, xmm0
cmp edx, 0x30
jb 0x40628c
nop word cs:[eax + eax]
nop
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm1, 0
pclmulqdq xmm0, xmm2, 0x11
movdqu xmm3, xmmword [ecx]
pxor xmm3, xmm4
pxor xmm3, xmm0
movdqu xmm0, xmmword [ecx + 0x10]
movdqa xmm4, xmm3
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm0
pclmulqdq xmm3, xmm2, 0x11
pxor xmm3, xmm4
movdqu xmm0, xmmword [ecx + 0x20]
movdqa xmm4, xmm3
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm0
pclmulqdq xmm3, xmm2, 0x11
pxor xmm3, xmm4
movdqu xmm0, xmmword [ecx + 0x30]
movdqa xmm4, xmm3
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm0
pclmulqdq xmm3, xmm2, 0x11
pxor xmm3, xmm4
add eax, 0xffffffc0
add ecx, 0x40
movdqa xmm0, xmm3
cmp eax, 0xf
ja 0x406200
jmp 0x40628c
movdqa xmm3, xmm0
movdqa xmm0, xmmword [0x53f9f0]
pclmulqdq xmm0, xmm3, 1
psrldq xmm3, 8
pxor xmm3, xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
pblendw xmm1, xmm3, 3
psrldq xmm3, 4
pclmulqdq xmm1, xmmword [0x53fa00], 0
pxor xmm1, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm1, 3
pclmulqdq xmm2, xmmword [0x53fa10], 0x10
pblendw xmm2, xmm0, 0xfc
pclmulqdq xmm2, xmmword [0x53fa20], 0
pxor xmm2, xmm1
pextrd eax, xmm2, 1
pop esi
pop edi
pop ebp
ret
Function at 0x407388
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x4073bc
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call fcn.004073c4
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4073b5
mov dword [esi], ebx
call fcn.0042a9a0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x40c7a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
xor eax, eax
dec eax
mov dword [ecx - 4], eax
mov dword [ecx - 8], eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.00529cab
add esp, 0x10
cmp eax, esi
jne 0x40c823
cmp ebx, 1
je 0x40c7c5
cmp ebx, 2
mov esi, 0xffffffff
je 0x40c826
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.0052982b
add esp, 4
neg eax
sbb esi, esi
jmp 0x40c826
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40c840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x40c864
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.00529cab
add esp, 0x14
jmp 0x40c893
test esi, esi
jle 0x40c88c
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, byte [eax + edi]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x40c88e
inc edi
cmp esi, edi
mov eax, ebx
jne 0x40c86d
mov edi, esi
jmp 0x40c88e
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x40c8a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp ebx, eax
je 0x40c8f0
mov edi, ecx
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x40c8f9
xor esi, esi
inc esi
lea eax, [ebp - 0x19]
push dword [edi + 0x20]
push esi
push esi
push eax
call fcn.00529cab
add esp, 0x10
cmp eax, esi
mov esi, 0xffffffff
je 0x40c8f2
jmp 0x40c981
xor ebx, ebx
mov esi, ebx
jmp 0x40c981
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x19]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x40c97e
mov ebx, eax
cmp eax, 3
je 0x40c961
cmp ebx, 1
ja 0x40c97e
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.00529cab
add esp, 0x10
cmp eax, esi
jne 0x40c97e
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x40c904
jmp 0x40c976
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.00529cab
add esp, 0x10
cmp eax, ebx
jne 0x40c97e
mov ebx, dword [ebp + 8]
jmp 0x40c8f2
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x40c9d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x40c9f4
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.00529cab
add esp, 0x14
jmp 0x40ca24
test esi, esi
jle 0x40ca1d
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x40ca1f
inc edi
cmp esi, edi
mov eax, ebx
jne 0x40c9fd
mov edi, esi
jmp 0x40ca1f
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x40ca30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
movzx esi, word [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp si, 0xffff
je 0x40ca7f
mov edi, ecx
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x40ca97
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.00529cab
add esp, 0x10
cmp eax, 1
je 0x40ca81
xor esi, esi
dec esi
jmp 0x40ca81
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x1a]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x40ca7a
mov ebx, eax
cmp eax, 3
je 0x40caff
cmp ebx, 1
ja 0x40ca7a
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.00529cab
add esp, 0x10
cmp eax, esi
jne 0x40ca7a
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x40caa2
jmp 0x40cb18
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.00529cab
add esp, 0x10
cmp eax, ebx
jne 0x40ca7a
movzx esi, word [ebp + 8]
jmp 0x40ca81

Function at 0x410c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x410c7f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x410c61
pop esi
pop edi
pop ebp
ret 8

Function at 0x410d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x410dc1
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x410da1
pop esi
pop edi
pop ebp
ret 8
Function at 0x411c50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov esi, esp
mov dword [esi + 0x78], ebp
lea ecx, [esi + 0x80]
mov dword [ecx - 4], esp
xor edx, edx
dec edx
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x4203f0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x18]
mov word [eax + 4], 0
mov dword [eax], 0x7025
lea edi, [esi + 0x50]
mov dword [edi + 0x10], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esi + 0x70]
push ebx
call fcn.0040cbd0
add esp, 4
push dword [ebp + 0x18]
lea eax, [esi + 0x18]
push eax
push dword [ebx + 4]
push dword [ebx]
push 0x14
push edi
call fcn.00422da3
add esp, 0x18
mov dword [esi + 0x14], eax
add eax, esi
add eax, 0x50
push dword [ebp + 0x10]
mov dword [esi + 0x10], eax
push eax
push edi
call fcn.0040f6ec
add esp, 0xc
mov dword [esi + 0xc], eax
xor eax, eax
dec eax
mov dword [esi + 0x41], eax
mov dword [esi + 0x3d], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
lea edi, [esi + 8]
mov ecx, dword [ebp + 0x10]
push edi
call fcn.00409f0a
lea eax, [esi + 0x80]
mov dword [eax + 8], 0
mov ecx, edi
push 0x598398
call fcn.0040d770
mov ebx, eax
mov ecx, dword [esi + 8]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x411d36
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
mov dword [esi + 0x88], 0xffffffff
lea edx, [esi + 0x20]
mov ecx, ebx
push edx
mov edi, dword [esi + 0x10]
push edi
lea ebx, [esi + 0x50]
push ebx
call eax
mov ecx, dword [esi + 0xc]
mov eax, ecx
sub eax, ebx
cmp ecx, edi
mov ecx, dword [esi + 0x14]
lea ecx, [esi + ecx + 0x20]
lea eax, [esi + eax + 0x20]
cmove eax, ecx
movsx edx, byte [ebp + 0x14]
push edx
push dword [ebp + 0x10]
push ecx
push eax
lea eax, [esi + 0x20]
push eax
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.00401d90
add esp, 0x1c
mov eax, dword [esi + 0x80]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x415260
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, esp
mov dword [esi + 0x88], ebp
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x90]
mov dword [eax - 4], esp
xor edx, edx
dec edx
mov dword [eax + 8], edx
mov dword [eax + 4], 0x420570
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
lea ecx, [esi + 0x20]
mov dword [ecx + 0x60], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx + 0x50], xmm0
movdqa xmmword [ecx + 0x40], xmm0
movdqa xmmword [ecx + 0x30], xmm0
movdqa xmmword [ecx + 0x20], xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
mov dword [esi + 8], ecx
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0xc], fcn.00402910
mov dword [esi + 0x14], edx
mov dword [eax + 8], 1
lea eax, [esi + 4]
mov dword [eax], edx
push eax
call fcn.00409f0a
mov dword [esi + 0x98], 2
lea ecx, [esi + 4]
push 0x598398
call fcn.0040d770
mov dword [esi + 0x10], eax
mov al, byte [ebp + 0x14]
lea ecx, [esi + 0x84]
lea edx, [esi + 3]
mov byte [edx], 0
lea edi, [esi + 0x14]
lea ebx, [esi + 8]
movzx eax, al
push ecx
push edi
push ebx
push dword [esi + 0x10]
push edx
push dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push dword [ecx + 4]
lea ecx, [esi + 4]
push ecx
push eax
push dword [esi + 0x1c]
lea eax, [ebp + 0xc]
push eax
call fcn.0041cce0
add esp, 0x2c
test al, al
je 0x4153be
mov ecx, dword [ebp + 0x20]
test byte [ecx], 1
jne 0x415357
mov word [ecx], 0
jmp 0x415364
mov eax, dword [ecx + 8]
mov byte [eax], 0
mov dword [ecx + 4], 0
cmp byte [esi + 3], 0
je 0x415380
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x2d
call dword [eax + 0x1c]
movsx eax, al
mov ecx, dword [ebp + 0x20]
push eax
call fcn.00421170
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x30
call dword [eax + 0x1c]
mov edx, dword [esi + 8]
mov edi, dword [esi + 0x14]
lea ebx, [edi - 1]
cmp edx, ebx
jae 0x4153aa
lea ecx, [edx + 1]
cmp ebx, ecx
cmova ecx, ebx
cmp byte [edx], al
jne 0x4153aa
inc edx
cmp ecx, edx
jne 0x41539f
mov edx, ecx
mov dword [esi + 0x98], 2
mov ecx, dword [ebp + 0x20]
push edi
push edx
call fcn.0041fde0
lea eax, [ebp + 0x10]
lea ecx, [ebp + 0xc]
push eax
call fcn.00402fb0
mov edi, dword [ebp + 8]
test al, al
je 0x4153d7
mov eax, dword [ebp + 0x1c]
or byte [eax], 2
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
mov ecx, dword [esi + 4]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x4153f0
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
je 0x415412
mov dword [esi + 0x98], 0
push eax
call dword [esi + 0xc]
mov edi, dword [ebp + 8]
add esp, 4
mov eax, dword [esi + 0x90]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x41c8f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0041fda4
mov ebx, eax
test esi, esi
je 0x41c931
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x41c91e
movzx eax, word [eax]
jmp 0x41c925
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x41c931
test bl, bl
jne 0x41c937
jmp 0x41c994
xor esi, esi
test bl, bl
jne 0x41c985
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x41c946
movzx eax, word [eax]
jmp 0x41c94b
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx eax, ax
push eax
push 8
call dword [edx + 0xc]
test al, al
je 0x41c976
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x41c96f
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x41c904
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x41c904
mov ecx, edi
call fcn.0041fda4
mov ebx, eax
test esi, esi
jne 0x41c99d
jmp 0x41c98e
mov ecx, edi
call fcn.0041fda4
mov ebx, eax
test bl, bl
jne 0x41c9bc
jmp 0x41c9c2
mov ecx, edi
call fcn.0041fda4
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x41c9aa
movzx eax, word [eax]
jmp 0x41c9b1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x41c9c2
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10