joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e2e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x40ecbc], ebx
push esi
push edi
jne 0x409eae
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x409ee9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x40ecbc], eax
je 0x409ee9
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x40ecc0], eax
call esi
cmp dword [0x40eb5c], 2
mov dword [0x40ecc4], eax
jne 0x409eae
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x40eccc], eax
je 0x409eae
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x40ecc8], eax
mov eax, dword [0x40ecc8]
test eax, eax
je 0x409ef3
call eax
test eax, eax
je 0x409eda
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x40eccc]
test eax, eax
je 0x409eda
test byte [ebp - 8], 1
jne 0x409ef3
cmp dword [0x40eb68], 4
jb 0x409eed
or byte [ebp + 0x12], 0x20
jmp 0x409f12
xor eax, eax
jmp 0x409f22
or byte [ebp + 0x12], 4
jmp 0x409f12
mov eax, dword [0x40ecc0]
test eax, eax
je 0x409f12
call eax
mov ebx, eax
test ebx, ebx
je 0x409f12
mov eax, dword [0x40ecc4]
test eax, eax
je 0x409f12
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x40ecbc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406128
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40614d
mov dword [0x40a0f4], eax
add esp, 0xfffffff8
push 0x4060ec
push eax
call fcn.00407c20
jmp 0x406152
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x406168
mov dword [0x409054], 0x40624c
jmp 0x406172
mov dword [0x409054], 0x406200
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x27700494
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x47f07f53
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4017d0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x4018a0
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x4018a0
mov ebp, dword [esp + 0x28]
mov esi, 0x1505
test ebp, ebp
je 0x40181d
xor edi, edi
nop
movzx ecx, byte [ebx + edi]
test ecx, ecx
je 0x40181d
mov edx, esi
shl edx, 5
add edx, esi
mov esi, edx
and esi, ecx
xor edx, ecx
lea esi, [edx + esi*2]
inc edi
cmp ebp, edi
jne 0x401800
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edi, [ebx - 1]
mov edx, ebx
sub edx, 1
mov dword [esp + 8], edx
jb 0x4018a0
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x401844
inc edi
dec ebx
je 0x40189e
mov eax, edi
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x40189e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x401840
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.00408690
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x401840
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.004086b0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x401840
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x4018a0
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x401bd0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x401cef
mov ecx, dword [eax + 4]
cmp ecx, 2
je 0x401ce3
cmp ecx, 5
je 0x401cb3
cmp ecx, 4
jne 0x401cef
mov esi, dword [eax + 8]
cmp dword [esi + 0x18], 0
je 0x401c3d
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0xc]
push dword [eax + edi*4]
call dword [section..data]
add esp, 4
mov eax, dword [esi + 0x10]
push dword [eax + edi*4]
call fcn.00401bd0
add esp, 4
mov eax, edi
and eax, 1
xor edi, 1
lea edi, [edi + eax*2]
cmp edi, dword [esi + 0x18]
jb 0x401c10
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
push dword [esi + 4]
call dword [section..data]
add esp, 4
push dword [esi + 0xc]
call dword [section..data]
add esp, 4
push dword [esi + 0x10]
call dword [section..data]
add esp, 4
push dword [esi + 0x14]
call dword [section..data]
add esp, 4
push dword [esi + 8]
call dword [section..data]
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
jmp 0x401ce0
mov esi, dword [eax + 8]
cmp dword [esi + 8], 0
je 0x401cd4
xor edi, edi
nop
nop
mov eax, dword [esi + 4]
push dword [eax + edi*4]
call fcn.00401bd0
add esp, 4
inc edi
cmp edi, dword [esi + 8]
jb 0x401cc0
push dword [esi + 4]
call dword [section..data]
add esp, 4
push esi
jmp 0x401ce6
push dword [eax + 8]
call dword [section..data]
add esp, 4
pop esi
pop edi
jmp dword [section..data]
Function at 0x401d00
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x28]
mov eax, 0xffffffff
test ebp, ebp
je 0x401e4b
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x401e4b
cmp dword [esp + 0x30], 0
je 0x401e4b
push edi
call fcn.00408690
add esp, 4
mov dword [esp], eax
mov ebx, 0x1505
test eax, eax
je 0x401d6e
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edi + eax]
test ecx, ecx
je 0x401d6e
mov edx, ebx
shl edx, 5
add edx, ebx
mov esi, edx
and esi, ecx
xor edx, ecx
lea ebx, [edx + esi*2]
inc eax
cmp dword [esp], eax
jne 0x401d50
mov esi, dword [ebp + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x401dd1
mov ebp, 0xffffffff
mov esi, dword [esp + 0x28]
mov eax, dword [esi + 0x18]
cmp eax, dword [esi + 0x1c]
jae 0x401e35
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x18]
mov edx, dword [esp + 0x2c]
mov dword [eax + ecx*4], edx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [esi + 0x10]
mov edx, dword [esp + 0x30]
mov dword [eax + ecx*4], edx
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x18]
mov dword [eax + ecx*4], ebx
inc dword [esi + 0x18]
mov eax, dword [esi]
mov dword [edx], eax
xor eax, eax
jmp 0x401e4b
and edi, ebx
mov eax, dword [ebp + 4]
mov dword [esp + 4], eax
jmp 0x401de4
inc edi
dec esi
je 0x401d7f
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x401d84
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + 8]
cmp dword [ecx + eax*4], ebx
jne 0x401de0
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.00408690
add esp, 4
cmp eax, dword [esp]
jne 0x401de0
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.004086b0
add esp, 0xc
test eax, eax
jne 0x401de0
mov eax, 0xffffffff
jmp 0x401e4b
mov ecx, esi
call fcn.00401f10
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x2c]
je 0x401e53
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push ecx
call fcn.00408690
add esp, 4
mov dword [esp + 0xc], eax
mov edx, dword [esi + 0x20]
lea edi, [edx - 1]
mov eax, edx
sub eax, 1
mov dword [esp + 8], eax
jae 0x401e7b
mov ebp, 0xffffffff
jmp 0x401d94
and edi, ebx
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
jmp 0x401e94
inc edi
dec edx
je 0x401ef4
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x401ef9
mov esi, dword [esp + 0x28]
mov ecx, dword [esi + 8]
cmp dword [ecx + eax*4], ebx
jne 0x401e90
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x10], eax
push eax
mov dword [esp + 4], edx
call fcn.00408690
mov edx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0xc]
jne 0x401e90
push dword [esp + 0xc]
push dword [esp + 0x14]
push dword [esp + 0x34]
call fcn.004086b0
mov edx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x401e90
jmp 0x401d94
mov ebp, 0xffffffff
mov esi, dword [esp + 0x28]
jmp 0x401d94
Function at 0x402650
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402806
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4027ff
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x4026e5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x4027ff
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x402765
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
mov edi, esi
and edi, eax
xor esi, eax
lea eax, [esi + edi*2]
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x402700
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x4026ad
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x4027b0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x402790
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4026a0
jmp 0x4027bf
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4026a0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x4027d0
jmp 0x4026a0
shl ecx, 0x10
or ecx, edi
jmp 0x40280b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402820
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40287d
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x40287f
not eax
xor esi, esi
nop
nop
nop
nop
mov ebx, eax
and ebx, 0xf
shr eax, 4
movzx edi, byte [ecx + esi]
mov ebp, ebx
xor ebp, ebx
xor ebp, 0xf
and ebp, edi
xor ebp, ebx
xor eax, dword [ebp*4 + 0x44480c]
mov ebx, eax
shr ebx, 4
and eax, 0xf
shr edi, 4
xor edi, eax
mov eax, ebx
xor eax, dword [edi*4 + 0x44480c]
inc esi
cmp edx, esi
jne 0x402840
not eax
jmp 0x40287f
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408bc0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, dword [esp + 8]
mov dword [0x44cb6c], edx
mov eax, 0xfffffd92
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x6c078965
mov esi, ecx
or ecx, 0x6c078965
imul ecx, edx
xor edx, 0x6c078965
and esi, 0x93f8769a
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x26f
mov dword [eax*4 + 0x44d528], edx
test eax, eax
je 0x408c4f
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x6c078965
mov esi, ecx
or ecx, 0x6c078965
imul ecx, edx
xor edx, 0x6c078965
and esi, 0x93f8769a
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x270
mov dword [eax*4 + 0x44d52c], edx
add eax, 2
jmp 0x408bd0
mov dword [0x44cb68], 0x270
pop esi
ret
Function at 0x408c70
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x214
call fcn.0043e700
test al, al
je 0x408e47
lea eax, [esp + 0xc]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00437a70
test al, al
je 0x408e42
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov ebp, 0xf677ed48
shr ebp, cl
mov eax, 0xf677ed48
xor edi, edi
mov ebx, 0
test cl, 0x20
jne 0x408cc7
mov ebx, ebp
mov edx, 0x38ce4db2
shrd edx, eax, cl
test cl, 0x20
jne 0x408cd6
mov ebp, edx
mov eax, 0x7b3bf6a4
mov esi, 0x7b3bf6a4
shr esi, cl
test cl, 0x20
jne 0x408ce9
mov edi, esi
mov edx, 0x1c6726d9
shrd edx, eax, cl
test cl, 0x20
jne 0x408cf8
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], eax
mov eax, esi
and eax, 0xe398d926
mov ecx, edi
and ecx, 0x4c4095b
or ebp, 1
sub esi, ebp
sbb edi, ebx
and edi, 0x7b3bf6a4
or edi, ecx
and esi, 0x1c6726d9
or esi, eax
mov ebp, esi
not ebp
mov eax, esi
and eax, 0xb9dd286b
mov ecx, edi
and ecx, 0x11a2811a
mov ebx, edi
xor ebx, 0x91a2811a
or ebx, ecx
not ebx
and ebp, 0x4622d794
imul ebx, eax
mul ebp
mov dword [esp], eax
imul ebp, ecx
add ebp, edx
add ebp, ebx
mov ecx, edi
and ecx, 0x6e5d7ee5
mov ebx, esi
or esi, 0x4622d794
mov eax, esi
imul esi, ecx
and ebx, 0x4622d794
mul ebx
add esi, edx
or edi, 0x6e5d7ee5
imul edi, ebx
add edi, esi
add eax, dword [esp]
adc edi, ebp
mov ebp, edi
shr ebp, 0x15
xor ebp, edi
mov esi, edi
shld esi, eax, 0xb
xor esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x408e1e
mov eax, esi
and eax, 0x6e7657c7
mov dword [esp + 4], eax
mov edi, ebp
and edi, 0xab9d38f1
xor eax, 0x6e7657c7
mov ebx, esi
and ebx, 0x9189a838
mov ecx, ebp
and ecx, 0x5462c70e
imul ecx, eax
mul ebx
mov dword [esp], eax
or esi, 0x6e7657c7
mov eax, esi
imul esi, edi
xor edi, 0xab9d38f1
imul ebx, edi
add ebx, edx
mov edi, dword [esp + 4]
mul edi
add ebx, ecx
add esi, edx
or ebp, 0xab9d38f1
imul ebp, edi
add ebp, esi
add eax, dword [esp]
adc ebp, ebx
mov esi, eax
mov ecx, dword [esp + 8]
shrd esi, ebp, cl
mov edx, ebp
shr edx, cl
test cl, 0x20
je 0x408e1a
mov esi, edx
xor edx, edx
xor ebp, edx
xor esi, eax
or ebp, 0x1010101
or esi, 0x1010101
push ebp
push esi
call fcn.0040a020
add esp, 8
test al, al
je 0x408e42
call fcn.0040d2b0
call fcn.0040b930
call fcn.0043fa10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408e50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x408eb5
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x408e70
mov eax, 0x270
jmp 0x408f9b
cmp eax, 0x4e0
jb 0x408f9b
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x408ed0
mov esi, dword [ecx + 0xd50]
xor eax, eax
jmp 0x408f4f
and esi, 0x80000000
mov ebx, edx
and ebx, 0x7ffffffe
or ebx, esi
shr ebx, 1
xor edi, dword [ecx + eax*4 + 4]
xor edi, ebx
xor edi, 0x6c436ad
mov dword [ecx + eax*4 + 0x390], edi
inc eax
mov esi, edx
cmp eax, 0x18c
je 0x408f67
mov edx, dword [ecx + eax*4 + 0xd54]
mov edi, 0x6c436ad
test dl, 1
je 0x408f20
mov edi, 0x9fcc8672
jmp 0x408f20
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
pop ebx
ret
Function at 0x40a020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x230
mov edi, dword [0x44df44]
mov dword [esp + 0x1b0], 0x3020900
mov word [esp + 0x1b4], 0
mov byte [esp + 0x1b6], 0
xor ecx, ecx
nop
movzx edx, byte [esp + ecx + 0x1b0]
lea ebx, [ecx - 0x6461ef40]
and ebx, edx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
mov byte [esp + ecx + 0x1b0], dl
inc ecx
cmp ecx, 7
jne 0x40a050
mov ecx, dword [esp + 0x1b0]
mov dword [esp + 0x20], 0xb11b8f15
mov dword [esp + 0x24], 0xb5d3b3e2
mov dword [esp + 0x28], 0xb9e4b7e1
mov dword [esp + 0x2c], 0xbddebb96
mov dword [esp + 0x30], 0xa1d2bfd0
mov dword [esp + 0x34], 0xa3a0
mov edx, 0x79ae0e1d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx - 0x79ae0dfd]
mov ebx, eax
and ebx, edx
add bl, bl
sub al, bl
movzx eax, al
add eax, edx
add al, 0x6f
mov byte [esp + edx - 0x79ae0dfd], al
inc edx
cmp edx, 0x79ae0e35
jne 0x40a0c0
lea esi, [esp + 0x20]
push ecx
push 0
push esi
call edi
mov ecx, 0x44df48
push eax
call fcn.0043e670
movzx eax, al
mov eax, dword [eax*4 + 0x447a20]
mov ecx, 0xfa77687
xor ecx, dword [0x447a28]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x40aae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40ad3c
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40ab1c
cmp edx, esi
jae 0x40ad3c
test edi, edi
je 0x40ad3c
movzx ebp, bl
test bl, bl
js 0x40ab50
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40ab10
jmp 0x40ad3c
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40ab8c
cmp bl, 0xc2
jb 0x40ab40
mov bh, byte [edx + 1]
movzx ecx, bh
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40abee
shl ebp, 6
add edx, 2
and ecx, 0x3f
lea esi, [ecx + ebp]
add esi, 0xffffd000
jmp 0x40ac40
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40abb6
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40abf8
cmp ebp, 0xe0
jne 0x40ac01
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40ab3c
jmp 0x40ac01
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40ad17
cmp bl, 0xf4
ja 0x40ab40
movzx ecx, byte [edx + 1]
je 0x40ac4b
cmp ebp, 0xf0
jne 0x40ac54
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40ab3c
jmp 0x40ac54
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40ab42
cmp cl, 0x9f
ja 0x40ab3c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ad1e
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ad24
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40ab32
cmp cl, 0x8f
ja 0x40ab3c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ad1e
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ad24
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ad30
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ebx, dword [esp]
and ebx, 0x3f
or ebx, ebp
cmp ebx, 0x10000
jb 0x40ab3c
mov ecx, ebx
xor ecx, 0x7ff
mov esi, ebx
or esi, 0x7ffff800
and esi, ecx
cmp esi, 0xd800
je 0x40ab3c
cmp edi, 2
jb 0x40ad17
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
and ebx, 0x3ff
or ebx, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bx
jmp 0x40ab32
mov ecx, eax
jmp 0x40ab32
inc edx
jmp 0x40ab3c
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40ab42
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40ab42
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44df20]
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40b32e
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x447d08]
mov eax, dword [0x447d1c]
nop
nop
nop
nop
nop
nop
jmp eax