joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x401f7d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x401f7d
push esi
call fcn.004088b0
add esp, 4
test eax, eax
je 0x401f5a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x401f61
inc edi
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
mov ecx, ebx
cmp eax, edi
jne 0x401f40
jmp 0x401f63
mov ebx, 0x1505
jmp 0x401f63
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x401f85
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x401f94
inc ebp
dec edi
je 0x401f7b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x401f7b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x401f90
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.004088b0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x401f90
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.004088d0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401f90
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x401f7d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x401f7d
Function at 0x4021a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x4022b2
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4022b2
cmp dword [esp + 0x2c], 0
je 0x4022b2
push esi
call fcn.004088b0
add esp, 4
test eax, eax
je 0x40220a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x402211
inc edi
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
mov ecx, ebx
cmp eax, edi
jne 0x4021f0
jmp 0x402213
mov ebx, 0x1505
jmp 0x402213
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x4022ba
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x402277
call fcn.004023b0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x4022b2
push ecx
call fcn.004088b0
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x40232d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4022d8
inc edi
dec esi
je 0x40222c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x402231
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4022d0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.004088b0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4022d0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.004088d0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4022d0
mov eax, 0xffffffff
jmp 0x4022b2
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x402348
inc edi
dec esi
je 0x402272
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x402277
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x402340
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.004088b0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x402340
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.004088d0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402340
jmp 0x402277
Function at 0x402aa0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402c26
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x402c1f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
mov eax, edx
jmp 0x402b35
mov eax, dword [esp]
sub eax, dword [esp + 0xc]
add ebp, eax
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov eax, 0x15b0
je 0x402c1f
xor ebx, ebx
cmp eax, 8
mov dword [esp], eax
mov dword [esp + 4], esi
jb 0x402bae
mov ebx, eax
and ebx, 0x1ff8
xor edx, edx
nop
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, dword [esp]
mov eax, dword [esp]
jb 0x402b50
add ebp, edx
mov esi, dword [esp + 4]
mov edx, ebx
sub edx, eax
jae 0x402afd
mov dword [esp + 8], edx
mov esi, eax
and esi, 3
mov dword [esp + 0xc], ebx
mov eax, ebx
mov edx, ebp
je 0x402bdc
nop
nop
nop
nop
nop
inc eax
movzx ebx, byte [edx]
add edi, ebx
add ecx, edi
inc edx
dec esi
jne 0x402bd0
cmp dword [esp + 8], 0xfffffffc
ja 0x402af0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x402bf0
jmp 0x402af0
shl ecx, 0x10
or ecx, edi
jmp 0x402c2b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402c40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402c6e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x402d0c
not eax
test bl, 1
jne 0x402c75
mov edx, ebx
cmp ebx, 1
jne 0x402ca6
jmp 0x402d0a
xor eax, eax
jmp 0x402d0c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x44180c]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x44180c]
cmp ebx, 1
je 0x402d0a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44180c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44180c]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44180c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44180c]
add esi, 2
cmp edx, esi
jne 0x402cb0
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x408e00
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push esi
sub esp, 0x14
call fcn.0043b650
test al, al
je 0x409026
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.00431310
test al, al
je 0x409021
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], 0xc60fdcdb
mov dword [esp + 0xc], 0xb2a4e6ae
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x408e8e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xde20d696
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x12
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x408e60
mov dword [esp + 8], 0xea518737
mov dword [esp + 0xc], 0xfc49aed1
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x408ee7
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
dec eax
and eax, ecx
add eax, eax
sub edx, eax
add edx, 0x156302ff
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 5
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x408eb0
test esi, esi
je 0x408fb7
mov dword [esp + 8], 0xb7b689a9
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x408f3e
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xeb2919de
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0xaa
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x408f10
mov dword [esp + 8], 0x37a10771
mov dword [esp + 0xc], 0xe9fcd02a
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x408fb7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx edx, byte [esp + ecx + 8]
lea ecx, [eax + 0x87]
and ecx, edx
add eax, edx
sub eax, ecx
mov edx, 0x975e7578
sub edx, eax
add eax, 0xac1daf87
and edx, ecx
not ecx
and ecx, eax
sub ecx, edx
mov dword [esp + 4], ecx
mov eax, dword [esp + 4]
add al, 0x5d
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x408f70
mov dword [esp + 8], 0x2030001
mov dword [esp + 0xc], 0x6070405
mov dword [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40900e
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x16dfa580
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x80
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x408fe0
call fcn.0040a090
test al, al
je 0x409021
call fcn.0040ce50
call fcn.0040bd40
call fcn.0043c600
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40b3f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x13c], 0
mov dword [esi + 0x138], 0
mov dword [esi + 0x130], 0
mov dword [esi + 0x12c], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x120], 0
mov dword [esi + 0x11c], 0
mov dword [esi + 0x114], 0
mov dword [esi + 0x110], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x104], 0x3c
mov dword [esi + 0x10c], 0xffffffff
mov dword [esi + 0x118], 0xffffffff
mov dword [esi + 0x134], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44a894]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40b4d1
sar edx, 1
lea edi, [esi + 0x104]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x444e74]
xor eax, eax
jmp 0x40b77f
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x415f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ebp, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x415f50
sar ebp, 1
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x415f70
sar eax, 1
lea ecx, [eax + ebp]
add ecx, 2
test ecx, ecx
jns 0x415f8e
mov eax, 0xffffffff
jmp 0x415f97
add eax, ebp
lea eax, [eax*2 + 4]
push eax
call fcn.00408680
add esp, 4
movzx ecx, word [esi]
mov edi, eax
test cx, cx
je 0x415fc1
add esi, 2
mov edi, eax
nop
mov word [edi], cx
add edi, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x415fb0
mov word [edi], 0x5c
add edi, 2
movzx ecx, word [ebx]
test cx, cx
je 0x415ff1
lea edx, [ebx + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edi], cx
add edi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415fe0
mov word [edi], 0
lea ecx, [esp + 0x10]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x24], eax
push eax
call fcn.0043eed0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x445ee0]
Function at 0x4163b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x80
mov eax, dword [esp + 0x98]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x4163d0
sar esi, 1
lea ebx, [esp + 0x70]
push ebx
push 0
push 0
push esi
push eax
push 0
call dword [0x44bbcc]
mov ebp, dword [esp + 0x70]
mov edi, 0xffffffff
test ebp, ebp
jns 0x416404
mov eax, 0xffffffff
jmp 0x41640b
lea eax, [ebp*2]
push eax
call fcn.00408680
add esp, 4
push ebx
push ebp
mov ebp, eax
push eax
push esi
push dword [esp + 0xa8]
push 0
call dword [0x44bbcc]
mov eax, dword [esp + 0x70]
mov ecx, eax
add ecx, 0xd
js 0x41643b
lea edi, [eax*2 + 0x1a]
push edi
call fcn.00408680
add esp, 4
mov edi, eax
mov dword [esp + 0x20], 0x73a671d4
mov dword [esp + 0x24], 0x7fcd7ddd
mov dword [esp + 0x28], 0x7b9a79c4
mov dword [esp + 0x2c], 0x47eb459a
mov dword [esp + 0x30], 0x43f141f2
mov dword [esp + 0x34], 0x4ff94de5
mov dword [esp + 0x38], 0x4b4a49fe
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x1b
ja 0x4164d3
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x20]
mov edx, eax
and edx, 0x2ca5e94
xor eax, 0x2ca5e94
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
not ecx
or eax, ecx
sub ecx, eax
lea eax, [edx + ecx*2]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x50]
add al, 0x1c
mov ecx, dword [esp]
mov byte [esp + ecx + 0x20], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1c
jb 0x416490
movzx ecx, word [ebp]
mov eax, edi
test cx, cx
je 0x416501
lea edx, [ebp + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4164f0
mov word [eax], 0
movzx ecx, word [esp + 0x20]
test cx, cx
je 0x416531
lea edx, [esp + 0x22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416520
mov word [eax], 0
lea eax, [esp + 0x10]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.0043eed0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44618c]
Function at 0x418d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, dword [esp + 0x3c]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x418da0
sar ebp, 1
lea eax, [esp + 8]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x44bbcc]
mov edi, dword [esp + 8]
test edi, edi
jns 0x418dcf
mov eax, 0xffffffff
jmp 0x418dd2
lea eax, [edi + edi]
push eax
call fcn.00408680
add esp, 4
mov esi, eax
lea eax, [esp + 8]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x44bbcc]
lea ebx, [esp + 0x10]
push ebx
push esi
call fcn.0043f080
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4464b0]
Function at 0x41a7b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x2c]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41a7c0
cmp eax, 0xffffffed
jge 0x41a7d7
mov eax, 0xffffffff
jmp 0x41a7da
add eax, 0x12
push eax
call fcn.00408680
add esp, 4
mov esi, eax
mov dword [esp + 4], 0x21932780
mov dword [esp + 8], 0x3da9239f
mov dword [esp + 0xc], 0x39c83ff0
mov dword [esp + 0x10], 0x35983b84
mov dword [esp + 0x14], 0x3734
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x13
ja 0x41a872
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
lea edx, [eax + ecx]
add edx, 0x74db29c9
add eax, 0xc9
and eax, ecx
mov ecx, edx
xor ecx, eax
add ecx, eax
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov ecx, eax
not ecx
and ecx, 0xed
and eax, 0x12
sub eax, ecx
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x14
jb 0x41a820
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41a8a1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41a890
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x41a8d1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a8c0
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.0043f080
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x446580]
Function at 0x425e70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x425eca
cmp edi, 1
je 0x425eca
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x425ea1
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x425ea0
cmp ecx, 0x20
je 0x425ea0
cmp ecx, 0x2b
mov edx, edi
je 0x425ec0
cmp ecx, 0x2d
jne 0x425edf
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x425ee4
xor edi, edi
test eax, eax
je 0x42609d
mov dword [eax], 0x16
jmp 0x42609d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x425f0d
cmp edx, 0x10
jne 0x425f25
cmp byte [ebx], 0x30
jne 0x425f06
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x425f27
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x425f27
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x425f80
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x426038
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x425fa7
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x426068
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x426068
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x425f60
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x425ff0
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x425ff9
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x42601d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x42604d
test bl, bl
jne 0x42604d
mov ebx, dword [esp + 0x10]
jmp 0x425f73
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x425f55
mov esi, edi
test bl, bl
jne 0x42605b
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x425f55
mov eax, dword [esp + 0x38]
test eax, eax
je 0x426076
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x426084
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x426094
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x42609d
cmp byte [esp + 3], 0
jne 0x42609d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42c040
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2f0
mov dword [esp + 0x2c4], 0x44837c
mov dword [esp + 0x40], 0
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x442c28
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x442c38
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2c0], eax
mov eax, dword [esp + 0x2c4]
mov ecx, dword [esp + 0x2c0]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x2bc], 0x448384
mov dword [esp + 0x2b4], 0x44838c
mov dword [esp + 0x2ac], 0x4479f0
mov dword [esp + 0x2a8], 0xa6
mov dword [esp + 0x2a4], 0x448394
mov dword [esp + 0x29c], 0x44839c
mov dword [esp + 0x294], 0x4479f0
mov dword [esp + 0x290], 0xa9
mov dword [esp + 0x28c], 0x4483a4
mov dword [esp + 0x284], 0x4479f0
mov dword [esp + 0x280], 0xab
mov dword [esp + 0x27c], 0x4483ac
mov dword [esp + 0x274], 0x4479f0
mov dword [esp + 0x270], 0xae
mov dword [esp + 0x26c], 0x4479f0
mov dword [esp + 0x268], 0xae
mov dword [esp + 0x264], 0x4483b4
mov dword [esp + 0x25c], 0x4483bc
mov dword [esp + 0x254], 0x4479f0
mov dword [esp + 0x250], 0xb1
mov dword [esp + 0x24c], 0x4483c4
mov dword [esp + 0x244], 0x4479f0
mov dword [esp + 0x240], 0xb3
mov dword [esp + 0x23c], 0x4483cc
mov dword [esp + 0x234], 0x4479f0
mov dword [esp + 0x230], 0xb5
mov dword [esp + 0x22c], 0x4483d4
mov dword [esp + 0x224], 0x4483dc
mov dword [esp + 0x21c], 0x4479f0
mov dword [esp + 0x218], 0xb8
mov dword [esp + 0x214], 0x4479f0
mov dword [esp + 0x210], 0xb9
mov dword [esp + 0x20c], 0x4483e4
mov dword [esp + 0x204], 0x4483ec
mov dword [esp + 0x1fc], 0x4479f0
mov dword [esp + 0x1f8], 0xbc
mov dword [esp + 0x1f4], 0x4483f4
mov dword [esp + 0x1ec], 0x4483fc
mov dword [esp + 0x1e4], 0x4479f0
mov dword [esp + 0x1e0], 0xbf
mov dword [esp + 0x1dc], 0x448404
mov dword [esp + 0x1d4], 0x44840c
mov dword [esp + 0x1cc], 0x4479f0
mov dword [esp + 0x1c8], 0xc2
mov dword [esp + 0x1c4], 0x448414
mov dword [esp + 0x1bc], 0x44841c
mov dword [esp + 0x1b4], 0x4479f0
mov dword [esp + 0x1b0], 0xc5
mov dword [esp + 0x1ac], 0x448424
mov dword [esp + 0x1a4], 0x44842c
mov dword [esp + 0x19c], 0x448434
mov dword [esp + 0x194], 0x44843c
mov dword [esp + 0x18c], 0x4479f0
mov dword [esp + 0x188], 0xa7
mov dword [esp + 0x184], 0x4479f0
mov dword [esp + 0x180], 0xb6
mov dword [esp + 0x17c], 0x4479f0
mov dword [esp + 0x178], 0xbd
mov dword [esp + 0x174], 0x4479f0
mov dword [esp + 0x170], 0xc0
mov dword [esp + 0x16c], 0x4479f0
mov dword [esp + 0x168], 0xc3
mov dword [esp + 0x164], 0x4479f0
mov dword [esp + 0x160], 0xc6
mov dword [esp + 0x15c], 0x4479f0
mov dword [esp + 0x158], 0xc9
xor edi, edi
jmp eax