joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9b2500
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x9fa230]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 0x1c]
mov esi, 8
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9b2591
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
lea esi, [ebp - 0xc]
mov eax, ebx
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
call fcn.009b2470
mov ecx, esi
push 8
push ecx
call fcn.009b7ba0
mov ecx, dword [ebp - 0x1c]
add esp, 8
lea edx, [ebp - 0x24]
push edx
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x9b25a2
mov edx, dword [ebp - 0x1c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0095f940
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edi
push 0
push 0
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x24]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 0x1c]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0095f940
mov esp, ebp
pop ebp
ret

Function at 0x9b4070
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x9b40a3
push 0x2e
push esi
call fcn.0095fa50
add esp, 8
test eax, eax
je 0x9b40a1
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x9b7bf0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
push esi
mov dword [esi], 0
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9b7c29
mov eax, dword [esi]
push edi
push 0
push 0
push 0x8002
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
ret
Function at 0x9b90b0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x9fb33c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x9b90db
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x9b9122
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x9b9125
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x9b9186
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x9b9150
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x9b91bf
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push 0x9ef1fa
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x9ef1fb
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x9b9190
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x9b9290
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000040
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9b92c3
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x800c
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
pop esi
pop ebp
ret
Function at 0x9bb455
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9bb47c
call fcn.0095d988
mov dword [eax], esi
call fcn.0095d975
push 0x16
pop esi
mov dword [eax], esi
call fcn.0095e5ca
mov eax, esi
jmp 0x9bb4d1
test dword [ebp + 0xc], 0xfffffff9
jne 0x9bb462
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9bb4a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0095d99b
pop ecx
call fcn.0095d975
mov eax, dword [eax]
jmp 0x9bb4d1
test al, 0x10
jne 0x9bb4cf
test al, 1
je 0x9bb4cf
test byte [ebp + 0xc], 2
je 0x9bb4cf
call fcn.0095d988
mov dword [eax], 5
call fcn.0095d975
mov dword [eax], 0xd
jmp 0x9bb4a0
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4045d0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x4046c9
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4046c9
cmp dword [esp + 0x2c], 0
je 0x404621
mov ecx, 0x1505
xor edi, edi
nop
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x404628
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
add edi, 0xdc8e70fd
mov ecx, esi
cmp edi, dword [esp + 0x2c]
jb 0x404600
jmp 0x40462a
mov esi, 0x1505
jmp 0x40462a
mov esi, ecx
mov ebx, dword [esp + 0x24]
mov ecx, dword [ebx + 0x20]
lea edx, [ecx - 1]
mov dword [esp + 8], ecx
sub ecx, 1
mov dword [esp + 0xc], ecx
jb 0x4046c9
mov ecx, esi
not ecx
or edx, ecx
lea eax, [esi + edx]
inc eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
xor edi, edi
mov edx, ebx
jmp 0x404667
inc edi
cmp dword [esp + 8], edi
je 0x4046c7
mov eax, edi
mov ebx, dword [esp + 4]
and eax, ebx
mov ecx, edi
xor ecx, ebx
lea eax, [ecx + eax*2]
and eax, dword [esp + 0xc]
mov ecx, dword [esp]
mov ebx, dword [ecx + eax*4]
cmp ebx, 0xffffffff
je 0x4046c7
mov eax, dword [edx + 8]
cmp dword [eax + ebx*4], esi
jne 0x404660
mov eax, dword [edx + 0xc]
mov ebp, dword [eax + ebx*4]
push ebp
call fcn.0040c990
mov edx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x404660
push dword [esp + 0x2c]
push ebp
push dword [esp + 0x30]
call fcn.0040c9b0
mov edx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404660
mov eax, dword [edx + 0x10]
mov eax, dword [eax + ebx*4]
jmp 0x4046c9
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4058d0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
cmp dword [esp + 0x2c], 0
je 0x405ace
mov esi, dword [esp + 0x30]
test esi, esi
je 0x405ace
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x405ace
cmp dword [ecx], 0
jne 0x405ace
push esi
call fcn.0040c990
add esp, 4
test eax, eax
je 0x40593f
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405946
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
add ebx, 0xdc8e70fd
mov ecx, edi
cmp ebx, eax
jb 0x405920
jmp 0x405948
mov edi, 0x1505
jmp 0x405948
mov edi, ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x20]
lea esi, [edx - 1]
mov dword [esp + 0xc], edx
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x405a1b
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x4059a8
call fcn.00405bb0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x30]
jne 0x405ace
push esi
call fcn.0040c990
add esp, 4
mov edx, esi
lea esi, [esp + 0x14]
mov ecx, dword [esp + 0x2c]
push esi
push edi
push eax
call fcn.00405ae0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x30]
push esi
call fcn.0040c990
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x442004]
add esp, 4
test eax, eax
je 0x405ac9
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c8b0
add esp, 0xc
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x34]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405ace
mov dword [esp], eax
mov edx, edi
not edx
or esi, edx
lea eax, [edi + esi]
inc eax
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
xor ebx, ebx
jmp 0x405a4b
inc ebx
cmp dword [esp + 0xc], ebx
je 0x405963
mov eax, ebx
mov esi, dword [esp + 8]
and eax, esi
mov edx, ebx
xor edx, esi
lea ebp, [edx + eax*2]
and ebp, dword [esp + 0x10]
mov eax, dword [esp + 4]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405968
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405a40
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
call fcn.0040c990
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x405a40
push dword [esp]
push ebp
push dword [esp + 0x38]
call fcn.0040c9b0
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x405a40
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404a00
mov edx, dword [esp + 0x30]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x34]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405a10
mov eax, 0xffffffff
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406b60
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406d16
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
movzx edi, si
shr esi, 0x10
test ebx, ebx
je 0x406d0f
mov ecx, 0x5e6ea9af
mov eax, ebx
mul ecx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ecx, ebx
sub ecx, eax
jmp 0x406bf6
mov ecx, dword [esp + 4]
mov eax, ecx
sub eax, dword [esp]
add ebp, eax
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, esi
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub esi, eax
mov ebx, dword [esp + 0xc]
sub ebx, ecx
mov ecx, 0x15b0
je 0x406d0f
xor edx, edx
cmp ecx, 8
mov dword [esp + 4], ecx
jb 0x406c79
and ecx, 0x1ff8
mov dword [esp], ecx
xor eax, eax
nop
nop
nop
nop
mov edx, eax
movzx ecx, byte [ebp + eax]
add ecx, edi
lea eax, [esi + ecx]
add eax, 0x66bdff82
movzx esi, byte [ebp + edx + 1]
add ecx, esi
add ecx, 0x66bdff82
add eax, ecx
movzx esi, byte [ebp + edx + 2]
add esi, ecx
add eax, esi
movzx ecx, byte [ebp + edx + 3]
add ecx, esi
add eax, ecx
movzx esi, byte [ebp + edx + 4]
add esi, ecx
movzx ecx, byte [ebp + edx + 5]
add ecx, esi
add esi, eax
movzx eax, byte [ebp + edx + 6]
add eax, ecx
add esi, ecx
mov ecx, dword [esp + 4]
movzx edi, byte [ebp + edx + 7]
add edi, eax
add esi, eax
lea eax, [edx + 8]
add esi, edi
add edx, 0xf
cmp edx, ecx
jb 0x406c10
add ebp, eax
mov edx, dword [esp]
mov eax, edx
sub eax, ecx
mov dword [esp + 0xc], ebx
jae 0x406bbb
mov dword [esp + 8], eax
mov eax, ecx
and eax, 3
mov dword [esp], edx
je 0x406cbf
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
movzx ecx, byte [edx]
inc edx
add edi, ecx
add esi, edi
dec ebx
cmp eax, ebx
jne 0x406ca0
mov eax, dword [esp]
sub eax, ebx
cmp dword [esp + 8], 0xfffffffc
ja 0x406bb0
jmp 0x406cce
mov eax, edx
mov edx, ebp
cmp dword [esp + 8], 0xfffffffc
ja 0x406bb0
mov ebx, dword [esp + 4]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + eax]
add ecx, edi
add esi, ecx
movzx edi, byte [edx + eax + 1]
add edi, ecx
add esi, edi
movzx ecx, byte [edx + eax + 2]
add ecx, edi
add esi, ecx
movzx edi, byte [edx + eax + 3]
add edi, ecx
add esi, edi
add eax, 4
cmp ebx, eax
jne 0x406ce0
jmp 0x406bb0
shl esi, 0x10
or esi, edi
jmp 0x406d1b
mov esi, 1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406d30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x406d5e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x406dfc
not eax
test bl, 1
jne 0x406d65
mov edx, ebx
cmp ebx, 1
jne 0x406d96
jmp 0x406dfa
xor eax, eax
jmp 0x406dfc
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x43fc50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x43fc50]
cmp ebx, 1
je 0x406dfa
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43fc50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43fc50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43fc50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43fc50]
add esi, 2
cmp edx, esi
jne 0x406da0
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x40cf30
Capabilities:
Encode data using xor
Terminate process

Disassembly:
sub esp, 8
call fcn.00438d30
test al, al
je 0x40cfa2
call fcn.00431dc0
test al, al
je 0x40cf9d
mov dword [esp], 0x159e231
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x3e
xor cl, byte [esp + eax]
add cl, 0xca
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x40cf60
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40cf8a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040dfb0
test al, al
je 0x40cf9d
call fcn.00410b80
call fcn.0040f810
call fcn.0043a2b0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40f170
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x447b28]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40f21e
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x442df4]
mov eax, dword [0x442e04]
nop
nop
nop
nop
nop
nop
jmp eax

Function at 0x40f820
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov edi, dword [esp + 0x464]
mov dword [esp + 0x38], 0x4fdd49b5
mov dword [esp + 0x3c], 0x43db4dc2
mov dword [esp + 0x40], 0x47da41dc
mov dword [esp + 0x44], 0x7ba945a5
mov dword [esp + 0x48], 0x7fac79ad
mov dword [esp + 0x4c], 0x73527dac
mov dword [esp + 0x50], 0x779d71a8
mov dword [esp + 0x54], 0x6bf875ed
mov dword [esp + 0x58], 0x6ffd698c
mov dword [esp + 0x5c], 0x63f56de7
mov dword [esp + 0x60], 0x67946140
mov dword [esp + 0x64], 0x1b3a6590
mov dword [esp + 0x68], 0x1fce19c9
mov dword [esp + 0x6c], 0x13c21dce
mov dword [esp + 0x70], 0x173611df
mov dword [esp + 0x74], 0xb9315ff
mov dword [esp + 0x78], 0xfc4099a
mov dword [esp + 0x7c], 0x3cd0dd8
mov dword [esp + 0x80], 0x78e0120
mov dword [esp + 0x84], 0x3bee05ce
mov dword [esp + 0x88], 0x3f1e39e1
mov dword [esp + 0x8c], 0x33a23dfd
mov dword [esp + 0x90], 0x37aa31a0
mov dword [esp + 0x94], 0x2bc135d1
mov dword [esp + 0x98], 0x2fc829cd
mov dword [esp + 0x9c], 0x23bb2dd3
mov dword [esp + 0xa0], 0x27f521b4
mov dword [esp + 0xa4], 0xdb0d25f1
mov dword [esp + 0xa8], 0xdf0cd913
mov dword [esp + 0xac], 0xd318dd0b
mov dword [esp + 0xb0], 0xd70ed1f0
mov dword [esp + 0xb4], 0xcb32d52b
mov dword [esp + 0xb8], 0xcf33c93c
mov dword [esp + 0xbc], 0xc31ecd30
mov dword [esp + 0xc0], 0xc75ac1e0
mov dword [esp + 0xc4], 0xfb65c55d
mov dword [esp + 0xc8], 0xffdef91d
mov dword [esp + 0xcc], 0xf317fd07
mov dword [esp + 0xd0], 0xf769f117
mov dword [esp + 0xd4], 0xeb33f567
mov dword [esp + 0xd8], 0xef29e9c8
mov dword [esp + 0xdc], 0xe374ed74
mov dword [esp + 0xe0], 0xe77be173
mov dword [esp + 0xe4], 0x9b49e501
mov dword [esp + 0xe8], 0x9f4f9949
mov dword [esp + 0xec], 0x93409d55
mov dword [esp + 0xf0], 0x97449140
Function at 0x4101e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov dword [esp + 0x38], 0xd1bfcf83
mov dword [esp + 0x3c], 0xd5b9d3aa
mov dword [esp + 0x40], 0xd9bad7b8
mov dword [esp + 0x44], 0xddebdbbb
mov dword [esp + 0x48], 0xe1f0dfeb
mov dword [esp + 0x4c], 0xe5c2e3d0
mov dword [esp + 0x50], 0xe9bfe7cc
mov dword [esp + 0x54], 0xed84eb83
mov dword [esp + 0x58], 0xf19fef88
mov dword [esp + 0x5c], 0xf587f389
mov dword [esp + 0x60], 0xf9b8f7d4
mov dword [esp + 0x64], 0xfddafbac
mov dword [esp + 0x68], 0x1ceffcf
mov dword [esp + 0x6c], 0x532032e
mov dword [esp + 0x70], 0x9260739
mov dword [esp + 0x74], 0xd610b51
mov dword [esp + 0x78], 0x11380f62
mov dword [esp + 0x7c], 0x152f1324
mov dword [esp + 0x80], 0x196e1734
mov dword [esp + 0x84], 0x1d2e1b2e
mov dword [esp + 0x88], 0x213e1f37
mov dword [esp + 0x8c], 0x25522363
mov dword [esp + 0x90], 0x294a2754
mov dword [esp + 0x94], 0x2d732b4f
mov dword [esp + 0x98], 0x314c2f4b
mov dword [esp + 0x9c], 0x3559337d
mov dword [esp + 0xa0], 0x39073740
mov dword [esp + 0xa4], 0x3d0f3b0f
mov dword [esp + 0xa8], 0x41103f05
mov dword [esp + 0xac], 0x45744375
mov dword [esp + 0xb0], 0x496e4764
mov dword [esp + 0xb4], 0x4d024b05
mov dword [esp + 0xb8], 0x51014f18
mov dword [esp + 0xbc], 0x557e531c
mov dword [esp + 0xc0], 0x593a5774
mov dword [esp + 0xc4], 0x5d375b33
mov dword [esp + 0xc8], 0x617e5f3b
mov dword [esp + 0xcc], 0x65056329
mov dword [esp + 0xd0], 0x690b6701
mov dword [esp + 0xd4], 0x6d416b19
mov dword [esp + 0xd8], 0x712b6f4c
mov dword [esp + 0xdc], 0x75007318
mov dword [esp + 0xe0], 0x79197705
mov dword [esp + 0xe4], 0x7d4b7b1f
mov dword [esp + 0xe8], 0x814d7f4f
mov dword [esp + 0xec], 0x85ac83bb
mov dword [esp + 0xf0], 0x89a887b4
mov dword [esp + 0xf4], 0x8da48bb8
mov dword [esp + 0xf8], 0x91ae8fbc
mov dword [esp + 0xfc], 0x95f193c5
mov dword [esp + 0x100], 0x99f597f2
mov dword [esp + 0x104], 0x9df19bea
mov dword [esp + 0x108], 0xa1a99fad
mov dword [esp + 0x10c], 0xa59ba395
mov dword [esp + 0x110], 0xa993a78a
mov dword [esp + 0x114], 0xadaaab9e
mov byte [esp + 0x11a], 0
mov word [esp + 0x118], 0
mov eax, dword [0x447b1c]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x38]
lea edi, [ecx + 0x636dc44d]
mov esi, edi
and esi, edx
lea ebx, [ecx + edx]
add ebx, 0x636dc44d
not ebx
lea esi, [ebx + esi*2]
and esi, edi
mov edi, esi
and edi, 0x636dc5fd
mov ebx, esi
and ebx, 2
or esi, 2
imul esi, ebx
xor ebx, 2
imul ebx, edi
sub esi, ecx
add esi, ebx
add esi, 0x9c923bb3
mov edi, edx
not edi
and edi, esi
not esi
and esi, edx
sub esi, edi
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
add dl, 0xb6
mov byte [esp + ecx + 0x38], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0xe3
jb 0x410440
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x44309c]
mov ecx, 0x50b1df47
xor ecx, dword [0x4430a4]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x4170c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x4170e0
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x417100
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x417120
mov eax, 0xffffffff
jmp 0x417129
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.0040c880
add esp, 4
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
je 0x417161
add esi, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x417150
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebx]
test cx, cx
je 0x417191
lea edx, [ebx + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417180
mov word [eax], 0
mov eax, esp
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.0043db20
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4435d0]

Function at 0x419a50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x419b5f
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x419a89
lea ecx, [edi + 4]
add edi, 2
mov eax, dword [esp]
mov esi, eax
cmp edi, edx
mov edi, ecx
mov ebp, dword [esp + 0x18]
jae 0x419b61
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.0041c070
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.0041c070
mov edx, dword [esp + 0x20]
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
lea ecx, [esi - 0x4e651b61]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi], al
cmp edi, edx
jae 0x419a70
movzx eax, byte [ebp + edi]
push eax
call fcn.0041c070
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x419a70
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea ebx, [esi + 0x56b0e464]
mov dword [esp], ebx
mov ebx, dword [esp + 0x20]
mov byte [ebx + esi - 0x4e651b61], cl
lea ecx, [edi - 0x43e3ee01]
cmp ecx, edx
jae 0x419a70
mov ecx, dword [esp + 0x18]
movzx ecx, byte [ecx + edi - 0x43e3ee01]
push ecx
mov ebx, eax
call fcn.0041c070
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x419a70
mov ecx, ebx
shl cl, 6
mov edx, eax
and dl, cl
add dl, dl
xor cl, al
add cl, dl
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov byte [eax + esi + 0x56b0e464], cl
add esi, 0x56b0e465
mov dword [esp], esi
jmp 0x419a70
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret