joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406292
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x4062bb
mov eax, dword [0x40b058]
cmp eax, 0xffffffff
je 0x4062af
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
or dword [0x40b058], 0xffffffff
jmp 0x406366
cmp dword [0x4614b0], ebx
je 0x406366
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_WriteFile]
cmp word [0x46a4c0], bx
je 0x406332
cmp dword [0x40b058], 0xffffffff
jne 0x40633b
mov esi, 0x46a4c0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
push 4
push 0x40000000
push esi
mov dword [ebp + 8], eax
call fcn.00405ff8
mov dword [0x40b058], eax
cmp eax, 0xffffffff
je 0x406364
cmp dword [ebp + 8], 0xffffffff
jne 0x406327
push ebx
lea ecx, [ebp - 4]
push ecx
push 2
lea ecx, [ebp + 8]
push ecx
push eax
mov dword [ebp + 8], 0xfeff
call edi
mov eax, dword [0x40b058]
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp dword [0x40b058], 0xffffffff
je 0x406364
push 0x4096bc
mov esi, 0x4614c0
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push ebx
lea ecx, [ebp + 8]
push ecx
add eax, eax
push eax
push esi
push dword [0x40b058]
call edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4064a7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x104
push esi
lea eax, [ebp - 0x23c]
shl edi, 3
mov ebx, dword [edi + 0x40b060]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
cmp eax, esi
jbe 0x4064d8
xor eax, eax
test eax, eax
je 0x4064eb
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4064eb
xor ecx, ecx
jmp 0x4064ee
xor ecx, ecx
inc ecx
push ebx
lea ecx, [ecx*2 + 0x408838]
push ecx
lea eax, [ebp + eax*2 - 0x23c]
push str._s_hs.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test eax, eax
jne 0x406529
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
test eax, eax
je 0x406536
push dword [edi + 0x40b064]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x406989
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x457260
push esi
call fcn.004061b2
push esi
call fcn.00405f01
mov edi, eax
test edi, edi
jne 0x4069aa
xor eax, eax
jmp 0x406a08
push edi
call fcn.004061e1
test byte [0x472d88], 0x80
je 0x4069c7
movzx eax, word [edi]
test ax, ax
je 0x4069a6
cmp ax, 0x5c
je 0x4069a6
sub edi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenW]
sar edi, 1
jmp 0x4069e9
push esi
call fcn.00406480
test eax, eax
je 0x4069e3
test byte [eax], 0x10
je 0x406a0d
push esi
call fcn.0040695c
push esi
call ebx
cmp eax, edi
jg 0x4069d4
push esi
call fcn.0040692d
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x406a07
Function at 0x406c9f
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x4098cc
mov ebx, 0x45b260
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov esi, 0x400
cmp edi, ebp
je 0x406ced
push 1
push ebp
push edi
call fcn.00405ff8
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
cmp eax, ebp
je 0x406e64
cmp eax, esi
jg 0x406e64
push esi
mov edi, 0x4608b0
push edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
cmp eax, ebp
je 0x406e64
cmp eax, esi
jg 0x406e64
push ebp
push ebp
push esi
push 0x45ba60
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebp
push ebp
call ebx
test eax, eax
je 0x406e64
push ebp
push ebp
push esi
mov esi, 0x45c0b0
push esi
push 0xffffffffffffffff
push edi
push ebp
push ebp
call ebx
test eax, eax
je 0x406e64
push esi
push 0x45ba60
push str._s_s_r_n
push 0x45c4b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x472d2c]
push dword [eax + 0x128]
push edi
call fcn.00406a11
push 4
push 0xc0000000
push edi
call fcn.00405ff8
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x406e64
push ebp
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x406e5a
push ebp
lea eax, [esp + 0x14]
push eax
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x406e5a
cmp edi, dword [esp + 0x10]
jne 0x406e5a
push str._Rename__r_n
push esi
call fcn.00405f5e
cmp eax, ebp
jne 0x406df1
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
add edi, 0xa
jmp 0x406e22
push 0x4098c0
add eax, 0xa
push eax
call fcn.00405f5e
mov ebp, eax
test ebp, ebp
je 0x406e20
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x406e13
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x406e0d
sub ebp, esi
inc ebp
mov eax, ebp
xor ebp, ebp
jmp 0x406e24
xor ebp, ebp
mov eax, edi
push ebx
push 0x45c4b0
add eax, esi
push eax
call fcn.00405fb4
push ebp
push ebp
push ebp
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push ebp
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x407499
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4610b4], 0
jne 0x4074d7
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4074ad
mov dword [ecx*4 + 0x4610b0], eax
inc ecx
cmp ecx, 0x100
jl 0x4074a8
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407504
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4610b0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4074e5
not eax
pop ebp
ret 0xc
Function at 0x404590
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x404670
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x404670
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4045da
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x4045e1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x4045c0
jmp 0x4045e3
mov esi, 0x1505
jmp 0x4045e3
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 0x20]
mov ebx, edi
sub ebx, 1
jb 0x404670
and ebx, esi
mov eax, edi
not eax
and eax, 1
mov edx, edi
and edx, 0xfffffffe
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404614
inc ebx
dec edi
je 0x40466e
mov eax, ebx
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x40466e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x404610
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040c970
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x404610
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040c990
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x404610
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x404670
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404bd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
xor eax, eax
cmp dword [esp + 0x18], 0
je 0x404df1
cmp dword [esp + 0x1c], 0
jle 0x404d98
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
lea esi, [edi + ecx]
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [edi]
cmp edx, 0xf4
ja 0x404def
mov ecx, edx
and cl, 0xfe
cmp cl, 0xc0
je 0x404def
mov ecx, edx
and ecx, 0xffffffc0
cmp ecx, 0x80
je 0x404def
test dl, dl
js 0x404c40
mov ebp, 1
mov ebx, edx
jmp 0x404d80
mov eax, edx
and eax, 0xffffffe0
cmp eax, 0xc0
je 0x404caf
mov ecx, edx
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x404cfe
movzx ebp, byte [edi + 1]
mov ecx, ebp
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x404def
mov dword [esp], esi
movzx ebx, byte [edi + 2]
mov ecx, ebx
xor ecx, 0xffffff3f
mov esi, ebx
or esi, 0xc0
and esi, ecx
cmp esi, 0x80
jne 0x404def
and edx, 0xf
shl edx, 0xc
and ebp, 0x3f
shl ebp, 6
or edx, ebp
mov ebp, 3
mov esi, dword [esp]
jmp 0x404ccf
movzx ebx, byte [edi + 1]
mov ecx, ebx
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x404def
and edx, 0x1f
shl edx, 6
mov ebp, 2
cmp eax, 0xc0
setne cl
and ebx, 0x3f
or ebx, edx
cmp ebx, 0x800
setb ch
cmp ebx, 0x80
jb 0x404def
and cl, ch
je 0x404d80
jmp 0x404def
mov ecx, edx
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x404def
mov eax, esi
movzx esi, byte [edi + 1]
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x404def
movzx ebx, byte [edi + 2]
mov ecx, ebx
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x404def
movzx ecx, byte [edi + 3]
and cl, 0xc0
cmp cl, 0x80
jne 0x404def
and edx, 7
shl edx, 0xc
and esi, 0x3f
shl esi, 6
or esi, edx
and ebx, 0x3f
or ebx, esi
shl ebx, 6
lea ecx, [ebx - 0x110000]
mov ebp, 4
cmp ecx, 0xfff00000
mov esi, eax
jb 0x404def
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and ebx, 0x1ff800
cmp ebx, 0xd800
je 0x404def
add edi, ebp
cmp edi, esi
jb 0x404c00
mov edi, dword [esp + 0x1c]
lea eax, [edi + 1]
push eax
call dword [0x448008]
add esp, 4
test eax, eax
je 0x404def
mov esi, eax
mov byte [eax + edi], 0
push edi
push dword [esp + 0x1c]
push eax
call fcn.0040c750
add esp, 0xc
push 0x10
call dword [0x448008]
add esp, 4
test eax, eax
je 0x404de5
mov dword [eax], 0
mov dword [eax + 4], 2
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
jmp 0x404df1
push esi
call dword [0x448004]
add esp, 4
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404e00
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x404f04
mov esi, dword [esp + 0x28]
test esi, esi
je 0x404f04
cmp dword [esp + 0x2c], 0
je 0x404f04
push esi
call fcn.0040c970
add esp, 4
test eax, eax
je 0x404e6a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x404e71
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x404e50
jmp 0x404e73
mov ebx, 0x1505
jmp 0x404e73
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
mov esi, edi
sub esi, 1
jae 0x404f0c
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x404ec9
call fcn.00405b70
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x404f04
push ecx
call fcn.0040c970
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
mov esi, edi
sub esi, 1
jae 0x404f90
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and esi, ebx
mov eax, edi
not eax
and eax, 1
mov edx, edi
and edx, 0xfffffffe
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404f38
inc esi
dec edi
je 0x404e85
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404e8a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x404f30
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040c970
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404f30
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040c990
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404f30
mov eax, 0xffffffff
jmp 0x404f04
and esi, ebx
mov eax, edi
not eax
and eax, 1
mov edx, edi
and edx, 0xfffffffe
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404fb8
inc esi
dec edi
je 0x404ec4
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404ec9
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x404fb0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040c970
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404fb0
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040c990
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404fb0
jmp 0x404ec9
Function at 0x4058c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405aa8
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405aa8
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405aa8
cmp dword [ecx], 0
jne 0x405aa8
push esi
call fcn.0040c970
add esp, 4
test eax, eax
je 0x40592a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405931
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405910
jmp 0x405933
mov edi, 0x1505
jmp 0x405933
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
mov esi, edx
sub esi, 1
jae 0x4059fd
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x40598a
call fcn.00405b70
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405aa8
push esi
call fcn.0040c970
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405ab0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040c970
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x448008]
add esp, 4
test eax, eax
je 0x405aa3
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c750
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405aa8
mov dword [esp], eax
and esi, edi
mov eax, edx
not eax
and eax, 1
mov ebx, edx
and ebx, 0xfffffffe
sub ebx, eax
mov dword [esp + 0xc], ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405a28
inc esi
dec edx
je 0x405945
mov ebp, esi
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ebx, dword [eax + ebp*4]
cmp ebx, 0xffffffff
je 0x40594a
mov eax, dword [ecx + 8]
cmp dword [eax + ebx*4], edi
jne 0x405a20
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + ebx*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040c970
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405a20
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040c990
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405a20
mov eax, dword [ecx + 0x10]
push dword [eax + ebx*4]
call fcn.004049a0
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ebx*4], esi
jmp 0x4059f2
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406b50
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406d06
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406cff
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406be5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406cff
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406c65
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
mov edi, esi
and edi, eax
xor esi, eax
lea eax, [esi + edi*2]
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406c00
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406bad
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406cb0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406c90
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406ba0
jmp 0x406cbf
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406ba0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406cd0
jmp 0x406ba0
shl ecx, 0x10
or ecx, edi
jmp 0x406d0b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x406d7a
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x406d7c
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x445c50]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
add edi, ebp
add ebx, ebx
sub edi, ebx
xor eax, dword [edi*4 + 0x445c50]
inc esi
cmp edx, esi
jne 0x406d40
not eax
jmp 0x406d7c
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cf80
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [esp], 0x1716fb0d
mov word [esp + 4], 0
mov eax, 6
mov ecx, 0x39
nop
mov esi, ecx
and esi, 0x39
mov edx, eax
and edx, 6
or edx, esi
xor dl, byte [esp + eax - 6]
xor dl, 0xb9
add dl, 0x62
mov byte [esp + eax - 6], dl
inc eax
dec ecx
cmp eax, 0xc
jne 0x40cfa0
mov edi, dword [esp]
call fcn.0043f230
test al, al
je 0x40d1c1
call fcn.00438530
test al, al
je 0x40d1bc
mov eax, edi
and eax, 0x34a7ad07
mov ecx, edi
or edi, 0x34a7ad07
imul edi, eax
xor eax, 0x34a7ad07
and ecx, 0xcb5852f8
imul ecx, eax
add edi, ecx
mov eax, edi
shr eax, 7
lea esi, [eax + eax]
not esi
add esi, eax
or esi, edi
not eax
and eax, edi
not esi
or esi, eax
mov eax, esi
and eax, 0xa51c8fe
mov ecx, esi
or esi, 0xa51c8fe
imul esi, eax
xor eax, 0xa51c8fe
and ecx, 0xf5ae3701
imul ecx, eax
add esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp], 0x6bbbc6b7
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xe5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0xe5]
mov edi, eax
and edi, edx
lea ecx, [eax - 0x5544f500]
or ecx, edx
xor ecx, edi
mov edx, 0x79
sub edx, ecx
and ecx, 1
or edx, 1
sub ecx, edx
mov byte [esp + eax - 0xe5], cl
inc eax
cmp eax, 0xec
jne 0x40d060
cmp esi, dword [esp]
jne 0x40d199
mov dword [esp], 0x23bf21c3
mov dword [esp + 4], 0x27f825c0
mov dword [esp + 8], 0xdb52d93d
mov dword [esp + 0xc], 0xdffedd39
mov dword [esp + 0x10], 0xd331d10f
mov dword [esp + 0x14], 0xd5d4
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
mov ecx, eax
xor ecx, 0xab044007
mov esi, eax
or esi, 0x54fbbff8
and ecx, esi
add ecx, esi
mov esi, ecx
and esi, edx
mov edi, esi
and edi, 2
mov ebx, esi
or ebx, 0xfd
inc ebx
mov ebp, esi
and ebp, 0xfffffffd
imul ebp, ebx
or esi, 2
imul esi, edi
sub ebp, esi
add ecx, edx
add ecx, ebp
add cl, 0x28
mov byte [esp + eax], cl
inc eax
cmp eax, 0x1b
jne 0x40d0e0
mov dword [esp + 0x1c], 0x1fae19ab
mov dword [esp + 0x20], 0xe3501db9
mov dword [esp + 0x24], 0xe1e0
mov byte [esp + 0x28], 0
mov eax, 0x99aa10fa
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x6655ef22]
mov esi, ecx
xor esi, eax
lea edx, [esi + esi]
not edx
add edx, esi
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x1e
mov byte [esp + eax + 0x6655ef22], cl
inc eax
cmp eax, 0x99aa1107
jne 0x40d150
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0
push eax
push 0x447050
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40d1a9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e100
test al, al
je 0x40d1bc
call fcn.004107e0
call fcn.0040f7a0
call fcn.0043ffb0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]