joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68c9d4
Capabilities:
Terminate process

Disassembly:
mov eax, 0x6b0925
call fcn.006375a8
sub esp, 0x64
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
test edi, edi
jne 0x68ca00
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov dword [esi + 0x84], eax
mov ecx, esi
call fcn.0068bc4e
cmp byte [esi + 0x24], bl
je 0x68cb73
test al, al
je 0x68ca3f
test edi, edi
je 0x68ca3f
mov ecx, dword [esi + 0x7c]
lea eax, [ebp - 0x3c]
push eax
call fcn.0068dc03
push eax
push ebx
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0068c9d4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
push ebx
push 1
call fcn.0040daff
mov eax, dword [esi + 0x80]
test eax, eax
je 0x68cadc
mov al, byte [eax + 0x74]
test al, al
je 0x68cadc
push dword [ebp + 0xc]
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x70], edi
call fcn.0040da7b
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 5
push eax
lea ecx, [ebp - 0x70]
call fcn.0068db8a
mov ecx, dword [esi + 0x80]
push eax
mov byte [ebp - 4], 6
call fcn.0068e8b7
push ebx
push 1
lea ecx, [ebp - 0x24]
call fcn.0040daff
test edi, edi
jne 0x68cad4
push 0x2710
push dword [esi + 0x84]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x68cac6
push 1
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push dword [esi + 0x10]
call edi
mov dword [esi + 0x10], ebx
push dword [esi + 0x84]
call edi
mov dword [esi + 0x84], ebx
lea ecx, [ebp - 0x6c]
jmp 0x68cb6b
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x24], bl
xor esi, esi
lea ecx, [ebp - 0x3c]
inc esi
push str.error
mov dword [ebp - 4], esi
call fcn.0040d4cf
push ebx
push str.The_other_end_of_the_pipe_hung_up
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.004684c0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.0040d5a9
push ebx
push esi
lea ecx, [ebp - 0x54]
call fcn.0040daff
push ebx
push esi
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.0040daff
push str.remote_ieprocess
lea ecx, [ebp - 0x3c]
call fcn.0040d4cf
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x24]
push eax
push 0x2c
call fcn.00485ab0
push ebx
push esi
lea ecx, [ebp - 0x3c]
call fcn.0040daff
lea ecx, [ebp - 0x24]
push ebx
push 1
call fcn.0040daff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x68ce38
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 4]
push ebp
push esi
push edi
push eax
push 2
xor ebp, ebp
push ebp
push str.SOFTWAREMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
push reloc.WS2_32.dll_accept
mov dword [esp + 0x24], ebp
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x68ce9a
lea eax, [esp + 0x14]
push eax
call fcn.0068d560
cmp dword [eax + 0x14], 8
jb 0x68ce81
mov eax, dword [eax]
push eax
push dword [esp + 0x14]
call esi
push ebp
push 1
lea ecx, [esp + 0x1c]
call fcn.004267c2
push dword [esp + 0x10]
call edi
lea eax, [esp + 0x10]
push eax
push 2
push ebp
push str.SOFTWAREMicrosoftInternet_ExplorerMainFeatureControlFEATURE_SCRIPTURL_MITIGATION
push reloc.WS2_32.dll_accept
call ebx
test eax, eax
jne 0x68cedd
lea eax, [esp + 0x14]
push eax
call fcn.0068d560
cmp dword [eax + 0x14], 8
jb 0x68cec4
mov eax, dword [eax]
push eax
push dword [esp + 0x14]
call esi
push ebp
push 1
lea ecx, [esp + 0x1c]
call fcn.004267c2
push dword [esp + 0x10]
call edi
lea eax, [esp + 0x10]
push eax
push 2
push ebp
push str.SOFTWAREMicrosoftInternet_ExplorerMainFeatureControlFEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION
push reloc.WS2_32.dll_accept
call ebx
test eax, eax
jne 0x68cf20
lea eax, [esp + 0x14]
push eax
call fcn.0068d560
cmp dword [eax + 0x14], 8
jb 0x68cf07
mov eax, dword [eax]
push eax
push dword [esp + 0x14]
call esi
push ebp
push 1
lea ecx, [esp + 0x1c]
call fcn.004267c2
push dword [esp + 0x10]
call edi
call fcn.0068d262
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x68d262
Capabilities:
Move file

Disassembly:
mov eax, 0x6ab3b7
call fcn.006375a8
sub esp, 0x38
push esi
xor esi, esi
push esi
push esi
push 6
call fcn.0068c35a
test eax, eax
je 0x68d2ee
push 0x799cc8
lea eax, [ebp - 0x24]
push eax
call fcn.0068c000
push esi
push 1
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], esi
call fcn.0043721b
push esi
push 1
lea ecx, [ebp - 0x24]
call fcn.0043721b
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], 3
jae 0x68d2bc
lea eax, [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov ecx, 0x6b6e68
mov eax, 0x414
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x32], esi
mov dword [ebp - 0x2e], esi
mov dword [ebp - 0x2a], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push esi
push 1
lea ecx, [ebp - 0x24]
call fcn.004267c2
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x68dff0
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x6b0b23
call fcn.006375a8
sub esp, 0x44
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], edi
push ebx
push ebx
lea esi, [edi + 0x2c]
mov dword [edi], 0x7385b0
mov dword [edi + 0x24], ebx
mov ecx, esi
mov byte [edi + 0x28], 1
mov dword [ebp - 0x14], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.0068e113
mov dword [esi], eax
lea esi, [edi + 0x34]
mov dword [ebp - 4], ebx
push ebx
push ebx
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.00457fdf
mov dword [esi], eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov eax, dword [ebp - 0x3c]
mov dword [edi + 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x1c]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [edi + 8], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push eax
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.DLL_GetProcessTimes]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [edi + 0x14], eax
mov eax, dword [ebp - 0x28]
mov dword [edi + 0x18], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x68e6ba
Capabilities:
Check if file exists
Create pipe
Create thread

Disassembly:
mov eax, 0x6b0ccf
call fcn.006375a8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
push dword [ebp + 8]
lea esi, [ebx + 4]
mov dword [ebp - 0x10], ebx
mov ecx, esi
mov dword [ebx], 0x7385c4
call fcn.0042615e
xor edx, edx
lea edi, [ebx + 0x1c]
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], edx
cmp dword [edi + 0x14], 8
mov dword [ebp - 4], edx
jb 0x68e6fe
mov eax, dword [edi]
jmp 0x68e700
mov eax, edi
xor ecx, ecx
mov word [eax], cx
mov al, byte [ebp + 0xc]
mov byte [ebx + 0x34], al
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x38], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebx + 0x3c], eax
lea eax, [ebp - 0x28]
push 0x7385c8
push eax
mov byte [ebp - 4], 1
mov byte [ebx + 0x74], dl
call fcn.004270b3
push eax
mov ecx, edi
call fcn.0042623d
xor esi, esi
lea ecx, [ebp - 0x28]
push esi
push 1
call fcn.004267c2
push esi
push esi
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_CreateEventW]
call esi
mov dword [ebx + 0x48], eax
xor eax, eax
push eax
push eax
push eax
push eax
call esi
mov dword [ebx + 0x5c], eax
xor eax, eax
push eax
push eax
push eax
push eax
call esi
cmp byte [ebx + 0x34], 0
mov dword [ebx + 0x70], eax
je 0x68e79b
cmp dword [edi + 0x14], 8
jb 0x68e776
mov edi, dword [edi]
push dword [ebp + 0x18]
xor esi, esi
mov eax, 0x800
push esi
push eax
push eax
push 0xff
push 6
push 0x40080003
push edi
call dword [sym.imp.KERNEL32.DLL_CreateNamedPipeW]
mov dword [ebx + 0x44], eax
jmp 0x68e7df
xor esi, esi
mov eax, esi
cmp eax, 2
jne 0x68e7af
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [edi + 0x14], 8
jb 0x68e7b9
mov eax, dword [edi]
jmp 0x68e7bb
mov eax, edi
push esi
push 0x40000080
push 3
push esi
push esi
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebx + 0x44], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x68e7a4
cmp dword [ebx + 0x44], 0xffffffff
je 0x68e7f8
push esi
push esi
push ebx
push 0x68e923
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x68e8b7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
and dword [esi + 0x68], 0
and dword [esi + 0x6c], 0
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
jb 0x68e8d4
mov ecx, dword [ecx]
lea edi, [esi + 0x60]
inc eax
push edi
lea edx, [ebp + 8]
push edx
push eax
push ecx
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
jne 0x68e914
push 0xffffffffffffffff
push dword [esi + 0x70]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
jne 0x68e914
push 1
lea eax, [ebp + 8]
push eax
push edi
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
pop edi
pop esi
pop ebp
ret 4
Function at 0x68e931
Capabilities:
Connect pipe
Read file on windows

Disassembly:
mov eax, 0x6aff04
call fcn.006375a8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov byte [edi + 0x74], 1
cmp byte [edi + 0x34], bl
je 0x68e992
lea eax, [edi + 0x4c]
mov dword [edi + 0x54], ebx
push eax
push dword [edi + 0x44]
mov dword [edi + 0x58], ebx
call dword [sym.imp.KERNEL32.DLL_ConnectNamedPipe]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test esi, esi
jne 0x68e992
cmp eax, 0x217
je 0x68e992
cmp eax, 0x3e5
jne 0x68ea46
push 0xffffffffffffffff
push dword [edi + 0x5c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
jne 0x68ea46
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov dword [ebp - 0x10], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
push 0x401
mov dword [ebp - 4], ebx
call fcn.00637905
pop ecx
mov esi, eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x400
push esi
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
sub eax, 6
neg eax
sbb eax, eax
and eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
je 0x68ea11
cmp byte [esi + eax - 1], 0
push esi
sete bl
mov byte [esi + 0x400], 0
call fcn.0040d6de
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040d642
push 0
test bl, bl
pop ebx
je 0x68e9c1
push esi
call fcn.006375d6
cmp dword [ebp - 0x10], 0
pop ecx
je 0x68ea38
push dword [edi + 0x3c]
lea eax, [ebp - 0x28]
push eax
call dword [edi + 0x38]
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.0040daff
jmp 0x68e99b
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.0040daff
mov byte [edi + 0x74], bl
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x68f4b5
Capabilities:
Get disk information

Disassembly:
mov eax, 0x69eeaa
call fcn.006375a8
sub esp, 0x228
push ebx
push esi
push edi
push 0x41
pop eax
push 0x3a
mov word [ebp - 0x14], ax
xor edi, edi
pop eax
mov word [ebp - 0x12], ax
push 0x5c
pop eax
mov word [ebp - 0x10], ax
xor eax, eax
mov dword [ebp - 4], edi
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov ebx, eax
mov esi, edi
test ebx, ebx
je 0x68f55f
test bl, 1
je 0x68f555
lea eax, [esi + 0x41]
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 2
jne 0x68f555
push 0x104
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x68f555
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00427f43
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00437447
push edi
push 1
test eax, eax
je 0x68f57f
lea ecx, [ebp - 0x2c]
call fcn.004267c2
shr ebx, 1
inc esi
cmp esi, 0x1a
jl 0x68f4f6
mov esi, edi
push edi
push 1
lea ecx, [ebp + 8]
call fcn.004267c2
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, dword [ebp + 0x20]
mov ax, word [ebp - 0x14]
mov word [ecx], ax
lea ecx, [ebp - 0x2c]
call fcn.004267c2
xor esi, esi
inc esi
jmp 0x68f55f
Function at 0x68f8de
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
mov esi, ecx
cmp dword [esi + 0x110], 2
jne 0x68f962
lea eax, [esi + 0xf0]
cmp dword [eax + 0x14], 8
jb 0x68f8fe
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x30]
push str._s:_
push eax
call fcn.004638e7
mov eax, dword [ebp - 0x30]
add esp, 0xc
cmp dword [ebp - 0x1c], 8
jae 0x68f91c
lea eax, [ebp - 0x30]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
xor ecx, ecx
test eax, eax
je 0x68f949
mov eax, dword [ebp - 8]
mov dword [esi + 0x108], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x10c], eax
jmp 0x68f955
mov dword [esi + 0x108], ecx
mov dword [esi + 0x10c], ecx
push ecx
push 1
lea ecx, [ebp - 0x30]
call fcn.004267c2
jmp 0x68f970
xor ecx, ecx
mov dword [esi + 0x108], ecx
mov dword [esi + 0x10c], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x68faad
Capabilities:
Get disk information

Disassembly:
mov eax, 0x6b0f03
call fcn.006375a8
sub esp, 0x448
push edi
mov edi, ecx
cmp dword [edi + 0x110], 2
jne 0x68fad1
xor eax, eax
inc eax
jmp 0x68fbd8
push esi
movzx esi, word [ebp + 8]
lea eax, [ebp - 0x44]
push esi
push 0x738694
push eax
call fcn.004638e7
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push esi
push str._c:_
push eax
call fcn.004638e7
add esp, 0x18
mov eax, dword [ebp - 0x2c]
push 8
pop esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], esi
jae 0x68fb0d
lea eax, [ebp - 0x2c]
mov edx, 0x104
lea ecx, [ebp - 0x454]
push edx
push ecx
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edx
lea ecx, [ebp - 0x24c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
je 0x68fbb5
lea eax, [ebp - 0x24c]
push eax
call fcn.00426a30
pop ecx
push eax
lea eax, [ebp - 0x24c]
push eax
lea ecx, [edi + 0xa8]
call fcn.004372ba
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], esi
jb 0x68fb63
mov eax, dword [eax]
push eax
mov ecx, edi
call fcn.0068f857
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x14], esi
jb 0x68fb75
mov eax, dword [eax]
push eax
mov ecx, edi
call fcn.0068f8bd
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x30], esi
jae 0x68fb88
lea eax, [ebp - 0x44]
push eax
mov ecx, edi
call fcn.0068f885
mov ecx, edi
mov dword [edi + 0x110], 2
call fcn.0068f8de
push 7
push edi
call fcn.005c9a0a
mov ecx, eax
call fcn.005c9d3f
xor esi, esi
inc esi
jmp 0x68fbbd
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004267c2
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.004267c2
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00431219
Function at 0xfd2260
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0xfd229a
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0xfd22a1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0xfd2280
jmp 0xfd22a3
mov eax, 0x1505
jmp 0xfd22a3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0xfd2990
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0xfd2b56
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test ebp, ebp
je 0xfd2b4f
mov edx, 0x5e6ea9af
mov eax, ebp
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebp
sub edx, eax
jmp 0xfd2a33
mov edx, dword [esp]
mov eax, edx
sub eax, dword [esp + 4]
add ebx, eax
mov ebp, edx
not ebp
mov esi, dword [esp + 0xc]
and ebp, esi
not esi
mov eax, ecx
mov edx, 0x80078071
mul edx
and esi, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
mov dword [esp], eax
mov eax, edi
mov edx, 0x80078071
mul edx
sub ecx, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov edx, 0x15b0
sub ebp, esi
je 0xfd2b4f
xor eax, eax
cmp edx, 8
mov dword [esp], edx
jb 0xfd2ab4
and edx, 0x1ff8
mov dword [esp + 4], edx
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add eax, 8
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 4]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 5]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 6]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 7]
add edi, esi
mov esi, ecx
xor esi, edi
and ecx, edi
lea ecx, [esi + ecx*2]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0xfd2a50
add ebx, eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], ebp
mov esi, eax
sub esi, edx
jae 0xfd29eb
mov ebp, edx
and ebp, 3
mov dword [esp + 4], eax
je 0xfd2b02
mov dword [esp + 8], esi
neg ebp
xor eax, eax
mov edx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec eax
cmp ebp, eax
jne 0xfd2ae0
mov ebp, dword [esp + 4]
sub ebp, eax
mov esi, dword [esp + 8]
cmp esi, 0xfffffffc
ja 0xfd29e0
jmp 0xfd2b0f
mov ebp, eax
mov edx, ebx
cmp esi, 0xfffffffc
ja 0xfd29e0
mov eax, dword [esp]
sub eax, ebp
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + ebp]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + ebp + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 3]
add edi, esi
add ecx, edi
add ebp, 4
cmp eax, ebp
jne 0xfd2b20
jmp 0xfd29e0
shl ecx, 0x10
or ecx, edi
jmp 0xfd2b5b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xfd2b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0xfd2bc8
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0xfd2bca
not eax
xor esi, esi
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x100f80c]
mov eax, edi
shr eax, 4
shr ebx, 4
mov ebp, ebx
and ebp, edi
and edi, 0xf
or edi, ebx
xor edi, ebp
xor eax, dword [edi*4 + 0x100f80c]
inc esi
cmp edx, esi
jne 0xfd2b90
not eax
jmp 0xfd2bca
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xfd7c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0xfd7c5b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0xfd7c63
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0xfd7cfb
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0xfd7ca9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0xfd7d0a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0xfd7cbe
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0xfd7cd0
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0xfd7c90
jmp 0xfd7cd9
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0xfd7c90
cmp edi, ebx
jge 0xfd7cf0
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0xfd7c94
jmp 0xfd7cf4
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0xfd7c9d
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0xfd7d92
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0xfd7d92
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0xfd7d44
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0xfd7d30
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0xfd7d92
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0xfd7d50
dec eax
mov ecx, 1
xor esi, esi
jmp 0xfd7dac
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0xfd7c5b
test edx, edx
mov dword [esp], ecx
js 0xfd7de0
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0xfd7df0
inc ebp
dec edx
cmp edi, ebp
jne 0xfd7dc0
mov edx, 0xffffffff
jmp 0xfd7df2
xor edi, edi
jmp 0xfd7df5
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0xfd7da0
and ebp, 3
je 0xfd7e28
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0xfd7e10
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0xfd7e2a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0xfd7da0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0xfd7e40
jmp 0xfd7da0