joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6cfc6f54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x6cfc6f92
jmp 0x6cfc6fbf
jmp 0x6cfc6fec
jmp 0x6cfc7019
jmp 0x6cfc7046
jmp 0x6cfc7073
jmp 0x6cfc70a0
jmp 0x6cfc70cd
jmp 0x6cfc70fa
jmp 0x6cfc7127
jmp 0x6cfc7154
jmp 0x6cfc7181
jmp 0x6cfc71ae
jmp 0x6cfc71db
jmp 0x6cfc7208
jmp 0x6cfc7235
jmp 0x6cfc7262
jmp 0x6cfc728f
jmp 0x6cfc72bc
jmp 0x6cfc72e9
jmp 0x6cfc7316
jmp 0x6cfc7343
jmp 0x6cfc7370
jmp 0x6cfc739d
jmp 0x6cfc73ca
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x6cfc73fd
jmp 0x6cfc742a
jmp 0x6cfc7457
jmp 0x6cfc7484
jmp 0x6cfc74b1
jmp 0x6cfc74de
jmp 0x6cfc750b
jmp 0x6cfc7538
jmp 0x6cfc7565
jmp 0x6cfc7592
jmp 0x6cfc75bf
jmp 0x6cfc75ec
jmp 0x6cfc7619
jmp 0x6cfc7646
jmp 0x6cfc7673
jmp 0x6cfc76a0
jmp 0x6cfc76cd
jmp 0x6cfc76fa
jmp 0x6cfc7727
jmp 0x6cfc7754
jmp 0x6cfc7781
jmp 0x6cfc77ae
jmp 0x6cfc77db
jmp 0x6cfc7808
jmp 0x6cfc7835
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x6cfc787c
jmp 0x6cfc78a9
jmp 0x6cfc78d6
jmp 0x6cfc7903
jmp 0x6cfc7930
jmp 0x6cfc795d
jmp 0x6cfc798a
jmp 0x6cfc79b7
jmp 0x6cfc79e4
jmp 0x6cfc7a11
jmp 0x6cfc7a3e
jmp 0x6cfc7a6b
jmp 0x6cfc7a98
jmp 0x6cfc7ac5
jmp 0x6cfc7af2
jmp 0x6cfc7b1f
jmp 0x6cfc7b4c
jmp 0x6cfc7b79
jmp 0x6cfc7ba6
jmp 0x6cfc7bd3
jmp 0x6cfc7c00
jmp 0x6cfc7c2d
jmp 0x6cfc7c5a
jmp 0x6cfc7c87
jmp 0x6cfc7cb4
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x6cfc7cea
jmp 0x6cfc7d17
jmp 0x6cfc7d44
jmp 0x6cfc7d71
jmp 0x6cfc7d9e
jmp 0x6cfc7dcb
jmp 0x6cfc7df8
jmp 0x6cfc7e25
jmp 0x6cfc7e52
jmp 0x6cfc7e7f
jmp 0x6cfc7eac
jmp 0x6cfc7ed9
jmp 0x6cfc7f06
jmp 0x6cfc7f33
jmp 0x6cfc7f60
jmp 0x6cfc7f8d
jmp 0x6cfc7fba
jmp 0x6cfc7fe7
jmp 0x6cfc8014
jmp 0x6cfc8041
jmp 0x6cfc806e
jmp 0x6cfc809b
jmp 0x6cfc80c8
jmp 0x6cfc80f5
jmp 0x6cfc8122
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x6cfc8168
jmp 0x6cfc8195
jmp 0x6cfc81c2
jmp 0x6cfc81ef
jmp 0x6cfc821c
jmp 0x6cfc8249
jmp 0x6cfc8276
jmp 0x6cfc82a3
jmp 0x6cfc82d0
jmp 0x6cfc82fd
jmp 0x6cfc832a
jmp 0x6cfc8357
jmp 0x6cfc8384
jmp 0x6cfc83b1
jmp 0x6cfc83de
jmp 0x6cfc840b
jmp 0x6cfc8438
jmp 0x6cfc8465
jmp 0x6cfc8492
jmp 0x6cfc84bf
jmp 0x6cfc84ec
jmp 0x6cfc8519
jmp 0x6cfc8546
jmp 0x6cfc8573
jmp 0x6cfc85a0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x1c]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x2c], eax
jmp 0x6cfc85e7
jmp 0x6cfc8614
jmp 0x6cfc8641
jmp 0x6cfc866e
Function at 0x6cfd3ead
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d93b018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6d93b018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6cfd3efa
jmp 0x6cfd3f27
jmp 0x6cfd3f54
jmp 0x6cfd3f81
jmp 0x6cfd3fae
jmp 0x6cfd3fdb
jmp 0x6cfd4008
jmp 0x6cfd4035
jmp 0x6cfd4062
jmp 0x6cfd408f
jmp 0x6cfd40bc
jmp 0x6cfd40e9
jmp 0x6cfd4116
jmp 0x6cfd4143
jmp 0x6cfd4170
jmp 0x6cfd419d
jmp 0x6cfd41ca
jmp 0x6cfd41f7
jmp 0x6cfd4224
jmp 0x6cfd4251
jmp 0x6cfd427e
jmp 0x6cfd42ab
jmp 0x6cfd42d8
jmp 0x6cfd4305
jmp 0x6cfd4332
mov dword [ebp - 0x14], 0
jmp 0x6cfd4366
jmp 0x6cfd4393
jmp 0x6cfd43c0
jmp 0x6cfd43ed
jmp 0x6cfd441a
jmp 0x6cfd4447
jmp 0x6cfd4474
jmp 0x6cfd44a1
jmp 0x6cfd44ce
jmp 0x6cfd44fb
jmp 0x6cfd4528
jmp 0x6cfd4555
jmp 0x6cfd4582
jmp 0x6cfd45af
jmp 0x6cfd45dc
jmp 0x6cfd4609
jmp 0x6cfd4636
jmp 0x6cfd4663
jmp 0x6cfd4690
jmp 0x6cfd46bd
jmp 0x6cfd46ea
jmp 0x6cfd4717
jmp 0x6cfd4744
jmp 0x6cfd4771
jmp 0x6cfd479e
mov dword [ebp - 0x18], 0
jmp 0x6cfd47d2
jmp 0x6cfd47ff
jmp 0x6cfd482c
jmp 0x6cfd4859
jmp 0x6cfd4886
jmp 0x6cfd48b3
jmp 0x6cfd48e0
jmp 0x6cfd490d
jmp 0x6cfd493a
jmp 0x6cfd4967
jmp 0x6cfd4994
jmp 0x6cfd49c1
jmp 0x6cfd49ee
jmp 0x6cfd4a1b
jmp 0x6cfd4a48
jmp 0x6cfd4a75
jmp 0x6cfd4aa2
jmp 0x6cfd4acf
jmp 0x6cfd4afc
jmp 0x6cfd4b29
jmp 0x6cfd4b56
jmp 0x6cfd4b83
jmp 0x6cfd4bb0
jmp 0x6cfd4bdd
jmp 0x6cfd4c0a
mov dword [ebp - 0x10], 0
jmp 0x6cfd4c3e
jmp 0x6cfd4c6b
jmp 0x6cfd4c98
jmp 0x6cfd4cc5
jmp 0x6cfd4cf2
jmp 0x6cfd4d1f
jmp 0x6cfd4d4c
jmp 0x6cfd4d79
jmp 0x6cfd4da6
jmp 0x6cfd4dd3
jmp 0x6cfd4e00
jmp 0x6cfd4e2d
jmp 0x6cfd4e5a
jmp 0x6cfd4e87
jmp 0x6cfd4eb4
jmp 0x6cfd4ee1
jmp 0x6cfd4f0e
jmp 0x6cfd4f3b
jmp 0x6cfd4f68
jmp 0x6cfd4f95
jmp 0x6cfd4fc2
jmp 0x6cfd4fef
jmp 0x6cfd501c
jmp 0x6cfd5049
jmp 0x6cfd5076
mov dword [ebp - 0x10], 0
jmp 0x6cfd66c3
jmp 0x6cfd50af
jmp 0x6cfd50dc
jmp 0x6cfd5109
jmp 0x6cfd5136
jmp 0x6cfd5163
jmp 0x6cfd5190
jmp 0x6cfd51bd
jmp 0x6cfd51ea
jmp 0x6cfd5217
jmp 0x6cfd5244
jmp 0x6cfd5271
jmp 0x6cfd529e
jmp 0x6cfd52cb
jmp 0x6cfd52f8
jmp 0x6cfd5325
jmp 0x6cfd5352
jmp 0x6cfd537f
jmp 0x6cfd53ac
jmp 0x6cfd53d9
jmp 0x6cfd5406
jmp 0x6cfd5433
jmp 0x6cfd5460
jmp 0x6cfd548d
jmp 0x6cfd54ba
jmp 0x6cfd54e7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6d93b014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6cfd5525
jmp fcn.6cfd5552
mov eax, dword [0x6d93b018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6cfd5082
nop
leave
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebx
pcmpeqw mm7, mm7
push ecx
pxor mm6, mm6
push esi
psllw mm7, 0xf
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
sub eax, 4
jl 0x401089
jmp 0x401030
movq mm0, qword [esi]
pxor mm0, mm7
movq mm3, mm0
movq mm1, qword [ebx + esi]
punpcklwd mm0, mm6
pxor mm1, mm7
movq mm2, qword [esi + ebx*2]
movq mm4, mm1
pxor mm2, mm7
add edi, 0x10
prefetcht0 byte [esi + ebx*2 + 0x40]
punpcklwd mm1, mm6
movq mm5, mm2
punpcklwd mm2, mm6
paddd mm1, mm1
punpckhwd mm3, mm6
paddd mm0, mm2
punpckhwd mm4, mm6
paddd mm0, mm1
punpckhwd mm5, mm6
paddd mm4, mm4
paddd mm3, mm5
paddd mm3, mm4
movq qword [edi - 0x10], mm0
add esi, 8
sub eax, 4
movq qword [edi - 8], mm3
jge 0x401030
add eax, 4
jle 0x4010be
push edx
movzx ecx, word [esi]
xor ecx, 0x8000
movzx edx, word [ebx + esi]
xor edx, 0x8000
add edx, edx
add ecx, edx
movzx edx, word [esi + ebx*2]
xor edx, 0x8000
add ecx, edx
add esi, 2
mov dword [edi], ecx
add edi, 4
dec eax
jg 0x40108f
pop edx
pop edi
pop esi
pop ecx
pop ebx
ret

Function at 0x5b9e60
Capabilities:
Delete file

Disassembly:
mov cl, byte [0x7ce046]
mov dl, byte [0x7ce045]
mov al, cl
push esi
and al, dl
mov esi, dword [0x7ce034]
xor al, 0x16
mov byte [0x7ce045], al
mov eax, dword [0x7ce030]
mov edx, eax
and eax, 8
shr edx, 5
and esi, edx
xor edx, edx
mov dl, cl
mov dword [0x7ce034], esi
imul eax, edx
mov edx, dword [0x7ce03c]
or edx, eax
mov eax, dword [0x7d1250]
push eax
mov dword [0x7ce03c], edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [0x7d1544]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, dword [0x7d1544]
push 0x23
push 0xa
push edx
call dword [sym.imp.GDI32.dll_GetPixel]
push 0
push 0
push 3
push 0
push 3
push 0x40000000
push str.CONOUT_
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_ReleaseStgMedium]
mov dword [0x7ce064], esi
mov eax, esi
pop esi
ret

Function at 0x6d9a3e
Capabilities:
Encode data using xor

Disassembly:
jmp 0x330692dc
loop 0x6d99b6
shr byte [ecx], cl
int3
cmpsd dword [esi], dword es:[edi]
into
ret
jg 0x6d99ca
mov eax, 0xc9b94814
inc esp
lodsb al, byte [esi]
pop es
mov ecx, 0x7ac44c9
xor ebp, dword [ebx + edx]
jecxz 0x6d9a43
pop ss
jmp 0x6d99e9
Function at 0x4045f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x4046f3
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4046f3
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x40463a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x404641
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x404620
jmp 0x404643
mov esi, 0x1505
jmp 0x404643
mov esi, ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x20]
mov edi, edx
sub edi, 1
jb 0x4046f3
and edi, esi
mov eax, edx
xor eax, 1
mov ebx, edx
and ebx, 0xfffffffe
add ebx, ebx
sub ebx, eax
mov dword [esp + 0xc], ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
xor ebp, ebp
mov dword [esp], edx
mov dword [esp + 4], edi
jmp 0x404694
mov eax, ebp
and eax, 1
xor ebp, 1
lea ebp, [ebp + eax*2]
cmp ebp, edx
mov edi, dword [esp + 4]
jae 0x4046f1
lea eax, [edi + ebp]
and eax, dword [esp + 0xc]
mov ebx, dword [esp + 8]
mov ebx, dword [ebx + eax*4]
cmp ebx, 0xffffffff
je 0x4046f1
mov eax, dword [ecx + 8]
cmp dword [eax + ebx*4], esi
jne 0x404680
mov eax, dword [ecx + 0xc]
mov edi, dword [eax + ebx*4]
push edi
call fcn.0040cb00
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x404680
push dword [esp + 0x2c]
push edi
push dword [esp + 0x30]
call fcn.0040cb20
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404680
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebx*4]
jmp 0x4046f3
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
xor eax, eax
cmp dword [esp + 0x18], 0
je 0x404e64
cmp dword [esp + 0x1c], 0
jle 0x404e0b
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
lea ecx, [edx + eax]
mov dword [esp], ecx
jmp 0x404ca5
cmp esi, 0xc0
jne 0x404e62
and ebx, 0xffffffe0
cmp ebx, 0x360
mov ecx, dword [esp]
je 0x404e62
add edx, ebp
cmp edx, ecx
jae 0x404e0b
movzx ebx, byte [edx]
cmp ebx, 0xf4
ja 0x404e62
mov eax, ebx
and al, 0xfe
cmp al, 0xc0
je 0x404e62
mov eax, ebx
and eax, 0xffffffc0
cmp eax, 0x80
je 0x404e62
mov ebp, 1
test bl, bl
jns 0x404c9b
mov esi, ebx
and esi, 0xffffffe0
cmp esi, 0xc0
jne 0x404d04
movzx edi, byte [edx + 1]
mov eax, edi
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x404e62
and ebx, 0x1f
mov ebp, 2
jmp 0x404d57
mov eax, ebx
xor eax, 0xffffff0f
mov ecx, ebx
or ecx, 0xf0
and ecx, eax
cmp ecx, 0xe0
jne 0x404d5b
movzx eax, byte [edx + 1]
mov ecx, eax
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x404e62
movzx edi, byte [edx + 2]
mov ecx, edi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x404e62
and ebx, 0xf
shl ebx, 6
and eax, 0x3f
or ebx, eax
mov ebp, 3
xor ecx, ecx
jmp 0x404dc9
mov eax, ebx
and eax, 0xfffffff8
cmp eax, 0xf0
jne 0x404e62
movzx ecx, byte [edx + 1]
mov eax, ecx
not eax
or eax, 0xc0
add eax, ecx
cmp eax, 0x7f
jne 0x404e62
movzx eax, byte [edx + 2]
mov edi, eax
and edi, 0xffffffc0
cmp edi, 0x80
jne 0x404e62
movzx edi, byte [edx + 3]
mov ebp, edi
and ebp, 0xffffffc0
cmp ebp, 0x80
jne 0x404e62
and ebx, 7
shl ebx, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebx
and eax, 0x3f
or eax, ecx
mov cl, 1
mov ebp, 4
mov ebx, eax
mov eax, ebx
shl eax, 6
and edi, 0x3f
or edi, eax
cmp edi, 0x80
jb 0x404e62
cmp edi, 0x7ff
jbe 0x404c7d
cmp edi, 0xffff
ja 0x404dfd
test cl, cl
je 0x404c89
jmp 0x404e62
cmp edi, 0x10ffff
jbe 0x404c89
jmp 0x404e62
mov edi, dword [esp + 0x1c]
lea eax, [edi + 1]
push eax
call dword [0x444004]
add esp, 4
test eax, eax
je 0x404e62
mov esi, eax
mov byte [eax + edi], 0
push edi
push dword [esp + 0x1c]
push eax
call fcn.0040ca20
add esp, 0xc
push 0x10
call dword [0x444004]
add esp, 4
test eax, eax
je 0x404e58
mov dword [eax], 0
mov dword [eax + 4], 2
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
jmp 0x404e64
push esi
call dword [section..data]
add esp, 4
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405900
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
cmp dword [esp + 0x2c], 0
je 0x405b08
mov esi, dword [esp + 0x30]
test esi, esi
je 0x405b08
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x405b08
cmp dword [ecx], 0
jne 0x405b08
push esi
call fcn.0040cb00
add esp, 4
test eax, eax
je 0x40596a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405971
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405950
jmp 0x405973
mov edi, 0x1505
jmp 0x405973
mov edi, ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x20]
mov esi, edx
sub esi, 1
jae 0x405a3d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x4059ca
call fcn.00405bf0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x30]
jne 0x405b08
push esi
call fcn.0040cb00
add esp, 4
mov edx, esi
lea esi, [esp + 0x14]
mov ecx, dword [esp + 0x2c]
push esi
push edi
push eax
call fcn.00405b10
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x30]
push esi
call fcn.0040cb00
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x444004]
add esp, 4
test eax, eax
je 0x405b03
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040ca20
add esp, 0xc
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x34]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405b08
mov dword [esp + 4], eax
and esi, edi
mov eax, edx
xor eax, 1
mov ebx, edx
and ebx, 0xfffffffe
add ebx, ebx
sub ebx, eax
mov dword [esp + 0x10], ebx
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
xor ebx, ebx
mov dword [esp], edx
mov dword [esp + 8], esi
jmp 0x405a87
mov eax, ebx
and eax, 1
xor ebx, 1
lea ebx, [ebx + eax*2]
cmp ebx, edx
mov esi, dword [esp + 8]
jae 0x405985
lea ebp, [ebx + esi]
and ebp, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x40598a
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405a70
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
call fcn.0040cb00
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x405a70
push dword [esp + 4]
push ebp
push dword [esp + 0x38]
call fcn.0040cb20
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x405a70
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404a20
mov edx, dword [esp + 0x30]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x34]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405a32
mov eax, 0xffffffff
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406cb0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x406e66
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test ebp, ebp
je 0x406e5f
mov edx, 0x5e6ea9af
mov eax, ebp
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebp
sub esi, eax
jmp 0x406d52
mov esi, dword [esp]
mov eax, esi
sub eax, dword [esp + 4]
add ebx, eax
mov ebp, dword [esp + 0xc]
mov eax, edi
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
mov dword [esp], eax
mov eax, ecx
mov edx, 0x80078071
mul edx
sub edi, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov eax, ebp
not eax
and eax, esi
not esi
and ebp, esi
mov esi, 0x15b0
sub ebp, eax
je 0x406e5f
xor eax, eax
cmp esi, 8
mov dword [esp], esi
jb 0x406dcc
and esi, 0x1ff8
mov dword [esp + 4], esi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
movzx edx, byte [ebx + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebx + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 6]
add edx, esi
mov esi, dword [esp]
add ecx, edx
movzx edi, byte [ebx + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, esi
jb 0x406d70
add ebx, edx
mov eax, dword [esp + 4]
mov edx, eax
sub edx, esi
jae 0x406d0f
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebp
mov ebp, esi
and ebp, 3
mov dword [esp + 4], eax
je 0x406e10
neg ebp
xor eax, eax
mov edx, ebx
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec eax
cmp ebp, eax
jne 0x406df0
mov ebp, dword [esp + 4]
sub ebp, eax
cmp dword [esp + 8], 0xfffffffc
ja 0x406d00
jmp 0x406e1f
mov ebp, eax
mov edx, ebx
cmp dword [esp + 8], 0xfffffffc
ja 0x406d00
mov eax, dword [esp]
sub eax, ebp
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + ebp]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + ebp + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 3]
add edi, esi
add ecx, edi
add ebp, 4
cmp eax, ebp
jne 0x406e30
jmp 0x406d00
shl ecx, 0x10
or ecx, edi
jmp 0x406e6b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x406ee6
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x406ee8
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
mov ebp, eax
xor ebp, 0x3ffffff0
or eax, 0xf
and eax, ebp
mov ebp, edi
not ebp
or ebp, 0xf
add ebp, edi
inc ebp
xor ebp, eax
xor ebx, dword [ebp*4 + 0x441c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x441c50]
inc esi
cmp edx, esi
jne 0x406ea0
not eax
jmp 0x406ee8
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d170
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
call fcn.0043a1e0
test al, al
je 0x40d26b
call fcn.00433360
test al, al
je 0x40d266
mov dword [esp], 0x19418649
mov dword [esp + 4], 0
xor ecx, ecx
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
mov esi, ecx
xor esi, 0x31e3ca07
or esi, edx
add esi, ecx
add esi, 0xce1c35f9
mov edi, esi
and edi, 0xfffffffd
mov ebx, esi
and ebx, 2
mov ebp, esi
or ebp, 0xfffffffd
inc ebp
imul ebp, edi
or esi, 2
imul esi, ebx
sub ebp, esi
add edx, ecx
lea esi, [edx + ebp]
add esi, 0xce1c35f8
mov edx, esi
and edx, 0x25
mov edi, esi
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, edx
or edx, 2
imul edx, edi
mov edi, esi
or edi, 0xd8
not esi
or esi, 0x27
and esi, edi
sub ebx, esi
add ebx, edx
mov byte [esp + ecx], bl
mov edx, ecx
mov esi, ecx
xor eax, 1
add eax, ecx
xor ecx, 0xfffffffe
or edx, 1
and edx, ecx
and esi, 6
sub eax, esi
add eax, edx
mov ecx, eax
cmp eax, 8
jb 0x40d1b0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40d253
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e380
test al, al
je 0x40d266
call fcn.00410ef0
call fcn.0040fab0
call fcn.0043b540
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40e380
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1a4
mov eax, dword [0x449920]
mov dword [esp + 0x124], 0x63629960
mov byte [esp + 0x128], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
or dl, 0x98
xor dl, byte [esp + ecx + 0x124]
add dl, 8
mov byte [esp + ecx + 0x124], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 5
jb 0x40e3b0
mov ecx, dword [esp + 0x124]
mov dword [esp + 0x24], 0x13fb118f
mov dword [esp + 0x28], 0x1ff61d8a
mov dword [esp + 0x2c], 0x1b861984
mov dword [esp + 0x30], 0x7d00594
mov dword [esp + 0x34], 0x39601ec
mov dword [esp + 0x38], 0xf0e0d98
mov word [esp + 0x3c], 0
mov byte [esp + 0x3e], 0
xor edx, edx
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx + 0x24]
lea esi, [edx + 0x44]
and esi, ebx
add ebx, edx
add esi, esi
sub ebx, esi
add bl, 0xf0
mov byte [esp + edx + 0x24], bl
mov esi, edx
not esi
or esi, 1
add esi, edx
or edx, 1
add edx, esi
inc edx
cmp edx, 0x1a
jbe 0x40e420
lea edx, [esp + 0x24]
push ecx
push 0
push edx
call eax
mov ecx, 0x4498e8
push eax
call fcn.00439f20
movzx eax, al
mov eax, dword [eax*4 + 0x444a00]
mov ecx, 0xcfb7055
xor ecx, dword [0x444a08]
add eax, ecx
inc eax
jmp eax

Function at 0x40f410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ebx, esp
push eax
mov dword [esi + 0x1c], esp
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x4498fc]
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40f4be
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x444c6c]
xor eax, eax
jmp 0x40f8ea
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f424
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ebx, esp
push eax
mov dword [esi + 0x1c], esp
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x4498fc]
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40f4be
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x444c6c]
xor eax, eax
jmp 0x40f8ea
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret