joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4578bc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004571f4
xor eax, eax
push ebp
push 0x457a2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x457a17
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x457907
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x457911
call fcn.00403af0
jmp 0x457a34
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00416590
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x457a0c
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x4579bf
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x4579ac
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004034b4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.00457874
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x457a40]
cmp dl, byte [eax + 0x28]
je 0x457a13
call fcn.0040b5e0
jmp 0x457a13
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004165b0
jmp 0x457a13
cmp ecx, ebx
jge 0x4579db
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004165b0
jmp 0x457911
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00416590
cmp edx, dword [esp + 4]
jne 0x4579fb
cmp eax, dword [esp]
pop edx
pop eax
jne 0x457911
push ebp
call fcn.00457874
pop ecx
jmp 0x457a13
push ebp
call fcn.00457874
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457a34
mov eax, dword [ebp - 4]
call fcn.00457200
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457a44
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x457b66
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004571f4
xor eax, eax
push ebp
push 0x457b49
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x457a94
call fcn.00403af0
jmp 0x457b50
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x457b33
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x457b33
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004034b4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x457b33
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040add4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x457b80
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x45b154]
mov dl, 1
mov eax, dword [0x4564fc]
call fcn.0040b6f8
call fcn.00403a44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457b50
mov eax, dword [ebp - 4]
call fcn.00457200
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457b6d
lea eax, [ebp - 0x28]
call fcn.0040408c
ret
Function at 0x457bcc
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x457d16
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004571f4
xor eax, eax
push ebp
push 0x457cf9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x457c31
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x457c31
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x457ce3
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x457c44
call fcn.00403af0
jmp 0x457d00
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x457ce3
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x457ce3
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004034b4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x457ce3
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040add4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x457d30
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x45b154]
mov dl, 1
mov eax, dword [0x4564fc]
call fcn.0040b6f8
call fcn.00403a44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457d00
mov eax, dword [ebp - 4]
call fcn.00457200
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457d1d
lea eax, [ebp - 0x28]
call fcn.0040408c
ret
Function at 0x401000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x434048]
sub esp, 0x90
push ebx
push esi
mov esi, 0x42c8c0
push edi
mov eax, esi
xor edi, edi
lea eax, [eax + 2]
and edx, 0x5ae942cf
cmp word [eax], di
jne 0x40101b
mov ecx, edi
imul ebx, edx, 0x5e481724
inc ecx
cmp word [ecx*2 + 0x42c8a8], di
jne 0x401031
mov eax, dword [ebp - 4]
jmp 0x401055
cmp eax, 0x1c16
jne 0x40104e
or ebx, 0xe5d1edf0
or edx, 0xe8fdda90
inc eax
cmp eax, ecx
jb 0x401041
sub edx, 0x30c20b57
mov dword [0x434048], edx
lea esi, [esi + 2]
imul ebx, ebx, 0x4f0efb99
cmp word [esi], di
jne 0x401065
push 6
mov eax, edi
mov dword [0x434020], ebx
pop ecx
mov esi, 0x42c054
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
push 0x47
pop esi
cmp si, word [ebp - 0x1c]
jne 0x4010b3
xor edi, edi
mov ecx, edi
test si, si
je 0x4010b3
cmp word [ebp + ecx - 0x1c], di
je 0x4010b3
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + 0x42c830]
cmp si, word [ebp + ecx - 0x1c]
je 0x401095
movzx ecx, byte [eax*2 + 0x42c830]
movzx eax, byte [ebp + eax*2 - 0x1c]
sub ecx, eax
cmp ecx, 0x19a6
jae 0x4010d8
and ebx, 0xf098d1c0
mov dword [0x434048], ebx
jmp 0x4010e3
imul eax, edx, 0x9082fba7
mov dword [0x434020], eax
call dword [sym.imp.USER32.dll_AnyPopup]
push 0x1d
pop ecx
push 0x53
mov esi, 0x42c070
lea edi, [ebp - 0x90]
xor ebx, ebx
pop edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
cmp dx, word [ebp - 0x90]
jne 0x40112f
mov ecx, ebx
test dx, dx
je 0x40112f
cmp word [ebp + ecx - 0x90], bx
je 0x40112f
inc eax
lea ecx, [eax + eax]
movzx edx, word [ecx + 0x42c7e0]
cmp dx, word [ebp + ecx - 0x90]
je 0x40110b
movzx ecx, byte [eax*2 + 0x42c7e0]
movzx eax, byte [ebp + eax*2 - 0x90]
sub ecx, eax
cmp ecx, 0x142f
ja 0x40115a
imul eax, dword [0x434020], 0x76c39c8a
mov dword [0x434020], eax
jmp 0x40115f
mov eax, dword [0x434020]
mov esi, 0x42c0f0
lea edi, [ebp - 0x14]
push 0x44
mov ebx, eax
xor ecx, ecx
xor ebx, 0xb725c91e
mov edx, ecx
movsd dword es:[edi], dword [esi]
mov dword [0x434048], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
cmp si, word [ebp - 0x14]
jne 0x4011d1
xor edi, edi
test si, si
je 0x4011a6
cmp word [ebp + ecx - 0x14], di
je 0x4011a6
inc edx
lea ecx, [edx + edx]
movzx esi, word [ecx + 0x42c8a8]
cmp si, word [ebp + ecx - 0x14]
je 0x401188
mov ecx, dword [ebp - 4]
cmp ecx, edx
jae 0x4011d1
cmp ecx, 0x21aa
jne 0x4011bb
imul eax, eax, 0x53b073e8
inc ecx
lea ebx, [eax + 0x7380a3db]
mov dword [0x434048], ebx
cmp ecx, edx
jb 0x4011ad
mov dword [0x434020], eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4011d8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
push edi
mov esi, 0x42c100
lea edi, [ebp - 0xc]
push 0x63
pop edx
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0xc], dl
jne 0x401213
mov cl, dl
test cl, cl
je 0x401213
cmp byte [ebp + eax - 0xc], 0
je 0x401213
mov cl, byte [eax + 0x42c861]
inc eax
cmp cl, byte [ebp + eax - 0xc]
je 0x4011fb
movzx ecx, byte [eax + 0x42c860]
movzx eax, byte [ebp + eax - 0xc]
sub ecx, eax
cmp ecx, 0x1881
jbe 0x401235
mov eax, dword [0x43404c]
add eax, 0x81b57e7f
jmp 0x40123f
imul eax, dword [0x43404c], 0x3001d7c1
xor esi, esi
imul ebx, eax, 0xf198e302
mov eax, esi
lea edi, [ebp - 0xc]
mov esi, 0x42c10c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0xc], 0x63
jne 0x401273
test dl, dl
je 0x401273
cmp byte [ebp + eax - 0xc], 0
je 0x401273
mov dl, byte [eax + 0x42c861]
inc eax
cmp dl, byte [ebp + eax - 0xc]
je 0x40125b
movzx ecx, byte [eax + 0x42c860]
lea edx, [ebx - 0x20da7358]
movzx eax, byte [ebp + eax - 0xc]
sub ecx, eax
cmp ecx, 0x132f
je 0x401295
lea edx, [ebx + 0x384c2164]
push 5
pop ecx
mov esi, 0x42c140
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
and edx, 0x8de5d45e
xor ebx, ebx
xor edx, 0xf6a88b93
mov eax, ebx
or edx, 0x2f321d8
add edx, 0x44b279bc
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x24], 0x53
jne 0x4012fd
mov cl, 0x53
test cl, cl
je 0x4012df
cmp byte [ebp + eax - 0x24], bl
je 0x4012df
mov cl, byte [eax + 0x42c781]
inc eax
cmp cl, byte [ebp + eax - 0x24]
je 0x4012c8
mov ecx, dword [ebp - 0x30]
jmp 0x4012f9
cmp ecx, 0x1b93
jne 0x4012f2
imul edx, edx, 0x66a67f9b
or edx, 0xac476a79
inc ecx
cmp ecx, eax
jb 0x4012e4
push 8
pop ecx
mov esi, 0x42c158
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
push 0x52
pop esi
add edx, 0x13b39d24
mov eax, ebx
cmp si, word [ebp - 0x2c]
jne 0x40133b
mov ecx, ebx
test si, si
je 0x40133b
cmp word [ebp + ecx - 0x2c], bx
je 0x40133b
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str.RtlNotifyFeatureUsage]
cmp si, word [ebp + ecx - 0x2c]
je 0x40131d
movzx ecx, byte [eax*2 + str.RtlNotifyFeatureUsage]
movzx eax, byte [ebp + eax*2 - 0x2c]
sub ecx, eax
cmp ecx, 0x1b3b
jne 0x40135a
and edx, 0x7ea94a77
jmp 0x401360
and edx, 0x16917665
push 0x14
pop ecx
mov esi, 0x42c178
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
push 0x53
pop ecx
movsw word es:[edi], word [esi]
cmp cx, word [ebp - 0x84]
jne 0x4013a6
xor esi, esi
mov eax, esi
test cx, cx
je 0x4013a6
cmp word [ebp + eax - 0x84], si
je 0x4013a6
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + 0x42c880]
cmp cx, word [ebp + eax - 0x84]
je 0x401382
movzx eax, byte [ebp + ebx*2 - 0x84]
movzx ecx, byte [ebx*2 + 0x42c880]
sub ecx, eax
mov eax, 0x2556
cmp eax, ecx
pop edi
sbb eax, eax
and eax, 0xc32bafc8
add eax, 0x63fe0ddd
imul eax, edx
pop esi
pop ebx
and eax, 0xc1b5612c
xor eax, 0x1cf6fcd0
add eax, 0x2c655a57
or eax, 0x9bcc805f
mov dword [0x43404c], eax
leave
ret
Function at 0x4013ec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x434060]
sub esp, 0x34
xor ecx, ecx
mov eax, ecx
or edx, 0x9eacf43b
inc eax
cmp word [eax*2 + 0x42ca10], cx
jne 0x4013fc
push ebx
mov ebx, dword [0x434084]
push esi
cmp eax, 0x1988
jbe 0x40142a
mov edx, dword [0x434074]
sub ebx, 0x79d60cde
jmp 0x401430
and edx, 0xc2d2c27f
push edi
mov eax, edx
mov dword [ebp - 0xc], ebx
or eax, 0x959fb111
lea edi, [ebp - 0x34]
push 0xa
mov dword [ebp - 8], eax
mov esi, 0x42c1cc
mov eax, ecx
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x49
pop ecx
xor esi, esi
cmp cx, word [ebp - 0x34]
jne 0x401481
mov ebx, eax
test cx, cx
je 0x401478
cmp word [ebp + eax - 0x34], si
je 0x401478
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + 0x42ca10]
cmp cx, word [ebp + eax - 0x34]
je 0x40145a
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx ecx, byte [eax*2 + 0x42ca10]
movzx eax, byte [ebp + eax*2 - 0x34]
sub ecx, eax
cmp ecx, 0xe97
jae 0x4014a1
mov eax, edx
and eax, 0x1762b8bf
jmp 0x4014a7
lea eax, [ebx + 0x460a41b4]
mov ebx, 0x42c800
mov ecx, ebx
lea ecx, [ecx + 2]
and eax, 0xe6d670a7
cmp word [ecx], si
jne 0x4014ae
mov dword [0x434084], eax
xor ecx, ecx
mov eax, esi
mov esi, dword [ebp - 8]
lea edi, [esi - 0x6f61acba]
inc eax
cmp word [eax*2 + 0x42ca10], cx
jne 0x4014cd
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
jae 0x4014fd
cmp ecx, 0x20e9
jne 0x4014ed
lea edi, [esi - 0x4a839448]
mov esi, edi
or esi, 0xc2b2a36
inc ecx
cmp ecx, eax
jb 0x4014df
mov dword [ebp - 8], esi
mov eax, 0x42ca10
xor ecx, ecx
lea eax, [eax + 2]
add edx, 0x4cb1e952
cmp word [eax], cx
jne 0x401504
push 8
mov eax, ecx
lea edi, [ebp - 0x30]
pop ecx
mov esi, 0x42c1f4
rep movsd dword es:[edi], dword [esi]
push 0x49
pop ecx
movsw word es:[edi], word [esi]
xor esi, esi
pop edi
cmp cx, word [ebp - 0x30]
jne 0x40155a
mov ebx, eax
test cx, cx
je 0x40154f
cmp word [ebp + eax - 0x30], si
je 0x40154f
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + 0x42ca10]
cmp cx, word [ebp + eax - 0x30]
je 0x401531
mov dword [ebp - 4], ebx
mov ebx, 0x42c800
mov eax, dword [ebp - 4]
movzx ecx, byte [eax*2 + 0x42ca10]
movzx eax, byte [ebp + eax*2 - 0x30]
sub ecx, eax
cmp ecx, 0xb7b
jne 0x40157a
mov edx, dword [ebp - 8]
and edx, 0xf07da270
mov eax, ebx
lea eax, [eax + 2]
add edx, 0x361e0e48
cmp word [eax], si
jne 0x40157c
mov eax, edx
xor eax, 0x854247ae
lea ebx, [ebx + 2]
add edx, 0x7219450d
cmp word [ebx], si
jne 0x401591
mov dword [0x434074], edx
mov ecx, esi
or eax, 0x21d38e93
inc ecx
cmp word [ecx*2 + 0x42c800], si
jne 0x4015a7
pop esi
mov dword [0x434060], eax
pop ebx
cmp dword [ebp - 0xc], ecx
jae 0x4015cf
imul ecx, edx, 0x4bd36704
mov dword [0x434060], ecx
imul ecx, edx, 0x9fb9632f
mov eax, edx
mov dword [0x434084], ecx
leave
ret
Function at 0x401dd8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x434080]
mov eax, 0x42c970
xor ecx, 0x6e4f9a88
inc eax
cmp byte [eax], 0
jne 0x401de3
push ebx
mov bl, byte [edx]
push esi
mov esi, dword [0x434050]
imul eax, esi, 0xa44eeca3
xor ecx, ecx
and eax, 0xa8118d42
inc ecx
cmp byte [ecx + 0x42c9e0], 0
jne 0x401e01
cmp ecx, 0x23e1
je 0x401e1d
or eax, 0x93a26343
mov edx, esi
xor edx, 0x6c8db19d
mov dword [0x43408c], edx
test bl, bl
je 0x401e3b
lea edx, [eax - 0x5998c063]
mov dword [0x43408c], edx
lea ecx, [esi + 0x352469c9]
mov eax, edx
pop esi
mov dword [0x434080], ecx
pop ebx
ret
Function at 0x4045e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4340e8]
push ebx
push esi
push edi
mov esi, 0x42cd68
lea edi, [ebp - 0x1c]
or eax, 0xa8f765a4
xor ebx, ebx
mov dword [ebp - 8], eax
mov ecx, ebx
imul eax, eax, 0x2c2786ab
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], eax
or eax, 0xc0654b7a
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x1c], 0x6f
jne 0x404653
mov dl, 0x6f
test dl, dl
je 0x404635
cmp byte [ebp + ecx - 0x1c], bl
je 0x404635
mov dl, byte [ecx + 0x42d3d1]
inc ecx
cmp dl, byte [ebp + ecx - 0x1c]
je 0x40461e
mov edx, dword [ebp - 0xc]
cmp edx, ecx
jae 0x404653
mov esi, dword [ebp - 0xc]
cmp edx, 0x1004
jne 0x40464e
mov eax, esi
xor eax, 0x2a50095a
inc edx
cmp edx, ecx
jb 0x40463f
mov ecx, dword [0x4340f8]
mov edx, ebx
mov edi, ecx
or edi, 0x41b46e99
mov dword [ebp - 0xc], edi
inc edx
cmp byte [edx + 0x42d320], bl
jne 0x404666
mov esi, dword [ebp - 0xc]
cmp esi, edx
jae 0x40469b
mov ecx, dword [ebp - 8]
cmp esi, 0x19d5
jne 0x404687
imul ecx, edi, 0x25cbb1c6
sub ecx, 0x143bf0b5
inc esi
cmp esi, edx
jb 0x404679
mov dword [ebp - 8], ecx
mov ecx, dword [0x4340f8]
mov esi, 0x42cd78
lea edi, [ebp - 0x1c]
mov edx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x1c], 0x6e
jne 0x4046f8
mov ecx, dword [0x4340f8]
mov byte [ebp - 1], 0x6e
mov bl, byte [ebp - 1]
test bl, bl
je 0x4046d3
cmp byte [ebp + edx - 0x1c], 0
je 0x4046d3
mov bl, byte [edx + 0x42d2c9]
inc edx
cmp bl, byte [ebp + edx - 0x1c]
je 0x4046bb
mov esi, dword [ebp - 0xc]
push 0
pop ebx
cmp esi, edx
jae 0x4046f8
mov ecx, dword [ebp - 8]
and ecx, 0x2d5efd87
cmp esi, 0x22c7
jne 0x4046f3
add eax, 0x45a26cc1
inc esi
cmp esi, edx
jb 0x4046e6
mov edi, ecx
mov edx, ebx
and edi, 0xa8abdfcc
inc edx
cmp byte [edx + 0x42d1c0], 0
jne 0x404702
cmp edx, 0x1f02
jne 0x40471e
mov edi, dword [ebp - 0xc]
and eax, 0x2006583f
jmp 0x404724
add edi, 0x6832d7ba
mov edx, eax
mov esi, ebx
and edx, 0xbc445111
mov dword [0x4340e8], edx
xor eax, 0x3cffb83d
inc esi
cmp byte [esi + 0x42d2c8], 0
jne 0x404734
cmp esi, 0x1e2
jb 0x404753
mov ecx, edi
and ecx, 0x5e3bf925
mov eax, ebx
xor ecx, 0xcf28c130
inc eax
cmp byte [eax + 0x42d424], 0
jne 0x40475b
mov esi, dword [ebp - 0xc]
jmp 0x404779
cmp esi, 0x16e0
jne 0x404778
add ecx, 0x10ebdb7f
inc esi
cmp esi, eax
jb 0x40476a
mov eax, edx
xor ecx, 0xd565f0a2
xor eax, 0x56c86405
mov dword [0x4340ac], eax
xor eax, 0xb90dc899
mov dword [0x4340e0], eax
mov eax, edx
xor eax, 0x7b36a633
mov dword [0x4340f4], eax
inc ebx
cmp byte [ebx + 0x42d3d0], 0
jne 0x4047a5
pop edi
pop esi
cmp ebx, 0x10ab
pop ebx
jbe 0x4047c2
and edx, 0x778ca8e9
jmp 0x4047ca
mov edx, ecx
and edx, 0xf2096d56
mov dword [0x4340f8], edx
leave
ret
Function at 0x4049f2
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
push edi
push 0x2a
pop eax
push 0xa
pop ecx
mov esi, 0x42ce30
mov byte [ebp - 9], al
lea edi, [ebp - 0x48]
mov dword [ebp - 0x18], 0xdd2653ef
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], 0x25ff77b4
mov dword [ebp - 0x10], 0xd0dff618
mov word [ebp - 0xc], 0x8d1a
movsw word es:[edi], word [esi]
mov byte [ebp - 0xa], 0x4e
mov dword [ebp - 8], 0x5bedaf2e
mov dword [ebp - 4], 0xa8543f07
movsb byte es:[edi], byte [esi]
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x148], al
inc eax
cmp eax, 0x100
jb 0x404a45
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x148]
push 0x2a
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x48]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x148]
mov byte [ebp + esi - 0x148], al
inc esi
mov byte [ebp + edi - 0x148], bl
cmp esi, 0x100
jb 0x404a56
and dword [ebp - 0x1c], 0
lea edi, [ebp - 0x2c]
mov esi, 0x42ce5c
xor ebx, ebx
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x2c], 0x6f
jne 0x404af2
mov cl, 0x6f
test cl, cl
je 0x404ac6
cmp byte [ebp + eax - 0x2c], bl
je 0x404ac6
mov cl, byte [eax + 0x42d181]
inc eax
cmp cl, byte [ebp + eax - 0x2c]
je 0x404aaf
mov ecx, dword [ebp + 8]
cmp ecx, eax
jae 0x404af2
mov edx, dword [0x4340a0]
cmp ecx, 0x178e
jne 0x404ae1
sub edx, 0x1cb6eb8b
imul edx, edx, 0xd27a6372
inc ecx
cmp ecx, eax
jb 0x404ad3
mov dword [0x4340a0], edx
mov edi, dword [ebp - 0x1c]
xor esi, esi
lea eax, [ebx + 1]
movzx ebx, al
mov cl, byte [ebp + ebx - 0x148]
movzx edx, cl
lea eax, [edx + edi]
movzx edi, al
mov al, byte [ebp + edi - 0x148]
mov byte [ebp + ebx - 0x148], al
mov byte [ebp + edi - 0x148], cl
movzx eax, byte [ebp + ebx - 0x148]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x148]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x38], al
inc esi
cmp esi, 0x18
jb 0x404af7
mov ecx, dword fs:[0x30]
lea edx, [ebp - 0x38]
mov esi, dword [ebp + 8]
mov byte [ebp - 0x20], 0
mov eax, dword [ecx + 0xa4]
mov dword [esi], eax
mov eax, dword [ecx + 0xa8]
mov dword [esi + 4], eax
movzx ecx, word [ecx + 0xac]
mov dword [esi + 8], ecx
lea ecx, [esi + 0xc]
push ecx
xor ecx, ecx
push 0xffffffffffffffff
inc ecx
call fcn.0040a2e6
call eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x404fa0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push ebx
push esi
push edi
push 7
mov dword [ebp - 0x1c], ecx
xor edi, edi
pop ecx
mov dword [ebp - 0x18], 0x3ef9d84b
xor eax, eax
mov dword [ebp - 0x14], 0x4e6004ea
mov dword [ebp - 0x10], 0xe08cc76c
mov dword [ebp - 0xc], 0x33c0dacf
mov dword [ebp - 8], 0x92873da2
mov byte [ebp - 4], 0x75
mov byte [ebp - 3], cl
mov word [ebp - 2], 0x9226
mov dword [ebp - 0x24], 0x7373656d
mov dword [ebp - 0x20], 0x656761
mov byte [ebp + eax - 0x160], al
inc eax
cmp eax, 0x100
jb 0x404ff4
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x160]
mov eax, esi
div ecx
movzx ecx, bl
push 7
movzx eax, byte [ebp + edx - 0x24]
add eax, edi
add ecx, eax
movzx edi, cl
pop ecx
mov al, byte [ebp + edi - 0x160]
mov byte [ebp + esi - 0x160], al
inc esi
mov byte [ebp + edi - 0x160], bl
cmp esi, 0x100
jb 0x405005
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x160]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x160]
mov byte [ebp + edi - 0x160], al
mov byte [ebp + ebx - 0x160], cl
movzx eax, byte [ebp + edi - 0x160]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x160]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x44], al
inc esi
cmp esi, 0x18
jb 0x405048
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x208
push eax
push dword [ebp - 0x1c]
xor ebx, ebx
lea edx, [ebp - 0x44]
push 6
pop eax
mov ecx, eax
mov byte [ebp - 0x2c], bl
call fcn.0040a2e6
call eax
test eax, eax
jne 0x4051e4
mov esi, 0x42ced8
mov dword [ebp - 0x18], 0x379c8fcd
lea edi, [ebp - 0x24]
mov dword [ebp - 0x14], 0x4ee526bf
mov dword [ebp - 0x10], 0xf6b6e0
mov eax, ebx
mov dword [ebp - 0xc], 0xe7437300
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 0x84d33bce
mov dword [ebp - 4], 0x4c03d184
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, ebx
mov byte [ebp + eax - 0x160], al
inc eax
cmp eax, 0x100
jb 0x4050f9
mov esi, ebx
xor edx, edx
mov bl, byte [ebp + esi - 0x160]
push 6
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x24]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x160]
mov byte [ebp + esi - 0x160], al
inc esi
mov byte [ebp + edi - 0x160], bl
cmp esi, 0x100
jb 0x40510a
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x160]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x160]
mov byte [ebp + edi - 0x160], al
mov byte [ebp + ebx - 0x160], cl
movzx eax, byte [ebp + edi - 0x160]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x160]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x60], al
inc esi
cmp esi, 0x18
jb 0x40514d
mov byte [ebp - 0x48], 0
call fcn.004045e1
lea ecx, [ebp - 0x60]
mov dword [0x43412c], 0x6fc9a02f
call fcn.0040b628
mov esi, eax
mov ecx, esi
call fcn.0040b8f4
add eax, eax
push eax
push esi
push dword [ebp - 0x1c]
call fcn.0040b543
mov ecx, esi
call fcn.0040b8f4
push eax
push 0
push esi
call fcn.0040b587
add esp, 0x18
mov ecx, esi
call fcn.0040a2d2
pop edi
pop esi
pop ebx
leave
ret