joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d70
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x104
mov eax, dword [0x44eea4]
xor eax, esp
mov dword [esp + 0x100], eax
push esi
mov esi, dword [0x44f1b4]
test esi, esi
je 0x402e82
cmp dword [0x44f1b0], 0
je 0x402e82
push 0x100
lea eax, [esp + 8]
push 0
push eax
call sub.MSVCR80.dll_memset
mov ecx, dword [str.Client_want_to_EXIT.]
mov eax, dword [0x447864]
mov edx, dword [0x447860]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x447868]
mov dword [esp + 0x18], eax
movzx eax, byte [0x447870]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [0x44f208]
mov byte [esp + 0x24], al
movzx eax, byte [0x44f20a]
mov dword [esp + 0x14], edx
mov edx, dword [0x44786c]
mov dword [esp + 0x20], edx
mov dl, byte [0x44f209]
mov byte [esp + 0x24], cl
movzx ecx, byte [0x44f20b]
mov byte [esp + 0x26], al
lea eax, [esp + 0x10]
mov byte [esp + 0x25], dl
add esp, 0xc
mov byte [esp + 0x1b], cl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402e22
push 0x10
push 0x44f58c
push 0
sub eax, edx
push eax
lea edx, [esp + 0x14]
push edx
push esi
call sub.WSOCK32.dll_sendto
cmp eax, 0xffffffff
jne 0x402e7c
push 0
push str.Error
push str.sendto__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x44f1b4]
push eax
call sub.WSOCK32.dll_closesocket
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.004451a2
add esp, 0x104
ret
mov esi, dword [0x44f1b4]
push esi
call sub.WSOCK32.dll_closesocket
mov dword [0x44f1b4], 0
mov dword [0x44f1b0], 0
call sub.WSOCK32.dll_WSACleanup
mov ecx, dword [esp + 0x104]
pop esi
xor ecx, esp
call fcn.004451a2
add esp, 0x104
ret
Function at 0x4144c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
xor al, al
cmp ebx, 0x20
jne 0x4144d0
mov al, bl
pop ebx
ret
lea ecx, [ebx - 0x41]
cmp ecx, 0x19
push esi
ja 0x414508
cmp byte [0x455388], 0x64
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
jne 0x4144f1
push 0x14
call esi
test ax, ax
je 0x414503
push 0x14
call esi
test ax, ax
jle 0x414577
cmp byte [0x455388], 0x64
je 0x414577
pop esi
mov al, bl
pop ebx
ret
lea edx, [ebx - 0x60]
cmp edx, 9
ja 0x414518
sub bl, 0x30
pop esi
mov al, bl
pop ebx
ret
cmp ebx, 0x6b
je 0x4145a1
cmp ebx, 0x6d
je 0x414697
cmp ebx, 0x6a
je 0x414666
cmp ebx, 0x6f
je 0x41470c
cmp ebx, 0x6e
je 0x4146ff
lea ecx, [ebx - 0x41]
cmp ecx, 0x19
ja 0x41457f
cmp byte [0x455388], 0x64
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
jne 0x414565
push 0x14
call esi
test ax, ax
je 0x41457a
push 0x14
call esi
test ax, ax
jle 0x414577
cmp byte [0x455388], 0x64
jne 0x41457a
add bl, 0x20
pop esi
mov al, bl
pop ebx
ret
cmp byte [0x455388], 0x64
jne 0x414683
cmp ebx, 0xbd
jne 0x414599
pop esi
mov al, 0x5f
pop ebx
ret
cmp ebx, 0xbb
jne 0x4145a6
pop esi
mov al, 0x2b
pop ebx
ret
cmp ebx, 0xdb
jne 0x4145b3
pop esi
mov al, 0x7b
pop ebx
ret
cmp ebx, 0xdd
jne 0x4145c0
pop esi
mov al, 0x7d
pop ebx
ret
cmp ebx, 0xba
jne 0x4145cd
pop esi
mov al, 0x3a
pop ebx
ret
cmp ebx, 0xde
jne 0x4145da
pop esi
mov al, 0x22
pop ebx
ret
cmp ebx, 0xdc
jne 0x4145e7
pop esi
mov al, 0x7c
pop ebx
ret
cmp ebx, 0xbc
jne 0x4145f4
pop esi
mov al, 0x3c
pop ebx
ret
cmp ebx, 0xbe
jne 0x414601
pop esi
mov al, 0x3e
pop ebx
ret
cmp ebx, 0xbf
jne 0x41460e
pop esi
mov al, 0x3f
pop ebx
ret
cmp ebx, 0xc0
jne 0x41461b
pop esi
mov al, 0x7e
pop ebx
ret
cmp ebx, 0x31
jne 0x414625
pop esi
mov al, 0x21
pop ebx
ret
cmp ebx, 0x32
jne 0x41462f
pop esi
mov al, 0x40
pop ebx
ret
cmp ebx, 0x33
jne 0x414639
pop esi
mov al, 0x23
pop ebx
ret
cmp ebx, 0x34
jne 0x414643
pop esi
mov al, 0x24
pop ebx
ret
cmp ebx, 0x35
jne 0x41464d
pop esi
mov al, 0x25
pop ebx
ret
cmp ebx, 0x36
jne 0x414657
pop esi
mov al, 0x5e
pop ebx
ret
cmp ebx, 0x37
jne 0x414661
pop esi
mov al, 0x26
pop ebx
ret
cmp ebx, 0x38
jne 0x41466b
pop esi
mov al, 0x2a
pop ebx
ret
cmp ebx, 0x39
jne 0x414675
pop esi
mov al, 0x28
pop ebx
ret
cmp ebx, 0x30
jne 0x41471b
pop esi
mov al, 0x29
pop ebx
ret
lea edx, [ebx - 0x30]
cmp edx, 9
jbe 0x41457a
cmp ebx, 0xbd
jne 0x41469c
pop esi
mov al, 0x2d
pop ebx
ret
cmp ebx, 0xbb
jne 0x4146a9
pop esi
mov al, 0x3d
pop ebx
ret
cmp ebx, 0xdb
jne 0x4146b6
pop esi
mov al, 0x5b
pop ebx
ret
cmp ebx, 0xdd
jne 0x4146c3
pop esi
mov al, 0x5d
pop ebx
ret
cmp ebx, 0xba
jne 0x4146d0
pop esi
mov al, 0x3b
pop ebx
ret
cmp ebx, 0xde
jne 0x4146dd
pop esi
mov al, 0x27
pop ebx
ret
cmp ebx, 0xdc
jne 0x4146ea
pop esi
mov al, 0x5c
pop ebx
ret
cmp ebx, 0xbc
jne 0x4146f7
pop esi
mov al, 0x2c
pop ebx
ret
cmp ebx, 0xbe
jne 0x414704
pop esi
mov al, 0x2e
pop ebx
ret
cmp ebx, 0xbf
jne 0x414711
pop esi
mov al, 0x2f
pop ebx
ret
cmp ebx, 0xc0
jne 0x41471b
mov al, 0x60
pop esi
pop ebx
ret
Function at 0x423820
Capabilities:
Create thread

Disassembly:
cmp dword [0x44d788], 0xffffff9d
je 0x4238ac
push esi
push edi
mov edi, 0x44967c
mov esi, 0x4527b0
mov ecx, 4
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
pop edi
pop esi
je 0x4238ac
mov ecx, 0x451d48
mov eax, 0x4527b0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x423870
test dl, dl
je 0x42386c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x423870
add eax, 2
add ecx, 2
test dl, dl
jne 0x423850
xor eax, eax
jmp 0x423875
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jle 0x4238ac
mov ecx, 0x4527b0
mov eax, 0x458350
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4238a3
test dl, dl
je 0x42389f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4238a3
add eax, 2
add ecx, 2
test dl, dl
jne 0x423883
xor eax, eax
jmp 0x4238a8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jg 0x4238b1
jmp 0x43c550
ret
push ecx
push esi
push 0x4554a4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x458424]
push 0x4554a4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
pop esi
jne 0x43c594
lea eax, [esp]
push eax
push 0
push 0
push 0x43c340
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x43c594
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ecx
ret
Function at 0x43bed0
Capabilities:
Print debug messages

Disassembly:
cmp dword [0x458430], 0
mov eax, dword [0x4554c0]
je 0x43beee
push 0x43b4d0
push eax
call fcn.00401bf0
add esp, 8
jmp 0x43bf0a
mov ecx, dword [0x44d790]
mov edx, dword [0x44d78c]
push ecx
push edx
push 0x43b4d0
push eax
call fcn.00401b00
add esp, 0x10
test eax, eax
mov dword [0x4546f4], eax
je 0x43bf39
mov ecx, dword [0x458430]
push ecx
push eax
push 0
push 0x457578
call fcn.00401000
add esp, 0x10
test eax, eax
jge 0x43bf3c
push str.DDStartup_failed._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
ret
cmp dword [0x458430], 0
je 0x43bf72
mov edx, dword [0x457578]
push 0x455608
push 0x455634
push edx
call fcn.00401300
add esp, 0xc
test eax, eax
jl 0x43bf39
mov dword [0x458348], 2
mov eax, 1
ret
mov eax, dword [0x4546f4]
mov ecx, dword [0x457578]
push eax
push 0x453e0c
push 0x457584
push 0x455608
push 0x455634
push ecx
call fcn.004011d0
add esp, 0x18
test eax, eax
jl 0x43bf39
xor edx, edx
cmp dword [0x453e0c], edx
mov eax, 1
sete dl
lea edx, [edx + edx + 1]
mov dword [0x458348], edx
ret
Function at 0x43c1c0
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
sub esp, 0x410
mov eax, dword [0x44eea4]
xor eax, esp
mov dword [esp + 0x40c], eax
mov eax, dword [esp + 0x41c]
push ebx
mov ebx, dword [esp + 0x41c]
push esi
mov esi, dword [esp + 0x41c]
push edi
push 0
push 0
push 0
push 1
push str.Sample
mov dword [esp + 0x20], eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
test edi, edi
je 0x43c317
test esi, esi
je 0x43c317
push ebp
mov ebp, dword [sym.imp.WININET.dll_InternetOpenUrlA]
push 0
push 0
push 0
push 0
push esi
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x43c24e
test ebx, ebx
je 0x43c313
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push esi
push esi
push esi
push ebx
push edi
call ebp
mov esi, eax
test esi, esi
je 0x43c313
mov ecx, dword [esp + 0x10]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, eax
mov dword [esp + 0x10], eax
je 0x43c2ea
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], eax
push 0x400
lea eax, [esp + 0x24]
push eax
push esi
call ebx
cmp eax, 1
jne 0x43c2e3
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, edi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x43c2e3
push 0
lea ecx, [esp + 0x1c]
push ecx
push eax
lea edx, [esp + 0x28]
push edx
push edi
mov dword [esp + 0x2c], 0
call ebp
test eax, eax
je 0x43c2cc
mov dword [esp + 0x10], 1
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x24]
push ecx
push esi
call ebx
cmp eax, 1
je 0x43c2a0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
cmp dword [esp + 0x10], eax
setne al
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.004451a2
add esp, 0x410
ret
xor eax, eax
jmp 0x43c2fa
mov ecx, dword [esp + 0x418]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004451a2
add esp, 0x410
ret
Function at 0x43e990
Capabilities:
Hide graphical window
Print debug messages

Disassembly:
call fcn.0043e960
test eax, eax
jge 0x43e9d4
mov dword [0x458434], 1
call fcn.00401ae0
call fcn.0043bed0
test eax, eax
jge 0x43e9bc
push str.Reinitialization_failed._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x4546f4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x458434], 0
ret

Function at 0x43e9e0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x20
mov eax, dword [0x455634]
lea edx, [esp]
mov dword [esp], 0x20
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x54]
call eax
mov ecx, dword [0x455608]
push 0
push ecx
call fcn.00401250
add esp, 8
test eax, eax
jge 0x43ea21
push str.UpdateFrame:_Couldnt_fill_back_buffer._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 0x20
ret
push str.LoadGameArt:_Art_loaded._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
add esp, 0x20
ret

Function at 0x43ef50
Capabilities:
Print debug messages

Disassembly:
sub esp, 0xd4
mov eax, dword [0x44eea4]
xor eax, esp
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0xdc]
lea edx, [esp + 8]
push esi
mov esi, ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x43ef84
mov edx, dword [esp + 0xdc]
push edi
lea eax, [esi + 8]
push eax
mov eax, dword [0x457578]
lea ecx, [esi + 4]
push ecx
push 0
push edx
push eax
xor eax, eax
xor ecx, ecx
lea edi, [esp + 0x24]
call fcn.0043ee10
add esp, 0x14
test eax, eax
mov dword [esi], eax
pop edi
jne 0x43efdf
push eax
lea ecx, [esp + 0x10]
push ecx
push str.Couldnt_create_art_surface.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Couldnt_create_art_surface._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x43f021
mov edx, dword [eax]
mov edx, dword [edx + 0x74]
lea ecx, [esp + 4]
push ecx
push 8
push eax
call edx
test eax, eax
jge 0x43f021
push 0
push str.Error
push str.Couldnt_set_the_color_key.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Couldnt_set_the_color_key._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esi], 0
mov ecx, dword [esp + 0xd4]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004451a2
add esp, 0xd4
ret 8
Function at 0x4451a2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44eea4]
jne 0x4451ac
repz ret
jmp fcn.0044565a
Function at 0x10006f2f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x100250e4]
test eax, eax
je 0x10006f6e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10006f6e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10006f6e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10006f6e
cmp dword [ecx + 0x74], 0xe
jbe 0x10006f6e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10008e60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10008e8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10008e8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10c6a70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x568015
lea edi, [esi - 0x167015]
lea eax, [edi + 0x196420]
push dword [eax]
mov dword [eax], 0xb297404
push eax
push edi
or ebp, 0xffffffff
jmp 0x10c6aa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10c6aa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10c6a98
mov eax, 1
add ebx, ebx
jne 0x10c6abb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10c6acc
jne 0x10c6aeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10c6aeb
dec eax
add ebx, ebx
jne 0x10c6ad8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10c6ab0
add ebx, ebx
jne 0x10c6ae7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10c6b3d
xor ecx, ecx
sub eax, 3
jb 0x10c6b03
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10c6b72
sar eax, 1
mov ebp, eax
jmp 0x10c6b0e
add ebx, ebx
jne 0x10c6b0e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10c6adc
inc ecx
add ebx, ebx
jne 0x10c6b1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10c6adc
add ebx, ebx
jne 0x10c6b29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10c6b1e
jne 0x10c6b3a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10c6b1e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10c6b5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10c6b4e
jmp 0x10c6a9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10c6b5c
add edi, ecx
jmp 0x10c6a9e
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x8c66
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10c6b7e
cmp byte [edi], 0x2f
jne 0x10c6b7e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10c6b83
lea edi, [esi + 0xbab000]
mov eax, dword [edi]
or eax, eax
je 0x10c6bf2
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xcc8184]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xcc828c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10c6bb0
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xcc8294]
or eax, eax
je 0x10c6bec
mov dword [ebx], eax
add ebx, 4
jmp 0x10c6bcd
call dword [esi + 0xcc8290]
mov ebp, dword [esi + 0xcc8298]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0xcc6c4d]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10c6c3e
sub esp, 0xffffff80
jmp 0x402e30
Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4893bfc
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x24a63068
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x402f70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
inc edi
imul esi
neg ebx
and edx, 0xd2
sub edx, 0x1d
inc eax
bswap edi
inc edx
and esi, 0x76
imul eax
add edx, 0xaa
rcl esi, 0xc1
rol edi, 0xc7
imul esi
rcl eax, 0x90
or edi, 0x84
or eax, 0x9d
ror edi, 0xa3
not esi
imul esi
add eax, 0xf7
not ebx
bswap esi
not esi
not eax
rol edx, 0xaa
dec esi
neg edi
rol edx, 0x9a
or esi, 0x33
neg edx
sub edx, 0xd9
or edi, 0x99
bswap esi
bswap edx
mov eax, 0x66
neg esi
and edx, 0xfd
rol eax, 0xbd
rcr eax, 0x9b
inc edx
and edx, 0xe0
imul esi
rcr ebx, 0xf6
inc edi
bswap ebx
dec edi
imul eax
sbb eax, 0x79
or edx, 0xeb
xor ecx, ecx
xor edi, edi
neg esi
neg edi
sbb esi, 0x14
dec edx
rcl edx, 0xf3
not edx
neg edx
or esi, 0x7d
bswap eax
neg esi
mov eax, 0x60
dec edx
add edi, 0x1c
inc edi
bswap eax
or esi, 0xa7
neg esi
neg edx
mov eax, 0x73
add edx, 0xab
not esi
rcr edx, 0xaa
bswap esi
neg edx
imul ebx
dec ebx
or eax, 0x73
or edx, 0xf
sbb edi, 0x5f
not ebx
rcr eax, 0x49
neg eax
neg esi
rcr ebx, 0x6c
dec eax
dec edi
rcl ebx, 0xec
neg edx
or ebx, 0x5d
sub esi, 7
rcr ebx, 0xe3
add ebx, 0xba
and esi, 0x3e
neg eax
rcl edx, 0x7a
add esi, 0x97
bswap edx
inc ebx
or ebx, 0x6b
neg ebx
mov ecx, dword [ebp + 0xc]
sub ebx, 0xce
neg ebx
neg edx
add esi, 0x73
ror esi, 0x9e
imul esi
add ebx, 0xab
rol eax, 0xca
sbb edx, 0xf0
imul ebx
or eax, 0xf6
not ebx
not ebx
or esi, 0xce
ror ebx, 0xad
sub edi, 0x78
inc edi
and eax, 0xeb
dec eax
not edi
rol ebx, 0
and edi, 0xb6
inc edi
or ebx, 0x97
dec esi
imul eax
sbb eax, 0xe0
sbb ebx, 0xf5
neg esi
and eax, 0x29
neg eax
ror edx, 6
neg ebx
not ebx
or edx, 0xbb
rcl edx, 0x8a
or eax, 0x8a
sub edx, 0x44
imul edi
add edi, 0xd
and edx, 0xad
and eax, 0x90
or ebx, 0xd6
add edi, 0x75
sub esi, 0x48
sub ebx, 0x70
dec edi
rcl eax, 0xe
rcr ebx, 0x4c
or esi, 0xbc
mov edi, dword [ebp + 8]
mov eax, ebx
xor esi, eax
mov esi, esi
xor esi, esi
mov esi, esi
xor esi, eax
mov ebx, ebx
xor esi, ebx
xor ebx, eax
mov esi, ebx
mov eax, esi
mov eax, eax
not byte [edi]
mov esi, eax
mov eax, esi
mov esi, ebx
xor eax, ebx
xor eax, esi
xor ebx, esi
mov ebx, esi
xor ebx, ebx
xor ebx, eax
sub byte [edi], 0x36
xor esi, ebx
mov esi, esi
mov eax, esi
mov esi, esi
mov eax, ebx
mov esi, ebx
xor ebx, ebx
xor eax, esi
xor esi, eax
add byte [edi], 0x87
mov eax, ebx
xor eax, esi
mov eax, eax
mov eax, ebx
mov ebx, esi
xor esi, eax
mov eax, eax
xor eax, eax
xor esi, eax
imul byte [edi]
inc edi
loop 0x40314d
pop esi
pop edi
pop ebx
pop ebp
ret