joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ff0a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x30]
sub eax, dword [ebx + 0x2c]
cmp eax, dword [esp]
jge 0x5ff0d3
mov ecx, 0xf0
mov edx, 0x5ff210
mov eax, 0x5ff2e8
call fcn.0040a208
mov eax, dword [esp + 4]
cmp eax, dword [esp]
je 0x5ff0fa
mov eax, dword [esp]
dec eax
cmp eax, dword [esp + 4]
je 0x5ff0fa
mov ecx, 0xf2
mov edx, 0x5ff210
mov eax, 0x5ff374
call fcn.0040a208
mov eax, dword [ebx + 0x2c]
mov edx, dword [esp]
cmp edx, dword [esp + 4]
jle 0x5ff107
inc eax
mov edx, dword [ebx + 0x1c]
mov dword [esp + 8], edx
mov ecx, dword [ebx + 0x20]
mov edx, dword [ebx + 0x24]
mov esi, dword [esp + 4]
dec esi
test esi, esi
jl 0x5ff147
inc esi
shl edx, 5
movzx edi, byte [eax + 2]
xor edx, edi
and edx, 0x3fff
mov edi, dword [ebx + 0x6c]
and edi, eax
mov ebp, dword [esp + 8]
lea ebp, [ebp + edi*4]
mov edi, dword [ecx + edx*4]
mov dword [ebp], edi
mov dword [ecx + edx*4], eax
inc eax
dec esi
jne 0x5ff11e
mov esi, dword [esp + 8]
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x2c], eax
cmp byte [ebx + 4], 0
je 0x5ff184
mov eax, dword [esp]
add dword [ebx + 0x4c], eax
mov eax, dword [esp]
cdq
add dword [ebx + 0x50], eax
adc dword [ebx + 0x54], edx
cmp byte [ebx + 0x38], 0
je 0x5ff1a6
mov eax, dword [ebx + 0x4c]
cmp eax, dword [ebx + 0x48]
jb 0x5ff1a6
mov eax, ebx
call fcn.005ff748
jmp 0x5ff1a6
mov edx, eax
sub edx, dword [ebx + 0x4c]
cmp edx, dword [ebx + 0x70]
jl 0x5ff1a6
mov byte [ebx + 4], 1
mov ecx, eax
sub ecx, dword [ebx + 0x70]
sub ecx, dword [ebx + 0x4c]
add dword [ebx + 0x4c], ecx
mov eax, ecx
cdq
add dword [ebx + 0x50], eax
adc dword [ebx + 0x54], edx
cmp word [ebx + 0x42], 0
je 0x5ff1ea
mov eax, dword [esp]
cdq
add dword [ebx + 0x10], eax
adc dword [ebx + 0x14], edx
mov eax, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
and eax, 0xfff
xor edx, edx
cmp edx, 0
jne 0x5ff1ea
cmp eax, 0
jne 0x5ff1ea
fild qword [ebx + 0x10]
fmul dword [0x5ff3e8]
fild qword [ebx + 0x60]
fdivp st(1)
call fcn.00407864
mov edx, eax
mov eax, dword [ebx + 0x44]
call dword [ebx + 0x40]
mov eax, dword [ebx + 0x4c]
cmp eax, dword [ebx + 0x48]
jb 0x5ff1f9
mov eax, ebx
call fcn.005ff748
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x60573c
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
test esi, esi
jne 0x605764
mov ecx, 0xf8
mov edx, 0x6057f4
mov eax, 0x6058cc
call fcn.0040a208
mov edx, esi
mov eax, ebx
call fcn.00605934
mov dword [ebp - 8], 0xc
mov edi, dword [ebp - 4]
lea esi, [ebp - 0x14]
mov eax, dword [ebx + 0x10]
and eax, 0xffff
or eax, 2
mov edx, 1
xor edx, eax
imul edx, eax
shr edx, 8
xor dl, byte [edi]
mov byte [esi], dl
mov edx, dword [ebx + 8]
movzx eax, byte [esi]
call fcn.005de2ac
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.005de2ac
mov dword [ebx + 0x10], eax
inc esi
inc edi
dec dword [ebp - 8]
jne 0x60577a
movzx eax, byte [ebp + 0xb]
cmp al, byte [ebp - 9]
sete al
mov byte [ebx + 4], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x605934
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6059e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
call fcn.00430d64
lea ecx, [ebp - 4]
mov edx, esi
call fcn.00431838
mov eax, dword [ebp - 4]
test eax, eax
je 0x60597e
sub eax, 4
mov eax, dword [eax]
mov esi, eax
dec esi
test esi, esi
jl 0x6059c5
inc esi
xor edi, edi
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edi]
mov edx, dword [ebx + 8]
call fcn.005de2ac
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.005de2ac
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x605988
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6059e8
lea eax, [ebp - 4]
mov edx, dword [0x404afc]
call fcn.0040c7a0
ret
Function at 0x631892
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
jmp 0x63194a
mov eax, dword [ebp + 8]
add dword [ebp + 8], 4
mov eax, dword [eax]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
shr ecx, 9
add eax, ecx
cmp eax, 0x100
jae 0x6318e2
movsx edx, byte [eax + 0x66f090]
mov ecx, 9
sub ecx, edx
shl eax, cl
and eax, 0xff
movzx eax, byte [eax + 0x66f190]
shl edx, 8
add eax, edx
add ebx, eax
jmp 0x63194a
cmp eax, 0x10000
jae 0x6318fa
mov edx, eax
shr edx, 8
movsx edx, byte [edx + 0x66f090]
add edx, 8
jmp 0x631921
cmp eax, 0x1000000
jae 0x631912
mov ecx, eax
shr ecx, 0x10
movsx edx, byte [ecx + 0x66f090]
add edx, 0x10
jmp 0x631921
mov ecx, eax
shr ecx, 0x18
movsx edx, byte [ecx + 0x66f090]
add edx, 0x18
lea ecx, [edx - 9]
shr eax, cl
and eax, 0xff
movzx eax, byte [eax + 0x66f190]
mov ecx, edx
shl ecx, 8
add eax, ecx
mov edx, eax
add ebx, eax
test esi, esi
je 0x63194a
cmp esi, edx
jg 0x63194a
or eax, 0xffffffff
jmp 0x63195b
mov edx, dword [ebp + 0xc]
add dword [ebp + 0xc], 0xffffffff
test edx, edx
jne 0x6318a1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x653884
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6538f3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040af1c
mov eax, dword [ebp - 0x210]
mov edx, ebx
call fcn.00653fe4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6538fa
lea eax, [ebp - 0x210]
call fcn.0040a3bc
ret

Function at 0x653900
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x653989
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20a]
push eax
push 0
push 0
push esi
push 0
call sub.shell32.dll_SHGetFolderPathW
test eax, eax
jne 0x653961
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040af1c
mov eax, dword [ebp - 0x210]
mov edx, ebx
call fcn.0042c758
jmp 0x653970
mov eax, ebx
mov edx, dword [0x670468]
mov edx, dword [edx]
call fcn.0040a79c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x653990
lea eax, [ebp - 0x210]
call fcn.0040a3bc
ret
Function at 0x6539b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x653b2a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [esi], eax
mov eax, edi
mov edx, dword [0x670468]
mov edx, dword [edx]
call fcn.0040a79c
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.0040ae60
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x653b0f
mov eax, dword [ebp - 0xc]
call fcn.00406eec
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x653b08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, ebx
call fcn.0040ae60
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x653aef
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x653b38
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x653aef
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp - 8]
and eax, dword [edx + 0x18]
mov dword [esi], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.00424a0c
push dword [ebp - 0x14]
push 0x653b48
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.00424a0c
push dword [ebp - 0x18]
push 0x653b48
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00424a0c
push dword [ebp - 0x1c]
push 0x653b48
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00424a0c
push dword [ebp - 0x20]
mov eax, edi
mov edx, 7
call fcn.0040b154
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x653b0f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00406f08
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x653b31
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.0040a41c
ret
Function at 0x6560a8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x656264
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x656234
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, 0x20119
mov dl, 1
mov eax, dword [0x4ef46c]
call fcn.004f05fc
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x656223
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000000
mov eax, dword [ebp - 0xc]
call fcn.004f06a0
mov edx, 0x656280
mov eax, dword [ebp - 0xc]
call fcn.004f092c
test al, al
je 0x656153
xor eax, eax
push ebp
push 0x65614c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 8]
mov edx, dword [0x670468]
mov edx, dword [edx]
mov eax, dword [ebp - 0xc]
call fcn.004f11b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x656153
mov eax, dword [ebp - 0xc]
call fcn.004f0670
ret
mov eax, dword [ebp - 8]
mov eax, dword [eax]
test eax, eax
je 0x656161
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x65620d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp word [eax], 0x22
jne 0x6561bd
mov eax, dword [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.0040b284
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, 1
mov eax, 0x656304
call fcn.0040b44c
mov ebx, eax
test ebx, ebx
je 0x6561bd
mov eax, dword [ebp - 8]
mov eax, dword [eax]
test eax, eax
je 0x6561ae
sub eax, 4
mov eax, dword [eax]
mov ecx, eax
sub ecx, ebx
inc ecx
mov eax, dword [ebp - 8]
mov edx, ebx
call fcn.0040b284
push 0
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040ae60
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040aff4
push ebx
mov eax, dword [ebp - 4]
call fcn.0040ae60
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040ae60
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x65620d
mov eax, dword [ebp - 4]
call fcn.0040ae60
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0040aec8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65622a
mov eax, dword [ebp - 0xc]
call fcn.00408594
ret

Function at 0x656308
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6563ac
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10c]
call fcn.006560a8
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.00653998
mov eax, dword [ebp - 0x108]
call fcn.00653c30
mov dword [ebp - 4], pe_nt_image_headers32
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0x104]
push edx
push eax
call sub.URLMON.DLL_ObtainUserAgentString
test eax, eax
jne 0x656382
mov eax, ebx
lea edx, [ebp - 0x104]
call fcn.0040ae98
jmp 0x65638e
mov eax, ebx
mov edx, 0x6563c4
call fcn.0040a79c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6563b3
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.0040a41c
ret
Function at 0x657430
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x657555
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67057c]
cmp byte [eax + 0x230b], 2
je 0x65753a
mov eax, dword [0x679640]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x65750b
inc esi
xor ebx, ebx
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, dword [0x679640]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 4]
mov cl, 1
xor edx, edx
call fcn.004258e0
mov eax, dword [0x67057c]
movzx eax, byte [eax + 0x230b]
sub al, 1
jb 0x6574a4
je 0x6574e2
jmp 0x657503
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [0x679640]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 8]
call fcn.00425aec
test al, al
jne 0x657503
push 4
push 0
lea ecx, [ebp - 0xc]
mov edx, ebx
mov eax, dword [0x679640]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.0040ae60
push eax
call sub.kernel32.dll_MoveFileExW
jmp 0x657503
push 4
push 0
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, dword [0x679640]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0040ae60
push eax
call sub.kernel32.dll_MoveFileExW
inc ebx
dec esi
jne 0x657475
mov eax, dword [0x679644]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x65753a
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, dword [0x679644]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.006573ac
dec ebx
cmp ebx, 0xffffffff
jne 0x65751d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65755c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040a41c
ret
Function at 0x657564
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
push ebp
push 0x65767a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x66fc58]
mov edx, dword [0x670468]
mov edx, dword [edx]
call fcn.0040b204
je 0x657664
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407dac
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x440
mov eax, 0x657688
mov dword [ebp - 0x30], eax
mov eax, dword [0x66fc58]
call fcn.0040ae60
mov dword [ebp - 0x2c], eax
mov eax, dword [0x67057c]
add eax, 0x130a
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x40]
mov eax, dword [0x66fc58]
call fcn.00425d10
mov eax, dword [ebp - 0x40]
call fcn.0040ae60
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x657653
mov eax, dword [ebp - 4]
test eax, eax
je 0x657664
xor edx, edx
push ebp
push 0x65764c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [0x67057c]
movzx eax, byte [eax + 0x230b]
mov edx, dword [0x67057c]
mov byte [edx + 0x230b], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x657664
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
ret
call sub.kernel32.dll_GetLastError
mov edx, eax
mov eax, dword [0x66fc58]
call fcn.00657060
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x657681
lea eax, [ebp - 0x40]
call fcn.0040a3bc
ret

Function at 0x659468
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov byte [ebp - 5], 0
xor eax, eax
mov dword [edi], eax
xor eax, eax
mov dword [esi], eax
push ebx
mov eax, dword [ebp - 4]
call fcn.0040ae60
push eax
push 0
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
je 0x6594d0
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6594d0
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov dword [esi], eax
cmp dword [esi], 0
je 0x6594d0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LockResource
mov dword [edi], eax
cmp dword [edi], 0
setne byte [ebp - 5]
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401630
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edx, eax
movzx ecx, al
shr edx, 0x18
movzx ecx, byte [ecx*4 + str.ccccwwww]
movzx edx, byte [edx*4 + str.ccccwwww]
mov edx, dword [edx*4 + 0x424cc0]
xor edx, dword [ecx*4 + 0x4220c0]
mov ecx, eax
shr ecx, 0x10
movzx eax, ah
movzx ecx, cl
movzx eax, byte [eax*4 + str.ccccwwww]
movzx ecx, byte [ecx*4 + str.ccccwwww]
xor edx, dword [ecx*4 + 0x4228c0]
xor edx, dword [eax*4 + 0x4224c0]
mov eax, edx
ret
Function at 0x402080
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
mov eax, 0x118c
push esi
push ebx
call fcn.00409940
sub esp, eax
lea eax, [esp + 0xe0]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x10
mov ebx, dword [esp + 0x11a4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x11a0]
mov dword [esp], eax
call fcn.00401690
test eax, eax
mov edx, 0xffffffff
jne 0x402128
mov dword [esp + 0x4c], 0x10
movzx edx, byte [ebx + eax]
mov byte [esp + eax + 0x50], dl
add eax, 1
cmp eax, 0x10
jne 0x4020d2
mov edx, dword [esp + 0x11ac]
test edx, edx
je 0x402117
cmp dword [esp + 0x11ac], 0x10
cmovbe eax, dword [esp + 0x11ac]
test al, 0xf
mov dword [esp + 0x18], eax
je 0x402135
add esp, 0x118c
mov edx, 0xffffffff
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0xe0]
mov dword [esp], eax
call fcn.00402030
xor edx, edx
add esp, 0x118c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [esp + 0x38]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x11a8]
lea edi, [esp + 0x28]
mov dword [esp + 0x1c], eax
lea esi, [esi]
lea eax, [esp + 0xe0]
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.00401d30
test eax, eax
jne 0x402105
mov ecx, dword [esp + 0x4c]
test ecx, ecx
jle 0x40219b
lea edx, [esp + 0x50]
lea ebp, [edx + eax]
movzx edx, byte [ebx + eax]
xor dl, byte [ebp]
mov byte [esp + 0x17], dl
movzx edx, byte [esi + eax]
mov byte [ebp], dl
movzx edx, byte [esp + 0x17]
mov byte [edi + eax], dl
add eax, 1
cmp eax, ecx
jne 0x402173
add esi, ecx
add edi, ecx
sub dword [esp + 0x1c], ecx
jne 0x402150
mov edi, dword [esp + 0x18]
cmp edi, 4
jae 0x402220
test edi, edi
je 0x4021ca
movzx eax, byte [esp + 0x28]
mov esi, dword [esp + 0x11a8]
mov byte [esi], al
mov eax, edi
test al, 2
jne 0x40227a
mov eax, dword [esp + 0x18]
add dword [esp + 0x11a8], eax
sub dword [esp + 0x11ac], eax
je 0x402117
lea eax, [ecx - 1]
cmp eax, 0xf
ja 0x402105
cmp dword [esp + 0x11ac], 0x10
mov eax, 0x10
cmovbe eax, dword [esp + 0x11ac]
xor edx, edx
mov dword [esp + 0x18], eax
div ecx
test edx, edx
jne 0x402105
jmp 0x402139
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x11a8]
mov dword [edi], eax
mov esi, dword [esp + 0x18]
lea edi, [esp + 0x28]
mov edx, dword [esp + 0x11a8]
mov eax, dword [esp + esi + 0x24]
mov dword [edx + esi - 4], eax
mov eax, dword [esp + 0x11a8]
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
sub edi, eax
add eax, esi
and eax, 0xfffffffc
cmp eax, 4
jb 0x4021ca
and eax, 0xfffffffc
xor esi, esi
mov ebp, dword [edi + esi]
mov dword [edx + esi], ebp
add esi, 4
cmp esi, eax
jb 0x402268
jmp 0x4021ca
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x11a8]
movzx eax, word [esp + edi + 0x26]
mov word [esi + edi - 2], ax
jmp 0x4021ca
Function at 0x4077c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov edi, eax
push ebx
xor eax, eax
sub esp, 0x90
lea esi, [esp + 0x50]
lea ebx, [esp + 0x10]
mov dword [esp + 0x50], 0x36363636
mov dword [esp + 0x54], 0x36363636
mov dword [esp + 0x58], 0x36363636
mov dword [esp + 0x5c], 0x36363636
mov dword [esp + 0x60], 0x36363636
mov dword [esp + 0x64], 0x36363636
mov dword [esp + 0x68], 0x36363636
mov dword [esp + 0x6c], 0x36363636
mov dword [esp + 0x70], 0x36363636
mov dword [esp + 0x74], 0x36363636
mov dword [esp + 0x78], 0x36363636
mov dword [esp + 0x7c], 0x36363636
mov dword [esp + 0x80], 0x36363636
mov dword [esp + 0x84], 0x36363636
mov dword [esp + 0x88], 0x36363636
mov dword [esp + 0x8c], 0x36363636
mov dword [esp + 0x10], 0x5c5c5c5c
mov dword [esp + 0x14], 0x5c5c5c5c
mov dword [esp + 0x18], 0x5c5c5c5c
mov dword [esp + 0x1c], 0x5c5c5c5c
mov dword [esp + 0x20], 0x5c5c5c5c
mov dword [esp + 0x24], 0x5c5c5c5c
mov dword [esp + 0x28], 0x5c5c5c5c
mov dword [esp + 0x2c], 0x5c5c5c5c
mov dword [esp + 0x30], 0x5c5c5c5c
mov dword [esp + 0x34], 0x5c5c5c5c
mov dword [esp + 0x38], 0x5c5c5c5c
mov dword [esp + 0x3c], 0x5c5c5c5c
mov dword [esp + 0x40], 0x5c5c5c5c
mov dword [esp + 0x44], 0x5c5c5c5c
mov dword [esp + 0x48], 0x5c5c5c5c
mov dword [esp + 0x4c], 0x5c5c5c5c
movzx ecx, byte [edx + eax]
xor byte [esi + eax], cl
xor byte [ebx + eax], cl
add eax, 1
cmp eax, 0x20
jne 0x4078e1
mov dword [edi + 0x28], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0x6a09e667
mov dword [edi + 0xc], 0xbb67ae85
mov dword [edi + 0x10], 0x3c6ef372
mov dword [edi + 0x14], 0xa54ff53a
mov dword [edi + 0x18], 0x510e527f
mov dword [edi + 0x1c], 0x9b05688c
mov dword [edi + 0x20], 0x1f83d9ab
mov dword [edi + 0x24], 0x5be0cd19
mov dword [esp + 4], esi
mov dword [esp], edi
mov dword [esp + 8], 0x40
add edi, 0x1a0
call fcn.004076b0
mov dword [edi + 0x28], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0x6a09e667
mov dword [edi + 0xc], 0xbb67ae85
mov dword [edi + 0x10], 0x3c6ef372
mov dword [edi + 0x14], 0xa54ff53a
mov dword [edi + 0x18], 0x510e527f
mov dword [edi + 0x1c], 0x9b05688c
mov dword [edi + 0x20], 0x1f83d9ab
mov dword [edi + 0x24], 0x5be0cd19
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 8], 0x40
call fcn.004076b0
add esp, 0x90
pop ebx
pop esi
pop edi
ret