joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414750
Capabilities:
Terminate process

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0x1074]
test eax, eax
je 0x414808
mov eax, dword [ebx + 0x1078]
mov dword [ebx + 0x1074], 0
test eax, eax
je 0x414808
mov eax, dword [eax + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x1c], 0
mov dword [esp], eax
call esi
sub esp, 4
mov dword [esp], 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebx + 0x1078]
sub esp, 4
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x1078]
sub esp, 4
mov eax, dword [eax + 0x14]
mov dword [esp], eax
call esi
sub esp, 4
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x1078]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
cmp dword [esp + 0x1c], 0x103
je 0x414810
mov eax, dword [ebx + 0x1078]
mov dword [esp], eax
call fcn.004cd6d0
mov dword [ebx + 0x1078], 0
add esp, 0x24
pop ebx
pop esi
ret
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x1078]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
sub esp, 8
jmp 0x4147f0
Function at 0x414830
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x44c
mov ebx, dword [edx + 0x1074]
mov dword [esp + 0x34], 0
test ebx, ebx
je 0x414966
mov dword [esp + 0x2c], eax
mov eax, dword [edx + 0x1078]
test ecx, ecx
lea ebp, [esp + 0x38]
lea edi, [esp + 0x40]
mov dword [esp + 0x28], ecx
mov ebx, edx
mov dword [esp + 0x38], 0
mov esi, dword [eax + 0x14]
cmovne esi, dword [eax + 0x10]
lea eax, [esp + 0x3c]
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], eax
mov eax, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov dword [esp + 8], 1
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x24], eax
call eax
sub esp, 0x18
mov eax, dword [esp + 0x38]
test eax, eax
je 0x414940
lea eax, [esp + 0x3c]
mov dword [esp + 0x38], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 1
mov dword [esp + 0x10], eax
mov dword [esp + 4], edi
mov dword [esp], esi
mov eax, dword [esp + 0x24]
call eax
sub esp, 0x18
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x414966
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x400
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x414922
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x414973
mov dword [esp], ebx
call fcn.00414750
add esp, 0x44c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x1078]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
cmp dword [esp + 0x34], 0x103
jne 0x414922
add esp, 0x44c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x28]
test edx, edx
je 0x414994
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ecx
call dword [edx + 0xc]
jmp 0x4148b6
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov eax, dword [ebx + 0x1060]
mov dword [esp], eax
call fcn.00429cd0
jmp 0x4148b6
Function at 0x418820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
mov ebp, edx
push esi
push ebx
mov edi, eax
sub esp, 0x5c
mov ebx, dword [esp + 0x78]
mov esi, dword [esp + 0x80]
cmp word [ebx], 0xdffe
je 0x418900
mov eax, dword [eax + 0x1064]
movzx ecx, word [edx]
mov dword [esp + 0x38], eax
mov edx, dword [eax]
mov eax, dword [esp + 0x84]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x88]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x20], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
call dword [eax + 4]
test esi, 0x60000000
je 0x4188f0
mov eax, dword [edi + 0x1064]
mov edi, dword [esp + 0x84]
movzx edx, word [ebp]
mov ebp, dword [esp + 0x88]
mov ecx, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], ebx
mov esi, dword [esp + 0x7c]
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x70]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], edx
mov dword [esp], eax
mov dword [esp + 0x10], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
call dword [ecx + 8]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [ecx], 0
je 0x4189e2
cmp dword [esp + 0x7c], 1
jne 0x4189a0
and esi, 0x400000
je 0x4189c1
mov eax, dword [edi + 0x1064]
movzx ecx, word [ebp]
mov ebx, dword [edi + 0x60]
mov esi, dword [edi + 0x64]
mov ebp, dword [edi + 0x5c]
mov dword [esp + 0x4c], 0x200020
mov edx, dword [eax]
mov dword [esp], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], esi
mov ebx, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 2
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp + 0xc], ecx
call dword [edx + 4]
mov eax, dword [edi + 0x1064]
mov esi, dword [esp + 0x74]
mov ebx, dword [esp + 0x70]
mov edx, dword [eax]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [edx + 0xc]
jmp 0x4188f0
mov dword [esp + 8], 0x1802
mov dword [esp + 4], str._MoTTY_terminal_terminal.c
mov dword [esp], str.ccount__1
call fcn.004d8b40
jmp 0x418914
mov dword [esp + 8], 0x1803
mov dword [esp + 4], str._MoTTY_terminal_terminal.c
mov dword [esp], str.attr__ATTR_WIDE
call fcn.004d8b40
jmp 0x418920
mov dword [esp + 8], 0x1801
mov dword [esp + 4], str._MoTTY_terminal_terminal.c
mov dword [esp], str.ldata__trusted
call fcn.004d8b40
jmp 0x418909
Function at 0x424a70
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ecx, dword [esp + 0x48]
mov esi, dword [esp + 0x4c]
mov ebx, dword [ebp + 0x128]
mov dword [esp + 0x18], ebp
mov dword [esp], eax
mov dword [esp + 0x1c], edi
xor eax, eax
mov edi, edx
test edx, edx
mov edx, dword [ebp + 0x12c]
cmovs edi, eax
test ecx, ecx
mov dword [esp + 0xc], ebx
cmovs ecx, eax
lea eax, [edx - 1]
cmp edx, esi
cmovle esi, eax
cmp ebx, dword [esp]
lea eax, [ebx - 1]
cmovg eax, dword [esp]
cmp eax, ecx
mov dword [esp], eax
jl 0x424b53
cmp ebx, ecx
jle 0x424b53
mov eax, dword [ebp + 0x18]
mov ebx, esi
shr ebx, 0x1f
add ebx, esi
mov dword [esp + 8], eax
mov eax, edi
sar ebx, 1
sar eax, 1
add ebx, 1
mov dword [esp + 4], eax
lea eax, [eax + eax*4]
lea eax, [eax*4 + 4]
mov dword [esp + 0x10], eax
lea eax, [edi + edi*4]
lea eax, [eax*4 + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
mov eax, dword [eax + ecx*4]
test byte [eax], 3
jne 0x424b70
cmp esi, edi
jl 0x424b45
cmp edx, edi
jle 0x424b45
mov ebp, dword [esp + 0x14]
add ebp, dword [eax + 0x14]
mov eax, edi
jmp 0x424b37
add ebp, 0x14
cmp edx, eax
je 0x424b45
add eax, 1
or dword [ebp], 0x3ffff
cmp esi, eax
jge 0x424b30
add ecx, 1
cmp dword [esp], ecx
jl 0x424b53
cmp dword [esp + 0xc], ecx
jne 0x424b10
cmp byte [esp + 0x1c], 0
mov eax, dword [esp + 0x18]
jne 0x424bc0
cmp byte [eax + 0x1081], 0
je 0x424bb0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esp + 4]
cmp ebp, ebx
jg 0x424b45
cmp edx, ebp
jle 0x424b45
mov ebp, dword [esp + 0x10]
add ebp, dword [eax + 0x14]
mov eax, dword [esp + 4]
jmp 0x424b97
add ebp, 0x14
cmp edx, eax
je 0x424b45
add eax, 1
or dword [ebp], 0x3ffff
cmp eax, ebx
jle 0x424b90
jmp 0x424b45
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0041b840
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00418a30
Function at 0x425040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x78]
mov edi, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x3c], eax
mov eax, edi
call fcn.00416520
mov edx, dword [edi + 8]
mov dword [esp + 0x34], eax
mov eax, edi
call fcn.004186d0
mov ebp, eax
mov esi, eax
lea eax, [ebx + ebx + 4]
neg esi
mov edx, 0x24
cmp eax, 0x24
mov dword [esp + 0x24], esi
cmovl eax, edx
sub ebx, ebp
imul eax, dword [edi + 0x12c]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
cmp esi, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], ebx
jg 0x4250b8
cmp dword [esp + 0x34], esi
jg 0x425144
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], 0
mov edi, dword [esp + 0x38]
mov byte [eax], 0
test edi, edi
je 0x425130
mov eax, dword [esp + 0x20]
mov dword [esp], str._5i____s
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
call fcn.004cc080
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x44], 0x168
mov dword [esp + 0x4c], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x4a
mov dword [esp], edi
add eax, 9
mov dword [esp + 0x48], eax
lea eax, [esp + 0x44]
mov dword [esp + 0xc], eax
call dword [sym.imp.USER32.dll_SendMessageA]
sub esp, 0x10
mov dword [esp], ebx
call fcn.004cd6d0
mov eax, dword [esp + 0x20]
mov dword [esp + 0x70], eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004d96e8
mov ebx, esi
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], 0
mov ecx, 0x1bd8
mov edx, ebp
call fcn.00416fc0
test eax, eax
je 0x4251a6
mov esi, dword [eax + 8]
test esi, esi
mov dword [esp + 0x30], esi
jle 0x4251a0
mov edx, dword [esp + 0x20]
add edx, dword [esp + 0x1c]
xor ecx, ecx
lea edi, [edx + esi]
mov esi, eax
mov eax, dword [esi + 0x14]
add edx, 1
mov eax, dword [eax + ecx]
add ecx, 0x14
mov byte [edx - 1], al
cmp edi, edx
jne 0x425183
mov ecx, dword [esp + 0x30]
add dword [esp + 0x1c], ecx
mov eax, esi
cmp byte [eax + 0xc], 0
jne 0x4251d1
add ebx, 1
sub ebp, 1
cmp dword [esp + 0x24], ebx
setle dl
cmp dword [esp + 0x28], ebx
setge al
test dl, al
je 0x4251c4
cmp dword [esp + 0x34], ebx
jg 0x42514e
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x1c]
jmp 0x4250c4
call fcn.00418a10
jmp 0x4251a6

Function at 0x427510
Capabilities:
Encode data using base64
Parse credit card information
Parse pe header

Disassembly:
push ebx
sub esp, 8
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp dword [ebx + 0x113c], 1
jle 0x42752d
cmp dword [ebx + 0x1134], eax
je 0x427532
add esp, 8
pop ebx
ret
cmp byte [0x521290], 0
mov dword [ebx + 0xe28], 0
mov dword [ebx + 0xe3c], 0
mov dword [ebx + 0xe40], 0
mov dword [ebx + 0xe34], 0
mov dword [ebx + 0xe38], 0
je 0x427580
add esp, 8
mov eax, ebx
xor edx, edx
pop ebx
jmp fcn.00420b30
mov eax, ebx
call fcn.0041c790
cmp dword [ebx + 0xe28], 2
je 0x42752d
jmp 0x42756d
Function at 0x42dc70
Capabilities:
Hide graphical window

Disassembly:
push ebx
sub esp, 0x28
mov eax, dword [0x522644]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x42ab50
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
sub esp, 0x14
mov ebx, eax
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 8
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
sub esp, 4
add esp, 0x28
pop ebx
ret

Function at 0x42e130
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x2c
mov eax, dword [0x5212b4]
test eax, eax
je 0x42e150
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
sub esp, 4
add esp, 0x2c
ret
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x42b290
mov dword [esp + 4], 0x6e
mov dword [esp + 8], eax
mov eax, dword [0x522644]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
sub esp, 0x14
mov dword [0x5212b4], eax
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5212b4]
sub esp, 8
jmp 0x42e13c
Function at 0x4353b0
Capabilities:
Write file on windows

Disassembly:
cmp byte [0x52268c], 0
jne 0x4353f0
push ebp
push edi
mov ebp, edx
push esi
push ebx
mov ebx, eax
mov esi, ecx
mov edi, ecx
sub esp, 0x18c
mov eax, dword [eax + 4]
test eax, eax
je 0x4353f2
cmp eax, 1
je 0x435402
cmp eax, 2
je 0x435420
add esp, 0x18c
pop ebx
pop esi
pop edi
pop ebp
ret
repz ret
mov dword [esp], ebx
call fcn.00435390
mov eax, dword [ebx + 4]
cmp eax, 1
jne 0x4353d7
add ebx, 8
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.004c95e0
jmp 0x4353dc
mov eax, dword [ebx]
test eax, eax
je 0x4354a0
mov dword [esp + 4], 0x109
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
call fcn.004cadc0
cmp eax, 1
jne 0x435444
cmp byte [ebp], 0xa
je 0x4354c1
mov eax, dword [ebx]
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], ebp
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
cmp eax, edi
jae 0x4353dc
mov eax, dword [ebx]
test eax, eax
je 0x43547a
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [ebx], 0
mov eax, dword [ebx + 0x20]
mov dword [ebx + 4], 3
mov edx, dword [eax]
mov dword [esp + 4], 0x4ecf60
mov dword [esp], eax
call dword [edx]
jmp 0x4353dc
mov dword [esp + 8], 0x37
mov dword [esp + 4], str._MoTTY_logging.c
mov dword [esp], str.ctx__lgfp
call fcn.004d8b40
jmp 0x435426
lea eax, [esp + 0x20]
lea esi, [esp + 0x80]
mov edi, 0x18
mov dword [esp], eax
call fcn.004d4470
mov eax, dword [esp + 0x20]
mov dword [esp], esi
mov dword [esp + 8], str._Y__m__d__H:_M:_S
mov dword [esp + 4], 0x18
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_strftime
mov dword [esp + 4], esi
mov dword [esp], str._n__s_
call fcn.004cc080
mov esi, eax
mov eax, dword [ebx]
mov dword [esp + 8], 0x18
mov dword [esp + 4], 1
mov dword [esp], esi
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
mov dword [esp + 0x1c], eax
call fcn.004cd6d0
mov eax, dword [esp + 0x1c]
jmp 0x43545e
Function at 0x43fdb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [0x521798]
test eax, eax
je 0x43fea1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x521790], eax
lea esi, [esi]
mov eax, dword [0x521798]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004d14e0
test eax, eax
mov ebx, eax
je 0x43fe82
mov dword [esp + 8], 0
mov eax, dword [eax + 4]
mov dword [esp + 4], eax
mov eax, dword [0x521794]
mov dword [esp], eax
call fcn.004d1860
test eax, eax
je 0x43fe60
mov esi, dword [ebx + 8]
mov eax, dword [0x521790]
mov ecx, dword [ebx + 0xc]
lea edx, [esi + 0xa]
add eax, 0xa
sub eax, ecx
sub edx, ecx
cmp eax, edx
jbe 0x43fe90
mov eax, dword [0x521798]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004d1920
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call dword [ebx]
mov dword [esp], ebx
call fcn.004cd6d0
jmp 0x43fdd0
mov eax, dword [0x521798]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004d1920
mov dword [esp], ebx
call fcn.004cd6d0
jmp 0x43fdd0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
mov eax, dword [esp + 0x24]
mov dword [eax], esi
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret
call fcn.0043fc80
jmp 0x43fdc2
Function at 0x4407d0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
xor ecx, ecx
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov eax, dword [edx + ecx*4]
mov dword [edi + ecx*4], eax
mov ebx, dword [esi*4 + 0x4df050]
add ecx, 1
cmp ebx, ecx
jg 0x4407e5
mov eax, ecx
mov ebp, dword [edi + ecx*4 - 4]
cdq
idiv ebx
test edx, edx
jne 0x44089d
lea esi, [esi]
mov edx, ebp
mov eax, dword [eax*4 + 0x4f0e3c]
ror edx, 8
mov ebp, edx
bswap eax
shr ebp, 0x18
mov dword [esp], eax
movzx ebp, byte [ebp + 0x4f0d40]
movzx eax, dl
movzx eax, byte [eax + 0x4f0d40]
shl ebp, 0x18
or ebp, eax
movzx eax, dh
shr edx, 0x10
movzx eax, byte [eax + 0x4f0d40]
movzx edx, dl
shl eax, 8
or eax, ebp
movzx ebp, byte [edx + 0x4f0d40]
shl ebp, 0x10
or ebp, eax
xor ebp, dword [esp]
mov eax, ecx
sub eax, ebx
mov edx, dword [edi + eax*4]
xor edx, ebp
mov dword [edi + ecx*4], edx
mov eax, dword [esi*4 + 0x4df05c]
add ecx, 1
add eax, 1
imul eax, dword [esi*4 + 0x4df044]
cmp eax, ecx
jle 0x4408f0
mov ebx, dword [esi*4 + 0x4df050]
mov eax, ecx
mov ebp, dword [edi + ecx*4 - 4]
cdq
idiv ebx
test edx, edx
je 0x440810
cmp edx, 4
jne 0x440860
cmp ebx, 6
jle 0x440860
mov eax, ebp
mov edx, ebp
shr eax, 0x18
movzx edx, dl
movzx eax, byte [eax + 0x4f0d40]
movzx edx, byte [edx + 0x4f0d40]
shl eax, 0x18
or eax, edx
mov edx, ebp
shr ebp, 0x10
movzx edx, dh
movzx edx, byte [edx + 0x4f0d40]
shl edx, 8
or eax, edx
mov edx, ebp
movzx ebp, dl
movzx edx, byte [ebp + 0x4f0d40]
shl edx, 0x10
or eax, edx
mov ebp, eax
jmp 0x440860
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x440a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 8
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov eax, ebx
lea ebp, [ebx + ebx]
mov esi, ebx
shr al, 7
mov dword [esp], edi
lea ecx, [eax + eax]
add ecx, eax
lea ecx, [ecx + ecx*8]
xor ecx, ebp
mov eax, ecx
shr al, 7
lea edx, [eax + eax]
add edx, eax
lea eax, [ecx + ecx]
lea edx, [edx + edx*8]
xor edx, eax
mov eax, edi
shr al, 1
mov ebp, eax
and ebp, 1
mov eax, ebp
imul eax, ecx
mov ecx, edx
shr cl, 7
mov ebp, eax
mov eax, edi
and eax, 1
imul eax, ebx
xor ebp, eax
mov eax, edi
shr al, 2
and eax, 1
imul eax, edx
xor ebp, eax
lea eax, [ecx + ecx]
add eax, ecx
lea ecx, [eax + eax*8]
lea eax, [edx + edx]
mov edx, edi
shr dl, 3
xor eax, ecx
and edx, 1
mov ecx, esi
imul eax, edx
xor ebp, eax
mov eax, ebp
mov byte [esp + 7], al
mov eax, edi
mov edi, 4
shr al, 4
and eax, 1
mov edx, ecx
add ecx, ecx
shr dl, 7
mov ebp, edx
lea edx, [ebp + ebp]
add edx, ebp
lea edx, [edx + edx*8]
xor ecx, edx
sub edi, 1
jne 0x440af3
imul eax, ecx
xor al, byte [esp + 7]
mov edi, 5
mov ecx, ebx
mov byte [esp + 7], al
movzx eax, byte [esp]
shr al, 5
and eax, 1
nop
lea esi, [esi]
mov edx, ecx
add ecx, ecx
shr dl, 7
mov ebp, edx
lea edx, [ebp + ebp]
add edx, ebp
lea edx, [edx + edx*8]
xor ecx, edx
sub edi, 1
jne 0x440b30
movzx ebp, byte [esp + 7]
mov edi, 6
imul eax, ecx
xor ebp, eax
movzx eax, byte [esp]
shr al, 6
and eax, 1
mov ecx, ebx
add ebx, ebx
shr cl, 7
lea edx, [ecx + ecx]
add edx, ecx
lea edx, [edx + edx*8]
xor ebx, edx
sub edi, 1
jne 0x440b62
imul eax, ebx
movzx ebx, byte [esp]
mov ecx, 7
mov edx, esi
xor ebp, eax
shr bl, 7
nop
lea esi, [esi]
mov eax, edx
add edx, edx
shr al, 7
mov esi, eax
lea eax, [esi + esi]
add eax, esi
lea eax, [eax + eax*8]
xor edx, eax
sub ecx, 1
jne 0x440b90
mov eax, edx
add esp, 8
imul eax, ebx
pop ebx
pop esi
xor eax, ebp
pop edi
pop ebp
ret

Function at 0x440fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], 0x90d0b0e
mov dword [esp + 0x24], 0xd0b0e09
mov dword [esp + 0x28], 0xb0e090d
mov dword [esp + 0x2c], 0xe090d0b
mov eax, dword [eax*4 + 0x4df044]
test eax, eax
jle 0x441073
mov esi, dword [esp + 0x48]
mov dword [esp + 0xc], 0
lea esi, [esi]
lea edi, [edi]
lea eax, [esp + 0x1c]
lea ebx, [esp + 0x20]
mov dword [esp + 8], eax
mov eax, 0xe
xor ebp, ebp
xor edi, edi
mov dword [esp + 4], eax
movzx eax, byte [esi + edi]
add edi, 1
mov dword [esp], eax
call fcn.00440a60
xor ebp, eax
cmp edi, 4
je 0x441025
movzx eax, byte [ebx + edi]
jmp 0x441005
mov ecx, dword [esp + 8]
mov eax, ebp
add ebx, 4
mov byte [ecx], al
lea eax, [esp + 0x30]
add ecx, 1
mov dword [esp + 8], ecx
cmp eax, ebx
je 0x441044
movzx eax, byte [ebx]
jmp 0x441001
xor eax, eax
movzx edx, byte [esp + eax + 0x1c]
mov byte [esi + eax], dl
add eax, 1
cmp eax, 4
jne 0x441046
mov edx, dword [esp + 0x44]
add dword [esp + 0xc], 1
add esi, 4
mov eax, dword [esp + 0xc]
cmp dword [edx*4 + 0x4df044], eax
jg 0x440ff0
add esp, 0x30
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x441080
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
xor eax, eax
push esi
push ebx
mov ecx, 0x3c
sub esp, 0x124
lea edi, [esp + 0x34]
mov ebp, dword [esp + 0x138]
mov ebx, dword [esp + 0x148]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
mov dword [esp], ebp
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x144]
mov dword [esp + 4], eax
call fcn.004407d0
mov eax, dword [ebx]
mov ecx, dword [esp + 0x140]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 4]
test ecx, ecx
mov dword [esp + 0x28], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0x2c], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x30], eax
jle 0x441263
mov esi, dword [ebp*4 + 0x4df044]
lea ebx, [esp + 0x14]
mov dword [esp + 0xc], 0
mov eax, dword [ebp*4 + 0x4df05c]
mov edi, dword [esp + 0x13c]
lea edx, [esi*4]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
xor eax, eax
add ecx, edi
test edx, edx
mov edi, edx
jle 0x441270
nop
lea esi, [esi]
movzx edx, byte [ecx + eax]
mov byte [ebx + eax], dl
add eax, 1
cmp eax, edi
jne 0x441150
mov edx, dword [esp + 0x10]
test edx, edx
js 0x441220
mov dword [esp + 0x138], ebp
mov ebp, dword [esp + 0x10]
test esi, esi
jle 0x441194
mov eax, ebp
imul eax, esi
lea ecx, [esp + eax*4 + 0x34]
xor eax, eax
mov edx, dword [ebx + eax*4]
xor edx, dword [ecx + eax*4]
mov dword [ebx + eax*4], edx
add eax, 1
cmp eax, esi
jne 0x441184
test ebp, ebp
je 0x441200
mov eax, dword [esp + 0x138]
cmp dword [eax*4 + 0x4df05c], ebp
jg 0x4411f2
mov eax, dword [esp + 0x138]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00440eb0
mov eax, dword [esp + 0x138]
mov esi, dword [eax*4 + 0x4df044]
test esi, esi
jle 0x4411ed
lea edi, [ebx + esi*4]
mov eax, ebx
lea ecx, [eax + 4]
movzx edx, byte [eax]
add eax, 1
movzx edx, byte [edx + 0x4f0c40]
mov byte [eax - 1], dl
cmp ecx, eax
jne 0x4411d5
cmp edi, eax
jne 0x4411d2
sub ebp, 1
jmp 0x441175
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00440fa0
jmp 0x4411a8
lea edx, [esi*4]
mov ebp, dword [esp + 0x138]
test edx, edx
jle 0x44124e
mov eax, dword [esp + 0x13c]
mov edi, dword [esp + 0xc]
lea ecx, [eax + edi]
xor eax, eax
movzx edx, byte [ebx + eax]
xor dl, byte [esp + eax + 0x24]
mov edi, edx
movzx edx, byte [ecx + eax]
mov byte [esp + eax + 0x24], dl
mov edx, edi
mov byte [ecx + eax], dl
mov esi, dword [ebp*4 + 0x4df044]
add eax, 1
lea edx, [esi*4]
cmp edx, eax
jg 0x441222
add dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x140], eax
jg 0x44111d
add esp, 0x124
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x10]
test eax, eax
js 0x44124e
jmp 0x44116a