joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101ae80c
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc ch
mov ecx, dword [ebp - 0x20c]
cmp ch, 0x9d
bt bx, 7
clc
cmp ah, cl
add ecx, 0x4c
jmp 0x101a330c
pushal
lea esp, [esp + 0x20]
call fcn.10050c00
jmp loc.10190c62
stc
cmc
sub esp, 0xffffffe0
mov dword fs:[0], esp
pushfd
pushfd
add esp, 0xfffffe08
cmp ebx, 0x6c369475
clc
pushfd
pushfd
mov dword [esp + 4], ebx
pushfd
mov dword [esp + 4], esi
clc
pushal
sub esp, 0xffffffdc
jno 0x101b9400
push edi
bt bp, bx
test al, 0x7c
pushal
sub esp, 0xffffffe0
mov dword [ebp - 0x18], esp
cmp bx, 0x8317
pushal
stc
mov dword [ebp - 0x20c], ecx
dec cx
neg cl
mov dword [ebp - 0x1fc], 0
sub cl, 0x6f
dec ch
btr cx, ax
mov ecx, dword [ebp - 0x20c]
clc
clc
cmp bl, dh
add ecx, 0x4c
pushal
lea esp, [esp + 0x40]
js 0x101c85e4
push ecx
lea esp, [esp + 4]
call fcn.10050be0
push 0xe4293bb9
mov dword [ebp - 0x200], eax
mov word [esp], 0x2df1
push dword [esp]
lea esp, [esp + 8]
jmp 0x101a0052
push 0x8f0029b4
mov word [esp], 0x62f7
bt cx, ax
cmc
mov dword [esp], edi
cmc
test ax, si
mov dword [ebp - 0x18], esp
jmp 0x101bd28f
stc
pushfd
mov dword [ebp - 0x20c], ecx
shld cx, sp, 0xc
shld cx, cx, cl
pushal
mov dword [ebp - 0x1fc], 0
rcl cx, 0xa
lea ecx, [edi*4 + 0xf9f25d2]
pushfd
mov ecx, dword [ebp - 0x20c]
mov word [esp], cx
stc
mov word [esp], 0x7105
add ecx, 0x4c
pushfd
call fcn.1018a2d8
jmp 0x1018e5e4

Function at 0x101b2e09
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [eax]
add byte [eax - 0x64], ah
setae ch
lea ecx, [esi*4 - 0x48903ebc]
mov dword [ebp - 0x20], eax
jmp loc.1018a2d3

Function at 0x101b48de
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], 0xc9
push dword [esp + 0xc]
lea esp, [esp + 0x14]
jne 0x10190fa5
xchg al, ch
seto dl
bswap dx
rdtsc
push 0x1f90
pushfd
cdq
mov ecx, dword [ebp - 0x24]
movsx edx, cl
lea edx, [0x4d47f4b2]
lea edx, [ebx + 0x2e02adca]
mov dword [esp], ecx
movzx dx, bl
not ch
rdtsc
mov edx, dword [ebp - 0x1c]
call fcn.10191d1c
call fcn.101b8861

Function at 0x101b5068
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
call fcn.1005bdc0
pushal
pushfd
lea esp, [esp + 0x24]
jmp fcn.10184580

Function at 0x101b8f05
Capabilities:
Packed with generic packer

Disassembly:
pushfd
mov dword [esp], edi
jmp fcn.101bef21
pushfd
lea esp, [esp + 0x30]
je 0x101972a9
jmp fcn.1004da42

Function at 0x101bdf02
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [ebp - 0x14]
pushal
push dword [esp]
push ebx
lea esp, [esp + 0x4c]
call fcn.10052430
push 0x1326b8ad
bts ecx, ebx
ror ch, 2
mov dword [ebp - 0x270], eax
bsf eax, ebp
rol ch, 3
shrd ecx, eax, 0xf
not ch
mov ecx, dword [ebp - 0x270]
neg eax
mov dword [ebp - 0x274], ecx
bsf dx, si
neg dl
shrd edx, ecx, 5
mov dword [esp], 1
das
or dh, dh
cwde
mov edx, dword [ebp - 0x244]
dec ecx
mov eax, dword [edx + 4]
xchg dh, ch
sbb cl, 0xe9
push eax
cwde
rdtsc
mov ecx, dword [ebp - 0x240]
rcl dx, 0xc
or eax, 0xbb545647
add ecx, 0x18
xchg dx, ax
push ecx
rdtsc
mov ecx, dword [ebp - 0x274]
lahf
movzx ax, cl
cdq
mov edx, dword [ebp - 0x274]
bswap ax
mov eax, dword [edx]
call fcn.101a2baf
Function at 0x101c059d
Capabilities:
Packed with generic packer

Disassembly:
sbb edi, esi
dec esi
dec eax
jg 0x101c0593
aaa
test al, 0x47
aaa
jg 0x101c059a
invalid
mov dl, 0xe3
loope 0x101c0584
neg byte [ebp - 0x7cdd4cb0]
mov ebp, 0xfffffddc
add al, ch
ret
push eax
mov bl, 0x22
cmp dword [ebp - 0x224], 0
call fcn.1018c910
popal
mov ecx, dword [edx + 0x55]
or bl, al
salc
mov dword [eax - 0x2702e181], ecx
mov byte [0x4e91], al
lodsb al, byte [esi]
dec ebp
pop ebp
cmp al, 0x8c
add al, 0xfc
pop di
cld
jb 0x101c0622
and al, 0xf0
xor dword [ebx], 0xffffff88
out dx, al
ror byte [edx - 0x5f], 1
jo 0x101c057c
cmp dword [ebx + 0x37d2c54], edx
mov eax, 0xe5989e98
in al, 0xe7
aaa
adc dword [esi - 0x62], ebp
invalid
sal dword [edi + edi*4], 0x84
add al, 0xad
jge 0x101c0693
mov ah, 0x60
sub eax, 0x8be7cae2
cmp eax, 0xd9f83098
xor al, 0xd2
mov ebx, fs
in al, dx
xor bh, byte [ecx - 0x7e31a0fc]
invalid
invalid

Function at 0x101c2f49
Capabilities:
Packed with generic packer

Disassembly:
call fcn.101b4c64
movsd dword es:[edi], dword [esi]
pop edx
fld qword [eax]
mov dl, 0x61
sbb al, 0xd3
xchg byte [ebp - 0x16d71824], bl
fsub qword [edx - 0x36cf3713]
out 0x86, al
lea edx, [0xe99a47b0]
rcl byte [ebp - 0x5c08af17]
loop 0x101c2fb0
je 0x101c2fd0
fisubr dword [edi]
xlatb
out 0xcf, eax
js 0x101c2f78
dec edi
or ah, byte [ecx]
inc dx
in eax, 0x3a
aaa
stosd dword es:[edi], eax
test byte [ecx], 0xb9
popal
loop 0x101c2fa5
int3
lahf
cmp ch, ch
insb byte es:[edi], dx
iretd
imul edx, dword [ebx + ebx*8], 0xfbc1582
lodsb al, byte [esi]
arpl word [edx + 0x49], bx
add bh, dl
loop 0x101c300d
and al, 0xdb
push ss
add edx, dword [ebp + 0x44]
pop ss
sti
leave
cmp byte [ebx + 0x44], al
das
mov cl, 0x67
jb 0x101c2f9f
dec eax
inc dword [edx + 0x218022f5]
test eax, 0xffcae596
xchg edi, eax
or ah, byte [edi + 0x42c4b966]
jl 0x101c303f
retf 0x97ff
or eax, 0x37cc0e4d
jb 0x101c2f9f
insb byte es:[edi], dx
ror dword [edx + 0x41], cl
je 0x101c303b
and ax, 0xb710
mov edx, 0x8fc4b5
xchg ecx, eax
test eax, 0x7d3ae596
out dx, al
inc ecx
out 0x66, al
mov ecx, 0x72d189c4
mov ebx, 0xc09aed3
stosd dword es:[edi], eax
mov bh, byte [0x933f34f]
mov eax, dword [0x191a0a9]
lodsb al, byte [esi]
test eax, 0xac0191a0
salc
movsd dword es:[edi], dword [esi]
xor bh, byte [edx - 0x3d]
rcl eax, cl
jg 0x101c3085
out 0x92, al
push edx
invalid

Function at 0x101c44f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp loc.10184e0f
add esp, 0x10
cmc
test eax, eax
jmp 0x101a1392

Function at 0x101c7c66
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x3c]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
rcl ch, 1
btc cx, si
pushfd
add esp, 8
movzx edx, dl
jmp loc.101897a9
jmp 0x101c1b2d
Function at 0x101cd87f
Capabilities:
Encode data using xor

Disassembly:
and al, 4
mov dword [esp + 8], edx
mov dword [esp + 0x38], 0x101b10c8
call fcn.10198392
push esp
xchg esi, eax
mov ch, 0x50
push ebx
salc
loope 0x101cd840
mov eax, dword [esi + 0x29]
xor bh, cl
outsb dx, byte [esi]
test eax, 0x502d7dd0
sar byte [ebp + 0x2d], 1
push eax
inc ebp
adc esp, dword [ebx]
popfd
mov bh, 0
xchg dword [edi + ebx*2], ebp
or al, 0x56
sbb al, 0x4d
dec edi
add eax, 0xd4df994c
arpl word [ebx + 0x41baea52], ax
mov eax, 0x5a877eaf
mov byte [0xfdb1f10a], al
xchg byte [ebp + 0x17272ed6], dl
test byte [ebp - 0x7ce3d98b], dh
sub dh, byte [ebx]
xor dword [ebx + ebx*4], eax
jns 0x101cd89f
sub ecx, esi
xchg ecx, eax
Function at 0x861390
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x191000]
push edi
or ebp, 0xffffffff
jmp 0x8613b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8613b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8613a8
mov eax, 1
add ebx, ebx
jne 0x8613cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8613dc
jne 0x8613fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8613fb
dec eax
add ebx, ebx
jne 0x8613e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8613c0
add ebx, ebx
jne 0x8613f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x86144d
xor ecx, ecx
sub eax, 3
jb 0x861413
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x861482
sar eax, 1
mov ebp, eax
jmp 0x86141e
add ebx, ebx
jne 0x86141e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8613ec
inc ecx
add ebx, ebx
jne 0x86142c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8613ec
add ebx, ebx
jne 0x861439
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x86142e
jne 0x86144a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x86142e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x86146c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x86145e
jmp 0x8613ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x86146c
add edi, ecx
jmp 0x8613ae
pop esi
mov edi, esi
mov ecx, 0x6baf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x86148a
cmp byte [edi], 0x13
jne 0x86148a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x86148f
lea edi, [esi + 0x458000]
mov eax, dword [edi]
or eax, eax
je 0x861507
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x465b94]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x465cd4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8614bc
mov ecx, edi
jns 0x8614eb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x465cd8]
or eax, eax
je 0x861501
mov dword [ebx], eax
add ebx, 4
jmp 0x8614d9
call dword [esi + 0x465ce8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x861538
cmp al, 0xef
ja 0x86152b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x86150d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x86151a
mov ebp, dword [esi + 0x465cdc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x86156c
sub esp, 0xffffff80
jmp 0x4af399
Function at 0xeecf38
Capabilities:
Encode data using xor

Disassembly:
jmp 0xeecf42
pushal
call 0xeecf48
pop ebp
sub ebp, 0x10
sub ebp, 0xaecf38
jmp 0xeecf5e
mov eax, 0xaecf38
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d3
mov edx, 0xd3688a42
xor byte [eax], dl
inc eax
dec ecx
jne 0xeecf75
jmp 0xeecf88
leave
invalid

Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ed0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4f3803ae
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3c767dbc
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1ec965ef
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6aa154ec
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x402700
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x4027f1
test edx, edx
je 0x4027f1
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x40274a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x402751
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x402730
jmp 0x402753
mov esi, 0x1505
jmp 0x402753
mov esi, ecx
mov dword [esp + 4], edx
mov edx, dword [esp]
mov ebx, dword [edx + 0x20]
mov ebp, ebx
sub ebp, 1
jb 0x4027f1
and ebp, esi
mov eax, ebx
xor eax, 0xfffffffe
mov ecx, ebx
and ecx, 0xfffffffe
lea eax, [eax + ecx*2]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [edx + 4]
mov dword [esp + 0xc], eax
jmp 0x402794
inc ebp
dec ebx
je 0x4027ef
mov eax, ebp
and eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edi, dword [ecx + eax*4]
cmp edi, 0xffffffff
je 0x4027ef
mov eax, dword [edx + 8]
cmp dword [eax + edi*4], esi
jne 0x402790
mov eax, dword [edx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00408fb0
mov edx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402790
push dword [esp + 0x28]
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00408fd0
mov edx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402790
mov eax, dword [edx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x4027f1
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402c70
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x402d6a
mov esi, edx
test edx, edx
je 0x402d6a
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x402d6a
push esi
call fcn.00408fb0
add esp, 4
test eax, eax
je 0x402cca
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402cd1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402cb0
jmp 0x402cd3
mov ebp, 0x1505
jmp 0x402cd3
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov ebx, dword [ecx + 0x20]
mov esi, ebx
sub esi, 1
jae 0x402d72
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x402d2c
call fcn.00402e90
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x402d6a
push ecx
call fcn.00408fb0
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov ebx, dword [ecx + 0x20]
mov esi, ebx
sub esi, 1
jae 0x402e02
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and esi, ebp
mov eax, ebx
xor eax, 0xfffffffe
mov edx, ebx
and edx, 0xfffffffe
lea eax, [eax + edx*2]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402da8
inc esi
dec ebx
je 0x402ce8
mov edi, esi
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402ced
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402da0
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00408fb0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402da0
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00408fd0
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402da0
mov eax, 0xffffffff
jmp 0x402d6a
and esi, ebp
mov eax, ebx
xor eax, 0xfffffffe
mov edx, ebx
and edx, 0xfffffffe
lea eax, [eax + edx*2]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402e28
inc esi
dec ebx
je 0x402d27
mov edi, esi
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402d2c
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402e20
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00408fb0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402e20
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00408fd0
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402e20
jmp 0x402d2c
Function at 0x403580
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x403726
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40371f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
mov eax, edx
jmp 0x403611
add ebp, dword [esp + 0x10]
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 0xc]
mov eax, 0x15b0
je 0x40371f
xor edx, edx
cmp eax, 8
mov dword [esp + 8], esi
jb 0x40368c
mov edx, eax
and edx, 0x1ff8
mov dword [esp], edx
mov edx, 7
nop
nop
nop
nop
mov ebx, eax
movzx eax, byte [ebp]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + 7]
add edi, eax
mov eax, ecx
and eax, edi
xor ecx, edi
lea ecx, [ecx + eax*2]
mov eax, ebx
add ebp, 8
add edx, 8
cmp edx, ebx
jb 0x403630
mov esi, dword [esp + 8]
mov edx, dword [esp]
mov ebx, eax
sub ebx, edx
mov dword [esp + 0xc], eax
jbe 0x4035d8
mov dword [esp], edx
not edx
add edx, eax
mov dword [esp + 4], edx
mov edx, eax
and edx, 3
mov dword [esp + 0x10], ebx
je 0x4036d4
neg edx
xor eax, eax
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx]
inc ebx
add edi, esi
add ecx, edi
dec eax
cmp edx, eax
jne 0x4036c0
mov edx, dword [esp]
sub edx, eax
jmp 0x4036d9
mov ebx, ebp
mov edx, dword [esp]
mov eax, dword [esp + 4]
cmp eax, 3
jb 0x4035d0
mov eax, dword [esp + 0xc]
sub eax, edx
xor edx, edx
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x4036f0
jmp 0x4035d0
shl ecx, 0x10
or ecx, edi
jmp 0x40372b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403740
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4037a8
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x4037aa
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
mov ebp, eax
not ebp
or ebp, 0xf
add eax, ebp
inc eax
mov ebp, edi
and ebp, 0xf
xor ebp, eax
mov eax, dword [ebp*4 + 0x441a18]
mov ebp, eax
and ebp, ebx
add ebx, eax
add ebp, ebp
sub ebx, ebp
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x441a18]
inc esi
cmp edx, esi
jne 0x403760
not eax
jmp 0x4037aa
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409400
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00409520
sub esp, 0x100
mov esi, esp
call fcn.0043b830
test al, 1
jne 0x40941f
jmp 0x4094e7
call fcn.00433b50
test al, 1
jne 0x40942d
jmp 0x4094e0
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, 0
jl 0x4094de
xor eax, eax
sub esp, 0x24
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, 0
jl 0x4094d8
call fcn.0040a990
test al, 1
jne 0x4094b2
jmp 0x4094d6
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00409500
add esp, 8
call fcn.0040d550
call fcn.0040c1c0
jmp 0x4094d6
jmp 0x4094d8
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4094e0
call fcn.0043be90
jmp 0x4094e7
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]