joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b6878
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4b688f
add esp, 0xfffffff0
call fcn.00405328
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00440e34
mov eax, dword [0x547bc0]
cmp byte [eax], 0
jne 0x4b68bc
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x548164]
cmp word [eax + 2], 0
jne 0x4b68d6
mov eax, dword [0x548164]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004b8970
mov eax, dword [0x548364]
cmp word [eax + 2], 0
jne 0x4b68f0
mov eax, dword [0x548364]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004b8b80
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x44b7a0]
call fcn.00451a74
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4b9130
mov dl, 1
mov eax, dword [0x4295d4]
call fcn.00404dc4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4295d4]
call fcn.00404dc4
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x44fc38]
call fcn.0045aee4
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4b6ad0
mov eax, dword [0x547f18]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0045b378
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4b9418
mov dl, 1
mov eax, dword [0x4295d4]
call fcn.00404dc4
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x547f18]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00413b78
test eax, eax
je 0x4b6a01
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00413908
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00413b5c
test eax, eax
je 0x4b6a19
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406b70
push ebx
push 0x4b8340
call fcn.004ac588
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x547bc0]
cmp byte [eax], 0
jne 0x4b6a6a
mov eax, ebx
call fcn.004b6c44
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004b9644
mov eax, ebx
call fcn.004ba278
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4b6ac7
call fcn.00405380
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6f18
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4b6fba
cmp dword [ebx + 0x94], 0
jne 0x4b6fb4
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4b6e64
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4b6fb4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4b6f7a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4b6fb4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004349d0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4b6f89
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4b71d8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x54e2bc]
cmp dword [eax + 0x170], 0
je 0x4b733d
test bl, bl
jne 0x4b728b
cmp dword [esi + 0x9c], 0
jne 0x4b7280
mov eax, esi
call fcn.004ba0c8
push eax
push 0x4b70e4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4b7251
mov eax, dword [0x54e2bc]
cmp byte [eax + 0xd3], 0
je 0x4b7251
mov eax, dword [esi + 0xd8]
call fcn.00407fb8
mov edi, eax
cmp edi, 0
jl 0x4b7251
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b723a
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b7280
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004349d0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b7260
inc dword [esi + 0x9c]
jmp 0x4b733d
cmp dword [esi + 0x9c], 0
jle 0x4b733d
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4b733d
cmp dword [esi + 0x44], 0
je 0x4b72e8
mov eax, dword [0x54e2bc]
cmp byte [eax + 0xd3], 0
je 0x4b72e8
mov eax, dword [esi + 0xd8]
call fcn.00407fb8
mov edi, eax
cmp edi, 0
jl 0x4b72e8
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b72d1
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b7317
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004349d0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b72f7
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4aa460]
call fcn.00408178
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4b7f8c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4b7ff7
cmp byte [ebx + 0xd3], 0
jne 0x4b7ff7
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406ab4
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4b7fe4
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4b8004
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406978
jmp 0x4b8004
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406978
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4b982c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4b989a
mov eax, esi
call fcn.00491e78
test al, al
je 0x4b989a
mov eax, dword [ebx + 0x84]
call fcn.00491acc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b989a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4b988e
push 0
mov eax, dword [ebx + 0x84]
call fcn.00491acc
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00488aa0
jmp 0x4b989a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004b9664
pop esi
pop ebx
ret
Function at 0x4ceb00
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4cec28
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004ce9ec
mov eax, dword [esi]
call fcn.00407fb0
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x40d2c4]
call fcn.00408178
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004043d8
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004043d8
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00407fb0
mov dword [ebp - 0xc], eax
mov eax, dword [0x548550]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.004bc798
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.004047b8
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00407fb0
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.004bc640
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.004bc3e4
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004bc790
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cec2f
lea eax, [ebp - 4]
mov edx, dword [0x40d2c4]
call fcn.00408184
ret
Function at 0x4025d0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x4026c7
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4026c7
push ebx
call fcn.00408c70
add esp, 4
test eax, eax
je 0x40262a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x402631
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x402610
jmp 0x402633
mov esi, 0x1505
jmp 0x402633
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x4026c7
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x402664
inc ebp
dec ebx
je 0x4026c5
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x4026c5
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402660
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00408c70
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402660
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.00408c90
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402660
mov eax, dword [ecx + 0x10]
mov edi, dword [eax + edi*4]
jmp 0x4026c7
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4026e0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x4027c7
test edx, edx
je 0x4027c7
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x40272a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x402731
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x402710
jmp 0x402733
mov esi, 0x1505
jmp 0x402733
mov esi, ecx
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jb 0x4027c7
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x402764
inc ebx
dec ebp
je 0x4027c5
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x4027c5
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402760
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00408c70
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402760
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00408c90
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402760
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x4027c7
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402be0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x402ce8
mov esi, edx
test edx, edx
je 0x402ce8
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x402ce8
push esi
call fcn.00408c70
add esp, 4
test eax, eax
je 0x402c3a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402c41
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402c20
jmp 0x402c43
mov ebp, 0x1505
jmp 0x402c43
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x402cf0
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x402caa
call fcn.00402de0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x402ce8
push ecx
call fcn.00408c70
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x402d5f
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402d08
inc ebx
dec esi
je 0x402c5f
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402c64
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402d00
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00408c70
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402d00
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00408c90
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402d00
mov eax, 0xffffffff
jmp 0x402ce8
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402d78
inc ebx
dec esi
je 0x402ca5
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402caa
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402d70
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00408c70
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402d70
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00408c90
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402d70
jmp 0x402caa
Function at 0x403470
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x403604
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4035fd
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x4034fb
add ebp, dword [esp + 4]
mov eax, edi
mov esi, 0x80078071
mul esi
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mul esi
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov esi, dword [esp + 8]
sub esi, dword [esp]
mov ebx, 0x15b0
je 0x4035fd
mov dword [esp + 8], esi
xor esi, esi
cmp ebx, 8
mov dword [esp], ebx
jb 0x40357b
mov esi, ebx
and esi, 0x1ff8
mov edx, 7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp]
add eax, edi
add ecx, eax
movzx edi, byte [ebp + 1]
add edi, eax
add ecx, edi
movzx eax, byte [ebp + 2]
add eax, edi
add ecx, eax
movzx edi, byte [ebp + 3]
add edi, eax
add ecx, edi
movzx eax, byte [ebp + 4]
add eax, edi
add ecx, eax
movzx edi, byte [ebp + 5]
mov ebx, eax
and ebx, edi
xor eax, edi
lea eax, [eax + ebx*2]
add ecx, eax
movzx edi, byte [ebp + 6]
mov ebx, eax
and ebx, edi
xor eax, edi
lea eax, [eax + ebx*2]
mov ebx, dword [esp]
add ecx, eax
movzx edi, byte [ebp + 7]
add edi, eax
add ecx, edi
add ebp, 8
add edx, 8
cmp edx, ebx
jb 0x403520
mov edx, ebx
sub edx, esi
jbe 0x4034c4
mov eax, esi
or eax, 1
test bl, 1
mov dword [esp + 4], edx
jne 0x4035a0
mov ebx, ebp
cmp dword [esp], eax
je 0x4034c0
jmp 0x4035bd
lea ebx, [ebp + 1]
movzx esi, byte [ebp]
mov edx, edi
and edx, esi
xor edi, esi
lea edi, [edi + edx*2]
add ecx, edi
mov esi, eax
cmp dword [esp], eax
je 0x4034c0
mov eax, dword [esp]
sub eax, esi
mov dword [esp + 0xc], eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + esi]
mov eax, edi
and eax, edx
xor edi, edx
lea eax, [edi + eax*2]
add ecx, eax
movzx edx, byte [ebx + esi + 1]
mov edi, eax
and edi, edx
xor eax, edx
lea edi, [eax + edi*2]
add ecx, edi
add esi, 2
cmp dword [esp + 0xc], esi
jne 0x4035d0
jmp 0x4034c0
shl ecx, 0x10
or ecx, edi
jmp 0x403609
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403620
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40367c
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x40367e
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
mov eax, dword [eax*4 + 0x43da18]
mov ebp, eax
and ebp, ebx
add ebx, eax
add ebp, ebp
sub ebx, ebp
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43da18]
inc esi
cmp edx, esi
jne 0x403640
not eax
jmp 0x40367e
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409290
Capabilities:
Terminate process

Disassembly:
sub esp, 0x124
call fcn.004382a0
test al, 1
jne 0x4092a4
jmp 0x409371
call fcn.00430c80
test al, 1
jne 0x4092b2
jmp 0x40936a
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
sub esp, 8
cmp eax, 0
jl 0x409368
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
sub esp, 0x24
cmp eax, 0
setge al
test al, 1
jne 0x409333
jmp 0x409362
call fcn.0040a3f0
test al, 1
jne 0x40933e
jmp 0x409360
lea eax, [esp + 0x24]
lea ecx, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00409380
call fcn.0040ed70
call fcn.0040c2c0
jmp 0x409360
jmp 0x409362
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x40936a
call fcn.00438d00
jmp 0x409371
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4093f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x409516
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40942c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x40945d
cmp cx, 0x7f
jbe 0x409420
movzx ecx, cx
cmp ecx, 0x7ff
ja 0x409450
add ebx, 2
jmp 0x409421
mov ecx, ebx
and ecx, 3
xor ebx, 3
lea ebx, [ebx + ecx*2]
jmp 0x409421
lea esi, [ebx + 1]
push esi
call fcn.00408a50
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x409524
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x409498
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x409526
movzx edx, word [edi]
test dx, dx
je 0x409526
cmp dx, 0x7f
jbe 0x409480
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
mov dword [esp + 4], esi
cmp esi, 0x7ff
ja 0x4094e0
cmp ecx, 2
jb 0x4094e0
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x409487
xor esi, esi
cmp ecx, 3
jb 0x409487
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x409487
push 1
call fcn.00408a50
add esp, 4
mov ebp, eax
jmp 0x409526
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x409547
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x409542
test eax, eax
jne 0x409540
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00405820
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x415910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x415930
mov edi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x415950
sar esi, 1
sar eax, 1
add eax, esi
inc eax
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
test eax, eax
jns 0x415978
mov eax, 0xffffffff
jmp 0x41597a
add eax, eax
push eax
call fcn.00408a50
add esp, 4
movzx ecx, word [edi]
mov ebx, eax
test cx, cx
je 0x4159b1
add edi, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4159a0
mov word [ebx], 0x5c
add ebx, 2
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x4159e1
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4159d0
mov word [ebx], 0
lea ecx, [esp + 0xc]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x34], eax
push eax
call fcn.0043b3d0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x441c0c]