joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402264
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 8], ecx
mov esi, dword [esp + 0x2c]
mov eax, dword [0x49b4e0]
lea ecx, [eax - 1]
mov dword [0x49b4e0], ecx
mov ecx, 0x676ed248
sub ecx, eax
or dword [0x497f7c], ecx
mov ax, word [0x48a59a]
mov ecx, 0xffffc5f9
sub ecx, eax
or ecx, 0xd757
mov word [0x489fde], cx
mov ax, word [0x4908ba]
cwde
imul eax, eax, 0x9123f654
mov dword [0x49f7b4], eax
mov eax, dword [0x4a8a00]
add eax, 0xfe279445
cmp eax, 0x5bd9a4a1
jl 0x4022d6
mov word [0x48fb02], 0x28fe
jmp 0x4022e7
mov ax, word [0x487b7c]
add eax, 0x4bc8
mov word [0x487b7c], ax
test esi, esi
je 0x40246a
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
lea eax, [ebx + 8]
mov dword [esp + 4], eax
mov eax, dword [0x4a775c]
mov dword [0x4a7dd4], eax
mov ecx, dword [esp + 8]
push esi
push ebx
call fcn.0041739e
mov edi, eax
mov eax, dword [0x4a3908]
mov dword [0x4964d0], eax
cmp edi, esi
jle 0x402352
and dword [0x49ea08], 0xa1c7213d
mov eax, dword [0x4a1dd0]
dec eax
mov dword [0x4a1dd0], eax
mov cx, word [0x4880da]
or ecx, eax
or ecx, 0x716
mov word [0x4880da], cx
mov edi, esi
jmp 0x402380
mov ax, word [0x48f89e]
dec eax
mov word [0x48f89e], ax
mov eax, dword [0x4a574c]
sar eax, 5
mov ecx, 0x7f8cbe1e
sub ecx, eax
cmp ecx, 0xedd7fbea
jg 0x402380
or dword [0x4a3be0], 0x5e0c16dd
mov dword [esp + 0xc], esi
mov eax, dword [0x49c718]
lea ecx, [eax + 1]
mov dword [0x49c718], ecx
add eax, 0x4286a8e7
cmp eax, 0x9fccac7f
jg 0x4023bc
mov eax, dword [0x499158]
cmp eax, 0xb273429
jl 0x4023bc
mov ax, word [0x4887a6]
imul eax, eax, 0x6e5a
mov word [0x4887a6], ax
test edi, edi
mov eax, dword [esp + 4]
mov ecx, edi
mov edx, ebp
je 0x4023f8
dec dword [0x497198]
mov si, word [0x486d4c]
dec esi
mov word [0x486d4c], si
mov bl, byte [eax]
xor byte [edx], bl
mov esi, dword [0x49ceb8]
imul esi, esi, 0x67cae93b
mov dword [0x49ceb8], esi
inc edx
inc eax
dec ecx
jne 0x4023c8
mov eax, dword [0x49ece8]
imul eax, eax, 0xdcabf8f8
mov dword [0x49ece8], eax
push edi
mov ebx, dword [esp + 0x28]
push ebx
call fcn.0042eefa
mov eax, dword [0x495ce8]
mov ecx, dword [0x493bb0]
shr ecx, 2
add ecx, eax
mov word [0x487064], cx
mov eax, dword [0x4a86a8]
mov ecx, dword [0x498584]
sar ecx, 7
add ecx, 0x32634532
xor ecx, 0x8740ef05
cmp eax, ecx
jle 0x402452
mov dword [0x4a9318], 0xe93e488e
add ebp, edi
xor dword [0x4a81ac], 0xffbd6b5f
mov esi, dword [esp + 0xc]
sub esi, edi
jne 0x4022fe
or dword [0x49a1e8], 0xf4d0e18f
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4074d6
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov eax, dword [0x4a2b20]
shr eax, 1
imul eax, eax, 0xcd4f2abc
mov cx, word [0x491516]
add ecx, eax
mov word [0x491516], cx
mov eax, dword [0x4a5a1c]
or eax, 0x32fc1c77
and dword [0x4a10d0], eax
mov eax, dword [0x49f360]
imul eax, eax, 0x1d6042ac
mov dword [0x49f360], eax
xor dword [0x4a5f84], 0xab642031
mov word [0x48f6de], 0xae52
mov eax, edx
shr eax, 8
mov cx, word [0x48f514]
add ecx, 0x24cf
mov word [0x48f514], cx
mov edi, edx
shr edi, 0x10
test ebp, 0x3fffffff
je 0x4075f0
mov esi, dword [esp + 0x14]
shl ebp, 2
mov cx, word [0x489810]
imul ecx, ecx, 0x75e6
mov word [0x489810], cx
shl edi, 0x10
shl eax, 8
movzx eax, ax
or eax, edi
movzx ecx, dl
or ecx, eax
xor dword [esi], ecx
mov edi, dword [0x4a7f90]
mov ebx, dword [0x4a1048]
sar ebx, 2
imul ebx, ebx, 0xc2269f11
add ebx, edi
mov dword [0x49d750], ebx
shr ecx, 1
shr eax, 9
mov edi, dword [0x4a4ff0]
imul edi, edi, 0xd897b85d
mov dword [0x4a4ff0], edi
add eax, ecx
mov word [0x48ab62], 0xfe04
mov edi, dword [0x4a8d08]
movzx edi, cl
movzx ebx, al
add ebx, edi
shl edx, 0x1f
or edx, ecx
add esi, 4
mov edi, edx
shr edi, 0x10
add ebp, 0xfffffffc
mov edx, ebx
jne 0x407563
jmp 0x4075f2
mov ebx, edx
mov ecx, dword [0x4a3ed0]
cmp ecx, 0x1ae4b030
jg 0x40760a
add dword [0x499a54], 0x4c889a50
shl edi, 0x10
shl eax, 8
movzx ecx, ax
or ecx, edi
movzx eax, bl
or eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408ae8
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov ax, word [0x48930e]
lea ecx, [eax - 1]
mov word [0x48930e], cx
cwde
mov ecx, dword [0x494798]
imul ecx, eax
mov dword [0x494798], ecx
mov eax, dword [0x495c10]
inc eax
mov dword [0x495c10], eax
imul eax, eax, 0xa0c8873a
mov ecx, dword [0x492f74]
lea eax, [eax + ecx + 0x7255f1b6]
mov dword [0x492f74], eax
mov ax, word [0x48d782]
xor eax, 0xe237
mov word [0x48eaf4], ax
xor edi, edi
test edx, edx
jle 0x408cda
mov ebp, dword [esp + 0x1c]
inc edx
xor edi, edi
mov dword [esp], edx
mov eax, dword [0x4a21f0]
imul eax, eax, 0x16587367
mov dx, word [0x48e214]
sub eax, edx
mov word [0x48c784], ax
and dword [0x4a3c8c], 0x474f7b39
mov ax, word [0x48b578]
inc eax
mov word [0x48b578], ax
cwde
mov edx, dword [0x4a3c08]
lea eax, [eax + edx + 1]
inc edx
mov dword [0x4a3c08], edx
cmp eax, 0x5c2adf10
je 0x408bc9
mov eax, dword [0x498ba4]
mov edx, dword [0x4a4d20]
lea ecx, [edx + 1]
mov dword [0x4a4d20], ecx
and edx, 0x499ed7b6
xor edx, eax
add dword [0x495ce0], edx
mov ax, word [0x487318]
imul eax, eax, 0x6e97
mov word [0x487318], ax
mov eax, dword [esp + 0x24]
mul dword [ebp]
mov cx, word [0x4900d0]
lea ebx, [ecx + 1]
mov word [0x4900d0], bx
movsx ecx, cx
and dword [0x498ad4], ecx
or dword [0x4a6f34], 0xccdee0aa
mov ecx, dword [0x49f858]
imul ecx, ecx, 0xe8bbccc
mov dword [0x49f858], ecx
mov ecx, dword [0x4a0e84]
mov ebx, 0x4e58187d
sub ebx, ecx
dec ecx
add eax, edi
mov dword [0x4a0e84], ecx
mov dword [0x4a0b9c], ebx
adc edx, 0
mov cx, word [0x4863aa]
imul ecx, ecx, 0x3df8
mov word [0x4863aa], cx
add eax, dword [esi]
mov ecx, dword [0x49f9a4]
add dword [0x4a338c], ecx
cmp eax, dword [esi]
mov edi, edx
adc edi, 0
mov cx, word [0x491602]
imul ecx, ecx, 0x6d93
mov word [0x491602], cx
mov ecx, dword [0x49e7e8]
imul ecx, ecx, 0xcc44f296
mov edx, dword [0x499a18]
dec edx
mov dword [0x499a18], edx
xor edx, ecx
or dword [0x49d218], edx
mov dword [esi], eax
mov eax, dword [0x4a5fb4]
imul eax, eax, 0x9edf7ff8
mov dword [0x4a5fb4], eax
mov ax, word [0x48d466]
cwde
mov ecx, dword [0x49a0a8]
sub eax, ecx
cmp eax, 0xd23c8729
jne 0x408cc7
mov dword [0x4aabe4], 0x4d0fb03b
add ebp, 4
add esi, 4
mov edx, dword [esp]
dec edx
cmp edx, 1
jg 0x408b5a
mov eax, dword [0x4abda0]
cmp eax, 0xad192656
jg 0x408cf7
mov ax, word [0x492cb8]
or eax, 0x39ca
mov word [0x492cb8], ax
mov eax, dword [0x494280]
shr eax, 9
mov ecx, 0xbac90bdf
sub ecx, eax
mov ax, word [0x488578]
xor eax, ecx
mov word [0x488578], ax
mov eax, dword [0x4a08d0]
or eax, 0x2102bcc5
xor eax, 0x8445000a
mov ecx, dword [0x49e00c]
imul ecx, eax
mov dword [0x49e00c], ecx
add dword [esi], edi
mov eax, dword [0x49525c]
lea ecx, [eax + 1]
mov dword [0x49525c], ecx
add eax, 0xaf63bd5c
xor dword [0x49818c], eax
mov eax, dword [esi]
cmp eax, edi
sbb ecx, ecx
and ecx, 1
add dword [0x49cab4], 0x43d110ee
add esi, 4
mov edx, dword [0x4a1d80]
imul edx, edx, 0xb00525ff
cmp eax, edi
mov dword [0x4a1d80], edx
mov edi, ecx
jb 0x408d14
add dword [0x49f504], 0x99fbbef5
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409010
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x499ab8]
add eax, 0x7fa158df
or eax, 0xae609f83
xor dword [0x49c26c], eax
push dword [0x4ac6e8]
call fcn.0041b3d7
add esp, 4
add dword [0x4a6520], 0x403051
push 1
call fcn.0043fef9
add esp, 4
int3

Function at 0x409066
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov bl, byte [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [0x4aa138]
and ecx, 0x532
xor ecx, 0x2718
mov dx, word [0x48e9ec]
and edx, ecx
mov word [0x48e9ec], dx
mov word [0x48dee6], 0x4000
mov ecx, dword [0x4a28f0]
dec ecx
mov dword [0x4a28f0], ecx
or ecx, 0x10958c58
add dword [0x4a2138], ecx
mov dword [esi + 0x2020], eax
add dword [0x4a2fe8], 0xfdf5ffd7
xor dword [0x4aaefc], 0xd5e19a1
call fcn.0041eaa2
mov dword [esp], eax
mov eax, dword [0x4a4e14]
imul eax, eax, 0x2000082c
mov dword [0x4a4e14], eax
cmp dword [esp], 0
je 0x4090ca
mov eax, dword [0x4a84d0]
shl eax, 8
or eax, 0xbf2
mov cx, word [0x488b30]
and ecx, eax
mov word [0x488b30], cx
call fcn.0041eaa2
mov dword [esp + 4], eax
add dword [0x499ea8], 0xf0770dc5
mov byte [esp + 4], bl
dec dword [0x4a06ec]
add dword [0x493378], 0xe459a9a
push dword [esp]
call fcn.0041db7a
add esp, 4
xor dword [esp + 4], eax
or dword [0x49ef5c], 0xd4fe7ad
mov edi, 8
lea eax, [esp]
push 0
push edi
push eax
push dword [esi + 0x2020]
call dword [0x4861cc]
mov ecx, dword [0x4a4b50]
lea edx, [ecx + 1]
mov dword [0x4a4b50], edx
add ecx, 0xf77696b6
xor dword [0x498b50], ecx
cmp eax, edi
jne 0x409261
mov eax, dword [0x4abafc]
lea ecx, [eax + 1]
mov dword [0x4abafc], ecx
mov ecx, dword [0x49f280]
imul ecx, eax
mov dword [0x49f280], ecx
sub esp, 4
movzx eax, bl
mov dword [esp], eax
mov ecx, esi
call fcn.0040b7f6
test al, al
je 0x40928e
mov dword [0x496540], 0xd7fcd3be
mov dword [esi], 0
mov ax, word [0x491300]
mov cx, word [0x48755a]
xor ecx, eax
not ecx
mov word [0x48755a], cx
mov eax, dword [esp]
mov dword [esi + 4], eax
mov eax, dword [0x49aad8]
cmp eax, 0x6797af6b
jl 0x409218
mov eax, dword [0x4973f4]
lea ecx, [eax - 1]
mov dword [0x4973f4], ecx
cmp eax, 0x414012
jg 0x409218
add dword [0x49b024], 0xdeff0ad1
xor eax, eax
mov dword [esi + 0x100c], eax
xor dword [0x494af0], 0x6fc56f8f
push dword [esp]
call dword [esi + 0x201c]
add esp, 4
mov dword [esi + 0x1010], eax
mov ax, word [0x48e078]
mov cx, word [0x48b8ba]
and ecx, eax
movsx eax, cx
mov ecx, dword [0x4abaa8]
sub ecx, eax
mov dword [0x4abaa8], ecx
xor eax, eax
inc eax
jmp 0x4092d8
mov eax, dword [0x4aafcc]
lea ecx, [eax + 1]
mov dword [0x4aafcc], ecx
xor eax, 0x18c4925a
cmp eax, 0xcdddcf3c
jg 0x4092b4
mov ax, word [0x486f68]
add eax, 0xfffff269
mov word [0x486f68], ax
jmp 0x4092c4
mov eax, dword [0x496c18]
sar eax, 7
add dword [0x4a4e6c], eax
mov ecx, esi
call fcn.0040f8e8
add dword [0x4a6440], 0xf8ebbd7c
mov eax, 0xfffffffe
jmp 0x4092d8
mov eax, dword [0x4a74dc]
imul eax, eax, 0x9847f282
mov dword [0x4a74dc], eax
mov ecx, esi
call fcn.0040f8e8
add dword [0x4ab260], 0x6f79ce53
xor eax, eax
dec eax
add esp, 8
pop esi
pop edi
pop ebx
ret 8
Function at 0x40b8e8
Capabilities:
Hash data with md5

Disassembly:
mov dword [0x4a2258], 0x9eed3bfb
xor eax, eax
mov dword [ecx], eax
mov edx, dword [0x4aa6ec]
inc dword [0x4a78fc]
mov edx, dword [0x496148]
imul edx, edx, 0x45fe400c
add dword [0x49a5a4], edx
mov dword [ecx + 4], eax
mov eax, dword [0x4ab3e4]
dec eax
mov dword [0x4ab3e4], eax
or eax, 0x42e0b193
cmp eax, 0xef0f9e21
jg 0x40b93a
xor dword [0x497a5c], 0x334833bc
jmp 0x40b956
mov eax, dword [0x49693c]
add eax, 0x963e1f0d
cmp eax, 0x55e81fd3
jl 0x40b956
inc dword [0x4a2180]
mov eax, dword [0x49e068]
push esi
mov dword [ecx + 8], 0x67452301
mov eax, dword [0x497ecc]
sar eax, 3
and eax, 0xb0468e9a
mov edx, dword [0x49bd58]
lea esi, [edx - 1]
mov dword [0x49bd58], esi
or edx, 0xb87006da
cmp eax, edx
pop esi
jge 0x40b98f
xor dword [0x4a3b3c], 0x675d72ce
mov dword [ecx + 0xc], 0xefcdab89
add dword [0x4a7070], 0xd116a94c
mov dword [ecx + 0x10], 0x98badcfe
dec dword [0x4a7a2c]
mov dword [ecx + 0x14], 0x10325476
add dword [0x4aafd0], 0x20408004
ret
Function at 0x41f74f
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov ax, word [0x487572]
inc eax
mov word [0x487572], ax
cwde
mov dword [0x498e08], eax
add dword [0x4a76b8], 0xfe865d58
cmp dword [0x4acf2c], 0
jne 0x41f7af
mov eax, dword [0x4a101c]
imul eax, eax, 0xd32b4a1f
mov dword [0x4a101c], eax
call fcn.0041eaa2
mov dword [0x4acf2c], eax
mov eax, dword [0x4ab180]
sar eax, 3
add eax, 0xa88e74a5
xor eax, 0x136eb6e8
or dword [0x49bd74], eax
mov dword [0x4aa178], 0xe80a762c
mov ebp, 3
push ebp
push 0x905f
call fcn.00421632
add esp, 8
mov edi, eax
or dword [0x4a40b0], 0x1511f290
push edi
push ebx
call fcn.0043faf9
add esp, 8
mov esi, eax
mov eax, dword [0x4a6ec8]
mov ax, word [0x4904c6]
and eax, 0x526b
mov word [0x4904c6], ax
push edi
push ebp
call fcn.00413689
add esp, 8
mov ax, word [0x4907c4]
cwde
add eax, 0x88abed89
xor eax, 0x9c5274c3
add dword [0x4ab0f0], eax
test esi, esi
jne 0x41f8dc
mov eax, dword [0x4aabe4]
lea ecx, [eax - 1]
mov dword [0x4aabe4], ecx
add eax, 0xaa239bd7
xor eax, 0xf0669b7
mov ecx, dword [0x49d6d4]
not ecx
imul ecx, ecx, 0x91d0b434
cmp eax, ecx
je 0x41f857
add dword [0x49ddac], 0xf7c0e44a
push 0x466
call dword [0x4862e8]
mov dword [0x4a5430], 0x62681522
mov ebp, 3
push ebp
push 0x905f
call fcn.00421632
add esp, 8
mov edi, eax
mov eax, dword [0x49bb84]
dec eax
mov dword [0x49bb84], eax
mov ecx, dword [0x49ad20]
lea edx, [ecx + 1]
mov dword [0x49ad20], edx
mov edx, dword [0x4a5ad8]
imul edx, ecx
or edx, eax
mov word [0x48da72], dx
push edi
push ebx
call fcn.0043faf9
add esp, 8
mov esi, eax
mov word [0x488c92], 0xf801
push edi
push ebp
call fcn.00413689
add esp, 8
mov eax, dword [0x495ea8]
imul eax, eax, 0x87d44e9c
mov dword [0x495ea8], eax
mov ax, word [0x48e4d6]
cwde
imul eax, eax, 0x4174103e
add dword [0x49e33c], eax
test esi, esi
je 0x41f964
mov eax, dword [0x49b090]
add eax, 0xe8901727
xor dword [0x4aa784], eax
push esi
push 1
push 4
push 0x4acf2c
call fcn.004404e7
add esp, 0x10
mov ax, word [0x48e306]
cwde
add eax, 0x16e90d17
mov ecx, dword [0x4a33ec]
lea edx, [ecx - 1]
mov dword [0x4a33ec], edx
cmp eax, ecx
jle 0x41f94a
mov eax, dword [0x4968e8]
inc eax
mov dword [0x4968e8], eax
or eax, 0x43b5b6c7
and dword [0x4979e8], eax
push esi
call fcn.004405cd
add esp, 4
mov ax, word [0x49104c]
add eax, 0xfffffbff
mov word [0x49104c], ax
mov eax, dword [0x4a1b48]
xor eax, 0x44148821
cmp eax, 0x37b6f7f7
jg 0x41f97f
add dword [0x4a1808], 0x7f35241c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46010f
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045ff03

Function at 0x4623a3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00461b7d

Function at 0x4623ae
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00461db8
Function at 0x464ca0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x485748]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00458298
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00458298
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x464c6e
cmp word [ecx], dx
je 0x464c6e
mov eax, dword [0x4768c4]
push edi
dec eax
push eax
push 0x4767b0
call fcn.00464b9a
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x464ce5
cmp word [eax], dx
je 0x464ce5
mov eax, dword [edi]
test eax, eax
je 0x464c92
cmp word [eax], dx
je 0x464c92
lea eax, [ebp - 0x10]
push eax
call fcn.00464582
jmp 0x464c9b
lea eax, [ebp - 0x10]
push eax
call fcn.0046461d
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x464d2a
mov eax, dword [0x4767ac]
push dword [ebp - 0x14]
dec eax
push eax
push 0x4764a0
call fcn.00464b9a
add esp, 0xc
test al, al
je 0x464d0f
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x464cd9
cmp word [eax], di
je 0x464cd9
lea eax, [ebp - 0x10]
push eax
call fcn.00464582
jmp 0x464ce2
lea eax, [ebp - 0x10]
push eax
call fcn.0046461d
pop ecx
jmp 0x464d11
mov eax, dword [edi]
test eax, eax
je 0x464cfc
cmp word [eax], dx
je 0x464cfc
lea eax, [ebp - 0x10]
push eax
call fcn.00464519
pop ecx
jmp 0x464d0f
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
jne 0x464d2c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004321fb
mov esp, ebp
pop ebp
ret
xor edi, edi
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00464a23
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x464d17
cmp esi, 0xfde8
je 0x464d17
cmp esi, 0xfde9
je 0x464d17
movzx eax, si
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x464d17
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x464d17
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x464d80
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00459ded
test ebx, ebx
je 0x464df6
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00459ded
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x464d17
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x464d17
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.004574bb
add esp, 0x10
xor eax, eax
inc eax
jmp 0x464d19
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x497202a8
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x25045bd9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, 0x49d9
push edi
xor esi, esi
xor ecx, ecx
mov eax, 7
xor edi, edi
mov dword [ebp - 8], ebx
mov edx, 0x89b
mov dword [ebp - 4], 0x3b
cmp eax, 0x3b
cmovg eax, dword [ebp - 4]
dec edx
jne 0x401158
mov eax, 0x66666667
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
lea eax, [eax + eax*4]
sub edx, eax
jne 0x401180
add esi, 3
jmp 0x401181
inc esi
cmp esi, 0x2f16
jl 0x401162
mov esi, 0xc8d
mov edi, edi
mov eax, 0x86d90545
imul esi
add edx, esi
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x401190
mov edx, dword [ebp + 8]
test edx, edx
je 0x401232
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x401232
cmp edx, esi
jae 0x401232
sub esi, edx
je 0x4011d0
nop
mov al, byte [ecx + edx + 1]
sub al, 0x63
xor byte [ecx + edx], al
inc ecx
cmp ecx, esi
jb 0x4011c0
mov edi, edi
inc edi
mov eax, 0x55555556
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, edi
lea eax, [eax + eax*2]
sub ecx, eax
jne 0x4011eb
add edi, 2
cmp edi, 0x403e
jl 0x4011d0
mov ebx, 0x5098
jmp 0x401200
mov eax, 0x6bca1af3
imul ebx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401200
mov ebx, dword [ebp - 8]
mov eax, 0x8fb823ef
imul ebx
add edx, ebx
sar edx, 6
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401216
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc ecx
mov eax, ecx
and eax, 0x80000007
jns 0x401241
dec eax
or eax, 0xfffffff8
inc eax
jne 0x401245
add ecx, ecx
cmp ecx, 0x1c5f
jl 0x401232
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, 0x6e
push edi
mov ebx, 0x6c9a
mov edi, 0x5a59
lea ecx, [esi - 0x66]
jmp 0x401c30
mov eax, 0x3949660b
imul ebx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401c30
mov eax, 0x4be9
dec eax
jne 0x401c48
jmp 0x401c50
mov eax, 0x3e88cb3d
imul edi
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x401c50
mov eax, 0x2ba8
mov edx, 0x6f
lea ecx, [ecx]
cmp esi, edx
cmovl esi, edx
dec eax
jne 0x401c70
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, edi
xor dword [esi + eax*4], edx
inc eax
cmp eax, 5
jb 0x401c80
pop edi
pop esi
mov eax, 0x629c
mov edx, 0x45
pop ebx
cmp ecx, edx
cmovg ecx, edx
dec eax
jne 0x401c96
pop ebp
ret
Function at 0x402f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
inc byte [esi + 0x124]
movzx eax, byte [esi + 0x124]
lea edx, [esi + 0xd]
add eax, edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
movzx edx, byte [eax]
movzx eax, byte [esi + 0x11a]
add eax, edx
mov byte [esi + 0x11a], al
movzx eax, al
add esi, 0xd
xor edi, edi
xor ecx, ecx
add eax, esi
mov esi, dword [ebp - 4]
mov dword [ebp + 8], eax
movzx eax, byte [eax]
mov dl, byte [esi]
mov byte [esi], al
mov eax, dword [ebp + 8]
mov ebx, 0xc8
mov byte [eax], dl
mov esi, 0x78a5
mov edi, edi
mov eax, 0x84a9f9c9
imul esi
add edx, esi
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x402fa0
inc edi
mov eax, 0x66666667
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*4]
add edx, edx
mov eax, edi
sub eax, edx
jne 0x402fd3
inc edi
cmp edi, 0x4d95
jl 0x402fb5
mov eax, dword [ebp + 8]
mov dl, byte [eax]
mov eax, dword [ebp - 4]
add dl, byte [eax]
mov eax, ecx
and eax, 0x80000003
jns 0x402ff3
dec eax
or eax, 0xfffffffc
inc eax
jne 0x402ffa
add ecx, 3
jmp 0x402ffb
inc ecx
cmp ecx, 0x2f16
jl 0x402fe5
mov ecx, dword [ebp - 8]
movzx eax, dl
mov edx, 0x8c
mov cl, byte [eax + ecx]
mov eax, 0x1675
cmp ebx, edx
cmovl ebx, edx
dec eax
jne 0x403016
movzx eax, cl
movzx ecx, byte [ebp + 0xc]
pop edi
pop esi
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40893a
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
mov ebx, dword [esp]
add esp, 4
call fcn.00408962
sub eax, 0xca5df858
xor dword [esi], ebx
inc esi
add edi, eax
or eax, eax
cmp esi, ecx
jne fcn.0040893a
ret
Function at 0x40ca80
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x14]
mov al, byte [eax + 0x4c]
mov byte [esp + 0x10], al
mov esi, dword [edi]
cmp esi, dword [esp + 0x18]
je 0x40cc03
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x24]
nop word [eax + eax]
mov cl, byte [esi + 5]
test cl, 0x18
je 0x40cbb8
mov eax, dword [esi]
mov dword [edi], eax
movzx eax, byte [esi + 4]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x40cad7.11
movzx eax, byte [eax + 0x40cc30]
jmp dword [eax*4 + 0x40cc08]
push esi
push ebx
call fcn.0040a3d0
add esp, 8
jmp case.0x40cad7.11
lea eax, [esi + 0x10]
cmp dword [esi + 8], eax
je 0x40cafe
push esi
call fcn.0040a6c0
add esp, 4
push 0x20
push esi
push ebx
call fcn.0040f1b0
add esp, 0xc
jmp case.0x40cad7.11
movzx eax, byte [esi + 6]
lea eax, [eax*4 + 0x10]
push eax
push esi
push ebx
call fcn.0040f1b0
add esp, 0xc
jmp case.0x40cad7.11
movzx eax, byte [esi + 6]
inc eax
shl eax, 4
push eax
push esi
push ebx
call fcn.0040f1b0
add esp, 0xc
jmp case.0x40cad7.11
push esi
push ebx
call fcn.004153e0
add esp, 8
jmp case.0x40cad7.11
push esi
push ebx
call fcn.004142e0
add esp, 8
jmp case.0x40cad7.11
movzx eax, word [esi + 6]
test ax, ax
jne 0x40cb70
mov ecx, 0x10
jmp 0x40cb78
mov ecx, eax
shl ecx, 4
add ecx, 0x18
mov eax, dword [esi + 8]
add eax, ecx
push eax
push esi
push ebx
call fcn.0040f1b0
add esp, 0xc
jmp case.0x40cad7.11
push esi
push ebx
call fcn.00415060
movzx eax, byte [esi + 7]
add eax, 0x11
push eax
push esi
push ebx
call fcn.0040f1b0
add esp, 0x14
jmp case.0x40cad7.11
mov eax, dword [esi + 0xc]
add eax, 0x11
push eax
push esi
push ebx
call fcn.0040f1b0
add esp, 0xc
jmp case.0x40cad7.11
test cl, 7
jne 0x40cbcc
and cl, 0xc1
and al, 0x18
or cl, al
or cl, 1
mov byte [esi + 5], cl
jmp 0x40cbef
movzx eax, cl
and cl, 0xf8
and eax, 7
or cl, byte [eax + 0x466188]
mov byte [esi + 5], cl
and cl, 7
cmp cl, 3
jne 0x40cbef
cmp dword [ebp], 0
jne 0x40cbef
mov dword [ebp], esi
mov edi, esi
mov esi, dword [edi]
mov al, byte [esp + 0x18]
cmp esi, dword [esp + 0x20]
jne 0x40cab0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
ret