joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f330
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x27000]
push edi
jmp 0x49f34a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x49f351
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49f340
mov eax, 1
add ebx, ebx
jne 0x49f363
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x49f374
jne 0x49f393
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49f393
dec eax
add ebx, ebx
jne 0x49f380
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x49f358
add ebx, ebx
jne 0x49f38f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x49f3e5
xor ecx, ecx
sub eax, 3
jb 0x49f3ab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49f41a
sar eax, 1
mov ebp, eax
jmp 0x49f3b6
add ebx, ebx
jne 0x49f3b6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49f384
inc ecx
add ebx, ebx
jne 0x49f3c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49f384
add ebx, ebx
jne 0x49f3d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x49f3c6
jne 0x49f3e2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49f3c6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x49f404
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x49f3f6
jmp 0x49f346
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x49f404
add edi, ecx
jmp 0x49f346
pop esi
mov edi, esi
mov ecx, 0xb0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49f422
cmp byte [edi], 0x43
jne 0x49f422
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x49f427
lea edi, [esi + 0x9d000]
mov eax, dword [edi]
or eax, eax
je 0x49f496
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9f59c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9f644]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x49f454
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9f64c]
or eax, eax
je 0x49f490
mov dword [ebx], eax
add ebx, 4
jmp 0x49f471
call dword [esi + 0x9f648]
mov ebp, dword [esi + 0x9f650]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x49f4ca
sub esp, 0xffffff80
jmp 0x425b6c
Function at 0x442cb0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x3c
mov ecx, dword [esp + 0x40]
call dword [method.QString.utf16___const]
lea edx, [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 0xc], edx
lea edx, [esp + 0x20]
mov dword [esp + 8], edx
lea edx, [esp + 0x18]
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, eax
sub esp, 0x10
xor eax, eax
xor edx, edx
test ecx, ecx
je 0x442cfa
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
shrd eax, edx, 0x14
shr edx, 0x14
add esp, 0x3c
ret
Function at 0x46db70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x46c
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
cmp eax, 0xffffffff
mov esi, eax
mov dword [ebp - 0x45c], eax
je 0x46dcf7
lea edi, [ebp - 0x244]
xor eax, eax
mov ecx, 0x8b
lea ebx, [ebp - 0x444]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x244]
mov dword [esp], esi
mov dword [ebp - 0x244], 0x22c
mov dword [esp + 4], eax
call sub.KERNEL32.dll_Process32FirstW
sub esp, 8
test eax, eax
je 0x46dca3
xor eax, eax
mov ecx, pe_nt_image_headers32
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x220]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.libmemuqt.dll_ConvertToMultiByte_wchar_t_const__char_]
mov eax, dword [ebp + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x46dc80
mov edi, dword [ebp - 0x23c]
mov dword [esp + 4], 0
mov dword [esp], 0x410
mov dword [esp + 8], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x46dc80
mov dword [esp + 4], eax
lea eax, [ebp - 0x448]
mov dword [esp], eax
call fcn.0046da50
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x448]
mov dword [esp], eax
call fcn.004da700
mov ecx, dword [ebp - 0x448]
sub esp, 4
mov edx, 0xffffffff
lock xadd dword [ecx - 4], edx
test edx, edx
jle 0x46dcc3
test eax, eax
je 0x46dce7
mov esi, esi
lea edi, [edi]
lea eax, [ebp - 0x244]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x45c]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32NextW
sub esp, 8
test eax, eax
jne 0x46dbe0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, dword [ebp - 0x45c]
mov dword [esp], eax
call ebx
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [ebp - 0x449]
sub ecx, 0xc
mov dword [ebp - 0x460], eax
mov dword [esp], edx
call fcn.004da5f0
mov eax, dword [ebp - 0x460]
sub esp, 4
test eax, eax
jne 0x46dc80
mov dword [esp], esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
sub esp, 4
jmp 0x46dcab
lea esp, [ebp - 0xc]
xor edi, edi
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x46dd30
Capabilities:
Terminate process

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x46dd72
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
sub esp, 8
test eax, eax
jne 0x46dd80
add esp, 0x18
xor eax, eax
pop ebx
ret
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, 1
add esp, 0x18
pop ebx
ret
Function at 0x4d9080
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.004d90e0
Function at 0x4d9a80
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4d9ab8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4d9aae
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4d9aba
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4d9aa0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x4d9d80
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
sub esp, 8
test eax, eax
mov dword [esp + 0x2c], eax
je 0x4d9ee1
mov edx, dword [esp + 0x3c]
lea eax, [edx*4]
cmp edx, 0x1fc00000
mov edx, 0xffffffff
cmova eax, edx
xor ebx, ebx
mov dword [esp], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov edx, dword [esp + 0x3c]
mov edi, eax
test edx, edx
jle 0x4d9e89
nop
mov eax, dword [esp + 0x2c]
mov ebp, dword [eax + ebx*4]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [esp], eax
mov dword [esp + 0x28], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov ecx, dword [esp + 0x28]
mov esi, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [edi + ebx*4], esi
add ebx, 1
cmp dword [esp + 0x3c], ebx
jg 0x4d9de0
mov eax, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00409740
mov esi, eax
mov eax, dword [esp + 0x3c]
test eax, eax
jle 0x4d9ecd
mov edx, dword [edi + ebx*4]
test edx, edx
je 0x4d9ec4
mov dword [esp], edx
call sub.libstdc_6.dll_operator_delete___void_
add ebx, 1
cmp dword [esp + 0x3c], ebx
jg 0x4d9eb5
mov dword [esp], edi
call sub.libstdc_6.dll_operator_delete___void_
mov eax, esi
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, 0xffffffff
jmp 0x4d9ed7
Function at 0x1598730
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9aa000]
push edi
or ebp, 0xffffffff
jmp 0x1598752
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1598759
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1598748
mov eax, 1
add ebx, ebx
jne 0x159876b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x159877c
jne 0x159879b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x159879b
dec eax
add ebx, ebx
jne 0x1598788
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1598760
add ebx, ebx
jne 0x1598797
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x15987ed
xor ecx, ecx
sub eax, 3
jb 0x15987b3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1598822
sar eax, 1
mov ebp, eax
jmp 0x15987be
add ebx, ebx
jne 0x15987be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x159878c
inc ecx
add ebx, ebx
jne 0x15987cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x159878c
add ebx, ebx
jne 0x15987d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x15987ce
jne 0x15987ea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x15987ce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x159880c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x15987fe
jmp 0x159874e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x159880c
add edi, ecx
jmp 0x159874e
pop esi
mov edi, esi
mov ecx, 0x1db17
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x159882a
cmp byte [edi], 0x6f
jne 0x159882a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x159882f
lea edi, [esi + 0x1164000]
mov eax, dword [edi]
or eax, eax
je 0x15988a7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11bb2dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11bb444]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x159885c
mov ecx, edi
jns 0x159888b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11bb448]
or eax, eax
je 0x15988a1
mov dword [ebx], eax
add ebx, 4
jmp 0x1598879
call dword [esi + 0x11bb450]
mov ebp, dword [esi + 0x11bb44c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x15988db
sub esp, 0xffffff80
jmp 0x8139ea
Function at 0x427a3e
Capabilities:
Clear file content

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 1
push esi
push esi
push edi
push esi
pop ebx
mov dword [ebp - 8], esi
call fcn.0041f2cf
push edx
pop ecx
mov dword [ebp - 0x18], eax
and eax, ecx
add esp, 0x10
mov dword [ebp - 0x14], ecx
cmp eax, 0xffffffff
je 0x427ac6
push 2
push esi
push esi
push edi
call fcn.0041f2cf
push eax
pop ecx
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x427ac6
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub esi, ecx
sbb eax, edx
mov dword [ebp - 4], eax
js 0x427b5d
jg 0x427aa0
or esi, esi
je 0x427b5d
push 0x1000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
or eax, eax
jne 0x427ad2
call fcn.00416b81
mov dword [eax], 0xc
call fcn.00416b81
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push edi
call fcn.00427c1c
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
pop ecx
or eax, eax
jl 0x427afa
jg 0x427af3
cmp esi, 0x1000
jb 0x427afa
mov eax, 0x1000
jmp 0x427afc
push esi
pop eax
push eax
push dword [ebp - 0xc]
push edi
call fcn.0041c714
add esp, 0xc
cmp eax, 0xffffffff
je 0x427b23
cdq
sub esi, eax
mov eax, dword [ebp - 4]
sbb eax, edx
mov dword [ebp - 4], eax
js 0x427b3e
jg 0x427ae5
test esi, esi
je 0x427b3e
jmp 0x427ae5
call fcn.00416b4d
cmp dword [eax], 5
jne 0x427b38
call fcn.00416b81
mov dword [eax], 0xd
or ebx, 0xffffffff
or dword [ebp - 8], ebx
push dword [ebp - 0x10]
push edi
call fcn.00427c1c
pop ecx
pop ecx
push dword [ebp - 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x427bc3
test eax, eax
jg 0x427bcf
jl 0x427b67
or esi, esi
jae 0x427bcf
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0041f2cf
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x427ac6
push edi
call fcn.00424a9e
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
push eax
pop ebx
push edx
pop eax
mov ecx, ebx
and ecx, eax
mov dword [ebp - 8], eax
cmp ecx, 0xffffffff
jne 0x427bcf
call fcn.00416b81
mov dword [eax], 0xd
call fcn.00416b4d
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
and ebx, dword [ebp - 8]
cmp ebx, 0xffffffff
je 0x427ac6
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call fcn.0041f2cf
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x427ac6
xor eax, eax
jmp 0x427acd

Function at 0x401a22
Capabilities:
Hide graphical window

Disassembly:
mov ecx, 0xfffffffe
jmp fcn.0040161c
Function at 0x429c00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1d000]
push edi
or ebp, 0xffffffff
jmp 0x429c22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x429c29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x429c18
mov eax, 1
add ebx, ebx
jne 0x429c3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x429c30
jne 0x429c4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x429c30
xor ecx, ecx
sub eax, 3
jb 0x429c60
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x429cd2
mov ebp, eax
add ebx, ebx
jne 0x429c6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x429c78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x429c9c
inc ecx
add ebx, ebx
jne 0x429c88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x429c7d
jne 0x429c99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x429c7d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x429cbc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x429cad
jmp 0x429c1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x429cbc
add edi, ecx
jmp 0x429c1e
pop esi
mov edi, esi
mov ecx, 0x3f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x429cda
cmp byte [edi], 6
jne 0x429cda
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x429cdf
lea edi, [esi + 0x27000]
mov eax, dword [edi]
or eax, eax
je 0x429d4e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x299b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x29a58]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x429d0c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x29a5c]
or eax, eax
je 0x429d48
mov dword [ebx], eax
add ebx, 4
jmp 0x429d29
call dword [esi + 0x29a60]
popal
jmp 0x40be94
Function at 0x38420770
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
cmp dword [ebp + 0xc], 0
je 0x38420857
mov eax, 0xffffffff
xor esi, esi
jmp 0x3842079c
add esi, 1
cmp dword [ebp + 0xc], esi
je 0x38420853
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx + esi]
mov ebx, eax
xor ebx, ecx
and ebx, 1
shr eax, 1
neg ebx
and ebx, 0xedb88320
xor ebx, eax
mov edi, ecx
shr edi, 1
xor edi, eax
and edi, 1
shr ebx, 1
neg edi
and edi, 0xedb88320
xor edi, ebx
mov eax, ecx
shr eax, 2
xor eax, ebx
and eax, 1
shr edi, 1
neg eax
and eax, 0xedb88320
xor eax, edi
mov ebx, ecx
shr ebx, 3
xor ebx, edi
and ebx, 1
shr eax, 1
neg ebx
and ebx, 0xedb88320
xor ebx, eax
mov edi, ecx
shr edi, 4
xor edi, eax
and edi, 1
shr ebx, 1
neg edi
and edi, 0xedb88320
xor edi, ebx
mov edx, ecx
shr edx, 5
xor edx, ebx
and edx, 1
shr edi, 1
neg edx
and edx, 0xedb88320
xor edx, edi
mov eax, ecx
shr eax, 6
xor eax, edi
and eax, 1
shr edx, 1
neg eax
and eax, 0xedb88320
xor eax, edx
shr ecx, 7
mov edx, eax
and edx, 1
shr eax, 1
cmp ecx, edx
je 0x38420790
xor eax, 0xedb88320
jmp 0x38420790
not eax
jmp 0x38420859
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x38427290
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x384272b3
mov ecx, dword [ebp + 8]
lea eax, [esi - 1]
mov edx, esi
and edx, 3
cmp eax, 3
jae 0x384272ba
mov eax, 0x1505
jmp 0x3842730b
mov eax, 0x1505
jmp 0x38427334
and esi, 0xfffffffc
neg esi
mov eax, 0x1505
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
shl edi, 5
add edi, eax
movzx eax, byte [ecx]
add eax, edi
mov edi, eax
shl edi, 5
add edi, eax
movzx eax, byte [ecx + 1]
add eax, edi
mov edi, eax
shl edi, 5
add edi, eax
movzx eax, byte [ecx + 2]
add eax, edi
mov edi, eax
shl edi, 5
add edi, eax
movzx eax, byte [ecx + 3]
add eax, edi
add ecx, 4
add esi, 4
jne 0x384272d0
test edx, edx
je 0x38427334
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
shl edi, 5
add edi, eax
movzx eax, byte [ecx + esi]
add eax, edi
add esi, 1
cmp edx, esi
jne 0x38427320
pop esi
pop edi
pop ebp
ret

Function at 0x3842a550
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x140
lea esi, [ebp + 8]
mov eax, dword [0x6e46000]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
or eax, dword [ebp + 0x14]
je 0x3842a629
mov ebx, esp
mov ecx, dword [esi + 4]
push eax
sub esp, 0x10
mov eax, esp
mov edx, dword [esi + 8]
mov esi, dword [esi + 0xc]
mov dword [eax + 4], edx
mov dword [eax + 8], esi
lea edx, [ebp - 0x50]
mov dword [eax], edx
mov dword [eax + 0xc], 0x40
mov byte [eax + 0x10], 0
call fcn.38485c70
mov esp, ebx
cmp eax, 0x40
jne 0x3842a617
movzx eax, word [ebp - 0x50]
cmp eax, 0x5a4d
jne 0x3842a617
mov dword [ebp - 0x14c], esp
lea eax, [ebp + 8]
mov esi, dword [eax + 0xc]
mov ecx, dword [eax + 4]
mov ebx, dword [eax + 8]
add ebx, dword [ebp - 0x14]
adc esi, 0
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], esi
mov dword [eax + 4], ebx
lea edx, [ebp - 0x148]
mov dword [eax], edx
mov dword [eax + 0xc], 0xf8
mov byte [eax + 0x10], 0
call fcn.38485c70
mov esp, dword [ebp - 0x14c]
cmp eax, 0xf8
jne 0x3842a617
mov eax, esi
cmp dword [ebp - 0x148], 0x4550
lea esi, [ebp + 8]
jne 0x3842a629
mov dword [edi], ebx
mov dword [edi + 4], eax
jmp 0x3842a636
mov dword [edi + 4], 0
mov dword [edi], 0
lea esi, [ebp + 8]
jmp 0x3842a636
mov dword [edi + 4], 0
mov dword [edi], 0
mov esi, dword [esi]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call 0x387310a4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x3848b810
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0x10]
not eax
cmp dword [ebp + 0xc], 0
je 0x3848b8f3
xor esi, esi
jmp 0x3848b83c
add esi, 1
cmp dword [ebp + 0xc], esi
je 0x3848b8f3
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx + esi]
mov ebx, eax
xor ebx, ecx
and ebx, 1
shr eax, 1
neg ebx
and ebx, 0xedb88320
xor ebx, eax
mov edi, ecx
shr edi, 1
xor edi, eax
and edi, 1
shr ebx, 1
neg edi
and edi, 0xedb88320
xor edi, ebx
mov eax, ecx
shr eax, 2
xor eax, ebx
and eax, 1
shr edi, 1
neg eax
and eax, 0xedb88320
xor eax, edi
mov ebx, ecx
shr ebx, 3
xor ebx, edi
and ebx, 1
shr eax, 1
neg ebx
and ebx, 0xedb88320
xor ebx, eax
mov edi, ecx
shr edi, 4
xor edi, eax
and edi, 1
shr ebx, 1
neg edi
and edi, 0xedb88320
xor edi, ebx
mov edx, ecx
shr edx, 5
xor edx, ebx
and edx, 1
shr edi, 1
neg edx
and edx, 0xedb88320
xor edx, edi
mov eax, ecx
shr eax, 6
xor eax, edi
and eax, 1
shr edx, 1
neg eax
and eax, 0xedb88320
xor eax, edx
shr ecx, 7
mov edx, eax
and edx, 1
shr eax, 1
cmp ecx, edx
je 0x3848b830
xor eax, 0xedb88320
jmp 0x3848b830
not eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x384c5ff0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [esi + 0x100], 0
mov cl, byte [ebp + 0x10]
add cl, al
mov byte [eax + esi], cl
inc eax
cmp eax, 0x100
jb 0x384c6004
xor edi, edi
mov eax, edi
mov bl, byte [edi + esi]
xor edx, edx
div dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
movzx eax, byte [edx + eax]
add al, bl
add byte [esi + 0x100], al
movzx ecx, byte [esi + 0x100]
movzx eax, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov byte [ecx + esi], bl
xor dword [ecx + 0x100ff], eax
add byte [edx - 0x33], dh

Function at 0x384c6050
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, dword [ebp + 0x10]
mov bl, byte [eax + 0x100]
mov cl, byte [eax + 0x101]
test edi, edi
je 0x384c60b1
push esi
lea esp, [esp]
mov esi, dword [ebp + 0xc]
mov cl, byte [esi]
movzx edx, cl
xor cl, bl
mov byte [esi], cl
inc esi
mov bh, byte [edx + eax]
mov dword [ebp + 0xc], esi
lea esi, [edx + eax]
movzx ecx, bl
movzx edx, bh
add edx, ecx
movzx ecx, dl
mov bl, byte [ecx + eax]
mov byte [esi], bl
add bl, bh
mov byte [ecx + eax], bh
sub edi, 1
jne 0x384c6070
pop esi
pop edi
mov byte [eax + 0x101], bh
mov byte [eax + 0x100], bl
pop ebx
pop ebp
ret
pop edi
mov byte [eax + 0x100], bl
mov byte [eax + 0x101], cl
pop ebx
pop ebp
ret

Function at 0x384c60d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
mov bl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
test ecx, ecx
je 0x384c612e
push esi
push edi
mov edi, dword [ebp + 0xc]
nop
xor byte [edi], bl
lea edi, [edi + 1]
movzx esi, byte [edi - 1]
dec ecx
mov dword [ebp + 0x10], ecx
movzx ecx, bl
mov bh, byte [esi + eax]
movzx edx, bh
add edx, ecx
movzx ecx, dl
mov bl, byte [ecx + eax]
mov byte [esi + eax], bl
add bl, bh
mov byte [ecx + eax], bh
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x384c60f0
pop edi
pop esi
mov byte [eax + 0x101], bh
mov eax, 0x101
mov byte [eax + 0x100], bl
mov byte [eax + 0x101], dl
pop ebx
pop ebp
ret