joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69009fe0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, ecx
sub esp, 0x4c
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
sub esp, 0xc
test eax, eax
je 0x6900a140
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x6900a115
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_LoadResource]
sub esp, 8
mov edi, eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
sub esp, 8
test edi, edi
je 0x6900a1a0
mov ecx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 8], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call ecx
lea ecx, [eax + 1]
sub esp, 0x18
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 2
mov dword [esp], ecx
mov dword [ebp - 0x28], ecx
call dword [sym.imp.ucrtbase.dll_calloc]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
mov esi, eax
mov dword [esp + 8], edi
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
call dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
xor eax, eax
mov ecx, dword [ebp + 0xc]
sub esp, 0x18
mov word [esi + edx*2], ax
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.69009c20
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6900d038], 4
jne 0x6900a170
mov eax, dword fs:[0x18]
mov edi, dword [eax + 0x34]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovg edi, eax
jmp 0x6900a0ff
test byte [0x6900d038], 4
jne 0x6900a1e0
mov eax, dword fs:[0x18]
mov edi, dword [eax + 0x34]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovg edi, eax
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], str.Could_not_find_source_n
mov dword [esp + 8], str.resource_register
mov dword [esp + 4], 0x6900d038
mov dword [esp], 2
call fcn.690084b0
jmp 0x6900a11e
test byte [0x6900d038], 4
je 0x6900a11e
mov dword [esp + 0xc], str.could_not_load_resource_n
mov dword [esp + 8], str.resource_register
mov dword [esp + 4], 0x6900d038
mov dword [esp], 2
call fcn.690084b0
jmp 0x6900a11e
mov dword [esp + 0xc], str.Could_not_load_resource_file_n
mov dword [esp + 8], str.resource_register
mov dword [esp + 4], 0x6900d038
mov dword [esp], 2
call fcn.690084b0
jmp 0x6900a14d
Function at 0x6900c040
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, eax
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x690180c0]
test eax, eax
je 0x6900c0e2
mov dword [esp], ebx
call eax
sub esp, 4
test eax, eax
mov dword [ebx + 8], eax
js 0x6900c0d8
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp], esi
mov dword [esp + 4], edi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x6900c117
mov dword [esp + 4], 0x69017328
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
test eax, eax
mov dword [0x690180c0], eax
jne 0x6900c05d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x6900c0da
Function at 0x404370
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x404473
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x404473
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4043ba
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x4043c1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x4043a0
jmp 0x4043c3
mov esi, 0x1505
jmp 0x4043c3
mov esi, ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x20]
mov ebx, edx
sub ebx, 1
jb 0x404473
and ebx, esi
mov eax, edx
not eax
and eax, 1
mov edi, edx
and edi, 0xfffffffe
sub edi, eax
mov dword [esp + 0xc], edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
xor ebp, ebp
mov dword [esp], edx
mov dword [esp + 4], ebx
jmp 0x404414
mov eax, ebp
and eax, 1
xor ebp, 1
lea ebp, [ebp + eax*2]
cmp ebp, edx
mov ebx, dword [esp + 4]
jae 0x404471
lea eax, [ebx + ebp]
and eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x404471
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x404400
mov eax, dword [ecx + 0xc]
mov ebx, dword [eax + edi*4]
push ebx
call fcn.0040c690
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x404400
push dword [esp + 0x2c]
push ebx
push dword [esp + 0x30]
call fcn.0040c6c0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404400
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x404473
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4049d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
xor eax, eax
cmp dword [esp + 0x18], 0
je 0x404be7
cmp dword [esp + 0x1c], 0
jle 0x404b8e
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
lea esi, [edx + eax]
mov dword [esp], esi
jmp 0x404a28
cmp esi, 0xc0
jne 0x404be5
and ebx, 0x1ff800
cmp ebx, 0xd800
mov esi, dword [esp]
je 0x404be5
add edx, ebp
cmp edx, esi
jae 0x404b8e
movzx ebx, byte [edx]
cmp ebx, 0xf4
ja 0x404be5
mov eax, ebx
and al, 0xfe
cmp al, 0xc0
je 0x404be5
mov eax, ebx
xor eax, 0xffffff3f
mov ecx, ebx
or ecx, 0xc0
and ecx, eax
cmp ecx, 0x80
je 0x404be5
mov ebp, 1
test bl, bl
jns 0x404a1e
mov esi, ebx
and esi, 0xffffffe0
cmp esi, 0xc0
jne 0x404a97
movzx edi, byte [edx + 1]
mov eax, edi
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x404be5
and ebx, 0x1f
shl ebx, 6
mov ebp, 2
jmp 0x404ae0
mov eax, ebx
and eax, 0xfffffff0
cmp eax, 0xe0
jne 0x404ae4
movzx eax, byte [edx + 1]
mov ecx, eax
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x404be5
movzx edi, byte [edx + 2]
mov ecx, edi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x404be5
and ebx, 0xf
shl ebx, 0xc
and eax, 0x3f
shl eax, 6
or ebx, eax
mov ebp, 3
xor ecx, ecx
jmp 0x404b51
mov eax, ebx
and eax, 0xfffffff8
cmp eax, 0xf0
jne 0x404be5
movzx ecx, byte [edx + 1]
mov eax, ecx
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x404be5
movzx eax, byte [edx + 2]
mov edi, eax
and edi, 0xffffffc0
cmp edi, 0x80
jne 0x404be5
movzx edi, byte [edx + 3]
mov ebp, edi
and ebp, 0xffffffc0
cmp ebp, 0x80
jne 0x404be5
and ebx, 7
shl ebx, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebx
and eax, 0x3f
or eax, ecx
shl eax, 6
mov cl, 1
mov ebp, 4
mov ebx, eax
and edi, 0x3f
or edi, ebx
cmp edi, 0x80
jb 0x404be5
cmp edi, 0x7ff
jbe 0x4049fd
cmp edi, 0xffff
ja 0x404b80
test cl, cl
je 0x404a09
jmp 0x404be5
cmp edi, 0x10ffff
jbe 0x404a09
jmp 0x404be5
mov edi, dword [esp + 0x1c]
lea eax, [edi + 1]
push eax
call dword [0x450008]
add esp, 4
test eax, eax
je 0x404be5
mov esi, eax
mov byte [eax + edi], 0
push edi
push dword [esp + 0x1c]
push eax
call fcn.0040c5b0
add esp, 0xc
push 0x10
call dword [0x450008]
add esp, 4
test eax, eax
je 0x404bdb
mov dword [eax], 0
mov dword [eax + 4], 2
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
jmp 0x404be7
push esi
call dword [0x450004]
add esp, 4
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405700
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
cmp dword [esp + 0x2c], 0
je 0x405906
mov esi, dword [esp + 0x30]
test esi, esi
je 0x405906
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x405906
cmp dword [ecx], 0
jne 0x405906
push esi
call fcn.0040c690
add esp, 4
test eax, eax
je 0x40576a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405771
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405750
jmp 0x405773
mov edi, 0x1505
jmp 0x405773
mov edi, ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x20]
mov ebx, edx
sub ebx, 1
jae 0x40583d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x4057ca
call fcn.004059f0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x30]
jne 0x405906
push esi
call fcn.0040c690
add esp, 4
mov edx, esi
lea esi, [esp + 0x14]
mov ecx, dword [esp + 0x2c]
push esi
push edi
push eax
call fcn.00405910
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x30]
push esi
call fcn.0040c690
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x450008]
add esp, 4
test eax, eax
je 0x405901
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c5b0
add esp, 0xc
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x34]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405906
mov dword [esp + 4], eax
and ebx, edi
mov eax, edx
not eax
and eax, 1
mov esi, edx
and esi, 0xfffffffe
sub esi, eax
mov dword [esp + 0x10], esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
xor esi, esi
mov dword [esp], edx
mov dword [esp + 8], ebx
jmp 0x405887
mov eax, esi
and eax, 1
xor esi, 1
lea esi, [esi + eax*2]
cmp esi, edx
mov ebx, dword [esp + 8]
jae 0x405785
lea ebp, [esi + ebx]
and ebp, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov ebx, dword [eax + ebp*4]
cmp ebx, 0xffffffff
je 0x40578a
mov eax, dword [ecx + 8]
cmp dword [eax + ebx*4], edi
jne 0x405870
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + ebx*4]
push ebp
call fcn.0040c690
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x405870
push dword [esp + 4]
push ebp
push dword [esp + 0x38]
call fcn.0040c6c0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x405870
mov eax, dword [ecx + 0x10]
push dword [eax + ebx*4]
call fcn.004047a0
mov edx, dword [esp + 0x30]
add esp, 4
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x34]
mov dword [eax + ebx*4], esi
jmp 0x405832
mov eax, 0xffffffff
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4069e0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406b86
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406b7f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406a75
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406b7f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406aee
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406a90
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406a3d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406b30
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406b10
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406a30
jmp 0x406b3f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406a30
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406b50
jmp 0x406a30
shl ecx, 0x10
or ecx, edi
jmp 0x406b8b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406ba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x406bfc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x406bfe
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
mov eax, dword [eax*4 + 0x44dc50]
mov ebp, eax
and ebp, ebx
add ebx, eax
add ebp, ebp
sub ebx, ebp
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44dc50]
inc esi
cmp edx, esi
jne 0x406bc0
not eax
jmp 0x406bfe
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cd50
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00445c30
test al, al
je 0x40cf3e
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043d4d0
test al, al
je 0x40cf39
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0x460f5c5b
mov dword [esp + 8], 0xb2a466ae
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40cdd6
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040cf50
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40cdb0
mov dword [esp + 4], 0x6a01cf8f
mov dword [esp + 8], 0x6419b681
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40ce26
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040cfe0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40ce00
test esi, esi
je 0x40cec6
mov dword [esp + 4], 0x4f4e4969
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40ce76
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d060
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40ce50
mov dword [esp + 4], 0x9a73dd3
mov dword [esp + 8], 0x63586c2a
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40cec6
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d0f0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40cea0
mov dword [esp + 4], 0x2e2d2c23
mov dword [esp + 8], 0x2a29282f
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40cf26
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d170
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40cf00
call fcn.0040e960
test al, al
je 0x40cf39
call fcn.00411f30
call fcn.00410010
call fcn.00446a90
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp + 4], ecx
mov edi, dword [esp + 0x220]
movzx edx, word [edi]
test dx, dx
je 0x40d29f
lea ecx, [edi + 2]
xor eax, eax
jmp 0x40d27d
add eax, esi
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x40d2a1
movzx ebx, dx
cmp ebx, 0x800
mov edx, 3
sbb edx, 0
mov esi, 1
cmp ebx, 0x80
jb 0x40d270
mov esi, edx
jmp 0x40d270
xor eax, eax
mov ecx, eax
and ecx, 1
xor eax, 1
lea esi, [eax + ecx*2]
push esi
call fcn.0040c580
add esp, 4
mov dword [esp], esi
lea ecx, [eax + esi]
dec ecx
mov esi, eax
mov dword [esp + 8], ecx
cmp eax, ecx
jae 0x40d370
add dword [esp], eax
mov esi, eax
jmp 0x40d2f2
mov byte [esi], bl
mov ebp, 1
add edi, 2
add esi, ebp
cmp esi, dword [esp + 8]
jae 0x40d370
movzx ebx, word [edi]
test bx, bx
je 0x40d370
cmp bx, 0x7f
jbe 0x40d2e0
mov ecx, esi
not ecx
add ecx, dword [esp]
movzx edx, bx
cmp ecx, 2
jb 0x40d340
cmp edx, 0x7ff
ja 0x40d340
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [esi], cl
and bl, 0x3f
or bl, 0x80
mov byte [esi + 1], bl
mov ebp, 2
jmp 0x40d2e7
xor ebp, ebp
cmp ecx, 3
jb 0x40d2e7
mov ecx, edx
shr ecx, 0xc
or cl, 0xe0
mov byte [esi], cl
shr edx, 6
and dl, 0x3f
or dl, 0x80
mov byte [esi + 1], dl
and bl, 0x3f
or bl, 0x80
mov byte [esi + 2], bl
mov ebp, 3
jmp 0x40d2e7
mov edi, dword [esp + 0x228]
mov ebp, dword [esp + 0x224]
mov byte [esi], 0
movzx edx, byte [eax]
lea ecx, [esp + 0xc]
mov ebx, ecx
test dl, dl
je 0x40d3b6
inc eax
lea ebx, [esp + 0xc]
jmp 0x40d3ab
mov byte [ebx], dh
inc ebx
movzx edx, byte [eax]
inc eax
test dl, dl
je 0x40d3b6
mov dh, 0x2f
cmp dl, 0x5c
je 0x40d3a0
mov dh, dl
jmp 0x40d3a0
mov byte [ebx], 0
push 0
push 0
push 0
mov eax, dword [esp + 0x10]
push dword [eax + 8]
add eax, 0x10
push 0
push 0
push edi
push ebp
push ecx
push eax
call fcn.00408bc0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x41cec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa50
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41cee0
sar esi, 1
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x457078]
mov ebx, dword [esp + 0x30]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41cf14
mov eax, 0xffffffff
jmp 0x41cf17
lea eax, [ebx + ebx]
push eax
call fcn.0040c580
add esp, 4
lea ecx, [esp + 0x30]
push ecx
push ebx
mov dword [esp + 0x2c], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x457078]
mov eax, dword [esp + 0x30]
mov ecx, eax
add ecx, 0xd
js 0x41cf4c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c580
add esp, 4
mov esi, eax
mov dword [esp + 0x108], 0xf1c20fb0
mov dword [esp + 0x10c], 0xf567f353
mov dword [esp + 0x110], 0xf916f760
mov dword [esp + 0x114], 0xfd5dfb4e
mov dword [esp + 0x118], 0xe16bff6e
mov dword [esp + 0x11c], 0xe573e34b
mov dword [esp + 0x120], 0xe9e6e74a
mov word [esp + 0x124], 0
mov dword [esp + 0x668], 0
mov eax, dword [esp + 0x668]
cmp eax, 0x1d
ja 0x41d010
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x668]
movzx eax, byte [esp + eax + 0x108]
push dword [esp + 0x668]
push eax
call fcn.004222b0
add esp, 8
mov ecx, dword [esp + 0x668]
mov byte [esp + ecx + 0x108], al
inc dword [esp + 0x668]
mov eax, dword [esp + 0x668]
cmp eax, 0x1e
jb 0x41cfd0
mov eax, dword [esp + 0x24]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x41d041
mov eax, dword [esp + 0x24]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d030
mov word [eax], 0
movzx ecx, word [esp + 0x108]
test cx, cx
je 0x41d071
lea edx, [esp + 0x10a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d060
mov word [eax], 0
lea eax, [esp + 0x548]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0044ab20
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x451de4]
Function at 0x4247d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x4247f0
cmp eax, 0xffffffdd
jge 0x424807
mov eax, 0xffffffff
jmp 0x42480a
add eax, 0x22
push eax
call fcn.0040c580
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0x8331815c
mov dword [esp + 0x1c], 0x87298530
mov dword [esp + 0x20], 0x8b2b893a
mov dword [esp + 0x24], 0x8f2b8d2b
mov dword [esp + 0x28], 0x9336914c
mov dword [esp + 0x2c], 0x97309531
mov dword [esp + 0x30], 0x9b2f9939
mov dword [esp + 0x34], 0x9f2a9d30
mov word [esp + 0x38], 0x6160
mov dword [esp + 0x3a], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x25
ja 0x4248ab
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.004256d0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x26
jb 0x424880
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x4248d1
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4248c0
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x424901
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4248f0
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0xc157c753
mov dword [esp + 0x1c], 0xcd95c35a
mov dword [esp + 0x20], 0xc956cfa3
mov dword [esp + 0x24], 0xf5a5cb54
mov dword [esp + 0x28], 0xf16bf762
mov dword [esp + 0x2c], 0xfd63f39b
mov dword [esp + 0x30], 0xf9abff6a
mov dword [esp + 0x34], 0xe5affbad
mov dword [esp + 0x38], 0xe180e7ce
mov dword [esp + 0x3c], 0xed7fe37f
mov dword [esp + 0x40], 0xe97cef83
mov dword [esp + 0x44], 0x157beba5
mov dword [esp + 0x48], 0x118a1782
mov dword [esp + 0x4c], 0x1d8a137f
mov dword [esp + 0x50], 0x19551f80
mov dword [esp + 0x54], 0x55d1b74
mov dword [esp + 0x58], 0x106072e
mov word [esp + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x45
ja 0x4249e6
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.00425750
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x46
jb 0x4249c0
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x424d10
push ecx
push esi
call fcn.00425bd0
add esp, 0x10
jmp dword [0x4522a0]
Function at 0x42caf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.0042cb10
add esp, 4
test al, al
je 0x42d1d0
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
xor edi, edi
mov esi, 0x20219
mov eax, 1
jmp dword [eax*4 + 0x453314]