joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035a2
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
mov ebx, ecx
push 0
push ebx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
jne 0x4035f3
mov eax, dword [section..data]
cmp eax, section..data
je 0x403631
test byte [eax + 0x1c], 1
je 0x403631
cmp byte [eax + 0x19], 2
jb 0x403631
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
mov eax, dword [section..data]
push ebx
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.004027bd
jmp 0x403631
lea eax, [esi + esi]
push eax
push 0x40
mov dword [ebp - 4], eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x403638
mov eax, dword [section..data]
cmp eax, section..data
je 0x403631
test byte [eax + 0x1c], 1
je 0x403631
cmp byte [eax + 0x19], 2
jb 0x403631
push dword [ebp - 4]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xb
pop ecx
call fcn.0040281e
xor eax, eax
jmp 0x4036bf
push esi
push edi
push ebx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
mov edx, eax
test edx, edx
jne 0x40367c
mov eax, dword [section..data]
cmp eax, section..data
je 0x4036b1
test byte [eax + 0x1c], 1
je 0x4036b1
cmp byte [eax + 0x19], 2
jb 0x4036b1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
mov eax, dword [section..data]
push ebx
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xc
pop ecx
call fcn.004027bd
jmp 0x4036b1
lea eax, [esi - 1]
cmp edx, eax
je 0x4036bd
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x4036b1
test byte [ecx + 0x1c], 1
je 0x4036b1
cmp byte [ecx + 0x19], 2
jb 0x4036b1
lea eax, [esi - 1]
push eax
push edx
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xd
pop ecx
call fcn.00402846
push edi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
jmp 0x403631
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4036c4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov ecx, 0x401504
mov dword [ebp - 4], edi
call fcn.004035a2
mov esi, eax
mov dword [ebx], esi
test esi, esi
je 0x40374e
mov ecx, edi
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4036ed
sub ecx, edx
lea edx, [esi + 2]
sar ecx, 1
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x4036ff
sub esi, edx
sar esi, 1
lea eax, [esi + ecx]
lea esi, [eax*2 + 4]
push esi
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x403755
mov eax, dword [section..data]
cmp eax, section..data
je 0x40374e
test byte [eax + 0x1c], 1
je 0x40374e
cmp byte [eax + 0x19], 2
jb 0x40374e
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xe
pop ecx
call fcn.0040281e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 4]
shr esi, 1
mov ecx, edi
mov edx, esi
call fcn.004024e0
push 0x401510
mov edx, esi
mov ecx, edi
call fcn.00402515
push dword [ebx]
mov edx, esi
mov ecx, edi
call fcn.00402515
push edi
push 0x401504
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
push edi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
xor eax, eax
inc eax
jmp 0x403750
Function at 0x4044a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push 0x401768
push 0x80000001
mov dword [ebp - 0xc], esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, 0x4018ac
push 4
pop edi
test eax, eax
jne 0x404501
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x4017d8
push 0x80000001
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x404542
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x404d2a
Capabilities:
Query or enumerate registry value
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x40a070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
mov esi, 0x20019
push eax
push esi
xor ebx, ebx
mov edi, 0x80000002
push ebx
push 0x401a00
push edi
mov dword [ebp - 0x21c], ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x404e27
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 4
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
push ebx
push 0x401a64
push dword [ebp - 0x218]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
push dword [ebp - 0x218]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [ebp - 0x21c], ebx
je 0x404e27
lea eax, [ebp - 0x218]
push eax
push esi
push ebx
push 0x401a88
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x404e21
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x224]
push eax
push ebx
push 0x401adc
push dword [ebp - 0x218]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x404e0d
cmp word [ebp - 0x210], bx
jne 0x404e13
mov dword [ebp - 0x21c], ebx
push dword [ebp - 0x218]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x404e27
mov dword [ebp - 0x21c], ebx
push ebx
push 0x401880
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
xor edi, edi
inc edi
test eax, eax
jne 0x404e4b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0xcb
jne 0x404ed3
call fcn.00407b4a
test al, al
je 0x404e7d
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_IsTSAppCompatOn]
test eax, eax
je 0x404e7d
push edi
push edi
push edi
push ebx
push ebx
mov esi, 0x401afc
push esi
call fcn.00403e40
test eax, eax
jne 0x404e7d
push edi
push edi
push edi
push edi
push ebx
push esi
call fcn.00403e40
cmp dword [ebp - 0x21c], ebx
je 0x404ee4
push ebx
push 3
push ebx
push ebx
push ebx
lea eax, [ebp - 0x210]
push eax
call fcn.00403920
test eax, eax
jne 0x404f34
call fcn.00407b4a
xor ebx, ebx
test al, al
push edi
sete bl
xor esi, esi
push esi
push ebx
push esi
push esi
push 0x401600
call fcn.00403e40
test eax, eax
jne 0x404ed3
push edi
push esi
push ebx
push edi
push 0x401574
push 0x401600
call fcn.00403e40
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407f10
leave
ret
call fcn.0040358b
test al, al
jne 0x404e9f
mov byte [ebp - 0x211], bl
call fcn.00407c29
test al, al
je 0x404f13
lea eax, [ebp - 0x211]
push eax
call dword [sym.imp.ext_ms_win_session_winsta_l1_1_3.dll_WinStationIsBoundToCacheTerminal]
test eax, eax
mov al, byte [ebp - 0x211]
je 0x404f15
mov al, bl
test al, al
jne 0x404e9f
call fcn.00407b4a
test al, al
je 0x404e9f
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_ProcesRemoteSessionInitialCommand]
test al, al
jne 0x404e9f
xor eax, eax
jmp 0x404ed5
Function at 0x40535f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push 0x401768
push 0x80000001
mov dword [ebp - 0xc], esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, 0x401bd4
push 4
pop edi
test eax, eax
jne 0x4053b8
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x401768
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x4053f9
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x4017d8
push 0x80000001
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x40543a
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x4017d8
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x40547b
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4068e4
Capabilities:
Check if file exists

Disassembly:
push 0x218
mov eax, 0x408bd3
call fcn.00408afe
mov eax, dword [ebp + 8]
xor edi, edi
push ecx
push ecx
push edi
mov edx, 0x104
mov dword [ebp - 0x224], eax
lea ecx, [ebp - 0x218]
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.004056a0
push 0x401df4
lea ecx, [ebp - 0x218]
call fcn.004055fb
lea eax, [ebp - 0x218]
push eax
push edi
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov esi, eax
mov dword [ebp - 0x21c], esi
mov dword [ebp - 4], edi
test esi, esi
jne 0x406969
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x4069b1
mov ecx, dword [ebp + 4]
mov edx, 0xc9
push 0x401db8
call fcn.004065ac
mov edi, eax
jmp 0x406997
lea edx, [ebp - 0x220]
mov dword [ebp - 0x220], edi
mov ecx, esi
call fcn.004067c8
mov ebx, eax
test ebx, ebx
jns 0x40699f
mov ecx, dword [ebp + 4]
mov edx, 0xcf
push ebx
push 0x401db8
call fcn.0040658f
mov edi, ebx
mov esi, dword [ebp - 0x21c]
jmp 0x4069b1
mov ecx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x220]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4069bf
push esi
call fcn.00406641
mov eax, edi
call fcn.00408ab9
ret 8

Function at 0x406eaf
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x408c1e
call fcn.00408aca
lea ecx, [ebp - 0x14]
call fcn.00407562
xor esi, esi
mov dword [ebp - 4], esi
push 0x5c
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x406f30
add eax, 2
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004075aa
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], esi
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 4
push eax
push esi
push 0x10010
push 0x401ea0
push dword [ebp - 0x10]
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x406f22
mov esi, dword [ebp - 0x18]
cmp dword [ebp - 0x10], eax
jmp 0x406f25
cmp dword [ebp - 0x10], esi
je 0x406f30
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x406f43
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov eax, esi
call fcn.00408aa4
ret
Function at 0x40789e
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x28]
xor ebx, ebx
push eax
push 0x20019
push ebx
push 0x401768
push 0x80000002
mov dword [edi], ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x407979
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push 0x4016d8
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x407970
mov eax, dword [ebp + 0x24]
mov ebx, dword [ebp + 0x18]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x1c]
push ebx
push esi
push 0x401600
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x407967
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x20]
lea eax, [ebp - 0x14]
push eax
push esi
push 0x4016bc
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x407967
mov eax, dword [ebx]
cmp eax, dword [ebp - 0x14]
jne 0x407967
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0x407967
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x407967
mov dword [edi], 1
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x24
Function at 0x407982
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x40a070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
mov dword [ebp - 0x38], edx
mov ecx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp + 0xc]
mov ebx, esi
push edi
mov dword [ebp - 0x2c], eax
mov edi, esi
mov dword [ebp - 0x30], ecx
push esi
push esi
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x28], 7
push ecx
push esi
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edi
push dword [eax + 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0x407a20
lea eax, [ebp - 0x14]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll__o__wtoi
pop ecx
cmp eax, ebx
jle 0x407a30
mov dword [ebp - 0x28], eax
lea ebx, [ebp - 0x14]
lea eax, [ebp - 0x24]
push 7
mov edx, eax
pop ecx
sub ebx, edx
test ecx, ecx
je 0x407a0f
movzx edx, word [ebx + eax]
test dx, dx
je 0x407a0b
mov word [eax], dx
add eax, 2
sub ecx, 1
jne 0x4079f3
test ecx, ecx
jne 0x407a12
sub eax, 2
xor edx, edx
mov word [eax], dx
test ecx, ecx
je 0x407a3e
mov ebx, dword [ebp - 0x28]
jmp 0x407a30
mov ecx, 0x103
cmp eax, ecx
je 0x407a45
cmp eax, 0xea
jne 0x407a63
inc edi
cmp edi, 0xffffffff
jae 0x407a69
mov eax, dword [ebp - 0x2c]
jmp 0x4079b1
mov esi, 0x10a
jmp 0x407a69
test ebx, ebx
je 0x407a67
push dword [ebp - 0x30]
lea eax, [ebp - 0x24]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push esi
push eax
mov eax, dword [ebp - 0x2c]
push dword [eax + 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
jmp 0x407a69
mov esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407f10
leave
ret 8

Function at 0x40806c
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x4080a9
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x4080a2
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x4080ae
add edx, 0x28
cmp edx, esi
jne 0x408093
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x4080ab
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6a195c29
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3d09155d
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4049df
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
movzx eax, si
shr esi, 0x10
mov dword [ebp + 8], eax
xor eax, eax
mov bx, word [ebp + 8]
push edi
mov dword [ebp - 4], esi
mov di, si
mov dword [ebp - 8], 0x40
sub eax, 0x61c88647
movzx edx, ax
mov dword [ebp - 0xc], eax
mov ax, di
shr ax, 5
lea ecx, [edx + esi]
shl esi, 4
xor cx, ax
xor cx, si
add bx, cx
mov word [ebp + 8], bx
mov ax, bx
mov ecx, dword [ebp + 8]
add edx, ecx
shr ax, 5
xor dx, ax
shl ecx, 4
xor dx, cx
add di, dx
sub dword [ebp - 8], 1
mov word [ebp - 4], di
je 0x404a56
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
jmp 0x404a07
mov al, byte [ebp + 8]
pop edi
pop esi
and al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404dc3
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x1505
jmp 0x404dd9
imul eax, eax, 0x21
inc edx
movzx ecx, cl
add eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x404dd0
pop ebp
ret

Function at 0x404de1
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x1505
jmp 0x404df9
imul eax, eax, 0x21
lea edx, [edx + 2]
movzx ecx, cx
add eax, ecx
movzx ecx, word [edx]
test cx, cx
jne 0x404dee
pop ebp
ret

Function at 0x405775
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x20
push esi
call fcn.004058f5
pop ecx
pop ecx
test eax, eax
je 0x40579a
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
xor eax, eax
inc eax
pop esi
pop ebp
ret

Function at 0x405846
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
not ecx
test edx, edx
je 0x405880
push esi
mov esi, dword [ebp + 0xc]
push edi
movzx eax, byte [esi]
dec edx
push 8
xor ecx, eax
inc esi
pop edi
mov eax, ecx
shr ecx, 1
and eax, 1
not eax
inc eax
and eax, 0xedb88320
xor ecx, eax
sub edi, 1
jne 0x405864
test edx, edx
jne 0x40585a
pop edi
pop esi
not ecx
mov eax, ecx
pop ebp
ret

Function at 0x4059d7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4059f9
push edi
mov edi, dword [ebp + 0xc]
mov edx, eax
sub edi, eax
mov cl, byte [edi + edx]
xor byte [edx], cl
inc edx
sub esi, 1
jne 0x4059ed
pop edi
pop esi
pop ebp
ret
Function at 0x4059fc
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
xor esi, esi
push edi
mov eax, esi
mov byte [ebp + eax - 0x104], al
inc eax
cmp eax, 0x100
jb 0x405a0c
mov edi, esi
xor edx, edx
mov bl, byte [ebp + edi - 0x104]
mov eax, edi
movzx ecx, bl
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [edx + eax]
add eax, esi
add ecx, eax
movzx esi, cl
mov al, byte [ebp + esi - 0x104]
mov byte [ebp + edi - 0x104], al
inc edi
mov byte [ebp + esi - 0x104], bl
cmp edi, 0x100
jb 0x405a1d
mov ebx, dword [ebp + 0x14]
xor esi, esi
mov eax, esi
test ebx, ebx
je 0x405ac6
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0x14], ecx
sub edi, ecx

Function at 0x405ac4
Capabilities:
Encode data using xor

Disassembly:
inc eax
movzx ecx, al
mov dword [ebp - 4], ecx
mov dl, byte [ebp + ecx - 0x104]
movzx eax, dl
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x104]
mov byte [ebp + ecx - 0x104], al
mov byte [ebp + esi - 0x104], dl
movzx ecx, byte [ebp + ecx - 0x104]
movzx eax, dl
add ecx, eax
mov eax, dword [ebp + 0x14]
movzx ecx, cl
mov cl, byte [ebp + ecx - 0x104]
xor cl, byte [edi + eax]
mov byte [eax], cl
inc eax
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 4]
sub ebx, 1
jne 0x405a70
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405dcf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 0x397
push ebx
push esi
mov esi, dword [ebp + 8]
xor esi, 0x76c7
shl esi, 0x10
xor esi, dword [ebp + 8]
xor esi, 0xafb9
mov eax, esi
shr eax, 0x15
push edi
cmp eax, ecx
ja 0x405e50
je 0x405e49
sub eax, 0x5f
je 0x405e42
sub eax, 9
je 0x405e3b
sub eax, 0x7b
je 0x405e34
sub eax, 0x100
je 0x405e2d
sub eax, 0x8b
je 0x405e26
sub eax, 0x1f
jne 0x405e76
mov eax, 0x405f7a
jmp 0x405e95
mov eax, 0x405c28
jmp 0x405e95
mov eax, 0x405f41
jmp 0x405e95
mov eax, 0x405cd3
jmp 0x405e95
mov eax, fcn.00405d23
jmp 0x405e95
mov eax, 0x405fb3
jmp 0x405e95
mov eax, 0x405cdf
jmp 0x405e95
sub eax, 0x4db
je 0x405e90
sub eax, 0x170
je 0x405e89
sub eax, 0x3f
je 0x405e82
sub eax, 0x6e
je 0x405e7b
sub eax, 0xca
jne 0x405e76
mov eax, 0x405f08
jmp 0x405e95
mov eax, dword [ebp + 8]
jmp 0x405e95
mov eax, 0x405fec
jmp 0x405e95
mov eax, 0x405c61
jmp 0x405e95
mov eax, 0x405d17
jmp 0x405e95
mov eax, 0x405c9a
call eax
mov edi, eax
test edi, edi
je 0x405eee
mov ecx, dword [edi + 0x3c]
and esi, 0x1fffff
xor ebx, ebx
mov ecx, dword [ecx + edi + 0x78]
add ecx, edi
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
add eax, edi
mov dword [ebp - 8], eax
add edx, edi
mov eax, dword [ecx + 0x1c]
add eax, edi
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp + 8], eax
test eax, eax
je 0x405eee
mov eax, dword [edx + ebx*4]
add eax, edi
push eax
call fcn.00405bae
and eax, 0x1fffff
pop ecx
cmp eax, esi
je 0x405ef7
mov edx, dword [ebp - 4]
inc ebx
cmp ebx, dword [ebp + 8]
jb 0x405ed0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ebx*2]
mov eax, dword [ecx + eax*4]
add eax, edi
jmp 0x405ef0