joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ccb54
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 8
call fcn.00696a8e
add esp, 4
mov esi, eax
push 0x104
call fcn.00696a8e
add esp, 4
mov ebx, eax
push esi
call fcn.00696af0
add esp, 4
push eax
push edi
push 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
cmp eax, 0
jne 0x5ccbc0
push ebx
call fcn.00696af0
add esp, 4
push eax
push 0
push esi
call fcn.00696c38
add esp, 8
push eax
call sub.SHELL32.dll_SHGetPathFromIDList
mov eax, ebx
push eax
mov eax, dword [eax]
call dword [eax + 0x34]
add esp, 4
push eax
call fcn.005835d0
add esp, 4
jmp 0x5ccbc7
mov eax, 0x6a9f80
jmp 0x5ccbc7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x658fb8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp eax, 0
je 0x658fd8
push 5
push dword [ebx + 0x80]
call sub.USER32.dll_ShowWindow
jmp 0x659017
mov eax, dword [ebx + 0xc]
cmp eax, 0x6abeb0
setne al
movzx eax, al
cmp eax, 0
je 0x658ffa
call fcn.0066685f
push eax
push ebx
mov eax, dword [ebx]
call dword [eax + 0x34]
add esp, 8
cmp eax, 0
je 0x65900a
push dword [ebx + 0xc]
call fcn.00666840
add esp, 4
push 0
push dword [ebx + 0x80]
call sub.USER32.dll_ShowWindow
mov eax, 0
jmp 0x65901e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x664f08
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, 0
push 0x10
call sub.USER32.dll_GetKeyState
and eax, 0x8000
cmp eax, 0
je 0x664f27
or ebx, 1
push 0x11
call sub.USER32.dll_GetKeyState
and eax, 0x8000
cmp eax, 0
je 0x664f3b
or ebx, 2
push 0x12
call sub.USER32.dll_GetKeyState
and eax, 0x8000
cmp eax, 0
je 0x664f4f
or ebx, 4
push 0x5b
call sub.USER32.dll_GetKeyState
and eax, 0x8000
cmp eax, 0
jne 0x664f6c
push 0x5c
call sub.USER32.dll_GetKeyState
and eax, 0x8000
cmp eax, 0
je 0x664f74
or ebx, 8
mov eax, ebx
jmp 0x664f78
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7bd900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x7bd96c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x7bd9b3
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.00812b28
add esp, 8
test eax, eax
jne 0x7bd9b1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x7bd9b5
jmp 0x7bd963
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x7ed870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x854147
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x871f3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.007ec760
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.007ec760
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.007ec760
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.007ed170
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.007ed170
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.007ed170
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x7edb50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x854237
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x871f3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.007ec680
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.007ec680
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.007ec680
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.007ed190
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.007ed190
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.007ed190
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x8023a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x856e80
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x871f3c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x875d14
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], 0x875df8
call fcn.007b7850
mov byte [esp + 0x38], 1
call fcn.00801574
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.007b7920
mov dword [esi], 0x875e1c
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x8333b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x83343d
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0080dfe0
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x833400
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x833422
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x833498
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.00833108
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x833484
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x833498
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x8333c1
pop esi
pop ebx
leave
ret
Function at 0x4f8b10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb6000]
push edi
jmp 0x4f8b2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4f8b31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f8b20
mov eax, 1
add ebx, ebx
jne 0x4f8b43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4f8b54
jne 0x4f8b73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f8b73
dec eax
add ebx, ebx
jne 0x4f8b60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4f8b38
add ebx, ebx
jne 0x4f8b6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4f8bc5
xor ecx, ecx
sub eax, 3
jb 0x4f8b8b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4f8bfa
sar eax, 1
mov ebp, eax
jmp 0x4f8b96
add ebx, ebx
jne 0x4f8b96
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f8b64
inc ecx
add ebx, ebx
jne 0x4f8ba4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f8b64
add ebx, ebx
jne 0x4f8bb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4f8ba6
jne 0x4f8bc2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4f8ba6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4f8be4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4f8bd6
jmp 0x4f8b26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4f8be4
add edi, ecx
jmp 0x4f8b26
pop esi
mov edi, esi
mov ecx, 0x377e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4f8c02
cmp byte [edi], 0x11
jne 0x4f8c02
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4f8c07
lea edi, [esi + 0xf4000]
mov eax, dword [edi]
or eax, eax
je 0x4f8c7f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1401b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x140304]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4f8c34
mov ecx, edi
jns 0x4f8c63
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x140308]
or eax, eax
je 0x4f8c79
mov dword [ebx], eax
add ebx, 4
jmp 0x4f8c51
call dword [esi + 0x140318]
mov ebp, dword [esi + 0x14030c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4f8cb3
sub esp, 0xffffff80
jmp 0x416310
Function at 0x11fdef0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xdba000]
push edi
or ebp, 0xffffffff
jmp 0x11fdf12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x11fdf19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x11fdf08
mov eax, 1
add ebx, ebx
jne 0x11fdf2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x11fdf3c
jne 0x11fdf5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x11fdf5b
dec eax
add ebx, ebx
jne 0x11fdf48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x11fdf20
add ebx, ebx
jne 0x11fdf57
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x11fdfad
xor ecx, ecx
sub eax, 3
jb 0x11fdf73
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x11fdfe2
sar eax, 1
mov ebp, eax
jmp 0x11fdf7e
add ebx, ebx
jne 0x11fdf7e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x11fdf4c
inc ecx
add ebx, ebx
jne 0x11fdf8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x11fdf4c
add ebx, ebx
jne 0x11fdf99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x11fdf8e
jne 0x11fdfaa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x11fdf8e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x11fdfcc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x11fdfbe
jmp 0x11fdf0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x11fdfcc
add edi, ecx
jmp 0x11fdf0e
pop esi
mov edi, esi
mov ecx, 0x305b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x11fdfea
cmp byte [edi], 0xc
jne 0x11fdfea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x11fdfef
lea edi, [esi + 0xdf7000]
mov eax, dword [edi]
or eax, eax
je 0x11fe067
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b57244]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b57370]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x11fe01c
mov ecx, edi
jns 0x11fe04b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b57374]
or eax, eax
je 0x11fe061
mov dword [ebx], eax
add ebx, 4
jmp 0x11fe039
call dword [esi + 0x1b57384]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x11fe098
cmp al, 0xef
ja 0x11fe08b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x11fe06d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x11fe07a
mov ebp, dword [esi + 0x1b57378]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x11fe0cc
sub esp, 0xffffff80
jmp 0x43d8e2
Function at 0x402d10
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test ecx, ecx
je 0x402e13
test edx, edx
je 0x402e13
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp], ecx
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402d5a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x402d61
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x402d40
jmp 0x402d63
mov esi, 0x1505
jmp 0x402d63
mov esi, ecx
mov ecx, dword [esp]
mov ebx, dword [ecx + 0x20]
mov ebp, ebx
sub ebp, 1
jb 0x402e0c
mov dword [esp + 8], edx
and ebp, esi
mov eax, ebx
xor eax, 1
mov edx, ebx
and edx, 0xfffffffe
add edx, edx
sub edx, eax
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 4]
lea edi, [eax + ebp*4]
add edi, 4
not ebp
mov edx, ebx
jmp 0x402da7
add edi, 4
dec ebp
dec edx
je 0x402e0a
mov eax, dword [esp + 0x10]
or eax, ebp
mov ebx, dword [edi + eax*4]
cmp ebx, 0xffffffff
je 0x402e0a
mov eax, dword [ecx + 8]
cmp dword [eax + ebx*4], esi
jne 0x402da0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebx*4]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 8], edx
call fcn.00409550
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402da0
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00409570
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402da0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebx*4]
jmp 0x402e0c
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403c20
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x403dc6
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x403dbf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x403cb0
add ebp, dword [esp + 0x10]
mov esi, dword [esp]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 4]
mov ebx, 0x15b0
je 0x403dbf
mov dword [esp], esi
xor edx, edx
cmp ebx, 8
jb 0x403d1a
xor eax, eax
nop
nop
nop
nop
movzx edx, byte [ebp]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebp + 7]
add edi, edx
add ecx, edi
mov esi, eax
and esi, 8
xor eax, 8
lea edx, [eax + esi*2]
add ebp, 8
lea esi, [eax + esi*2]
add esi, 7
mov eax, edx
cmp esi, ebx
jb 0x403cc0
mov eax, edx
sub eax, ebx
mov dword [esp + 4], ebx
jae 0x403c74
sub ebx, edx
mov dword [esp + 0x10], ebx
and ebx, 3
mov dword [esp + 8], ebx
je 0x403d70
mov dword [esp + 0xc], eax
neg dword [esp + 8]
xor esi, esi
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec esi
cmp dword [esp + 8], esi
jne 0x403d50
sub edx, esi
mov eax, dword [esp + 0xc]
cmp eax, 0xfffffffc
ja 0x403c70
jmp 0x403d7b
mov ebx, ebp
cmp eax, 0xfffffffc
ja 0x403c70
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x403d90
jmp 0x403c70
shl ecx, 0x10
or ecx, edi
jmp 0x403dcb
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x403e53
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
lea eax, [esi + esi]
not eax
add eax, esi
test edx, edx
je 0x403e4f
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ecx + esi]
mov ebx, eax
mov edi, edx
and edi, 0xf
mov ebp, edi
and ebp, eax
and eax, 0xf
add eax, edi
add ebp, ebp
sub eax, ebp
shr ebx, 4
xor ebx, dword [eax*4 + 0x43a80c]
mov eax, ebx
and ebx, 0xf
shr edx, 4
xor edx, ebx
shr eax, 4
xor eax, dword [edx*4 + 0x43a80c]
mov edx, dword [esp + 0x1c]
inc esi
cmp edx, esi
jne 0x403e10
not eax
jmp 0x403e55
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40e860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x140
mov word [esp + 0x48], 0x2b81
mov dword [esp + 0x4a], 0
mov byte [esp + 0x4e], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x40e8d9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x48]
add eax, 0x5ed11487
xor eax, ecx
mov dword [esp + 0xb4], eax
mov eax, dword [esp + 0xb4]
add al, 0x5d
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x48], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 7
jb 0x40e8a0
lea esi, [esp + 0x48]
push esi
push dword [ebp + 8]
call fcn.00402ef0
add esp, 8
mov edi, eax
xor ecx, ecx
test eax, eax
sete cl
xor ebx, ebx
xor eax, eax
jmp dword [ecx*4 + 0x43e3f0]
Function at 0x4135f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x413610
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x413630
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x413650
mov eax, 0xffffffff
jmp 0x413659
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.004092e0
add esp, 4
movzx ecx, word [esi]
mov ebx, eax
test cx, cx
je 0x413691
add esi, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x413680
mov word [ebx], 0x5c
add ebx, 2
movzx ecx, word [ebp]
test cx, cx
je 0x4136c1
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4136b0
mov word [ebx], 0
lea ecx, [esp + 8]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x24], eax
push eax
call fcn.00438720
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43e890]