joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x109b1128
nop
nop
nop
nop
test eax, eax
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x2fa494f
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0xa3f45b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0a2e5e8
jmp 0xa3f495
mov word [esp + 1], cx
mov byte [esp + 2], bl
push word [esp + 3]
ja 0xa3f51d
push ax
lea esp, [esp + 4]
mov dword [esp + 0x28], edi
jmp 0xa3f588
pushfd
jmp 0xa3f12a
mov al, 0x91
cpuid
sub esp, 2
jmp 0xa3f51f
push ax
lea esp, [esp + 4]
mov dword [esp + 0x28], edi
call fcn.00a3f4dd
inc ecx
push dword [esp + 2]
lea ebx, [ebx - 0x39]
call fcn.00a3f4fb
rol byte [edi - 0x29], 1
mov dl, 0x41
invalid
jmp 0xa3f4b5
jle 0xa3f545
mov bl, al
lea esp, [esp + 2]
jmp 0xa3f54b
mov edi, dword [esp + 0x2c]
mov bh, 0xd2
xchg dx, ax
rdtsc
mov eax, ecx
jmp 0xa3f563
mov bl, al
lea esp, [esp + 2]
jmp 0xa3f529
sub esp, 0xc0
jmp 0xa3f5a7
lea ebp, [esp]
lea ecx, [esi*4]
setae ch
not ebx
jmp 0xa3f54d
lea esp, [esp + 0x28]
jmp 0xa3f48f
rdtsc
jmp 0xa3f5b6
mov esi, esp
sub esp, 0x10
ja 0xa3f591
rdtsc
jmp 0xa3f68c
sub esp, 3
mov ebx, 0xf52d9ff2
lea esp, [esp + 3]
mov ecx, edi
jmp 0xa3f62b
mov bx, 0x98aa
setnp al
jmp 0xa3f5fb
not bx
bswap eax
setnp dl
lea esp, [esp + 1]
jmp 0xa3f606
dec ebx
sub esp, 0x11
mov word [esp + 2], ax
jmp 0xa3f5e5
lea esp, [esp + 0x10]
sub edi, 0x38fc3c8f
bsr dx, bp
jns 0xa3f656
js 0xa3f640
fistp word [ebp - 0x33]
xchg esp, eax
shr dword [bx], cl
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 0
cmp eax, ebx
push ebx
lds esi, ss:[edx + 6]
stc
jns 0xa3f5c6
mov bx, 0x98aa
setnp al
dec ebx
sub esp, 0x11
mov word [esp + 2], ax
jmp 0xa3f5e5
not bx
jmp 0xa3f659
not bx
call 0xa3f675
call fcn.00a3f6b3
mov dword [edx + eax*4], ecx
in eax, 0x14
rcl byte [ecx]
cdq
or dword [eax - 0x65], ebp
sub bh, byte [eax + 0x5b]
mov dl, 0xad
mov esp, 0x8afe8a8f
clc
dec dh
jge 0xa3f65e
jl 0xa3f65e
pop ds
xchg esp, eax
or ch, byte [ebp - 0x64]
pop ebp
mov eax, dword [ecx]
xchg ecx, eax
lock add edi, dword [esi + reloc.WINMM.dll_midiStreamOut]
sub esp, 3
mov ebx, 0xf52d9ff2
lea esp, [esp + 3]
jmp 0xa3f5c2

Function at 0xa4398a
Capabilities:
Encode data using xor

Disassembly:
push 0xf0a2e5e8
jmp 0xa43950
push eax
call 0xa4382b
popfd
push word [esp + 3]
jl 0xa43844
lea esp, [esp + 2]
mov dword [esp], ecx
push edx
push ebx
jmp 0xa438b4
jmp 0xa4388b
lea esp, [esp + 2]
mov dword [esp], ecx
push edx
jmp 0xa438b3
push ebx
call fcn.00a4391c
pushal
push word [esp + 0x10]
jmp 0xa438f5
pushal
lea esp, [esp + 0x42]
push edi
jmp 0xa439e1
jp 0xa438c5
pushal
lea esp, [esp + 0x42]
jmp 0xa43902
push edi
jmp 0xa439e1
jmp 0xa439a2
not bl
jmp 0xa43970
not bl
bsr esi, ebp
jmp 0xa43973
rcr bx, cl
jo 0xa4395a
mov dh, byte [esp]
jmp 0xa4397c
rdtsc
mov al, 0xc8
dec dh
jnp 0xa43926
jp 0xa439a2
mov dh, byte [esp]
jmp 0xa4397c
bsr esi, ebp
lea esi, [esp]
xchg ecx, edx
xchg al, dh
jmp 0xa43937
sub esp, 0xc0
mov edi, esp
call 0xa4398a
and byte [esi + 0xf], ah
mov ebp, 0x662571d1
bsf eax, edi
mov ecx, 0xd7be1821
jmp fcn.00a439d4
mov ebp, dword [esp + 0x2c]
bswap esi
clc
jl 0xa43928
jge 0xa43930
jmp 0xa439cb
bsf ax, di
mov ecx, 0xd7be1821
pushfd
jmp 0xa43174

Function at 0xa4be61
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp 0xa3190e
Function at 0xa5135e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], esp
jmp 0xa51367
mov ch, bh
mov ecx, 0xd843c8d6
mov esp, edi
mov cx, sp
lea ecx, [eax + ebp]
jmp 0xa51391

Function at 0xa514e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xa51507
mov dl, 0xd9
mov al, bl
rdtsc
lea edx, [ebp*4]

Function at 0x10b77ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xc
mov dword [esp + 9], edi
mov ah, bh
mov esi, ebp
rdtsc
xchg edx, eax
jmp 0x10b77d8
mov di, word [esp + 3]
mov ecx, 0x27f59db1
add ah, ah
bswap edi
xchg word [esp], bp
jmp 0x10b778a
popal
xchg byte [esp + 1], ch
clc
jmp 0x10b77a0
pop dx
mov ebx, 0x12689d65
stc
bswap esi
pop ebp
mov dl, 0x33
jmp 0x10b7829
mov byte [esp + 3], bl
push word [esp + 4]
lea edx, [eax + ebx]
xchg edi, eax
pop word [esp + 0xa]
bt cx, cx
jmp 0x10b77c2
mov ah, byte [esp + 1]
neg ch
pop dx
xchg esi, eax
not dx
add ch, ah
jmp 0x10b783e
xchg word [esp], si
xchg word [esp], si
mov di, word [esp]
bsr edx, ebx
mov byte [esp], dh
bswap ebp
jmp 0x10b77f0
lea ebx, [ebp - 0x17]
mov edx, dword [esp + 2]
mov di, word [esp + 3]
pop dword [esp]
lea eax, [ebx + ebp]
pop ebp
jmp 0x10b7806
not dx
xchg bh, dh
not bx
lea ebx, reloc.WINMM.dll_midiStreamOut
lea ecx, [edi + ebp]
rdtsc
jmp 0x10b78d3
xchg dl, dh
xchg ecx, esi
call fcn.010b787e
Function at 0x10b7eba
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc edi, esp
lea esp, [esp + 0xc]
lea ebx, reloc.WINMM.dll_midiStreamOut
jmp 0x10b7f40
push ecx
mov esi, edi
bsf dx, dx
push dword [esp + 4]
cmc
mov word [esp + 1], sp
jmp 0x10b7edb
mov byte [esp + 1], cl
mov eax, dword [esp]
bsr ecx, ebx
push word [esp]
xchg ebx, esi
cpuid
jmp 0x10b7ef8

Function at 0x10b851a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
lea esp, [esp + 0xb]
mov bx, word [esp + 7]
rdtsc
pop word [esp + 3]
setg ch
jmp 0x10b8461
push ax
pop word [esp + 6]
mov edx, dword [esp + 0x12]
xchg dword [esp + 1], ebp
jmp 0x10b847f

Function at 0x10b87da
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pop word [esp + 1]
push word [esp + 2]
pop word [esp + 1]
jmp 0x10b87f5
pushfd
jmp 0x10b87c4
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
jmp 0x10b8808
push dword [esp + 1]
lea esp, [esp + 2]
mov dword [esp + 0x40], esi
pushfd
pushal
pop dword [esp]
jmp 0x10b87dd
mov eax, dword fs:[0x30]
jmp 0x10b884f
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x10b8839
Function at 0x1001529
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x10015a0
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001588
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x1001590
push dword [ebp - 4]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10017cd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret
cmp dword [ebp - 8], 0xd2af9
sete bl
jmp 0x100157f

Function at 0x1001630
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 1], 1
je 0x1001667
push 0x10017c0
push dword [ebp + 8]
call fcn.010015ca
test eax, eax
pop ecx
pop ecx
jne 0x10017dc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 8]
push eax
mov edi, 0x20019
push edi
push ebx
push 0x1001730
push 0x80000001
call esi
test eax, eax
jne 0x10016d1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x100178c
push dword [ebp - 8]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10016c0
cmp dword [ebp - 0x10], 4
jne 0x10016c0
cmp dword [ebp - 0x14], 1
je 0x10017e3
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], bl
mov dword [ebp - 8], ebx
je 0x1001723
lea eax, [ebp - 8]
push eax
push edi
push ebx
push 0x100175c
push 0x80000002
call esi
test eax, eax
jne 0x1001723
push 4
pop esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x10017a8
push dword [ebp - 8]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100171a
cmp dword [ebp - 0x10], esi
jne 0x100171a
cmp dword [ebp - 0x14], 1
jne 0x100171a
mov byte [ebp - 1], bl
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 4
xor al, al
jmp 0x1001728
mov byte [ebp - 1], bl
jmp 0x10016c0

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
lea ecx, [esp]
mov dword [esp], 0x168
mov dword [esp + 4], 0
call fcn.00401070
push 1
push 0
push 0
push str.https:__get.saltyram.com_ru__apkpop0partnerp40823p3300306p4612
push 0x402108
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp]
mov dword [esp], 5
mov dword [esp + 4], 0
call fcn.00401070
push 0x1040
push str.MELLSTROY_PROMO
push 0x4021c0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100c3a50
Capabilities:
Encode data using xor

Disassembly:
fsub st(4)
mov bl, 0xfc
adc al, 0x20
mov ebp, 0xe4d43f5b
mov dl, 0xf2
fidivr word [ebx - 0x35]
sbb al, 0x86
push edi
fmul dword [eax]
add byte [eax], al
add byte [eax], al
add byte [ecx - 0x73], bh
lea esp, [esp + 4]
lea esp, [esp + 4]
push ecx
push edx
call fcn.100be1d9
jns 0x100c3acd
aaa
dec esi
lds ecx, [edx]
aad 0x48
lodsd eax, dword [esi]
test eax, 0xc0b1fa9a
add eax, dword [eax + 0x23]
adc byte [edx + 0x27f3cd56], dh
loopne 0x100c3a35
adc al, 0xb2
add byte [edi], bl
add eax, 0xf4
add bl, ah
add byte [eax], al
jg 0x100c3b39
xchg edi, eax
inc esi
test eax, 0x53525119
push eax
push esi
pushfd
jmp 0x100f3c55
mov bl, 0xc0
pop ds
xor byte [edi + 0x4e], ch
lds ebp, [ecx]
sbb ebx, ecx
adc al, 0xb2
mov esi, 0x2d8ff3c4
mov edx, 0x3490bd11
mov ah, 0xc0
add ebp, dword [edi + 0x2de5ddb9]
pop ecx
jae 0x100c3b39
scasd eax, dword es:[edi]
sub bh, byte [edi]
lds ebp, [0xc53f2aaf]
add edi, dword [eax - 0x78]
dec esp
lds esp, [edi]
push ebp
sub byte [edi], bh
lds ebp, [ecx]
scasd eax, dword es:[edi]
sub bh, byte [edi]
lds eax, [edx]
scasd eax, dword es:[edi]
sub bh, byte [edi]
lds ebp, [ebx]
scasd eax, dword es:[edi]
sub bh, byte [edi]
lds ecx, [esp + ebx]
cli
dec esp
lds ebx, [edi]
call 0x130ca88a
add eax, edi
ret
push ebp
call fcn.100e1598
ljmp 0xc5fc

Function at 0x100f718f
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
push edx
push ebx
push eax
push esi
call fcn.100081a6
jns 0x100f7205
push 0x1b02c54b
fst dword [edx + esi*4]
pop ebp
invalid
invalid

Function at 0x101def2d
Capabilities:
Encode data using xor

Disassembly:
push eax
adc edx, esp
invalid
lea esp, [esp + 4]
push eax
push esi
pushfd
call fcn.102c190b
jno 0x101deec4
sub dword [esi], ecx
add byte [ecx - 0x77], dh
push es
pop ecx
lds esi, [ebx]
mov edx, 0xc1b22617
mov dl, 0xc1
adc dl, ah
out dx, eax
xor ch, byte [edi + 0x2c]
mov ebp, 0xd9273ad1
jnp 0x101def36
cmp ah, byte [edi]
fnstcw word [ebx - 0x1b]
sub dh, ch
sub byte [ecx - 0x42], bh
push ds
mov dl, 0x7e
out 0xe1, eax
pop es
jecxz 0x101def4c
mov dl, 0x47
mov ebx, 0
jnp 0x101def78
sbb dl, byte [eax + 0x2ab58cae]
cmp ah, 0xf8
jecxz 0x101defa2
insd dword es:[edi], dx
cmpsb byte [esi], byte es:[edi]
push edi
push ebp
je 0x101def36
adc ebp, dword [esi]
and dh, byte [edx - 0x701e5530]
loopne 0x101def42
push ds
mov dl, 0x19
pop edi
bnd retf
cmp ebp, eax
pop ecx
lds ebx, [0xc559e83b]
paddusw mm2, qword [ebp + 0x4a05c560]
invalid
Function at 0x10299eb1
Capabilities:
Encode data using xor

Disassembly:
add eax, 0xbc0c13a
rol eax, 0xb
fnstenv [ebx]
mov esi, 0x3a053bc0
rol eax, 0x1e
insb byte es:[edi], dx
dec ebp
ret 0x39c0
push eax
call fcn.1023944e
je 0x101f0547
mov cl, 0x64
shl byte [ecx], 0x89
push es
pop ecx
lds ebx, [eax]
pushfd
jecxz 0x101f05bb
mov dl, 0x6d
cli
loopne 0x101f0609
invalid
scasb al, byte es:[edi]
cmp eax, 0xf71ac1bf
clc
and dword [edx + 0x45c3837f], esi
dec esi
into
test eax, 0xe11d3be9
arpl word [ecx + 0x2a44f22f], bp
ret
jg 0x101f0549
ret
jae 0x101f05bc
push ebx
mov byte [ecx - 0x3d], ch
inc ebp
dec esi
into
test eax, 0xe12ac68f
pop esi
sub ah, cl
loope 0x101f05c4
int 0x17
pop ss
mov dl, 0xa
cli
loopne 0x101f05f5
or byte [eax], dh
and ecx, esp
jl 0x101f05f2
mov ebp, 0x886a1ec0
std
clc
push ds
js 0x101f0669
daa
out dx, al
push ds
cmp bl, byte [edx]
mul dword [ebx - 0x3a4bb13]
clc
push ds
push esi
or bl, al
rcr byte [esi], 0x79
mov esi, 0xe103b21e
loopne 0x101f0657
jns 0x101f05e8
push ds
mov dl, 0x9a
xor al, 0xf1
dec ebx
dec ecx
imul byte [ecx]
mov dl, 0xbc
adc eax, 0x3726bfe1
daa
mov dl, 0xcd
inc edi
int1
mov bl, 0xbc
and eax, dword [ecx + 0x1a3668c3]
movsb byte es:[edi], byte [esi]
mov ah, 0x77
popfd
pop ebx
lds ebx, [esi]
cld
out 0xa8, al
ljmp 0xe95f
jmp 0x4d89c9e9
stosd dword es:[edi], eax
invalid
lea esp, [esp + 4]
push edx
push ebx
jmp 0x101f0581
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4026e0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x4027d1
test edx, edx
je 0x4027d1
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x40272a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x402731
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x402710
jmp 0x402733
mov esi, 0x1505
jmp 0x402733
mov esi, ecx
mov dword [esp + 4], edx
mov edx, dword [esp]
mov ebx, dword [edx + 0x20]
mov ebp, ebx
sub ebp, 1
jb 0x4027d1
and ebp, esi
mov eax, ebx
xor eax, 0xfffffffe
mov ecx, ebx
and ecx, 0xfffffffe
lea eax, [eax + ecx*2]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [edx + 4]
mov dword [esp + 0xc], eax
jmp 0x402774
inc ebp
dec ebx
je 0x4027cf
mov eax, ebp
and eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edi, dword [ecx + eax*4]
cmp edi, 0xffffffff
je 0x4027cf
mov eax, dword [edx + 8]
cmp dword [eax + edi*4], esi
jne 0x402770
mov eax, dword [edx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00408f50
mov edx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402770
push dword [esp + 0x28]
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00408f70
mov edx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402770
mov eax, dword [edx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x4027d1
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402c50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x402d4a
mov esi, edx
test edx, edx
je 0x402d4a
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x402d4a
push esi
call fcn.00408f50
add esp, 4
test eax, eax
je 0x402caa
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402cb1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402c90
jmp 0x402cb3
mov ebp, 0x1505
jmp 0x402cb3
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov ebx, dword [ecx + 0x20]
mov esi, ebx
sub esi, 1
jae 0x402d52
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x402d0c
call fcn.00402e70
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x402d4a
push ecx
call fcn.00408f50
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov ebx, dword [ecx + 0x20]
mov esi, ebx
sub esi, 1
jae 0x402de2
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and esi, ebp
mov eax, ebx
xor eax, 0xfffffffe
mov edx, ebx
and edx, 0xfffffffe
lea eax, [eax + edx*2]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402d88
inc esi
dec ebx
je 0x402cc8
mov edi, esi
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402ccd
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402d80
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00408f50
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402d80
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00408f70
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402d80
mov eax, 0xffffffff
jmp 0x402d4a
and esi, ebp
mov eax, ebx
xor eax, 0xfffffffe
mov edx, ebx
and edx, 0xfffffffe
lea eax, [eax + edx*2]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402e08
inc esi
dec ebx
je 0x402d07
mov edi, esi
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402d0c
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402e00
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00408f50
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402e00
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00408f70
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402e00
jmp 0x402d0c
Function at 0x403580
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x403716
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40370f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x403610
add ebp, dword [esp]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 8]
mov edx, 0x15b0
je 0x40370f
xor eax, eax
cmp edx, 8
mov dword [esp + 4], esi
jb 0x403698
mov eax, edx
and eax, 0x1ff8
mov dword [esp], eax
xor esi, esi
nop
nop
nop
nop
nop
mov eax, edx
mov edx, esi
movzx esi, byte [ebp + esi]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + edx + 3]
add edi, esi
mov esi, ecx
and esi, edi
xor ecx, edi
movzx ebx, byte [ebp + edx + 4]
add ebx, edi
movzx edi, byte [ebp + edx + 5]
add edi, ebx
add ebx, ecx
lea ecx, [ebx + esi*2]
movzx esi, byte [ebp + edx + 6]
add esi, edi
add ecx, edi
movzx edi, byte [ebp + edx + 7]
add edi, esi
add ecx, esi
add ecx, edi
lea esi, [edx + 8]
add edx, 0xf
cmp edx, eax
mov edx, eax
jb 0x403630
add ebp, esi
mov esi, dword [esp + 4]
mov eax, dword [esp]
mov ebx, edx
sub ebx, eax
mov dword [esp + 8], edx
jbe 0x4035d7
mov esi, eax
not esi
add esi, edx
mov dword [esp + 0xc], esi
mov esi, edx
and esi, 3
mov dword [esp], ebx
mov ebx, ebp
je 0x4036cc
nop
nop
nop
nop
movzx edx, byte [ebx]
add edi, edx
add ecx, edi
inc ebx
inc eax
dec esi
jne 0x4036c0
cmp dword [esp + 0xc], 3
jb 0x4035d0
mov edx, dword [esp + 8]
sub edx, eax
xor eax, eax
nop
movzx esi, byte [ebx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp edx, eax
jne 0x4036e0
jmp 0x4035d0
shl ecx, 0x10
or ecx, edi
jmp 0x40371b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403730
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40379e
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x4037a0
not eax
xor esi, esi
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov edi, eax
and eax, 0xf
mov ebp, ebx
not ebp
or ebp, 0xf
mov ecx, edx
lea edx, [ebx + ebp]
add ebp, ebx
inc ebp
and ebp, eax
add eax, edx
inc eax
mov edx, ecx
mov ecx, dword [esp + 0x18]
add ebp, ebp
sub eax, ebp
shr edi, 4
xor edi, dword [eax*4 + 0x43ca18]
mov eax, edi
shr ebx, 4
and edi, 0xf
xor edi, ebx
shr eax, 4
xor eax, dword [edi*4 + 0x43ca18]
inc esi
cmp edx, esi
jne 0x403750
not eax
jmp 0x4037a0
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409510
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00409640
sub esp, 0x100
mov esi, esp
call fcn.00436de0
test al, 1
jne 0x40952f
jmp 0x409604
call fcn.0042fd30
test al, 1
jne 0x40953d
jmp 0x4095ff
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, 0
setge al
test al, 1
jne 0x409566
jmp 0x4095fd
xor eax, eax
sub esp, 0x24
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, 0
setge al
test al, 1
jne 0x4095c4
jmp 0x4095f5
call fcn.0040a650
test al, 1
jne 0x4095cf
jmp 0x4095f3
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00409620
add esp, 8
call fcn.0040ee30
call fcn.0040c630
jmp 0x4095f3
jmp 0x4095f5
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4095fd
jmp 0x4095ff
call fcn.004377e0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]