joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a229a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
bsf dx, bp
pop dword [esp]
mov dx, cx
jmp 0x6a22e6
mov byte [esp + 0xc], dl
mov eax, dword [esp + 2]
add esp, 0xf
pop word [esp]
jmp 0x6a235a
mov word [esp], dx
mov ebx, ecx
mov dx, si
inc al
dec dl
sub esp, 0x1c
jmp 0x6a22d0
mov ebx, dword [esp]
lea eax, [ebx*4]
rdtsc
bsr edx, ebp
setle bh
call fcn.006a22f8
lea esp, [esp + 0xc]
bsr ebx, edx
neg dx
not ebx
mov dx, si
mov word [esp], sp
jmp 0x6a2320

Function at 0x6a22f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 6]
jmp 0x6a2303
xchg dword [esp + 2], ebx
push word [esp + 1]
xor ebx, 0x5380af93
call fcn.006a2337
loopne 0x6a2390
adc eax, esp
or dword [ebp + reloc.KERNEL32.dll_TerminateProcess], ebx
and al, 0x8d
add al, 0x9d
add byte [eax], al
add byte [eax], al
mov ebp, 0xb51c8dc0
add byte [eax], al
add byte [eax], al
Function at 0x6a260d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
mov dword [esp + 1], edi
pop word [esp + 5]
mov edx, dword [esp + 7]
jmp 0x6a25d2
mov word [esp + 3], si
rdtsc
xchg al, dh
add esp, 0x15
mov ebx, ebp
push esp
jmp 0x6a2589
mov word [esp + 0xf], cx
mov al, byte [esp + 0x12]
push word [esp + 5]
bsf ebx, esp
mov byte [esp + 0xe], ch
mov ah, byte [esp + 0xe]
jmp 0x6a259f
mov bx, word [esp + 3]
mov ax, word [esp + 1]
xchg dh, al
mov ebx, edi
call fcn.006a260d
mov dword [reloc.KERNEL32.dll_TerminateProcess], eax
ret
lea edx, reloc.KERNEL32.dll_TerminateProcess
pushal
mov edx, dword [esp + 0x26]
mov ax, word [esp + 0x22]
lea esp, [esp + 0x18]
lea ebx, [ebx + ebx]
and cl, byte [ebp - 0x72e7db9c]
sbb al, 0x1b
jmp 0x6a25b7
push dword [esp + 0xa]
call fcn.006a2696
jb 0x6a2603
jnp 0x6a2638
in eax, dx
inc edx
cwde
or al, 0x82
in eax, 0x14
mov al, byte [0x6809990e]
wait
xor byte [eax - 0x73], bh
lea ebx, [ecx + edx]
mov dword [esp + 4], eax
jmp 0x6a25f4
clc
lea ebx, [edi*4]
neg bl
jmp 0x6a267d
bsf edx, eax
push word [esp + 6]
mov ax, word [esp + 0xa]
xchg byte [esp + 0xb], bl
jmp 0x6a2734
pop word [esp + 9]
stc
lea esp, [esp + 0xb]
lea ebx, [ebp*4]
lea ebx, [esp + 0x3d]
mov dx, word [esp + 1]
call fcn.006a26c0
lea eax, reloc.KERNEL32.dll_TerminateProcess
mov word [esp], si
push edi
pop dword [esp + 8]
mov byte [esp + 0xd], bl
pop ax
jmp 0x6a27a1
seto bh
mov byte [esp + 2], ah
pop ax
rdtsc
rcr ax, 5
pushfd
jmp 0x6a2782

Function at 0x6a2963
Capabilities:
Parse pe header

Disassembly:
pop word [esp]
pushal
mov dword [esp + 0x10], ebx
jmp 0x6a294d

Function at 0x6a296e
Capabilities:
Parse pe header

Disassembly:
push word [esp + 3]
push dword [esp + 1]
push dword [esp + 3]
jmp 0x6a2a07
push dword [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0x64], esi
call fcn.006a29c7

Function at 0x6a29c7
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 1]
mov dword [esp + 0x60], edi
lea esp, [esp + 0x60]
jmp 0x6a29ec
push word [esp]
mov word [esp + 1], cx
lea esp, [esp + 5]
jmp 0x6a29b1
mov eax, dword [eax + 0xc]
jmp 0x6a2a49
mov eax, dword fs:[0x30]
jmp 0x6a29d6
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]

Function at 0x6a35fb
Capabilities:
Execute anti-debugging instructions

Disassembly:
ret 0x8766
setnp dh
setno dh
call fcn.006a2137
rcr ax, cl
add esp, 5
call fcn.006a21f7
push cs
xchg ebx, eax
add esp, dword [esi - 0x6b]
jne 0x6a2147
add eax, eax
cmp dword [edx], reloc.KERNEL32.dll_TerminateProcess
popfd
mov esi, 0x89000028
inc esp
and al, 3
shr edx, 0x11
bswap edx
mov dword [esp + 0x19], ebx
mov dx, sp
jmp 0x6a219f
dec eax
rdtsc
push dword [esp + 6]
std
mov bl, dh
pop word [esp + 0xa]
jmp 0x6a2194
lea esp, [esp + 7]
mov dh, ah
lea eax, [ebx*4]
pop word [esp + 4]
mov ax, 0x77ee
bswap edx
jmp 0x6a2231
push dword [esp + 5]
bsr eax, eax
lea ebx, [esi*4]
mov bl, byte [esp + 6]
mov dword [esp + 0xc], edi
push dword [esp + 0xf]
jmp 0x6a22b3
xchg dword [esp + 3], edx
push dword [esp + 0xb]
push di
cld
lea eax, [ecx + esi]
mov bx, word [esp + 8]
jmp 0x6a238b
pop dword [esp + 6]
rdtsc
xchg bl, dh
lea ebx, [ecx + ebp]
neg edx
jmp 0x6a2e7d
Function at 0x415df0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
or ebp, 0xffffffff
jmp 0x415e12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x415e19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x415e08
mov eax, 1
add ebx, ebx
jne 0x415e2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x415e20
jne 0x415e3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415e20
xor ecx, ecx
sub eax, 3
jb 0x415e50
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x415ec2
mov ebp, eax
add ebx, ebx
jne 0x415e5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x415e68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x415e8c
inc ecx
add ebx, ebx
jne 0x415e78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x415e6d
jne 0x415e89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415e6d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x415eac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x415e9d
jmp 0x415e0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x415eac
add edi, ecx
jmp 0x415e0e
pop esi
mov edi, esi
mov ecx, 0x353
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x415eca
cmp byte [edi], 5
jne 0x415eca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x415ecf
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x415f3e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16790]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x167f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x415efc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x167f8]
or eax, eax
je 0x415f38
mov dword [ebx], eax
add ebx, 4
jmp 0x415f19
call dword [esi + 0x167fc]
popal
jmp section.UPX0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402590
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
xor eax, eax
test ecx, ecx
je 0x402678
test edx, edx
je 0x402678
mov ebp, dword [esp + 0x2c]
test ebp, ebp
mov dword [esp], ecx
mov esi, 0x1505
je 0x4025dd
xor edi, edi
nop
nop
nop
nop
nop
movzx ecx, byte [edx + edi]
test ecx, ecx
je 0x4025dd
mov ebx, esi
shl ebx, 5
add ebx, esi
mov esi, ebx
and esi, ecx
xor ebx, ecx
lea esi, [ebx + esi*2]
inc edi
cmp ebp, edi
jne 0x4025c0
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea edi, [ebp - 1]
mov ebx, ebp
sub ebx, 1
jb 0x402678
mov dword [esp + 0x14], ebx
mov dword [esp + 4], edx
mov dword [esp + 0xc], esi
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov ebx, edi
not ebx
inc edi
jmp 0x402615
dec ebx
inc edi
dec ebp
je 0x402676
mov eax, dword [esp + 0x14]
or eax, ebx
add eax, edi
mov edx, dword [esp + 0x10]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x402676
mov eax, dword [ecx + 8]
mov edx, dword [esp + 0xc]
cmp dword [eax + esi*4], edx
jne 0x402610
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 8], eax
push eax
call fcn.00408d70
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x402610
push dword [esp + 0x2c]
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00408d90
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402610
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
jmp 0x402678
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403460
Capabilities:
Compute adler32 checksum
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x403616
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0x40360f
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0x4034f8
add ebp, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov eax, edi
mov esi, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov eax, ecx
mul esi
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov edx, dword [esp + 4]
mov eax, edx
xor eax, ebx
not edx
and edx, ebx
add edx, edx
mov ebx, edx
mov esi, 0x15b0
sub ebx, eax
je 0x40360f
xor edx, edx
cmp esi, 8
mov dword [esp + 4], esi
jb 0x40356d
and esi, 0x1ff8
mov dword [esp], esi
xor edx, edx
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 6]
add edx, esi
mov esi, dword [esp + 4]
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, esi
jb 0x403510
add ebp, edx
mov edx, dword [esp]
mov eax, esi
sub eax, edx
jbe 0x4034b8
mov dword [esp], edx
not edx
add edx, esi
mov dword [esp + 8], edx
and esi, 3
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
je 0x4035c3
neg esi
xor edx, edx
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0x4035a0
mov eax, dword [esp]
sub eax, edx
mov edx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x4034b0
jmp 0x4035d5
mov ebx, ebp
mov eax, dword [esp + 8]
mov edx, dword [esp]
cmp eax, 3
jb 0x4034b0
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x4035e0
jmp 0x4034b0
shl ecx, 0x10
or ecx, edi
jmp 0x40361b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403630
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x403682
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
lea eax, [esi + esi]
not eax
add eax, esi
test edx, edx
je 0x40367e
xor esi, esi
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43aa18]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43aa18]
inc esi
cmp edx, esi
jne 0x403650
not eax
jmp 0x403684
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x4092f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00409380
sub esp, 0x100
mov esi, esp
call fcn.00435360
test al, 1
jne 0x40930c
jmp 0x40934c
call fcn.00430310
test al, 1
jne 0x409317
jmp 0x409343
call fcn.0040a640
test al, 1
jne 0x409322
jmp 0x409341
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00409360
add esp, 8
call fcn.0040fb20
jmp 0x409341
jmp 0x409343
call fcn.004359b0
jmp 0x40934a
jmp 0x40934c
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40a540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40a62c
mov ebp, dword [esp + 0x14]
xor esi, esi
mov edi, 2
jmp 0x40a576
mov edx, ebp
nop
lea eax, [edi + 4]
add edi, 2
mov esi, edx
cmp edi, ecx
mov edi, eax
mov ebp, dword [esp + 0x14]
jae 0x40a62e
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.0040f850
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.0040f850
add esp, 4
mov bl, al
shl bh, 2
xor al, 0xc0
mov ecx, ebx
or cl, 0x30
and cl, al
shr cl, 4
add cl, bh
lea edx, [esi + 1]
mov eax, dword [esp + 0x1c]
mov byte [eax + esi], cl
mov ecx, dword [esp + 0x18]
cmp edi, ecx
jae 0x40a560
movzx eax, byte [ebp + edi]
push eax
mov ebp, edx
call fcn.0040f850
mov edx, ebp
mov ecx, dword [esp + 0x1c]
add esp, 4
cmp al, 0x40
je 0x40a560
mov bh, al
shl bl, 4
shr al, 2
and al, 0xf
or al, bl
lea ebp, [esi + 2]
mov edx, dword [esp + 0x1c]
mov byte [edx + esi + 1], al
lea eax, [edi + 1]
cmp eax, ecx
jae 0x40a55d
mov eax, dword [esp + 0x14]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.0040f850
mov ecx, dword [esp + 0x1c]
add esp, 4
cmp al, 0x40
mov edx, ebp
je 0x40a560
shl bh, 6
add al, bh
mov edx, dword [esp + 0x1c]
mov byte [edx + esi + 2], al
add esi, 3
mov edx, esi
jmp 0x40a560
xor edx, edx
mov eax, edx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x419ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov dword [esp + 8], 0x53e551f2
mov dword [esp + 0xc], 0x5fe75dfd
mov dword [esp + 0x10], 0x5bae59a2
mov dword [esp + 0x14], 0x278625f6
lea eax, [esp + 0x18]
mov word [esp + 0x18], 0x2126
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov dword [esp + 0x21], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x1c
ja 0x419f42
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea esi, [ecx + edx]
add esi, 0x8ad4f8b3
add ecx, 0x8ad4f8b3
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 0x28], esi
mov ecx, dword [esp + 0x28]
add cl, 0x1b
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x1d
jb 0x419f00
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x38]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x419f70
mov edi, esi
cmp eax, 0xffffffed
jge 0x419f89
mov eax, 0xffffffff
jmp 0x419f8c
add eax, 0x12
push eax
call fcn.00408c60
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x419fc1
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x419fb0
mov word [eax], 0
movzx ecx, word [esp + 0x28]
test cx, cx
je 0x419ff1
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419fe0
mov word [eax], 0
push edi
push esi
call fcn.00438950
add esp, 8
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x44009c]
mov ecx, 0xe9094b50
xor ecx, dword [0x4400a4]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x41d1e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0x4b93558d
mov dword [esp + 0x14], 0x4fd849da
mov dword [esp + 0x18], 0x43ab4d8a
mov dword [esp + 0x1c], 0x47a741d6
mov dword [esp + 0x20], 0x7ba8459d
mov dword [esp + 0x24], 0x7fe0798e
mov dword [esp + 0x28], 0x73ee7df5
mov dword [esp + 0x2c], 0x77eb7196
mov dword [esp + 0x30], 0x6b9275e0
mov dword [esp + 0x34], 0x6ffe69f5
mov dword [esp + 0x38], 0x63806d8a
mov dword [esp + 0x3c], 0x67f66192
mov dword [esp + 0x40], 0x1bfe65f7
mov dword [esp + 0x44], 0x1f841985
mov dword [esp + 0x48], 0x13891d85
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0x1112
mov dword [esp + 0x4e], 0
mov dword [esp + 0x51], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x44
ja 0x41d2f0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
lea esi, [ecx - 0x21b857f3]
and esi, edx
add ecx, edx
add ecx, 0xde47a80d
add esi, esi
sub ecx, esi
mov dword [esp + 8], ecx
mov ecx, dword [esp + 8]
add cl, 0xa5
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
mov ecx, dword [esp + 4]
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
cmp ecx, 0x45
jb 0x41d2a0
lea ebx, [esp + 0x5e]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x9a]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x44646c]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41d339
mov eax, 0xffffffff
jmp 0x41d33c
lea eax, [edi + edi]
push eax
call fcn.00408c60
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x1e
push ebx
push 0
call dword [0x44646c]
mov dword [esp + 0x10], 0x1bb219c4
mov dword [esp + 0x14], 0xe750e559
mov dword [esp + 0x18], 0xe34fe14c
mov dword [esp + 0x1c], 0xef4ced5e
mov dword [esp + 0x20], 0xeb58e941
mov dword [esp + 0x24], 0xf7f6f558
mov word [esp + 0x28], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x19
ja 0x41d3f0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + 0x7c]
and edx, ecx
mov edi, 0xbd5b1083
sub edi, eax
or edi, ecx
not edi
add edi, ecx
sub edi, edx
mov dword [esp + 8], edi
mov eax, dword [esp + 8]
add al, 0x9c
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x1a
jb 0x41d3b0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.00417dc0
add esp, 0x14
mov ebx, eax
jmp dword [0x440b1c]
Function at 0x4244d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov esi, esp
mov edx, ecx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x424648
movzx eax, byte [ebx]
test al, al
je 0x424648
mov dword [esi + 8], 0
nop
nop
nop
mov ecx, eax
cmp al, 0x2f
je 0x42451d
mov edi, dword [esi + 8]
movzx eax, byte [ebx + edi + 1]
inc edi
mov dword [esi + 8], edi
test al, al
jne 0x424500
xor edi, edi
jmp 0x4245da
mov byte [esi + 7], cl
mov ecx, dword [esi + 8]
lea eax, [ecx + 4]
mov dword [esi + 8], ecx
and eax, 0xfffffffc
call fcn.00408c30
mov eax, esp
and eax, 0xfffffff0
mov esp, eax
mov edi, eax
mov dword [esi + 0x10], eax
shr ecx, 2
mov dword [esi + 0xc], ebx
mov eax, dword [esi + 0xc]
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edi, dword [esi + 8]
and edi, 0xfffffffc
lea ecx, [ebx + edi]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 8]
and ecx, 3
mov dword [esi + 0x18], ecx
shr ecx, 1
add edi, dword [esi + 0x10]
mov eax, dword [esi + 0xc]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x14], edi
mov eax, dword [esi + 0x1c]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov ecx, dword [esi + 8]
test cl, 1
je 0x4245a5
mov edi, dword [esi + 0x18]
xor edi, 1
mov ecx, dword [esi + 8]
or ecx, 2
and ecx, edi
mov edi, dword [esi + 0xc]
movzx ecx, byte [edi + ecx]
mov edi, edx
mov edx, dword [esi + 8]
and edx, 2
mov eax, dword [esi + 0x14]
mov byte [eax + edx], cl
mov ecx, dword [esi + 8]
mov edx, edi
lea edi, [ebx + ecx]
mov eax, dword [esi + 0x10]
mov byte [eax + ecx], 0
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [ebx + eax + 1], 0
lea eax, [eax + 1]
jne 0x4245c0
cmp eax, 2
movzx ecx, byte [esi + 7]
mov eax, dword [esi + 0x10]
jae 0x4245d8
mov eax, ebx
mov ebx, eax
mov edx, dword [edx + 8]
test edx, edx
je 0x424646
mov dword [esi + 0xc], edi
mov byte [esi + 7], cl
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esi + 0x10], edx
mov eax, dword [edx]
mov dword [esi + 8], eax
xor edi, edi
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 8]
movsx ecx, byte [eax + edi]
lea eax, [ecx - 0x41]
cmp eax, 0x1a
jae 0x424612
or ecx, 0x20
mov edx, ebx
movsx eax, byte [ebx + edi]
lea ebx, [eax - 0x41]
cmp ebx, 0x1a
jae 0x424623
or eax, 0x20
test ecx, ecx
mov ebx, edx
je 0x42462e
inc edi
cmp ecx, eax
je 0x424600
mov edx, eax
not edx
and edx, ecx
not ecx
and ecx, eax
cmp edx, ecx
je 0x424654
mov edx, dword [esi + 0x10]
mov edx, dword [edx + 4]
test edx, edx
jne 0x4245f0
xor edx, edx
mov eax, edx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
cmp byte [esi + 7], 0x2f
mov edx, dword [esi + 0x10]
jne 0x424648
mov eax, dword [esi + 0xc]
inc eax
mov ecx, edx
push eax
call fcn.004244d0
mov edx, eax
jmp 0x424648
Function at 0x42d390
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4c
call esi
mov dword [esp + 0x1c], eax
push 0x4d
call esi
mov dword [esp + 0x18], eax
push 7
push edi
call dword [sym.imp.GDI32.dll_GetCurrentObject]
mov esi, eax
lea eax, [esp + 0x44]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x14], ebx
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
push ebx
push dword [esp + 0xc]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0xc], eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
push 0xcc0020
push dword [esp + 0x1c]
push dword [esp + 0x24]
push edi
push dword [esp + 0x24]
push dword [esp + 0x1c]
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push ebx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, 0xe4911178
lea esi, [esp + 0x33]
xor ebx, ebx
xor eax, eax
cmp ecx, 0xe4911178
setl al
mov eax, dword [eax*4 + 0x442cb0]
mov edx, 0x24b58e46
xor edx, dword [0x442cb8]
add eax, edx
inc eax
jmp eax
Function at 0x433e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, esp
mov eax, dword [ebp + 8]
push eax
sub esp, 0xc
mov ecx, esp
and ecx, 0xfffffff8
mov esp, ecx
mov dword [ecx], 0x33323100
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [esi], 0
mov edx, dword [esi]
cmp edx, 0xf
ja 0x433f10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esi]
mov edi, dword [esi]
movzx ebx, byte [ecx + edi]
mov edi, edx
and edi, 0xf6055ef8
xor edx, 0x76055ef8
lea edx, [edx + edi*2]
lea edi, [edx + ebx]
and edx, ebx
add edx, edx
mov ebx, edi
not ebx
and ebx, edx
not edx
and edx, edi
sub edx, ebx
mov dword [esi + 4], edx
mov edx, dword [esi + 4]
add dl, 0x38
mov edi, dword [esi]
mov byte [ecx + edi], dl
mov edx, dword [esi]
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
mov dword [esi], edx
mov edx, dword [esi]
cmp edx, 0x10
jb 0x433ec0
mov ecx, dword [ecx]
mov ecx, dword fs:[ecx]
mov edx, dword [0x443da0]
mov edi, 0x57ed6a15
xor edi, dword [0x443da4]
add edx, edi
inc edx
nop
nop
nop
nop
nop
nop
nop
jmp edx