joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4026a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x402787
test edx, edx
je 0x402787
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x4026ea
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x4026f1
inc edi
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
mov ecx, esi
cmp ebp, edi
jne 0x4026d0
jmp 0x4026f3
mov esi, 0x1505
jmp 0x4026f3
mov esi, ecx
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jb 0x402787
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x402724
inc ebx
dec ebp
je 0x402785
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402785
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402720
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.00409320
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402720
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00409340
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402720
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x402787
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402790
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x402899
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x402899
push ebx
call fcn.00409320
add esp, 4
test eax, eax
je 0x4027ea
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x4027f1
inc ebp
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
mov ecx, esi
cmp eax, ebp
jne 0x4027d0
jmp 0x4027f3
mov esi, 0x1505
jmp 0x4027f3
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x402899
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x402824
inc ebp
dec ebx
je 0x402897
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402897
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402820
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00409320
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402820
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.00409340
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402820
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x402897
cmp dword [eax + 4], 2
mov edi, 0
jne 0x402899
mov edi, dword [eax + 8]
jmp 0x402899
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4028d0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x402938
mov esi, dword [esp + 0x30]
test esi, esi
je 0x402938
push esi
call fcn.00409320
add esp, 4
test eax, eax
je 0x40291a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402921
inc edi
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
mov ecx, ebp
cmp eax, edi
jne 0x402900
jmp 0x402923
mov ebp, 0x1505
jmp 0x402923
mov ebp, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov edx, edi
sub edx, 1
jae 0x402944
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x402964
inc ebx
dec edi
je 0x402938
mov eax, ebx
and eax, edx
mov esi, dword [esp + 0xc]
mov esi, dword [esi + eax*4]
cmp esi, 0xffffffff
je 0x402938
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x402960
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 8], eax
push eax
call fcn.00409320
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402960
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x38]
call fcn.00409340
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x402960
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x402938
cmp dword [eax + 4], 3
jne 0x402938
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x402938
Function at 0x402a10
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x402b19
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x402b19
push ebx
call fcn.00409320
add esp, 4
test eax, eax
je 0x402a6a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x402a71
inc ebp
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
mov ecx, esi
cmp eax, ebp
jne 0x402a50
jmp 0x402a73
mov esi, 0x1505
jmp 0x402a73
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x402b19
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x402aa4
inc ebp
dec ebx
je 0x402b17
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402b17
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402aa0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00409320
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402aa0
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.00409340
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402aa0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x402b17
cmp dword [eax + 4], 5
mov edi, 0
jne 0x402b19
mov edi, dword [eax + 8]
jmp 0x402b19
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402b50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x402c5c
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x402c5c
push ebx
call fcn.00409320
add esp, 4
test eax, eax
je 0x402baa
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x402bb1
inc ebp
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
mov ecx, esi
cmp eax, ebp
jne 0x402b90
jmp 0x402bb3
mov esi, 0x1505
jmp 0x402bb3
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x402c5c
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x402be4
inc ebp
dec ebx
je 0x402c57
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402c57
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402be0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.00409320
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402be0
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.00409340
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402be0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x402c57
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x402c5c
mov edi, dword [eax + 8]
jmp 0x402c5c
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402c70
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
push 0x2e
push edi
call fcn.00409390
add esp, 8
test eax, eax
je 0x402ce0
mov ebx, eax
jmp 0x402cb4
mov edi, ebx
inc edi
push 0x2e
push edi
call fcn.00409390
add esp, 8
mov ebx, eax
test eax, eax
je 0x402ce0
mov eax, ebx
xor eax, edi
mov esi, edi
not esi
and esi, ebx
add esi, esi
sub esi, eax
mov ecx, ebp
mov edx, edi
push esi
call fcn.004026a0
add esp, 4
xor ebp, ebp
test eax, eax
je 0x402ca0
cmp dword [eax + 4], 4
jne 0x402ca0
mov ebp, dword [eax + 8]
jmp 0x402ca0
xor eax, eax
test ebp, ebp
je 0x402d36
test edi, edi
je 0x402d36
push edi
call fcn.00409320
add esp, 4
test eax, eax
je 0x402d1a
mov ecx, 0x1505
xor esi, esi
nop
nop
movzx edx, byte [edi + esi]
test edx, edx
je 0x402d21
inc esi
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
mov ecx, ebx
cmp eax, esi
jne 0x402d00
jmp 0x402d23
mov ebx, 0x1505
jmp 0x402d23
mov ebx, ecx
mov dword [esp + 8], eax
mov ecx, dword [ebp + 0x20]
lea esi, [ecx - 1]
mov edx, ecx
sub edx, 1
jae 0x402d3e
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and esi, ebx
mov dword [esp], ebp
mov eax, dword [ebp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 4], edx
jmp 0x402d54
inc esi
dec ecx
je 0x402d34
mov eax, esi
and eax, edx
mov ebp, dword [esp + 0x14]
mov ebp, dword [ebp + eax*4]
cmp ebp, 0xffffffff
je 0x402d34
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + ebp*4], ebx
jne 0x402d50
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp + 0x10], eax
push eax
mov dword [esp + 0x10], ecx
call fcn.00409320
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
add esp, 4
cmp eax, dword [esp + 8]
jne 0x402d50
push dword [esp + 8]
push dword [esp + 0x14]
push edi
call fcn.00409340
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x402d50
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x402d36
Function at 0x402e60
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x402ecd
mov esi, dword [esp + 0x28]
test esi, esi
je 0x402ecd
push esi
call fcn.00409320
add esp, 4
test eax, eax
je 0x402eaa
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x402eb1
inc edi
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
mov ecx, ebx
cmp eax, edi
jne 0x402e90
jmp 0x402eb3
mov ebx, 0x1505
jmp 0x402eb3
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x402ed5
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x402ee4
inc ebp
dec edi
je 0x402ecb
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x402ecb
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x402ee0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.00409320
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x402ee0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00409340
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402ee0
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x402ecd
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x402ecd
Function at 0x4030f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x4031f8
mov esi, edx
test edx, edx
je 0x4031f8
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x4031f8
push esi
call fcn.00409320
add esp, 4
test eax, eax
je 0x40314a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x403151
inc edi
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
mov ecx, ebp
cmp eax, edi
jne 0x403130
jmp 0x403153
mov ebp, 0x1505
jmp 0x403153
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x403200
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x4031ba
call fcn.004032f0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x4031f8
push ecx
call fcn.00409320
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x40326f
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x403218
inc ebx
dec esi
je 0x40316f
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x403174
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x403210
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.00409320
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x403210
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00409340
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x403210
mov eax, 0xffffffff
jmp 0x4031f8
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x403288
inc ebx
dec esi
je 0x4031b5
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x4031ba
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x403280
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.00409320
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x403280
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00409340
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x403280
jmp 0x4031ba
Function at 0x403a20
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x403bc2
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x403bbb
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x403ab0
add ebp, dword [esp + 4]
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov ebx, 0x15b0
je 0x403bbb
xor eax, eax
cmp ebx, 8
jb 0x403b2b
mov eax, ebx
and eax, 0x1ff8
mov dword [esp], eax
mov eax, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
movzx ebx, byte [ebp + ebx]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 1]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 2]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 3]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 4]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 5]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 6]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 7]
add edi, ebx
add ecx, edi
lea ebx, [edx + 8]
add edx, 0xf
cmp edx, eax
jb 0x403ad0
add ebp, ebx
mov ebx, eax
mov eax, dword [esp]
mov edx, ebx
sub edx, eax
mov dword [esp], ebx
jbe 0x403a78
mov dword [esp + 4], edx
mov edx, eax
or edx, 1
test bl, 1
mov dword [esp + 8], esi
jne 0x403b60
mov ebx, ebp
cmp dword [esp], edx
je 0x403a70
jmp 0x403b7d
lea ebx, [ebp + 1]
movzx eax, byte [ebp]
add edi, eax
mov eax, edi
and eax, ecx
xor ecx, edi
lea ecx, [ecx + eax*2]
mov eax, edx
cmp dword [esp], edx
je 0x403a70
mov edx, dword [esp]
sub edx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + eax]
add esi, edi
mov edi, esi
and edi, ecx
xor ecx, esi
lea ecx, [ecx + edi*2]
movzx edi, byte [ebx + eax + 1]
add edi, esi
mov esi, edi
and esi, ecx
xor ecx, edi
lea ecx, [ecx + esi*2]
add eax, 2
cmp edx, eax
jne 0x403b90
jmp 0x403a70
shl ecx, 0x10
or ecx, edi
jmp 0x403bc7
mov ecx, 1
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x403c42
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
not ecx
test edx, edx
je 0x403c39
xor esi, esi
nop
nop
nop
nop
movzx ebx, byte [eax + esi]
mov edi, ecx
shr edi, 4
xor ecx, ebx
and ecx, 0xf
xor edi, dword [ecx*4 + 0x43ea18]
mov ecx, edi
shr ecx, 4
not edi
shr ebx, 4
mov ebp, edi
and ebp, ebx
and edi, 0xf
or edi, ebx
xor edi, 0xf
or edi, ebp
xor ecx, dword [edi*4 + 0x43ea18]
inc esi
cmp edx, esi
jne 0x403c00
lea eax, [ecx + ecx]
not eax
add eax, ecx
jmp 0x403c44
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4098b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.004099e0
sub esp, 0x100
mov esi, esp
call fcn.00439010
test al, 1
jne 0x4098cf
jmp 0x4099a2
call fcn.00432440
test al, 1
jne 0x4098dd
jmp 0x40999d
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, 0
setge al
test al, 1
jne 0x409906
jmp 0x40999b
xor eax, eax
sub esp, 0x24
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, 0
setge al
test al, 1
jne 0x409964
jmp 0x409993
call fcn.0040aa70
test al, 1
jne 0x40996f
jmp 0x409991
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004099c0
add esp, 8
call fcn.0040f660
call fcn.0040c8d0
jmp 0x409993
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x40999b
jmp 0x40999d
call fcn.004397c0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x409b76
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x409a7d
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x409aa1
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x409a70
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x409a70
lea esi, [ebx + 1]
push esi
call fcn.00409200
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x409b84
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x409ae8
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x409b86
movzx edx, word [edi]
test dx, dx
je 0x409b86
cmp dx, 0x7f
jbe 0x409ad0
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
mov dword [esp + 4], esi
cmp esi, 0x7ff
ja 0x409b40
cmp ecx, 2
jb 0x409b40
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
mov ecx, edx
not ecx
or ecx, 0x3f
add ecx, edx
add cl, 0x81
mov byte [eax + 1], cl
mov esi, 2
jmp 0x409ad7
xor esi, esi
cmp ecx, 3
jb 0x409ad7
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x409ad7
push 1
call fcn.00409200
add esp, 4
mov ebp, eax
jmp 0x409b86
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x409ba7
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x409ba2
test eax, eax
jne 0x409ba0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00405d40
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x41b200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov dword [esp + 8], 0x73dd6db0
mov dword [esp + 0xc], 0x77cf71d5
mov dword [esp + 0x10], 0x7b887580
mov dword [esp + 0x14], 0x7fd879dc
lea eax, [esp + 0x18]
mov word [esp + 0x18], 0x7d7c
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov dword [esp + 0x22], 0
mov byte [esp + 0x26], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x1e
ja 0x41b2c1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea esi, [ecx + edx]
add esi, 0x107b678e
add ecx, 0x107b678e
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 0x28], esi
mov ecx, dword [esp + 0x28]
add cl, 0x1e
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
mov ecx, dword [esp + 4]
mov edx, ecx
xor edx, 1
and ecx, 1
lea ecx, [edx + ecx*2]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
cmp ecx, 0x1f
jb 0x41b270
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x38]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax], 0
lea eax, [eax + 2]
jne 0x41b2f0
lea ecx, [ebx + eax]
add ecx, 0xfffffffe
mov eax, ebx
not eax
and eax, ecx
xor ecx, ebx
add eax, eax
sub eax, ecx
mov edi, esi
cmp eax, 0xffffffed
jge 0x41b31a
mov eax, 0xffffffff
jmp 0x41b31d
add eax, 0x12
push eax
call fcn.00409200
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x41b351
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41b340
mov word [eax], 0
movzx ecx, word [esp + 0x28]
test cx, cx
je 0x41b381
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b370
mov word [eax], 0
push edi
push esi
call fcn.0043c050
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x443414]
Function at 0x422280
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 4]
call fcn.004222a0
add esp, 4
test al, al
je 0x422293
mov al, 1
ret
jmp fcn.00422a90