joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001510
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push 0x10001550
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
ret

Function at 0x10001530
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push 0x10001560
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
ret

Function at 0x100017c0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x100081db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x134
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x14]
call fcn.10001000
lea eax, [esp + 0x38]
push 0x104
push eax
push 0x1000a0a0
mov ecx, 0x10010fd0
mov dword [esp + 0x150], 0
call fcn.10001b50
xor eax, eax
mov cl, byte [eax + str.UUU_]
xor cl, 0x55
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0xc
jl 0x1000180e
lea edx, [esp + 0x38]
push 0x270f
push edx
mov ecx, esi
call fcn.100019d0
test eax, eax
je 0x100018c5
push 6
push 5
push 0x10001710
push 7
lea eax, [esp + 0x48]
push 0x1000a0b0
push eax
lea ecx, [esp + 0x2c]
call fcn.10001190
push 5
push 5
lea ecx, [esp + 0x40]
push 0x104
push ecx
push 0x1000a05c
mov ecx, 0x10010fd0
call fcn.10001c80
lea edx, [esp + 0x38]
push 0x270f
push edx
mov ecx, esi
call fcn.100019d0
test eax, eax
je 0x10001997
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
lea ecx, [esp + 0xc]
push 2
push ecx
lea edx, [esp + 0x34]
push 0xc
push edx
push 0
push eax
mov ecx, 0x10010fd0
call fcn.10002400
cmp ax, 2
jne 0x10001997
jmp 0x10001979
push 5
push 4
lea eax, [esp + 0x40]
push 0x104
push eax
push 0x1000a068
mov ecx, 0x10010fd0
call fcn.10001c80
lea ecx, [esp + 0x38]
push 0x270f
push ecx
mov ecx, esi
call fcn.100019d0
test eax, eax
je 0x100019a4
push 6
push 5
push 0x10001710
push 7
lea edx, [esp + 0x48]
push 0x1000a0b0
push edx
lea ecx, [esp + 0x2c]
call fcn.10001190
push 5
push 5
lea eax, [esp + 0x40]
push 0x104
push eax
push 0x1000a050
mov ecx, 0x10010fd0
call fcn.10001c80
lea ecx, [esp + 0x38]
push 0x270f
push ecx
mov ecx, esi
call fcn.100019d0
test eax, eax
je 0x10001997
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
lea ecx, [esp + 0xc]
push 2
push ecx
lea edx, [esp + 0x34]
push 0xc
push edx
push 0
push eax
mov ecx, 0x10010fd0
call fcn.10002400
cmp ax, 2
jne 0x10001997
mov eax, dword [esp + 0xc]
push 0
add eax, 0xc
push 5
push 0x100016e0
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], eax
call fcn.10001090
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x144], 0xffffffff
call fcn.10001070
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x140
ret
Function at 0x10002130
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x218
push ebx
push ebp
push esi
push edi
push 0x1000a178
mov ebx, ecx
push 4
call fcn.10001e60
mov ebp, dword [esp + 0x22c]
test eax, eax
je 0x100021b6
lea ecx, [esp + 0x124]
push 0x104
push ecx
mov byte [esp + 0x12c], 0
call eax
lea edi, [esp + 0x124]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000a1d4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10002204
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [edx]
sub esp, 0x10
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [esp + 0x30]
mov dword [edx + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov ecx, ebx
call fcn.10002830
lea edx, [esp + 0x20]
mov ecx, ebx
push edx
push ebp
call fcn.100027d0
mov ecx, ebx
call fcn.10001cf0
mov eax, dword [ebx + 0x34]
cmp eax, 4
jne 0x1000221e
lea edx, [esp + 0x20]
mov edi, 0x1000a1d0
jmp 0x10002251
cmp eax, 5
jne 0x1000222e
lea edx, [esp + 0x20]
mov edi, 0x1000a1cc
jmp 0x10002251
cmp eax, 6
jne 0x1000223e
lea edx, [esp + 0x20]
mov edi, 0x1000a1c8
jmp 0x10002251
cmp eax, 7
lea edx, [esp + 0x20]
mov edi, str.2003
je 0x10002251
mov edi, str.UKOS
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
push ecx
push ebp
mov ecx, ebx
call fcn.100027d0
mov edi, 0x1000a1b4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 8
Function at 0x100037c0
Capabilities:
Create thread

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push esi
push edi
mov esi, ecx
push 0x104
push eax
push 0x1000a250
mov ecx, 0x10010fd0
xor edi, edi
call fcn.10001b50
lea ecx, [esp + 0xc]
push ecx
call dword [0x10025064]
test eax, eax
je 0x1000381d
lea edx, [esp + 8]
push edx
push edi
push esi
push 0x10002a20
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x108
ret
mov eax, edi
pop edi
pop esi
add esp, 0x108
ret

Function at 0x10003cf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
push 0x64
push esi
mov byte [ebp], 0
call ebx
test eax, eax
je 0x10003d18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
mov edi, dword [esi + 8]
test edi, edi
jne 0x10003d28
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
cmp edi, 0x63
jle 0x10003d36
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
mov eax, dword [esi + 0xc]
add esi, 0xc
push 0x32
push eax
call ebx
test eax, eax
je 0x10003d4e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
xor ecx, ecx
test edi, edi
jle 0x10003d74
mov eax, dword [esi]
add esi, 4
mov edx, dword [eax]
mov ebx, dword [eax + 4]
mov eax, dword [eax + 8]
xor edx, 0xc0017921
mov edx, dword [ebx + edx*4]
xor dl, al
mov byte [ecx + ebp], dl
inc ecx
cmp ecx, edi
jl 0x10003d54
mov byte [edi + ebp], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8

Function at 0x10003d90
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push 0x10003dc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret

Function at 0x100044e0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextA]
push ebp
mov ebp, dword [esp + 0x114]
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0x10]
push 0x104
push eax
push edi
call ebx
mov esi, ebp
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x10004535
test cl, cl
je 0x10004531
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x10004535
add eax, 2
add esi, 2
test cl, cl
jne 0x10004511
xor eax, eax
jmp 0x1000453a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000454d
push edi
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
test edi, edi
je 0x1000455c
jmp 0x100044fe
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x104
ret 8

Function at 0x10004800
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push 0x10004830
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x10005030
Capabilities:
Send data
Send data on socket

Disassembly:
mov edx, dword [esp + 8]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0xc]
not ecx
dec ecx
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
pop edi
ret 8
Function at 0x10006400
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
add esp, 0x190
ret

Function at 0x100066f0
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push 0x10006690
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret

Function at 0x100076f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push 0
mov ecx, dword [esp + 0xc]
push eax
mov edx, dword [esi + 0x30]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
mov dword [esi + 0x1003c], eax
jbe 0x1000771d
mov dword [esi + 0x10034], 1
pop esi
ret 8

Function at 0x10007730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1000836b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.10001a20
push str.send
push 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x158], 0
call fcn.10001e10
mov ecx, dword [esp + 0x15c]
mov edx, dword [esp + 0x158]
push 0
push ecx
mov ecx, dword [esi + 0x30]
push edx
push ecx
call eax
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x150], 0xffffffff
call fcn.10001b40
mov ecx, dword [esp + 0x148]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x150
ret 8

Function at 0x10007970
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push 0x100076a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
ret

Function at 0x10007990
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
push 0
push 1
mov esi, ecx
push 2
call dword [sym.imp.WS2_32.dll_socket]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esi + 0x30], eax
mov eax, ecx
pop esi
ret

Function at 0x100079b0
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x30]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x100079e3
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100079da
mov ecx, esi
call fcn.10007970
mov eax, 1
pop esi
ret 0xc
mov eax, dword [esi + 0x30]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop esi
ret 0xc

Function at 0x10007a00
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [ecx + 8]
sub esp, 0x190
test eax, eax
jne 0x10007a24
lea eax, [esp]
mov dword [ecx + 8], 1
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
add esp, 0x190
ret

Function at 0x10007c10
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push 0x10007c00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x97c167d
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x24f1cf7
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x402280
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4022ba
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0x4022c1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0x4022a0
jmp 0x4022c3
mov eax, 0x1505
jmp 0x4022c3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x402a10
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402b96
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x402b8f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
mov eax, edx
jmp 0x402aa5
mov eax, dword [esp]
sub eax, dword [esp + 0xc]
add ebp, eax
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov eax, 0x15b0
je 0x402b8f
xor ebx, ebx
cmp eax, 8
mov dword [esp], eax
mov dword [esp + 4], esi
jb 0x402b1e
mov ebx, eax
and ebx, 0x1ff8
xor edx, edx
nop
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, dword [esp]
mov eax, dword [esp]
jb 0x402ac0
add ebp, edx
mov esi, dword [esp + 4]
mov edx, ebx
sub edx, eax
jae 0x402a6d
mov dword [esp + 8], edx
mov esi, eax
and esi, 3
mov dword [esp + 0xc], ebx
mov eax, ebx
mov edx, ebp
je 0x402b4c
nop
nop
nop
nop
nop
movzx ebx, byte [edx]
add edi, ebx
inc edx
add ecx, edi
inc eax
dec esi
jne 0x402b40
cmp dword [esp + 8], 0xfffffffc
ja 0x402a60
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x402b60
jmp 0x402a60
shl ecx, 0x10
or ecx, edi
jmp 0x402b9b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402bb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402bde
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x402c7c
not eax
test bl, 1
jne 0x402be5
mov edx, ebx
cmp ebx, 1
jne 0x402c16
jmp 0x402c7a
xor eax, eax
jmp 0x402c7c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x43b80c]
inc ecx
mov eax, edi
shr eax, 4
shr esi, 4
and edi, 0xf
xor edi, esi
xor eax, dword [edi*4 + 0x43b80c]
cmp ebx, 1
je 0x402c7a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x43b80c]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0x43b80c]
movzx ebx, byte [ecx + esi + 1]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x43b80c]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0x43b80c]
add esi, 2
cmp edx, esi
jne 0x402c20
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x407f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x407f5b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x407f63
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x407ffb
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x407fa9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x40800a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x407fbe
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x407fd0
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x407f90
jmp 0x407fd9
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x407f90
cmp edi, ebx
jge 0x407ff0
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x407f94
jmp 0x407ff4
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x407f9d
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x408092
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x408092
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x408044
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x408030
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x408092
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x408050
dec eax
mov ecx, 1
xor esi, esi
jmp 0x4080ac
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x407f5b
test edx, edx
mov dword [esp], ecx
js 0x4080e0
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x4080f0
inc ebp
dec edx
cmp edi, ebp
jne 0x4080c0
mov edx, 0xffffffff
jmp 0x4080f2
xor edi, edi
jmp 0x4080f5
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x4080a0
and ebp, 3
je 0x408128
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x408110
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x40812a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x4080a0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x408140
jmp 0x4080a0
Function at 0x408af0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + 4]
mov dword [0x4434ac], ecx
mov eax, 0xfffffd92
nop
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x26f
mov dword [eax*4 + 0x443e68], ecx
test eax, eax
je 0x408b41
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x270
mov dword [eax*4 + 0x443e6c], ecx
add eax, 2
jmp 0x408b00
mov dword [0x4434a8], 0x270
ret

Function at 0x408b50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov eax, dword [0x4434a8]
cmp eax, 0x270
jne 0x408baf
mov eax, 0xfffff640
mov edx, dword [0x4434ac]
nop
nop
nop
nop
nop
nop
nop
nop
and edx, 0x80000000
mov esi, dword [eax + 0x443e70]
mov ecx, esi
and ecx, 0x7ffffffe
or ecx, edx
mov edx, esi
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, dword [eax + 0x4444a0]
shr ecx, 1
xor esi, ecx
mov dword [eax + 0x44482c], esi
add eax, 4
jne 0x408b70
mov eax, 0x270
jmp 0x408bc5
cmp eax, 0x4e0
jb 0x408bc5
mov ecx, 0x4434a8
call fcn.00408e50
mov eax, dword [0x4434a8]
lea ecx, [eax + 1]
mov dword [0x4434a8], ecx
mov eax, dword [eax*4 + 0x4434ac]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [0x44482c]
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc40000
xor ecx, eax
shr ecx, 0x12
and eax, 0x7fff
xor eax, ecx
pop esi
ret
Function at 0x408c30
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
call fcn.00437850
test al, al
je 0x408e39
call fcn.00431b70
test al, al
je 0x408e34
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x424a99e5
mov eax, 0x9ef86b95
shrd eax, edx, cl
shr edx, cl
mov esi, 0xbdb5661a
mov edi, 0x6107946a
shrd edi, esi, cl
sar esi, cl
and cl, 0x20
xor ebx, ebx
mov byte [esp], cl
test cl, cl
mov dword [esp + 4], esi
je 0x408c97
mov eax, edx
xor edx, edx
mov edi, esi
mov dword [esp + 0xc], eax
mov ecx, edx
shld ecx, eax, 1
not ecx
lea ebp, [eax + eax]
not ebp
add ebp, eax
adc ecx, edx
mov esi, ecx
and esi, 0x424a99e5
mov eax, ebp
and eax, 0x9ef86b95
add ebp, 0x9ef86b95
adc ecx, 0x424a99e5
sub ebp, eax
sbb ecx, esi
neg byte [esp]
sbb ebx, ebx
or ebx, dword [esp + 4]
mov eax, dword [esp + 0xc]
and eax, 0x1e906281
and edx, 0x42401840
and ebx, 0xa81a5
or ebx, edx
and edi, 0x80680914
or edi, eax
xor edi, 0xe16f9d7e
and edi, ebp
xor ebx, 0xbdbfe7bf
and ebx, ecx
mov ebp, ebx
not ebp
mov ecx, edi
not ecx
and ebx, 0xfaf86cac
and edi, 0x54c9f5b
mov esi, ebp
and esi, 0x5079353
mov eax, ecx
and eax, 0xfab360a4
imul ebx, eax
mul edi
mov dword [esp], eax
add edx, ebx
imul esi, edi
add esi, edx
mov edx, ebp
and edx, 0xfaf86cac
mov edi, ecx
and edi, 0x54c9f5b
or ecx, 0x54c9f5b
mov eax, ecx
imul ecx, edx
mul edi
add ecx, edx
or ebp, 0xfaf86cac
imul ebp, edi
add ebp, ecx
add eax, dword [esp]
adc ebp, esi
mov edi, ebp
shr edi, 0x15
xor edi, ebp
mov esi, ebp
shld esi, eax, 0xb
xor esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x408e10
mov eax, esi
and eax, 0x85d11c99
mov dword [esp], eax
mov ebp, edi
and ebp, 0xff563576
mov ebx, esi
and ebx, 0x7a2ee366
mov ecx, edi
and ecx, 0xa9ca89
mov eax, ebx
xor eax, 0x7a2ee366
imul ebp, eax
mul dword [esp]
mov dword [esp + 4], eax
or esi, 0x7a2ee366
mov eax, esi
imul esi, ecx
xor ecx, 0xa9ca89
imul ecx, dword [esp]
add ecx, edx
mul ebx
add ecx, ebp
add esi, edx
or edi, 0xa9ca89
imul edi, ebx
add edi, esi
add eax, dword [esp + 4]
adc edi, ecx
mov esi, eax
mov ecx, dword [esp + 8]
shrd esi, edi, cl
mov edx, edi
shr edx, cl
test cl, 0x20
je 0x408df8
mov esi, edx
xor edx, edx
mov ecx, esi
and ecx, eax
mov ebx, edx
and ebx, edi
add esi, eax
adc edx, edi
shld ebx, ecx, 1
add ecx, ecx
sub esi, ecx
sbb edx, ebx
mov edi, edx
or edi, 0x1010101
or esi, 0x1010101
push edi
push esi
call fcn.00409f00
add esp, 8
test al, al
je 0x408e34
call fcn.0040cb20
call fcn.0040baf0
call fcn.00437d80
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]