joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402aba
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x42c6b0
jmp 0x402aae
mov eax, 0x422d7d
call fcn.00418cc4
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0xc]
call fcn.0040469d
xor ebx, ebx
lea ecx, [esi + 0x14]
mov dword [ebp - 4], ebx
call fcn.0040469d
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 1
call fcn.0040469d
or dword [esi + 8], 0xffffffff
mov edi, 0x42c714
push edi
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 2
call fcn.00405362
or dword [esi + 0x10], 0xffffffff
push edi
lea ecx, [esi + 0x14]
call fcn.00405362
fldz
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], 0xbb8
fstp dword [esi + 0x50]
fldz
mov dword [esi + 0x1c], ebx
mov byte [esi + 0x20], bl
fstp dword [esi + 0x54]
fldz
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 5
fstp dword [esi + 0x58]
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], 0xffffff
mov byte [esi + 0x34], bl
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 0x1e0
mov dword [esi + 0x44], 0x168
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x5c], 1
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x402f42
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x422dd3
call fcn.00418cc4
sub esp, 0x114
push ebx
xor ebx, ebx
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
call fcn.0040469d
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push 0x20019
push ebx
inc esi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402fc3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x120]
push eax
push ebx
push ebx
push str.ProgramFilesDir
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402fba
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x10]
push eax
call fcn.00405362
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004046ad
mov dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00404777
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4055f7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x454]
push str.__s_
push eax
call fcn.0041a61f
xor esi, esi
add esp, 0xc
cmp dword [ebp + 0xc], esi
je 0x405644
push dword [ebp + 0xc]
lea eax, [ebp - 0x454]
push 0x42683c
push eax
call fcn.00418df0
pop ecx
lea eax, [ebp + eax - 0x454]
push eax
call fcn.0041a61f
add esp, 0xc
push edi
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x50]
mov dword [ebp - 0x54], 0x44
rep stosd dword es:[edi], eax
inc eax
cmp dword [ebp + 0x10], eax
mov word [ebp - 0x24], ax
mov dword [ebp - 0x28], eax
pop edi
jne 0x405668
mov word [ebp - 0x24], si
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x454]
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp + 0x14]
test eax, eax
setne al
cmp ecx, esi
pop esi
je 0x405698
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
leave
ret

Function at 0x405b5f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and byte [ebp - 1], 0
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0x80000002
call esi
test eax, eax
mov ebx, dword [ebp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jne 0x405bb9
push ebx
call fcn.00418df0
pop ecx
inc eax
push eax
push ebx
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
call edi
test eax, eax
jne 0x405baa
mov byte [ebp - 1], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], 0
jne 0x405bf2
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0x80000001
call esi
test eax, eax
jne 0x405bf2
push ebx
call fcn.00418df0
pop ecx
inc eax
push eax
push ebx
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
call edi
test eax, eax
jne 0x405be9
mov byte [ebp - 1], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405bfa
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and byte [ebp - 1], 0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0x80000002
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jne 0x405c4c
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
call edi
test eax, eax
jne 0x405c3d
mov byte [ebp - 1], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], 0
jne 0x405c81
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0x80000001
call esi
test eax, eax
jne 0x405c81
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
call edi
test eax, eax
jne 0x405c78
mov byte [ebp - 1], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop edi
pop esi
leave
ret
Function at 0x405c88
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
xor bl, bl
push 0x80000002
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jne 0x405cd4
push 8
lea eax, [ebp + 0x10]
push eax
push 3
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call edi
test eax, eax
jne 0x405cc7
inc bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x405d07
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0x80000001
call esi
test eax, eax
jne 0x405d07
push 8
lea eax, [ebp + 0x10]
push eax
push 3
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call edi
test eax, eax
jne 0x405cfe
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x405e84
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.00418cf0
lea eax, [ebp - 0x104]
push eax
call fcn.00405f06
add esp, 0xc
push 0
lea eax, [ebp - 0x104]
push eax
call esi
test eax, eax
jne 0x405f01
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.0041a860
test eax, eax
pop ecx
pop ecx
jne 0x405ee9
lea eax, [ebp - 0x104]
push 0x2f
push eax
call fcn.0041a860
test eax, eax
pop ecx
pop ecx
je 0x405efd
and byte [eax], 0
push 0
lea eax, [ebp - 0x104]
push eax
call esi
test eax, eax
je 0x405ec1
jmp 0x405e94
xor al, al
jmp 0x405f03
mov al, 1
pop esi
leave
ret

Function at 0x405fcc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x405fde
xor al, al
ret
and eax, 1
dec al
neg al
sbb eax, eax
inc eax
ret

Function at 0x405fe9
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406010
and eax, 0xfffffffe
cmp byte [esp + 8], 0
je 0x406005
or eax, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret
Function at 0x406baf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp byte [esi], 0
jne 0x406c18
push dword [esi + 8]
lea ecx, [ebp - 8]
call fcn.004046bc
mov ecx, esi
call fcn.004065b5
test al, al
jne 0x406c10
lea ecx, [ebp - 4]
call fcn.0040469d
lea ecx, [ebp - 8]
call fcn.004050cf
push eax
lea eax, [ebp - 4]
push str.There_is_something_wrong_with__s.__It_may_be_an_empty_or_damaged_archive.
push eax
call fcn.00404a3a
add esp, 0xc
lea ecx, [ebp - 4]
call fcn.004050cf
push eax
push str.FATAL_ERROR_IN_ZIP
call fcn.004056c0
pop ecx
pop ecx
push 0xffffffffffffffff
call fcn.00418e98
lea ecx, [ebp - 8]
call fcn.00404777
pop esi
leave
ret

Function at 0x406ff0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 0xc]
test edx, edx
mov eax, dword [esp + 4]
je 0x40701c
mov ecx, dword [esp + 8]
push esi
push edi
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
mov esi, dword [esi*4 + 0x4268e0]
shr eax, 8
xor eax, esi
inc ecx
dec edx
jne 0x407002
pop edi
pop esi
ret

Function at 0x40904c
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x40907a
push esi
call fcn.0040bf34
cmp dword [esi + 0x40], 0
pop ecx
je 0x409073
xor eax, eax
mov dword [esi + 0x10], 0xcf
inc eax
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4090ec
mov eax, dword [esi + 0x1b0]
cmp dword [eax + 0x10], 0
je 0x4090de
mov eax, dword [esi + 8]
test eax, eax
je 0x40909b
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x1b0]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x4090da
cmp eax, 2
je 0x4090de
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x409090
cmp eax, 3
je 0x4090bf
cmp eax, 1
jne 0x409090
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x409090
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x409090
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
mov dword [esi + 0x98], eax
jmp 0x40910a
cmp eax, 0xcc
je 0x40910a
mov eax, dword [esi]
mov dword [eax + 0x14], 0x12
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
push esi
call fcn.00409113
pop ecx
pop esi
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x54e745bb
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x272d1aad
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x1f9e4dbc
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x48d80252
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x40894e
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
sub edx, 0xf2b1e117
sub ebx, edx
call fcn.00408981
add edx, ebx
add ebx, 1
xor dword [eax], edi
dec ebx
inc edx
inc eax
sub edx, 1
inc edx
cmp eax, esi
jne fcn.0040894e
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405873
Capabilities:
Encode data using xor

Disassembly:
dec esi
push esi
pop eax
push edi
push eax
cmp edi, dword [eax]
dec esi
dec esi
dec esi
dec esi
push edx
cdq
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
pop esp
sbb dword [edi + edx*4 - 0x705d5e64], 0xffffff9a
lcall 0x959c, 0x97a0a281
cmp edi, dword [eax]
cmp edi, dword [eax]
dec esi
dec esi
dec esi
dec esi
test byte [ebx - 0x62685e60], dl
pushfd
dec esi
wait
invalid
Function at 0x436371
Capabilities:
Encode data using xor

Disassembly:
or byte [esi + 0x77], 0x95
pushfd
popfd
mov al, byte [0xa06f9293]
xchg ebp, eax
mov dword [0xa29c939b], eax
mov eax, dword [0x4e4e383b]
dec esi
dec esi
outsd dx, dword [esi]
lcall 0xa14e, 0xa1a59d9a
sahf
lcall 0x959c, 0x97a2a28f
movsd dword es:[edi], dword [esi]
mov eax, dword [0x9a9ea14e]
invalid
xchg ebp, eax
dec esi
movsd dword es:[edi], dword [esi]
xchg edi, eax
mov byte [0xa08f4e96], al
xchg ebp, eax
mov dword [0xa29c939b], eax
mov eax, dword [0x8f96a24e]
mov byte [0x4e9d924e], al
dec esi
pushfd
popfd
mov byte [0x9e9e8f4e], al
lcall 0x4e92, 0x9c8f4ea7
pushfd
xchg edx, eax
dec esi
xchg esp, eax
mov dword [0x93a0a3a2], eax
dec esi
xchg ebx, eax
cmpsb byte [esi], byte es:[edi]
sahf
invalid
xchg ecx, eax
mov byte [0x3b5ca79a], al
cmp byte [ebx], bh
cmp byte [edi + esi*2 + 0x7c], bl
jle 0x436302
add dword [edx + 0x4e383b81], 0x4e
dec esi
add byte [ecx + 0x4e4e383b], 0x4e
dec esi
and dword [edi - 0x646c5d5f], 0xa0a2815c
xchg edi, eax
pushfd
xchg ebp, eax
cmp edi, dword [eax]
cmp edi, dword [eax]
pop esp
jge 0x43631e
cmp byte [esi - 0x7d], 0x82
cmp dword [ebx], 0x4e4e4e38
dec esi
jle 0x436329
jno 0x43634d
mov eax, dword [0x7d9b9da2]
nop
cwde
xchg ebx, eax
xchg ecx, eax
mov byte [0x383b383b], al
pop esp
jae 0x436341
outsd dx, dword [esi]
jnp 0x43643c
jp 0x436433
cmp edi, dword [eax]
dec esi
dec esi
dec esi
dec esi
mov dword [edi - 0x58705f60], ecx
mov edx, dword [edx - 0x67]
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
dec esi
imul ecx, dword [esi + 0x75], 0xffffff93
mov byte [0x979c835b], al
pushfd
mov eax, dword [0x9a9a8fa2]
adc byte [ebx - 0x5d5e686b], 0xa0
cmpsd dword [esi], dword es:[edi]
jns 0x43637e
cmpsd dword [esi], dword es:[edi]
dec esi
pop ebx
sbb dword [ebp - 0x705a5d6c], 0x8f7c93a0
wait
xchg ebx, eax
dec esi
push eax
test byte [edx + 0x71], bh
dec esi
wait
xchg ebx, eax
xchg edx, eax
xchg edi, eax
invalid
mov byte [0xa28f9b4e], al
xchg ecx, eax
xchg esi, eax
push 0x949da14e
mov byte [0x93a08fa5], al
dec esi
pushfd
invalid
mov eax, dword [0xa5a2949d]
invalid

Function at 0x436b28
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
lcall 0x907d, 0x5ba29193
cwde
xchg ebx, eax
xchg ecx, eax
mov byte [0xa6735b4e], al
sahf
invalid
Function at 0x4010c0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
add ebx, 0x645
push esi
mov esi, dword [esp + 0x2c]
mov edx, ebp
add esi, 0x62b
xor edx, 0xfab
lea eax, [ebx - 0x7ec]
lea ecx, [ebp - 0x73]
mov dword [esp + 0xc], ecx
push edi
mov edi, dword [esp + 0x34]
cmp esi, eax
je 0x401119
mov eax, dword [0x72a2e0]
lea ecx, [ebp - 0x73]
add eax, 0xc930f7cd
add eax, dword [edi + 0x120]
mov dword [edi + 0x98], eax
jmp 0x4011ae
lea eax, [edx + 0x3aea]
mov dword [esp + 0x24], esi
cmp esi, eax
jl 0x4011ae
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x10]
imul eax, esi, 0x3154
xor ecx, 0x3d35
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x80]
and eax, esi
or eax, ebx
push eax
push dword [esp + 0x18]
lea eax, [ebx + esi]
push eax
imul eax, dword [edi + 0x44], 0x322e
or eax, 0x3270
push eax
mov eax, ebp
sub eax, dword [edi + 0x10c]
push ecx
or eax, ebp
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov eax, dword [0x70c18c]
mov ecx, dword [esp + 0x24]
add ecx, 4
mov dword [esp + 0x24], ecx
mov edx, dword [eax + 0xd8]
xor edx, dword [edi + 0x58]
add edx, dword [edi + 0x94]
lea eax, [edx + 0x3aea]
cmp ecx, eax
mov ecx, dword [esp + 0x28]
jge 0x401147
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
mov eax, esi
xor eax, 0xa61
cmp ebx, eax
jl 0x4011f3
push ebp
lea eax, [ebx - 0x1f4]
mov dword [edi + 0xd0], 0x70c190
push eax
lea eax, [ecx - 0x538]
xor edx, 0x577
push eax
push edi
add edx, 0x51e
lea eax, [ecx - 0x133]
push edx
push eax
push dword [esp + 0x48]
call fcn.00401dc5
add esp, 0x1c
pop edi
lea eax, [esi + 0x736]
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x401d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [0x72aa9c]
movzx ecx, word [esp + 4]
push ebx
mov bx, word [esp + 0xc]
push esi
mov eax, dword [edx + ecx*8]
or dword [ecx + 0x18], eax
mov eax, dword [edx + 0xc]
push edi
mov edi, edx
xor edi, 0x1779
add dword [edi + 0xc], eax
mov eax, dword [0x72aa94]
mov edx, dword [0x72aa9c]
movzx esi, word [0x72aac0]
imul eax, edx
imul eax, eax, 0x1bf5
mov dword [0x72aa94], eax
cmp esi, 0xe2
ja 0x401db3
mov ecx, esi
shl ecx, 4
push ebp
movzx ebp, bx
add ecx, edi
mov eax, dword [0x72aad4]
inc edx
xor eax, esi
mov dword [0x72aa9c], edx
sub eax, edx
or eax, ebp
or dword [ecx], eax
inc esi
lea ecx, [ecx + 0x10]
cmp esi, 0xe2
jg 0x401db2
mov edx, dword [0x72aa9c]
jmp 0x401d8a
pop ebp
movzx ecx, bx
mov eax, 0x17ce
xor edx, edx
div ecx
pop edi
pop esi
mov eax, edx
pop ebx
ret

Function at 0x401dc5
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x14]
add ecx, 0x7a3
push edi
mov edi, dword [esp + 0x1c]
mov eax, ecx
xor eax, 0xdb3
xor edi, 0xe6a
cmp ecx, eax
je 0x401f5b
lea eax, [ecx + 0x414]
cmp ecx, eax
jge 0x401f5b
push ebx
push esi
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov eax, dword [esi + 0x128]
sub dword [esi + 0x80], eax
mov eax, dword [0x70c18c]
push 0x61
pop ecx
sub ecx, dword [eax + 0x38]
add dword [0x72a304], ecx
mov eax, dword [esi + 0xd0]
mov ecx, dword [ebx + eax]
add ebx, 4
mov eax, dword [0x72a228]
sub eax, dword [0x72a2f8]
inc eax
imul eax, dword [esi + 0xb4]
mov dword [esi + 0xb4], eax
mov eax, dword [esi + 0x38]
xor eax, dword [0x72a250]
sub eax, 0x61
or dword [0x72a254], eax
mov eax, dword [0x70c18c]
mov edx, dword [esi + 0x98]
imul edx, ecx
mov ecx, dword [esi + 4]
sub ecx, dword [eax + 0xfc]
sub ecx, 0xe85df
xor dword [esi + 0x128], ecx
mov ecx, dword [esi + 0x58]
mov eax, dword [esi + 0x74]
add ecx, 0xffea12e9
add eax, ecx
mov ecx, dword [esi + 0xc0]
add dword [esi + 0xc], eax
mov eax, dword [0x70c18c]
sub ecx, dword [eax + 0x44]
xor ecx, 0xffeae1c9
sub dword [esi + 0x134], ecx
mov eax, dword [0x70c18c]
mov ecx, dword [eax + 0xd4]
mov eax, dword [0x72a28c]
mov byte [eax + ecx], dl
inc dword [0x72a28c]
mov eax, dword [esi + 0xa4]
add dword [esi + 0x24], eax
mov eax, dword [esi + 0x8c]
inc eax
imul eax, dword [0x72a290]
mov dword [0x72a290], eax
mov eax, dword [esi + 0x30]
sub eax, dword [esi + 0x110]
add eax, 0x17565d
add dword [esi + 0x80], eax
mov eax, dword [esi + 0x84]
xor eax, dword [0x72a250]
sub eax, 0x10
add dword [esi + 0xe8], eax
mov eax, dword [0x70c18c]
mov ecx, dword [eax + 0xd8]
xor ecx, dword [eax + 0x84]
xor ecx, 0x11
imul ecx, dword [esi + 4]
mov dword [esi + 4], ecx
mov eax, dword [esi + 0xa4]
add eax, dword [esi + 0x8c]
xor dword [0x72a2a8], eax
cmp ebx, 0x1d6d0
jl 0x401dff
mov eax, dword [0x70c18c]
mov eax, dword [eax + 0x70]
cmp eax, dword [esi + 0x134]
je 0x401f59
mov eax, dword [esi + 0x70]
add eax, dword [esi + 0x74]
xor eax, 0x1472b3
mov dword [esi + 0x98], eax
pop esi
pop ebx
lea eax, [edi - 0x5df]
pop edi
ret
Function at 0x41a8a7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
add ecx, 0xfffffa1f
mov edx, dword [esp + 0x14]
add eax, 0x131
push ebx
mov ebx, dword [esp + 0x10]
add edx, 0xfffffae2
push ebp
mov ebp, dword [esp + 0x10]
add ebx, 0x13b
push esi
mov esi, dword [esp + 0x28]
xor ebp, 0x7823
mov dword [esp + 0xc], eax
xor esi, 0x529
lea eax, [ecx + 0x33f]
mov dword [esp + 0x18], edx
mov dword [esp + 0x24], ecx
push edi
mov edi, dword [esp + 0x20]
cmp esi, eax
je 0x41a99c
lea eax, [ebx - 0x11c]
cmp edx, eax
je 0x41a99c
lea eax, [ebp + 0x26b]
push eax
lea eax, [ecx + 0x712]
push eax
mov eax, dword [esp + 0x38]
xor eax, 0x380f
add eax, 0x3347
push eax
lea eax, [ebx + 0xdec]
push eax
lea eax, [edx - 0xb0]
push eax
push edi
call fcn.00408e8e
mov ecx, dword [0x72a26c]
add esp, 0x18
add ecx, 0x2fba
mov ebx, eax
push 0x40
push ecx
push dword [edi + 0x4c]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add eax, 0x3800
xor esi, 0x9a7
mov dword [0x72a2ac], eax
lea eax, [ebx + 0x6d0]
push esi
push eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff8
push edi
push eax
mov eax, dword [esp + 0x2c]
xor eax, 0x743
push eax
call fcn.0041a377
mov edx, dword [esp + 0x30]
add esp, 0x14
mov esi, eax
mov ecx, ebp
xor ecx, 0xa59
cmp esi, ecx
je 0x41aa37
lea ecx, [ebp - 0x651]
cmp ebx, ecx
jle 0x41a9d7
mov eax, dword [0x70c18c]
cmp dword [eax + 0xb4], 0xd254
jbe 0x41aa37
mov eax, dword [eax + 0x58]
add eax, 0x3a76
mov dword [edi + 0x118], eax
jmp 0x41aa37
mov eax, dword [0x72a274]
mov ecx, dword [esp + 0x10]
imul eax, esi
mov dword [esp + 0x30], ecx
sub eax, edx
cmp ecx, eax
ja 0x41aa37
mov ecx, dword [esp + 0x28]
and ecx, esi
and ecx, 0x3940
cmp dword [0x72a200], ecx
jne 0x41aa23
mov eax, dword [edi + 0x88]
and eax, dword [esp + 0x28]
sub eax, dword [edi + 0xc4]
xor ebx, eax
mov eax, ebx
sub eax, dword [edi + 0x9c]
xor eax, ebp
add dword [edi + 0xa8], eax
mov eax, dword [0x72a274]
inc dword [esp + 0x30]
imul eax, esi
sub eax, edx
cmp dword [esp + 0x30], eax
jbe 0x41a9f9
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add eax, 0xfffffc2d
pop ebx
pop ecx
ret