joyce8/EMBER2024-capa huggingface dataset:
Function at 0x556de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x84], 0xffffffff
jne 0x556df5
xor eax, eax
pop edi
pop ebp
ret
push ebx
push esi
push dword [edi]
call fcn.00534060
mov ecx, dword [ebp + 0x10]
add esp, 4
mov ebx, dword [ebp + 0xc]
mov esi, eax
mov dword [ecx], esi
test ebx, ebx
je 0x556ea9
mov ecx, dword [edi + 0x84]
cmp ecx, esi
jne 0x556e46
test esi, esi
jle 0x556e87
mov edx, ebx
lea ecx, [edi + 4]
mov ebx, esi
nop dword [eax + eax]
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x556e30
jmp 0x556e84
sub eax, ecx
mov byte [ecx + edi + 0x64], 0x80
cmp eax, 1
jle 0x556e64
dec eax
push eax
lea eax, [edi + 0x65]
add eax, ecx
push 0
push eax
call fcn.005e26d0
add esp, 0xc
test esi, esi
jle 0x556e87
mov edx, ebx
lea ecx, [edi + 0x24]
mov ebx, esi
nop
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x556e70
mov ebx, dword [ebp + 0xc]
push esi
push ebx
push ebx
push dword [edi]
call fcn.005345f0
add esp, 0x10
test eax, eax
jne 0x556ea9
push esi
push ebx
call fcn.00538750
add esp, 8
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ebp
ret
Function at 0x600439
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006002b8
Function at 0x404540
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x404610
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x404610
mov esi, 0x1505
cmp dword [esp + 0x28], 0
je 0x404590
xor ebx, ebx
nop
nop
movzx ecx, byte [ebp + ebx]
test ecx, ecx
je 0x404590
mov edx, esi
shl edx, 5
mov edi, edx
and edi, esi
xor edx, esi
add edx, ecx
lea esi, [edx + edi*2]
inc ebx
cmp dword [esp + 0x28], ebx
jne 0x404570
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edi, [ebx - 1]
mov edx, ebx
sub edx, 1
mov dword [esp + 8], edx
jb 0x404610
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4045b4
inc edi
dec ebx
je 0x40460e
mov eax, edi
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x40460e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x4045b0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040cb00
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x4045b0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040cb20
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x4045b0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x404610
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404d90
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x28]
mov eax, 0xffffffff
test ebp, ebp
je 0x404edb
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x404edb
cmp dword [esp + 0x30], 0
je 0x404edb
push edi
call fcn.0040cb00
add esp, 4
mov dword [esp], eax
mov ebx, 0x1505
test eax, eax
je 0x404dfe
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edi + eax]
test ecx, ecx
je 0x404dfe
mov edx, ebx
shl edx, 5
mov esi, edx
and esi, ebx
xor edx, ebx
add edx, ecx
lea ebx, [edx + esi*2]
inc eax
cmp dword [esp], eax
jne 0x404de0
mov esi, dword [ebp + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x404e61
mov ebp, 0xffffffff
mov esi, dword [esp + 0x28]
mov eax, dword [esi + 0x18]
cmp eax, dword [esi + 0x1c]
jae 0x404ec5
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x18]
mov edx, dword [esp + 0x2c]
mov dword [eax + ecx*4], edx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [esi + 0x10]
mov edx, dword [esp + 0x30]
mov dword [eax + ecx*4], edx
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x18]
mov dword [eax + ecx*4], ebx
inc dword [esi + 0x18]
mov eax, dword [esi]
mov dword [edx], eax
xor eax, eax
jmp 0x404edb
and edi, ebx
mov eax, dword [ebp + 4]
mov dword [esp + 4], eax
jmp 0x404e74
inc edi
dec esi
je 0x404e0f
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404e14
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + 8]
cmp dword [ecx + eax*4], ebx
jne 0x404e70
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040cb00
add esp, 4
cmp eax, dword [esp]
jne 0x404e70
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040cb20
add esp, 0xc
test eax, eax
jne 0x404e70
mov eax, 0xffffffff
jmp 0x404edb
mov ecx, esi
call fcn.00405ac0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x2c]
je 0x404ee3
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push ecx
call fcn.0040cb00
add esp, 4
mov dword [esp + 0xc], eax
mov edx, dword [esi + 0x20]
lea edi, [edx - 1]
mov eax, edx
sub eax, 1
mov dword [esp + 8], eax
jae 0x404f0b
mov ebp, 0xffffffff
jmp 0x404e24
and edi, ebx
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
jmp 0x404f24
inc edi
dec edx
je 0x404f84
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404f89
mov esi, dword [esp + 0x28]
mov ecx, dword [esi + 8]
cmp dword [ecx + eax*4], ebx
jne 0x404f20
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x10], eax
push eax
mov dword [esp + 4], edx
call fcn.0040cb00
mov edx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0xc]
jne 0x404f20
push dword [esp + 0xc]
push dword [esp + 0x14]
push dword [esp + 0x34]
call fcn.0040cb20
mov edx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x404f20
jmp 0x404e24
mov ebp, 0xffffffff
mov esi, dword [esp + 0x28]
jmp 0x404e24
Function at 0x405820
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405a03
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x405a03
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405a03
cmp dword [ecx], 0
jne 0x405a03
push edi
call fcn.0040cb00
add esp, 4
mov ebp, 0x1505
test eax, eax
je 0x40588d
xor ebx, ebx
nop
nop
nop
nop
movzx ecx, byte [edi + ebx]
test ecx, ecx
je 0x40588d
mov edx, ebp
shl edx, 5
mov esi, edx
and esi, ebp
xor edx, ebp
add edx, ecx
lea ebp, [edx + esi*2]
inc ebx
cmp eax, ebx
jne 0x405870
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x28]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0xc], eax
mov dword [esp], ebp
jae 0x40596f
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
jb 0x4058fd
mov ecx, dword [esp + 0x28]
call fcn.00405ac0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x405a03
push ebx
call fcn.0040cb00
add esp, 4
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov edx, ebx
push esi
push dword [esp + 4]
push eax
call fcn.00405a10
add esp, 0xc
mov ebp, eax
push ebx
call fcn.0040cb00
add esp, 4
mov esi, ebx
mov ebx, eax
inc eax
push eax
call dword [0x449008]
add esp, 4
test eax, eax
je 0x4059fe
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c8e0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov dword [eax + ecx*4], edi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov esi, dword [esp]
mov dword [eax + ecx*4], esi
mov ecx, edx
inc dword [edx + 0x18]
mov eax, dword [ecx]
mov dword [edi], eax
xor eax, eax
jmp 0x405a03
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405988
inc ebx
dec esi
je 0x4058ad
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov edi, dword [eax + ebp*4]
cmp edi, 0xffffffff
je 0x4058b2
mov eax, dword [ecx + 8]
mov edx, dword [esp]
cmp dword [eax + edi*4], edx
jne 0x405980
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + edi*4]
push ebp
call fcn.0040cb00
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x405980
push dword [esp + 4]
push ebp
push dword [esp + 0x34]
call fcn.0040cb20
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405980
mov eax, dword [ecx + 0x10]
push dword [eax + edi*4]
call fcn.00404940
mov ecx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [ecx + 0x10]
mov edx, dword [esp + 0x30]
mov dword [eax + edi*4], edx
mov edi, edx
jmp 0x405964
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406ad0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406c76
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406c6f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406b65
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406c6f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406bde
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406b80
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406b2d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406c20
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406c00
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406b20
jmp 0x406c2f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406b20
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406c40
jmp 0x406b20
shl ecx, 0x10
or ecx, edi
jmp 0x406c7b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d0b0
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push edi
push esi
sub esp, 0x2c
mov dword [esp], 0x710e3123
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x3d
xor cl, byte [esp + eax]
add cl, 0xcf
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x40d0c0
mov esi, dword [esp]
call fcn.0043fad0
test al, al
je 0x40d277
call fcn.00437d30
test al, al
je 0x40d272
mov ecx, esi
and ecx, 0x34a7ad07
mov edx, esi
mov eax, esi
or esi, 0x34a7ad07
imul esi, ecx
xor ecx, 0x34a7ad07
and edx, 0xcb5852f8
lea edi, [edx*2 + 2]
sub edi, edx
add edi, 0xfffffffe
or eax, 0xcb5852f8
mov edx, edi
and edx, eax
or eax, edi
not eax
imul eax, edx
mov edx, edi
and edx, ecx
or edi, ecx
imul edi, edx
add esi, edi
add esi, eax
mov edi, esi
shr edi, 7
xor edi, esi
mov eax, edi
and eax, 0xf5ae3701
mov ecx, edi
and ecx, 0xa51c8fe
or edi, 0xa51c8fe
imul edi, ecx
xor ecx, 0xa51c8fe
imul ecx, eax
add edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp], 0xf9814689
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
mov ecx, eax
add cl, 0x28
xor cl, byte [esp + eax]
add cl, 0x38
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x40d180
cmp edi, dword [esp]
jne 0x40d24f
mov dword [esp], 0x41d147a9
mov dword [esp + 4], 0x4d9443ac
mov dword [esp + 8], 0x49d64fa3
mov dword [esp + 0xc], 0x756a4ba7
mov dword [esp + 0x10], 0x719b77a5
mov dword [esp + 0x14], 0x7370
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x11
xor cl, byte [esp + eax]
add cl, 0xab
mov byte [esp + eax], cl
inc eax
cmp eax, 0x1b
jne 0x40d1e0
mov dword [esp + 0x1c], 0x81368735
mov dword [esp + 0x20], 0x8d34832f
mov dword [esp + 0x24], 0x8f8c
mov byte [esp + 0x28], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x21
xor cl, byte [esp + eax + 0x1c]
add cl, 0x5b
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0xd
jne 0x40d220
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0
push eax
push 0x448050
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40d25f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call int.0040e1c0
test al, al
je 0x40d272
call fcn.004107e0
call fcn.0040f960
call fcn.00440ca0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40e010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov al, byte [esp + 0x1c]
test esi, esi
sets bl
mov edi, esi
sub edi, 1
sete bh
or bl, bh
mov edi, esi
sub edi, 0x25
setge bh
or bl, bh
test bl, 1
jne 0x40e046
jmp 0x40e04b
jmp 0x40e1ad
movzx ebx, al
mov edi, ecx
add edi, edx
add edi, 0xffffffff
mov byte [ecx + edx - 1], 0
cmp ebx, 0
sete cl
test cl, 1
jne 0x40e067
jmp 0x40e075
mov ecx, edi
add ecx, 0xffffffff
mov byte [edi - 1], 0x30
jmp 0x40e1ad
cmp esi, 0xa
sete cl
test cl, 1
jne 0x40e085
jmp 0x40e122
jmp 0x40e087
movzx esi, al
cmp esi, 0x64
setae al
test al, 1
jne 0x40e096
jmp 0x40e0ce
mov ecx, 0x64
mov eax, esi
xor edx, edx
div ecx
shl edx, 1
mov al, byte [edx + 0x4476d9]
mov ecx, edi
add ecx, 0xffffffff
mov byte [edi - 1], al
mov al, byte [edx + 0x4476d8]
add ecx, 0xffffffff
mov byte [edi - 2], al
mov edi, 0x64
mov eax, esi
xor edx, edx
div edi
mov edi, ecx
jmp 0x40e087
cmp esi, 0xa
jae 0x40e0e4
mov al, byte [esi + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov ecx, edi
add ecx, 0xffffffff
mov byte [edi - 1], al
jmp 0x40e11d
mov eax, esi
and eax, 0xfffffffd
mov ecx, esi
or ecx, 0xfffffffd
xor ecx, 0xffffffff
imul ecx, eax
mov eax, esi
and eax, 2
or esi, 2
imul esi, eax
add esi, ecx
mov al, byte [esi + 0x4476d9]
mov ecx, edi
add ecx, 0xffffffff
mov byte [edi - 1], al
mov al, byte [esi + 0x4476d8]
add ecx, 0xffffffff
mov byte [edi - 2], al
jmp 0x40e1ad
cmp esi, 0x10
sete cl
jmp 0x40e12a
test cl, 1
jne 0x40e133
jmp 0x40e131
jmp 0x40e176
movzx eax, al
jmp 0x40e138
cmp eax, 0x10
setl cl
test cl, 1
jne 0x40e145
jmp 0x40e156
mov al, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov ecx, edi
add ecx, 0xffffffff
mov byte [edi - 1], al
jmp 0x40e1ad
shl eax, 1
mov dl, byte [eax + 0x4477a2]
mov ecx, edi
add ecx, 0xffffffff
mov byte [edi - 1], dl
mov al, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
add ecx, 0xffffffff
mov byte [edi - 2], al
jmp 0x40e1ad
movzx ecx, al
cmp ecx, 0
seta al
test al, 1
jne 0x40e185
jmp 0x40e1a9
mov eax, ecx
xor edx, edx
div esi
lea eax, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
add eax, edx
jmp 0x40e195
mov al, byte [eax]
mov ebx, edi
add ebx, 0xffffffff
mov byte [edi - 1], al
mov eax, ecx
xor edx, edx
div esi
mov edi, ebx
jmp 0x40e176
mov ecx, edi
jmp 0x40e1ad
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
ret
Function at 0x40ea10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
movzx ecx, byte [edx]
test cl, cl
je 0x40ecac
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test ebp, ebp
je 0x40ea4c
cmp edx, ebp
jae 0x40ecac
test edi, edi
je 0x40ecac
movzx ebx, cl
test cl, cl
js 0x40ea80
inc edx
lea ecx, [eax + 2]
mov word [eax], bx
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
movzx ecx, byte [edx]
test cl, cl
jne 0x40ea40
jmp 0x40ecac
mov ebp, ebx
and ebp, 0xffffffe0
cmp ebp, 0xc0
jne 0x40ea98
cmp cl, 0xc2
jae 0x40eadb
mov ebp, dword [esp + 0x28]
jmp 0x40ea6c
mov esi, ebx
and esi, 0xfffffff0
cmp esi, 0xe0
jne 0x40eb0c
movzx esi, byte [edx + 1]
mov dword [esp], esi
cmp cl, 0xed
mov ebp, dword [esp + 0x28]
je 0x40eb59
cmp ebx, 0xe0
mov ecx, dword [esp]
jne 0x40eb65
mov ecx, dword [esp]
add cl, 0x40
cmp cl, 0xe0
mov ecx, dword [esp]
jb 0x40ea6c
jmp 0x40eb65
movzx ecx, byte [edx + 1]
movzx esi, cl
mov ebp, esi
and ebp, 0xffffffc0
cmp ebp, 0x80
jne 0x40eb4f
and ebx, 0x1f
shl ebx, 6
add edx, 2
and esi, 0x3f
or esi, ebx
lea ecx, [eax + 2]
mov word [eax], si
mov ebp, dword [esp + 0x28]
jmp 0x40ea62
mov esi, ebx
and esi, 0xfffffff8
cmp esi, 0xf0
mov ebp, dword [esp + 0x28]
jne 0x40ec87
cmp cl, 0xf4
ja 0x40ea6c
movzx ecx, byte [edx + 1]
mov dword [esp], ecx
je 0x40ebb1
cmp ebx, 0xf0
jne 0x40ebba
mov ecx, dword [esp]
add cl, 0x40
cmp cl, 0xd0
mov ecx, dword [esp]
jb 0x40ea6c
jmp 0x40ebba
inc edx
mov ebp, dword [esp + 0x28]
jmp 0x40ea6f
mov ecx, dword [esp]
cmp cl, 0x9f
ja 0x40ea6c
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40ec8e
movzx ecx, byte [edx + 2]
movzx ebp, cl
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ec94
shl ebx, 0xc
mov ecx, dword [esp]
and ecx, 0x3f
shl ecx, 6
or ecx, ebx
add edx, 3
and ebp, 0x3f
or ebp, ecx
lea ecx, [eax + 2]
mov word [eax], bp
mov ebp, dword [esp + 0x28]
jmp 0x40ea62
cmp cl, 0x8f
ja 0x40ea6c
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40ec8e
movzx ecx, byte [edx + 2]
movzx ebp, cl
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ec94
movzx ecx, byte [edx + 3]
movzx esi, cl
mov dword [esp + 4], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40eca0
and ebp, 0x3f
shl ebp, 6
and ebx, 7
shl ebx, 0x12
mov esi, dword [esp]
and esi, 0x3f
shl esi, 0xc
or esi, ebx
or esi, ebp
add edx, 4
mov ecx, esi
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x40ea92
mov ebx, dword [esp + 4]
and ebx, 0x3f
or ebx, esi
cmp ebx, 0x10000
jb 0x40ea92
cmp edi, 2
mov ebp, dword [esp + 0x28]
jb 0x40ec87
mov ecx, ebx
xor ecx, 0x10000
and ebx, 0x1effff
add ebx, ebx
sub ebx, ecx
mov ecx, ebx
shr ecx, 0xa
and ecx, 0x3ff
or ecx, 0xd800
mov word [eax], cx
and ebx, 0x3ff
or ebx, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bx
jmp 0x40ea62
mov ecx, eax
jmp 0x40ea62
inc edx
jmp 0x40ea6c
add edx, 2
mov ebp, dword [esp + 0x28]
jmp 0x40ea6f
add edx, 3
mov ebp, dword [esp + 0x28]
jmp 0x40ea6f
mov word [eax], 0
sub eax, dword [esp + 0x1c]
sar eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f970
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov ebp, dword [esp + 0x468]
mov edi, dword [esp + 0x450]
mov dword [esp + 0x3c], 0xf345f1a5
mov dword [esp + 0x40], 0xff57fd46
mov dword [esp + 0x44], 0xfb4ef94c
mov dword [esp + 0x48], 0xc7b1c565
mov dword [esp + 0x4c], 0xc3b4c1bd
mov dword [esp + 0x50], 0xcfaecdbc
mov dword [esp + 0x54], 0xcb95c9a0
mov dword [esp + 0x58], 0xd760d57d
mov dword [esp + 0x5c], 0xd365d17c
mov dword [esp + 0x60], 0xdf6ddd63
mov dword [esp + 0x64], 0xdb8cd9b8
mov dword [esp + 0x68], 0x27462578
mov dword [esp + 0x6c], 0x23522151
mov dword [esp + 0x70], 0x2f5e2d5a
mov dword [esp + 0x74], 0x2b4a2953
mov dword [esp + 0x78], 0x379f356b
mov dword [esp + 0x7c], 0x334c3186
mov dword [esp + 0x80], 0x3f453d40
mov dword [esp + 0x84], 0x3b823958
mov dword [esp + 0x88], 0x77a057a
mov dword [esp + 0x8c], 0x3620169
mov dword [esp + 0x90], 0xfbe0d4d
mov dword [esp + 0x94], 0xbbe09b8
mov dword [esp + 0x98], 0x174915b9
mov dword [esp + 0x9c], 0x13b011bd
mov dword [esp + 0xa0], 0x1fb71d57
mov dword [esp + 0xa4], 0x1b6d19a4
mov dword [esp + 0xa8], 0x67156519
mov dword [esp + 0xac], 0x6314611f
mov dword [esp + 0xb0], 0x6f106d1f
mov dword [esp + 0xb4], 0x6b026908
mov dword [esp + 0xb8], 0x773e753f
mov dword [esp + 0xbc], 0x7327712c
mov dword [esp + 0xc0], 0x7f0a7d28
mov dword [esp + 0xc4], 0x7bce7918
mov dword [esp + 0xc8], 0x47ed45ed
mov dword [esp + 0xcc], 0x432241ed
mov dword [esp + 0xd0], 0x4fe34d03
mov dword [esp + 0xd4], 0x4be149eb
mov dword [esp + 0xd8], 0x573f55e3
mov dword [esp + 0xdc], 0x53115130
mov dword [esp + 0xe0], 0x5fec5df4
mov dword [esp + 0xe4], 0x5bef59ef
mov dword [esp + 0xe8], 0xa7d1a509
mov dword [esp + 0xec], 0xa3d3a1d1
mov dword [esp + 0xf0], 0xafd8add5
mov dword [esp + 0xf4], 0xabdca9d8
mov dword [esp + 0xf8], 0xb7c0b5c4
mov dword [esp + 0xfc], 0xb3d2b1c0
mov dword [esp + 0x100], 0xbf1fbdef
mov dword [esp + 0x104], 0xbb1bb916
mov dword [esp + 0x108], 0x872f8536
mov dword [esp + 0x10c], 0x83ff81f7
mov dword [esp + 0x110], 0x8ff18dff
mov dword [esp + 0x114], 0x8bf989fe
mov dword [esp + 0x118], 0x979695ea
mov byte [esp + 0x11e], 0
mov word [esp + 0x11c], 0
mov eax, dword [0x44f190]
mov ecx, 0x6d3616d6
mov edx, 0xda6c2dac
nop
nop
mov esi, edx
and esi, 0x86000a8
mov ebx, ecx
xor ebx, 0x14f8c854
add ebx, esi
mov esi, ebx
xor esi, 0xd6
and ebx, 0x29
add ebx, ebx
sub ebx, esi
xor bl, byte [esp + ecx - 0x6d36169a]
add bl, 0x5c
mov byte [esp + ecx - 0x6d36169a], bl
inc ecx
add edx, 2
cmp ecx, 0x6d3617b9
jne 0x40fbe0
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
xor ecx, ecx
mov dword [esp + 8], eax
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449b70]
Function at 0x41f3f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41f4fe
mov ebp, dword [esp + 0x18]
xor ebx, ebx
mov edi, 2
jmp 0x41f422
mov ebp, edx
lea ecx, [edi + 4]
add edi, 2
cmp edi, esi
mov edi, ecx
jae 0x41f500
mov esi, ebx
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.00421a20
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.00421a20
add esp, 4
shl bh, 2
mov ah, al
shr ah, 4
and ah, 3
or ah, bh
mov ecx, esi
and ecx, 1
mov edx, ebp
mov ebp, esi
xor ebp, 1
lea ebx, [ecx*2]
add ebx, ebp
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi], ah
mov esi, dword [esp + 0x1c]
cmp edi, esi
jae 0x41f410
mov byte [esp], al
movzx eax, byte [edx + edi]
push eax
call fcn.00421a20
add esp, 4
cmp al, 0x40
jne 0x41f490
mov ebp, dword [esp + 0x18]
jmp 0x41f412
and ebp, 1
mov ecx, ebx
or ecx, 1
add ecx, ebp
mov ebp, ecx
movzx edx, byte [esp]
shl dl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, dl
mov edx, dword [esp + 0x20]
mov byte [edx + ebx], cl
lea ecx, [edi + 1]
cmp ecx, esi
jae 0x41f4de
mov dword [esp], ebp
mov ebx, eax
mov ebp, dword [esp + 0x18]
movzx eax, byte [ebp + edi + 1]
push eax
call fcn.00421a20
add esp, 4
cmp al, 0x40
jne 0x41f4e9
mov ebx, dword [esp]
jmp 0x41f412
mov ebx, ebp
mov ebp, dword [esp + 0x18]
jmp 0x41f412
shl bl, 6
add al, bl
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp]
mov byte [ecx + ebx], al
inc ebx
jmp 0x41f412
xor ebx, ebx
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret