joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100605ee
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x10064b40
call fcn.10058c20
xor esi, esi
cmp dword [0x1006ab14], esi
jne 0x10060632
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x1006061d
mov dword [0x1006ab14], edi
jmp 0x10060632
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x10060632
mov dword [0x1006ab14], 2
mov eax, dword [0x1006ab14]
cmp eax, 2
je 0x10060713
cmp eax, esi
je 0x10060713
cmp eax, 1
jne 0x10060677
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x10060660
mov eax, dword [0x1006a88c]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x1006067e
xor eax, eax
jmp 0x10060725
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.10057e90
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x100606b4
cmp edi, esi
jne 0x100606cf
lea eax, [ebx + ebx]
push eax
call fcn.1005b553
pop ecx
mov edi, eax
cmp edi, esi
je 0x10060677
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x10060702
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x100606ec
push esi
push esi
jmp 0x100606f2
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x1006070e
push edi
call fcn.1005a219
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x10060725
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.10058c5b
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x430a6450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x430a645f
pop dword [ebp - 0x18]
mov eax, 0x430a645f
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x34cb6
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0xcb65e286
add ecx, 0x349a5a36
xor ebx, ebx
add ebx, eax
mov esi, 0x283b3e71
add esi, 0x1acf9f8f
add esi, dword [ebp - 0x18]
mov edx, 0xbf84e724
mov dword [ebp - 8], 0xaa240ad5
mov edi, dword [esi]
xor dword [ebp - 0xc], edi
sub edi, edx
mov dword [ebx], edi
sub dword [ebp - 0xc], 0x83c92e4d
add ebx, 0x5baa028b
sub ebx, 0x5baa0287
add esi, 0x3e37c118
add esi, 0xc1c83eec
loop 0x430a64b0
add eax, 0xd0c31024
sub eax, 0xd0c22a61
mov ebx, eax
add eax, 5
mov ecx, 0x430a0000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x430a67ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430aa9f0]
jne 0x430a67c4
repz ret
jmp fcn.430a7df9
Function at 0x401ea0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x401f97
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x401f97
push ebx
call fcn.004087f0
add esp, 4
test eax, eax
je 0x401efa
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x401f01
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x401ee0
jmp 0x401f03
mov esi, 0x1505
jmp 0x401f03
mov esi, ecx
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov edx, ebx
sub edx, 1
jb 0x401f97
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
mov dword [esp], edx
jmp 0x401f34
inc ebp
dec ebx
je 0x401f95
mov eax, ebp
and eax, edx
mov edi, dword [esp + 0xc]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x401f95
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x401f30
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.004087f0
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x401f30
push dword [esp + 4]
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.00408810
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401f30
mov eax, dword [ecx + 0x10]
mov edi, dword [eax + edi*4]
jmp 0x401f97
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x401fb0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
xor eax, eax
test ecx, ecx
je 0x402097
test edx, edx
je 0x402097
mov ebp, dword [esp + 0x28]
test ebp, ebp
mov dword [esp], ecx
je 0x401ffa
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x402001
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x401fe0
jmp 0x402003
mov esi, 0x1505
jmp 0x402003
mov esi, ecx
mov dword [esp + 8], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
jb 0x402097
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edx
jmp 0x402034
inc ebx
dec ebp
je 0x402095
mov eax, ebx
and eax, edx
mov edi, dword [esp + 0x10]
mov edi, dword [edi + eax*4]
cmp edi, 0xffffffff
je 0x402095
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402030
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.004087f0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402030
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00408810
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402030
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x402097
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402490
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
test ecx, ecx
je 0x402598
mov esi, edx
test edx, edx
je 0x402598
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x402598
push esi
call fcn.004087f0
add esp, 4
test eax, eax
je 0x4024ea
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x4024f1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x4024d0
jmp 0x4024f3
mov ebp, 0x1505
jmp 0x4024f3
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x4025a0
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x40255a
call fcn.00402690
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x402598
push ecx
call fcn.004087f0
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x40260f
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x4025b8
inc ebx
dec esi
je 0x40250f
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x402514
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x4025b0
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.004087f0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4025b0
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00408810
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4025b0
mov eax, 0xffffffff
jmp 0x402598
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402628
inc ebx
dec esi
je 0x402555
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x40255a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x402620
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.004087f0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x402620
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00408810
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402620
jmp 0x40255a
Function at 0x402d40
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x402ee6
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x402edf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
mov eax, edx
jmp 0x402dd1
add ebp, dword [esp + 0x10]
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 0xc]
mov eax, 0x15b0
je 0x402edf
xor edx, edx
cmp eax, 8
mov dword [esp + 8], esi
jb 0x402e4c
mov edx, eax
and edx, 0x1ff8
mov dword [esp], edx
mov edx, 7
nop
nop
nop
nop
mov ebx, eax
movzx eax, byte [ebp]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + 7]
add edi, eax
mov eax, ecx
xor eax, edi
and ecx, edi
lea ecx, [eax + ecx*2]
mov eax, ebx
add ebp, 8
add edx, 8
cmp edx, ebx
jb 0x402df0
mov esi, dword [esp + 8]
mov edx, dword [esp]
mov ebx, eax
sub ebx, edx
mov dword [esp + 0xc], eax
jbe 0x402d98
mov dword [esp], edx
not edx
add edx, eax
mov dword [esp + 4], edx
mov edx, eax
and edx, 3
mov dword [esp + 0x10], ebx
je 0x402e94
neg edx
xor eax, eax
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx]
inc ebx
add edi, esi
add ecx, edi
dec eax
cmp edx, eax
jne 0x402e80
mov edx, dword [esp]
sub edx, eax
jmp 0x402e99
mov ebx, ebp
mov edx, dword [esp]
mov eax, dword [esp + 4]
cmp eax, 3
jb 0x402d90
mov eax, dword [esp + 0xc]
sub eax, edx
xor edx, edx
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x402eb0
jmp 0x402d90
shl ecx, 0x10
or ecx, edi
jmp 0x402eeb
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402f00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
not eax
cmp edx, 4
jb 0x402f7c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
shr esi, 8
xor al, byte [ecx]
movzx eax, al
mov ebx, dword [eax*4 + 0x436938]
mov eax, ebx
and eax, esi
add eax, eax
sub ebx, eax
add ebx, esi
mov eax, ebx
xor bl, byte [ecx + 1]
shr eax, 8
movzx esi, bl
xor eax, dword [esi*4 + 0x436938]
mov ebx, eax
xor al, byte [ecx + 2]
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x436938]
mov eax, ebx
xor bl, byte [ecx + 3]
shr eax, 8
movzx esi, bl
xor eax, dword [esi*4 + 0x436938]
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x402f20
test edx, edx
je 0x402f8e
test dl, 1
jne 0x402f92
mov esi, edx
cmp edx, 1
jne 0x402fae
jmp 0x402fec
mov ebx, eax
jmp 0x402fec
mov ebx, eax
xor al, byte [ecx]
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x436938]
inc ecx
lea esi, [edx - 1]
mov eax, ebx
cmp edx, 1
je 0x402fec
xor edx, edx
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ebx
shr eax, 8
xor bl, byte [ecx + edx]
movzx edi, bl
xor eax, dword [edi*4 + 0x436938]
mov ebx, eax
shr ebx, 8
xor al, byte [ecx + edx + 1]
movzx eax, al
xor ebx, dword [eax*4 + 0x436938]
add edx, 2
cmp esi, edx
jne 0x402fc0
not ebx
mov eax, ebx
pop esi
pop edi
pop ebx
ret
Function at 0x408d30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push eax
call fcn.00408e30
sub esp, 0x100
mov esi, esp
call fcn.00430fb0
jmp 0x408d49
test al, 1
jne 0x408d4f
jmp 0x408dca
call fcn.0042c920
test al, 1
jne 0x408d5a
jmp 0x408dc3
sub esp, 4
mov dword [esp], 0xfffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 8], eax
xor eax, eax
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x100
call fcn.00408720
add esp, 0xc
lea eax, str.eleet_or_leetspeak__is_a_system_of_modified_spellings_used_primarily_on_the_internet._it_often_uses_character_replacements_in_ways_that_play_on_the_similarity_of_their_glyphs_via_reflection_or_other_resemblance
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00408de0
add esp, 8
jmp 0x408da7
call fcn.0040a210
jmp 0x408dae
test al, 1
jne 0x408db4
jmp 0x408dbd
call fcn.0040fe10
jmp 0x408dbb
jmp 0x408dbd
jmp 0x408dbf
jmp 0x408dc1
jmp 0x408dc3
call fcn.00432de0
jmp 0x408dca
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov ebp, 0xffffffff
mov eax, 0xfffffffe
mov esi, 0xfffffffd
nop
nop
nop
nop
nop
nop
add eax, 2
add esi, 3
cmp byte [edi + ebp + 1], 0
lea ebp, [ebp + 1]
jne 0x40a010
shr esi, 2
cmp byte [edi + ebp - 1], 0x3d
mov dword [esp], ebp
je 0x40a045
mov ecx, dword [esp]
or ecx, 0xfffffffe
mov edx, dword [esp]
and edx, 0xfffffffe
add edx, ecx
mov ebp, dword [esp]
cmp byte [edi + edx + 1], 0x2e
jne 0x40a046
dec esi
cmp byte [edi + ebp - 2], 0x3d
je 0x40a062
mov ecx, dword [esp]
xor ecx, 0xfffffffd
and eax, 0xfffffffa
add eax, ecx
mov ebp, dword [esp]
cmp byte [edi + eax + 1], 0x2e
jne 0x40a063
dec esi
mov dword [esp + 8], esi
mov edx, 0
test ebp, ebp
je 0x40a157
xor ebp, ebp
mov edi, 2
jmp 0x40a092
lea eax, [edi + 4]
add edi, 2
mov ebp, edx
cmp edi, ecx
mov edi, eax
jae 0x40a157
mov esi, dword [esp + 0x40]
movzx eax, byte [esi + edi - 2]
push eax
call fcn.0040fb50
add esp, 4
mov ebx, eax
movzx eax, byte [esi + edi - 1]
push eax
call fcn.0040fb50
add esp, 4
mov bh, al
shl bl, 2
shr al, 4
and al, 3
or al, bl
lea edx, [ebp + 1]
mov ecx, dword [esp + 0x44]
mov byte [ecx + ebp], al
mov ecx, dword [esp]
cmp edi, ecx
jae 0x40a080
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + edi]
push eax
mov dword [esp + 8], edx
call fcn.0040fb50
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
add esp, 4
cmp al, 0x40
je 0x40a080
mov bl, al
shl bh, 4
shr al, 2
and al, 0xf
or al, bh
lea edx, [ebp + 2]
mov ecx, dword [esp + 0x44]
mov byte [ecx + ebp + 1], al
mov ecx, dword [esp]
lea eax, [edi + 1]
cmp eax, ecx
jae 0x40a080
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + edi + 1]
push eax
mov dword [esp + 8], edx
call fcn.0040fb50
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
add esp, 4
cmp al, 0x40
je 0x40a080
shl bl, 6
add al, bl
mov ecx, dword [esp + 0x44]
mov byte [ecx + ebp + 2], al
mov ecx, dword [esp]
add ebp, 3
mov edx, ebp
jmp 0x40a080
mov ebx, dword [esp + 8]
cmp edx, ebx
mov eax, 0
jne 0x40a1b1
lea edi, [esp + 0xc]
mov esi, dword [esp + 0x44]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
add ebx, 0xffffffe0
je 0x40a1ab
xor eax, eax
nop
nop
movzx ecx, byte [esi + eax + 0x20]
mov edx, eax
and edx, 0x1f
movzx edx, byte [esp + edx + 0xc]
mov ch, dl
and ch, cl
add dl, cl
add ch, ch
sub dl, ch
mov byte [esi + eax], dl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, ebx
jb 0x40a180
mov byte [esi + ebx], 0
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x414950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebp, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x414970
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x414990
sar edi, 1
sar eax, 1
add eax, edi
add eax, 2
test eax, eax
jns 0x4149af
mov eax, 0xffffffff
jmp 0x4149b1
add eax, eax
push eax
call fcn.00408540
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x4149e1
add esi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x4149d0
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0x414a11
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414a00
mov word [eax], 0
lea eax, [esp + 4]
push 0x20
push 1
push 3
push 0x120089
push eax
push ebx
call fcn.004341a0
add esp, 0x18
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x43af68]
mov ecx, 0x8edad508
xor ecx, dword [0x43af70]
add eax, ecx
inc eax
mov dword [esp + 0x24], ebx
jmp eax
Function at 0x42dfc0
Capabilities:
Encode data using xor
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x14], 0xc3d2e1f0
mov dword [esp + 0x10], 0x10325476
mov dword [esp + 0xc], 0x98badcfe
mov dword [esp + 8], 0xefcdab89
mov dword [esp + 4], 0x67452301
cmp ebp, 0x40
jb 0x42e07d
mov edi, ebp
shr edi, 6
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
add esi, 4
cmp esi, 0x40
jne 0x42e020
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.0042e690
add esp, 8
inc ebx
lea eax, [esi + ebp]
cmp ebx, edi
jne 0x42e010
add ebp, esi
mov eax, ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov ecx, ebp
and ecx, 0x3f
mov dword [esp], ecx
je 0x42e174
mov ecx, ebp
and ecx, 1
xor edi, edi
cmp dword [esp], 1
je 0x42e15d
mov dword [esp + 0x18], ecx
sub dword [esp], ecx
xor ebx, ebx
xor edi, edi
nop
movzx ebp, byte [eax + edi]
mov ecx, ebx
and cl, 0x10
shl ebp, cl
mov edx, edi
and edx, 0xfffffffc
xor ebp, dword [esp + edx + 0x1c]
mov dword [esp + edx + 0x1c], ebp
movzx esi, byte [eax + edi + 1]
or cl, 8
shl esi, cl
xor esi, ebp
mov dword [esp + edx + 0x1c], esi
add edi, 2
add ebx, 0x10
cmp dword [esp], edi
jne 0x42e120
add eax, edi
mov ebp, dword [esp + 0x74]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x42e174
movzx eax, byte [eax]
lea ecx, [edi*8]
shl eax, cl
and edi, 0xfffffffc
xor dword [esp + edi + 0x1c], eax
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x1c], eax
mov esi, dword [esp + 0x78]
mov eax, ebp
not eax
test al, 0x38
jne 0x42e1ba
lea edi, [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
call fcn.0042e690
add esp, 8
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov dword [esp + 0x54], ebx
shr ebp, 0x1d
mov dword [esp + 0x58], ebp
lea eax, [esp + 0x1c]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.0042e690
add esp, 8
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x430fb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x290
mov dword [esp + 0x80], 0x3bac3958
mov dword [esp + 0x84], 0x3f503d5e
mov dword [esp + 0x88], 0x230e2152
mov dword [esp + 0x8c], 0x27482546
mov dword [esp + 0x90], 0x2b28294a
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa3], 0
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 0x26
ja 0x43106b
nop
nop
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
add al, 0x27
xor al, byte [esp + ecx + 0x80]
add al, 0xef
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x80], al
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, 0x27
jb 0x431040
lea esi, [esp + 0x80]
push esi
call fcn.00432f10
add esp, 4
mov dword [0x442a28], eax
xor ecx, ecx
test eax, eax
sete cl
mov ecx, dword [ecx*4 + 0x43fd44]
mov edx, 0x938c9d75
xor edx, dword [0x43fd4c]
add ecx, edx
inc ecx
jmp ecx
dec edx
dec edx
dec edx
dec edx
dec edx
dec edx
dec edx
dec edx
popal
arpl word [edi + 0x4e], sp
dec edx
dec edx
imul ebp, dword [ebp + 0x4a], 0x4a
inc ebp
insd dword es:[edi], dx
dec edx
dec edx
inc esp
inc ebp
dec edx
dec edx
add byte [eax], al
add byte [edx], al
or eax, 0x6060606
push cs
add byte [eax], al
add byte [eax], al
push es
push es
push es
add byte [esi], al
push es
add al, byte [esi]
add byte [edx], cl
or cl, byte [edx]
pop es
pop es
push es
add al, byte [0x20205]
add byte [esp + eax], al
add al, 4
add byte [eax], al
add byte [esi], cl
add eax, 0x1060606
push es
add byte [eax], al
or byte [eax], al
adc byte [eax], al
sbb byte [eax], al
and byte [eax], al
sub byte [eax], al
xor byte [eax], al
add byte [ecx], 0x82
add dword [esi - 0x1300a00], eax
aas
stosd dword es:[edi], eax
add byte [eax - 0x4cff4f00], dh
add byte [edx - 0x3fff4408], bh
add cl, al
add bh, al
mov edi, 0x8d00ff62
inc dword [eax]
invalid
ret