joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404570
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x404650
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x404650
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4045ba
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x4045c1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x4045a0
jmp 0x4045c3
mov esi, 0x1505
jmp 0x4045c3
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edx, [ebx - 1]
mov ecx, ebx
sub ecx, 1
mov dword [esp + 8], ecx
jb 0x404650
mov ecx, esi
not ecx
or edx, ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
lea ebp, [esi + edx]
inc ebp
jmp 0x4045f4
inc ebp
dec ebx
je 0x40464e
mov eax, ebp
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40464e
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4045f0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp], eax
push eax
call fcn.0040c9e0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x4045f0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040ca00
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x4045f0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x404650
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404dd0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x404eea
mov esi, dword [esp + 0x28]
test esi, esi
je 0x404eea
cmp dword [esp + 0x2c], 0
je 0x404eea
push esi
call fcn.0040c9e0
add esp, 4
test eax, eax
je 0x404e3a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x404e41
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x404e20
jmp 0x404e43
mov ebx, 0x1505
jmp 0x404e43
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edx, [esi - 1]
mov edi, ebx
not edi
mov ebp, esi
sub ebp, 1
mov dword [esp + 0xc], ebp
mov dword [esp + 4], edi
jae 0x404ef2
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x404eaf
call fcn.00405b90
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x404eea
push ecx
call fcn.0040c9e0
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea eax, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0xc], edx
jae 0x404f70
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
or edx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
lea edi, [ebx + edx]
inc edi
jmp 0x404f18
inc edi
dec esi
je 0x404e64
mov ebp, edi
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404e69
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x404f10
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040c9e0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404f10
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040ca00
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404f10
mov eax, 0xffffffff
jmp 0x404eea
or eax, dword [esp + 4]
mov edx, dword [ecx + 4]
mov dword [esp + 8], edx
lea edi, [ebx + eax]
inc edi
jmp 0x404f98
inc edi
dec esi
je 0x404eaa
mov ebp, edi
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404eaf
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x404f90
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 4], eax
push eax
call fcn.0040c9e0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404f90
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040ca00
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404f90
jmp 0x404eaf
Function at 0x4058d0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405aba
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405aba
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405aba
cmp dword [ecx], 0
jne 0x405aba
push esi
call fcn.0040c9e0
add esp, 4
test eax, eax
je 0x40593a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405941
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405920
jmp 0x405943
mov edi, 0x1505
jmp 0x405943
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea esi, [edx - 1]
mov ebx, edx
sub ebx, 1
mov dword [esp + 0xc], ebx
jae 0x405a14
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x4059a1
call fcn.00405b90
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405aba
push esi
call fcn.0040c9e0
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405ad0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040c9e0
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x449008]
add esp, 4
test eax, eax
je 0x405ab5
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c900
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405aba
mov dword [esp], eax
mov eax, edx
mov edx, edi
not edx
or esi, edx
mov edx, eax
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
lea ebx, [edi + esi]
inc ebx
jmp 0x405a38
inc ebx
dec edx
je 0x40595c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405961
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405a30
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040c9e0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405a30
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040ca00
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405a30
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404980
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405a09
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406b80
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406d26
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406d1f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406c15
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406d1f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406c8e
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406c30
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406bdd
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406cd0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406cb0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406bd0
jmp 0x406cdf
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406bd0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406cf0
jmp 0x406bd0
shl ecx, 0x10
or ecx, edi
jmp 0x406d2b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406d40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x406d9c
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test edx, edx
je 0x406d9e
not eax
xor esi, esi
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x446c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
mov edi, dword [edi*4 + 0x446c50]
mov ebx, eax
and ebx, edi
add eax, edi
add ebx, ebx
sub eax, ebx
inc esi
cmp edx, esi
jne 0x406d60
not eax
jmp 0x406d9e
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x40c7b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, edx
mov eax, dword [esp + 0x14]
mov edx, dword [edx + 8]
mov esi, 1
cmp edx, eax
jae 0x40c820
cmp dword [esp + 0x18], 0
je 0x40c7fe
cmp edx, 1
adc edx, 0
cmp edx, eax
jae 0x40c802
mov ebx, edx
nop
nop
nop
nop
nop
nop
nop
mov ebp, edx
or ebp, 2
and ebx, 2
imul ebp, ebx
and edx, 0xfffffffd
xor ebx, 2
imul ebx, edx
add ebx, ebp
mov edx, ebx
cmp ebx, eax
jb 0x40c7e0
jmp 0x40c804
mov ebx, eax
jmp 0x40c804
mov ebx, edx
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40c81e
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40c820
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cf70
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push edi
push esi
sub esp, 0x2c
mov dword [esp], 0xb7b6eb9d
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xcf828a5e
nop
nop
nop
movzx ecx, byte [esp + eax + 0x307d75a2]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x2a
mov byte [esp + eax + 0x307d75a2], cl
inc eax
cmp eax, 0xcf828a65
jne 0x40cf90
mov esi, dword [esp]
call fcn.0043f400
test al, al
je 0x40d1c3
call fcn.004386d0
test al, al
je 0x40d1be
mov eax, esi
not eax
or eax, 0xcb5852f8
lea ecx, [esi + eax]
inc ecx
lea eax, [esi + esi]
not eax
add eax, esi
and eax, 0x34a7ad07
mov edi, ecx
not edi
and edi, eax
mov edx, eax
not edx
and edx, ecx
imul edx, edi
mov edi, eax
and edi, ecx
or eax, ecx
imul eax, edi
mov ecx, esi
and ecx, 0x34a7ad07
or esi, 0x34a7ad07
imul esi, ecx
add esi, eax
add esi, edx
mov eax, esi
shr eax, 7
lea ecx, [esi + esi]
not ecx
add ecx, esi
mov edi, eax
not edi
or ecx, edi
add eax, ecx
inc eax
and edi, esi
or edi, eax
mov eax, edi
and eax, 0xf5ae3701
mov ecx, edi
and ecx, 0xa51c8fe
or edi, 0xa51c8fe
imul edi, ecx
xor ecx, 0xa51c8fe
imul ecx, eax
add edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp], 0xffd7122b
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
mov ecx, eax
xor ecx, 0x327fa5ac
mov esi, eax
or esi, 3
and esi, ecx
mov ecx, eax
xor ecx, 0x4d805a53
lea ecx, [ecx + esi*2]
xor ecx, edx
mov edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
add cl, 0x60
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x40d070
cmp edi, dword [esp]
jne 0x40d19b
mov dword [esp], 0x57a349a7
mov dword [esp + 4], 0x536055b8
mov dword [esp + 8], 0x5fa651bd
mov dword [esp + 0xc], 0x5b7a5db1
mov dword [esp + 0x10], 0x6789596b
mov dword [esp + 0x14], 0x6564
mov dword [esp + 0x18], 0
mov eax, 0x479b578e
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x479b578e]
xor ecx, eax
mov edx, ecx
not edx
and edx, 0xc7
and ecx, 0x38
sub ecx, edx
inc cl
mov byte [esp + eax - 0x479b578e], cl
inc eax
cmp eax, 0x479b57aa
jne 0x40d0f0
mov dword [esp + 0x1c], 0x9f6e996b
mov dword [esp + 0x20], 0xa3509d79
mov dword [esp + 0x24], 0xa1a0
mov word [esp + 0x28], 0
mov eax, 0x6916395a
nop
nop
movzx ecx, byte [esp + eax - 0x6916393e]
lea edx, [eax - 0x69163900]
and edx, ecx
or ecx, eax
xor ecx, edx
lea edx, [ecx - 0xd6f1ec3]
mov esi, edx
xor esi, 0xfe
or edx, 1
and edx, esi
mov esi, 0xc2
sub esi, ecx
or esi, 1
sub edx, esi
mov byte [esp + eax - 0x6916393e], dl
inc eax
cmp eax, 0x69163968
jne 0x40d140
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0
push eax
push 0x448028
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40d1ab
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e210
test al, al
je 0x40d1be
call fcn.00410be0
call fcn.0040fd40
call fcn.00440660
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx eax, word [esi]
lea ebp, [esp + 4]
test ax, ax
je 0x40d355
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x40d270
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x40d300
cmp ebx, 0x7ff
ja 0x40d2a0
cmp edx, 2
jb 0x40d2a0
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x40d300
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x40d31a
cmp edx, 4
jb 0x40d31a
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
mov eax, ecx
xor eax, 0xc0
or ecx, 0x3f
and ecx, eax
add cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx eax, word [esi]
test ax, ax
je 0x40d355
test edx, edx
jne 0x40d250
jmp 0x40d355
movzx eax, ax
cmp eax, 0xdc00
jne 0x40d328
mov esi, edi
jmp 0x40d308
cmp edx, 3
jb 0x40d351
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x40d300
mov eax, ebp
jmp 0x40d300
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ebp], 0
xor eax, eax
jmp 0x40d378
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x40d370
test ecx, ecx
je 0x40d38c
mov ebx, ecx
jmp 0x40d370
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00408db0
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40ebe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40ee3e
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40ec1c
cmp edx, esi
jae 0x40ee3e
test edi, edi
je 0x40ee3e
movzx ebp, bl
test bl, bl
js 0x40ec50
mov word [eax], bp
lea ecx, [eax + 2]
inc edx
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40ec10
jmp 0x40ee3e
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40ec83
cmp bl, 0xc2
jb 0x40ec40
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40eced
and ebp, 0x1f
shl ebp, 6
add edx, 2
jmp 0x40ed47
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40ecad
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40ecf7
cmp ebp, 0xe0
jne 0x40ed00
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40ec3c
jmp 0x40ed00
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40ee19
cmp bl, 0xf4
ja 0x40ec40
movzx ecx, byte [edx + 1]
je 0x40ed57
cmp ebp, 0xf0
jne 0x40ed60
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40ec3c
jmp 0x40ed60
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40ec42
cmp cl, 0x9f
ja 0x40ec3c
mov esi, ecx
xor esi, 0xffffff3f
mov ebx, ecx
or ebx, 0xc0
and ebx, esi
cmp ebx, 0x80
jne 0x40ee20
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ee26
and ecx, 0x3f
shl ecx, 6
shl ebp, 0xc
or ebp, ecx
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ebp
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40ec32
cmp cl, 0x8f
ja 0x40ec3c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ee20
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ee26
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ee32
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ecx, ebp
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x40ec3c
mov esi, dword [esp]
and esi, 0x3f
or esi, ebp
cmp esi, 0x10000
jb 0x40ec3c
cmp edi, 2
jb 0x40ee19
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
and esi, 0x3ff
or esi, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], si
jmp 0x40ec32
mov ecx, eax
jmp 0x40ec32
inc edx
jmp 0x40ec3c
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40ec42
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40ec42
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f3f0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x13c], 0
mov dword [esi + 0x138], 0
mov dword [esi + 0x130], 0
mov dword [esi + 0x12c], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x120], 0
mov dword [esi + 0x11c], 0
mov dword [esi + 0x114], 0
mov dword [esi + 0x110], 0
mov dword [esi + 0x10c], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x104], 0x3c
mov dword [esi + 0x118], 0xffffffff
mov dword [esi + 0x134], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44f8dc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40f4d1
sar edx, 1
lea edi, [esi + 0x104]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449c68]
xor eax, eax
jmp 0x40fc17
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x410430
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x248
mov dword [esp + 0x48], 0x57a5499d
mov dword [esp + 0x4c], 0x53bb55d2
mov dword [esp + 0x50], 0x5faa51a4
mov dword [esp + 0x54], 0x5b695dbd
mov dword [esp + 0x58], 0x67545965
mov dword [esp + 0x5c], 0x63426554
mov dword [esp + 0x60], 0x6fb56148
mov dword [esp + 0x64], 0x6b986d85
mov dword [esp + 0x68], 0x77856984
mov dword [esp + 0x6c], 0x738d758f
mov dword [esp + 0x70], 0x7fac7150
mov dword [esp + 0x74], 0x7b5a7da0
mov dword [esp + 0x78], 0x7367949
mov dword [esp + 0x7c], 0x3320536
mov dword [esp + 0x80], 0xf2e01c7
mov dword [esp + 0x84], 0xbe30dd7
mov dword [esp + 0x88], 0x172c09fa
mov dword [esp + 0x8c], 0x13d51528
mov dword [esp + 0x90], 0x1fe61130
mov dword [esp + 0x94], 0x1b261d26
mov dword [esp + 0x98], 0x27061931
mov dword [esp + 0x9c], 0x23d225e5
mov dword [esp + 0xa0], 0x2fda21d0
mov dword [esp + 0xa4], 0x2bf12dc1
mov dword [esp + 0xa8], 0x37d829c5
mov dword [esp + 0xac], 0x33db35e3
mov dword [esp + 0xb0], 0x3f0d31cc
mov dword [esp + 0xb4], 0x3b053d01
mov dword [esp + 0xb8], 0xc7f43903
mov dword [esp + 0xbc], 0xc3f8c5fb
mov dword [esp + 0xc0], 0xcfe6c1e0
mov dword [esp + 0xc4], 0xcb02cd1b
mov dword [esp + 0xc8], 0xd703c914
mov dword [esp + 0xcc], 0xd3e6d500
mov dword [esp + 0xd0], 0xdf2ad1f0
mov dword [esp + 0xd4], 0xdb2ddd35
mov dword [esp + 0xd8], 0xe7c6d935
mov dword [esp + 0xdc], 0xe30fe52f
mov dword [esp + 0xe0], 0xef19e10f
mov dword [esp + 0xe4], 0xebc3ed1f
mov dword [esp + 0xe8], 0xf739e9c8
mov dword [esp + 0xec], 0xf30cf51c
mov dword [esp + 0xf0], 0xff0bf103
mov dword [esp + 0xf4], 0xfbc9fd11
mov dword [esp + 0xf8], 0x87b7f9c9
mov dword [esp + 0xfc], 0x83b085bd
mov dword [esp + 0x100], 0x8fbc81b0
mov dword [esp + 0x104], 0x8bb88dbc
mov dword [esp + 0x108], 0x97b689b8
mov dword [esp + 0x10c], 0x9373954b
mov dword [esp + 0x110], 0x9f7f917a
mov dword [esp + 0x114], 0x9b739d62
mov dword [esp + 0x118], 0xa79b99ab
mov dword [esp + 0x11c], 0xa399a59b
mov dword [esp + 0x120], 0xaf91a192
mov dword [esp + 0x124], 0xabaaad96
mov byte [esp + 0x12a], 0
mov word [esp + 0x128], 0
mov eax, dword [0x44f8d0]
mov ecx, 0xbdb8fe0e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x4247023a]
xor edx, ecx
lea esi, [edx + 0xb9]
not edx
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + ecx + 0x4247023a], dl
inc ecx
cmp ecx, 0xbdb8fef1
jne 0x4106a0
lea ecx, [esp + 0x48]
push 0
push 0
push 0
push 0
push ecx
call eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449dd0]

Function at 0x410be0
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
shr eax, 0x1f
jmp dword [eax*4 + 0x44a5e8]