joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428380
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4283ab
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4283cf
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x4283ea
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x42ad72
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x42ad94
cmp dword [edi + 0x3c], 0
jne 0x42ad94
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.0044088b
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0042adc1
pop edi
pop esi
pop ebx
ret 8

Function at 0x42ae0f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.0044088b
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42ae40
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.0042ae53
pop edi
pop esi
pop ebx
ret 8

Function at 0x42c453
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x42c48b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0042f932
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0042f90a
jmp 0x42c497
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x42e062
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x42e0a4
call fcn.0044088b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x42e0a4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x42e09b
xor eax, eax
jmp 0x42e0ac
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0042e0b2
pop edi
pop esi
pop ebx
ret 4
Function at 0x440f5e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.0044088b
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x440f9b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x440f9b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x440f9f
xor eax, eax
jmp 0x44101d
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.0042f1cc
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x440fd7
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x440fc1
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.0044110e
push ebx
mov edi, eax
call fcn.0042f1f5
test edi, edi
pop ecx
je 0x441019
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.00440ed7
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.00441022
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x4015e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x406408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push 0x20
push eax
lea ecx, [esp + 8]
call sub.MFC42.DLL_CFile::CFile_2
lea ecx, [esp]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CFile::GetLength
mov ecx, dword [esp + 0x28]
cmp eax, ecx
jg 0x401623
xor ecx, ecx
push esi
mov esi, dword [esp + 0x28]
lea edx, [esi + ecx]
cmp edx, eax
jle 0x401633
sub eax, ecx
mov esi, eax
push 0
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CFile::Seek
mov eax, dword [esp + 0x30]
push esi
push eax
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CFile::Read
lea ecx, [esp + 4]
call sub.MFC42.DLL_CFile::Close
lea ecx, [esp + 4]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CFile::CFile
mov ecx, dword [esp + 0x14]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x401680
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x406450
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x18]
call fcn.00405c90
mov esi, dword [esp + 0x44]
lea ecx, [esp + 8]
push esi
mov dword [esp + 0x40], 0
call sub.MFC42.DLL_CString::CString_1
push esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 1
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 8]
mov byte [esp + 0x3c], 2
mov ecx, dword [eax - 8]
mov al, byte [ecx + eax - 1]
cmp al, 0x5c
je 0x4016fa
push 0x409020
lea ecx, [esp + 0xc]
call fcn.00405ccc
push 0x409020
lea ecx, [esp + 0x10]
call fcn.00405ccc
push 0x409024
lea ecx, [esp + 0xc]
call fcn.00405ccc
mov eax, dword [esp + 8]
push 0
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x4017e7
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov bl, 4
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea ecx, [esp + 0x1c]
mov esi, eax
push ecx
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CFileFind::GetFileName
lea edx, [esp + 0x14]
lea ecx, [esp + 0x4c]
push edx
mov byte [esp + 0x48], 3
call fcn.00405cde
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x4c]
push eax
mov byte [esp + 0x48], bl
call fcn.00405cd8
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x4017c1
mov edx, dword [esp + 0x20]
push 0x10
lea ecx, [esp + 0x24]
call dword [edx + 0x40]
test eax, eax
je 0x4017ba
lea eax, [esp + 0x4c]
push 0x409020
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.MFC42.DLL_operator
mov edx, dword [esp + 0x18]
mov ecx, edi
push edx
mov byte [esp + 0x48], 5
call fcn.00401680
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], bl
call sub.MFC42.DLL_CString::CString
jmp 0x4017c1
mov eax, dword [esp + 0x4c]
push eax
call ebp
lea ecx, [esp + 0x4c]
mov byte [esp + 0x44], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], 2
call sub.MFC42.DLL_CString::CString
test esi, esi
jne 0x40172a
pop ebp
pop ebx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CFileFind::Close
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 0xffffffff
call sub.MFC42.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 0x34]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x403050
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4068d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebp
mov ebp, ecx
push edi
lea ecx, [esp + 0x14]
call fcn.00405c90
mov edi, dword [esp + 0x40]
lea ecx, [esp + 8]
push edi
mov dword [esp + 0x3c], 0
call sub.MFC42.DLL_CString::CString_1
push 0x409024
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 1
call fcn.00405ccc
mov eax, dword [esp + 8]
push 0
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x403177
push ebx
push esi
mov bl, 3
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea ecx, [esp + 0x18]
mov esi, eax
push ecx
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::GetFileName
push edi
lea ecx, [esp + 0x4c]
mov byte [esp + 0x44], 2
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0x18]
lea ecx, [esp + 0x48]
push edx
mov byte [esp + 0x44], bl
call fcn.00405cd8
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x403151
mov eax, dword [esp + 0x1c]
push 0x10
lea ecx, [esp + 0x20]
call dword [eax + 0x40]
test eax, eax
je 0x403146
lea ecx, [esp + 0x48]
push 0x409020
lea edx, [esp + 0x18]
push ecx
push edx
call sub.MFC42.DLL_operator
mov eax, dword [esp + 0x14]
mov ecx, ebp
push eax
mov byte [esp + 0x44], 4
call fcn.00403050
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], bl
call sub.MFC42.DLL_CString::CString
jmp 0x403151
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x48]
mov byte [esp + 0x40], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 1
call sub.MFC42.DLL_CString::CString
test esi, esi
jne 0x4030ba
pop esi
pop ebx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CFileFind::Close
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 8]
mov byte [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 0x30]
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x4038b0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
lea eax, [esp]
push eax
push 0x407830
push 1
push 0
push 0x407820
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x403967
mov eax, dword [esp]
mov edx, dword [esp + 0x214]
push esi
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x220]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [esp + 4]
push 5
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push 0x407840
mov edx, dword [eax]
push eax
call dword [edx]
mov esi, eax
test esi, esi
jl 0x40395a
mov eax, dword [esp + 0x21c]
lea edx, [esp + 0xc]
push 0x104
push edx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, esi
pop esi
add esp, 0x210
ret 0xc
Function at 0x404560
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x406bc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push edi
mov edi, ecx
lea ecx, [esp + 0x18]
call fcn.00405c90
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x40], 0
call sub.MFC42.DLL_CString::CString_1
push 0x409024
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 1
call fcn.00405ccc
mov ecx, dword [esp + 0xc]
push 0
push ecx
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x404722
push ebx
push ebp
push esi
mov esi, dword [esp + 0x54]
mov bl, 5
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea edx, [esp + 0x14]
lea ecx, [esp + 0x24]
push edx
mov ebp, eax
call sub.MFC42.DLL_CFileFind::GetFileName
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x10]
push eax
mov byte [esp + 0x4c], 2
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 3
push ecx
lea ecx, [esp + 0x14]
call fcn.00405cd8
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x4046fb
mov edx, dword [esp + 0x24]
push 0x10
lea ecx, [esp + 0x28]
call dword [edx + 0x40]
test eax, eax
je 0x404663
lea eax, [esp + 0x10]
push 0x409020
lea ecx, [esp + 0x20]
push eax
push ecx
call sub.MFC42.DLL_operator
mov edx, dword [esp + 0x1c]
push esi
push edx
mov ecx, edi
mov byte [esp + 0x50], 4
call fcn.00404560
mov byte [esp + 0x48], 3
lea ecx, [esp + 0x1c]
jmp 0x4046f6
lea eax, [esp + 0x54]
push 3
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::Right
lea ecx, [esp + 0x54]
mov byte [esp + 0x48], bl
call sub.MFC42.DLL_CString::MakeUpper
mov eax, dword [esp + 0x54]
cmp byte [eax], 0x4f
jne 0x4046ed
cmp byte [eax + 1], 0x43
jne 0x4046ed
cmp byte [eax + 2], 0x58
jne 0x4046ed
push esi
lea ecx, [esp + 0x58]
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
push 0x409020
push edx
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x4c], 6
call fcn.00405cd8
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], bl
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x10]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, dword [esp + 0x54]
mov ecx, edi
push edx
call fcn.00404760
mov byte [esp + 0x48], 3
lea ecx, [esp + 0x54]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 1
call sub.MFC42.DLL_CString::CString
test ebp, ebp
jne 0x4045ce
pop esi
pop ebp
pop ebx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CFileFind::Close
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 0xffffffff
call sub.MFC42.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 0x34]
pop edi
mov dword fs:[0], ecx
add esp, 0x3c
ret 8
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..00cfg
mov ebx, 0x408ecc
nop
mov ecx, 0x5cd96594
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x1c576b9b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4038a0
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x403a66
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
mov eax, esi
not eax
or eax, 0xffff
lea edi, [esi + eax]
inc edi
shr esi, 0x10
test ebx, ebx
je 0x403a5f
mov ecx, 0x5e6ea9af
mov eax, ebx
mul ecx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebx
sub edx, eax
jmp 0x40392c
add ebp, dword [esp + 0xc]
mov eax, edi
mov ecx, 0x80078071
mul ecx
mov ebx, edx
shr ebx, 0xf
mov eax, esi
mul ecx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub esi, eax
mov ebx, dword [esp + 0x10]
sub ebx, dword [esp + 4]
mov edx, 0x15b0
je 0x403a5f
xor eax, eax
cmp edx, 8
mov dword [esp + 0x10], ebx
jb 0x4039c2
mov eax, edx
and eax, 0x1ff8
mov dword [esp], eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
movzx ecx, byte [ebp + ecx]
add ecx, edi
add esi, ecx
mov ebx, edx
movzx edx, byte [ebp + eax + 1]
add edx, ecx
add esi, edx
movzx ecx, byte [ebp + eax + 2]
add ecx, edx
add esi, ecx
movzx edx, byte [ebp + eax + 3]
add edx, ecx
mov ecx, esi
and ecx, edx
xor esi, edx
lea ecx, [esi + ecx*2]
movzx esi, byte [ebp + eax + 4]
mov edi, edx
and edi, esi
xor edx, esi
lea edx, [edx + edi*2]
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, edx
mov edx, ecx
and edx, edi
xor ecx, edi
lea esi, [ecx + edx*2]
mov edx, ebx
lea ecx, [eax + 8]
add eax, 0xf
cmp eax, ebx
jb 0x403950
add ebp, ecx
mov eax, dword [esp]
mov ecx, edx
sub ecx, eax
mov dword [esp + 4], edx
jbe 0x4038f4
mov dword [esp + 0xc], ecx
mov dword [esp], eax
not eax
add eax, edx
mov ecx, edx
and ecx, 3
je 0x403a11
mov dword [esp + 8], eax
neg ecx
xor edx, edx
mov ebx, ebp
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add esi, edi
dec edx
cmp ecx, edx
jne 0x4039f0
mov ecx, dword [esp]
sub ecx, edx
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x4038f0
jmp 0x403a1f
mov ebx, ebp
mov ecx, dword [esp]
cmp eax, 3
jb 0x4038f0
mov eax, dword [esp + 4]
sub eax, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebx + edx]
add ecx, edi
add esi, ecx
movzx edi, byte [ebx + edx + 1]
add edi, ecx
add esi, edi
movzx ecx, byte [ebx + edx + 2]
add ecx, edi
add esi, ecx
movzx edi, byte [ebx + edx + 3]
add edi, ecx
add esi, edi
add edx, 4
cmp eax, edx
jne 0x403a30
jmp 0x4038f0
shl esi, 0x10
add esi, edi
jmp 0x403a6b
mov esi, 1
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403a80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x403ab3
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
lea eax, [edx + edx]
not eax
add eax, edx
test ebx, ebx
je 0x403b4a
test bl, 1
jne 0x403aba
mov edx, ebx
cmp ebx, 1
jne 0x403aeb
jmp 0x403b4a
xor eax, eax
jmp 0x403b4c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x43e928]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x43e928]
cmp ebx, 1
je 0x403b4a
xor esi, esi
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43e928]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43e928]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43e928]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43e928]
add esi, 2
cmp edx, esi
jne 0x403af0
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x4096a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x4097ce
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x4096dd
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x409701
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x4096d0
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x4096d0
lea ebp, [ebx + 1]
push ebp
call fcn.00437310
add esp, 4
mov esi, eax
test ebx, ebx
jle 0x4097dc
add ebx, esi
add ebp, esi
mov eax, esi
mov dword [esp + 8], ebp
jmp 0x409748
mov byte [eax], dl
mov ebp, 1
add edi, 2
add eax, ebp
cmp eax, ebx
mov ebp, dword [esp + 8]
jae 0x4097de
movzx edx, word [edi]
test dx, dx
je 0x4097de
cmp dx, 0x7f
jbe 0x409730
mov ecx, eax
not ecx
add ecx, ebp
movzx ebp, dx
cmp ebp, 0x7ff
ja 0x409790
cmp ecx, 2
jb 0x409790
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov ebp, 2
jmp 0x409737
mov dword [esp + 4], ebp
xor ebp, ebp
cmp ecx, 3
jb 0x409737
mov ebp, dword [esp + 4]
mov ecx, ebp
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
shr ebp, 6
mov ecx, ebp
not ecx
or ecx, 0x3f
add ecx, ebp
add cl, 0x81
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov ebp, 3
jmp 0x409737
push 1
call fcn.00437310
add esp, 4
mov esi, eax
jmp 0x4097de
mov eax, esi
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x409807
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [esi + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x409802
test eax, eax
jne 0x409800
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00405cb0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40a900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40a9ff
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x40a938
mov ebp, ebx
mov esi, ebp
lea eax, [edi + 4]
add edi, 2
cmp edi, ecx
mov edi, eax
mov ebp, dword [esp + 0x18]
jae 0x40aa01
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.00410440
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.00410440
add esp, 4
shl bh, 2
mov ah, al
shr ah, 4
and ah, 3
or ah, bh
mov ecx, esi
and ecx, 1
mov edx, esi
xor edx, 1
lea ebx, [edx + ecx*2]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov byte [edx + esi], ah
cmp edi, ecx
jae 0x40a920
mov byte [esp + 3], al
mov esi, ebx
movzx eax, byte [ebp + edi]
push eax
call fcn.00410440
add esp, 4
cmp al, 0x40
jne 0x40a9a0
mov ebp, esi
mov ecx, dword [esp + 0x1c]
jmp 0x40a922
mov bh, al
movzx ecx, byte [esp + 3]
shl cl, 4
shr al, 2
and al, 0xf
or al, cl
lea ebp, [esi + 1]
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi], al
lea eax, [edi + 1]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jae 0x40a922
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.00410440
mov ecx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x40a922
shl bh, 6
add al, bh
mov edx, dword [esp + 0x20]
mov byte [edx + esi + 1], al
add esi, 2
mov ebp, esi
jmp 0x40a922
xor esi, esi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret