joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435ff5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00435f71
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x436164
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x436164
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x436119
jg 0x436051
test eax, eax
je 0x43610f
push 1
push 0x1000
call fcn.0042a5d5
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x436074
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x436106
push 0x8000
push ebx
call fcn.0042741e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x43609d
jg 0x436098
cmp ecx, 0x1000
jb 0x43609d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0042c508
add esp, 0x10
cmp eax, 0xffffffff
je 0x4360e2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x436098
jl 0x4360c9
test ecx, ecx
jne 0x43608a
push dword [ebp - 0xc]
push ebx
call fcn.0042741e
push esi
call fcn.0042a54d
add esp, 0xc
xor ebx, ebx
jmp 0x436172
cmp byte [edi + 0x24], 0
je 0x4360f9
cmp dword [edi + 0x20], 5
jne 0x4360f9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x436104
mov ebx, dword [edi + 0x18]
jmp 0x436106
xor ebx, ebx
push esi
call fcn.0042a54d
pop ecx
jmp 0x436172
test ecx, ecx
jg 0x4360db
jl 0x436119
test eax, eax
jae 0x4360db
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0042c96a
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x436139
cmp byte [edi + 0x1c], 0
je 0x4360db
jmp 0x43616a
push ebx
call fcn.0042fad7
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4360db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x436172
cmp byte [edi + 0x1c], 0
je 0x43616f
mov ebx, dword [edi + 0x18]
jmp 0x436172
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0042c96a
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x437600
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43762d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43762d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404540
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x40462c
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x40462c
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x40458a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x404591
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x404570
jmp 0x404593
mov esi, 0x1505
jmp 0x404593
mov esi, ecx
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 0x20]
lea edi, [ecx - 1]
mov dword [esp + 8], ecx
sub ecx, 1
mov dword [esp + 0xc], ecx
jb 0x40462c
and edi, esi
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
xor ebp, ebp
jmp 0x4045c7
inc ebp
cmp dword [esp + 8], ebp
je 0x40462a
mov eax, ebp
and eax, edi
mov ecx, ebp
xor ecx, edi
lea eax, [ecx + eax*2]
and eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov ebx, dword [ecx + eax*4]
cmp ebx, 0xffffffff
je 0x40462a
mov eax, dword [edx + 8]
cmp dword [eax + ebx*4], esi
jne 0x4045c0
mov eax, dword [edx + 0xc]
mov eax, dword [eax + ebx*4]
mov dword [esp], eax
push eax
call fcn.0040cb10
mov edx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x4045c0
push dword [esp + 0x2c]
push dword [esp + 4]
push dword [esp + 0x30]
call fcn.0040cb30
mov edx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4045c0
mov eax, dword [edx + 0x10]
mov eax, dword [eax + ebx*4]
jmp 0x40462c
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404b90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
xor eax, eax
cmp dword [esp + 0x18], 0
je 0x404da4
cmp dword [esp + 0x1c], 0
jle 0x404d41
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
lea ecx, [edx + eax]
mov dword [esp], ecx
jmp 0x404be8
cmp esi, 0xc0
jne 0x404da2
and ebx, 0x1ff800
cmp ebx, 0xd800
mov ecx, dword [esp]
je 0x404da2
add edx, ebp
cmp edx, ecx
jae 0x404d41
movzx ebx, byte [edx]
cmp ebx, 0xf4
ja 0x404da2
mov eax, ebx
and al, 0xfe
cmp al, 0xc0
je 0x404da2
mov eax, ebx
and eax, 0xffffffc0
cmp eax, 0x80
je 0x404da2
mov ebp, 1
test bl, bl
jns 0x404bde
mov esi, ebx
and esi, 0xffffffe0
cmp esi, 0xc0
jne 0x404c4a
movzx edi, byte [edx + 1]
mov eax, edi
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x404da2
and ebx, 0x1f
shl ebx, 6
mov ebp, 2
jmp 0x404c93
mov eax, ebx
and eax, 0xfffffff0
cmp eax, 0xe0
jne 0x404c97
movzx eax, byte [edx + 1]
mov ecx, eax
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x404da2
movzx edi, byte [edx + 2]
mov ecx, edi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x404da2
and ebx, 0xf
shl ebx, 0xc
and eax, 0x3f
shl eax, 6
or ebx, eax
mov ebp, 3
xor ecx, ecx
jmp 0x404d04
mov eax, ebx
and eax, 0xfffffff8
cmp eax, 0xf0
jne 0x404da2
movzx ecx, byte [edx + 1]
mov eax, ecx
and eax, 0xffffffc0
cmp eax, 0x80
jne 0x404da2
movzx eax, byte [edx + 2]
mov edi, eax
and edi, 0xffffffc0
cmp edi, 0x80
jne 0x404da2
movzx edi, byte [edx + 3]
mov ebp, edi
and ebp, 0xffffffc0
cmp ebp, 0x80
jne 0x404da2
and ebx, 7
shl ebx, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebx
and eax, 0x3f
or eax, ecx
shl eax, 6
mov cl, 1
mov ebp, 4
mov ebx, eax
and edi, 0x3f
or edi, ebx
cmp edi, 0x80
jb 0x404da2
cmp edi, 0x7ff
jbe 0x404bbd
cmp edi, 0xffff
ja 0x404d33
test cl, cl
je 0x404bc9
jmp 0x404da2
cmp edi, 0x10ffff
jbe 0x404bc9
jmp 0x404da2
mov edi, dword [esp + 0x1c]
mov eax, edi
and eax, 1
mov ecx, edi
xor ecx, 1
lea eax, [ecx + eax*2]
push eax
call dword [0x44a008]
add esp, 4
test eax, eax
je 0x404da2
mov esi, eax
mov byte [eax + edi], 0
push edi
push dword [esp + 0x1c]
push eax
call fcn.0040ca20
add esp, 0xc
push 0x10
call dword [0x44a008]
add esp, 4
test eax, eax
je 0x404d98
mov dword [eax], 0
mov dword [eax + 4], 2
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
jmp 0x404da4
push esi
call dword [0x44a004]
add esp, 4
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405880
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
cmp dword [esp + 0x2c], 0
je 0x405a7e
mov edi, dword [esp + 0x30]
test edi, edi
je 0x405a7e
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x405a7e
cmp dword [ecx], 0
jne 0x405a7e
push edi
call fcn.0040cb10
add esp, 4
test eax, eax
je 0x4058ea
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [edi + ebx]
test edx, edx
je 0x4058f1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebx
mov ecx, esi
cmp eax, ebx
jne 0x4058d0
jmp 0x4058f3
mov esi, 0x1505
jmp 0x4058f3
mov esi, ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x20]
lea edi, [edx - 1]
mov dword [esp + 0xc], edx
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x4059cf
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
mov ebx, dword [esp + 0x30]
jb 0x405953
call fcn.00405b60
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x405a7e
push ebx
call fcn.0040cb10
add esp, 4
lea edi, [esp + 0x14]
mov ecx, dword [esp + 0x2c]
mov edx, ebx
push edi
push esi
push eax
call fcn.00405a90
add esp, 0xc
mov ebp, eax
push ebx
call fcn.0040cb10
add esp, 4
mov ebx, eax
and eax, 1
mov ecx, ebx
xor ecx, 1
lea eax, [ecx + eax*2]
push eax
call dword [0x44a008]
add esp, 4
test eax, eax
je 0x405a79
mov edi, eax
mov byte [eax + ebx], 0
push ebx
push dword [esp + 0x34]
push eax
call fcn.0040ca20
add esp, 0xc
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov edi, dword [esp + 0x34]
mov dword [eax + ecx*4], edi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [edi], eax
xor eax, eax
jmp 0x405a7e
mov dword [esp], eax
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
xor ebx, ebx
mov dword [esp + 4], edi
jmp 0x4059ff
inc ebx
cmp dword [esp + 0xc], ebx
mov edi, dword [esp + 4]
je 0x40590e
mov eax, ebx
and eax, edi
mov edx, ebx
xor edx, edi
lea ebp, [edx + eax*2]
and ebp, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edi, dword [eax + ebp*4]
cmp edi, 0xffffffff
je 0x405913
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4059f0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + edi*4]
push ebp
call fcn.0040cb10
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x4059f0
push dword [esp]
push ebp
push dword [esp + 0x38]
call fcn.0040cb30
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x4059f0
mov eax, dword [ecx + 0x10]
push dword [eax + edi*4]
call fcn.00404960
mov edx, dword [esp + 0x30]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x34]
mov dword [eax + edi*4], ecx
mov edi, ecx
jmp 0x4059c4
mov eax, 0xffffffff
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406bb0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406d56
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406d4f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406c45
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ecx
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, edi
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub ecx, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406d4f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406cbe
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406c60
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406c0d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406d00
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406ce0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406c00
jmp 0x406d0f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406c00
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406d20
jmp 0x406c00
shl ecx, 0x10
or ecx, edi
jmp 0x406d5b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406d70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x406d9e
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
not ecx
test ebx, ebx
je 0x406e3a
test bl, 1
jne 0x406da5
mov edx, ebx
cmp ebx, 1
jne 0x406dd6
jmp 0x406e3a
xor eax, eax
jmp 0x406e41
lea edx, [ebx - 1]
mov esi, ecx
shr esi, 4
movzx edi, byte [eax]
xor ecx, edi
and ecx, 0xf
xor esi, dword [ecx*4 + 0x447c50]
mov ecx, esi
shr ecx, 4
and esi, 0xf
shr edi, 4
xor edi, esi
xor ecx, dword [edi*4 + 0x447c50]
inc eax
cmp ebx, 1
je 0x406e3a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, ecx
shr edi, 4
movzx ebx, byte [eax + esi]
xor ecx, ebx
and ecx, 0xf
xor edi, dword [ecx*4 + 0x447c50]
mov ecx, edi
shr ecx, 4
and edi, 0xf
shr ebx, 4
xor ebx, edi
xor ecx, dword [ebx*4 + 0x447c50]
mov edi, ecx
shr edi, 4
movzx ebx, byte [eax + esi + 1]
xor ecx, ebx
and ecx, 0xf
xor edi, dword [ecx*4 + 0x447c50]
mov ecx, edi
shr ecx, 4
and edi, 0xf
shr ebx, 4
xor ebx, edi
xor ecx, dword [ebx*4 + 0x447c50]
add esi, 2
cmp edx, esi
jne 0x406de0
lea eax, [ecx + ecx]
not eax
add eax, ecx
pop esi
pop edi
pop ebx
ret
Function at 0x40c8d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x40c93c
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x40c91e
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x40c920
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 0xfffffffd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x40c900
jmp 0x40c920
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40c93a
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40c93c
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d080
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebx
push edi
push esi
sub esp, 0x2c
call fcn.004414d0
test al, al
je 0x40d2d9
mov dword [esp], 0x13123e25
mov byte [esp + 4], 0
mov eax, 0x3a13bbb
mov ecx, 0x9c5ec443
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x3a13bbb]
lea esi, [eax - 0x4fffffff]
mov edi, ecx
and edi, 0x41a8450
and esi, 0x83210baf
or esi, edi
xor edx, 0x349ab450
mov edi, edx
and edi, esi
add edx, esi
add edi, edi
sub edx, edi
mov esi, edx
and esi, 0x3dd9d551
mov edi, edx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, edi
add esi, ebx
xor edx, 0x7dd9d553
mov edi, esi
and edi, edx
xor esi, edx
lea ebx, [esi + edi*2]
and edx, 1
or ebx, 1
add ebx, edx
mov byte [esp + eax - 0x3a13bbb], bl
inc eax
dec ecx
cmp eax, 0x3a13bc0
jne 0x40d0b0
mov eax, dword [esp]
mov dword [esp], 0xfff4826d
mov dword [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xfd
xor dl, byte [esp + ecx]
add dl, 0xf
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 8
jne 0x40d140
mov ecx, eax
and ecx, 0xc97ed9
mov edx, eax
or eax, 0xc97ed9
imul eax, ecx
xor ecx, 0xc97ed9
and edx, 0xff368126
imul edx, ecx
add eax, edx
mov ecx, eax
shr ecx, 7
mov edx, ecx
or edx, eax
add ecx, eax
not ecx
add ecx, edx
and ecx, edx
mov eax, ecx
and eax, 0xb9fe1a8
mov edx, ecx
not edx
or edx, 0xf4601e57
add edx, ecx
inc edx
or ecx, 0xb9fe1a8
imul ecx, eax
xor eax, 0xb9fe1a8
imul edx, eax
add ecx, edx
cmp ecx, dword [esp]
jne 0x40d2a2
mov dword [esp], 0x91019f39
mov dword [esp + 4], 0x954c9334
mov dword [esp + 8], 0x891e9733
mov dword [esp + 0xc], 0x8d6a8b2f
mov dword [esp + 0x10], 0x812b8f5d
mov dword [esp + 0x14], 0x8380
mov dword [esp + 0x18], 0
mov eax, 0xd5c9c4e5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x2a363b1b]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
add cl, 0x86
mov byte [esp + eax + 0x2a363b1b], cl
inc eax
cmp eax, 0xd5c9c501
jne 0x40d200
mov dword [esp + 0x1c], 0x41d647d5
mov dword [esp + 0x20], 0x4dd443af
mov dword [esp + 0x24], 0x4f4c
mov byte [esp + 0x28], 0
mov eax, 0x11
mov ecx, 0x6f62deee
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0xb]
mov esi, ecx
or esi, edx
not edx
or edx, eax
and edx, esi
mov esi, edx
not esi
and esi, 0x2a
xor edx, 0x55
lea edx, [edx + esi*2]
inc dl
mov byte [esp + eax + 0xb], dl
inc eax
dec ecx
cmp eax, 0x1e
jne 0x40d260
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0
push eax
push 0x4493da
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.004394d0
test al, al
je 0x40d2d4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetInputState]
test eax, eax
je 0x40d2c1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e200
test al, al
je 0x40d2d4
call fcn.00410f00
call fcn.0040fb00
call fcn.00442430
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d570
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov edx, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov dword [esp + 0x14], ecx
mov ecx, dword [ecx + 0x60]
mov word [esp], 0x2523
mov byte [esp + 2], 0x3e
mov dword [esp + 3], 0
xor ebx, ebx
nop
nop
nop
nop
nop
mov eax, ebx
add al, 0x75
xor al, byte [esp + ebx]
add al, 0xb7
mov byte [esp + ebx], al
inc ebx
cmp ebx, 7
jne 0x40d5a0
mov dword [esp + 8], 0x26382412
mov dword [esp + 0xc], 0x3d36
mov byte [esp + 0x10], 0
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
mov eax, ebp
xor eax, 0xbf33dd4b
mov esi, ebp
or esi, 4
and esi, eax
mov ebx, ebp
or ebx, 0x40cc22b4
and eax, ebx
xor ebx, esi
lea eax, [ebx + eax*2]
xor al, byte [esp + ebp + 8]
add al, 0x7c
mov byte [esp + ebp + 8], al
inc ebp
cmp ebp, 9
jne 0x40d5d0
mov dword [esp + 0x18], 0x8680dcdd
mov dword [esp + 0x1c], 0x8282d0ec
mov dword [esp + 0x20], 0x9f8a80cd
mov dword [esp + 0x24], 0x9a879e83
mov dword [esp + 0x28], 0xc2978382
mov dword [esp + 0x2c], 0x88f52f29
mov dword [esp + 0x30], 0xb5afbdb6
mov dword [esp + 0x34], 0xb6caf0b8
mov dword [esp + 0x38], 0xb0bdb1b3
mov dword [esp + 0x3c], 0xb8bfb1bd
mov dword [esp + 0x40], 0xbdfad3a6
mov dword [esp + 0x44], 0xe2a3afa3
mov dword [esp + 0x48], 0xb2a6b0b4
mov dword [esp + 0x4c], 0xb6a8f5df
mov dword [esp + 0x50], 0x9274c55
mov byte [esp + 0x54], 0xec
mov dword [esp + 0x55], 0
mov word [esp + 0x59], 0
xor ebx, ebx
nop
nop
nop
nop
nop
mov eax, ebx
add al, 0x48
xor al, byte [esp + ebx + 0x18]
add al, 0x98
mov byte [esp + ebx + 0x18], al
inc ebx
cmp ebx, 0x43
jne 0x40d690
mov eax, dword [esp + 0x70]
add eax, ecx
movzx ebx, byte [esp + 0x18]
mov esi, eax
test bl, bl
je 0x40d6cc
lea ebp, [esp + 0x19]
mov esi, eax
nop
nop
nop
nop
nop
mov byte [esi], bl
inc esi
movzx ebx, byte [ebp]
inc ebp
test bl, bl
jne 0x40d6c0
mov byte [esi], 0
movzx ebx, byte [edi]
test bl, bl
je 0x40d6eb
inc edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [esi], bl
inc esi
movzx ebx, byte [edi]
inc edi
test bl, bl
jne 0x40d6e0
mov byte [esi], 0
movzx ebx, byte [esp + 8]
test bl, bl
je 0x40d70b
lea edi, [esp + 9]
nop
nop
nop
nop
nop
mov byte [esi], bl
inc esi
movzx ebx, byte [edi]
inc edi
test bl, bl
jne 0x40d700
mov byte [esi], 0
movzx ebx, byte [edx]
test bl, bl
je 0x40d72b
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [esi], bl
inc esi
movzx ebx, byte [edx]
inc edx
test bl, bl
jne 0x40d720
mov byte [esi], 0
movzx edx, byte [esp]
test dl, dl
je 0x40d74b
lea edi, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [esi], dl
inc esi
movzx edx, byte [edi]
inc edi
test dl, dl
jne 0x40d740
mov byte [esi], 0
sub esi, eax
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x60]
mov ecx, eax
and ecx, esi
xor esi, eax
lea eax, [esi + ecx*2]
mov dword [edx + 0x60], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40e040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov bl, byte [ebp + 8]
call fcn.0040e1f0
sub esp, 8
push eax
test edi, edi
sets al
mov ecx, edi
sub ecx, 1
sete cl
or al, cl
mov ecx, edi
sub ecx, 0x25
setge cl
or al, cl
test al, 1
jne 0x40e077
jmp 0x40e07c
jmp 0x40e1dc
movzx eax, bl
mov edi, esi
mov ecx, dword [ebp + 0x10]
add edi, ecx
add edi, 0xffffffff
mov byte [esi + ecx - 1], 0
cmp eax, 0
sete al
test al, 1
jne 0x40e09a
jmp 0x40e0a7
add edi, 0xffffffff
mov byte [edi], 0x30
jmp 0x40e0a2
jmp 0x40e1da
cmp dword [ebp + 0x14], 0xa
sete al
test al, 1
jne 0x40e0b7
jmp 0x40e13d
jmp 0x40e0b9
movzx ecx, bl
cmp ecx, 0x64
jb 0x40e0fb
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
shl edx, 1
mov al, byte [edx + 0x448761]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov al, byte [edx + 0x448760]
add esi, 0xffffffff
mov byte [edi - 2], al
mov edi, 0x64
mov eax, ecx
xor edx, edx
div edi
mov ebx, eax
mov edi, esi
jmp 0x40e0b9
cmp ecx, 0xa
setb al
test al, 1
jne 0x40e107
jmp 0x40e118
mov cl, byte [ecx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov eax, edi
add eax, 0xffffffff
mov byte [edi - 1], cl
jmp 0x40e136
shl ecx, 1
mov dl, byte [ecx + 0x448761]
mov eax, edi
add eax, 0xffffffff
mov byte [edi - 1], dl
mov cl, byte [ecx + 0x448760]
add eax, 0xffffffff
mov byte [edi - 2], cl
mov edi, eax
jmp 0x40e1da
cmp dword [ebp + 0x14], 0x10
sete al
jmp 0x40e146
test al, 1
jne 0x40e14e
jmp 0x40e14c
jmp 0x40e1b0
movzx eax, bl
jmp 0x40e153
cmp eax, 0x10
setl cl
test cl, 1
jne 0x40e160
jmp 0x40e173
mov cl, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov eax, edi
add eax, 0xffffffff
mov byte [edi - 1], cl
mov edi, eax
jmp 0x40e1da
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 2
mov edx, eax
and edx, 0xfffffffd
imul edx, ecx
mov ecx, eax
and ecx, 2
or eax, 2
imul eax, ecx
add eax, edx
mov cl, byte [eax + 0x44882a]
mov edx, edi
add edx, 0xffffffff
mov byte [edi - 1], cl
mov al, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
add edx, 0xffffffff
mov byte [edi - 2], al
mov edi, edx
jmp 0x40e1da
movzx ecx, bl
cmp ecx, 0
jbe 0x40e1d8
mov eax, ecx
xor edx, edx
div dword [ebp + 0x14]
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
add edi, 0xffffffff
mov byte [edi], al
jmp 0x40e1cd
mov eax, ecx
xor edx, edx
div dword [ebp + 0x14]
mov ebx, eax
jmp 0x40e1b0
jmp 0x40e1da
mov esi, edi
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret