joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f550
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
push esi
add eax, eax
lea edx, [ebp + 0xc]
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f5be
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x40f58d
cmp eax, 2
jne 0x40f5a8
mov eax, dword [ebp - 4]
test esi, esi
je 0x40f5b8
test eax, eax
je 0x40f5b3
test al, 1
jne 0x40f5a8
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x40f5b8
mov eax, 0xd
mov esp, ebp
pop ebp
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x4106c7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a520]
jne 0x4106d1
repz ret
jmp fcn.004166aa

Function at 0x41ec7c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00415f82
and dword [ebp - 0x14], 0
cmp dword [0x46b150], 0
mov dword [ebp - 0x18], eax
jne 0x41ed2f
push 0x4258c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41edd7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4258b8
push ebx
call edi
test eax, eax
je 0x41edd7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4258a8
push ebx
mov dword [0x46b150], eax
call edi
push eax
call esi
push 0x425894
push ebx
mov dword [0x46b154], eax
call edi
push eax
call esi
push 0x425878
push ebx
mov dword [0x46b158], eax
call edi
push eax
call esi
mov dword [0x46b160], eax
test eax, eax
je 0x41ed2f
push 0x425860
push ebx
call edi
push eax
call esi
mov dword [0x46b15c], eax
mov eax, dword [0x46b15c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41ed88
cmp dword [0x46b160], ecx
je 0x41ed88
push eax
call esi
push dword [0x46b160]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41ed88
test ebx, ebx
je 0x41ed88
call edi
test eax, eax
je 0x41ed7f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41ed7f
test byte [ebp - 8], 1
jne 0x41ed88
or dword [ebp + 0x10], 0x200000
jmp 0x41edbb
mov eax, dword [0x46b154]
cmp eax, dword [ebp - 0x18]
je 0x41edbb
push eax
call esi
test eax, eax
je 0x41edbb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41edbb
mov eax, dword [0x46b158]
cmp eax, dword [ebp - 0x18]
je 0x41edbb
push eax
call esi
test eax, eax
je 0x41edbb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46b150]
call esi
test eax, eax
je 0x41edd7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41edd9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004106c7
leave
ret
Function at 0x403ab0
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x403ab7
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.00403ac0
Function at 0x403ac0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x403af2
lea esp, [esp]
test cl, 3
je 0x403af2
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x40d560]
add ecx, 1
sub esi, 1
jne 0x403ad0
cmp esi, 0x20
push ebx
push edi
jb 0x403cdc
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x40d960]
xor edx, dword [ebx*4 + 0x40dd60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x40d560]
add ecx, 4
xor edx, dword [eax*4 + 0x40e160]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x40d960]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x40dd60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x40d560]
add ecx, 4
xor eax, dword [edx*4 + 0x40e160]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x40d960]
xor edx, dword [ebx*4 + 0x40dd60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x40d560]
xor edx, dword [eax*4 + 0x40e160]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x40d960]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x40dd60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x40d560]
xor eax, dword [edx*4 + 0x40e160]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x40d960]
xor edx, dword [ebx*4 + 0x40dd60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x40d560]
xor edx, dword [eax*4 + 0x40e160]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x40d960]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x40dd60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x40d560]
and edx, 0xff
xor eax, dword [edx*4 + 0x40e160]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x40d960]
xor edx, dword [ebx*4 + 0x40dd60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x40d560]
add ecx, 4
xor edx, dword [eax*4 + 0x40e160]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x40d960]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x40dd60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x40d560]
and edx, 0xff
xor eax, dword [edx*4 + 0x40e160]
sub edi, 1
jne 0x403b02
cmp esi, 4
jb 0x403d29
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x40d960]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x40dd60]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x40d560]
and eax, 0xff
xor edi, dword [eax*4 + 0x40e160]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x403ce6
test esi, esi
pop edi
pop ebx
je 0x403d4d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x40d560]
add ecx, 1
sub esi, 1
jne 0x403d30
not eax
pop esi
ret
Function at 0x405fb4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00404e5f
xor ebx, ebx
cmp dword [0x412338], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x40608a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40616a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40616a
push eax
call fcn.00404df1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x412338], eax
call esi
push eax
call fcn.00404df1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41233c], eax
call esi
push eax
call fcn.00404df1
mov dword [0x412340], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00404094
test eax, eax
pop ecx
pop ecx
je 0x406058
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00405885
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x40608a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404df1
cmp eax, ebx
pop ecx
mov dword [0x412348], eax
je 0x40608a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404df1
pop ecx
mov dword [0x412344], eax
mov eax, dword [0x412344]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x40610f
cmp dword [0x412348], ecx
je 0x40610f
push eax
call fcn.00404e68
push dword [0x412348]
mov esi, eax
call fcn.00404e68
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x40610f
cmp edi, ebx
je 0x40610f
call esi
cmp eax, ebx
je 0x4060dc
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4060dc
test byte [ebp - 0x18], 1
jne 0x40610f
lea eax, [ebp - 0x10]
push eax
call fcn.004040cb
test eax, eax
pop ecx
je 0x4060f7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00405885
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x406106
or dword [ebp + 0x10], 0x200000
jmp 0x40614a
or dword [ebp + 0x10], 0x40000
jmp 0x40614a
mov eax, dword [0x41233c]
cmp eax, dword [ebp - 8]
je 0x40614a
push eax
call fcn.00404e68
cmp eax, ebx
pop ecx
je 0x40614a
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40614a
mov eax, dword [0x412340]
cmp eax, dword [ebp - 8]
je 0x40614a
push eax
call fcn.00404e68
cmp eax, ebx
pop ecx
je 0x40614a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x412338]
call fcn.00404e68
cmp eax, ebx
pop ecx
je 0x40616a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40616c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406b79
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x406b6b
invalid
jnp 0x3fb7f6
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
push dword [ebx]
leave
mov edi, 0x60000000
jmp 0x406b89
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
xchg esp, eax
invalid
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x406be7
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x406bce
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x406bd7
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x406be1
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x406bc3
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x406b4d
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x406ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esp + edi*8 - 0x39a80001], esi
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.004064a4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00406459
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.004064a4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00406459
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.004064a4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00406459
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.00406494
ljmp 0xcca5

Function at 0x4073de
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [edx]
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
Function at 0x40803f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.004064a4
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.00406405
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x40840c
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.00406494
lodsb al, byte [esi]
sbb eax, 0xb5fffee5
pushal
cld
invalid

Function at 0x408666
Capabilities:
Resolve function by parsing pe exports

Disassembly:
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00406494
lcall 0x348b, 0x49cc56c3
mov eax, dword [ebx]
idiv dword [eax + 0x50746547]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x408681
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x408681
call fcn.00406494
test byte [ecx + 0x4f], ch
sti
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00406494
mov esp, 0xffaa11ba
jne 0x4086cb
push dword [ebp + 4]
push dword [ebp]
call fcn.00406c94
add byte [eax], al
cmp eax, 1
jne 0x4087c1
in eax, 0xff
inc dword [eax]
add byte [ebx - 0x7af0fe08], al
call 0x394086da
pop ebp
sbb byte [ecx + 0x875f85d], cl
cmp dword [ebp + 0x18], ebx
mov dword [ebp - 8], ebx
jne 0x4086e9
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [ebp + 0x18], eax
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
cmp dword [ebp + 0x20], ebx
push ebx
push ebx
push dword [ebp + 0x10]
setne al
push dword [ebp + 0xc]
lea eax, [eax*8 + 1]
push eax
push dword [ebp + 0x18]
call esi
mov edi, eax
cmp edi, ebx
je 0x4087c1
jle 0x408754
cmp edi, 0x7ffffff0
ja 0x408754
lea eax, [edi + edi + 8]
cmp eax, 0x400
ja 0x40873e
call fcn.00409850
mov eax, esp
cmp eax, ebx
je 0x408752
mov dword [eax], 0xcccc
jmp 0x40874f
push eax
call fcn.004088ad
cmp eax, ebx
pop ecx
je 0x408752
mov dword [eax], 0xdddd
add eax, 8
mov ebx, eax
test ebx, ebx
je 0x4087c1
lea eax, [edi + edi]
push eax
push 0
push ebx
call fcn.00408140
add esp, 0xc
push edi
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 1
push dword [ebp + 0x18]
call esi
test eax, eax
je 0x40878b
push dword [ebp + 0x14]
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov dword [ebp - 8], eax
push ebx
call fcn.00408266
mov eax, dword [ebp - 8]
pop ecx
jmp 0x40880c
xor eax, eax
jmp 0x40880c
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407edd
leave
ret
Function at 0x402294
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
mov eax, ecx
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], edx
mov ebx, dword [ebx]
je 0x40237b
push esi
mov esi, dword [ebp + 0x10]
sub eax, edx
push edi
mov dword [ebp - 8], eax
test ebx, ebx
jne 0x402357
mov eax, dword [ebp + 0x10]
lea edi, [esi + 1]
movzx edx, byte [edi + 3]
shl edx, 0x18
movzx ecx, byte [eax]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 0x10
shl eax, 8
or ecx, eax
movzx eax, byte [edi + 2]
or ecx, eax
movzx eax, byte [edi + 4]
mov dword [ebp - 0x10], ecx
movzx ecx, byte [edi + 5]
shl eax, 0x10
or edx, eax
shl ecx, 8
movzx eax, byte [edi + 6]
or ecx, eax
or ecx, edx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0x10]
call fcn.0040241d
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, ecx
shr eax, 0x18
mov edx, dword [ebp - 4]
mov byte [esi], al
mov eax, ecx
shr eax, 0x10
mov byte [edi], al
mov eax, ecx
shr eax, 8
mov byte [esi + 2], al
mov byte [esi + 3], cl
mov ecx, dword [ebp - 0xc]
mov eax, ecx
shr eax, 0x18
mov byte [esi + 4], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 5], al
mov eax, ecx
shr eax, 8
mov byte [esi + 6], al
mov eax, dword [ebp - 8]
mov byte [esi + 7], cl
mov cl, byte [eax + edx]
mov al, byte [ebx + esi]
mov byte [ebx + esi], cl
xor cl, al
mov eax, dword [ebp - 8]
mov byte [edx], cl
inc edx
inc ebx
mov dword [ebp - 4], edx
and ebx, 7
sub dword [ebp + 8], 1
jne 0x4022b9
pop edi
pop esi
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop ebx
leave
ret
Function at 0x402b85
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 8], 0x7d
movzx edi, byte [esi]
movzx eax, byte [esi + 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 2]
shl eax, 8
shl edi, 0x10
or edi, eax
movzx eax, byte [esi + 3]
add esi, 4
or edi, eax
mov dword [ebp - 0x14], esi
movzx ebx, byte [esi]
movzx eax, byte [esi + 1]
shl eax, 0x10
shl ebx, 0x18
or ebx, eax
movzx eax, byte [esi + 2]
shl eax, 8
or ebx, eax
movzx eax, byte [esi + 3]
or ebx, eax
mov esi, edx
movzx edx, byte [ecx]
movzx eax, byte [ecx + 1]
shl eax, 0x10
shl edx, 0x18
or edx, eax
movzx eax, byte [ecx + 2]
shl eax, 8
or edx, eax
movzx eax, byte [ecx + 3]
or edx, eax
movzx eax, byte [ecx + 4]
shl eax, 0x18
mov dword [ebp - 4], eax
movzx eax, byte [ecx + 5]
shl eax, 0x10
or dword [ebp - 4], eax
movzx eax, byte [ecx + 6]
shl eax, 8
or dword [ebp - 4], eax
movzx eax, byte [ecx + 7]
add ecx, 8
or dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
call fcn.004027d1
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
xor ecx, edi
mov eax, ecx
xor edx, ebx
shr eax, 0x18
mov byte [esi], al
mov eax, ecx
shr eax, 0x10
lea esi, [esi + 8]
mov ebx, dword [ebp - 4]
mov byte [esi - 7], al
mov eax, ecx
shr eax, 8
mov byte [esi - 6], al
mov eax, edx
shr eax, 0x18
mov byte [esi - 4], al
mov eax, edx
shr eax, 0x10
mov byte [esi - 3], al
mov eax, edx
shr eax, 8
sub dword [ebp - 8], 1
mov byte [esi - 1], dl
mov edx, dword [ebp - 0xc]
mov edi, edx
mov byte [esi - 5], cl
mov ecx, dword [ebp - 0x10]
mov byte [esi - 2], al
jne 0x402bdc
mov esi, dword [ebp - 0x14]
mov eax, edx
shr eax, 0x18
mov ebx, edx
mov dword [ebp - 0x10], eax
mov eax, edx
shr ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x10]
mov byte [esi - 4], bl
shr eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, eax
mov ebx, dword [ebp - 8]
mov ecx, eax
mov byte [esi - 3], bl
mov ebx, dword [ebp - 0x18]
mov byte [esi - 2], bl
mov ebx, dword [ebp - 0xc]
mov byte [esi - 1], bl
shr edx, 0x18
mov byte [esi], dl
shr ecx, 0x10
shr eax, 8
mov byte [esi + 1], cl
mov byte [esi + 2], al
mov eax, dword [ebp - 4]
pop edi
mov byte [esi + 3], al
pop esi
pop ebx
leave
ret
Function at 0x402ce9
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x1048
mov edi, ecx
mov esi, edx
push 0x6b97f0
push edi
call fcn.00638b30
mov edx, dword [ebp + 8]
add esp, 0xc
push 0x48
pop ebx
cmp esi, ebx
cmovle ebx, esi
add ebx, edx
xor esi, esi
movzx ecx, byte [edx]
inc edx
cmp edx, ebx
cmovae edx, dword [ebp + 8]
shl ecx, 8
movzx eax, byte [edx]
or ecx, eax
inc edx
cmp edx, ebx
cmovae edx, dword [ebp + 8]
shl ecx, 8
movzx eax, byte [edx]
or ecx, eax
inc edx
cmp edx, ebx
cmovae edx, dword [ebp + 8]
shl ecx, 8
movzx eax, byte [edx]
or ecx, eax
inc edx
cmp edx, ebx
cmovae edx, dword [ebp + 8]
xor dword [edi + esi*4], ecx
inc esi
cmp esi, 0x12
jl 0x402d17
xor esi, esi
mov dword [ebp - 8], esi
mov ebx, esi
mov dword [ebp - 4], esi
mov edx, edi
lea ecx, [ebp - 8]
call fcn.0040241d
mov eax, dword [ebp - 8]
mov dword [edi + ebx*4], eax
mov eax, dword [ebp - 4]
mov dword [edi + ebx*4 + 4], eax
add ebx, 2
cmp ebx, 0x12
jl 0x402d61
mov edx, edi
lea ecx, [ebp - 8]
call fcn.0040241d
mov eax, dword [ebp - 8]
mov dword [edi + esi*4 + 0x48], eax
mov eax, dword [ebp - 4]
mov dword [edi + esi*4 + 0x4c], eax
add esi, 2
cmp esi, 0x400
jl 0x402d80
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40307c
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0xc
mov eax, 0x66c79c
call fcn.00612ae6
mov edi, edx
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push 0x6aa334
push 1
push ebx
push 0x6aa344
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jne 0x403116
push str.ROOTCIMV2SecurityMicrosoftVolumeEncryption
lea ecx, [ebp - 0x18]
call fcn.00402e26
mov dword [ebp - 4], ebx
mov eax, dword [eax]
test eax, eax
je 0x4030c9
mov edx, dword [eax]
jmp 0x4030cb
mov edx, ebx
mov eax, dword [ebp - 0x14]
lea esi, [ebp - 0x10]
push esi
push ebx
push ebx
mov ecx, dword [eax]
push ebx
push ebx
push ebx
push ebx
push edx
push eax
call dword [ecx + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00402e8b
test esi, esi
jne 0x403116
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
test esi, esi
jne 0x403116
mov eax, dword [ebp - 0x10]
mov ecx, ebx
mov dword [edi], eax
mov dword [ebp - 0x10], ecx
jmp 0x403119
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x40312c
mov eax, dword [edx]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
test ecx, ecx
je 0x403136
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, esi
call fcn.00612ab4
ret