joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ae7d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41c410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403218
and dword [ebp - 0x14], 0
cmp dword [0x41e514], 0
mov dword [ebp - 0x18], eax
jne 0x40af30
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40afd8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40afd8
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41e514], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41e518], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41e51c], eax
call edi
push eax
call esi
mov dword [0x41e524], eax
test eax, eax
je 0x40af30
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41e520], eax
mov eax, dword [0x41e520]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40af89
cmp dword [0x41e524], ecx
je 0x40af89
push eax
call esi
push dword [0x41e524]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40af89
test ebx, ebx
je 0x40af89
call edi
test eax, eax
je 0x40af80
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40af80
test byte [ebp - 8], 1
jne 0x40af89
or dword [ebp + 0x10], 0x200000
jmp 0x40afbc
mov eax, dword [0x41e518]
cmp eax, dword [ebp - 0x18]
je 0x40afbc
push eax
call esi
test eax, eax
je 0x40afbc
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40afbc
mov eax, dword [0x41e51c]
cmp eax, dword [ebp - 0x18]
je 0x40afbc
push eax
call esi
test eax, eax
je 0x40afbc
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41e514]
call esi
test eax, eax
je 0x40afd8
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40afda
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405622
leave
ret
Function at 0x40b1b4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8c
mov dword [esp + 4], 0x486c1c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x40b2ac
lea eax, [ebp - 0x84]
mov dword [esp], eax
call fcn.00419d40
mov dword [esp], 0xc800
call fcn.00477128
mov ebx, eax
jmp 0x40b216
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
lea eax, [ebp - 0x84]
mov dword [esp], eax
call fcn.0041a564
mov edi, ebx
mov ecx, 0xc800
xor eax, eax
rep stosb byte es:[edi], al
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0xc800
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_fread
test eax, eax
jg 0x40b200
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [ebp - 0x2a], 0
lea edi, [ebp - 0x26]
mov ecx, 0xc
xor eax, eax
rep stosb byte es:[edi], al
lea eax, [ebp - 0x84]
mov dword [esp + 4], eax
lea esi, [ebp - 0x2a]
mov dword [esp], esi
call fcn.0041a4e4
test ebx, ebx
je 0x40b27d
mov dword [esp], ebx
call fcn.00477104
lea eax, [ebp - 0x1a]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00451c98
mov eax, dword [ebp + 8]
add esp, 0x8c
pop ebx
pop esi
pop edi
leave
ret 4
lea eax, [ebp - 0x19]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x486c1f
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00451c4c
mov eax, dword [ebp + 8]
add esp, 0x8c
pop ebx
pop esi
pop edi
leave
ret 4
Function at 0x414270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4142a7
cmp dword [eax + 0x10], ebx
jne 0x4142c1
mov edx, dword [eax + 0x28]
test edx, edx
je 0x4142b0
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x4142bc
mov dword [ecx + 0x28], edx
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 4]
mov al, 1
add esp, 0x14
pop ebx
leave
ret
mov ecx, dword [eax + 0x24]
mov dword [ebx + 0x1c], ecx
test ecx, ecx
jne 0x41429a
nop
mov dword [ebx + 0x18], edx
jmp 0x41429d
mov dword [esp + 8], 0x153
mov dword [esp + 4], str...CommonTinyXML_tinyxml.cpp
mov dword [esp], 0x4875c2
call sub.msvcrt.dll__assert
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
test edi, edi
jle 0x414321
xor ebx, ebx
nop
mov dword [esp + 0xc], esi
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], str.
call sub.msvcrt.dll_fwrite
inc ebx
cmp edi, ebx
jg 0x4142fc
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x20]
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], str.__s_
mov dword [ebp + 8], esi
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
jmp sub.msvcrt.dll_fprintf
Function at 0x414ce4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x414d8e
mov dword [esp], esi
call fcn.004138f0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jle 0x414e48
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [esp], eax
call fcn.00477128
mov edi, eax
mov byte [eax], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_fread
dec eax
je 0x414dc0
mov dword [esp], edi
call fcn.00477104
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], esi
call fcn.004114c8
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp - 0x1c]
lea ebx, [edi + eax]
mov byte [ebx], 0
mov cl, byte [edi]
mov edx, edi
mov eax, edi
test cl, cl
je 0x414dfb
nop
cmp eax, ebx
jae 0x414e96
cmp ebx, edx
jb 0x414eb2
cmp eax, edx
jb 0x414e7a
cmp cl, 0xd
je 0x414e38
mov byte [edx], cl
inc eax
mov cl, byte [eax]
inc edx
test cl, cl
jne 0x414dd4
cmp ebx, edx
jb 0x414ece
mov byte [edx], 0
mov eax, dword [esi]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [eax + 0xc]
mov dword [esp], edi
call fcn.00477104
mov al, byte [esi + 0x2c]
xor eax, 1
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
mov byte [edx], 0xa
inc eax
mov cl, byte [eax]
cmp cl, 0xa
je 0x414df3
inc edx
jmp 0x414df7
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp], esi
call fcn.004114c8
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], 0x3f8
mov dword [esp + 4], str...CommonTinyXML_tinyxml.cpp
mov dword [esp], str.q___p
call sub.msvcrt.dll__assert
mov dword [esp + 8], 0x3f6
mov dword [esp + 4], str...CommonTinyXML_tinyxml.cpp
mov dword [esp], str.p____buflength_
call sub.msvcrt.dll__assert
mov dword [esp + 8], 0x3f7
mov dword [esp + 4], str...CommonTinyXML_tinyxml.cpp
mov dword [esp], str.q____buflength_
call sub.msvcrt.dll__assert
mov dword [esp + 8], 0x405
mov dword [esp + 4], str...CommonTinyXML_tinyxml.cpp
mov dword [esp], str.q____buflength_
call sub.msvcrt.dll__assert
nop

Function at 0x419d40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
leave
ret
Function at 0x41a664
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x74
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
test esi, esi
je 0x41a6ea
xor ebx, ebx
lea edi, [ebp - 0x64]
lea esi, [esi]
mov eax, dword [ecx + ebx*4]
mov dword [esp + 8], eax
mov eax, dword [edx + ebx*4]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x74], ecx
call fcn.0041a564
inc ebx
cmp esi, ebx
mov edx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x74]
ja 0x41a6ac
mov dword [esp + 4], edi
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call fcn.0041a4e4
add esp, 0x74
pop ebx
pop esi
pop edi
leave
ret
lea edi, [ebp - 0x64]
jmp 0x41a6d3
Function at 0x41a6f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xa0
cmp dword [ebp + 0x10], 5
ja 0x41a82f
cmp dword [ebp + 0xc], 0x40
ja 0x41a83a
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x98], ecx
mov ecx, 0x40
xor eax, eax
mov edi, dword [ebp - 0x98]
rep stosb byte es:[edi], al
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x98]
rep movsb byte es:[edi], byte [esi]
lea ebx, [ebp - 0x8c]
lea edx, [ebp - 0x4c]
mov eax, ebx
xor byte [eax], 0x36
inc eax
cmp eax, edx
jne 0x41a744
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], 0x40
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41a86a
xor eax, eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x9c], ebx
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
nop
inc eax
mov ecx, dword [esi + eax*4 - 4]
mov ebx, dword [ebp - 0x90]
mov dword [ebx + eax*4], ecx
mov ecx, dword [edi + eax*4 - 4]
mov dword [edx + eax*4], ecx
cmp eax, dword [ebp + 0x10]
jne 0x41a780
mov ebx, dword [ebp - 0x9c]
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov ecx, dword [ebp - 0x90]
mov dword [esp + 4], ecx
mov eax, dword [ebp + 0x10]
inc eax
mov dword [esp], eax
mov dword [ebp - 0x94], edx
call fcn.0041a664
mov ecx, 0x40
xor eax, eax
mov edi, dword [ebp - 0x98]
rep stosb byte es:[edi], al
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x98]
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x94]
nop
xor byte [ebx], 0x5c
inc ebx
cmp edx, ebx
jne 0x41a7ec
lea ebx, [ebp - 0x8c]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x4c], 0x40
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x48], 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov ecx, dword [ebp - 0x90]
mov dword [esp + 4], ecx
mov dword [esp], 2
call fcn.0041a664
add esp, 0xa0
pop ebx
pop esi
pop edi
leave
ret
lea ebx, [ebp - 0x1c]
mov dword [esp + 0xc], ebx
lea eax, [ebp + 0xc]
mov dword [esp + 8], eax
lea eax, [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 1
call fcn.0041a664
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], 0x10
jmp 0x41a710
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x90], ecx
jmp 0x41a7a0
Function at 0x41a8bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
cmp dword [esi], 2
je 0x41a8e4
mov eax, 0xffffffff
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
test al, 7
jne 0x41a8d6
shr eax, 3
mov dword [ebp - 0x44], eax
je 0x41a964
lea eax, [esi + 4]
mov dword [ebp - 0x48], eax
lea edx, [esi + 0x304]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x38]
lea esi, [esi]
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [ebp - 0x4c], ecx
call fcn.0041ad54
xor eax, eax
mov ecx, dword [ebp - 0x4c]
lea esi, [esi]
mov dl, byte [esi + eax + 0x304]
xor byte [ebx + eax], dl
inc eax
cmp eax, 8
jne 0x41a934
mov eax, dword [ecx]
mov edx, dword [ebp - 0x40]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x44], eax
jbe 0x41a964
add ebx, 8
add edi, 8
jmp 0x41a90c
xor eax, eax
jmp 0x41a8db

Function at 0x41a96c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
cmp dword [ebx], 2
je 0x41a994
mov eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
test al, 7
jne 0x41a986
shr eax, 3
mov dword [ebp - 0x20], eax
je 0x41aa08
lea eax, [ebx + 4]
mov dword [ebp - 0x24], eax
lea ecx, [ebx + 0x304]
mov dword [ebp - 0x1c], 0
mov eax, edi
mov edi, ecx
mov ecx, eax
lea esi, [esi]
xor eax, eax
nop
mov dl, byte [esi + eax]
xor byte [ebx + eax + 0x304], dl
inc eax
cmp eax, 8
jne 0x41a9c0
mov dword [esp + 8], edi
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [ebp - 0x28], ecx
call fcn.0041ac94
mov eax, dword [edi]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x20], eax
jbe 0x41aa08
add esi, 8
add ecx, 8
jmp 0x41a9bc
xor eax, eax
jmp 0x41a98b
Function at 0x41aa90
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [eax]
mov esi, dword [eax + 4]
mov eax, ebx
shr eax, 4
xor eax, esi
and eax, 0xf0f0f0f
xor esi, eax
mov ecx, eax
shl ecx, 4
xor ecx, ebx
mov eax, ecx
shr eax, 0x10
xor eax, esi
and eax, 0xffff
xor esi, eax
shl eax, 0x10
xor eax, ecx
mov ecx, esi
shr ecx, 2
xor ecx, eax
and ecx, 0x33333333
xor eax, ecx
lea ebx, [ecx*4]
xor ebx, esi
mov ecx, ebx
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor eax, ecx
shl ecx, 8
xor ecx, ebx
ror ecx, 0x1f
mov ebx, ecx
xor ebx, eax
and ebx, 0xaaaaaaaa
xor eax, ebx
xor ecx, ebx
ror eax, 0x1f
xor ebx, ebx
nop
mov esi, ecx
ror esi, 4
xor esi, dword [edx + ebx]
mov edi, dword [edx + ebx + 4]
xor edi, ecx
mov dword [ebp - 0x10], edi
and edi, 0x3f
xor eax, dword [edi*4 + 0x487d00]
mov edi, esi
and edi, 0x3f
xor eax, dword [edi*4 + 0x487900]
mov edi, dword [ebp - 0x10]
shr edi, 8
and edi, 0x3f
xor eax, dword [edi*4 + 0x487e00]
mov edi, dword [ebp - 0x10]
shr edi, 0x10
and edi, 0x3f
xor eax, dword [edi*4 + 0x487f00]
mov edi, dword [ebp - 0x10]
shr edi, 0x18
and edi, 0x3f
xor eax, dword [edi*4 + 0x488000]
mov edi, esi
shr edi, 8
and edi, 0x3f
xor eax, dword [edi*4 + 0x487a00]
mov edi, esi
shr edi, 0x10
and edi, 0x3f
xor eax, dword [edi*4 + 0x487b00]
shr esi, 0x18
and esi, 0x3f
xor eax, dword [esi*4 + 0x487c00]
mov esi, eax
ror esi, 4
xor esi, dword [edx + ebx + 8]
mov edi, dword [edx + ebx + 0xc]
xor edi, eax
mov dword [ebp - 0x10], edi
and edi, 0x3f
xor ecx, dword [edi*4 + 0x487d00]
mov edi, esi
and edi, 0x3f
xor ecx, dword [edi*4 + 0x487900]
mov edi, dword [ebp - 0x10]
shr edi, 8
and edi, 0x3f
xor ecx, dword [edi*4 + 0x487e00]
mov edi, dword [ebp - 0x10]
shr edi, 0x10
and edi, 0x3f
xor ecx, dword [edi*4 + 0x487f00]
mov edi, dword [ebp - 0x10]
shr edi, 0x18
and edi, 0x3f
xor ecx, dword [edi*4 + 0x488000]
mov edi, esi
shr edi, 8
and edi, 0x3f
xor ecx, dword [edi*4 + 0x487a00]
mov edi, esi
shr edi, 0x10
and edi, 0x3f
xor ecx, dword [edi*4 + 0x487b00]
shr esi, 0x18
and esi, 0x3f
xor ecx, dword [esi*4 + 0x487c00]
add ebx, 0x10
cmp ebx, 0x80
jne 0x41ab0c
ror ecx, 1
mov edx, ecx
xor edx, eax
and edx, 0xaaaaaaaa
xor eax, edx
xor ecx, edx
ror eax, 1
mov edx, eax
shr edx, 8
xor edx, ecx
and edx, 0xff00ff
xor ecx, edx
shl edx, 8
xor edx, eax
mov eax, edx
shr eax, 2
xor eax, ecx
and eax, 0x33333333
xor ecx, eax
shl eax, 2
xor eax, edx
mov edx, ecx
shr edx, 0x10
xor edx, eax
and edx, 0xffff
mov ebx, edx
xor ebx, eax
shl edx, 0x10
xor edx, ecx
mov eax, edx
shr eax, 4
xor eax, ebx
and eax, 0xf0f0f0f
mov ecx, eax
shl ecx, 4
xor ecx, edx
mov edx, dword [ebp - 0x14]
mov dword [edx], ecx
xor eax, ebx
mov dword [edx + 4], eax
add esp, 8
pop ebx
pop esi
pop edi
leave
ret
Function at 0x41b038
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
xor edx, edx
mov eax, esi
call fcn.0041ae18
lea edi, [esi + 8]
lea ecx, [ebx + 0x80]
mov edx, 1
mov eax, edi
call fcn.0041ae18
lea eax, [esi + 0x10]
mov dword [ebp - 0x10], eax
lea ecx, [ebx + 0x100]
xor edx, edx
call fcn.0041ae18
lea eax, [ebx + 0x180]
mov dword [ebp - 0x14], eax
lea ecx, [ebx + 0x280]
mov edx, 1
mov eax, esi
call fcn.0041ae18
lea ecx, [ebx + 0x200]
xor edx, edx
mov eax, edi
call fcn.0041ae18
mov ecx, dword [ebp - 0x14]
mov edx, 1
mov eax, dword [ebp - 0x10]
add esp, 8
pop ebx
pop esi
pop edi
leave
jmp fcn.0041ae18

Function at 0x41f810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
mov dword [esp], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x10]
test ebx, ebx
mov dword [esp + 8], edi
sete al
cmp esi, ecx
sete dl
or eax, edx
xor edi, edi
test al, 1
jne 0x41f870
test esi, esi
setne al
test ecx, ecx
setne dl
xor eax, edx
test al, 1
jne 0x41f881
test ebx, ebx
je 0x41f864
movzx eax, word [esi]
movzx edx, word [ecx]
cmp ax, dx
jne 0x41f89d
add esi, 2
add ecx, 2
dec ebx
jne 0x41f850
xor edi, edi
lea esi, [esi]
lea edi, [edi]
mov eax, edi
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0xc
ret
cmp ecx, 1
mov ebx, dword [esp]
sbb eax, eax
and eax, 2
mov esi, dword [esp + 4]
lea edi, [eax - 1]
mov eax, edi
mov edi, dword [esp + 8]
add esp, 0xc
ret
movzx edi, ax
movzx eax, dx
sub edi, eax
jmp 0x41f870
Function at 0x4547f4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebx, eax
cmp eax, 0xffffffff
je 0x45482c
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x454803
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x50ba1e83
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section._RDATA
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x52d37b8f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401140
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esi, dword [eax + 0xc]
mov eax, dword [esi + 0x18]
test eax, eax
je 0x40117f
mov edi, dword [esp + 0x10]
mov esi, dword [esi]
mov ecx, dword [esi + 0x30]
push edi
push ecx
call fcn.004010c0
add esp, 8
test eax, eax
mov eax, dword [esi + 0x18]
je 0x401181
test eax, eax
jne 0x401165
xor eax, eax
pop edi
pop esi
pop ecx
ret

Function at 0x401240
Capabilities:
Encrypt data using rc4 prga
Hide graphical window

Disassembly:
sub esp, 0xc
mov eax, dword [0x40a024]
push ebx
push ebp
push esi
push edi
push eax
call fcn.004018fc
mov ecx, dword [0x40a024]
push ecx
mov edi, eax
call fcn.004018fc
mov ecx, dword [0x40a024]
xor ebx, ebx
add esp, 8
cmp ecx, ebx
mov esi, eax
mov dword [esp + 0x10], ebx
jbe 0x4012a2
sub eax, edi
mov dword [esp + 0x14], eax
jmp 0x401284
mov eax, dword [esp + 0x14]
lea ebp, [ebx + edi]
mov byte [eax + ebp], bl
mov eax, ebx
cdq
idiv dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
add ebx, 1
cmp ebx, ecx
mov dl, byte [edx + eax]
mov byte [ebp], dl
jb 0x401280
xor ebp, ebp
test ecx, ecx
jbe 0x4012f2
mov edx, edi
sub edx, esi
mov ebp, ecx
mov ebx, esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebp
jmp 0x4012c4
mov edx, dword [esp + 0x18]
movzx edx, byte [edx + ebx]
mov al, byte [ebx]
add edx, dword [esp + 0x10]
movzx eax, al
add eax, edx
xor edx, edx
div ecx
mov al, byte [ebx]
add ebx, 1
sub dword [esp + 0x14], 1
mov edi, edx
mov dl, byte [edi + esi]
mov byte [edi + esi], al
mov byte [ebx - 1], dl
mov dword [esp + 0x10], edi
jne 0x4012c0
xor edi, edi
cmp dword [esp + 0x24], edi
jle 0x40136f
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
sub eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
jmp 0x401318
mov ecx, dword [0x40a024]
xor edx, edx
lea eax, [ebp + 1]
div ecx
push 0
push 0
mov ebp, edx
movzx eax, byte [esi + ebp]
add eax, edi
xor edx, edx
div ecx
mov edi, edx
mov dl, byte [esi + ebp]
mov al, byte [edi + esi]
mov byte [edi + esi], dl
mov byte [esi + ebp], al
movzx edx, byte [edi + esi]
movzx eax, al
add eax, edx
xor edx, edx
div ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
mov edx, dword [esp + 0x14]
xor cl, byte [edx + esi]
add ebx, 1
sub dword [esp + 0x24], 1
mov byte [ebx - 1], cl
jne 0x401312
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret