joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45466c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [str.LnaeLhbs]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x40797361
mov byte [ecx + 0xc], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xc
jne 0x4546c9
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x454702
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [str.Vhruu_l_]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x626f6d6c
mov byte [ecx + 0xc], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xc
jne 0x45475f
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x454798
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movaps xmm0, xmmword [str.FeuCnmlaodMioe_]
movups xmmword [ecx], xmm0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xf
jne 0x4547e8
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x454826
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movaps xmm0, xmmword [str.FeuCnmlaodMioeV]
movups xmmword [ecx], xmm0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xf
jne 0x454876
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret
Function at 0x4548b4
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [str._wfeum_]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x73616f69
mov word [ecx + 0xc], 0x7267
mov byte [ecx + 0xe], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xe
jne 0x454917
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x454950
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [str._feum_i]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x6773616f
mov word [ecx + 0xc], 0x72
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xd
jne 0x4549af
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x4549ee
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [0x438c40]
movsd qword [ecx], xmm0
mov word [ecx + 8], 0x7767
mov byte [ecx + 0xa], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xa
jne 0x454a4a
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x454a82
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [str._q__va]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x776773
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xb
jne 0x454adb
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret
Function at 0x454b1a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [str._p_as]
movsd qword [ecx], xmm0
mov word [ecx + 8], 0x6267
mov byte [ecx + 0xa], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xa
jne 0x454b76
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x454bae
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov dword [ecx], 0x75697965
mov byte [ecx + 4], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 4
jne 0x454bfe
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x454c36
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov dword [ecx], 0x6979455e
mov word [ecx + 4], 0x75
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 5
jne 0x454c88
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x454cc6
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov dword [ecx], 0x6979655e
mov word [ecx + 4], 0x75
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 5
jne 0x454d18
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret
Function at 0x454d56
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [str.qtibkey]
movsd qword [ecx], xmm0
mov word [ecx + 8], 0x7569
mov byte [ecx + 0xa], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xa
jne 0x454db2
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x454dea
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [str.DxhtQrnc]
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0x727364
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0xb
jne 0x454e43
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x454e82
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [str.otelm.el]
movsd qword [ecx], xmm0
mov word [ecx + 8], 0x6d
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 9
jne 0x454eda
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret

Function at 0x454f18
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
movsd xmm0, qword [0x438d0a]
movsd qword [ecx + 0xd], xmm0
movups xmm0, xmmword [str.NuUom_pWidwNfRebthoo]
movups xmmword [ecx], xmm0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
test eax, eax
nop
inc eax
cmp eax, 0x14
jne 0x454f75
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
pop esi
ret
Function at 0x402b0d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f0
push ebx
push esi
push edi
mov ebx, 0x3bc617b3
mov eax, ebx
add eax, ebx
mov ebx, eax
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov byte [ebp - 0x197], 0
jmp 0x402c8f
mov eax, ebx
mul ebx
mov dword [ebp - 0x1e8], eax
mov ebx, eax
movzx eax, byte [ebp - 0x197]
push eax
push 0x43042b
lea eax, [ebp - 0x196]
push eax
call 0x40f5f0
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x43041c
lea eax, [ebp - 0x196]
push eax
push 0x80000001
call fcn.00408d8a
add esp, 0x20
mov dword [ebp - 0x19c], eax
or eax, eax
je 0x402bad
push 0x100
push dword [ebp + 8]
dec eax
push eax
lea eax, [ebp - 0x100]
add eax, 2
push eax
call fcn.00402a9c
add esp, 0x10
xor ebx, 0x12ed
lea edi, [ebp - 0x1c4]
lea esi, [0x42d0b8]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1e4]
lea esi, [0x42d0d8]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x1a1], 0
jmp 0x402c4d
mov eax, ebx
add eax, ebx
mov ebx, eax
push 0x100
lea eax, [ebp - 0x100]
push eax
movzx edi, byte [ebp - 0x1a1]
shl edi, 2
push dword [ebp + edi - 0x1c4]
lea edi, [ebp - 0x196]
push edi
push 0x80000001
call fcn.00408d8a
lea eax, [ebp - 0x100]
push eax
movzx edi, byte [ebp - 0x1a1]
shl edi, 2
push dword [ebp + edi - 0x1e4]
mov edi, dword [ebp + 8]
push edi
push 0x430397
push edi
call 0x40f5f0
add esp, 0x28
mov eax, ebx
sub eax, ebx
mov ebx, eax
add byte [ebp - 0x1a1], 1
mov al, byte [ebp - 0x1a1]
cmp al, 8
jb 0x402be2
inc dword [ebp - 0x1a0]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1ec], eax
push eax
call 0x40f38c
mov edi, dword [ebp - 0x1ec]
lea edi, [edi + eax + 1]
mov dword [ebp + 8], edi
mov eax, 0x1f78
mul ebx
mov dword [ebp - 0x1f0], eax
mov ebx, eax
add byte [ebp - 0x197], 1
mov al, byte [ebp - 0x197]
cmp al, 0x1e
jb 0x402b3d
mov eax, dword [ebp - 0x1a0]
and eax, 0xff
jmp 0x402cb0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405344
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov ebx, dword [ebp + 8]
mov ecx, 0xae60305
add ecx, 0xce4
mov esi, ebx
and dword [0x418600], 0
mov eax, ecx
add eax, ecx
mov ecx, eax
and dword [0x419f94], 0
and dword [0x41afa4], 0
and dword [0x418de0], 0
add ecx, 0x35ab
mov dword [0x419b78], 4
mov dword [0x4196d8], 4
mov eax, esi
inc esi
mov al, byte [eax]
mov byte [0x419600], al
movzx eax, byte [0x419600]
or eax, eax
jl 0x405612
cmp eax, 0xff
jg 0x405612
jmp dword [eax*4 + 0x42d1c8]
test byte [0x419f94], 0x40
je 0x4056e9
mov eax, esi
inc esi
mov al, byte [eax]
mov byte [0x42b0c4], al
mov eax, 0x7c27
mul ecx
mov dword [ebp - 0xc], eax
mov ecx, eax
movzx eax, byte [0x42b0c4]
and eax, 0xc0
mov byte [ebp - 5], al
movzx eax, byte [0x42b0c4]
and eax, 7
mov byte [ebp - 6], al
movzx eax, byte [ebp - 5]
cmp eax, 0xc0
je 0x4056e9
cmp byte [ebp - 5], 0x40
jne 0x40566c
inc dword [0x418de0]
mov eax, ecx
sub eax, ecx
mov ecx, eax
movzx eax, byte [ebp - 5]
cmp eax, 0x80
jne 0x405688
mov eax, dword [0x4196d8]
add dword [0x418de0], eax
cmp dword [0x4196d8], 2
jne 0x4056a6
cmp byte [ebp - 5], 0
jne 0x4056e9
cmp byte [ebp - 6], 6
jne 0x4056e9
add dword [0x418de0], 2
jmp 0x4056e9
cmp byte [ebp - 6], 4
jne 0x4056d0
or byte [0x419f94], 0x80
mov eax, ecx
sub eax, ecx
mov ecx, eax
mov eax, esi
inc esi
mov al, byte [eax]
mov byte [0x419b74], al
movzx eax, byte [0x419b74]
and eax, 7
mov byte [ebp - 6], al
cmp byte [ebp - 6], 5
jne 0x4056e3
cmp byte [ebp - 5], 0
jne 0x4056e3
add dword [0x418de0], 4
mov eax, ecx
sub eax, ecx
mov ecx, eax
and dword [0x418de8], 0
jmp 0x40570a
mov eax, esi
inc esi
mov edx, dword [0x418de8]
mov al, byte [eax]
mov byte [edx + 0x4195f8], al
inc dword [0x418de8]
mov eax, dword [0x418de0]
cmp dword [0x418de8], eax
jb 0x4056f2
mov eax, ecx
xor eax, ecx
mov ecx, eax
and dword [0x418de8], 0
jmp 0x40573e
mov eax, esi
inc esi
mov edx, dword [0x418de8]
mov al, byte [eax]
mov byte [edx + 0x42c810], al
inc dword [0x418de8]
mov eax, dword [0x41afa4]
cmp dword [0x418de8], eax
jb 0x405726
mov eax, esi
sub eax, ebx
mov dword [0x418600], eax
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret
Function at 0x40704f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, 0x30b1265f
xor edi, 0x2d18
mov eax, dword [ebp + 8]
add eax, 5
push eax
lea eax, [ebp - 0x101]
push eax
call 0x40f5f0
add esp, 8
mov byte [ebp - 1], 0
jmp 0x4070a0
movzx eax, byte [ebp - 1]
cmp byte [ebp + eax - 0x101], 0x2c
jne 0x40709c
movzx eax, byte [ebp - 1]
mov byte [ebp + eax - 0x101], 0x2e
add byte [ebp - 1], 1
lea eax, [ebp - 0x101]
push eax
call 0x40f38c
movzx esi, byte [ebp - 1]
cmp esi, eax
jl 0x407082
mov eax, edi
xor eax, edi
mov edi, eax
push 4
push 0x430168
lea eax, [ebp - 0x101]
push eax
call fcn.0040434d
mov esi, eax
mov word [ebp - 0x104], si
push 5
push 0x430168
lea eax, [ebp - 0x101]
push eax
call fcn.0040434d
mov esi, eax
mov word [ebp - 0x106], si
movzx eax, word [ebp - 0x104]
mov byte [ebp + eax - 0x101], 0
mov eax, edi
sub eax, edi
mov edi, eax
movzx eax, word [ebp - 0x106]
mov byte [ebp + eax - 0x101], 0
lea eax, [ebp - 0x101]
push eax
push dword [ebp + 0xc]
call 0x40f5f0
mov eax, edi
mul edi
mov dword [ebp - 0x10c], eax
mov edi, eax
lea eax, [ebp - 0x101]
movzx edx, word [ebp - 0x104]
lea eax, [eax + edx + 1]
push eax
call 0x40f59c
mov ebx, eax
mov byte [ebp - 0x107], bl
lea eax, [ebp - 0x101]
movzx edx, word [ebp - 0x106]
lea eax, [eax + edx + 1]
push eax
call 0x40f59c
add esp, 0x28
mov ebx, eax
mov byte [ebp - 0x108], bl
mov eax, edi
add eax, edi
mov edi, eax
movzx edi, byte [ebp - 0x108]
movzx esi, byte [ebp - 0x107]
movzx esi, si
shl esi, 8
or edi, esi
movzx eax, di
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b95c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40ba72
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00406866
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40b9b3
mov byte [ebp - 2], 0
jmp 0x40b9dd
call 0x40f5d8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40b9fc
cmp al, 0x7f
ja 0x40b9fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40ba1b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call 0x40f5c0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call 0x40f5b4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call 0x40f5b4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40b990
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401d41
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412b28
push 0x40f670
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov al, byte [0x415308]
and al, byte [0x415324]
mov byte [0x4152f8], al
and dword [ebp - 0x1c], 0
push dword [0x415330]
push 0x253bffff
call fcn.004033d3
pop ecx
pop ecx
add word [0x415312], ax
and dword [ebp - 4], 0
call dword [0x415834]
test eax, 0x80000000
je 0x401dd8
dec byte [0x415301]
push ebx
push eax
inc eax
xor ebx, eax
pop eax
pop ebx
mov ecx, dword fs:[0x20]
push ebx
push eax
sub eax, ebx
and eax, 0xb4d5ffff
pop eax
pop ebx
mov dword [ebp - 0x1c], ecx
push ecx
push eax
mov eax, 0x9a3fffff
and ecx, 0xd261ffff
pop eax
pop ecx
jmp 0x401e3d
call dword [0x411040]
add byte [0x415301], al
push edx
mov edx, 0xc237ffff
and edx, 0x8963ffff
pop edx
mov ecx, dword fs:[0x30]
push edx
push ecx
or ecx, edx
xor ecx, 0x20a3ffff
pop ecx
pop edx
mov al, byte [ecx + 2]
push edx
dec edx
pop edx
movzx ecx, al
push ecx
push ebx
add ebx, ecx
pop ebx
pop ecx
mov dword [ebp - 0x1c], ecx
push edx
push ecx
push eax
mov ecx, 0x134dffff
mov eax, edx
pop eax
pop ecx
pop edx
jmp 0x401e3d
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40d390
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d3b38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push 0x14
push 0
mov esi, ecx
mov dword [esp + 0xc], 0x4d72d0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0x14
call fcn.00404550
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
push eax
lea ecx, [esp + 0x10]
push 0x500b44
push ecx
mov dword [esp + 0x30], 0
call fcn.0040d520
add esp, 0x14
push 5
mov ecx, esi
call fcn.0044bad0
mov esi, dword [esp + 8]
add eax, 0x68
xor edx, edx
test esi, esi
je 0x40d417
cmp byte [esi], dl
mov ecx, esi
je 0x40d417
jmp 0x40d410
inc edx
inc ecx
cmp byte [ecx], 0
jne 0x40d410
push edx
push esi
mov ecx, eax
call fcn.004047b0
test esi, esi
je 0x40d42d
push esi
call fcn.004c3f2c
add esp, 4
mov ecx, dword [esp + 0x14]
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x4194f0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d4136
push eax
mov eax, dword [esp + 0x1c]
mov dword fs:[0], esp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x30]
push 0x1a0
mov dword [esi], 0x4d7818
mov dword [esi + 4], eax
mov dword [esi + 0x10], ecx
mov dword [esi + 8], 0
call fcn.004c3f1a
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0xc], 0
je 0x41954a
push esi
mov ecx, eax
call fcn.004174b0
jmp 0x41954c
xor eax, eax
mov dword [esi + 8], eax
mov edx, dword [str.root]
add eax, 0x24
mov dword [eax], edx
mov cx, word [0x5019dc]
mov word [eax + 4], cx
mov edx, dword [esi + 8]
mov eax, dword [esp + 0x24]
mov dword [edx + 0x130], eax
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x28]
push 0x2c
mov dword [ecx + 0x12c], edx
call fcn.004c3f1a
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0xc], 1
je 0x4195b6
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push ecx
push edx
mov ecx, eax
call fcn.00402c80
jmp 0x4195b8
xor eax, eax
mov ecx, dword [esp + 4]
mov dword [esi + 0xc], eax
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0x20