joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cbed0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x118
mov eax, dword [0x5eef00]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x12c]
push ebx
mov ebx, dword [esp + 0x120]
test ebx, ebx
push ebp
mov ebp, dword [esp + 0x128]
push esi
mov esi, dword [esp + 0x130]
push edi
mov dword [esp + 0x10], eax
jne 0x4cbf14
test ebp, ebp
ja 0x4cc0b1
test esi, esi
mov edi, dword [esp + 0x138]
jne 0x4cbf27
test edi, edi
ja 0x4cc0b1
test eax, eax
je 0x4cc0b1
cmp dword [esp + 0x140], 0x20
jb 0x4cc0b1
cmp edi, 0x40
jbe 0x4cbfa9
lea eax, [esp + 0x14]
push eax
call fcn.004ce110
push edi
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.004ce170
lea edx, [esp + 0x94]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.004ce230
add esp, 0x18
xor eax, eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
jmp 0x4cbfd7
push 0x40
lea ecx, [esp + 0x88]
push 0
push ecx
call fcn.004b3a80
add esp, 0xc
test esi, esi
je 0x4cbfd7
test edi, edi
jbe 0x4cbfd7
push edi
lea edx, [esp + 0x88]
push esi
push edx
call fcn.004b42c0
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x84]
xor cl, 0x36
mov byte [esp + eax + 0xc4], cl
add eax, 1
cmp eax, 0x40
jb 0x4cbfe0
lea edx, [esp + 0x14]
push edx
call fcn.004ce110
push 0x40
lea eax, [esp + 0xcc]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.004ce170
add esp, 0x10
test ebx, ebx
je 0x4cc031
test ebp, ebp
jbe 0x4cc031
push ebp
lea edx, [esp + 0x18]
push ebx
push edx
call fcn.004ce170
add esp, 0xc
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.004ce230
add esp, 8
xor eax, eax
jmp 0x4cc050
mov dl, byte [esp + eax + 0x84]
xor dl, 0x5c
mov byte [esp + eax + 0xc4], dl
add eax, 1
cmp eax, 0x40
jb 0x4cc050
lea eax, [esp + 0x14]
push eax
call fcn.004ce110
push 0x40
lea ecx, [esp + 0xcc]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.004ce170
push 0x20
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.004ce170
mov edx, dword [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push eax
call fcn.004ce230
add esp, 0x24
xor eax, eax
jmp 0x4cc0b4
or eax, 0xffffffff
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b2f95
add esp, 0x118
ret
Function at 0x4ce110
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
jne 0x4ce11e
or eax, 0xffffffff
ret
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
ret
Function at 0x4ce490
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
mov eax, dword [0x5eef00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x11c]
xor bl, bl
test edi, edi
je 0x4ce53b
mov ebp, dword [esp + 0x120]
test ebp, ebp
je 0x4ce53b
mov esi, dword [esp + 0x124]
test esi, esi
je 0x4ce53b
xor eax, eax
mov byte [edi + eax], al
add eax, 1
cmp eax, 0x100
jb 0x4ce4d1
xor ecx, ecx
mov eax, ecx
xor edx, edx
div esi
add ecx, 1
cmp ecx, 0x100
mov al, byte [edx + ebp]
mov byte [esp + ecx + 0x13], al
jb 0x4ce4e0
lea ebp, [esp + 0x14]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], pe_nt_image_headers32
movzx edx, byte [eax + ebp]
mov cl, byte [eax]
add dl, cl
add bl, dl
movzx edx, bl
lea esi, [edx + edi]
movzx edx, byte [esi]
mov byte [eax], dl
add eax, 1
sub dword [esp + 0x10], 1
mov byte [esi], cl
jne 0x4ce508
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
xor eax, eax
jmp 0x4ce53e
or eax, 0xffffffff
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b2f95
add esp, 0x108
ret

Function at 0x4ce560
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push edi
je 0x4ce5e3
mov edi, dword [esp + 0xc]
test edi, edi
je 0x4ce5e3
push ebp
mov ebp, dword [esp + 0x14]
xor ecx, ecx
test ebp, ebp
jbe 0x4ce5de
push ebx
push esi
mov edi, edi
add byte [eax + 0x100], 1
movzx edx, byte [eax + 0x100]
lea esi, [edx + eax]
movzx edx, byte [esi]
add byte [eax + 0x101], dl
mov dl, byte [eax + 0x101]
mov bl, byte [esi]
movzx edx, dl
movzx edx, byte [edx + eax]
mov byte [esi], dl
movzx edx, byte [eax + 0x101]
mov byte [edx + eax], bl
movzx edx, byte [eax + 0x100]
movzx edx, byte [edx + eax]
movzx esi, byte [eax + 0x101]
add dl, byte [esi + eax]
add ecx, 1
movzx edx, dl
movzx edx, byte [edx + eax]
xor byte [ecx + edi - 1], dl
cmp ecx, ebp
jb 0x4ce580
pop esi
pop ebx
pop ebp
xor eax, eax
pop edi
ret
or eax, 0xffffffff
pop edi
ret
Function at 0x57d240
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
call fcn.004c143c
add esp, 8
push 1
call fcn.004b3799
int3

Function at 0x57d260
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 0xc
push ebx
push ebp
lea ebx, [eax + ecx - 0x21524111]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, ebx
mov ebp, ebx
jbe switch.0x0057d35c
lea edx, [eax - 0xd]
mov eax, 0xaaaaaaab
mul edx
shr edx, 3
add edx, 1
mov dword [esp + 0x14], edx
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 4]
add edx, esi
shl eax, 8
lea edi, [edx + eax]
movzx eax, byte [ecx + 0xb]
movzx edx, byte [ecx + 0xa]
movzx esi, byte [ecx + 2]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 9]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 8]
add edx, ebx
shl eax, 8
lea ebx, [edx + eax]
movzx edx, byte [ecx + 3]
shl edx, 8
add edx, esi
movzx esi, byte [ecx + 1]
shl edx, 8
add edx, esi
movzx esi, byte [ecx]
shl edx, 8
add edx, esi
sub edx, ebx
add edx, ebp
mov eax, ebx
rol eax, 4
xor eax, edx
add ebx, edi
sub edi, eax
mov esi, eax
rol esi, 6
xor esi, edi
add eax, ebx
sub dword [esp + 0x18], 0xc
sub ebx, esi
mov edi, esi
rol edi, 8
xor edi, ebx
add esi, eax
sub eax, edi
mov edx, edi
rol edx, 0x10
xor edx, eax
mov ebp, edx
add edi, esi
sub esi, ebp
mov eax, ebp
ror eax, 0xd
xor esi, eax
add ebp, edi
mov edx, esi
sub edi, esi
rol edx, 4
xor edx, edi
add esi, ebp
add ecx, 0xc
sub dword [esp + 0x14], 1
mov ebx, edx
jne 0x57d294
cmp dword [esp + 0x18], 0xc
ja case.default.0x57d35c
mov eax, dword [esp + 0x18]
jmp dword [eax*4 + 0x57d418]
movzx eax, byte [ecx + 0xb]
shl eax, 0x18
add ebx, eax
movzx edx, byte [ecx + 0xa]
shl edx, 0x10
add ebx, edx
movzx eax, byte [ecx + 9]
shl eax, 8
add ebx, eax
movzx edx, byte [ecx + 8]
add ebx, edx
movzx eax, byte [ecx + 7]
shl eax, 0x18
add esi, eax
movzx edx, byte [ecx + 6]
shl edx, 0x10
add esi, edx
movzx eax, byte [ecx + 5]
shl eax, 8
add esi, eax
movzx edx, byte [ecx + 4]
add esi, edx
movzx eax, byte [ecx + 3]
shl eax, 0x18
add ebp, eax
movzx edx, byte [ecx + 2]
shl edx, 0x10
add ebp, edx
movzx eax, byte [ecx + 1]
shl eax, 8
add ebp, eax
movzx ecx, byte [ecx]
add ebp, ecx
xor ebx, esi
mov edx, esi
rol edx, 0xe
sub ebx, edx
mov eax, ebx
rol eax, 0xb
mov ecx, ebx
xor ecx, ebp
sub ecx, eax
xor esi, ecx
mov edx, ecx
ror edx, 7
sub esi, edx
xor ebx, esi
mov eax, esi
rol eax, 0x10
sub ebx, eax
mov eax, ebx
mov edi, eax
rol edi, 4
mov edx, eax
xor edx, ecx
sub edx, edi
mov ecx, edx
xor esi, edx
rol ecx, 0xe
sub esi, ecx
pop edi
mov edx, esi
xor eax, esi
pop esi
ror edx, 8
pop ebp
sub eax, edx
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x57dd60
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0
call dword [section..rdata]
test eax, eax
jne 0x57dd22
push str.error_CryptAcquireContextW
call fcn.004b3c49
add eax, 0x40
push eax
call fcn.004b3afa
add esp, 8
push 1
call fcn.004b3799
mov edx, dword [esp]
lea ecx, [esp + 4]
push ecx
push 4
push edx
call dword [0x58a004]
test eax, eax
jne 0x57dd3e
push str.error_CryptGenRandom
jmp 0x57dd0a
mov eax, dword [esp]
push 0
push eax
call dword [0x58a008]
mov eax, dword [esp + 4]
add esp, 8
ret
jmp 0x57dce0

Function at 0x57f390
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
push esi
xor ebx, ebx
or ebp, 0xffffffff
test eax, eax
push edi
mov esi, ecx
je 0x57f3ca
test esi, esi
je 0x57f3ca
mov eax, dword [eax + 0xd90]
cmp eax, 5
jae 0x57f3ca
shl eax, 5
mov edx, eax
cmp word [edx + 0x5bc458], 0xffff
je 0x57f3ca
mov edi, dword [edx + 0x5bc45c]
test edi, edi
jne 0x57f3d1
xor ebp, ebp
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
movzx eax, word [esi + 4]
cmp ax, 1
jb 0x57f3ca
movzx ecx, ax
mov eax, dword [edx + 0x5bc464]
add eax, 1
cmp ecx, eax
jb 0x57f3ca
xor edx, edx
mov eax, ecx
div edi
test edx, edx
jne 0x57f3ca
mov edi, dword [esi + 8]
mov cl, byte [edi + ecx - 1]
movzx eax, word [esi + 4]
movzx dx, cl
cmp ax, dx
jbe 0x57f3ca
sub eax, edx
movzx ecx, cl
lea edx, [eax - 1]
xor eax, eax
test ecx, ecx
mov word [esi + 4], dx
jbe 0x57f42f
movzx edx, dx
add edx, edi
movzx esi, byte [edx + eax]
xor esi, ecx
add eax, 1
or ebx, esi
cmp eax, ecx
jb 0x57f420
xor ebp, ebp
test ebx, ebx
je 0x57f3ca
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x404550
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x404640
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x404640
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40459a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x4045a1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x404580
jmp 0x4045a3
mov esi, 0x1505
jmp 0x4045a3
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
mov edx, ebx
sub edx, 1
jb 0x404640
mov ecx, esi
not ecx
or edx, ecx
mov eax, ebx
and eax, 0xfffffffe
add eax, eax
mov ecx, ebx
xor ecx, 1
sub eax, ecx
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
lea ebp, [esi + edx]
inc ebp
jmp 0x4045e4
inc ebp
dec ebx
je 0x40463e
mov eax, ebp
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40463e
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4045e0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp], eax
push eax
call fcn.0040c9c0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x4045e0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040c9e0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x4045e0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x404640
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405890
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405a8a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405a8a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405a8a
cmp dword [ecx], 0
jne 0x405a8a
push esi
call fcn.0040c9c0
add esp, 4
test eax, eax
je 0x4058fa
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405901
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x4058e0
jmp 0x405903
mov edi, 0x1505
jmp 0x405903
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
mov esi, edx
sub esi, 1
jae 0x4059cd
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x40595a
call fcn.00405b60
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405a8a
push esi
call fcn.0040c9c0
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405aa0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040c9c0
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x449008]
add esp, 4
test eax, eax
je 0x405a85
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c8b0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405a8a
mov dword [esp], eax
mov eax, edx
mov edx, edi
not edx
or esi, edx
mov ebx, eax
and ebx, 0xfffffffe
add ebx, ebx
mov edx, eax
xor edx, 1
sub ebx, edx
mov dword [esp + 0xc], ebx
mov edx, eax
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
lea ebx, [edi + esi]
inc ebx
jmp 0x405a08
inc ebx
dec edx
je 0x405915
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x40591a
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405a00
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040c9c0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405a00
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040c9e0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405a00
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404970
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x4059c2
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406b50
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x406cf2
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406ceb
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406be0
add ebp, dword [esp + 8]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406ceb
xor eax, eax
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 4], esi
jb 0x406c65
mov eax, edx
and eax, 0x1ff8
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
movzx ebx, byte [ebp + ebx]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 1]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 2]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 3]
add edi, ebx
add ecx, edi
movzx ebx, byte [ebp + edx + 4]
add ebx, edi
add ecx, ebx
movzx edi, byte [ebp + edx + 5]
add edi, ebx
mov ebx, ecx
xor ebx, edi
and ecx, edi
movzx esi, byte [ebp + edx + 6]
add esi, edi
movzx edi, byte [ebp + edx + 7]
add edi, esi
add esi, ebx
lea ecx, [esi + ecx*2]
lea ebx, [edx + 8]
add ecx, edi
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406c00
add ebp, ebx
mov esi, dword [esp + 4]
mov ebx, edx
sub ebx, eax
mov dword [esp + 8], ebx
jbe 0x406ba8
mov ebx, edx
mov edx, eax
or edx, 1
test bl, 1
jne 0x406c90
mov ebx, ebp
cmp dword [esp], edx
je 0x406ba0
jmp 0x406cad
lea ebx, [ebp + 1]
movzx eax, byte [ebp]
add edi, eax
mov eax, edi
and eax, ecx
xor ecx, edi
lea ecx, [ecx + eax*2]
mov eax, edx
cmp dword [esp], edx
je 0x406ba0
mov edx, dword [esp]
sub edx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + eax]
add esi, edi
mov edi, esi
and edi, ecx
xor ecx, esi
lea ecx, [ecx + edi*2]
movzx edi, byte [ebx + eax + 1]
add edi, esi
mov esi, edi
and esi, ecx
xor ecx, edi
lea ecx, [ecx + esi*2]
add eax, 2
cmp edx, eax
jne 0x406cc0
jmp 0x406ba0
shl ecx, 0x10
or ecx, edi
jmp 0x406cf7
mov ecx, 1
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406d10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x406d3e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x406ddc
not eax
test bl, 1
jne 0x406d45
mov edx, ebx
cmp ebx, 1
jne 0x406d76
jmp 0x406dda
xor eax, eax
jmp 0x406ddc
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x446c50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x446c50]
cmp ebx, 1
je 0x406dda
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x446c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x446c50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x446c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x446c50]
add esi, 2
cmp edx, esi
jne 0x406d80
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x40cf90
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov dword [esp], 0x3f3e1b15
mov byte [esp + 4], 0
mov eax, 0x8a
mov ecx, 0x75
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x8a]
mov esi, eax
or esi, edx
not edx
or edx, ecx
and edx, esi
add dl, 0x4e
mov byte [esp + eax - 0x8a], dl
inc eax
dec ecx
cmp eax, 0x8f
jne 0x40cfb0
mov edi, dword [esp]
call fcn.0043ff20
test al, al
je 0x40d1c4
call fcn.00438d10
test al, al
je 0x40d1bf
mov esi, edi
and esi, 0x34a7ad07
mov eax, esi
xor eax, 0x34a7ad07
mov ecx, edi
and ecx, 0xcb5852f8
imul ecx, eax
mov eax, esi
not eax
lea edx, [edi + eax]
add edx, 0x34a7ad08
add edi, 0x34a7ad08
mov ebx, esi
sub ebx, edi
and ebx, esi
and eax, edx
imul eax, ebx
add eax, ecx
mov ecx, edx
and ecx, esi
or esi, edx
imul esi, ecx
add esi, eax
mov ecx, esi
shr ecx, 7
mov eax, ecx
not eax
or eax, 0x98098b91
add eax, ecx
inc eax
and ecx, 0x1f6746e
xor ecx, 0x67f6746e
or eax, ecx
mov ecx, esi
and ecx, 0x67f6746e
or ecx, 0x8010a00
and esi, 0x98098b91
xor esi, ecx
xor esi, eax
xor esi, 0x6ff77e6e
mov eax, esi
and eax, 0xa51c8fe
mov ecx, esi
or esi, 0xa51c8fe
imul esi, eax
xor eax, 0xa51c8fe
and ecx, 0xf5ae3701
imul ecx, eax
add esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp], 0x961a659
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x40
xor cl, byte [esp + eax]
add cl, 0xc0
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x40d0b0
cmp esi, dword [esp]
jne 0x40d19c
mov dword [esp], 0xf73096f
mov dword [esp + 4], 0x3300d68
mov dword [esp + 8], 0x78e0165
mov dword [esp + 0xc], 0x1b3a0561
mov dword [esp + 0x10], 0x1f79192b
mov dword [esp + 0x14], 0x1d1c
mov eax, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 2]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xf6
mov byte [esp + eax - 2], cl
inc eax
cmp eax, 0x1a
jne 0x40d110
mov dword [esp + 0x18], 0x2392219f
mov dword [esp + 0x1c], 0x27982581
mov dword [esp + 0x20], 0x3938
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
mov eax, 0x88
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x70]
mov esi, eax
and esi, edx
or edx, eax
lea ecx, [esi + esi]
not ecx
add ecx, esi
and ecx, edx
add cl, 0x58
mov byte [esp + eax - 0x70], cl
inc eax
cmp eax, 0x97
jne 0x40d160
mov eax, esp
lea ecx, [esp + 0x18]
push 5
push 0
push eax
push 0x448050
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40d1ac
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e1a0
test al, al
je 0x40d1bf
call fcn.00410b90
call fcn.0040fa70
call fcn.00440de0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40e990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40ec03
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40e9cc
cmp edx, esi
jae 0x40ec03
test edi, edi
je 0x40ec03
movzx ebp, bl
test bl, bl
js 0x40ea10
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
xor esi, eax
not eax
and eax, ecx
add eax, eax
sub eax, esi
sar eax, 1
sub edi, eax
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40e9c0
jmp 0x40ec03
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40ea4b
cmp bl, 0xc2
jb 0x40e9f8
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40eab4
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40e9e2
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40ea75
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40eabe
cmp ebp, 0xe0
jne 0x40eac7
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40e9f4
jmp 0x40eac7
mov ecx, ebp
not ecx
or ecx, 0xf8
add ecx, ebp
cmp ecx, 0xef
jne 0x40ebde
cmp bl, 0xf4
ja 0x40e9f8
movzx ecx, byte [edx + 1]
je 0x40eb11
cmp ebp, 0xf0
jne 0x40eb1a
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40e9f4
jmp 0x40eb1a
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40e9fa
cmp cl, 0x9f
ja 0x40e9f4
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ebe5
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ebeb
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
mov word [eax], si
lea ecx, [eax + 2]
add edx, 3
jmp 0x40e9e2
cmp cl, 0x8f
ja 0x40e9f4
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ebe5
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ebeb
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ebf7
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ecx, ebp
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x40e9f4
mov ecx, dword [esp]
add ecx, ebp
add ecx, 0xffffff80
cmp ecx, 0x10000
jb 0x40e9f4
cmp edi, 2
jb 0x40ebde
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
mov esi, 0x3ff
sub esi, ecx
not esi
or esi, ecx
and esi, 0x3ff
or esi, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], si
jmp 0x40e9e2
mov ecx, eax
jmp 0x40e9e2
inc edx
jmp 0x40e9f4
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40e9fa
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40e9fa
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f190
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x13c], 0
mov dword [esi + 0x138], 0
mov dword [esi + 0x130], 0
mov dword [esi + 0x12c], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x120], 0
mov dword [esi + 0x11c], 0
mov dword [esi + 0x114], 0
mov dword [esi + 0x110], 0
mov dword [esi + 0x10c], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x104], 0x3c
mov dword [esi + 0x118], 0xffffffff
mov dword [esi + 0x134], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44f038]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40f271
sar edx, 1
lea edi, [esi + 0x104]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449ab4]