joyce8/EMBER2024-capa huggingface dataset:
Function at 0x561be9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x65d17c], 0x1b78
mov dword [0x65d180], 0x1566
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
jmp 0x561ce9
lea eax, [0x60fcb3]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov dword [0x65d17c], 0x2154
mov dword [0x65d180], 0x4610
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x140], ecx
call fcn.005614b0
mov eax, dword [0x65d17c]
add eax, 0x170f
mov dword [0x65d180], eax
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x144]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x148]
mov dword [esp + 0xc], edx
call fcn.005621f5
xor eax, eax
mov ecx, dword [ebp - 0x144]
add ecx, 0x8277d
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x128000
mov ecx, dword [ebp - 0x144]
add ecx, 0x4728e
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x2090
mov dword [0x65d180], 0x1682
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
imul esi, eax, 0xdc
mov edi, edx
add edi, esi
add edi, 0xa0
mov esi, dword [edi]
imul edi, eax, 0xdc
add edx, edi
add edx, 0x54
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x576
mov ecx, edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
jne 0x561ce9
mov dword [0x65d17c], 0x14bc
lea eax, [0x60fca5]
mov ecx, 0xe
lea edx, [ebp - 0x12c]
mov dword [0x65d180], 0xfffff816
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], ecx
call fcn.00561e9b
mov dword [0x65d17c], 0x784
call fcn.00561975
mov dword [esp], eax
mov eax, dword [ebp - 0x14c]
mov dword [esp + 4], eax
call fcn.00561a60
mov dword [0x65d19c], eax
mov dword [0x65d17c], 0x867
mov ecx, esp
mov edx, dword [ebp - 0x148]
mov dword [ecx + 4], edx
mov dword [ecx + 0xc], 4
mov dword [ecx + 8], 0x1000
mov dword [ecx], 0
call eax
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], ecx
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x154]
lea edx, section..data
imul esi, eax, 0xdc
mov edi, edx
add edi, esi
add edi, 0xa0
mov esi, dword [edi]
imul edi, eax, 0xdc
mov ebx, edx
add ebx, edi
add ebx, 0x40
mov edi, dword [ebx]
imul ebx, eax, 0xdc
add edx, ebx
add edx, 0x54
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x144]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], edx
call fcn.00561f4e
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x160]
add eax, ecx
mov edx, dword [ebp - 0x15c]
add edx, 1
cmp edx, 0x576
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], edx
je 0x561c27
jmp 0x561df1
Function at 0x5621f5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x65d184], 0
mov dword [0x65d188], 0
mov dword [0x65d194], 0
mov dword [0x65d17c], 0x1445
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x562397
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x65d17c], 0x1a3e
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x65d184], edx
mov dword [0x65d180], 0x263
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x65d188], edx
mov dword [0x65d180], 0x25c1
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x65d18c], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x65d180]
add edx, 0x1fb5
mov dword [0x65d17c], edx
mov cl, byte [0x65d18c]
mov edx, dword [0x65d188]
mov byte [edi + edx], cl
mov edx, dword [0x65d17c]
add edx, 0x201f
mov dword [0x65d17c], edx
mov edx, dword [0x65d184]
movzx edx, byte [edi + edx]
mov ebx, dword [0x65d188]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x65d194], ebx
mov dword [0x65d17c], 0xfad
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov byte [0x65d199], ch
mov byte [0x65d19a], cl
xor ch, cl
mov byte [0x65d198], ch
mov dword [0x65d17c], 0x8f3
mov edx, dword [0x65d180]
add edx, 0xffffec9d
mov dword [0x65d180], edx
mov edx, dword [ebp - 0x1c]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x562397
mov eax, dword [0x65d188]
mov ecx, dword [0x65d184]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
jmp 0x562258
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x408e54
mov ecx, 0x24391439
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x2a3c2475
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x407600
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x517380]
test eax, eax
jne 0x407636
push esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
mov esi, eax
push esi
push 0x517380
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp dword [0x517380], esi
je 0x407635
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, dword [0x517380]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret

Function at 0x40781b
Capabilities:
Get disk information
Query environment variable

Disassembly:
sub esp, 0x100
push 0x100
push 0
push 0x601800
call fcn.004269c0
add esp, 0xc
push 0xfe
lea eax, [esp + 4]
push eax
push str.SystemDrive
mov dword [0x517338], 0
mov byte [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x407859
cmp eax, 0xfe
jbe 0x40786a
lea ecx, [esp]
push 0x4cd794
push ecx
call fcn.004269a0
add esp, 8
lea edx, [esp]
push edx
call fcn.0042b670
add esp, 4
test eax, eax
je 0x40788a
cmp byte [esp + eax - 1], 0x5c
je 0x40788a
mov byte [esp + eax], 0x5c
mov byte [esp + eax + 1], 0
push 0
push 0
push 0
push 0
push 0x601800
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4078b4
mov dword [0x517338], 4
add esp, 0x100
ret

Function at 0x407ef0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x4cd8a0]
test eax, eax
je 0x407f1f
mov dword [0x5173bc], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x4cd784], eax
je 0x407f29
mov dword [0x4cd8a0], 0
jmp 0x407f24
mov eax, dword [0x4cd784]
cmp eax, 0xffffffff
jne 0x407f2c
xor eax, eax
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x407f6e
push 4
call fcn.00409c30
mov esi, eax
add esp, 4
test esi, esi
je 0x407f6a
mov eax, dword [0x4cd784]
push esi
push eax
mov dword [esi], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x407f6e
push esi
call fcn.00409c50
add esp, 4
xor eax, eax
pop esi
ret
mov eax, esi
pop esi
ret
Function at 0x40aca0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
cmp dword [ebx], 0
push ebp
push edi
je 0x40acbc
pop edi
mov dword [esp + 0xc], 0xdd
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x10]
movzx edx, byte [eax + 2]
xor ecx, ecx
mov ch, byte [eax]
push esi
mov cl, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 3]
shl ecx, 8
or ecx, edx
cmp ecx, 0x54534421
jne 0x40ad03
movzx esi, byte [eax + 6]
xor edx, edx
mov dh, byte [eax + 4]
mov ecx, 1
mov dl, byte [eax + 5]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
or edx, esi
jmp 0x40ad23
mov edx, dword [eax]
xor ecx, ecx
cmp edx, 0x54534421
je 0x40ad20
pop esi
pop edi
mov dword [esp + 0xc], 0xd8
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
mov edx, dword [eax + 4]
cmp edx, 2
je 0x40ad39
pop esi
pop edi
mov dword [esp + 0xc], 0xdf
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
cmp ecx, 1
jne 0x40ad5a
movzx edx, byte [eax + 0x16]
xor ecx, ecx
mov ch, byte [eax + 0x14]
mov cl, byte [eax + 0x15]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 0x17]
shl ecx, 8
or ecx, edx
jmp 0x40ad5d
mov ecx, dword [eax + 0x14]
add ecx, 0x20
push ecx
push eax
call fcn.00435500
mov esi, eax
add esp, 8
test esi, esi
je 0x40ae05
push ebx
push esi
call fcn.00434d00
mov edi, eax
push esi
mov dword [esp + 0x20], edi
call fcn.004354a0
add esp, 0xc
test edi, edi
jne 0x40ae0d
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
xor ebp, ebp
test ecx, ecx
jbe 0x40ae0d
xor ebx, ebx
jmp 0x40ada0
mov esi, dword [eax + 0x14]
mov ecx, dword [esi + ebx]
mov edx, dword [eax + 0x18]
add esi, ebx
lea eax, [edx + ecx*8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ecx
push edx
call fcn.00435440
mov edi, eax
add esp, 8
test edi, edi
je 0x40adf6
push edi
call fcn.0040a7c0
push edi
mov dword [esi + 0xc], eax
call fcn.00435100
mov eax, dword [esi + 0xc]
add esp, 8
test eax, eax
mov eax, dword [esp + 0x18]
je 0x40ae16
mov eax, dword [eax]
mov ecx, dword [eax + 8]
inc ebp
add ebx, 0x10
cmp ebp, ecx
jb 0x40ada0
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push edx
call fcn.0040a6a0
add esp, 4
mov dword [esp + 0x14], 0xc
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebp
pop ebx
ret
mov ecx, dword [eax]
push ecx
call fcn.0040a6a0
add esp, 4
pop esi
pop edi
mov dword [esp + 0xc], 0x7d1
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret
Function at 0x414aa0
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414ac1
ret
mov eax, dword [esp + 0xc]
ret

Function at 0x414e30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
test cx, cx
push ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 4], eax
jbe 0x414ed2
push ebp
movzx ecx, cx
push esi
push edi
mov dword [esp + 0x1c], ecx
jmp 0x414e60
mov eax, dword [esp + 0x10]
jmp 0x414e60
mov edi, dword [eax + 4]
mov ebp, dword [eax]
mov dword [esp + 0x18], 0x10
lea ecx, [ecx]
xor ecx, ecx
mov cl, bl
lea edx, [esp + 0x14]
mov dword [esp + 0x14], edi
and ecx, 0xf
call fcn.00414dd0
mov edx, dword [esp + 0x14]
mov esi, ebp
xor esi, edx
mov ecx, 2
lea edx, [esp + 0x24]
xor esi, ebx
call fcn.00414e00
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x24]
dec eax
mov ebp, edi
mov edi, esi
mov dword [esp + 0x18], eax
jne 0x414e70
mov eax, dword [esp + 0x10]
mov dword [eax + 4], esi
mov dword [eax], ebp
add eax, 8
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
inc ebx
dec eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], eax
jne 0x414e51
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x414ee0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
test ax, ax
push ebp
mov ebp, dword [esp + 0x10]
jbe 0x414f69
push ebx
movzx eax, ax
push esi
mov dword [esp + 0x10], eax
push edi
jmp 0x414f00
mov esi, dword [ebp]
mov edi, dword [ebp + 4]
mov dword [esp + 0x10], 0x10
mov edi, edi
mov ecx, 2
lea edx, [esp + 0x20]
call fcn.00414dd0
mov ebx, dword [esp + 0x20]
xor ecx, ecx
mov cl, bl
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], esi
and ecx, 0xf
call fcn.00414dd0
mov ecx, dword [esp + 0x10]
mov eax, edi
xor eax, dword [esp + 0x1c]
xor eax, ebx
dec ecx
mov edi, esi
mov esi, eax
mov dword [esp + 0x10], ecx
jne 0x414f10
mov dword [ebp], eax
mov eax, dword [esp + 0x14]
mov dword [ebp + 4], edi
add ebp, 8
inc ebx
dec eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], eax
jne 0x414f00
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret

Function at 0x415260
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
movzx eax, byte [esi + 2]
movzx ecx, byte [eax + 0x4ce320]
mov eax, 4
cmp edi, eax
jle 0x415292
push ebx
mov bl, byte [eax + esi]
mov edx, ecx
and edx, 0xff
mov dl, byte [edx + 0x4ce320]
xor bl, dl
inc ecx
mov byte [eax + esi], bl
inc eax
cmp eax, edi
jl 0x415275
pop ebx
ret
Function at 0x4153e0
Capabilities:
Check if process is running under wine

Disassembly:
push ecx
mov eax, dword [0x537918]
test eax, eax
mov dword [esp], 0
jne 0x415465
push esi
push 0x4ce4a4
mov dword [0x537918], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x415464
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ce4b4
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x41545b
push 0x4ce4c0
push esi
call edi
mov edi, eax
test edi, edi
je 0x41545b
lea eax, [esp + 0xc]
push eax
push str.SoftwareWineWineConfig
push 0x80000002
call ebx
test eax, eax
jne 0x41545b
mov eax, dword [esp + 0xc]
test eax, eax
je 0x415451
push eax
call edi
mov dword [0x537914], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop ebx
pop esi
pop ecx
ret
Function at 0x415630
Capabilities:
Encode data using xor

Disassembly:
mov dx, word [eax + 0x2c]
mov ecx, dword [esp + 4]
mov word [ecx], dx
mov dx, word [eax + 0x2e]
mov word [ecx + 2], dx
mov dx, word [eax + 0x28]
mov word [ecx + 4], dx
mov dx, word [eax + 0x2a]
mov word [ecx + 6], dx
mov edx, dword [esp + 8]
sub esp, 8
dec word [eax + 0x18]
mov edx, dword [edx]
test byte [edx + 0x4d], 1
push edi
mov di, word [eax + 0x18]
jne 0x415681
mov dl, byte [eax + 0x1c]
cmp dl, 2
jb 0x415678
cmp dl, 0x34
jbe 0x415681
mov ax, 7
pop edi
add esp, 8
ret
test di, di
je 0x415819
cmp di, 0x1fff
ja 0x415819
add ecx, 8
test di, di
mov dword [esp + 0x10], ecx
jbe 0x415819
push ebx
push ebp
jmp 0x4156b0
mov ecx, dword [esp + 0x18]
lea ecx, [ecx]
mov dx, word [ecx]
mov word [eax + 0x28], dx
mov dx, word [ecx + 2]
mov word [eax + 0x2a], dx
mov dx, word [ecx + 4]
mov word [eax + 0x2c], dx
mov cx, word [ecx + 6]
mov word [eax + 0x2e], cx
lea ecx, [eax + 2]
mov dword [esp + 0xc], ecx
mov ebp, eax
mov dword [esp + 0x10], 6
mov dx, word [eax + 0x2c]
mov bl, dl
mov word [eax + 0x20], dx
mov cx, word [eax + 0x2e]
mov byte [esp + 0x1c], bl
mov bl, dh
xor bl, dl
movzx dx, dl
mov word [eax + 0x22], cx
movzx di, bl
mov bl, cl
shl edi, 8
add edi, edx
mov dl, ch
xor dl, bl
movzx dx, dl
and ecx, 0xff00
mov word [eax + 0x2c], di
add ecx, edx
mov word [eax + 0x2e], cx
mov dx, word [ebp]
xor dx, di
mov edi, dword [esp + 0xc]
mov word [eax + 0x2c], dx
mov dx, word [edi]
xor dx, cx
mov word [eax + 0x2e], dx
mov cl, byte [esi + 2]
add cl, byte [esi + 1]
inc cl
mov dl, cl
shr dl, 7
shl cl, 1
or dl, cl
mov bl, dl
shl dl, 1
shr bl, 7
or bl, dl
mov dl, byte [esi]
add dl, bl
mov cl, dl
shl dl, 1
shr cl, 7
or cl, dl
mov dl, cl
shr dl, 7
shl cl, 1
or dl, cl
mov byte [esi], dl
mov dl, byte [esi + 2]
add dl, bl
mov cl, dl
shr cl, 7
shl dl, 1
or cl, dl
mov dl, cl
shl cl, 1
shr dl, 7
or dl, cl
mov cl, byte [esi + 3]
add cl, dl
mov byte [esi + 2], dl
inc cl
mov dl, cl
shl cl, 1
shr dl, 7
or dl, cl
mov cl, dl
shr cl, 7
shl dl, 1
or cl, dl
mov byte [esi + 1], bl
mov byte [esi + 3], cl
mov dx, word [eax + 0x28]
xor word [eax + 0x2c], dx
mov cx, word [eax + 0x2a]
mov dx, word [eax + 0x20]
xor word [eax + 0x2e], cx
mov cx, word [eax + 0x22]
mov word [eax + 0x28], dx
mov word [eax + 0x2a], cx
mov ecx, dword [esp + 0x10]
add edi, 4
add ebp, 4
dec ecx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ecx
jne 0x4156e0
mov ecx, dword [esp + 0x18]
mov dx, word [eax + 0x2c]
mov word [ecx], dx
mov dx, word [eax + 0x2e]
mov word [ecx + 2], dx
mov dx, word [eax + 0x28]
mov word [ecx + 4], dx
mov dx, word [eax + 0x2a]
mov word [ecx + 6], dx
dec word [eax + 0x18]
add ecx, 8
cmp word [eax + 0x18], 0
mov dword [esp + 0x18], ecx
ja 0x4156a9
pop ebp
pop ebx
xor ax, ax
pop edi
add esp, 8
ret
Function at 0x416120
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [ecx]
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
add dword [eax + 4], edx
mov edx, dword [ecx + 4]
add esi, edx
mov dword [eax], esi
lea edx, [ecx + 0x10]
mov dword [esp + 0x10], 3
mov edi, edi
mov ebp, dword [eax]
mov ebx, dword [eax + 4]
xor ebx, ebp
mov esi, ebx
mov edi, ebp
shr edi, 4
and edi, 0x1f
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
mov edi, dword [edx - 8]
shl ebx, cl
mov ecx, 0x20
or esi, ebx
sub esi, edi
mov dword [eax + 4], esi
mov edi, esi
shr edi, 7
xor esi, ebp
and edi, 0x1f
sub ecx, edi
mov ebx, esi
shr ebx, cl
mov ecx, edi
shl esi, cl
mov ecx, dword [edx - 4]
or ebx, esi
add ecx, ebx
mov ebx, dword [eax + 4]
xor ebx, ecx
mov dword [eax], ecx
mov ebp, dword [edx]
mov edi, ecx
shr edi, 4
and edi, 0x1f
mov esi, ebx
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, 0x20
or esi, ebx
mov ebx, dword [eax]
sub esi, ebp
xor ebx, esi
mov edi, esi
mov dword [eax + 4], esi
shr edi, 7
and edi, 0x1f
sub ecx, edi
mov esi, ebx
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, dword [edx + 4]
or esi, ebx
mov ebx, dword [eax + 4]
add ecx, esi
mov edi, ecx
xor ebx, ecx
mov dword [eax], ecx
mov ebp, dword [edx + 8]
shr edi, 4
and edi, 0x1f
mov esi, ebx
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, 0x20
or esi, ebx
mov ebx, dword [eax]
sub esi, ebp
mov edi, esi
shr edi, 7
and edi, 0x1f
mov dword [eax + 4], esi
xor ebx, esi
sub ecx, edi
mov esi, ebx
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, dword [edx + 0xc]
add edx, 0x20
or esi, ebx
mov ebx, dword [eax + 4]
add ecx, esi
xor ebx, ecx
mov dword [eax], ecx
mov ebp, dword [edx - 0x10]
mov edi, ecx
shr edi, 4
and edi, 0x1f
mov esi, ebx
mov ecx, 0x20
sub ecx, edi
shr esi, cl
mov ecx, edi
shl ebx, cl
mov ecx, 0x20
or esi, ebx
mov ebx, dword [eax]
sub esi, ebp
mov edi, esi
xor ebx, esi
shr edi, 7
mov dword [eax + 4], esi
and edi, 0x1f
sub ecx, edi
mov esi, ebx
shr esi, cl
mov ecx, edi
mov edi, dword [edx - 0xc]
shl ebx, cl
mov ecx, dword [esp + 0x10]
or esi, ebx
add esi, edi
dec ecx
mov dword [eax], esi
mov dword [esp + 0x10], ecx
jne 0x416140
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x416280
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebp, 0xc
jmp 0x416290
mov ebx, dword [edi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + ebp*8 + 4]
mov edx, dword [edi]
sub edx, ecx
mov esi, ebx
shr esi, 7
and esi, 0x1f
mov eax, edx
mov ecx, 0x20
sub ecx, esi
shl eax, cl
mov ecx, esi
shr edx, cl
mov ecx, dword [esp + 0x10]
or eax, edx
xor eax, ebx
mov dword [edi], eax
mov edx, dword [ecx + ebp*8]
lea esi, [edx + ebx]
mov edx, eax
shr edx, 4
and edx, 0x1f
mov ecx, 0x20
sub ecx, edx
mov ebx, esi
shl ebx, cl
mov ecx, edx
shr esi, cl
or ebx, esi
xor ebx, eax
dec ebp
mov dword [edi + 4], ebx
jne 0x416290
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
sub dword [edi], ecx
mov edx, dword [eax]
mov eax, ebx
pop esi
sub eax, edx
pop ebp
mov dword [edi + 4], eax
pop ebx
ret
Function at 0x4169f0
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push ebp
mov esi, eax
push esi
push str.HL_LICENSEDIR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test ebx, ebx
je 0x416a3c
lea eax, [ebp - 1]
cmp ebx, eax
jae 0x416a2e
mov ecx, esi
call fcn.00415cb0
cmp byte [eax + esi - 1], 0x5c
je 0x416a2e
push edi
mov edi, 0x4ce220
call fcn.00415de0
inc ebx
pop edi
test ebx, ebx
je 0x416a3c
cmp ebx, ebp
jae 0x416a3c
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
push ebp
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x416a4e
pop esi
pop ebp
pop ebx
ret
cmp byte [eax + esi], 0x5c
je 0x416a6c
cmp byte [eax + esi], 0x3a
je 0x416a6c
test eax, eax
je 0x416a6c
mov byte [eax + esi], 0
mov cl, byte [eax + esi - 1]
dec eax
cmp cl, 0x5c
jne 0x416a54
pop esi
pop ebp
inc eax
pop ebx
ret
Function at 0x421570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 4], ebx
jle 0x421600
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
xor esi, esi
nop
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x4215a1
dec eax
or eax, 0xffffff00
inc eax
movzx edi, al
movzx eax, byte [edi + ebp]
lea ecx, [edi + ebp]
add eax, ebx
and eax, 0x800000ff
jns 0x4215bb
dec eax
or eax, 0xffffff00
inc eax
movzx ebx, al
lea eax, [ebx + ebp]
call fcn.00421560
movzx ecx, byte [ecx]
movzx edx, byte [eax]
add ecx, edx
and ecx, 0x800000ff
jns 0x4215de
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, cl
mov cl, byte [eax + ebp]
mov eax, dword [esp + 0x18]
xor byte [esi + eax], cl
mov eax, dword [esp + 0x10]
inc eax
movsx esi, ax
mov dword [esp + 0x10], eax
cmp esi, dword [esp + 0x1c]
jl 0x421590
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x421610
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
xor eax, eax
mov ecx, ebx
lea esp, [esp]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x421620
xor dl, dl
xor esi, esi
mov ecx, ebx
mov ebp, 0x100
mov eax, dword [esp + 0x14]
movzx edi, dl
movzx eax, byte [edi + eax]
movzx edx, byte [ecx]
sub eax, edx
add eax, esi
and eax, 0x800000ff
jns 0x421655
dec eax
or eax, 0xffffff00
inc eax
movzx esi, al
lea eax, [esi + ebx]
call fcn.00421560
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x18]
inc ecx
dec ebp
jne 0x421635
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x421f80
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
test edi, edi
jbe 0x421fd8
push ebx
push esi
mov esi, dword [esp + 0x10]
movzx edx, byte [esi]
mov ecx, eax
and ecx, 0xf
movzx ecx, word [ecx*4 + 0x4cec30]
shr ax, 4
mov ebx, edx
and ebx, 0xf
xor cx, word [ebx*4 + 0x4cec30]
shr edx, 4
xor ecx, eax
mov eax, ecx
and eax, 0xf
movzx eax, word [eax*4 + 0x4cec30]
xor ax, word [edx*4 + 0x4cec30]
shr cx, 4
xor eax, ecx
inc esi
dec edi
jne 0x421f91
pop esi
pop ebx
pop edi
ret
Function at 0x422e90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
cmp dword [esi + 0x94], 1
push edi
jne 0x422f0f
mov ebx, dword [esp + 0x18]
test bl, 3
jne 0x422f1f
xor edi, edi
test ebx, ebx
jbe 0x422edc
mov ebp, dword [esp + 0x14]
lea eax, [edi + ebp]
call fcn.00422610
add dword [esi + 0x3c], eax
mov ecx, esi
call fcn.00422630
mov edx, esi
call fcn.004226c0
mov edx, dword [esi + 0x10]
xor edx, eax
add edi, 4
cmp edi, ebx
mov dword [esi + 0x10], edx
jb 0x422eb4
add dword [esi + 0x3c], ebx
mov eax, esi
call fcn.00422870
call fcn.00422850
mov eax, esi
call fcn.00422770
xor eax, eax
pop edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], 1
pop esi
pop ebp
pop ebx
ret
mov eax, esi
call fcn.004227e0
mov ebx, dword [esp + 0x18]
test bl, 3
je 0x422f29
pop edi
pop esi
pop ebp
mov eax, 0x7d1
pop ebx
ret
xor edi, edi
test ebx, ebx
jbe 0x422f5b
mov ebp, dword [esp + 0x14]
lea eax, [edi + ebp]
call fcn.00422610
add dword [esi + 0x3c], eax
mov ecx, esi
call fcn.00422630
mov edx, esi
call fcn.004226c0
mov edx, dword [esi + 0x10]
xor edx, eax
add edi, 4
cmp edi, ebx
mov dword [esi + 0x10], edx
jb 0x422f33
add dword [esi + 0x3c], ebx
mov eax, esi
call fcn.00422870
pop edi
mov dword [esi + 0x90], 0
pop esi
pop ebp
xor eax, eax
pop ebx
ret