joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x409936
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40984d
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x409871
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x409840
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x409840
lea esi, [ebx + 1]
push esi
call fcn.00408f00
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x409944
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x4098b8
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x409946
movzx edx, word [edi]
test dx, dx
je 0x409946
cmp dx, 0x7f
jbe 0x4098a0
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
mov dword [esp + 4], esi
cmp esi, 0x7ff
ja 0x409900
cmp ecx, 2
jb 0x409900
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x4098a7
xor esi, esi
cmp ecx, 3
jb 0x4098a7
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x4098a7
push 1
call fcn.00408f00
add esp, 4
mov ebp, eax
jmp 0x409946
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x409967
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x409962
test eax, eax
jne 0x409960
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00405a00
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x415d20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov ebx, dword [ebp + 0xc]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax], 0
lea eax, [eax + 2]
jne 0x415d40
lea ecx, [ebx + eax]
add ecx, 0xfffffffe
add eax, ebx
mov edx, 1
sub edx, eax
and edx, ebx
mov esi, ebx
not esi
and esi, ecx
sub esi, edx
sar esi, 1
lea edi, [esp + 0x74]
push edi
push 0
push 0
push esi
push ebx
push 0
call dword [0x447764]
mov ebx, dword [esp + 0x74]
test ebx, ebx
jns 0x415d87
mov eax, 0xffffffff
jmp 0x415d8a
lea eax, [ebx + ebx]
push eax
call fcn.00408f00
add esp, 4
push edi
push ebx
mov dword [esp + 0x18], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x447764]
mov dword [esp + 0x20], 0x338e319c
mov dword [esp + 0x24], 0x37a53595
mov dword [esp + 0x28], 0x2b4a29bc
mov dword [esp + 0x2c], 0x2f8b2d9a
mov dword [esp + 0x30], 0x23b121b2
mov dword [esp + 0x34], 0x27b925bd
mov dword [esp + 0x38], 0x1b1a1986
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov byte [esp + 0x44], 0
mov dword [esp + 0xb8], 0
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x24
ja 0x415e67
nop
nop
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0xb8]
movzx edx, byte [esp + edx + 0x20]
lea esi, [ecx + edx]
add esi, 0x3ec6a08
add ecx, 0x3ec6a08
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 0x90], esi
mov ecx, dword [esp + 0x90]
add cl, 0xc8
mov edx, dword [esp + 0xb8]
mov byte [esp + edx + 0x20], cl
inc dword [esp + 0xb8]
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x25
jb 0x415e10
lea edi, [esp + 0xb8]
lea edx, [esp + 0x20]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xd4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x74]
mov ecx, eax
add ecx, 0xd
jns 0x415e9d
mov eax, 0xffffffff
jmp 0x415ea2
add eax, eax
add eax, 0x1a
push eax
call fcn.00408f00
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x10]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x415ee1
mov eax, dword [esp + 0x10]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415ed0
mov word [eax], 0
movzx ecx, word [esp + 0xb8]
test cx, cx
je 0x415f11
lea edx, [esp + 0xba]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415f00
mov word [eax], 0
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043b670
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442004]
Function at 0x41b040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x30], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], ecx
movzx ecx, byte [ebp + 0x20]
mov dword [esp + 0x40], edi
mov byte [esp + 0x44], cl
mov dword [esp + 0x48], eax
movzx eax, cl
xor ebx, ebx
jmp dword [eax*4 + 0x442650]
Function at 0x41e140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0x3430179
mov dword [esp + 0x14], 0x1fac1db2
mov dword [esp + 0x18], 0x1bbb1942
mov dword [esp + 0x1c], 0x17b71596
mov dword [esp + 0x20], 0x13b41169
mov dword [esp + 0x24], 0x6fd46dbe
mov dword [esp + 0x28], 0x6bde69e1
mov dword [esp + 0x2c], 0x67db65d6
mov dword [esp + 0x30], 0x63c261d4
mov dword [esp + 0x34], 0x7fce7dd9
mov dword [esp + 0x38], 0x7bdc79c2
mov dword [esp + 0x3c], 0x77c6752a
mov dword [esp + 0x40], 0x73ce71c7
mov dword [esp + 0x44], 0x4ff84dc9
mov dword [esp + 0x48], 0x4bc549f1
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0x454a
mov dword [esp + 0x4e], 0
mov word [esp + 0x52], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x43
ja 0x41e23e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
lea esi, [ecx + 0x2b]
and esi, edx
add ecx, edx
add esi, esi
sub ecx, esi
add ecx, 0x3397b02b
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x5c]
add cl, 0xd3
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x44
jb 0x41e200
lea ebx, [esp + 0x5c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x447764]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41e287
mov eax, 0xffffffff
jmp 0x41e28a
lea eax, [edi + edi]
push eax
call fcn.00408f00
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x1e
push ebx
push 0
call dword [0x447764]
mov dword [esp + 0x10], 0x8b228d50
mov dword [esp + 0x14], 0x97248935
mov dword [esp + 0x18], 0x933f9538
mov dword [esp + 0x1c], 0x9f30912e
mov dword [esp + 0x20], 0x9b249d35
mov dword [esp + 0x24], 0x67669934
mov dword [esp + 0x28], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1b
ja 0x41e33a
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0xdfb82eea
add eax, 0xea
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x9a
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1c
jb 0x41e2f0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.004188e0
add esp, 0x14
mov ebx, eax
jmp dword [0x442dd8]
Function at 0x421150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [esp + 4]
call fcn.00421170
add esp, 4
test al, al
je 0x421163
mov al, 1
ret
jmp fcn.004218b0

Function at 0x421170
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x468
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x60], 0x33a631a3
mov dword [esp + 0x64], 0x37573551
mov dword [esp + 0x68], 0x2b7429b5
mov dword [esp + 0x6c], 0x2fa62d49
mov dword [esp + 0x70], 0x23222145
mov dword [esp + 0x78], 0
mov dword [esp + 0x74], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1b
ja 0x42121b
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x60]
lea edx, [eax + 0x1fa10b28]
add eax, 0x28
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
add al, 0xe8
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x60], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1c
jb case.default.0x42122e
lea ebx, [esp + 0x60]
lea ecx, [esp + 0x44]
push ebx
call fcn.004375c0
shr eax, 0x1f
xor edx, edx
jmp dword [eax*4 + 0x443640]
Function at 0x42dc00
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov eax, dword [ebp + 8]
mov byte [esp + 0xf], 0
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
cmp eax, 0
je 0x42ddbc
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp + 0x50], eax
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
je 0x42ddb6
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
jmp 0x42dc7e
mov dword [esp + 0x40], eax
jmp 0x42dc84
mov eax, dword [esp + 0x40]
jmp 0x42dc8a
mov dword [esp], eax
call fcn.00409020
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
jmp 0x42dc9c
cmp eax, 0
setne al
jmp 0x42dca4
test al, 1
jne 0x42dcad
jmp 0x42dda6
call fcn.004097b0
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
mov bl, byte [esp + 0x14]
mov byte [esp + 0x1c], bl
mov byte [esp + 0x20], 0xdb
mov byte [esp + 0x21], 0xed
mov byte [esp + 0x22], 0xe3
mov byte [esp + 0x23], 0xeb
mov byte [esp + 0x24], 0xf6
mov byte [esp + 0x25], 0xe2
mov byte [esp + 0x26], 0xf7
mov byte [esp + 0x27], 0xe5
mov byte [esp + 0x28], 0xec
mov byte [esp + 0x29], 0xa7
mov byte [esp + 0x2a], 0x1e
mov byte [esp + 0x2b], 0x1b
mov byte [esp + 0x2c], 0x20
mov byte [esp + 0x2d], 0xad
mov byte [esp + 0x30], 0
mov word [esp + 0x2e], 0
mov dword [esp + 0x10], 0
mov esi, dword [esp + 0x10]
cmp esi, 0x11
jae 0x42dd87
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edx
jmp 0x42dd32
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
movzx eax, byte [esp + edi + 0x20]
mov ebx, esi
add ebx, 0x14
mov edi, eax
not edi
mov edx, ebx
or edx, edi
and ebx, eax
add ebx, edx
neg ebx
lea eax, [esi + ebx + 0x625b0213]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x4c]
add al, 0x74
mov edx, dword [esp + 0x10]
mov byte [esp + edx + 0x20], al
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0x11
jb 0x42dd32
mov edx, dword [esp + 0x48]
mov edi, dword [esp + 0x44]
jmp 0x42dd87
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 8], edx
call fcn.004099c0
sub esp, 0xc
and al, 1
mov byte [esp + 0xf], al
jmp 0x42dda6
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, byte [esp + 0xf]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433980
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, 0xfffffffe
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x4339a0
test edx, edx
je 0x433a1a
sar edx, 1
lea esi, [edx - 1]
mov edi, edx
and edi, 3
je 0x4339d5
xor ebx, ebx
nop
nop
nop
movzx ebp, word [ecx]
add ecx, 2
xor ebp, eax
imul eax, ebp, 0x1000193
inc ebx
cmp edi, ebx
jne 0x4339c0
sub edx, ebx
cmp esi, 3
jb 0x433a1a
xor esi, esi
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 4]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 6]
xor edi, eax
imul eax, edi, 0x1000193
add esi, 4
cmp edx, esi
jne 0x4339e0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x939091a6
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xa
ja 0x4374ec
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx esi, byte [esp + edx + 8]
lea edi, [ecx - 0x1ed417ed]
lea edx, [ecx + esi]
add edx, 0xe12be813
and edi, esi
add ecx, 0x13
and ecx, esi
add ecx, edi
mov esi, ecx
xor esi, edx
not ecx
and ecx, edx
add ecx, ecx
sub ecx, esi
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x7b
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xb
jb 0x4374a0
mov ecx, dword [esp + 8]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x44f788]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x4375c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0x12111017
mov dword [esp + 0x14], 0
mov word [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x437645
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0xde7156d3
add eax, 0xde7156d3
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x3b
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x437600
mov ebx, dword [esp + 0x10]
mov eax, dword [0x447768]
test eax, eax
je 0x437696
xor ecx, ecx
mov edx, dword [0x44776c]
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xe4aa2089
je 0x437670
inc ecx
cmp eax, ecx
jne 0x437660
jmp 0x437696
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebx
je 0x437696
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x447770]
push eax
call fcn.00438da0
add esp, 0x1c
mov ebx, eax
cmp ebx, 0xc0000004
jne 0x4377e8
mov dword [esp + 0x20], esi
push dword [esp + 8]
call fcn.00437460
add esp, 4
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], 0x12111017
mov dword [esp + 0x14], 0
mov word [esp + 0x18], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 9
ja 0x437727
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x10]
lea esi, [ecx + edx]
add esi, 0xde7156d3
add ecx, 0xde7156d3
and ecx, edx
add ecx, ecx
mov edx, ecx
xor edx, esi
not ecx
and ecx, esi
add ecx, ecx
sub ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0x3b
mov edx, dword [esp]
mov byte [esp + edx + 0x10], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xa
jb 0x4376e0
mov ebx, dword [esp + 0x10]
mov ecx, dword [0x447768]
test ecx, ecx
je 0x43777e
xor edx, edx
mov esi, dword [0x44776c]
nop
nop
nop
cmp dword [esi + edx*8], 0xe4aa2089
je 0x43775a
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
cmp edx, ecx
jb 0x437740
jmp 0x43777e
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, ebx
je 0x43777e
push 0
push eax
push dword [esp + 0xc]
push 5
push 4
push dword [0x447770]
push ecx
call fcn.00438da0
add esp, 0x1c
mov ebx, eax
test ebx, ebx
js 0x4377dc
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 4]
mov esi, dword [ecx]
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [edx + esi]
movzx edi, word [eax + esi]
test bx, bx
je 0x4377b5
add esi, 2
cmp bx, di
je 0x4377a0
cmp bx, di
je 0x4377c7
mov esi, dword [ecx]
test esi, esi
jne 0x437790
mov ebx, 0xc0000225
jmp 0x4377dc
mov eax, dword [ecx + 0x44]
mov edx, dword [esp + 0x20]
mov dword [edx + 4], eax
mov eax, dword [ecx + 0xdc]
mov dword [edx + 8], eax
xor ebx, ebx
push dword [esp + 4]
call fcn.00437510
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x437820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov edx, dword [ecx + 4]
test edx, edx
je 0x437920
xor eax, eax
cmp dword [ecx], 0
jne 0x437925
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], edx
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 8], 0x12111017
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x4378f5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea esi, [eax + edx]
add esi, 0xde7156d3
add eax, 0xde7156d3
and eax, edx
add eax, eax
mov edx, eax
xor edx, esi
not eax
and eax, esi
add eax, eax
sub eax, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x3b
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x4378b0
mov eax, dword [esp + 8]
mov esi, dword [0x447768]
test esi, esi
je 0x437925
mov edx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x44776c]
nop
nop
cmp dword [ebx + edi*8], 0x94b236a1
je 0x43792f
inc edi
cmp esi, edi
jne 0x437910
jmp 0x437925
mov eax, 0xc0000008
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x437925
lea eax, [esp + 0x1c]
lea edi, [esp + 0x24]
push eax
push edi
push edx
push ecx
push 4
push dword [0x447770]
push esi
call fcn.00438da0
add esp, 0x1c
jmp 0x437925

Function at 0x437960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
test eax, eax
je 0x437a37
mov esi, ecx
mov dword [esp + 8], 0x12111017
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 9
ja 0x4379e7
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + edx]
add edi, 0xde7156d3
add ecx, 0xde7156d3
and ecx, edx
add ecx, ecx
mov edx, ecx
xor edx, edi
not ecx
and ecx, edi
add ecx, ecx
sub ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x3b
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xa
jb 0x4379a0
mov ecx, dword [0x447768]
test ecx, ecx
je 0x437a2a
mov edx, dword [esp + 8]
xor edi, edi
mov ebx, dword [0x44776c]
nop
nop
nop
cmp dword [ebx + edi*8], 0x11081610
je 0x437a10
inc edi
cmp ecx, edi
jne 0x437a00
jmp 0x437a2a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x437a2a
push eax
push 1
push dword [0x447770]
push ecx
call fcn.00438da0
add esp, 0x10
mov dword [esi], 0
mov dword [esi + 4], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, 0xc0000008
cmp dword [ecx + 4], 0
je 0x437c2e
mov esi, ecx
mov eax, dword [ecx]
test eax, eax
je 0x437c2e
mov dword [esp + 8], 0x12111017
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 9
ja 0x437ad7
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + edx]
add edi, 0xde7156d3
add ecx, 0xde7156d3
and ecx, edx
add ecx, ecx
mov edx, ecx
xor edx, edi
not ecx
and ecx, edi
add ecx, ecx
sub ecx, edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
add cl, 0x3b
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xa
jb 0x437a90
mov ebx, dword [ebp + 0x10]
mov edi, dword [esp + 8]
mov edx, dword [0x447768]
test edx, edx
je 0x437b25
xor ecx, ecx
mov ebx, dword [0x44776c]
cmp dword [ebx + ecx*8], 0xac3673b8
je 0x437b03
inc ecx
cmp edx, ecx
jne 0x437af0
mov ebx, dword [ebp + 0x10]
jmp 0x437b25
mov ecx, dword [ebx + ecx*8 + 4]
cmp ecx, edi
mov ebx, dword [ebp + 0x10]
je 0x437b25
push dword [ebp + 8]
push eax
push 2
push dword [0x447770]
push ecx
call fcn.00438da0
add esp, 0x14
mov edi, eax
cmp dword [ebp + 0xc], 1
mov eax, ebx
sbb eax, 0
jl 0x437c23
cmp edi, 0xc000010a
jne 0x437c23
mov ecx, 0xffffd8f0
mov edi, dword [ebp + 0xc]
mov eax, edi
mul ecx
sub edx, edi
imul ecx, ebx, 0xffffd8f0
add ecx, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esi]
mov dword [esp + 8], 0x12111017
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 9
ja 0x437bda
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + edx]
add edi, 0xde7156d3
add ecx, 0xde7156d3
and ecx, edx
add ecx, ecx
mov edx, ecx
xor edx, edi
not ecx
and ecx, edi
add ecx, ecx
sub ecx, edx
mov dword [esp], ecx
mov ecx, dword [esp]
add cl, 0x3b
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0xa
jb 0x437b90
mov edi, dword [esp + 8]
mov ecx, dword [0x447768]
test ecx, ecx
je 0x437c23
xor edx, edx
mov ebx, dword [0x44776c]
cmp dword [ebx + edx*8], 0xb33e16a3
je 0x437c00
inc edx
cmp ecx, edx
jne 0x437bf0
jmp 0x437c23
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, edi
je 0x437c23
lea edx, [esp + 0x18]
push edx
push 0
push eax
push 3
push dword [0x447770]
push ecx
call fcn.00438da0
add esp, 0x18
mov edi, eax
test edi, edi
js 0x437c2e
mov ecx, esi
call fcn.00437960
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x437c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x437c57
lea edx, [esp + 0x18]
mov ecx, dword [ecx]
mov dword [esp + 8], 0x12111017
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x437cc5
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 8]
lea edi, [eax + esi]
add edi, 0xde7156d3
add eax, 0xde7156d3
and eax, esi
add eax, eax
mov esi, eax
xor esi, edi
not eax
and eax, edi
add eax, eax
sub eax, esi
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x3b
mov esi, dword [esp]
mov byte [esp + esi + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x437c80
mov eax, dword [esp + 8]
mov esi, dword [0x447768]
test esi, esi
je 0x437d14
xor edi, edi
mov ebx, dword [0x44776c]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xc99a73c4
je 0x437cf0
inc edi
cmp esi, edi
jne 0x437ce0
jmp 0x437d14
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x437d14
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push 5
push dword [0x447770]
push esi
call fcn.00438da0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x438dd0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x278
push dword [0x44f780]
call fcn.00439d20
add esp, 4
movzx eax, al
jmp dword [eax*4 + 0x445828]