joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4050c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x4051d2
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4051d2
cmp dword [esp + 0x2c], 0
je 0x4051d2
push esi
call fcn.0040cb40
add esp, 4
test eax, eax
je 0x40512a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x405131
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x405110
jmp 0x405133
mov ebx, 0x1505
jmp 0x405133
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x4051da
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405197
call fcn.00405dc0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x4051d2
push ecx
call fcn.0040cb40
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x40524d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4051f8
inc edi
dec esi
je 0x40514c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405151
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4051f0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040cb40
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4051f0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040cb60
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4051f0
mov eax, 0xffffffff
jmp 0x4051d2
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405268
inc edi
dec esi
je 0x405192
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x405197
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405260
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040cb40
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405260
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040cb60
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405260
jmp 0x405197
Function at 0x405b10
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405cfa
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405cfa
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405cfa
cmp dword [ecx], 0
jne 0x405cfa
push esi
call fcn.0040cb40
add esp, 4
test eax, eax
je 0x405b7a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405b81
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405b60
jmp 0x405b83
mov edi, 0x1505
jmp 0x405b83
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x405c54
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405be1
call fcn.00405dc0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405cfa
push esi
call fcn.0040cb40
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405d10
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040cb40
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x449008]
add esp, 4
test eax, eax
je 0x405cf5
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040ca40
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405cfa
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405c78
inc ebx
dec edx
je 0x405b9c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405ba1
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405c70
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040cb40
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405c70
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040cb60
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405c70
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404c40
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405c49
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406de0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406f86
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406f7f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406e75
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406f7f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406eee
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406e90
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406e3d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406f30
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406f10
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406e30
jmp 0x406f3f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406e30
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406f50
jmp 0x406e30
shl ecx, 0x10
or ecx, edi
jmp 0x406f8b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x406ffa
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x406ffc
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x446c50]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
add edi, ebp
add ebx, ebx
sub edi, ebx
xor eax, dword [edi*4 + 0x446c50]
inc esi
cmp edx, esi
jne 0x406fc0
not eax
jmp 0x406ffc
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d3f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx edx, word [edi]
test dx, dx
je 0x40d44f
lea ecx, [edi + 2]
xor eax, eax
jmp 0x40d42d
add eax, esi
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x40d451
movzx ebx, dx
cmp ebx, 0x800
mov edx, 3
sbb edx, 0
mov esi, 1
cmp ebx, 0x80
jb 0x40d420
mov esi, edx
jmp 0x40d420
xor eax, eax
mov ecx, eax
and ecx, 1
xor eax, 1
lea ebx, [eax + ecx*2]
push ebx
call fcn.0040ca10
add esp, 4
mov esi, eax
lea ecx, [eax + ebx]
dec ecx
mov dword [esp + 8], ecx
cmp eax, ecx
jae 0x40d520
mov eax, esi
add eax, ebx
mov dword [esp + 4], eax
mov eax, esi
jmp 0x40d4a2
mov byte [eax], bl
mov ebp, 1
add eax, ebp
add edi, 2
cmp eax, dword [esp + 8]
jae 0x40d520
movzx ebx, word [edi]
test bx, bx
je 0x40d520
cmp bx, 0x7f
jbe 0x40d490
mov ecx, eax
not ecx
add ecx, dword [esp + 4]
movzx edx, bx
cmp ecx, 2
jb 0x40d4f0
cmp edx, 0x7ff
ja 0x40d4f0
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and bl, 0x3f
or bl, 0x80
mov byte [eax + 1], bl
mov ebp, 2
jmp 0x40d497
xor ebp, ebp
cmp ecx, 3
jb 0x40d497
mov ecx, edx
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
shr edx, 6
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
and bl, 0x3f
or bl, 0x80
mov byte [eax + 2], bl
mov ebp, 3
jmp 0x40d497
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x40d545
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [esi + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x40d540
test eax, eax
je 0x40d558
mov ebx, eax
jmp 0x40d540
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00408fd0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40e3f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x198
mov eax, dword [0x44f3c4]
mov dword [esp + 0x118], 0x191a131c
mov dword [esp + 0x11c], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 7
ja 0x40e466
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x118]
add ecx, 0x53433fb
xor ecx, edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
add cl, 0x19
mov edx, dword [esp]
mov byte [esp + edx + 0x118], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 8
jb 0x40e430
mov ecx, dword [esp + 0x118]
mov dword [esp + 0x18], 0x1ed07fd
mov dword [esp + 0x1c], 0xdea03f6
mov dword [esp + 0x20], 0x9f20ff0
mov dword [esp + 0x24], 0x153c0bf8
mov dword [esp + 0x28], 0x11e217f8
mov dword [esp + 0x2c], 0x1d1213e4
mov word [esp + 0x30], 0
mov byte [esp + 0x32], 0
mov dword [esp + 4], 0
mov edx, dword [esp + 4]
cmp edx, 0x1a
ja 0x40e510
nop
nop
nop
nop
nop
nop
mov esi, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x18]
mov edi, esi
xor edi, 0x95bbadc1
add esi, esi
and esi, 0x2b775b82
mov ebx, esi
and ebx, edi
xor esi, edi
lea esi, [esi + ebx*2]
lea edi, [esi + edx]
not edx
or esi, edx
sub edx, esi
lea edx, [edi + edx*2]
mov dword [esp], edx
mov edx, dword [esp]
add dl, 0x3b
mov esi, dword [esp + 4]
mov byte [esp + esi + 0x18], dl
inc dword [esp + 4]
mov edx, dword [esp + 4]
cmp edx, 0x1b
jb 0x40e4c0
lea ebp, [esp + 0x18]
push ecx
push 0
push ebp
call eax
mov ecx, 0x44f38c
push eax
call fcn.0043ee00
movzx eax, al
mov eax, dword [eax*4 + 0x449a64]
mov ecx, 0x104fdc32
xor ecx, dword [0x449a6c]
add eax, ecx
inc eax
jmp eax
Function at 0x41aad0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get elevation service for chromium-based browsers
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xaa8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41aaf0
sar esi, 1
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x4506d8]
mov ebx, dword [esp + 0x2c]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41ab24
mov eax, 0xffffffff
jmp 0x41ab27
lea eax, [ebx + ebx]
push eax
call fcn.0040ca10
add esp, 4
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov ebx, eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x4506d8]
mov eax, dword [esp + 0x2c]
mov ecx, eax
add ecx, 0xd
js 0x41ab57
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040ca10
add esp, 4
mov edi, eax
mov dword [esp + 0x1f8], 0x7f327904
mov dword [esp + 0x1fc], 0x63f57d1d
mov dword [esp + 0x200], 0x674661f4
mov dword [esp + 0x204], 0x6b0f651e
mov dword [esp + 0x208], 0x6ff969fe
mov dword [esp + 0x20c], 0x93016d05
mov dword [esp + 0x210], 0x97969102
mov byte [esp + 0x214], 0
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x48]
cmp eax, 0x1c
ja 0x41ac21
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x48]
movzx ecx, byte [esp + ecx + 0x1f8]
mov edx, eax
xor edx, 0x73cf5d6a
and eax, 0xf3cf5d6a
lea eax, [edx + eax*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x698], edx
mov eax, dword [esp + 0x698]
add al, 0xee
mov ecx, dword [esp + 0x48]
mov byte [esp + ecx + 0x1f8], al
inc dword [esp + 0x48]
mov eax, dword [esp + 0x48]
cmp eax, 0x1d
jb 0x41abd0
movzx ecx, word [ebx]
mov eax, edi
test cx, cx
je 0x41ac41
lea edx, [ebx + 2]
mov eax, edi
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ac30
mov word [eax], 0
movzx ecx, word [esp + 0x1f8]
test cx, cx
mov dword [esp + 8], ebx
je 0x41ac71
lea edx, [esp + 0x1fa]
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ac60
mov word [eax], 0
lea eax, [esp + 0x638]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00443ba0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b17c]
Function at 0x420ba0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x420bb0
cmp eax, 0xffffffed
jge 0x420bc7
mov eax, 0xffffffff
jmp 0x420bca
add eax, 0x12
push eax
call fcn.0040ca10
add esp, 4
mov esi, eax
mov dword [esp + 4], 0x71a30fb0
mov dword [esp + 8], 0x75e973d7
mov dword [esp + 0xc], 0x79187720
mov dword [esp + 0x10], 0x7dd87bdc
mov word [esp + 0x14], 0x7f7c
mov dword [esp + 0x16], 0
mov byte [esp + 0x1a], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x16
ja 0x420c59
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0xa22ab83d
and eax, 0x222ab83d
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0xcf
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x17
jb 0x420c20
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x420c81
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x420c70
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x420cb1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420ca0
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.00443d60
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x44b53c]
Function at 0x4249c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [0x4506d8]
mov dword [esp + 8], 0x99559bb7
mov dword [esp + 0xc], 0xa556a768
mov dword [esp + 0x10], 0xa14da368
mov dword [esp + 0x14], 0xad41af5c
mov dword [esp + 0x18], 0xa94eab87
mov dword [esp + 0x1c], 0xb55eb774
mov dword [esp + 0x20], 0xb140b34f
mov dword [esp + 0x24], 0xbd55bf5c
mov dword [esp + 0x28], 0xb954bb42
mov dword [esp + 0x2c], 0x45b8474f
mov dword [esp + 0x30], 0x41a643a8
mov dword [esp + 0x34], 0x4db04f90
mov dword [esp + 0x38], 0x49a04bbd
mov dword [esp + 0x3c], 0x55a257bf
mov dword [esp + 0x40], 0x51af53bf
mov word [esp + 0x44], 0x5f50
mov dword [esp + 0x46], 0
mov byte [esp + 0x4a], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x42
ja 0x424ab3
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov esi, ecx
xor esi, 0x329e9a5b
add ecx, ecx
and ecx, 0x653d34b6
mov edi, ecx
and edi, esi
xor ecx, esi
lea ecx, [ecx + edi*2]
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x39
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x43
jb 0x424a70
lea ebp, [esp + 0x4c]
lea ecx, [esp + 8]
push ebp
push 0
push 0
push 0x1e
push ecx
push 0
call eax
mov edi, dword [esp + 0x4c]
test edi, edi
jns 0x424ad6
mov eax, 0xffffffff
jmp 0x424ad9
lea eax, [edi + edi]
push eax
call fcn.0040ca10
add esp, 4
mov esi, eax
mov eax, dword [0x4506d8]
mov dword [esp + 8], 0x83438165
mov dword [esp + 0xc], 0x87368534
mov dword [esp + 0x10], 0x8b2b894c
mov dword [esp + 0x14], 0x8f2f8d38
mov dword [esp + 0x18], 0x934e9175
mov dword [esp + 0x1c], 0x973e9540
mov dword [esp + 0x20], 0x9b34992d
mov dword [esp + 0x24], 0x9f3b9d38
mov dword [esp + 0x28], 0x63c061d2
mov dword [esp + 0x2c], 0x67d465cd
mov dword [esp + 0x30], 0x6bb669cc
mov dword [esp + 0x34], 0x6fdc6dbc
mov dword [esp + 0x38], 0x73d471df
mov dword [esp + 0x3c], 0x77da75dd
mov dword [esp + 0x40], 0x7bc979dd
mov dword [esp + 0x44], 0x7d7c
mov byte [esp + 0x48], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x40
ja 0x424bcc
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov ebx, ecx
xor ebx, 0x80befd60
and ecx, 0xbefd60
lea ecx, [ebx + ecx*2]
lea ebx, [ecx + edx]
and ecx, edx
mov edx, ebx
xor edx, ecx
add edx, ecx
not ecx
and ecx, ebx
add ecx, ecx
sub ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x20
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x41
jb 0x424b80
push ebp
push edi
push esi
push 0x1e
lea edi, [esp + 0x18]
push edi
push 0
call eax
jmp dword [0x44bdc4]
Function at 0x426be0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84c
xor ebp, ebp
xor edi, edi
mov ecx, 0xfffffdff
mov eax, 1
mov dword [esp + 8], 0
jmp dword [eax*4 + 0x44c50c]
Function at 0x431760
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x338
mov dword [esp + 0x30c], 0x44d298
mov dword [esp + 0x104], 0
lea eax, [esp + 0x104]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x448070
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x448080
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x308], eax
mov eax, dword [esp + 0x30c]
mov ecx, dword [esp + 0x308]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x304], 0x44d2a0
mov dword [esp + 0x2fc], 0x44d2a8
mov dword [esp + 0x2f4], 0x44cae0
mov dword [esp + 0x2f0], 0x7b
mov dword [esp + 0x2ec], 0x44cae0
mov dword [esp + 0x2e8], 0x7c
mov dword [esp + 0x2e4], 0x44cae0
mov dword [esp + 0x2e0], 0x7d
mov dword [esp + 0x2dc], 0x44d2b0
mov dword [esp + 0x2d4], 0x44d2b8
mov dword [esp + 0x2cc], 0x44cae0
mov dword [esp + 0x2c8], 0x80
mov dword [esp + 0x2c4], 0x44cae0
mov dword [esp + 0x2c0], 0x81
mov dword [esp + 0x2bc], 0x44d2c0
mov dword [esp + 0x2b4], 0x44d2c8
mov dword [esp + 0x2ac], 0x44d2d0
mov dword [esp + 0x2a4], 0x44d2d8
mov dword [esp + 0x29c], 0x44d2e0
mov dword [esp + 0x294], 0x44d2e8
mov dword [esp + 0x28c], 0x44d2f0
mov dword [esp + 0x284], 0x44cae0
mov dword [esp + 0x280], 0x89
mov dword [esp + 0x27c], 0x44d2f8
mov dword [esp + 0x274], 0x44d300
mov dword [esp + 0x26c], 0x44d308
mov dword [esp + 0x264], 0x44cae0
mov dword [esp + 0x260], 0x8e
mov dword [esp + 0x25c], 0x44cae0
mov dword [esp + 0x258], 0x8e
mov dword [esp + 0x254], 0x44d310
mov dword [esp + 0x24c], 0x44d318
mov dword [esp + 0x244], 0x44cae0
mov dword [esp + 0x240], 0x91
mov dword [esp + 0x23c], 0x44d320
mov dword [esp + 0x234], 0x44cae0
mov dword [esp + 0x230], 0x93
mov dword [esp + 0x22c], 0x44cae0
mov dword [esp + 0x228], 0x94
mov dword [esp + 0x224], 0x44cae0
mov dword [esp + 0x220], 0x95
mov dword [esp + 0x21c], 0x44d328
mov dword [esp + 0x214], 0x44d330
mov dword [esp + 0x20c], 0x44d338
mov dword [esp + 0x204], 0x44cae0
mov dword [esp + 0x200], 0x99
mov dword [esp + 0x1fc], 0x44cae0
mov dword [esp + 0x1f8], 0x9a
mov dword [esp + 0x1f4], 0x44cae0
mov dword [esp + 0x1f0], 0x9b
mov dword [esp + 0x1ec], 0x44d340
mov dword [esp + 0x1e4], 0x44cae0
mov dword [esp + 0x1e0], 0x9d
mov dword [esp + 0x1dc], 0x44cae0
mov dword [esp + 0x1d8], 0x9e
mov dword [esp + 0x1d4], 0x44cae0
mov dword [esp + 0x1d0], 0x9f
mov dword [esp + 0x1cc], 0x44d348
mov dword [esp + 0x1c4], 0x44d350
mov dword [esp + 0x1bc], 0x44cae0
mov dword [esp + 0x1b8], 0xa2
mov dword [esp + 0x1b4], 0x44cae0
mov dword [esp + 0x1b0], 0xa3
mov dword [esp + 0x1ac], 0x44cae0
mov dword [esp + 0x1a8], 0xa4
mov dword [esp + 0x1a4], 0x44cae0
mov dword [esp + 0x1a0], 0x79
mov dword [esp + 0x19c], 0x44cae0
mov dword [esp + 0x198], 0x7e
mov dword [esp + 0x194], 0x44cae0
mov dword [esp + 0x190], 0x84
mov dword [esp + 0x18c], 0x44cae0
mov dword [esp + 0x188], 0x87
mov dword [esp + 0x184], 0x44cae0
mov dword [esp + 0x180], 0x8b
mov dword [esp + 0x17c], 0x44cae0
mov dword [esp + 0x178], 0x97
mov dword [esp + 0x174], 0x44cae0
mov dword [esp + 0x170], 0xa0
xor esi, esi
jmp eax