joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov dword [esp + 8], 0x63f661ce
mov dword [esp + 0xc], 0x67ca65c0
mov dword [esp + 0x10], 0x6b8469c4
mov dword [esp + 0x14], 0x6fc26dc8
mov dword [esp + 0x18], 0x535251fc
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x23], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x1e
ja 0x437c00
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
and edx, 0xef0f3b90
xor eax, 0x6f0f3b90
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0x10
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1f
jb 0x437bc0
lea eax, [esp + 8]
push eax
call fcn.0043a030
add esp, 4
mov dword [0x4516a0], eax
xor ecx, ecx
test eax, eax
sete cl
mov ecx, dword [ecx*4 + 0x446bdc]
mov edx, 0x59e07270
xor edx, dword [0x446be4]
add ecx, edx
inc ecx
jmp ecx

Function at 0x4396b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [ebp + 8]
movzx eax, word [ebx]
mov dword [esp + 0x28], 0x4b4a2b19
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x33], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xe
ja 0x439741
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x28]
add ecx, 0x4d58a8ca
mov esi, ecx
and esi, edx
mov edi, ecx
xor edi, edx
or ecx, edx
xor ecx, edi
lea edx, [edi + esi*2]
add ecx, esi
sub edx, ecx
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x18]
add cl, 0x7a
mov edx, dword [esp]
mov byte [esp + edx + 0x28], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xf
jb 0x439700
xor ecx, ecx
cmp dword [esp + 0x28], eax
setne cl
mov eax, dword [ecx*4 + 0x4476f4]
mov ecx, 0x244fb71e
xor ecx, dword [0x4476fc]
add eax, ecx
inc eax
xor edx, edx
jmp eax
add al, 0x39
invalid

Function at 0x43a030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0xc3c4c536
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43a08e
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x8c6a1221
xor eax, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
add al, 0x19
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x43a060
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
jmp dword [0x448010]
Function at 0x43a41b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ecx, dword [ebp + 8]
mov dword [esp + 8], 0xf3f2cd9c
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x43a453
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea esi, [eax + edx]
add esi, 0x3057e65e
add eax, 0x5e
and eax, edx
add eax, eax
mov edx, eax
xor edx, esi
not eax
and eax, esi
add eax, eax
sub eax, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x6e
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x43a410
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x4480a0]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov edi, dword [0x4480d0]
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x4480a8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
mov edi, dword [0x4480d0]
jmp dword [ebx*4 + 0x4480a8]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x4480c0]
mov ebx, 1
jmp case.0x43a461.10
mov eax, dword [esi + 0x30]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edi
jmp dword [0x4480bc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b126
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x43b0d0
cmp edi, 0xfffffff5
jge 0x43b0e7
mov eax, 0xffffffff
jmp 0x43b0ea
lea eax, [edi + 0xa]
push eax
call fcn.00408f80
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [ebx]
test cx, cx
je 0x43b131
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x43b120
mov word [eax], 0
and edi, 0xfffffffe
lea eax, [edi + 8]
mov word [esp + 0x18], ax
add edi, 0xa
mov word [esp + 0x1a], di
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 8], 0x52515057
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x43b1fa
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0xb84cdaf3
add eax, 0xf3
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
add al, 0x5b
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x43b1b0
mov edi, dword [esp + 8]
mov eax, dword [0x449688]
test eax, eax
je 0x43b25d
xor ecx, ecx
mov edx, dword [0x44968c]
nop
cmp dword [edx + ecx*8], 0x7a96736e
je 0x43b220
inc ecx
cmp eax, ecx
jne 0x43b210
jmp 0x43b25d
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43b25d
lea ecx, [esp + 8]
lea edx, [esp + 0x24]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x449690]
push eax
call fcn.004388a0
add esp, 0x38
mov edi, eax
push esi
call fcn.00408f90
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x43b290
cmp edi, 0xfffffff5
jge 0x43b2a7
mov eax, 0xffffffff
jmp 0x43b2aa
lea eax, [edi + 0xa]
push eax
call fcn.00408f80
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [ebx]
test cx, cx
je 0x43b2f1
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x43b2e0
mov word [eax], 0
and edi, 0xfffffffe
lea eax, [edi + 8]
mov word [esp + 0x18], ax
add edi, 0xa
mov word [esp + 0x1a], di
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 8], 0x52515057
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x43b3ba
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0xb84cdaf3
add eax, 0xf3
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
add al, 0x5b
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x43b370
mov edi, dword [esp + 8]
mov eax, dword [0x449688]
test eax, eax
je 0x43b411
xor ecx, ecx
mov edx, dword [0x44968c]
nop
cmp dword [edx + ecx*8], 0x366ceda
je 0x43b3e0
inc ecx
cmp eax, ecx
jne 0x43b3d0
jmp 0x43b411
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43b411
lea ecx, [esp + 8]
lea edx, [esp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x449690]
push eax
call fcn.004388a0
add esp, 0x24
mov edi, eax
push esi
call fcn.00408f90
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43b450
mov edi, eax
sar edi, 1
cmp eax, 0xfffffff5
jge 0x43b46b
mov eax, 0xffffffff
jmp 0x43b46e
add eax, 0xa
push eax
call fcn.00408f80
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea eax, [edi + 4]
mov word [esi + 8], 0
mov ecx, esi
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43b4b1
add ebx, 2
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43b4a0
mov word [ecx], 0
mov ecx, eax
and ecx, 0xfffd
and edi, 2
mov edx, edi
xor edx, 2
imul edx, ecx
or eax, 2
imul eax, edi
lea ecx, [eax + edx]
mov word [esp + 4], cx
add eax, edx
add eax, 2
mov word [esp + 6], ax
mov dword [esp + 8], esi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x52515057
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov byte [esp + 0x34], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x43b595
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x28]
lea edx, [eax + ecx]
add edx, 0xb84cdaf3
add eax, 0xf3
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x5b
mov ecx, dword [esp]
mov byte [esp + ecx + 0x28], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0x43b550
mov edi, dword [esp + 0x28]
mov eax, dword [0x449688]
test eax, eax
je 0x43b5e5
xor ecx, ecx
mov edx, dword [0x44968c]
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xb5b385c7
je 0x43b5c0
inc ecx
cmp eax, ecx
jne 0x43b5b0
jmp 0x43b5e5
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43b5e5
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push ecx
push edx
push 2
push dword [0x449690]
push eax
call fcn.004388a0
add esp, 0x14
mov edi, eax
push esi
call fcn.00408f90
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43b5fb
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0x52515057
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x43b69a
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0xb84cdaf3
add eax, 0xf3
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
add al, 0x5b
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x43b650
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 8]
mov edx, dword [0x449688]
test edx, edx
je 0x43b6f8
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x44968c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3bebd150
je 0x43b6d0
inc edi
cmp edx, edi
jne 0x43b6c0
jmp 0x43b6f8
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x43b6f8
lea eax, [esp + 8]
lea edi, [esp + 0x24]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x449690]
push edx
call fcn.004388a0
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x43b705
mov edx, dword [esp + 0x10]
mov dword [esi], edx
test ecx, ecx
je 0x43b711
cmp byte [esp + 0x1d], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0x52515057
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x43b7a5
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0xb84cdaf3
add eax, 0xf3
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0x5b
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0x43b760
mov eax, dword [esp + 8]
mov edi, dword [0x449688]
test edi, edi
je 0x43b80d
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x44968c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebx*8], 0xb0852ef6
je 0x43b7e0
inc ebx
cmp edi, ebx
jne 0x43b7d0
jmp 0x43b80d
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x43b80d
lea eax, [esp + 0x1c]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x449690]
push edi
call fcn.004388a0
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x43b8e8
mov dword [esp + 8], 0x52515057
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x43b898
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0xb84cdaf3
add eax, 0xf3
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x5b
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x43b850
mov eax, dword [esp + 8]
mov ecx, dword [0x449688]
test ecx, ecx
je 0x43b8e0
xor edx, edx
mov esi, dword [0x44968c]
nop
nop
cmp dword [esi + edx*8], 0xb33e16a3
je 0x43b8c0
inc edx
cmp ecx, edx
jne 0x43b8b0
jmp 0x43b8e0
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43b8e0
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x449690]
push ecx
call fcn.004388a0
add esp, 0x18
test eax, eax
js 0x43b8e8
mov eax, dword [esp + 0x1c]
test edi, edi
je 0x43b8fb
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43b8f9
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b94e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0x52515057
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x43b995
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0xb84cdaf3
add eax, 0xf3
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0x5b
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0x43b950
mov eax, dword [esp + 8]
mov edi, dword [0x449688]
test edi, edi
je 0x43b9fd
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x44968c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebx*8], 0x58c2bab5
je 0x43b9d0
inc ebx
cmp edi, ebx
jne 0x43b9c0
jmp 0x43b9fd
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x43b9fd
lea eax, [esp + 0x1c]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x449690]
push edi
call fcn.004388a0
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x43bad8
mov dword [esp + 8], 0x52515057
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x43ba88
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0xb84cdaf3
add eax, 0xf3
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x5b
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x43ba40
mov eax, dword [esp + 8]
mov ecx, dword [0x449688]
test ecx, ecx
je 0x43bad0
xor edx, edx
mov esi, dword [0x44968c]
nop
nop
cmp dword [esi + edx*8], 0xb33e16a3
je 0x43bab0
inc edx
cmp ecx, edx
jne 0x43baa0
jmp 0x43bad0
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43bad0
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x449690]
push ecx
call fcn.004388a0
add esp, 0x18
test eax, eax
js 0x43bad8
mov eax, dword [esp + 0x1c]
test edi, edi
je 0x43bae2
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43baf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x43bb10
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 4], bx
add ebx, 2
mov word [esp + 6], bx
mov dword [esp + 8], edi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0x52515057
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x43bbd5
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
lea edi, [eax + ecx]
add edi, 0xb84cdaf3
add eax, 0xf3
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edi
not eax
and eax, edi
add eax, eax
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x5b
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0x43bb90
mov eax, dword [esp + 0x10]
mov edi, dword [0x449688]
test edi, edi
je 0x43bc23
xor ebx, ebx
mov ecx, dword [0x44968c]
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x850a6e6
je 0x43bc00
inc ebx
cmp edi, ebx
jne 0x43bbf0
jmp 0x43bc23
mov ecx, dword [ecx + ebx*8 + 4]
cmp ecx, eax
je 0x43bc23
lea eax, [esp + 0x24]
push esi
push eax
push edx
push dword [ebp + 0xc]
push 4
push dword [0x449690]
push ecx
call fcn.004388a0
add esp, 0x1c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402080
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43d371
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x455d50]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x24c
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x28], 0
call fcn.0042ac10
lea ecx, [esp + 0x20]
push esi
push ecx
mov ebx, str..
call fcn.0040cfe0
add esp, 0x14
mov dword [esp + 0x280], 0
mov eax, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [esp + 0x280], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0040c520
cmp edi, 0xffffffff
je 0x40224e
mov ecx, 0x448b50
lea eax, [esp + 0x48]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402156
test dx, dx
je 0x402152
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402156
add eax, 4
add ecx, 4
test dx, dx
jne 0x402130
xor eax, eax
jmp 0x40215b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402233
mov ecx, 0x448b54
lea eax, [esp + 0x48]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402196
test dx, dx
je 0x402192
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402196
add eax, 4
add ecx, 4
test dx, dx
jne 0x402170
xor eax, eax
jmp 0x40219b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402233
lea eax, [esp + 0x18]
push esi
push eax
mov ebx, 0x448b5c
call fcn.0040cfe0
mov dword [esp + 0x288], 1
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ebx, [esp + 0x58]
call fcn.0040cfe0
add esp, 0x10
mov byte [esp + 0x280], 3
lea ecx, [esp + 0x18]
call fcn.0040c520
test byte [esp + 0x1c], 0x10
je 0x402204
mov edx, dword [ebp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00402080
mov ecx, dword [esp + 0x18]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edx, dword [esp + 0x10]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x280], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0040c520
lea ecx, [esp + 0x1c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402127
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp + 0xc], 0
je 0x40225d
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.00421490
mov esp, ebp
pop ebp
ret
Function at 0x4026a0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push 0
push edi
call esi
test eax, eax
je 0x4026c4
cmp dword [edi], 0
jne 0x4026da
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
push 0
push edi
call esi
cmp dword [edi], 0
je 0x402707
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x20]
lea esi, [esp + 0xc]
call fcn.00418bb0
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
lea ecx, [edi + 4]
push ecx
mov ecx, dword [edi]
push 0
push 0
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov eax, dword [edi + 4]
test eax, eax
je 0x40273c
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push 0
lea edx, [esp + 0x1c]
push edx
mov ecx, 1
push 3
push eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
call esi
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push 4
push ecx
call esi
pop esi
add esp, 0x10
ret 8