joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408e50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
xor eax, eax
mov edx, SysReAllocString
nop
nop
nop
nop
nop
mov esi, eax
and esi, 0x70
mov edi, eax
xor edi, 0x270
lea edi, [edi + esi*2]
mov ebx, dword [ecx + edi*4 + 4]
and ebx, edx
mov esi, eax
and esi, 1
mov ebp, edi
or ebp, 1
add ebp, esi
mov esi, dword [ecx + ebp*4 + 4]
mov ebp, esi
and ebp, 0x7ffffffe
or ebp, ebx
shr ebp, 1
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, ebp
mov ebx, edi
and ebx, 0x18d
xor edi, 0x18d
lea edi, [edi + ebx*2]
mov edi, dword [ecx + edi*4 + 4]
mov ebx, esi
and ebx, edi
add esi, edi
add ebx, ebx
sub esi, ebx
mov dword [ecx + eax*4 + 4], esi
inc eax
cmp eax, 0xe3
jne 0x408e60
mov eax, 0xe4
mov edx, 0x1c6
mov esi, SysReAllocString
nop
nop
nop
nop
nop
nop
nop
lea edi, [eax - 1]
mov ebx, edx
and ebx, 0x4e0
xor edi, 0x270
add edi, ebx
mov ebp, dword [ecx + edi*4 + 4]
and ebp, esi
mov ebx, edx
and ebx, 2
xor edi, 1
add edi, ebx
mov edi, dword [ecx + edi*4 + 4]
mov ebx, edi
and ebx, 0x7ffffffe
or ebx, ebp
shr ebx, 1
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 - 0x38c]
xor edi, ebx
mov dword [ecx + eax*4], edi
inc eax
add edx, 2
cmp eax, 0x270
jne 0x408ee0
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4090e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx eax, word [esi]
lea ebp, [esp + 4]
test ax, ax
je 0x409231
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x409130
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x4091d0
cmp ebx, 0x7ff
ja 0x409160
cmp edx, 2
jb 0x409160
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x4091d0
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x4091f6
cmp edx, 4
jb 0x4091f6
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
mov eax, ecx
or eax, 0xffff23ff
mov edi, ecx
and edi, 0x23ff
add edi, ebx
add eax, edi
add eax, 0xfca10001
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
nop
nop
nop
nop
mov ecx, eax
xor ecx, ebp
not ebp
and ebp, eax
add ecx, edx
add ebp, ebp
sub ecx, ebp
mov esi, edi
mov ebp, eax
mov edx, ecx
movzx eax, word [esi]
test ax, ax
je 0x409231
test edx, edx
jne 0x409110
jmp 0x409231
movzx eax, ax
cmp eax, 0xdc00
jne 0x409204
mov esi, edi
jmp 0x4091e4
cmp edx, 3
jb 0x40922d
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 2], bl
lea eax, [ebp + 3]
jmp 0x4091d0
mov eax, ebp
jmp 0x4091d0
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ebp], 0
xor eax, eax
jmp 0x409258
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x409250
test ecx, ecx
je 0x40926c
mov ebx, ecx
jmp 0x409250
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00404bb0
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4092b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx eax, word [esi]
test ax, ax
je 0x409401
mov edx, dword [esp + 0x18]
dec edx
je 0x409401
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x409300
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x4093a0
cmp ebx, 0x7ff
ja 0x409330
cmp edx, 2
jb 0x409330
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x4093a0
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x4093c6
cmp edx, 4
jb 0x4093c6
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
mov eax, ecx
or eax, 0xffff23ff
mov edi, ecx
and edi, 0x23ff
add edi, ebx
add eax, edi
add eax, 0xfca10001
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
nop
nop
nop
nop
mov ecx, eax
xor ecx, ebp
not ebp
and ebp, eax
add ecx, edx
add ebp, ebp
sub ecx, ebp
mov esi, edi
mov ebp, eax
mov edx, ecx
movzx eax, word [esi]
test ax, ax
je 0x409401
test edx, edx
jne 0x4092e0
jmp 0x409401
movzx eax, ax
cmp eax, 0xdc00
jne 0x4093d4
mov esi, edi
jmp 0x4093b4
cmp edx, 3
jb 0x4093fd
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 2], bl
lea eax, [ebp + 3]
jmp 0x4093a0
mov eax, ebp
jmp 0x4093a0
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x444888]
mov dword [esp + 0x18], 0xe755e553
mov dword [esp + 0x1c], 0xebb5e99a
mov dword [esp + 0x20], 0xef9ced9f
mov dword [esp + 0x24], 0xf356f19e
mov dword [esp + 0x28], 0xf75af558
mov word [esp + 0x2c], 0xf9f8
mov ecx, 0x231f9cc4
mov edx, 0x3b
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x231f9cac]
mov edi, edx
xor edi, ecx
and edi, esi
xor edi, ecx
mov esi, edi
and esi, 0x5f
xor edi, 0xdf
lea ebx, [edi + esi*2]
inc bl
mov byte [esp + ecx - 0x231f9cac], bl
inc ecx
dec edx
cmp ecx, 0x231f9cda
jne 0x409f50
lea esi, [esp + 0x18]
push 0x800
push 0
push esi
call eax
mov ecx, 0x44488c
push eax
call fcn.00437810
movzx eax, al
mov eax, dword [eax*4 + 0x43e6f4]
mov ecx, 0x43b3bd01
xor ecx, dword [0x43e6fc]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x40ab20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
movzx ebx, byte [edx]
test bl, bl
je 0x40ad84
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov ecx, eax
not ecx
lea edi, [ecx + eax*2]
mov eax, dword [esp + 0x1c]
nop
nop
nop
test esi, esi
je 0x40ab5c
cmp edx, esi
jae 0x40ad84
test edi, edi
je 0x40ad84
movzx ebp, bl
test bl, bl
js 0x40ab90
mov word [eax], bp
lea ecx, [eax + 2]
inc edx
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x28]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40ab50
jmp 0x40ad84
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40abc8
cmp bl, 0xc2
jb 0x40ab80
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40ac2a
and ebp, 0x1f
shl ebp, 6
and esi, 0x3f
or esi, ebp
add edx, 2
jmp 0x40ac7c
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40abf2
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40ac34
cmp ebp, 0xe0
jne 0x40ac3d
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40ab7c
jmp 0x40ac3d
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40ad63
cmp bl, 0xf4
ja 0x40ab80
movzx ecx, byte [edx + 1]
je 0x40ac87
cmp ebp, 0xf0
jne 0x40ac90
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40ab7c
jmp 0x40ac90
inc edx
mov esi, dword [esp + 0x28]
jmp 0x40ab82
cmp cl, 0x9f
ja 0x40ab7c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ad6a
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ad70
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40ab72
cmp cl, 0x8f
ja 0x40ab7c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ad6a
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ad70
mov dword [esp], ebp
movzx ebp, byte [edx + 3]
mov esi, ebp
xor esi, 0xffffff3f
mov dword [esp + 4], ebp
or ebp, 0xc0
and ebp, esi
cmp ebp, 0x80
jne 0x40ad7c
and bl, 7
movzx esi, bl
shl esi, 0x12
shl ecx, 0xc
add ecx, esi
mov esi, dword [esp]
and esi, 0x3f
shl esi, 6
add ecx, esi
add ecx, 0xfff80000
add edx, 4
mov esi, ecx
and esi, 0xfffff800
cmp esi, 0xd800
je 0x40ab7c
mov ebx, dword [esp + 4]
and ebx, 0x3f
or ebx, ecx
cmp ebx, 0x10000
mov esi, dword [esp + 0x28]
jb 0x40ab80
cmp edi, 2
jb 0x40ad63
add ecx, 0xf0000
shr ecx, 0xa
and ecx, 0x3ff
or ecx, 0xd800
mov word [eax], cx
and ebx, 0x3ff
or ebx, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bx
jmp 0x40ab72
mov ecx, eax
jmp 0x40ab72
inc edx
jmp 0x40ab7c
add edx, 2
mov esi, dword [esp + 0x28]
jmp 0x40ab82
add edx, 3
jmp 0x40ab7c
mov word [eax], 0
sub eax, dword [esp + 0x1c]
sar eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40bb20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov edi, dword [esp + 0x44c]
mov dword [esp + 0x38], 0x80308ed0
mov dword [esp + 0x3c], 0x843a820b
mov dword [esp + 0x40], 0x983b8639
mov dword [esp + 0x44], 0x9ce49a38
mov dword [esp + 0x48], 0x90e19ee8
mov dword [esp + 0x4c], 0x94f392e1
mov dword [esp + 0x50], 0xe8c096ed
mov dword [esp + 0x54], 0xec55ea50
mov dword [esp + 0x58], 0xe050ee49
mov dword [esp + 0x5c], 0xe450e256
mov dword [esp + 0x60], 0xf8b9e685
mov dword [esp + 0x64], 0xfc9bfaad
mov dword [esp + 0x68], 0xf08ffe8c
mov dword [esp + 0x6c], 0xf483f28f
mov dword [esp + 0x70], 0xc897f6be
mov dword [esp + 0x74], 0xcc72ca9e
mov dword [esp + 0x78], 0xc0b9ce73
mov dword [esp + 0x7c], 0xc488c2b5
mov dword [esp + 0x80], 0xd84fc6a5
mov dword [esp + 0x84], 0xdcafdaaf
mov dword [esp + 0x88], 0xd0bfdea4
mov dword [esp + 0x8c], 0xd463d290
mov dword [esp + 0x90], 0x286bd665
mov dword [esp + 0x94], 0x2c7c2a8c
mov dword [esp + 0x98], 0x208d2e88
mov dword [esp + 0x9c], 0x249a227a
mov dword [esp + 0xa0], 0x38582691
mov dword [esp + 0xa4], 0x3c483a4c
mov dword [esp + 0xa8], 0x30413e4a
mov dword [esp + 0xac], 0x34453242
mov dword [esp + 0xb0], 0x84f3655
mov dword [esp + 0xb4], 0xc530a52
mov dword [esp + 0xb8], 0x520e59
mov dword [esp + 0xbc], 0x47f025d
mov dword [esp + 0xc0], 0x18bb0665
mov dword [esp + 0xc4], 0x1ca01aa0
mov dword [esp + 0xc8], 0x107f1eb8
mov dword [esp + 0xcc], 0x14b61256
mov dword [esp + 0xd0], 0x68ac16b6
mov dword [esp + 0xd4], 0x6c126ad6
mov dword [esp + 0xd8], 0x602c6e0d
mov dword [esp + 0xdc], 0x64d162d9
mov dword [esp + 0xe0], 0x78da66da
mov dword [esp + 0xe4], 0x7c047adc
mov dword [esp + 0xe8], 0x700e7e0c
mov dword [esp + 0xec], 0x740d7238
mov dword [esp + 0xf0], 0x48097605
mov dword [esp + 0xf4], 0x4c354a39
mov dword [esp + 0xf8], 0x402f4e3d
mov dword [esp + 0xfc], 0x44e24212
mov dword [esp + 0x100], 0x58e646e3
mov dword [esp + 0x104], 0x5ce25aeb
mov dword [esp + 0x108], 0x502a5e22
mov dword [esp + 0x10c], 0x54245222
mov dword [esp + 0x110], 0xa824562b
mov dword [esp + 0x114], 0xacabaadf
mov eax, dword [0x444858]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x38]
mov ebx, ecx
and ebx, 0x5b
xor ebx, 0x16a7975b
mov edx, ecx
and edx, 0xa4
sub edx, ebx
mov ebx, edx
and ebx, esi
add edx, esi
add ebx, ebx
sub edx, ebx
add dl, 0xd8
mov byte [esp + ecx + 0x38], dl
inc ecx
cmp ecx, 0xe0
jne 0x40bd70
lea esi, [esp + 0x38]
push 0
push 0
push 0
push 0
push esi
call eax
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
mov eax, dword [eax*4 + 0x43ea9c]
mov ecx, 0x847eda4c
xor ecx, dword [0x43eaa4]
add eax, ecx
inc eax
jmp eax
Function at 0x40c400
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov edi, dword [esp + 0x250]
mov dword [esp + 0x3c], 0x254b236f
mov dword [esp + 0x40], 0x294127bc
mov dword [esp + 0x44], 0x2d402b46
mov dword [esp + 0x48], 0x517f2f4f
mov dword [esp + 0x4c], 0x557a5307
mov dword [esp + 0x50], 0x59785706
mov dword [esp + 0x54], 0x5d2b5b72
mov dword [esp + 0x58], 0x412e5f37
mov dword [esp + 0x5c], 0x452b4326
mov dword [esp + 0x60], 0x49db47d1
mov dword [esp + 0x64], 0x4d024b6a
mov dword [esp + 0x68], 0x71504f3a
mov dword [esp + 0x6c], 0x75247323
mov dword [esp + 0x70], 0x79287758
mov dword [esp + 0x74], 0x7d5c7b21
mov dword [esp + 0x78], 0x61097f09
mov dword [esp + 0x7c], 0x6532630c
mov dword [esp + 0x80], 0x69336732
mov dword [esp + 0x84], 0x6df46b4a
mov dword [esp + 0x88], 0x91c46f38
mov dword [esp + 0x8c], 0x95b493bb
mov dword [esp + 0x90], 0x990897d7
mov dword [esp + 0x94], 0x9df09b0a
mov dword [esp + 0x98], 0x81f79ffb
mov dword [esp + 0x9c], 0x85e683e7
mov dword [esp + 0xa0], 0x89e187cd
mov dword [esp + 0xa4], 0x8da38b1e
mov dword [esp + 0xa8], 0xb1e38fdb
mov dword [esp + 0xac], 0xb59ab3e5
mov dword [esp + 0xb0], 0xb9eeb7e5
mov dword [esp + 0xb4], 0xbd94bb9a
mov dword [esp + 0xb8], 0xa1e8bff5
mov dword [esp + 0xbc], 0xa5e9a3d6
mov dword [esp + 0xc0], 0xa984a7ea
mov dword [esp + 0xc4], 0xadc0ab8a
mov dword [esp + 0xc8], 0xd1bbafc7
mov dword [esp + 0xcc], 0xd5f4d3b7
mov dword [esp + 0xd0], 0xd9bdd791
mov dword [esp + 0xd4], 0xddb7dbb9
mov dword [esp + 0xd8], 0xc1e9dfb1
mov dword [esp + 0xdc], 0xc587c3e2
mov dword [esp + 0xe0], 0xc95ac7ae
mov dword [esp + 0xe4], 0xcda1cba5
mov dword [esp + 0xe8], 0xf1dfcfab
mov dword [esp + 0xec], 0xf5a5f3a3
mov dword [esp + 0xf0], 0xf9d6f7af
mov dword [esp + 0xf4], 0xfdd2fbaa
mov dword [esp + 0xf8], 0xe1ceffae
mov dword [esp + 0xfc], 0xe5c4e3b2
mov dword [esp + 0x100], 0xe989e795
mov dword [esp + 0x104], 0xed8deb8c
mov dword [esp + 0x108], 0x1179ef7c
mov dword [esp + 0x10c], 0x1541133d
mov dword [esp + 0x110], 0x194f1745
mov dword [esp + 0x114], 0x1d4f1b34
mov dword [esp + 0x118], 0x1001f48
mov eax, dword [0x444858]
mov ecx, 0xb1
mov edx, 0x4b05db4d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x75]
lea ebp, [ecx - 0x2582edff]
mov ebx, edx
xor ebx, ebp
and ebx, esi
xor ebx, ebp
add bl, 0x70
mov byte [esp + ecx - 0x75], bl
inc ecx
dec edx
cmp ecx, 0x191
jne 0x40c660
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov ebp, eax
xor eax, eax
test ebp, ebp
setne al
mov eax, dword [eax*4 + 0x43ec9c]
mov ecx, 0xab88c61f
xor ecx, dword [0x43eca4]
add eax, ecx
inc eax
jmp eax
Function at 0x413f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x420
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x413f90
mov eax, edi
sar eax, 1
mov dword [esp + 0xe8], eax
cmp eax, 0xfffffff2
jge 0x413fb2
mov eax, 0xffffffff
jmp 0x413fb5
lea eax, [edi + 0x1c]
push eax
call fcn.004082f0
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x29c], 0x4e314c27
mov dword [esp + 0x2a0], 0x42d2402e
mov dword [esp + 0x2a4], 0x466544d7
mov dword [esp + 0x2a8], 0x7a1c7831
mov dword [esp + 0x2ac], 0x7eee7ce9
mov dword [esp + 0x2b0], 0x72ee70e6
mov dword [esp + 0x2b4], 0x767574ed
lea eax, [esp + 0x29c]
mov ecx, 0x2c
nop
nop
nop
nop
nop
movzx esi, byte [eax]
lea edx, [ecx - 0x4094d400]
or edx, esi
and esi, ecx
not edx
or edx, esi
add edx, 0xfb596167
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x10
jne 0x414020
movzx ecx, word [ebx]
mov esi, dword [esp + 8]
mov eax, esi
test cx, cx
je 0x414071
add ebx, 2
mov eax, esi
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x414060
mov word [eax], 0
movzx ecx, word [esp + 0x29c]
test cx, cx
je 0x4140a1
lea edx, [esp + 0x29e]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414090
mov word [eax], 0
lea eax, [esp + 0x118]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00439c50
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43f7f4]
Function at 0x417930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x417a3e
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x417968
mov ebp, ebx
mov esi, ebp
lea eax, [edi + 4]
add edi, 2
cmp edi, ecx
mov edi, eax
mov ebp, dword [esp + 0x18]
jae 0x417a40
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.0041ad80
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.0041ad80
add esp, 4
shl bh, 2
mov ah, al
shr ah, 4
and ah, 3
or ah, bh
mov ecx, esi
and ecx, 1
mov edx, esi
xor edx, 1
lea ebx, [edx + ecx*2]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov byte [edx + esi], ah
cmp edi, ecx
jae 0x417950
mov byte [esp + 3], al
movzx eax, byte [ebp + edi]
push eax
call fcn.0041ad80
add esp, 4
cmp al, 0x40
jne 0x4179d0
mov ebp, ebx
mov ecx, dword [esp + 0x1c]
jmp 0x417952
movzx ecx, al
mov ah, byte [esp + 3]
shl ah, 4
mov edx, ecx
not edx
or edx, 0x3c
add ecx, edx
inc ecx
shr ecx, 2
add cl, ah
lea ebp, [ebx + 1]
mov edx, dword [esp + 0x20]
mov byte [edx + ebx], cl
lea ecx, [edi + 1]
mov edx, dword [esp + 0x1c]
cmp ecx, edx
jae 0x417a37
mov esi, ebx
mov ebx, eax
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.0041ad80
mov ecx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x417952
shl bl, 6
add al, bl
mov edx, dword [esp + 0x20]
mov byte [edx + esi + 1], al
add esi, 2
mov ebp, esi
jmp 0x417952
mov ecx, edx
jmp 0x417952
xor esi, esi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x418880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a8
mov dword [esp + 0x10], 0xbe27bce4
mov dword [esp + 0x14], 0xb22eb02c
mov dword [esp + 0x18], 0xb6b5b42d
mov eax, 0x69856da3
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x69856d93]
mov ecx, eax
and ecx, edi
add ecx, ecx
mov edx, edi
sub edx, ecx
add edx, eax
mov ebx, edx
mov esi, edx
xor esi, 0x4c2b6d18
or ebx, 0x33d492e7
and ebx, esi
lea esi, [edi + ebx*2]
lea edi, [edx + edx]
and edi, 0xce
sub esi, edi
sub esi, ecx
lea edx, [edx*2 - 2]
lea ecx, [eax + esi]
add ecx, 0xb3d492e7
and edx, 2
xor ecx, 1
add ecx, edx
mov byte [esp + eax - 0x69856d93], cl
inc eax
cmp eax, 0x69856daf
jne 0x4188b0
mov dword [esp + 0x40], 0x44b742b9
mov dword [esp + 0x44], 0x58b746b1
mov dword [esp + 0x48], 0x5c645a93
mov dword [esp + 0x4c], 0x50a35e62
mov dword [esp + 0x50], 0x54b052ae
mov dword [esp + 0x54], 0x68ab56b4
mov dword [esp + 0x58], 0x6c946a91
mov dword [esp + 0x5c], 0x609b6e9e
mov dword [esp + 0x60], 0x646362ab
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 9
xor cl, byte [esp + eax + 0x40]
add cl, 0xb8
mov byte [esp + eax + 0x40], cl
inc eax
cmp eax, 0x24
jne 0x418960
movzx ecx, word [esp + 0x40]
lea eax, [esp + 0x164]
test cx, cx
je 0x4189a1
lea edx, [esp + 0x42]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418990
mov word [eax], 0
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x4189d1
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4189c0
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x418a01
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4189f0
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
mov dword [esp + 0x40], 0x2b282886
mov byte [esp + 0x44], 0x90
mov edx, 0xec
nop
nop
nop
movzx eax, byte [esp + edx - 0xac]
mov ebx, eax
mov esi, eax
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xfd
mul cl
mov ecx, eax
mov eax, esi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0xa0
mov byte [esp + edx - 0xac], al
inc edx
cmp edx, 0xf1
jne 0x418a20
movzx eax, byte [esp + 0x40]
test al, al
je 0x418a8b
lea ecx, [esp + 0x41]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x418a80
mov byte [edi], 0
lea eax, [esp + 0x154]
lea ecx, [esp + 0x158]
lea edx, [esp + 0x24]
lea esi, [esp + 0x164]
push eax
push ecx
push edx
push esi
call fcn.0040b2a0
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x43fb24]
mov ecx, 0xdd65f11e
xor ecx, dword [0x43fb2c]
add eax, ecx
inc eax
jmp eax
Function at 0x41e560
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41e570
cmp eax, 0xffffffed
jge 0x41e587
mov eax, 0xffffffff
jmp 0x41e58a
add eax, 0x12
push eax
call fcn.004082f0
add esp, 4
mov esi, eax
mov dword [esp], 0xe418e20d
mov dword [esp + 4], 0xf86ee600
mov dword [esp + 8], 0xfcc5facd
mov dword [esp + 0xc], 0xf01dfe19
mov word [esp + 0x10], 0xf2f1
xor eax, eax
nop
nop
nop
mov edx, eax
and edx, 0x17
xor edx, 0x57
mov ecx, eax
and ecx, 8
sub ecx, edx
xor cl, byte [esp + eax]
add cl, 0xb8
mov byte [esp + eax], cl
mov ecx, eax
mov edx, eax
xor edx, 1
add edx, eax
and eax, 1
and ecx, 0x1e
mov ebx, edx
sub ebx, ecx
and edx, eax
xor ebx, eax
lea eax, [ebx + edx*2]
cmp eax, 0x12
jb 0x41e5c0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41e621
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41e610
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41e651
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e640
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00439db0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x43fef8]
Function at 0x421b32
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp edi, 0x14
setne al
jmp dword [eax*4 + 0x440580]
Function at 0x423350
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44c
mov dword [esp + 0x4c], 0xf265f06c
mov dword [esp + 0x50], 0xf654f456
mov dword [esp + 0x54], 0xeab7e86a
mov dword [esp + 0x58], 0xee65ec4e
mov dword [esp + 0x5c], 0xe2e1e04a
mov edi, 0x2d5b29c7
mov esi, 0xd2a4d638
nop
nop
nop
nop
movzx edx, byte [esp + edi - 0x2d5b297b]
mov ebx, edx
xor ebx, edi
or ebx, esi
mov eax, ebx
shr al, 1
and al, 1
mov ecx, ebx
not cl
mov ah, cl
and ah, 0x7d
mul ah
add al, al
sub dl, al
test bl, 2
sete al
or cl, 2
mul cl
add al, al
sub dl, al
movzx eax, dl
add eax, edi
add al, 0xc8
mov byte [esp + edi - 0x2d5b297b], al
inc edi
dec esi
cmp edi, 0x2d5b29db
jne 0x423390
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
lea ebp, [esp + 0x4c]
lea edi, [esp + 0x30]
mov ecx, edi
push ebp
call fcn.00436a50
mov ecx, edi
push 0x410
call fcn.00436bd0
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x440bdc]