joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x406e77
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x406e79
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
mov ebp, eax
xor ebp, 0x3ffffff0
mov ecx, edx
mov edx, eax
or edx, 0xf
and edx, ebp
mov ebp, edi
and ebp, 0xf
and eax, ebp
add ebp, edx
shr ebx, 4
add eax, eax
sub ebp, eax
xor ebx, dword [ebp*4 + 0x441c50]
mov eax, ebx
mov edx, ebx
and edx, 0xf
shr edi, 4
and ebx, edi
or edi, edx
mov edx, ecx
mov ecx, dword [esp + 0x18]
xor edi, ebx
shr eax, 4
xor eax, dword [edi*4 + 0x441c50]
inc esi
cmp edx, esi
jne 0x406e20
not eax
jmp 0x406e79
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cfe0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push esi
sub esp, 8
call fcn.0043a870
test al, al
je 0x40d070
call fcn.00433a50
test al, al
je 0x40d06b
mov dword [esp], 0x274f825b
mov byte [esp + 4], 0
mov eax, 0xf7
mov ecx, 0xd4bc0908
movzx edx, byte [esp + eax - 0xf7]
mov esi, eax
xor esi, ecx
and esi, edx
xor esi, ecx
mov edx, 0x27ac2d2b
sub edx, esi
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + eax - 0xf7], dl
inc eax
dec ecx
cmp eax, 0xfc
jne 0x40d010
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40d058
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e160
test al, al
je 0x40d06b
call fcn.00410fe0
call fcn.0040fbe0
call fcn.0043bc70
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40ecd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40ef2d
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40ed0c
cmp edx, esi
jae 0x40ef2d
test edi, edi
je 0x40ef2d
movzx ebp, bl
test bl, bl
js 0x40ed40
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40ed00
jmp 0x40ef2d
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40ed78
cmp bl, 0xc2
jb 0x40ed30
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40edda
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40ee28
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40eda2
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40ede4
cmp ebp, 0xe0
jne 0x40eded
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40ed2c
jmp 0x40eded
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40ef0c
cmp bl, 0xf4
ja 0x40ed30
movzx ecx, byte [edx + 1]
je 0x40ee3f
cmp ebp, 0xf0
jne 0x40ee48
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40ed2c
jmp 0x40ee48
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40ed32
cmp cl, 0x9f
ja 0x40ed2c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ef13
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ee33
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40ed22
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40ed32
cmp cl, 0x8f
ja 0x40ed2c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ef13
movzx ebp, byte [edx + 2]
mov esi, ebp
xor esi, 0xffffff3f
mov dword [esp], ebp
or ebp, 0xc0
and ebp, esi
cmp ebp, 0x80
jne 0x40ef19
mov bh, byte [edx + 3]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ef21
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
mov esi, dword [esp]
and esi, 0x3f
shl esi, 6
or esi, ecx
add edx, 4
mov ecx, esi
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x40ed2c
and ebp, 0x3f
or ebp, esi
cmp ebp, 0x10000
jb 0x40ed2c
cmp edi, 2
jb 0x40ef0c
add esi, 0xf0000
shr esi, 0xa
and esi, 0x3ff
or esi, 0xd800
mov word [eax], si
and ebp, 0x3ff
or ebp, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bp
jmp 0x40ed22
mov ecx, eax
jmp 0x40ed22
inc edx
jmp 0x40ed2c
add edx, 2
jmp 0x40ed2c
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40ed32
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4107f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x240
mov dword [esp + 0x40], 0x33453165
mov dword [esp + 0x44], 0x3f573d46
mov dword [esp + 0x48], 0x3b4e394c
mov dword [esp + 0x4c], 0x47714525
mov dword [esp + 0x50], 0x4374417d
mov dword [esp + 0x54], 0x4f6e4d7c
mov dword [esp + 0x58], 0x4b154960
mov dword [esp + 0x5c], 0x5720553d
mov dword [esp + 0x60], 0x5325513c
mov dword [esp + 0x64], 0x5f2d5d23
mov dword [esp + 0x68], 0x5b0c5978
mov dword [esp + 0x6c], 0x67466538
mov dword [esp + 0x70], 0x63526151
mov dword [esp + 0x74], 0x6f5e6d5a
mov dword [esp + 0x78], 0x6b4a6953
mov dword [esp + 0x7c], 0x771f752b
mov dword [esp + 0x80], 0x734c7106
mov dword [esp + 0x84], 0x7f457d40
mov dword [esp + 0x88], 0x7b027958
mov dword [esp + 0x8c], 0x87ba85ba
mov dword [esp + 0x90], 0x83a281a9
mov dword [esp + 0x94], 0x8ffe8dcd
mov dword [esp + 0x98], 0x8bfe89f8
mov dword [esp + 0x9c], 0x97c995f9
mov dword [esp + 0xa0], 0x93f091fd
mov dword [esp + 0xa4], 0x9ff79dd7
mov dword [esp + 0xa8], 0x9bad99e4
mov dword [esp + 0xac], 0xa795a599
mov dword [esp + 0xb0], 0xa394a19f
mov dword [esp + 0xb4], 0xaf90ad9f
mov dword [esp + 0xb8], 0xab82a988
mov dword [esp + 0xbc], 0xb7feb5ff
mov dword [esp + 0xc0], 0xb3e7b1ec
mov dword [esp + 0xc4], 0xbf8abde8
mov dword [esp + 0xc8], 0xbbceb998
mov dword [esp + 0xcc], 0xc7adc5ad
mov dword [esp + 0xd0], 0xc3e2c1ad
mov dword [esp + 0xd4], 0xcfa3cd83
mov dword [esp + 0xd8], 0xcba1c9ab
mov dword [esp + 0xdc], 0xd7ffd5a3
mov dword [esp + 0xe0], 0xd391d1f0
mov dword [esp + 0xe4], 0xdfacddb4
mov dword [esp + 0xe8], 0xdbafd9af
mov dword [esp + 0xec], 0xe7d1e589
mov dword [esp + 0xf0], 0xe3d3e1d1
mov dword [esp + 0xf4], 0xefd8edd5
mov dword [esp + 0xf8], 0xebdce9d8
mov dword [esp + 0xfc], 0xf7c0f5c4
mov dword [esp + 0x100], 0xf3d2f1c0
mov dword [esp + 0x104], 0xff9ffdaf
mov dword [esp + 0x108], 0xfb9bf996
mov dword [esp + 0x10c], 0x76f0576
mov dword [esp + 0x110], 0x33f0137
mov dword [esp + 0x114], 0xf310d3f
mov dword [esp + 0x118], 0xb39093e
mov dword [esp + 0x11c], 0x1716152a
mov eax, dword [0x449abc]
mov ecx, 0x8ca82b4
mov edx, 0x77357d4b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x8ca8274]
mov ebx, edx
and ebx, 0x521038a9
mov edi, ecx
and edi, 0x8488356
or edi, ebx
xor edi, esi
xor edi, 0x2d6dc756
and edi, ecx
mov ebx, edi
and ebx, 2
mov ebp, edi
or edi, 2
imul edi, ebx
xor ebx, 2
and ebp, 0x84883fd
imul ebp, ebx
add edi, ebp
lea ebx, [edx - 0x80000000]
and ebx, edi
not edi
and edi, ecx
sub edi, ebx
lea ebp, [edi + esi]
lea ebx, [edi + esi]
add ebx, 0x7b
mov esi, 0x84
sub esi, ebp
or esi, 1
or ebx, 1
add ebx, ebp
add ebx, esi
add bl, 0x7c
mov byte [esp + ecx - 0x8ca8274], bl
inc ecx
dec edx
cmp ecx, 0x8ca8394
jne 0x410a50
lea edi, [esp + 0x40]
push 0
push 0
push 0
push 0
push edi
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x445030]
mov ecx, 0x7e3ee831
xor ecx, dword [str.:fH]
add eax, ecx
inc eax
jmp eax
Function at 0x417c80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edi + 2], 0
lea edi, [edi + 2]
jne 0x417ca0
mov esi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x417cc0
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x417ce0
mov eax, 0xffffffff
jmp 0x417ce9
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.0040c860
add esp, 4
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
je 0x417d21
add esi, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x417d10
mov word [eax], 0x5c
add eax, 2
mov edx, dword [esp + 0x30]
movzx ecx, word [edx]
test cx, cx
je 0x417d51
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417d40
mov word [eax], 0
lea eax, [esp + 0xc]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.0043f4d0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x445584]
Function at 0x420060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 8]
push eax
mov ecx, esp
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x420080
cmp eax, 0xffffffed
jge 0x420097
mov eax, 0xffffffff
jmp 0x42009a
add eax, 0x12
mov dword [ebp - 0x10], ecx
push eax
call fcn.0040c860
add esp, 4
mov esi, eax
mov dword [ebp - 0x28], 0x19af1bb8
mov dword [ebp - 0x24], 0xe561e7b3
mov dword [ebp - 0x20], 0xe110e318
mov dword [ebp - 0x1c], 0xed40ef4c
mov dword [ebp - 0x18], 0xebec
mov byte [ebp - 0x14], 0
xor ebx, ebx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ebx
and eax, 0x36
mov edx, ecx
xor edx, 0xfb
add edx, eax
xor dl, byte [ebp + ecx - 0x28]
add dl, 0x19
mov byte [ebp + ecx - 0x28], dl
inc ecx
add ebx, 2
cmp ecx, 0x15
jne 0x4200e0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x420131
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x420120
mov word [eax], 0
movzx ecx, word [ebp - 0x28]
test cx, cx
mov ebx, dword [ebp - 0x10]
je 0x420161
lea edx, [ebp - 0x26]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420150
mov word [eax], 0
push ebx
push esi
call fcn.0043f6a0
add esp, 8
mov edi, eax
mov ebx, dword [ebx]
mov eax, dword [0x445eec]
nop
nop
nop
nop
nop
nop
nop
jmp eax
Function at 0x421eb0
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x94
mov dword [esp], 0x7f32795d
mov dword [esp + 4], 0x63057def
mov dword [esp + 8], 0x670a6101
mov dword [esp + 0xc], 0x6bfa6525
mov dword [esp + 0x10], 0x6f2a69f8
mov dword [esp + 0x14], 0x93066d0d
mov dword [esp + 0x18], 0x97b391f1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x9594
mov byte [esp + 0x20], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
lea edi, [ecx - 0x5ef93f16]
mov esi, 0x15
sub esi, ecx
xor esi, edi
and esi, edx
xor esi, edi
mov edi, esi
mov edx, esi
xor edx, 0xdade3b6d
add edx, esi
and esi, 0x8006016d
and edi, 0x2100c092
sub edx, edi
mov edi, edx
and edi, esi
xor edx, esi
lea esi, [edx + edi*2]
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + ecx], dl
mov edx, ecx
or edx, 0x1c9ca32d
and ecx, 0x2d
add ecx, edx
add ecx, 0xe3635cd4
cmp ecx, 0x21
jb 0x421f10
lea ebx, [esp + 0x76]
mov edx, esp
mov edi, ebx
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x92]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea ebp, [esp + 0x50]
push ebp
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x44ae00]
mov esi, dword [esp + 0x50]
mov edi, 0xffffffff
test esi, esi
jns 0x421fba
mov eax, 0xffffffff
jmp 0x421fbd
lea eax, [esi + esi]
push eax
call fcn.0040c860
add esp, 4
push ebp
push esi
mov dword [esp + 0x5c], eax
push eax
push 0xe
push ebx
push 0
call dword [0x44ae00]
mov eax, dword [esp + 0x50]
mov ecx, eax
add ecx, 9
js 0x421fea
lea edi, [eax*2 + 0x12]
push edi
call fcn.0040c860
add esp, 4
mov ebp, eax
mov dword [esp], 0x13c211b4
mov dword [esp + 4], 0xef4ded4d
mov dword [esp + 8], 0xeb4be953
mov dword [esp + 0xc], 0xe75be55b
mov dword [esp + 0x10], 0xe3e2e153
mov byte [esp + 0x14], 0
mov eax, 0x7c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x7c]
mov esi, eax
and esi, edx
lea ecx, [eax - 0x2eb57b00]
or ecx, edx
xor ecx, esi
mov edx, ecx
and edx, 0x91
mov esi, ecx
and esi, 2
mov ebx, esi
xor ebx, 2
imul ebx, edx
or edx, 2
imul edx, esi
xor ecx, 0x93
add ecx, ebx
add ecx, edx
inc cl
mov byte [esp + eax - 0x7c], cl
inc eax
cmp eax, 0x91
jne 0x422030
mov edi, dword [esp + 0x54]
movzx ecx, word [edi]
mov eax, ebp
test cx, cx
je 0x4220a1
lea edx, [edi + 2]
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x422090
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4220d1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4220c0
mov word [eax], 0
lea eax, [esp + 0x70]
push eax
push ebp
call fcn.0043f6a0
add esp, 8
not eax
shr eax, 0x1f
mov dword [esp + 0x68], ebp
jmp dword [eax*4 + 0x446424]
Function at 0x422590
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0x19551b77
mov dword [esp + 8], 0x65d667a8
mov dword [esp + 0xc], 0x61cd6328
mov dword [esp + 0x10], 0x6dc16fdc
mov dword [esp + 0x14], 0x69ce6b07
mov dword [esp + 0x18], 0x75de7734
mov dword [esp + 0x1c], 0x71c073cf
mov dword [esp + 0x20], 0x7dd57fdc
mov dword [esp + 0x24], 0x79d47bc2
mov dword [esp + 0x28], 0x45f847cf
mov dword [esp + 0x2c], 0x41e643e8
mov dword [esp + 0x30], 0x4df04f10
mov dword [esp + 0x34], 0x49e04bfd
mov dword [esp + 0x38], 0x55e257ff
mov dword [esp + 0x3c], 0x51ef53ff
lea eax, [esp + 0x40]
mov word [esp + 0x40], 0x5f50
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
xor ecx, ecx
nop
nop
mov esi, ecx
xor esi, 0x45
mov edx, ecx
and edx, 0x3a
add edx, edx
sub edx, esi
xor dl, byte [esp + ecx + 4]
add dl, 0x59
mov byte [esp + ecx + 4], dl
mov edx, ecx
not edx
or edx, 1
add edx, ecx
inc edx
mov edi, edx
and edi, 2
mov esi, edx
or edx, 2
imul edx, edi
xor edi, 2
and esi, 0xfffffffd
imul esi, edi
xor ecx, 1
add ecx, edx
add ecx, esi
cmp ecx, 0x44
jb 0x422630
lea ebx, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, esp
push edi
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x44ae00]
mov ebp, dword [esp]
test ebp, ebp
jns 0x4226bb
mov eax, 0xffffffff
jmp 0x4226c2
lea eax, [ebp*2]
push eax
call fcn.0040c860
add esp, 4
mov esi, eax
push edi
push ebp
push eax
push 0x1e
push ebx
push 0
call dword [0x44ae00]
mov dword [esp + 4], 0x1fb619cc
mov dword [esp + 8], 0xe3501da9
mov dword [esp + 0xc], 0xe743e144
mov dword [esp + 0x10], 0xeb4ce552
mov dword [esp + 0x14], 0xef58e941
mov dword [esp + 0x18], 0xf3f2ed48
mov eax, 0xfa
mov ecx, 5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0xf6]
mov ebx, ecx
or ebx, edi
lea edx, [edi + edi]
not edx
add edx, edi
or edx, eax
and edx, ebx
mov bl, 0x1d
sub bl, dl
mov byte [esp + eax - 0xf6], bl
inc eax
dec ecx
cmp eax, 0x112
jne 0x422720
push 0
push 0
lea eax, [esp + 0xc]
push eax
push esi
push dword [esp + 0xac]
call fcn.0041e400
add esp, 0x14
jmp dword [0x44647c]
Function at 0x424dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx ecx, word [esi]
mov eax, ebp
test cx, cx
je 0x424f02
mov edx, dword [esp + 0x18]
mov eax, ebp
dec edx
je 0x424f02
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x424e10
lea ecx, [eax + 1]
mov byte [eax], bl
jmp 0x424ea0
cmp ebx, 0x7ff
ja 0x424e40
cmp edx, 2
jb 0x424e40
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
mov ecx, ebx
xor ecx, 0xc0
or ebx, 0x3f
and ebx, ecx
add bl, 0x80
lea ecx, [eax + 2]
mov byte [eax + 1], bl
jmp 0x424ea0
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x424ec4
cmp edx, 4
jb 0x424ec4
movzx ecx, word [esi + 2]
shl ebx, 0xa
lea edi, [ebx + ecx]
add edi, 0xfca02400
mov ebx, edi
shr ebx, 0x12
add bl, 0xf0
mov byte [eax], bl
mov ebx, edi
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [eax + 1], bl
shr edi, 6
mov ebx, edi
not ebx
or ebx, 0x3f
add ebx, edi
add bl, 0x81
mov byte [eax + 2], bl
and cl, 0x3f
or cl, 0x80
mov byte [eax + 3], cl
lea ecx, [eax + 4]
add esi, 4
mov edi, esi
mov esi, ecx
not esi
and esi, eax
not eax
and eax, ecx
sub edx, eax
add edx, esi
mov esi, edi
mov eax, ecx
movzx ecx, word [esi]
test cx, cx
je 0x424f02
test edx, edx
jne 0x424df0
jmp 0x424f02
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x424ed3
mov esi, edi
jmp 0x424eb2
cmp edx, 3
jb 0x424efe
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 3]
mov byte [eax + 2], bl
jmp 0x424ea0
mov ecx, eax
jmp 0x424ea0
mov byte [eax], 0
sub eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x429890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
cmp edi, 0x24
ja 0x4298ea
cmp edi, 1
je 0x4298ea
mov ebp, dword [esp + 0x38]
mov ebx, ebp
jmp 0x4298c1
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x4298c0
cmp ecx, 0x20
je 0x4298c0
cmp ecx, 0x2b
mov edx, edi
je 0x4298e0
cmp ecx, 0x2d
jne 0x4298ff
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x429904
xor edi, edi
test esi, esi
je 0x429ad9
mov dword [esi], 0x16
jmp 0x429ad9
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42992d
cmp edx, 0x10
jne 0x429945
cmp byte [ebx], 0x30
jne 0x429926
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x429947
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x429947
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x18], ecx
sub eax, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
xor edx, edx
div edi
mov dword [esp + 0x1c], eax
xor ebp, ebp
mov dword [esp + 8], 0
mov edx, edi
mov dword [esp + 0x20], edi
inc ebx
jmp 0x4299a1
mov ebp, ecx
mov dword [esp + 8], 0
mov esi, dword [esp + 0x44]
test esi, esi
je 0x429a70
mov dword [esi], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ecx, [eax - 0x30]
cmp ecx, 0xa
jae 0x4299c0
and eax, 0xf
lea ebp, [eax + eax]
sub ebp, eax
cmp ebp, edx
jl 0x4299e1
jmp 0x429aa4
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x1a
jae 0x429aa4
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x429aa4
mov eax, edi
mov ecx, dword [esp + 0xc]
xor eax, ecx
mov esi, dword [esp + 8]
or eax, esi
je 0x429980
mov dword [esp + 0x14], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x1c], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x429a20
xor edx, edx
mov esi, dword [esp + 0xc]
jmp 0x429a29
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 0xc]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
mov dword [esp + 8], ecx
cmp edi, esi
mov ecx, dword [esp + 0xc]
sbb eax, edx
setae al
jae 0x429a55
mov dword [esp + 8], 0
mov ebp, ecx
and bl, al
mov esi, dword [esp + 0x44]
test esi, esi
mov edx, dword [esp + 0x20]
je 0x429a8b
test bl, bl
jne 0x429a8b
mov ebx, dword [esp + 0x14]
jmp 0x429996
mov dword [esp + 0x10], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
mov dword [esp + 8], 0
jmp 0x42997b
test bl, bl
jne 0x429a97
mov dword [esp + 0x10], 0x22
mov ebx, dword [esp + 0x14]
mov dword [esp + 4], ebx
jmp 0x42997b
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x429ab2
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x44]
test ecx, ecx
mov eax, dword [esp + 0x10]
je 0x429ac0
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x429ad0
mov edi, SysReAllocString
sub edi, dword [esp + 0x18]
jmp 0x429ad9
cmp byte [esp + 3], 0
jne 0x429ad9
neg edi
mov eax, edi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + edx + 2], 0
lea edx, [edx + 2]
jne 0x435f50
mov dword [esp], 0x8e8e881f
mov word [esp + 4], 0
xor ebx, ebx
nop
nop
nop
nop
nop
mov ecx, ebx
add cl, 0x62
xor cl, byte [esp + ebx]
add cl, 0x16
mov byte [esp + ebx], cl
inc ebx
cmp ebx, 6
jne 0x435f70
test edx, edx
je 0x435fee
mov ecx, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x435fb1
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [esi]
add esi, 2
xor eax, ebp
imul eax, ecx
mov ebp, eax
dec ebx
jne 0x435fa0
cmp edi, 3
jb 0x435fee
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [esi + edi*2]
xor ebx, eax
imul ebx, ecx
movzx eax, word [esi + edi*2 + 2]
xor eax, ebx
imul eax, ecx
movzx ebx, word [esi + edi*2 + 4]
xor ebx, eax
imul ebx, ecx
movzx eax, word [esi + edi*2 + 6]
xor eax, ebx
imul eax, ecx
add edi, 4
cmp edx, edi
jne 0x435fc0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4369d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x44]
call fcn.0043f4d0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44864c]

Function at 0x436c30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.0043fc10
add esp, 0x14
test eax, eax
js 0x436d6f
lea esi, [esp + 0xc]
lea eax, [esp + 0x10]
push esi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00440040
add esp, 0x24
mov ecx, eax
xor ebx, ebx
mov eax, 0
test ecx, ecx
js 0x436ccf
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x436c99
mov eax, 0xffffffff
jmp 0x436ca0
lea eax, [eax*2 + 2]
push eax
call fcn.0040c860
add esp, 4
push esi
mov esi, eax
push eax
push 0
push edi
push dword [esp + 0x10]
call fcn.00440680
add esp, 0x14
test eax, eax
js 0x436cc4
mov eax, esi
jmp 0x436ccf
push esi
call fcn.0040c870
add esp, 4
xor eax, eax
mov ecx, dword [esp]
mov dword [esp + 4], 0x80b0a0d
mov word [esp + 8], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
add dl, 0xc3
xor dl, byte [esp + ebx + 4]
add dl, 0x31
mov byte [esp + ebx + 4], dl
mov edx, ebx
and edx, 2
xor ebx, 0x5e755e5a
lea ebx, [ebx + edx*2]
add ebx, 0xa18aa1a7
cmp ebx, 6
jb 0x436cf0
mov edx, dword [0x44ae04]
test edx, edx
je 0x436d5e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44ae08]
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x436d40
inc edi
cmp edx, edi
jne 0x436d30
jmp 0x436d5e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x436d5e
push ecx
push 1
push edx
push dword [0x44ae0c]
mov esi, eax
call fcn.0043bd80
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x436d71
lea eax, [esp + 4]
push eax
call fcn.0043f2c0
add esp, 4
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
ret
Function at 0x4389f0
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
mov eax, dword [esp + 0xc]
mov dword [esp], 0x636261b0
xor ecx, ecx
nop
mov edx, ecx
add dl, 0x18
xor dl, byte [esp + ecx]
add dl, 0x88
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne 0x438a00
mov ecx, dword [esp]
mov edx, dword [0x4489c4]
nop
nop
nop
jmp edx

Function at 0x438a60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x4489ec]