joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4283d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.00427ca0
add esp, 4
test al, al
je 0x4283d0
mov al, 1
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe0
push eax
mov esi, esp
push eax
mov dword [ebp - 0x2c], esp
sub esp, 0x24
mov ebx, esp
sub esp, 8
mov edi, esp
sub esp, 8
mov dword [ebp - 0xa0], esp
sub esp, 8
mov dword [ebp - 0x3c], esp
sub esp, 0x20
mov dword [ebp - 0xe8], esp
mov dword [ebp - 0xe4], 0x3f903df5
mov dword [ebp - 0xe0], 0x3b601b3
mov dword [ebp - 0xdc], 0x7aa05a5
mov dword [ebp - 0xd8], 0xbda09a4
mov dword [ebp - 0xd4], 0xfba0dad
mov dword [ebp - 0xd0], 0x131211b8
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebp + eax - 0xe4]
lea edx, [eax - 0x7d582d24]
and edx, ecx
add edx, edx
neg edx
add edx, eax
add edx, 0x82a7d2dc
add dl, cl
add dl, 0x20
mov byte [ebp + eax - 0xe4], dl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x18
jb 0x428450
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x96], 0x3546334e
mov dword [ebp - 0x92], 0x397f3773
mov dword [ebp - 0x8e], 0x3d4f3b73
mov dword [ebp - 0x8a], 0x21523f4a
mov dword [ebp - 0x86], 0x2558235b
mov dword [ebp - 0x82], 0x2969276b
mov dword [ebp - 0x7e], 0x2d642b69
mov dword [ebp - 0x7a], 0x511e2f67
mov dword [ebp - 0x76], 0x55285317
mov dword [ebp - 0x72], 0x59175725
mov dword [ebp - 0x6e], 0x5d285b1c
mov dword [ebp - 0x6a], 0x41015f29
mov dword [ebp - 0x66], 0x45014330
mov dword [ebp - 0x62], 0x493e473a
mov dword [ebp - 0x5e], 0x4d204b2b
mov dword [ebp - 0x5a], 0x71154fd8
mov dword [ebp - 0x56], 0x7507730e
mov dword [ebp - 0x52], 0x791d77e2
mov dword [ebp - 0x4e], 0x7d117b1b
mov word [ebp - 0x4a], 0x7f7e
mov eax, 0x22
mov ecx, 0xdd
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + eax - 0xb8]
mov esi, eax
or esi, edx
not edx
or edx, ecx
and edx, esi
add dl, 0xf0
mov byte [ebp + eax - 0xb8], dl
inc eax
dec ecx
cmp eax, 0x70
jne 0x428540
lea eax, [ebp - 0xec]
lea edi, [ebp - 0xe4]
lea ecx, [ebp - 0x96]
push eax
push edi
push ecx
call fcn.004388d0
add esp, 0xc
mov esi, eax
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x444a68]
Function at 0x4375a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x4375c0
mov dword [esp], 0x10f0f9e
mov esi, 0xfbec1f25
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi + 0x413e0db]
xor ebx, esi
add ebx, 0x16c4f0a3
mov edi, ebx
xor edi, 0xcc
and ebx, 0x33
add ebx, ebx
sub ebx, edi
inc bl
mov byte [esp + esi + 0x413e0db], bl
inc esi
cmp esi, 0xfbec1f29
jne 0x4375e0
test edx, edx
je 0x43767e
mov esi, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x437641
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x437630
cmp edi, 3
jb 0x43767e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x437650
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d6e0
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
mov dword [esp], 0xfcfbfac9
mov eax, 0x71
mov ecx, 0x8e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x71]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0x78
mov byte [esp + eax - 0x71], dl
inc eax
dec ecx
cmp eax, 0x75
jne 0x43d700
mov eax, dword [esp]
mov eax, dword fs:[eax]
add esp, 4
pop esi
ret

Function at 0x43dba0
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x445828
xor esi, 0x79c396e
sub edx, esi
jmp edx
loopne 0x432585
test byte [eax + ebp*8], ah
add byte [eax], al
add byte [ebx + 0x8498b08], cl
mov dword [esp], eax
call ecx
sub esp, 4
mov ecx, dword [esp + 0x158]
xor ecx, 0x35dff978
mov eax, dword [esp + 0x1c8]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x445954]
xor ecx, 0xcf99b88d
sub eax, ecx
jmp eax
retf
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
ret
add al, 0x89
invalid
invalid
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [esp + 0x2c]
movzx eax, word [esi]
mov dword [esp + 8], 0x67663f29
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x44
xor dl, byte [esp + ecx + 8]
add dl, 0xe0
mov byte [esp + ecx + 8], dl
inc ecx
cmp ecx, 4
jne case.default.0x43dbe1
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x446e48]
Function at 0x43e190
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43e1a0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43e1bb
mov eax, 0xffffffff
jmp 0x43e1be
add eax, 0xa
push eax
call fcn.00408b20
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [edi]
test dx, dx
je 0x43e201
add edi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [edi]
add edi, 2
test dx, dx
jne 0x43e1f0
mov word [ecx], 0
lea ecx, [esi*2 + 8]
mov word [esp + 8], cx
and esi, 1
xor ecx, 2
lea ecx, [ecx + esi*4]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xdfd0d1d2
mov ecx, esp
xor ebp, ebp
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx]
mov edx, ebp
and edx, 0xfcc8d116
mov edi, esi
xor edi, 0x19b9774
sub edi, edx
inc edi
mov edx, edi
and edx, ebx
or edi, ebx
lea ebx, [edx + edx]
not ebx
add ebx, edx
and ebx, edi
add bl, 0x58
mov byte [ecx], bl
inc ecx
dec esi
add ebp, 0xfffffffe
cmp esi, 0xfffffffc
jne 0x43e270
mov esi, dword [esp]
mov ecx, dword [0x449650]
test ecx, ecx
je 0x43e315
xor edx, edx
mov edi, dword [0x449654]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x5f7891a5
je 0x43e2d0
inc edx
cmp ecx, edx
jne 0x43e2c0
jmp 0x43e315
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43e315
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x449658]
mov edi, eax
call fcn.0043c060
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408b30
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e330
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43e340
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43e35b
mov eax, 0xffffffff
jmp 0x43e35e
add eax, 0xa
push eax
call fcn.00408b20
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x43e3a1
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x43e390
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov ebx, ecx
and ebx, 0xfffd
imul ebx, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xdfd0d1d2
mov ecx, esp
xor edi, edi
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ecx]
mov ebp, edi
and ebp, 0xfcc8d116
mov ebx, esi
xor ebx, 0x19b9774
sub ebx, ebp
inc ebx
mov ebp, ebx
and ebp, edx
or ebx, edx
lea edx, [ebp*2]
not edx
add edx, ebp
and edx, ebx
add dl, 0x58
mov byte [ecx], dl
inc ecx
dec esi
add edi, 0xfffffffe
cmp esi, 0xfffffffc
jne 0x43e420
mov esi, dword [esp]
mov ecx, dword [0x449650]
test ecx, ecx
je 0x43e4b7
xor edx, edx
mov ebx, dword [0x449654]
nop
nop
nop
cmp dword [ebx + edx*8], 0x75935cf9
je 0x43e480
inc edx
cmp ecx, edx
jne 0x43e470
jmp 0x43e4b7
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43e4b7
mov edx, esp
lea esi, [esp + 0x10]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x449658]
mov edi, eax
call fcn.0043c060
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408b30
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e4d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43e4f0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43e50b
mov eax, 0xffffffff
jmp 0x43e50e
add eax, 0xa
push eax
call fcn.00408b20
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov dword [esp + 4], eax
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x43e561
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x43e550
mov word [edx], 0
mov edi, 3
sub edi, esi
and edi, 2
mov edx, ecx
and edx, 0xfffd
imul edx, edi
and esi, 2
or ecx, 2
imul ecx, esi
lea esi, [ecx + edx]
mov word [esp + 8], si
add ecx, edx
add ecx, 2
mov word [esp + 0xa], cx
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xdfd0d1d2
lea ecx, [esp + 0x28]
xor eax, eax
xor esi, esi
nop
nop
movzx ebx, byte [ecx]
mov edx, eax
and edx, 0xfcc8d116
mov edi, esi
xor edi, 0x19b9774
sub edi, edx
inc edi
mov edx, edi
and edx, ebx
or edi, ebx
lea ebx, [edx + edx]
not ebx
add ebx, edx
and ebx, edi
add bl, 0x58
mov byte [ecx], bl
inc ecx
dec esi
add eax, 0xfffffffe
cmp esi, 0xfffffffc
jne 0x43e5e0
mov esi, dword [esp + 0x28]
mov ecx, dword [0x449650]
test ecx, ecx
je 0x43e665
xor edx, edx
mov edi, dword [0x449654]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xcaa82e26
je 0x43e640
inc edx
cmp ecx, edx
jne 0x43e630
jmp 0x43e665
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43e665
lea eax, [esp + 0x28]
lea edx, [esp + 0x10]
push eax
push edx
push 8
push ecx
push dword [0x449658]
call fcn.0043c060
add esp, 0x14
mov esi, eax
push dword [esp + 4]
call fcn.00408b30
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43e67e
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp], 0xdfd0d1d2
mov eax, esp
xor edi, edi
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
mov esi, edi
and esi, 0xfcc8d116
mov ebx, ecx
xor ebx, 0x19b9774
sub ebx, esi
inc ebx
mov esi, ebx
and esi, edx
or ebx, edx
lea edx, [esi + esi]
not edx
add edx, esi
and edx, ebx
add dl, 0x58
mov byte [eax], dl
inc eax
dec ecx
add edi, 0xfffffffe
cmp ecx, 0xfffffffc
jne 0x43e6b0
mov eax, dword [esp]
mov edx, dword [0x449650]
test edx, edx
je 0x43e738
xor ecx, ecx
mov ebx, dword [0x449654]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + ecx*8], 0xa269eeef
je 0x43e710
inc ecx
cmp edx, ecx
jne 0x43e700
jmp 0x43e738
mov ecx, dword [ebx + ecx*8 + 4]
cmp ecx, eax
je 0x43e738
mov eax, esp
lea edx, [esp + 0x1c]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 0x14
push ecx
push dword [0x449658]
call fcn.0043c060
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x43e745
mov ecx, dword [esp + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43e754
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e760
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x28]
mov dword [esp], 0xdfd0d1d2
mov eax, esp
xor esi, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [eax]
mov ebx, esi
and ebx, 0xfcc8d116
mov ebp, edi
xor ebp, 0x19b9774
sub ebp, ebx
inc ebp
mov ebx, ebp
and ebx, ecx
or ebp, ecx
lea ecx, [ebx + ebx]
not ecx
add ecx, ebx
and ecx, ebp
add cl, 0x58
mov byte [eax], cl
inc eax
dec edi
add esi, 0xfffffffe
cmp edi, 0xfffffffc
jne 0x43e780
mov eax, dword [esp]
mov ebx, dword [0x449650]
test ebx, ebx
je 0x43e810
xor edi, edi
mov ebp, dword [0x449654]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + edi*8], 0xe88ddea1
je 0x43e7e1
inc edi
cmp ebx, edi
jne 0x43e7d0
jmp 0x43e810
mov ebx, dword [ebp + edi*8 + 4]
cmp ebx, eax
je 0x43e810
mov eax, esp
push 0
push 0
push edx
push dword [esp + 0x30]
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x449658]
call fcn.0043c060
add esp, 0x30
cmp eax, 0x103
jne 0x43e8b8
mov dword [esp + 8], 0xdfd0d1d2
lea eax, [esp + 8]
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
movzx esi, byte [eax]
mov ebx, ecx
and ebx, 0xfcc8d116
mov edi, edx
xor edi, 0x19b9774
sub edi, ebx
inc edi
mov ebp, edi
and ebp, esi
or edi, esi
lea ebx, [ebp*2]
not ebx
add ebx, ebp
and ebx, edi
add bl, 0x58
mov byte [eax], bl
inc eax
dec edx
add ecx, 0xfffffffe
cmp edx, 0xfffffffc
jne 0x43e830
mov eax, dword [esp + 8]
mov ecx, dword [0x449650]
test ecx, ecx
je 0x43e8b1
xor edx, edx
mov edi, dword [0x449654]
nop
nop
cmp dword [edi + edx*8], 0xa67d73aa
je 0x43e890
inc edx
cmp ecx, edx
jne 0x43e880
jmp 0x43e8b1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43e8b1
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x449658]
call fcn.0043c060
add esp, 0x18
test eax, eax
js 0x43e8b8
mov eax, dword [esp]
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x43e8cf
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43e8cd
mov ecx, dword [esp + 4]
mov dword [edx], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x28]
mov dword [esp], 0xdfd0d1d2
mov eax, esp
xor esi, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [eax]
mov ebx, esi
and ebx, 0xfcc8d116
mov ebp, edi
xor ebp, 0x19b9774
sub ebp, ebx
inc ebp
mov ebx, ebp
and ebx, ecx
or ebp, ecx
lea ecx, [ebx + ebx]
not ecx
add ecx, ebx
and ecx, ebp
add cl, 0x58
mov byte [eax], cl
inc eax
dec edi
add esi, 0xfffffffe
cmp edi, 0xfffffffc
jne 0x43e900
mov eax, dword [esp]
mov ebx, dword [0x449650]
test ebx, ebx
je 0x43e990
xor edi, edi
mov ebp, dword [0x449654]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + edi*8], 0x88822328
je 0x43e961
inc edi
cmp ebx, edi
jne 0x43e950
jmp 0x43e990
mov ebx, dword [ebp + edi*8 + 4]
cmp ebx, eax
je 0x43e990
mov eax, esp
push 0
push 0
push edx
push dword [esp + 0x30]
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x449658]
call fcn.0043c060
add esp, 0x30
cmp eax, 0x103
jne 0x43ea38
mov dword [esp + 8], 0xdfd0d1d2
lea eax, [esp + 8]
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
movzx esi, byte [eax]
mov ebx, ecx
and ebx, 0xfcc8d116
mov edi, edx
xor edi, 0x19b9774
sub edi, ebx
inc edi
mov ebp, edi
and ebp, esi
or edi, esi
lea ebx, [ebp*2]
not ebx
add ebx, ebp
and ebx, edi
add bl, 0x58
mov byte [eax], bl
inc eax
dec edx
add ecx, 0xfffffffe
cmp edx, 0xfffffffc
jne 0x43e9b0
mov eax, dword [esp + 8]
mov ecx, dword [0x449650]
test ecx, ecx
je 0x43ea31
xor edx, edx
mov edi, dword [0x449654]
nop
nop
cmp dword [edi + edx*8], 0xa67d73aa
je 0x43ea10
inc edx
cmp ecx, edx
jne 0x43ea00
jmp 0x43ea31
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43ea31
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x449658]
call fcn.0043c060
add esp, 0x18
test eax, eax
js 0x43ea38
mov eax, dword [esp]
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x43ea46
mov ecx, dword [esp + 4]
mov dword [edx], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ea50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x38]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x43ea70
sar ebx, 1
mov ecx, ebx
and ecx, 0xfffd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 4], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0xdfd0d1d2
mov eax, esp
xor edx, edx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [eax]
mov edi, edx
and edi, 0xfcc8d116
mov ebp, ebx
xor ebp, 0x19b9774
sub ebp, edi
inc ebp
mov edi, ebp
and edi, ecx
or ebp, ecx
lea ecx, [edi + edi]
not ecx
add ecx, edi
and ecx, ebp
add cl, 0x58
mov byte [eax], cl
inc eax
dec ebx
add edx, 0xfffffffe
cmp ebx, 0xfffffffc
jne 0x43eaf0
mov eax, dword [esp]
mov edi, dword [0x449650]
test edi, edi
je 0x43eb78
xor ebx, ebx
mov ebp, dword [0x449654]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xb7847e1b
je 0x43eb51
inc ebx
cmp edi, ebx
jne 0x43eb40
jmp 0x43eb78
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43eb78
lea eax, [esp + 0xc]
push esi
push eax
push dword [esp + 0x48]
push dword [esp + 0x48]
push 0x10
push edi
push dword [0x449658]
call fcn.0043c060
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x75304a93
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x32a814ae
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x64de2cde
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x16951ac4
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10211df0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, 0x244f
mov dword [0x103df140], 0
mov byte [0x103df144], 0
mov dword [0x103df138], 0x244f
mov dword [0x103df134], 0x3025
mov dword [0x103df13c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
jmp 0x10211e5a
xor eax, eax
mov dword [0x103df13c], 0
mov dword [ebp - 0x24], eax
jmp 0x10211ea8
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add eax, 0x1f3c
mov dword [0x103df134], eax
mov eax, ecx
mov dl, al
mov eax, dword [ebp - 0x18]
mov byte [eax + ecx], dl
mov ecx, dword [0x103df134]
add ecx, 0x22b2
mov dword [0x103df138], ecx
mov esi, dword [0x103df13c]
add esi, 1
mov dword [0x103df13c], esi
cmp esi, 0x100
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ecx
jl 0x10211e5a
jmp 0x10211e49
mov eax, dword [ebp - 0x24]
mov ecx, 0x100
mov dword [0x103df148], 0
mov dword [0x103df134], 0x5de
mov edx, dword [0x103df140]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x28], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x103df148], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x103df140], edx
mov dword [0x103df134], 0x317
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov cl, byte [ecx + edi]
mov byte [0x103df144], cl
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov ecx, dword [0x103df134]
add ecx, 0xffffecb7
mov dword [0x103df134], ecx
mov cl, byte [0x103df144]
mov edx, dword [0x103df140]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x103df13c]
add edx, 1
mov dword [0x103df13c], edx
cmp edx, 0x100
mov dword [ebp - 0x24], edx
jl 0x10211ea8
mov dword [0x103df138], 0x16ae
mov dword [0x103df134], 0xe0d
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1021204c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x103df138], 0x2a8
mov esi, dword [0x103df134]
add esi, 0x99c
mov dword [0x103df134], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + 0x10346ad4]
mov dl, byte [eax + str.Az8]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x30], eax
jne 0x10212080
lea eax, [ebp - 0x24]
mov dword [0x103df134], 0x196a
mov dword [ebp - 0x34], eax
call fcn.1021341b
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.102134d9
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
je 0x102121a1
jmp 0x102120f9
mov eax, dword [ebp - 0x40]
add eax, 0x260a
mov dword [0x103df134], 0x2194
mov dword [ebp - 0x3c], eax
jmp 0x102121a1
mov eax, dword [0x103df138]
mov ecx, dword [ebp - 0x38]
add eax, 0xb6
mov dword [0x103df134], eax
mov eax, esp
mov dword [eax + 0xc], 0x40
mov dword [eax + 8], 0x1000
mov dword [eax + 4], 0x6000
mov dword [eax], 0
call ecx
sub esp, 0x10
mov dword [0x103df138], 0x6cc
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.102128ea
xor eax, eax
mov ecx, dword [ebp - 0x40]
mov word [ecx], 0x5a4d
mov dword [0x103df138], 0xba6
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x14], ecx
mov ecx, dword [ebp - 0x40]
mov dword [edx + 0x44], ecx
mov esi, dword [0x103df138]
add esi, 0xfffff6ea
mov dword [0x103df134], esi
cmp ecx, 0
mov dword [ebp - 0x3c], eax
jne 0x102120df
mov eax, dword [ebp - 0x3c]
add esp, 0x4c
pop esi
pop ebp
ret