joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409d10
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x230
push eax
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x14], esp
sub esp, 0x6c
mov dword [ebp - 0x20], esp
sub esp, 0x24
mov dword [ebp - 0x10], esp
sub esp, 8
mov esi, esp
sub esp, 0x40
mov dword [ebp - 0x24], esp
sub esp, 0x80
mov dword [ebp - 0x2c], esp
mov eax, dword [0x4491b8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xac], 0x55545b52
mov ecx, 0x71951e42
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ecx - 0x71951eee]
xor edx, ecx
add edx, 0x73570def
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
mov byte [ebp + ecx - 0x71951eee], dl
inc ecx
cmp ecx, 0x71951e46
jne 0x409d60
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 0x23c], 0xb814a612
mov dword [ebp - 0x238], 0xbc14ba4b
mov dword [ebp - 0x234], 0xb04dbe4e
mov dword [ebp - 0x230], 0xb417b24f
mov dword [ebp - 0x22c], 0x880bb609
mov word [ebp - 0x228], 0x8a89
xor edx, edx
nop
nop
movzx ebx, byte [ebp + edx - 0x23c]
mov edi, 0xdea4432
sub edi, edx
or edi, ebx
lea eax, [edx + 0xcd]
not ebx
or ebx, eax
and ebx, edi
not ebx
mov eax, ebx
and eax, 0x97
or ebx, 0x97
add ebx, eax
inc bl
mov byte [ebp + edx - 0x23c], bl
mov eax, edx
and eax, 1
xor edx, 1
lea edx, [edx + eax*2]
cmp edx, 0x16
jb 0x409dd0
lea edi, [ebp - 0x23c]
push ecx
push 0
push edi
call dword [ebp - 0x18]
mov ecx, 0x4491bc
push eax
call fcn.0043c2f0
movzx eax, al
mov eax, dword [eax*4 + 0x44335c]
mov ecx, 0x64c45abf
xor ecx, dword [0x443364]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x40b770
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [esp + 0x3c], 0xef41ed21
mov dword [esp + 0x40], 0xf35bf14a
mov dword [esp + 0x44], 0xf75af558
mov dword [esp + 0x48], 0xfb15f959
mov dword [esp + 0x4c], 0xff10fd09
mov dword [esp + 0x50], 0xc322c130
mov dword [esp + 0x54], 0xc711c52c
mov dword [esp + 0x58], 0xcb64c961
mov dword [esp + 0x5c], 0xcf61cd68
mov dword [esp + 0x60], 0xd361d167
mov dword [esp + 0x64], 0xd718d534
mov dword [esp + 0x68], 0xdb3ad90c
mov dword [esp + 0x6c], 0xdf2edd2d
mov dword [esp + 0x70], 0xa352a14e
mov dword [esp + 0x74], 0xa746a55f
mov dword [esp + 0x78], 0xab03a97f
mov dword [esp + 0x7c], 0xaf58ad02
mov dword [esp + 0x80], 0xb349b144
mov dword [esp + 0x84], 0xb70eb554
mov dword [esp + 0x88], 0xbb4eb94e
mov dword [esp + 0x8c], 0xbf5ebd55
mov dword [esp + 0x90], 0x83328141
mov dword [esp + 0x94], 0x872a8534
mov dword [esp + 0x98], 0x8b5d892d
mov dword [esp + 0x9c], 0x8f2c8d29
mov dword [esp + 0xa0], 0x933b915b
mov dword [esp + 0xa4], 0x97799520
mov dword [esp + 0xa8], 0x9b69996d
mov dword [esp + 0xac], 0x9f709d6b
mov dword [esp + 0xb0], 0x63946193
mov dword [esp + 0xb4], 0x678e6584
mov dword [esp + 0xb8], 0x6ba269a3
mov dword [esp + 0xbc], 0x6fa36db8
mov dword [esp + 0xc0], 0x739e71bc
mov dword [esp + 0xc4], 0x77da7594
mov dword [esp + 0xc8], 0x7bd179d1
mov dword [esp + 0xcc], 0x7f9e7dd9
mov dword [esp + 0xd0], 0x43e74187
mov dword [esp + 0xd4], 0x47ed45e7
mov dword [esp + 0xd8], 0x4ba349e7
mov dword [esp + 0xdc], 0x4f8d4dac
mov dword [esp + 0xe0], 0x53e051f8
mov dword [esp + 0xe4], 0x57fb55fb
mov dword [esp + 0xe8], 0x5bb559fd
mov dword [esp + 0xec], 0x5faf5dad
mov dword [esp + 0xf0], 0x23cc21d9
mov dword [esp + 0xf4], 0x27c825d4
mov dword [esp + 0xf8], 0x2bc429d8
mov dword [esp + 0xfc], 0x2fce2ddc
mov dword [esp + 0x100], 0x339331e3
mov dword [esp + 0x104], 0x37973592
mov dword [esp + 0x108], 0x3b93398a
mov dword [esp + 0x10c], 0x3fcb3dd3
mov dword [esp + 0x110], 0x3f501f3
mov dword [esp + 0x114], 0x7f505ea
mov dword [esp + 0x118], 0xb0a09fe
mov eax, dword [0x449188]
mov dword [esp], eax
mov ecx, 0x49f842b
mov edx, 0x92f237d4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x49f83ef]
lea esi, [ecx - 0x49f839f]
and esi, edi
mov eax, esi
or eax, 0xfffffffd
inc eax
mov ebp, esi
and ebp, 0xfffffffd
imul ebp, eax
mov eax, esi
and eax, 2
or esi, 2
imul esi, eax
lea ebx, [edi + ebp]
sub ebx, esi
add ebx, ecx
mov eax, ebx
and eax, 1
sub esi, ebp
sub esi, edi
add esi, edx
and esi, 0xaa
and ebx, 0x55
or ebx, esi
xor ebx, 0xab
lea eax, [ebx + eax*2]
mov byte [esp + ecx - 0x49f83ef], al
inc ecx
dec edx
cmp ecx, 0x49f850b
jne 0x40b9d0
lea esi, [esp + 0x3c]
push 0
push 0
push 0
push 0
push esi
call dword [esp + 0x14]
mov ebp, eax
xor eax, eax
test ebp, ebp
setne al
mov eax, dword [eax*4 + 0x4436f4]
mov ecx, 0x1e2a8451
xor ecx, dword [0x4436fc]
add eax, ecx
inc eax
jmp eax
Function at 0x40c120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov edi, dword [esp + 0x264]
mov dword [esp + 0x38], 0x80308ed0
mov dword [esp + 0x3c], 0x843a820b
mov dword [esp + 0x40], 0x983b8639
mov dword [esp + 0x44], 0x9ce49a38
mov dword [esp + 0x48], 0x90e19ee8
mov dword [esp + 0x4c], 0x94f392e1
mov dword [esp + 0x50], 0xe8c096ed
mov dword [esp + 0x54], 0xec55ea50
mov dword [esp + 0x58], 0xe050ee49
mov dword [esp + 0x5c], 0xe450e256
mov dword [esp + 0x60], 0xf8b9e685
mov dword [esp + 0x64], 0xfc9bfaad
mov dword [esp + 0x68], 0xf08ffe8c
mov dword [esp + 0x6c], 0xf483f28f
mov dword [esp + 0x70], 0xc897f6be
mov dword [esp + 0x74], 0xcc72ca9e
mov dword [esp + 0x78], 0xc0b9ce73
mov dword [esp + 0x7c], 0xc488c2b5
mov dword [esp + 0x80], 0xd84fc6a5
mov dword [esp + 0x84], 0xdcafdaaf
mov dword [esp + 0x88], 0xd0bfdea4
mov dword [esp + 0x8c], 0xd463d290
mov dword [esp + 0x90], 0x286bd665
mov dword [esp + 0x94], 0x2c7c2a8c
mov dword [esp + 0x98], 0x208d2e88
mov dword [esp + 0x9c], 0x249a227a
mov dword [esp + 0xa0], 0x38582691
mov dword [esp + 0xa4], 0x3c483a4c
mov dword [esp + 0xa8], 0x30413e4a
mov dword [esp + 0xac], 0x34453242
mov dword [esp + 0xb0], 0x84f3655
mov dword [esp + 0xb4], 0xc530a52
mov dword [esp + 0xb8], 0x520e59
mov dword [esp + 0xbc], 0x47f025d
mov dword [esp + 0xc0], 0x18bb0665
mov dword [esp + 0xc4], 0x1ca01aa0
mov dword [esp + 0xc8], 0x107f1eb8
mov dword [esp + 0xcc], 0x14b61256
mov dword [esp + 0xd0], 0x68ac16b6
mov dword [esp + 0xd4], 0x6c126ad6
mov dword [esp + 0xd8], 0x602c6e0d
mov dword [esp + 0xdc], 0x64d162d9
mov dword [esp + 0xe0], 0x78da66da
mov dword [esp + 0xe4], 0x7c047adc
mov dword [esp + 0xe8], 0x700e7e0c
mov dword [esp + 0xec], 0x740d7238
mov dword [esp + 0xf0], 0x48097605
mov dword [esp + 0xf4], 0x4c354a39
mov dword [esp + 0xf8], 0x402f4e3d
mov dword [esp + 0xfc], 0x44e24212
mov dword [esp + 0x100], 0x58e646e3
mov dword [esp + 0x104], 0x5ce25aeb
mov dword [esp + 0x108], 0x502a5e22
mov dword [esp + 0x10c], 0x54245222
mov dword [esp + 0x110], 0xa824562b
mov dword [esp + 0x114], 0xacabaadf
mov eax, dword [0x449188]
mov ecx, 0x5d776da5
nop
nop
nop
movzx edx, byte [esp + ecx - 0x5d776d6d]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0xd8
mov byte [esp + ecx - 0x5d776d6d], dl
inc ecx
cmp ecx, 0x5d776e85
jne 0x40c370
lea ebx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ebx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x443888]
mov ecx, dword [0x443890]
mov edx, ecx
and edx, 0xe19bcfef
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0x1e643011
jmp eax
Function at 0x415690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x468
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 8]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x4156b0
lea ecx, [esi + eax]
add ecx, 0xfffffffe
add eax, esi
mov edx, 1
sub edx, eax
and edx, esi
mov eax, esi
not eax
and eax, ecx
mov ecx, eax
sub ecx, edx
mov eax, ecx
sar eax, 1
mov dword [esp + 0xbc], eax
mov edi, 0xffffffff
cmp eax, 0xfffffff2
mov dword [esp + 0x114], ecx
jge 0x4156f8
mov eax, 0xffffffff
jmp 0x4156fb
lea eax, [ecx + 0x1c]
push eax
call fcn.004080f0
add esp, 4
mov ebx, eax
mov dword [esp + 0x2c8], 0x72cd70d3
mov dword [esp + 0x2cc], 0x76e674d2
mov dword [esp + 0x2d0], 0x6a0968e3
mov dword [esp + 0x2d4], 0x6ec86cdd
mov dword [esp + 0x2d8], 0x62f260fd
mov dword [esp + 0x2dc], 0x66fa64fa
mov dword [esp + 0x2e0], 0x5a5958f9
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, edi
or edx, 0x47
mov ecx, eax
or ecx, 0x47
add ecx, edx
add ecx, eax
inc cl
xor cl, byte [esp + eax + 0x2c8]
add cl, 0xc8
mov byte [esp + eax + 0x2c8], cl
lea ecx, [eax + 1]
dec edi
mov eax, ecx
cmp ecx, 0x1c
jne 0x415760
movzx ecx, word [esi]
mov eax, ebx
test cx, cx
je 0x4157b1
add esi, 2
mov eax, ebx
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x4157a0
mov word [eax], 0
movzx ecx, word [esp + 0x2c8]
test cx, cx
je 0x4157e1
lea edx, [esp + 0x2ca]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4157d0
mov word [eax], 0
lea eax, [esp + 0x148]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043e830
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x444470]
Function at 0x41a220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41a327
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x41a258
mov ebp, ebx
mov esi, ebp
lea eax, [edi + 4]
add edi, 2
cmp edi, ecx
mov edi, eax
mov ebp, dword [esp + 0x18]
jae 0x41a329
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.0041e450
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.0041e450
add esp, 4
shl bh, 2
mov ah, al
shr ah, 4
and ah, 3
or ah, bh
mov ecx, esi
and ecx, 1
mov edx, esi
xor edx, 1
lea ebx, [edx + ecx*2]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov byte [edx + esi], ah
cmp edi, ecx
jae 0x41a240
mov byte [esp + 3], al
movzx eax, byte [ebp + edi]
push eax
call fcn.0041e450
add esp, 4
cmp al, 0x40
jne 0x41a2c0
mov ebp, ebx
mov ecx, dword [esp + 0x1c]
jmp 0x41a242
movzx edx, byte [esp + 3]
shl dl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, dl
lea ebp, [ebx + 1]
mov edx, dword [esp + 0x20]
mov byte [edx + ebx], cl
lea ecx, [edi + 1]
mov edx, dword [esp + 0x1c]
cmp ecx, edx
jae 0x41a320
mov esi, ebx
mov ebx, eax
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.0041e450
mov ecx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x41a242
shl bl, 6
add al, bl
mov edx, dword [esp + 0x20]
mov byte [edx + esi + 1], al
add esi, 2
mov ebp, esi
jmp 0x41a242
mov ecx, edx
jmp 0x41a242
xor esi, esi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x420280
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov dword [esp], 0xacabaa93
mov ecx, 0x249eaca1
mov edx, 0x5e
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x249eaca1]
mov edi, ecx
or edi, esi
not esi
or esi, edx
and esi, edi
add esi, 0xdb0a9af7
mov ebx, esi
xor ebx, 0xfe
or esi, 1
and ebx, esi
add ebx, esi
mov byte [esp + ecx - 0x249eaca1], bl
inc ecx
dec edx
cmp ecx, 0x249eaca5
jne 0x4202c0
lea ecx, [esp + 4]
mov edx, esp
push ecx
push 0x421bd0
push edx
push dword [eax + 8]
call fcn.00421fc0
add esp, 0x24
pop esi
pop edi
pop ebx
ret

Function at 0x421cf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
mov ecx, 0xfffffffe
nop
cmp word [edi + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x421d00
mov eax, ecx
sar eax, 1
and ecx, 0x12
xor eax, 9
add eax, ecx
jns 0x421d20
mov eax, 0xffffffff
jmp 0x421d22
add eax, eax
push eax
call fcn.004080f0
add esp, 4
mov esi, eax
mov dword [esp], 0x7319712c
mov dword [esp + 4], 0x770f7511
mov dword [esp + 8], 0x7b54794c
mov dword [esp + 0xc], 0x7f1c7d18
mov word [esp + 0x10], 0x8180
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x70
xor byte [esp + eax], cl
inc eax
cmp eax, 0x12
jne 0x421d60
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x421d91
add edi, 2
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x421d80
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x421dc1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x421db0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043e9d0
add esp, 8
mov ebx, dword [esp]
mov edi, eax
jmp dword [0x444b74]
Function at 0x423fba
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0x2bd006a
mov dword [esp + 8], 0x6a6049c
mov dword [esp + 0xc], 0x7ae578a6
mov dword [esp + 0x10], 0x7eed7c3a
mov dword [esp + 0x14], 0x723570ef
mov dword [esp + 0x18], 0x76e174d2
mov dword [esp + 0x1c], 0x6a0c68d6
lea eax, [esp + 0x20]
mov word [esp + 0x20], 0x6c6b
mov ecx, 0xb7
mov edx, 0x48
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 0x76
mov ebx, ecx
xor ebx, 0xf6
or ebx, esi
xor bl, byte [esp + ecx - 0xb3]
xor bl, 0xf6
add bl, 0x48
mov byte [esp + ecx - 0xb3], bl
inc ecx
dec edx
cmp ecx, 0xd5
jne 0x423f00
lea ebx, [esp + 0x6a]
lea ebp, [esp + 4]
mov edx, ebp
mov edi, ebx
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, esp
push eax
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x44a4dc]
mov dword [esp + 4], 0x6cabaa8a
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 4]
lea edi, [ecx + 0xa1]
mov edx, edi
or edx, esi
and edi, esi
sub edx, edi
add dl, 0xf8
mov byte [esp + ecx + 4], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 4
jb case.default.0x423fb3
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
jmp dword [ecx*4 + 0x4450cc]
mov esi, dword [esp]
test esi, esi
jns 0x423fd2
mov eax, 0xffffffff
jmp 0x423fd5
mov eax, dword [case.0x423fb3.4]
xor ebx, ebx
nop
jmp eax
lea eax, [esi + esi]
push eax
call fcn.004080f0
add esp, 4
mov ecx, esp
push ecx
push esi
mov edi, eax
push eax
push 0xe
push ebx
push 0
call dword [0x44a4dc]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4450e4]
mov eax, ebx
add esp, 0x88
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4277c8
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xd8]
shr eax, 1
mov ecx, eax
add ecx, 0x12
jns 0x4277e6
mov eax, 0xffffffff
jmp 0x4277ed
lea eax, [eax*2 + 0x24]
push eax
call fcn.004080f0
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x6a], 0x208c2e81
mov dword [esp + 0x6e], 0x249d229e
mov dword [esp + 0x72], 0x389e2683
mov dword [esp + 0x76], 0x3c973a9e
mov dword [esp + 0x7a], 0x30803e9e
mov dword [esp + 0x7e], 0x3495328f
mov dword [esp + 0x82], 0x890368c
mov dword [esp + 0x86], 0xcbd0a77
mov dword [esp + 0x8a], 0xa90ea9
mov word [esp + 0x8e], 0x201
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [eax + eax]
mov ebx, ecx
and ebx, 0xa
mov edx, eax
xor edx, 5
add edx, ebx
xor dl, byte [esp + eax + 0x6a]
add dl, 0xd8
mov byte [esp + eax + 0x6a], dl
and ecx, 2
xor eax, 1
add eax, ecx
cmp eax, 0x26
jb 0x427860
movzx ecx, word [esi]
mov ebx, dword [esp + 4]
mov eax, ebx
test cx, cx
je 0x4278b1
mov edx, esi
add edx, 2
mov eax, ebx
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4278a0
mov word [eax], 0
movzx ecx, word [esp + 0x6a]
test cx, cx
je 0x4278e1
lea edx, [esp + 0x6c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4278d0
mov word [eax], 0
jmp dword [0x4458e8]

Function at 0x4278ec
Capabilities:
Copy file

Disassembly:
push esi
call fcn.00408100
add esp, 4
xor eax, eax
cmp word [ebx], 0x2a
sete al
jmp dword [eax*4 + 0x4458f0]

Function at 0x427905
Capabilities:
Copy file
Encode data using xor

Disassembly:
xor eax, eax
cmp word [ebx], 0x2a
sete al
jmp dword [eax*4 + 0x4458f0]

Function at 0x427baf
Capabilities:
Encode data using xor

Disassembly:
push edi
call fcn.00408100
add esp, 4

Function at 0x427c45
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp ebp, edi
sete cl
xor eax, eax
jmp dword [ecx*4 + 0x445940]

Function at 0x427fb2
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
lea eax, [esp + 0xd0]
push 0
push eax
push dword [esp + 0x6c]
call fcn.0043eb60
add esp, 0xc
not eax
shr eax, 0x1f
mov dword [esp + 8], 0
mov dword [esp + 0x14], esi
mov dword [esp + 4], esi
jmp dword [eax*4 + 0x445988]
Function at 0x42890f
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xf8
mov dword [esp + 6], 0xbb7bb99d
mov dword [esp + 0xa], 0xbf4ebd4c
mov dword [esp + 0xe], 0x43a34184
mov dword [esp + 0x12], 0x47a745b0
mov dword [esp + 0x16], 0x4b4a496d
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [eax + eax]
mov esi, ecx
and esi, 0x30
mov edx, eax
xor edx, 0x78
add edx, esi
xor dl, byte [esp + eax + 6]
add dl, 0x40
mov byte [esp + eax + 6], dl
and ecx, 2
xor eax, 1
add eax, ecx
cmp eax, 0x14
jb 0x4288c0
lea esi, [esp + 0xe4]
lea eax, [esp + 6]
mov edi, esi
mov ecx, 5
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xf8]
lea eax, [esp + 0x1a]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x58]
push edi
push 0
push 0
push 9
push esi
push 0
call dword [0x44a4dc]
mov dword [esp + 6], 0x67a6a5c7
mov ecx, 0x2abec384
movzx edx, byte [esp + ecx - 0x2abec37e]
xor edx, ecx
mov ebx, edx
not ebx
and ebx, 0xad
and edx, 0x52
sub edx, ebx
add dl, 0x8d
mov byte [esp + ecx - 0x2abec37e], dl
inc ecx
cmp ecx, 0x2abec388
jne 0x428930
xor ecx, ecx
cmp eax, dword [esp + 6]
setne cl
jmp dword [ecx*4 + 0x445a80]
Function at 0x4389d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x14]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.0043e830
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447098]
Function at 0x4391a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 0xc], 0x200
mov dword [esp + 0x10], 0x100
mov dword [esp + 0x14], 0
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + ebx + 0xc]
mov ecx, 0x20019
or eax, ecx
push 0
push 0
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x40]
call fcn.0043ef20
add esp, 0x14
test eax, eax
js 0x439304
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x28]
call fcn.0043f2c0
add esp, 0x24
xor ebp, ebp
mov esi, 0
test eax, eax
js 0x43926d
mov eax, dword [esp + 4]
inc eax
push eax
call fcn.004080f0
add esp, 4
mov esi, eax
lea eax, [esp + 4]
push eax
push esi
push 0
push dword [esp + 0x40]
push dword [esp + 0x18]
call fcn.0043f870
add esp, 0x14
test eax, eax
js 0x439262
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x43926d
mov eax, dword [esp + 4]
mov dword [ecx], eax
jmp 0x43926d
push esi
call fcn.00408100
add esp, 4
xor esi, esi
mov eax, dword [esp + 8]
mov dword [esp], 0x1c1d1e1f
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + ebp]
mov edi, ecx
and edi, 0xffffffd6
xor edi, 0x410c8cd6
mov edx, ecx
xor edx, 0x410c8cd6
or ecx, 0x29
and ecx, edx
mov edx, edi
xor edx, ecx
not ecx
and ecx, edi
add edx, edi
sub edx, ecx
xor edx, ebp
xor dl, 0x36
mov byte [esp + ebp], dl
inc ebp
cmp ebp, 4
jne 0x439280
mov ecx, dword [0x44a4e0]
test ecx, ecx
je 0x439300
mov edx, dword [esp]
xor edi, edi
mov ebp, dword [0x44a4e4]
nop
nop
nop
nop
nop
cmp dword [ebp + edi*8], 0xb430e561
je 0x4392e1
inc edi
cmp ecx, edi
jne 0x4392d0
jmp 0x439300
mov ecx, dword [ebp + edi*8 + 4]
cmp ecx, edx
je 0x439300
push eax
push 4
push ecx
push dword [0x44a4e8]
call fcn.0043c7c0
add esp, 0x10
nop
nop
nop
nop
nop
test esi, esi
jne 0x439328
mov eax, esp
push eax
call fcn.0043e630
add esp, 4
cmp dword [esp], 1
sete cl
xor esi, esi
test al, cl
jne 0x439328
add ebx, 4
cmp ebx, 0xc
jne 0x4391d0
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b250
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x43b337
xor eax, eax
cmp dword [ecx], 0
jne 0x43b3c2
mov edx, dword [esp + 0x38]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x1c1d1e1f
xor eax, eax
mov esi, 0xffffffff
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax]
mov edi, eax
xor edi, 0x20
mov ebp, eax
xor ebp, 0x6f0b5d1f
or ebp, ebx
add edi, esi
not ebx
and edi, 0x37
xor edi, 0xf7
or edi, ebx
xor edi, ebp
mov ebx, edi
not ebx
and ebx, 1
neg edi
or edi, 1
sub ebx, edi
mov byte [esp + eax], bl
inc eax
add esi, 0xfffffffe
cmp eax, 4
jne 0x43b2c0
mov eax, dword [esp]
mov esi, dword [0x44a4e0]
test esi, esi
je 0x43b3c2
xor edi, edi
mov ebx, dword [0x44a4e4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xf62c6d34
je 0x43b3cc
inc edi
cmp esi, edi
jne 0x43b320
jmp 0x43b3c2
mov dword [esp + 4], 0xa4948af
mov eax, 0x9bd0af8b
mov ecx, 0x37a15f16
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x642f5079]
mov esi, eax
xor esi, 0xcb7a315c
mov edx, ecx
and edx, 0x21011d06
sub edx, esi
mov ebx, edx
and ebx, edi
mov ebp, ebx
and ebp, 0x3d
mov esi, ebx
or esi, 0xfffffffd
inc esi
imul esi, ebp
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
sub esi, ebx
add edx, edi
add esi, edx
mov edi, esi
and edi, 7
xor esi, 0x7d4c0e87
lea edi, [esi + edi*2]
and esi, 1
and edx, 1
lea edx, [edx + esi*2]
and edi, 0xfe
add edx, edi
mov byte [esp + eax + 0x642f5079], dl
inc eax
add ecx, 2
cmp eax, 0x9bd0af8f
jne 0x43b350
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43b3c2
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44a4e8]
call fcn.0043c7c0
add esp, 0x1c
jmp 0x43b3c2

Function at 0x43b400
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43b4bb
push ebp
push ebx
push edi
push esi
push eax
mov dword [esp], 0x1c1d1e1f
xor edx, edx
mov esi, 0xffffffff
nop
nop
nop
movzx ebx, byte [esp + edx]
mov edi, edx
xor edi, 0x20
mov ebp, edx
xor ebp, 0x6f0b5d1f
or ebp, ebx
add edi, esi
not ebx
and edi, 0x37
xor edi, 0xf7
or edi, ebx
xor edi, ebp
mov ebx, edi
not ebx
and ebx, 1
neg edi
or edi, 1
sub ebx, edi
mov byte [esp + edx], bl
inc edx
add esi, 0xfffffffe
cmp edx, 4
jne 0x43b420
mov edx, dword [0x44a4e0]
test edx, edx
je 0x43b4ae
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44a4e4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb430e561
je 0x43b490
inc edi
cmp edx, edi
jne 0x43b480
jmp 0x43b4ae
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43b4ae
push eax
push 4
push edx
push dword [0x44a4e8]
mov esi, ecx
call fcn.0043c7c0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret