joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408d40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x408daa
mov edx, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
not esi
or esi, 0x80000000
lea edi, [edx + esi]
inc edi
mov edx, dword [ecx + eax + 0x9c8]
mov esi, edx
and esi, 0x7fffffff
or esi, edi
mov edi, esi
shr edi, 1
and esi, 1
neg esi
xor edi, dword [ecx + eax + 0xff8]
and esi, 0x9908b0df
xor edi, esi
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x408d60
mov eax, 0x270
jmp 0x408dbc
cmp eax, 0x4e0
jb 0x408dbc
mov esi, ecx
call fcn.00408e00
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov ecx, edx
shl ecx, 7
and ecx, 0x9d2c5680
xor ecx, edx
mov eax, ecx
shl eax, 0xf
and eax, 0xefc60000
xor eax, ecx
mov edx, eax
shr edx, 0x12
not eax
or eax, edx
not edx
or edx, ecx
and eax, edx
not eax
pop esi
pop edi
ret

Function at 0x408e00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
mov esi, dword [ecx + eax*4 - 0x630]
mov edi, esi
and edi, 0x7ffffffe
and edx, 0x80000000
or edx, edi
shr edx, 1
mov edi, esi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4]
xor edi, edx
mov dword [ecx + eax*4 - 0xff4], edi
inc eax
mov edx, esi
cmp eax, 0x4e1
jne 0x408e10
mov ebx, dword [ecx + 0xd50]
mov eax, 0xe4
mov edx, 0x1c6
nop
nop
nop
nop
mov esi, ebx
or esi, 0x80000000
xor ebx, 0x7fffffff
and ebx, esi
mov esi, dword [ecx + eax*4 + 0x9c4]
mov edi, esi
and edi, 0x7fffffff
or edi, ebx
mov ebx, edi
shr ebx, 1
and edi, 1
neg edi
and edi, 0x9908b0df
mov ebp, edi
and ebp, ebx
add edi, ebx
lea ebx, [eax - 1]
add ebp, ebp
sub edi, ebp
xor ebx, 0x3ffffd8f
mov ebp, edx
and ebp, 0x31e
add ebp, ebx
mov ebx, dword [ecx + ebp*4 + 0x63c]
mov ebp, edi
and ebp, ebx
add edi, ebx
add ebp, ebp
sub edi, ebp
mov dword [ecx + eax*4], edi
inc eax
add edx, 2
mov ebx, esi
cmp eax, 0x270
jne 0x408e60
mov eax, SysReAllocString
and eax, dword [ecx + 0x1380]
mov edx, dword [ecx + 4]
mov esi, edx
and esi, 0x7fffffff
or eax, esi
shr eax, 1
xor edx, 0x7ffffffe
and edx, esi
je 0x408ef7
mov edx, 0x9908b0df
xor eax, dword [ecx + 0x634]
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, ecx
mov dword [ecx + 4], 0
lea eax, [ecx + 8]
mov dword [esp + 4], eax
mov dword [ecx + 8], 0
lea edi, [ecx + 0x10]
xor ebx, ebx
xor eax, eax
mov ecx, 0x13
mov dword [esp + 8], edi
rep stosd dword es:[edi], eax
mov dword [edx + 0x80], 0
mov dword [esp + 0xc], edx
lea esi, [edx + 0x60]
call fcn.00408ad0
mov ecx, eax
mov edx, 0xaaaaaaab
mul edx
shr edx, 1
and edx, 0xfffffffc
lea eax, [edx + edx*2]
neg eax
lea edi, [ecx + eax]
add edi, 8
mov ebp, 0x38e38e39
mov dword [esp], esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.00408ad0
mov ecx, eax
imul ebp
mov eax, edx
shr eax, 0x1f
sar edx, 3
add edx, eax
shl edx, 2
lea eax, [edx + edx*8]
neg eax
movzx eax, byte [ecx + eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov byte [esi], al
inc esi
mov eax, ebx
xor eax, 1
and ebx, 1
lea ebx, [eax + ebx*2]
cmp ebx, edi
jb 0x409030
mov byte [esi], 0
mov esi, dword [esp + 0xc]
movzx eax, byte [esp + 0x24]
mov byte [esi], al
xor eax, eax
mov edi, dword [esp + 4]
mov ecx, 0x16
rep stosd dword es:[edi], eax
xor eax, eax
mov edi, dword [esp]
xor ecx, ecx
rep stosw word es:[edi], ax
mov dword [esi + 8], 9
push 0x400
push 0
push dword [esp + 0x10]
call fcn.00404670
add esp, 0xc
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x40bf40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov ebp, dword [esp + 0x468]
mov dword [esp + 0x3c], 0x9705992d
mov dword [esp + 0x40], 0x930b9512
mov dword [esp + 0x44], 0x8f1a9104
mov dword [esp + 0x48], 0x8bd98d2d
mov dword [esp + 0x4c], 0x87d489c5
mov dword [esp + 0x50], 0x83e285d4
mov dword [esp + 0x54], 0xff5581d8
mov dword [esp + 0x58], 0xfb68fd65
mov dword [esp + 0x5c], 0xf765f964
mov dword [esp + 0x60], 0xf37df57f
mov dword [esp + 0x64], 0xef5cf190
mov dword [esp + 0x68], 0xeb8aed40
mov dword [esp + 0x6c], 0xe7b6e9b9
mov dword [esp + 0x70], 0xe3b2e5b6
mov dword [esp + 0x74], 0xdfbee1a7
mov dword [esp + 0x78], 0xdb43dd77
mov dword [esp + 0x7c], 0xd79cd94a
mov dword [esp + 0x80], 0xd395d598
mov dword [esp + 0x84], 0xcf46d1b0
mov dword [esp + 0x88], 0xcb86cd86
mov dword [esp + 0x8c], 0xc7a6c991
mov dword [esp + 0x90], 0xc352c585
mov dword [esp + 0x94], 0x3faac150
mov dword [esp + 0x98], 0x3b913da1
mov dword [esp + 0x9c], 0x37a839a5
mov dword [esp + 0xa0], 0x33ab3583
mov dword [esp + 0xa4], 0x2f7d31bc
mov dword [esp + 0xa8], 0x2b652d61
mov dword [esp + 0xac], 0x27742963
mov dword [esp + 0xb0], 0x2368256b
mov dword [esp + 0xb4], 0x1f462140
mov dword [esp + 0xb8], 0x1ba21dab
mov dword [esp + 0xbc], 0x17a319b4
mov dword [esp + 0xc0], 0x134615a0
mov dword [esp + 0xc4], 0xf9a1170
mov dword [esp + 0xc8], 0xb9d0d95
mov dword [esp + 0xcc], 0x7660995
mov dword [esp + 0xd0], 0x39f05bf
mov dword [esp + 0xd4], 0x7fe9019f
mov dword [esp + 0xd8], 0x7b237def
mov dword [esp + 0xdc], 0x77c97918
mov dword [esp + 0xe0], 0x73fc75ec
mov dword [esp + 0xe4], 0x6ffb71e3
mov dword [esp + 0xe8], 0x6b396df1
mov dword [esp + 0xec], 0x67376939
mov dword [esp + 0xf0], 0x6330652d
mov dword [esp + 0xf4], 0x5f0c6130
mov dword [esp + 0xf8], 0x5b085d0c
mov dword [esp + 0xfc], 0x57365908
mov dword [esp + 0x100], 0x53f355fb
mov dword [esp + 0x104], 0x4fef51ca
mov dword [esp + 0x108], 0x4bd34dc2
mov dword [esp + 0x10c], 0x470b491b
mov dword [esp + 0x110], 0x4309450b
mov dword [esp + 0x114], 0xbff14112
mov dword [esp + 0x118], 0xbbbabdf6
mov eax, dword [0x44bf60]
mov ecx, 0xa6
mov edx, 0xa3b54259
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x6a]
mov ebx, ecx
xor ebx, edx
and ebx, esi
xor ebx, edx
lea esi, [ebx + ebx]
and esi, 0x45008782
xor esi, 0x65149782
mov edi, ebx
xor edi, 0xcd75b43e
add edi, esi
and ebx, 1
mov esi, edi
add ebx, edi
and edi, 0xfe
xor esi, 1
add ebx, esi
sub ebx, edi
mov byte [esp + ecx - 0x6a], bl
inc ecx
dec edx
cmp ecx, 0x186
jne 0x40c1a0
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
xor edx, edx
test eax, eax
setne dl
mov ecx, 0xe49d08db
xor ecx, dword [0x445ef4]
mov edx, dword [edx*4 + 0x445eec]
add ecx, edx
inc ecx
xor edi, edi
mov dword [esp], 0
mov ebx, dword [esp + 0x464]
jmp ecx
Function at 0x40cac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x224
push eax
sub esp, 0x28
mov dword [ebp - 0x10], esp
sub esp, 8
mov ebx, esp
push eax
mov edi, esp
mov eax, dword [0x44bf60]
mov dword [ebp - 0x230], 0x33a53185
mov dword [ebp - 0x22c], 0x2fb72da6
mov dword [ebp - 0x228], 0x2bbe29bc
mov dword [ebp - 0x224], 0x27f12585
mov dword [ebp - 0x220], 0x23f421ed
mov dword [ebp - 0x21c], 0x1ffe1dcc
mov dword [ebp - 0x218], 0x1bb519c0
mov dword [ebp - 0x214], 0x1780158d
mov dword [ebp - 0x210], 0x1385118c
mov dword [ebp - 0x20c], 0xf9d0d83
mov dword [ebp - 0x208], 0xbbc09e8
mov dword [ebp - 0x204], 0x7e605a8
mov dword [ebp - 0x200], 0x3d201d1
mov dword [ebp - 0x1fc], 0xff2efd2a
mov dword [ebp - 0x1f8], 0xfb1af933
mov dword [ebp - 0x1f4], 0xf76ff55b
mov dword [ebp - 0x1f0], 0xf33cf166
mov dword [ebp - 0x1ec], 0xef25ed20
mov dword [ebp - 0x1e8], 0xeb62e908
mov dword [ebp - 0x1e4], 0xe72ae52a
mov dword [ebp - 0x1e0], 0xe302e139
mov dword [ebp - 0x1dc], 0xdf4edd1d
mov dword [ebp - 0x1d8], 0xdb4ed948
mov dword [ebp - 0x1d4], 0xd779d549
mov dword [ebp - 0x1d0], 0xd370d14d
mov dword [ebp - 0x1cc], 0xcf57cd77
mov dword [ebp - 0x1c8], 0xcb1dc944
mov dword [ebp - 0x1c4], 0xc715c509
mov dword [ebp - 0x1c0], 0xc314c10f
mov dword [ebp - 0x1bc], 0xbf70bd6f
mov dword [ebp - 0x1b8], 0xbb62b958
mov dword [ebp - 0x1b4], 0xb70eb50f
mov dword [ebp - 0x1b0], 0xb307b11c
mov dword [ebp - 0x1ac], 0xaf7aad18
mov dword [ebp - 0x1a8], 0xab3ea948
mov dword [ebp - 0x1a4], 0xa73da53d
mov dword [ebp - 0x1a0], 0xa342a13d
mov dword [ebp - 0x19c], 0x9f039d23
mov dword [ebp - 0x198], 0x9b01993b
mov dword [ebp - 0x194], 0x974f9503
mov dword [ebp - 0x190], 0x93519170
mov dword [ebp - 0x18c], 0x8f1c8d14
mov dword [ebp - 0x188], 0x8b1f891f
mov dword [ebp - 0x184], 0x87518519
mov dword [ebp - 0x180], 0x83538151
mov dword [ebp - 0x17c], 0x7fa87db5
mov dword [ebp - 0x178], 0x7bac79a8
mov dword [ebp - 0x174], 0x77a075a4
mov dword [ebp - 0x170], 0x739271a0
mov dword [ebp - 0x16c], 0x6fcf6ddf
mov dword [ebp - 0x168], 0x6bcb69f6
mov dword [ebp - 0x164], 0x67ff65f6
mov dword [ebp - 0x160], 0x63af61b7
mov dword [ebp - 0x15c], 0x5f915d8f
mov dword [ebp - 0x158], 0x5b89598e
mov dword [ebp - 0x154], 0x5756559a
mov word [ebp - 0x150], 0
mov ecx, 0x6f482acc
nop
nop
movzx edx, byte [ebp + ecx - 0x6f482cfc]
xor edx, ecx
add edx, 0xd3972a03
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [ebp + ecx - 0x6f482cfc], dl
inc ecx
cmp ecx, 0x6f482bae
jne 0x40cd20
lea esi, [ebp - 0x230]
push 0
push 0
push 0
push 0
push esi
call eax
xor ecx, ecx
mov dword [ebp - 0x18], eax
test eax, eax
setne cl
mov eax, dword [ecx*4 + 0x446158]
mov ecx, 0xa0ea85d7
xor ecx, dword [0x446160]
add eax, ecx
inc eax
jmp eax
Function at 0x418980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x460
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x4189a0
sar esi, 1
lea ecx, [esp + 0x98]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44d2b4]
mov dword [esp + 4], eax
mov dword [esp + 0x120], 0x914e4f29
mov dword [esp + 0x124], 0
xor ebx, ebx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx + 0x120]
mov edi, edx
xor edi, 0x5ec40e93
mov ecx, ebx
and ecx, 8
sub ecx, edi
xor ecx, eax
mov eax, ecx
and eax, 0x5e
xor ecx, 0xde
lea eax, [ecx + eax*2]
inc al
mov byte [esp + edx + 0x120], al
inc edx
add ebx, 2
cmp edx, 8
jne case.default.0x418a39
xor eax, eax
mov ecx, dword [esp + 4]
cmp ecx, dword [esp + 0x120]
setne al
jmp dword [eax*4 + 0x446a64]
mov ebx, dword [esp + 0x98]
test ebx, ebx
jns 0x418a62
mov eax, 0xffffffff
jmp 0x418a65
mov ecx, dword [case.0x418a39.4]
xor eax, eax
nop
nop
nop
nop
nop
nop
jmp ecx
lea eax, [ebx + ebx]
push eax
call fcn.00408380
add esp, 4
lea ecx, [esp + 0x98]
push ecx
push ebx
mov ebx, eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44d2b4]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446a7c]
xor eax, eax
jmp dword [0x446a84]
push ebx
jmp 0x418eac
mov eax, dword [esp + 0x98]
mov ecx, eax
add ecx, 0xd
jns 0x418ab8
mov eax, 0xffffffff
jmp 0x418abf
lea eax, [eax*2 + 0x1a]
push eax
call fcn.00408380
add esp, 4
mov edi, eax
mov dword [esp + 0x120], 0x71420fb0
mov dword [esp + 0x124], 0x75e773d3
mov dword [esp + 0x128], 0x791677e0
mov dword [esp + 0x12c], 0x7ddd7bce
mov dword [esp + 0x130], 0x61eb7fee
mov dword [esp + 0x134], 0x65f363cb
mov dword [esp + 0x138], 0x696667ca
mov word [esp + 0x13c], 0
mov eax, 0x3d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xe3]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xcf
mov byte [esp + eax + 0xe3], cl
inc eax
cmp eax, 0x5b
jne 0x418b30
movzx ecx, word [ebx]
mov eax, edi
test cx, cx
je 0x418b81
lea edx, [ebx + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418b70
mov word [eax], 0
movzx ecx, word [esp + 0x120]
test cx, cx
mov dword [esp + 0x60], ebx
je 0x418bb1
lea edx, [esp + 0x122]
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418ba0
mov word [eax], 0
lea eax, [esp + 0x2a0]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.0043ff30
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446a8c]
call fcn.00408390
add esp, 4
xor eax, eax
jmp case.0x418a39.4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41df00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push eax
sub esp, 0x30
mov dword [ebp - 0x50], esp
sub esp, 0x14
mov dword [ebp - 0x54], esp
sub esp, 0x34
mov dword [ebp - 0x20], esp
sub esp, 0x1c
mov dword [ebp - 0x4c], esp
sub esp, 8
mov dword [ebp - 0x48], esp
xor eax, eax
test esi, esi
setne al
mov dword [ebp - 0x18], 0
xor ebx, ebx
jmp dword [eax*4 + 0x446ed0]
Function at 0x420970
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [eax + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x420980
sar ebp, 1
lea ecx, [esp + 8]
push ecx
push 0
push 0
push ebp
push eax
push 0
call dword [0x44d2b4]
mov dword [esp + 0xc], 0xb7760967
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0xc]
lea edx, [ecx - 0x25eecd42]
mov edi, 1
sub edi, ecx
lea ebx, [ecx + 0x3e]
and edi, 0x3f
and ebx, 0x3f
xor ebx, 0x140c83f
and edx, 0xc21112c0
or edx, edi
or edx, ebx
xor edx, esi
xor edx, 0x1940e83f
mov esi, 0x4255fdb6
sub esi, edx
or esi, 1
add esi, edx
add esi, 0xbdaa024a
mov ebx, esi
and ebx, 2
mov edi, esi
or esi, 2
imul esi, ebx
xor ebx, 2
and edi, 0xfd
imul edi, ebx
lea ebx, [edx + edx]
or ebx, 0xfd
add ebx, edx
add ebx, esi
add ebx, edi
add bl, 0x4b
mov byte [esp + ecx + 0xc], bl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 7
jb case.default.0x420a53
xor ecx, ecx
cmp eax, dword [esp + 0xc]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x4470a0]
mov ebx, dword [esp + 8]
test ebx, ebx
jns 0x420a69
mov eax, 0xffffffff
jmp 0x420a6c
lea eax, [ebx + ebx]
push eax
call fcn.00408380
add esp, 4
mov esi, eax
lea eax, [esp + 8]
push eax
push ebx
push esi
push ebp
push dword [esp + 0x48]
push 0
call dword [0x44d2b4]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4470a8]
xor ebx, ebx
jmp dword [0x4470b0]
push esi
call fcn.00408390
add esp, 4
xor ebx, ebx
jmp case.0x420a53.1
lea edi, [esp + 0xc]
push edi
push esi
call fcn.004400e0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4470b8]
xor ecx, ecx
test byte [esp + 0xc], 0x10
sete cl
mov eax, 1
jmp dword [ecx*4 + 0x4470c0]
jmp dword [0x4470c8]
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422580
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x422590
cmp eax, 0xffffffed
jge 0x4225a7
mov eax, 0xffffffff
jmp 0x4225aa
add eax, 0x12
push eax
call fcn.00408380
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp], 0x77c179dc
mov dword [esp + 4], 0x73fb75c9
mov dword [esp + 8], 0x4fbc71bc
mov dword [esp + 0xc], 0x4bf44df0
mov word [esp + 0x10], 0x4948
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
mov ebp, 0x5bef6616
mov esi, 0xe9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ebp - 0x5bef6616]
lea eax, [esi - 0x80]
and eax, 0x7c
mov edx, ebp
and edx, 3
or edx, eax
xor edx, 0x7c
and edx, ebx
mov ecx, esi
and ecx, ebx
mov eax, ebp
xor eax, ebx
add eax, ebx
not eax
add eax, ecx
or eax, edx
mov cl, 0x91
sub cl, al
mov byte [esp + ebp - 0x5bef6616], cl
inc ebp
dec esi
cmp ebp, 0x5bef662d
jne 0x422600
movzx ecx, word [edi]
mov esi, dword [esp + 0x18]
mov eax, esi
test cx, cx
je 0x422671
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x422660
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4226a1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x422690
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.004400e0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x447190]
Function at 0x425080
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10d0
call fcn.00408260
push eax
mov dword [ebp - 0x5c], esp
sub esp, 0xa4
mov dword [ebp - 0x54], esp
sub esp, 0xa4
mov dword [ebp - 0x84], esp
sub esp, 0xe8
mov dword [ebp - 0x50], esp
sub esp, 0xec
mov dword [ebp - 0x80], esp
sub esp, 0xa4
mov dword [ebp - 0x4c], esp
sub esp, 0xa4
mov dword [ebp - 0x30], esp
sub esp, 0xa4
mov dword [ebp - 0x48], esp
sub esp, 0xa8
mov dword [ebp - 0x7c], esp
sub esp, 0xa4
mov dword [ebp - 0x78], esp
sub esp, 0xa4
mov dword [ebp - 0x74], esp
sub esp, 0x14
mov dword [ebp - 0x88], esp
sub esp, 0x200
mov dword [ebp - 0x60], esp
sub esp, 0x18
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x68], esp
push eax
sub esp, 0x7fc
mov dword [ebp - 0x2c], esp
push eax
mov dword [ebp - 0x8c], esp
push eax
mov dword [ebp - 0x90], esp
sub esp, 0x400
mov dword [ebp - 0x28], esp
push eax
mov dword [ebp - 0x3c], esp
sub esp, 0x10
mov dword [ebp - 0x10], esp
sub esp, 0x18
mov dword [ebp - 0x18], esp
sub esp, 0x28
mov dword [ebp - 0x94], esp
mov dword [ebp - 0x10dc], 0x134011b4
mov dword [ebp - 0x10d8], 0x6f316d31
mov dword [ebp - 0x10d4], 0x6b396931
mov dword [ebp - 0x10d0], 0x673465c8
mov dword [ebp - 0x10cc], 0x63c661c9
mov dword [ebp - 0x10c8], 0x7f2d7dd1
mov dword [ebp - 0x10c4], 0x7b287925
mov dword [ebp - 0x10c0], 0x7574
mov byte [ebp - 0x10bc], 0
mov eax, 0x8a69373c
mov ecx, 0xc3
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebp + eax + 0x7596b7e8]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
mov edi, edx
not edi
add edi, edi
and edi, 2
sub edx, edi
add edx, 0x4bf1ebd4
mov esi, edx
and esi, edi
xor edx, edi
lea edx, [edx + esi*2]
mov byte [ebp + eax + 0x7596b7e8], dl
inc eax
dec ecx
cmp eax, 0x8a69375d
jne 0x4251b0
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x10dc]
push 0
push 0
push 0x20019
push eax
mov dword [ebp - 0x14], ecx
push ecx
call fcn.00440620
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0x4477ac]
Function at 0x429207
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [esp + 0x58]
test edi, edi
jns 0x429228
mov eax, 0xffffffff
jmp 0x42922b
lea eax, [edi + edi]
push eax
call fcn.00408380
add esp, 4
push esi
push edi
mov dword [esp + 0x44], eax
push eax
push 9
push ebx
push 0
call dword [0x44d2b4]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448204]
Function at 0x42bec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
cmp esi, 0x24
ja 0x42bf1a
cmp esi, 1
je 0x42bf1a
mov edi, dword [esp + 0x38]
mov ebx, edi
jmp 0x42bef1
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x42bef0
cmp ecx, 0x20
je 0x42bef0
cmp ecx, 0x2b
mov edx, esi
je 0x42bf10
cmp ecx, 0x2d
jne 0x42bf30
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x42bf35
xor edi, edi
test ebp, ebp
je 0x42c109
mov dword [ebp], 0x16
jmp 0x42c109
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], edi
jle 0x42bf5e
cmp edx, 0x10
jne 0x42bf76
cmp byte [ebx], 0x30
jne 0x42bf57
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x42bf78
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x42bf78
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x18], ecx
sub eax, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
xor edx, edx
div edi
mov dword [esp + 0x1c], eax
xor esi, esi
mov dword [esp + 8], 0
mov edx, edi
mov dword [esp + 0x20], edi
inc ebx
jmp 0x42bfd2
mov esi, ecx
mov dword [esp + 8], 0
mov ebp, dword [esp + 0x44]
test ebp, ebp
je 0x42c0a0
mov dword [ebp], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, esi
movsx esi, byte [ebx - 1]
lea eax, [esi - 0x30]
cmp eax, 0xa
jae 0x42bff0
and esi, 0xf
cmp esi, edx
jl 0x42c015
jmp 0x42c0d4
mov eax, esi
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp eax, 0x1a
jae 0x42c0d4
mov eax, esi
not eax
or eax, 0xffffffdf
add esi, eax
add esi, 0xffffffca
cmp esi, edx
jge 0x42c0d4
mov eax, edi
mov ecx, dword [esp + 0xc]
xor eax, ecx
mov ebp, dword [esp + 8]
or eax, ebp
je 0x42bfb0
mov dword [esp + 0x14], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x1c], edi
mov edi, 0
sbb edi, ebp
setae bl
jae 0x42c050
xor edx, edx
mov ebp, dword [esp + 0xc]
jmp 0x42c059
imul ebp, ecx
add edx, ebp
mov ebp, dword [esp + 4]
mov ecx, esi
sar ecx, 0x1f
mov edi, dword [esp + 0xc]
sub edi, esi
sbb eax, ecx
add esi, ebp
adc ecx, edx
mov dword [esp + 8], ecx
cmp edi, ebp
mov ecx, dword [esp + 0xc]
sbb eax, edx
setae al
jae 0x42c085
mov dword [esp + 8], 0
mov esi, ecx
and bl, al
mov ebp, dword [esp + 0x44]
test ebp, ebp
mov edx, dword [esp + 0x20]
je 0x42c0bb
test bl, bl
jne 0x42c0bb
mov ebx, dword [esp + 0x14]
jmp 0x42bfc6
mov dword [esp + 0x10], 0x22
mov dword [esp + 4], ebx
mov esi, ecx
mov dword [esp + 8], 0
jmp 0x42bfac
test bl, bl
jne 0x42c0c7
mov dword [esp + 0x10], 0x22
mov ebx, dword [esp + 0x14]
mov dword [esp + 4], ebx
jmp 0x42bfac
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x42c0e2
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x44]
test ecx, ecx
mov eax, dword [esp + 0x10]
je 0x42c0f0
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x42c100
mov edi, SysReAllocString
sub edi, dword [esp + 0x18]
jmp 0x42c109
cmp byte [esp + 3], 0
jne 0x42c109
neg edi
mov eax, edi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret