joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
cmp dword [ecx + 8], 0
je 0x43a7d0
mov eax, dword [ecx]
test eax, eax
je 0x43a7d0
mov dword [esp + 0xc], eax
mov dword [esp], 0xd1d2d3d4
xor esi, esi
nop
nop
nop
movzx ebx, byte [esp + esi]
mov edx, esi
and edx, 2
mov edi, esi
or edi, 2
imul edi, edx
xor edx, 2
mov eax, esi
and eax, 1
neg eax
and eax, edx
mov edx, esi
xor edx, 0xfa2b9fc3
add edx, eax
add edx, edi
xor edx, ebx
mov eax, edx
and eax, 0x67
xor edx, 0xe7
lea eax, [edx + eax*2]
inc al
mov byte [esp + esi], al
inc esi
cmp esi, 4
jne 0x43a760
mov eax, dword [esp]
mov ebx, dword [0x4494c0]
test ebx, ebx
je 0x43a83b
xor edi, edi
mov esi, dword [0x4494c4]
nop
nop
nop
cmp dword [esi + edi*8], 0xddb7c3f3
je 0x43a817
inc edi
cmp ebx, edi
jne 0x43a7c0
jmp 0x43a83b
mov dword [esp], 0x6625241b
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
mov esi, 4
sub esi, eax
lea ecx, [eax + 0xfb]
or ecx, edx
not edx
or edx, esi
and ecx, edx
add cl, 0x28
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x43a7e0
mov eax, dword [esp]
jmp 0x43a931
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
je 0x43a83b
push dword [ebp + 8]
push dword [esp + 0x10]
push 8
push esi
push dword [0x4494c8]
mov esi, ecx
call fcn.0043ba90
mov ecx, esi
add esp, 0x14
cmp dword [ebp + 0xc], 0
je 0x43a924
cmp eax, 0xc000010a
jne 0x43a924
mov edx, 0xffffd8f0
mov esi, dword [ebp + 0xc]
mov eax, esi
mul edx
sub edx, esi
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [ecx]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0xd1d2d3d4
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x10]
mov edx, eax
and edx, 2
mov ebx, eax
or ebx, 2
imul ebx, edx
xor edx, 2
mov esi, eax
and esi, 1
neg esi
and esi, edx
mov edx, eax
xor edx, 0xfa2b9fc3
add edx, esi
add edx, ebx
xor edx, edi
mov esi, edx
and esi, 0x67
xor edx, 0xe7
lea edx, [edx + esi*2]
inc dl
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 4
jne 0x43a880
xor edi, edi
cmp dword [ebp + 0xc], 0xffffffff
je 0x43a8d0
mov edi, esp
mov eax, dword [esp + 0x10]
mov esi, dword [0x4494c0]
test esi, esi
je 0x43a924
xor ebx, ebx
mov edx, dword [0x4494c4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ebx*8], 0xa67d73aa
je 0x43a900
inc ebx
cmp esi, ebx
jne 0x43a8f0
jmp 0x43a924
mov edx, dword [edx + ebx*8 + 4]
cmp edx, eax
je 0x43a924
push edi
push 0
push dword [esp + 0x14]
push 0xc
push edx
push dword [0x4494c8]
mov esi, ecx
call fcn.0043ba90
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43a931
mov esi, eax
call fcn.0043a670
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x43d120
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push eax
mov dword [esp], 0x858483d2
mov eax, 0x6bb5c9ed
mov ecx, esp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ecx]
mov edi, eax
and edi, 0x4224082e
lea edx, [eax - 0x80000000]
and edx, 0xa991c1c1
or edx, edi
xor esi, 0x522c1e2e
xor edx, 0xadd3e1d1
mov edi, esi
and edi, edx
add edx, esi
add edi, edi
sub edx, edi
add dl, 0x70
mov byte [ecx], dl
dec eax
inc ecx
cmp eax, 0x6bb5c9e9
jne 0x43d140
mov eax, dword [esp]
mov eax, dword fs:[eax]
add esp, 4
pop esi
pop edi
ret

Function at 0x43d520
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add bh, al
test byte [esp + ecx*8], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x35], ch
add byte [esi], ah
mov edi, edi
xor eax, 0x4494cc
call fcn.0043d520
add esp, 8
lea ecx, [esp + 0xc8]
lea edx, [esp + 0xd0]
push ecx
push 1
push 0
push 0
push edx
push 0
lea ecx, [esp + 0x3c]
push ecx
call eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x444b9c]
movzx edx, byte [esp + eax + 0x24]
lea ecx, [eax + edx]
lea esi, [eax + 0x37]
and esi, edx
add esi, esi
sub ecx, esi
int1
int1
add ecx, 0x2c24b437
mov esi, ecx
sub al, 0x89
into
and esi, 0xc001645
mov edi, ecx
and edi, 2
mov edx, edi
xor edx, 2
imul edx, esi
or esi, 2
imul esi, edi
xor ecx, 0x9eda5e47
add edx, ecx
add edx, esi
and ecx, 1
xor edx, 1
lea ecx, [edx + ecx*2]
mov byte [esp + eax + 0x24], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x1e
jb 0x4280d0
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 8]
sub eax, esi
mov ecx, dword [esp + 0xfc]
push eax
push esi
lea eax, [esp + 0x2c]
push eax
call fcn.00409b30
jmp dword [0x444bdc]
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x48]
movzx eax, word [eax]
mov dword [esp + 8], 0x101fb440
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 8]
lea esi, [ecx - 0x5d100b4b]
mov ebx, 0x5d100b4a
sub ebx, ecx
mov ebp, ebx
or ebp, edx
mov edi, 0x4a
sub edi, ecx
and edi, edx
xor edi, ebp
and edi, esi
add edi, edi
xor esi, edi
and edi, ebx
add edx, esi
add edx, 0xe8805a57
add edi, edi
mov esi, edx
sub esi, edi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + ecx + 8], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 4
jb case.default.0x43d59d
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
jmp dword [ecx*4 + 0x446d18]
Function at 0x43da20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43da40
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x43da5b
mov eax, 0xffffffff
jmp 0x43da5e
add eax, 0xa
push eax
call fcn.00408b20
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43daa1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43da90
mov word [ecx], 0
lea ecx, [edi*2 + 8]
mov word [esp + 8], cx
lea ecx, [edi*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xc1c2c3c4
xor ecx, ecx
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x53
xor dl, byte [esp + ecx]
add dl, 0x68
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 4
jb 0x43db00
mov esi, dword [esp]
mov ecx, dword [0x4494c0]
test ecx, ecx
je 0x43db8f
xor edx, edx
mov edi, dword [0x4494c4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x5f7891a5
je 0x43db50
inc edx
cmp ecx, edx
jne 0x43db40
jmp 0x43db8f
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43db8f
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push ebx
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x4494c8]
mov edi, eax
call fcn.0043ba90
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408b30
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43dbb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + eax + 2], 0
lea eax, [eax + 2]
jne 0x43dbd0
mov ebx, eax
sar ebx, 1
and eax, 8
mov ecx, ebx
xor ecx, 4
lea esi, [ecx + eax]
add eax, ecx
inc eax
test eax, eax
jns 0x43dbf8
mov eax, 0xffffffff
jmp 0x43dbff
lea eax, [esi*2 + 2]
push eax
call fcn.00408b20
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebp]
test dx, dx
je 0x43dc42
add ebp, 2
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebp]
add ebp, 2
test dx, dx
jne 0x43dc30
mov word [ecx], 0
mov ecx, esi
and ecx, 0xfffd
and ebx, 2
mov edx, ebx
xor edx, 2
imul edx, ecx
or esi, 2
imul esi, ebx
add esi, edx
mov word [esp + 8], si
mov ecx, esi
and ecx, 2
xor esi, 2
lea ecx, [esi + ecx*2]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xc1c2c3c4
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x53
xor dl, byte [esp + ecx]
add dl, 0x68
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 4
jb 0x43dcc0
mov esi, dword [esp]
mov ecx, dword [0x4494c0]
test ecx, ecx
je 0x43dd44
xor edx, edx
mov ebx, dword [0x4494c4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x75935cf9
je 0x43dd10
inc edx
cmp ecx, edx
jne 0x43dd00
jmp 0x43dd44
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43dd44
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x4494c8]
mov edi, eax
call fcn.0043ba90
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408b30
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43dd60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43dd80
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43dd9b
mov eax, 0xffffffff
jmp 0x43dd9e
add eax, 0xa
push eax
call fcn.00408b20
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x43dde1
add ebx, 2
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x43ddd0
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp], dx
add ecx, edi
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xc1c2c3c4
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
add dl, 0x53
xor dl, byte [esp + ecx + 0x20]
add dl, 0x68
mov byte [esp + ecx + 0x20], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 4
jb 0x43de50
mov esi, dword [esp + 0x20]
mov ecx, dword [0x4494c0]
test ecx, ecx
je 0x43dec9
xor edx, edx
mov edi, dword [0x4494c4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xcaa82e26
je 0x43dea0
inc edx
cmp ecx, edx
jne 0x43de90
jmp 0x43dec9
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43dec9
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x4494c8]
mov edi, eax
call fcn.0043ba90
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.00408b30
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43dedf
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43def0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xc1c2c3c4
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x53
xor cl, byte [esp + eax]
add cl, 0x68
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x43df10
mov eax, dword [esp]
mov edx, dword [0x4494c0]
test edx, edx
je 0x43df88
xor ebx, ebx
mov ecx, dword [0x4494c4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa269eeef
je 0x43df60
inc ebx
cmp edx, ebx
jne 0x43df50
jmp 0x43df88
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43df88
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x4494c8]
call fcn.0043ba90
add esp, 0x20
test edi, edi
je 0x43df92
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43df9e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43dfb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], 0xc1c2c3c4
xor eax, eax
nop
nop
nop
mov ebx, eax
add bl, 0x53
xor bl, byte [esp + eax + 4]
add bl, 0x68
mov byte [esp + eax + 4], bl
mov edi, eax
and edi, 1
xor eax, 1
lea eax, [eax + edi*2]
cmp eax, 4
jb 0x43dfd0
mov eax, dword [esp + 4]
mov ebx, dword [0x4494c0]
test ebx, ebx
je 0x43e04e
xor ebp, ebp
mov edi, dword [0x4494c4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xe88ddea1
je 0x43e020
inc ebp
cmp ebx, ebp
jne 0x43e010
jmp 0x43e04e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43e04e
lea eax, [esp + 4]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x4494c8]
call fcn.0043ba90
add esp, 0x30
cmp eax, 0x103
jne 0x43e0e9
mov dword [esp], 0xc1c2c3c4
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x53
xor cl, byte [esp + eax]
add cl, 0x68
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x43e070
mov eax, dword [esp]
mov ecx, dword [0x4494c0]
test ecx, ecx
je 0x43e0e1
xor edx, edx
mov edi, dword [0x4494c4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xa67d73aa
je 0x43e0c0
inc edx
cmp ecx, edx
jne 0x43e0b0
jmp 0x43e0e1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43e0e1
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x4494c8]
call fcn.0043ba90
add esp, 0x18
test eax, eax
js 0x43e0e9
mov eax, dword [esp + 4]
test esi, esi
je 0x43e0fc
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43e0fa
mov ecx, dword [esp + 8]
mov dword [esi], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e110
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], 0xc1c2c3c4
xor eax, eax
nop
nop
nop
mov ebx, eax
add bl, 0x53
xor bl, byte [esp + eax + 4]
add bl, 0x68
mov byte [esp + eax + 4], bl
mov edi, eax
and edi, 1
xor eax, 1
lea eax, [eax + edi*2]
cmp eax, 4
jb 0x43e130
mov eax, dword [esp + 4]
mov ebx, dword [0x4494c0]
test ebx, ebx
je 0x43e1ae
xor ebp, ebp
mov edi, dword [0x4494c4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0x88822328
je 0x43e180
inc ebp
cmp ebx, ebp
jne 0x43e170
jmp 0x43e1ae
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43e1ae
lea eax, [esp + 4]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x4494c8]
call fcn.0043ba90
add esp, 0x30
cmp eax, 0x103
jne 0x43e249
mov dword [esp], 0xc1c2c3c4
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x53
xor cl, byte [esp + eax]
add cl, 0x68
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x43e1d0
mov eax, dword [esp]
mov ecx, dword [0x4494c0]
test ecx, ecx
je 0x43e241
xor edx, edx
mov edi, dword [0x4494c4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xa67d73aa
je 0x43e220
inc edx
cmp ecx, edx
jne 0x43e210
jmp 0x43e241
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43e241
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x4494c8]
call fcn.0043ba90
add esp, 0x18
test eax, eax
js 0x43e249
mov eax, dword [esp + 4]
test esi, esi
je 0x43e253
mov ecx, dword [esp + 8]
mov dword [esi], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4291d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov eax, ecx
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
cmp edi, 0x1f
jb 0x429370
test edx, 3
je 0x429202
movzx esi, byte [edx]
movzx ebx, al
inc edx
shr eax, 8
xor esi, ebx
xor eax, dword [ebp + esi*4]
dec edi
jmp 0x4291e7
xor eax, dword [edx]
lea edi, [edx + edi - 0x1b]
sub edx, edi
lea ebx, [ebx]
mov ecx, dword [edi + edx + 0xc]
mov ebx, dword [edi + edx + 8]
movzx esi, bl
xor ecx, dword [ebp + esi*4 + 0xc00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [ebp + esi*4 + 0x800]
movzx esi, bl
shr ebx, 8
xor ecx, dword [ebp + esi*4 + 0x400]
xor ecx, dword [ebp + ebx*4]
mov ebx, dword [edi + edx + 4]
movzx esi, bl
xor ecx, dword [ebp + esi*4 + 0x1c00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [ebp + esi*4 + 0x1800]
movzx esi, bl
shr ebx, 8
xor ecx, dword [ebp + esi*4 + 0x1400]
xor ecx, dword [ebp + ebx*4 + 0x1000]
movzx esi, al
mov ebx, eax
shr ebx, 0x18
xor ecx, dword [ebp + esi*4 + 0x2c00]
xor ecx, dword [ebp + ebx*4 + 0x2000]
ror eax, 0x10
movzx esi, al
shr eax, 0x18
xor ecx, dword [ebp + esi*4 + 0x2400]
xor ecx, dword [ebp + eax*4 + 0x2800]
mov eax, dword [edi + edx + 0x18]
mov ebx, dword [edi + edx + 0x14]
movzx esi, bl
xor eax, dword [ebp + esi*4 + 0xc00]
movzx esi, bh
shr ebx, 0x10
xor eax, dword [ebp + esi*4 + 0x800]
movzx esi, bl
shr ebx, 8
xor eax, dword [ebp + esi*4 + 0x400]
xor eax, dword [ebp + ebx*4]
mov ebx, dword [edi + edx + 0x10]
movzx esi, bl
xor eax, dword [ebp + esi*4 + 0x1c00]
movzx esi, bh
shr ebx, 0x10
xor eax, dword [ebp + esi*4 + 0x1800]
movzx esi, bl
shr ebx, 8
xor eax, dword [ebp + esi*4 + 0x1400]
xor eax, dword [ebp + ebx*4 + 0x1000]
movzx esi, cl
mov ebx, ecx
shr ebx, 0x18
xor eax, dword [ebp + esi*4 + 0x2c00]
xor eax, dword [ebp + ebx*4 + 0x2000]
ror ecx, 0x10
movzx esi, cl
shr ecx, 0x18
xor eax, dword [ebp + esi*4 + 0x2400]
xor eax, dword [ebp + ecx*4 + 0x2800]
add edx, 0x18
jae 0x429210
add edi, 0x18
sub edx, 0x18
movzx ebx, al
movzx ecx, ah
shr eax, 0x10
movzx esi, al
shr eax, 8
mov eax, dword [ebp + eax*4]
xor eax, dword [ebp + ebx*4 + 0xc00]
xor eax, dword [ebp + ecx*4 + 0x800]
xor eax, dword [ebp + esi*4 + 0x400]
add edx, 4
jb 0x429369
xor eax, dword [edi + edx]
jmp 0x429337
add edx, edi
add edi, 3
sub edi, edx
test edi, edi
je 0x429387
movzx esi, byte [edx]
movzx ebx, al
inc edx
shr eax, 8
xor esi, ebx
xor eax, dword [ebp + esi*4]
dec edi
jne 0x429374
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1000ba96
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10038780]
jne 0x1000baa0
repz ret
jmp fcn.10010d05

Function at 0x1001d054
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100122ae
and dword [ebp - 4], 0
cmp dword [0x1003a640], 0
mov ebx, eax
jne 0x1001d105
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001d1b6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001d1b6
push eax
call fcn.1001223c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1003a640], eax
call esi
push eax
call fcn.1001223c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1003a644], eax
call esi
push eax
call fcn.1001223c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1003a648], eax
call esi
push eax
call fcn.1001223c
pop ecx
mov dword [0x1003a650], eax
test eax, eax
je 0x1001d105
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1001223c
pop ecx
mov dword [0x1003a64c], eax
mov eax, dword [0x1003a64c]
cmp eax, ebx
je 0x1001d15d
cmp dword [0x1003a650], ebx
je 0x1001d15d
push eax
call fcn.100122b7
push dword [0x1003a650]
mov esi, eax
call fcn.100122b7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001d15d
test edi, edi
je 0x1001d15d
call esi
test eax, eax
je 0x1001d154
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001d154
test byte [ebp - 0xc], 1
jne 0x1001d15d
or dword [ebp + 0x10], 0x200000
jmp 0x1001d196
mov eax, dword [0x1003a644]
cmp eax, ebx
je 0x1001d196
push eax
call fcn.100122b7
pop ecx
test eax, eax
je 0x1001d196
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001d196
mov eax, dword [0x1003a648]
cmp eax, ebx
je 0x1001d196
push eax
call fcn.100122b7
pop ecx
test eax, eax
je 0x1001d196
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1003a640]
call fcn.100122b7
pop ecx
test eax, eax
je 0x1001d1b6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001d1b8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41cca8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ecx, esi
and ecx, 1
mov eax, esi
shl ecx, 4
mov ebx, ecx
or ebx, 6
and al, 2
push edi
lea eax, [ebp - 0x140]
cmove ebx, ecx
push eax
push dword [ebp + 8]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
jne 0x41ccec
xor eax, eax
jmp 0x41cd8e
and esi, 4
xor eax, eax
mov ecx, ebx
and ecx, dword [ebp - 0x140]
cmp eax, ecx
sbb eax, eax
neg eax
test esi, esi
jne 0x41cd0a
xor eax, eax
cmp eax, ecx
sbb eax, eax
inc eax
test eax, eax
je 0x41cd5c
mov al, byte [ebp - 0x114]
xor ecx, ecx
test al, al
setne cl
cmp al, 0x2e
jne 0x41cd38
mov al, byte [ebp - 0x113]
xor edx, edx
test al, al
cmove ecx, edx
cmp al, 0x2e
jne 0x41cd38
cmp byte [ebp - 0x112], dl
je 0x41cd5c
test ecx, ecx
je 0x41cd5c
lea eax, [ebp - 0x114]
inc edi
push eax
push dword [ebp + 0xc]
call fcn.0040a5dc
push 0x43d9e8
push dword [ebp + 0xc]
call fcn.0040a5dc
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41ccef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41ccef
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43258e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043240d