joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409710
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x40977d
mov edx, dword [ecx + 4]
mov eax, 0xfffff640
jmp 0x40974f
shr esi, 1
mov ebx, edi
and ebx, esi
add esi, edi
add ebx, ebx
sub esi, ebx
xor esi, dword [ecx + eax + 0xff8]
mov dword [ecx + eax + 0x1384], esi
add eax, 4
je 0x409791
mov edi, edx
and edi, 0x80000000
mov edx, dword [ecx + eax + 0x9c8]
mov esi, edx
and esi, 0x7fffffff
or esi, edi
mov ebx, esi
or ebx, 1
mov edi, esi
xor edi, 0xfffffffe
and edi, ebx
je 0x409730
mov edi, 0x9908b0df
jmp 0x409730
cmp eax, 0x4e0
jb 0x409796
mov esi, ecx
call fcn.004097f0
mov ecx, esi
mov eax, dword [esi]
jmp 0x409796
mov eax, 0x270
lea edx, [eax + 1]
mov dword [ecx], edx
mov edx, dword [ecx + eax*4 + 4]
mov eax, edx
shr eax, 0xb
mov esi, eax
not esi
or esi, dword [ecx + 0x1384]
add eax, esi
inc eax
mov ecx, eax
and ecx, edx
add ecx, ecx
sub eax, ecx
add eax, edx
mov ecx, eax
shl ecx, 7
mov edx, ecx
xor edx, 0x62d3a97f
or ecx, 0x9d2c5680
and ecx, edx
xor ecx, eax
mov edx, ecx
shl edx, 0xf
and edx, 0xefc60000
xor edx, ecx
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
pop edi
pop ebx
ret

Function at 0x4097f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [ecx + 0x9c4]
xor eax, eax
nop
nop
nop
nop
lea edx, [eax + 0x270]
and edi, 0x80000000
mov ebx, dword [ecx + eax*4 + 0x9c8]
mov esi, ebx
and esi, 0x7ffffffe
or esi, edi
shr esi, 1
mov edi, ebx
and ebx, 1
neg ebx
and ebx, 0x9908b0df
mov ebp, edx
and ebp, 0x18d
xor edx, 0x18d
lea edx, [edx + ebp*2]
xor ebx, dword [ecx + edx*4 + 4]
xor ebx, esi
mov dword [ecx + eax*4 + 4], ebx
inc eax
cmp eax, 0xe3
jne 0x409800
mov eax, 0xe3
mov edx, 0x80000000
nop
nop
nop
nop
nop
nop
nop
mov ebx, dword [ecx + eax*4 + 0x9c4]
and ebx, edx
mov esi, dword [ecx + eax*4 + 0x9c8]
mov edi, esi
and edi, 0x7ffffffe
or edi, ebx
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, dword [ecx + eax*4 - 0x388]
shr edi, 1
xor esi, edi
mov dword [ecx + eax*4 + 4], esi
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
cmp eax, 0x26f
jb 0x409860
mov esi, 0x80000000
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
movzx edi, word [esi]
test di, di
je 0x409d72
mov edx, dword [esp + 0x18]
dec edx
je 0x409d72
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, di
lea edi, [esi + 2]
cmp cx, 0x7f
ja 0x409c70
lea ebp, [eax + 1]
mov byte [eax], cl
jmp 0x409d10
cmp ecx, 0x7ff
ja 0x409ca0
cmp edx, 2
jb 0x409ca0
mov ebx, ecx
shr ebx, 6
add bl, 0xc0
mov byte [eax], bl
and cl, 0x3f
or cl, 0x80
lea ebp, [eax + 2]
mov byte [eax + 1], cl
jmp 0x409d10
mov ebp, ecx
and ebp, 0xfc00
cmp ebp, 0xd800
jne 0x409d2a
cmp edx, 4
jb 0x409d2a
movzx edi, word [esi + 2]
add esi, 4
shl ecx, 0xa
lea ebx, [ecx + edi]
add ebx, 0xfca02400
mov ecx, ebx
shr ecx, 0x12
add cl, 0xf0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 0xc
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [eax + 2], bl
mov ebx, 0xff
sub ebx, edi
or ebx, 0x3f
add ebx, edi
add bl, 0x81
lea ebp, [eax + 4]
mov byte [eax + 3], bl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edx, eax
sub edx, ebp
mov esi, edi
mov eax, ebp
movzx edi, word [esi]
test di, di
je 0x409d72
test edx, edx
jne 0x409c50
jmp 0x409d72
movzx esi, bp
cmp esi, 0xdc00
jne 0x409d39
mov esi, edi
jmp 0x409d18
cmp edx, 3
jb 0x409d6e
mov ebx, ecx
shr ebx, 0xc
or bl, 0xe0
mov byte [eax], bl
mov ebx, ecx
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [eax + 1], bl
mov esi, ecx
or esi, 0x3f
xor ecx, 0xc0
and ecx, esi
add cl, 0x80
lea ebp, [eax + 3]
mov byte [eax + 2], cl
jmp 0x409d10
mov ebp, eax
jmp 0x409d10
mov byte [eax], 0
sub eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40c8c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [esp + 0x3c], 0xe41ce23c
mov dword [esp + 0x40], 0xf81ee66f
mov dword [esp + 0x44], 0xfc07fa05
mov dword [esp + 0x48], 0xf0c0fe1c
mov dword [esp + 0x4c], 0xf4cdf2c4
mov dword [esp + 0x50], 0x88d7f6c5
mov dword [esp + 0x54], 0x8c5c8ab1
mov dword [esp + 0x58], 0x80718e74
mov dword [esp + 0x5c], 0x847c8265
mov dword [esp + 0x60], 0x98748672
mov dword [esp + 0x64], 0x9c459ab9
mov dword [esp + 0x68], 0x90bf9e49
mov dword [esp + 0x6c], 0x94a392a0
mov dword [esp + 0x70], 0xa8a796ab
mov dword [esp + 0x74], 0xac8baa62
mov dword [esp + 0x78], 0xa056ae7a
mov dword [esp + 0x7c], 0xa495a25f
mov dword [esp + 0x80], 0xb86ca691
mov dword [esp + 0x84], 0xbc33ba99
mov dword [esp + 0x88], 0xb08bbe8b
mov dword [esp + 0x8c], 0xb493b288
mov dword [esp + 0x90], 0x4847b674
mov dword [esp + 0x94], 0x4cb74ab9
mov dword [esp + 0x98], 0x40984ea8
mov dword [esp + 0x9c], 0x44a142a4
mov dword [esp + 0xa0], 0x58be469e
mov dword [esp + 0xa4], 0x5c645aad
mov dword [esp + 0xa8], 0x506c5e68
mov dword [esp + 0xac], 0x546d5266
mov dword [esp + 0xb0], 0x68615666
mov dword [esp + 0xb4], 0x6c536a49
mov dword [esp + 0xb8], 0x60b76eb6
mov dword [esp + 0xbc], 0x64be62b5
mov dword [esp + 0xc0], 0x785b66b9
mov dword [esp + 0xc4], 0x7c877a59
mov dword [esp + 0xc8], 0x70847e84
mov dword [esp + 0xcc], 0x74537294
mov dword [esp + 0xd0], 0x89276b2
mov dword [esp + 0xd4], 0xcf00aea
mov dword [esp + 0xd8], 0x360ef2
mov dword [esp + 0xdc], 0x4c00221
mov dword [esp + 0xe0], 0x18f506fd
mov dword [esp + 0xe4], 0x1ce61ae6
mov dword [esp + 0xe8], 0x10201ef8
mov dword [esp + 0xec], 0x14221220
mov dword [esp + 0xf0], 0x282916dc
mov dword [esp + 0xf4], 0x2c152a19
mov dword [esp + 0xf8], 0x20112e1d
mov dword [esp + 0xfc], 0x24032211
mov dword [esp + 0x100], 0x38c626f6
mov dword [esp + 0x104], 0x3cda3adf
mov dword [esp + 0x108], 0x30c63ecf
mov dword [esp + 0x10c], 0x3406320e
mov dword [esp + 0x110], 0xc8003606
mov dword [esp + 0x114], 0xccf8caf7
mov dword [esp + 0x118], 0xc0cfcefb
mov eax, dword [0x44848c]
mov ecx, 0x783eaca9
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x783eac6d]
xor edx, ecx
mov edi, edx
and edi, 0x380a88b5
mov ebx, edx
and ebx, 2
mov ebp, ebx
xor ebp, 2
imul ebp, edi
or edi, 2
imul edi, ebx
add edi, ebp
xor edx, 0x3e0a9ab7
mov ebx, edi
and ebx, edx
xor edx, edi
lea edx, [edx + ebx*2]
inc dl
mov byte [esp + ecx - 0x783eac6d], dl
inc ecx
cmp ecx, 0x783ead89
jne 0x40cb10
lea edi, [esp + 0x3c]
push 0
push 0
push 0
push 0
push edi
call eax
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x44281c]
mov ecx, 0x6b0d5ce9
xor ecx, dword [0x442824]
add ecx, edx
inc ecx
jmp ecx
Function at 0x416420
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x450
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x416440
mov eax, ebx
sar eax, 1
mov dword [esp + 0xfc], eax
cmp eax, 0xfffffff2
jge 0x416462
mov eax, 0xffffffff
jmp 0x416465
lea eax, [ebx + 0x1c]
push eax
call fcn.00408c90
add esp, 4
mov esi, eax
mov dword [esp + 0x2c8], 0x4d804bb6
mov dword [esp + 0x2cc], 0x71e34faf
mov dword [esp + 0x2d0], 0x755473e6
mov dword [esp + 0x2d4], 0x799d7780
mov dword [esp + 0x2d8], 0x7def7be8
mov dword [esp + 0x2dc], 0x618f7f97
mov dword [esp + 0x2e0], 0x6564638c
mov eax, 0xb6082b9a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x49f7d72e]
xor ecx, eax
mov edx, 0x79
sub edx, ecx
add ecx, 0x86
and edx, 0x56
and ecx, 0xa9
sub ecx, edx
mov byte [esp + eax + 0x49f7d72e], cl
inc eax
cmp eax, 0xb6082bb6
jne 0x4164d0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x416521
add edi, 2
mov eax, esi
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x416510
mov word [eax], 0
movzx ecx, word [esp + 0x2c8]
test cx, cx
je 0x416551
lea edx, [esp + 0x2ca]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416540
mov word [eax], 0
lea eax, [esp + 0x140]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043d980
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4436f8]
Function at 0x41be00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a8
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x18], 0x872c85eb
mov dword [esp + 0x1c], 0x8b25893b
mov dword [esp + 0x20], 0x8f8e8d22
mov eax, 0xa4
mov ecx, 0x5b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x8c]
mov edx, ecx
xor edx, eax
and edx, edi
xor edx, eax
add dl, 0xe0
mov byte [esp + eax - 0x8c], dl
inc eax
dec ecx
cmp eax, 0xb0
jne 0x41be40
mov dword [esp + 0x34], 0x44b742b9
mov dword [esp + 0x38], 0x58b746b1
mov dword [esp + 0x3c], 0x5c645a93
mov dword [esp + 0x40], 0x50a35e62
mov dword [esp + 0x44], 0x54b052ae
mov dword [esp + 0x48], 0x68ab56b4
mov dword [esp + 0x4c], 0x6c946a91
mov dword [esp + 0x50], 0x609b6e9e
mov dword [esp + 0x54], 0x646362ab
mov eax, 0x3cd31a09
movzx ecx, byte [esp + eax - 0x3cd319d5]
xor ecx, eax
add ecx, 0x19672fb7
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax - 0x3cd319d5], cl
inc eax
cmp eax, 0x3cd31a2d
jne 0x41beb0
movzx ecx, word [esp + 0x34]
lea eax, [esp + 0x164]
test cx, cx
je 0x41bf01
lea edx, [esp + 0x36]
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bef0
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x41bf31
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bf20
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x41bf61
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41bf50
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
mov dword [esp + 0x34], 0x3b383896
mov byte [esp + 0x38], 0x60
mov eax, 0x7d
mov esi, 0x83
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x49]
lea ebx, [edx + edx]
not ebx
add ebx, edx
and ebx, 0xa0
and edx, 0x5f
or edx, ebx
mov ecx, esi
and ecx, 0xa0
mov ebx, esi
or ebx, 0x5f
add ebx, eax
or ebx, ecx
xor ebx, edx
add bl, 0x20
mov byte [esp + eax - 0x49], bl
inc eax
dec esi
cmp eax, 0x82
jne 0x41bf90
movzx eax, byte [esp + 0x34]
test al, al
je 0x41bfeb
lea ecx, [esp + 0x35]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41bfe0
mov byte [edi], 0
lea eax, [esp + 0x148]
lea ecx, [esp + 0x158]
lea edx, [esp + 0x30]
lea esi, [esp + 0x164]
push eax
push ecx
push edx
push esi
call fcn.0040be80
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x443af0]
mov ecx, 0xbd4551a8
xor ecx, dword [0x443af8]
add eax, ecx
inc eax
jmp eax
Function at 0x427290
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.00426c70
add esp, 4
test al, al
je 0x427290
mov al, 1
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe4
push eax
mov dword [ebp - 0x18], esp
push eax
mov dword [ebp - 0x4c], esp
push eax
mov dword [ebp - 0x40], esp
sub esp, 0x24
mov dword [ebp - 0x38], esp
sub esp, 8
mov dword [ebp - 0xa8], esp
sub esp, 8
mov dword [ebp - 0xec], esp
sub esp, 8
mov dword [ebp - 0x3c], esp
sub esp, 0x20
mov dword [ebp - 0x50], esp
mov dword [ebp - 0xe8], 0xfa67f8be
mov dword [ebp - 0xe4], 0xfe69fc68
mov dword [ebp - 0xe0], 0xf26df05e
mov dword [ebp - 0xdc], 0xf645f46f
mov dword [ebp - 0xd8], 0xea7de856
mov dword [ebp - 0xd4], 0xeeedec73
mov eax, 0xffffffe8
mov ecx, 0x720ffb00
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + eax - 0xd0]
lea edi, [eax - 0x720ffae9]
mov ebx, ecx
or ebx, edx
lea esi, [ecx - 0x720ffb00]
and esi, edx
xor esi, ebx
and esi, edi
mov ebx, esi
or ebx, 0xfffffffd
inc ebx
mov edi, esi
and edi, 0x1fd
imul edi, ebx
mov ebx, esi
and ebx, 2
or esi, 2
imul esi, ebx
add edi, edx
sub edi, esi
lea edx, [eax + edi]
add edx, 0x1e6fdd1e
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [ebp + eax - 0xd0], dl
dec ecx
inc eax
jne 0x427320
mov dword [ebp - 0x9e], 0xd96ad76a
mov dword [ebp - 0x9a], 0xdd9bdb9f
mov dword [ebp - 0x96], 0xc173df97
mov dword [ebp - 0x92], 0xc576c376
mov dword [ebp - 0x8e], 0xc974c77f
mov dword [ebp - 0x8a], 0xcd8dcb87
mov dword [ebp - 0x86], 0x3178cf8d
mov dword [ebp - 0x82], 0x357a337b
mov dword [ebp - 0x7e], 0x39843773
mov dword [ebp - 0x7a], 0x3d733b89
mov dword [ebp - 0x76], 0x21943f78
mov dword [ebp - 0x72], 0x25652395
mov dword [ebp - 0x6e], 0x296d2794
mov dword [ebp - 0x6a], 0x2d9a2b96
mov dword [ebp - 0x66], 0x11bc2f8f
mov dword [ebp - 0x62], 0x15b11384
mov dword [ebp - 0x5e], 0x19ab17aa
mov dword [ebp - 0x5a], 0x1db91b8e
mov dword [ebp - 0x56], 0x1ad1fbf
mov word [ebp - 0x52], 0x302
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 0xcc
mov edx, ecx
xor edx, 0xe6
add edx, esi
xor dl, byte [ebp + ecx - 0x9e]
add dl, 0xd0
mov byte [ebp + ecx - 0x9e], dl
inc ecx
add eax, 2
cmp ecx, 0x4e
jne 0x427430
lea eax, [ebp - 0xf0]
lea ecx, [ebp - 0xe8]
lea edi, [ebp - 0x9e]
push eax
push ecx
push edi
call fcn.00437e60
add esp, 0xc
mov esi, eax
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x444acc]
Function at 0x429640
Capabilities:
Encode data using xor

Disassembly:
test al, 0xc7
inc esp
and al, 0x4f
push ds
stosb byte es:[edi], al
salc
lodsb al, byte [esi]
mov al, byte [0x572444c7]
adc esp, dword [edx + 0x44c7a41e]
and al, 0x5b
fsub dword [esi + 0x44c7b812]
and al, 0x5f
or edi, dword [edx + 0x44c7bc07]
and al, 0x63
sbb byte [esi + 0x44c7b001], bh
and al, 0x67
adc dh, byte [edx + 0x44c7b40c]
and al, 0x6b
adc dword [esi + 0x44c78812], esi
and al, 0x6f
sub eax, 0xc78c968a
inc esp
and al, 0x73
xchg edi, eax
mov cs, word [edi - 0x6f6f6f80]
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc0
push eax
mov dword [ebp - 0x34], esp
push eax
mov dword [ebp - 0x30], esp
sub esp, 0x1c
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x80], 0x4e0c4c6e
mov dword [ebp - 0x7c], 0x42d140df
mov dword [ebp - 0x78], 0x46244407
mov dword [ebp - 0x74], 0x7a1878d3
mov dword [ebp - 0x70], 0x7e117c5e
mov dword [ebp - 0x6c], 0x72ee7001
mov dword [ebp - 0x68], 0x761074e7
mov dword [ebp - 0x64], 0x6a0868e7
mov dword [ebp - 0x60], 0x6e366c0f
mov dword [ebp - 0x5c], 0x620d6034
mov dword [ebp - 0x58], 0x660064f0
mov dword [ebp - 0x54], 0x9a0a98f4
mov dword [ebp - 0x50], 0x9e029c02
mov dword [ebp - 0x4c], 0x92cf9001
mov dword [ebp - 0x48], 0x9608941b
mov dword [ebp - 0x44], 0x8a89880b
xor eax, eax
nop
nop
nop
nop
movzx edx, byte [ebp + eax - 0x80]
mov ecx, eax
and ecx, 0x13
mov esi, eax
xor esi, 0xad97a1d3
lea ecx, [esi + ecx*2]
xor ecx, edx
mov edx, ecx
xor edx, 0x99
and ecx, 0x66
add ecx, ecx
sub ecx, edx
inc cl
mov byte [ebp + eax - 0x80], cl
mov ecx, eax
not ecx
or ecx, 1
add ecx, eax
xor eax, 1
lea eax, [eax + ecx*2]
add eax, 2
cmp eax, 0x40
jb 0x4296d0
lea ebx, [ebp - 0xcc]
lea eax, [ebp - 0x80]
mov edi, ebx
mov ecx, 0x10
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [ebp - 0x8c]
lea eax, [ebp - 0x40]
xor esi, esi
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [ebp - 0x40]
push eax
push 0
push 0
push 0x1f
push ebx
push 0
call dword [0x4497e0]
mov dword [ebp - 0x80], 0x184746a6
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, esi
and edx, 2
mov edi, ecx
xor edi, edx
and edx, ecx
xor edi, 0x2d
lea edx, [edi + edx*2]
xor dl, byte [ebp + ecx - 0x80]
add dl, 0x98
mov byte [ebp + ecx - 0x80], dl
inc ecx
add esi, 2
cmp ecx, 4
jne case.default.0x42978f
xor ecx, ecx
cmp eax, dword [ebp - 0x80]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x444d94]
Function at 0x437e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 0xc], 0x200
mov dword [esp + 0x10], 0x100
mov dword [esp + 0x14], 0
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + ebp + 0xc]
mov ecx, 0x20019
or eax, ecx
push 0
push 0
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x40]
call fcn.0043e070
add esp, 0x14
test eax, eax
js 0x437fb4
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x28]
call 0x43e4a0
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x437f2d
mov eax, dword [esp + 4]
inc eax
push eax
call fcn.00408c90
add esp, 4
mov esi, eax
lea eax, [esp + 4]
push eax
push esi
push 0
push dword [esp + 0x40]
push dword [esp + 0x18]
call 0x43eb30
add esp, 0x14
test eax, eax
js 0x437f22
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x437f2d
mov eax, dword [esp + 4]
mov dword [ecx], eax
jmp 0x437f2d
push esi
call fcn.00408ca0
add esp, 4
xor esi, esi
mov eax, dword [esp + 8]
mov dword [esp], 0xe4e5e6e7
mov ecx, ebx
nop
nop
nop
nop
nop
nop
mov edx, ebx
or dl, 0x58
xor dl, byte [esp + ebx]
add dl, 0x40
mov byte [esp + ebx], dl
not ecx
or ecx, 1
add ecx, ebx
and ebx, 2
mov edx, ebx
xor edx, 0xfffffffe
xor ebx, 2
or ebx, edx
sub ecx, ebx
mov ebx, ecx
cmp ecx, 4
jb 0x437f40
mov ecx, dword [0x4497e4]
test ecx, ecx
je 0x437fb0
mov edx, dword [esp]
xor ebx, ebx
mov edi, dword [0x4497e8]
cmp dword [edi + ebx*8], 0xb430e561
je 0x437f90
inc ebx
cmp ecx, ebx
jne 0x437f80
jmp 0x437fb0
mov ecx, dword [edi + ebx*8 + 4]
cmp ecx, edx
je 0x437fb0
push eax
push 4
push ecx
push dword [0x4497ec]
call fcn.0043b5f0
add esp, 0x10
nop
nop
nop
nop
nop
nop
test esi, esi
jne 0x437fd8
mov eax, esp
push eax
call fcn.0043d770
add esp, 4
cmp dword [esp], 1
sete cl
xor esi, esi
test al, cl
jne 0x437fd8
add ebp, 4
cmp ebp, 0xc
jne 0x437e90
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439ee0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x439fb0
xor eax, eax
cmp dword [ecx], 0
jne 0x439ff7
mov edx, dword [esp + 0x34]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0xe4e5e6e7
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax]
mov esi, 0xa7
sub esi, eax
mov edi, eax
or edi, ebx
or edi, 0x58
not ebx
or ebx, esi
and ebx, edi
add bl, 0x40
mov byte [esp + eax], bl
mov esi, eax
or esi, 0xd1571d11
and eax, 1
add eax, esi
add eax, 0x2ea8e2f0
cmp eax, 4
jb 0x439f50
mov eax, dword [esp]
mov esi, dword [0x4497e4]
test esi, esi
je 0x439ff7
xor edi, edi
mov ebx, dword [0x4497e8]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xf62c6d34
je 0x43a000
inc edi
cmp esi, edi
jne 0x439fa0
jmp 0x439ff7
mov dword [esp + 4], 0x94d3d2c9
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
mov esi, eax
and esi, 2
mov edx, ecx
xor edx, 0xfbdc6b19
add edx, esi
mov esi, edx
and esi, 6
or esi, 0x29
and edx, 0x19
xor edx, esi
xor dl, byte [esp + ecx + 4]
xor dl, 0x29
add dl, 0x38
mov byte [esp + ecx + 4], dl
inc ecx
add eax, 2
cmp ecx, 4
jne 0x439fc0
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x439ff7
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x4497ec]
call fcn.0043b5f0
add esp, 0x1c
jmp 0x439ff7
Function at 0x43ce50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0xd1d0ef3e
mov eax, 1
mov edx, 0xffffffff
xor edi, edi
mov esi, 0xfffffff8
mov dword [esp + 8], esi
mov dword [esp], edi
mov dword [esp + 0xc], edx
mov edi, dword [esp]
and edi, 0xfffffffc
movzx ecx, byte [esp + eax + 3]
lea ebp, [edx + edx]
or ebp, 0xe280943c
mov edx, dword [esp + 8]
lea esi, [eax + edx]
sub esi, edi
lea edx, [esi + ebp]
add edx, 0xf1404a27
mov esi, edx
lea ebx, [ecx + ecx]
not ebx
add ebx, ecx
or ebx, edx
or edx, ecx
xor esi, ecx
add esi, ebp
sub esi, edx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp]
add ecx, eax
sub ecx, edi
mov edi, dword [esp]
add ecx, esi
add ecx, 0xf1404a1f
mov esi, dword [esp + 8]
not ebx
or ebx, ecx
add bl, 0x10
mov byte [esp + eax + 3], bl
inc eax
dec edx
add edi, 2
add esi, 2
cmp eax, 5
jne 0x43ce70
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x54101b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00540e9a

Function at 0x543dd0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00543a90

Function at 0x54eb0c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x28ca6edc
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x190b0fdb
nop
nop
nop
nop
nop
test eax, eax
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219