joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c630
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0xc95bcbbf
mov dword [esp + 0x40], 0xc551c74e
mov dword [esp + 0x44], 0xc156c350
mov dword [esp + 0x48], 0xfdafff5f
mov dword [esp + 0x4c], 0xf9a8fbb7
mov dword [esp + 0x50], 0xf5d6f7a8
mov dword [esp + 0x54], 0xf19bf3ac
mov dword [esp + 0x58], 0xed7cef67
mov dword [esp + 0x5c], 0xe97beb70
mov dword [esp + 0x60], 0xe56be761
mov dword [esp + 0x64], 0xe190e3c4
mov dword [esp + 0x68], 0x1d3e1f8c
mov dword [esp + 0x6c], 0x194a1b53
mov dword [esp + 0x70], 0x1546174a
mov dword [esp + 0x74], 0x11321351
mov dword [esp + 0x78], 0xd990f79
mov dword [esp + 0x7c], 0x9400b9e
mov dword [esp + 0x80], 0x5430744
mov dword [esp + 0x84], 0x18a0324
mov dword [esp + 0x88], 0x3d723f4a
mov dword [esp + 0x8c], 0x391a3b6b
mov dword [esp + 0x90], 0x35a63747
mov dword [esp + 0x94], 0x31a633a4
mov dword [esp + 0x98], 0x2d472fab
mov dword [esp + 0x9c], 0x29b42bb7
mov dword [esp + 0xa0], 0x25b1275d
mov dword [esp + 0xa4], 0x217323a8
mov dword [esp + 0xa8], 0x5d135f6b
mov dword [esp + 0xac], 0x59085b15
mov dword [esp + 0xb0], 0x551c5715
mov dword [esp + 0xb4], 0x510a5374
mov dword [esp + 0xb8], 0x4d364f25
mov dword [esp + 0xbc], 0x49394b20
mov dword [esp + 0xc0], 0x4512473c
mov dword [esp + 0xc4], 0x41d64364
mov dword [esp + 0xc8], 0x7deb7fd7
mov dword [esp + 0xcc], 0x795a7be7
mov dword [esp + 0xd0], 0x75ed7701
mov dword [esp + 0xd4], 0x71e773e9
mov dword [esp + 0xd8], 0x6d396fe1
mov dword [esp + 0xdc], 0x69176b4c
mov dword [esp + 0xe0], 0x65e867f0
mov dword [esp + 0xe4], 0x61f163f5
mov dword [esp + 0xe8], 0x9dcf9ffb
mov dword [esp + 0xec], 0x99d59bd3
mov dword [esp + 0xf0], 0x95c497df
mov dword [esp + 0xf4], 0x91c093c4
mov dword [esp + 0xf8], 0x8ddc8fc0
mov dword [esp + 0xfc], 0x89aa8bdc
mov dword [esp + 0x100], 0x851987e5
mov dword [esp + 0x104], 0x811d831e
mov dword [esp + 0x108], 0xbd29bf0e
mov dword [esp + 0x10c], 0xb9f1bbed
mov dword [esp + 0x110], 0xb5ffb7f5
mov dword [esp + 0x114], 0xb1ffb3e6
mov dword [esp + 0x118], 0xadaeaffa
mov dword [esp + 0x11c], 0
mov eax, dword [0x44ba00]
mov ecx, 0x53
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x17]
lea esi, [ecx - 0x228a4300]
mov ebx, ecx
and ebx, edx
or esi, edx
xor esi, ebx
mov edx, esi
and edx, 0x60
xor esi, 0x60
lea edx, [esi + edx*2]
inc dl
mov byte [esp + ecx - 0x17], dl
inc ecx
cmp ecx, 0x137
jne 0x40c890
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov ebp, eax
xor eax, eax
test ebp, ebp
setne al
mov eax, dword [eax*4 + 0x445f04]
mov ecx, 0xd4c7df48
xor ecx, dword [0x445f0c]
add eax, ecx
inc eax
jmp eax
Function at 0x419550
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x438
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + ecx], 0
lea ecx, [ecx + 2]
jne 0x419570
lea edx, [eax + ecx]
add edx, 0xfffffffe
add ecx, eax
mov edi, 1
sub edi, ecx
and edi, eax
mov esi, eax
not esi
and esi, edx
sub esi, edi
sar esi, 1
lea edi, [esp + 0x90]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x44cd54]
mov dword [esp + 0x100], 0x914e4f29
mov word [esp + 0x104], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xed
xor dl, byte [esp + ecx + 0x100]
add dl, 0x5f
mov byte [esp + ecx + 0x100], dl
inc ecx
cmp ecx, 6
jne case.default.0x4195fa
xor ecx, ecx
cmp eax, dword [esp + 0x100]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x446920]
mov ebx, dword [esp + 0x90]
test ebx, ebx
jns 0x419613
mov eax, 0xffffffff
jmp 0x419616
lea eax, [ebx + ebx]
push eax
call fcn.004083b0
add esp, 4
push edi
push ebx
mov dword [esp + 0x74], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44cd54]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446928]
xor eax, eax
jmp dword [0x446930]
push dword [esp + 0x6c]
call fcn.004083c0
add esp, 4
xor eax, eax
jmp case.0x4195fa.0
mov eax, dword [esp + 0x90]
mov ecx, eax
add ecx, 0xd
jns 0x419671
mov eax, 0xffffffff
jmp 0x419678
lea eax, [eax*2 + 0x1a]
push eax
call fcn.004083b0
add esp, 4
mov esi, eax
mov dword [esp + 0x100], 0x41f247e0
mov dword [esp + 0x104], 0x4ddf43e3
mov dword [esp + 0x108], 0x492e4fd0
mov dword [esp + 0x10c], 0xb5e54bf6
mov dword [esp + 0x110], 0xb12bb726
mov dword [esp + 0x114], 0xbd23b31b
mov dword [esp + 0x118], 0xb9bebf2a
mov edx, 0xf1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx + 0xf]
mov ebx, eax
mov edi, eax
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xfd
mul cl
mov ecx, eax
mov eax, edi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0x4b
mov byte [esp + edx + 0xf], al
inc edx
cmp edx, 0x10d
jne 0x4196e0
mov eax, dword [esp + 0x6c]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x419751
mov eax, dword [esp + 0x6c]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419740
mov word [eax], 0
movzx ecx, word [esp + 0x100]
test cx, cx
je 0x419781
lea edx, [esp + 0x102]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419770
mov word [eax], 0
lea eax, [esp + 0x280]
push 0x60
push 3
push 0x120089
push eax
mov dword [esp + 0x14], esi
push esi
call fcn.004403d0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446938]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
jmp dword [0x446990]
Function at 0x41dc20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov ebx, dword [ebp + 0xc]
mov dword [esp + 8], 0x936891a7
mov dword [esp + 0xc], 0xaf59ad5f
mov dword [esp + 0x10], 0xabaaa95e
mov dword [esp + 0x14], 0
xor ecx, ecx
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 3
mov edx, ecx
xor edx, 0x3f992f5c
add edx, ecx
sub edx, esi
mov esi, ecx
and esi, 0xc
add edx, esi
movzx esi, byte [esp + ecx + 8]
xor edx, esi
add edx, 0xc2021333
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + ecx + 8], dl
and eax, 1
not ecx
or ecx, 1
sub eax, ecx
mov ecx, eax
cmp eax, 0x10
jb 0x41dc60
mov dword [esp + 0x2c], 0x3faa3990
mov dword [esp + 0x30], 0x23b23da8
mov dword [esp + 0x34], 0x27f521fe
mov dword [esp + 0x38], 0x2b8625f7
mov dword [esp + 0x3c], 0x2f8929bb
mov dword [esp + 0x40], 0x13be2d8d
mov dword [esp + 0x44], 0x178511b8
mov dword [esp + 0x48], 0x1b8e1583
mov dword [esp + 0x4c], 0x1f1e19c6
mov word [esp + 0x50], 0
mov byte [esp + 0x52], 0
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xca
xor cl, byte [esp + eax + 0x2c]
add cl, 0xe
mov byte [esp + eax + 0x2c], cl
inc eax
cmp eax, 0x27
jne 0x41dd00
movzx ecx, word [esp + 0x2c]
lea eax, [esp + 0x15c]
test cx, cx
je 0x41dd43
lea edx, [esp + 0x2e]
mov esi, dword [ebp + 0x10]
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41dd30
jmp 0x41dd46
mov esi, dword [ebp + 0x10]
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x41dd71
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41dd60
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x41dda1
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41dd90
mov word [eax], 0
mov edi, dword [ebx]
mov dword [esp + 0x2c], 0x9590904a
mov byte [esp + 0x30], 0x38
mov dword [esp + 0x31], 0
mov byte [esp + 0x35], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 0x16
mov edx, ecx
xor edx, 0x8b
add edx, esi
xor dl, byte [esp + ecx + 0x2c]
add dl, 0x49
mov byte [esp + ecx + 0x2c], dl
inc ecx
add eax, 2
cmp ecx, 0xa
jne 0x41ddd0
movzx eax, byte [esp + 0x2c]
test al, al
je 0x41de0b
lea ecx, [esp + 0x2d]
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41de00
mov byte [edi], 0
lea eax, [esp + 0x138]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x15c]
push eax
push ecx
push edx
call fcn.0040b380
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x446cb8]
mov ecx, 0xc5d821a9
xor ecx, dword [0x446cc0]
add eax, ecx
inc eax
jmp eax

Function at 0x41eac0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov ebp, dword [esp + 0x64]
xor eax, eax
test ebp, ebp
setne al
xor esi, esi
mov dword [esp + 0x3c], 0
mov dword [esp], 0
jmp dword [eax*4 + 0x446dc8]
Function at 0x421790
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x34]
mov edi, 0xfffffffe
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x4217a0
sar edi, 1
lea ebp, [esp + 0x18]
push ebp
push 0
push 0
push edi
push ebx
push 0
call dword [0x44cd54]
mov dword [esp + 4], 0xd7969947
mov dword [esp + 8], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x66
xor dl, byte [esp + ecx + 4]
add dl, 2
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 8
jne case.default.0x4217ff
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
jmp dword [ecx*4 + 0x446f58]
mov esi, dword [esp + 0x18]
test esi, esi
jns 0x421832
mov eax, 0xffffffff
jmp 0x421835
xor ebx, ebx
jmp dword [0x446f68]
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + esi]
push eax
call fcn.004083b0
add esp, 4
push ebp
mov ebp, eax
push esi
push eax
push edi
push ebx
push 0
call dword [0x44cd54]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446f70]
xor ebx, ebx
jmp dword [0x446f78]
push ebp
call fcn.004083c0
add esp, 4
xor ebx, ebx
jmp case.0x4217ff.3
lea edi, [esp + 4]
push edi
push ebp
call fcn.00440590
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446f80]
Function at 0x423320
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x423330
cmp eax, 0xffffffed
jge 0x423347
mov eax, 0xffffffff
jmp 0x42334a
add eax, 0x12
push eax
call fcn.004083b0
add esp, 4
mov esi, eax
mov dword [esp], 0x91039f30
mov dword [esp + 4], 0x95199337
mov dword [esp + 8], 0x89c897c0
mov dword [esp + 0xc], 0x8d288b2c
mov dword [esp + 0x10], 0x8f8c
xor eax, eax
nop
nop
mov edx, eax
and edx, 0x1b
xor edx, 0xdb
mov ecx, eax
and ecx, 4
sub ecx, edx
xor cl, byte [esp + eax]
add cl, 0x47
mov byte [esp + eax], cl
inc eax
cmp eax, 0x14
jne 0x423380
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x4233c1
add edi, 2
mov eax, esi
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4233b0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4233f1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4233e0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00440590
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x447028]
Function at 0x427ff9
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x44ba30]
mov dword [esp + 0x1a8], 0x97966198
mov dword [esp + 0x1ac], 0
mov ecx, 0x66
mov edx, 0x99
nop
movzx ebx, byte [esp + ecx + 0x142]
mov esi, ecx
or esi, ebx
not ebx
or ebx, edx
and ebx, esi
add bl, 2
mov byte [esp + ecx + 0x142], bl
inc ecx
dec edx
cmp ecx, 0x6e
jne 0x40a020
mov ecx, dword [esp + 0x1a8]
mov dword [esp + 0x18], 0xb7298913
mov dword [esp + 0x1c], 0xb351b56a
mov dword [esp + 0x20], 0xbf60b16f
mov dword [esp + 0x24], 0xbb56bd6e
mov dword [esp + 0x28], 0xa732b92c
mov dword [esp + 0x2c], 0xa5a4
xor edx, edx
nop
nop
nop
nop
mov ebx, edx
add bl, 0xde
xor bl, byte [esp + edx + 0x18]
add bl, 0xaa
mov byte [esp + edx + 0x18], bl
mov esi, edx
xor esi, 1
and edx, 1
lea edx, [esi + edx*2]
add edx, 0x55919a1a
mov esi, edx
xor esi, 0xaa6e65e6
and edx, 0x66
lea edx, [esi + edx*2]
cmp edx, 0x18
jb case.default.0x40a0e3
lea esi, [esp + 0x18]
push ecx
push 0
push esi
call eax
mov ecx, 0x44ba34
push eax
call fcn.0043c5a0
movzx eax, al
mov eax, dword [eax*4 + 0x4459f8]
mov ecx, 0x9c53141c
xor ecx, dword [0x445a00]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
inc ebp
inc esi
inc edi
inc eax
mov byte [esp + 0x20], 0
xor ecx, ecx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + esi + 0x1c]
mov edx, ecx
and edx, 2
mov ebx, esi
xor ebx, 0xa8086811
add ebx, edx
mov edx, ebx
and edx, eax
mov ebp, edx
and ebp, 0x1d
mov edi, edx
or edi, 0xfd
inc edi
imul edi, ebp
mov ebp, edx
and ebp, 2
or edx, 2
imul edx, ebp
sub edi, edx
add ebx, eax
add ebx, edi
add bl, 0xab
mov byte [esp + esi + 0x1c], bl
inc esi
add ecx, 2
cmp esi, 5
jne 0x428010
mov eax, dword [0x44cd58]
test eax, eax
mov ebx, dword [esp + 8]
je 0x4280b0
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov esi, dword [0x44cd5c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x1b6183f2
je 0x42809a
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
cmp edx, eax
jb 0x428080
jmp 0x4280b0
mov eax, dword [esi + edx*8 + 4]
cmp eax, ecx
jne 0x4280d4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [esp + 0xc]
jmp dword [0x447cb0]
push dword [esp + 0x38]
push 4
push eax
push dword [0x44cd60]
call fcn.0043dda0
add esp, 0x10
mov edi, dword [esp + 0xc]
jmp dword [0x447cb0]
Function at 0x428e37
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edi
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
add ecx, 2
cmp word [eax], 0
jne 0x428e40
sub eax, edi
cmp eax, 0xffffffd9
jge 0x428e59
mov eax, 0xffffffff
jmp 0x428e5c
add eax, 0x26
push eax
call fcn.004083b0
add esp, 4
mov ebx, eax
mov dword [esp + 0x18], 0x39973b98
mov dword [esp + 0x1c], 0x25b427a9
mov dword [esp + 0x20], 0x21b5238e
mov dword [esp + 0x24], 0x2d8a2f89
mov dword [esp + 0x28], 0x29bb2b81
mov dword [esp + 0x2c], 0x15bc17ba
mov dword [esp + 0x30], 0x11bb1383
mov dword [esp + 0x34], 0x1d841f42
mov dword [esp + 0x38], 0x19b01bb0
mov word [esp + 0x3c], 0x718
mov dword [esp + 0x3e], 0
mov word [esp + 0x42], 0
mov eax, 0xd695c20b
mov ecx, 0xf4
nop
movzx edx, byte [esp + eax + 0x296a3e0d]
mov esi, ecx
xor esi, eax
and esi, edx
xor esi, eax
mov edx, esi
and edx, 0x48
xor esi, 0xc8
lea edx, [esi + edx*2]
inc dl
mov byte [esp + eax + 0x296a3e0d], dl
inc eax
dec ecx
cmp eax, 0xd695c237
jne 0x428ed0
movzx ecx, word [edi]
mov eax, ebx
test cx, cx
je 0x428f31
mov edx, edi
add edx, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428f20
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x428f61
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428f50
mov word [eax], 0
jmp dword [0x447d90]

Function at 0x428f85
Capabilities:
Copy file
Encode data using xor

Disassembly:
xor eax, eax
cmp word [ebx], 0x2a
sete al
jmp dword [eax*4 + 0x447d98]

Function at 0x42917d
Capabilities:
Encode data using xor

Disassembly:
lea eax, [esp + 0x18]
mov ecx, 0xf
lea edx, [esp + 0xac]
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xe8]
lea eax, [esp + 0x54]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x1e
push edx
push 0
call dword [0x44cd54]
mov dword [esp + 0x18], 0x418687e9
mov dword [esp + 0x1c], 0
mov eax, 0xa1
mov ecx, 0x57a18f5e
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x89]
mov edx, eax
and edx, edi
mov esi, edx
and esi, 0xffffffad
mov ebx, edx
and ebx, 2
or edx, 2
imul edx, ebx
xor ebx, 2
imul ebx, esi
add edx, ebx
lea esi, [eax + edi]
add esi, 0xa85e7000
mov ebx, ecx
sub ebx, edi
and ebx, edx
not edx
and edx, esi
sub edx, ebx
add dl, 0xdb
mov byte [esp + eax - 0x89], dl
inc eax
dec ecx
cmp eax, 0xa9
jne 0x4291e0
nop
nop
nop
nop

Function at 0x429f28
Capabilities:
Encode data using xor

Disassembly:
mov esi, eax
and al, 1
movzx eax, al
jmp dword [eax*4 + 0x447ee8]
Function at 0x42a330
Capabilities:
Encode data using xor

Disassembly:
push eax
sub esp, 0x10
mov dword [ebp - 0x14], esp
sub esp, 0x14
mov eax, esp
push eax
mov dword [ebp - 0x30], esp
sub esp, 8
mov esi, esp
sub esp, 0x10
mov dword [ebp - 0x18], esp
sub esp, 0x14
mov dword [ebp - 0x24], esp
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
sub esp, 0x1c
mov dword [ebp - 0x2c], esp
sub esp, 0x18
mov dword [ebp - 0x20], esp
sub esp, 0x1c
mov dword [ebp - 0x10], esp
sub esp, 0xc
mov dword [ebp - 0x64], esp
sub esp, 0x20
mov dword [ebp - 0x60], esp
push eax
mov dword [ebp - 0x34], esp
push eax
mov dword [ebp - 0x58], esp
sub esp, 0x1c
mov dword [ebp - 0x40], esp
sub esp, 8
mov dword [ebp - 0x80], esp
sub esp, 8
mov dword [ebp - 0x3c], esp
sub esp, 0x14
mov dword [ebp - 0x7c], esp
sub esp, 0x30
mov dword [ebp - 0x44], esp
sub esp, 0x18
mov dword [ebp - 0x5c], esp
push eax
mov dword [ebp - 0xa0], esp
mov dword [eax], 0xb7f789a5
mov dword [eax + 4], 0xb322b524
mov dword [eax + 8], 0xbfdfb1fc
mov dword [eax + 0xc], 0xbbdbbd20
mov dword [eax + 0x10], 0xa7a6b995
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
add dl, 0x9e
xor dl, byte [eax + ecx]
add dl, 0xea
mov byte [eax + ecx], dl
inc ecx
cmp ecx, 0x14
jne 0x42a3d0
mov edx, eax
mov ebx, dword [ebp - 0x14]
mov edi, ebx
mov ecx, 5
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edi, ebx
mov edx, ebx
add edi, 0x14
add eax, 0x14
xor ebx, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
push dword [ebp - 0x30]
push 0
push 0
push 9
push edx
push 0
call dword [0x44cd54]
mov dword [esi], 0x21e6e7b9
mov word [esi + 4], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
add cl, 0x59
xor cl, byte [esi + ebx]
add cl, 0x43
mov byte [esi + ebx], cl
inc ebx
cmp ebx, 6
jne 0x42a430
jmp dword [0x447f30]
Function at 0x42b26b
Capabilities:
Encode data using xor

Disassembly:
mov dword [edi], 0x23bb2164
mov dword [edi + 4], 0x274525b7
mov dword [edi + 8], 0x5bc859c7
mov dword [edi + 0xc], 0x5f5e5d38
lea eax, [edi + 0x10]
mov word [edi + 0x10], 0
mov ecx, 0xc8a45c38
mov ebx, dword [ebp - 0x2c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [edi + ecx + 0x375ba3c8]
xor edx, ecx
mov esi, edx
not esi
add edx, 0xe7
and esi, 1
or edx, 1
add edx, esi
mov byte [edi + ecx + 0x375ba3c8], dl
inc ecx
cmp ecx, 0xc8a45c4a
jne 0x42b2a0
mov edx, edi
mov esi, dword [ebp - 0x18]
mov edi, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esi + 0x10]
xor edx, edx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [ebx], 0x33db31fc
mov dword [ebx + 4], 0x3fdd3dcf
mov dword [ebx + 8], 0x3bc839cf
mov dword [ebx + 0xc], 0xc705c528
mov dword [ebx + 0x10], 0xc334c121
mov dword [ebx + 0x14], 0xcf3ccd2d
mov dword [ebx + 0x18], 0xcbcac931
xor eax, eax
nop
nop
nop
nop
mov esi, edx
and esi, 0x28
mov ecx, eax
xor ecx, 0xf4
add ecx, esi
xor cl, byte [ebx + eax]
add cl, 0x3c
mov byte [ebx + eax], cl
inc eax
add edx, 2
cmp eax, 0x1c
jne 0x42b320
mov eax, ebx
mov edx, dword [ebp - 0x1c]
mov edi, edx
mov ecx, 7
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [edx + 0x1c]
lea eax, [ebx + 0x1c]
xor edx, edx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 0xcf57c98c
mov dword [ecx + 4], 0xc3a5cd5b
mov dword [ecx + 8], 0xc750c153
mov dword [ecx + 0xc], 0xfb8ac5a0
mov dword [ecx + 0x10], 0xffb8f98c
lea eax, [ecx + 0x14]
mov dword [ecx + 0x14], 0xfdfc
mov byte [ecx + 0x18], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ecx + edx]
mov esi, edx
and esi, 4
xor esi, 0xaa480784
mov edi, edx
and edi, 0x1b
sub edi, esi
mov esi, edi
and esi, 0xd5a11052
xor edi, 0xdfa11252
lea ebx, [edi + esi*2]
add ebx, 0xaa480784
mov esi, ecx
and esi, ebx
add esi, esi
sub ebx, esi
add bl, cl
mov ecx, dword [ebp - 0x10]
add bl, 0x66
mov byte [ecx + edx], bl
inc edx
cmp edx, 0x19
jne 0x42b3a0
mov edx, ecx
mov esi, dword [ebp - 0x20]
mov edi, esi
mov ecx, 5
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esi + 0x14]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov edi, dword [ebp - 0x24]
Function at 0x431d20
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2a0
mov dword [esp + 0x284], 0x448ab4
mov dword [esp + 0xa8], 0
lea eax, [esp + 0xa8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4435e0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x4435f0
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x280], eax
mov eax, dword [esp + 0x284]
mov ecx, dword [esp + 0x280]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x448abc]
xor ecx, 0xee5db259
sub eax, ecx
mov dword [esp + 0x27c], 0x448ac0
mov dword [esp + 0x274], 0x448acc
mov dword [esp + 0x26c], 0x448ad8
mov dword [esp + 0x264], 0x448ae4
mov dword [esp + 0x25c], 0x448af0
mov dword [esp + 0x254], 0x4481e0
mov ecx, dword [0x448afc]
mov dword [esp + 0x13c], ecx
mov dword [esp + 0x250], 0x448b04
mov dword [esp + 0x248], 0x4481e0
mov ecx, dword [0x448b10]
mov dword [esp + 0x178], ecx
mov dword [esp + 0x244], 0x4481e0
mov ecx, dword [0x448b18]
mov dword [esp + 0x174], ecx
mov dword [esp + 0x240], 0x448b20
mov dword [esp + 0x238], 0x448b2c
mov dword [esp + 0x230], 0x4481e0
mov ecx, dword [0x448b38]
mov dword [esp + 0x170], ecx
mov dword [esp + 0x22c], 0x448b40
mov dword [esp + 0x224], 0x448b4c
mov dword [esp + 0x21c], 0x4481e0
mov ecx, dword [0x448b58]
mov dword [esp + 0x16c], ecx
mov dword [esp + 0x218], 0x448b60
mov dword [esp + 0x210], 0x4481e0
mov ecx, dword [0x448b6c]
mov dword [esp + 0x164], ecx
mov dword [esp + 0x20c], 0x448b74
mov dword [esp + 0x204], 0x448b80
mov dword [esp + 0x1fc], 0x448b8c
mov dword [esp + 0x1f4], 0x4481e0
mov ecx, dword [0x448b98]
mov dword [esp + 0x160], ecx
mov dword [esp + 0x1f0], 0x4481e0
mov ecx, dword [0x448ba0]
mov dword [esp + 0x15c], ecx
mov dword [esp + 0x1ec], 0x4481e0
mov ecx, dword [0x448ba8]
mov dword [esp + 0x158], ecx
mov dword [esp + 0x1e8], 0x448bb0
mov dword [esp + 0x1e0], 0x448bbc
mov dword [esp + 0x1d8], 0x4481e0
mov ecx, dword [0x448bc8]
mov dword [esp + 0x168], ecx
mov dword [esp + 0x1d4], 0x4481e0
mov ecx, dword [0x448bd0]
mov dword [esp + 0x180], ecx
mov dword [esp + 0x1d0], 0x4481e0
mov ecx, dword [0x448bd8]
mov dword [esp + 0x184], ecx
mov dword [esp + 0x1cc], 0x448be0
mov dword [esp + 0x1c4], 0x448bec
mov dword [esp + 0x1bc], 0x4481e0
mov edx, dword [0x448bf8]
mov dword [esp + 0x1b8], 0x4481e0
mov ecx, dword [0x448c00]
mov dword [esp + 0x1b4], 0x448c08
mov dword [esp + 0x1ac], 0x448c14
mov dword [esp + 0x1a4], 0x4481e0
mov esi, dword [0x448c20]
mov dword [esp + 0x1a0], 0x4481e0
mov edi, dword [0x448c28]
mov dword [esp + 0x150], edi
mov dword [esp + 0x19c], 0x4481e0
mov edi, dword [0x448c30]
mov dword [esp + 0x14c], edi
mov dword [esp + 0x198], 0x4481e0
mov edi, dword [0x448c38]
mov dword [esp + 0x188], edi
mov dword [esp + 0x194], 0x4481e0
xor ebx, ebx
mov edi, dword [0x448c40]
jmp eax