joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c1d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41c1e0
cmp eax, 0xffffffed
jge 0x41c1f7
mov eax, 0xffffffff
jmp 0x41c1fa
add eax, 0x12
push eax
call fcn.00408350
add esp, 4
mov esi, eax
mov dword [esp], 0xe907eb38
mov dword [esp + 4], 0xed11ef03
mov dword [esp + 8], 0xf1c0f3d8
mov dword [esp + 0xc], 0xf510f714
mov dword [esp + 0x10], 0xfbf4
mov byte [esp + 0x14], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa7
xor cl, byte [esp + eax]
add cl, 0xbd
mov byte [esp + eax], cl
inc eax
cmp eax, 0x15
jne 0x41c240
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41c281
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41c270
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41c2b1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41c2a0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043cd10
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x444024]
Function at 0x425c70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, edx
mov edi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov ebx, 0xffffffff
nop
nop
nop
cmp byte [ebp + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x425c90
lea esi, [ebx + 1]
push esi
call fcn.00408350
add esp, 4
mov dword [esp], edi
mov dword [edi], eax
mov ecx, esi
shr ecx, 2
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, esi
and edx, 0xfffffffc
add eax, edx
add edx, ebp
mov ecx, esi
xor ecx, 0xfffffffc
or esi, 3
and esi, ecx
mov ecx, esi
shr ecx, 1
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov edi, eax
mov eax, dword [esp + 8]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
test bl, 1
jne 0x425cff
and esi, 0xfffffffe
movzx eax, byte [edx + esi]
mov ecx, dword [esp + 4]
mov byte [ecx + esi], al
test ebx, ebx
je 0x425dd0
neg ebx
mov ecx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp]
xor eax, ecx
mov ecx, eax
shr ecx, 1
not eax
mov edx, eax
or edx, 1
sub eax, edx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr ecx, 1
not eax
mov edx, eax
or edx, 1
sub eax, edx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr ecx, 1
not eax
mov edx, eax
or edx, 1
sub eax, edx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr ecx, 1
not eax
mov edx, eax
or edx, 1
sub eax, edx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr ecx, 1
not eax
mov edx, eax
or edx, 1
sub eax, edx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr ecx, 1
not eax
mov edx, eax
or edx, 1
sub eax, edx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr ecx, 1
not eax
mov edx, eax
or edx, 1
sub eax, edx
and eax, 0xedb88320
xor eax, ecx
mov edx, eax
shr edx, 1
not eax
mov ecx, eax
or ecx, 1
sub eax, ecx
and eax, 0xedb88320
mov ecx, eax
xor ecx, edx
inc ebp
inc ebx
jne 0x425d10
not ecx
mov eax, dword [esp]
mov dword [eax + 4], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
jmp 0x425dc2
Function at 0x434250
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x3c]
call fcn.0043d310
add esp, 0x14
test eax, eax
js 0x4343d9
lea ebx, [esp + 0x10]
lea eax, [esp + 0x14]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.0043d750
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x4342ea
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov ecx, eax
inc ecx
jns 0x4342b8
mov eax, 0xffffffff
jmp 0x4342bf
lea eax, [eax*2 + 2]
push eax
call fcn.00408350
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.0043ddb0
add esp, 0x14
test eax, eax
jns 0x4342ea
push esi
call fcn.00408360
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xc0c7c6c5
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 4]
mov ebp, edi
and ebp, 2
mov ebx, ecx
xor ebx, 0x59392cb1
add ebx, ebp
mov ebp, ebx
and ebp, edx
add ebx, edx
add ebp, ebp
sub ebx, ebp
lea ebp, [ebx + 0x41e2208a]
mov eax, ebp
xor eax, 0xfe
mov edx, ebp
or edx, 1
and edx, eax
mov eax, 0xbe1ddf75
sub eax, ebx
mov ebx, eax
not ebx
and eax, 0xb
and ebp, 0xf4
or ebp, eax
and ebx, 1
or ebx, ebp
xor ebx, 0xa
add ebx, edx
mov byte [esp + ecx + 4], bl
inc ecx
add edi, 2
cmp ecx, 7
jne 0x434310
mov ecx, dword [0x44a8e4]
test ecx, ecx
je 0x4343bd
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44a8e8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x4343a0
inc edi
cmp ecx, edi
jne 0x434390
jmp 0x4343bd
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x4343bd
push dword [esp + 0xc]
push 1
push ecx
push dword [0x44a8ec]
call fcn.004390d0
add esp, 0x10
test esi, esi
jne 0x4343db
lea eax, [esp + 4]
push eax
call fcn.0043c930
add esp, 4
test al, al
je 0x4343d9
cmp dword [esp + 4], 1
je 0x4343db
xor esi, esi
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435fa0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x18]
mov dword [esp], 0x919e9f4c
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
mov edi, ecx
and edi, 0xa
mov ebx, edx
xor ebx, 0x6b40ede5
add ebx, edi
xor ebx, esi
mov esi, ebx
and esi, 6
xor ebx, 0x86
lea ebx, [ebx + esi*2]
inc bl
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 7
jne 0x435fd0
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x452908]
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x436020
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x446d98]
Function at 0x436090
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp], 0xc0c7c6c5
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xb1
xor cl, byte [esp + eax]
add cl, 0x8b
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x4360c0
mov edi, dword [esp]
mov eax, dword [0x44a8e4]
test eax, eax
je 0x436126
xor ecx, ecx
mov edx, dword [0x44a8e8]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0x436100
inc ecx
cmp eax, ecx
jne 0x4360f0
jmp 0x436126
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x436126
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push eax
push dword [0x44a8ec]
call fcn.004390d0
add esp, 0x1c
mov edi, eax
mov dword [esp], 0x23626164
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x18
xor cl, byte [esp + eax]
add cl, 0x88
mov byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x436140
cmp edi, dword [esp]
jne 0x436265
push dword [esp + 0xc]
call fcn.00435fa0
add esp, 4
mov esi, dword [esp + 0xc]
mov dword [esp], 0xc0c7c6c5
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
add cl, 0xb1
xor cl, byte [esp + edx]
add cl, 0x8b
mov byte [esp + edx], cl
inc edx
cmp edx, 7
jne 0x436190
mov edi, dword [esp]
mov edx, dword [0x44a8e4]
test edx, edx
je 0x4361fc
mov dword [esp + 8], esi
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x44a8e8]
nop
cmp dword [esi + ebp*8], 0x9abdb589
je 0x4361d2
inc ebp
cmp edx, ebp
jne 0x4361c0
mov ebp, ecx
jmp 0x4361fc
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
mov ebp, ecx
je 0x4361fc
push 0
push dword [esp + 0xc]
push eax
push 5
push 4
push edx
push dword [0x44a8ec]
mov esi, eax
call fcn.004390d0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43625c
mov dword [esp + 8], ebp
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x436235
add edi, 2
cmp si, bp
je 0x436220
cmp si, bp
je 0x436247
mov esi, dword [ecx]
test esi, esi
jne 0x436210
mov edi, 0xc0000225
jmp 0x43625c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 8]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.00436020
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4362a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x436350
xor eax, eax
cmp dword [ecx], 0
jne 0x43639a
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xc0c7c6c5
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
mov ebx, eax
add bl, 0xb1
xor bl, byte [esp + eax]
add bl, 0x8b
mov byte [esp + eax], bl
inc eax
cmp eax, 7
jne 0x436310
mov eax, dword [esp]
mov esi, dword [0x44a8e4]
test esi, esi
je 0x43639a
xor edi, edi
mov ebx, dword [0x44a8e8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xef01f5a1
je 0x4363a3
inc edi
cmp esi, edi
jne 0x436340
jmp 0x43639a
mov dword [esp + 8], 0xbffef9f0
mov word [esp + 0xc], 0
mov eax, 0x9263542a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x6d9cabde]
xor ecx, eax
mov edx, ecx
and edx, 0x2d
xor ecx, 0x2d
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax + 0x6d9cabde], cl
inc eax
cmp eax, 0x92635430
jne 0x436370
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43639a
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push esi
push dword [0x44a8ec]
call fcn.004390d0
add esp, 0x1c
jmp 0x43639a

Function at 0x4363d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43646a
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0xc0c7c6c5
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0xb1
xor bl, byte [esp + edx]
add bl, 0x8b
mov byte [esp + edx], bl
inc edx
cmp edx, 7
jne 0x436400
mov edx, dword [0x44a8e4]
test edx, edx
je 0x43645e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44a8e8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x436440
inc edi
cmp edx, edi
jne 0x436430
jmp 0x43645e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43645e
push eax
push 1
push edx
push dword [0x44a8ec]
mov esi, ecx
call fcn.004390d0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x436a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x436a19
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x436a2a
cmp eax, 2
je 0x436aa0
jmp 0x436acd
push 0xbbf966b4
push dword [0x44a8d8]
call fcn.0043c0e0
add esp, 8
test eax, eax
je 0x436a6b
mov ecx, dword [esi]
test ecx, ecx
je 0x436a98
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x436a74
cmp dword [esp + 4], 0
je 0x436a74
mov dword [esi + 4], 3
jmp 0x436a98
mov dword [esi + 4], 1
jmp 0x436acd
lea eax, [esp + 0xc]
push eax
call fcn.0043c930
add esp, 4
test al, al
je 0x436a98
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x436a95
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x436acd
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x452900]
call fcn.0043c0e0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x436b54
mov ecx, dword [esi]
mov dword [esp + 4], 0xc0c7c6c5
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0xb1
xor dl, byte [esp + eax + 4]
add dl, 0x8b
mov byte [esp + eax + 4], dl
inc eax
cmp eax, 7
jne 0x436af0
mov eax, dword [esp + 4]
mov edx, dword [0x44a8e4]
test edx, edx
je 0x436b54
xor esi, esi
mov ebx, dword [0x44a8e8]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x436b30
inc esi
cmp edx, esi
jne 0x436b20
jmp 0x436b54
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x436b54
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push edx
push dword [0x44a8ec]
call fcn.004390d0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x4376d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x68
mov dword [esp + 0x50], 0x79ee7b96
mov dword [esp + 0x54], 0x7de27fdc
mov dword [esp + 0x58], 0x712073e0
mov dword [esp + 0x5c], 0x75ea77d4
mov dword [esp + 0x60], 0x696a6be8
mov word [esp + 0x64], 0
mov byte [esp + 0x66], 0
xor eax, eax
nop
nop
nop
mov ecx, eax
add cl, 0x3f
xor cl, byte [esp + eax + 0x50]
add cl, 0xc5
mov byte [esp + eax + 0x50], cl
inc eax
cmp eax, 0x17
jne 0x437710
lea eax, [esp + 0x50]
push eax
call fcn.0043bc30
add esp, 4
mov dword [0x452900], eax
mov dword [esp + 0x2c], 0xbccca54e
test eax, eax
je 0x43774c
mov dword [esp + 0x2c], 0x481baa1e
mov edi, 0xdeedf822
xor eax, eax
cmp edi, 0x121861dd
setl al
mov eax, dword [eax*4 + 0x446dc0]
mov ecx, 0x980ad3e7
xor ecx, dword [0x446dc8]
add eax, ecx
inc eax
mov dword [esp + 0x28], ecx
jmp eax

Function at 0x439020
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
xor ecx, ecx
test esi, esi
sete cl
jmp dword [ecx*4 + 0x4473fc]
Function at 0x43a830
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov ecx, eax
add ecx, edi
adc edx, 0
xor ebp, ebp
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x43a8a3
mov ecx, eax
shr ecx, 2
mov edx, edi
mov ebx, edi
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, eax
and edx, 0xfffffffc
add esi, edx
add edx, ebx
mov ecx, eax
shr ecx, 1
and ecx, 1
mov ebx, edx
mov edi, esi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test al, 1
je 0x43aa2a
and eax, 2
movzx ecx, byte [edx + eax]
mov byte [esi + eax], cl
jmp 0x43aa2a
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov eax, 0xb2cef8c5
mov ecx, 0x3a
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x4d31073b]
mov edx, ecx
xor edx, eax
and edx, edi
xor edx, eax
add edx, 0x81f52426
mov ebx, edx
xor ebx, 0xfe
or edx, 1
and ebx, edx
add ebx, edx
mov byte [esp + eax + 0x4d31073b], bl
inc eax
dec ecx
cmp eax, 0xb2cef8cb
jne 0x43a8c0
mov ebp, dword [esp]
mov ecx, dword [0x44a8e4]
test ecx, ecx
je 0x43a956
xor edx, edx
mov edi, dword [0x44a8e8]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x43a92a
mov ebx, edx
xor ebx, 1
and edx, 1
lea edx, [ebx + edx*2]
cmp edx, ecx
jb 0x43a910
jmp 0x43a956
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, ebp
je 0x43a956
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push ecx
push dword [0x44a8ec]
call fcn.004390d0
add esp, 0x28
mov ebp, eax
test ebp, ebp
mov edi, dword [esp + 0x20]
js 0x43aa2a
push 0x732f71fd
push dword [0x452900]
call fcn.0043c0e0
add esp, 8
push 0
push 0
push dword [esp + 0x34]
push esi
push dword [esp + 0x34]
push edi
push dword [esp + 0x20]
call eax
mov ebp, eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov edx, 0xb2cef8c5
mov esi, 0x3a
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx + 0x4d31073b]
mov edi, esi
xor edi, edx
and edi, ebx
xor edi, edx
add edi, 0x81f52426
mov ebx, edi
xor ebx, 0xfe
or edi, 1
and ebx, edi
add ebx, edi
mov byte [esp + edx + 0x4d31073b], bl
inc edx
dec esi
cmp edx, 0xb2cef8cb
jne 0x43a9b0
mov edx, dword [0x44a8e4]
test edx, edx
je 0x43aa2a
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44a8e8]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43aa10
inc edi
cmp edx, edi
jne 0x43aa00
jmp 0x43aa2a
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43aa2a
push ecx
push 1
push edx
push dword [0x44a8ec]
call fcn.004390d0
add esp, 0x10
mov eax, ebp
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43bc30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 8], 0xd7d6c938
mov word [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 8]
lea ecx, [eax + 0x2e]
lea edx, [esi + esi]
not edx
add edx, esi
mov ebx, 0xd1
sub ebx, eax
and ebx, esi
not esi
or edx, esi
and edx, ecx
or ebx, edx
add bl, 0x1a
mov byte [esp + eax + 8], bl
lea ecx, [eax + eax]
and ecx, 2
sub eax, ecx
inc eax
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [eax + edx*2]
cmp eax, 6
jb case.default.0x43bc9f
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x28], 0
sete cl
jmp dword [ecx*4 + 0x447f84]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp], 0
mov edi, dword [0x447fc0]
mov ecx, dword [edx]
xor eax, eax
cmp ecx, edx
setne al
mov dword [esp + 0x10], edx
jmp dword [eax*4 + 0x447f8c]
mov dword [esp + 4], ecx
mov ebp, dword [ecx + 0x30]
xor eax, eax
test ebp, ebp
setne al
mov ebx, 1
jmp dword [eax*4 + 0x447fa4]
mov eax, dword [case.0x43bc9f.6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [0x447fd8]
nop
nop
nop
jmp eax
Function at 0x43cb50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43cb70
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x43cb8b
mov eax, 0xffffffff
jmp 0x43cb8e
add eax, 0xa
push eax
call fcn.00408350
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea eax, [edi + 4]
mov word [esi + 8], 0
mov ecx, esi
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43cbd1
add ebx, 2
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43cbc0
mov word [ecx], 0
mov ecx, eax
and ecx, 0xfffd
and edi, 2
mov edx, edi
xor edx, 2
imul edx, ecx
or eax, 2
imul eax, edi
lea ecx, [eax + edx]
mov word [esp + 8], cx
add eax, edx
add eax, 2
mov word [esp + 0xa], ax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xf8fbfafd
mov word [esp + 4], 0
mov edx, 0x65053c2b
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx - 0x65053c2b]
mov ebx, eax
mov edi, eax
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0x3d
mul cl
mov ecx, eax
mov eax, edi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0x29
mov byte [esp + edx - 0x65053c2b], al
inc edx
cmp edx, 0x65053c31
jne 0x43cc50
mov edi, dword [esp]
mov eax, dword [0x44a8e4]
test eax, eax
je 0x43ccf0
xor ecx, ecx
mov edx, dword [0x44a8e8]
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x1affabda
je 0x43ccc0
inc ecx
cmp eax, ecx
jne 0x43ccb0
jmp 0x43ccf0
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43ccf0
mov ecx, esp
lea edx, [esp + 0x10]
push ebp
push dword [esp + 0x4c]
push ecx
push edx
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push eax
push dword [0x44a8ec]
call fcn.004390d0
add esp, 0x24
mov edi, eax
push esi
call fcn.00408360
add esp, 4
mov eax, edi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401ae0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401b1f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401b1f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401b1f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401b1f
cmp dword [ecx + 0x74], 0xe
jbe 0x401b1f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6f7b1508
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section._RDATA
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x10bb586a
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219