joyce8/EMBER2024-capa huggingface dataset:
Function at 0x72fa6b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + ecx - 0xef9dae]
mov dword [esp + 0x10], 0x9afc577a
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.00797830

Function at 0x733861
Capabilities:
Check for vm using instruction vpcext

Disassembly:
add edi, 4
call fcn.0075c3cb
mov al, byte gs:[0x8cfc2f78]
push eax
imul ebx
pop esi
invalid

Function at 0x73f593
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ebx, eax
add edi, eax
mov dword [esp + ecx*2 - 0x435bfe2e], 0xbd9b7e95
movsx eax, cx
mov ecx, dword [ecx + esi - 0x21adff17]
shr eax, 0xe4
btr ax, ax
mov eax, dword [esi + eax*8 - 0x7fffff84]
call fcn.0078356d

Function at 0x75f78a
Capabilities:
Set environment variable
Set registry value

Disassembly:
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x24]
jmp 0x5d023e
push ecx
push str.DNGTrialTimesLeft
jmp 0x5d0765
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
jmp 0x5e24fb
jmp 0x438cf5
and eax, eax
bswap ecx
seto dl
shl dword [esp + edx + 4], 0xfd
not dword [esp + edx*2 + 4]
rol ecx, 1
sar dx, 0xce
not ecx
imul al
jb 0x7531e2
push eax
jmp 0x5ce33b
sbb ecx, edx
jmp 0x790202
rol ecx, 1
mov dword [esp + eax*2 - 0x6c2fff6a], eax
cwde
xor ecx, 0x4abbb737
jmp 0x6b98a3
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0xb8]
or ah, 0xb6
sub edx, esi
movsx eax, sp
push edx
movzx ax, al
lea eax, [esp + 0x28]
jmp 0x7b1415
not dword [esp + edx*2 + 4]
sal dword [esp + edx*8 + 4], 0x5a
xor ebx, ecx
sal eax, 0xd
add esi, ecx
add edx, dword [edx + edi]
mov cl, byte [edi + 4]
call fcn.005eb054
push ecx
push edi
jmp 0x7791c6
push 0x45f34c
jmp 0x6dc016

Function at 0x76c775
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb eax, 0xd781c029
rol ecx, cl
xadd cx, dx
call fcn.0078bc8e
mov eax, 0x7c90eb1b
shl eax, 0xc6
mov edx, eax
pop edi
dec edx
lea edi, [edi + eax - 0x243ac6c5]
movsx ecx, dl
lea ebp, [ebp + edx*2 - 0x48758d82]
cdq
mov eax, dword [ebp + eax*2 - 0x48758d80]
dec ecx
xor eax, ebx
neg ecx
bt dx, dx
jae 0x6ade10

Function at 0x770577
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
or ecx, 0x9b845c2f
sar ecx, cl
adc ebp, 3
push ecx
call fcn.0067e022
shld dx, ax, cl
mov dword [esp], 0x2e2d571b
call fcn.00656b37
mov eax, 0x42215c10
and ax, ax
movsx edx, ax
mov eax, dword [ebp + eax - 0x42215c10]
movsx ecx, dl
sar ecx, 0x16
mov edx, dword [edx + ebp - 0x5c0c]
jns 0x6687b3
pop eax
xor dl, dh
xor ebx, ecx
sub edx, dword [esp + eax - 0x79fd61f5]
mov dword [esp + eax - 0x79fd61fa], eax
adc ebp, ecx
mov dword [esp + eax - 0x79fd61fa], ebp
ret 0xc
Function at 0x7806cd
Capabilities:
Read file on windows

Disassembly:
push ebx
cmc
push esi
jmp 0x6a8c7d
push ebp
shr bp, 0xaa
mov ebp, 0xfb2ae419
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
jmp 0x6c6c6a

Function at 0x797e05
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push esi
pushfd
mov esi, 0x8e9cb536
push ebx
mov dword [esp + 0x10], 0xebb62b51
mov esi, dword [esp + esi + 0x71634ad2]
mov ebx, 0xc9efe87
mov ebx, 0x7b09b19f
xor bl, 0xa3
and bl, bh
mov ebx, dword [esp + ebx - 0x7b09b130]
jl 0x797e26
js 0x797e1c
call fcn.005c1da1

Function at 0x797f10
Capabilities:
Encode data using xor

Disassembly:
movsx eax, word [esp + 8]
mov eax, dword [esi]
pop ecx
lea ecx, [edx*2 + 0x613b7e8f]
xor eax, ebx
sub eax, 0x91881009
pop edx
xor eax, 0x82323a3f
ror eax, 3
xor eax, 0x5f3fb396
call fcn.0070c0f0
sub bh, cl
dec ebx
inc ecx
mov eax, ecx
out 0xb6, eax
dec ebx
jnp 0x797f1a
push ebp
invalid
push 0x5b
sal dword [ebp - 0x1d3eb2fb], 0x8e
xor al, 0x52
mov esp, 0x4ae0b23e
inc ecx
or bh, byte [esi + 0x414363f4]
mov ebp, 0x3eb67555
cmc
aas
push esi
shl dword [esi + 0x416d968a], 0x72
push es
inc ebx
mov cl, 0xf4
xchg byte [esi + 0x1adb3659], dl
rcl dword [0x414d7d1f], 0xd3
inc esp
push ss
movsd dword es:[edi], dword [esi]
cwde
jae 0x797fc8
jl 0x798004
push ebx
mov bh, 0xe9
lahf
sbb eax, 0x239b4c3c
ljmp 0x20ca
scasd eax, dword es:[edi]
sbb eax, 0x20ca5d1d
invalid
leave
movsb byte es:[edi], byte [esi]
mulps xmm0, xmmword [ecx + 0x11defbd1]
add bh, bh
loope 0x797f8f
sbb dword [ebp - 0x53728cf6], ebx
sub ah, bl
invalid
dec esp
and eax, 0x4c0d0d00
daa
mov dl, 0x8b
inc ebp
add al, 0xe8
insd dword es:[edi], dx
push esi
out 0xff, eax
xadd dword [esp + ecx*2], edx
mov dword [esp + edx - 0x7fb8c9af], edi
ret
Function at 0x7ae743
Capabilities:
Execute anti-debugging instructions

Disassembly:
and al, dl
lea edx, [ecx*8 + 0x6c16a8ac]
inc dx
mov word [ebp + edx - 0x6c16a8ad], ax
mov ecx, dword [esi + edx - 0x6c16a8ad]
mov eax, 0x548b9fb4
and edx, 0xe1206901
lea esi, [edx + esi - 0x600027fd]
btr ax, ax
imul eax, eax
xor ecx, ebx
shl eax, 0xfd
neg ax
cdq
neg ecx
xchg dx, ax
dec ecx
bswap ecx
ror edx, 0x8e
call fcn.0074219e
pop ecx
cdq
sub ebp, 4
mov eax, dword [ebp]
xor dx, dx
jp 0x71afef
call fcn.006d9653
lea esi, [esi + ecx - 0x4f0b02f7]
sbb ecx, ecx
not dl
xor al, bl
jmp 0x78a184
sal dx, 0xe7
sub cx, 0xca97
sbb ebp, 2
xchg dx, cx
mov word [ebp], ax
sar cl, 0x61
mov edx, dword [esi]
jp 0x6fcd19
movzx edi, ax
lea esi, [esi + edi*4 - 0x350f0]
movzx ebp, al
mov ebp, ecx
cdq
mov edi, esi
call fcn.006c9644
adc esi, 4
sub ecx, ecx
xor edx, ebx
movsx eax, cx
rol al, 0x27
rol edx, 1
call fcn.0065cd50
push esi
invalid
ror al, 1
add al, cl
xor al, 0x36
btr cx, 0xb5
neg al
inc dx
xor bl, al
jmp 0x6c1fbd
lea edx, [esp + edx + 0x18]
xor ecx, 0x3abc2ab0
not ax
xadd ax, cx
movzx cx, byte [edx + eax - 0xae8f80]
sar eax, 0x70
lea esi, [esi + eax*2 - 0x15e]
shr dword [esp + eax*2 - 0x14b], 0x45
mov word [esi + eax*2 - 0x15c], cx
movsx ecx, ax
lea edx, [ecx*2 + 0x58b2e83e]
pop edx
pop edx
pop ecx
pop eax
pop edx
pop eax
jne fcn.0077ff4c
mov ecx, 0x4f0b5f13
lea edx, [ecx + ecx*2 + 0x7538a121]
movzx eax, byte [esi + edx - 0x625abe5a]
imul edx, ecx
sar cx, 0x65
jbe 0x6a957f
movzx ax, byte [ebp]
mov ecx, 0xbb0796b7
mov dl, byte [ebp + 2]
add ebp, 2
sal ecx, 0x5d
pop es
mov ebx, 0x8102558a
lds eax, [edx]
add byte [eax], al
add cl, al
int1
pop ebp
not al
not dl
jne 0x68d087
out 0xf1, al
out dx, eax
jo 0x7ae815
sti
add eax, 0x94283e9a
lodsb al, byte [esi]
mov eax, dword [0x2a086cbe]
xchg edi, eax
cdq
mov esi, 0xc179734f
add ecx, dword [esi + 0x18]
xchg dword [esi], edi
dec ebp
in eax, dx
push ebx
xchg ebp, eax
push 0xffffffffffffffc1
xor edi, edx
jl 0x7ae7b7
or al, 0x82
lodsd eax, dword [esi]
lea edi, [esi]
add al, 0x1f
jnp 0x7ae841
sub al, 0xd8
aam 0xe6
int 0xd0
cld
pop es
invalid
leave
arpl word [ebp - 0x14], cx
call dword [ebp - 0x5db0bce1]
mov dword [edx - 0x712ee2a9], edi
and bh, 0xf9
scasd eax, dword es:[edi]
push 0xb5e3335d
mov edi, 0xd0066a3
call 0x72048bac
xchg edi, eax
retf
neg eax
inc dl
not dl
sub eax, ecx
rol dl, 1
xadd byte [esp + 0x10], ch
call fcn.0072edbb
jmp loc.00423518
Function at 0x7b5828
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, 0xa30ff42d
mov word [edi], dx
add eax, 0xcd1e84ab
mov byte [esp + 3], 0x19
call fcn.00651add
xor ebx, ecx
rol al, 0xe6
add edi, ecx
mov dword [esp + edx - 0x18928004], edi
ret
cbw
not ecx
bts eax, edx
jae 0x6824c1
mov ecx, dword [edi]
mov eax, 0xc2b6842a
rol al, 0x82
mov eax, dword ss:[ecx]
mov ecx, 0x7ba03c9d
or ecx, ecx
mov dword [edi + ecx - 0x7ba03c9d], eax
lea edx, [ecx + ecx + 0x5dbc2f98]
xadd dl, dh
adc ecx, 0xfb228aa1
lea esi, [ecx + esi - 0x76c2c743]
dec ecx
lea eax, [edx + 0x4b053e94]
mov eax, dword [esi + edx - 0x54fcd27a]
btc cx, cx
bts ecx, 0xa2
not ecx
xor eax, ebx
rol dx, cl
sbb eax, 0xa0ace305
shl cx, cl
xadd ecx, edx
not eax
shr edx, 0x30
dec eax
or ecx, ecx
setb dl
rol eax, 1
imul dx, cx
call fcn.007937cf
movzx dx, byte [edi]
movzx ecx, al
inc word [esp + ecx*4 - 0x104]
mov cl, byte [edi + ecx*4 - 0x102]
and dword [esp], eax
adc edi, 2
cbw
not dword [esp]
shr dl, cl
jmp 0x5fd93e
lea ecx, [edx + ecx - 0x14f3f3de]
not ecx
mov dword [esp + edx - 0x18928004], eax
sbb ecx, 0x89281d1f
jmp 0x6aff96

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x400703ff
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x1e091f83
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x403f80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0051efe0
mov eax, dword [0x5ff004]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x1000
lea eax, [ebp - 0x1004]
mov edi, 0x811c9dc5
push eax
mov eax, dword [ecx + 0xc]
push ecx
call eax
mov al, byte [ebp - 0x1004]
add esp, 0xc
test al, al
je 0x403fe6
push esi
lea esi, [ebp - 0x1004]
movsx eax, al
push eax
call fcn.0050d12b
imul edi, edi, 0x1000193
lea esi, [esi + 1]
movzx ecx, al
add esp, 4
xor edi, ecx
mov cl, byte [esi]
mov al, cl
test cl, cl
jne 0x403fc3
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.00502eb4
mov esp, ebp
pop ebp
ret

Function at 0x406a60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
push ebx
mov dword [ebp - 8], edx
xor esi, esi
mov dword [ebp - 4], ecx
call fcn.0050f2a0
mov edi, eax
add esp, 8
test edi, edi
je 0x406b6c
push 0x1048
push 1
call fcn.0050f2a0
mov esi, eax
add esp, 8
test esi, esi
je 0x406b6c
mov edx, dword [ebp - 8]
mov ecx, edx
mov eax, dword [ebp - 4]
mov dword [esi + 0x103c], ebx
mov dword [esi], 0x4067f0
mov dword [esi + 4], 0x4069a0
lea ebx, [ecx + 1]
mov dword [esi + 8], 0x4069b0
mov dword [esi + 0xc], 0x4069d0
mov dword [esi + 0x10], 0x406a10
mov dword [esi + 0x14], 0x406a30
mov dword [esi + 0x1c], eax
mov dword [esi + 0x1038], edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406ae5
sub ecx, ebx
mov dword [esi + 0x1020], ecx
cmp ecx, 0x1000
jae 0x406b6c
push ecx
push edx
lea eax, [esi + 0x20]
push eax
call fcn.00504df0
mov eax, dword [esi + 0x1020]
add esp, 0xc
cmp dword [ebp - 4], 0
mov byte [esi + eax + 0x20], 0
je 0x406b4a
push 2
push 0
push 0
push dword [esi + 0x1c]
call fcn.0050fe5f
push dword [esi + 0x1c]
call fcn.0050f8a2
push 0
push 0
push 0
push dword [esi + 0x1c]
mov dword [esi + 0x1044], eax
call fcn.0050fe5f
add esp, 0x24
jmp 0x406b54
mov dword [esi + 0x1044], 0
mov eax, dword [esi + 0x1044]
cmp eax, 0xffffffff
jne 0x406b84
push 0x5ef5b0
call fcn.0040b9e0
add esp, 4
push edi
call fcn.005092c3
push esi
call fcn.005092c3
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x406bd2
cmp eax, dword [esi + 0x103c]
jae 0x406bd2
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x406bd2
push ecx
push eax
push 1
push dword [esi + 0x1038]
mov dword [esi + 0x1030], 0
mov dword [esi + 0x1034], 0
call fcn.0050fabc
push dword [esi + 0x1c]
mov dword [esi + 0x1040], eax
call fcn.005066d6
add esp, 0x14
mov dword [esi + 0x1c], 0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x5ff004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x184
mov dword [ebp - 0x198], eax
mov ebx, edx
lea eax, [ebp - 0x190]
mov edi, ecx
push 0
push eax
call fcn.00504370
mov esi, dword [ebp + 0x10]
add esp, 0xc
lea ecx, [esi + esi*2]
shl ecx, 6
test ecx, ecx
je 0x474817
cmp ecx, 0x180
ja 0x474817
mov eax, ebx
cdq
push ecx
mov ebx, edx
mov dword [ebp - 0x194], eax
push ebx
push eax
lea eax, [ebp - 0x190]
push eax
mov eax, dword [edi]
push edi
call eax
add esp, 0x14
mov dword [ebp - 0x10], eax
test esi, esi
jle 0x4746f0
lea edx, [ebp - 0x18e]
movzx ecx, byte [edx - 2]
lea edx, [edx + 0xc0]
movzx eax, byte [edx - 0xc1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 0xc0]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 0xbf]
shl ecx, 8
or ecx, eax
xor ecx, 0xa0024e9f
mov eax, ecx
sar eax, 0x18
mov byte [edx - 0xc2], al
mov eax, ecx
sar eax, 0x10
mov byte [edx - 0xc1], al
mov eax, ecx
sar eax, 8
mov byte [edx - 0xc0], al
mov byte [edx - 0xbf], cl
sub esi, 1
jne 0x474690
push 0x20
push 1
call fcn.0050f2a0
mov esi, eax
add esp, 8
test esi, esi
je 0x474817
mov edx, dword [ebp - 0x198]
mov ecx, esi
push ebx
push dword [ebp - 0x194]
mov dword [esi], 0x406f10
mov dword [esi + 4], fcn.00406f30
mov dword [esi + 8], 0x406f50
mov dword [esi + 0xc], 0x406df0
mov dword [esi + 0x10], 0x406f70
mov dword [esi + 0x14], fcn.00406f90
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edi
call fcn.00407110
mov edi, eax
add esp, 8
test edi, edi
je 0x47480e
push 0x38
push 1
mov esi, edi
call fcn.0050f2a0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x474805
mov dword [ebx], 0x4071a0
mov dword [ebx + 4], 0x4071c0
mov dword [ebx + 8], 0x406f50
mov dword [ebx + 0xc], 0x406df0
mov dword [ebx + 0x10], 0x4071f0
mov dword [ebx + 0x14], 0x407230
mov eax, dword [edi + 0x18]
push 0x184
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edi
call fcn.0050cda6
add esp, 4
mov dword [ebx + 0x20], eax
test eax, eax
je 0x4747fc
mov edi, eax
lea esi, [ebp - 0x190]
mov ecx, 0x61
mov eax, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x24], 0x184
mov dword [ebx + 0x28], 0x4745b0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00502eb4
mov esp, ebp
pop ebp
ret
push eax
call fcn.005092c3
add esp, 4
push ebx
call fcn.005092c3
add esp, 4
mov eax, dword [esi + 0x14]
push esi
call eax
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00502eb4
mov esp, ebp
pop ebp
ret
Function at 0x483030
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x5ff004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x5c], edi
mov al, byte [edi]
cmp al, 0x1f
jae 0x483068
push 0x1048
movzx esi, al
call fcn.0050cda6
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x48307c
mov dword [edi + 0x28], eax
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00502eb4
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edi, edi
mov eax, ecx
cdq
idiv esi
mov al, byte [edx + edi + 1]
mov byte [ebp + ecx - 0x4c], al
inc ecx
cmp ecx, 0x48
jb 0x483080
xor edx, edx
jmp 0x4830a0
movzx ecx, byte [ebp + edx - 0x4c]
movzx eax, byte [ebp + edx - 0x4b]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + edx - 0x4a]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + edx - 0x49]
shl ecx, 8
or ecx, eax
xor ecx, dword [edx + 0x533b70]
mov dword [edx + ebx], ecx
add edx, 4
cmp edx, 0x48
jl 0x4830a0
lea edi, [ebx + 0x48]
mov dword [ebp - 0x50], 0
mov ecx, 0x400
mov dword [ebp - 0x54], 0
mov esi, 0x533bb8
rep movsd dword es:[edi], dword [esi]
xor esi, esi
lea eax, [ebp - 0x54]
mov ecx, ebx
push eax
lea edx, [ebp - 0x50]
call fcn.004f0e80
mov eax, dword [ebp - 0x50]
add esp, 4
mov dword [ebx + esi*4], eax
mov eax, dword [ebp - 0x54]
mov dword [ebx + esi*4 + 4], eax
add esi, 2
cmp esi, 0x12
jl 0x4830f3
lea esi, [ebx + 0x4c]
mov dword [ebp - 0x58], 4
mov edi, 0x80
lea eax, [ebp - 0x54]
mov ecx, ebx
push eax
lea edx, [ebp - 0x50]
call fcn.004f0e80
mov eax, dword [ebp - 0x50]
add esp, 4
mov dword [esi - 4], eax
mov eax, dword [ebp - 0x54]
mov dword [esi], eax
add esi, 8
sub edi, 1
jne 0x483128
sub dword [ebp - 0x58], 1
jne 0x483123
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax + 0x28], ebx
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00502eb4
mov esp, ebp
pop ebp
ret
Function at 0x492e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov edx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [edx + 4]
test ebx, ebx
jle 0x492ed4
mov edx, ecx
jmp 0x492eb0
mov eax, edi
imul edi, edi, 0x1dba038f
sar eax, 8
xor al, byte [esi + edx]
mov byte [esi + edx], al
inc esi
movsx eax, al
imul ecx, eax, 0x14ee3
add edi, ecx
cmp esi, ebx
jl 0x492eb0
mov edx, dword [ebp + 8]
add dword [edx + 8], ebx
mov dword [edx + 4], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e11d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x5ff004]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esp + 8], eax
lea eax, [ebx + 0x1c]
push edi
xor edi, edi
mov dword [esp + 0x14], edx
cmp eax, 0x100
jle 0x4e1219
mov ecx, dword [esp + 0xc]
xor edx, edx
jmp 0x4e1333
push ebx
push 0
push dword [ebp + 0x10]
lea eax, [esp + 0x38]
push eax
mov eax, dword [ecx]
push ecx
call eax
add esp, 0x14
cmp eax, ebx
je 0x4e123b
mov ecx, dword [esp + 0xc]
xor edx, edx
jmp 0x4e1333
mov al, byte [esp + 0x2c]
xor edi, edi
cmp al, 3
je 0x4e1297
cmp al, 4
je 0x4e1297
movzx ecx, byte [esp + 0x2d]
xor esi, esi
shl cx, 8
movzx eax, al
or cx, ax
mov eax, 0x1000
movzx edi, cx
cmp di, ax
jbe 0x4e1278
push edi
mov edx, ebx
lea ecx, [esp + 0x30]
call fcn.004e0d20
add esp, 4
jmp 0x4e1282
mov eax, 0x165
cmp di, ax
je 0x4e1290
mov eax, 0x6501
cmp di, ax
je 0x4e1290
xor edi, edi
jmp 0x4e129c
mov edi, 1
jmp 0x4e129c
mov esi, 1
mov ecx, dword [esp + 0xc]
lea edx, [ebx + 0x1c]
add ecx, 0xfffffff8
mov dword [esp + 0x18], 0x46464952
add ecx, edx
mov dword [esp + 0x20], 0x45564157
mov eax, ecx
mov byte [esp + 0x1c], cl
sar eax, 8
mov byte [esp + 0x1d], al
mov eax, ecx
sar eax, 0x10
mov byte [esp + 0x1e], al
mov eax, ebx
sar ecx, 0x18
neg esi
mov byte [esp + 0x1f], cl
mov ecx, dword [esp + 0xc]
sbb esi, esi
sar eax, 8
and esi, 0x11ccdff2
mov byte [esp + 0x29], al
add esi, 0x20746d66
mov eax, ebx
mov dword [esp + 0x24], esi
sar eax, 0x10
mov byte [esp + 0x2a], al
mov eax, ebx
sar eax, 0x18
mov byte [esp + 0x2b], al
mov eax, ecx
mov byte [esp + 0x28], bl
sar eax, 8
mov dword [esp + ebx + 0x2c], 0x61746164
mov byte [esp + ebx + 0x31], al
mov eax, ecx
sar eax, 0x10
mov byte [esp + ebx + 0x32], al
mov eax, ecx
sar eax, 0x18
mov byte [esp + ebx + 0x30], cl
mov byte [esp + ebx + 0x33], al
push 0
push 0
push ecx
mov ecx, dword [esp + 0x20]
mov eax, edx
push 0
push dword [esp + 0x20]
cdq
push edx
push eax
lea edx, [esp + 0x34]
call fcn.00409810
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x4e136e
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00502eb4
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x4e1385
xor edx, edx
mov dword [esi + 0xe4], 1
mov ecx, esi
call fcn.0040a600
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00502eb4
mov esp, ebp
pop ebp
ret
Function at 0x4e27f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, edx
mov eax, 0x80808081
mul dword [ebp + 8]
push edi
mov eax, edx
xor edi, edi
shr eax, 7
mov dword [ebp - 8], eax
add eax, 0x1c
add eax, dword [ebp + 8]
cmp eax, esi
jbe 0x4e2820
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
mov esi, ecx
test ebx, ebx
setne al
dec al
mov byte [esi + 0x12], bl
and al, 2
mov dword [esi], 0x5367674f
mov byte [esi + 5], al
mov eax, dword [ebp + 0x10]
mov ecx, eax
sar ecx, 8
mov byte [esi + 7], cl
mov ecx, eax
mov byte [esi + 6], al
sar ecx, 0x10
mov byte [esi + 8], cl
mov ecx, eax
cdq
mov eax, ebx
sar ecx, 0x18
sar eax, 8
mov byte [esi + 0x13], al
mov eax, ebx
sar eax, 0x10
mov byte [esi + 0x14], al
mov eax, dword [ebp - 8]
inc al
mov byte [esi + 0xa], dl
mov byte [esi + 0xb], dl
mov byte [esi + 0xc], dl
mov byte [esi + 0xd], dl
mov edx, dword [ebp + 8]
sar ebx, 0x18
mov byte [esi + 0x1a], al
mov eax, 0x1b
mov byte [esi + 4], 0
mov byte [esi + 9], cl
mov dword [esi + 0xe], 0x7667
mov byte [esi + 0x15], bl
mov dword [esi + 0x16], edi
test edx, edx
je 0x4e28cc
lea ecx, [ecx]
mov ecx, edx
sub ecx, edi
cmp ecx, 0xff
jle 0x4e28b1
mov ecx, 0xff
mov byte [eax + esi], cl
add edi, ecx
inc eax
cmp edi, edx
je 0x4e28bf
jb 0x4e28a0
jmp 0x4e28cc
cmp ecx, 0xff
jne 0x4e28cc
mov byte [eax + esi], 0
inc eax
add eax, edx
xor ebx, ebx
xor edi, edi
test eax, eax
jle 0x4e28f0
movzx edx, byte [edi + esi]
mov ecx, ebx
shr ecx, 0x18
inc edi
xor edx, ecx
shl ebx, 8
xor ebx, dword [edx*4 + 0x52eee8]
cmp edi, eax
jl 0x4e28d6
mov ecx, ebx
mov byte [esi + 0x16], bl
sar ecx, 8
mov byte [esi + 0x17], cl
mov ecx, ebx
sar ecx, 0x10
sar ebx, 0x18
pop edi
mov byte [esi + 0x19], bl
mov byte [esi + 0x18], cl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e9c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x5ff004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x54], eax
push edi
mov edi, edx
mov dword [ebp - 0x50], edi
test eax, eax
je 0x4e9dfd
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
cmp dword [eax], ebx
jle 0x4e9dfc
push esi
xor esi, esi
mov dword [ebp - 0x2c], esi
jmp 0x4e9ca0
mov eax, dword [eax + 8]
mov esi, dword [esi + eax + 0x500]
mov dword [ebp - 0x4c], esi
test esi, esi
je 0x4e9de0
test edi, edi
jne 0x4e9cd3
push dword [esi + 0xc]
call fcn.005092c3
add esp, 4
mov dword [esi + 0xc], edi
mov dword [esi + 8], 1
jmp 0x4e9de0
cmp dword [esi + 0xc], 0
jne 0x4e9cfe
push 0x1410
call fcn.0050cda6
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4e9cf4
mov dword [esi + 0xc], eax
jmp 0x4e9ddd
mov ecx, ebx
call fcn.004fde80
mov dword [esi + 0xc], ebx
mov ecx, str.UaoK3P94vdxX_ftk_mnjoO
mov dword [esi + 8], 1
sub ecx, edi
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x28], ecx
lea eax, [edi + 2]
lea ecx, [ebp - 0x1c]
mov ebx, dword [ebp - 0x28]
sub ecx, edi
mov dword [ebp - 0x30], ecx
mov ecx, 0x5f89c1
sub ecx, edi
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x1b]
sub ecx, edi
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
mov ecx, 0x5f89c2
sub ecx, edi
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x1a]
sub ecx, edi
mov dword [ebp - 0x40], ecx
mov ecx, 0x5f89c3
sub ecx, edi
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x19]
sub ecx, edi
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x48], ecx
xor edx, edx
movzx ecx, byte [edx + str.UaoK3P94vdxX_ftk_mnjoO]
lea edx, [edx + 6]
xor cl, byte [eax - 2]
lea eax, [eax + 6]
mov byte [ebp + edx - 0x22], cl
movzx ecx, byte [edx + 0x5f89bb]
xor cl, byte [eax - 7]
mov byte [ebp + edx - 0x21], cl
movzx ecx, byte [ebx + eax - 6]
xor cl, byte [eax - 6]
mov ebx, dword [ebp - 0x38]
mov byte [edi + eax - 6], cl
movzx ecx, byte [esi + eax - 6]
xor cl, byte [eax - 5]
mov byte [ebx + eax - 6], cl
mov ecx, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x40]
movzx ecx, byte [ecx + eax - 6]
xor cl, byte [eax - 4]
mov byte [ebx + eax - 6], cl
mov ecx, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x48]
movzx ecx, byte [ecx + eax - 6]
xor cl, byte [eax - 3]
sub dword [ebp - 0x24], 1
mov byte [ebx + eax - 6], cl
mov ebx, dword [ebp - 0x28]
jne 0x4e9d62
mov esi, dword [ebp - 0x4c]
lea edx, [ebp - 0x1c]
mov ecx, dword [esi + 0xc]
call fcn.004fdb20
mov edi, dword [ebp - 0x50]
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
inc ebx
mov esi, dword [ebp - 0x2c]
add esi, 0x504
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], esi
cmp ebx, dword [eax]
jl 0x4e9ca0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00502eb4
mov esp, ebp
pop ebp
ret