joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x435451
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x435399
lea ecx, [edi + 4]
add edi, 2
mov eax, dword [esp]
mov esi, eax
cmp edi, edx
mov edi, ecx
mov ebp, dword [esp + 0x18]
jae 0x435453
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.00418d00
add esp, 4
mov ebx, eax
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.00418d00
mov edx, dword [esp + 0x20]
add esp, 4
mov bh, al
shl bl, 2
shr al, 4
and al, 3
or al, bl
lea ecx, [esi + 1]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi], al
cmp edi, edx
jae 0x435380
movzx eax, byte [ebp + edi]
push eax
call fcn.00418d00
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x435380
mov bl, al
shl bh, 4
shr al, 2
and al, 0xf
or al, bh
lea ecx, [esi + 2]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi + 1], al
lea eax, [edi + 1]
cmp eax, edx
jae 0x435380
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.00418d00
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x435380
shl bl, 6
mov ecx, eax
and cl, bl
add cl, cl
xor bl, al
add bl, cl
mov eax, dword [esp + 0x20]
mov byte [eax + esi + 2], bl
add esi, 3
mov dword [esp], esi
jmp 0x435380
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x438880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov dword [esp + 8], 0xfbf8f916
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x13], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xe
ja 0x438906
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0xcfa0a01f
add eax, 0xcfa0a01f
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
mov ecx, eax
xor ecx, 0x26
and eax, 0x26
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xf
jb 0x4388c0
mov ecx, dword [ebp + 8]
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
mov edx, dword [0x447538]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx
Function at 0x43be40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 0x10], 0xb3b4b5c6
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1b], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xe
ja 0x43bef0
nop
nop
nop
mov eax, dword [esp + 4]
mov edx, dword [esp + 4]
movzx esi, byte [esp + edx + 0x10]
lea edi, [eax + 0xa11b99]
lea edx, [eax + esi]
add edx, 0xa11b99
and edi, esi
add eax, 0x99
and eax, esi
add eax, edi
mov esi, edx
not esi
and esi, eax
not eax
and eax, edx
sub eax, esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov edx, eax
or edx, 0xd0
and eax, 0xd0
add eax, edx
inc al
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], al
mov eax, dword [esp + 4]
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
cmp eax, 0xf
jb 0x43be80
mov eax, dword [esp + 0x10]
mov eax, dword fs:[eax]
xor edx, edx
cmp dword [ebp + 8], 0
sete dl
jmp dword [edx*4 + 0x448370]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov esi, dword [case.0x43bf00.14]
mov ebx, dword [0x4483cc]
mov dword [esp + 8], edx
xor eax, eax
nop
mov edx, dword [edx]
xor ecx, ecx
cmp edx, dword [esp + 8]
setne cl
jmp dword [ecx*4 + 0x448388]
jmp esi
xor ecx, ecx
mov edi, dword [ebp + 8]
cmp dword [edx + 0x18], edi
sete cl
jmp dword [ecx*4 + 0x4483b0]
jmp dword [0x44839c]
mov ecx, dword [0x4483d8]
nop
nop
nop
nop
jmp ecx
mov ecx, dword [case.0x43bf00.4]
nop
nop
nop
nop
nop
nop
jmp ecx
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c9c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43c9e0
mov edi, eax
sar edi, 1
cmp eax, 0xfffffff5
jge 0x43c9fb
mov eax, 0xffffffff
jmp 0x43c9fe
add eax, 0xa
push eax
call fcn.00408c40
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea eax, [edi + 4]
mov word [esi + 8], 0
mov ecx, esi
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43ca41
add ebx, 2
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43ca30
mov word [ecx], 0
mov edx, 3
sub edx, edi
and edx, 2
mov ecx, eax
and ecx, 0xfffd
imul ecx, edx
and edi, 2
or eax, 2
imul eax, edi
lea edx, [eax + ecx]
mov word [esp + 0x18], dx
add eax, ecx
add eax, 2
mov word [esp + 0x1a], ax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 8], 0xbcbdbebf
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x43cb25
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
and edx, 0xf9b45068
xor eax, 0xf9b45068
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
add al, 0x28
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x43cae0
mov edi, dword [esp + 8]
mov eax, dword [0x4498e8]
test eax, eax
je 0x43cb8d
xor ecx, ecx
mov edx, dword [0x4498ec]
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x6ec8215b
je 0x43cb50
inc ecx
cmp eax, ecx
jne 0x43cb40
jmp 0x43cb8d
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43cb8d
lea ecx, [esp + 8]
lea edx, [esp + 0x24]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x4498f0]
push eax
call fcn.0043a390
add esp, 0x38
mov edi, eax
push esi
call fcn.00408c50
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + edi + 2], 0
lea edi, [edi + 2]
jne 0x43cbc0
cmp edi, 0xfffffff5
jge 0x43cbd7
mov eax, 0xffffffff
jmp 0x43cbda
lea eax, [edi + 0xa]
push eax
call fcn.00408c40
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
add eax, 8
movzx ecx, word [ebx]
test cx, cx
je 0x43cc21
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x43cc10
mov word [eax], 0
and edi, 0xfffffffe
lea eax, [edi + 8]
mov word [esp + 0x18], ax
add edi, 0xa
mov word [esp + 0x1a], di
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 8], 0xbcbdbebf
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x43cce5
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
and edx, 0xf9b45068
xor eax, 0xf9b45068
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
add al, 0x28
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x43cca0
mov edi, dword [esp + 8]
mov eax, dword [0x4498e8]
test eax, eax
je 0x43cd41
xor ecx, ecx
mov edx, dword [0x4498ec]
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x20578d2f
je 0x43cd10
inc ecx
cmp eax, ecx
jne 0x43cd00
jmp 0x43cd41
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43cd41
lea ecx, [esp + 8]
lea edx, [esp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x4498f0]
push eax
call fcn.0043a390
add esp, 0x24
mov edi, eax
push esi
call fcn.00408c50
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cd60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43cd80
mov edi, eax
sar edi, 1
cmp eax, 0xfffffff5
jge 0x43cd9b
mov eax, 0xffffffff
jmp 0x43cd9e
add eax, 0xa
push eax
call fcn.00408c40
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea eax, [edi + 4]
mov word [esi + 8], 0
mov ecx, esi
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43cde1
add ebx, 2
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43cdd0
mov word [ecx], 0
mov ecx, eax
and ecx, 0xfffd
and edi, 2
mov edx, edi
xor edx, 2
imul edx, ecx
or eax, 2
imul eax, edi
lea ecx, [eax + edx]
mov word [esp + 4], cx
add eax, edx
add eax, 2
mov word [esp + 6], ax
mov dword [esp + 8], esi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xbcbdbebf
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov byte [esp + 0x34], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x43cec0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x28]
mov edx, eax
and edx, 0xf9b45068
xor eax, 0xf9b45068
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
add al, 0x28
mov ecx, dword [esp]
mov byte [esp + ecx + 0x28], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0x43ce80
mov edi, dword [esp + 0x28]
mov eax, dword [0x4498e8]
test eax, eax
je 0x43cf15
xor ecx, ecx
mov edx, dword [0x4498ec]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xb3c6ef08
je 0x43cef0
inc ecx
cmp eax, ecx
jne 0x43cee0
jmp 0x43cf15
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43cf15
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push ecx
push edx
push 2
push dword [0x4498f0]
push eax
call fcn.0043a390
add esp, 0x14
mov edi, eax
push esi
call fcn.00408c50
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43cf2b
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cf40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0xbcbdbebf
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x43cfc5
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
and edx, 0xf9b45068
xor eax, 0xf9b45068
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
add al, 0x28
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x43cf80
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 8]
mov edx, dword [0x4498e8]
test edx, edx
je 0x43d028
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x4498ec]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x47995699
je 0x43d000
inc edi
cmp edx, edi
jne 0x43cff0
jmp 0x43d028
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x43d028
lea eax, [esp + 8]
lea edi, [esp + 0x24]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x4498f0]
push edx
call fcn.0043a390
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x43d035
mov edx, dword [esp + 0x10]
mov dword [esi], edx
test ecx, ecx
je 0x43d041
cmp byte [esp + 0x1d], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0xbcbdbebf
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x43d0d0
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
and edx, 0xf9b45068
xor eax, 0xf9b45068
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
add al, 0x28
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0x43d090
mov eax, dword [esp + 8]
mov edi, dword [0x4498e8]
test edi, edi
je 0x43d12d
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x4498ec]
nop
nop
nop
nop
cmp dword [esi + ebx*8], 0x9a9108a3
je 0x43d100
inc ebx
cmp edi, ebx
jne 0x43d0f0
jmp 0x43d12d
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x43d12d
lea eax, [esp + 0x1c]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x4498f0]
push edi
call fcn.0043a390
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x43d208
mov dword [esp + 8], 0xbcbdbebf
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x43d1b3
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
and edx, 0xf9b45068
xor eax, 0xf9b45068
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp], edx
mov eax, dword [esp]
add al, 0x28
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x43d170
mov eax, dword [esp + 8]
mov ecx, dword [0x4498e8]
test ecx, ecx
je 0x43d200
xor edx, edx
mov esi, dword [0x4498ec]
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x10c53004
je 0x43d1e0
inc edx
cmp ecx, edx
jne 0x43d1d0
jmp 0x43d200
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43d200
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x4498f0]
push ecx
call fcn.0043a390
add esp, 0x18
test eax, eax
js 0x43d208
mov eax, dword [esp + 0x1c]
test edi, edi
je 0x43d21b
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43d219
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0xbcbdbebf
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x43d2b0
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
and edx, 0xf9b45068
xor eax, 0xf9b45068
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
add al, 0x28
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0x43d270
mov eax, dword [esp + 8]
mov edi, dword [0x4498e8]
test edi, edi
je 0x43d30d
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [0x4498ec]
nop
nop
nop
nop
cmp dword [esi + ebx*8], 0x332bb82a
je 0x43d2e0
inc ebx
cmp edi, ebx
jne 0x43d2d0
jmp 0x43d30d
mov edi, dword [esi + ebx*8 + 4]
cmp edi, eax
je 0x43d30d
lea eax, [esp + 0x1c]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x4498f0]
push edi
call fcn.0043a390
add esp, 0x30
mov edi, dword [ebp + 0x14]
cmp eax, 0x103
jne 0x43d3e8
mov dword [esp + 8], 0xbcbdbebf
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x43d393
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
and edx, 0xf9b45068
xor eax, 0xf9b45068
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp], edx
mov eax, dword [esp]
add al, 0x28
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x43d350
mov eax, dword [esp + 8]
mov ecx, dword [0x4498e8]
test ecx, ecx
je 0x43d3e0
xor edx, edx
mov esi, dword [0x4498ec]
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x10c53004
je 0x43d3c0
inc edx
cmp ecx, edx
jne 0x43d3b0
jmp 0x43d3e0
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43d3e0
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x4498f0]
push ecx
call fcn.0043a390
add esp, 0x18
test eax, eax
js 0x43d3e8
mov eax, dword [esp + 0x1c]
test edi, edi
je 0x43d3f2
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x43d420
sar ebx, 1
mov ecx, ebx
and ecx, 2
mov edx, ebx
or ebx, 2
imul ebx, ecx
xor ecx, 2
and edx, 0xfffd
imul edx, ecx
lea ecx, [edx + ebx]
mov word [esp + 4], cx
lea ecx, [edx + ebx]
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0xbcbdbebf
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x43d500
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, eax
and edx, 0xf9b45068
xor eax, 0xf9b45068
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
add al, 0x28
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0x43d4c0
mov eax, dword [esp + 0x10]
mov edi, dword [0x4498e8]
test edi, edi
je 0x43d555
xor ebx, ebx
mov ecx, dword [0x4498ec]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0xe6b73065
je 0x43d530
inc ebx
cmp edi, ebx
jne 0x43d520
jmp 0x43d555
mov ecx, dword [ecx + ebx*8 + 4]
cmp ecx, eax
je 0x43d555
lea eax, [esp + 0x24]
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 4
push dword [0x4498f0]
push ecx
call fcn.0043a390
add esp, 0x1c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4244c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4b2900], 0
jne 0x4244ee
call fcn.00424490
mov dword [esp], 0x4b2900
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x424518
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4b2904]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4244f4
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x427040
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00426ff4
test al, al
jne 0x427061
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4270ad
xor eax, eax
push ebp
push 0x42709d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004084c8
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4270a4
lea eax, [ebp - 0xc]
call fcn.00427030
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e9fa
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x45894c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004587cb

Function at 0x45aef9
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045adfe

Function at 0x45fb05
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045f7c5

Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18