joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405850
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405a31
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405a31
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405a31
cmp dword [ecx], 0
jne 0x405a31
push esi
call fcn.0040c930
add esp, 4
test eax, eax
je 0x4058ba
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x4058c1
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x4058a0
jmp 0x4058c3
mov edi, 0x1505
jmp 0x4058c3
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
test edx, edx
je 0x40597b
mov dword [esp], eax
mov eax, edx
not eax
and eax, 1
mov esi, edx
and esi, 0xfffffffe
sub esi, eax
and esi, edi
lea eax, [edx - 1]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405904
inc esi
dec edx
je 0x40597b
mov ebp, esi
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ebx, dword [eax + ebp*4]
cmp ebx, 0xffffffff
je 0x405980
mov eax, dword [ecx + 8]
cmp dword [eax + ebx*4], edi
jne 0x405900
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + ebx*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040c930
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405900
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040c950
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405900
mov eax, dword [ecx + 0x10]
push dword [eax + ebx*4]
call fcn.00404940
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ebx*4], esi
jmp 0x405a24
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x4059c0
call fcn.00405b00
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405a31
push esi
call fcn.0040c930
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405a40
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040c930
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x44b008]
add esp, 4
test eax, eax
je 0x405a2c
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c850
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405a31
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406b20
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406cd6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406ccf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x406bb6
mov eax, dword [esp + 4]
sub eax, dword [esp]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ecx
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, edi
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub ecx, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
sub esi, dword [esp + 4]
mov ebx, 0x15b0
je 0x406ccf
xor edx, edx
cmp ebx, 8
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
jb 0x406c38
and ebx, 0x1ff8
mov dword [esp], ebx
xor eax, eax
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
mov eax, ecx
xor eax, esi
and ecx, esi
movzx ebx, byte [ebp + edx + 6]
add ebx, esi
movzx edi, byte [ebp + edx + 7]
add edi, ebx
add ebx, eax
lea ecx, [ebx + ecx*2]
mov ebx, dword [esp + 4]
lea eax, [edx + 8]
add ecx, edi
add edx, 0xf
cmp edx, ebx
jb 0x406bd0
add ebp, eax
mov esi, dword [esp + 8]
mov edx, dword [esp]
mov eax, edx
sub eax, ebx
jae 0x406b7d
mov dword [esp + 0xc], eax
mov eax, ebx
and eax, 3
mov dword [esp], edx
je 0x406c7f
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406c60
mov eax, dword [esp]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406b70
jmp 0x406c8e
mov eax, edx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406b70
mov ebx, dword [esp + 4]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406ca0
jmp 0x406b70
shl ecx, 0x10
or ecx, edi
jmp 0x406cdb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406cf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x406d61
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x406d63
xor esi, esi
nop
nop
nop
nop
nop
nop
mov ebx, eax
not ebx
movzx edx, byte [ecx + esi]
mov ebp, edx
xor ebp, 0xf0
mov edi, edx
or edi, 0xf
and edi, ebp
mov ebp, ebx
and eax, 0xe
and ebx, 1
or ebx, eax
xor ebx, edi
shr ebp, 4
xor ebx, 0xe
xor ebp, dword [ebx*4 + 0x448c50]
mov eax, ebp
shr edx, 4
and ebp, 0xf
xor ebp, edx
mov edx, dword [esp + 0x1c]
shr eax, 4
xor eax, dword [ebp*4 + 0x448c50]
not eax
inc esi
cmp edx, esi
jne 0x406d10
jmp 0x406d63
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40ced0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
sub esp, 8
call fcn.00441400
test al, al
je 0x40cf43
call fcn.00439a00
test al, al
je 0x40cf3e
mov dword [esp], 0xebdb06d7
mov word [esp + 4], 0
xor eax, eax
mov cl, 0x2a
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
xor dl, cl
mov ch, 0xd6
sub ch, dl
mov byte [esp + eax], ch
inc eax
dec cl
cmp eax, 6
jne 0x40cf00
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40cf2b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040de90
test al, al
je 0x40cf3e
call fcn.00410370
call fcn.0040f480
call fcn.00442610
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d1f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov edx, dword [esp + 0x78]
mov esi, dword [esp + 0x74]
mov dword [esp + 0x14], ecx
mov edi, dword [ecx + 0x60]
mov word [esp], 0x6577
mov byte [esp + 2], 0x6a
mov dword [esp + 3], 0
mov byte [esp + 7], 0
xor ebx, ebx
mov eax, ebx
add al, 0x67
xor al, byte [esp + ebx]
add al, 0xfd
mov byte [esp + ebx], al
inc ebx
cmp ebx, 8
jne 0x40d220
mov dword [esp + 8], 0x868884b2
mov dword [esp + 0xc], 0xadb6
mov byte [esp + 0x10], 0
mov ebx, 0xb001419c
nop
nop
nop
nop
movzx eax, byte [esp + ebx + 0x4ffebe6c]
xor eax, ebx
add eax, 0x95d5eee
mov ebp, eax
xor ebp, 0xfb
and eax, 4
add eax, eax
sub eax, ebp
inc al
mov byte [esp + ebx + 0x4ffebe6c], al
inc ebx
cmp ebx, 0xb00141a5
jne 0x40d250
mov dword [esp + 0x18], 0x7e44b0b3
mov dword [esp + 0x1c], 0x427eaca8
mov dword [esp + 0x20], 0x454e4493
mov dword [esp + 0x24], 0x4a414649
mov dword [esp + 0x28], 0x82494546
mov dword [esp + 0x2c], 0x5c6fa9a7
mov dword [esp + 0x30], 0x5f51435a
mov dword [esp + 0x34], 0x5e769c44
mov dword [esp + 0x38], 0x4c575749
mov dword [esp + 0x3c], 0xac594f5b
mov dword [esp + 0x40], 0xa75e75aa
mov dword [esp + 0x44], 0x62ada9a9
mov dword [esp + 0x48], 0x92ba94a8
mov dword [esp + 0x4c], 0x8ea45375
mov dword [esp + 0x50], 0x4b69b0bb
mov byte [esp + 0x54], 0x28
mov dword [esp + 0x55], 0
mov byte [esp + 0x59], 0
xor ebx, ebx
nop
nop
nop
nop
mov eax, ebx
add al, 0x59
xor al, byte [esp + ebx + 0x18]
add al, 0x43
mov byte [esp + ebx + 0x18], al
inc ebx
cmp ebx, 0x42
jne 0x40d310
mov eax, dword [esp + 0x70]
add eax, edi
movzx ebx, byte [esp + 0x18]
mov edi, eax
test bl, bl
je 0x40d34c
lea ebp, [esp + 0x19]
mov edi, eax
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [ebp]
inc ebp
test bl, bl
jne 0x40d340
mov byte [edi], 0
movzx ebx, byte [esi]
test bl, bl
je 0x40d36b
inc esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40d360
mov byte [edi], 0
movzx ebx, byte [esp + 8]
test bl, bl
je 0x40d38b
lea esi, [esp + 9]
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40d380
mov byte [edi], 0
movzx ebx, byte [edx]
test bl, bl
je 0x40d3ab
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [edx]
inc edx
test bl, bl
jne 0x40d3a0
mov byte [edi], 0
movzx edx, byte [esp]
test dl, dl
je 0x40d3cb
lea esi, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], dl
inc edi
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x40d3c0
mov byte [edi], 0
sub edi, eax
mov eax, dword [esp + 0x14]
add dword [eax + 0x60], edi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40de90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18c
mov eax, dword [0x45185c]
mov dword [esp + 0x10c], 0x97966198
mov byte [esp + 0x110], 0
mov ecx, 6
mov edx, 0x99
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x106]
lea edi, [esi + esi]
not edi
add edi, esi
and edi, 0xf5
and esi, 0xa
or esi, edi
mov edi, edx
and edi, 0x95
mov ebx, ecx
and ebx, 0xa
or ebx, edi
xor ebx, esi
add bl, 2
mov byte [esp + ecx + 0x106], bl
inc ecx
dec edx
cmp ecx, 0xb
jne 0x40dec0
mov ecx, dword [esp + 0x10c]
mov dword [esp + 0xc], 0x812d873d
mov dword [esp + 0x10], 0x8d2a8336
mov dword [esp + 0x14], 0x89328f30
mov dword [esp + 0x18], 0x957c8b38
mov dword [esp + 0x1c], 0x91229738
mov dword [esp + 0x20], 0x9d929324
mov word [esp + 0x24], 0
mov edx, 0x3f6dace1
nop
movzx esi, byte [esp + edx - 0x3f6dacd5]
xor esi, edx
mov edi, esi
and edi, 0x1a
xor esi, 0x9a
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + edx - 0x3f6dacd5], bl
inc edx
cmp edx, 0x3f6dacfb
jne 0x40df40
lea esi, [esp + 0xc]
push ecx
push 0
push esi
call eax
mov ecx, 0x451824
push eax
call fcn.004410c0
movzx eax, al
jmp dword [eax*4 + 0x44b994]
Function at 0x40ee20
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x451838]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40eece
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44ba8c]
xor eax, eax
jmp 0x40f45e
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40fb60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov dword [esp + 0x38], 0xcf5dc975
mov dword [esp + 0x3c], 0xc35bcd42
mov dword [esp + 0x40], 0xc75ac15c
mov dword [esp + 0x44], 0xbb69c565
mov dword [esp + 0x48], 0xbf6cb96d
mov dword [esp + 0x4c], 0xb352bd6c
mov dword [esp + 0x50], 0xb71db168
mov dword [esp + 0x54], 0xab38b52d
mov dword [esp + 0x58], 0xaf3da90c
mov dword [esp + 0x5c], 0xa335ad27
mov dword [esp + 0x60], 0xa714a140
mov dword [esp + 0x64], 0x9b7aa510
mov dword [esp + 0x68], 0x9f4e9949
mov dword [esp + 0x6c], 0x93429d4e
mov dword [esp + 0x70], 0x9776915f
mov dword [esp + 0x74], 0x8b13953f
mov dword [esp + 0x78], 0x8f44891a
mov dword [esp + 0x7c], 0x834d8d58
mov dword [esp + 0x80], 0x870e8160
mov dword [esp + 0x84], 0x7bae854e
mov dword [esp + 0x88], 0x7f9e79a1
mov dword [esp + 0x8c], 0x73e27dbd
mov dword [esp + 0x90], 0x77ea71e0
mov dword [esp + 0x94], 0x6bc175d1
mov dword [esp + 0x98], 0x6fc869cd
mov dword [esp + 0x9c], 0x63fb6dd3
mov dword [esp + 0xa0], 0x67b561f4
mov dword [esp + 0xa4], 0x5b8d65b1
mov dword [esp + 0xa8], 0x5f8c5993
mov dword [esp + 0xac], 0x53985d8b
mov dword [esp + 0xb0], 0x578e51b0
mov dword [esp + 0xb4], 0x4bf255eb
mov dword [esp + 0xb8], 0x4ff349fc
mov dword [esp + 0xbc], 0x439e4df0
mov dword [esp + 0xc0], 0x47da41a0
mov dword [esp + 0xc4], 0x3ba545dd
mov dword [esp + 0xc8], 0x3fde399d
mov dword [esp + 0xcc], 0x33973d87
mov dword [esp + 0xd0], 0x37a93197
mov dword [esp + 0xd4], 0x2bf335a7
mov dword [esp + 0xd8], 0x2fe929c8
mov dword [esp + 0xdc], 0x23b42db4
mov dword [esp + 0xe0], 0x27bb21b3
mov dword [esp + 0xe4], 0x1bc92581
mov dword [esp + 0xe8], 0x1fcf19c9
mov dword [esp + 0xec], 0x13c01dd5
mov dword [esp + 0xf0], 0x17c411c0
mov dword [esp + 0xf4], 0xbd815c4
mov dword [esp + 0xf8], 0xfee09d8
mov dword [esp + 0xfc], 0x3a30dbb
mov dword [esp + 0x100], 0x7a7019a
mov dword [esp + 0x104], 0xfb630592
mov dword [esp + 0x108], 0xff2bf92b
mov dword [esp + 0x10c], 0xf339fd2b
mov dword [esp + 0x110], 0xf721f122
mov dword [esp + 0x114], 0xebeaf53e
mov word [esp + 0x118], 0
mov eax, dword [0x45182c]
mov ecx, 0xcb224f32
movzx edx, byte [esp + ecx + 0x34ddb106]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 6
mov byte [esp + ecx + 0x34ddb106], dl
inc ecx
cmp ecx, 0xcb225014
jne 0x40fdb0
lea esi, [esp + 0x38]
push 0
push 0
push 0
push 0
push esi
call eax
xor ecx, ecx
mov dword [esp + 0x34], eax
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44bbc4]
Function at 0x41cab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1108
call fcn.0040c780
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
mov edi, 0xfffffffe
nop
nop
cmp word [eax + edi + 2], 0
lea edi, [edi + 2]
jne 0x41cad0
sar edi, 1
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push edi
push eax
push 0
call dword [0x452b70]
mov ebx, dword [esp + 0x24]
test ebx, ebx
jns 0x41caff
mov eax, 0xffffffff
jmp 0x41cb02
lea eax, [ebx + ebx]
push eax
call fcn.0040c820
add esp, 4
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x28], eax
push eax
push edi
push dword [esi + 4]
push 0
call dword [0x452b70]
mov eax, dword [esp + 0x24]
mov ecx, eax
add ecx, 0xd
jns 0x41cb34
mov eax, 0xffffffff
jmp 0x41cb3b
lea eax, [eax*2 + 0x1a]
push eax
call fcn.0040c820
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x104], 0xf946fba8
mov dword [esp + 0x108], 0xfd6bff5f
mov dword [esp + 0x10c], 0xf112f368
mov dword [esp + 0x110], 0xf56df75a
mov dword [esp + 0x114], 0xe97feb62
mov dword [esp + 0x118], 0xed7fef77
mov dword [esp + 0x11c], 0xe1e2e37e
mov word [esp + 0x120], 0
xor esi, esi
xor ecx, ecx
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 4], esi
movzx eax, byte [esp + ecx + 0x104]
mov edi, ecx
xor edi, 0xf81187f
lea ebx, [esi + edi]
lea esi, [eax + eax]
not esi
add esi, eax
and esi, ebx
mov ebx, edx
sub ebx, edi
and ebx, eax
or ebx, esi
mov esi, dword [esp + 4]
add bl, 0x85
mov byte [esp + ecx + 0x104], bl
inc ecx
add edx, 0xfffffffe
add esi, 2
cmp ecx, 0x1e
jne 0x41cbb0
mov edx, dword [esp + 0x20]
movzx ecx, word [edx]
mov edi, dword [esp + 0xc]
mov eax, edi
test cx, cx
je 0x41cc21
add edx, 2
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cc10
mov word [eax], 0
movzx ecx, word [esp + 0x104]
test cx, cx
je 0x41cc51
lea edx, [esp + 0x106]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cc40
mov word [eax], 0
lea eax, [esp + 0x98]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00445ed0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d328]
Function at 0x4231f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x423200
sar ebp, 1
mov eax, esp
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x452b70]
mov edi, dword [esp]
test edi, edi
jns 0x42322c
mov eax, 0xffffffff
jmp 0x42322f
lea eax, [edi + edi]
push eax
call fcn.0040c820
add esp, 4
mov esi, eax
mov eax, esp
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x452b70]
lea ebx, [esp + 0xc]
push ebx
push esi
call fcn.00446040
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d7a0]
Function at 0x424300
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebp, dword [esp + 0x58]
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
movzx eax, byte [esp + 0x5c]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebp
mov byte [esp + 0x2c], al
test ebp, ebp
setg cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44d968]

Function at 0x427530
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x21e8
call fcn.0040c780
mov dword [esp + 0xde8], 0x41f447e0
mov dword [esp + 0xdec], 0x4d0b430f
mov dword [esp + 0xdf0], 0x49f34f07
mov dword [esp + 0xdf4], 0xb5f84bf4
mov dword [esp + 0xdf8], 0xb112b70f
mov dword [esp + 0xdfc], 0xbd0fb30f
mov dword [esp + 0xe00], 0xb90cbff3
mov dword [esp + 0xe04], 0xbbb8
mov eax, 0xce714171
mov ecx, 0x8e
movzx edx, byte [esp + eax + 0x318ecc77]
mov esi, edx
not esi
or esi, ecx
mov edi, esi
not edi
mov ebx, edi
and ebx, 0xfffffffd
and esi, 2
imul esi, ebx
mov ebx, edi
and ebx, 2
or edi, 2
imul edi, ebx
lea ebx, [eax + edx]
sub edx, esi
sub edx, edi
add edx, eax
add edx, 0x18
and ebx, 1
xor edx, 1
lea edx, [edx + ebx*2]
add dl, 0xb2
mov byte [esp + eax + 0x318ecc77], dl
inc eax
dec ecx
cmp eax, 0xce714191
jne 0x4275a0
lea eax, [esp + 8]
lea ecx, [esp + 0xde8]
push 0
push 0
push 0x20019
push eax
mov ebx, ecx
push ecx
call fcn.004464f0
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0x44dff8]
Function at 0x428f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx ecx, word [esi]
test cx, cx
je 0x429051
mov eax, dword [esp + 0x18]
mov edx, eax
not edx
lea edx, [edx + eax*2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test edx, edx
je 0x429051
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x428f60
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x429000
cmp ebx, 0x7ff
ja 0x428f90
cmp edx, 2
jb 0x428f90
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
mov ecx, ebx
not ecx
or ecx, 0x3f
add ecx, ebx
add cl, 0x81
lea eax, [ebp + 2]
mov byte [ebp + 1], cl
jmp 0x429000
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x429016
cmp edx, 4
jb 0x429016
movzx ecx, word [esi + 2]
add esi, 4
mov eax, ebx
xor eax, 0xd800
and ebx, 0x27ff
add ebx, ebx
sub ebx, eax
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0x2400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
mov ebx, eax
not ebx
or ebx, 0x3f
add ebx, eax
add bl, 0x81
mov byte [ebp + 2], bl
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
jne 0x428f40
jmp 0x429051
movzx eax, ax
cmp eax, 0xdc00
jne 0x429024
mov esi, edi
jmp 0x429008
cmp edx, 3
jb 0x42904d
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x429000
mov eax, ebp
jmp 0x429000
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42d2a0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xbc
mov dword [esp + 0x1c], 0x89558b77
mov dword [esp + 0x20], 0x85368738
mov dword [esp + 0x24], 0x813d8358
mov dword [esp + 0x28], 0x9d219f0c
mov dword [esp + 0x2c], 0x993e9b67
mov dword [esp + 0x30], 0x9527974a
mov dword [esp + 0x34], 0x91299318
mov dword [esp + 0x38], 0x6dd16f20
mov dword [esp + 0x3c], 0x699f6bd0
mov dword [esp + 0x40], 0x65c2679d
mov dword [esp + 0x44], 0x61d963e9
mov dword [esp + 0x48], 0x7df37fed
mov dword [esp + 0x4c], 0x79cb7bcb
mov dword [esp + 0x50], 0x758477ca
mov dword [esp + 0x54], 0x71c173fc
mov dword [esp + 0x58], 0x4d4e4fc4
lea eax, [esp + 0x5c]
mov word [esp + 0x5c], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x63
xor dl, byte [esp + ecx + 0x1c]
add dl, 0x11
mov byte [esp + ecx + 0x1c], dl
inc ecx
cmp ecx, 0x42
jne 0x42d340
lea ebp, [esp + 0x7c]
lea edx, [esp + 0x1c]
mov edi, ebp
mov ecx, 0x10
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xbc]
mov dword [esp + 8], 0
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x78]
push esi
push 0
push 0
push 0x1f
push ebp
push 0
call dword [0x452b70]
mov edi, dword [esp + 0x78]
test edi, edi
jns 0x42d3a4
mov eax, 0xffffffff
jmp 0x42d3a7
lea eax, [edi + edi]
push eax
call fcn.0040c820
add esp, 4
mov ebx, eax
push esi
push edi
push eax
push 0x1f
push ebp
push 0
call dword [0x452b70]
lea eax, [esp + 0x10]
push 0x60
push 3
push 0x120089
push eax
mov dword [esp + 0x84], ebx
push ebx
call fcn.00445ed0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44ec10]