joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc5ea8b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0xc78994]
sub esp, 0x4c
and eax, 0xfec4b20
xor edx, edx
mov ecx, edx
push ebx
push esi
push edi
mov edi, eax
xor edi, 0xbdab47bd
inc ecx
cmp byte [ecx + 0xc749a4], dl
jne 0xc5eaaa
mov esi, dword [ebp - 8]
jmp 0xc5eacc
cmp esi, 0x16aa
jne 0xc5eac5
and eax, 0xf67ad0f7
xor edi, 0xd6f9379a
inc esi
cmp esi, ecx
jb 0xc5eab8
mov esi, eax
mov ecx, edx
or esi, 0x1c5a08c
inc ecx
cmp word [ecx*2 + 0xc74bd0], dx
jne 0xc5eada
lea ebx, [eax + 0x36f7f1f0]
cmp ecx, 0x19ca
jb 0xc5eaf9
imul ebx, esi, 0x389be174
imul eax, esi, 0xcedf1e07
lea edi, [ebp - 0x20]
push 5
pop ecx
mov esi, 0xc73000
rep movsd dword es:[edi], dword [esi]
mov cl, byte [str.SrchSamplePI]
mov dword [ebp - 8], eax
mov eax, edx
cmp cl, byte [ebp - 0x20]
jne 0xc5eb33
test cl, cl
je 0xc5eb33
cmp byte [ebp + eax - 0x20], dl
je 0xc5eb33
mov cl, byte [eax + 0xc78915]
inc eax
cmp cl, byte [ebp + eax - 0x20]
je 0xc5eb1c
movzx ecx, byte [eax + str.SrchSamplePI]
movzx eax, byte [ebp + eax - 0x20]
sub ecx, eax
cmp ecx, 0xc5d
jne 0xc5eb51
add ebx, 0x604a497f
jmp 0xc5eb5a
mov ebx, dword [ebp - 8]
add ebx, 0xd5602701
push 0xb
pop ecx
mov esi, 0xc6f030
mov dword [ebp - 4], ebx
lea edi, [ebp - 0x4c]
mov eax, edx
rep movsd dword es:[edi], dword [esi]
push 0x65
pop ecx
cmp cx, word [ebp - 0x4c]
jne 0xc5eb9e
mov ebx, edx
test cx, cx
je 0xc5eb95
cmp word [ebp + eax - 0x4c], dx
je 0xc5eb95
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + 0xc74bd0]
cmp cx, word [ebp + eax - 0x4c]
je 0xc5eb77
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax*2 + 0xc74bd0]
movzx eax, byte [ebp + eax*2 - 0x4c]
sub ecx, eax
mov eax, ebx
and eax, 0x40eb835f
or ebx, 0xeb1dbf9f
cmp ecx, 0x218e
cmovae ebx, eax
mov eax, 0xc74ab4
sub ebx, 0x5b19bb5e
imul ebx, ebx, 0xe90a9025
inc eax
cmp byte [eax], dl
jne 0xc5ebce
push 5
pop ecx
mov esi, 0xc70198
mov dword [0xc78994], ebx
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x20], 0x53
jne 0xc5ec0d
mov al, 0x53
test al, al
je 0xc5ec0d
cmp byte [ebp + edx - 0x20], 0
je 0xc5ec0d
mov al, byte [edx + 0xc74a2d]
inc edx
cmp al, byte [ebp + edx - 0x20]
je 0xc5ebf5
movzx ecx, byte [edx + 0xc74a2c]
movzx eax, byte [ebp + edx - 0x20]
sub ecx, eax
cmp ecx, 0x24ed
jbe 0xc5ec2b
imul eax, ebx, 0x7a1c2a05
jmp 0xc5ec31
imul eax, ebx, 0xfbc7ff6b
pop edi
pop esi
mov dword [0xc78964], eax
pop ebx
leave
ret
Function at 0xc62bfd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [0xc78b38]
xor edx, edx
push ebx
imul ebx, dword [0xc78b38], 0xb7186cb3
and ecx, 0xcd903f88
push esi
push edi
mov esi, 0xc6f258
lea edi, [ebp - 0x14]
mov eax, edx
mov dword [ebp - 8], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x14], 0x6e
jne 0xc62c6e
mov dl, 0x6e
test dl, dl
je 0xc62c4e
cmp byte [ebp + eax - 0x14], 0
je 0xc62c4e
mov dl, byte [eax + 0xc75a81]
inc eax
cmp dl, byte [ebp + eax - 0x14]
je 0xc62c36
mov edx, dword [ebp - 8]
cmp edx, eax
jae 0xc62c6c
cmp edx, 0x2175
jne 0xc62c63
sub ecx, 0x243289e0
xor ecx, 0x85a0374b
inc edx
jmp 0xc62c51
xor edx, edx
mov eax, str.SrchCollatorFetch
or ecx, 0xc873f913
inc eax
cmp byte [eax], 0
jne 0xc62c73
mov esi, str.FailFast
lea edi, [ebp - 0x14]
and ebx, 0x12d3dcd4
mov eax, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x14], 0x63
jne 0xc62cd5
mov cl, 0x63
test cl, cl
je 0xc62cb2
cmp byte [ebp + eax - 0x14], 0
je 0xc62cb2
mov cl, byte [eax + 0xc75861]
inc eax
cmp cl, byte [ebp + eax - 0x14]
je 0xc62c9a
mov ecx, dword [ebp - 8]
cmp ecx, eax
jae 0xc62cd5
mov edx, dword [ebp - 8]
cmp ecx, 0xed2
jne 0xc62cca
imul edx, edx, 0xc1156bed
sub ebx, 0x215821f8
inc ecx
cmp ecx, eax
jb 0xc62cbc
mov eax, dword [str.clsid]
mov edx, ebx
mov dword [ebp - 8], eax
xor edi, edi
mov ax, word [0xc6f1d0]
and edx, 0xeb935598
cmp byte [ebp - 8], 0x46
mov esi, edi
mov word [ebp - 4], ax
jne 0xc62d13
mov al, 0x46
test al, al
je 0xc62d13
cmp byte [ebp + esi - 8], 0
je 0xc62d13
mov al, byte [esi + 0xc75879]
inc esi
cmp al, byte [ebp + esi - 8]
je 0xc62cfb
movzx ecx, byte [esi + str.FallbackError]
movzx eax, byte [ebp + esi - 8]
sub ecx, eax
cmp ecx, 0x1d1d
jae 0xc62d33
mov edx, ebx
xor edx, 0xbd44c7b3
jmp 0xc62d3b
mov ebx, edx
xor ebx, 0xc667732a
mov eax, edi
mov esi, str.timed_out
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x14], 0x6e
jne 0xc62d6a
push 0x6e
pop ecx
test cl, cl
je 0xc62d6a
cmp byte [ebp + eax - 0x14], 0
je 0xc62d6a
mov cl, byte [eax + 0xc75a81]
inc eax
cmp cl, byte [ebp + eax - 0x14]
je 0xc62d52
movzx ecx, byte [eax + str.no_stream_resources]
movzx eax, byte [ebp + eax - 0x14]
sub ecx, eax
cmp ecx, 0x4e1
jae 0xc62d88
or ebx, 0xdf3abcaf
jmp 0xc62d8e
add ebx, 0xddd1249d
mov dword [0xc78b3c], ebx
xor ecx, ecx
xor edx, 0x23fc7fc1
inc ecx
cmp byte [ecx + str.SrchCollatorFetch], 0
jne 0xc62d96
mov eax, dword [ebp - 8]
mov dword [0xc78b38], edx
cmp eax, ecx
jae 0xc62ddb
cmp eax, 0x617
jne 0xc62dc8
mov ebx, edx
and ebx, 0xf4727f0e
mov dword [0xc78b3c], ebx
mov edx, ebx
and edx, 0xc8814506
inc eax
cmp eax, ecx
jb 0xc62db3
mov dword [0xc78b38], edx
pop edi
pop esi
mov eax, edx
pop ebx
leave
ret
Function at 0xc62de2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 9
pop ecx
mov edx, dword [0xc78b04]
lea edi, [ebp - 0x2c]
mov esi, str.SrchDSSPortManager
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push 0x68
lea ebx, [edx - 0x6813ae5e]
movsw word es:[edi], word [esi]
pop esi
xor edi, edi
cmp si, word [ebp - 0x2c]
jne 0xc62e58
mov ecx, edi
test si, si
je 0xc62e33
cmp word [ebp + ecx - 0x2c], di
je 0xc62e33
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + 0xc75970]
cmp si, word [ebp + ecx - 0x2c]
je 0xc62e15
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
jmp 0xc62e54
cmp eax, 0x1647
jne 0xc62e4d
mov ebx, edx
and ebx, 0x41bbba0d
and ebx, 0xefd8c316
inc eax
cmp eax, ecx
jb 0xc62e3e
imul eax, ebx, 0x104783a
mov esi, str.SrchGatherPI
push 6
mov ebx, edi
lea edi, [ebp - 0x20]
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x41
pop ecx
mov dword [ebp - 4], eax
movsw word es:[edi], word [esi]
xor esi, esi
cmp cx, word [ebp - 0x20]
jne 0xc62eab
mov eax, esi
test cx, cx
je 0xc62e9d
cmp word [ebp + eax - 0x20], si
je 0xc62e9d
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + 0xc75b80]
cmp cx, word [ebp + eax - 0x20]
je 0xc62e7f
cmp dword [ebp - 4], ebx
jae 0xc62eab
mov edx, dword [ebp - 4]
add edx, 0x5892aaab
lea eax, [edx + 0x621c9e72]
mov ecx, esi
add edx, 0x4cbf7072
inc ecx
cmp word [ecx*2 + 0xc75990], si
jne 0xc62eb3
cmp dword [ebp - 4], ecx
jae 0xc62ed0
mov eax, edx
or eax, 0xbbb447cb
mov bl, byte [0xc78b70]
mov ecx, esi
test bl, bl
je 0xc62efe
mov eax, edx
or eax, 0xc738a10b
inc ecx
cmp byte [ecx + 0xc78b70], 0
jne 0xc62ee3
cmp ecx, 0x800
jbe 0xc62efe
mov eax, edx
xor eax, 0xedaf0832
jmp 0xc62f04
add edx, 0x2088e691
mov ecx, esi
test bl, bl
je 0xc62f22
xor edx, 0x2160ea9b
inc ecx
cmp byte [ecx + 0xc78b70], 0
jne 0xc62f0a
cmp ecx, 0x1dcc
jae 0xc62f27
xor eax, 0x57403f0d
or eax, 0x2c304581
mov edx, esi
mov dword [0xc78b24], eax
inc edx
cmp word [edx*2 + str.lineNumber], si
jne 0xc62f33
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
jmp 0xc62f59
cmp ecx, 0xc7b
jne 0xc62f58
or eax, 0x9912ce04
mov dword [0xc78b24], eax
inc ecx
cmp ecx, edx
jb 0xc62f46
imul eax, eax, 0xe5f08ee8
mov dword [0xc78b04], eax
leave
ret
Function at 0xc63772
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov eax, edx
mov dword [ebp - 8], ecx
mov ebx, eax
mov dword [ebp - 0xc], eax
push esi
and ebx, 0xdfaade8c
xor edx, edx
push edi
mov esi, edx
lea edi, [ecx + 0x5e4e1986]
inc esi
cmp byte [esi + str.operation_not_supported], dl
jne 0xc63795
mov ecx, dword [ebp + 8]
cmp ecx, esi
jae 0xc637c7
mov eax, dword [0xc78a7c]
xor eax, 0xf1d82f25
mov dword [ebp - 4], eax
cmp ecx, 0x14e4
jne 0xc637c0
imul ebx, edi, 0xca060171
inc ecx
cmp ecx, esi
jb 0xc637b2
jmp 0xc637cf
mov eax, dword [0xc78b64]
mov dword [ebp - 4], eax
push 0xa
pop ecx
mov esi, str.std::exception:__hs
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
movzx eax, word [edi]
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp ax, word [ebp - 0x3c]
jne 0xc6381d
movzx esi, cx
mov eax, edx
mov ecx, edx
test si, si
je 0xc6380f
cmp word [ebp + eax - 0x3c], dx
je 0xc6380f
inc ecx
lea eax, [ecx + ecx]
movzx esi, word [eax + edi]
cmp si, word [ebp + eax - 0x3c]
je 0xc637f4
cmp dword [ebp + 8], ecx
jae 0xc6381d
mov ebx, dword [ebp - 0xc]
or ebx, 0x352958dd
push 9
mov eax, dword [ebp - 0x10]
lea edi, [ebp - 0x38]
pop ecx
mov esi, 0xc7263c
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp ax, word [ebp - 0x38]
jne 0xc6386f
mov edi, dword [ebp + 8]
mov ecx, edx
movzx esi, ax
mov eax, edx
test si, si
je 0xc6385a
cmp word [ebp + eax - 0x38], dx
je 0xc6385a
inc ecx
lea eax, [ecx + ecx]
movzx esi, word [eax + edi]
cmp si, word [ebp + eax - 0x38]
je 0xc6383f
cmp dword [ebp + 8], ecx
mov ecx, dword [ebp - 8]
jae 0xc63872
lea eax, [ecx + 0x5e4e1986]
or eax, 0x128b9a61
jmp 0xc63875
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
and ecx, 0x47240918
lea edi, [ebp - 0x4c]
mov dword [0xc78a7c], ecx
mov esi, str.onecoreuap_baseAppModelSearchcommoninclude_tpslist.hxx
push 0xe
pop ecx
rep movsd dword es:[edi], dword [esi]
or eax, 0x803ae50e
mov dword [0xc78aa0], eax
imul eax, dword [ebp - 0xc], 0x51461310
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x4c], 0x65
mov dword [0xc78b64], eax
jne 0xc638c7
mov al, 0x65
test al, al
je 0xc638c7
cmp byte [ebp + edx - 0x4c], 0
je 0xc638c7
mov al, byte [edx + 0xc75ab1]
inc edx
cmp al, byte [ebp + edx - 0x4c]
je 0xc638af
movzx ecx, byte [edx + str.ext_ms_win_advapi32_eventlog_l1_1_1]
movzx eax, byte [ebp + edx - 0x4c]
sub ecx, eax
cmp ecx, 0x13a9
jne 0xc638ee
imul eax, dword [0xc78b64], 0x32c1d92e
mov dword [0xc78a7c], eax
jmp 0xc638fa
mov ebx, dword [0xc78b64]
and ebx, 0x23140a8b
pop edi
add ebx, 0x718caade
pop esi
mov dword [0xc78b10], ebx
pop ebx
leave
ret
Function at 0xc6390b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0xc78a94]
sub esp, 0x2c
xor edx, edx
mov ecx, edx
add eax, 0xb243d091
inc ecx
cmp word [ecx*2 + str.Module_Raw], dx
jne 0xc6391a
push ebx
push esi
mov esi, dword [ebp - 4]
push edi
cmp esi, ecx
jae 0xc6395b
mov edi, eax
mov ebx, eax
mov eax, ebx
cmp esi, 0x20cf
jne 0xc63948
imul eax, edi, 0x8dbc84dc
and eax, 0x6a1a276
inc esi
mov dword [0xc78a94], eax
mov edi, eax
mov ebx, edi
cmp esi, ecx
jb 0xc63938
mov ecx, edx
xor eax, 0x2a10de60
inc ecx
cmp byte [ecx + str.state_not_recoverable], dl
jne 0xc6395d
mov esi, dword [ebp - 4]
mov dword [0xc78a94], eax
cmp esi, ecx
jae 0xc6399d
mov edi, eax
mov ebx, eax
cmp esi, 0x37c
jne 0xc63989
lea ebx, [edi - 0x1acc071d]
lea eax, [ebx - 0x16ae697]
inc esi
mov dword [0xc78a94], eax
mov edi, eax
mov ebx, edi
cmp esi, ecx
jb 0xc6397b
push 9
pop ecx
mov esi, 0xc75788
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
or eax, 0x7c662ab
mov ebx, edx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x2c], 0x6e
jne 0xc639ef
mov cl, 0x6e
test cl, cl
je 0xc639d3
cmp byte [ebp + ebx - 0x2c], dl
je 0xc639d3
mov cl, byte [ebx + 0xc75a95]
inc ebx
cmp cl, byte [ebp + ebx - 0x2c]
je 0xc639bc
mov ecx, dword [ebp - 4]
jmp 0xc639eb
cmp ecx, 0x2447
jne 0xc639e5
add eax, 0x5dd0bdb0
add eax, 0x7876c934
inc ecx
cmp ecx, ebx
jb 0xc639d8
mov ecx, 0xc759c0
and eax, 0x9c723d8f
inc ecx
cmp byte [ecx], dl
jne 0xc639f4
mov ecx, edx
add eax, 0xaf0fe44a
inc ecx
cmp byte [ecx + 0xc759c0], dl
jne 0xc63a00
mov esi, dword [ebp - 4]
mov dword [0xc78a94], eax
cmp esi, ecx
jae 0xc63a42
mov edi, eax
mov ebx, eax
mov eax, ebx
cmp esi, 0x6c7
jne 0xc63a2f
mov eax, edi
or eax, 0x51c46273
and eax, 0xc268999b
inc esi
mov dword [0xc78a94], eax
mov edi, eax
mov ebx, edi
cmp esi, ecx
jb 0xc63a1e
and eax, 0x793d21
xor eax, 0xfe575e84
imul eax, eax, 0xf7a7cfb3
and eax, 0x451238f8
and eax, 0x3fdfa482
inc edx
cmp byte [edx + 0xc75968], 0
jne 0xc63a57
mov ecx, dword [ebp - 4]
cmp ecx, edx
jae 0xc63a94
mov esi, eax
mov edi, eax
mov eax, edi
cmp ecx, 0x1109
jne 0xc63a81
lea eax, [esi + 0xfc0341f]
xor eax, 0xa17f63b4
inc ecx
mov dword [0xc78a94], eax
mov esi, eax
mov edi, esi
cmp ecx, edx
jb 0xc63a71
or eax, 0x8a1bd9a2
xor eax, 0x62ea840
imul eax, eax, 0x40a548d0
pop edi
pop esi
pop ebx
add eax, 0x834022e4
mov dword [0xc78a94], eax
leave
ret
Function at 0xc63ca7
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
push esi
push edi
mov esi, 0xc70f38
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x38]
mov dword [ebp - 0x2c], edx
xor ebx, ebx
mov dword [ebp - 0x20], 0x11c554c8
xor ecx, ecx
mov dword [ebp - 0x1c], 0xd16c5d8c
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], 0xe8809e77
mov dword [ebp - 0x14], 0x5118612d
mov dword [ebp - 0x10], 0xee7fd10b
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], 0x6189b1f9
movsb byte es:[edi], byte [esi]
mov esi, dword [0xc78a74]
add esi, 0x79e3d5af
add esi, 0x6266f3f8
mov byte [ebp + ecx - 0x154], cl
inc ecx
cmp ecx, 0x100
jb 0xc63cfe
xor edi, edi
mov dl, byte [ebp + edi - 0x154]
mov eax, edi
and eax, 7
movzx ecx, dl
movzx eax, byte [ebp + eax - 0x38]
add eax, ebx
add ecx, eax
movzx ebx, cl
mov al, byte [ebp + ebx - 0x154]
mov byte [ebp + edi - 0x154], al
inc edi
mov byte [ebp + ebx - 0x154], dl
cmp edi, 0x100
jb 0xc63d16
and dword [ebp - 8], 0
xor ebx, ebx
call fcn.00c6390b
mov eax, str.SrchGatherSvc
imul esi, esi, 0x1c3be576
inc eax
cmp byte [eax], bl
jne 0xc63d5f
xor edi, edi
lea eax, [ebx + 1]
imul esi, esi, 0xa755aca6
movzx ebx, al
mov eax, dword [ebp - 8]
push 0x18
mov cl, byte [ebp + ebx - 0x154]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 8], eax
mov al, byte [ebp + eax - 0x154]
mov byte [ebp + ebx - 0x154], al
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x154], cl
movzx eax, byte [ebp + ebx - 0x154]
add eax, edx
movzx eax, al
pop ecx
mov al, byte [ebp + eax - 0x154]
xor al, byte [ebp + edi - 0x20]
mov byte [ebp + edi - 0x54], al
inc edi
cmp edi, ecx
jb 0xc63d6c
imul eax, esi, 0x65ced720
xor ebx, ebx
mov byte [ebp - 0x3c], bl
mov dword [0xc78a74], eax
mov eax, dword [ebp - 0x24]
test eax, eax
je 0xc63e43
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], ecx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x1c], ebx
push 0x1fffff
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x24], ebx
call fcn.00c6e4d9
add esp, 0x10
cmp dword [ebp - 8], ebx
jne 0xc63e27
mov eax, dword [ebp + 8]
sub dword [0xc78a74], 0x79888326
mov dword [eax], ebx
jmp 0xc63e43
push dword [ebp - 0x2c]
xor ecx, ecx
lea edx, [ebp - 0x54]
push dword [ebp - 8]
inc ecx
call fcn.00c4ba1b
call eax
push dword [ebp - 8]
call fcn.00c6e4cf
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0xc66c96
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov edx, dword [0xc78c08]
xor edx, 0xe8c2b8f3
lea eax, [edx + 0x449f34a8]
or edx, 0x6c5c6162
mov dword [ebp - 4], eax
mov eax, str.MSSearch_DAV
xor edx, 0xa858c7f2
inc eax
cmp byte [eax], 0
jne 0xc66cbc
push ebx
push esi
push edi
push 6
pop ecx
mov esi, str.TelemetryAssertDiagTrack
mov dword [0xc78c08], edx
lea edi, [ebp - 0x20]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x20], 0x52
jne 0xc66d02
mov cl, 0x52
test cl, cl
je 0xc66d02
cmp byte [ebp + eax - 0x20], bl
je 0xc66d02
mov cl, byte [eax + 0xc763d1]
inc eax
cmp cl, byte [ebp + eax - 0x20]
je 0xc66ceb
movzx ecx, byte [eax + 0xc763d0]
movzx eax, byte [ebp + eax - 0x20]
sub ecx, eax
cmp ecx, 0x14dd
jae 0xc66d27
mov edx, dword [ebp - 4]
and edx, 0x253d5f9b
mov dword [0xc78c08], edx
lea ecx, [edx + 0x6dc9f0a0]
mov eax, ebx
or ecx, 0x97fa8bdf
mov dword [0xc78c0c], ecx
xor ecx, 0x2a75a259
mov dword [ebp - 4], ecx
inc eax
cmp byte [eax + str.MSSearch_DAV], bl
jne 0xc66d44
cmp eax, 0xb82
je 0xc66d60
mov eax, edx
xor eax, 0xf6ad18f7
mov dword [0xc78c0c], eax
mov esi, 0xc6fec8
imul eax, ecx, 0xc751a233
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
mov dword [0xc78cb8], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x1c], 0x4d
jne 0xc66d9a
mov al, 0x4d
test al, al
je 0xc66d9a
cmp byte [ebp + ebx - 0x1c], 0
je 0xc66d9a
mov al, byte [ebx + 0xc76525]
inc ebx
cmp al, byte [ebp + ebx - 0x1c]
je 0xc66d82
movzx ecx, byte [ebx + str.MSSearch_DAV]
movzx eax, byte [ebp + ebx - 0x1c]
pop edi
sub ecx, eax
pop esi
pop ebx
cmp ecx, 0x1e3a
ja 0xc66dc0
imul edx, dword [ebp - 4], 0x4bd748ff
mov dword [0xc78c08], edx
imul eax, edx, 0xacb2f57d
mov dword [0xc78cac], eax
leave
ret
Function at 0xc67462
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov bl, byte [ecx]
push esi
test bl, bl
je 0xc6747e
mov edx, dword [0xc78cc0]
mov eax, ecx
and edx, 0x8f6d6826
inc eax
cmp byte [eax], 0
jne 0xc67472
mov edx, dword [0xc78bdc]
xor eax, eax
add edx, 0x3d666ee8
mov esi, eax
and edx, 0x97755961
test bl, bl
je 0xc674a6
inc esi
cmp byte [esi + ecx], al
jne 0xc67498
cmp esi, 0x1163
ja 0xc674ac
xor edx, 0x299b6c14
imul edx, edx, 0x1cd8ebfd
imul esi, edx, 0xd3f1fbcb
inc eax
cmp byte [eax + str.PartA_PrivTags], 0
jne 0xc674b8
cmp eax, 0xea5
jae 0xc674d1
imul eax, esi, 0xbecd11c0
jmp 0xc674d7
lea eax, [esi - 0x2fd47637]
pop esi
test bl, bl
pop ebx
je 0xc674e9
xor edx, 0x61158714
inc ecx
cmp byte [ecx], 0
jne 0xc674dd
imul ecx, edx, 0x8cc65fd4
or eax, 0xd8c8f222
mov dword [0xc78cc0], eax
mov dword [0xc78bdc], ecx
ret

Function at 0xc67611
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov esi, 0xc74840
lea edi, [ebp - 0x14]
xor edx, edx
mov eax, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x14], 0x74
jne 0xc67659
mov cl, 0x74
test cl, cl
je 0xc67648
cmp byte [ebp + eax - 0x14], dl
je 0xc67648
mov cl, byte [eax + 0xc768e5]
inc eax
cmp cl, byte [ebp + eax - 0x14]
je 0xc67631
cmp dword [ebp - 4], eax
jae 0xc67659
mov eax, dword [0xc78b9c]
xor eax, 0x92210033
jmp 0xc6765e
mov eax, dword [0xc78b8c]
imul ecx, eax, 0xe12181f1
mov eax, edx
inc eax
cmp word [eax*2 + str.message_size], dx
jne 0xc67666
push ebx
cmp dword [ebp - 4], eax
jae 0xc6768b
mov ebx, dword [0xc78c44]
add ebx, 0xa914189
mov dword [0xc78ba8], ebx
jmp 0xc67691
mov ebx, dword [0xc78ba8]
mov esi, 0xc757c8
lea edi, [ebp - 0x14]
lea eax, [ecx + 0x3e8b193e]
mov ecx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x14], 0x6f
jne 0xc676e7
mov dl, 0x6f
test dl, dl
je 0xc676c5
cmp byte [ebp + ecx - 0x14], 0
je 0xc676c5
mov dl, byte [ecx + 0xc76301]
inc ecx
cmp dl, byte [ebp + ecx - 0x14]
je 0xc676ad
mov edx, dword [ebp - 4]
cmp edx, ecx
jae 0xc676e5
cmp edx, 0x1664
jne 0xc676da
lea ebx, [eax + 0x7119e560]
inc edx
cmp edx, ecx
jb 0xc676cc
mov dword [0xc78ba8], ebx
xor edx, edx
or eax, 0x96e3849b
mov esi, eax
and esi, 0xec4ece70
xor edi, edi
xor eax, 0x715ff7c
inc edx
cmp word [edx*2 + 0xc765e0], di
jne 0xc676f6
mov ecx, dword [ebp - 4]
jmp 0xc6771a
cmp ecx, 0x14b1
jne 0xc67719
xor esi, 0xb32707f2
inc ecx
cmp ecx, edx
jb 0xc6770b
imul esi, esi, 0x38439369
lea ecx, [ebx - 0xe27dd24]
add eax, 0x411ddfb7
mov dword [0xc78b9c], ecx
mov dword [0xc78b8c], eax
mov edx, edi
pop ebx
and esi, 0x9736a059
mov dword [0xc78c44], esi
inc edx
cmp word [edx*2 + str.message_size], di
jne 0xc67749
cmp edx, 0xd87
jae 0xc67769
lea eax, [esi + 0x7e933da4]
mov dword [0xc78b8c], eax
jmp 0xc67775
or ecx, 0xa9e82270
mov dword [0xc78ba8], ecx
pop edi
pop esi
leave
ret
Function at 0xc6bb75
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
push edi
mov esi, 0xc7008c
mov dword [ebp - 0x18], 0x33dcbdc3
lea edi, [ebp - 0x20]
mov dword [ebp - 0x14], 0x25cbd34
mov dword [ebp - 0x10], 0x869a3e7c
mov dword [ebp - 0xc], 0xc23f5ff0
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 0xabe117b1
mov dword [ebp - 4], 0xc6fc77d2
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x13c], al
inc eax
cmp eax, 0x100
jb 0xc6bbbb
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x13c]
push 6
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x20]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x13c]
mov byte [ebp + esi - 0x13c], al
inc esi
mov byte [ebp + edi - 0x13c], bl
cmp esi, 0x100
jb 0xc6bbcc
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x13c]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x13c]
mov byte [ebp + edi - 0x13c], al
mov byte [ebp + ebx - 0x13c], cl
movzx eax, byte [ebp + edi - 0x13c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x13c]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x3c], al
inc esi
cmp esi, 0x18
jb 0xc6bc0f
xor ecx, ecx
mov byte [ebp - 0x24], 0
push 0
lea edx, [ebp - 0x3c]
inc ecx
call fcn.00c4ba1b
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100436d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10122e30
push 0x100f2189
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x10126008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov dword [ebp - 0x438], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.100053d0
mov dword [ebp - 0x43c], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x10043738
mov eax, dword [eax]
lea edx, [ebp - 0x43c]
mov ecx, eax
call fcn.10006b50
mov edx, esi
call fcn.10043830
mov bl, al
mov byte [ebp - 0x431], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x1004377b
test bl, bl
jne 0x1004380b
mov ecx, esi
call fcn.100053d0
mov dword [ebp - 0x438], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x100437a3
mov eax, dword [eax]
lea edx, [ebp - 0x438]
mov ecx, eax
call fcn.10006b50
push 0x410
push 0
lea eax, [ebp - 0x430]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x207
lea eax, [ebp - 0x430]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x430]
call fcn.10006b80
push eax
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.10006990
mov ecx, esi
call fcn.10011ea0
movzx ebx, bl
mov ecx, 1
test al, al
cmove ebx, ecx
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100f1763
mov esp, ebp
pop ebp
ret