joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcfb86b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0ce8e1c
jmp 0xcfb879
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0xcfb895
mov word [esp], ax
mov byte [esp], dl
pushfd
mov dword [esp + 0x24], esi
jmp 0xcfb851
mov ebp, edx
not ch
rdtsc
cpuid
jmp 0xcfb8b1
pushfd
jmp 0xcf7a4a
lea esi, [esp]
bswap ecx
rdtsc
sub esp, 7
jmp 0xcfb8ef
mov ebp, dword [esp + 0x2c]
rdtsc
mov ebx, dword [esp]
mov bh, byte [esp]
sbb ecx, 0xd6e7e6c5
jmp 0xcfba15
je 0xcfb928
lea esp, [esp + 3]
jmp 0xcfb92c
lea esp, [esp + 3]
sub esp, 0xbc
jmp 0xcfb8d9
ja 0xcfb89b
jbe 0xcfb89b

Function at 0xd9eb6f
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc bx, sp
rol cx, cl
jmp 0xd9eb9d

Function at 0xda2ff2
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ch
mov edi, dword [esp + 6]
mov cx, word [esp + 0xa]
jmp 0xda3016

Function at 0xda33e6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, 0xcd37107e
pop dword [esp + 0x19]
rdtsc
mov dl, byte [esp + 0xc]
mov dl, 0x30
jmp 0xda33ba

Function at 0xda3470
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, reloc.ADVAPI32.DLL_RegCloseKey
lea esi, reloc.ADVAPI32.DLL_RegCloseKey
push word [esp + 0xb]
pop word [esp + 0x12]
jmp 0xda3383
pop di
pop ecx
dec edx
xchg ah, dh
pop esi
xchg byte [esp + 0xc], ah
jmp 0xda3330
mov dword [esp + 3], esp
mov word [esp + 0x10], bx
lea edx, [ebx*4]
rdtsc
lea edi, [esp + ebp]
rdtsc
setg dh
push dword [esp + 5]
jmp 0xda334e
std
mov edx, 0xda099e8b
push dword [esp + 0x17]
jmp 0xda3407

Function at 0xda8acd
Capabilities:
Parse pe header

Disassembly:
mov eax, dword fs:[0x30]
jmp 0xda8a9e
mov dword [esp + 0x1c], edi
lea esp, [esp + 0x1c]
jmp 0xda8ab4

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp int.00401219

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x26ec59ff
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3a800939
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x403180
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x40327e
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x40327e
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4031ca
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x4031d1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x4031b0
jmp 0x4031d3
mov esi, 0x1505
jmp 0x4031d3
mov esi, ecx
mov edx, dword [esp + 0x24]
mov ebx, dword [edx + 0x20]
test ebx, ebx
je 0x40327e
mov eax, ebx
xor eax, 1
mov ecx, ebx
and ecx, 0xfffffffe
add ecx, ecx
sub ecx, eax
and ecx, esi
mov dword [esp + 0xc], ecx
lea eax, [ebx - 1]
mov dword [esp + 8], eax
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
xor ebp, ebp
jmp 0x403215
inc ebp
cmp ebx, ebp
je 0x40327c
mov eax, ebp
mov edi, dword [esp + 0xc]
and eax, edi
mov ecx, ebp
xor ecx, edi
lea eax, [ecx + eax*2]
and eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edi, dword [ecx + eax*4]
cmp edi, 0xffffffff
je 0x40327c
mov eax, dword [edx + 8]
cmp dword [eax + edi*4], esi
jne 0x403210
mov eax, dword [edx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp], eax
push eax
call fcn.004096b0
mov edx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x403210
push dword [esp + 0x2c]
push dword [esp + 4]
push dword [esp + 0x30]
call fcn.004096e0
mov edx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x403210
mov eax, dword [edx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x40327e
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404020
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4041c6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4041bf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x4040b5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x4041bf
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x40412e
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x4040d0
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x40407d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x404170
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x404150
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x404070
jmp 0x40417f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x404070
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x404190
jmp 0x404070
shl ecx, 0x10
or ecx, edi
jmp 0x4041cb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4041e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40423c
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
lea eax, [esi + esi]
not eax
add eax, esi
test edx, edx
je 0x404238
xor esi, esi
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44180c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
mov edi, dword [edi*4 + 0x44180c]
mov ebx, eax
and ebx, edi
add eax, edi
add ebx, ebx
sub eax, ebx
inc esi
cmp edx, esi
jne 0x404200
not eax
jmp 0x40423e
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x413bb0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x78
mov eax, dword [esp + 0x90]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edi + 2], 0
lea edi, [edi + 2]
jne 0x413bd0
sar edi, 1
lea esi, [esp + 0x68]
push esi
push 0
push 0
push edi
push eax
push 0
call dword [0x44ab50]
mov ebp, dword [esp + 0x68]
mov ebx, 0xffffffff
test ebp, ebp
jns 0x413c04
mov eax, 0xffffffff
jmp 0x413c0b
lea eax, [ebp*2]
push eax
call fcn.004095a0
add esp, 4
push esi
push ebp
mov ebp, eax
push eax
push edi
push dword [esp + 0xa0]
push 0
call dword [0x44ab50]
mov eax, dword [esp + 0x68]
mov ecx, eax
and ecx, 0xd
xor eax, 0xd
lea eax, [eax + ecx*2]
test eax, eax
js 0x413c40
add eax, eax
mov ebx, eax
push ebx
call fcn.004095a0
add esp, 4
mov ebx, eax
mov dword [esp + 0x1c], 0xd86fda79
mov dword [esp + 0x20], 0xd458d678
mov dword [esp + 0x24], 0xd033d259
mov dword [esp + 0x28], 0xcc52ce7b
mov dword [esp + 0x2c], 0xc844ca43
mov dword [esp + 0x30], 0xc454c650
mov dword [esp + 0x34], 0xc0c3c257
mov byte [esp + 0x38], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x1c
ja 0x413cce
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x1c]
add eax, 0xf7cb9da3
xor eax, ecx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x4c]
add al, 0x82
mov ecx, dword [esp]
mov byte [esp + ecx + 0x1c], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1d
jb 0x413ca0
movzx ecx, word [ebp]
mov eax, ebx
test cx, cx
je 0x413cf1
lea edx, [ebp + 2]
mov eax, ebx
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413ce0
mov word [eax], 0
movzx ecx, word [esp + 0x1c]
test cx, cx
je 0x413d21
lea edx, [esp + 0x1e]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413d10
mov word [eax], 0
lea eax, [esp + 8]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043f310
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x445b3c]
Function at 0x418e80
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov ebx, dword [esp + 0x80]
mov ebp, dword [esp + 0x7c]
mov edi, dword [esp + 0x78]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x418ea0
cmp eax, 0xffffffdd
jge 0x418eb7
mov eax, 0xffffffff
jmp 0x418eba
add eax, 0x22
push eax
call fcn.004095a0
add esp, 4
mov esi, eax
mov dword [esp + 8], 0xff69f914
mov dword [esp + 0xc], 0xf361fd68
mov dword [esp + 0x10], 0xf717f166
mov dword [esp + 0x14], 0xeb0ff56f
mov dword [esp + 0x18], 0xef0ae904
mov dword [esp + 0x1c], 0xe378ed09
mov dword [esp + 0x20], 0xe773e101
mov dword [esp + 0x24], 0x9b0ee578
mov word [esp + 0x28], 0x9998
mov dword [esp + 0x2a], 0
mov byte [esp + 0x2e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x26
ja 0x418f5e
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xd1de79a2
xor eax, ecx
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x50]
add al, 0xa6
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x27
jb 0x418f30
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x418f81
add ecx, 2
mov eax, esi
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x418f70
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x418fb1
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x418fa0
mov word [eax], 0
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebx
mov eax, dword [esp + 0x84]
mov dword [esp + 0x60], eax
mov dword [esp + 8], 0x394b3b4f
mov dword [esp + 0xc], 0x457147c0
mov dword [esp + 0x10], 0x4138432f
mov dword [esp + 0x14], 0x4d214f32
mov dword [esp + 0x18], 0x49374b38
mov dword [esp + 0x1c], 0x5527573f
mov dword [esp + 0x20], 0x51675320
mov dword [esp + 0x24], 0x5d6b5f69
mov dword [esp + 0x28], 0x593a5b6c
mov dword [esp + 0x2c], 0x651b671b
mov dword [esp + 0x30], 0x611e630f
mov dword [esp + 0x34], 0x6d1f6f21
mov dword [esp + 0x38], 0x69146b18
mov dword [esp + 0x3c], 0x750c771b
mov dword [esp + 0x40], 0x7139730e
mov dword [esp + 0x44], 0x7d397f12
mov dword [esp + 0x48], 0x79787b4c
mov dword [esp + 0x4c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x47
ja 0x4190b1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x35c017bc
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x7a
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x48
jb 0x419080
lea eax, [esp + 0x50]
lea ecx, [esp + 8]
push eax
push 0x419440
push ecx
push esi
call fcn.00419ac0
add esp, 0x10
jmp dword [0x445eb0]
Function at 0x41f940
Capabilities:
Copy file
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.0041f960
add esp, 4
test al, al
je 0x41fff0
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
xor edi, edi
mov esi, 0x20219
mov eax, 1
jmp dword [eax*4 + 0x446e08]
Function at 0x422460
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x80
mov eax, dword [0x44ab50]
mov dword [esp + 0x20], 0xcc8acaac
mov dword [esp + 0x24], 0xd07fce7d
mov dword [esp + 0x28], 0xd472d295
mov dword [esp + 0x2c], 0xd876d661
mov dword [esp + 0x30], 0xdc87dabc
mov dword [esp + 0x34], 0x2070de93
mov dword [esp + 0x38], 0x24862295
mov dword [esp + 0x3c], 0x28862695
mov dword [esp + 0x40], 0x2c402a8d
mov dword [esp + 0x44], 0x30732e46
mov dword [esp + 0x48], 0x34963282
mov dword [esp + 0x4c], 0x38843686
mov dword [esp + 0x50], 0x3c943a90
mov dword [esp + 0x54], 0x513e93
mov dword [esp + 0x58], 0x4ae02b9
mov dword [esp + 0x5c], 0x80706a9
mov byte [esp + 0x60], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x40
ja 0x422540
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x20]
add ecx, 0xf8e9
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xe0
mov edx, dword [esp]
mov byte [esp + edx + 0x20], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x41
jb 0x422510
lea esi, [esp + 0x7c]
lea ecx, [esp + 0x20]
push esi
push 0
push 0
push 0x1f
push ecx
push 0
call eax
mov edi, dword [esp + 0x7c]
test edi, edi
jns 0x422563
mov eax, 0xffffffff
jmp 0x422566
lea eax, [edi + edi]
push eax
call fcn.004095a0
add esp, 4
mov ebx, eax
mov eax, dword [0x44ab50]
mov dword [esp + 0x20], 0xfbb3fd95
mov dword [esp + 0x24], 0xc748f94a
mov dword [esp + 0x28], 0xc36bc58a
mov dword [esp + 0x2c], 0xcf6fc17e
mov dword [esp + 0x30], 0xcb68cda5
mov dword [esp + 0x34], 0xd779c998
mov dword [esp + 0x38], 0xd37fd56a
mov dword [esp + 0x3c], 0xdf7fd162
mov dword [esp + 0x40], 0xdba9dd72
mov dword [esp + 0x44], 0x277cd9af
mov dword [esp + 0x48], 0x238f259b
mov dword [esp + 0x4c], 0x2f9d219f
mov dword [esp + 0x50], 0x2b9d2d99
mov dword [esp + 0x54], 0x375a2998
mov dword [esp + 0x58], 0x3387358e
mov dword [esp + 0x5c], 0x3f303186
mov word [esp + 0x60], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x41
ja 0x42264c
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x20]
add ecx, 0x3e4917d9
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
mov edx, ecx
not edx
and edx, 0x27
and ecx, 0xd8
sub ecx, edx
mov edx, dword [esp]
mov byte [esp + edx + 0x20], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x42
jb 0x422610
push esi
push edi
push ebx
push 0x1f
lea edi, [esp + 0x30]
push edi
push 0
call eax
lea eax, [esp + 0x1c]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043f310
add esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 8], 0
jmp dword [eax*4 + 0x4470a8]
inc edx
add byte [ebp + 0x2e004226], ah
daa
inc edx
add al, dl
inc edx
add al, dl
inc edx
add al, dl
inc edx
add al, dl
inc edx
add dh, dl
inc edx
add byte [edx], dl
daa
inc edx
add bh, al
daa
inc edx
add byte [eax + 0x12004228], ah
daa
inc edx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [esi + ebp + 0x10042], dh
add byte [eax], al
aad 0x28
sub byte [edx], al
loopne 0x447115
Function at 0x423c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x423c5a
cmp edi, 1
je 0x423c5a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x423c31
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x423c30
cmp ecx, 0x20
je 0x423c30
cmp ecx, 0x2b
mov edx, edi
je 0x423c50
cmp ecx, 0x2d
jne 0x423c6f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x423c74
xor edi, edi
test eax, eax
je 0x423e2d
mov dword [eax], 0x16
jmp 0x423e2d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x423c9d
cmp edx, 0x10
jne 0x423cb5
cmp byte [ebx], 0x30
jne 0x423c96
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x423cb7
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x423cb7
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x423d10
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x423dc8
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x423d37
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x423df8
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x423df8
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x423cf0
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x423d80
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x423d89
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x423dad
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x423ddd
test bl, bl
jne 0x423ddd
mov ebx, dword [esp + 0x10]
jmp 0x423d03
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x423ce5
mov esi, edi
test bl, bl
jne 0x423deb
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x423ce5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x423e06
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x423e14
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x423e24
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x423e2d
cmp byte [esp + 3], 0
jne 0x423e2d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436710
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + ebx], 0
lea ebx, [ebx + 2]
jne 0x436730
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x4e72709d
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x4367a3
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea esi, [eax + 0x6f707bdd]
lea edi, [eax + edx]
add edi, 0x6f707bdd
add eax, 0xdd
or eax, esi
and eax, edx
add eax, eax
sub edi, eax
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x14]
add al, 0x53
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x436760
cmp ebx, 2
je 0x4367bd
lea eax, [ebx - 2]
mov edx, eax
sar edx, 1
mov esi, dword [esp + 8]
mov edi, esi
not edi
test al, 2
jne 0x4367c4
jmp 0x4367ef
mov eax, ebp
jmp 0x436848
dec edx
mov ecx, dword [esp + 0x2c]
movzx eax, word [ecx]
add ecx, 2
mov dword [esp + 4], ecx
xor eax, ebp
mov ecx, eax
and ecx, edi
mov ebp, eax
not ebp
and ebp, esi
imul ebp, ecx
mov ecx, eax
and ecx, esi
or eax, esi
imul eax, ecx
add eax, ebp
mov ebp, eax
cmp ebx, 4
mov ecx, dword [esp + 4]
je 0x436848
xor ebx, ebx
mov eax, ebp
mov dword [esp + 0x10], edx
movzx ebp, word [ecx + ebx*2]
xor ebp, eax
mov eax, ebp
and eax, edi
mov edx, ebp
not edx
and edx, esi
imul edx, eax
mov eax, ebp
and eax, esi
or ebp, esi
imul ebp, eax
add ebp, edx
movzx eax, word [ecx + ebx*2 + 2]
xor eax, ebp
mov edx, eax
and edx, edi
mov ebp, eax
not ebp
and ebp, esi
imul ebp, edx
mov edx, eax
and edx, esi
or eax, esi
imul eax, edx
mov edx, dword [esp + 0x10]
add eax, ebp
add ebx, 2
cmp edx, ebx
jne 0x436800
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
push eax
mov dword [ebp - 0x1c], esp
sub esp, 0xc
mov esi, esp
lea ecx, [ebp - 0x2c]
push 0x68
push 7
push 0x100080
push ecx
push eax
call fcn.0043f310
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448460]
Function at 0x43b280
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov dword [esp + 4], 0xb8bbba6d
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43b2de
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0xb59a23cb
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x8a
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x43b2b0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
mov edx, dword [0x448910]
nop
jmp edx

Function at 0x43b320
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x448938]