joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x419db0
cmp eax, 0xffffffed
jge 0x419dc7
mov eax, 0xffffffff
jmp 0x419dca
add eax, 0x12
push eax
call fcn.0040a300
add esp, 4
mov esi, eax
mov dword [esp + 4], 0x18b41eb9
mov dword [esp + 8], 0x4821ab4
mov dword [esp + 0xc], 0x510659
mov dword [esp + 0x10], 0xca102ad
mov word [esp + 0x14], 0xe0d
mov dword [esp + 0x16], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x15
ja 0x419e4e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0xa36ea329
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0xcc
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x16
jb 0x419e20
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x419e71
add edi, 2
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x419e60
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x419ea1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419e90
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.0043ec70
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x444e70]

Function at 0x419dbb
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x419db0
cmp eax, 0xffffffed
jge 0x419dc7
mov eax, 0xffffffff
jmp 0x419dca
add eax, 0x12
push eax
call fcn.0040a300
add esp, 4
mov esi, eax
mov dword [esp + 4], 0x18b41eb9
mov dword [esp + 8], 0x4821ab4
mov dword [esp + 0xc], 0x510659
mov dword [esp + 0x10], 0xca102ad
mov word [esp + 0x14], 0xe0d
mov dword [esp + 0x16], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x15
ja 0x419e4e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0xa36ea329
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0xcc
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x16
jb 0x419e20
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x419e71
add edi, 2
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x419e60
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x419ea1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419e90
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.0043ec70
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x444e70]
Function at 0x41d940
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x74
mov ebp, dword [esp + 0x88]
mov eax, dword [0x449968]
mov dword [esp + 0x18], 0x8550fbd7
mov dword [esp + 0x1c], 0x81638771
mov dword [esp + 0x20], 0x8d788363
mov dword [esp + 0x24], 0x89788f4f
mov dword [esp + 0x28], 0x95588b7a
mov dword [esp + 0x2c], 0x916c9777
mov dword [esp + 0x30], 0x9db19373
mov word [esp + 0x34], 0x9f9e
mov dword [esp + 0x36], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x21
ja 0x41d9e0
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x18]
add ecx, 0x240f963e
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0x3c
mov edx, dword [esp]
mov byte [esp + edx + 0x18], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x22
jb 0x41d9b0
lea edi, [esp + 0x68]
lea esi, [esp + 0x18]
push edi
push 0
push 0
push 0xe
push esi
push 0
call eax
mov ebx, dword [esp + 0x68]
test ebx, ebx
jns 0x41da03
mov eax, 0xffffffff
jmp 0x41da06
lea eax, [ebx + ebx]
push eax
call fcn.0040a300
add esp, 4
mov dword [esp + 8], eax
mov eax, dword [0x449968]
mov dword [esp + 0x18], 0xc217c4fe
mov dword [esp + 0x1c], 0xde22c030
mov dword [esp + 0x20], 0xda2fdc22
mov dword [esp + 0x24], 0xd627d806
mov dword [esp + 0x28], 0xd20fd425
mov dword [esp + 0x2c], 0xee63d02e
mov dword [esp + 0x30], 0xead0ec12
mov dword [esp + 0x34], 0xe8e9
mov byte [esp + 0x38], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x20
ja 0x41daa0
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x18]
add ecx, 0x7b48ce8a
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0xb1
mov edx, dword [esp]
mov byte [esp + edx + 0x18], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x21
jb 0x41da70
push edi
push ebx
push dword [esp + 0x10]
push 0xe
push esi
push 0
call eax
mov eax, dword [esp + 0x68]
mov ecx, eax
add ecx, 9
jns 0x41dabf
mov eax, 0xffffffff
jmp 0x41dac6
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040a300
add esp, 4
mov edi, eax
mov dword [esp + 0x18], 0xa0d1a2df
mov dword [esp + 0x1c], 0xa4c0a6c0
mov dword [esp + 0x20], 0xa8ceaac6
mov dword [esp + 0x24], 0xacc6aec6
mov dword [esp + 0x28], 0xd0d1d246
mov byte [esp + 0x2c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x14
ja 0x41db3e
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x18]
add eax, 0x9f97f8b0
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xed
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x15
jb 0x41db10
mov eax, dword [esp + 8]
movzx eax, word [eax]
mov ebx, edi
test ax, ax
je 0x41db71
mov ecx, dword [esp + 8]
add ecx, 2
mov ebx, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], ax
add ebx, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41db60
mov word [ebx], 0
jmp dword [0x44557c]
Function at 0x436000
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebp, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + ebx], 0
lea ebx, [ebx + 2]
jne 0x436020
mov dword [esp + 8], 0xf8f8fe6d
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x43607e
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
add eax, 0x62d146b2
xor eax, edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add al, 0xb4
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x436050
cmp ebx, 2
je 0x4360a0
mov dword [esp + 4], ecx
lea eax, [ebx - 2]
mov esi, eax
sar esi, 1
mov edi, dword [esp + 8]
mov edx, edi
not edx
test al, 2
mov dword [esp + 0x14], edx
jne 0x4360a7
jmp 0x4360d2
mov eax, ebp
jmp 0x436140
dec esi
mov ecx, dword [esp + 0x30]
movzx eax, word [ecx]
add ecx, 2
mov dword [esp + 4], ecx
xor eax, ebp
mov ebp, eax
not ebp
and ebp, edi
mov ecx, eax
and ecx, edx
imul ecx, ebp
mov ebp, eax
and ebp, edi
or eax, edi
imul eax, ebp
add eax, ecx
mov ebp, eax
cmp ebx, 4
mov ecx, dword [esp + 4]
je 0x436140
xor ebx, ebx
mov eax, ebp
mov dword [esp + 0x10], esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [ecx + ebx*2]
xor ebp, eax
mov eax, ebp
not eax
and eax, edi
mov edx, ebp
mov esi, ecx
mov ecx, dword [esp + 0x14]
and edx, ecx
imul edx, eax
mov eax, ebp
and eax, edi
or ebp, edi
imul ebp, eax
add ebp, edx
movzx eax, word [esi + ebx*2 + 2]
xor eax, ebp
mov edx, eax
not edx
and edx, edi
mov ebp, eax
and ebp, ecx
mov ecx, esi
imul ebp, edx
mov edx, eax
and edx, edi
or eax, edi
imul eax, edx
mov esi, dword [esp + 0x10]
add eax, ebp
add ebx, 2
cmp esi, ebx
jne 0x4360f0
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a6f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov dword [esp + 4], 0xb9babb4c
mov byte [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x43a750
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add ecx, 0x39ed05db
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0x99
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x43a720
mov ecx, dword [esp + 4]
mov edx, dword [0x447738]
nop
nop
nop
nop
nop
nop
jmp edx
Function at 0x43a830
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x9363734
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43a88e
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0x5250939d
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x56
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x43a860
mov edi, dword [esp + 4]
mov eax, dword [0x44996c]
test eax, eax
je 0x43a8e6
xor ecx, ecx
mov edx, dword [0x449970]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x43a8c0
inc ecx
cmp eax, ecx
jne 0x43a8b0
jmp 0x43a8e6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43a8e6
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x449974]
push eax
call fcn.0043c800
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43aa25
mov dword [esp + 0x14], esi
push dword [esp + 0xc]
call fcn.0043a6f0
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x9363734
mov dword [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 7
ja 0x43a960
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0x5250939d
xor edx, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 0x56
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 8
jb 0x43a930
mov edi, dword [esp + 4]
mov edx, dword [0x44996c]
test edx, edx
je 0x43a9c0
xor ebx, ebx
mov ebp, dword [0x449970]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x43a99b
mov esi, ebx
and esi, 1
xor ebx, 1
lea ebx, [ebx + esi*2]
cmp ebx, edx
jb 0x43a980
jmp 0x43a9c0
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x43a9c0
push 0
push ecx
push eax
push 5
push 4
push dword [0x449974]
push edx
mov esi, eax
call fcn.0043c800
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43aa1c
mov ecx, dword [esp + 0x2c]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x43a9f5
add ebx, 2
cmp bp, si
je 0x43a9e0
cmp bp, si
je 0x43aa07
mov ebx, dword [edx]
test ebx, ebx
jne 0x43a9d0
mov edi, 0xc0000225
jmp 0x43aa1c
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x14]
mov dword [esi + 4], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 8], ecx
xor edi, edi
push eax
call fcn.0043a780
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43aa60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ecx + 4]
test edx, edx
je 0x43ab40
xor eax, eax
cmp dword [ecx], 0
jne 0x43ab97
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], edx
mov eax, dword [ecx + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x9363734
mov dword [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43ab0e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
add eax, 0x5250939d
xor eax, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add al, 0x56
mov edx, dword [esp]
mov byte [esp + edx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x43aae0
mov eax, dword [esp + 0xc]
mov esi, dword [0x44996c]
test esi, esi
je 0x43ab97
mov edx, dword [esp + 0x40]
xor edi, edi
mov ebx, dword [0x449970]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x43aba0
inc edi
cmp esi, edi
jne 0x43ab30
jmp 0x43ab97
mov dword [esp + 0x14], 0xd293949d
mov byte [esp + 0x18], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x43ab93
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x14]
add eax, 0x3adcbed2
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xb9
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x43ab60
mov eax, dword [esp + 0x14]
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43ab97
lea eax, [esp + 4]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x449974]
push esi
call fcn.0043c800
add esp, 0x1c
jmp 0x43ab97

Function at 0x43abd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43ac91
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x9363734
mov dword [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 7
ja 0x43ac30
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add edx, 0x5250939d
xor edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
add dl, 0x56
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 8
jb 0x43ac00
mov edx, dword [0x44996c]
test edx, edx
je 0x43ac7e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x449970]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x43ac60
inc edi
cmp edx, edi
jne 0x43ac50
jmp 0x43ac7e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43ac7e
push eax
push 1
push dword [0x449974]
push edx
mov esi, ecx
call fcn.0043c800
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
mov dword [ecx + 4], 0
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x43aca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 4], 0
je 0x43ad46
mov edx, dword [ecx]
test edx, edx
je 0x43ad46
mov dword [esp + 0x14], 0x9363734
mov dword [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43ad0e
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 0x14]
add eax, 0x5250939d
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0x56
mov esi, dword [esp]
mov byte [esp + esi + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x43ace0
mov edi, dword [ebp + 0x10]
mov eax, dword [esp + 0x14]
mov ebx, dword [0x44996c]
test ebx, ebx
je 0x43add4
xor edi, edi
mov esi, dword [0x449970]
nop
nop
nop
nop
nop
cmp dword [esi + edi*8], 0xc766965c
je 0x43adb0
inc edi
cmp ebx, edi
jne 0x43ad30
mov edi, dword [ebp + 0x10]
jmp 0x43add4
mov dword [esp], 0xd817161d
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 3
ja 0x43ada8
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx]
lea edx, [eax + ecx]
add edx, 0x86c40aa5
add eax, 0x86c40aa5
and eax, ecx
mov ecx, edx
xor ecx, eax
add ecx, eax
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0x50
mov ecx, dword [esp + 8]
mov byte [esp + ecx], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 4
jb 0x43ad60
mov eax, dword [esp]
jmp 0x43aec2
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
mov edi, dword [ebp + 0x10]
je 0x43add4
push dword [ebp + 8]
push edx
push 2
push dword [0x449974]
push esi
mov esi, ecx
call fcn.0043c800
mov ecx, esi
add esp, 0x14
mov esi, dword [ebp + 0xc]
cmp esi, 1
mov edx, edi
sbb edx, 0
jl 0x43aeb5
cmp eax, 0xc000010a
jne 0x43aeb5
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
imul esi, edi, 0xffffd8f0
add esi, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov edx, dword [ecx]
mov dword [esp + 0x14], 0x9363734
mov dword [esp + 0x18], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 7
ja 0x43ae61
nop
nop
mov eax, dword [esp + 4]
mov esi, dword [esp + 4]
movzx esi, byte [esp + esi + 0x14]
add eax, 0x5250939d
xor eax, esi
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x56
mov esi, dword [esp + 4]
mov byte [esp + esi + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 8
jb 0x43ae30
mov eax, dword [esp + 0x14]
mov esi, dword [0x44996c]
test esi, esi
je 0x43aeb5
xor edi, edi
mov ebx, dword [0x449970]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e28bda7
je 0x43ae90
inc edi
cmp esi, edi
jne 0x43ae80
jmp 0x43aeb5
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43aeb5
lea eax, [esp + 8]
push eax
push 0
push edx
push 3
push dword [0x449974]
push esi
mov esi, ecx
call fcn.0043c800
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43aec2
mov esi, eax
call fcn.0043abd0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43aed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edx, dword [esp + 0x34]
mov ecx, dword [ecx]
mov dword [esp + 4], 0x9363734
mov dword [esp + 8], 0
test edx, edx
jne 0x43aef5
lea edx, [esp + 0x10]
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43af3e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
add eax, 0x5250939d
xor eax, esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x56
mov esi, dword [esp]
mov byte [esp + esi + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x43af10
mov eax, dword [esp + 4]
mov ebp, dword [0x44996c]
test ebp, ebp
je 0x43af94
mov ebx, dword [esp + 0x30]
xor esi, esi
mov edi, dword [0x449970]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x3baba5e0
je 0x43af70
inc esi
cmp ebp, esi
jne 0x43af60
jmp 0x43af94
mov ebp, dword [edi + esi*8 + 4]
cmp ebp, eax
je 0x43af94
push edx
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push ecx
push 5
push dword [0x449974]
push ebp
call fcn.0043c800
add esp, 0x20
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43c840
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x254
push dword [0x451984]
call fcn.0043d4d0
add esp, 4
movzx eax, al
jmp dword [eax*4 + 0x447c78]

Function at 0x43d4d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov ebp, dword [esp + 0x58]
movzx eax, word [ebp]
mov dword [esp + 0x28], 0x92937246
mov byte [esp + 0x2c], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 4
ja 0x43d533
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x28]
add ecx, 0x3adcbed2
xor ecx, edx
mov dword [esp], ecx
mov ecx, dword [esp]
add cl, 0xb9
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x28], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 5
jb 0x43d500
xor ecx, ecx
cmp dword [esp + 0x28], eax
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x447d38]
mov eax, dword [ebp + 0x3c]
mov ecx, dword [ebp + eax]
mov dword [esp + 4], 0x181753a5
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 3
ja 0x43d5ad
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
lea edi, [edx + esi]
add edx, 0xa5
and edx, esi
add edx, edx
sub edi, edx
add edi, 0x86c40aa5
mov dword [esp + 0x28], edi
mov edx, dword [esp + 0x28]
add dl, 0x50
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 4
jb 0x43d570
xor edx, edx
cmp ecx, dword [esp + 4]
setne dl
xor ebx, ebx
jmp dword [edx*4 + 0x447d40]
mov edx, dword [ebp + eax + 0x78]
cmp dword [ebp + eax + 0x7c], 0
sete al
test edx, edx
sete cl
or cl, al
movzx eax, cl
xor ebx, ebx
jmp dword [eax*4 + 0x447d48]
mov eax, dword [ebp + edx + 0x20]
add eax, ebp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + edx + 0x24]
add eax, ebp
mov dword [esp + 0x14], eax
mov eax, dword [ebp + edx + 0x1c]
add eax, ebp
mov dword [esp + 0x10], eax
mov esi, dword [0x449970]
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], edx
jmp dword [eax*4 + 0x447d50]
mov eax, ebx
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43de40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc0f0ef1
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43de9e
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0xc]
add eax, 0x34258ae7
xor eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0x1a
mov ecx, dword [esp]
mov byte [esp + ecx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43de70
mov eax, dword [esp + 0xc]
mov eax, dword fs:[eax]
mov ecx, dword [0x448224]
nop
nop
nop
nop
nop
jmp ecx
Function at 0x403194
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404c24
test esi, esi
jne 0x4031cb
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404d14
jmp 0x4031ec
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00403030
mov dword [esp], eax
test esi, esi
je 0x4031ec
cmp dword [ebx], 0
je 0x4031ec
dec esi
jmp 0x4031d3
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403d0c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46c020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403da4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403d84
xor eax, eax
push ebp
push 0x403d7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403dc0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403d84
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x46c020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46c020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404aa0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46e048], 0
je 0x404b01
cmp word [0x46e21c], 0xd7b2
jne 0x404ac9
cmp dword [0x46e224], 0
jbe 0x404ac9
mov eax, 0x46e218
call dword [0x46e234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46c070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404b28
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46c030], 0
jne 0x404b1d
push 0
push 0x46c068
push 0x46c070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret