joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e70a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4e7171
xchg dx, cx
not cx
cmc
jo 0x4e7093
xchg cl, ch
push si
mov cl, dh
not dh
lea esp, [esp + 2]
jmp 0x4e70fe
mov dl, 0x3d
setbe dh
inc cx
xchg cl, ch
btr ecx, esi
setb cl
jmp 0x4e7102
xchg dx, cx
stc
jle 0x4e70c0
mov dl, 0x3d
jmp 0x4e7118
btr ecx, esi
jmp 0x4e70cc
not dh
lea esp, [esp + 2]
neg al
jmp 0x4e70d6
bts cx, sp
js 0x4e7137
jns 0x4e7137
mov dh, 0x3b
stosd dword es:[edi], eax
into
cmp eax, 0xb21c9cc4
aad 0x24
into
jmp 0xc6e48023
setbe dh
inc cx
xchg cl, ch
jmp 0x4e70e0
mov dx, word [esp]
bswap ecx
mov dx, 0xa38e
jmp 0x4e7156
neg al
setb ch
mov ecx, esi
jmp 0x4e7121
xchg dh, dl
mov dx, word [esp]
mov cx, word [esp]
stc
jmp 0x4e71b0
xor al, 0x64
mov dh, 0x8f
not ch
mov cx, bp
btc dx, ax
jmp 0x4e717c
xchg cl, ch
push si
mov cl, dh
jmp 0x4e70f8
jae 0x4e7140
xchg dh, dl
mov dx, word [esp]
jmp 0x4e718a
mov cx, word [esp]
stc
jmp 0x4e71b0
ror al, 0
jmp 0x4e724b
lea ecx, reloc.WSOCK32.dll___WSAFDIsSet
sub esp, 6
lea esp, [esp + 2]
jmp 0x4e71d8
lea esp, [esp + 4]
dec al
bsf dx, bp
jg 0x4e7655
jle 0x4e75a8
dec ebx
lea esp, [esp + 2]
call fcn.004e721b
loopne 0x4e725a
not byte [ecx - 0x62e175a0]
or eax, 0x6c13a754
xor dx, sp
lea ecx, [ecx - 0x20]
bswap edx
mov dx, 0xda5e
clc
jmp 0x4e722e
mov dh, 0x1a
xchg dword [esp], ecx
mov cl, ch
not ecx
mov dh, 0x3a
bswap edx
jmp 0x4e76ef
jae 0x4e71b9
lea ecx, reloc.WSOCK32.dll___WSAFDIsSet
sub esp, 6
jmp 0x4e71ef
or dh, bh
jmp 0x4e7657
or dh, bh
mov edx, eax
call 0x4e7441
mov ch, 0xcf
jmp 0x4e7681
cmp edi, eax
jmp 0x4e770b
bswap ecx
mov dx, word [esp]
xchg cx, ax
mov ecx, esi
rdtsc
jmp 0x4e771e
push dword [esp]
ret 4
mov dx, word [esp]
xchg cx, ax
jmp 0x4e7690
ja fcn.004e69cb
bsr eax, esp
je 0x4e7688
bswap ecx
jmp 0x4e76f5
xchg ah, dh
rdtsc
lea edx, reloc.WSOCK32.dll___WSAFDIsSet
lea edx, [esi + 0x40]
mov ah, byte [esp]
jmp 0x4e7765
mov eax, edi
jmp 0x4e778d
bswap eax
sub edx, ecx
mov eax, 0x68df5453
not ax
mov ax, word [esp]
jmp 0x4e774f
jmp 0x4e77a1
lea eax, [edi - 0x80]
and al, 0xfc
sub esp, 2
je 0x4e7777
lea esp, [esp + 1]
jmp 0x4e77eb
lea esp, [esp + 1]
lea esp, [esp + 1]
jmp 0x4e77d5
sub eax, edx
cmc
ja 0x4e7820
sub esp, 0x1c
jmp 0x4e7807
lea esp, [esp + 1]
jmp 0x4e77d5
push esi
jmp 0x4e783b
mov esp, eax
pushfd
lea esi, [eax + edx - 0x40]
jmp 0x4e77f1
sub esp, 0x1c
jmp 0x4e7807
pushal
neg esi
jg 0x4e7889
not ebp
mov dword [esp + 4], ecx
popal
call fcn.004e869b
test eax, 0x7f6c1de2
push edi
push ecx
jmp 0x4e7825
mov dword [esp + 4], ecx
popal
call fcn.004e788d
mov ch, 0xea
push 0x9b6899fe
add al, 0x85
adc eax, 0xb4728f7c
cmpsd dword [esi], dword es:[edi]
into
not ebp
jmp 0x4e786f
Function at 0x4f16d9
Capabilities:
Encode data using xor

Disassembly:
rol ecx, 0x1e
jp 0x4f17c1
jnp 0x4f17cd
rcl dword [esi - 0x3c]
mov dword [reloc.WSOCK32.dll___WSAFDIsSet], eax
pop ebx
int 0x78
out dx, al
stc
fmul dword [ebp - reloc.WSOCK32.dll___WSAFDIsSet]
push dword [edx]
retf 0xeb8a
and ecx, 0x5e686be2
jmp 0x4f1804
and ecx, 0x5e686be2
sbb ch, ah
lea ecx, [esi + 0xe5]
bsr cx, bp
jmp 0x4f17ee
rol bl, 0
mov ch, ah
lea ecx, [ecx + ebx]
neg ecx
jle 0x4f1841
or ch, 0x13
clc
jmp 0x4f18a0
sbb ch, ah
lea ecx, [esi + 0xe5]
bsr cx, bp
jmp 0x4f17ee
or ch, 0x13
clc
or cl, 0x13
pushfd
jmp 0x4f1864
jmp 0x4f182a
sub dl, bl
lea ecx, reloc.WSOCK32.dll___WSAFDIsSet
lea ecx, [eax + edx]
bswap ecx
jmp 0x4f2443
or cl, 0x13
pushfd
call fcn.004f1843
in eax, 0x8d
lea ecx, [ecx*4]
mov ebx, dword [esp]
bts cx, si
jmp 0x4f1973
not al
neg ecx
jb 0x4f18d4
mov ebx, dword [esp]
jmp 0x4f19f9
add ecx, 0x161b7b48
jmp 0x4f1a50
clc
mov bx, word [esp]
jmp 0x4f1bf4
lea ecx, [ebp - 0x44]
cmc
jmp 0x4f1948
add ecx, 0x6d707023
jmp 0x4f1a6f
shl ebx, cl
ja 0x4f190e
lea ecx, [ebp - 0x44]
cmc
jmp 0x4f1948
lea ecx, reloc.WSOCK32.dll___WSAFDIsSet
mov ecx, 0xc2e673c1
mov cx, dx
jmp 0x4f195b
rol al, 0
not cl
mov ch, byte [esp]
lea ebx, reloc.WSOCK32.dll___WSAFDIsSet
mov bx, si
jmp 0x4f192e
neg al
not bh
inc cx
ja 0x4f19c9
jbe 0x4f1999
dec ebp
outsd dx, dword [esi]
std
pop eax
scasb al, byte es:[edi]
leave
inc edx
sbb dword fs:[ebp + 0xa], eax
scasb al, byte es:[edi]
mov esp, 0x66c8fecc
mov ecx, eax
dec al
mov cx, ax
xchg ch, bh
mov ebx, 0xf2a2f34b
mov ch, bl
jmp 0x4f1924
clc
jae 0x4f19a7
mov bx, 0x321d
shr bl, cl
jmp 0x4f19b3
mov ebx, 0xe4a4a853
lea ecx, reloc.WSOCK32.dll___WSAFDIsSet
jmp 0x4f19d5
mov bx, 0x321d
shr bl, cl
jmp 0x4f19b3
mov ecx, eax
not bx
mov bl, bh
clc
jne 0x4f19db
mov bx, word [esp]
jmp 0x4f1a1c
mov ebx, 0xe4a4a853
lea ecx, reloc.WSOCK32.dll___WSAFDIsSet
sub al, 0x52
bswap ecx
jmp 0x4f1983
jmp 0x4f1a18
jmp 0x4f1a02
lea esp, [esp + 1]
jmp 0x4f18f8
bts cx, si
jmp 0x4f1973
xchg word [esp + 1], bx
mov bx, 0x3a3b
push dword [esp + 7]
jmp 0x4f19df
mov bx, word [esp]
shl ecx, 2
sub esp, 0x1d
jbe 0x4f19dd
xchg word [esp + 1], bx
mov bx, 0x3a3b
push dword [esp + 7]
lea esp, [esp + 1]
jmp 0x4f18f8
mov ecx, dword [ecx - reloc.WSOCK32.dll___WSAFDIsSet]
setns bl
lea ebx, [esi*4]
jmp 0x4f1a67
mov bx, word [esp]
lea ebx, [ebx + ebx]
mov ebx, dword [esp]
cmp bx, ax
jmp 0x4f1a63
ja 0x4f1a3a
jbe 0x4f1a3a
mov ebx, dword [esp]
jmp 0x4f1914
not bh
mov bh, 0xd3
setae bl
call fcn.004f1ae4
ljmp 0x40c3
stc
mov cx, 0xb2e
mov ecx, 0x54716f51
jmp 0x4f1904
stc
mov cx, 0xb2e
mov ecx, 0x54716f51
clc
mov bx, word [esp]
bsr cx, bx
mov bl, 0xd3
jmp 0x4f18ea
mov cx, bx
inc ebp
inc ch
jno 0x4f1be5
jo 0x4f1a88
xchg dword [esp], ebx
push dword [esp + 1]
jge 0x4f2470
jl 0x4f247a
xchg dword [ecx], eax
xchg ecx, eax
lock add esi, dword [edx - reloc.WSOCK32.dll___WSAFDIsSet]
add al, 0xe8
in eax, 0xff
invalid
lea esp, [esp + 8]
call fcn.004f2498
lodsb al, byte [esi]
das
mov edi, 0xc2b029da
inc eax
salc
mov cl, 0x40
mov bl, 0x7d
dec esp
fistp qword [ebx]
cmp edi, ecx
Function at 0x594094
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], esp
mov dword [esp], esp
jmp 0x594066
neg ebx
ja 0x59401a
mov dword [esp], esp
mov dword [esp], esp
not ah
rcr eax, cl
xchg edi, edx
jmp 0x594049
setl bh
add esp, 0x10
jle 0x59406e
jg 0x59406e
add ecx, 0xc9b78297
jmp 0x595f6b
not ah
rcr eax, cl
xchg edi, edx
jmp 0x594049
pop edi
jmp 0x4cf032
jmp 0x594033
mov edx, 0x97746d25
mov edx, 0x43273439
xchg byte [esp + 0xc], dh
mov dl, dh
mov dx, di
not dx
call fcn.00595fa8
arpl word [ebp - 0x16fedb9c], cx
call 0x10595f4c
mov ebp, 0xc17e9d6
add byte [eax], al
xchg ecx, eax
bsr edx, esi
jmp 0x596b8a
call fcn.005969f1
adc al, 0x92
add byte [edi - 0x6e], ah
daa
xchg esi, eax
pop ss
xchg edx, esp
adc dword [ebx + reloc.WSOCK32.dll___WSAFDIsSet], ebp
out dx, al
lea edx, [ecx + ebp]
sub esp, 0x11
jmp 0x595f46
jae 0x595f74
jb 0x595f74
Function at 0x714ab6
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ah
btc ebp, edi
xchg dword [esp + 0xc], ecx
cpuid
inc esi
pop bp
jmp 0x714ac2
lea esp, [esp + 7]
cld
mov di, word [esp + 0x11]
jmp 0x714aa0
xchg byte [esp + 0xf], dh
mov word [esp + 0xf], bp
xchg word [esp + 0xc], si
mov edx, eax
add esp, 0xb
xchg edi, eax
jmp 0x714b08
xchg di, ax
stc
mov edi, ebx
push dword [esp + 4]
push ecx
pop eax
jmp 0x714af2

Function at 0x714e26
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edi
rcr si, 6
mov ebx, dword [esp + 6]
mov dl, cl
push dword [esp + 3]
pop ebx
jmp 0x714dfb
mov word [esp + 4], di
btc bp, sp
push dword [esp + 7]
push ax
pop ebx
dec dh
jmp 0x714dd1
mov dh, byte [esp + 1]
mov cl, 0x6e
xchg dx, bx
mov ch, cl
mov edi, dword [esp + 5]
cpuid
jmp 0x714e4e
sub esp, 0x13
lea esp, [esp + 0x29]
add esp, 0
rdtsc
sub esp, 1
jmp 0x714e2c
rdtsc
mov ch, 0x5e
jmp 0x714de7
mov word [esp + 1], ax
mov ah, 0xec
push dword [esp + 7]
mov bp, 0xe9c3
lea esi, [ecx*4]
cpuid
jmp 0x714e7c
mov dx, 0x57c8
bts si, di
mov cx, word [esp]
sub esp, 0x17
rdtsc
mov word [esp + 0x18], ax
jmp 0x714e0e
mov bh, 0xd7
bswap ecx
xchg dword [esp + 2], ebp
mov dword [esp + 5], esp
call fcn.00714ea6
and ebx, dword [edx - 0x4b]
movsb byte es:[edi], byte [esi]
xlatb
pop ebp
mov byte [esp + 8], al
mov ebp, 0xaa1d6733
std
cpuid
mov cx, word [esp + 8]
jmp 0x714e66

Function at 0x714ea6
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edi, ebp
xchg byte [esp + 2], dl
mov ebx, 0x7284b71f
xchg word [esp + 0xb], bx
jmp 0x714f2c
stc
mov di, word [esp + 2]
jmp 0x714e90
mov byte [esp + 0x20], ah
btc ecx, edx
bswap edx
pop cx
mov dword [esp + 0x1d], edx
jmp 0x714f0c
cld
mov edi, dword [esp + 0x23]
dec ch
pop word [esp + 0xe]
push dword [esp + 4]
neg dx
jmp 0x714ecb
not bp
mov cl, ch
mov esi, 0x86eaeb88
btr bp, cx
jmp 0x714f5d
mov dl, 0x29
pop edx
mov dl, 0x88
clc
dec di
mov ebx, 0x68ee96f9
jmp 0x714ef6
push word [esp + 9]
mov si, 0xd783
push dword [esp + 0xd]
rdtsc
sub esp, 0x10
ror si, cl
jmp 0x714ee1
cld
sub ebp, esi
bts ebp, edi
xchg dword [esp + 8], eax
xchg dword [esp + 0x16], eax
mov ebx, dword [esp + 0xf]
jmp 0x714f70
add esp, 4
sub esp, 1
mov esi, ecx
sbb ebx, ebx
xchg word [esp + 0x1a], ax
bswap eax
jmp 0x714f43
mov al, 0x9f
sub esp, 0x1e
btc eax, ecx
cpuid
mov word [esp + 7], di
xchg word [esp + 0x17], bx
jmp 0x714fc6
mov esi, ecx
lea esp, [esp + 0x2f]
mov edi, dword [esp + 8]
add esp, 2
inc ecx
sub esp, 2
jmp 0x714fa3

Function at 0x715006
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, 0x5a1f0c92
lea ebp, [ebx - 0x5d]
sub esp, 0x11
jmp 0x715046
xchg word [esp + 0x1c], bp
mov ebx, 0x3bdaba70
rdtsc
lea esp, [esp + 0x19]
bswap ebp
cmp edx, 0xd8bda256
jmp 0x715030
Function at 0x715230
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.0071411c
mov dword [esp + 0x20], esp
mov dword [esp + 0x1c], ebp
pushal
pop word [esp + 9]
lea esp, [esp + 2]
mov dword [esp + 0x34], esi
call 0x715230
mov dl, 0x38
scasb al, byte es:[edi]
leave
cmp byte [edi - 0x6148fb6b], bh
push dword [esp + 2]
mov dword [esp + 0x20], ebx
call fcn.007151f9
jmp 0x715296
pop word [esp]
mov dword [esp], edx
lea esp, [esp]
lea esp, [esp + 2]
jmp 0x7151fe
mov dword [esp + 0x3c], edi
lea esp, [esp + 0x3c]
jmp 0x7152d0
push dword [esp]
push eax
mov word [esp + 5], bp
push word [esp + 4]
mov dword [esp + 8], eax
lea esp, [esp + 2]
jmp 0x715280
mov eax, dword [eax]
push ebx
pushal
jmp 0x7152b8
mov cx, di
mov dword [esp + 0x10], eax
pushal
lea esp, [esp + 0x20]
popal
jmp 0x7152de
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x7152ae
lea ebx, [ebx + 8]
mov eax, dword [ebx]
pop ebx
push eax
jmp 0x714117
Function at 0x403b54
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4f9008], 0x8088405
inc edx
mov dword [ebx + 0x4f9008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x425d08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x425d35
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x425d26
and ecx, 3
je 0x425d4d
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x425d3a
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x425d58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0x425d91
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0x425d79
pop esi
and esi, 3
je 0x425db6
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0x425d97
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x425dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x425dec
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0x425ddd
and ecx, 3
je 0x425e04
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0x425df1
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x425e0c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
shr ecx, 1
lea edi, [eax + ecx*8]
lea edx, [edx + ecx*8]
neg ecx
mov ebx, dword [edx + ecx*8]
mov eax, dword [edx + ecx*8 + 4]
xor dword [edi + ecx*8], ebx
xor dword [edi + ecx*8 + 4], eax
inc ecx
jne 0x425e18
pop edi
pop ebx
ret
Function at 0x426734
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
mov esi, eax
mov eax, esi
shr eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.0042638c
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x437c73
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
dec edi
test edi, edi
jl 0x4267e2
inc edi
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.004038a0
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.00425e0c
lea eax, [ebx + esi]
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, esi
call fcn.004038a0
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.00425e0c
lea eax, [ebx + esi]
mov ebx, eax
dec edi
jne 0x42678f
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
cmp esi, edi
jg 0x426830
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.004038a0
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.00425e0c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov ecx, esi
call fcn.004038a0
lea eax, [ebx + esi]
mov ebx, eax
sub edi, esi
test edi, edi
jle 0x42685a
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec edi
test edi, edi
jl 0x42685a
inc edi
xor eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov dl, byte [edx + eax]
xor byte [ebx + eax], dl
inc eax
dec edi
jne 0x42684a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x437c7a
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00426528
ret

Function at 0x43503c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov bl, dl
dec ebx
test ebx, ebx
jl 0x435090
inc ebx
xor edx, edx
mov ecx, edx
shl ecx, 2
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x4f9780]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x4f9b80]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x4f9f80]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x4fa380]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x43504b
pop edi
pop esi
pop ebx
ret
Function at 0x442b84
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
lea esi, [ebp - 0x110]
mov eax, ebx
xor edx, edx
div ecx
mov al, byte [edi + edx]
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 0x100
jne 0x442ba7
xor ebx, ebx
xor esi, esi
cmp dword [ebp - 0xc], 0
jle 0x442c2d
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jb 0x442c2d
inc eax
mov dword [ebp - 0x10], eax
xor edx, edx
inc ebx
and ebx, 0xff
xor eax, eax
mov al, byte [ebp + ebx - 0x110]
lea ecx, [eax + esi]
and ecx, 0xff
mov esi, ecx
mov cl, byte [ebp + esi - 0x110]
mov byte [ebp + ebx - 0x110], cl
mov byte [ebp + esi - 0x110], al
xor ecx, ecx
mov cl, byte [ebp + ebx - 0x110]
add eax, ecx
and eax, 0xff
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + edx]
xor cl, byte [ebp + eax - 0x110]
mov eax, dword [ebp - 8]
mov byte [eax + edx], cl
inc edx
dec dword [ebp - 0x10]
jne 0x442bd4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x442c38
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
xor ebx, ebx
lea esi, [ebp - 0x110]
mov eax, dword [ebp + 8]
cdq
push edx
push eax
mov eax, ebx
xor edx, edx
call fcn.0040639c
mov al, byte [edi + eax]
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 0x100
jne 0x442c58
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 0xc], 0
jle 0x442ce5
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jb 0x442ce5
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
inc ebx
and ebx, 0xff
xor eax, eax
mov al, byte [ebp + ebx - 0x110]
lea edx, [eax + edx]
and edx, 0xff
mov cl, byte [ebp + edx - 0x110]
mov byte [ebp + ebx - 0x110], cl
mov byte [ebp + edx - 0x110], al
xor ecx, ecx
mov cl, byte [ebp + ebx - 0x110]
add eax, ecx
and eax, 0xff
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + esi]
xor cl, byte [ebp + eax - 0x110]
mov eax, dword [ebp - 8]
mov byte [eax + esi], cl
inc esi
dec dword [ebp - 0x10]
jne 0x442c8e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x442cf0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov edi, ecx
mov ecx, edx
mov ebp, eax
test cl, cl
jbe 0x442d57
xor ebx, ebx
mov esi, esp
mov byte [edi + ebx], bl
xor eax, eax
mov al, cl
push eax
mov eax, ebx
pop edx
push ecx
mov ecx, edx
cdq
idiv ecx
pop ecx
mov al, byte [ebp + edx]
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 0x100
jne 0x442d08
xor eax, eax
xor ebx, ebx
mov esi, esp
mov dl, byte [edi + ebx]
xor ecx, ecx
mov cl, dl
add eax, ecx
xor ecx, ecx
mov cl, byte [esi]
add eax, ecx
and eax, 0xff
mov cl, byte [edi + eax]
mov byte [edi + ebx], cl
mov byte [edi + eax], dl
inc ebx
inc esi
cmp ebx, 0x100
jne 0x442d30
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4561dc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4561e2
ret

Function at 0x46077c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x471d2d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.0040576c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x471d44
call fcn.004053c8
mov eax, ebx
call fcn.00424620
mov edi, eax
dec edi
test edi, edi
jl 0x460834
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004245f4
mov edx, dword [0x485ec0]
call fcn.00404330
test al, al
je 0x460830
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.004245f4
lea edx, [ebp - 0x14]
call fcn.00494b88
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.0040576c
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040543c
inc esi
dec edi
jne 0x4607e2
mov al, byte [0x471d48]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x471d54
mov eax, dword [ebp - 0xc]
call fcn.0040f824
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00405144
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00494b88
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x471d44
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00494b88
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x471d44
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x471d44
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x471d60
call fcn.0040b384
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471d34
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004050d0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004050d0
lea eax, [ebp - 0x14]
call fcn.004050ac
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004050d0
ret