joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4209fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x453b11
call fcn.004534f4
sub esp, 0x258
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], bl
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.0040cac9
mov ecx, dword [ebp - 0x38]
cmp ecx, 0x10
jb 0x420a74
inc ecx
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x4c]
mov eax, edx
cmp ecx, 0x1000
jb 0x420a6b
add ecx, 0x23
mov dword [ebp - 0x28], ecx
mov edx, dword [edx - 4]
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420b8b
push ecx
push edx
call fcn.0044488d
pop ecx
pop ecx
mov byte [ebp - 0x4c], bl
mov dword [ebp - 0x34], 0x200
movaps xmm0, xmmword [0x4085d0]
movups xmmword [ebp - 0x5e], xmm0
mov word [ebp - 0x4e], 0x47
mov edx, ebx
mov dword [ebp - 0x2c], edx
cmp edx, 0x10
jae 0x420ab7
movsx ecx, byte [ebp - 0x5e]
and ecx, 0x8000000f
jns 0x420aaa
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x5d]
sub al, cl
mov byte [ebp + edx - 0x5d], al
inc edx
jmp 0x420a91
mov byte [ebp - 0x4d], bl
lea esi, [ebp - 0x5d]
mov al, 0x6d
mov dword [ebp - 0x22], 0x83714e6d
mov dword [ebp - 0x1e], 0x40767d6e
mov dword [ebp - 0x1a], 0x79713b3f
mov word [ebp - 0x16], 0x79
mov edx, ebx
mov dword [ebp - 0x30], edx
cmp edx, 0xc
jae 0x420b07
movsx ecx, al
and ecx, 0x8000000f
jns 0x420af4
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x21]
sub al, cl
mov byte [ebp + edx - 0x21], al
inc edx
mov dword [ebp - 0x30], edx
mov al, byte [ebp - 0x22]
jmp 0x420adf
mov byte [ebp - 0x15], bl
mov edx, esi
lea ecx, [ebp - 0x21]
call fcn.0040c457
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 0x10
jb 0x420b1f
mov ecx, dword [ecx]
lea edx, [ebp - 0x34]
push edx
lea edx, [ebp - 0x264]
push edx
push ebx
push ebx
push ecx
push dword [ebp + 8]
call eax
test eax, eax
jne 0x420b58
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040bc98
push eax
mov ecx, dword [ebp + 0x10]
call fcn.0040cac9
lea ecx, [ebp - 0x4c]
call fcn.0040bc59
jmp 0x420b7a
push dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
call fcn.0040caa4
jmp 0x420b7a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
call fcn.00448974
int3
Function at 0x422c3d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x453b89
call fcn.004534f4
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
wait
movaps xmm0, xmmword [0x407370]
movups xmmword [ebp - 0x70], xmm0
mov edx, ebx
mov dword [ebp - 0x1c], edx
cmp edx, 0xe
jae 0x422c89
movsx ecx, byte [ebp - 0x70]
and ecx, 0x8000000f
jns 0x422c7c
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x6f]
sub al, cl
mov byte [ebp + edx - 0x6f], al
inc edx
jmp 0x422c63
mov byte [ebp - 0x61], bl
lea esi, [ebp - 0x6f]
mov al, 0x29
mov dword [ebp - 0x48], 0x7b6e5429
mov dword [ebp - 0x44], 0x3c756e77
mov dword [ebp - 0x40], 0x756d373b
mov word [ebp - 0x3c], 0x75
mov edx, ebx
mov dword [ebp - 0x20], edx
cmp edx, 0xc
jae 0x422cd9
movsx ecx, al
and ecx, 0x8000000f
jns 0x422cc6
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x47]
sub al, cl
mov byte [ebp + edx - 0x47], al
inc edx
mov dword [ebp - 0x20], edx
mov al, byte [ebp - 0x48]
jmp 0x422cb1
mov byte [ebp - 0x3b], bl
mov edx, esi
lea ecx, [ebp - 0x47]
call fcn.0040c457
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x50]
push ecx
call eax
test eax, eax
je 0x422de9
mov dword [ebp - 0x24], 0x5c4
mov ecx, dword [ebp - 0x24]
xor ecx, 0x5e4
mov eax, dword [ebp - 0x4c]
shl eax, cl
or eax, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x2c], 0xe8
mov dword [ebp - 0x28], 0x67f
mov ecx, dword [ebp - 0x28]
xor ecx, 0x65f
mov edx, dword [ebp - 0x54]
shl edx, cl
or edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x2c]
xor ecx, 0xc8
mov eax, dword [ebp - 0x5c]
shl eax, cl
or eax, dword [ebp - 0x60]
add eax, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
mov ecx, 0x332
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
xor eax, ecx
cmp dword [ebp - 0x14], ebx
jb 0x422d9a
mov esi, dword [ebp - 0x18]
ja 0x422d6d
cmp esi, eax
jbe 0x422d9a
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
call fcn.004535e0
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x30], xmm0
mov edx, dword [ebp - 0x14]
mov ecx, esi
call fcn.004535e0
cvtsd2ss xmm0, xmm0
movss xmm2, dword [ebp - 0x30]
divss xmm2, xmm0
jmp 0x422d9d
xorps xmm2, xmm2
mov dword [ebp - 0x34], 0x3f9
mov eax, dword [ebp - 0x34]
xor eax, 0x39d
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x407990]
cvtpd2ps xmm0, xmm0
movss xmm1, dword [0x407028]
subss xmm1, xmm2
mulss xmm0, xmm1
call fcn.00453590
mov edx, eax
mov ecx, dword [ebp + 8]
call fcn.0041828f
mov eax, dword [ebp + 8]
wait
jmp 0x422e4a
mov al, 0x4e
mov dword [ebp - 0x14], 0x3f3b4e
mov edx, ebx
mov dword [ebp - 0x38], edx
cmp edx, 2
jae 0x422e1f
movsx ecx, al
and ecx, 0x8000000f
jns 0x422e0c
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x13]
sub al, cl
mov byte [ebp + edx - 0x13], al
inc edx
mov dword [ebp - 0x38], edx
mov al, byte [ebp - 0x14]
jmp 0x422df7
mov byte [ebp - 0x11], bl
lea eax, [ebp - 0x13]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040bc98
jmp 0x422de3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4255c3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x453bf5
call fcn.004534f4
sub esp, 0x9c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x54]
call fcn.0040cd59
push 0xffffffffffffffff
push ecx
push dword [ebp + 0x10]
lea ecx, [ebp - 0x54]
call fcn.0043da80
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x54]
call fcn.0040c0be
push eax
lea ecx, [ebp - 0x54]
call fcn.0040cac9
lea ecx, [ebp - 0x3c]
call fcn.0040bc59
mov al, 0x3a
mov dword [ebp - 0x30], 0x7d39463a
mov dword [ebp - 0x2c], 0x737e7e6f
mov dword [ebp - 0x28], 0x487178
mov edx, ebx
mov dword [ebp - 0x58], edx
cmp edx, 0xa
jae 0x425659
movsx ecx, al
and ecx, 0x8000000f
jns 0x425646
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x2f]
sub al, cl
mov byte [ebp + edx - 0x2f], al
inc edx
mov dword [ebp - 0x58], edx
mov al, byte [ebp - 0x30]
jmp 0x425631
mov byte [ebp - 0x25], bl
push ecx
lea eax, [ebp - 0x2f]
push eax
lea ecx, [ebp - 0x54]
call fcn.0040ca79
push eax
push ebx
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x54]
call fcn.0040c0be
push eax
lea ecx, [ebp - 0x54]
call fcn.0040cac9
lea ecx, [ebp - 0x90]
call fcn.0040bc59
mov dl, 0xe
mov dword [ebp - 0x19], 0x6f78320e
mov dword [ebp - 0x15], 0x306b7b62
mov byte [ebp - 0x11], bl
mov ecx, ebx
mov dword [ebp - 0x5c], ecx
cmp ecx, 7
jae 0x4256be
mov al, byte [ebp + ecx - 0x18]
xor al, dl
mov byte [ebp + ecx - 0x18], al
inc ecx
mov dword [ebp - 0x5c], ecx
mov dl, byte [ebp - 0x19]
jmp 0x4256a6
mov byte [ebp - 0x11], bl
push 0xffffffffffffffff
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x54]
call fcn.0040ca79
push eax
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x54]
call fcn.0040c0be
push eax
lea ecx, [ebp - 0x54]
call fcn.0040cac9
lea ecx, [ebp - 0x78]
call fcn.0040bc59
push 0xffffffffffffffff
push 7
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x54]
call fcn.0040c0be
push eax
lea ecx, [ebp - 0x54]
call fcn.0040cac9
lea ecx, [ebp - 0x78]
call fcn.0040bc59
mov dl, 0x5a
mov dword [ebp - 0x23], 0x2c75665a
mov dword [ebp - 0x1f], 0x3f2f363b
mov word [ebp - 0x1b], 0x64
mov ecx, ebx
mov dword [ebp - 0x60], ecx
cmp ecx, 8
jae 0x425742
mov al, byte [ebp + ecx - 0x22]
xor al, dl
mov byte [ebp + ecx - 0x22], al
inc ecx
mov dword [ebp - 0x60], ecx
mov dl, byte [ebp - 0x23]
jmp 0x42572a
mov byte [ebp - 0x1a], bl
push ecx
lea eax, [ebp - 0x22]
push eax
lea ecx, [ebp - 0x54]
call fcn.0040ca79
push eax
push ebx
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x54]
call fcn.0040c0be
push eax
lea ecx, [ebp - 0x54]
call fcn.0040cac9
lea ecx, [ebp - 0xa8]
call fcn.0040bc59
mov esi, dword [ebp + 8]
mov dword [esi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea eax, [ebp - 0x54]
push eax
mov ecx, esi
call fcn.0040bd60
lea ecx, [ebp - 0x54]
call fcn.0040bc59
mov eax, esi
jmp 0x4257b3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x425f7c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x453c55
call fcn.004534f4
sub esp, 0x410
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, edi
mov dword [ebp - 0x14], eax
cmp eax, 0x100
jge 0x425fb3
mov dword [ebp + eax*4 - 0x41c], eax
inc eax
jmp 0x425f9f
mov ebx, edi
mov dword [ebp - 0x14], ebx
cmp ebx, 0x100
jge 0x426018
mov ecx, 0x45b628
cmp dword [0x45b63c], 0x10
cmovae ecx, dword [0x45b628]
mov esi, dword [ebp + ebx*4 - 0x41c]
mov eax, ebx
xor edx, edx
div dword [0x45b638]
movsx ecx, byte [edx + ecx]
add ecx, esi
add ecx, dword [ebp - 0x18]
and ecx, 0x800000ff
jns 0x425ffd
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + ecx*4 - 0x41c]
mov dword [ebp + ebx*4 - 0x41c], eax
mov dword [ebp + ecx*4 - 0x41c], esi
inc ebx
jmp 0x425fb5
mov esi, edi
mov dword [ebp - 0x14], esi
mov edx, edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
cmp edx, dword [ebx + 0x10]
jae 0x4260b3
inc esi
and esi, 0x800000ff
jns 0x42603f
dec esi
or esi, 0xffffff00
inc esi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp + esi*4 - 0x41c]
add edi, ecx
and edi, 0x800000ff
jns 0x42605b
dec edi
or edi, 0xffffff00
inc edi
mov eax, dword [ebp + edi*4 - 0x41c]
mov dword [ebp + esi*4 - 0x41c], eax
mov dword [ebp + edi*4 - 0x41c], ecx
mov eax, dword [ebp + esi*4 - 0x41c]
add eax, ecx
and eax, 0x800000ff
jns 0x426087
dec eax
or eax, 0xffffff00
inc eax
mov eax, dword [ebp + eax*4 - 0x41c]
mov dword [ebp + 8], eax
mov ecx, ebx
cmp dword [ebx + 0x14], 0x10
jb 0x42609b
mov ecx, dword [ebx]
mov al, byte [ecx + edx]
xor byte [ebp + 8], al
mov eax, dword [ebp + 8]
mov byte [ecx + edx], al
inc edx
jmp 0x426022
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x430edc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x453d99
call fcn.004534f4
sub esp, 0x8c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
and dword [ebp - 4], 0
mov dl, 0x1d
mov word [ebp - 0x2d], 0x411d
mov byte [ebp - 0x2b], 0x72
push 0x6e
pop ebx
mov byte [ebp - 0x2a], bl
mov dword [ebp - 0x29], 0x72413c68
mov byte [ebp - 0x25], bl
mov dword [ebp - 0x24], 0x79333c68
mov word [ebp - 0x20], 0x7f
xor ecx, ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0xd
jae 0x430f3e
mov al, byte [ebp + ecx - 0x2c]
xor al, dl
mov byte [ebp + ecx - 0x2c], al
inc ecx
mov dword [ebp - 0x34], ecx
mov dl, byte [ebp - 0x2d]
jmp 0x430f26
mov byte [ebp - 0x1f], 0
lea edi, [ebp - 0x2c]
mov byte [ebp - 0x1e], bl
mov dword [ebp - 0x1d], 0x6f717d7a
mov dword [ebp - 0x19], 0x7e7e6f7a
mov dword [ebp - 0x15], 0x6f826f72
mov byte [ebp - 0x11], 0
xor edx, edx
mov dword [ebp - 0x38], edx
cmp edx, 0xc
jae 0x430f8e
movsx ecx, bl
and ecx, 0x8000000f
jns 0x430f7b
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x1d]
sub al, cl
mov byte [ebp + edx - 0x1d], al
inc edx
mov dword [ebp - 0x38], edx
mov bl, byte [ebp - 0x1e]
jmp 0x430f66
xor ebx, ebx
mov byte [ebp - 0x11], bl
lea eax, [ebp - 0x1d]
push eax
call fcn.004494dd
pop ecx
push eax
lea ecx, [ebp - 0x80]
call fcn.0040bc98
push edi
mov edx, eax
lea ecx, [ebp - 0x68]
call fcn.00417bac
lea ecx, [ebp - 0x80]
call fcn.0040bc59
lea eax, [ebp - 0x68]
push eax
call fcn.0041c1db
test al, al
je 0x43103a
push dword [ebp + 8]
lea ecx, [esi + 0x3b0]
call fcn.004439d9
movaps xmm0, xmmword [0x407de0]
movups xmmword [ebp - 0x4d], xmm0
mov byte [ebp - 0x3d], bl
mov edx, ebx
mov dword [ebp - 0x3c], edx
cmp edx, 0xf
jae 0x43100a
movsx ecx, byte [ebp - 0x4d]
and ecx, 0x8000000f
jns 0x430ffd
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x4c]
sub al, cl
mov byte [ebp + edx - 0x4c], al
inc edx
jmp 0x430fe4
mov byte [ebp - 0x3d], bl
lea eax, [ebp - 0x4c]
push eax
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x98]
call fcn.00417b5f
push eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [esi + 0x3b0]
call fcn.00443981
lea ecx, [ebp - 0x98]
call fcn.0040bc59
lea ecx, [ebp - 0x68]
call fcn.0040bc59
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x43b50f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x453e11
call fcn.004534f4
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ebx, 0x45b628
and dword [ebp - 4], 0
lea edi, [esi + 0x1e4]
push edi
call fcn.0041c1db
test al, al
je 0x43b545
push edi
mov ecx, esi
call fcn.0041eb24
movaps xmm0, xmmword [0x407af0]
movups xmmword [ebp - 0x3b], xmm0
mov dword [ebp - 0x2b], 0x73787e64
mov word [ebp - 0x27], 0x4b
xor edx, edx
mov ecx, edx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x14
jae 0x43b577
mov al, byte [ebp + ecx - 0x3a]
xor al, byte [ebp - 0x3b]
mov byte [ebp + ecx - 0x3a], al
inc ecx
jmp 0x43b561
mov byte [ebp - 0x26], dl
lea esi, [ebp - 0x3a]
mov al, 0x23
mov dword [ebp - 0x25], 0x716c5a23
mov dword [ebp - 0x21], 0x7768716c
mov dword [ebp - 0x1d], 0x6f6f6731
mov byte [ebp - 0x19], dl
mov dword [ebp - 0x18], edx
cmp edx, 0xb
jae 0x43b5c2
movsx ecx, al
and ecx, 0x8000000f
jns 0x43b5af
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x24]
sub al, cl
mov byte [ebp + edx - 0x24], al
inc edx
mov dword [ebp - 0x18], edx
mov al, byte [ebp - 0x25]
jmp 0x43b59a
mov byte [ebp - 0x19], 0
mov edx, esi
lea ecx, [ebp - 0x24]
call fcn.0040c457
cmp dword [0x45b63c], 0x10
cmovae ebx, dword [0x45b628]
push ebx
call eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x43e197
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movaps xmm0, xmmword [0x407350]
push ebx
xor ebx, ebx
push esi
movups xmmword [ebp - 0x2c], xmm0
mov ecx, ebx
movsx eax, byte [ebp - 0x2c]
and eax, 0x8000000f
jns 0x43e1be
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0xe
jb 0x43e1ae
mov byte [ebp - 0x1d], bl
mov al, 0x7a
mov dword [ebp - 0xe], 0x7c6f557a
mov ecx, ebx
mov dword [ebp - 0xa], 0x3d766f78
mov dword [ebp - 6], 0x766e383c
mov word [ebp - 2], 0x76
movsx eax, al
and eax, 0x8000000f
jns 0x43e1f9
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0xd], al
inc ecx
cmp ecx, 0xc
jae 0x43e208
mov al, byte [ebp - 0xe]
jmp 0x43e1ea
lea edx, [ebp - 0x2b]
mov byte [ebp - 1], bl
lea ecx, [ebp - 0xd]
call fcn.0040c457
movaps xmm0, xmmword [0x407fc0]
mov esi, eax
movups xmmword [ebp - 0x3f], xmm0
mov word [ebp - 0x2f], 0x7b7b
mov ecx, ebx
mov byte [ebp - 0x2d], bl
movsx eax, byte [ebp - 0x3f]
and eax, 0x8000000f
jns 0x43e23e
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x3e], al
inc ecx
cmp ecx, 0x11
jb 0x43e22e
mov byte [ebp - 0x2d], bl
mov al, 0x63
mov dword [ebp - 0x1c], 0x75684e63
mov ecx, ebx
mov dword [ebp - 0x18], 0x366f6871
mov dword [ebp - 0x14], 0x6f673135
mov word [ebp - 0x10], 0x6f
movsx eax, al
and eax, 0x8000000f
jns 0x43e279
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0xc
jae 0x43e288
mov al, byte [ebp - 0x1c]
jmp 0x43e26a
lea edx, [ebp - 0x3e]
mov byte [ebp - 0xf], bl
lea ecx, [ebp - 0x1b]
call fcn.0040c457
call eax
push 0x45b618
push eax
call esi
movaps xmm0, xmmword [0x407310]
mov ecx, ebx
movups xmmword [ebp - 0x2c], xmm0
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0xe
jb 0x43e2ad
mov byte [ebp - 0x1d], bl
mov cl, 0x5f
mov dword [ebp - 0x1c], 0x2d3a145f
mov eax, ebx
mov dword [ebp - 0x18], 0x6c333a31
mov dword [ebp - 0x14], 0x333b716d
mov word [ebp - 0x10], 0x33
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xc
jae 0x43e2eb
mov cl, byte [ebp - 0x1c]
jmp 0x43e2dc
lea edx, [ebp - 0x2b]
mov byte [ebp - 0xf], bl
lea ecx, [ebp - 0x1b]
call fcn.0040c457
call eax
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x43e302
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
cmp dword [0x45b618], 0
push ebx
push esi
push edi
jne 0x43e31d
xor eax, eax
xor edx, edx
jmp 0x43e461
mov esi, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
test esi, esi
jle 0x43e33c
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
dec esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
jmp 0x43e344
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
test esi, esi
jle 0x43e35d
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [edx - 8]
mov ecx, dword [edx - 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x43e365
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
test esi, esi
jle 0x43e37e
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [edx - 8]
mov ecx, dword [edx - 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x43e386
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
test esi, esi
jle 0x43e39f
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [edx - 8]
mov ecx, dword [edx - 4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
jmp 0x43e3a7
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
and dword [ebp - 8], 0
mov eax, edx
and dword [ebp - 0xc], 0
xorps xmm0, xmm0
cdq
mov dword [ebp - 0x44], eax
mov eax, esi
mov dword [ebp - 0x40], edx
cdq
movlpd qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov word [ebp - 0xc], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 8], esp
and esp, 0xfffffff0
push 0x33
call 0x43e3e2
add dword [esp], 5
retf
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43e466
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5dc
cmp dword [0x45b618], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x43e77e
push edi
call fcn.004496c0
xor ecx, ecx
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004448c3
mov esi, eax
push edi
mov dword [ebp - 0x24], esi
call fcn.004496c0
inc eax
push eax
push edi
push esi
call fcn.0044968b
xorps xmm0, xmm0
add esp, 0x18
movlpd qword [ebp - 0x18], xmm0
push 0x33
call 0x43e4c2
add dword [esp], 5
retf
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43e7a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x45b978]
sub esp, 0x10
mov edx, dword [0x45b97c]
test eax, eax
jne 0x43e811
test edx, edx
jne 0x43e811
mov al, 0x51
mov dword [ebp - 0xb], 0x65756f51
mov dword [ebp - 7], 0x652f6d6d
xor ecx, ecx
mov word [ebp - 3], 0x6d6d
mov byte [ebp - 1], dl
movsx eax, al
and eax, 0x8000000f
jns 0x43e7eb
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0xa], al
inc ecx
cmp ecx, 9
jae 0x43e7fa
mov al, byte [ebp - 0xb]
jmp 0x43e7dc
lea ecx, [ebp - 0xa]
mov byte [ebp - 1], 0
call fcn.0043e466
mov dword [0x45b978], eax
mov dword [0x45b97c], edx
leave
ret
Function at 0x43e813
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d4
push ebx
push esi
push edi
call fcn.0043e7a8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
test eax, eax
jne 0x43e836
test edx, edx
je 0x43ec62
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
push 0x33
call fcn.0043e84c
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43ffa2
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
xor edi, edi
inc ebp
mov ebx, edx
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x43ffcd
mov dword [esi + 0x6af78], ebp
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
mov dword [esi + 0x6af6c], edi
push edi
push eax
call fcn.00445a50
movzx eax, word [ebx*8 + 0x406e6a]
add esp, 0xc
mov dword [esi + 0x6af98], eax
movzx eax, word [ebx*8 + 0x406e68]
mov dword [esi + 0x6af9c], eax
movzx eax, word [ebx*8 + 0x406e6c]
push 2
mov dword [esi + 0x6afa0], eax
movzx eax, word [ebx*8 + 0x406e6e]
pop ecx
mov dword [esi + 0x6af94], eax
cmp ebx, ecx
jg 0x440031
mov eax, dword [esp + 0x14]
or word [eax], 4
jmp 0x44003d
cmp ebx, 8
jl 0x44003d
mov eax, dword [esp + 0x14]
or word [eax], cx
mov eax, dword [esi + 0xc]
lea ebx, [esi + 0x1af70]
push 0x10000
mov edx, ebx
mov dword [esi + 0x6af84], edi
mov ecx, esi
mov dword [esi + 0x6af74], edi
call eax
mov dword [esi + 0x6af90], eax
test eax, eax
je 0x4400a5
cmp eax, 0xffffffff
je 0x4400a5
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x440080
mov ecx, esi
call fcn.00440226
mov dword [esi + 0x6af7c], edi
mov ecx, edi
movzx eax, byte [ebx + edi]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc edi
mov dword [esi + 0x6af7c], ecx
cmp edi, 2
jb 0x440088
jmp 0x4400b1
mov dword [esi + 0x6af8c], ebp
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebp
pop ebx
ret 4