joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461298
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x415664]
call fcn.004051cc
xor eax, eax
push ebp
push 0x4613dc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46cf10], 0
jne 0x4612eb
mov ecx, dword [0x46cfc0]
mov dl, 1
mov eax, dword [0x407b50]
call fcn.0040c64c
call fcn.004041dc
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403320
mov eax, ebx
call fcn.00405030
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4613ec
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406214
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405040
test eax, eax
jle 0x461383
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46137c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404a50
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404a38
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004089c8
test eax, eax
jne 0x46137c
mov ebx, 0x15
jmp 0x461388
mov ebx, 0x10
jmp 0x461388
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x46cf10]
call fcn.004610b4
mov eax, dword [ebp - 8]
call fcn.004610b4
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.0040622c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4613e3
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004047ec
lea eax, [ebp - 0x10]
mov edx, dword [0x415664]
call fcn.0040529c
ret
Function at 0x46a2f4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46a4d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00409238
test al, al
je 0x46a45f
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, dword [0x46ecac]
mov eax, dword [ebp - 4]
call fcn.00467ec8
cmp al, 1
jne 0x46a37c
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, dword [0x46ecac]
mov eax, dword [ebp - 4]
call fcn.00467fe0
cmp al, 1
jne 0x46a37c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
mov eax, dword [eax + 0x220]
mov edx, 0x46a4ec
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x46a4b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
mov eax, dword [eax + 0x220]
mov edx, 0x46a52c
mov ecx, dword [eax]
call dword [ecx + 0x38]
add dword [ebp - 0xc], 1
jno 0x46a3a0
call fcn.00403978
push dword [0x46ec9c]
push dword [0x46eca4]
push 0x46a548
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00408d30
push dword [ebp - 0x14]
push dword [0x46eca0]
mov eax, 0x46eca8
mov edx, 5
call fcn.00404b48
push 0x46a554
push dword [0x46eca8]
push 0x46a570
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404b48
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x46eca8]
call fcn.00404a88
cmp eax, 0x102
jle 0x46a44d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
mov eax, dword [eax + 0x220]
mov edx, 0x46a57c
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
mov eax, dword [eax + 0x220]
mov edx, 0x46a5c8
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x46a4b8
mov edx, 0x46eca8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0046a2f4
jmp 0x46a4b8
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404c88
push eax
mov eax, dword [0x46ecac]
call fcn.00404c88
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x46a49b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
mov eax, dword [eax + 0x220]
mov edx, 0x46a5f0
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x46a4b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
mov eax, dword [eax + 0x220]
mov edx, 0x46a614
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a4da
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004047ec
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x499f20
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b6b1c]
jne 0x499f2a
repz ret
jmp fcn.0049f645

Function at 0x49cd70
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b6b1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00497482
and dword [ebp - 0x14], 0
cmp dword [0x4b9ccc], 0
mov dword [ebp - 0x18], eax
jne 0x49ce23
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x49cecb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x49cecb
mov esi, dword [fcn.00492f00]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4b9ccc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4b9cd0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4b9cd4], eax
call edi
push eax
call esi
mov dword [0x4b9cdc], eax
test eax, eax
je 0x49ce23
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4b9cd8], eax
mov eax, dword [0x4b9cd8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00492f04]
cmp eax, ecx
je 0x49ce7c
cmp dword [0x4b9cdc], ecx
je 0x49ce7c
push eax
call esi
push dword [0x4b9cdc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x49ce7c
test ebx, ebx
je 0x49ce7c
call edi
test eax, eax
je 0x49ce73
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x49ce73
test byte [ebp - 8], 1
jne 0x49ce7c
or dword [ebp + 0x10], 0x200000
jmp 0x49ceaf
mov eax, dword [0x4b9cd0]
cmp eax, dword [ebp - 0x18]
je 0x49ceaf
push eax
call esi
test eax, eax
je 0x49ceaf
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x49ceaf
mov eax, dword [0x4b9cd4]
cmp eax, dword [ebp - 0x18]
je 0x49ceaf
push eax
call esi
test eax, eax
je 0x49ceaf
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4b9ccc]
call esi
test eax, eax
je 0x49cecb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x49cecd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00499f20
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x408a5c
Capabilities:
Get file system object information
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
mov dword [ebp - 0x114], eax
mov eax, 0x4089e4
call fcn.00403da8
xor eax, eax
push ebp
push 0x408bb4
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x110]
call fcn.00403a24
lea edx, [ebp - 0x110]
mov eax, 0x40aee0
call fcn.00403538
mov eax, dword [0x40aee0]
call fcn.004036d0
push eax
push 0x408bc0
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.comctl32.dll_InitCommonControls
push 0x105
push 0x40add8
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, 0x40add8
mov eax, dword [0x4092ec]
call fcn.004034c8
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [0x4092ec]
mov eax, dword [eax]
call fcn.004036d0
push eax
call sub.kernel32.dll_CreateFileA
mov edx, dword [0x4092d0]
mov dword [edx], eax
mov eax, dword [0x4092d0]
cmp dword [eax], 0xffffffff
jne 0x408b3f
lea eax, [ebp - 0x114]
push eax
mov edx, dword [0x4092ec]
xor ecx, ecx
mov eax, 0x408bd0
call fcn.00406660
mov eax, dword [ebp - 0x114]
call fcn.004078cc
call fcn.00406ad4
call fcn.004060bc
mov eax, 0x40ac78
xor ecx, ecx
mov edx, 0x160
call fcn.004029bc
push 0x4001
push 0x160
push 0x40ac78
push 0
mov eax, dword [0x4092ec]
mov eax, dword [eax]
call fcn.004036d0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [0x4092e4]
mov dword [edx], eax
push 0x407f28
mov edx, 0x408bec
xor ecx, ecx
mov eax, dword [0x40a650]
call fcn.00404028
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408bbb
lea eax, [ebp - 0x114]
call fcn.004033d8
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x657c40ed
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x63963ed9
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x14459a4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 1
sete al
movzx eax, al
ret

Function at 0x1445a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ecx, 4
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x28]
mov esi, 0x414030
push ebx
xor ebx, ebx
sub esp, 0x4c
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov eax, dword [0x428028]
lea edx, [eax - 0x1f6890c9]
sub eax, 0x1dc4bfee
mov dword [0x428028], edx
mov dword [0x428148], eax
mov dword [esp + 4], eax
mov dword [esp], 0x42d3c0
call fcn.01451630
sub ebx, dword [ebp + esi*4 - 0x28]
inc esi
cmp esi, 4
jne 0x1445a7c
mov eax, dword [0x428148]
xor edx, edx
mov dword [ebp - 0x38], ebx
add eax, 0x61004cd3
mov dword [0x428028], eax
xor eax, 0x6dad681f
mov dword [0x428208], eax
or eax, 0xb7ab2082
mov dword [0x428148], eax
lea eax, [ebp - 0x38]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], eax
mov dword [esp + 4], 7
mov dword [esp], 0xffffffff
call fcn.01441083
mov ebx, eax
test eax, eax
jne 0x1445bd3
imul edx, dword [0x428148], 0xe6bc6d32
mov eax, dword [0x428028]
sub eax, 0x3db8604f
mov dword [0x428028], eax
mov dword [0x428208], edx
mov dword [esp + 4], eax
mov dword [esp], 0x42d760
call fcn.01451630
call fcn.0144faa4
mov eax, dword [0x428148]
sub eax, 0x1df114a2
mov edx, eax
or edx, 0xa22e7637
mov dword [0x428028], edx
imul edx, eax, 0x274cf141
imul eax, eax, 0xfad44879
mov dword [0x428148], edx
mov dword [0x428208], eax
call fcn.0144fec8
imul eax, dword [0x428028], 0x159e7f1e
and eax, 0x5fcdf507
lea edx, [eax + 0x70ade58c]
mov dword [0x428148], eax
mov dword [0x428028], edx
mov dword [esp + 8], 0x42c100
mov dword [esp + 4], 0x42c100
mov dword [esp], eax
call fcn.014513d8
mov eax, dword [0x428028]
mov edx, eax
mov ecx, eax
xor edx, 0xfc31f949
and ecx, 0x4987cf6b
mov dword [0x428208], edx
xor edx, edx
cmp dword [ebp - 0x38], 0
mov dword [0x428148], ecx
jne 0x1445bda
xor esi, esi
jmp 0x1445c93
cmp byte [edx + 0x42d860], 0
je 0x1445bf6
inc edx
cmp edx, 0x19ab
jne 0x1445bda
mov dword [esp], ecx
call fcn.0144d6c4
jmp 0x1445c08
cmp edx, 0x1984
jg 0x1445c08
xor eax, 0x8917aa60
mov dword [0x428028], eax
mov eax, dword [0x428148]
mov esi, 7
xor eax, 0xbe2ff203
mov dword [0x428208], eax
call fcn.01453038
mov dword [ebp - 0x34], 0x2d
mov dword [ebp - 0x30], 0x53
mov dword [ebp - 0x2c], 0xffffff7a
mov dword [esp + 8], 0x42d760
mov dword [esp + 4], 0x42d860
mov eax, dword [0x428208]
mov dword [esp], eax
call fcn.014507cc
mov eax, dword [0x428208]
xor eax, 0xe9879bb6
mov edx, eax
mov dword [0x428148], eax
or edx, 0x27d2420a
mov dword [0x428208], edx
mov dword [esp], eax
call dword [0x42e0d4]
push eax
mov eax, dword [0x428148]
add esi, dword [ebp + ebx*4 - 0x34]
inc ebx
add eax, 0x6e8cd044
mov dword [0x428028], eax
cmp ebx, 3
jne 0x1445c36
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x14464b0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0x12
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x15c]
mov esi, 0x42a9cb
push ebx
sub esp, 0x17c
mov eax, dword [0x427fc8]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x138]
mov esi, 0x42a9dd
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
sub eax, 0x77e46688
mov ecx, 0x4284e0
and eax, 0xa13af718
imul eax, eax, 0xb1fa2203
mov dword [0x427fc8], eax
mov dl, byte [ecx]
test dl, dl
je 0x144651c
sub edx, 0x30
cmp dl, 9
jbe 0x1446519
xor eax, 0x22c84088
mov dword [0x427fc8], eax
jmp 0x144651c
inc ecx
jmp 0x14464ff
and dword [0x427fc8], 0x956919b1
call dword [0x42e0c8]
mov eax, dword [0x427fc8]
or eax, 0x4b5e3cd3
imul eax, eax, 0x1b862fd5
mov dword [ebp - 0x16c], eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x1446544
xor esi, esi
xor ecx, ecx
mov edi, 0x1f
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x138]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x144655c
xor esi, esi
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x118]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x118]
mov byte [ebp + edx - 0x118], bl
lea ebx, [ebp - 0x14a]
mov byte [ebp + ecx - 0x118], al
add al, byte [ebp + edx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [esi + ebp - 0x15c]
mov byte [ebp + esi - 0x14a], al
inc esi
cmp esi, 0x12
jne 0x144659f
mov eax, dword [ebp - 0x16c]
mov byte [ebp - 0x138], 0
sub eax, 0x5c1f04d6
mov dword [0x427fc8], eax
call dword [0x42e09c]
add eax, 0x29f70cd2
and eax, 0xd55ee466
sub eax, 0x21043a01
or eax, 0x3973b3f3
xor eax, 0x8c198077
mov dword [0x427fc8], eax
call dword [0x42e090]
mov eax, dword [0x427fc8]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0x12
mov dword [esp + 4], 0x1be4
or eax, 0x30658a70
mov dword [esp], 0x414220
add eax, 0x4d7eda6b
mov dword [0x427fc8], eax
call fcn.0144a580
add esp, 0x17c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1446670
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0xa
xor eax, eax
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x178]
mov esi, 0x42acbe
push ebx
sub esp, 0x18c
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x151]
mov esi, 0x42acc8
mov ecx, 0x39
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x14466a2
mov eax, dword [0x428158]
xor edi, edi
xor ecx, ecx
mov esi, 0x38
sub eax, 0x28586652
mov dword [0x428374], eax
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div esi
movzx eax, byte [ebp + edx - 0x151]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + edi - 0x118], bl
cmp ecx, 0x100
jne 0x14466c9
xor esi, esi
xor edx, edx
xor edi, edi
imul eax, dword [0x4281dc], 0x43215b3d
mov ebx, 0x4288c0
mov ecx, 0x1f97
mov dword [0x428158], eax
lea eax, [edi + 1]
movzx edi, al
mov al, byte [ebp + edi - 0x118]
add edx, eax
mov byte [ebp - 0x179], al
movzx edx, dl
mov al, byte [ebp + edx - 0x118]
mov byte [ebp + edi - 0x118], al
movzx eax, byte [ebx]
inc ebx
test al, al
je 0x1446785
add ecx, eax
cmp ecx, 0x1575
jbe 0x144674b
mov dword [esp + 8], 0x4284a0
mov dword [esp + 4], 0x42ac1e
mov dword [esp], 0x42ac82
mov dword [ebp - 0x180], edx
call fcn.01450390
mov edx, dword [ebp - 0x180]
mov eax, dword [0x4281dc]
mov dword [ebp - 0x180], edx
lea ebx, [eax + 0x2e071c0b]
xor eax, 0x32a176b2
mov dword [0x428158], ebx
lea ebx, [ebp - 0x16e]
mov dword [0x4281dc], eax
call fcn.01452680
mov eax, dword [0x4281dc]
mov edx, dword [ebp - 0x180]
and eax, 0xe5a2c240
mov dword [0x428374], eax
mov al, byte [ebp - 0x179]
mov byte [ebp + edx - 0x118], al
add al, byte [ebp + edi - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebp + esi - 0x178]
mov byte [ebp + esi - 0x16e], al
inc esi
cmp esi, 0xa
jne 0x144670c
mov edx, 0x4284a0
mov ecx, 0x342
movzx eax, byte [edx]
inc edx
test al, al
je 0x1446827
add ecx, eax
cmp ecx, 0xaae
jbe 0x1446806
mov eax, dword [0x428158]
or eax, 0x45afe72c
mov dword [0x428374], eax
mov eax, dword [0x428374]
lea edi, [ebp - 0x164]
mov esi, 0x4140f4
sub eax, 0x6d058f3c
mov dword [0x4281dc], eax
xor eax, 0x39098d18
mov dword [0x428158], eax
call fcn.01451f80
mov byte [ebp - 0x164], 0
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0x5a
mov edx, 0x4288c0
mov al, byte [edx]
test al, al
je 0x1446891
sub eax, 0x30
cmp al, 9
jbe 0x144688e
mov eax, dword [0x4281dc]
or eax, 0xb68e8c5d
mov dword [0x428158], eax
call dword [0x42e090]
jmp 0x1446891
inc edx
jmp 0x144686a
mov eax, dword [0x428158]
mov ecx, 0x4284a0
or eax, 0x94323304
mov dword [0x428374], eax
mov dl, byte [ecx]
sub edx, 0x30
cmp dl, 9
ja 0x14468b2
inc ecx
jmp 0x14468a5
xor eax, 0xb338f026
mov dword [0x428158], eax
call dword [0x42e0cc]
sub edi, dword [ebp + esi*4 - 0x164]
inc esi
and eax, 0x3664d87
mov dword [0x4281dc], eax
cmp esi, 4
jne 0x1446865
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1ad0
mov dword [esp], 0x415e20
call fcn.0144a580
add esp, 0x18c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1446900
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x17c
cmp word [eax + 0x42d340], 0
je 0x1446931
add eax, 2
cmp eax, 0x40d0
jne 0x144690e
call fcn.01451940
xor dword [0x427fec], 0xe8bef523
lea edi, [ebp - 0x166]
mov esi, 0x42a994
mov ecx, 0x17
imul eax, dword [0x427fec], 0x70c0f462
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x138]
mov esi, 0x42a9ab
xor eax, 0x6eed0b63
add eax, 0x55bb619
xor eax, 0x26627966
mov dword [0x427fec], eax
call dword [0x42e0cc]
mov ecx, 8
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x144697b
mov edi, dword [0x427fec]
xor esi, esi
xor ecx, ecx
mov al, byte [ebp + ecx - 0x118]
mov ebx, 0x1f
xor edx, edx
mov byte [ebp - 0x169], al
mov eax, ecx
div ebx
movzx eax, byte [ebp + edx - 0x138]
movzx edx, byte [ebp - 0x169]
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
imul eax, edi, 0x76fa0c0
inc ecx
lea edi, [eax - 0x62c2568d]
mov al, byte [ebp - 0x169]
mov byte [ebp + esi - 0x118], al
cmp ecx, 0x100
jne 0x1446994
and edi, 0xae515717
xor ebx, ebx
xor ecx, ecx
xor edx, edx
mov esi, edi
inc edx
xor esi, 0x478c5676
lea edi, [ebp - 0x14f]
movzx edx, dl
mov al, byte [ebp + edx - 0x118]
add ecx, eax
mov byte [ebp - 0x169], al
movzx ecx, cl
mov al, byte [ebp + ecx - 0x118]
mov byte [ebp + edx - 0x118], al
mov al, byte [ebp - 0x169]
mov byte [ebp + ecx - 0x118], al
add al, byte [ebp + edx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebx + ebp - 0x166]
mov byte [ebp + ebx - 0x14f], al
inc ebx
cmp ebx, 0x17
jne 0x1446a00
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x17
mov dword [esp + 4], 0x1b6c
mov dword [esp], 0x417900
mov dword [0x427fec], esi
mov byte [ebp - 0x138], 0
call fcn.0144a580
add esp, 0x17c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1446f98
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 5
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x15b]
mov esi, 0x42ad01
push ebx
sub esp, 0x17c
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x133]
mov esi, 0x42ad15
mov ecx, 0x1b
rep movsb byte es:[edi], byte [esi]
mov dword [esp], 0xb9e
call dword [0x42e0d4]
and eax, 0xa2392a12
push edx
xor edx, edx
xor eax, 0x883d8f3b
mov dword [0x428234], eax
cmp byte [edx + 0x42de60], 0
je 0x1447003
inc edx
cmp edx, 0x762
jne 0x1446fe7
and eax, 0xef3977eb
mov dword [0x428234], eax
mov eax, dword [0x428234]
or eax, 0xf7df7fdd
sub eax, 0x58a5feeb
mov dword [0x428234], eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x1447019
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov edi, 0x1a
xor edx, edx
mov cl, byte [ebp + ebx - 0x118]
div edi
mov byte [ebp - 0x169], cl
movzx eax, byte [ebp + edx - 0x133]
movzx edx, cl
add eax, edx
add eax, esi
movzx esi, al
mov eax, dword [0x428234]
and eax, 0x9156741c
add eax, 0x77a427a0
or eax, 0x105151b3
mov dword [0x428234], eax
call dword [0x42e09c]
mov al, byte [ebp + esi - 0x118]
mov cl, byte [ebp - 0x169]
mov byte [ebp + ebx - 0x118], al
inc ebx
mov byte [ebp + esi - 0x118], cl
cmp ebx, 0x100
jne 0x144702c
mov edi, dword [0x428234]
xor ebx, ebx
xor ecx, ecx
xor edx, edx
lea esi, [ebp - 0x147]
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x118]
add ecx, eax
mov byte [ebp - 0x169], al
movzx ecx, cl
mov al, byte [ebp + ecx - 0x118]
mov byte [ebp + edx - 0x118], al
mov al, byte [ebp - 0x169]
mov byte [ebp + ecx - 0x118], al
add al, byte [ebp + edx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebp + ebx - 0x15b]
inc ebx
mov byte [ebx + esi - 1], al
cmp ebx, 0x14
jne 0x14470ab
add edi, 0x7bbbe864
mov byte [ebp - 0x133], 0
xor eax, eax
mov dword [0x428234], edi
cmp byte [eax + 0x4296a0], 0
je 0x1447146
inc eax
cmp eax, 0xef4
jne 0x1447113
mov dword [esp + 8], 0x42de60
mov dword [esp + 4], edi
mov dword [esp], 0x42d7a0
call fcn.0144d43c
add dword [0x428234], 0x32c2e3ae
mov eax, dword [0x428234]
xor eax, 0x5135865f
add eax, 0x185a1ef2
xor eax, 0x5414df72
mov dword [0x428234], eax
mov dword [esp + 8], esi
mov dword [esp + 0xc], 0x14
mov dword [esp + 4], 0x1e30
mov dword [esp], 0x41d180
call fcn.0144a580
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret