joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov dword [esp + 8], ecx
cmp dword [ecx + 8], 0
je 0x43b570
mov eax, dword [esp + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x43b570
mov dword [esp], 0x1c1d1e1f
xor esi, esi
mov edi, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi]
mov eax, esi
xor eax, 0x20
mov edx, esi
xor edx, 0x6f0b5d1f
or edx, ebx
add eax, edi
not ebx
and eax, 0x37
xor eax, 0xf7
or eax, ebx
xor eax, edx
mov edx, eax
not edx
and edx, 1
neg eax
or eax, 1
sub edx, eax
mov byte [esp + esi], dl
inc esi
add edi, 0xfffffffe
cmp esi, 4
jne 0x43b500
mov eax, dword [esp]
mov esi, dword [0x44a4e0]
test esi, esi
je 0x43b5ed
xor edx, edx
mov edi, dword [0x44a4e4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xddb7c3f3
je 0x43b5d0
inc edx
cmp esi, edx
jne 0x43b560
jmp 0x43b5ed
mov dword [esp], 0x7c6c5cc
mov eax, 0xf1d06fe4
mov ecx, 0xe2f901b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0xe2f901c]
mov esi, edx
and esi, ecx
mov edi, eax
xor edi, edx
sub edi, esi
add edi, ecx
or edx, eax
and edx, edi
mov esi, edx
and esi, 0x5f
xor edx, 0xdf
lea edx, [edx + esi*2]
inc dl
mov byte [esp + eax + 0xe2f901c], dl
inc eax
dec ecx
cmp eax, 0xf1d06fe8
jne 0x43b590
mov eax, dword [esp]
jmp 0x43b6fe
mov edx, dword [edi + edx*8 + 4]
cmp edx, eax
je 0x43b5ed
push dword [ebp + 8]
push ecx
push 8
push edx
push dword [0x44a4e8]
call fcn.0043c7c0
add esp, 0x14
cmp dword [ebp + 0xc], 0
je 0x43b6ed
cmp eax, 0xc000010a
jne 0x43b6ed
mov edi, dword [ebp + 0xc]
mov ebx, edi
and ebx, 0xffffd8f0
mov eax, ebx
xor eax, 0xffffd8f0
mov ecx, edi
and ecx, 0x270f
mul ecx
mov dword [esp + 0x10], eax
mov esi, edx
sub esi, ecx
or edi, 0xffffd8f0
mov eax, edi
mul ebx
sub edx, ebx
add eax, dword [esp + 0x10]
adc edx, esi
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp + 8]
mov edx, dword [eax]
mov dword [esp + 0xc], 0x1c1d1e1f
xor eax, eax
mov esi, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0xc]
mov edi, eax
xor edi, 0x20
mov ecx, eax
xor ecx, 0x6f0b5d1f
or ecx, ebx
add edi, esi
not ebx
and edi, 0x37
xor edi, 0xf7
or edi, ebx
xor edi, ecx
mov ecx, edi
not ecx
and ecx, 1
neg edi
or edi, 1
sub ecx, edi
mov byte [esp + eax + 0xc], cl
inc eax
add esi, 0xfffffffe
cmp eax, 4
jne 0x43b660
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x43b6aa
mov esi, esp
mov eax, dword [esp + 0xc]
mov edi, dword [0x44a4e0]
test edi, edi
je 0x43b6ed
xor ecx, ecx
mov ebx, dword [0x44a4e4]
cmp dword [ebx + ecx*8], 0xa67d73aa
je 0x43b6d0
inc ecx
cmp edi, ecx
jne 0x43b6c0
jmp 0x43b6ed
mov ecx, dword [ebx + ecx*8 + 4]
cmp ecx, eax
je 0x43b6ed
push esi
push 0
push edx
push 0xc
push ecx
push dword [0x44a4e8]
call fcn.0043c7c0
add esp, 0x18
test eax, eax
js 0x43b6fe
mov ecx, dword [esp + 8]
mov esi, eax
call fcn.0043b400
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x43b710
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x28]
mov ecx, dword [ecx]
mov dword [esp], 0x1c1d1e1f
xor esi, esi
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi]
mov eax, esi
xor eax, 0x20
mov ebx, esi
xor ebx, 0x6f0b5d1f
or ebx, edi
add eax, edx
not edi
and eax, 0x37
xor eax, 0xf7
or eax, edi
xor eax, ebx
mov ebx, eax
not ebx
and ebx, 1
neg eax
or eax, 1
sub ebx, eax
mov byte [esp + esi], bl
inc esi
add edx, 0xfffffffe
cmp esi, 4
jne 0x43b730
mov eax, dword [esp]
mov edx, dword [0x44a4e0]
test edx, edx
je 0x43b7a8
xor esi, esi
mov edi, dword [0x44a4e4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xe095b21b
je 0x43b7a0
inc esi
cmp edx, esi
jne 0x43b790
jmp 0x43b7a8
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x43b7b2
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
push ebp
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push ecx
push 0x18
push edx
push dword [0x44a4e8]
call fcn.0043c7c0
add esp, 0x28
jmp 0x43b7ab

Function at 0x43b7e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x2c]
mov eax, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp], 0x1c1d1e1f
xor edx, edx
mov ebp, 0xffffffff
nop
movzx esi, byte [esp + edx]
mov eax, edx
xor eax, 0x20
mov edi, edx
xor edi, 0x6f0b5d1f
or edi, esi
add eax, ebp
not esi
and eax, 0x37
xor eax, 0xf7
or eax, esi
xor eax, edi
mov ecx, eax
not ecx
and ecx, 1
neg eax
or eax, 1
sub ecx, eax
mov byte [esp + edx], cl
inc edx
add ebp, 0xfffffffe
cmp edx, 4
jne 0x43b800
test ebx, ebx
jne 0x43b845
lea ebx, [esp + 8]
mov eax, dword [esp]
mov edx, dword [0x44a4e0]
test edx, edx
je 0x43b8a5
xor ebp, ebp
mov esi, dword [0x44a4e4]
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0xa99f3325
je 0x43b87b
mov ecx, ebp
and ecx, 1
xor ebp, 1
lea ebp, [ebp + ecx*2]
cmp ebp, edx
jb 0x43b860
jmp 0x43b8a5
mov edx, dword [esi + ebp*8 + 4]
cmp edx, eax
je 0x43b8a5
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x14]
push 0x14
push edx
push dword [0x44a4e8]
call fcn.0043c7c0
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43c330
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 2], 0x35a0335c
mov dword [esp + 6], 0x39543752
mov dword [esp + 0xa], 0x3d123b56
mov dword [esp + 0xe], 0x214c3f5a
mov dword [esp + 0x12], 0x2524234e
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 2]
lea edx, [eax - 0xcc4aade]
xor edx, ecx
mov ecx, edx
not ecx
and ecx, 0xaa
mov esi, edx
and esi, 0x55
sub ecx, esi
and edx, 1
or ecx, 1
add ecx, edx
mov dl, 0x9b
sub dl, cl
mov byte [esp + eax + 2], dl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x14
jb 0x43c370
lea esi, [esp + 2]
push esi
call fcn.0043ddb0
add esp, 4
mov dword [0x4524fc], eax
xor ecx, ecx
test eax, eax
sete cl
mov ecx, dword [ecx*4 + 0x447268]
mov edx, dword [0x447270]
mov edi, edx
and edi, 0xff3b3ea5
add edi, edi
sub edi, edx
add ecx, edi
add ecx, 0x80c4c15b
jmp ecx

Function at 0x43d3c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x48]
movzx eax, word [eax]
mov dword [esp], eax
mov dword [esp + 0x28], 0xc0b6054
lea ecx, [esp + 0x28]
xor edx, edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx]
mov ebx, edx
and ebx, 0x3ef61bfe
mov ebp, esi
xor ebp, 0xe084f200
sub ebp, ebx
lea eax, [ebp + 1]
and eax, edi
lea ebx, [edi + ebp]
inc ebx
add eax, eax
sub ebx, eax
add bl, 0xf8
mov byte [ecx], bl
inc ecx
dec esi
add edx, 0xfffffffe
cmp esi, 0xfffffffc
jne 0x43d3f0
xor eax, eax
mov ecx, dword [esp]
cmp dword [esp + 0x28], ecx
setne al
mov eax, dword [eax*4 + 0x4477a4]
mov ecx, dword [0x4477ac]
mov edx, ecx
and edx, 0xd525640e
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0xaada9bf2
xor ebx, ebx
jmp eax

Function at 0x43dd70
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
mov dword [esp], 0xc0b0a39
xor eax, eax
xor ecx, ecx
nop
nop
nop
mov esi, eax
and esi, 2
mov edx, ecx
xor edx, 1
add edx, esi
xor dl, byte [esp + ecx]
add dl, 0xf8
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 4
jne 0x43dd80
mov eax, dword [esp]
mov eax, dword fs:[eax]
add esp, 4
pop esi
ret

Function at 0x43e140
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
movzx eax, word [ebp]
mov dword [esp + 0xc], 0x5d5ca197
mov ecx, 0x27a8590a
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x27a858fe]
xor edx, ecx
mov esi, edx
and esi, 0xad
mov edi, edx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, edi
xor edx, 0xaf
add edx, ebx
add edx, esi
inc dl
mov byte [esp + ecx - 0x27a858fe], dl
inc ecx
cmp ecx, 0x27a8590e
jne 0x43e160
xor ecx, ecx
cmp dword [esp + 0xc], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x447d08]
Function at 0x43e680
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
mov esi, 0xfffffffe
cmp word [ebx + esi + 2], 0
lea esi, [esi + 2]
jne 0x43e690
sar esi, 1
lea edi, [esi + 4]
mov ecx, esi
and ecx, 1
mov eax, edi
or eax, 1
add eax, ecx
jns 0x43e6b5
mov eax, 0xffffffff
jmp 0x43e6b7
add eax, eax
push eax
call fcn.004080f0
add esp, 4
mov ebp, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x43e701
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x43e6f0
mov word [ecx], 0
mov eax, edi
and eax, 0xfffd
and esi, 2
mov ecx, esi
xor ecx, 2
imul ecx, eax
or edi, 2
imul edi, esi
lea eax, [edi + ecx]
mov word [esp + 8], ax
lea eax, [edi + ecx]
add eax, 2
mov word [esp + 0xa], ax
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x76777879
mov ecx, 0xf95868d6
mov edx, 0x29
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 0x6a7972a]
mov ebx, eax
xor ebx, ecx
or ebx, edx
add bl, bl
add bl, al
movzx eax, bl
add eax, ecx
add al, 0x52
mov byte [esp + ecx + 0x6a7972a], al
inc ecx
dec edx
cmp ecx, 0xf95868da
jne 0x43e780
mov esi, dword [esp]
mov ecx, dword [0x44a4e0]
test ecx, ecx
je 0x43e811
xor edx, edx
mov edi, dword [0x44a4e4]
nop
cmp dword [edi + edx*8], 0x5f7891a5
je 0x43e7d0
inc edx
cmp ecx, edx
jne 0x43e7c0
jmp 0x43e811
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43e811
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44a4e8]
call fcn.0043c7c0
add esp, 0x38
mov esi, eax
push ebp
call fcn.00408100
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e830
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x3c]
mov esi, 0xfffffffe
cmp word [ebp + esi + 2], 0
lea esi, [esi + 2]
jne 0x43e840
sar esi, 1
lea ebx, [esi + 4]
mov ecx, esi
and ecx, 1
mov eax, ebx
or eax, 1
add eax, ecx
jns 0x43e865
mov eax, 0xffffffff
jmp 0x43e867
add eax, eax
push eax
call fcn.004080f0
add esp, 4
mov edi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebp]
test dx, dx
je 0x43e8b2
add ebp, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebp]
add ebp, 2
test dx, dx
jne 0x43e8a0
mov word [ecx], 0
mov eax, 3
sub eax, esi
and eax, 2
mov ecx, ebx
and ecx, 0xfffd
imul ecx, eax
and esi, 2
or ebx, 2
imul ebx, esi
lea eax, [ebx + ecx]
mov word [esp + 8], ax
lea eax, [ebx + ecx]
add eax, 2
mov word [esp + 0xa], ax
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x76777879
mov ecx, 0xf95868d6
mov edx, 0x29
nop
nop
nop
movzx eax, byte [esp + ecx + 0x6a7972a]
mov ebx, eax
xor ebx, ecx
or ebx, edx
add bl, bl
add bl, al
movzx eax, bl
add eax, ecx
add al, 0x52
mov byte [esp + ecx + 0x6a7972a], al
inc ecx
dec edx
cmp ecx, 0xf95868da
jne 0x43e930
mov esi, dword [esp]
mov ecx, dword [0x44a4e0]
test ecx, ecx
je 0x43e9b3
xor edx, edx
mov ebx, dword [0x44a4e4]
nop
cmp dword [ebx + edx*8], 0x75935cf9
je 0x43e980
inc edx
cmp ecx, edx
jne 0x43e970
jmp 0x43e9b3
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43e9b3
mov eax, esp
lea edx, [esp + 0x10]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push eax
push edx
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44a4e8]
call fcn.0043c7c0
add esp, 0x24
mov esi, eax
push edi
call fcn.00408100
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e9d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43e9f0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43ea0b
mov eax, 0xffffffff
jmp 0x43ea0e
add eax, 0xa
push eax
call fcn.004080f0
add esp, 4
mov edi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43ea51
add esi, 2
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43ea40
mov word [ecx], 0
lea eax, [ebx*2 + 8]
mov word [esp], ax
lea eax, [ebx*2 + 0xa]
mov word [esp + 2], ax
mov dword [esp + 4], edi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov eax, esp
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x76777879
mov ecx, 0xf95868d6
mov edx, 0x29
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 0x6a7974a]
mov ebx, eax
xor ebx, ecx
or ebx, edx
add bl, bl
add bl, al
movzx eax, bl
add eax, ecx
add al, 0x52
mov byte [esp + ecx + 0x6a7974a], al
inc ecx
dec edx
cmp ecx, 0xf95868da
jne 0x43eac0
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44a4e0]
test ecx, ecx
je 0x43eb35
xor edx, edx
mov ebx, dword [0x44a4e4]
cmp dword [ebx + edx*8], 0xcaa82e26
je 0x43eb10
inc edx
cmp ecx, edx
jne 0x43eb00
jmp 0x43eb35
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43eb35
lea eax, [esp + 0x20]
lea edx, [esp + 8]
push eax
push edx
push 8
push ecx
push dword [0x44a4e8]
call fcn.0043c7c0
add esp, 0x14
mov esi, eax
push edi
call fcn.00408100
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43eb4b
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43eb60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x76777879
mov eax, 0xf95868d6
mov edx, 0x29
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x6a7972a]
mov ebx, ecx
xor ebx, eax
or ebx, edx
add bl, bl
add bl, cl
movzx ecx, bl
add ecx, eax
add cl, 0x52
mov byte [esp + eax + 0x6a7972a], cl
inc eax
dec edx
cmp eax, 0xf95868da
jne 0x43eb90
mov eax, dword [esp]
mov edx, dword [0x44a4e0]
test edx, edx
je 0x43ec08
xor ebx, ebx
mov ecx, dword [0x44a4e4]
nop
cmp dword [ecx + ebx*8], 0xa269eeef
je 0x43ebe0
inc ebx
cmp edx, ebx
jne 0x43ebd0
jmp 0x43ec08
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43ec08
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x44a4e8]
call fcn.0043c7c0
add esp, 0x20
test edi, edi
je 0x43ec12
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43ec1e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43ec30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov dword [esp + 4], 0x76777879
mov eax, 0xf95868d6
mov ebx, 0x29
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x6a7972e]
mov ecx, edx
xor ecx, eax
or ecx, ebx
add cl, cl
add cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x52
mov byte [esp + eax + 0x6a7972e], cl
inc eax
dec ebx
cmp eax, 0xf95868da
jne 0x43ec60
mov eax, dword [esp + 4]
mov ebx, dword [0x44a4e0]
test ebx, ebx
je 0x43ecf2
mov edx, edi
mov ecx, ebp
xor ebp, ebp
mov edi, dword [0x44a4e4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xe88ddea1
je 0x43ecc2
inc ebp
cmp ebx, ebp
jne 0x43ecb0
mov ebp, ecx
jmp 0x43ecf2
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
mov ebp, ecx
je 0x43ecf2
lea eax, [esp + 4]
push 0
push 0
push esi
push edx
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x44a4e8]
call fcn.0043c7c0
add esp, 0x30
cmp eax, 0x103
jne 0x43ed89
mov dword [esp], 0x76777879
mov eax, 0xf95868d6
mov ecx, 0x29
nop
nop
movzx edx, byte [esp + eax + 0x6a7972a]
mov ebx, edx
xor ebx, eax
or ebx, ecx
add bl, bl
add bl, dl
movzx edx, bl
add edx, eax
add dl, 0x52
mov byte [esp + eax + 0x6a7972a], dl
inc eax
dec ecx
cmp eax, 0xf95868da
jne 0x43ed10
mov eax, dword [esp]
mov ecx, dword [0x44a4e0]
test ecx, ecx
je 0x43ed81
xor edx, edx
mov edi, dword [0x44a4e4]
nop
cmp dword [edi + edx*8], 0xa67d73aa
je 0x43ed60
inc edx
cmp ecx, edx
jne 0x43ed50
jmp 0x43ed81
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43ed81
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x44a4e8]
call fcn.0043c7c0
add esp, 0x18
test eax, eax
js 0x43ed89
mov eax, dword [esp + 4]
test ebp, ebp
je 0x43ed9d
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43ed9a
mov ecx, dword [esp + 8]
mov dword [ebp], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43edb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov dword [esp + 4], 0x76777879
mov eax, 0xf95868d6
mov ebx, 0x29
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x6a7972e]
mov ecx, edx
xor ecx, eax
or ecx, ebx
add cl, cl
add cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x52
mov byte [esp + eax + 0x6a7972e], cl
inc eax
dec ebx
cmp eax, 0xf95868da
jne 0x43ede0
mov eax, dword [esp + 4]
mov ebx, dword [0x44a4e0]
test ebx, ebx
je 0x43ee72
mov edx, edi
mov ecx, ebp
xor ebp, ebp
mov edi, dword [0x44a4e4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0x88822328
je 0x43ee42
inc ebp
cmp ebx, ebp
jne 0x43ee30
mov ebp, ecx
jmp 0x43ee72
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
mov ebp, ecx
je 0x43ee72
lea eax, [esp + 4]
push 0
push 0
push esi
push edx
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x44a4e8]
call fcn.0043c7c0
add esp, 0x30
cmp eax, 0x103
jne 0x43ef09
mov dword [esp], 0x76777879
mov eax, 0xf95868d6
mov ecx, 0x29
nop
nop
movzx edx, byte [esp + eax + 0x6a7972a]
mov ebx, edx
xor ebx, eax
or ebx, ecx
add bl, bl
add bl, dl
movzx edx, bl
add edx, eax
add dl, 0x52
mov byte [esp + eax + 0x6a7972a], dl
inc eax
dec ecx
cmp eax, 0xf95868da
jne 0x43ee90
mov eax, dword [esp]
mov ecx, dword [0x44a4e0]
test ecx, ecx
je 0x43ef01
xor edx, edx
mov edi, dword [0x44a4e4]
nop
cmp dword [edi + edx*8], 0xa67d73aa
je 0x43eee0
inc edx
cmp ecx, edx
jne 0x43eed0
jmp 0x43ef01
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43ef01
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x44a4e8]
call fcn.0043c7c0
add esp, 0x18
test eax, eax
js 0x43ef09
mov eax, dword [esp + 4]
test ebp, ebp
je 0x43ef14
mov ecx, dword [esp + 8]
mov dword [ebp], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ef20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov edi, dword [esp + 0x38]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x43ef40
sar ebx, 1
mov ecx, ebx
and ecx, 0xfffd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 4], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0x76777879
mov eax, 0xf95868d6
mov edi, 0x29
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x6a7972a]
mov ebx, ecx
xor ebx, eax
or ebx, edi
add bl, bl
add bl, cl
movzx ecx, bl
add ecx, eax
add cl, 0x52
mov byte [esp + eax + 0x6a7972a], cl
inc eax
dec edi
cmp eax, 0xf95868da
jne 0x43efc0
mov eax, dword [esp]
mov edi, dword [0x44a4e0]
test edi, edi
je 0x43f035
xor ebx, ebx
mov ebp, dword [0x44a4e4]
nop
cmp dword [ebp + ebx*8], 0xb7847e1b
je 0x43f011
inc ebx
cmp edi, ebx
jne 0x43f000
jmp 0x43f035
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43f035
lea eax, [esp + 0xc]
push esi
push eax
push edx
push dword [esp + 0x48]
push 0x10
push edi
push dword [0x44a4e8]
call fcn.0043c7c0
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7ffe533f
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
nop
lea esp, [esp]
stc
push edx
cdq
pop edx
cld
add eax, 0
nop
lea esp, [esp]
nop
add eax, 0
cld
push edx
cdq
pop edx
cld
and bh, 0xff
cld
add eax, 0
nop
pushal
inc eax
popal
cld
pushal
inc eax
popal
cld
add eax, 0
cld
lea esp, [esp]
cld
push edx
cdq
pop edx
stc
lea esp, [esp]
cld
pushal
inc eax
popal
stc
lea esp, [esp]
cld
add eax, 0
clc
push edx
cdq
pop edx
clc
and bh, 0xff
clc
add eax, 0
cld
push edx
cdq
pop edx
cld
push edx
cdq
pop edx
clc
and bh, 0xff
clc
lea esp, [esp]
cld
pushal
inc eax
popal
cld
push edx
cdq
pop edx
clc
add eax, 0
stc
push edx
cdq
pop edx
nop
and bh, 0xff
cld
lea esp, [esp]
cld
lea esp, [esp]
cld
push edx
cdq
pop edx
cld
push edx
cdq
pop edx
nop
and bh, 0xff
cld
lea esp, [esp]
clc
pushal
inc eax
popal
cld
pushal
inc eax
popal
clc
call 0x7ffe53df
pop edx
and bh, 0xff
add eax, 0
xor dx, dx
and bh, 0xff
cld
pushal
inc eax
popal
push es
pop ds
nop
add edx, 0xd5e0
cld
cld
xor ecx, ecx
stc
pushal
inc eax
popal
cld
stc
mov cl, 0x1e
cld
clc
xor byte [ecx + edx], 0x38
loop 0x7ffe5407
lea esp, [esp]
push dword fs:[0x24]
cld
clc
nop
pop dword [edx + 0xa]
mov cl, 0xff
cld
clc
push edx
loop 0x7ffe5421
cld
lea esp, [esp]
cld
pushal
inc eax
popal
nop
nop
cld
cld
mov dword [edx + 0x11], 0xffffacbb
stc
mov ecx, dword [eax + 0x2c]
and bh, 0xff
clc
push edx
cdq
pop edx
clc
and al, 0xff
cld
mov dword [edx + 0x1b], ecx
mov dword [edx + 0x100], ecx
and bh, 0xff
nop
lea esp, [esp]
and bh, 0xff
mov dword [eax + 0x2c], esp
cld
cld
push 0
push edx
cdq
pop edx
stc
lea esp, [esp]
cld
push 0
add eax, 0
cld
push edx
cdq
pop edx
cld
and al, 0xff
cld
push 0
push edx
cdq
pop edx
clc
lea esp, [esp]
clc
push 0
push edx
cdq
pop edx
stc
pushal
inc eax
popal
stc
and bh, 0xff
clc
push 0x30
lea esp, [esp]
cld
lea esp, [esp]
cld
add eax, 0
nop
push 0x20
and bh, 0xff
inc esi
dec esi
nop
push 0
stc
push edx
cdq
pop edx
cld
and bh, 0xff
cld
cld
cld
cld
push 0
nop
push edx
cdq
pop edx
cld
pushal
inc eax
popal
stc
cld
stc
add edx, 0xffff7f2c
cld
stc
push edx
nop
push edx
clc
pushal
inc eax
popal
nop
cld
push 0
clc
lea esp, [esp]
nop
push edx
cdq
pop edx
nop
call dword [edx + 0x8217]
and bh, 0xff
cld
clc
cld
add esp, 0x3f8
push es
pop ds
cld
xor eax, eax
push edx
cdq
pop edx
cld
and al, 0xff
cld
inc eax
pushal
inc eax
popal
stc
push edx
cdq
pop edx
cld
inc esi
dec esi
clc
ret 0xc