joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [esp + 0x3c], 0xea76e84a
mov dword [esp + 0x40], 0xee74ec61
mov dword [esp + 0x44], 0xe27de073
mov dword [esp + 0x48], 0xe63ae442
mov dword [esp + 0x4c], 0xda07d832
mov dword [esp + 0x50], 0xde3ddc0b
mov dword [esp + 0x54], 0xd266d007
mov dword [esp + 0x58], 0xd64bd44a
mov dword [esp + 0x5c], 0xca56c873
mov dword [esp + 0x60], 0xce5ecc5c
mov dword [esp + 0x64], 0xc27fc02f
mov dword [esp + 0x68], 0xc625c477
mov dword [esp + 0x6c], 0xba69b816
mov dword [esp + 0x70], 0xbe6dbc65
mov dword [esp + 0x74], 0xb251b074
mov dword [esp + 0x78], 0xb62cb404
mov dword [esp + 0x7c], 0xaa7fa829
mov dword [esp + 0x80], 0xae66ac7f
mov dword [esp + 0x84], 0xa229a04f
mov dword [esp + 0x88], 0xa671a475
mov dword [esp + 0x8c], 0x9a79987e
mov dword [esp + 0x90], 0x9e0d9c5a
mov dword [esp + 0x94], 0x920d900f
mov dword [esp + 0x98], 0x96229436
mov dword [esp + 0x9c], 0x8a2b8832
mov dword [esp + 0xa0], 0x8e148c30
mov dword [esp + 0xa4], 0x825e801b
mov dword [esp + 0xa8], 0x86568456
mov dword [esp + 0xac], 0x7aa77850
mov dword [esp + 0xb0], 0x7eab7ca8
mov dword [esp + 0xb4], 0x72a9709f
mov dword [esp + 0xb8], 0x76cd74c8
mov dword [esp + 0xbc], 0x6ad468c3
mov dword [esp + 0xc0], 0x6eb16cd7
mov dword [esp + 0xc4], 0x62fd608f
mov dword [esp + 0xc8], 0x66fe64fa
mov dword [esp + 0xcc], 0x5ab958c2
mov dword [esp + 0xd0], 0x5ef85c9c
mov dword [esp + 0xd4], 0x52ca50fc
mov dword [esp + 0xd8], 0x568c54cc
mov dword [esp + 0xdc], 0x4a8a48b7
mov dword [esp + 0xe0], 0x4edf4cd3
mov dword [esp + 0xe4], 0x42dc40d0
mov dword [esp + 0xe8], 0x469a44e6
mov dword [esp + 0xec], 0x3ae83896
mov dword [esp + 0xf0], 0x3ee33cf2
mov dword [esp + 0xf4], 0x32ef30ef
mov dword [esp + 0xf8], 0x36eb34e3
mov dword [esp + 0xfc], 0x2ac928e7
mov dword [esp + 0x100], 0x2e8c2c98
mov dword [esp + 0x104], 0x22802089
mov dword [esp + 0x108], 0x26bc24b1
mov dword [esp + 0x10c], 0x1acc18f8
mov dword [esp + 0x110], 0x1eca1cc8
mov dword [esp + 0x114], 0x12c210c1
mov dword [esp + 0x118], 0x161514c5
mov eax, dword [0x4462ac]
mov ebx, 0xc6e11f8f
mov edx, 0x11ee070
nop
nop
movzx edi, byte [esp + ebx + 0x391ee0ad]
lea ecx, [edi + edi]
not ecx
add ecx, edi
and ecx, 0xc1ffb11a
and edi, 0xffffffe5
or edi, ecx
mov ebp, edx
and ebp, 0x11eb11a
mov esi, ebx
xor esi, 0xc1ffb11a
mov ecx, ebx
or ecx, 0x6000ee5
and ecx, esi
xor ecx, ebp
xor ecx, edi
mov esi, ecx
not esi
or esi, 0xc8f70387
lea edi, [ecx + esi]
inc edi
mov esi, edi
and esi, 0xfd
mov ebp, edi
and ebp, 2
or edi, 2
imul edi, ebp
xor ebp, 2
imul ebp, esi
lea esi, [ecx + ecx]
and esi, 0xe
sub ecx, esi
add ecx, edi
add ecx, ebp
add cl, 0x88
mov byte [esp + ebx + 0x391ee0ad], cl
inc ebx
dec edx
cmp ebx, 0xc6e1206f
jne 0x40b950
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov ecx, 0x7b99ff6f
xor ecx, dword [0x440820]
mov eax, dword [eax*4 + 0x440818]
add eax, ecx
inc eax
xor edi, edi
xor ebx, ebx
jmp eax
Function at 0x40c2c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0xccb4ca94
mov dword [esp + 0x40], 0xc0b6ce47
mov dword [esp + 0x44], 0xc4bfc2bd
mov dword [esp + 0x48], 0xd8f8c6a4
mov dword [esp + 0x4c], 0xdce5daec
mov dword [esp + 0x50], 0xd0ffdeed
mov dword [esp + 0x54], 0xd484d2e9
mov dword [esp + 0x58], 0xe8a9d6ac
mov dword [esp + 0x5c], 0xec94ea8d
mov dword [esp + 0x60], 0xe09cee9a
mov dword [esp + 0x64], 0xe4bde2c1
mov dword [esp + 0x68], 0xf8c7e6b1
mov dword [esp + 0x6c], 0xfccbfac8
mov dword [esp + 0x70], 0xf0cffec3
mov dword [esp + 0x74], 0xf4d3f2ba
mov dword [esp + 0x78], 0x88ef6a2
mov dword [esp + 0x7c], 0xc3d0a77
mov dword [esp + 0x80], 0x440e39
mov dword [esp + 0x84], 0x48b0221
mov dword [esp + 0x88], 0x18330633
mov dword [esp + 0x8c], 0x1c3b1a20
mov dword [esp + 0x90], 0x106f1e5c
mov dword [esp + 0x94], 0x146f1261
mov dword [esp + 0x98], 0x28401670
mov dword [esp + 0x9c], 0x2c492a4c
mov dword [esp + 0xa0], 0x20562e76
mov dword [esp + 0xa4], 0x241c2255
mov dword [esp + 0xa8], 0x38142610
mov dword [esp + 0xac], 0x3c053a0e
mov dword [esp + 0xb0], 0x30093e0e
mov dword [esp + 0xb4], 0x340b3211
mov dword [esp + 0xb8], 0x486f366e
mov dword [esp + 0xbc], 0x4c164a1d
mov dword [esp + 0xc0], 0x40734e11
mov dword [esp + 0xc4], 0x443f4261
mov dword [esp + 0xc8], 0x583c463c
mov dword [esp + 0xcc], 0x5c7b5a3c
mov dword [esp + 0xd0], 0x503a5e1a
mov dword [esp + 0xd4], 0x54285232
mov dword [esp + 0xd8], 0x686e562a
mov dword [esp + 0xdc], 0x6c286a49
mov dword [esp + 0xe0], 0x601d6e15
mov dword [esp + 0xe4], 0x641e621e
mov dword [esp + 0xe8], 0x78586600
mov dword [esp + 0xec], 0x7c4a7a48
mov dword [esp + 0xf0], 0x70417e34
mov dword [esp + 0xf4], 0x744d7241
mov dword [esp + 0xf8], 0x88497645
mov dword [esp + 0xfc], 0x8cab8ab9
mov dword [esp + 0x100], 0x80ee8ede
mov dword [esp + 0x104], 0x84e282e7
mov dword [esp + 0x108], 0x98fe86f7
mov dword [esp + 0x10c], 0x9cae9aa6
mov dword [esp + 0x110], 0x90a89eae
mov dword [esp + 0x114], 0x94a092af
mov dword [esp + 0x118], 0xa89796a3
mov eax, dword [0x4462ac]
mov ecx, 0xc1
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x85]
lea edx, [ecx - 0x80]
mov edi, esi
not edi
mov ebx, edi
and ebx, 0x91
or edi, 0x6e
add esi, edi
inc esi
or esi, ebx
mov edi, ecx
and edi, 0x91
and edx, 0x6e
or edx, edi
xor edx, esi
xor dl, 0x91
add dl, 0xf8
mov byte [esp + ecx - 0x85], dl
inc ecx
cmp ecx, 0x1a1
jne 0x40c510
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov edi, eax
xor eax, eax
test edi, edi
setne al
mov eax, dword [eax*4 + 0x440a70]
mov ecx, 0x3c8ef6ac
xor ecx, dword [0x440a78]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x414060
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edi + 2], 0
lea edi, [edi + 2]
jne 0x414080
mov esi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4140a0
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
mov dword [esp + 0x20], edi
jns 0x4140c4
mov eax, 0xffffffff
jmp 0x4140cd
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.00408000
add esp, 4
movzx ecx, word [esi]
mov dword [esp + 0x18], eax
test cx, cx
je 0x414101
add esi, 2
mov eax, dword [esp + 0x18]
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x4140f0
mov word [eax], 0
mov word [esp + 4], 0xdd0
xor ecx, ecx
mov dl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 4]
mov esi, ecx
or esi, 0xb004676c
xor esi, ebx
lea ebx, [esi + 0x3be59ac]
mov ebp, ebx
and ebp, 0x1f
xor ebx, 0x7fdcc49f
add esi, esi
or esi, 0xfd
lea ebp, [ebx + ebp*2]
and ebx, 1
add ebp, esi
lea ebx, [ebx*2]
add ebx, ebp
add bl, 0x56
mov byte [esp + ecx + 4], bl
mov ecx, 1
test dl, 1
mov edx, 0
jne 0x414120
movzx ecx, word [esp + 4]
mov word [eax], cx
add eax, 2
mov edx, dword [esp + 0x44]
movzx ecx, word [edx]
test cx, cx
je 0x4141a1
add edx, 2
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414190
mov word [eax], 0
lea eax, [esp + 0x14]
xor edi, edi
push 0x60
push 7
push 0x120089
push eax
push dword [esp + 0x28]
call fcn.0043aee0
add esp, 0x14
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 4], 0xf4b3b272
mov esi, 0x32bca186
lea edx, [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [edx]
mov ecx, esi
or ecx, ebp
lea ebx, [esi - 0x32bca100]
and ebx, ebp
not ecx
or ecx, ebx
mov ebx, 0xc8
sub ebx, ecx
not ecx
and ecx, 1
or ebx, 1
sub ecx, ebx
mov byte [edx], cl
inc edx
dec esi
cmp esi, 0x32bca182
jne 0x4141f0
xor ecx, ecx
cmp eax, dword [esp + 4]
sete cl
jmp dword [ecx*4 + 0x44108c]
Function at 0x414740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x440
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [ecx + edi + 2], 0
lea edi, [edi + 2]
jne 0x414760
mov eax, edi
sar eax, 1
mov dword [esp + 0xd4], eax
cmp eax, 0xfffffff2
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
jge 0x41478a
mov eax, 0xffffffff
jmp 0x41478d
lea eax, [edi + 0x1c]
push eax
call fcn.00408000
add esp, 4
mov dword [esp], eax
mov dword [esp + 0x2b8], 0xfc20dd0
mov dword [esp + 0x2bc], 0x13a111b1
mov dword [esp + 0x2c0], 0x17f615a0
mov dword [esp + 0x2c4], 0x1bbf19ce
mov dword [esp + 0x2c8], 0x1fad1dae
mov dword [esp + 0x2cc], 0xe34de149
mov dword [esp + 0x2d0], 0xe7e6e54a
mov eax, 0x8afc746c
mov edi, 0x93
movzx ebx, byte [esp + eax + 0x75038e4c]
mov edx, edi
xor edx, eax
and edx, ebx
xor edx, eax
mov ebx, edx
and ebx, 0x9d
mov ecx, edx
and ecx, 2
mov esi, ecx
xor esi, 2
imul esi, ebx
or ebx, 2
imul ebx, ecx
xor edx, 0x9f
add edx, esi
add edx, ebx
inc dl
mov byte [esp + eax + 0x75038e4c], dl
inc eax
dec edi
cmp eax, 0x8afc7488
jne 0x4147f0
mov edx, dword [esp + 4]
movzx ecx, word [edx]
mov edi, dword [esp]
mov eax, edi
test cx, cx
je 0x414861
add edx, 2
mov eax, edi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414850
mov word [eax], 0
movzx ecx, word [esp + 0x2b8]
test cx, cx
je 0x414891
lea edx, [esp + 0x2ba]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x414880
mov word [eax], 0
lea eax, [esp + 0x138]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.0043aee0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x441608]
Function at 0x41a150
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x198
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x10], 0xa5cea38d
mov dword [esp + 0x14], 0xa9c7a735
mov dword [esp + 0x18], 0xadacabc4
mov eax, 0x32
mov ecx, 0xcd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x22]
mov edx, eax
xor edx, ecx
and edx, edi
xor edx, ecx
mov bl, 0x6f
sub bl, dl
mov byte [esp + eax - 0x22], bl
inc eax
dec ecx
cmp eax, 0x3e
jne 0x41a190
mov dword [esp + 0x2c], 0x53265138
mov dword [esp + 0x30], 0x57265520
mov dword [esp + 0x34], 0x5b755962
mov dword [esp + 0x38], 0x5f325d73
mov dword [esp + 0x3c], 0x6301610f
mov dword [esp + 0x40], 0x670a6505
mov dword [esp + 0x44], 0x6b056900
mov dword [esp + 0x48], 0x6f1a6d1f
mov dword [esp + 0x4c], 0x7372714a
mov eax, 0xd0
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0xa4]
mov ecx, eax
and ecx, edx
add ecx, ecx
add edx, eax
add edx, 0xc9c39e00
mov edi, ecx
xor edi, edx
not ecx
and ecx, edx
add ecx, ecx
sub ecx, edi
mov edx, ecx
xor edx, 0x4e1cf681
and ecx, 0x31e3097e
add ecx, ecx
sub ecx, edx
mov edi, ecx
mov edx, ecx
xor edx, 1
add edx, ecx
and ecx, 1
and edi, 0xfe
add edx, ecx
sub edx, edi
mov byte [esp + eax - 0xa4], dl
inc eax
cmp eax, 0xf4
jne 0x41a200
movzx ecx, word [esp + 0x2c]
lea eax, [esp + 0x154]
test cx, cx
je 0x41a281
lea edx, [esp + 0x2e]
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a270
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
je 0x41a2b1
lea edx, [esi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a2a0
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x41a2e1
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a2d0
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
mov dword [esp + 0x2c], 0xbca1a31f
mov byte [esp + 0x30], 0x19
xor eax, eax
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x2c]
lea ecx, [eax + eax]
mov edi, ecx
and edi, 0xa
mov ebx, eax
xor ebx, 0x637e4b6d
add ebx, edi
xor ebx, edx
add ebx, 0xe40da497
mov edx, ebx
and edx, 1
xor ebx, 1
lea edx, [ebx + edx*2]
mov byte [esp + eax + 0x2c], dl
and ecx, 2
xor eax, 1
add eax, ecx
cmp eax, 5
jb 0x41a300
movzx eax, byte [esp + 0x2c]
test al, al
je 0x41a35d
lea ecx, [esp + 0x2d]
mov ebx, esi
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41a350
jmp 0x41a35f
mov ebx, esi
mov byte [ebx], 0
lea eax, [esp + 0x138]
lea ecx, [esp + 0x148]
lea edx, [esp + 0x20]
lea edi, [esp + 0x154]
push eax
push ecx
push edx
push edi
call fcn.0040b050
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0x4419a0]
mov ecx, 0xa40ad2ed
xor ecx, dword [0x4419a8]
add eax, ecx
inc eax
mov esi, dword [ebp + 0x10]
jmp eax
Function at 0x41b560
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov ecx, dword [esp + 0x5c]
xor eax, eax
test ecx, ecx
setne al
xor esi, esi
mov dword [esp], 0
xor ebx, ebx
jmp dword [eax*4 + 0x441b54]
Function at 0x41cba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
cmp dword [ecx], 0xffffffff
je 0x41cd47
mov esi, ecx
lea eax, [esp + 0x20]
push 0
push 0
push 2
push eax
call fcn.0041e130
test al, al
je 0x41cd47
movzx eax, byte [esp + 0x21]
mov ecx, eax
and ecx, 0x7f
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], 0
cmp ecx, 0x7f
je 0x41cc28
cmp ecx, 0x7e
jne 0x41cd23
mov word [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esi
push 0
push 0
push 2
push eax
call fcn.0041e130
movzx ecx, word [esp + 8]
rol cx, 8
mov ebx, eax
movzx eax, cx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
jmp 0x41cc60
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esi
push 0
push 0
push 8
push eax
call fcn.0041e130
mov ebx, eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
bswap ecx
bswap eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ecx
movzx eax, byte [esp + 0x21]
test al, al
js 0x41cd2d
xor eax, eax
test bl, bl
je 0x41cd47
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
push edi
mov dword [esp + 0x3c], eax
call fcn.00408000
add esp, 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
lea edx, [esp + 0x18]
mov ecx, esi
push edx
push ebx
push edi
push eax
call fcn.0041e130
mov ebx, eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
xor eax, edx
mov edi, dword [esp + 0x28]
xor edi, ecx
or edi, eax
sete byte [esp + 7]
or ecx, edx
setne cl
mov eax, dword [esp + 0x38]
and al, cl
cmp al, 1
jne 0x41cd03
xor eax, eax
xor edx, edx
nop
mov edi, dword [esp + 0x34]
mov ecx, eax
and ecx, 3
movzx ecx, byte [esp + ecx + 0x30]
xor byte [edi + eax], cl
add eax, 1
adc edx, 0
cmp eax, dword [esp + 0x18]
mov ecx, edx
sbb ecx, dword [esp + 0x1c]
jb 0x41cce0
mov edi, dword [ebp + 8]
and bl, byte [esp + 7]
cmp byte [esi + 4], 0
je 0x41cd55
lea eax, [esp + 8]
mov ecx, esi
lea edx, [esp + 0x20]
push edx
push eax
call fcn.0041e3c0
jmp 0x41cd66
xor ebx, ebx
test al, al
jns 0x41cc6d
lea eax, [esp + 0x30]
mov ecx, esi
push 0
push 0
push 4
push eax
call fcn.0041e130
test bl, bl
jne 0x41cc77
xor ebx, ebx
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [esp + 8]
mov ecx, esi
lea edx, [esp + 0x20]
push edx
push eax
call fcn.0041e240
mov eax, dword [esp + 0x14]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [edi + 8], eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [edi + 4], ecx
mov dword [edi], eax
jmp 0x41cd49
Function at 0x41e510
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x2c]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp], 0xb4b3b28b
mov ecx, 0x32bca186
mov edx, 0xcd435e79
mov ebp, 0xcd435e7a
nop
nop
nop
mov dword [esp + 4], ebp
movzx edi, byte [esp + edx + 0x32bca187]
mov ebx, ecx
or ebx, edi
lea esi, [edx + ebx]
inc esi
mov ebp, esi
not ebp
and ebp, 2
mov eax, esi
and eax, 0xfffffffd
imul eax, ebp
mov ebp, dword [esp + 4]
sub edi, eax
or esi, 2
add ebx, ebp
shr ebx, 1
and ebx, 1
imul ebx, esi
add ebx, ebx
sub edi, ebx
add edi, edx
mov eax, edi
and eax, 0x37
xor edi, 0x37
lea eax, [edi + eax*2]
inc al
mov byte [esp + edx + 0x32bca187], al
dec ecx
inc edx
inc ebp
cmp ecx, 0x32bca182
jne 0x41e550
lea eax, [esp + 8]
mov ecx, esp
push eax
push 0x41fbf0
push ecx
mov eax, dword [esp + 0x3c]
push dword [eax + 8]
call fcn.004200e0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41fd40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [esp + 0x28]
xor eax, eax
nop
nop
nop
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x41fd50
lea ecx, [esi + eax]
add ecx, 0xfffffffe
add eax, esi
mov edx, 1
sub edx, eax
and edx, esi
mov eax, esi
not eax
and eax, ecx
sub eax, edx
cmp eax, 0xffffffed
jge 0x41fd7f
mov eax, 0xffffffff
jmp 0x41fd82
add eax, 0x12
push eax
call fcn.00408000
add esp, 4
mov esi, eax
mov dword [esp], 0x1e861c77
mov dword [esp + 4], 0x1298107a
mov dword [esp + 8], 0x164b1447
mov dword [esp + 0xc], 0xa6b0873
mov word [esp + 0x10], 0xc0b
mov eax, esp
mov ecx, 0x2d206fc
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax]
mov edx, ecx
or edx, ebx
lea ebp, [ecx - 0x2d20600]
xor ebp, ecx
add ebp, ecx
and ebp, ebx
not edx
or edx, ebp
mov ebx, edx
and ebx, 0xe5
mov edi, edx
and edi, 2
mov ebp, edi
xor ebp, 2
imul ebp, ebx
or ebx, 2
imul ebx, edi
xor edx, 0xe7
add edx, ebp
add edx, ebx
inc dl
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x2d206ea
jne 0x41fdc0
mov edi, dword [esp + 0x28]
jmp dword [0x441d78]
Function at 0x42557c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov ecx, edi
nop
nop
mov eax, ecx
add ecx, 2
cmp word [eax], 0
jne 0x425580
sub eax, edi
cmp eax, 0xffffffd9
jge 0x4255a0
mov eax, 0xffffffff
jmp 0x4255a3
add eax, 0x26
push eax
call fcn.00408000
add esp, 4
mov ebp, eax
mov dword [esp + 0x6a], 0x5537532e
mov dword [esp + 0x6e], 0x59365739
mov dword [esp + 0x72], 0x5d355b3c
mov dword [esp + 0x76], 0x413c5f39
mov dword [esp + 0x7a], 0x452b4321
mov dword [esp + 0x7e], 0x492e4728
mov dword [esp + 0x82], 0x4d2b4b23
mov dword [esp + 0x86], 0x71e64f60
mov dword [esp + 0x8a], 0x75127316
mov word [esp + 0x8e], 0x7776
xor eax, eax
xor ecx, ecx
nop
nop
nop
movzx edx, byte [esp + ecx + 0x6a]
mov esi, eax
and esi, 4
mov ebx, ecx
xor ebx, 0xc0899c42
add ebx, esi
xor ebx, edx
mov edx, ebx
and edx, 0xef
and ebx, 0x10
xor ebx, 0x11
sub edx, ebx
inc dl
mov byte [esp + ecx + 0x6a], dl
inc ecx
add eax, 2
cmp ecx, 0x26
jne 0x425610
movzx ecx, word [edi]
mov eax, ebp
test cx, cx
je 0x425671
mov edx, edi
add edx, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425660
mov word [eax], 0
movzx ecx, word [esp + 0x6a]
test cx, cx
je 0x4256a1
lea edx, [esp + 0x6c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425690
mov word [eax], 0
mov dword [esp + 8], ebp
jmp dword [0x442b64]

Function at 0x4256b0
Capabilities:
Copy file

Disassembly:
push edi
call fcn.00408010
add esp, 4
xor eax, eax
cmp word [ebp], 0x2a
sete al
jmp dword [eax*4 + 0x442b6c]

Function at 0x4256ca
Capabilities:
Copy file
Encode data using xor

Disassembly:
xor eax, eax
cmp word [ebp], 0x2a
sete al
jmp dword [eax*4 + 0x442b6c]

Function at 0x425a42
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
xor eax, eax
cmp ebp, ebx
sete al
jmp dword [eax*4 + 0x442bcc]
Function at 0x4277f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x2c], 0x7b81857d
mov dword [esp + 0x30], 0x778c7181
mov word [esp + 0x34], 0x365e
mov byte [esp + 0x36], 0x15
xor eax, eax
nop
nop
mov ecx, eax
add cl, 3
xor cl, byte [esp + eax + 0x2c]
add cl, 0xe8
mov byte [esp + eax + 0x2c], cl
inc eax
cmp eax, 0xb
jne 0x427810
movzx edx, byte [esp + 0x2c]
test dl, dl
je 0x427872
lea eax, [esp + 0x2c]
mov ecx, esi
jmp 0x427847
movzx edx, byte [eax]
test dl, dl
je 0x427872
mov dh, byte [ecx]
test dh, dh
je 0x427870
inc ecx
inc eax
lea ebp, [esi + 1]
cmp dh, dl
je 0x42785a
mov esi, ebp
mov ecx, ebp
je 0x427840
lea eax, [esp + 0x2c]
jmp 0x427840
xor esi, esi
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x442e64]

Function at 0x427c83
Capabilities:
Encode data using xor

Disassembly:
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442ee4]

Function at 0x427c95
Capabilities:
Encode data using xor

Disassembly:
test eax, eax
setns al
mov edx, dword [esp + 0x14]
cmp edx, 0x100000
setb cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x442ebc]

Function at 0x427e32
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x74], esi
not eax
shr eax, 0x1f
mov dword [esp + 4], 0
jmp dword [eax*4 + 0x442e5c]

Function at 0x427ee2
Capabilities:
Encode data using xor

Disassembly:
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x442e1c]
Function at 0x434790
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x4347b0
mov dword [esp + 4], edx
mov dword [esp], 0x3f3d3d88
mov ecx, 0x2e29c0ca
mov ebx, 0x5c538194
movzx edx, byte [esp + ecx - 0x2e29c0ca]
mov ebp, ebx
and ebp, 0x5c408006
mov esi, ecx
xor esi, 0xae264323
add esi, ebp
mov edi, 0x2e29c0c9
sub edi, esi
or edi, edx
not edi
mov ebp, 0xc9
sub ebp, esi
and ebp, edx
or ebp, edi
mov edx, ebp
and edx, 0x67
xor ebp, 0x8ecde6e7
lea edx, [edx*2]
add edx, ebp
and ebp, 1
xor edx, 1
lea edx, [edx + ebp*2]
mov byte [esp + ecx - 0x2e29c0ca], dl
inc ecx
add ebx, 2
cmp ecx, 0x2e29c0ce
jne 0x4347d0
mov ebx, dword [esp + 4]
test ebx, ebx
je 0x4348ae
mov esi, dword [esp]
sar ebx, 1
lea edi, [ebx - 1]
mov ecx, ebx
and ebx, 3
je 0x434868
mov ebp, eax
mov edx, dword [esp + 0x1c]
nop
nop
nop
dec ecx
movzx eax, word [edx]
add edx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x434850
cmp edi, 3
jae 0x434871
jmp 0x4348ae
mov edx, dword [esp + 0x1c]
cmp edi, 3
jb 0x4348ae
mov ebx, ecx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [edx + edi*2]
xor ecx, eax
imul ecx, esi
movzx eax, word [edx + edi*2 + 2]
xor eax, ecx
imul eax, esi
movzx ecx, word [edx + edi*2 + 4]
xor ecx, eax
imul ecx, esi
movzx eax, word [edx + edi*2 + 6]
xor eax, ecx
imul eax, esi
add edi, 4
cmp ebx, edi
jne 0x434880
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret