joyce8/EMBER2024-capa huggingface dataset:
Function at 0x805d84
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805d8a
pop ebp
sub ebp, 6
sub ebp, 0x405d84
jmp 0x805de8
jmp 0x805df1
mov eax, 0x405d84
add eax, ebp
add eax, 0x93
mov ecx, 0x638
mov edx, 0x8c109c09
xor byte [eax], dl
inc eax
dec ecx
jne 0x805e08
jmp 0x805e1b
arpl word [ecx + 0x61], cx
or dword [ecx], ebx
or dword [ecx], ecx
popal
or ebp, eax
and eax, 0x59c93a09
neg byte [ecx + ecx + 0x59093fd8]
add ah, 0x82
xor byte [0x88090909], 0xc8
int1
or dword [ecx], ecx
or dword [edx], ecx
les esi, [ecx + 0x909090f]
mov bl, 0x21
or dword [ecx], ecx
or esi, edi
jmp 0x805e58
popal
fnstcw word [eax + eax]
or dword [ecx - 0x45], esp
or dword ds:[eax], ecx
and eax, 0x909612d
or dword [ecx], ecx
loope 0x805e78
or dword [ecx], ecx
or eax, esp
and ecx, dword [ecx]
or dword [ecx], ecx
pop esp
test byte [ebp + 0x2d], ah
or dword [edx + 0x909018c], eax
or dword [edx + 0x909059c], eax
or dword [edx + 0x9091984], eax
or eax, ecx
loopne 0x805e99
cmp byte [ebx], cl
mov cl, bl
or eax, 0xfd8c0640
div dh
not byte [ebx + ecx*8 + 5]
or dword [edx + 0x90d2d85], eax
or dword [ecx], ecx
popal
fnstcw word [eax + eax]
or dword [ecx - 0x45], esp
or dword ds:[eax], ecx
and eax, 0xce1582d
or dword [ecx], ecx
or eax, esp
inc esp
or ecx, dword [ecx]
or dword [esp + eax*4 + 0x65], ebx
sub eax, 0x57cf609
idiv byte [ecx + eax - 0x1f]
ja 0x805ed4
or dword [ecx], ecx
xor byte [ecx + eax - 0x77f6f6f7], 0xf8
clc
dec ecx
cmpsd dword [esi], dword es:[edi]
dec esp
cwde
mov al, bh
dec ecx
cmpsd dword [esi], dword es:[edi]
dec esp
cwde
cmp al, al
mov bl, bh
push edi
mov ecx, 0xfb88a7bc
cmpsd dword [esi], dword es:[edi]
mov bl, bh
sti
push edi
mov ecx, 0xdb3aa7bc
mov ah, cl
or al, 0x41
push es
lea eax, [edi + 9]
or dword [ecx], ecx
push es
add dword [ecx + 9], 0x826f0909
adc eax, 0xe1f28930
push es
lea edx, [ebx]
or dword [ecx], ecx
or dword [ecx - 0x72f91f0e], ecx
sbb byte [ecx], cl
or dword [ecx], ecx
outsd dx, dword [esi]
mov dl, dh
imul byte [esi + eax]
lea ebx, [ecx + ecx]
or dword [ecx], ecx
dec eax
loopne 0x805ee8
div dh
mul byte [eax]
inc ebp
xor byte [eax], cl
mov cl, al
or al, 0x8a
loope 0x805f3d
loopne 0x805ee6
div dh
mul byte [eax]
pop ebp
xor byte [ebx], cl
mov cl, al
jp 0xe20a6d24
jecxz 0x805f4c
mov ah, cl
or al, 0xe0
mov byte [0x54f6f6f6], al
retf
and ch, 0x5f
pop esi
pop esp
cmp byte [ebp + eax - 0x7e], 0x74
add ebp, esi
mov ebx, 0x880f8389
iretd

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
or esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
push edx
pop edi
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
push esi
pop eax
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
push eax
pop esi
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x1a0736cd
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0xb75579e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40ac13
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x40ac62
cmp byte [esi + 0x3d], bl
je 0x40ac62
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40ac91
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, ebx
je 0x40ac69
sub eax, 1
je 0x40ac6c
dec eax
sub eax, 1
jne 0x40ac91
mov byte [esi + 0x3d], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40ac89
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00445d1d
add esp, 0x10
cmp edi, eax
jne 0x40ac91
cmp byte [esi + 0x3d], bl
sete al
jmp 0x40ac64
xor al, al
jmp 0x40ac64

Function at 0x40d019
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov eax, edi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x47d670]
movups xmmword [ebx + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x40d026
mov edx, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
mov esi, dword [ebx + edx*4]
mov eax, edx
cmovae ecx, dword [ebp + 8]
cdq
idiv dword [ebp + 0x20]
movsx eax, byte [edx + ecx]
add eax, esi
add edi, eax
and edi, 0x800000ff
jns 0x40d076
dec edi
or edi, 0xffffff00
inc edi
mov edx, dword [ebp - 4]
mov eax, dword [ebx + edi*4]
mov dword [ebx + edx*4], eax
inc edx
mov dword [ebx + edi*4], esi
mov dword [ebp - 4], edx
cmp edx, 0x100
jl 0x40d04a
lea ecx, [ebp + 8]
call fcn.0040b1fc
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x40d09d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x468412
call fcn.00467fd0
sub esp, 0xc
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 0x24]
lea edi, [eax + 0x400]
and dword [ebp - 4], 0
mov ecx, edi
push 0x20
push ebx
call fcn.0040a7c6
xor eax, eax
xor esi, esi
and dword [ebp - 0x10], eax
test ebx, ebx
jle 0x40d153
inc eax
and eax, 0x800000ff
jns 0x40d0e3
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov edx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x10]
add eax, edx
and eax, 0x800000ff
jns 0x40d0ff
dec eax
or eax, 0xffffff00
inc eax
mov ebx, dword [ebp - 0x18]
cmp dword [ebp + 0x20], 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + eax*4]
mov dword [ecx + ebx*4], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + eax*4], edx
lea ecx, [ebp + 0xc]
mov eax, dword [ebp - 0x14]
cmovae ecx, dword [ebp + 0xc]
mov eax, dword [eax + ebx*4]
add eax, edx
and eax, 0x800000ff
jns 0x40d132
dec eax
or eax, 0xffffff00
inc eax
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp + 0x24]
mov dl, byte [edx + eax*4]
mov eax, edi
xor dl, byte [ecx + esi]
cmp dword [edi + 0x14], 0x10
jb 0x40d148
mov eax, dword [edi]
mov byte [eax + esi], dl
inc esi
mov eax, dword [ebp - 0x18]
cmp esi, ebx
jl 0x40d0d4
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
call fcn.0040b442
lea ecx, [ebp + 0xc]
call fcn.0040b1fc
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x20

Function at 0x413eae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x413eb9
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x413f75
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x478a48]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x478a48]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x478a48]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x478a48]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x478a48]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x478a48]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x478a48]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x478a48]
sub edi, 1
jne 0x413ece
pop edi
test esi, esi
je 0x413f91
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x478a48]
inc edx
sub esi, 1
jne 0x413f79
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x413f98
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x478a48]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x478a48]
mov dword [edi + 8], ecx
pop edi
pop esi
ret
Function at 0x41f2e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4695a3
call fcn.00467fd0
sub esp, 0xcc
push ebx
mov ebx, dword [0x46b150]
push esi
push edi
mov esi, edx
mov dword [ebp - 0x14], ecx
push esi
call ebx
test eax, eax
je 0x41f481
push dword [ebp + 8]
call ebx
test eax, eax
je 0x41f481
mov ebx, dword [0x46b2d0]
mov edi, esi
push 7
push 0x47c0ec
push esi
call ebx
test eax, eax
jne 0x41f32f
lea edi, [esi + 0xe]
push 0x12
push 0x47c0fc
push esi
call ebx
test eax, eax
jne 0x41f340
add edi, 0x24
push 6
push 0x47c124
push edi
call ebx
test eax, eax
jne 0x41f481
mov ebx, dword [ebp - 0x14]
lea edx, [ebp - 0xe]
mov cl, 0x4c
mov byte [ebp - 0xd], 0
mov al, 0x46
mov byte [ebp - 0xf], cl
xor al, cl
mov byte [ebp - 0xd], 0
push 1
mov ecx, ebx
mov byte [ebp - 0xe], al
call fcn.00435314
mov esi, dword [0x46b150]
pop ecx
push edi
call esi
push eax
mov edx, edi
mov ecx, ebx
call fcn.00435257
pop ecx
mov cl, 0x58
mov byte [ebp - 0xd], 0
mov al, 0x52
mov byte [ebp - 0xf], cl
xor al, cl
mov byte [ebp - 0xd], 0
push 1
lea edx, [ebp - 0xe]
mov byte [ebp - 0xe], al
mov ecx, ebx
call fcn.00435314
pop ecx
push dword [ebp + 8]
call esi
mov edx, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.00435257
lea ecx, [ebp - 0xd8]
call fcn.00409c57
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, ebx
movaps xmm0, xmmword [str.type_must_be_number__but_is]
movups xmmword [ebp - 0x25], xmm0
mov byte [ebp - 0x15], bl
mov al, byte [ebp - 0x25]
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0xf
jb 0x41f3db
mov byte [ebp - 0x15], bl
call fcn.004354a4
push ecx
push ecx
lea edx, [ebp - 0x24]
mov ecx, eax
call fcn.0043500b
push eax
lea ecx, [ebp - 0xd8]
call fcn.00409bc7
mov ecx, edi
call fcn.0043539b
mov edx, eax
lea ecx, [ebp - 0xd8]
call fcn.0040bbb4
mov cl, 9
mov byte [ebp - 0xd], bl
mov al, 3
mov byte [ebp - 0xf], cl
xor al, cl
lea edx, [ebp - 0xe]
lea ecx, [ebp - 0xd8]
mov byte [ebp - 0xe], al
call fcn.0040bbb4
mov ecx, dword [ebp + 8]
call fcn.0043539b
mov edx, eax
lea ecx, [ebp - 0xd8]
call fcn.0040bbb4
mov cl, 0x1c
mov byte [ebp - 0x11], bl
mov al, 0x16
mov byte [ebp - 0x13], cl
xor al, cl
lea edx, [ebp - 0x12]
lea ecx, [ebp - 0xd8]
mov byte [ebp - 0x12], al
call fcn.0040bbb4
lea ecx, [ebp - 0xd8]
call fcn.00409b97
lea ecx, [ebp - 0xd8]
call fcn.004064fe
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x434134
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov dword [ebp - 4], ecx
mov ebx, edx
push esi
mov al, 0x62
mov dword [ebp - 0x10], 0xf1efe862
mov dword [ebp - 0xc], 0xb3f3f2f0
xor ecx, ecx
mov dword [ebp - 8], 0xf1f1f9
not al
xor byte [ebp + ecx - 0xf], al
inc ecx
cmp ecx, 0xa
jae 0x43416b
mov al, byte [ebp - 0x10]
jmp 0x43415a
lea eax, [ebp - 0xf]
mov byte [ebp - 5], 0
push eax
call dword [0x46b1a8]
mov esi, eax
test esi, esi
jne 0x43418d
push eax
call dword [0x46b194]
mov eax, 0xe4
jmp 0x43420a
movaps xmm0, xmmword [0x47df60]
xor edx, edx
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0x84a0a9
mov ecx, edx
mov al, byte [ebp - 0x30]
not al
xor byte [ebp + ecx - 0x2f], al
inc ecx
cmp ecx, 0x12
jb 0x4341a3
mov byte [ebp - 0x1d], dl
mov al, 0x7c
mov dword [ebp - 0x1c], 0xeff1f67c
mov ecx, edx
mov dword [ebp - 0x18], 0xadedecee
mov dword [ebp - 0x14], 0xefefe7
not al
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0xa
jae 0x4341df
mov al, byte [ebp - 0x1c]
jmp 0x4341ce
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], dl
push eax
call dword [0x46b1a8]
lea ecx, [ebp - 0x2f]
push ecx
push eax
call dword [0x46b1a0]
test eax, eax
jne 0x4341fe
push esi
jmp 0x434180
push 0
push 0
push ebx
push dword [ebp - 4]
push 0
call eax
pop esi
pop ebx
leave
ret

Function at 0x4343a9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x11], 0xeaedce61
push edi
mov edi, ecx
mov dword [ebp - 0xd], 0xfdfbecf1
mov al, 0x61
mov dword [ebp - 9], 0xf2f2fab0
mov byte [ebp - 5], bl
mov ecx, ebx
not al
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 0xb
jae 0x4343e3
mov al, byte [ebp - 0x11]
jmp 0x4343d2
lea eax, [ebp - 0x10]
mov byte [ebp - 5], bl
push eax
call dword [0x46b1a8]
mov esi, eax
test esi, esi
je 0x434461
movaps xmm0, xmmword [0x47dfc0]
mov ecx, ebx
movups xmmword [ebp - 0x27], xmm0
mov dword [ebp - 0x17], 0xa5a8a7b2
mov word [ebp - 0x13], 0xa3
mov al, byte [ebp - 0x27]
not al
xor byte [ebp + ecx - 0x26], al
inc ecx
cmp ecx, 0x14
jb 0x434410
lea eax, [ebp - 0x26]
mov byte [ebp - 0x12], bl
push eax
push esi
call dword [0x46b1a0]
test eax, eax
je 0x43445a
push ebx
push ebx
push ebx
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
push ecx
call eax
test eax, eax
js 0x43445a
mov edx, dword [ebp - 4]
test edx, edx
je 0x43445a
push ecx
mov ecx, edi
call fcn.004342ac
mov eax, dword [ebp - 4]
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call dword [0x46b194]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4354a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
xor ebx, ebx
mov dword [ebp - 0xd], 0xdbcdcb61
mov al, 0x61
mov dword [ebp - 9], 0xd1cccecc
mov dword [ebp - 5], 0xdbd2d7d8
mov ecx, ebx
mov byte [ebp - 1], bl
not al
xor byte [ebp + ecx - 0xc], al
inc ecx
cmp ecx, 0xb
jae 0x4354dd
mov al, byte [ebp - 0xd]
jmp 0x4354cc
push 0x104
lea eax, [ebp - 0x120]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 0xc]
push eax
call dword [0x46b0e8]
movaps xmm0, xmmword [0x47dfa0]
xor ecx, ecx
cmp ecx, eax
mov dword [ebp - 4], 0xa48f97
lea eax, [ebp - 0x120]
mov edx, ebx
sbb ecx, ecx
and ecx, eax
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
not al
xor byte [ebp + edx - 0x13], al
inc edx
cmp edx, 0x12
jb 0x435518
lea edx, [ebp - 0x13]
mov byte [ebp - 1], bl
call fcn.0043500b
pop ebx
leave
ret
Function at 0x438394
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x46a541
call fcn.00467fd0
sub esp, 0xbc
push ebx
push esi
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], 0xf
mov byte [ebp - 0x64], bl
xor eax, eax
mov edx, ebx
inc eax
mov dword [ebp - 4], eax
movaps xmm0, xmmword [str.SoftwareMicrosoftInternet_Account_ManagerAccounts]
movups xmmword [ebp - 0x85], xmm0
mov dword [ebp - 0x24], 0x40
movaps xmm0, xmmword [0x47df90]
mov dword [ebp - 0x28], eax
movups xmmword [ebp - 0x75], xmm0
mov byte [ebp - 0x65], bl
mov cl, byte [ebp - 0x85]
not cl
xor byte [ebp + edx - 0x84], cl
inc edx
cmp edx, 0x1f
jb 0x4383eb
push edi
lea eax, [ebp - 0x20]
mov byte [ebp - 0x65], bl
push eax
push 0x20119
push ebx
lea eax, [ebp - 0x84]
push eax
push 0x80000002
call dword [0x46b01c]
mov edi, eax
mov dword [ebp - 0x19], 0xf8fad664
mov cl, 0x64
mov dword [ebp - 0x15], 0xfef5f2f3
mov dword [ebp - 0x11], 0xfff2eedc
mov edx, ebx
mov byte [ebp - 0xd], bl
not cl
xor byte [ebp + edx - 0x18], cl
inc edx
cmp edx, 0xb
jae 0x43844f
mov cl, byte [ebp - 0x19]
jmp 0x43843e
lea eax, [ebp - 0x24]
mov byte [ebp - 0xd], bl
push eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x20]
call dword [0x46b00c]
test edi, edi
pop edi
jne 0x438487
test eax, eax
jne 0x438487
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x64]
call fcn.0040b36d
push dword [ebp - 0x20]
call dword [0x46b030]
lea eax, [ebp - 0x64]
mov dword [ebp - 0x38], ebx
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], ebx
call fcn.0040b442
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
push 0x477d1b
mov byte [esi], bl
call fcn.0040b36d
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
cmp byte [eax + ebx], 0
je 0x4384fc
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
movsx eax, byte [eax + ebx]
push eax
call fcn.004517e6
pop ecx
mov byte [ebp - 0x30], al
mov ecx, esi
push dword [ebp - 0x30]
call fcn.0040b24c
inc ebx
jmp 0x4384c5
lea ecx, [ebp - 0x48]
call fcn.0040b1fc
lea ecx, [ebp - 0x64]
call fcn.0040b1fc
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x438909
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
push ebx
push edi
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x90]
push ebx
push eax
call fcn.00442100
xor eax, eax
lea edi, [ebp - 0x4c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x104
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x194]
push eax
push ebx
call dword [0x46b0b8]
movaps xmm0, xmmword [0x47e1c0]
mov ecx, ebx
movups xmmword [ebp - 0x3a], xmm0
mov dword [ebp - 0xa], 0xc79996d0
movaps xmm0, xmmword [0x47e350]
movups xmmword [ebp - 0x2a], xmm0
mov dword [ebp - 6], 0xc5939496
movaps xmm0, xmmword [0x47de80]
movups xmmword [ebp - 0x1a], xmm0
mov word [ebp - 2], 0x94
mov al, byte [ebp - 0x3a]
not al
xor byte [ebp + ecx - 0x39], al
inc ecx
cmp ecx, 0x38
jb 0x43897b
lea eax, [ebp - 0x194]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 0x39]
push eax
lea eax, [ebp - 0x39c]
push 0x208
push eax
call fcn.00434faa
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x90]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x39c]
push eax
push ebx
call dword [0x46b104]
push dword [ebp - 0x48]
call dword [0x46b160]
push dword [ebp - 0x4c]
call dword [0x46b160]
pop edi
pop ebx
leave
ret

Function at 0x43a870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, edx
lea eax, [ecx - 1]
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
mov esi, edi
sar eax, 1
mov dword [ebp - 8], eax
cmp edi, eax
jge 0x43a8cb
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x18
add ecx, ebx
lea edx, [ecx - 0x18]
call fcn.0041f03f
movzx eax, al
xor eax, 1
imul ecx, edi, 0x18
inc eax
add esi, eax
imul eax, esi, 0x18
add ecx, ebx
add eax, ebx
push eax
call fcn.0040a8ed
mov eax, dword [ebp - 8]
mov edi, esi
cmp esi, eax
jl 0x43a894
mov ecx, dword [ebp + 8]
cmp esi, eax
jne 0x43a8ea
test cl, 1
jne 0x43a8ea
imul eax, ecx, 0x18
imul ecx, edi, 0x18
add eax, 0xffffffe8
add eax, ebx
add ecx, ebx
push eax
call fcn.0040a8ed
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 4], edi
jge 0x43a91e
mov edx, dword [ebp + 0xc]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0x18
add eax, ebx
mov ecx, eax
mov dword [ebp + 8], eax
call fcn.0041f03f
test al, al
je 0x43a91e
push dword [ebp + 8]
imul ecx, edi, 0x18
add ecx, ebx
call fcn.0040a8ed
mov edi, esi
cmp dword [ebp - 4], esi
jl 0x43a8ef
push dword [ebp + 0xc]
imul ecx, edi, 0x18
add ecx, ebx
call fcn.0040a8ed
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43bd93
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
push esi
push edi
mov esi, ecx
lea eax, [ebx - 1]
cmp eax, 7
jbe 0x43bdaf
mov dword [esi + 0x6afa4], 0x47d5b4
xor edi, edi
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x43bdd3
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
mov dword [esi + 0x6af6c], edi
push edi
push eax
call fcn.00442100
movzx eax, word [ebx*8 + 0x47a612]
add esp, 0xc
mov dword [esi + 0x6af98], eax
movzx eax, word [ebx*8 + 0x47a610]
mov dword [esi + 0x6af9c], eax
movzx eax, word [ebx*8 + 0x47a614]
push 2
mov dword [esi + 0x6afa0], eax
movzx eax, word [ebx*8 + 0x47a616]
pop ecx
mov dword [esi + 0x6af94], eax
cmp ebx, ecx
jg 0x43be36
mov eax, dword [ebp + 8]
or word [eax], 4
jmp 0x43be41
cmp ebx, 8
jl 0x43be41
mov eax, dword [ebp + 8]
or word [eax], cx
mov eax, dword [esi + 0xc]
lea ebx, [esi + 0x1af70]
push 0x10000
push ebx
push esi
mov dword [esi + 0x6af84], edi
mov dword [esi + 0x6af74], edi
call eax
add esp, 0xc
mov dword [esi + 0x6af90], eax
test eax, eax
je 0x43beaa
cmp eax, 0xffffffff
je 0x43beaa
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x43be85
mov ecx, esi
call fcn.0043c079
mov dword [esi + 0x6af7c], edi
mov ecx, edi
movzx eax, byte [ebx + edi]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc edi
mov dword [esi + 0x6af7c], ecx
cmp edi, 2
jb 0x43be8d
jmp 0x43beba
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret