joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d360
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x58
mov esi, dword [esp + 0x70]
mov dword [esp + 0x14], ecx
mov eax, dword [ecx + 0x60]
mov dword [esp + 0x10], eax
mov dword [esp], 0x868d93
mov ebx, 0x61
mov edx, 0x9e
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + ebx - 0x61]
mov eax, ebx
and eax, ecx
mov ebp, edx
and ebp, ecx
lea edi, [edx - 0x5533e800]
xor edi, ecx
sub edi, ecx
add edi, ebp
or edi, eax
mov ecx, 0x87e1bb8b
sub ecx, edi
add edi, 0x74
and edi, 0x72
mov eax, ecx
and eax, 0x8c
sub eax, edi
and ecx, 1
or ecx, eax
inc cl
mov byte [esp + ebx - 0x61], cl
inc ebx
dec edx
cmp ebx, 0x65
jne 0x40d390
mov dword [esp + 4], 0x26382412
mov word [esp + 8], 0x3d36
mov dword [esp + 0xa], 0
xor ebx, ebx
xor ebp, ebp
nop
nop
movzx eax, byte [esp + ebp + 4]
mov edx, ebp
xor edx, 0x82df7dcc
mov ecx, ebx
and ecx, 6
sub ecx, edx
mov edx, ecx
and edx, eax
add ecx, eax
add edx, edx
sub ecx, edx
add cl, 0xfc
mov byte [esp + ebp + 4], cl
inc ebp
add ebx, 2
cmp ebp, 0xa
jne 0x40d3f0
mov dword [esp + 0x18], 0x1e045053
mov dword [esp + 0x1c], 0x21e2c28
mov dword [esp + 0x20], 0x50e0433
mov dword [esp + 0x24], 0xa010609
mov dword [esp + 0x28], 0x42090506
mov dword [esp + 0x2c], 0xfc2f6967
mov dword [esp + 0x30], 0xfff103fa
mov dword [esp + 0x34], 0xfed6bc04
mov dword [esp + 0x38], 0xcf7f709
mov dword [esp + 0x3c], 0xecf90ffb
mov dword [esp + 0x40], 0xe7bed5ea
mov dword [esp + 0x44], 0xa2ede9e9
mov dword [esp + 0x48], 0xf21af4e8
mov dword [esp + 0x4c], 0xcee4b3d5
mov dword [esp + 0x50], 0x8be9d0db
mov byte [esp + 0x54], 0xa8
mov word [esp + 0x55], 0
mov byte [esp + 0x57], 0
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
mov eax, ebx
add al, 0x69
xor al, byte [esp + ebx + 0x18]
add al, 0xf3
mov byte [esp + ebx + 0x18], al
inc ebx
cmp ebx, 0x40
jne 0x40d4b0
mov eax, dword [esp + 0x6c]
add eax, dword [esp + 0x10]
movzx ebx, byte [esp + 0x18]
mov edi, eax
test bl, bl
mov ecx, dword [esp + 0x74]
je 0x40d4fc
lea ebp, [esp + 0x19]
mov edi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [ebp]
inc ebp
test bl, bl
jne 0x40d4f0
mov byte [edi], 0
movzx ebx, byte [esi]
test bl, bl
je 0x40d51b
inc esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40d510
mov byte [edi], 0
movzx ebx, byte [esp + 4]
test bl, bl
je 0x40d53b
lea esi, [esp + 5]
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40d530
mov byte [edi], 0
movzx ebx, byte [ecx]
test bl, bl
je 0x40d55b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [ecx]
inc ecx
test bl, bl
jne 0x40d550
mov byte [edi], 0
movzx edx, byte [esp]
test dl, dl
je 0x40d57b
lea esi, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], dl
inc edi
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x40d570
mov byte [edi], 0
sub edi, eax
mov eax, dword [esp + 0x14]
add dword [eax + 0x60], edi
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40e960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40ebcd
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40e99c
cmp edx, esi
jae 0x40ebcd
test edi, edi
je 0x40ebcd
movzx ebp, bl
test bl, bl
js 0x40e9d0
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40e990
jmp 0x40ebcd
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40ea0e
cmp bl, 0xc2
jb 0x40e9c0
movzx esi, byte [edx + 1]
mov ecx, esi
not ecx
or ecx, 0xc0
add ecx, esi
cmp ecx, 0x7f
jne 0x40eba8
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40eabf
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40ea38
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40ea77
cmp ebp, 0xe0
jne 0x40ea80
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40e9bc
jmp 0x40ea80
mov ecx, ebp
not ecx
or ecx, 0xf8
add ecx, ebp
cmp ecx, 0xef
jne 0x40ebae
cmp bl, 0xf4
ja 0x40e9c0
movzx ecx, byte [edx + 1]
je 0x40eaca
cmp ebp, 0xf0
jne 0x40ead3
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40e9bc
jmp 0x40ead3
cmp cl, 0x9f
ja 0x40e9bc
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40eba8
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ebb5
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40e9b2
cmp cl, 0x8f
ja 0x40e9bc
mov esi, ecx
xor esi, 0xffffff3f
mov ebp, ecx
or ebp, 0xc0
and ebp, esi
cmp ebp, 0x80
jne 0x40eba8
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ebb5
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ebc1
shl ecx, 0xc
and bl, 7
movzx esi, bl
shl esi, 0x12
and ebp, 0x3f
shl ebp, 6
or ebp, esi
mov ebx, ecx
and ebx, 0x3f000
or ebx, ebp
add edx, 4
mov esi, ebx
and esi, 0x1ff800
cmp esi, 0xd800
je 0x40e9bc
mov esi, dword [esp]
and esi, 0x3f
or esi, ebx
cmp esi, 0x10000
jb 0x40e9bc
cmp edi, 2
jb 0x40ebae
not ecx
and ecx, 0x10000
and ebx, 0xefc00
sub ebx, ecx
shr ebx, 0xa
and ebx, 0x3ff
or ebx, 0xd800
mov word [eax], bx
and esi, 0x3ff
or esi, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], si
jmp 0x40e9b2
inc edx
jmp 0x40e9bc
mov ecx, eax
jmp 0x40e9b2
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40e9c2
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40e9c2
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f0e0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44e3c0]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40f18e
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x448a74]
jmp dword [0x448a88]
Function at 0x410940
Capabilities:
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x128
mov esi, esp
push eax
sub esp, 0x64
mov dword [esi + 4], esp
sub esp, 0xc
mov dword [esi + 0x10], esp
sub esp, 0x208
mov dword [esi + 0x1c], esp
sub esp, 8
mov dword [esi + 8], esp
push eax
mov ecx, esp
sub esp, 8
mov eax, esp
sub esp, 8
mov dword [esi + 0x18], esp
sub esp, 0x68
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
mov dword [esi + 0x94], ecx
mov dword [esi + 0xc], eax
push eax
sub esp, 0x64
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x64], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x60], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x5c], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x58], eax
mov esp, eax
push eax
sub esp, 0xfc
mov dword [esi + 0x38], esp
sub esp, 0xc
mov dword [esi + 0x2c], esp
sub esp, 8
mov dword [esi + 0x50], esp
sub esp, 0x24
mov dword [esi + 0x6c], esp
push eax
mov dword [esi + 0x4c], esp
push eax
mov dword [esi + 0x48], esp
sub esp, 0x68
mov dword [esi + 0x54], esp
sub esp, 0xc
mov dword [esi + 0x98], esp
sub esp, 0x68
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x44], eax
mov esp, eax
push eax
sub esp, 0xc
mov dword [esi + 0x24], esp
sub esp, 0x800
mov dword [esi + 0x14], esp
sub esp, 0x7c
mov dword [esi + 0x28], esp
sub esp, 0x44
mov dword [esi + 0x68], esp
sub esp, 0x10
mov dword [esi + 0x20], esp
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
shr eax, 0x1f
jmp dword [eax*4 + 0x44930c]
Function at 0x41b850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1110
call fcn.0040c650
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
xor ecx, ecx
nop
nop
nop
nop
nop
cmp word [eax + ecx], 0
lea ecx, [ecx + 2]
jne 0x41b870
add ecx, eax
add ecx, 0xfffffffe
mov esi, eax
not esi
and esi, ecx
add esi, esi
xor ecx, eax
sub esi, ecx
sar esi, 1
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44f6f8]
mov ebx, dword [esp + 0x34]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41b8b4
mov eax, 0xffffffff
jmp 0x41b8b7
lea eax, [ebx + ebx]
push eax
call fcn.0040c6f0
add esp, 4
lea ecx, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x20], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44f6f8]
mov eax, dword [esp + 0x34]
mov ecx, eax
add ecx, 0xd
js 0x41b8ec
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c6f0
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x10c], 0x790e7b18
mov dword [esp + 0x110], 0x65fb6717
mov dword [esp + 0x114], 0x614263f8
mov dword [esp + 0x118], 0x6d056f1a
mov dword [esp + 0x11c], 0x69f76bf2
mov dword [esp + 0x120], 0x950797ff
mov dword [esp + 0x124], 0x91929306
mov dword [esp + 0x128], 0
mov eax, 0xfbfaa36b
mov ecx, 0x4055c94
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x4055da1]
lea esi, [edx + edx]
not esi
add esi, edx
mov ebx, eax
or ebx, edx
not edx
and edx, esi
or edx, ecx
and edx, ebx
mov esi, 1
sub esi, edx
mov ebx, esi
not ebx
or ebx, edx
mov edi, 0x17
sub edi, edx
and edi, 0xfe
or esi, 0xfe
xor esi, edi
and ebx, 1
lea edx, [esi + ebx*2]
mov byte [esp + eax + 0x4055da1], dl
inc eax
dec ecx
cmp eax, 0xfbfaa38b
jne 0x41b960
mov edx, dword [esp + 0x18]
movzx ecx, word [edx]
mov edi, dword [esp + 0x14]
mov eax, edi
test cx, cx
je 0x41b9e1
add edx, 2
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b9d0
mov word [eax], 0
movzx ecx, word [esp + 0x10c]
test cx, cx
je 0x41ba11
lea edx, [esp + 0x10e]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ba00
mov word [eax], 0
lea eax, [esp + 0xa0]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00442a10
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a1c4]
Function at 0x422090
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x4220a0
sar ebp, 1
mov eax, esp
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x44f6f8]
mov edi, dword [esp]
test edi, edi
jns 0x4220cc
mov eax, 0xffffffff
jmp 0x4220cf
lea eax, [edi + edi]
push eax
call fcn.0040c6f0
add esp, 4
mov esi, eax
mov eax, esp
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x44f6f8]
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00442bd0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a66c]
Function at 0x423f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x423f30
cmp eax, 0xffffffed
jge 0x423f47
mov eax, 0xffffffff
jmp 0x423f4a
add eax, 0x12
push eax
call fcn.0040c6f0
add esp, 4
mov esi, eax
mov dword [esp], 0xcf51c9a4
mov dword [esp + 4], 0xc34bcda9
mov dword [esp + 8], 0xc794c194
mov dword [esp + 0xc], 0xfb9cc5a0
mov dword [esp + 0x10], 0xf9f8
mov eax, esp
mov ecx, 0x5f95f92d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
mov ebx, edx
not ebx
or ebx, 0x6f3d3de2
add ebx, edx
inc ebx
and edx, 0x1d
xor edx, 0x90c2c21d
or ebx, edx
mov edx, ecx
xor edx, 0x6f3d3de2
mov ebp, ebx
and ebp, edx
add edx, ebx
add ebp, ebp
sub edx, ebp
add dl, 0xe6
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x5f95f919
jne 0x423f90
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x423ff1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x423fe0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x424021
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424010
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00442bd0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44a774]
Function at 0x426b50
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov dword [esp + 4], 0xd102cf2b
mov dword [esp + 8], 0xd577d361
mov dword [esp + 0xc], 0xd97ad777
mov dword [esp + 0x10], 0xdd6adb1b
mov dword [esp + 0x14], 0xa11adf6c
mov dword [esp + 0x18], 0xa516a303
mov dword [esp + 0x1c], 0xa941a707
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0xaba8
mov ecx, 0x2ed102d
mov edx, 0x3512efd2
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x2ed1029]
mov edi, edx
and edi, 0x34102e12
mov ebx, ecx
and ebx, 0x224006d
or ebx, edi
xor ebx, esi
xor ebx, 0x3cd93e12
add ebx, 0xc95eaf1e
mov esi, ebx
xor esi, 0xee
and ebx, 0x11
add ebx, ebx
sub ebx, esi
add bl, 0xef
mov byte [esp + ecx - 0x2ed1029], bl
inc ecx
dec edx
cmp ecx, 0x2ed104d
jne 0x426bb0
lea ebx, [esp + 0x72]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea ebp, [esp + 0x54]
push ebp
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x44f6f8]
mov esi, dword [esp + 0x54]
mov edi, 0xffffffff
test esi, esi
jns 0x426c49
mov eax, 0xffffffff
jmp 0x426c4c
lea eax, [esi + esi]
push eax
call fcn.0040c6f0
add esp, 4
push ebp
push esi
mov dword [esp + 8], eax
push eax
push 0xe
push ebx
push 0
call dword [0x44f6f8]
mov eax, dword [esp + 0x54]
mov ecx, eax
and ecx, 9
xor eax, 9
lea eax, [eax + ecx*2]
test eax, eax
js 0x426c7e
add eax, eax
mov edi, eax
push edi
call fcn.0040c6f0
add esp, 4
mov edi, eax
mov dword [esp + 4], 0x3d201dc
mov dword [esp + 8], 0x7e505e5
mov dword [esp + 0xc], 0xbeb09e3
mov dword [esp + 0x10], 0xfeb0deb
mov dword [esp + 0x14], 0x131211e3
mov word [esp + 0x18], 0
mov eax, 0x4e4a8040
mov ebp, 0xbf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x4e4a803c]
lea ecx, [edx + edx]
not ecx
add ecx, edx
and ecx, eax
and edx, ebp
or edx, ecx
mov ecx, 0x87748140
sub ecx, edx
or ecx, 1
lea ebx, [edx + ecx]
add ebx, 0x788b7ec0
mov ecx, ebx
and ecx, 2
mov esi, ebx
or ebx, 2
imul ebx, ecx
xor ecx, 2
and esi, 0xfd
imul esi, ecx
lea ecx, [edx + 0xbf]
or edx, 0xfe
or ecx, 1
and ecx, edx
add ecx, ebx
add ecx, esi
mov byte [esp + eax - 0x4e4a803c], cl
inc eax
dec ebp
cmp eax, 0x4e4a8056
jne 0x426cd0
mov eax, dword [esp]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x426d61
mov eax, dword [esp]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x426d50
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x426d91
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x426d80
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.00442bd0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44ae38]
Function at 0x427210
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0x91dd9ffb
mov dword [esp + 8], 0x95029300
mov dword [esp + 0xc], 0x893597d0
mov dword [esp + 0x10], 0x8d298b1c
mov dword [esp + 0x14], 0x81228feb
mov dword [esp + 0x18], 0x851a8334
mov dword [esp + 0x1c], 0xf9188713
mov dword [esp + 0x20], 0xfd5dfb5c
mov dword [esp + 0x24], 0xf15cff6e
mov dword [esp + 0x28], 0xf560f36b
mov dword [esp + 0x2c], 0xe95af750
mov dword [esp + 0x30], 0xed78eb58
mov dword [esp + 0x34], 0xe148ef7d
mov dword [esp + 0x38], 0xe57ee37b
mov dword [esp + 0x3c], 0xd973e743
lea eax, [esp + 0x40]
mov word [esp + 0x40], 0xdbd8
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
mov ecx, 0x25
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x21]
mov edx, ecx
and edx, esi
mov edi, edx
and edi, 0xfffffffd
mov ebx, edx
and ebx, 2
mov ebp, edx
or ebp, 0xfffffffd
inc ebp
imul ebp, edi
or edx, 2
imul edx, ebx
add ebp, esi
sub ebp, edx
lea edx, [ecx + ebp]
add edx, 0x89054f46
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + ecx - 0x21], dl
inc ecx
cmp ecx, 0x69
jne 0x4272c0
lea ebx, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, esp
push edi
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x44f6f8]
mov ebp, dword [esp]
test ebp, ebp
jns 0x42734a
mov eax, 0xffffffff
jmp 0x427351
lea eax, [ebp*2]
push eax
call fcn.0040c6f0
add esp, 4
mov esi, eax
push edi
push ebp
push eax
push 0x1e
push ebx
push 0
call dword [0x44f6f8]
mov dword [esp + 4], 0x99f29bc0
mov dword [esp + 8], 0xa5d4a7e3
mov dword [esp + 0xc], 0xa1c9a3c8
mov dword [esp + 0x10], 0xadc0afde
mov dword [esp + 0x14], 0xa9d4abdb
mov dword [esp + 0x18], 0xb5b6b7c4
mov byte [esp + 0x1c], 0
mov eax, 0x5b1a9b
mov ecx, 0x64
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x5b1a97]
mov ebx, ecx
and ebx, 0x38
mov edx, eax
and edx, 7
or edx, ebx
xor edx, 0x47
and edx, ecx
mov ebx, eax
or ebx, edi
not edx
and edx, edi
not ebx
or ebx, edx
mov dl, 0xf8
sub dl, bl
mov byte [esp + eax - 0x5b1a97], dl
inc eax
dec ecx
cmp eax, 0x5b1ab4
jne 0x4273b0
push 0
push 0
lea eax, [esp + 0xc]
push eax
push esi
push dword [esp + 0xac]
call fcn.00422090
add esp, 0x14
mov ebx, eax
jmp dword [0x44ae90]
Function at 0x428fe0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x840
xor ebp, ebp
xor edi, edi
mov eax, 0x20219
mov ecx, 1
mov dword [esp], 0
jmp dword [ecx*4 + 0x44b4c4]

Function at 0x429720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
movzx ecx, word [esi]
test cx, cx
je 0x429872
mov edx, dword [esp + 0x18]
dec edx
je 0x429872
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x429770
mov byte [eax], bl
lea ecx, [eax + 1]
jmp 0x429810
cmp ebx, 0x7ff
ja 0x4297a0
cmp edx, 2
jb 0x4297a0
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 2]
mov byte [eax + 1], bl
jmp 0x429810
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x429834
cmp edx, 4
jb 0x429834
movzx ebp, word [esi + 2]
add esi, 4
shl ebx, 0xa
add ebx, ebp
add ebx, 0xfca02400
mov ecx, ebx
shr ecx, 0x12
add cl, 0xf0
mov byte [eax], cl
mov edi, ebx
shr edi, 0xc
mov ecx, edi
not ecx
or ecx, 0x3f
add ecx, edi
add cl, 0x81
mov byte [eax + 1], cl
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [eax + 2], bl
mov bl, 0x3f
mov ecx, ebp
sub bl, cl
or bl, 0xc0
xor bl, 0x7f
lea ecx, [eax + 4]
mov byte [eax + 3], bl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
not esi
and esi, eax
not eax
and eax, ecx
sub edx, eax
add edx, esi
mov esi, edi
mov eax, ecx
movzx ecx, word [esi]
test cx, cx
je 0x429872
test edx, edx
jne 0x429750
jmp 0x429872
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x429843
mov esi, edi
jmp 0x429822
cmp edx, 3
jb 0x42986e
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 3]
mov byte [eax + 2], bl
jmp 0x429810
mov ecx, eax
jmp 0x429810
mov byte [eax], 0
sub eax, dword [esp + 0x14]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x429b60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.00429b80
add esp, 4
test al, al
je case.0x429c07.16
mov al, 1
ret
Function at 0x42c480
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xbc
mov dword [esp + 0x20], 0x4185476b
mov dword [esp + 0x24], 0x4dd243d0
mov dword [esp + 0x28], 0x49ad4f80
mov dword [esp + 0x2c], 0x75a94bd4
mov dword [esp + 0x30], 0x7192775b
mov dword [esp + 0x34], 0x7de37386
mov dword [esp + 0x38], 0x79917fe0
mov dword [esp + 0x3c], 0x65997be8
mov dword [esp + 0x40], 0x61b36788
mov dword [esp + 0x44], 0x6d8663b5
mov dword [esp + 0x48], 0x69816ff1
mov dword [esp + 0x4c], 0x15f76bf5
mov dword [esp + 0x50], 0x118717ff
mov dword [esp + 0x54], 0x1dc41386
mov dword [esp + 0x58], 0x19891f84
mov dword [esp + 0x5c], 0x51a1b8c
lea eax, [esp + 0x60]
mov byte [esp + 0x60], 0
mov ecx, 0x1849791
mov edx, 0x3e7b686e
nop
nop
nop
movzx esi, byte [esp + ecx - 0x1849771]
mov edi, edx
and edi, 0x2a216398
mov ebx, ecx
and ebx, 0x1808c67
or ebx, edi
xor ebx, 0xd5da8c67
lea edi, [ebx + ebx]
not edi
add edi, ebx
and edi, esi
lea ebx, [ecx - 0x1849700]
or ebx, esi
xor ebx, edi
add bl, 0x2b
mov byte [esp + ecx - 0x1849771], bl
inc ecx
dec edx
cmp ecx, 0x18497d2
jne 0x42c520
lea esi, [esp + 0x7c]
lea edx, [esp + 0x20]
mov edi, esi
mov ecx, 0x10
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xbc]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x78]
push edi
push 0
push 0
push 0x1f
push esi
push 0
call dword [0x44f6f8]
mov ebx, dword [esp + 0x78]
test ebx, ebx
jns 0x42c5ad
mov eax, 0xffffffff
jmp 0x42c5b0
lea eax, [ebx + ebx]
push eax
call fcn.0040c6f0
add esp, 4
mov ebp, eax
push edi
push ebx
push eax
push 0x1f
push esi
push 0
call dword [0x44f6f8]
lea eax, [esp + 0x1c]
push 0x60
push 3
push 0x120089
push eax
mov dword [esp + 0x84], ebp
push ebp
call fcn.00442a10
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b88c]