joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a6c3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4695dc
call fcn.004685c0
sub esp, 0xc0
push ebx
xor ebx, ebx
mov cl, 0x21
push esi
mov dword [ebp - 4], ebx
mov edx, ebx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1d], 0xb2bf8921
mov dword [ebp - 0x19], 0xadaabbb2
mov byte [ebp - 0x15], bl
not cl
xor byte [ebp + edx - 0x1c], cl
inc edx
cmp edx, 7
jae 0x41a704
mov cl, byte [ebp - 0x1d]
jmp 0x41a6f3
movaps xmm0, xmmword [0x47fd80]
mov edx, ebx
mov byte [ebp - 0x15], bl
movups xmmword [ebp - 0x41], xmm0
mov dword [ebp - 0x31], 0xe7e5e3f0
mov byte [ebp - 0x2d], bl
mov cl, byte [ebp - 0x41]
not cl
xor byte [ebp + edx - 0x40], cl
inc edx
cmp edx, 0x13
jb 0x41a71e
cmp dword [0x48aba8], 0x10
mov eax, 0x48ab94
mov byte [ebp - 0x2d], bl
cmovae eax, dword [0x48ab94]
push eax
call fcn.0044759e
pop ecx
lea edx, [ebp - 0x40]
mov ecx, eax
call fcn.004354d9
mov byte [ebp - 0x48], bl
lea edx, [ebp - 0x50]
push dword [ebp - 0x48]
mov edi, eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x50], edi
call fcn.004157f9
pop ecx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 1
call fcn.0040cd0e
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0
mov bl, al
call fcn.00413b3d
test bl, bl
je 0x41a8b4
call fcn.00435972
lea edx, [ebp - 0x1c]
mov ecx, eax
call fcn.004354d9
mov esi, eax
mov dword [ebp - 0x18], 0xf
xor ebx, ebx
lea ecx, [ebp - 0x2c]
push esi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00413d68
lea ecx, [ebp - 0x2c]
call fcn.0040d215
lea ecx, [ebp - 0x2c]
call fcn.00413d07
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.004354d9
mov esi, eax
mov dword [ebp - 0x22], 0xeee3d57d
mov dword [ebp - 0x4c], esi
mov cl, 0x7d
mov dword [ebp - 0x1e], 0xf1f6e7ee
mov edx, ebx
mov dword [ebp - 0x1a], 0xfae3c8de
mov word [ebp - 0x16], 0xfa
not cl
xor byte [ebp + edx - 0x21], cl
inc edx
cmp edx, 0xc
jae 0x41a805
mov cl, byte [ebp - 0x22]
jmp 0x41a7f4
mov byte [ebp - 0x15], bl
call fcn.00435972
lea edx, [ebp - 0x21]
mov ecx, eax
call fcn.004354d9
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], bl
call fcn.00413d68
lea ecx, [ebp - 0x44]
call fcn.0040d215
lea ecx, [ebp - 0x44]
call fcn.00413d07
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], bl
call fcn.00413d68
lea ecx, [ebp - 0x44]
call fcn.0040d215
lea ecx, [ebp - 0x44]
call fcn.00413d07
mov byte [ebp - 0x48], bl
lea edx, [ebp - 0x4c]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x44]
call fcn.004157f9
pop ecx
mov byte [ebp - 4], 2
lea edx, [ebp - 0x50]
mov byte [ebp - 0x4c], bl
lea ecx, [ebp - 0x68]
push dword [ebp - 0x4c]
call fcn.004157f9
pop ecx
push 0x12
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x68]
call fcn.0040d185
pop ecx
lea ecx, [ebp - 0x68]
call fcn.00413b3d
lea ecx, [ebp - 0x44]
call fcn.00413b3d
push esi
call fcn.0044061a
pop ecx
push edi
call fcn.0044061a
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x41a8db
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x469605
call fcn.004685c0
sub esp, 0xb0
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edx, ebx
movaps xmm0, xmmword [0x47fd10]
push esi
push edi
mov dword [ebp - 0x10], esp
movups xmmword [ebp - 0x57], xmm0
mov word [ebp - 0x47], 0xffff
mov byte [ebp - 0x45], bl
mov cl, byte [ebp - 0x57]
not cl
xor byte [ebp + edx - 0x56], cl
inc edx
cmp edx, 0x11
jb 0x41a90c
mov byte [ebp - 0x45], bl
mov cl, 0x1f
mov dword [ebp - 0x1d], 0x8c81b71f
mov edx, ebx
mov dword [ebp - 0x19], 0x9394858c
mov byte [ebp - 0x15], bl
not cl
xor byte [ebp + edx - 0x1c], cl
inc edx
cmp edx, 7
jae 0x41a944
mov cl, byte [ebp - 0x1d]
jmp 0x41a933
cmp dword [0x48aba8], 0x10
mov eax, 0x48ab94
mov byte [ebp - 0x15], bl
cmovae eax, dword [0x48ab94]
push eax
call fcn.0044759e
pop ecx
lea edx, [ebp - 0x56]
mov ecx, eax
call fcn.004354d9
mov byte [ebp - 0x21], bl
lea edx, [ebp - 0x2c]
push dword [ebp - 0x21]
mov edi, eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x2c], edi
call fcn.004157f9
pop ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.0040cd0e
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
mov bl, al
call fcn.00413b3d
test bl, bl
je 0x41aa63
call fcn.00435972
lea edx, [ebp - 0x1c]
mov ecx, eax
call fcn.004354d9
mov esi, eax
mov dword [ebp - 0x30], 0xf
xor ebx, ebx
lea ecx, [ebp - 0x44]
push esi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
call fcn.00413d68
lea ecx, [ebp - 0x44]
call fcn.0040d215
lea ecx, [ebp - 0x44]
call fcn.00413d07
lea edx, [ebp - 0x56]
mov ecx, esi
call fcn.004354d9
mov esi, eax
mov dword [ebp - 0x34], ebx
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], bl
call fcn.00413d68
lea ecx, [ebp - 0x44]
call fcn.0040d215
lea ecx, [ebp - 0x44]
call fcn.00413d07
mov byte [ebp - 0x21], bl
lea edx, [ebp - 0x28]
push dword [ebp - 0x21]
lea ecx, [ebp - 0x5c]
call fcn.004157f9
pop ecx
mov byte [ebp - 4], 2
lea edx, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
lea ecx, [ebp - 0x44]
push dword [ebp - 0x28]
call fcn.004157f9
pop ecx
push 0x12
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
call fcn.0040d185
pop ecx
lea ecx, [ebp - 0x44]
call fcn.00413b3d
lea ecx, [ebp - 0x5c]
call fcn.00413b3d
push esi
call fcn.0044061a
pop ecx
push edi
call fcn.0044061a
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x41ee5a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x41ee65
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x41ef21
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47b0f0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47b0f0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47b0f0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47b0f0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47b0f0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47b0f0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47b0f0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47b0f0]
sub edi, 1
jne 0x41ee7a
pop edi
test esi, esi
je 0x41ef3d
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47b0f0]
inc edx
sub esi, 1
jne 0x41ef25
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x41ef44
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x47b0f0]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47b0f0]
mov dword [edi + 8], ecx
pop edi
pop esi
ret
Function at 0x42809b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov edi, ecx
call fcn.004270b6
mov cl, byte [edi]
cmp cl, 1
je 0x428146
cmp cl, 2
je 0x4280f3
lea eax, [ecx - 3]
cmp al, 4
ja 0x428173
cmp cl, 3
jne 0x4280e7
mov ecx, dword [edi + 8]
call fcn.00413d07
push 0x18
push dword [edi + 8]
call fcn.004152f0
and dword [edi + 8], 0
pop ecx
pop ecx
mov ecx, edi
mov byte [edi], 0
call fcn.00424259
jmp 0x42816a
mov esi, dword [edi + 8]
mov ecx, dword [ebp + 0x14]
add esi, 4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], esi
mov edi, dword [esi]
lea eax, [ecx + 0x10]
cmp eax, edi
je 0x428133
mov esi, ecx
mov ebx, eax
sub esp, 0x10
mov ecx, esp
push ebx
call fcn.004241d3
mov ecx, esi
call fcn.00424955
add ebx, 0x10
add esi, 0x10
cmp ebx, edi
jne 0x42810f
mov esi, dword [ebp - 8]
mov ebx, dword [ebp + 8]
mov edi, dword [esi]
lea ecx, [edi - 0x10]
call fcn.00423e6b
add dword [esi], 0xfffffff0
mov eax, dword [ebp - 0xc]
mov dword [ebx + 8], eax
jmp 0x42816a
mov esi, dword [ebp + 0x10]
lea ecx, [ebp + 8]
mov dword [ebp + 8], esi
call fcn.00424a83
mov ecx, dword [edi + 8]
push esi
call fcn.004298c7
mov edx, eax
call fcn.00429b7a
mov ecx, dword [ebp + 8]
mov dword [ebx + 4], ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x14
push 0x1d50
call fcn.0044786f
int3
Function at 0x429fc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x46a529
call fcn.004685c0
sub esp, 0xcc
push ebx
mov ebx, dword [0x46d158]
push esi
push edi
mov esi, edx
mov dword [ebp - 0x14], ecx
push esi
call ebx
test eax, eax
je 0x42a16b
push dword [ebp + 8]
call ebx
test eax, eax
je 0x42a16b
mov ebx, dword [0x46d2d4]
mov edi, esi
push 7
push 0x47dc48
push esi
call ebx
test eax, eax
jne 0x42a00f
lea edi, [esi + 0xe]
push 0x12
push 0x47dc58
push esi
call ebx
test eax, eax
jne 0x42a020
add edi, 0x24
push 6
push 0x47dc80
push edi
call ebx
test eax, eax
jne 0x42a16b
mov ebx, dword [ebp - 0x14]
lea edx, [ebp - 0xe]
mov cl, 0x75
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xf], cl
mov al, 0x80
not cl
mov byte [ebp - 0xd], 0
xor al, cl
mov ecx, ebx
push 1
mov byte [ebp - 0xe], al
call fcn.004357e2
mov esi, dword [0x46d158]
pop ecx
push edi
call esi
push eax
mov edx, edi
mov ecx, ebx
call fcn.00435725
pop ecx
mov cl, 0x55
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xf], cl
lea edx, [ebp - 0xe]
not cl
mov byte [ebp - 0xd], 0
mov al, 0xa0
xor al, cl
mov ecx, ebx
push 1
mov byte [ebp - 0xe], al
call fcn.004357e2
pop ecx
push dword [ebp + 8]
call esi
mov edx, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.00435725
lea ecx, [ebp - 0xd8]
call fcn.004126c0
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, ebx
movaps xmm0, xmmword [0x47f840]
movups xmmword [ebp - 0x25], xmm0
mov byte [ebp - 0x15], bl
mov al, byte [ebp - 0x25]
not al
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0xf
jb 0x42a0bf
mov byte [ebp - 0x15], bl
call fcn.00435972
push ecx
push ecx
lea edx, [ebp - 0x24]
mov ecx, eax
call fcn.004354d9
push eax
lea ecx, [ebp - 0xd8]
call fcn.00412630
mov ecx, edi
call fcn.00435869
mov edx, eax
lea ecx, [ebp - 0xd8]
call fcn.00414769
mov dl, 4
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xf], dl
lea ecx, [ebp - 0xd8]
not dl
mov al, 0xf1
xor al, dl
lea edx, [ebp - 0xe]
mov byte [ebp - 0xe], al
call fcn.00414769
mov ecx, dword [ebp + 8]
call fcn.00435869
mov edx, eax
lea ecx, [ebp - 0xd8]
call fcn.00414769
mov cl, 0x46
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x13], cl
lea edx, [ebp - 0x12]
not cl
mov al, 0xb3
xor al, cl
lea ecx, [ebp - 0xd8]
mov byte [ebp - 0x12], al
call fcn.00414769
lea ecx, [ebp - 0xd8]
call fcn.00412600
lea ecx, [ebp - 0xd8]
call fcn.0041179a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x42a17a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x46a550
call fcn.004685c0
sub esp, 0x194
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edx - 1]
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.004126c0
and dword [ebp - 4], 0
mov ebx, 0x47a41b
sub esi, 3
je 0x42a25b
sub esi, 1
je 0x42a248
sub esi, 1
jne 0x42a395
mov ecx, dword [ebp + 0x14]
call fcn.00435869
mov ecx, dword [ebp + 0xc]
mov edi, eax
call fcn.00435869
mov ecx, dword [ebp + 8]
mov esi, eax
call fcn.00435869
push edi
mov edx, esi
mov ecx, eax
call fcn.00435cba
movaps xmm0, xmmword [0x47fba0]
mov esi, eax
movups xmmword [ebp - 0x3c], xmm0
pop ecx
movaps xmm0, xmmword [0x47f170]
xor ecx, ecx
movups xmmword [ebp - 0x2c], xmm0
mov al, byte [ebp - 0x3c]
not al
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x1e
jb 0x42a203
mov edi, 0x48eb10
mov byte [ebp - 0x1d], 0
lea edx, [ebp - 0x3b]
mov ecx, edi
call fcn.00414769
mov edx, 0x48b3a4
mov ecx, eax
call fcn.00414ab7
mov edx, esi
mov ecx, edi
call fcn.00414769
inc dword [0x48ead8]
push esi
call fcn.0044061a
jmp 0x42a255
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.00429fc0
pop ecx
jmp 0x42a395
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
mov esi, dword [ecx]
add eax, esi
mov edx, dword [ecx + 4]
add eax, edx
cmp dword [ebp + 0x10], eax
jb 0x42a395
mov edi, dword [ecx + 0x14]
lea eax, [ecx + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [esi + edx]
add eax, ecx
shr edi, 1
mov dword [ebp - 0x1c], eax
je 0x42a395
mov ecx, dword [ebp + 8]
call fcn.00435869
mov edx, eax
mov ecx, ebx
call fcn.004354d9
mov dl, 0x54
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x13], dl
mov cl, 0xa1
not dl
mov byte [ebp - 0x11], 0
xor cl, dl
lea edx, [ebp - 0x12]
mov byte [ebp - 0x12], cl
mov ecx, eax
call fcn.004354d9
mov ebx, dword [ebp - 0x18]
mov esi, eax
mov ecx, dword [ebx]
add ecx, dword [ebp - 0x1c]
call fcn.00435869
mov edx, eax
mov ecx, esi
call fcn.004354d9
add ebx, 0x20
mov dword [ebp - 0x10], 0xe1e114
mov esi, eax
mov dword [ebp - 0x18], ebx
mov cl, 0x14
xor edx, edx
not cl
xor byte [ebp + edx - 0xf], cl
inc edx
cmp edx, 2
jae 0x42a2f9
mov cl, byte [ebp - 0x10]
jmp 0x42a2e8
lea edx, [ebp - 0xf]
mov byte [ebp - 0xd], 0
mov ecx, esi
call fcn.004354d9
push ecx
lea ecx, [ebp - 0xf0]
mov ebx, eax
call fcn.004126c0
mov byte [ebp - 4], 1
xor edx, edx
movaps xmm0, xmmword [0x47fd00]
movups xmmword [ebp - 0x2d], xmm0
mov byte [ebp - 0x1d], 0
mov cl, byte [ebp - 0x2d]
not cl
xor cl, byte [ebp + edx - 0x2c]
mov byte [ebp + edx - 0x2c], cl
inc edx
cmp edx, 0xf
jb 0x42a32a
mov byte [ebp - 0x1d], 0
call fcn.00435972
push ecx
push ecx
lea edx, [ebp - 0x2c]
mov ecx, eax
call fcn.004354d9
push eax
lea ecx, [ebp - 0xf0]
call fcn.00412630
mov edx, ebx
lea ecx, [ebp - 0xf0]
call fcn.00414769
push ebx
call fcn.0044061a
pop ecx
lea ecx, [ebp - 0xf0]
call fcn.00412600
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0
call fcn.0041179a
sub edi, 1
jne 0x42a28c
lea ecx, [ebp - 0x1a0]
call fcn.0041179a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4346b1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x11], 0x8582a10e
push edi
mov edi, ecx
mov dword [ebp - 0xd], 0x9294839e
mov al, 0xe
mov dword [ebp - 9], 0x9d9d95df
mov byte [ebp - 5], bl
mov ecx, ebx
not al
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 0xb
jae 0x4346eb
mov al, byte [ebp - 0x11]
jmp 0x4346da
lea eax, [ebp - 0x10]
mov byte [ebp - 5], bl
push eax
call dword [0x46d1ac]
mov esi, eax
test esi, esi
je 0x434769
movaps xmm0, xmmword [str.SMTP_Password2]
mov ecx, ebx
movups xmmword [ebp - 0x27], xmm0
mov dword [ebp - 0x17], 0xb6bbb4a1
mov word [ebp - 0x13], 0xb0
mov al, byte [ebp - 0x27]
not al
xor byte [ebp + ecx - 0x26], al
inc ecx
cmp ecx, 0x14
jb 0x434718
lea eax, [ebp - 0x26]
mov byte [ebp - 0x12], bl
push eax
push esi
call dword [0x46d1a4]
test eax, eax
je 0x434762
push ebx
push ebx
push ebx
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
push ecx
call eax
test eax, eax
js 0x434762
mov edx, dword [ebp - 4]
test edx, edx
je 0x434762
push ecx
mov ecx, edi
call fcn.004345b4
mov eax, dword [ebp - 4]
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call dword [0x46d198]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x435972
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
xor ebx, ebx
mov dword [ebp - 0xd], 0xb4a2a40e
mov al, 0xe
mov dword [ebp - 9], 0xbea3a1a3
mov dword [ebp - 5], 0xb4bdb8b7
mov ecx, ebx
mov byte [ebp - 1], bl
not al
xor byte [ebp + ecx - 0xc], al
inc ecx
cmp ecx, 0xb
jae 0x4359ab
mov al, byte [ebp - 0xd]
jmp 0x43599a
push 0x104
lea eax, [ebp - 0x120]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 0xc]
push eax
call dword [0x46d0e8]
movaps xmm0, xmmword [str.HTTP_Server_URL]
xor ecx, ecx
cmp ecx, eax
mov dword [ebp - 4], 0x83a8b0
lea eax, [ebp - 0x120]
mov edx, ebx
sbb ecx, ecx
and ecx, eax
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
not al
xor byte [ebp + edx - 0x13], al
inc edx
cmp edx, 0x12
jb 0x4359e6
lea edx, [ebp - 0x13]
mov byte [ebp - 1], bl
call fcn.004354d9
pop ebx
leave
ret
Function at 0x4387e1
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x46b255
call fcn.004685c0
sub esp, 0xbc
push ebx
push esi
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], 0xf
mov byte [ebp - 0x64], bl
xor eax, eax
mov edx, ebx
inc eax
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x47fdf0]
movups xmmword [ebp - 0x85], xmm0
mov dword [ebp - 0x24], 0x40
movaps xmm0, xmmword [0x47fe30]
mov dword [ebp - 0x28], eax
movups xmmword [ebp - 0x75], xmm0
mov byte [ebp - 0x65], bl
mov cl, byte [ebp - 0x85]
not cl
xor byte [ebp + edx - 0x84], cl
inc edx
cmp edx, 0x1f
jb 0x438838
push edi
lea eax, [ebp - 0x20]
mov byte [ebp - 0x65], bl
push eax
push 0x20119
push ebx
lea eax, [ebp - 0x84]
push eax
push 0x80000002
call dword [0x46d01c]
mov edi, eax
mov dword [ebp - 0x19], 0xd2d0fc4e
mov cl, 0x4e
mov dword [ebp - 0x15], 0xd4dfd8d9
mov dword [ebp - 0x11], 0xd5d8c4f6
mov edx, ebx
mov byte [ebp - 0xd], bl
not cl
xor byte [ebp + edx - 0x18], cl
inc edx
cmp edx, 0xb
jae 0x43889c
mov cl, byte [ebp - 0x19]
jmp 0x43888b
lea eax, [ebp - 0x24]
mov byte [ebp - 0xd], bl
push eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x20]
call dword [0x46d00c]
test edi, edi
pop edi
jne 0x4388d4
test eax, eax
jne 0x4388d4
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x64]
call fcn.00413d68
push dword [ebp - 0x20]
call dword [0x46d030]
lea eax, [ebp - 0x64]
mov dword [ebp - 0x38], ebx
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], ebx
call fcn.00413de2
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
push 0x47a41b
mov byte [esi], bl
call fcn.00413d68
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
cmp byte [eax + ebx], 0
je 0x438949
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
movsx eax, byte [eax + ebx]
push eax
call fcn.00451d94
pop ecx
mov byte [ebp - 0x30], al
mov ecx, esi
push dword [ebp - 0x30]
call fcn.00413d2d
inc ebx
jmp 0x438912
lea ecx, [ebp - 0x48]
call fcn.00413d07
lea ecx, [ebp - 0x64]
call fcn.00413d07
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x438d56
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
push ebx
push edi
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x90]
push ebx
push eax
call fcn.004436b0
xor eax, eax
lea edi, [ebp - 0x4c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x104
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x194]
push eax
push ebx
call dword [0x46d0b8]
movaps xmm0, xmmword [0x47fb80]
mov ecx, ebx
movups xmmword [ebp - 0x3a], xmm0
mov dword [ebp - 0xa], 0xdc828dcb
movaps xmm0, xmmword [0x47fd50]
movups xmmword [ebp - 0x2a], xmm0
mov dword [ebp - 6], 0xde888f8d
movaps xmm0, xmmword [0x47f730]
movups xmmword [ebp - 0x1a], xmm0
mov word [ebp - 2], 0x8f
mov al, byte [ebp - 0x3a]
not al
xor byte [ebp + ecx - 0x39], al
inc ecx
cmp ecx, 0x38
jb 0x438dc8
lea eax, [ebp - 0x194]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 0x39]
push eax
lea eax, [ebp - 0x39c]
push 0x208
push eax
call fcn.0043547c
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x90]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x39c]
push eax
push ebx
call dword [0x46d104]
push dword [ebp - 0x48]
call dword [0x46d168]
push dword [ebp - 0x4c]
call dword [0x46d168]
pop edi
pop ebx
leave
ret

Function at 0x43acb1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, edx
lea eax, [ecx - 1]
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
mov esi, edi
sar eax, 1
mov dword [ebp - 8], eax
cmp edi, eax
jge 0x43ad0c
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x18
add ecx, ebx
lea edx, [ecx - 0x18]
call fcn.00429d04
movzx eax, al
xor eax, 1
imul ecx, edi, 0x18
inc eax
add esi, eax
imul eax, esi, 0x18
add ecx, ebx
add eax, ebx
push eax
call fcn.004133ce
mov eax, dword [ebp - 8]
mov edi, esi
cmp esi, eax
jl 0x43acd5
mov ecx, dword [ebp + 8]
cmp esi, eax
jne 0x43ad2b
test cl, 1
jne 0x43ad2b
imul eax, ecx, 0x18
imul ecx, edi, 0x18
add eax, 0xffffffe8
add eax, ebx
add ecx, ebx
push eax
call fcn.004133ce
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 4], edi
jge 0x43ad5f
mov edx, dword [ebp + 0xc]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0x18
add eax, ebx
mov ecx, eax
mov dword [ebp + 8], eax
call fcn.00429d04
test al, al
je 0x43ad5f
push dword [ebp + 8]
imul ecx, edi, 0x18
add ecx, ebx
call fcn.004133ce
mov edi, esi
cmp dword [ebp - 4], esi
jl 0x43ad30
push dword [ebp + 0xc]
imul ecx, edi, 0x18
add ecx, ebx
call fcn.004133ce
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43c206
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
push esi
push edi
mov esi, ecx
lea eax, [ebx - 1]
cmp eax, 7
jbe 0x43c222
mov dword [esi + 0x6afa4], str.string
xor edi, edi
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x43c246
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
mov dword [esi + 0x6af6c], edi
push edi
push eax
call fcn.004436b0
movzx eax, word [ebx*8 + 0x47cdfa]
add esp, 0xc
mov dword [esi + 0x6af98], eax
movzx eax, word [ebx*8 + 0x47cdf8]
mov dword [esi + 0x6af9c], eax
movzx eax, word [ebx*8 + 0x47cdfc]
push 2
mov dword [esi + 0x6afa0], eax
movzx eax, word [ebx*8 + 0x47cdfe]
pop ecx
mov dword [esi + 0x6af94], eax
cmp ebx, ecx
jg 0x43c2a9
mov eax, dword [ebp + 8]
or word [eax], 4
jmp 0x43c2b4
cmp ebx, 8
jl 0x43c2b4
mov eax, dword [ebp + 8]
or word [eax], cx
mov eax, dword [esi + 0xc]
lea ebx, [esi + 0x1af70]
push 0x10000
push ebx
push esi
mov dword [esi + 0x6af84], edi
mov dword [esi + 0x6af74], edi
call eax
add esp, 0xc
mov dword [esi + 0x6af90], eax
test eax, eax
je 0x43c31d
cmp eax, 0xffffffff
je 0x43c31d
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x43c2f8
mov ecx, esi
call fcn.0043c4ec
mov dword [esi + 0x6af7c], edi
mov ecx, edi
movzx eax, byte [ebx + edi]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc edi
mov dword [esi + 0x6af7c], ecx
cmp edi, 2
jb 0x43c300
jmp 0x43c32d
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret