joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc4e1d4
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push esi
push edi
push 7
pop ecx
mov esi, str.resource_deadlock_would_occur
mov dword [ebp - 0x20], 0xb520a58
lea edi, [ebp - 0x4c]
mov dword [ebp - 0x1c], 0x564569a5
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], 0xb3bfadb1
mov dword [ebp - 0x14], 0xad6e65f
mov dword [ebp - 0x10], 0xca0a05dc
movsw word es:[edi], word [esi]
mov esi, dword [0xc78500]
add esi, 0x6d4db6fa
mov dword [ebp - 0xc], 0x217fb611
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [0xc784f4], esi
mov ecx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], eax
mov byte [ebp + ecx - 0x14c], cl
inc ecx
cmp ecx, 0x100
jb 0xc4e237
mov edi, eax
xor edx, edx
mov dword [ebp - 0x28], 0x1d
mov eax, edi
mov cl, byte [ebp + edi - 0x14c]
div dword [ebp - 0x28]
mov byte [ebp - 1], cl
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x4c]
add eax, dword [ebp - 8]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 8], ecx
mov al, byte [ebp + ecx - 0x14c]
mov byte [ebp + edi - 0x14c], al
inc edi
mov al, byte [ebp - 1]
mov byte [ebp + ecx - 0x14c], al
cmp edi, 0x100
jb 0xc4e249
xor eax, eax
mov dword [ebp - 8], eax
mov esi, eax
mov edi, eax
lea eax, [esi + 1]
movzx esi, al
mov eax, dword [ebp - 8]
mov cl, byte [ebp + esi - 0x14c]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 8], eax
mov al, byte [ebp + eax - 0x14c]
mov byte [ebp + esi - 0x14c], al
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x14c], cl
movzx eax, byte [ebp + esi - 0x14c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x14c]
xor al, byte [ebp + edi - 0x20]
mov byte [ebp + edi - 0x48], al
inc edi
cmp edi, 0x18
jb 0xc4e29e
mov esi, dword [ebp - 0x2c]
xor eax, eax
xor esi, 0xca7019e4
mov byte [ebp - 0x30], al
mov edi, eax
mov dword [0xc78500], esi
cmp dword [ebp + 8], eax
jne 0xc4e326
mov dword [ebp - 0x24], 5
mov edi, 0xe8
mov dword [0xc78500], 0x5232da6
jmp 0xc4e347
cmp dword [ebp + 8], 1
jne 0xc4e347
mov dword [ebp - 0x24], 5
call fcn.00c4d781
mov dword [0xc78500], 0x8d12c9be
mov edi, 0xba
xor ecx, ecx
lea edx, [ebp - 0x48]
inc ecx
call fcn.00c4ba1b
call eax
add eax, dword [0xc773c0]
mov esi, dword [ebp - 0x24]
mov dword [ebp + 8], eax
mov edx, dword [0xc773c0]
lea eax, [ebp + 8]
push eax
call fcn.00c4e1b6
pop ecx
mov eax, dword [eax*8 + 0xc773c8]
add eax, esi
add eax, dword [0xc78cdc]
movzx ecx, byte [eax]
cmp ecx, edi
jne 0xc4e360
pop edi
pop esi
leave
ret
Function at 0xc5022d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0xc7859c]
push ebx
mov ebx, ecx
push esi
mov dl, byte [ebx]
mov byte [ebp - 1], dl
test dl, dl
je 0xc50250
and eax, 0xa1b78a9d
inc ecx
cmp byte [ecx], 0
jne 0xc50245
push edi
mov esi, 0xc6f58c
lea edi, [ebp - 0x18]
xor ecx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp dl, byte [ebp - 0x18]
jne 0xc5029b
test dl, dl
je 0xc5027b
cmp byte [ebp + ecx - 0x18], 0
je 0xc5027b
inc ecx
mov dl, byte [ebx + ecx]
cmp dl, byte [ebp + ecx - 0x18]
je 0xc50266
mov edx, dword [ebp - 8]
cmp edx, ecx
jae 0xc50298
cmp edx, 0x2386
jne 0xc50290
imul eax, eax, 0xeb4a7e7a
and eax, 0xd7ca29a4
inc edx
jmp 0xc5027e
mov dl, byte [ebp - 1]
mov esi, 0xc72cd8
lea edi, [ebp - 0x18]
xor ecx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp dl, byte [ebp - 0x18]
jne 0xc502e1
test dl, dl
je 0xc502c4
cmp byte [ebp + ecx - 0x18], 0
je 0xc502c4
inc ecx
mov dl, byte [ebx + ecx]
cmp dl, byte [ebp + ecx - 0x18]
je 0xc502af
mov edx, dword [ebp - 8]
jmp 0xc502dd
cmp edx, 0xb0d
jne 0xc502d6
sub eax, 0x788478d6
imul eax, eax, 0xf2ba0fdd
inc edx
cmp edx, ecx
jb 0xc502c9
xor ecx, ecx
add eax, 0x887b49ae
mov esi, ecx
imul edx, eax, 0x38240390
and edx, 0x39e6dc94
inc esi
cmp byte [esi + 0xc73260], cl
jne 0xc502f0
mov eax, edx
lea edi, [ebp - 0x54]
or eax, 0x9b47ff66
and edx, 0x16c0e453
cmp esi, 0x148a
mov esi, 0xc6f264
push 0xf
cmovbe edx, eax
mov eax, ecx
pop ecx
or edx, 0x789b4e37
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x54], 0x4c
jne 0xc50368
mov cl, 0x4c
test cl, cl
je 0xc5034a
cmp byte [ebp + eax - 0x54], 0
je 0xc5034a
mov cl, byte [eax + 0xc73101]
inc eax
cmp cl, byte [ebp + eax - 0x54]
je 0xc50332
mov ecx, dword [ebp - 8]
jmp 0xc50364
cmp ecx, 0x20fd
jne 0xc5035d
and edx, 0x19adf896
and edx, 0x7714ff3e
inc ecx
cmp ecx, eax
jb 0xc5034f
mov eax, 0xc73260
and edx, 0x866824df
inc eax
cmp byte [eax], 0
jne 0xc5036d
xor ecx, ecx
mov eax, ecx
xor edx, 0x9f8d5051
inc eax
cmp byte [eax + str.onecoreuap_baseAppModelSearchcommonincludeTPKPHMAP.hxx], cl
jne 0xc5037d
mov dword [0xc7859c], edx
cmp eax, 0x10d8
jae 0xc503a1
imul eax, edx, 0x4015442f
jmp 0xc503a7
lea eax, [edx + 0x1ab3c78a]
xor eax, 0xe9001482
inc ecx
cmp byte [ecx + 0xc73100], 0
jne 0xc503a7
mov edx, dword [ebp - 8]
mov esi, eax
mov dword [0xc7859c], eax
cmp edx, ecx
jae 0xc503e9
mov edi, eax
mov eax, edi
cmp edx, 0x1f3b
jne 0xc503d6
lea eax, [esi - 0x39cd9bf0]
and eax, 0xb2f099ff
inc edx
mov dword [0xc7859c], eax
mov esi, eax
mov edi, esi
cmp edx, ecx
jb 0xc503c6
cmp byte [ebp - 1], 0
pop edi
je 0xc50414
mov ecx, ebx
add eax, 0x5d1eb4b1
inc ecx
cmp byte [ecx], 0
jne 0xc503f2
mov dword [0xc7859c], eax
or eax, 0xa8fea0d
inc ebx
cmp byte [ebx], 0
jne 0xc50402
mov dword [0xc7859c], eax
jmp 0xc50416
mov eax, esi
and eax, 0x9016d420
xor eax, 0x31dbb6ff
pop esi
mov dword [0xc7859c], eax
pop ebx
leave
ret
Function at 0xc50429
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0xc7857c]
mov ecx, 0xc73174
xor eax, 0x70f836ed
imul eax, eax, 0x3c3dd757
xor edx, edx
lea ecx, [ecx + 2]
add eax, 0x583d2423
cmp word [ecx], dx
jne 0xc50440
xor eax, 0xc4717c6c
mov ecx, 0xc731b0
lea ecx, [ecx + 2]
or eax, 0xd87d5fb8
cmp word [ecx], dx
jne 0xc50457
xor eax, 0xa65f7493
mov ecx, edx
imul eax, eax, 0x607138a1
xor eax, 0x57970839
inc ecx
cmp word [ecx*2 + 0xc73174], dx
jne 0xc50471
cmp ecx, 0x1142
jae 0xc50490
or eax, 0x4ac76027
jmp 0xc50496
imul eax, eax, 0x72ec4203
mov ecx, edx
or eax, 0x835e3176
add eax, 0x321f0e27
inc ecx
cmp word [ecx*2 + 0xc731b0], dx
jne 0xc5049d
cmp ecx, 0x1969
jae 0xc504bc
xor eax, 0xd92506ae
jmp 0xc504c2
imul eax, eax, 0x18da97e
imul eax, eax, 0x5aa5427a
mov ecx, 0xaca930da
sub ecx, eax
mov eax, 0xc73490
lea eax, [eax + 2]
or ecx, 0x9462a1db
cmp word [eax], dx
jne 0xc504d4
mov dword [0xc7857c], ecx
mov eax, ecx
ret
Function at 0xc581fc
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x3c], 0x72e2c465
push edi
mov dword [ebp - 0x38], 0x4e7536d9
mov edi, eax
mov dword [ebp - 0x34], 0xc7abe353
mov ecx, eax
mov dword [ebp - 0x30], 0x34dfb7b1
mov dword [ebp - 0x2c], 0xa4d40194
mov dword [ebp - 0x28], 0x9b4d6671
mov dword [ebp - 0x24], 0x5dca236c
mov dword [ebp - 0x20], 0x5acca815
mov dword [ebp - 0x1c], 0x8602b0a9
mov dword [ebp - 0x18], 0xdfea3459
mov dword [ebp - 0x14], 0x65e5069c
mov dword [ebp - 0xc], 0x7373656d
mov dword [ebp - 8], 0x656761
mov byte [ebp + ecx - 0x17c], cl
inc ecx
cmp ecx, 0x100
jb 0xc58269
mov esi, eax
xor edx, edx
mov bl, byte [ebp + esi - 0x17c]
push 7
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0xc]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x17c]
mov byte [ebp + esi - 0x17c], al
inc esi
mov byte [ebp + edi - 0x17c], bl
cmp esi, 0x100
jb 0xc5827b
mov esi, dword [0xc786b8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ebx
lea eax, [ebx + 1]
imul esi, esi, 0x51b5868a
movzx ebx, al
mov eax, dword [ebp - 4]
mov cl, byte [ebp + ebx - 0x17c]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 4], eax
mov al, byte [ebp + eax - 0x17c]
mov byte [ebp + ebx - 0x17c], al
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x17c], cl
movzx eax, byte [ebp + ebx - 0x17c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x17c]
xor al, byte [ebp + edi - 0x3c]
mov byte [ebp + edi - 0x7c], al
inc edi
cmp edi, 0x2c
jb 0xc582c5
push esi
xor ebx, ebx
mov dword [ebp - 8], esi
push 0xf3a1ee67
mov edx, 0xc73ee0
mov byte [ebp - 0x50], bl
call fcn.00c56941
pop ecx
pop ecx
push 0xf
pop ecx
mov esi, 0xc6f448
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
push 0x6d
pop ecx
mov edx, ebx
movsw word es:[edi], word [esi]
mov esi, 0xc73f80
mov dword [ebp - 4], edx
cmp cx, word [ebp - 0x4c]
jne 0xc58390
mov eax, ebx
test cx, cx
je 0xc58390
cmp word [ebp + eax - 0x4c], bx
je 0xc58390
push ecx
mov edx, esi
mov ecx, 0xc73ee0
call fcn.00c56392
mov edx, dword [ebp - 4]
inc edx
pop ecx
mov dword [ebp - 4], edx
lea eax, [edx + edx]
movzx ecx, word [eax + 0xc73ee0]
cmp cx, word [ebp + eax - 0x4c]
je 0xc5835e
movzx eax, byte [ebp + edx*2 - 0x4c]
movzx ecx, byte [edx*2 + 0xc73ee0]
sub ecx, eax
cmp ecx, 0x1ad9
jne 0xc583b7
push esi
call fcn.00c56a34
mov eax, dword [ebp - 8]
or eax, 0xfd841c6a
jmp 0xc583cc
push ecx
mov edx, esi
mov ecx, 0xc73ee0
call fcn.00c5623d
mov eax, dword [ebp - 8]
add eax, 0x9e95ed31
xor esi, esi
mov dword [0xc786b8], eax
pop ecx
inc esi
lea edx, [ebp - 0x7c]
mov ecx, esi
call fcn.00c4ba1b
call eax
movzx eax, ax
mov ecx, 0x419
cmp ax, cx
je 0xc583f9
add ecx, 9
cmp ax, cx
cmove ebx, esi
mov esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0xc5c24a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0xc78880]
sub esp, 0x18
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
mov edx, esi
xor eax, 0x9debc0b7
inc edx
cmp byte [edx + 0xc742a0], 0
jne 0xc5c25e
cmp edx, 0x1877
jne 0xc5c27d
imul eax, eax, 0x4e310c3e
jmp 0xc5c282
xor eax, 0x1b2c9f57
movzx edi, word [ebx]
mov edx, esi
mov ecx, edi
mov dword [ebp - 4], ecx
mov ecx, eax
test di, di
je 0xc5c2d9
add eax, 0x9e50c19c
inc edx
cmp word [ebx + edx*2], si
jne 0xc5c293
mov esi, dword [ebp - 4]
mov ecx, eax
mov dword [0xc78880], eax
cmp esi, edx
jae 0xc5c2d7
mov edi, eax
mov eax, ecx
cmp esi, 0x198
jne 0xc5c2c0
mov eax, edi
and eax, 0xdce4e6cb
or eax, 0xa0ae71b9
inc esi
mov ecx, eax
cmp esi, edx
jb 0xc5c2ad
xor esi, esi
mov dword [0xc78880], eax
mov edx, esi
jmp 0xc5c2e0
xor esi, esi
mov edx, esi
test di, di
je 0xc5c307
mov ecx, eax
or ecx, 0x374177ba
inc edx
mov dword [0xc78880], ecx
mov eax, ecx
cmp word [ebx + edx*2], si
jne 0xc5c2e0
cmp edx, 0x26b7
jb 0xc5c307
and ecx, 0x38163d8
jmp 0xc5c30d
or ecx, 0x16d3754a
and ecx, 0xad984573
mov eax, esi
add ecx, 0x497ca1ae
inc eax
mov edx, ecx
add ecx, 0x1c368d9
cmp word [eax*2 + str.SrchCollatorAdmin], si
jne 0xc5c31b
cmp eax, 0x13de
jne 0xc5c343
imul ecx, edx, 0x2db9faaa
sub ecx, 0x160775e6
jmp 0xc5c349
lea ecx, [edx - 0x2c2757f7]
movzx eax, word [ebx]
lea edi, [ebp - 0x18]
mov edx, esi
add ecx, 0x622d3ce3
mov esi, str.iostream
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp ax, word [ebp - 0x18]
jne 0xc5c3aa
mov eax, dword [ebp - 4]
xor edi, edi
movzx esi, ax
mov eax, edi
test si, si
je 0xc5c38d
cmp word [ebp + eax - 0x18], di
je 0xc5c38d
inc edx
lea eax, [edx + edx]
movzx esi, word [eax + ebx]
cmp si, word [ebp + eax - 0x18]
je 0xc5c372
mov eax, dword [ebp - 4]
jmp 0xc5c3a6
cmp eax, 0xb1e
jne 0xc5c39f
and ecx, 0xb267a1f9
xor ecx, 0x6c545e06
inc eax
cmp eax, edx
jb 0xc5c392
imul eax, ecx, 0xfffd74eb
and eax, 0x1c08100
or eax, 0xf627767d
xor eax, 0x97f4861c
sub eax, 0x730474f9
mov dword [0xc78880], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
pop edi
pop esi
pop ebx
leave
ret
Function at 0xc5c844
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov ecx, dword [0xc78894]
xor edx, edx
imul esi, ecx, 0xbfe35d95
mov eax, edx
mov dword [ebp - 0xc], edi
mov dword [0xc787d0], esi
inc eax
cmp byte [eax + str.protocol_error], dl
jne 0xc5c86d
cmp dword [ebp + 8], eax
jae 0xc5c887
lea esi, [ecx - 0x6118995b]
mov dword [0xc787d0], esi
mov al, byte [edi]
lea edi, [ebp - 0x40]
mov byte [ebp - 1], al
lea eax, [esi - 0x6f4f747b]
push 7
pop ecx
mov esi, 0xc6ffe0
and eax, 0x7b72c1c7
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x20], eax
lea eax, [ebx - 0x199b6bce]
push 0x6f
mov dword [ebp - 8], eax
mov eax, edx
movsw word es:[edi], word [esi]
pop esi
cmp si, word [ebp - 0x40]
jne 0xc5c8f9
mov ecx, edx
test si, si
je 0xc5c8dd
cmp word [ebp + ecx - 0x40], dx
je 0xc5c8dd
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + 0xc746f0]
cmp si, word [ebp + ecx - 0x40]
je 0xc5c8bf
cmp dword [ebp + 8], eax
jae 0xc5c8f9
sub eax, dword [ebp + 8]
lea ecx, [ebx - 0x199b6bce]
and ecx, 0xa15ce67e
sub eax, 1
jne 0xc5c8eb
mov dword [ebp - 8], ecx
mov cl, byte [ebp - 1]
lea edi, [ebp - 0x1c]
mov esi, str.FailFast
mov eax, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0xc]
cmp cl, byte [ebp - 0x1c]
jne 0xc5c925
test cl, cl
je 0xc5c925
cmp byte [ebp + eax - 0x1c], dl
je 0xc5c925
inc eax
mov cl, byte [esi + eax]
cmp cl, byte [ebp + eax - 0x1c]
je 0xc5c911
movzx ecx, byte [eax + esi]
movzx eax, byte [ebp + eax - 0x1c]
sub ecx, eax
cmp ecx, 0x1f0f
ja 0xc5c941
imul eax, ebx, 0x55159d74
mov dword [ebp - 8], eax
push 0x17
pop ecx
mov esi, 0xc72558
mov dword [ebp - 0x10], edx
lea edi, [ebp - 0xa0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp + 8]
movzx eax, word [edi]
mov ecx, eax
cmp ax, word [ebp - 0xa0]
jne 0xc5c991
mov esi, ecx
mov eax, edx
mov ecx, edx
test si, si
je 0xc5c98e
cmp word [ebp + ecx - 0xa0], dx
je 0xc5c98e
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + edi]
cmp si, word [ebp + ecx - 0xa0]
je 0xc5c96d
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx ecx, byte [edi + eax*2]
movzx eax, byte [ebp + eax*2 - 0xa0]
sub ecx, eax
cmp ecx, 0x14d5
jne 0xc5c9b3
imul eax, dword [ebp - 8], 0x58d3d4ad
jmp 0xc5c9b9
lea eax, [ebx + 0x24e524d1]
xor ebx, 0x455a5275
mov dword [0xc78894], eax
mov dword [0xc7889c], ebx
cmp byte [ebp - 1], dl
je 0xc5c9ed
imul eax, dword [0xc787d0], 0x5fc105c0
mov ecx, dword [ebp - 0xc]
inc edx
cmp byte [edx + ecx], 0
jne 0xc5c9dc
cmp edx, 0x2676
jae 0xc5c9fa
jmp 0xc5c9f0
mov eax, dword [ebp - 0x20]
or eax, 0x2f5a6096
mov dword [0xc78894], eax
and ebx, 0x735d71ef
pop edi
pop esi
mov dword [0xc78900], ebx
mov eax, ebx
pop ebx
leave
ret
Function at 0xc5cc84
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 8
mov bh, cl
xor ah, ah
pop esi
mov bl, dl
mov al, ah
xor al, bh
and bl, 1
movzx ecx, al
test bl, bl
movzx eax, ah
cmove ecx, eax
shr dl, 1
mov ah, cl
mov byte [ebp - 1], dl
mov cl, bh
add cl, cl
mov al, cl
movzx ecx, cl
xor al, 0x1b
test bh, bh
movzx edx, al
cmovns edx, ecx
mov bh, dl
mov dl, byte [ebp - 1]
sub esi, 1
jne 0xc5cc91
pop esi
mov al, ah
pop ebx
leave
ret

Function at 0xc5d101
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
add edx, 2
push esi
mov esi, dword [0xc787cc]
add ecx, 8
push edi
shl eax, 4
push 4
add edx, eax
pop edi
mov al, byte [edx - 2]
sub esi, 0x7657546d
xor byte [ecx - 8], al
mov al, byte [edx - 1]
xor byte [ecx - 4], al
mov al, byte [edx]
lea edx, [edx + 4]
xor byte [ecx], al
mov al, byte [edx - 3]
xor byte [ecx + 4], al
inc ecx
sub edi, 1
jne 0xc5d11e
pop edi
mov dword [0xc787cc], esi
pop esi
pop ebp
ret

Function at 0xc5d890
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x10
sub ecx, edx
pop esi
mov al, byte [ecx + edx]
xor byte [edx], al
inc edx
sub esi, 1
jne 0xc5d896
pop esi
ret
Function at 0xc5d92d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
mov dword [ebp - 0x10], esi
xor ebx, ebx
call fcn.00c5d647
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0xc5da9f
mov edx, dword [ebp + 8]
mov ecx, esi
call fcn.00c5d8a3
mov edx, dword [0xc787a8]
mov edi, eax
mov dword [ebp - 8], edi
mov ecx, 0xc74180
xor edx, 0xf7aa7e82
inc ecx
cmp byte [ecx], bl
jne 0xc5d96f
push 0x10
push dword [ebp + 0x10]
lea eax, [ebp - 0x4c]
mov dword [0xc787a8], edx
push eax
call fcn.00c4cef6
push edi
push esi
push dword [ebp - 4]
call fcn.00c4cef6
push edi
push dword [ebp - 4]
push esi
call fcn.00c4cef6
mov esi, 0xc6ffd0
lea edi, [ebp - 0x1c]
add esp, 0x24
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x1c], 0x6f
jne 0xc5d9d2
mov cl, 0x6f
test cl, cl
je 0xc5d9d2
cmp byte [ebp + eax - 0x1c], bl
je 0xc5d9d2
mov cl, byte [eax + 0xc74111]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0xc5d9bb
movzx ecx, byte [eax + str.onecoreuap_base_appmodel_searchcommonpkmutildlmstr.cxx]
movzx eax, byte [ebp + eax - 0x1c]
sub ecx, eax
cmp ecx, 0x1447
jbe 0xc5d9f4
mov eax, dword [0xc787a8]
or eax, 0x387b96ed
jmp 0xc5da08
mov ecx, 0xc74340
call fcn.00c5bc90
mov eax, dword [0xc787a8]
xor eax, 0x67dc5495
mov dword [0xc787a8], eax
mov ecx, ebx
call fcn.00c5d079
mov byte [ebp + ebx - 0x14c], al
inc ebx
cmp ebx, 0x100
jb 0xc5da0d
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 0x14c]
mov ecx, dword [ebp + 0xc]
mov edx, edi
push eax
call fcn.00c5d41a
mov eax, dword [ebp - 8]
mov esi, eax
shr esi, 4
pop ecx
test esi, esi
je 0xc5da9d
mov ebx, dword [ebp - 0x10]
push 0x10
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.00c4cef6
pop ecx
pop ecx
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x4c]
call fcn.00c5d890
lea eax, [ebp - 0x14c]
push eax
push edi
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x2c]
call fcn.00c5d665
push 0x10
lea eax, [ebp - 0x3c]
push eax
push ebx
call fcn.00c4cef6
push 0x10
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00c4cef6
add esp, 0x24
add ebx, 0x10
sub esi, 1
jne 0xc5da48
mov eax, dword [ebp - 8]
mov ebx, eax
mov ecx, edi
call fcn.00c4ba07
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0xc5de60
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
push ebx
push esi
push edi
push 0x15
pop eax
mov dword [ebp - 8], ecx
lea edi, [ebp - 0x6c]
push 5
pop ecx
mov esi, 0xc701ec
mov byte [ebp - 0xe], al
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x48], 0x7d54bcc
mov dword [ebp - 0x44], 0x82c98da
movsw word es:[edi], word [esi]
xor edi, edi
mov dword [ebp - 0x40], 0x9803e425
mov dword [ebp - 0x3c], 0x8725b27b
xor eax, eax
mov dword [ebp - 0x38], 0xb5c5e2ed
mov dword [ebp - 0x34], 0x3cb957cb
mov dword [ebp - 0x30], 0x394e22bc
mov dword [ebp - 0x2c], 0x30ef8b84
mov dword [ebp - 0x28], 0xd0a5c7f3
mov dword [ebp - 0x24], 0xa6894595
mov dword [ebp - 0x20], 0x29dd7e82
mov dword [ebp - 0x1c], 0xa9ce57e5
mov dword [ebp - 0x18], 0x4fdb6bf1
mov dword [ebp - 0x14], 0x11d4bfbb
mov word [ebp - 0x10], 0xa17b
mov dword [ebp - 0xd], 0xf6b95db6
mov byte [ebp - 9], 0xd6
mov byte [ebp + eax - 0x1b0], al
inc eax
cmp eax, 0x100
jb 0xc5defe
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x1b0]
push 0x15
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x6c]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x1b0]
mov byte [ebp + esi - 0x1b0], al
inc esi
mov byte [ebp + edi - 0x1b0], bl
cmp esi, 0x100
jb 0xc5df0f
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
and dword [0xc78904], 0x5491301c
movzx edi, al
mov cl, byte [ebp + edi - 0x1b0]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x1b0]
mov byte [ebp + edi - 0x1b0], al
mov byte [ebp + ebx - 0x1b0], cl
movzx eax, byte [ebp + edi - 0x1b0]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x1b0]
xor al, byte [ebp + esi - 0x48]
mov byte [ebp + esi - 0xb0], al
inc esi
cmp esi, 0x40
jb 0xc5df52
mov ecx, 0x104
mov byte [ebp - 0x70], 0
xor bl, bl
call fcn.00c4b9d3
lea edx, [ebp - 0xb0]
mov dword [ebp - 0x54], eax
mov ecx, eax
call fcn.00c4d328
mov edx, dword [ebp - 8]
xor esi, esi
xor edi, edi
mov dword [ebp - 0x4c], edi
cmp dword [ebp - 0x50], esi
jbe 0xc5e051
mov ch, byte [edi + edx]
xor cl, cl
mov edi, dword [ebp - 0x54]
movzx eax, cl
cmp byte [eax + edi], ch
je 0xc5dff2
inc cl
cmp cl, 0x40
jb 0xc5dfe3
mov edi, dword [ebp - 0x4c]
mov edx, dword [ebp - 8]
movzx eax, bl
inc bl
mov byte [ebp + eax - 4], cl
cmp bl, 4
jne 0xc5e048
mov cl, byte [ebp - 4]
mov ebx, edx
mov al, byte [ebp - 3]
mov dl, byte [ebp - 2]
shl cl, 2
shr al, 4
add cl, al
mov byte [esi + ebx], cl
inc esi
cmp dl, 0x40
je 0xc5e033
mov al, byte [ebp - 3]
mov cl, dl
shr cl, 2
shl al, 4
add cl, al
mov byte [esi + ebx], cl
inc esi
mov al, byte [ebp - 1]
cmp al, 0x40
je 0xc5e043
shl dl, 6
add dl, al
mov byte [esi + ebx], dl
inc esi
mov edx, dword [ebp - 8]
xor bl, bl
inc edi
mov dword [ebp - 0x4c], edi
cmp edi, dword [ebp - 0x50]
jb 0xc5dfdb
mov ecx, dword [ebp - 0x54]
mov byte [esi + edx], 0
call fcn.00c4ba07
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0xc5e2ec
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor dword [0xc78908], 0xd0385392
push esi
mov esi, dword [ebp + 0xc]
push edi
lea eax, [esi + 0x4943324c]
mov dword [0xc78940], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, esi
mov ecx, 0xc74bd0
xor eax, 0xc0b0abed
xor edi, edi
lea ecx, [ecx + 2]
xor eax, 0xed50f601
cmp word [ecx], di
jne 0xc5e31d
mov edx, dword [0xc78940]
mov ecx, edi
imul edx, edx, 0xaa49295d
inc ecx
cmp word [ecx*2 + 0xc74880], di
jne 0xc5e332
cmp ecx, 0x17ba
jne 0xc5e352
mov eax, esi
and eax, 0x9e139e15
lea edx, [esi - 0x13d14525]
xor eax, 0xfcee5037
and esi, 0xc4221a3e
mov dword [0xc78940], edx
mov dword [0xc78908], eax
mov ecx, edi
mov dword [0xc78988], esi
inc ecx
cmp word [ecx*2 + 0xc74bd0], di
jne 0xc5e376
pop edi
pop esi
cmp dword [ebp + 0xc], ecx
jae 0xc5e394
mov eax, edx
xor eax, 0x28c2dd4f
mov dword [0xc78908], eax
pop ebp
ret

Function at 0xc5e874
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [0xc78984]
lea eax, [ecx - 0x2ebf80f5]
imul ebx, eax, 0x377e5c49
inc esi
cmp word [esi*2 + 0xc748c0], dx
jne 0xc5e895
cmp dword [ebp - 4], esi
jae 0xc5e8ab
imul eax, ecx, 0x2393ae93
mov ecx, edx
and ebx, 0x54b9057
inc ecx
cmp word [ecx*2 + 0xc74960], dx
jne 0xc5e8ad
mov esi, dword [ebp - 4]
mov dword [0xc78974], ebx
jmp 0xc5e8d9
cmp esi, 0x15f3
jne 0xc5e8d8
mov eax, edi
xor eax, 0x2193436a
inc esi
cmp esi, ecx
jb 0xc5e8c9
mov ecx, edi
mov esi, edx
and ecx, 0xf2b4d572
xor ecx, 0x917c7564
inc esi
cmp word [esi*2 + 0xc74960], dx
jne 0xc5e8e7
mov dword [0xc7890c], ecx
mov ecx, dword [ebp - 4]
cmp ecx, esi
jae 0xc5e926
and edi, 0xbf58be1b
cmp ecx, 0x25ff
jne 0xc5e91f
lea ebx, [eax + 0x5ca12e5a]
mov dword [0xc78974], ebx
inc ecx
mov eax, edi
cmp ecx, esi
jb 0xc5e90b
mov esi, edx
add eax, 0x3b510513
inc esi
cmp byte [esi + str.IndexEfsCertificateUnavailableFail], dl
jne 0xc5e928
mov ecx, dword [ebp - 4]
mov dword [0xc78938], eax
cmp ecx, esi
jae 0xc5e961
mov edi, dword [0xc78984]
cmp ecx, 0x8f5
jne 0xc5e95c
mov eax, edi
or eax, 0x9f92543b
mov dword [0xc78938], eax
inc ecx
cmp ecx, esi
jb 0xc5e948
push 5
pop ecx
mov esi, 0xc6f240
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x1c], 0x4e
jne 0xc5e991
mov al, 0x4e
test al, al
je 0xc5e991
cmp byte [ebp + edx - 0x1c], 0
je 0xc5e991
mov al, byte [edx + 0xc749b1]
inc edx
cmp al, byte [ebp + edx - 0x1c]
je 0xc5e979
movzx ecx, byte [edx + 0xc749b0]
movzx eax, byte [ebp + edx - 0x1c]
sub ecx, eax
cmp ecx, 0xe8a
jae 0xc5e9b7
imul ebx, dword [0xc78984], 0xc88fb9f6
mov dword [0xc78974], ebx
pop edi
lea ecx, [ebx + 0x7ba69b07]
mov eax, ebx
pop esi
mov dword [0xc78980], ecx
pop ebx
leave
ret