joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ecx, dword [esp + 0x2c]
mov eax, 0xfffffffe
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x41f8f0
cmp eax, 0xffffffed
jge 0x41f907
mov eax, 0xffffffff
jmp 0x41f90a
add eax, 0x12
push eax
call fcn.00408130
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp], 0x73ae7358
mov dword [esp + 4], 0x73be73a3
mov dword [esp + 8], 0x7367737c
mov dword [esp + 0xc], 0x73a973ae
mov word [esp + 0x10], 0x730c
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [esp + ecx*2]
mov esi, ecx
xor esi, 0xdf3a9ddc
mov edx, eax
and edx, 6
sub edx, esi
mov ebp, edx
and ebp, ebx
mov edi, ebp
and edi, 0x623d
mov esi, ebp
or esi, 0xfffffffd
inc esi
imul esi, edi
mov edi, ebp
and edi, 2
or ebp, 2
imul ebp, edi
sub esi, ebp
add edx, ebx
add edx, esi
mov esi, edx
not esi
and esi, 0x62b1121
and edx, 0xf9d4eede
sub edx, esi
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov word [esp + ecx*2], dx
inc ecx
add eax, 2
cmp ecx, 9
jne 0x41f950
mov edx, dword [esp + 0x2c]
movzx ecx, word [edx]
mov esi, dword [esp + 0x14]
mov eax, esi
test cx, cx
je 0x41f9e1
add edx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41f9d0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41fa11
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41fa00
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043abf0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x440a18]
Function at 0x421760
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov dword [esp + 4], 0x97419769
mov dword [esp + 8], 0x972c9721
mov dword [esp + 0xc], 0x973d9731
mov dword [esp + 0x10], 0x97239753
mov dword [esp + 0x14], 0x97519724
mov dword [esp + 0x18], 0x97239737
mov dword [esp + 0x1c], 0x977c9739
lea eax, [esp + 0x20]
mov word [esp + 0x20], 0x979a
xor ecx, ecx
mov edx, 0xef13
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [esp + ecx*2 + 4]
lea esi, [ecx + 0x5fdc10ec]
lea ebp, [edx - 0x8000]
and ebp, 0x4e11
mov ebx, esi
and ebx, 0x8e
or ebx, ebp
xor ebx, 0xa18e
and ebx, edx
not ebx
and ebx, edi
or esi, edi
sub esi, ebx
add esi, 0x78a0
mov word [esp + ecx*2 + 4], si
inc ecx
dec edx
cmp ecx, 0xf
jne 0x4217c0
lea esi, [esp + 0x6e]
lea edx, [esp + 4]
mov edi, esi
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8a]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, esp
push eax
push 0
push 0
push 0xe
push esi
push 0
call dword [0x446180]
mov dword [esp + 4], 0x209060fc
xor edx, edx
mov cl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + edx*2 + 4]
lea edi, [edx + 0x4aa80da7]
and edi, esi
lea ebx, [edx + esi]
add ebx, 0x4aa80da7
add edi, edi
sub ebx, edi
lea esi, [ebx + 0x92c7]
mov edi, 0x55406d38
sub edi, ebx
or edi, 1
add ebx, edi
add ebx, 0xaabf92c8
mov ebp, ebx
and ebp, 2
mov edi, ebx
or ebx, 2
imul ebx, ebp
xor ebp, 2
and edi, 0xfffd
imul edi, ebp
xor esi, 1
add esi, ebx
add esi, edi
mov word [esp + edx*2 + 4], si
mov edx, 1
test cl, 1
mov ecx, 0
jne 0x421850
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x440ef4]
Function at 0x422038
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x98
mov dword [esp + 0x1c], 0xc771c75a
mov dword [esp + 0x20], 0xc7a2c7a1
mov dword [esp + 0x24], 0xc795c777
mov dword [esp + 0x28], 0xc797c7a1
mov dword [esp + 0x2c], 0xc784c752
mov dword [esp + 0x30], 0xc7b2c79d
mov dword [esp + 0x34], 0xc7b2c7be
mov dword [esp + 0x38], 0xc78bc789
mov dword [esp + 0x3c], 0xc782c7bd
mov dword [esp + 0x40], 0xc7b0c7b8
mov dword [esp + 0x44], 0xc788c787
mov dword [esp + 0x48], 0xc7b4c795
mov dword [esp + 0x4c], 0xc7bec7b8
mov dword [esp + 0x50], 0xc786c780
mov dword [esp + 0x54], 0xc78fc7be
lea eax, [esp + 0x58]
mov word [esp + 0x58], 0xc71d
mov ecx, 0xd8133f07
mov edx, 0xc0f8
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [esp + ecx*2 + 0x4fd9820e]
mov esi, edx
xor esi, ecx
and esi, edi
xor esi, ecx
mov edi, esi
not edi
and edi, 0xf839
and esi, 0x7c6
sub esi, edi
inc esi
mov word [esp + ecx*2 + 0x4fd9820e], si
inc ecx
dec edx
cmp ecx, 0xd8133f26
jne 0x421f70
lea ebp, [esp + 0x5a]
lea edx, [esp + 0x1c]
mov edi, ebp
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x96]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x18]
push edi
push 0
push 0
push 0x1e
push ebp
push 0
call dword [0x446180]
mov dword [esp + 0x1c], 0x2549656b
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + ecx*2 + 0x1c]
mov esi, ecx
or esi, 0xd08
mov ebx, 0x72f7
sub ebx, ecx
or ebx, 0xb204
xor ebx, esi
and ebx, edx
xor ebx, esi
add ebx, 0xffff97c0
mov word [esp + ecx*2 + 0x1c], bx
lea ecx, [ecx + ecx*2]
xor ecx, 1
cmp ecx, 2
jb case.default.0x422031
xor ecx, ecx
cmp eax, dword [esp + 0x1c]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x440f64]
mov ebx, dword [esp + 0x18]
test ebx, ebx
jns 0x422047
mov eax, 0xffffffff
jmp 0x42204a
lea eax, [ebx + ebx]
push eax
call fcn.00408130
add esp, 4
mov esi, eax
push edi
push ebx
push eax
push 0x1e
push ebp
push 0
call dword [0x446180]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x440f6c]
xor ebx, ebx
jmp dword [0x440f74]
mov eax, ebx
add esp, 0x98
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42fe80
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.00413a30
sub esp, 0x10
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x42feaa
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x42febb
jmp 0x430010
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x42fef7
jmp 0x43000a
mov dword [ebp - 0x1c], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.00423a10
add esp, 4
cmp eax, 0
setne cl
jmp 0x42ff21
xor ebx, ebx
test cl, 1
jne 0x42ff2d
jmp 0x42fffb
mov dword [ebp - 0x18], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.00408130
add esp, 4
mov dword [ebp - 0x10], eax
sub esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00408fe0
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov byte [ebp - 0x14], al
mov word [edi], 0xe2ff
mov word [edi + 2], 0xe694
mov word [edi + 4], 0xe79c
mov word [edi + 6], 0x989e
mov word [edi + 8], 0x24a4
mov word [edi + 0xa], 0x9eb5
mov word [edi + 0xc], 0x16b6
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, 7
jae 0x42ffc0
mov si, word [edi + eax*2]
mov dx, ax
add dx, 0xd9dc
xor dx, si
add dx, 0x3120
mov word [edi + eax*2], dx
mov edx, eax
shl edx, 1
and edx, 2
xor eax, 1
add eax, edx
jmp 0x42ff95
sub esp, 0xc
mov dword [esp], edi
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
call fcn.00409140
mov bl, al
and bl, 1
jmp 0x42ffe0
jmp 0x42ffe2
jmp 0x42ffe4
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00408140
add esp, 4
jmp 0x42fff7
jmp 0x42fff9
jmp 0x42fffb
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x434830
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp], 0xa70aa70b
xor eax, eax
mov cl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + eax*2]
mov esi, edx
not esi
and esi, 0x2e28
xor edx, 0xbe592e28
or edx, esi
mov esi, eax
or esi, 0x539755bc
xor esi, edx
add esi, 0x918c235f
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov word [esp + eax*2], dx
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x434850
mov eax, dword [esp]
mov ecx, dword [0x446184]
test ecx, ecx
je 0x4348e2
xor edx, edx
mov esi, dword [0x446188]
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xb7c1bb11
je 0x4348c0
inc edx
cmp ecx, edx
jne 0x4348b0
jmp 0x4348e2
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x4348e2
lea eax, [esp + 8]
push eax
push 8
push 0xffffffffffffffff
push 0xc
push ecx
push dword [0x44618c]
call fcn.00438b10
add esp, 0x18
xor ebx, ebx
test eax, eax
js 0x434a1e
mov ecx, dword [esp + 8]
mov dword [esp], 0xa70aa70b
mov al, 1
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + ebx*2]
mov esi, edx
not esi
and esi, 0x2e28
xor edx, 0xbe592e28
or edx, esi
mov esi, ebx
or esi, 0x539755bc
xor esi, edx
add esi, 0x918c235f
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov word [esp + ebx*2], dx
mov ebx, 1
test al, 1
mov eax, 0
jne 0x434900
mov eax, dword [esp]
mov edx, dword [0x446184]
test edx, edx
je 0x43497c
xor esi, esi
mov edi, dword [0x446188]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x6e83e51e
je 0x434970
inc esi
cmp edx, esi
jne 0x434960
jmp 0x43497c
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x434a27
mov dword [esp], 0xa70aa70b
xor edx, edx
mov bl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + edx*2]
mov edi, esi
not edi
and edi, 0x2e28
xor esi, 0xbe592e28
or esi, edi
mov edi, edx
or edi, 0x539755bc
xor edi, esi
add edi, 0x918c235f
mov esi, edi
and esi, 1
xor edi, 1
lea esi, [edi + esi*2]
mov word [esp + edx*2], si
mov edx, 1
test bl, 1
mov ebx, 0
jne 0x434990
test eax, eax
setns bl
mov eax, dword [0x446184]
test eax, eax
je 0x434a1a
mov edx, dword [esp]
xor esi, esi
mov edi, dword [0x446188]
nop
nop
nop
cmp dword [edi + esi*8], 0xb430e561
je 0x434a00
inc esi
cmp eax, esi
jne 0x4349f0
jmp 0x434a1a
mov eax, dword [edi + esi*8 + 4]
cmp eax, edx
je 0x434a1a
push ecx
push 4
push eax
push dword [0x44618c]
call fcn.00438b10
add esp, 0x10
and bl, byte [esp + 7]
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
ret
mov eax, esp
lea esi, [esp + 0xc]
push eax
push 4
push esi
push 0x14
push ecx
push 0x14
push edx
push dword [0x44618c]
call fcn.00438b10
add esp, 0x20
mov ecx, dword [esp + 8]
cmp dword [esp + 0xc], 0
setne byte [esp + 7]
jmp 0x43497c
Function at 0x4353a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.0043afb0
add esp, 0x14
test eax, eax
js 0x4354f3
lea ebx, [esp + 8]
lea eax, [esp + 0xc]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.0043b2d0
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x43543c
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 8]
mov ecx, eax
inc ecx
jns 0x43540a
mov eax, 0xffffffff
jmp 0x435411
lea eax, [eax*2 + 2]
push eax
call fcn.00408130
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x14]
call fcn.0043b790
add esp, 0x14
test eax, eax
jns 0x43543c
push esi
call fcn.00408140
add esp, 4
xor esi, esi
mov eax, dword [esp + 4]
mov dword [esp], 0xa70aa70b
mov cl, 1
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + edi*2]
mov ebx, edx
not ebx
and ebx, 0x2e28
xor edx, 0xbe592e28
or edx, ebx
mov ebx, edi
or ebx, 0x539755bc
xor ebx, edx
add ebx, 0x918c235f
mov edx, ebx
and edx, 1
xor ebx, 1
lea edx, [ebx + edx*2]
mov word [esp + edi*2], dx
mov edi, 1
test cl, 1
mov ecx, 0
jne 0x435450
mov ecx, dword [0x446184]
test ecx, ecx
je 0x4354da
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0x446188]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb430e561
je 0x4354c0
inc edi
cmp ecx, edi
jne 0x4354b0
jmp 0x4354da
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x4354da
push eax
push 4
push ecx
push dword [0x44618c]
call fcn.00438b10
add esp, 0x10
test esi, esi
jne 0x4354f5
mov eax, esp
push eax
call fcn.0043a8e0
add esp, 4
test al, al
je 0x4354f3
cmp dword [esp], 1
je 0x4354f5
xor esi, esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437170
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0xa70aa70b
xor eax, eax
nop
nop
mov ecx, eax
or ecx, 0x7b94
xor cx, word [esp + eax*2]
add ecx, 0x2360
mov word [esp + eax*2], cx
add eax, 0x3f184be7
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
add eax, 0xc0e7b419
cmp eax, 2
jb 0x437190
mov ebp, dword [esp]
mov eax, dword [0x446184]
test eax, eax
je 0x437216
xor ecx, ecx
mov edx, dword [0x446188]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x67f3d776
je 0x4371f0
inc ecx
cmp eax, ecx
jne 0x4371e0
jmp 0x437216
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebp
je 0x437216
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x44618c]
call fcn.00438b10
add esp, 0x1c
mov ebp, eax
cmp ebp, 0xc0000004
jne 0x437394
push dword [esp + 8]
call fcn.00437120
add esp, 4
mov ecx, dword [esp + 8]
mov dword [esp], 0xa70aa70b
xor edx, edx
nop
nop
nop
nop
nop
mov esi, edx
or esi, 0x7b94
xor si, word [esp + edx*2]
add esi, 0x2360
mov word [esp + edx*2], si
add edx, 0x3f184be7
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
add edx, 0xc0e7b419
cmp edx, 2
jb 0x437240
mov ebp, dword [esp]
mov edx, dword [0x446184]
test edx, edx
je 0x4372d0
mov dword [esp + 4], ecx
mov ecx, edi
mov edi, ebp
xor ebp, ebp
mov esi, dword [0x446188]
nop
cmp dword [esi + ebp*8], 0x67f3d776
je 0x4372a4
inc ebp
cmp edx, ebp
jne 0x437290
mov ebp, edi
mov edi, ecx
jmp 0x4372d0
mov edx, dword [esi + ebp*8 + 4]
mov ebp, edi
cmp edx, edi
mov edi, ecx
je 0x4372d0
push 0
push dword [esp + 8]
push eax
push 5
push 0x10
push edx
push dword [0x44618c]
mov esi, eax
call fcn.00438b10
add esp, 0x1c
mov ebp, eax
mov eax, esi
test ebp, ebp
js 0x43738b
mov dword [esp + 4], edi
mov dword [esp], 0x209062fa
xor ecx, ecx
mov dl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + ecx*2]
mov edi, 0xf258
sub edi, ecx
lea ebp, [ecx + 0x4aa80da7]
or ebp, esi
not esi
or esi, edi
and ebp, esi
mov esi, ebp
or esi, 0x92c6
and ebp, 0x92c6
add esi, ebp
add esi, 2
mov word [esp + ecx*2], si
mov ecx, 1
test dl, 1
mov edx, 0
jne 0x4372f0
mov ecx, dword [esp]
mov dword [esp + 0xc], ecx
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebp]
movzx edi, word [ebx + ebp]
test si, si
je 0x437365
add ebp, 2
cmp si, di
je 0x437350
cmp si, di
je 0x437376
mov esi, dword [ecx]
test esi, esi
jne 0x437340
mov ebp, dword [esp + 0xc]
jmp 0x43738b
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 4]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor ebp, ebp
push eax
call fcn.00437140
add esp, 4
mov eax, ebp
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4373c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x437490
xor eax, eax
cmp dword [ecx], 0
jne 0x4374e5
mov edx, dword [esp + 0x34]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0xa70aa70b
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
or esi, 0x7b94
xor si, word [esp + eax*2]
add esi, 0x2360
mov word [esp + eax*2], si
add eax, 0x3f184be7
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
add eax, 0xc0e7b419
cmp eax, 2
jb 0x437430
mov eax, dword [esp]
mov esi, dword [0x446184]
test esi, esi
je 0x4374e5
xor edi, edi
mov ebx, dword [0x446188]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xf62c6d34
je 0x4374ee
inc edi
cmp esi, edi
jne 0x437480
jmp 0x4374e5
mov dword [esp + 4], 0x1d141d8
xor eax, eax
mov cl, 1
nop
nop
nop
nop
movzx edx, word [esp + eax*2 + 4]
mov esi, eax
or esi, 0x5f9b9b50
xor esi, edx
lea edx, [esi + 0x257f]
mov edi, 0x7cdcda80
sub edi, esi
or edi, 1
add edi, esi
xor edx, 1
lea edx, [edx + edi*2]
add edx, 0x4b00
mov word [esp + eax*2 + 4], dx
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x4374a0
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x4374e5
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44618c]
call fcn.00438b10
add esp, 0x1c
jmp 0x4374e5

Function at 0x437520
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x4375ca
push ebx
push edi
push esi
push eax
mov dword [esp], 0xa70aa70b
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
or esi, 0x7b94
xor si, word [esp + edx*2]
add esi, 0x2360
mov word [esp + edx*2], si
add edx, 0x3f184be7
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
add edx, 0xc0e7b419
cmp edx, 2
jb 0x437540
mov edx, dword [0x446184]
test edx, edx
je 0x4375be
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x446188]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb430e561
je 0x4375a0
inc edi
cmp edx, edi
jne 0x437590
jmp 0x4375be
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x4375be
push eax
push 4
push edx
push dword [0x44618c]
mov esi, ecx
call fcn.00438b10
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x437860
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
mov ecx, dword [ecx]
mov dword [esp], 0xa70aa70b
xor eax, eax
nop
nop
nop
nop
nop
nop
mov edx, eax
or edx, 0x7b94
xor dx, word [esp + eax*2]
add edx, 0x2360
mov word [esp + eax*2], dx
add eax, 0x3f184be7
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
add eax, 0xc0e7b419
cmp eax, 2
jb 0x437880
test ebx, ebx
jne 0x4378b8
lea ebx, [esp + 4]
mov eax, dword [esp]
mov ebp, dword [0x446184]
test ebp, ebp
je 0x437904
xor edx, edx
mov esi, dword [0x446188]
nop
nop
nop
cmp dword [esi + edx*8], 0xa99f3325
je 0x4378e0
inc edx
cmp ebp, edx
jne 0x4378d0
jmp 0x437904
mov ebp, dword [esi + edx*8 + 4]
cmp ebp, eax
je 0x437904
push ebx
push dword [esp + 0x28]
push edi
push dword [esp + 0x28]
push ecx
push 0x14
push ebp
push dword [0x44618c]
call fcn.00438b10
add esp, 0x20
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43a3b0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 8]
push eax
mov edx, esp
movzx ecx, word [eax]
mov dword [ebp - 0x14], 0x7281c8cd
xor esi, esi
mov bl, 1
nop
nop
nop
movzx eax, word [ebp + esi*2 - 0x14]
mov edi, esi
or edi, 0x4680
and edi, eax
add eax, esi
add edi, edi
sub eax, edi
add eax, 0x1280
mov word [ebp + esi*2 - 0x14], ax
mov esi, 1
xor eax, eax
test bl, 1
mov ebx, 0
jne 0x43a3d0
xor ebx, ebx
cmp dword [ebp - 0x14], ecx
setne bl
jmp dword [ebx*4 + 0x4439d0]
Function at 0x43b080
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [0x446184]
mov eax, 0xffffffff
test esi, esi
je 0x43b0dd
xor ecx, ecx
mov edx, dword [0x446188]
nop
nop
cmp dword [edx + ecx*8], 0x29df508e
je 0x43b0b0
inc ecx
cmp esi, ecx
jne 0x43b0a0
jmp 0x43b0dd
mov edx, dword [edx + ecx*8 + 4]
cmp edx, 0xffffffff
je 0x43b0dd
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
push dword [esp + 0x38]
push dword [esp + 0x38]
push 0x18
push edx
push dword [0x44618c]
call fcn.00438b10
add esp, 0x24
mov dword [esp + 4], eax
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0xc], 0x15d5d5b7
xor eax, eax
mov cl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + eax*2 + 0xc]
mov edi, eax
or edi, 0x16d4e674
mov ebp, edi
xor ebp, edx
lea esi, [ebp*2]
not esi
add esi, ebp
and esi, edi
add esi, esi
neg esi
add esi, eax
add esi, 0x16d4e674
add edx, esi
add edx, 0xffffcc60
mov word [esp + eax*2 + 0xc], dx
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x43b100
mov esi, dword [esp + 4]
cmp esi, dword [esp + 0xc]
jne 0x43b2b1
push dword [esp + 8]
call fcn.00437120
add esp, 4
mov dword [esp], eax
mov edx, dword [0x446184]
mov esi, 0xffffffff
test edx, edx
je 0x43b1c1
mov ecx, dword [esp + 8]
xor ebp, ebp
mov edi, dword [0x446188]
nop
nop
cmp dword [edi + ebp*8], 0x29df508e
je 0x43b190
inc ebp
cmp edx, ebp
jne 0x43b180
jmp 0x43b1c1
mov edx, dword [edi + ebp*8 + 4]
cmp edx, 0xffffffff
je 0x43b1c1
lea esi, [esp + 8]
push esi
push ecx
mov eax, dword [esp + 8]
push eax
push 0
push dword [esp + 0x38]
push dword [esp + 0x38]
push 0x18
push edx
push dword [0x44618c]
call fcn.00438b10
add esp, 0x24
mov esi, eax
mov ebp, dword [esp + 0x30]
test ebp, ebp
je 0x43b2a6
test esi, esi
js 0x43b2a6
test ebx, ebx
je 0x43b29b
mov eax, dword [esp]
mov ecx, dword [eax + 0xc]
shr ecx, 1
mov eax, dword [ebp]
cmp eax, ecx
jb 0x43b1ee
mov eax, ecx
test eax, eax
mov dword [esp + 4], esi
je 0x43b292
mov ecx, dword [esp]
add ecx, 0x10
mov edi, eax
and edi, 3
je 0x43b2bb
xor ebp, ebp
nop
nop
nop
movzx esi, word [ecx]
xor edx, edx
test si, si
setne dl
lea ecx, [ecx + edx*2]
mov word [ebx], si
add ebx, 2
inc ebp
cmp edi, ebp
jne 0x43b210
mov esi, eax
sub esi, ebp
mov ebp, dword [esp + 0x30]
cmp eax, 4
jb 0x43b292
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, word [ecx]
xor edx, edx
test ax, ax
setne dl
lea edi, [ecx + edx*2]
mov word [ebx], ax
movzx eax, word [ecx + edx*2]
xor ecx, ecx
test ax, ax
setne cl
lea edx, [edi + ecx*2]
mov word [ebx + 2], ax
movzx eax, word [edi + ecx*2]
xor ecx, ecx
test ax, ax
setne cl
lea edi, [edx + ecx*2]
mov word [ebx + 4], ax
movzx eax, word [edx + ecx*2]
xor ecx, ecx
test ax, ax
setne cl
mov word [ebx + 6], ax
add ebx, 8
lea ecx, [edi + ecx*2]
add esi, 0xfffffffc
jne 0x43b240
mov word [ebx], 0
mov esi, dword [esp + 4]
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
shr eax, 1
mov dword [ebp], eax
push dword [esp]
call fcn.00437140
add esp, 4
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, eax
cmp eax, 4
jae 0x43b240
jmp 0x43b292
Function at 0x10001000
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
ret

Function at 0x10001010
Capabilities:
Access peb ldr_data

Disassembly:
push edi
push esi
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov edx, edi
nop dword [eax + eax]
mov edx, dword [edx]
cmp edx, edi
setne ah
test edx, edx
setne al
and al, ah
cmp al, 1
jne 0x10001081
cmp dword [edx + 0x18], esi
jne 0x10001030
mov dword [ecx], esi
mov esi, dword [edx + 0x1c]
mov dword [ecx + 4], esi
mov esi, dword [edx + 0x20]
mov dword [ecx + 8], esi
mov esi, dword [edx + 0x30]
mov dword [ecx + 0x18], esi
movzx esi, word [edx + 0x2c]
mov word [ecx + 0x14], si
movzx esi, word [edx + 0x2e]
mov word [ecx + 0x16], si
mov esi, dword [edx + 0x28]
mov dword [ecx + 0x10], esi
movzx esi, word [edx + 0x24]
mov word [ecx + 0xc], si
movzx edx, word [edx + 0x26]
mov word [ecx + 0xe], dx
pop esi
pop edi
ret