joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bb50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov edi, dword [esp + 0x464]
mov dword [esp + 0x38], 0xb92bbbf7
mov dword [esp + 0x3c], 0xbd21bf36
mov dword [esp + 0x40], 0xb12eb320
mov dword [esp + 0x44], 0xb5e7b7d7
mov dword [esp + 0x48], 0xa9f8abff
mov dword [esp + 0x4c], 0xad8eaff8
mov dword [esp + 0x50], 0xa1cba3f4
mov dword [esp + 0x54], 0xa534a73f
mov dword [esp + 0x58], 0xd94bdbc0
mov dword [esp + 0x5c], 0xdd4bdf51
mov dword [esp + 0x60], 0xd1a0d3fc
mov dword [esp + 0x64], 0xd5f6d7a4
mov dword [esp + 0x68], 0xc99acb83
mov dword [esp + 0x6c], 0xcd9ecf9a
mov dword [esp + 0x70], 0xc1e2c381
mov dword [esp + 0x74], 0xc559c7a9
mov dword [esp + 0x78], 0xf9b0fb56
mov dword [esp + 0x7c], 0xfdb3ffac
mov dword [esp + 0x80], 0xf17af3dc
mov dword [esp + 0x84], 0xf5a2f7ba
mov dword [esp + 0x88], 0xe9caebab
mov dword [esp + 0x8c], 0xed7eefaf
mov dword [esp + 0x90], 0xe17ee37c
mov dword [esp + 0x94], 0xe58fe77b
mov dword [esp + 0x98], 0x197c1b7f
mov dword [esp + 0x9c], 0x1d811f65
mov dword [esp + 0xa0], 0x11431388
mov dword [esp + 0xa4], 0x1543175b
mov dword [esp + 0xa8], 0x9580b5d
mov dword [esp + 0xac], 0xd440f5d
mov dword [esp + 0xb0], 0x15a032c
mov dword [esp + 0xb4], 0x57e077d
mov dword [esp + 0xb8], 0x39493b70
mov dword [esp + 0xbc], 0x3d623f44
mov dword [esp + 0xc0], 0x31ae331c
mov dword [esp + 0xc4], 0x35ab37af
mov dword [esp + 0xc8], 0x290a2baf
mov dword [esp + 0xcc], 0x2db52f51
mov dword [esp + 0xd0], 0x21bf2349
mov dword [esp + 0xd4], 0x257927b1
mov dword [esp + 0xd8], 0x591f5b04
mov dword [esp + 0xdc], 0x5dc85fc0
mov dword [esp + 0xe0], 0x51c153cd
mov dword [esp + 0xe4], 0x550757cb
mov dword [esp + 0xe8], 0x491d4b03
mov dword [esp + 0xec], 0x4d1c4f07
mov dword [esp + 0xf0], 0x4110431c
mov dword [esp + 0xf4], 0x45144710
mov dword [esp + 0xf8], 0x795a7b14
mov dword [esp + 0xfc], 0x7d197f0d
mov dword [esp + 0x100], 0x711573e6
mov dword [esp + 0x104], 0x75e977e6
mov dword [esp + 0x108], 0x69216b25
mov dword [esp + 0x10c], 0x6d276f3d
mov dword [esp + 0x110], 0x6137633e
mov dword [esp + 0x114], 0x6566672a
mov eax, dword [0x44ce70]
mov ecx, 0xf591681f
nop
nop
nop
movzx edx, byte [esp + ecx + 0xa6e9819]
xor edx, ecx
mov esi, edx
xor esi, 0xae
and edx, 0x51
add edx, edx
sub edx, esi
add dl, 0x13
mov byte [esp + ecx + 0xa6e9819], dl
inc ecx
cmp ecx, 0xf59168ff
jne 0x40bda0
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
xor ecx, ecx
mov dword [esp + 8], eax
test eax, eax
setne cl
mov eax, dword [ecx*4 + 0x446d4c]
mov ecx, dword [0x446d54]
mov edx, ecx
and edx, 0xc1f64b52
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0x3e09b4ae
jmp eax
Function at 0x40c520
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov dword [esp + 0x38], 0x77c579ad
mov dword [esp + 0x3c], 0x73cb75f2
mov dword [esp + 0x40], 0x4ffa71c4
mov dword [esp + 0x44], 0x4bb94ded
mov dword [esp + 0x48], 0x47b44985
mov dword [esp + 0x4c], 0x43a245b4
mov dword [esp + 0x50], 0x5ff541b8
mov dword [esp + 0x54], 0x5be85de5
mov dword [esp + 0x58], 0x57e559e4
mov dword [esp + 0x5c], 0x53dd55df
mov dword [esp + 0x60], 0x2ffc51b0
mov dword [esp + 0x64], 0x2bca2d80
mov dword [esp + 0x68], 0x27d629d9
mov dword [esp + 0x6c], 0x23d225d6
mov dword [esp + 0x70], 0x3fde21e7
mov dword [esp + 0x74], 0x3b833d97
mov dword [esp + 0x78], 0x37fc398a
mov dword [esp + 0x7c], 0x33f535f8
mov dword [esp + 0x80], 0xf8631d0
mov dword [esp + 0x84], 0xbc60dc6
mov dword [esp + 0x88], 0x7e609f1
mov dword [esp + 0x8c], 0x3b205c5
mov dword [esp + 0x90], 0x1faa01b0
mov dword [esp + 0x94], 0x1bb11da1
mov dword [esp + 0x98], 0x17a819a5
mov dword [esp + 0x9c], 0x13ab15c3
mov dword [esp + 0xa0], 0xef1d119c
mov dword [esp + 0xa4], 0xeb25ed21
mov dword [esp + 0xa8], 0xe714e923
mov dword [esp + 0xac], 0xe328e52b
mov dword [esp + 0xb0], 0xff06e100
mov dword [esp + 0xb4], 0xfb22fd2b
mov dword [esp + 0xb8], 0xf723f954
mov dword [esp + 0xbc], 0xf306f520
mov dword [esp + 0xc0], 0xcf7af110
mov dword [esp + 0xc4], 0xcb7dcd75
mov dword [esp + 0xc8], 0xc726c975
mov dword [esp + 0xcc], 0xc37fc51f
mov dword [esp + 0xd0], 0xdf69c17f
mov dword [esp + 0xd4], 0xdb23dd6f
mov dword [esp + 0xd8], 0xd709d938
mov dword [esp + 0xdc], 0xd35cd56c
mov dword [esp + 0xe0], 0xaf1bd163
mov dword [esp + 0xe4], 0xab59ad11
mov dword [esp + 0xe8], 0xa757a959
mov dword [esp + 0xec], 0xa350a56d
mov dword [esp + 0xf0], 0xbf4ca150
mov dword [esp + 0xf4], 0xbb48bd4c
mov dword [esp + 0xf8], 0xb756b948
mov dword [esp + 0xfc], 0xb313b51b
mov dword [esp + 0x100], 0x8f2fb10a
mov dword [esp + 0x104], 0x8b338d02
mov dword [esp + 0x108], 0x874b897b
mov dword [esp + 0x10c], 0x8349854b
mov dword [esp + 0x110], 0x9f518172
mov dword [esp + 0x114], 0x9b9a9d56
mov eax, dword [0x44ce70]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x38]
mov edi, ecx
and edi, 0x94
mov edx, ecx
and edx, 2
mov ebx, edx
xor ebx, 2
imul ebx, edi
or edi, 2
imul edi, edx
mov edx, ecx
xor edx, 0x93b49a96
add edx, ebx
add edx, edi
xor edx, esi
mov edi, edx
xor edi, 0xe28704ee
mov esi, edx
or esi, 0x1d78fb11
and esi, edi
mov ebx, esi
and ebx, 2
mov edi, esi
or esi, 2
imul esi, ebx
xor ebx, 2
and edi, 0xfd
imul edi, ebx
xor edx, 0x11
add edx, esi
add edx, edi
inc dl
mov byte [esp + ecx + 0x38], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0xe0
jb 0x40c770
lea edi, [esp + 0x38]
push 0
push 0
push 0
push 0
push edi
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x446e84]
mov ecx, dword [0x446e8c]
mov edx, ecx
and edx, 0xf0abe76
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0xf0f5418a
jmp eax
Function at 0x418ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x438
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + ecx], 0
lea ecx, [ecx + 2]
jne 0x418d00
add ecx, eax
add ecx, 0xfffffffe
mov edx, eax
not edx
and edx, ecx
xor ecx, eax
add edx, edx
sub edx, ecx
sar edx, 1
lea ecx, [esp + 0x84]
push ecx
push 0
push 0
mov dword [esp + 0x10], edx
push edx
push eax
push 0
call dword [0x44e1c4]
mov dword [esp + 0x24], eax
mov dword [esp + 0x100], 0x713e3f19
mov dword [esp + 0x104], 0
mov ecx, 0xc9dbecf5
mov eax, 0x3624130a
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0x3624140b]
mov esi, edi
not esi
or esi, ecx
lea ebx, [edi + esi]
inc ebx
mov esi, ebx
and esi, 0xfffffffd
mov edx, ebx
and edx, 2
or ebx, 2
imul ebx, edx
xor edx, 2
imul edx, esi
add ebx, edx
mov edx, eax
sub edx, edi
lea esi, [ecx + edi]
and edx, ebx
not ebx
and ebx, esi
sub ebx, edx
mov edx, ebx
not edx
or edx, 0xeb45f36
add edx, ebx
xor ebx, 0xeb45f36
lea edx, [ebx + edx*2]
add edx, 0x53399e37
mov esi, edx
and esi, 0x4c
xor edx, 0xcc
lea edx, [edx + esi*2]
mov byte [esp + ecx + 0x3624140b], dl
inc ecx
dec eax
cmp ecx, 0xc9dbecfd
jne 0x418d60
xor ecx, ecx
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x100]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x447910]
Function at 0x41d200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x198
mov ebx, dword [ebp + 0x10]
mov dword [esp + 8], 0x219c2755
mov dword [esp + 0xc], 0x3d9323ad
mov dword [esp + 0x10], 0x393e3f8a
mov word [esp + 0x14], 0
mov byte [esp + 0x16], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 8]
mov edi, ecx
xor edi, 0x85072f77
mov edx, eax
and edx, 0x10
sub edx, edi
xor edx, esi
mov esi, edx
xor esi, 0xae
and edx, 0x51
add edx, edx
sub edx, esi
inc dl
mov byte [esp + ecx + 8], dl
inc ecx
add eax, 2
cmp ecx, 0xf
jne 0x41d240
mov dword [esp + 0x28], 0xe91eeb0c
mov dword [esp + 0x2c], 0xed1eef1c
mov dword [esp + 0x30], 0xf1c3f3d2
mov dword [esp + 0x34], 0xf51af7c1
mov dword [esp + 0x38], 0xf91ffb05
mov dword [esp + 0x3c], 0xfd12ff1f
mov dword [esp + 0x40], 0x81738314
mov dword [esp + 0x44], 0x85728775
mov dword [esp + 0x48], 0x898a8bba
mov dword [esp + 0x4c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x27
xor cl, byte [esp + eax + 0x28]
add cl, 0x3d
mov byte [esp + eax + 0x28], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x28
jb 0x41d2d0
movzx ecx, word [esp + 0x28]
lea eax, [esp + 0x154]
test cx, cx
je 0x41d321
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d310
mov word [eax], 0
movzx ecx, word [ebx]
test cx, cx
je 0x41d351
lea edx, [ebx + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d340
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x41d381
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d370
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov dword [esp + 0x28], 0xafacacca
mov byte [esp + 0x2c], 0x2c
mov word [esp + 0x2d], 0
mov byte [esp + 0x2f], 0
mov eax, 0xc35d5d4c
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x3ca2a2dc]
mov edx, eax
and edx, esi
mov edi, edx
and edi, 0x5d
mov ecx, edx
or ecx, 0xfffffffd
inc ecx
imul ecx, edi
mov edi, edx
and edi, 2
or edx, 2
imul edx, edi
add ecx, esi
sub ecx, edx
add ecx, eax
mov esi, ecx
and esi, 0x2f2d2d81
mov edi, ecx
and edi, 2
mov edx, edi
xor edx, 2
imul edx, esi
or esi, 2
imul esi, edi
xor ecx, 0x2f2d2d83
add edx, ecx
add edx, esi
and ecx, 1
or edx, 1
add edx, ecx
mov byte [esp + eax + 0x3ca2a2dc], dl
inc eax
cmp eax, 0xc35d5d54
jne 0x41d3b0
movzx eax, byte [esp + 0x28]
test al, al
je 0x41d43b
lea ecx, [esp + 0x29]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41d430
mov byte [ebx], 0
lea eax, [esp + 0x13c]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x154]
push eax
push ecx
push edx
call fcn.0040b4b0
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x447cb8]
mov ecx, 0x4c2161bd
xor ecx, dword [0x447cc0]
add eax, ecx
inc eax
jmp eax
Function at 0x420fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x420ff0
sar ebp, 1
mov eax, esp
push eax
push 0
push 0
push ebp
push edi
push 0
call dword [0x44e1c4]
mov dword [esp + 4], 0xe92a2b01
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xb7
xor dl, byte [esp + ecx + 4]
add dl, 0x6d
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 7
jne case.default.0x421051
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x447f74]
mov ebx, dword [esp]
test ebx, ebx
jns 0x421066
mov eax, 0xffffffff
jmp 0x421069
lea eax, [ebx + ebx]
push eax
call fcn.004084d0
add esp, 4
mov esi, eax
mov eax, esp
push eax
push ebx
push esi
push ebp
push edi
push 0
call dword [0x44e1c4]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447f7c]
xor ebx, ebx
jmp dword [0x447f84]
jmp dword [0x447f8c]
push esi
call fcn.004084e0
add esp, 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push esi
call fcn.004084e0
add esp, 4
xor ebx, ebx
jmp dword [0x447f94]
lea eax, [esp + 4]
push eax
push esi
call fcn.00440ea0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447f9c]
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x2c]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x422b50
cmp eax, 0xffffffed
jge 0x422b67
mov eax, 0xffffffff
jmp 0x422b6a
add eax, 0x12
push eax
call fcn.004084d0
add esp, 4
mov esi, eax
mov dword [esp], 0x29c72bd8
mov dword [esp + 4], 0x2db12fc3
mov dword [esp + 8], 0xd100d3f8
mov dword [esp + 0xc], 0xd530d734
mov word [esp + 0x10], 0xdbd4
mov dword [esp + 0x12], 0
mov word [esp + 0x16], 0
xor eax, eax
xor ecx, ecx
nop
nop
movzx edx, byte [esp + ecx]
mov ebx, eax
and ebx, 0x2e
mov ebp, ecx
xor ebp, 0xd9cb9bf7
add ebp, ebx
xor ebp, edx
mov ebx, ebp
mov edx, ebp
xor edx, 0x2c
add edx, ebp
and ebp, 0x2c
and ebx, 0xd3
sub edx, ebx
add edx, ebp
inc dl
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0x18
jne 0x422bb0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x422c11
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x422c00
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x422c41
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x422c30
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00440ea0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x448044]
Function at 0x42528f
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0xe9adeb8f
mov dword [esp + 8], 0xed7eef78
mov dword [esp + 0xc], 0xd175d3a8
mov dword [esp + 0x10], 0xd571d744
mov dword [esp + 0x14], 0xd966dbbf
mov dword [esp + 0x18], 0xdd76df6c
mov dword [esp + 0x1c], 0xc150c347
mov dword [esp + 0x20], 0xc56dc764
mov dword [esp + 0x24], 0xc96ccb52
mov dword [esp + 0x28], 0xcd58cf67
mov dword [esp + 0x2c], 0x318e3368
mov dword [esp + 0x30], 0x35a03780
mov dword [esp + 0x34], 0x39903ba5
mov dword [esp + 0x38], 0x3d923f97
mov dword [esp + 0x3c], 0x21b72397
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0x2720
mov byte [esp + 0x44], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 4]
lea edx, [ecx - 0x5c625829]
xor edx, esi
mov esi, edx
xor esi, 0x34
and edx, 0x4b
add edx, edx
sub edx, esi
inc dl
mov byte [esp + ecx + 4], dl
mov edx, ecx
not edx
or edx, 1
add edx, ecx
or ecx, 1
add ecx, edx
inc ecx
cmp ecx, 0x41
jb 0x4251b0
lea esi, [esp + 0x4a]
lea edx, [esp + 4]
mov ecx, 0xf
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, esp
push eax
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x44e1c4]
mov dword [esp + 4], 0x591a1bf1
mov dword [esp + 8], 0
xor ecx, ecx
nop
nop
nop
movzx edx, byte [esp + ecx + 4]
lea ebx, [edx + edx]
not ebx
add ebx, edx
mov edi, 0x84
sub edi, ecx
lea esi, [ecx + 0x7b]
xor ebx, esi
mov ebp, edi
and ebp, edx
or ebp, ebx
and esi, 0x7c
and edi, 0x83
or edi, esi
xor edi, 0x83
not edx
or edx, edi
and edx, ebp
mov bl, 0x98
sub bl, dl
mov byte [esp + ecx + 4], bl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 8
jb case.default.0x425288
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x448618]
mov ebp, dword [esp]
test ebp, ebp
jns 0x42529d
mov eax, 0xffffffff
jmp 0x4252a4
lea eax, [ebp*2]
push eax
call fcn.004084d0
add esp, 4
mov edi, eax
mov eax, esp
push eax
push ebp
push edi
push 0x1e
lea eax, [esp + 0x5a]
push eax
push 0
call dword [0x44e1c4]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448620]
xor ebx, ebx
xor eax, eax
jmp dword [0x448628]
mov dword [esp + 4], 0x9720b60
mov dword [esp + 8], 0x5740783
mov dword [esp + 0xc], 0x1790378
mov dword [esp + 0x10], 0x1d601f8e
mov dword [esp + 0x14], 0x19941b6b
mov dword [esp + 0x18], 0x15161764
mov word [esp + 0x1c], 0
mov eax, 0x545d6d03
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x545d6cff]
lea edx, [eax - 0x545d6d00]
and edx, ecx
or ecx, eax
xor ecx, edx
add ecx, 0xe3b0e04e
mov edx, ecx
and edx, 0x23
xor ecx, 0xa3
lea ecx, [ecx + edx*2]
mov byte [esp + eax - 0x545d6cff], cl
inc eax
cmp eax, 0x545d6d1d
jne 0x425320
push 0
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0xac]
call fcn.00420fe0
add esp, 0x14
mov ebx, eax
jmp dword [0x448628]
push edi
call fcn.004084e0
add esp, 4
mov eax, ebx
add esp, 0x88
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4297f9
Capabilities:
Encode data using xor

Disassembly:
mov ebx, dword [esp + 0x4c]
test ebx, ebx
jns 0x429808
mov eax, 0xffffffff
jmp 0x42980b
lea eax, [ebx + ebx]
push eax
call fcn.004084d0
add esp, 4
lea ecx, [esp + 0x4c]
push ecx
push ebx
mov dword [esp + 0x44], eax
push eax
push 9
push esi
push 0
call dword [0x44e1c4]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44902c]

Function at 0x429a72
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
xor eax, eax
cmp ecx, 0xc
setne al
jmp dword [eax*4 + 0x44904c]
Function at 0x431820
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2b0
mov dword [esp + 0x294], 0x449dac
mov dword [esp + 0x8c], 0
lea eax, [esp + 0x8c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4445d8
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x4445e8
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x290], eax
mov eax, dword [esp + 0x294]
mov ecx, dword [esp + 0x290]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x449db4]
xor ecx, 0xbae42cc4
sub eax, ecx
mov dword [esp + 0x28c], 0x4492b0
mov ecx, dword [0x449db8]
mov dword [esp + 0x144], ecx
mov dword [esp + 0x288], 0x449dc0
mov dword [esp + 0x280], 0x449dcc
mov dword [esp + 0x278], 0x449dd8
mov dword [esp + 0x270], 0x4492b0
mov ecx, dword [0x449de4]
mov dword [esp + 0x14c], ecx
mov dword [esp + 0x26c], 0x449dec
mov dword [esp + 0x264], 0x4492b0
mov ecx, dword [0x449df8]
mov dword [esp + 0x18c], ecx
mov dword [esp + 0x260], 0x449e00
mov dword [esp + 0x258], 0x449e0c
mov dword [esp + 0x250], 0x4492b0
mov ecx, dword [0x449e18]
mov dword [esp + 0x188], ecx
mov dword [esp + 0x24c], 0x449e20
mov dword [esp + 0x244], 0x449e2c
mov dword [esp + 0x23c], 0x449e38
mov dword [esp + 0x234], 0x449e44
mov dword [esp + 0x22c], 0x449e50
mov dword [esp + 0x224], 0x449e5c
mov dword [esp + 0x21c], 0x4492b0
mov ecx, dword [0x449e68]
mov dword [esp + 0x180], ecx
mov dword [esp + 0x218], 0x449e70
mov dword [esp + 0x210], 0x4492b0
mov ecx, dword [0x449e7c]
mov dword [esp + 0x17c], ecx
mov dword [esp + 0x20c], 0x449e84
mov dword [esp + 0x204], 0x449e90
mov dword [esp + 0x1fc], 0x449e9c
mov dword [esp + 0x1f4], 0x4492b0
mov ecx, dword [0x449ea8]
mov dword [esp + 0x178], ecx
mov dword [esp + 0x1f0], 0x4492b0
mov ecx, dword [0x449eb0]
mov dword [esp + 0x174], ecx
mov dword [esp + 0x1ec], 0x4492b0
mov ecx, dword [0x449eb8]
mov dword [esp + 0x170], ecx
mov dword [esp + 0x1e8], 0x449ec0
mov dword [esp + 0x1e0], 0x4492b0
mov ecx, dword [0x449ecc]
mov dword [esp + 0x184], ecx
mov dword [esp + 0x1dc], 0x4492b0
mov edi, dword [0x449ed4]
mov dword [esp + 0x1d8], 0x449edc
mov dword [esp + 0x1d0], 0x449ee8
mov dword [esp + 0x1c8], 0x4492b0
mov edx, dword [0x449ef4]
mov dword [esp + 0x1c4], 0x4492b0
mov ecx, dword [0x449efc]
mov dword [esp + 0x1c0], 0x449f04
mov dword [esp + 0x1b8], 0x449f10
mov dword [esp + 0x1b0], 0x4492b0
mov esi, dword [0x449f1c]
mov dword [esp + 0x16c], esi
mov dword [esp + 0x1ac], 0x4492b0
mov esi, dword [0x449f24]
mov dword [esp + 0x168], esi
mov dword [esp + 0x1a8], 0x4492b0
mov esi, dword [0x449f2c]
mov dword [esp + 0x160], esi
mov dword [esp + 0x1a4], 0x4492b0
mov esi, dword [0x449f34]
mov dword [esp + 0x15c], esi
mov dword [esp + 0x1a0], 0x4492b0
mov esi, dword [0x449f3c]
mov dword [esp + 0x190], esi
mov dword [esp + 0x19c], 0x4492b0
xor ebx, ebx
mov esi, dword [0x449f44]
jmp eax
Function at 0x438e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x438e90
mov dword [esp], 0x2020093
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov esi, 0xda645640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi + 0x259ba9c0]
xor edi, esi
mov ebx, edi
not ebx
mov ebp, ebx
or ebp, 0xbf
or ebx, 0x40
add ebx, ebp
lea ebx, [ebx + edi*2]
add bl, 0xc2
mov byte [esp + esi + 0x259ba9c0], bl
inc esi
cmp esi, 0xda645647
jne 0x438ec0
test edx, edx
je 0x438f5e
mov esi, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x438f21
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x438f10
cmp edi, 3
jb 0x438f5e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edi*2]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 2]
xor eax, ebx
imul eax, esi
movzx ebx, word [ecx + edi*2 + 4]
xor ebx, eax
imul ebx, esi
movzx eax, word [ecx + edi*2 + 6]
xor eax, ebx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x438f30
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.004413a0
add esp, 0x14
test eax, eax
js 0x439c60
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00441750
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x439bba
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x439b88
mov eax, 0xffffffff
jmp 0x439b8f
lea eax, [eax*2 + 2]
push eax
call fcn.004084d0
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00441d20
add esp, 0x14
test eax, eax
jns 0x439bba
push esi
call fcn.004084e0
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x8c8d8a8b
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
add cl, 0x62
xor cl, byte [esp + ebx + 4]
add cl, 0x16
mov byte [esp + ebx + 4], cl
inc ebx
cmp ebx, 7
jne 0x439be0
mov ecx, dword [0x44e1c8]
test ecx, ecx
je 0x439c44
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44e1cc]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x439c2a
mov ebp, edi
and ebp, 1
xor edi, 1
lea edi, [edi + ebp*2]
cmp edi, ecx
jb 0x439c10
jmp 0x439c44
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x439c44
push eax
push 4
push ecx
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x10
test esi, esi
jne 0x439c62
lea eax, [esp + 4]
push eax
call fcn.00440b20
add esp, 4
test al, al
je 0x439c60
cmp dword [esp + 4], 1
je 0x439c62
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b900
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x18]
mov dword [esp], 0xc3c2c110
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x92adf2b0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x6d520d50]
xor ecx, eax
neg ecx
mov edx, ecx
and edx, 0x71
add edx, edx
xor ecx, 0x8e
sub ecx, edx
add cl, 2
mov byte [esp + eax + 0x6d520d50], cl
inc eax
cmp eax, 0x92adf2b7
jne 0x43b930
mov eax, dword [esp]
mov eax, dword fs:[eax]
mov edi, dword [eax + 0x18]
mov ebx, dword [0x4561ec]
jmp dword [0x44aa74]