joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4288f0
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x6c
mov eax, dword [0x451adc]
mov dword [esp], 0xf3a6f19d
mov dword [esp + 4], 0xff5dfd4b
mov dword [esp + 8], 0xfb4ef959
mov dword [esp + 0xc], 0xc776c585
mov dword [esp + 0x10], 0xc38ec170
mov dword [esp + 0x14], 0xcf72cd6d
mov dword [esp + 0x18], 0xcba7c969
mov dword [esp + 0x1c], 0xd5d4
mov ecx, 0xc202d954
movzx edx, byte [esp + ecx + 0x3dfd26ac]
mov esi, ecx
and esi, edx
lea edi, [ecx + edx]
add esi, esi
sub edx, esi
add edx, ecx
add edx, 0x5b
and edi, 1
or edx, 1
sub edx, edi
inc dl
mov byte [esp + ecx + 0x3dfd26ac], dl
inc ecx
cmp ecx, 0xc202d974
jne 0x428940
lea edx, [esp + 0x50]
mov ecx, esp
push edx
push 0
push 0
push 0xe
push ecx
push 0
call eax
mov edi, dword [esp + 0x50]
test edi, edi
jns 0x428993
mov eax, 0xffffffff
jmp 0x428996
lea eax, [edi + edi]
push eax
call fcn.0040c650
add esp, 4
mov dword [esp + 0x54], eax
mov esi, dword [0x451adc]
mov dword [esp], 0x31e23f1b
mov dword [esp + 4], 0x35d733c1
mov dword [esp + 8], 0xc9ca37d7
mov dword [esp + 0xc], 0xcd3acb0b
mov dword [esp + 0x10], 0xc10acf3c
mov dword [esp + 0x14], 0xc536c323
mov dword [esp + 0x18], 0xd9e1c727
mov word [esp + 0x1c], 0xdbd8
mov dword [esp + 0x1e], 0
mov ebp, 0x75
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ebp - 0x75]
mov edx, ebx
and edx, ebp
mov eax, edx
or al, 0xfd
inc al
mov ecx, edx
and cl, 0xfd
mul cl
mov ecx, eax
add cl, bl
mov eax, edx
shr al, 1
and al, 1
or dl, 2
mul dl
add al, al
sub cl, al
movzx eax, cl
add eax, ebp
add al, 0xb7
mov byte [esp + ebp - 0x75], al
inc ebp
cmp ebp, 0x97
jne 0x428a00
lea eax, [esp + 0x50]
push eax
push edi
mov ebx, dword [esp + 0x5c]
push ebx
push 0xe
lea eax, [esp + 0x10]
push eax
push 0
call esi
mov eax, dword [esp + 0x50]
mov ecx, eax
add ecx, 9
jns 0x428a65
mov eax, 0xffffffff
jmp 0x428a6c
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040c650
add esp, 4
mov edi, eax
mov dword [esp], 0x895a8b28
mov dword [esp + 4], 0x853b8737
mov dword [esp + 8], 0x813d8331
mov dword [esp + 0xc], 0x9d259f39
mov dword [esp + 0x10], 0x999a9b11
mov word [esp + 0x14], 0
mov eax, 0x1cb91d63
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x1cb91d63]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x11
mov byte [esp + eax - 0x1cb91d63], cl
inc eax
cmp eax, 0x1cb91d79
jne 0x428ab0
movzx ecx, word [ebx]
mov eax, edi
test cx, cx
je 0x428b01
lea edx, [ebx + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428af0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x428b31
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428b20
mov word [eax], 0
lea eax, [esp + 0x68]
push eax
push edi
call fcn.004459c0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d4e4]
Function at 0x428f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
push eax
sub esp, 0x40
mov edi, esp
sub esp, 0x18
mov dword [ebp - 0x10], esp
mov eax, dword [0x451adc]
mov dword [ebp - 0x5c], 0xf93dfbdf
mov dword [ebp - 0x58], 0xfd6eff68
mov dword [ebp - 0x54], 0xf155f338
mov dword [ebp - 0x50], 0xf551f764
mov dword [ebp - 0x4c], 0xe946eb2f
mov dword [ebp - 0x48], 0xed76ef5c
mov dword [ebp - 0x44], 0xe170e367
mov dword [ebp - 0x40], 0xe57de744
mov dword [ebp - 0x3c], 0xd97cdb72
mov dword [ebp - 0x38], 0xdd48df47
mov dword [ebp - 0x34], 0xd17ed378
mov dword [ebp - 0x30], 0xd540d760
mov dword [ebp - 0x2c], 0xc950cb45
mov dword [ebp - 0x28], 0xcd52cf57
mov dword [ebp - 0x24], 0xc157c357
mov dword [ebp - 0x20], 0xc7c0
mov ecx, 0x9cdd7f7f
nop
movzx edx, byte [ebp + ecx + 0x63228025]
xor edx, ecx
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
add dl, 0x84
mov byte [ebp + ecx + 0x63228025], dl
inc ecx
cmp ecx, 0x9cdd7fbf
jne 0x429010
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x5c]
push edx
push 0
push 0
push 0x1e
push ecx
push 0
call eax
mov eax, dword [ebp - 0x14]
test eax, eax
jns 0x42905a
mov ebx, eax
mov eax, 0xffffffff
jmp 0x42905e
mov ebx, eax
add eax, eax
push eax
call fcn.0040c650
add esp, 4
mov ecx, dword [0x451adc]
mov dword [ebp - 0x18], ecx
mov dword [edi], 0xe92debcf
mov dword [edi + 4], 0xed1eef18
mov dword [edi + 8], 0xf115f328
mov dword [edi + 0xc], 0xf511f704
mov dword [edi + 0x10], 0xf926fbdf
mov dword [edi + 0x14], 0xfd16ff2c
mov dword [edi + 0x18], 0x81708307
mov dword [edi + 0x1c], 0x856d8764
mov dword [edi + 0x20], 0x896c8b72
mov dword [edi + 0x24], 0x8d788f67
mov dword [edi + 0x28], 0x914e9368
mov dword [edi + 0x2c], 0x95609740
mov dword [edi + 0x30], 0x99709b65
mov dword [edi + 0x34], 0x9d729f77
mov dword [edi + 0x38], 0xa157a377
mov dword [edi + 0x3c], 0xa7a0
mov byte [edi + 0x40], 0
mov ecx, 0x36ea6570
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [edi + ecx - 0x36ea6570]
lea esi, [ecx - 0x36ea6549]
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov esi, edx
xor esi, 0xd
and edx, 0x72
add edx, edx
sub edx, esi
inc dl
mov byte [edi + ecx - 0x36ea6570], dl
inc ecx
cmp ecx, 0x36ea65b1
jne 0x4290f0
lea ecx, [ebp - 0x14]
push ecx
push ebx
mov dword [ebp - 0x1c], eax
push eax
push 0x1e
push edi
push 0
call dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x29c22bd0
mov dword [eax + 4], 0x2dbc2fb3
mov dword [eax + 8], 0xd139d3c8
mov dword [eax + 0xc], 0xd530d746
mov dword [eax + 0x10], 0xd94cdb3b
mov dword [eax + 0x14], 0xdddedf3c
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 0x3c
mov edi, ecx
xor edi, 0x212b545e
mov ebx, 0x66
sub ebx, edx
sub ebx, edi
add edx, edi
add edx, 0x99
mov edi, dword [ebp - 0x10]
movzx esi, byte [edi + ecx]
or edx, esi
not esi
or esi, ebx
and edx, esi
add dl, 0x2d
mov byte [edi + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0x18
jne 0x429170
push 0
push 0
push edi
mov esi, dword [ebp - 0x1c]
push esi
push dword [ebp + 8]
call fcn.00423e60
add esp, 0x14
mov ebx, eax
jmp dword [0x44d51c]
Function at 0x429200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xd8
push eax
sub esp, 0xffc
mov eax, esp
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x94], eax
push eax
mov dword [ebp - 0xd8], esp
push eax
mov dword [ebp - 0x20], esp
sub esp, 0xa4
mov dword [ebp - 0x68], esp
sub esp, 0xa8
mov dword [ebp - 0x88], esp
sub esp, 0xe8
mov dword [ebp - 0x64], esp
sub esp, 0xec
mov dword [ebp - 0x4c], esp
sub esp, 0xa4
mov dword [ebp - 0x74], esp
sub esp, 0xa4
mov dword [ebp - 0x3c], esp
sub esp, 0xa4
mov dword [ebp - 0x70], esp
sub esp, 0xa4
mov dword [ebp - 0x28], esp
sub esp, 0xa4
mov dword [ebp - 0x6c], esp
sub esp, 0xa8
mov dword [ebp - 0x1c], esp
sub esp, 0x14
mov esi, esp
sub esp, 0x200
mov dword [ebp - 0x18], esp
sub esp, 0x14
mov dword [ebp - 0x34], esp
push eax
mov dword [ebp - 0x58], esp
push eax
sub esp, 0x7fc
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0xa0], esp
push eax
mov edi, esp
sub esp, 0x400
mov dword [ebp - 0x44], esp
push eax
mov dword [ebp - 0x60], esp
sub esp, 0x14
mov eax, esp
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x48], eax
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x38], eax
sub esp, 0x28
mov dword [ebp - 0x8c], esp
mov dword [ebp - 0xc8], 0x93c091f4
mov dword [ebp - 0xc4], 0xaff1adf1
mov dword [ebp - 0xc0], 0xabf9a9f1
mov dword [ebp - 0xbc], 0xa7f4a5c8
mov dword [ebp - 0xb8], 0xa3c6a1c9
mov dword [ebp - 0xb4], 0xbfedbdd1
mov dword [ebp - 0xb0], 0xbbe8b9e5
mov dword [ebp - 0xac], 0xb5b4
mov byte [ebp - 0xa8], 0
mov eax, 0x392cca9c
nop
nop
nop
movzx ecx, byte [ebp + eax - 0x392ccb64]
xor ecx, eax
mov edx, ecx
and edx, 0x73
xor ecx, 0xf3
lea ecx, [ecx + edx*2]
inc cl
mov byte [ebp + eax - 0x392ccb64], cl
inc eax
cmp eax, 0x392ccabd
jne 0x429340
lea eax, [ebp - 0x84]
lea ecx, [ebp - 0xc8]
push 0
push 0
push 0x20019
push eax
push ecx
call fcn.00445f20
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0x44d534]
Function at 0x42be90
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.0042beb0
add esp, 4
test al, al
je 0x42c520
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xc4
mov dword [esp + 0xa0], 0x11801f67
mov dword [esp + 0xa4], 0x15861385
mov dword [esp + 0xa8], 0x98a1777
mov dword [esp + 0xac], 0xd7a0b94
mov dword [esp + 0xb0], 0x19a0f6f
mov dword [esp + 0xb4], 0x5020398
mov byte [esp + 0xb8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x85
xor cl, byte [esp + eax + 0xa0]
add cl, 0x67
mov byte [esp + eax + 0xa0], cl
inc eax
cmp eax, 0x19
jne 0x42c580
mov dword [esp + 0x18], 0xc1b4c7a0
mov dword [esp + 0x1c], 0xcd8bc38f
mov dword [esp + 0x20], 0xc9b3cf87
mov dword [esp + 0x24], 0xf5b8cbb4
mov dword [esp + 0x28], 0xf192f78f
mov dword [esp + 0x2c], 0xfdb1f387
mov dword [esp + 0x30], 0xf9b6ffb1
mov dword [esp + 0x34], 0xe58cfbb3
mov dword [esp + 0x38], 0xe182e7ab
mov dword [esp + 0x3c], 0xed93e39d
mov dword [esp + 0x40], 0xe992efa2
mov dword [esp + 0x44], 0x15a9eb91
mov dword [esp + 0x48], 0x11591766
mov dword [esp + 0x4c], 0x1d6c1374
mov dword [esp + 0x50], 0x198a1f7f
mov dword [esp + 0x54], 0x5751b86
mov dword [esp + 0x58], 0x17b0760
mov dword [esp + 0x5c], 0xd6d039c
mov dword [esp + 0x60], 0x9990f6f
mov word [esp + 0x64], 0xb08
mov byte [esp + 0x68], 0
mov word [esp + 0x66], 0
mov eax, 0xab102dd1
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x54efd247]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
add cl, 0xea
mov byte [esp + eax + 0x54efd247], cl
inc eax
cmp eax, 0xab102e22
jne 0x42c650
lea ecx, [esp + 0xa0]
lea eax, [esp + 0x18]
push ecx
push eax
call fcn.0043cad0
add esp, 8
mov edi, eax
xor eax, eax
test edi, edi
sete al
jmp dword [eax*4 + 0x44dc78]
Function at 0x430170
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, edx
mov esi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
xor ebp, ebp
nop
nop
nop
nop
nop
nop
cmp byte [ebx + ebp], 0
lea ebp, [ebp + 1]
jne 0x430190
push ebp
call fcn.0040c650
add esp, 4
mov dword [esp + 8], esi
mov dword [esi], eax
mov ecx, ebp
shr ecx, 2
mov edx, ebx
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebp
and edx, 0xfffffffc
add eax, edx
add edx, ebx
mov esi, ebp
and esi, 3
mov ecx, esi
shr ecx, 1
mov dword [esp + 4], edx
mov dword [esp], eax
mov edi, eax
mov eax, dword [esp + 4]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov ecx, ebp
xor ecx, 2
and ecx, esi
je 0x4301fb
mov esi, ebp
and esi, 2
add edx, esi
mov eax, dword [esp]
add eax, esi
push ecx
push edx
push eax
call fcn.0040c680
add esp, 0xc
xor edx, edx
cmp ebp, 1
je 0x4302f1
mov eax, 1
sub eax, ebp
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebx]
xor ecx, edx
mov edx, ecx
shr edx, 1
mov esi, ecx
xor esi, 0xfffffffe
or ecx, 1
and ecx, esi
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr edx, 1
mov esi, ecx
xor esi, 0xfffffffe
or ecx, 1
and ecx, esi
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr edx, 1
mov esi, ecx
xor esi, 0xfffffffe
or ecx, 1
and ecx, esi
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr edx, 1
mov esi, ecx
xor esi, 0xfffffffe
or ecx, 1
and ecx, esi
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr edx, 1
mov esi, ecx
xor esi, 0xfffffffe
or ecx, 1
and ecx, esi
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr edx, 1
mov esi, ecx
xor esi, 0xfffffffe
or ecx, 1
and ecx, esi
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr edx, 1
mov esi, ecx
xor esi, 0xfffffffe
or ecx, 1
and ecx, esi
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov esi, ecx
shr esi, 1
mov edx, ecx
xor edx, 0xfffffffe
or ecx, 1
and ecx, edx
neg ecx
and ecx, 0xedb88320
mov edx, ecx
xor edx, esi
inc ebx
inc eax
jne 0x430220
not edx
mov eax, dword [esp + 8]
mov dword [eax + 4], edx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436e30
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebp, dword [esp + 0x44]
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x436fab
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
xor ebx, ebx
cmp edi, 0
je 0x436fa5
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.0040c810
jmp 0x436ea7
cmp eax, 0
setne cl
jmp 0x436eaf
jmp 0x436eb1
xor ebx, ebx
test cl, 1
jne 0x436ebd
jmp 0x436f97
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], esi
mov cl, byte [esp + 0xc]
mov byte [esp + 0x10], cl
mov byte [esp + 0x14], 0x63
mov byte [esp + 0x15], 0xbd
mov byte [esp + 0x16], 0xbb
mov byte [esp + 0x17], 0xb3
mov byte [esp + 0x18], 0x46
mov byte [esp + 0x19], 0xba
mov byte [esp + 0x1a], 0x47
mov byte [esp + 0x1b], 0xb5
mov byte [esp + 0x1c], 0x3c
mov byte [esp + 0x1d], 7
mov byte [esp + 0x1e], 0xce
mov byte [esp + 0x1f], 0xd3
mov byte [esp + 0x20], 0xc8
mov byte [esp + 0x21], 0x5d
mov ecx, 0xe
mov byte [esp + ecx + 0x14], 0
add ecx, 1
cmp ecx, 0x14
jne 0x436f18
xor esi, esi
cmp esi, 0x14
jae 0x436f6f
mov eax, ebp
movzx ebp, byte [esp + esi + 0x14]
mov ebx, esi
xor ebx, 0x534a6d49
mov ecx, esi
shl ecx, 1
and ecx, 0x596b256c
sub ecx, ebx
mov ebx, ecx
add ebx, 0x81
mov edx, ebp
xor edx, 0xffffffff
and ebx, edx
mov edx, 0x7e
sub edx, ecx
and edx, ebp
mov ebp, eax
or ebx, edx
add bl, 0xe8
mov byte [esp + esi + 0x14], bl
add esi, 1
jmp 0x436f27
lea edx, [esp + 0x14]
mov ecx, ebp
mov dword [esp], edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
call fcn.0040d100
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x436f97
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x436fa5
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43bd30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x43bd50
mov dword [esp], 0x969a9401
mov esi, 0xe4
mov edi, 0x1b
nop
nop
nop
nop
movzx ebp, byte [esp + edi - 0x1b]
mov ecx, edi
or ecx, ebp
mov ebx, ecx
sub ebx, ebp
add ebx, esi
and ebx, ecx
add bl, 0x79
mov byte [esp + edi - 0x1b], bl
dec esi
inc edi
cmp edi, 0x1f
jne 0x43bd70
test edx, edx
je 0x43be0e
mov esi, dword [esp]
sar edx, 1
lea edi, [edx - 1]
mov ebx, edx
and ebx, 3
je 0x43bdc8
mov ebp, eax
mov ecx, dword [esp + 0x18]
nop
nop
nop
nop
nop
nop
nop
nop
dec edx
movzx eax, word [ecx]
add ecx, 2
xor eax, ebp
imul eax, esi
mov ebp, eax
dec ebx
jne 0x43bdb0
cmp edi, 3
jae 0x43bdd1
jmp 0x43be0e
mov ecx, dword [esp + 0x18]
cmp edi, 3
jb 0x43be0e
mov ebx, ecx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edi*2]
xor ecx, eax
imul ecx, esi
movzx eax, word [ebx + edi*2 + 2]
xor eax, ecx
imul eax, esi
movzx ecx, word [ebx + edi*2 + 4]
xor ecx, eax
imul ecx, esi
movzx eax, word [ebx + edi*2 + 6]
xor eax, ecx
imul eax, esi
add edi, 4
cmp edx, edi
jne 0x43bde0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43be20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov eax, 0x9f
mov ecx, 0xc82e3d60
nop
movzx esi, byte [esp + ecx + 0x37d1c2a0]
lea edx, [esi + esi]
not edx
add edx, esi
and edx, ecx
lea edi, [eax - 0x37d1c300]
mov ebp, eax
and ebp, 0x83
mov ebx, ecx
and ebx, 0x44
or ebx, ebp
xor ebx, 0x5c
or ebx, edi
and ebx, esi
or ebx, edx
add bl, 0x20
mov byte [esp + ecx + 0x37d1c2a0], bl
dec eax
inc ecx
cmp eax, 0x99
jne 0x43be40
mov eax, dword [esp]
mov ecx, dword [0x451ae0]
test ecx, ecx
je 0x43bed2
xor edx, edx
mov esi, dword [0x451ae4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xd518dba1
je 0x43beb0
inc edx
cmp ecx, edx
jne 0x43bea0
jmp 0x43bed2
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43bed2
lea eax, [esp + 0x14]
push eax
push 8
push 0xffffffffffffffff
push 3
push dword [0x451ae8]
push ecx
call fcn.004425f0
add esp, 0x18
test eax, eax
js 0x43bf70
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov ebp, 0x9f
mov edx, 0xc82e3d60
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx + 0x37d1c2a0]
lea esi, [edi + edi]
not esi
add esi, edi
and esi, edx
lea ecx, [ebp - 0x37d1c300]
mov eax, ebp
and eax, 0x83
mov ebx, edx
and ebx, 0x44
or ebx, eax
xor ebx, 0x5c
or ebx, ecx
and ebx, edi
or ebx, esi
add bl, 0x20
mov byte [esp + edx + 0x37d1c2a0], bl
dec ebp
inc edx
cmp ebp, 0x99
jne 0x43bf00
mov eax, dword [esp]
mov edx, dword [0x451ae0]
test edx, edx
je 0x43bf83
xor ecx, ecx
mov esi, dword [0x451ae4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ecx*8], 0xd1a85eee
je 0x43bf77
inc ecx
cmp edx, ecx
jne 0x43bf60
jmp 0x43bf83
xor ebx, ebx
jmp 0x43c031
mov edx, dword [esi + ecx*8 + 4]
cmp edx, eax
jne 0x43c03b
mov dword [esp + 0xc], eax
mov dword [esp], 0xbcbdbebf
mov word [esp + 4], 0
mov ebp, 0x9f
mov esi, 0xc82e3d60
nop
movzx ebx, byte [esp + esi + 0x37d1c2a0]
lea edi, [ebx + ebx]
not edi
add edi, ebx
and edi, esi
lea eax, [ebp - 0x37d1c300]
mov edx, ebp
and edx, 0x83
mov ecx, esi
and ecx, 0x44
or ecx, edx
xor ecx, 0x5c
or ecx, eax
and ecx, ebx
or ecx, edi
add cl, 0x20
mov byte [esp + esi + 0x37d1c2a0], cl
dec ebp
inc esi
cmp ebp, 0x99
jne 0x43bfa0
cmp dword [esp + 0xc], 0
setns bl
mov eax, dword [0x451ae0]
test eax, eax
je 0x43c02d
mov edx, dword [esp]
xor ecx, ecx
mov esi, dword [0x451ae4]
nop
cmp dword [esi + ecx*8], 0x7e776f1
je 0x43c010
inc ecx
cmp eax, ecx
jne 0x43c000
jmp 0x43c02d
mov eax, dword [esi + ecx*8 + 4]
cmp eax, edx
je 0x43c02d
push dword [esp + 0x10]
push 1
push dword [0x451ae8]
push eax
call fcn.004425f0
add esp, 0x10
and bl, byte [esp + 0xb]
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, esp
lea ecx, [esp + 0x18]
push eax
push 4
push ecx
push 0x14
push dword [esp + 0x20]
push 5
push dword [0x451ae8]
push edx
call fcn.004425f0
add esp, 0x20
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x18], 0
setne byte [esp + 0xb]
jmp 0x43bf87
Function at 0x43c800
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x18]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.00445820
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44f340]

Function at 0x43cad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
lea eax, [esp + 4]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x40]
call fcn.00445f20
add esp, 0x14
test eax, eax
js 0x43cc51
lea ebx, [esp + 0x14]
lea eax, [esp + 0x18]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x24]
call fcn.00446310
add esp, 0x24
test eax, eax
js 0x43cb33
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
mov ecx, eax
inc ecx
jns 0x43cb3c
mov eax, 0xffffffff
jmp 0x43cb43
mov dword [esp], 0
jmp 0x43cb78
lea eax, [eax*2 + 2]
push eax
call fcn.0040c650
add esp, 4
mov edi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x14]
call fcn.00446920
add esp, 0x14
test eax, eax
js 0x43cb68
mov dword [esp], edi
jmp 0x43cb78
mov dword [esp], 0
push edi
call fcn.0040c660
add esp, 4
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0xbcbdbebf
mov word [esp + 0xc], 0
mov esi, 0x9f
mov ebp, 0xc82e3d60
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ebp + 0x37d1c2a8]
lea edi, [ebx + ebx]
not edi
add edi, ebx
and edi, ebp
lea eax, [esi - 0x37d1c300]
mov ecx, esi
and ecx, 0x83
mov edx, ebp
and edx, 0x44
or edx, ecx
xor edx, 0x5c
or edx, eax
and edx, ebx
or edx, edi
add dl, 0x20
mov byte [esp + ebp + 0x37d1c2a8], dl
dec esi
inc ebp
cmp esi, 0x99
jne 0x43cba0
mov ecx, dword [0x451ae0]
test ecx, ecx
mov eax, dword [esp]
je 0x43cc31
mov edx, dword [esp + 8]
xor edi, edi
mov ebx, dword [0x451ae4]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43cc10
inc edi
cmp ecx, edi
jne 0x43cc00
jmp 0x43cc31
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43cc31
push dword [esp + 0x10]
push 1
push dword [0x451ae8]
push ecx
mov esi, eax
call fcn.004425f0
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x43cc53
mov esi, eax
lea eax, [esp + 8]
push eax
call fcn.00445600
add esp, 4
test al, al
je 0x43cc51
mov eax, esi
cmp dword [esp + 8], 1
je 0x43cc53
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43cd80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x43ce75
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x43cdb9
lea ecx, [edi + 4]
add edi, 2
mov eax, dword [esp]
mov esi, eax
cmp edi, edx
mov edi, ecx
mov ebp, dword [esp + 0x18]
jae 0x43ce77
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.00422f30
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.00422f30
mov edx, dword [esp + 0x20]
add esp, 4
mov bl, al
shl bh, 2
xor al, 0xc0
mov ecx, ebx
or cl, 0x30
and cl, al
shr cl, 4
add cl, bh
lea eax, [esi + 1]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov byte [eax + esi], cl
cmp edi, edx
jae 0x43cda0
movzx eax, byte [ebp + edi]
push eax
call fcn.00422f30
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x43cda0
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea ebx, [esi + 2]
mov dword [esp], ebx
mov ebx, dword [esp + 0x20]
mov byte [ebx + esi + 1], cl
lea ecx, [edi + 1]
cmp ecx, edx
jae 0x43cda0
mov ecx, dword [esp + 0x18]
movzx ecx, byte [ecx + edi + 1]
push ecx
mov ebx, eax
call fcn.00422f30
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x43cda0
mov ecx, ebx
shl cl, 6
add al, cl
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi + 2], al
add esi, 3
mov dword [esp], esi
jmp 0x43cda0
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fa10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x313e3f0c
mov word [esp + 4], 0
mov ecx, 0x3b7d0f75
mov edx, 2
nop
movzx esi, byte [esp + ecx - 0x3b7d0f75]
lea edi, [esi + esi]
not edi
add edi, esi
mov ebx, edi
xor ebx, 0x3e83ec2b
or edi, 0xc17c13d4
and edi, ebx
and esi, 0x2b
mov ebp, edx
and ebp, 4
mov ebx, edi
xor ebx, esi
not esi
and esi, edi
add ebx, edi
sub ebx, esi
mov esi, ecx
and esi, 0x3a6d0d2b
or esi, ebp
mov edi, esi
xor edi, 0x7f
or edi, ebx
not ebx
or ebx, esi
or ebx, 0x80
and ebx, edi
mov al, 0xb6
sub al, bl
mov byte [esp + ecx - 0x3b7d0f75], al
inc ecx
dec edx
cmp ecx, 0x3b7d0f7b
jne 0x43fa30
mov eax, dword [esp]
mov ecx, dword fs:[eax]
mov ecx, dword [ecx + 0x18]
mov edx, dword [0x44f794]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx

Function at 0x43fad0
Capabilities:
Encode data using xor

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44f7b8]