joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a3db
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov edx, dword [0x435884]
lea edi, [ebp - 0x60]
push 0xf
pop ecx
mov esi, str.onecoreuap_base_appmodel_searchcommonutils_regredirect.cxx
or edx, 0x21122cd2
rep movsd dword es:[edi], dword [esi]
push 0x53
xor ebx, ebx
xor edx, 0x539640f7
pop ecx
movsb byte es:[edi], byte [esi]
mov eax, ebx
cmp byte [ebp - 0x60], cl
jne 0x41a445
test cl, cl
je 0x41a427
cmp byte [ebp + eax - 0x60], bl
je 0x41a427
mov cl, byte [eax + 0x430fd1]
inc eax
cmp cl, byte [ebp + eax - 0x60]
je 0x41a410
mov ecx, dword [ebp - 8]
jmp 0x41a441
cmp ecx, 0x14be
jne 0x41a43a
xor edx, 0xa9ad1f09
or edx, 0x50ba473c
inc ecx
cmp ecx, eax
jb 0x41a42c
mov esi, 0x430ed0
lea edi, [ebp - 0x1c]
and edx, 0x8088809
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x1c], 0x6f
jne 0x41a499
mov cl, 0x6f
test cl, cl
je 0x41a47b
cmp byte [ebp + eax - 0x1c], bl
je 0x41a47b
mov cl, byte [eax + 0x430f31]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0x41a464
mov ecx, dword [ebp - 8]
jmp 0x41a495
cmp ecx, 0x24da
jne 0x41a48e
or edx, 0xc57360c0
or edx, 0xd07dd4f1
inc ecx
cmp ecx, eax
jb 0x41a480
push 5
pop ecx
mov esi, 0x42ccc4
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
push 0x53
pop ecx
mov eax, ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x20], cl
jne 0x41a4ed
xor ebx, ebx
test cl, cl
je 0x41a4cc
cmp byte [ebp + eax - 0x20], bl
je 0x41a4cc
mov cl, byte [eax + 0x430fd1]
inc eax
cmp cl, byte [ebp + eax - 0x20]
je 0x41a4b5
mov esi, dword [ebp - 8]
push 0x53
pop ecx
jmp 0x41a4e9
cmp esi, 0x998
jne 0x41a4e2
imul edx, edx, 0xa4c24f8c
xor edx, 0x93829a0b
inc esi
cmp esi, eax
jb 0x41a4d4
mov esi, ebx
or edx, 0x884acae5
inc esi
cmp byte [esi + 0x4310c0], 0
jne 0x41a4ef
mov eax, edx
mov edi, 0x431000
xor eax, 0x4bbfd9f6
add edx, 0x34ce3830
cmp esi, 0x186f
cmovbe edx, eax
lea edi, [edi + 2]
xor edx, 0xd7faaf99
cmp word [edi], bx
jne 0x41a51a
mov esi, str.connection_refused
mov dword [0x435884], edx
lea edi, [ebp - 0x1c]
and edx, 0xebf3144b
add edx, 0x2e8d3d6f
mov eax, ebx
or edx, 0x2339d6cc
movsd dword es:[edi], dword [esi]
imul edx, edx, 0x4d6ed27c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x1c], cl
jne 0x41a574
test cl, cl
je 0x41a574
cmp byte [ebp + eax - 0x1c], 0
je 0x41a574
mov cl, byte [eax + 0x430fd1]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0x41a55c
movzx ecx, byte [eax + 0x430fd0]
movzx eax, byte [ebp + eax - 0x1c]
sub ecx, eax
cmp ecx, 0x16f7
jbe 0x41a592
imul eax, edx, 0xb096195f
jmp 0x41a598
imul eax, edx, 0xae3a3201
imul eax, eax, 0x16dec23e
mov edx, 0x7a6612cc
sub edx, eax
and edx, 0x82df4119
inc ebx
cmp byte [ebx + 0x430f30], 0
jne 0x41a5a5
lea ecx, [edx - 0x548c88f6]
or edx, 0x666a5d27
cmp ebx, 0x218d
pop edi
cmovae edx, ecx
pop esi
mov dword [0x435884], edx
mov eax, edx
pop ebx
leave
ret
Function at 0x41a602
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 8
mov bh, cl
xor ah, ah
pop esi
mov bl, dl
mov al, ah
xor al, bh
and bl, 1
movzx ecx, al
test bl, bl
movzx eax, ah
cmove ecx, eax
shr dl, 1
mov ah, cl
mov byte [ebp - 1], dl
mov cl, bh
add cl, cl
mov al, cl
movzx ecx, cl
xor al, 0x1b
test bh, bh
movzx edx, al
cmovns edx, ecx
mov bh, dl
mov dl, byte [ebp - 1]
sub esi, 1
jne 0x41a60f
pop esi
mov al, ah
pop ebx
leave
ret

Function at 0x41a9e2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
add edx, 2
push esi
shl eax, 4
add ecx, 8
push 4
add edx, eax
pop esi
mov al, byte [edx - 2]
xor byte [ecx - 8], al
mov al, byte [edx - 1]
xor byte [ecx - 4], al
mov al, byte [edx]
lea edx, [edx + 4]
xor byte [ecx], al
mov al, byte [edx - 3]
xor byte [ecx + 4], al
inc ecx
sub esi, 1
jne 0x41a9f8
pop esi
pop ebp
ret

Function at 0x41af17
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x10
sub ecx, edx
pop esi
mov al, byte [ecx + edx]
xor byte [edx], al
inc edx
sub esi, 1
jne 0x41af1d
pop esi
ret
Function at 0x41c1cf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, edx
push edi
push dword [ebp + 8]
mov edi, ecx
movzx eax, word [esi + 0x14]
mov ecx, dword [esi + 0x78]
add eax, 0x18
add eax, esi
mov dword [ebp - 8], edi
mov edx, eax
mov dword [ebp - 4], eax
call fcn.0041c19a
push dword [ebp + 8]
mov edx, dword [ebp - 4]
lea ebx, [edi + eax]
mov ecx, dword [ebx + 0x20]
mov dword [ebp - 0xc], ebx
call fcn.0041c19a
push dword [ebp + 8]
mov edx, dword [ebp - 4]
add eax, edi
mov ecx, dword [ebx + 0x24]
mov dword [ebp - 0x10], eax
call fcn.0041c19a
add eax, edi
mov esi, 0x42ec58
lea edi, [ebp - 0x24]
mov dword [ebp - 0x14], eax
add esp, 0xc
xor ebx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x24], 0x53
jne 0x41c25e
mov al, 0x53
test al, al
je 0x41c25e
cmp byte [ebp + ebx - 0x24], 0
je 0x41c25e
push ecx
push ecx
call fcn.0041bd55
mov al, byte [ebx + 0x431551]
inc ebx
pop ecx
pop ecx
cmp al, byte [ebp + ebx - 0x24]
je 0x41c23d
movzx ecx, byte [ebx + 0x431550]
movzx eax, byte [ebp + ebx - 0x24]
sub ecx, eax
cmp ecx, 0x4a9
jbe 0x41c280
xor dword [0x4358c4], 0xabab004e
jmp 0x41c294
or dword [0x4358c0], 0x9b347786
mov ecx, 0x431230
call fcn.0041be81
mov edi, dword [ebp - 0xc]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, dword [edi + 0x1c]
call fcn.0041c19a
mov esi, eax
add esp, 4
add esi, dword [ebp - 8]
cmp dword [edi + 0x18], 0
jbe 0x41c2e0
xor ebx, ebx
mov eax, dword [ebp - 0x10]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, dword [eax + ebx*4]
call fcn.0041c19a
add eax, dword [ebp - 8]
add esp, 4
mov edx, dword [ebp + 0xc]
mov ecx, eax
call fcn.0040ba1d
test eax, eax
je 0x41c2e7
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x41c2b5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + ebx*2]
mov eax, dword [esi + eax*4]
jmp 0x41c2e2
Function at 0x41cbe4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x43593c]
sub esp, 0x4c
push ebx
xor ebx, ebx
add edx, 0xf7f8565b
mov ecx, ebx
and edx, 0x87c37dc4
inc ecx
cmp byte [ecx + 0x431990], bl
jne 0x41cbfb
mov eax, dword [ebp - 4]
push esi
cmp eax, ecx
jae 0x41cc2e
mov esi, edx
cmp eax, 0x18b7
jne 0x41cc21
imul edx, esi, 0xb2fad83e
xor edx, 0xb81125c9
inc eax
mov esi, edx
cmp eax, ecx
jb 0x41cc14
push edi
mov esi, 0x42f1e8
lea edi, [ebp - 0x10]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x10], 0x6d
jne 0x41cc5d
mov cl, 0x6d
test cl, cl
je 0x41cc5d
cmp byte [ebp + eax - 0x10], bl
je 0x41cc5d
mov cl, byte [eax + 0x4318c5]
inc eax
cmp cl, byte [ebp + eax - 0x10]
je 0x41cc46
movzx ecx, byte [eax + 0x4318c4]
movzx eax, byte [ebp + eax - 0x10]
sub ecx, eax
cmp ecx, 0x1d6f
jne 0x41cc7b
add edx, 0x3ff01c1c
jmp 0x41cc81
xor edx, 0x148879e5
push 0xe
pop ecx
mov esi, str.onecoreuap_base_appmodel_searchcommon_secutil_secutil.cxx
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
and edx, 0x53714903
mov eax, ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x4c], 0x64
pop edi
jne 0x41ccb9
mov cl, 0x64
test cl, cl
je 0x41ccb9
cmp byte [ebp + eax - 0x4c], bl
je 0x41ccb9
mov cl, byte [eax + 0x431931]
inc eax
cmp cl, byte [ebp + eax - 0x4c]
je 0x41cca2
movzx ecx, byte [eax + str.directory_not_empty]
movzx eax, byte [ebp + eax - 0x4c]
sub ecx, eax
cmp ecx, 0x9a1
jbe 0x41ccd7
or edx, 0x3d5436e
jmp 0x41ccdd
imul edx, edx, 0x59834d44
mov eax, ebx
or edx, 0x867feb9d
add edx, 0xc901ee6b
inc eax
cmp byte [eax + 0x4318c4], bl
jne 0x41cce5
mov ecx, dword [ebp - 4]
cmp ecx, eax
jae 0x41cd19
mov esi, edx
xor esi, 0xed755128
cmp ecx, 0x2a7
cmovne esi, edx
inc ecx
lea edx, [esi + 0x4f6e839f]
mov esi, edx
cmp ecx, eax
jb 0x41ccfd
and edx, 0xf08621a0
mov ecx, 0xf8e2d189
imul eax, edx, 0x4158f0b
pop esi
sub ecx, eax
xor ecx, 0xffdafdbe
or ecx, 0xd5d299b2
add ecx, 0x20dd53d2
and ecx, 0xe071cdd3
inc ebx
cmp byte [ebx + 0x4318c4], 0
jne 0x41cd3f
cmp ebx, 0x1656
pop ebx
jbe 0x41cd60
imul ecx, ecx, 0x716cd69e
jmp 0x41cd66
xor ecx, 0xb800294b
mov eax, 0x4318c4
and ecx, 0xd1958621
inc eax
cmp byte [eax], 0
jne 0x41cd6b
mov dword [0x43593c], ecx
mov eax, ecx
leave
ret
Function at 0x41d2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
mov esi, str.TypeLib
lea edi, [ebp - 0x14]
push 0x6e
xor ebx, ebx
pop edx
movsd dword es:[edi], dword [esi]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dx, word [ebp - 0x14]
jne 0x41d322
mov ecx, ebx
test dx, dx
je 0x41d322
cmp word [ebp + ecx - 0x14], bx
je 0x41d322
inc eax
lea ecx, [eax + eax]
movzx edx, word [ecx + str.no_such_device]
cmp dx, word [ebp + ecx - 0x14]
je 0x41d304
movzx ecx, byte [eax*2 + str.no_such_device]
movzx eax, byte [ebp + eax*2 - 0x14]
sub ecx, eax
cmp ecx, 0x1fe5
jae 0x41d34d
mov esi, dword [0x435944]
mov ecx, dword [0x435930]
add esi, 0x24fffc95
jmp 0x41d35f
mov ecx, dword [0x43598c]
mov esi, dword [0x435938]
or ecx, 0x14c04478
mov eax, ebx
xor ecx, 0x182ab5e7
inc eax
cmp byte [eax + str.SeChangeNotifyPrivilege], bl
jne 0x41d361
mov dword [0x435930], ecx
mov eax, ebx
inc eax
cmp word [eax*2 + str.no_such_device], bx
jne 0x41d378
mov edx, dword [ebp - 4]
jmp 0x41d3a3
cmp edx, 0x8ba
jne 0x41d39c
add ecx, 0x7387c8ef
mov dword [0x435930], ecx
xor esi, 0x2c569920
inc edx
cmp edx, eax
jb 0x41d388
mov eax, ecx
lea ebx, [ecx - 0x118eb26a]
push 0x14
pop ecx
mov esi, 0x42c178
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
and eax, 0xaa37e911
and ebx, 0x7edac170
mov dword [0x435948], eax
imul eax, eax, 0x891554aa
push 0x25
pop ecx
movsw word es:[edi], word [esi]
mov dword [0x435944], ebx
mov dword [0x435938], eax
lea eax, [ebx - 0x265d68eb]
mov dword [0x43598c], eax
xor eax, eax
mov edx, eax
cmp cx, word [ebp - 0x68]
jne 0x41d428
xor esi, esi
test cx, cx
je 0x41d417
cmp word [ebp + eax - 0x68], si
je 0x41d417
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + str._hs__p:]
cmp cx, word [ebp + eax - 0x68]
je 0x41d3f9
cmp dword [ebp - 4], edx
jae 0x41d428
lea ecx, [ebx - 0x4b25085e]
mov dword [0x435938], ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x41d712
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 7
pop ecx
mov esi, 0x42c2f0
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
push 0x6c
xor edx, edx
pop ecx
movsw word es:[edi], word [esi]
mov ebx, edx
cmp cx, word [ebp - 0x24]
jne 0x41d76e
mov eax, edx
test cx, cx
je 0x41d757
cmp word [ebp + eax - 0x24], dx
je 0x41d757
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + str.lineNumber]
cmp cx, word [ebp + eax - 0x24]
je 0x41d739
cmp dword [ebp - 4], ebx
jae 0x41d76e
imul ecx, dword [0x435924], 0x5dea160b
mov dword [0x435988], ecx
jmp 0x41d774
mov ecx, dword [0x435988]
mov ebx, dword [0x435950]
mov edi, ecx
and edi, 0xb29d4699
mov esi, edx
imul eax, ebx, 0xc81f7dd0
mov dword [0x435924], edi
mov dword [0x435920], eax
xor ebx, 0x7f79f734
inc esi
cmp word [esi*2 + str.lineNumber], dx
jne 0x41d795
cmp esi, 0x1f2c
jae 0x41d7ba
and eax, 0xbed05438
mov dword [0x435920], eax
jmp 0x41d7c6
imul ecx, edi, 0x6abb3912
mov dword [0x435988], ecx
and ecx, 0xc73f5284
mov dword [0x435934], ecx
or ecx, 0x41504159
mov dword [0x435950], ecx
inc edx
cmp byte [edx + 0x431a58], 0
jne 0x41d7de
mov esi, dword [ebp - 4]
jmp 0x41d802
cmp esi, 0xea6
jne 0x41d801
mov eax, edi
and eax, 0x48420d5a
mov dword [0x435920], eax
inc esi
cmp esi, edx
jb 0x41d7ed
pop edi
lea eax, [ecx - 0x1838947a]
pop esi
mov dword [0x435998], eax
pop ebx
leave
ret
Function at 0x41eb1b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov edx, dword [0x4359d0]
xor ecx, ecx
push ebx
push esi
push edi
mov esi, 0x42d5a8
lea edi, [ebp - 0x10]
lea eax, [edx - 0x75d104e9]
or edx, 0xccf3fd50
imul ebx, eax, 0x6652d149
mov eax, ecx
mov dword [0x4359d0], edx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x10], 0x63
jne 0x41eba3
mov byte [ebp - 1], 0x63
mov bl, byte [ebp - 1]
test bl, bl
je 0x41eb79
cmp byte [ebp + eax - 0x10], cl
je 0x41eb79
mov bl, byte [eax + 0x431c61]
inc eax
cmp bl, byte [ebp + eax - 0x10]
je 0x41eb62
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 8]
cmp esi, eax
jae 0x41eba3
cmp esi, 0x10d6
jne 0x41eb93
mov ebx, edx
xor ebx, 0xa8bf076a
imul edi, ebx, 0xc8a56c2b
inc esi
mov dword [ebp - 8], edi
cmp esi, eax
jb 0x41eb83
jmp 0x41ebab
mov eax, dword [0x4359ec]
mov dword [ebp - 8], eax
mov esi, str.SrchCollatorRowset
lea edi, [ebp - 0x1c]
mov eax, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x1c], 0x4d
jne 0x41ebdc
mov cl, 0x4d
test cl, cl
je 0x41ebdc
cmp byte [ebp + eax - 0x1c], 0
je 0x41ebdc
mov cl, byte [eax + 0x431c75]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0x41ebc4
movzx ecx, byte [eax + 0x431c74]
movzx eax, byte [ebp + eax - 0x1c]
sub ecx, eax
cmp ecx, 0x2550
jbe 0x41ebfd
mov ebx, dword [ebp - 8]
add ebx, 0xefca2f22
jmp 0x41ec0b
mov edx, ebx
or edx, 0x97da233a
mov dword [0x4359d0], edx
push 6
pop ecx
mov esi, str.IndexEfsCertificateMapFail
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x24], 0x64
jne 0x41ec3d
mov cl, 0x64
test cl, cl
je 0x41ec3d
cmp byte [ebp + eax - 0x24], 0
je 0x41ec3d
mov cl, byte [eax + 0x431d01]
inc eax
cmp cl, byte [ebp + eax - 0x24]
je 0x41ec25
movzx ecx, byte [eax + 0x431d00]
movzx eax, byte [ebp + eax - 0x24]
sub ecx, eax
cmp ecx, 0x328
jne 0x41ec5e
mov ebx, dword [ebp - 8]
add ebx, 0x5c7346f1
jmp 0x41ec6d
mov edx, dword [ebp - 8]
or edx, 0xaaba6c61
mov dword [0x4359d0], edx
mov esi, str.broken_pipe
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x18], 0x64
jne 0x41eca6
push 0x64
xor eax, eax
pop ecx
test cl, cl
je 0x41ec9b
cmp byte [ebp + eax - 0x18], 0
je 0x41ec9b
mov cl, byte [eax + 0x431d01]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x41ec83
cmp dword [ebp - 8], eax
jae 0x41eca6
lea ebx, [edx - 0xf1563e6]
or ebx, 0x639328be
xor edx, 0x795d8659
pop edi
pop esi
mov dword [0x4359ec], ebx
mov dword [0x4359b4], edx
pop ebx
leave
ret
Function at 0x41ecc3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [0x4359c4]
push ebx
mov ebx, dword [0x4359f0]
xor edx, 0x4872e316
push esi
push edi
mov esi, str.StructuredQuery
mov dword [ebp - 8], edx
lea edi, [ebp - 0x18]
mov eax, ebx
and eax, 0xcef13776
add eax, 0x5f4ba213
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x18], 0x6f
jne 0x41ed46
mov cl, 0x6f
test cl, cl
je 0x41ed1e
cmp byte [ebp + eax - 0x18], 0
je 0x41ed1e
mov cl, byte [eax + 0x431ca1]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x41ed06
mov ecx, dword [ebp - 8]
cmp ecx, eax
jae 0x41ed46
mov esi, dword [ebp - 4]
xor edx, 0x5e8f3595
cmp ecx, 0x50e
jne 0x41ed3c
lea ebx, [esi - 0x2fc38d88]
inc ecx
mov esi, edx
cmp ecx, eax
jb 0x41ed2e
mov edx, dword [ebp - 8]
mov eax, str.ETWLogging
xor ebx, 0xade2e719
inc eax
cmp byte [eax], 0
jne 0x41ed4b
lea ecx, [edx + 0x1ccb3b4f]
lea eax, [ecx + 0x40eb4f40]
mov dword [0x4359f0], ecx
or ecx, 0xe9fcbeff
mov dword [0x4359cc], eax
imul eax, eax, 0x15c91abd
pop edi
pop esi
mov dword [0x4359d8], ecx
pop ebx
mov dword [0x4359c4], eax
leave
ret
Function at 0x41ed8a
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov ebx, ecx
xor edx, edx
push esi
mov esi, dword [0x4359b0]
mov eax, edx
add esi, 0xc52ca1c9
mov dword [ebp - 8], ebx
movzx ecx, word [ebx]
mov dword [ebp - 0x14], esi
push edi
test cx, cx
je 0x41ede6
mov edi, dword [0x4359d4]
mov dword [ebp - 0xc], edi
lea esi, [edi + 0x68a39a62]
mov dword [ebp - 0x14], esi
inc eax
cmp word [ebx + eax*2], dx
jne 0x41edc5
cmp eax, 0xe99
jbe 0x41ede6
mov ebx, dword [0x4359a8]
mov eax, edx
add ebx, 0x2a8d2f7
mov dword [ebp - 4], ebx
jmp 0x41ee01
mov ebx, dword [0x4359a8]
mov eax, edx
mov edi, ebx
mov dword [ebp - 4], ebx
and edi, 0x5a813f74
mov dword [ebp - 0xc], edi
test cx, cx
je 0x41ee43
mov esi, dword [0x43599c]
mov ecx, dword [ebp - 8]
xor esi, 0xd84bd77d
inc eax
cmp word [ecx + eax*2], dx
jne 0x41ee0a
mov ecx, dword [ebp - 0x14]
mov dword [0x43599c], esi
cmp ecx, eax
jae 0x41ee43
cmp ecx, 0x445
jne 0x41ee32
lea edi, [esi - 0x4d21ce51]
inc ecx
lea ebx, [edi + 0x5bf7df6f]
mov dword [ebp - 4], ebx
cmp ecx, eax
jb 0x41ee24
mov dword [ebp - 0xc], edi
push 8
pop ecx
mov esi, 0x430834
mov dword [ebp - 0x10], edx
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 8]
movzx eax, word [ecx]
cmp ax, word [ebp - 0x34]
jne 0x41ee86
mov esi, eax
mov ebx, edx
mov eax, edx
test si, si
je 0x41ee80
cmp word [ebp + eax - 0x34], dx
je 0x41ee80
inc ebx
lea eax, [ebx + ebx]
movzx esi, word [eax + ecx]
cmp si, word [ebp + eax - 0x34]
je 0x41ee65
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
movzx ecx, byte [ecx + eax*2]
movzx eax, byte [ebp + eax*2 - 0x34]
sub ecx, eax
cmp ecx, 0xfa
jbe 0x41eea8
or dword [0x4359b0], 0x94023f07
jmp 0x41eeb7
mov ebx, dword [0x43599c]
add ebx, 0x936f352c
mov dword [ebp - 4], ebx
push 0xb
pop ecx
mov esi, 0x4306a0
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
mov eax, edx
movzx ecx, word [esi]
cmp cx, word [ebp - 0x40]
jne 0x41eef8
mov ebx, edx
test cx, cx
je 0x41eeef
cmp word [ebp + eax - 0x40], dx
je 0x41eeef
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + esi]
cmp cx, word [ebp + eax - 0x40]
je 0x41eed4
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
movzx ecx, byte [esi + eax*2]
movzx eax, byte [ebp + eax*2 - 0x40]
sub ecx, eax
cmp ecx, 0x1151
jae 0x41ef12
imul ebx, dword [ebp - 0xc], 0x7cb30771
imul ecx, dword [0x43599c], 0x54c95a18
add ecx, 0x1dc618b1
inc edx
cmp byte [edx + str.FallbackError], 0
jne 0x41ef1c
mov dword [0x4359d4], ecx
cmp edx, 0x1fcd
je 0x41ef47
mov eax, dword [ebp - 0x14]
add eax, 0xcaf39cfb
mov dword [0x4359b0], eax
xor ecx, 0xf7376ebc
xor ebx, 0x130d4bab
pop edi
pop esi
mov dword [0x4359a8], ebx
mov dword [0x4359ac], ecx
pop ebx
leave
ret
Function at 0x4207cb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x435a50]
push ebx
push esi
push edi
push 6
pop ecx
mov esi, 0x42cbf8
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
push 0x6e
xor ebx, ebx
and eax, 0x78998f57
pop esi
mov edx, ebx
cmp si, word [ebp - 0x1c]
jne 0x420834
mov ecx, ebx
test si, si
je 0x420818
cmp word [ebp + ecx - 0x1c], bx
je 0x420818
inc edx
lea ecx, [edx + edx]
movzx esi, word [ecx + str.no_buffer_space]
cmp si, word [ebp + ecx - 0x1c]
je 0x4207fa
mov ecx, dword [ebp - 4]
jmp 0x420830
cmp ecx, 0x2483
jne 0x42082a
and eax, 0x705a73f5
sub eax, 0x4ac13a1d
inc ecx
cmp ecx, edx
jb 0x42081d
add eax, 0xb111aa14
mov ecx, ebx
and eax, 0x970c9f86
imul edx, eax, 0x7f3048a0
sub edx, 0x5cc72148
xor edx, 0x4e3be337
sub edx, 0x310354aa
add edx, 0x2206206b
inc ecx
cmp byte [ecx + str.API_MS_Win_Core_LocalRegistry_L1_1_0.dll], bl
jne 0x420858
mov esi, dword [ebp - 4]
cmp esi, ecx
jae 0x420890
mov edi, edx
mov eax, edx
cmp esi, 0x2401
jne 0x420881
mov eax, edi
or eax, 0xba9f2030
imul edx, eax, 0xc475490b
inc esi
mov edi, edx
mov eax, edi
cmp esi, ecx
jb 0x420872
mov esi, 0x42cd58
lea edi, [ebp - 0x14]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x14], 0x41
jne 0x4208bf
mov cl, 0x41
test cl, cl
je 0x4208bf
cmp byte [ebp + eax - 0x14], bl
je 0x4208bf
mov cl, byte [eax + 0x432051]
inc eax
cmp cl, byte [ebp + eax - 0x14]
je 0x4208a8
movzx ecx, byte [eax + str.API_MS_Win_Core_LocalRegistry_L1_1_0.dll]
movzx eax, byte [ebp + eax - 0x14]
sub ecx, eax
cmp ecx, 0x1780
lea ecx, [edx + 0x1acfb06d]
jb 0x4208e1
lea ecx, [edx - 0x1a435fea]
mov eax, str.API_MS_Win_Core_LocalRegistry_L1_1_0.dll
imul ecx, ecx, 0x69771bb2
inc eax
cmp byte [eax], bl
jne 0x4208e6
mov dword [0x435a50], ecx
mov eax, 0x432100
xor ecx, 0xe2263c72
inc eax
cmp byte [eax], bl
jne 0x4208fc
mov dword [0x435a50], ecx
mov edx, ebx
and ecx, 0x193b0c8b
inc edx
cmp word [edx*2 + str.failureId], bx
jne 0x42090f
mov eax, ecx
mov dword [0x435a50], ecx
xor eax, 0x8423d2a
or ecx, 0x82f6463e
cmp edx, 0x1081
mov esi, ebx
cmovbe ecx, eax
add ecx, 0xbbe0df74
inc esi
cmp word [esi*2 + str.no_buffer_space], bx
jne 0x42093e
mov eax, ecx
add ecx, 0xaf3f8ab9
xor eax, 0x60026dbd
cmp esi, 0x352
pop edi
cmovbe ecx, eax
add ecx, 0x6bddfc5b
pop esi
mov dword [0x435a50], ecx
pop ebx
leave
ret

Function at 0x420b2e
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x435a74]
xor edx, edx
mov eax, ecx
xor eax, 0xf7cc3faa
or eax, 0xc7883caa
xor eax, 0xe0218061
inc edx
cmp byte [edx + str._hs__u__hs__p:], 0
jne 0x420b42
cmp edx, 0x1ec6
je 0x420b5f
lea ecx, [eax - 0x54ac8f92]
imul eax, eax, 0xd09892d6
xor ecx, 0x978e98e0
mov dword [0x435a74], ecx
mov dword [0x435a70], eax
lea eax, [ecx - 0x257b50c0]
xor ecx, 0x2274d527
mov dword [0x435a24], eax
mov dword [0x435a00], ecx
ret