joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408830
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + 4]
mov dword [0x445c9c], ecx
mov eax, 0xfffffd92
nop
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x26f
mov dword [eax*4 + 0x446658], ecx
test eax, eax
je 0x408881
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x270
mov dword [eax*4 + 0x44665c], ecx
add eax, 2
jmp 0x408840
mov dword [0x445c98], 0x270
ret

Function at 0x408890
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov eax, dword [0x445c98]
cmp eax, 0x270
jne 0x4088ef
mov eax, 0xfffff640
mov edx, dword [0x445c9c]
nop
nop
nop
nop
nop
nop
nop
nop
and edx, 0x80000000
mov esi, dword [eax + 0x446660]
mov ecx, esi
and ecx, 0x7ffffffe
or ecx, edx
mov edx, esi
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, dword [eax + 0x446c90]
shr ecx, 1
xor esi, ecx
mov dword [eax + 0x44701c], esi
add eax, 4
jne 0x4088b0
mov eax, 0x270
jmp 0x408905
cmp eax, 0x4e0
jb 0x408905
mov ecx, 0x445c98
call fcn.00408c90
mov eax, dword [0x445c98]
lea ecx, [eax + 1]
mov dword [0x445c98], ecx
mov eax, dword [eax*4 + 0x445c9c]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [0x44701c]
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc40000
xor ecx, eax
shr ecx, 0x12
and eax, 0x7fff
xor eax, ecx
pop esi
ret
Function at 0x408c90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
xor eax, eax
mov edx, 0x80000000
nop
nop
nop
nop
nop
nop
lea esi, [eax + 0x270]
mov edi, dword [ecx + eax*4 + 0x9c4]
and edi, edx
mov ebx, eax
and ebx, 1
or esi, 1
add esi, ebx
mov esi, dword [ecx + esi*4 + 4]
mov ebx, esi
and ebx, 0x7ffffffe
or ebx, edi
shr ebx, 1
and esi, 1
neg esi
and esi, 0x9908b0df
xor esi, ebx
mov edi, dword [ecx + eax*4 + 0xff8]
mov ebx, esi
and ebx, edi
add esi, edi
add ebx, ebx
sub esi, ebx
mov dword [ecx + eax*4 + 4], esi
inc eax
cmp eax, 0xe3
jne 0x408ca0
mov esi, dword [ecx + 0xd50]
xor eax, eax
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0xd54]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 4]
xor edi, edx
mov dword [ecx + eax*4 + 0x390], edi
inc eax
cmp eax, 0x18c
jne 0x408d00
mov edx, 0x80000000
and edx, dword [ecx + 0x1380]
mov eax, 0x7fffffff
and eax, dword [ecx + 4]
or eax, edx
mov esi, eax
or esi, 1
mov edx, eax
xor edx, 0xfffffffe
and edx, esi
je 0x408d63
mov edx, 0x9908b0df
shr eax, 1
xor eax, dword [ecx + 0x634]
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
ret
Function at 0x408ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx ecx, word [esi]
lea edi, [esp + 4]
test cx, cx
je 0x409018
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea eax, [esi + 2]
cmp bx, 0x7f
ja 0x408f30
lea ebp, [edi + 1]
mov byte [edi], bl
jmp 0x408fc0
cmp ebx, 0x7ff
ja 0x408f60
cmp edx, 2
jb 0x408f60
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [edi], cl
lea ebp, [edi + 2]
and bl, 0x3f
or bl, 0x80
mov byte [edi + 1], bl
jmp 0x408fc0
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x408fda
cmp edx, 4
jb 0x408fda
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + ecx]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [edi], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [edi + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [edi + 2], al
mov al, 0x3f
sub al, cl
and al, 0x3f
xor al, 0xbf
lea ebp, [edi + 4]
mov byte [edi + 3], al
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
add edx, edi
sub edx, ebp
mov esi, eax
mov edi, ebp
movzx ecx, word [esi]
test cx, cx
je 0x409018
test edx, edx
jne 0x408f10
jmp 0x409018
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x408fe9
mov esi, eax
jmp 0x408fc8
cmp edx, 3
jb 0x409014
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [edi], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [edi + 1], cl
and bl, 0x3f
or bl, 0x80
lea ebp, [edi + 3]
mov byte [edi + 2], bl
jmp 0x408fc0
mov ebp, edi
jmp 0x408fc0
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [edi], 0
movzx ecx, byte [esp + 4]
lea eax, [esp + 0x204]
mov edi, eax
test cl, cl
je 0x409066
lea edi, [esp + 0x204]
lea ebx, [esp + 5]
jmp 0x40905b
mov byte [edi], ch
inc edi
movzx ecx, byte [ebx]
inc ebx
test cl, cl
je 0x409066
mov ch, 0x2f
cmp cl, 0x5c
je 0x409050
mov ch, cl
jmp 0x409050
mov byte [edi], 0
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.004047e0
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x409df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x230
mov eax, dword [0x44707c]
mov dword [esp + 0x1b0], 0x13121910
xor ecx, ecx
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x1b0]
mov edi, ecx
or edi, 0xde424fc4
mov edx, 0x3b
sub edx, ecx
xor edx, edi
and edx, esi
xor edx, edi
mov esi, edx
and esi, 1
add edx, 0x2b
or edx, 1
sub edx, esi
inc dl
mov byte [esp + ecx + 0x1b0], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 4
jb 0x409e10
mov ecx, dword [esp + 0x1b0]
mov dword [esp + 0x20], 0x23b121b7
mov dword [esp + 0x24], 0x27c925f6
mov dword [esp + 0x28], 0xdb08d90b
mov dword [esp + 0x2c], 0xdf3add02
mov dword [esp + 0x30], 0xd34ed14c
mov word [esp + 0x34], 0xd5d4
mov dword [esp + 0x36], 0
mov byte [esp + 0x3a], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx + 0x20]
lea esi, [edx + 0x7f9a7bf8]
mov ebx, 0x80658407
sub ebx, edx
and ebx, 0x800506bb
and esi, 0x75024944
or esi, ebx
xor esi, edi
lea edi, [esi + esi]
and edi, 0x206084e
xor edi, 0x46
mov ebx, esi
xor ebx, 0x9c
add ebx, edi
and esi, 1
xor ebx, 1
or ebx, esi
add ebx, esi
mov byte [esp + edx + 0x20], bl
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
cmp edx, 0x1b
jb case.default.0x409f23
lea esi, [esp + 0x20]
push ecx
push 0
push esi
call eax
mov ecx, 0x447080
push eax
call fcn.004366c0
movzx eax, al
mov eax, dword [eax*4 + 0x440a48]
mov ecx, 0xbe09eafe
xor ecx, dword [0x440a50]
add eax, ecx
inc eax
jmp eax
mov word [eax], cx
add eax, 2
rol byte [edx], 0xf
mov bh, 0xa
rol byte [edx], 0xf
mov bh, 0xa
add edx, 2
test cx, cx
jne 0x416b60
jmp 0x416b76
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x416ba1
lea edx, [esp + 0xa]
push esp
and al, 0xa
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416b90
mov word [eax], 0
mov ebx, dword [edi]
mov dword [esp + 0x34], 0x9b949c36
mov byte [esp + 0x38], 0x3c
mov dword [esp + 0x39], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 0x14
mov edx, ecx
xor edx, 0xca
add edx, esi
xor dl, byte [esp + ecx + 0x34]
add dl, 0xe
mov byte [esp + ecx + 0x34], dl
inc ecx
add eax, 2
cmp ecx, 9
jne 0x416bd0
movzx eax, byte [esp + 0x34]
test al, al
je 0x416c0b
lea ecx, [esp + 0x35]
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x416c00
mov byte [ebx], 0
lea eax, [esp + 0x144]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x14e]
push eax
push ecx
push edx
call fcn.0040b0d0
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x441c54]
mov ecx, 0x9f53f000
xor ecx, dword [0x441c5c]
add eax, ecx
inc eax
jmp eax
rdtsc
shr byte [ecx], cl
enter 0xffffffffffff940f, 0xffffffffffffffc2
ret 0x9589
movsb byte es:[edi], byte [esi]
cld
invalid
dec dword [ebx - 0x35f7b]
dec dword [ebx - 0x35b73]
dec dword [ebx + 0xd8b8804]
insb byte es:[edi], dx
inc ebx
inc esp
add byte [ecx - 0x6fdbc50f], al
lodsb al, byte [esi]
sub eax, ecx
jmp eax
ret 0x9589
Function at 0x40b0d0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x447058]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40b17e
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x440e38]
jmp dword [0x440e48]
Function at 0x40b800
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov edi, dword [esp + 0x44c]
mov dword [esp + 0x38], 0x93659145
mov dword [esp + 0x3c], 0xaf57ad26
mov dword [esp + 0x40], 0xab5ea95c
mov dword [esp + 0x44], 0xa791a545
mov dword [esp + 0x48], 0xa394a16d
mov dword [esp + 0x4c], 0xbf9ebd8c
mov dword [esp + 0x50], 0xbb55b980
mov dword [esp + 0x54], 0xb740b54d
mov dword [esp + 0x58], 0xb345b14c
mov dword [esp + 0x5c], 0x4fbd4dc3
mov dword [esp + 0x60], 0x4b9c4968
mov dword [esp + 0x64], 0x476645a8
mov dword [esp + 0x68], 0x43724171
mov dword [esp + 0x6c], 0x5f6e5d6a
mov dword [esp + 0x70], 0x5b7a5993
mov dword [esp + 0x74], 0x57af55bb
mov dword [esp + 0x78], 0x539c51a6
mov dword [esp + 0x7c], 0x6fa56da0
mov dword [esp + 0x80], 0x6be26948
mov dword [esp + 0x84], 0x67aa65aa
mov dword [esp + 0x88], 0x63426159
mov dword [esp + 0x8c], 0x7f8e7dbd
mov dword [esp + 0x90], 0x7b8e7988
mov dword [esp + 0x94], 0x77997589
mov dword [esp + 0x98], 0x7390718d
mov dword [esp + 0x9c], 0xff70dd7
mov dword [esp + 0xa0], 0xb3d0984
mov dword [esp + 0xa4], 0x73505c9
mov dword [esp + 0xa8], 0x33401cf
mov dword [esp + 0xac], 0x1fd01d2f
mov dword [esp + 0xb0], 0x1b221938
mov dword [esp + 0xb4], 0x17ce15cf
mov dword [esp + 0xb8], 0x13c711fc
mov dword [esp + 0xbc], 0x2f1a2df8
mov dword [esp + 0xc0], 0x2bde2908
mov dword [esp + 0xc4], 0x27dd25dd
mov dword [esp + 0xc8], 0x230221dd
mov dword [esp + 0xcc], 0x3fc33de3
mov dword [esp + 0xd0], 0x3bc139db
mov dword [esp + 0xd4], 0x370f35c3
mov dword [esp + 0xd8], 0x33f13110
mov dword [esp + 0xdc], 0xcf3ccd34
mov dword [esp + 0xe0], 0xcb3fc93f
mov dword [esp + 0xe4], 0xc7f1c539
mov dword [esp + 0xe8], 0xc3f3c1f1
mov dword [esp + 0xec], 0xdfe8dd15
mov dword [esp + 0xf0], 0xdbecd9e8
mov dword [esp + 0xf4], 0xd7e0d5e4
mov dword [esp + 0xf8], 0xd3f2d1e0
mov dword [esp + 0xfc], 0xef0fed3f
mov dword [esp + 0x100], 0xeb0be916
mov dword [esp + 0x104], 0xe71fe516
mov dword [esp + 0x108], 0xe32fe1d7
mov dword [esp + 0x10c], 0xff31fdcf
mov dword [esp + 0x110], 0xfbc9f9ce
mov dword [esp + 0x114], 0xf7f6f53a
mov dword [esp + 0x118], 0
mov eax, dword [0x44704c]
mov ecx, 0x9b6e8db
mov edx, 0x76491723
nop
nop
nop
movzx esi, byte [esp + ecx - 0x9b6e8a3]
lea ebx, [ecx - 0x3fffffff]
mov ebp, edx
and ebp, 0x26410f32
and ebx, 0x898240cd
or ebx, ebp
xor ebx, esi
xor ebx, 0x6675af32
mov esi, ebx
or esi, 0xb2
and ebx, 0xb2
add ebx, esi
add bl, 2
mov byte [esp + ecx - 0x9b6e8a3], bl
inc ecx
dec edx
cmp ecx, 0x9b6e9bf
jne 0x40ba60
lea ebp, [esp + 0x38]
push 0
push 0
push 0
push 0
push ebp
call eax
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x440f08]
mov ecx, 0xfd6a7cc6
xor ecx, dword [0x440f10]
add ecx, edx
inc ecx
jmp ecx
Function at 0x413780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x11b8
call fcn.00408130
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x4137a0
sar esi, 1
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x448398]
mov ebx, dword [esp + 0x34]
mov edi, 0xffffffff
test ebx, ebx
jns 0x4137d4
mov eax, 0xffffffff
jmp 0x4137d7
lea eax, [ebx + ebx]
push eax
call fcn.00408160
add esp, 4
lea ecx, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x34], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x448398]
mov eax, dword [esp + 0x34]
mov ecx, eax
add ecx, 0xd
js 0x41380c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.00408160
add esp, 4
mov dword [esp + 0x1b4], 0xb742896c
mov dword [esp + 0x1b8], 0xb32db555
mov dword [esp + 0x1bc], 0xbf9eb12c
mov dword [esp + 0x1c0], 0xbb57bd46
mov dword [esp + 0x1c4], 0xa739b926
mov dword [esp + 0x1c8], 0xa331a54d
mov dword [esp + 0x1cc], 0xafaea132
mov edi, 0xbe5646de
mov esi, dword [esp + 0x2c]
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edi + 0x41a9bad6]
mov edx, ecx
and edx, edi
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, edi
add cl, 0xaa
mov byte [esp + edi + 0x41a9bad6], cl
inc edi
cmp edi, 0xbe5646fa
jne 0x413870
movzx ecx, word [esi]
mov edi, eax
test cx, cx
je 0x4138c1
lea edx, [esi + 2]
mov edi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edi], cx
add edi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4138b0
mov word [edi], 0
movzx ecx, word [esp + 0x1b4]
test cx, cx
je 0x4138f1
lea edx, [esp + 0x1b6]
nop
nop
nop
nop
nop
nop
mov word [edi], cx
add edi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4138e0
mov word [edi], 0
lea ecx, [esp + 0xa0]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x2c], eax
push eax
call fcn.0043ba40
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x441a04]
Function at 0x416a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x188
mov dword [esp + 8], 0x77e0095b
mov dword [esp + 0xc], 0x73e175eb
mov dword [esp + 0x10], 0x7f7e71e2
mov dword [esp + 0x14], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
and esi, 0x1c
mov edx, ecx
xor edx, 0xbe
add edx, esi
xor dl, byte [esp + ecx + 8]
add dl, 0x4a
mov byte [esp + ecx + 8], dl
inc ecx
add eax, 2
cmp ecx, 0x10
jne 0x416a50
mov dword [esp + 0x34], 0x179a1980
mov dword [esp + 0x38], 0x13821598
mov dword [esp + 0x3c], 0xfdd11d6
mov dword [esp + 0x40], 0xb9e0ddf
mov dword [esp + 0x44], 0x799099b
mov dword [esp + 0x48], 0x39605e5
mov dword [esp + 0x4c], 0x3fad0198
mov dword [esp + 0x50], 0x3bb63db3
mov dword [esp + 0x54], 0x373639fe
mov dword [esp + 0x58], 0
mov eax, 0x93ef8146
mov ecx, 0x6c107eb9
nop
nop
nop
movzx edx, byte [esp + eax + 0x6c107eee]
lea esi, [edx + edx]
not esi
add esi, edx
mov edi, eax
or edi, edx
not edx
and edx, esi
or edx, ecx
and edx, edi
mov esi, edx
and esi, 0x5e
mov ebx, edx
xor ebx, 0xa1
add ebx, edx
sub ebx, esi
and edx, 0xa1
add ebx, edx
inc bl
mov byte [esp + eax + 0x6c107eee], bl
inc eax
dec ecx
cmp eax, 0x93ef816e
jne 0x416ad0
movzx ecx, word [esp + 0x34]
lea eax, [esp + 0x14e]
test cx, cx
je 0x416b41
lea edx, [esp + 0x36]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416b30
mov word [eax], 0
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x416b73
add edx, 2
mov edi, dword [ebp + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [ebp + 0xc]
Function at 0x41c0c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41c0d0
cmp eax, 0xffffffed
jge 0x41c0e7
mov eax, 0xffffffff
jmp 0x41c0ea
add eax, 0x12
push eax
call fcn.00408160
add esp, 4
mov esi, eax
mov dword [esp], 0xf741f95c
mov dword [esp + 4], 0xf37bf549
mov dword [esp + 8], 0xcfbcf1bc
mov dword [esp + 0xc], 0xcb74cd70
mov word [esp + 0x10], 0xc9c8
mov dword [esp + 0x12], 0
mov word [esp + 0x16], 0
xor eax, eax
nop
nop
nop
nop
mov ecx, eax
add cl, 0xd6
xor cl, byte [esp + eax]
add cl, 0xd2
mov byte [esp + eax], cl
inc eax
cmp eax, 0x18
jne 0x41c130
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41c171
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41c160
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41c1a1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41c190
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043bbf0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44203c]
Function at 0x421d4c
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.00421600
add esp, 4
test al, al
je 0x421d40
mov al, 1
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc8
push eax
sub esp, 0x28
mov ebx, esp
sub esp, 0x30
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x20
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 0x44], esp
sub esp, 0x40
mov dword [ebp - 0x34], esp
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x2c], eax
mov edi, eax
push eax
mov dword [ebp - 0x30], esp
push eax
mov dword [ebp - 0x38], esp
push eax
mov esi, esp
sub esp, 0x24
mov dword [ebp - 0xb4], esp
sub esp, 8
mov dword [ebp - 0x58], esp
sub esp, 8
mov dword [ebp - 0xb8], esp
sub esp, 8
mov dword [ebp - 0x4c], esp
sub esp, 0x24
mov dword [ebp - 0x60], esp
mov dword [ebp - 0xd4], 0x21b027df
mov dword [ebp - 0xd0], 0xddae23ad
mov dword [ebp - 0xcc], 0xd94adf3f
mov dword [ebp - 0xc8], 0xd52adb4c
mov dword [ebp - 0xc4], 0xd15ad737
mov dword [ebp - 0xc0], 0xcdd2d348
mov byte [ebp - 0xbc], 0
xor eax, eax
nop
nop
movzx ecx, byte [ebp + eax - 0xd4]
lea edx, [eax - 0x43c2b507]
and edx, ecx
add edx, edx
neg edx
add edx, eax
add edx, 0xbc3d4af9
add dl, cl
add dl, 0x23
mov byte [ebp + eax - 0xd4], dl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x19
jb 0x421df0
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0xb0], 0x13e011f4
mov dword [ebp - 0xac], 0x1fd11dd1
mov dword [ebp - 0xa8], 0x1be919d1
mov dword [ebp - 0xa4], 0x7f405f8
mov dword [ebp - 0xa0], 0x3e601f9
mov dword [ebp - 0x9c], 0xfcf0df9
mov dword [ebp - 0x98], 0xbc209cb
mov dword [ebp - 0x94], 0x37c035fd
mov dword [ebp - 0x90], 0x33d631fd
mov dword [ebp - 0x8c], 0x3fc93dcf
mov dword [ebp - 0x88], 0x3bc639f6
mov dword [ebp - 0x84], 0x27e725db
mov dword [ebp - 0x80], 0x23ef21d2
mov dword [ebp - 0x7c], 0x2fd02dc8
mov dword [ebp - 0x78], 0x2bbe29c9
mov dword [ebp - 0x74], 0xd73bd54a
mov dword [ebp - 0x70], 0xd321d134
mov dword [ebp - 0x6c], 0xdf33dd40
mov dword [ebp - 0x68], 0xdb4fd939
mov dword [ebp - 0x64], 0xc5c4
xor eax, eax
mov ecx, eax
add cl, 0xc4
xor cl, byte [ebp + eax - 0xb0]
add cl, 0x2c
mov byte [ebp + eax - 0xb0], cl
inc eax
cmp eax, 0x50
jne case.default.0x421f1b
lea eax, [ebp - 0xd4]
lea ecx, [ebp - 0xb0]
push eax
push ecx
call fcn.00433120
add esp, 8
mov edi, eax
xor eax, eax
test edi, edi
sete al
jmp dword [eax*4 + 0x442e80]
pop ds
inc edx
add byte [ecx + 0x1f], cl
inc edx
add byte [edi - 0x53ffbdd2], dh
das
inc edx
add byte [ebx - 0x53ffbdd0], bl
das
inc edx
add byte [esi - 0x5effbddd], ah
xor byte [edx], al
pop edx
xor dword [edx], eax
mov ah, 0x30
inc edx
add bh, ch

Function at 0x4223a6
Capabilities:
Copy file

Disassembly:
push edi
call fcn.00408170
add esp, 4
xor eax, eax
cmp word [esi], 0x2a
sete al
mov ebx, dword [ebp - 0x24]
jmp dword [eax*4 + 0x442ea0]
Function at 0x4224b2
Capabilities:
Encode data using xor

Disassembly:
cmp dword [edi + esi*8], 0xb62b8d10
je 0x4223e0
inc esi
cmp ecx, esi
jne 0x4223d0
jmp case.0x422ba5.12
mov ecx, dword [edi + esi*8 + 4]
cmp ecx, edx
je case.0x422ba5.12
push eax
push 1
push ecx
push dword [0x4483a4]
call fcn.00437ec0
add esp, 0x10
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0xb0], 0x5c5d5e5f
mov byte [ebp - 0xac], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebp + ecx - 0xb0]
mov edx, esi
not edx
and edx, 0xf6
mov edi, esi
xor edi, 0xf6
or esi, 9
and esi, edi
or esi, edx
mov ebx, 0x6f
sub ebx, ecx
and ebx, 0x66
mov edx, ecx
and edx, 1
or ebx, edx
xor ebx, esi
add bl, 0x30
mov byte [ebp + ecx - 0xb0], bl
mov esi, ecx
not edx
add edx, ecx
xor ecx, 0xfffffffe
or esi, 1
and esi, ecx
lea ecx, [esi + edx]
add ecx, 2
cmp ecx, 5
jb 0x4224d0
mov ecx, dword [0x44839c]
test ecx, ecx
je case.0x422ba5.12
mov edx, dword [ebp - 0xb0]
xor esi, esi
mov edi, dword [0x4483a0]
jmp 0x4223d0

Function at 0x422bf5
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
cmp esi, edi
sete al
jmp dword [eax*4 + 0x442f10]

Function at 0x422fac
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebx], 0x8f298924
mov dword [ebx + 4], 0x83308d3f
mov dword [ebx + 8], 0x873f813a
mov dword [ebx + 0xc], 0x9b36853f
mov dword [ebx + 0x10], 0x9f2d993f
mov dword [ebx + 0x14], 0x93289d2e
mov dword [ebx + 0x18], 0x972d9129
mov dword [ebx + 0x1c], 0x6be09566
mov dword [ebx + 0x20], 0x6fd469cc
mov word [ebx + 0x24], 0x6d6c
mov dword [ebx + 0x26], 0
mov word [ebx + 0x2a], 0
mov eax, 2
mov ecx, 0x9d
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0xf4
mov edx, eax
and edx, 0xb
or edx, esi
xor dl, byte [ebx + eax - 2]
xor dl, 0xf4
add dl, 0x16
mov byte [ebx + eax - 2], dl
inc eax
dec ecx
cmp eax, 0x2e
jne 0x423010
movzx ecx, word [edi]
mov esi, dword [ebp - 0x28]
mov eax, esi
test cx, cx
je 0x423061
lea edx, [edi + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423050
mov word [eax], 0
movzx ecx, word [ebx]
test cx, cx
je 0x423091
lea edx, [ebx + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423080
mov word [eax], 0
jmp case.0x421f1b.1

Function at 0x4230a1
Capabilities:
Copy file
Encode data using xor

Disassembly:
xor eax, eax
cmp word [esi], 0x2a
sete al
mov ebx, dword [ebp - 0x24]
jmp dword [eax*4 + 0x442ea0]
Function at 0x428a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx edi, word [edx]
test di, di
je 0x428ba4
mov eax, edx
mov edx, dword [esp + 0x1c]
mov ecx, edx
not ecx
lea esi, [ecx + edx*2]
mov edx, eax
mov eax, dword [esp + 0x18]
nop
nop
nop
nop
test esi, esi
je 0x428ba4
movzx ebx, di
lea edi, [edx + 2]
cmp bx, 0x7f
ja 0x428a90
lea ebp, [eax + 1]
mov byte [eax], bl
jmp 0x428b50
cmp ebx, 0x7ff
ja 0x428ac0
cmp esi, 2
jb 0x428ac0
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and bl, 0x3f
or bl, 0x80
lea ebp, [eax + 2]
mov byte [eax + 1], bl
jmp 0x428b50
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x428b66
cmp esi, 4
jb 0x428b66
movzx edi, word [edx + 2]
add edx, 4
mov dword [esp], edx
mov ecx, ebx
xor ecx, 0xd800
and ebx, 0x27ff
add ebx, ebx
sub ebx, ecx
shl ebx, 0xa
lea ecx, [ebx + edi]
add ecx, 0xffff2400
lea edx, [ebx + edi]
add edx, 0x2400
mov ebx, edx
shr ebx, 0x12
add bl, 0xf0
mov byte [eax], bl
shr edx, 0xc
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 2], cl
mov ecx, 0xff
sub ecx, edi
or ecx, 0x3f
add ecx, edi
add cl, 0x81
lea ebp, [eax + 4]
mov byte [eax + 3], cl
mov edi, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
add esi, eax
sub esi, ebp
mov edx, edi
mov eax, ebp
movzx edi, word [edx]
test di, di
jne 0x428a70
jmp 0x428ba4
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x428b75
mov edx, edi
jmp 0x428b58
cmp esi, 3
jb 0x428ba0
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and bl, 0x3f
or bl, 0x80
lea ebp, [eax + 3]
mov byte [eax + 2], bl
jmp 0x428b50
mov ebp, eax
jmp 0x428b50
mov byte [eax], 0
sub eax, dword [esp + 0x18]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret