joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 5
pop ecx
mov esi, 0x42ccc4
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov eax, ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x24], 0x6d
jne 0x409b1c
mov cl, 0x6d
test cl, cl
je 0x409b1c
cmp byte [ebp + eax - 0x24], bl
je 0x409b1c
mov cl, byte [eax + 0x42e3ed]
inc eax
cmp cl, byte [ebp + eax - 0x24]
je 0x409b05
movzx ecx, byte [eax + 0x42e3ec]
movzx eax, byte [ebp + eax - 0x24]
sub ecx, eax
mov eax, dword [0x43427c]
cmp ecx, 0x2098
jb 0x409b3c
add eax, 0x7ee48401
mov ecx, str.SrchScriptPI
xor eax, 0x8183fbfb
inc ecx
cmp byte [ecx], bl
jne 0x409b41
lea edx, [eax - 0x4745eb0f]
mov ecx, ebx
mov dword [ebp - 8], edx
mov dword [0x43428c], edx
inc ecx
cmp byte [ecx + 0x42e424], bl
jne 0x409b5c
cmp ecx, 0x873
je 0x409b73
imul eax, eax, 0x6e9e688d
mov esi, 0x42d658
lea edi, [ebp - 0x1c]
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x1c], 0x53
jne 0x409bd2
mov edx, dword [ebp - 8]
mov byte [ebp - 1], 0x53
mov bl, byte [ebp - 1]
test bl, bl
je 0x409baa
cmp byte [ebp + ecx - 0x1c], 0
je 0x409baa
mov bl, byte [ecx + 0x42e3a1]
inc ecx
cmp bl, byte [ebp + ecx - 0x1c]
je 0x409b92
mov esi, dword [ebp - 8]
push 0
pop ebx
cmp esi, ecx
jae 0x409bd2
mov edi, dword [0x434270]
cmp esi, 0x218f
jne 0x409bc8
and edi, 0xa5525fc4
and eax, 0x4cd4c552
inc esi
cmp esi, ecx
jb 0x409bba
mov ecx, ebx
inc ecx
cmp byte [ecx + 0x42e424], 0
jne 0x409bd4
cmp dword [ebp - 8], ecx
jae 0x409bf0
sub ecx, dword [ebp - 8]
xor eax, 0xc23b5c13
sub ecx, 1
jne 0x409be6
mov ecx, edx
mov eax, ebx
xor ecx, 0x3add8f7e
mov dword [0x43427c], ecx
inc eax
cmp byte [eax + 0x42e3ec], 0
jne 0x409c00
cmp eax, 0x1913
jbe 0x409c1d
lea edx, [ecx + 0x37e94164]
mov dword [0x43428c], edx
mov eax, edx
mov ecx, 0x42e3a0
or eax, 0x7c7a4b20
or eax, 0x6f53bf71
inc ecx
cmp byte [ecx], 0
jne 0x409c29
and edx, 0xb88f6d83
mov dword [0x4342b4], eax
push 0x1a58
mov dword [0x434270], edx
call dword [sym.imp.USER32.dll_OpenIcon]
add eax, 0xd70589ef
mov ecx, ebx
mov dword [0x43427c], eax
add eax, 0x6a6eb710
mov dword [0x43428c], eax
inc ecx
cmp byte [ecx + str.SrchScriptPI], 0
jne 0x409c66
mov edx, dword [0x434270]
cmp ecx, 0x25b8
jne 0x409c8f
mov eax, dword [0x4342b4]
or eax, 0xc8aad6e6
mov dword [0x43428c], eax
jmp 0x409c9b
mov eax, edx
and eax, 0x60dc6916
mov dword [0x4342b4], eax
push 7
pop ecx
mov esi, 0x42df6c
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x28], 0x53
jne 0x409ccb
push 0x53
pop eax
test al, al
je 0x409ccb
cmp byte [ebp + ebx - 0x28], 0
je 0x409ccb
mov al, byte [ebx + 0x42e3a1]
inc ebx
cmp al, byte [ebp + ebx - 0x28]
je 0x409cb3
movzx ecx, byte [ebx + 0x42e3a0]
movzx eax, byte [ebp + ebx - 0x28]
pop edi
sub ecx, eax
pop esi
pop ebx
cmp ecx, 0x1db7
jne 0x409cf2
or edx, 0x242e9be6
mov dword [0x4342b4], edx
leave
ret
or edx, 0x53c7171c
mov dword [0x434270], edx
leave
ret
Function at 0x40a1f2
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [0x435c3c]
mov eax, 0x5a4d
push edi
mov dword [ebp - 4], edx
cmp word [esi], ax
jne 0x40a272
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x40a272
mov ecx, 0x2000
test word [eax + 0x16], cx
je 0x40a272
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x40a272
xor edi, edi
cmp dword [eax + 0x7c], edi
je 0x40a272
mov ebx, dword [ecx + esi + 0x1c]
mov edx, dword [ecx + esi + 0x20]
add edx, esi
mov dword [ebp - 8], edx
lea eax, [ebx + esi]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + esi + 0x24]
add eax, esi
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x40a272
mov ecx, dword [edx + edi*4]
add ecx, esi
call fcn.0040b8e6
mov edx, eax
call fcn.0040a1a1
cmp eax, dword [ebp - 4]
je 0x40a279
mov edx, dword [ebp - 8]
inc edi
cmp edi, ebx
jb 0x40a254
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, esi
jmp 0x40a274

Function at 0x40a28a
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
ret
Function at 0x40ae79
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x434344]
sub esp, 0x30
mov edx, 0x42eb30
push ebx
push esi
lea eax, [ecx - 0x7333ec50]
xor ebx, ebx
lea edx, [edx + 2]
add eax, 0xd3311382
cmp word [edx], bx
jne 0x40ae94
mov esi, ebx
xor eax, 0xe2508538
inc esi
cmp word [esi*2 + 0x42eb30], bx
jne 0x40aea3
mov edx, dword [ebp - 4]
jmp 0x40aed0
cmp edx, 0x182d
jne 0x40aec7
mov eax, ecx
xor eax, 0xce96c079
mov ecx, eax
or ecx, 0x6fe6837d
inc edx
cmp edx, esi
jb 0x40aeb8
push edi
or ecx, 0xa7d6cf9a
lea edi, [ebp - 0x30]
imul edx, ecx, 0xca10adf3
mov esi, 0x42dfa0
push 0xa
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x53
pop eax
mov dword [0x434344], edx
movsw word es:[edi], word [esi]
xor esi, esi
cmp ax, word [ebp - 0x30]
jne 0x40af23
mov ecx, eax
mov eax, esi
test cx, cx
je 0x40af23
cmp word [ebp + eax - 0x30], si
je 0x40af23
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + 0x42eb30]
cmp cx, word [ebp + eax - 0x30]
je 0x40af05
movzx ecx, byte [ebx*2 + 0x42eb30]
movzx eax, byte [ebp + ebx*2 - 0x30]
sub ecx, eax
cmp ecx, 0x18b6
jbe 0x40af46
or edx, 0x1697e108
mov dword [0x434344], edx
push 7
mov ebx, esi
lea edi, [ebp - 0x24]
pop ecx
mov esi, str.IsWow64Process
mov eax, edx
rep movsd dword es:[edi], dword [esi]
push 0x53
pop ecx
or eax, 0xb988498a
movsw word es:[edi], word [esi]
mov dword [0x43432c], eax
pop edi
cmp cx, word [ebp - 0x24]
jne 0x40afb4
xor esi, esi
mov eax, esi
test cx, cx
je 0x40af8f
cmp word [ebp + eax - 0x24], si
je 0x40af8f
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + 0x42eb30]
cmp cx, word [ebp + eax - 0x24]
je 0x40af71
mov eax, dword [ebp - 4]
cmp eax, ebx
jae 0x40afb4
cmp eax, 0x981
jne 0x40afa3
and edx, 0x4bbdbe1a
and edx, 0x92de2a69
inc eax
cmp eax, ebx
jb 0x40af96
mov dword [0x434344], edx
pop esi
pop ebx
leave
ret
Function at 0x40b6f6
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
push edi
mov dword [ebp - 0x3c], ecx
lea edi, [ebp - 0x90]
push 8
mov ebx, dword [0x434340]
mov esi, str.inappropriate_io_control_operation
pop ecx
rep movsd dword es:[edi], dword [esi]
and ebx, 0xf3eeda09
mov dword [ebp - 0x38], edx
push ecx
mov dword [ebp - 0x30], 0xbc6e1e71
movsw word es:[edi], word [esi]
mov dword [ebp - 0x2c], 0x6b19ee03
mov dword [ebp - 0x28], 0x8ed842e5
mov dword [ebp - 0x24], 0xf2ec52bd
mov dword [ebp - 0x20], 0xb8f3b599
mov dword [ebp - 0x1c], 0x3de60688
mov dword [ebp - 0x18], 0x27830a71
mov dword [ebp - 0x14], 0x617cc05e
mov dword [ebp - 0x10], 0x3b3bb9b9
mov dword [ebp - 0xc], 0x39237cf9
mov dword [ebp - 8], 0xf266dc34
mov dword [ebp - 0x34], ebx
mov dword [0x434340], ebx
movsb byte es:[edi], byte [esi]
call fcn.0040ac01
pop ecx
push 6
pop ecx
push 0x69
mov esi, 0x42cb3c
lea edi, [ebp - 0x58]
pop edx
xor eax, eax
rep movsd dword es:[edi], dword [esi]
cmp dx, word [ebp - 0x58]
jne 0x40b7eb
xor esi, esi
mov ecx, esi
test dx, dx
je 0x40b7be
cmp word [ebp + ecx - 0x58], si
je 0x40b7be
inc eax
lea ecx, [eax + eax]
movzx edx, word [ecx + 0x42e8e0]
cmp dx, word [ebp + ecx - 0x58]
je 0x40b7a0
mov esi, dword [ebp - 0x38]
mov dword [ebp - 4], eax
cmp esi, eax
jae 0x40b7eb
mov edi, eax
cmp esi, 0x24c3
jne 0x40b7d8
imul ebx, ebx, 0xd31c5d9e
sub ebx, 0x515452d2
call fcn.0040ae79
inc esi
cmp esi, edi
jb 0x40b7ca
mov dword [ebp - 0x34], ebx
xor ecx, ecx
mov edi, ecx
mov eax, ecx
mov byte [ebp + eax - 0x190], al
inc eax
cmp eax, 0x100
jb 0x40b7f1
mov esi, ecx
xor edx, edx
mov bl, byte [ebp + esi - 0x190]
push 0x22
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x90]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x190]
mov byte [ebp + esi - 0x190], al
inc esi
mov byte [ebp + edi - 0x190], bl
cmp esi, 0x100
jb 0x40b802
mov esi, dword [ebp - 0x34]
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
lea eax, [ebx + 1]
sub esi, 0x6250711b
movzx ebx, al
mov eax, dword [ebp - 4]
mov cl, byte [ebp + ebx - 0x190]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 4], eax
mov al, byte [ebp + eax - 0x190]
mov byte [ebp + ebx - 0x190], al
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x190], cl
movzx eax, byte [ebp + ebx - 0x190]
mov cl, byte [ebp + edi - 0x30]
add eax, edx
movzx eax, al
xor cl, byte [ebp + eax - 0x190]
mov byte [ebp + edi - 0x6c], cl
inc edi
cmp edi, 0x2c
jb 0x40b84e
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov dword [0x434340], esi
mov byte [ebp - 0x40], dl
pop edi
pop esi
pop ebx
test ecx, ecx
jne 0x40b8c2
xor eax, eax
leave
ret
call fcn.0040b8e6
add eax, 2
push eax
push dword [ebp - 0x38]
push 0xffffffffffffffff
push ecx
push edx
xor ecx, ecx
lea edx, [ebp - 0x6c]
push 0xfde9
inc ecx
call fcn.0040a2e6
call eax
leave
ret
Function at 0x40c5bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [0x4354e0]
xor ebx, ebx
add esi, 0x7c9df915
mov eax, ebx
lea ecx, [esi + 0x6be26de5]
and ecx, 0x93a812b
sub ecx, 0x94b6f04
imul edx, ecx, 0xa881661e
inc eax
cmp byte [eax + 0x42f3b4], bl
jne 0x40c5ed
cmp eax, 0xf41
jbe 0x40c605
lea edx, [esi + 0x978f113]
jmp 0x40c60b
or edx, 0xbbe44eed
push edi
mov esi, str.ModuleCollection
lea edi, [ebp - 0x1c]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x1c], 0x66
pop edi
jne 0x40c657
mov byte [ebp - 1], 0x66
mov bl, byte [ebp - 1]
test bl, bl
je 0x40c641
cmp byte [ebp + eax - 0x1c], 0
je 0x40c641
mov bl, byte [eax + 0x42f3b5]
inc eax
cmp bl, byte [ebp + eax - 0x1c]
je 0x40c629
push 0
pop ebx
cmp dword [ebp - 8], eax
jae 0x40c657
sub eax, dword [ebp - 8]
sub ecx, 0x756c258f
sub eax, 1
jne 0x40c64c
xor edx, 0x9e032ea8
mov eax, ecx
imul esi, edx, 0xe052fe30
or eax, 0x165e7108
xor ecx, 0x5f78d6f6
inc ebx
cmp byte [ebx + 0x42f350], 0
jne 0x40c66a
mov edx, dword [ebp - 8]
cmp edx, ebx
jae 0x40c6a3
add esi, 0xc59cacee
cmp edx, 0x7f0
jne 0x40c696
mov eax, ecx
and eax, 0x95dd0983
inc edx
mov dword [0x4354d8], esi
mov ecx, esi
cmp edx, ebx
jb 0x40c687
sub eax, 0x504e250d
mov dword [0x4354e0], eax
and eax, 0xd1a2f246
mov ecx, eax
mov dword [0x4354d8], eax
and ecx, 0xd55b09c
pop esi
mov dword [0x4354d4], ecx
pop ebx
leave
ret
Function at 0x40c6c9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov ebx, dword [0x4354e4]
lea edi, [ebp - 0x28]
push 8
pop ecx
mov esi, str.inappropriate_io_control_operation
add ebx, 0x770d328e
rep movsd dword es:[edi], dword [esi]
mov edx, ebx
xor eax, eax
or edx, 0xfeffdffd
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x28], 0x66
jne 0x40c736
mov cl, 0x66
test cl, cl
je 0x40c718
cmp byte [ebp + eax - 0x28], 0
je 0x40c718
mov cl, byte [eax + 0x42f3c1]
inc eax
cmp cl, byte [ebp + eax - 0x28]
je 0x40c700
mov ecx, dword [ebp - 4]
jmp 0x40c732
cmp ecx, 0x1492
jne 0x40c72b
add edx, 0x36fec509
and edx, 0x7c10744c
inc ecx
cmp ecx, eax
jb 0x40c71d
mov eax, 0x42f370
sub ebx, 0x3f6358ec
inc eax
cmp byte [eax], 0
jne 0x40c73b
xor ecx, ecx
lea edi, [ebp - 0x24]
push 7
mov eax, ecx
mov esi, 0x42f250
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x6f
pop esi
xor edi, edi
cmp si, word [ebp - 0x24]
jne 0x40c783
mov ecx, edi
test si, si
je 0x40c783
cmp word [ebp + ecx - 0x24], di
je 0x40c783
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + 0x42f310]
cmp si, word [ebp + ecx - 0x24]
je 0x40c765
movzx ecx, byte [eax*2 + 0x42f310]
movzx eax, byte [ebp + eax*2 - 0x24]
sub ecx, eax
cmp ecx, 0x10ab
jne 0x40c7a2
lea ebx, [edx + 0x25922fd1]
jmp 0x40c7a8
and edx, 0xe30d7f9f
mov eax, edi
mov esi, 0x42c218
lea edi, [ebp - 0x18]
or ebx, 0x57b0958a
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x63
jne 0x40c7df
mov cl, 0x63
test cl, cl
je 0x40c7df
cmp byte [ebp + eax - 0x18], 0
je 0x40c7df
mov cl, byte [eax + 0x42f3e9]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0x40c7c7
movzx ecx, byte [eax + 0x42f3e8]
movzx eax, byte [ebp + eax - 0x18]
sub ecx, eax
cmp ecx, 0x9ca
jbe 0x40c7fd
xor edx, 0x1bfab1cd
jmp 0x40c803
lea edx, [ebx + 0x2963f91c]
add ebx, 0x536f2b12
or edx, 0x50cb13da
pop edi
pop esi
mov dword [0x434398], ebx
mov eax, 0x42f3d0
xor ecx, ecx
pop ebx
lea eax, [eax + 2]
xor edx, 0x962b3ba4
cmp word [eax], cx
jne 0x40c81f
mov dword [0x4354e4], edx
mov eax, edx
leave
ret
Function at 0x40dae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 7
pop ecx
mov esi, 0x42f578
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
push 0x53
xor edx, edx
pop ecx
movsw word es:[edi], word [esi]
mov ebx, edx
cmp cx, word [ebp - 0x20]
jne 0x40db25
mov eax, edx
test cx, cx
je 0x40db25
cmp word [ebp + eax - 0x20], dx
je 0x40db25
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + 0x42ce90]
cmp cx, word [ebp + eax - 0x20]
je 0x40db07
movzx ecx, byte [ebx*2 + 0x42ce90]
movzx eax, byte [ebp + ebx*2 - 0x20]
sub ecx, eax
cmp ecx, 0x264b
jae 0x40db50
mov ebx, dword [0x435594]
add ebx, 0xb7038d9c
mov dword [0x435508], ebx
jmp 0x40db56
mov ebx, dword [0x435508]
push 5
pop ecx
mov esi, 0x42f598
lea edi, [ebp - 0x18]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x6e
jne 0x40db84
mov al, 0x6e
test al, al
je 0x40db84
cmp byte [ebp + edx - 0x18], 0
je 0x40db84
mov al, byte [edx + 0x42fb71]
inc edx
cmp al, byte [ebp + edx - 0x18]
je 0x40db6c
movzx ecx, byte [edx + str.no_such_device_or_address]
movzx eax, byte [ebp + edx - 0x18]
sub ecx, eax
cmp ecx, 0xa1b
mov ecx, dword [0x4355a0]
jae 0x40dbae
mov ebx, ecx
xor ebx, 0x96ce17e5
mov dword [0x435508], ebx
lea eax, [ebx + 0x6ca996bf]
pop edi
mov dword [0x435594], eax
lea eax, [ecx + 0x6c3da44d]
pop esi
mov dword [0x4354ec], eax
pop ebx
leave
ret
Function at 0x40fc08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 9
pop ecx
push 0x6f
mov esi, 0x42fea0
lea edi, [ebp - 0x24]
xor ebx, ebx
pop edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
cmp dx, word [ebp - 0x24]
jne 0x40fc4b
mov ecx, ebx
test dx, dx
je 0x40fc4b
cmp word [ebp + ecx - 0x24], bx
je 0x40fc4b
inc eax
lea ecx, [eax + eax]
movzx edx, word [ecx + str.onecoreuap_base_appmodel_search_search_searchgather_fltrdmn_fltrutil.cxx]
cmp dx, word [ebp + ecx - 0x24]
je 0x40fc2d
movzx ecx, byte [eax*2 + str.onecoreuap_base_appmodel_search_search_searchgather_fltrdmn_fltrutil.cxx]
movzx eax, byte [ebp + eax*2 - 0x24]
sub ecx, eax
cmp ecx, 0x23e1
jne 0x40fc70
mov ecx, dword [0x43562c]
xor ecx, 0xe43fe2dc
jmp 0x40fc7a
imul ecx, dword [0x43562c], 0xac20eea
add ecx, 0x25930e1
mov edx, ebx
or ecx, 0x28079619
add ecx, 0x232bf8a8
xor ecx, 0x57acf837
inc edx
cmp word [edx*2 + 0x4302b0], bx
jne 0x40fc8e
lea eax, [ecx - 0x5750d326]
or ecx, 0xa58a1049
cmp edx, 0x1320
pop edi
cmovbe ecx, eax
and ecx, 0x20100004
pop esi
pop ebx
lea eax, [ecx - 0x2cc8f117]
mov dword [0x43562c], eax
leave
ret
Function at 0x40fd83
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
lea edi, [ebp - 0x34]
push 8
pop ecx
mov esi, 0x42f610
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ebx, edx
mov edx, eax
mov dword [ebp - 4], ebx
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 0xc]
movzx eax, word [edi]
mov esi, eax
mov dword [ebp - 0x10], esi
cmp ax, word [ebp - 0x34]
jne 0x40fddd
xor eax, eax
movzx ecx, si
xor ebx, ebx
test cx, cx
je 0x40fdda
cmp word [ebp + eax - 0x34], bx
je 0x40fdda
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + edi]
cmp cx, word [ebp + eax - 0x34]
je 0x40fdbf
mov ebx, dword [ebp - 4]
movzx eax, byte [ebp + edx*2 - 0x34]
movzx ecx, byte [edi + edx*2]
lea edx, [ebx + 0x367b85b7]
sub ecx, eax
mov eax, ebx
or eax, 0x37f0e10c
cmp ecx, 0x22ff
cmovne edx, eax
mov eax, dword [0x4355d0]
xor eax, 0x7ce66bdc
mov dword [ebp - 8], eax
xor eax, eax
test si, si
je 0x40fe38
mov ecx, dword [0x4355f8]
xor ebx, ebx
xor ecx, 0xfc7c97f
inc eax
cmp word [edi + eax*2], bx
jne 0x40fe1a
mov ebx, dword [ebp - 4]
cmp dword [ebp - 0x10], eax
jae 0x40fe38
mov edx, dword [ebp - 8]
and edx, 0x3f8124c7
mov ecx, ebx
and edx, 0xb4a0d313
xor ecx, 0xc451e1ee
mov dword [0x4355f8], edx
test si, si
je 0x40fe65
imul edx, ebx, 0x8e07a75a
mov ecx, ebx
or ecx, 0x3daf6e5c
mov dword [0x4355f8], edx
and ecx, 0xf0f96f1a
xor eax, eax
mov dword [0x435618], ecx
test si, si
je 0x40fe90
xor esi, esi
inc eax
cmp word [edi + eax*2], si
jne 0x40fe7a
cmp eax, 0x1ce6
jbe 0x40fe92
imul eax, ebx, 0xff64310d
jmp 0x40fe98
xor esi, esi
lea eax, [ebx - 0x73fc283b]
xor edx, 0xf691851f
mov dword [ebp - 8], eax
mov edi, esi
mov dword [0x435620], edx
inc edi
cmp byte [edi + 0x430220], 0
jne 0x40fea9
mov esi, dword [ebp - 0x10]
cmp esi, edi
jae 0x40fede
mov ebx, dword [ebp - 8]
cmp esi, 0x1ab3
jne 0x40fecd
mov ebx, ecx
or ebx, 0x47414188
mov eax, ebx
and eax, 0x2ab11a7
inc esi
mov dword [0x4355f8], eax
cmp esi, edi
jb 0x40febd
mov esi, 0x42f200
lea edi, [ebp - 0x24]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 0x10]
cmp si, word [ebp - 0x24]
jne 0x40ff4a
xor ebx, ebx
movzx edi, si
mov esi, ebx
xor edx, edx
mov ebx, dword [ebp - 0xc]
test di, di
je 0x40ff1e
cmp word [ebp + esi - 0x24], dx
je 0x40ff1e
inc eax
lea esi, [eax + eax]
movzx edi, word [esi + ebx]
cmp di, word [ebp + esi - 0x24]
je 0x40ff03
mov edx, dword [0x435620]
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
jmp 0x40ff46
cmp eax, 0x796
jne 0x40ff45
imul edx, ebx, 0xdaa4731
mov dword [0x435620], edx
inc eax
cmp eax, esi
jb 0x40ff32
pop edi
or edx, 0x9c491b3b
mov eax, ecx
add edx, 0x741a546a
pop esi
mov dword [0x4355d0], edx
pop ebx
leave
ret
Function at 0x416910
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
push ebx
push esi
push edi
mov esi, str.ModuleCollection
mov dword [ebp - 0x2c], 0xe73342c7
lea edi, [ebp - 0x44]
mov dword [ebp - 0x28], 0xb5abbbaf
xor ebx, ebx
mov dword [ebp - 0x24], 0xc4fa3ecc
mov dword [ebp - 0x20], 0xe6fd5377
mov eax, ebx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1c], 0xade34787
mov dword [ebp - 0x18], 0xc105b0fe
mov dword [ebp - 0x14], 0x1a73e539
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], 0x93a86454
mov dword [ebp - 0xc], 0xcd13f53e
mov dword [ebp - 8], 0x81f3face
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], 0xcb59ce14
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, ebx
mov byte [ebp + eax - 0x174], al
inc eax
cmp eax, 0x100
jb 0x41697c
mov esi, ebx
mov dl, byte [ebp + esi - 0x174]
mov eax, esi
and eax, 0xf
movzx ecx, dl
movzx eax, byte [ebp + eax - 0x44]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x174]
mov byte [ebp + esi - 0x174], al
inc esi
mov byte [ebp + edi - 0x174], dl
cmp esi, 0x100
jb 0x41698d
mov edi, ebx
mov esi, ebx
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x174]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x174]
mov byte [ebp + edi - 0x174], al
mov byte [ebp + ebx - 0x174], cl
movzx eax, byte [ebp + edi - 0x174]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x174]
xor al, byte [ebp + esi - 0x2c]
mov byte [ebp + esi - 0x74], al
inc esi
cmp esi, 0x2c
jb 0x4169ca
xor esi, esi
lea edx, [ebp - 0x74]
inc esi
xor ebx, ebx
mov ecx, esi
mov byte [ebp - 0x48], bl
call fcn.0040a2e6
call eax
movzx eax, ax
mov ecx, 0x419
cmp ax, cx
je 0x416a43
add ecx, 9
cmp ax, cx
cmove ebx, esi
mov esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x419e1d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x43579c]
sub esp, 0x44
push edi
xor edi, edi
mov ecx, edi
imul edx, edx, 0x479b0712
inc ecx
cmp byte [ecx + 0x43121c], 0
jne 0x419e2e
mov eax, dword [ebp - 8]
push ebx
push esi
cmp eax, ecx
jae 0x419e5f
mov esi, dword [0x435888]
cmp eax, 0x220c
jne 0x419e5a
xor esi, 0x1fb963d5
inc eax
cmp eax, ecx
jb 0x419e4d
mov ebx, edx
mov eax, edi
or ebx, 0x97e04573
inc eax
cmp byte [eax + str.IndexEfsSuccess], 0
jne 0x419e69
cmp eax, 0x4e4
jbe 0x419e82
lea ebx, [edx - 0x6d20b932]
jmp 0x419e8a
mov edx, ebx
or edx, 0xda82e63a
mov eax, dword [0x430dd8]
mov esi, edx
mov dword [ebp - 8], eax
or ebx, 0x7fa7bf9b
mov ax, word [0x430ddc]
or esi, 0x2d0eaf
cmp byte [ebp - 8], 0x6f
mov ecx, edi
mov word [ebp - 4], ax
jne 0x419ed9
mov al, 0x6f
test al, al
je 0x419ecc
cmp byte [ebp + ecx - 8], 0
je 0x419ecc
mov al, byte [ecx + 0x4311a1]
inc ecx
cmp al, byte [ebp + ecx - 8]
je 0x419eb4
cmp dword [ebp - 8], ecx
jae 0x419ed9
mov ebx, esi
xor ebx, 0xfe9ae70b
mov eax, edi
xor esi, 0xc3f4b8cc
inc eax
cmp byte [eax + str.IndexEfsSuccess], 0
jne 0x419edb
cmp eax, 0x134e
jb 0x419ef8
or edx, 0x1a632592
lea eax, [edx - 0x2efee4c3]
mov esi, 0x42ff40
mov dword [ebp - 8], eax
mov eax, edi
push 0xe
pop ecx
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x44], 0x74
jne 0x419f31
mov cl, 0x74
test cl, cl
je 0x419f31
cmp byte [ebp + eax - 0x44], 0
je 0x419f31
mov cl, byte [eax + 0x43121d]
inc eax
cmp cl, byte [ebp + eax - 0x44]
je 0x419f19
movzx ecx, byte [eax + 0x43121c]
movzx eax, byte [ebp + eax - 0x44]
sub ecx, eax
cmp ecx, 0x1062
jbe 0x419f4f
lea ebx, [edx + 0xdbcf7c5]
jmp 0x419f55
imul edx, ebx, 0x51878a
mov esi, dword [ebp - 8]
xor edi, edi
mov ecx, edi
and esi, 0xef780008
inc ecx
cmp byte [ecx + 0x43121c], 0
jne 0x419f5c
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x419f91
mov edi, esi
and edi, 0x7674f603
cmp eax, 0x4d7
jne 0x419f88
lea edx, [ebx - 0x7b6ed912]
inc eax
mov ebx, edi
cmp eax, ecx
jb 0x419f7b
xor edi, edi
add edx, 0x6dd6a034
mov eax, str._08lX__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
imul ecx, esi, 0xb5d5ca3d
pop esi
pop ebx
imul ecx, ecx, 0xe9d45115
inc eax
cmp byte [eax], 0
jne 0x419fa4
or edx, 0xba0beddb
mov ecx, edi
mov eax, edx
mov dword [0x43579c], edx
xor eax, 0x1467fd97
mov dword [0x435864], eax
inc ecx
cmp word [ecx*2 + str.ext_ms_win_imm_l1_1_0], di
jne 0x419fca
pop edi
cmp dword [ebp - 8], ecx
jae 0x419fef
sub ecx, dword [ebp - 8]
or edx, 0x698f4e19
sub ecx, 1
jne 0x419fde
mov dword [0x43579c], edx
imul eax, edx, 0x98a26caa
mov dword [0x435888], eax
leave
ret