joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x88
push eax
mov dword [ebp - 0x10], esp
sub esp, 8
mov ebx, esp
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x54], 0x49b54b97
mov dword [ebp - 0x50], 0x45d647d8
mov dword [ebp - 0x4c], 0x41dd43b8
mov dword [ebp - 0x48], 0x7de17fcc
mov dword [ebp - 0x44], 0x799e7ba7
mov dword [ebp - 0x40], 0x75ee7794
mov dword [ebp - 0x3c], 0x71e073ff
mov dword [ebp - 0x38], 0x6df56fec
mov dword [ebp - 0x34], 0x69f46be2
mov dword [ebp - 0x30], 0x65e867ff
mov dword [ebp - 0x2c], 0x618663f8
mov dword [ebp - 0x28], 0x1d901f90
mov dword [ebp - 0x24], 0x19801b8d
mov dword [ebp - 0x20], 0x1582178f
mov dword [ebp - 0x1c], 0x119f138f
lea eax, [ebp - 0x18]
mov word [ebp - 0x18], 0xf10
mov dword [ebp - 0x16], 0
mov word [ebp - 0x12], 0
xor ecx, ecx
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x13
xor dl, byte [ebp + ecx - 0x54]
add dl, 0xa1
mov byte [ebp + ecx - 0x54], dl
inc ecx
cmp ecx, 0x44
jne 0x4255d0
lea edi, [ebp - 0x92]
lea edx, [ebp - 0x54]
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [ebp - 0x56]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
push dword [ebp - 0x10]
push 0
push 0
push 0x1e
lea eax, [ebp - 0x92]
push eax
push 0
call dword [0x34cdd0]
mov dword [ebx], 0xd39291b3
mov byte [ebx + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ecx]
lea edi, [ecx + 0x5c]
and edi, edx
add edx, ecx
add edx, 0x5c
add edi, edi
sub edx, edi
add dl, 0x34
mov byte [ebx + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 5
jb 0x425630
xor ecx, ecx
cmp eax, dword [ebx]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x3474ec]
Function at 0x427910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
movzx edi, word [esi]
test di, di
je 0x427a52
mov edx, dword [esp + 0x18]
dec edx
je 0x427a52
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, di
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x427960
lea ebp, [ecx + 1]
mov byte [ecx], bl
jmp 0x4279f0
cmp ebx, 0x7ff
ja 0x427990
cmp edx, 2
jb 0x427990
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ecx], al
and bl, 0x3f
or bl, 0x80
lea ebp, [ecx + 2]
mov byte [ecx + 1], bl
jmp 0x4279f0
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x427a18
cmp edx, 4
jb 0x427a18
movzx edi, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea eax, [ebx + edi]
add eax, 0xfca02400
mov ebx, eax
shr ebx, 0x12
add bl, 0xf0
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [ecx + 1], bl
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ecx + 2], al
mov al, 0x3f
mov ebx, edi
sub al, bl
and al, 0x3f
xor al, 0xbf
lea ebp, [ecx + 4]
mov byte [ecx + 3], al
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
mov eax, ebp
sub eax, ecx
mov ecx, edx
not ecx
and ecx, eax
not eax
and eax, edx
sub eax, ecx
mov esi, edi
mov ecx, ebp
mov edx, eax
movzx edi, word [esi]
test di, di
je 0x427a52
test edx, edx
jne 0x427940
jmp 0x427a52
movzx eax, ax
cmp eax, 0xdc00
jne 0x427a26
mov esi, edi
jmp 0x427a06
cmp edx, 3
jb 0x427a4e
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ecx], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ecx + 1], al
and bl, 0x3f
or bl, 0x80
lea ebp, [ecx + 3]
mov byte [ecx + 2], bl
jmp 0x4279f0
mov ebp, ecx
jmp 0x4279f0
mov byte [ecx], 0
mov edx, ecx
not edx
mov eax, dword [esp + 0x14]
and edx, eax
not eax
and eax, ecx
sub eax, edx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43bfa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp], 0xb08f8e8d
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
xor ecx, 0xe2
mov edx, eax
or edx, 0x1d
and ecx, edx
add ecx, edx
xor cl, byte [esp + eax]
add cl, 0x6f
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 6
jb 0x43bfd0
mov ebp, dword [esp]
mov eax, dword [0x34cdd4]
test eax, eax
je 0x43c046
xor ecx, ecx
mov edx, dword [0x34cdd8]
nop
nop
cmp dword [edx + ecx*8], 0x61813e67
je 0x43c020
inc ecx
cmp eax, ecx
jne 0x43c010
jmp 0x43c046
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebp
je 0x43c046
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x34cddc]
call fcn.0043e5c0
add esp, 0x1c
mov ebp, eax
mov dword [esp], 0x97564944
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xee
xor cl, byte [esp + eax]
add cl, 0x5a
mov byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x43c060
cmp ebp, dword [esp]
jne 0x43c1e4
push dword [esp + 0xc]
call fcn.0043be10
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], ecx
mov dword [esp], 0xb08f8e8d
mov word [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
xor ecx, 0xe2
mov esi, edx
or esi, 0x1d
and ecx, esi
add ecx, esi
xor cl, byte [esp + edx]
add cl, 0x6f
mov byte [esp + edx], cl
mov ecx, edx
and ecx, 1
xor edx, 1
lea edx, [edx + ecx*2]
cmp edx, 6
jb 0x43c0b0
mov ebp, dword [esp]
mov edx, dword [0x34cdd4]
test edx, edx
je 0x43c13c
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x34cdd8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x61813e67
je 0x43c112
inc ebp
cmp edx, ebp
jne 0x43c100
mov ebp, ecx
jmp 0x43c13c
mov edx, dword [esi + ebp*8 + 4]
mov ebp, ecx
cmp edx, ecx
je 0x43c13c
push 0
push dword [esp + 0xc]
push eax
push 5
push 0x10
push edx
push dword [0x34cddc]
mov esi, eax
call fcn.0043e5c0
add esp, 0x1c
mov ebp, eax
mov eax, esi
test ebp, ebp
js 0x43c1db
mov dword [esp + 8], edi
mov dword [esp], 0xb372732d
mov word [esp + 4], 0
mov ecx, 0x6c
mov esi, 0x93
movzx edi, byte [esp + ecx - 0x6c]
mov edx, esi
xor edx, ecx
and edx, edi
xor edx, ecx
add dl, 0xe4
mov byte [esp + ecx - 0x6c], dl
inc ecx
dec esi
cmp ecx, 0x72
jne 0x43c160
mov ecx, dword [esp]
mov dword [esp + 0x10], ecx
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebp]
movzx edi, word [ebx + ebp]
test si, si
je 0x43c1b5
add ebp, 2
cmp si, di
je 0x43c1a0
cmp si, di
je 0x43c1c6
mov esi, dword [ecx]
test esi, esi
jne 0x43c190
mov ebp, dword [esp + 0x10]
jmp 0x43c1db
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 8]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor ebp, ebp
push eax
call fcn.0043bf30
add esp, 4
mov eax, ebp
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43c210
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43c2d0
xor eax, eax
cmp dword [ecx], 0
jne 0x43c313
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0xb08f8e8d
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
mov ebx, eax
xor ebx, 0xe2
mov esi, eax
or esi, 0x1d
and ebx, esi
add ebx, esi
xor bl, byte [esp + eax]
add bl, 0x6f
mov byte [esp + eax], bl
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
cmp eax, 6
jb 0x43c280
mov eax, dword [esp]
mov esi, dword [0x34cdd4]
test esi, esi
je 0x43c313
xor edi, edi
mov ebx, dword [0x34cdd8]
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43c31c
inc edi
cmp esi, edi
jne 0x43c2c0
jmp 0x43c313
mov dword [esp + 8], 0xd11e1f24
mov word [esp + 0xc], 0
mov eax, 0x85
mov ecx, 0x7a
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x7d]
mov esi, eax
or esi, edx
not edx
or edx, ecx
and edx, esi
add dl, 0x67
mov byte [esp + eax - 0x7d], dl
inc eax
dec ecx
cmp eax, 0x8b
jne 0x43c2f0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43c313
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x34cddc]
call fcn.0043e5c0
add esp, 0x1c
jmp 0x43c313
Function at 0x43d270
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov dword [esp + 0x48], 0x8336812e
mov dword [esp + 0x4c], 0x872a8520
mov dword [esp + 0x50], 0x8b648924
mov dword [esp + 0x54], 0x8f228d28
mov dword [esp + 0x58], 0x9392913c
mov byte [esp + 0x5c], 0
mov eax, 0x854f1de0
mov ecx, 0x7ab0e21f
nop
nop
movzx edx, byte [esp + eax + 0x7ab0e268]
mov esi, eax
and esi, edx
add esi, esi
sub esi, edx
add esi, ecx
and esi, eax
mov edi, esi
and edi, 2
mov ebx, esi
or esi, 2
imul esi, edi
xor edi, 2
and ebx, 0x854f1dfd
imul ebx, edi
add esi, ebx
mov edi, esi
not edi
and edi, eax
and esi, ecx
sub edi, esi
lea esi, [edi + edx]
not esi
and esi, 1
add edx, edi
add edx, 0x9f
or edx, 1
xor edx, esi
lea edx, [edx + esi*2]
mov byte [esp + eax + 0x7ab0e268], dl
inc eax
dec ecx
cmp eax, 0x854f1df5
jne 0x43d2b0
lea eax, [esp + 0x48]
push eax
call fcn.0043f8a0
add esp, 4
mov dword [0x354df0], eax
mov ebp, 0x84460650
test eax, eax
je 0x43d331
mov ebp, 0x7f411199
mov esi, 0xee261b4c
xor eax, eax
cmp esi, 0xe72980bb
setl al
mov eax, dword [eax*4 + 0x3497e4]
mov ecx, 0x4441f7e2
xor ecx, dword [0x3497ec]
add eax, ecx
inc eax
mov dword [esp + 8], ecx
mov dword [esp], ecx
jmp eax

Function at 0x43f8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x494a4b1c
mov eax, 0xe232b0f3
mov ecx, 0x1dcd4f0c
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0x1dcd4f11]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0x41
mov byte [esp + eax + 0x1dcd4f11], dl
inc eax
dec ecx
cmp eax, 0xe232b0f7
jne 0x43f8c0
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x24], 0
sete cl
jmp dword [ecx*4 + 0x34a4c4]

Function at 0x43fcd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x14]
mov dword [esp], 0x23222170
xor eax, eax
mov edx, 0x253b53c7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax]
mov edi, edx
and edi, 0x24081105
mov ebx, eax
and ebx, 2
or ebx, edi
xor ebx, esi
xor ebx, 0xbeccbd3d
add ebx, 0xcc910b30
mov esi, ebx
and esi, 0x38
xor ebx, 0xb8
lea ebx, [ebx + esi*2]
mov byte [esp + eax], bl
inc eax
dec edx
cmp eax, 4
jne 0x43fcf0
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x34a594]

Function at 0x43fdc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [esp + 0x40]
movzx eax, word [eax]
mov dword [esp], 0x7776dfad
mov word [esp + 4], 0
xor ecx, ecx
nop
nop
mov edx, ecx
add dl, 0x96
xor dl, byte [esp + ecx]
add dl, 0x12
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 6
jne 0x43fde0
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x34a5c4]
Function at 0x440540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x440560
lea ecx, [esi + eax]
add ecx, 0xfffffffe
add eax, esi
mov edx, 1
sub edx, eax
and edx, esi
mov eax, esi
not eax
and eax, ecx
sub eax, edx
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x440593
mov eax, 0xffffffff
jmp 0x440596
add eax, 0xa
push eax
call fcn.004086e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x4405e1
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x4405d0
mov word [ecx], 0
lea ecx, [edi*2 + 8]
mov word [esp + 8], cx
lea ecx, [edi*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x14151617
mov word [esp + 4], 0
mov ecx, 0x3256797c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x3256797c]
xor edx, ecx
mov esi, edx
and esi, 0x13
xor edx, 0x93
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx - 0x3256797c], dl
inc ecx
cmp ecx, 0x32567982
jne 0x440650
mov esi, dword [esp]
mov ecx, dword [0x34cdd4]
test ecx, ecx
je 0x4406df
xor edx, edx
mov edi, dword [0x34cdd8]
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x4406a0
inc edx
cmp ecx, edx
jne 0x440690
jmp 0x4406df
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x4406df
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push ebx
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x34cddc]
mov edi, eax
call fcn.0043e5c0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.004086f0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x440720
lea ecx, [esi + eax]
add ecx, 0xfffffffe
add eax, esi
mov edx, 1
sub edx, eax
and edx, esi
mov eax, esi
not eax
and eax, ecx
sub eax, edx
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x440753
mov eax, 0xffffffff
jmp 0x440756
add eax, 0xa
push eax
call fcn.004086e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [ebx + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [esi]
test bp, bp
je 0x4407a1
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [esi]
add esi, 2
test bp, bp
jne 0x440790
mov word [edx], 0
mov edx, 3
sub edx, ebx
and edx, 2
mov esi, ecx
and esi, 0xfffd
imul esi, edx
and ebx, 2
or ecx, 2
imul ecx, ebx
lea edx, [ecx + esi]
mov word [esp + 8], dx
add ecx, esi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x14151617
mov word [esp + 4], 0
mov ecx, 0x3256797c
nop
nop
nop
movzx edx, byte [esp + ecx - 0x3256797c]
xor edx, ecx
mov esi, edx
and esi, 0x13
xor edx, 0x93
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx - 0x3256797c], dl
inc ecx
cmp ecx, 0x32567982
jne 0x440820
mov esi, dword [esp]
mov ecx, dword [0x34cdd4]
test ecx, ecx
je 0x4408a4
xor edx, edx
mov ebx, dword [0x34cdd8]
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x440870
inc edx
cmp ecx, edx
jne 0x440860
jmp 0x4408a4
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x4408a4
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x34cddc]
mov edi, eax
call fcn.0043e5c0
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.004086f0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4408c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [ebp + 8]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax], 0
lea eax, [eax + 2]
jne 0x4408e0
lea ecx, [ebx + eax]
add ecx, 0xfffffffe
add eax, ebx
mov edx, 1
sub edx, eax
and edx, ebx
mov esi, ebx
not esi
and esi, ecx
sub esi, edx
sar esi, 1
lea edi, [esi + 4]
mov ecx, esi
and ecx, 1
mov eax, edi
or eax, 1
add eax, ecx
jns 0x44091d
mov eax, 0xffffffff
jmp 0x44091f
add eax, eax
push eax
call fcn.004086e0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x440961
add ebx, 2
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x440950
mov word [ecx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov ecx, edi
and ecx, 0xfffd
imul ecx, edx
and esi, 2
or edi, 2
imul edi, esi
lea edx, [edi + ecx]
mov word [esp], dx
add ecx, edi
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x14151617
mov word [esp + 0x24], 0
mov ecx, 0x3256797c
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x3256795c]
xor edx, ecx
mov esi, edx
and esi, 0x13
xor edx, 0x93
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx - 0x3256795c], dl
inc ecx
cmp ecx, 0x32567982
jne 0x4409e0
mov esi, dword [esp + 0x20]
mov ecx, dword [0x34cdd4]
test ecx, ecx
je 0x440a59
xor edx, edx
mov edi, dword [0x34cdd8]
cmp dword [edi + edx*8], 0x1ce638e1
je 0x440a30
inc edx
cmp ecx, edx
jne 0x440a20
jmp 0x440a59
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x440a59
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x34cddc]
mov edi, eax
call fcn.0043e5c0
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.004086f0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x440a6f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x14151617
mov word [esp + 4], 0
mov eax, 0x3256797c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x3256797c]
xor ecx, eax
mov edx, ecx
and edx, 0x13
xor ecx, 0x93
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x3256797c], cl
inc eax
cmp eax, 0x32567982
jne 0x440ab0
mov eax, dword [esp]
mov edx, dword [0x34cdd4]
test edx, edx
je 0x440b28
xor ebx, ebx
mov ecx, dword [0x34cdd8]
nop
nop
cmp dword [ecx + ebx*8], 0x9c142cda
je 0x440b00
inc ebx
cmp edx, ebx
jne 0x440af0
jmp 0x440b28
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x440b28
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x34cddc]
call fcn.0043e5c0
add esp, 0x20
test edi, edi
je 0x440b32
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x440b3e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x440cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x14151617
mov word [esp + 4], 0
mov eax, 0x3256797c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x3256797c]
xor edi, eax
mov ebx, edi
and ebx, 0x13
xor edi, 0x93
lea ebx, [edi + ebx*2]
inc bl
mov byte [esp + eax - 0x3256797c], bl
inc eax
cmp eax, 0x32567982
jne 0x440cf0
mov eax, dword [esp]
mov ebx, dword [0x34cdd4]
test ebx, ebx
je 0x440d6e
xor ebp, ebp
mov edi, dword [0x34cdd8]
nop
nop
cmp dword [edi + ebp*8], 0xa2545bf7
je 0x440d40
inc ebp
cmp ebx, ebp
jne 0x440d30
jmp 0x440d6e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x440d6e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x34cddc]
call fcn.0043e5c0
add esp, 0x30
cmp eax, 0x103
jne 0x440e09
mov dword [esp], 0x14151617
mov word [esp + 4], 0
mov eax, 0x3256797c
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x3256797c]
xor ecx, eax
mov edx, ecx
and edx, 0x13
xor ecx, 0x93
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x3256797c], cl
inc eax
cmp eax, 0x32567982
jne 0x440d90
mov eax, dword [esp]
mov ecx, dword [0x34cdd4]
test ecx, ecx
je 0x440e01
xor edx, edx
mov edi, dword [0x34cdd8]
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x440de0
inc edx
cmp ecx, edx
jne 0x440dd0
jmp 0x440e01
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x440e01
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x34cddc]
call fcn.0043e5c0
add esp, 0x18
test eax, eax
js 0x440e09
mov eax, dword [esp + 8]
test esi, esi
je 0x440e13
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405f90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x405fda
push eax
push 0xffffffffffffffff
mov ecx, esi
call fcn.00405090
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret 0xc
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret 0xc

Function at 0x4063c0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push esi
push edi
push 0xf01ff
xor edi, edi
push eax
push ecx
mov dword [esp + 0x14], edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4064b8
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push ebx
lea edx, [esp + 0x10]
push ebp
push edx
push esi
call edi
cmp dword [esp + 0x18], 4
je 0x40649b
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x4064a3
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x38], eax
lea eax, [esp + 0x14]
push eax
push esi
call edi
test eax, eax
je 0x4064a3
mov eax, dword [esp + 0x18]
cmp eax, 4
je 0x40649b
cmp eax, 2
jne 0x4064a3
call ebp
sub eax, dword [esp + 0x38]
cmp eax, 0x7530
jae 0x4064a3
mov eax, dword [esp + 0x2c]
cmp eax, 0x1388
jbe 0x40646a
mov eax, 0x1388
jmp 0x406473
test eax, eax
jne 0x406477
mov eax, 0x3e8
mov dword [esp + 0x2c], eax
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
push esi
call edi
test eax, eax
jne 0x40643d
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x20
ret 8
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x20
ret 8
mov eax, edi
pop edi
pop esi
add esp, 0x20
ret 8