joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc4850f
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
push edi
push 6
pop ecx
mov esi, 0xc704a4
and dword [ebp - 4], 0
lea edi, [ebp - 0x3c]
mov dword [ebp - 0x1c], 0xa787fab4
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], 0xea3cc80f
xor eax, eax
mov dword [ebp - 0x14], 0x8bcd621c
mov dword [ebp - 0x10], 0xc4e70ef3
movsw word es:[edi], word [esi]
mov dword [ebp - 0xc], 0x9b7b3a53
mov dword [ebp - 8], 0x5d63dcca
movsb byte es:[edi], byte [esi]
mov edi, dword [0xc77114]
and edi, 0x8e3ca7a9
mov byte [ebp + eax - 0x13c], al
inc eax
cmp eax, 0x100
jb 0xc48561
mov dword [ebp - 0x20], edi
xor esi, esi
mov edi, dword [ebp - 4]
xor edx, edx
mov bl, byte [ebp + esi - 0x13c]
push 0x1a
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x3c]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x13c]
mov byte [ebp + esi - 0x13c], al
inc esi
mov byte [ebp + edi - 0x13c], bl
cmp esi, 0x100
jb 0xc4857e
and dword [ebp - 4], 0
xor ebx, ebx
mov edi, dword [ebp - 0x20]
xor esi, esi
lea eax, [ebx + 1]
sub edi, 0x7c2283d0
movzx ebx, al
mov eax, dword [ebp - 4]
mov cl, byte [ebp + ebx - 0x13c]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 4], eax
mov al, byte [ebp + eax - 0x13c]
mov byte [ebp + ebx - 0x13c], al
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x13c], cl
movzx eax, byte [ebp + ebx - 0x13c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x13c]
xor al, byte [ebp + esi - 0x1c]
mov byte [ebp + esi - 0x3c], al
inc esi
cmp esi, 0x18
jb 0xc485c6
xor ecx, ecx
mov dword [0xc77114], edi
lea edx, [ebp - 0x3c]
mov byte [ebp - 0x24], 0
inc ecx
call fcn.00c4ba1b
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xc493e9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov edx, dword [0xc771c4]
xor eax, eax
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
lea edi, [ebp - 0x20]
push 6
pop ecx
mov esi, 0xc6feb0
imul ebx, edx, 0x4e21d8bc
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
mov dword [0xc77230], ebx
movzx eax, word [ecx]
mov esi, eax
mov dword [ebp - 4], esi
cmp ax, word [ebp - 0x20]
jne 0xc4947b
xor eax, eax
movzx edi, si
mov esi, eax
xor ebx, ebx
test di, di
je 0xc4944b
cmp word [ebp + eax - 0x20], bx
je 0xc4944b
inc esi
lea eax, [esi + esi]
movzx edi, word [eax + ecx]
cmp di, word [ebp + eax - 0x20]
je 0xc49430
mov eax, dword [ebp - 8]
mov ebx, dword [0xc77230]
cmp eax, esi
jae 0xc49478
cmp eax, 0x1b4c
jne 0xc49465
xor ebx, 0xe5b07076
mov edx, ebx
or edx, 0x4588b497
inc eax
cmp eax, esi
jb 0xc49458
mov dword [0xc77230], ebx
mov esi, dword [ebp - 4]
test si, si
je 0xc494b9
mov eax, ecx
xor esi, esi
lea eax, [eax + 2]
lea edx, [edx + 0x34913fec]
cmp word [eax], si
jne 0xc49484
mov ebx, dword [0xc7720c]
mov eax, esi
lea edx, [ebx - 0x394e9c13]
inc eax
cmp word [ecx + eax*2], si
jne 0xc494a0
cmp dword [ebp - 8], eax
jae 0xc494c1
lea eax, [ebx + 0x1699e492]
mov dword [0xc77230], eax
jmp 0xc494c1
mov ebx, dword [0xc7720c]
xor esi, esi
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x1c]
and ebx, 0x3b2c4310
mov dword [0xc77228], ebx
mov ebx, esi
mov esi, 0xc6f420
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp ax, word [ebp - 0x1c]
jne 0xc49508
xor edi, edi
movzx esi, ax
mov eax, edi
test si, si
je 0xc49508
cmp word [ebp + eax - 0x1c], di
je 0xc49508
inc ebx
lea eax, [ebx + ebx]
movzx esi, word [eax + ecx]
cmp si, word [ebp + eax - 0x1c]
je 0xc494ed
movzx ecx, byte [ecx + ebx*2]
movzx eax, byte [ebp + ebx*2 - 0x1c]
pop edi
sub ecx, eax
pop esi
pop ebx
cmp ecx, 0x2345
jbe 0xc49526
add edx, 0xaaab2568
jmp 0xc49532
mov edx, dword [0xc7720c]
add edx, 0x82e01de9
mov dword [0xc771c4], edx
leave
ret
Function at 0xc4af33
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0xc77300]
sub esp, 0x34
push ebx
push esi
xor esi, esi
push edi
mov ecx, esi
xor eax, 0x431eaf68
inc ecx
cmp word [ecx*2 + 0xc71c10], si
jne 0xc4af45
cmp dword [ebp - 8], ecx
jae 0xc4af64
mov ecx, eax
and ecx, 0x6d9b20dc
jmp 0xc4af6a
mov ecx, dword [0xc77330]
xor ecx, 0x9f728c5a
mov edx, esi
or eax, 0x67eaab2d
inc edx
cmp byte [edx + str.RegDeleteKeyExW], 0
jne 0xc4af77
cmp edx, 0xb81
jae 0xc4af8e
add eax, 0x5e9bbe36
mov edx, esi
or eax, 0xe26bc171
inc edx
cmp word [edx*2 + 0xc71c10], si
jne 0xc4af95
cmp edx, 0xd40
jne 0xc4afaf
mov eax, ecx
xor eax, 0x61972d0e
mov edx, esi
inc edx
cmp word [edx*2 + 0xc71c10], si
jne 0xc4afb1
cmp edx, 0x16c8
jbe 0xc4afcb
mov eax, ecx
and eax, 0x6630605f
and eax, 0x9c314adb
lea edi, [ebp - 0x34]
imul edx, eax, 0x9fdc91b3
push 0xb
pop ecx
push 0x6e
mov eax, edx
mov ebx, edx
xor eax, 0xc890916d
xor ebx, 0xb4c241b3
mov dword [ebp - 8], eax
mov eax, esi
mov esi, 0xc6f030
rep movsd dword es:[edi], dword [esi]
pop esi
cmp si, word [ebp - 0x34]
jne 0xc4b04c
xor edi, edi
mov ecx, edi
test si, si
je 0xc4b022
cmp word [ebp + ecx - 0x34], di
je 0xc4b022
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + 0xc71c10]
cmp si, word [ebp + ecx - 0x34]
je 0xc4b004
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp eax, ecx
jae 0xc4b04c
mov esi, dword [ebp - 8]
cmp eax, 0x2426
jne 0xc4b041
mov ebx, edx
xor ebx, 0x35e9997a
inc eax
lea edx, [esi + 0x2f127e2c]
cmp eax, ecx
jb 0xc4b032
lea eax, [ebx - 0x41493300]
xor eax, 0x829b5b1f
pop edi
mov dword [0xc77330], eax
add eax, 0x5c9654c8
xor edx, 0xd3bc9880
mov dword [0xc7732c], eax
pop esi
mov dword [0xc77300], edx
pop ebx
leave
ret
Function at 0xc4b077
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0xe
pop ecx
mov esi, 0xc71764
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov eax, ebx
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x40], 0x6f
jne 0xc4b0b2
mov cl, 0x6f
test cl, cl
je 0xc4b0b2
cmp byte [ebp + eax - 0x40], bl
je 0xc4b0b2
mov cl, byte [eax + 0xc71cb1]
inc eax
cmp cl, byte [ebp + eax - 0x40]
je 0xc4b09b
movzx ecx, byte [eax + 0xc71cb0]
movzx eax, byte [ebp + eax - 0x40]
sub ecx, eax
cmp ecx, 0x28c
jbe 0xc4b0d4
mov eax, dword [0xc772f8]
and eax, 0x4be5f59b
jmp 0xc4b0de
mov eax, dword [0xc77280]
and eax, 0x91064df9
and eax, 0xb0e105c6
mov ecx, ebx
imul edx, eax, 0x1c63a74a
mov esi, edx
or esi, 0xb9c7a0f2
inc ecx
cmp word [ecx*2 + 0xc71e20], bx
jne 0xc4b0f3
mov eax, dword [ebp - 4]
jmp 0xc4b117
cmp eax, 0x2171
jne 0xc4b110
imul esi, esi, 0x7de09b4d
add edx, 0x1a933345
inc eax
cmp eax, ecx
jb 0xc4b103
push 6
pop ecx
mov esi, 0xc71748
imul edx, edx, 0x956ccaf2
lea edi, [ebp - 0x20]
mov eax, ebx
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x20], 0x41
jne 0xc4b150
mov cl, 0x41
test cl, cl
je 0xc4b150
cmp byte [ebp + eax - 0x20], bl
je 0xc4b150
mov cl, byte [eax + 0xc71ead]
inc eax
cmp cl, byte [ebp + eax - 0x20]
je 0xc4b139
movzx ecx, byte [eax + 0xc71eac]
movzx eax, byte [ebp + eax - 0x20]
sub ecx, eax
cmp ecx, 0x1c0f
jae 0xc4b170
mov ebx, edx
and ebx, 0x8eea8041
jmp 0xc4b176
lea ebx, [edx + 0x25ca2959]
xor edx, 0x4a966f7d
xor esi, esi
mov dword [0xc772f8], edx
mov ecx, esi
or ebx, 0xb0d77fca
inc ecx
cmp word [ecx*2 + 0xc71e20], si
jne 0xc4b186
mov eax, dword [ebp - 4]
cmp eax, ecx
jae 0xc4b1c2
imul edx, ebx, 0xcfb1587a
cmp eax, 0x1a68
jne 0xc4b1b7
add ebx, 0x364b60b6
sub edx, 0x2eff5944
inc eax
mov dword [0xc772f8], edx
cmp eax, ecx
jb 0xc4b1a4
mov eax, esi
lea edi, [ebp - 0x18]
mov esi, 0xc717a0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x66
jne 0xc4b1ff
mov cl, 0x66
test cl, cl
je 0xc4b1f2
cmp byte [ebp + eax - 0x18], 0
je 0xc4b1f2
mov cl, byte [eax + 0xc71be5]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0xc4b1da
cmp dword [ebp - 4], eax
jae 0xc4b1ff
mov ebx, edx
or ebx, 0xd64a539d
push 0xb
pop ecx
mov esi, 0xc707ac
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
push 0x61
pop esi
xor eax, eax
cmp si, word [ebp - 0x34]
jne 0xc4b239
xor edi, edi
mov ecx, edi
test si, si
je 0xc4b239
cmp word [ebp + ecx - 0x34], di
je 0xc4b239
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + 0xc71e20]
cmp si, word [ebp + ecx - 0x34]
je 0xc4b21b
movzx ecx, byte [eax*2 + 0xc71e20]
movzx eax, byte [ebp + eax*2 - 0x34]
sub ecx, eax
cmp ecx, 0x35b
je 0xc4b25e
mov edx, ebx
and edx, 0x78c6ef17
mov dword [0xc772f8], edx
pop edi
lea eax, [edx + 0x1a09ccd2]
xor eax, 0x4f9c0029
pop esi
mov dword [0xc77280], eax
pop ebx
leave
ret
Function at 0xc4b3cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0xc772fc]
sub esp, 0x18
push ebx
xor ebx, ebx
mov edx, ebx
or ecx, 0xc8455952
inc edx
cmp word [edx*2 + 0xc71c30], bx
jne 0xc4b3e0
mov eax, dword [0xc7727c]
push esi
mov esi, dword [ebp - 4]
push edi
cmp esi, edx
jae 0xc4b411
cmp esi, 0x142d
jne 0xc4b40e
mov eax, ecx
or eax, 0xa8ac6c63
inc esi
jmp 0xc4b3fb
mov edx, ebx
imul esi, eax, 0x2a65c481
inc edx
cmp byte [edx + str.SrchSimplePI], bl
jne 0xc4b419
cmp edx, 0xe9d
ja 0xc4b432
mov ecx, esi
or ecx, 0x91d480c9
mov edx, ebx
xor eax, 0x29d02874
inc edx
cmp word [edx*2 + 0xc71c30], bx
jne 0xc4b434
imul esi, ecx, 0x2fde94ca
mov eax, ebx
mov edx, esi
and edx, 0x5a066456
inc eax
cmp word [eax*2 + 0xc71aa0], bx
jne 0xc4b454
cmp eax, 0x1fda
ja 0xc4b46c
imul edx, esi, 0x34297a73
imul edi, edx, 0x7b41bb2d
mov esi, ebx
lea eax, [edi + 0x42e4587]
inc esi
cmp word [esi*2 + 0xc71a60], bx
jne 0xc4b47a
mov edx, dword [ebp - 4]
jmp 0xc4b4a0
cmp edx, 0x1c4e
jne 0xc4b499
mov eax, ecx
and eax, 0xcf86f9d9
xor edi, 0xc7c12a82
inc edx
cmp edx, esi
jb 0xc4b48a
mov edx, eax
mov ecx, ebx
and edx, 0x2a8bffe1
inc ecx
cmp word [ecx*2 + 0xc719a0], bx
jne 0xc4b4ae
cmp ecx, 0x2da
jbe 0xc4b4c6
and eax, 0x94a490c9
and edx, 0x501207af
mov ecx, ebx
imul ebx, edx, 0x62c1e9eb
xor edi, edi
mov dword [0xc77278], edx
mov dword [ebp - 4], ebx
inc ecx
cmp word [ecx*2 + 0xc71a60], di
jne 0xc4b4df
mov esi, dword [ebp - 4]
jmp 0xc4b509
cmp esi, 0xf75
jne 0xc4b503
imul edx, eax, 0x9a1424ba
mov dword [0xc77278], edx
and eax, 0x6804d2f5
inc esi
cmp esi, ecx
jb 0xc4b4ef
mov eax, edi
inc eax
cmp word [eax*2 + 0xc71b20], di
jne 0xc4b50f
cmp eax, 0x94a
jae 0xc4b52c
sub ebx, 0x7cf05f75
mov dword [ebp - 4], ebx
jmp 0xc4b538
imul edx, edx, 0x29d2a5f7
mov dword [0xc77278], edx
mov eax, edi
lea ebx, [edx - 0x544de0ce]
mov esi, 0xc717b0
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x4e
pop edi
pop esi
jne 0xc4b56f
mov cl, 0x4e
test cl, cl
je 0xc4b56f
cmp byte [ebp + eax - 0x18], 0
je 0xc4b56f
mov cl, byte [eax + 0xc71ae1]
inc eax
cmp cl, byte [ebp + eax - 0x18]
je 0xc4b557
movzx ecx, byte [eax + 0xc71ae0]
movzx eax, byte [ebp + eax - 0x18]
sub ecx, eax
cmp ecx, 0x25b
jne 0xc4b593
lea edx, [ebx - 0x6bcb526d]
mov dword [0xc77278], edx
jmp 0xc4b59c
mov ebx, dword [ebp - 4]
add ebx, 0xfd3e155a
xor ecx, ecx
mov eax, ecx
imul ebx, ebx, 0xd9ab7cce
inc eax
cmp word [eax*2 + 0xc71a60], cx
jne 0xc4b5a0
mov dword [0xc7727c], ebx
pop ebx
cmp eax, 0x136
jae 0xc4b5c7
and edx, 0x8a42ac98
jmp 0xc4b5cd
or edx, 0x94a5708f
mov dword [0xc772fc], edx
mov eax, edx
leave
ret
Function at 0xc4b911
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [0xc78cd4]
mov eax, 0x5a4d
push edi
mov dword [ebp - 4], edx
cmp word [esi], ax
jne 0xc4b99d
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0xc4b99d
mov ecx, 0x2000
test word [eax + 0x16], cx
je 0xc4b99d
mov ebx, dword [eax + 0x78]
test ebx, ebx
je 0xc4b99d
xor edi, edi
cmp dword [eax + 0x7c], edi
je 0xc4b99d
mov eax, dword [esi + ebx + 0x1c]
mov edx, dword [esi + ebx + 0x20]
sub dword [0xc77270], 0x22ff97b0
add edx, esi
mov dword [ebp - 8], edx
lea ecx, [eax + esi]
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + ebx + 0x24]
add ecx, esi
mov dword [ebp - 0xc], ecx
test eax, eax
je 0xc4b99d
mov ecx, dword [edx + edi*4]
add ecx, esi
call fcn.00c4d309
mov edx, eax
call fcn.00c4b889
cmp eax, dword [ebp - 4]
je 0xc4b9a4
mov edx, dword [ebp - 8]
inc edi
cmp edi, dword [esi + ebx + 0x1c]
jb 0xc4b97d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, esi
jmp 0xc4b99f

Function at 0xc4b9b5
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
ret
Function at 0xc4cbb7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0xc7736c]
sub esp, 0x18
and eax, 0x9e5748eb
xor ecx, ecx
or eax, 0xd2cc6827
mov edx, ecx
push ebx
push esi
imul esi, eax, 0x92bcbb88
push edi
mov edi, esi
xor edi, 0x30c6f065
inc edx
cmp byte [edx + 0xc724e4], cl
jne 0xc4cbe1
mov eax, dword [ebp - 4]
jmp 0xc4cc03
cmp eax, 0x1039
jne 0xc4cbfc
imul esi, edi, 0x73ee5927
sub esi, 0x13830c8a
inc eax
cmp eax, edx
jb 0xc4cbef
imul ebx, edi, 0x810df811
mov edx, 0xc721a0
mov eax, ebx
mov dword [0xc7736c], ebx
xor eax, 0x143b25c1
xor eax, 0x1bc2a774
inc edx
cmp byte [edx], cl
jne 0xc4cc1f
mov esi, str.operation_canceled
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x18], 0x6e
jne 0xc4cc74
mov dl, 0x6e
test dl, dl
je 0xc4cc58
cmp byte [ebp + ecx - 0x18], 0
je 0xc4cc58
mov dl, byte [ecx + 0xc724a5]
inc ecx
cmp dl, byte [ebp + ecx - 0x18]
je 0xc4cc40
mov edx, dword [ebp - 4]
jmp 0xc4cc70
cmp edx, 0x685
jne 0xc4cc6a
or eax, 0x13e3666
add eax, 0x3cf07df0
inc edx
cmp edx, ecx
jb 0xc4cc5d
pop edi
lea eax, [ebx + 0x146ee3e4]
pop esi
mov dword [0xc7734c], eax
pop ebx
leave
ret
Function at 0xc4d166
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
push ebx
push esi
push edi
mov esi, 0xc72104
mov dword [ebp - 0x3c], edx
lea edi, [ebp - 0x50]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], 0x3515d66b
mov dword [ebp - 0x2c], 0x417459b8
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x28], 0x3b48ed56
mov dword [ebp - 0x24], 0xb710efe7
mov dword [ebp - 0x20], 0xdb102f7
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1c], 0x15259c9b
mov dword [ebp - 0x18], 0x89a1345a
mov dword [ebp - 0x14], 0xac79023e
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], 0x897aab8c
mov dword [ebp - 0xc], 0x43838441
mov dword [ebp - 8], 0x75cfb058
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x180], al
inc eax
cmp eax, 0x100
jb 0xc4d1d7
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x180]
push 0x11
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x50]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x180]
mov byte [ebp + esi - 0x180], al
inc esi
mov byte [ebp + edi - 0x180], bl
cmp esi, 0x100
jb 0xc4d1e8
and dword [ebp - 0x34], 0
xor ebx, ebx
mov edx, dword [0xc773a4]
xor edi, edi
lea eax, [ebx + 1]
movzx ebx, al
mov eax, dword [ebp - 0x34]
mov cl, byte [ebp + ebx - 0x180]
movzx esi, cl
add eax, esi
movzx eax, al
mov dword [ebp - 0x34], eax
mov al, byte [ebp + eax - 0x180]
mov byte [ebp + ebx - 0x180], al
mov eax, dword [ebp - 0x34]
mov byte [ebp + eax - 0x180], cl
movzx eax, byte [ebp + ebx - 0x180]
add eax, esi
xor esi, esi
movzx eax, al
mov al, byte [ebp + eax - 0x180]
mov byte [ebp - 1], al
push edx
mov ecx, 0xc70760
call fcn.00c4c642
inc esi
mov edx, 0x17385afc
pop ecx
cmp byte [esi + 0xc72300], 0
jne 0xc4d27f
call fcn.00c4c457
mov al, byte [ebp + edi - 0x30]
cmp esi, 0x152d
sbb edx, edx
xor al, byte [ebp - 1]
and edx, 0xcec45311
mov byte [ebp + edi - 0x80], al
add edx, 0x4f619909
inc edi
cmp edi, 0x2c
jb 0xc4d233
mov ecx, dword [ebp - 0x38]
mov dword [0xc773a4], 0xf5af424c
mov byte [ebp - 0x54], 0
pop edi
pop esi
pop ebx
test ecx, ecx
jne 0xc4d2e4
xor eax, eax
leave
ret
call fcn.00c4d309
add eax, 2
lea edx, [ebp - 0x80]
push eax
push dword [ebp - 0x3c]
push 0xffffffffffffffff
push ecx
xor ecx, ecx
push 0
push 0xfde9
inc ecx
call fcn.00c4ba1b
call eax
leave
ret
Function at 0xc4d5dc
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
push ebx
push esi
push edi
mov dword [ebp - 0x30], ecx
lea edi, [ebp - 0x6c]
push 0xe
pop ecx
mov esi, str.onecoreuap_base_appmodel_searchcommon_secutil_secutil.cxx
mov dword [ebp - 0x2c], 0x5ffbbf0
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x28], 0x55e11e7f
mov dword [ebp - 0x24], 0x70511eb
mov dword [ebp - 0x20], 0xc98989a
movsw word es:[edi], word [esi]
mov dword [ebp - 0x1c], 0x3cda7052
mov dword [ebp - 0x18], 0x8fcf8541
mov dword [ebp - 0x14], 0x25544856
movsb byte es:[edi], byte [esi]
xor edi, edi
mov dword [ebp - 0x10], 0xf29365c7
mov dword [ebp - 0xc], 0x3d81fc1d
xor eax, eax
mov dword [ebp - 8], 0xf8fd7edf
mov dword [ebp - 4], 0x23b5d1aa
mov byte [ebp + eax - 0x16c], al
inc eax
cmp eax, 0x100
jb 0xc4d64c
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x16c]
push 0x3a
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x6c]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x16c]
mov byte [ebp + esi - 0x16c], al
inc esi
mov byte [ebp + edi - 0x16c], bl
cmp esi, 0x100
jb 0xc4d65d
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x16c]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x16c]
mov byte [ebp + edi - 0x16c], al
mov byte [ebp + ebx - 0x16c], cl
movzx eax, byte [ebp + edi - 0x16c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x16c]
xor al, byte [ebp + esi - 0x2c]
mov byte [ebp + esi - 0x60], al
inc esi
cmp esi, 0x2c
jb 0xc4d6a0
imul eax, dword [ebp - 0x30], 0x3e8
lea edx, [ebp - 0x60]
push 0
xor ecx, ecx
mov byte [ebp - 0x34], 0
inc ecx
push eax
push 0xffffffffffffffff
call fcn.00c4ba1b
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xc4d811
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [0xc773bc]
xor ebx, ebx
mov edx, edi
mov eax, ebx
xor edx, 0x42441da0
inc eax
cmp byte [eax + 0xc72770], bl
jne 0xc4d82a
cmp dword [ebp - 4], eax
jae 0xc4d846
sub eax, dword [ebp - 4]
or edx, 0xdbe99a76
sub eax, 1
jne 0xc4d83b
mov ecx, dword [0xc78520]
mov eax, str.Windows_Search_Service
lea eax, [eax + 2]
or ecx, 0xaec048d2
cmp word [eax], bx
jne 0xc4d851
mov ecx, edi
mov eax, ebx
xor ecx, 0x5735784b
inc eax
cmp word [eax*2 + str.Windows_Search_Service], bx
jne 0xc4d869
cmp eax, 0x1e33
jae 0xc4d881
lea edx, [ecx + 0x15e30672]
mov esi, ebx
xor ecx, 0x14e0730a
inc esi
cmp byte [esi + 0xc72780], bl
jne 0xc4d883
mov eax, dword [ebp - 4]
jmp 0xc4d8ad
cmp eax, 0xdc6
jne 0xc4d8a6
mov edi, edx
or edi, 0x79604e83
imul ecx, edi, 0x7a5a6329
inc eax
cmp eax, esi
jb 0xc4d897
add ecx, 0x93627f1d
mov eax, ebx
inc eax
cmp byte [eax + 0xc72770], bl
jne 0xc4d8b9
mov esi, dword [ebp - 4]
jmp 0xc4d8de
cmp esi, 0x285
jne 0xc4d8d7
mov ecx, edi
and ecx, 0x1fac1b34
add edx, 0xda78e1
inc esi
cmp esi, eax
jb 0xc4d8c7
mov esi, edx
mov eax, ebx
xor esi, 0xe1e6ed66
inc eax
cmp byte [eax + str.SrchCIWrapper], bl
jne 0xc4d8ec
mov edi, dword [ebp - 4]
jmp 0xc4d911
cmp edi, 0x124a
jne 0xc4d908
lea edx, [esi - 0x78d80f05]
mov ecx, edx
or ecx, 0x1806a411
inc edi
cmp edi, eax
jb 0xc4d8fa
xor ecx, 0xd90a0ef6
mov eax, ebx
mov dword [0xc773b8], ecx
inc eax
cmp byte [eax + 0xc72770], bl
jne 0xc4d923
mov edx, dword [ebp - 4]
jmp 0xc4d946
cmp edx, 0x1e6b
jne 0xc4d945
add ecx, 0x37ca4502
mov dword [0xc773b8], ecx
inc edx
cmp edx, eax
jb 0xc4d931
lea eax, [esi - 0x782458b2]
mov edx, ebx
mov dword [0xc773a8], eax
inc edx
cmp word [edx*2 + str.Windows_Search_Service], bx
jne 0xc4d957
cmp edx, 0x1223
jae 0xc4d97a
mov ecx, esi
xor ecx, 0x6b7c746c
mov dword [0xc773b8], ecx
jmp 0xc4d986
mov eax, esi
and eax, 0x7059cab
mov dword [0xc773a8], eax
imul eax, eax, 0x3fe6b638
xor ecx, 0xd8105b44
pop edi
pop esi
mov dword [0xc773bc], ecx
pop ebx
mov dword [0xc78520], eax
leave
ret
Function at 0xc4df73
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0xc773c0], 0
push esi
push edi
jne 0xc4e17d
mov eax, dword fs:[0x30]
and dword [ebp - 8], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
call fcn.00c4d811
mov esi, dword [str.kq_aC]
xor edi, edi
call fcn.00c4d70f
add esi, 0x9ad8ecaf
inc edi
cmp byte [edi + 0xc72720], 0
jne 0xc4dfa5
mov dword [str.kq_aC], esi
call fcn.00c4ddc2
cmp edi, 0x10c6
jae 0xc4dfe0
xor esi, 0x5ac04f0f
mov dword [str.kq_aC], esi
call fcn.00c4ddc2
jmp 0xc4dff1
add esi, 0xfd3bc143
mov dword [str.kq_aC], esi
call fcn.00c4db7e
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0xc4e184
mov edx, eax
imul esi, esi, 0x1593a878
mov dword [ebp - 0xc], edx
mov eax, dword [edx + 0x3c]
mov dword [str.kq_aC], esi
mov eax, dword [eax + edx + 0x78]
test eax, eax
je 0xc4e04e
lea edi, [eax + edx]
mov eax, dword [edi + 0xc]
add eax, edx
mov dword [ebp - 8], edi
mov dword [ebp - 4], eax
mov eax, dword [eax]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0xc4e051
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0xc4e05a
jmp 0xc4e051
mov edi, dword [ebp - 8]
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x18]
test eax, eax
jne 0xc4e002
mov dword [ebp - 0x14], esi
test edi, edi
je 0xc4e184
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x20]
mov dword [ebp - 4], eax
add ecx, edx
mov eax, dword [edi + 0x1c]
add eax, edx
mov dword [0xc78cdc], edx
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x24]
xor edi, edi
add eax, edx
mov edx, dword [ebp - 4]
mov esi, edx
lea eax, [eax + edx*2]
mov edx, dword [ebp - 0xc]
add eax, 0xfffffffe
dec esi
mov dword [ebp - 8], eax
lea esi, [ecx + esi*4]
mov ecx, dword [esi]
mov eax, 0x775a
add ecx, edx
cmp word [ecx], ax
mov eax, dword [ebp - 4]
jne 0xc4e0db
call fcn.00c4df1e
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [edi*8 + 0xc773c4], eax
movzx eax, word [ecx]
mov eax, dword [edx + eax*4]
mov dword [edi*8 + 0xc773c8], eax
inc edi
cmp edi, 0x226
je 0xc4e0ef
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
jmp 0xc4e0de
mov ecx, dword [ebp - 8]
dec eax
sub ecx, 2
sub esi, 4
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
test eax, eax
jne 0xc4e09a
mov esi, dword [ebp - 0x14]
lea eax, [edi - 1]
or esi, 0x4e2654a8
mov dword [0xc773c0], edi
xor esi, 0x4a273395
mov dword [str.kq_aC], esi
xor esi, esi
test eax, eax
je 0xc4e17d
mov eax, edi
xor edx, edx
sub eax, esi
sub eax, 1
je 0xc4e175
mov ecx, dword [edx*8 + 0xc773c8]
mov dword [ebp - 0x14], ecx
cmp ecx, dword [edx*8 + 0xc773d0]
jbe 0xc4e16b
mov eax, dword [edx*8 + 0xc773cc]
mov ecx, dword [edx*8 + 0xc773c4]
mov dword [edx*8 + 0xc773c4], eax
mov eax, dword [edx*8 + 0xc773d0]
mov dword [edx*8 + 0xc773c8], eax
mov eax, dword [ebp - 0x14]
mov dword [edx*8 + 0xc773cc], ecx
mov dword [edx*8 + 0xc773d0], eax
mov edi, dword [0xc773c0]
mov eax, edi
inc edx
sub eax, esi
dec eax
cmp edx, eax
jb 0xc4e11e
inc esi
lea eax, [edi - 1]
cmp esi, eax
jb 0xc4e113
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
xor eax, eax
jmp 0xc4e180