joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410b70
Capabilities:
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x110
mov esi, esp
push eax
sub esp, 0x20
mov dword [esi], esp
push eax
mov dword [esi + 8], esp
push eax
mov dword [esi + 0x1c], esp
sub esp, 0x68
mov dword [esi + 4], esp
sub esp, 0x10
mov dword [esi + 0x18], esp
sub esp, 0x208
mov dword [esi + 0x80], esp
sub esp, 8
mov dword [esi + 0x84], esp
push eax
mov dword [esi + 0x28], esp
sub esp, 8
mov dword [esi + 0x78], esp
sub esp, 8
mov dword [esi + 0x20], esp
sub esp, 0x68
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
sub esp, 0x64
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x6c], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x68], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x64], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x60], eax
mov esp, eax
push eax
sub esp, 0xfc
mov dword [esi + 0x30], esp
sub esp, 8
mov dword [esi + 0x5c], esp
sub esp, 8
mov dword [esi + 0x58], esp
sub esp, 0x24
mov dword [esi + 0x34], esp
push eax
mov dword [esi + 0x54], esp
push eax
mov dword [esi + 0x50], esp
sub esp, 0x68
mov dword [esi + 0x2c], esp
sub esp, 0x10
mov dword [esi + 0x7c], esp
sub esp, 0x68
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x4c], eax
mov esp, eax
push eax
sub esp, 8
mov dword [esi + 0x70], esp
sub esp, 0x800
mov dword [esi + 0x48], esp
sub esp, 0x80
mov dword [esi + 0x14], esp
sub esp, 0x44
mov dword [esi + 0x74], esp
sub esp, 0x10
mov dword [esi + 0x44], esp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x4499d4]
Function at 0x42404b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x28]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x424040
cmp eax, 0xffffffed
jge 0x424057
mov eax, 0xffffffff
jmp 0x42405a
add eax, 0x12
push eax
call fcn.0040c730
add esp, 4
mov esi, eax
mov dword [esp], 0x2399218c
mov dword [esp + 4], 0x27af2581
mov dword [esp + 8], 0x3b44394c
mov dword [esp + 0xc], 0x3f9c3d98
mov word [esp + 0x10], 0x3130
mov dword [esp + 0x12], 0
mov eax, 0x88
mov ecx, 0x77
nop
nop
nop
movzx ebx, byte [esp + eax - 0x88]
mov edx, eax
xor edx, ecx
and edx, ebx
xor edx, ecx
mov bl, 0x57
sub bl, dl
mov byte [esp + eax - 0x88], bl
inc eax
dec ecx
cmp eax, 0x9e
jne 0x4240a0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x4240f1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x4240e0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x424121
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424110
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00443cc0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
mov eax, dword [0x44ae4c]
nop
nop
nop
nop
jmp eax
Function at 0x426f20
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x70
mov eax, dword [0x44fd5c]
mov dword [esp], 0x11621f3b
mov dword [esp + 4], 0x15771381
mov dword [esp + 8], 0x98a1777
mov dword [esp + 0xc], 0xd9a0b4b
mov dword [esp + 0x10], 0x14a0f9c
mov dword [esp + 0x14], 0x5960363
mov dword [esp + 0x18], 0x39210767
mov word [esp + 0x1c], 0x3b38
mov dword [esp + 0x1e], 0
mov ecx, 5
mov edx, 0xe428eefa
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 5]
mov esi, ecx
and esi, edi
not edi
and edi, edx
lea ebx, [edi + edi]
not ebx
add ebx, edi
not esi
and esi, ebx
lea ebx, [esi + 0x74ccaae6]
mov edi, 1
sub edi, esi
not edi
or edi, esi
and edi, 1
mov ebp, ebx
and ebp, 0xfe
xor ebx, 1
add ebx, esi
add ebx, 0x74ccaae6
sub ebx, ebp
add ebx, edi
mov byte [esp + ecx - 5], bl
inc ecx
dec edx
cmp ecx, 0x27
jne 0x426f80
lea edi, [esp + 0x64]
mov ecx, esp
push edi
push 0
push 0
push 0xe
push ecx
push 0
call eax
mov ebx, dword [esp + 0x64]
test ebx, ebx
jns 0x426fef
mov eax, 0xffffffff
jmp 0x426ff2
lea eax, [ebx + ebx]
push eax
call fcn.0040c730
add esp, 4
mov dword [esp + 0x60], eax
mov eax, dword [0x44fd5c]
mov dword [esp], 0x4ff2492d
mov dword [esp + 4], 0x43e54ddf
mov dword [esp + 8], 0x47da41e1
mov dword [esp + 0xc], 0xbb2a4505
mov dword [esp + 0x10], 0xbffab928
mov dword [esp + 0x14], 0xb326bd1d
mov dword [esp + 0x18], 0xb7d3b111
mov word [esp + 0x1c], 0xb5b4
mov dword [esp + 0x1e], 0
mov ecx, 0xf2
mov ebp, 0xd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0xf2]
mov edx, ebp
xor edx, ecx
and edx, esi
xor edx, ecx
add dl, 0x46
mov byte [esp + ecx - 0xf2], dl
inc ecx
dec ebp
cmp ecx, 0x114
jne 0x427060
push edi
push ebx
mov esi, dword [esp + 0x68]
push esi
push 0xe
lea ecx, [esp + 0x10]
push ecx
push 0
call eax
mov eax, dword [esp + 0x64]
mov ecx, eax
add ecx, 9
jns 0x4270a8
mov eax, 0xffffffff
jmp 0x4270af
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040c730
add esp, 4
mov edi, eax
mov dword [esp], 0x23d221cc
mov dword [esp + 4], 0x27c525c5
mov dword [esp + 8], 0xdb3bd943
mov dword [esp + 0xc], 0xdf3bdd3b
mov dword [esp + 0x10], 0xd3d2d143
mov dword [esp + 0x14], 0
mov ecx, 0xebbe3278
nop
nop
movzx eax, byte [esp + ecx + 0x1441cd88]
mov edx, eax
mov ebp, eax
and edx, ecx
mov eax, edx
not eax
and eax, 2
mov ebx, edx
and ebx, 0xfffffffd
imul ebx, eax
mov eax, ebp
sub al, bl
mov ebx, eax
mov eax, edx
shr al, 1
and al, 1
or dl, 2
mul dl
add al, al
mov edx, ebx
sub dl, al
movzx eax, dl
add eax, ecx
add al, 0xa8
mov byte [esp + ecx + 0x1441cd88], al
inc ecx
cmp ecx, 0xebbe3290
jne 0x4270f0
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x427161
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x427150
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x427191
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x427180
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.00443cc0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b668]
Function at 0x429420
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x840
mov dword [esp], 0
mov eax, 0x20219
mov ecx, 1
xor edi, edi
mov dword [esp + 0xc], 0
jmp 0x429460
jmp dword [ecx*4 + 0x44bd54]
Function at 0x42b387
Capabilities:
Encode data using xor

Disassembly:
mov eax, ebp
mov ecx, eax
and cl, 1
movzx ecx, cl
jmp dword [ecx*4 + 0x44bfec]

Function at 0x42b3b8
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x14], 0x1c1d1a1b
mov byte [esp + 0x18], 0
mov ecx, 0xd8258f3a
nop
nop
movzx edx, byte [esp + ecx + 0x27da70da]
xor edx, ecx
add edx, 0x3d1e3ca4
mov esi, edx
xor esi, 0x38
and edx, 0x38
lea edx, [esi + edx*2]
add dl, 2
mov byte [esp + ecx + 0x27da70da], dl
inc ecx
cmp ecx, 0xd8258f3f
jne 0x42b3d0
mov ecx, dword [0x44fd60]
test ecx, ecx
je case.0x42b0d9.49
mov edx, dword [esp + 0x14]
xor esi, esi
mov ebx, dword [0x44fd64]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x7e776f1
je 0x42b430
inc esi
cmp ecx, esi
jne 0x42b420
jmp case.0x42b0d9.49
mov ecx, dword [ebx + esi*8 + 4]
cmp ecx, edx
je case.0x42b0d9.49
push eax
push 1
push dword [0x44fd68]
push ecx
call fcn.004407f0
add esp, 0x10
jmp case.0x42b0d9.49
Function at 0x42cd60
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84
mov eax, dword [0x44fd5c]
mov dword [esp + 0x10], 0x89558b77
mov dword [esp + 0x14], 0x85368738
mov dword [esp + 0x18], 0x813d8358
mov dword [esp + 0x1c], 0x9d219f0c
mov dword [esp + 0x20], 0x993e9b67
mov dword [esp + 0x24], 0x9527974a
mov dword [esp + 0x28], 0x91299318
mov dword [esp + 0x2c], 0x6dd16f20
mov dword [esp + 0x30], 0x699f6bd0
mov dword [esp + 0x34], 0x65c2679d
mov dword [esp + 0x38], 0x61d963e9
mov dword [esp + 0x3c], 0x7df37fed
mov dword [esp + 0x40], 0x79cb7bcb
mov dword [esp + 0x44], 0x758477ca
mov dword [esp + 0x48], 0x71c173fc
mov dword [esp + 0x4c], 0x4d4e4fc4
mov ecx, 0x63
mov edx, 0x9c
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x53]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0x11
mov byte [esp + ecx - 0x53], bl
inc ecx
dec edx
cmp ecx, 0xa3
jne 0x42ce00
lea esi, [esp + 0x80]
lea ecx, [esp + 0x10]
push esi
push 0
push 0
push 0x1f
push ecx
push 0
call eax
mov edi, dword [esp + 0x80]
test edi, edi
jns 0x42ce47
mov eax, 0xffffffff
jmp 0x42ce4a
lea eax, [edi + edi]
push eax
call fcn.0040c730
add esp, 4
mov dword [esp + 0x6c], eax
mov eax, dword [0x44fd5c]
mov dword [esp + 0x10], 0x49b54b97
mov dword [esp + 0x14], 0x45d647d8
mov dword [esp + 0x18], 0x41dd43b8
mov dword [esp + 0x1c], 0x7de17fcc
mov dword [esp + 0x20], 0x799e7ba7
mov dword [esp + 0x24], 0x75e7778a
mov dword [esp + 0x28], 0x71e973f8
mov dword [esp + 0x2c], 0x6df16fe0
mov dword [esp + 0x30], 0x69bf6bf0
mov dword [esp + 0x34], 0x658267bd
mov dword [esp + 0x38], 0x61f963e9
mov dword [esp + 0x3c], 0x1d931fed
mov dword [esp + 0x40], 0x198b1b8b
mov dword [esp + 0x44], 0x15c4178a
mov dword [esp + 0x48], 0x1181139c
mov dword [esp + 0x4c], 0xd0e0f84
mov word [esp + 0x50], 0
mov byte [esp + 0x52], 0
mov ecx, 0xd12fe213
mov edx, 0xec
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x2ed01dfd]
mov ebp, edx
xor ebp, ecx
and ebp, ebx
xor ebp, ecx
mov ebx, ebp
and ebx, 0x20
add ebx, ebx
xor ebp, 0x5f
sub ebx, ebp
mov byte [esp + ecx + 0x2ed01dfd], bl
inc ecx
dec edx
cmp ecx, 0xd12fe256
jne 0x42cf00
push esi
push edi
mov ebx, dword [esp + 0x74]
push ebx
push 0x1f
lea ecx, [esp + 0x20]
push ecx
push 0
call eax
lea eax, [esp + 0x58]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00443b30
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c13c]
Function at 0x42e500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x42e55a
cmp edi, 1
je 0x42e55a
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x42e531
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x42e530
cmp ecx, 0x20
je 0x42e530
cmp ecx, 0x2b
mov edx, edi
je 0x42e550
cmp ecx, 0x2d
jne 0x42e56f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x42e574
xor edi, edi
test eax, eax
je 0x42e72d
mov dword [eax], 0x16
jmp 0x42e72d
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x42e59d
cmp edx, 0x10
jne 0x42e5b5
cmp byte [ebx], 0x30
jne 0x42e596
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x42e5b7
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x42e5b7
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x42e610
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x42e6c8
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x42e637
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x42e6f8
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x42e6f8
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x42e5f0
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x42e680
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x42e689
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x42e6ad
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x42e6dd
test bl, bl
jne 0x42e6dd
mov ebx, dword [esp + 0x10]
jmp 0x42e603
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x42e5e5
mov esi, edi
test bl, bl
jne 0x42e6eb
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x42e5e5
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42e706
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x42e714
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x42e724
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x42e72d
cmp byte [esp + 3], 0
jne 0x42e72d
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x434be0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov edi, dword [ebp + 8]
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x434c12
jmp 0x434d54
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
jmp 0x434c3e
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x434c50
jmp 0x434d4e
sub esp, 4
mov dword [ebp - 0x30], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call fcn.0040c860
add esp, 4
cmp eax, 0
setne cl
jmp 0x434c78
xor ebx, ebx
test cl, 1
jne 0x434c84
jmp 0x434d3d
mov cl, byte [esi]
mov byte [ebp - 0x10], cl
mov byte [ebp - 0x24], 0xc9
mov byte [ebp - 0x23], 0xe3
mov byte [ebp - 0x22], 0xe5
mov byte [ebp - 0x21], 0x21
mov byte [ebp - 0x20], 0xd2
mov byte [ebp - 0x1f], 0x22
mov byte [ebp - 0x1e], 0xd1
mov byte [ebp - 0x1d], 0x27
mov byte [ebp - 0x1c], 0xd0
mov byte [ebp - 0x1b], 0x99
mov byte [ebp - 0x1a], 0x22
mov byte [ebp - 0x19], 0x21
mov byte [ebp - 0x18], 0x2c
mov byte [ebp - 0x17], 0xbb
mov ecx, 0xe
mov byte [ebp + ecx - 0x24], 0
add ecx, 1
cmp ecx, 0x11
jne 0x434cc6
mov dword [ebp - 0x28], eax
xor ecx, ecx
cmp ecx, 0x11
jae 0x434d16
movzx esi, byte [ebp + ecx - 0x24]
mov edx, ecx
add edx, 0x9d
mov ebx, esi
xor ebx, 0xffffffff
and edx, ebx
mov ebx, 0x62
sub ebx, ecx
mov eax, edi
mov edi, esi
add edi, 1
xor esi, 0xffffffff
or ebx, esi
add ebx, edi
mov edi, eax
or edx, ebx
add dl, 0xef
mov byte [ebp + ecx - 0x24], dl
add ecx, 1
jmp 0x434cd8
jmp 0x434d18
lea edx, [ebp - 0x24]
sub esp, 0xc
mov ecx, edi
mov dword [esp], edx
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
call fcn.0040d2c0
mov bl, al
and bl, 1
jmp 0x434d3d
mov eax, dword [ebp - 0x30]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x434d4e
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a0c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp], 0x1c1d1a1b
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x3a
xor cl, byte [esp + eax]
add cl, 0xde
mov byte [esp + eax], cl
inc eax
cmp eax, 5
jne 0x43a0e0
mov eax, dword [esp]
mov ecx, dword [0x44fd60]
test ecx, ecx
je 0x43a142
xor edx, edx
mov esi, dword [0x44fd64]
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xd518dba1
je 0x43a120
inc edx
cmp ecx, edx
jne 0x43a110
jmp 0x43a142
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43a142
lea eax, [esp + 0xc]
push eax
push 8
push 0xffffffffffffffff
push 3
push dword [0x44fd68]
push ecx
call fcn.004407f0
add esp, 0x18
xor ebx, ebx
test eax, eax
js 0x43a21e
mov ecx, dword [esp + 0xc]
mov dword [esp], 0x1c1d1a1b
mov byte [esp + 4], 0
nop
nop
nop
nop
mov eax, ebx
add al, 0x3a
xor al, byte [esp + ebx]
add al, 0xde
mov byte [esp + ebx], al
inc ebx
cmp ebx, 5
jne 0x43a160
mov eax, dword [esp]
mov edx, dword [0x44fd60]
test edx, edx
je 0x43a1a8
xor esi, esi
mov edi, dword [0x44fd64]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xd1a85eee
je 0x43a1a0
inc esi
cmp edx, esi
jne 0x43a190
jmp 0x43a1a8
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
jne 0x43a227
mov dword [esp], 0x1c1d1a1b
mov byte [esp + 4], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x3a
xor bl, byte [esp + edx]
add bl, 0xde
mov byte [esp + edx], bl
inc edx
cmp edx, 5
jne 0x43a1c0
test eax, eax
setns bl
mov eax, dword [0x44fd60]
test eax, eax
je 0x43a21a
mov edx, dword [esp]
xor esi, esi
mov edi, dword [0x44fd64]
nop
nop
nop
cmp dword [edi + esi*8], 0x7e776f1
je 0x43a200
inc esi
cmp eax, esi
jne 0x43a1f0
jmp 0x43a21a
mov eax, dword [edi + esi*8 + 4]
cmp eax, edx
je 0x43a21a
push ecx
push 1
push dword [0x44fd68]
push eax
call fcn.004407f0
add esp, 0x10
and bl, byte [esp + 0xb]
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
ret
mov eax, esp
lea esi, [esp + 0x10]
push eax
push 4
push esi
push 0x14
push ecx
push 5
push dword [0x44fd68]
push edx
call fcn.004407f0
add esp, 0x20
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x10], 0
setne byte [esp + 0xb]
jmp 0x43a1a8
Function at 0x43a260
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov edi, dword [ebp + 8]
mov eax, dword [0x44fd5c]
mov dword [esp + 8], 0x83518165
mov dword [esp + 0xc], 0x8735853d
mov dword [esp + 0x10], 0x8b2f893c
mov dword [esp + 0x14], 0x8f4a8d21
mov dword [esp + 0x18], 0x933b9122
mov dword [esp + 0x1c], 0x97339522
mov dword [esp + 0x20], 0x9b9a997d
mov ecx, 0xc3993ae0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x3c66c528]
xor edx, ecx
mov esi, edx
xor esi, 0x61
and edx, 0x1e
add edx, edx
sub edx, esi
inc dl
mov byte [esp + ecx + 0x3c66c528], dl
inc ecx
cmp ecx, 0xc3993afc
jne 0x43a2c0
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x84]
lea esi, [esp + 8]
push ecx
push 8
push edx
push 0xd
push esi
push 0
call eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d548]

Function at 0x43a9e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push eax
sub esp, 0xc
mov esi, esp
lea ecx, [ebp - 0x20]
push 0x68
push 7
push 0x100080
push ecx
push eax
call fcn.00443b30
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d620]

Function at 0x43ac20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00444220
add esp, 0x14
test eax, eax
js 0x43ad46
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00444600
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0x43acba
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x43ac88
mov eax, 0xffffffff
jmp 0x43ac8f
lea eax, [eax*2 + 2]
push eax
call fcn.0040c730
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.00444c10
add esp, 0x14
test eax, eax
jns 0x43acba
push esi
call fcn.0040c740
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x1c1d1a1b
mov byte [esp + 8], 0
nop
nop
nop
nop
nop
nop
mov ecx, ebx
add cl, 0x3a
xor cl, byte [esp + ebx + 4]
add cl, 0xde
mov byte [esp + ebx + 4], cl
inc ebx
cmp ebx, 5
jne 0x43acd0
mov ecx, dword [0x44fd60]
test ecx, ecx
je 0x43ad2a
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44fd64]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43ad10
inc edi
cmp ecx, edi
jne 0x43ad00
jmp 0x43ad2a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43ad2a
push eax
push 1
push dword [0x44fd68]
push ecx
call fcn.004407f0
add esp, 0x10
test esi, esi
jne 0x43ad48
lea eax, [esp + 4]
push eax
call fcn.00443940
add esp, 4
test al, al
je 0x43ad46
cmp dword [esp + 4], 1
je 0x43ad48
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43dac0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44da5c]

Function at 0x43db90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, ecx
mov ebx, dword [esp + 0x28]
mov dword [esp], 0
mov dword [esp + 4], 0x1c1d1a1b
mov byte [esp + 8], 0
lea eax, [esp + 4]
mov ecx, 0x27da70c5
nop
nop
nop
nop
nop
nop
movzx esi, byte [eax]
mov edi, ecx
or edi, esi
not edi
lea edx, [ecx - 0x27da7000]
and edx, esi
or edx, edi
mov esi, edx
not esi
add edx, 0xdd
and esi, 1
or edx, 1
add edx, esi
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x27da70c0
jne 0x43dbc0
mov edi, dword [esp + 4]
mov eax, dword [0x44fd60]
test eax, eax
je 0x43dc44
xor ecx, ecx
mov edx, dword [0x44fd64]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xc85f7986
je 0x43dc20
inc ecx
cmp eax, ecx
jne 0x43dc10
jmp 0x43dc44
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43dc44
mov ecx, esp
push ecx
push 0
push 0
push 5
push 4
push dword [0x44fd68]
push eax
call fcn.004407f0
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43dd70
mov dword [esp + 0x10], ebp
push dword [esp]
call fcn.0043da20
add esp, 4
mov ecx, dword [esp]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0x1c1d1a1b
mov byte [esp + 8], 0
lea edx, [esp + 4]
mov ebp, 0x27da70c5
nop
nop
nop
nop
movzx esi, byte [edx]
mov edi, ebp
or edi, esi
not edi
lea ecx, [ebp - 0x27da7000]
and ecx, esi
or ecx, edi
mov esi, ecx
not esi
add ecx, 0xdd
and esi, 1
or ecx, 1
add ecx, esi
mov byte [edx], cl
inc edx
dec ebp
cmp ebp, 0x27da70c0
jne 0x43dc80
mov edi, dword [esp + 4]
mov edx, dword [0x44fd60]
test edx, edx
je 0x43dd08
xor ecx, ecx
mov esi, dword [0x44fd64]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ecx*8], 0xc85f7986
je 0x43dce0
inc ecx
cmp edx, ecx
jne 0x43dcd0
jmp 0x43dd08
mov edx, dword [esi + ecx*8 + 4]
cmp edx, edi
je 0x43dd08
push 0
push dword [esp + 0x10]
push eax
push 5
push 4
push dword [0x44fd68]
push edx
mov esi, eax
call fcn.004407f0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43dd67
mov edx, dword [eax]
mov ecx, eax
mov edi, dword [ecx + edx + 0x3c]
add ecx, edx
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [edi + ebp]
movzx esi, word [ebx + ebp]
test edx, edx
je 0x43dd34
add ebp, 2
cmp dx, si
je 0x43dd20
movzx esi, si
mov edi, esi
xor edi, edx
not esi
and esi, edx
add esi, esi
cmp esi, edi
je 0x43dd52
mov edx, dword [ecx]
test edx, edx
jne 0x43dd10
mov edi, 0xc0000225
jmp 0x43dd67
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043dac0
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4