joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a56d0
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 0x19
xor eax, eax
mov edi, 0x1010acfd
xor ebp, ebp
push str.User32
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], ebp
mov dword [0x1010acf9], ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x100a570e
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IsHungAppWindow
push esi
call edi
push str.IsHungThread
push esi
mov dword [ebx + 4], eax
call edi
mov dword [ebx + 8], eax
call fcn.1009f570
test eax, eax
jne 0x100a573c
call fcn.1009f5e0
test eax, eax
je 0x100a5744
mov dword [esp + 0x10], 1
push 0
push 0x100a58d0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x1010acf9]
mov dword [esp + 0x14], 0
test eax, eax
jl 0x100a57ed
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], 0x1010acfd
mov eax, dword [esp + 0x1c]
mov esi, dword [eax]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100a57cf
mov eax, dword [ebx + 4]
test eax, eax
jne 0x100a5791
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x100a57cf
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x100a579e
push esi
call eax
jmp 0x100a57ab
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [ebx + 8]
test eax, eax
je 0x100a57cf
push 0x100
call fcn.100a7f77
add esp, 4
mov dword [edi], eax
push 0x100
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
inc ebp
add edi, 4
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ecx, dword [0x1010acf9]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edx
jle 0x100a5772
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret 4

Function at 0x100a5800
Capabilities:
Enumerate gui resources

Disassembly:
push 0xffffffffffffffff
push 0x100bde58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x10106c69]
push ebp
push esi
push edi
mov dword [esp + 0xc], eax
xor ebp, ebp
mov ecx, 0x40
xor eax, eax
mov edi, 0x1010acfd
push ebp
push 0x100a58d0
rep stosd dword es:[edi], eax
mov dword [esp + 0x20], ebp
mov dword [0x1010acf9], ebp
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x1010acf9]
cmp eax, ebp
jl 0x100a58a4
push ebx
mov ebx, dword [esp + 0x24]
mov esi, 0x1010acfd
sub esi, ebx
mov dword [esp + 0x24], esi
jmp 0x100a5867
mov esi, dword [esp + 0x24]
push 0x14
call fcn.100a7f77
add esp, 4
mov dword [ebx], eax
mov ecx, dword [esi + ebx]
lea edx, [esp + 0x10]
push ecx
push 0x100fdb6d
push edx
call fcn.100b497e
mov esi, dword [esp + 0x1c]
mov edi, dword [ebx]
mov ecx, 5
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x1010acf9]
inc ebp
add ebx, 4
cmp ebp, eax
jle 0x100a5863
pop ebx
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x18], 0xffffffff
call fcn.100b577c
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x100b9c38
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x100b9c7a
call fcn.100bc3c7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x100b9c7a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x100b9c71
xor eax, eax
jmp 0x100b9c82
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.100b9c88
pop edi
pop esi
pop ebx
ret 4
Function at 0x224940
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x268cb0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x282014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x283074
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.00237f00
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x282a8c
push eax
call fcn.00237f00
mov esi, dword [0x283084]
xor ebx, ebx
mov edi, dword [0x283088]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x2862d0], bl
mov eax, ebx
mov ecx, 0x283074
cmovae ecx, dword [0x283074]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x2863e0], al
inc ebx
cmp ebx, 0x100
jl 0x2249c0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x2862d0]
movzx eax, byte [esi + 0x2863e0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x224a14
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x2862d0]
mov byte [esi + 0x2862d0], al
inc esi
mov byte [edi + 0x2862d0], dl
cmp esi, 0x100
jl 0x2249f0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00224590
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x224a69
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x224a5f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x224abf
push edx
push ecx
call fcn.0023d569
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x224aab
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x224aa1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x224abf
push edx
push ecx
call fcn.0023d569
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00256b7a
int3
Function at 0x227050
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x282014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x5120ecf
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x227239
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x227239
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00254000
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x511034d
nop
test eax, eax
je 0x227239
push 4
push 0x1000
push 4
push 0
call 0x5120bf0
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x511000c
nop
test eax, eax
je 0x227239
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x278d48
push dword [esp + 0x30]
call 0x5130000
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x22715c
push 0x278d4c
push 0x278d64
call 0x51208f6
nop
push eax
call 0x5110114
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x5110247
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0x227239
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x5120df0
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x2271f3
mov dword [esp + 0xc], eax
call fcn.00226ea0
push eax
call 0x51208f0
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x5120df0
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x2271a2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x5120df0
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x5110484
nop
push dword [esp + 0x24]
call 0x51209fd
nop
push 0x8000
push 0
push esi
call 0x5120d20
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.0023cef4
mov esp, ebp
pop ebp
ret

Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x10004000
Capabilities:
Encode data using xor

Disassembly:
invalid
or ah, byte [esi + 0x51]
push ecx
inc edx
and al, 0xf8
imul edi, esi, 0xffffff83
lodsd eax, dword [esi]
mov esp, 0x9ebf04ca
xchg ecx, eax
aam 0x23
mov eax, dword [0x2fc74c7c]
sub al, 0x55
inc esp
mov bl, 0xeb
adc al, 0x8e
in eax, dx
dec edx
inc ebx
xor al, 0xcf
jge 0x10004002
add ebp, dword [esp + ebx*8 - 0x137270f9]
movsd dword es:[edi], dword [esi]
mov dword [0xff85d833], eax
dec esp
in eax, 0x6c
popal
cli
loopne 0x10004051
jle 0x100040b0
jge 0x10004043
stosd dword es:[edi], eax
jmp 0x4003d371
xor byte [ebp + eax*4 + 0x49], cl
fiadd word fs:[ebp + 0x6f]
aad 0xf0
lcall 0x308e, 0xc431c5b6
pop edx
mov edi, dword [edx + 0x1b]
je 0x10003ff4
les ecx, [esi + 0x7a8b5a30]
sbb esi, dword [edx + ebx*4 + 0x51]
push ecx
aad 0x80
insd dword es:[edi], dx
rcl esp, 0x9d
lcall 0xd37f, 0x17140297
inc edi
invalid
inc ebx
sbb dh, ch
invalid

Function at 0x1044a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1044a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1044a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1044a06a
add dl, dl
jne 0x1044a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1044a0dc
xor eax, eax
add dl, dl
jne 0x1044a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1044a17d
add dl, dl
jne 0x1044a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1044a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1044a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1044a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1044a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1044a075
mov eax, 1
add dl, dl
jne 0x1044a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1044a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1044a0e1
sub eax, ebx
mov ebx, 1
jne 0x1044a128
mov ecx, 1
add dl, dl
jne 0x1044a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1044a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1044a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1044a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1044a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1044a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1044a136
cmp eax, 0x7d00
jae 0x1044a16d
cmp eax, 0x500
jb 0x1044a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1044a075
cmp eax, 0x7f
ja 0x1044a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1044a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1044a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1044a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x473000
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x30
nop
mov edi, dword fs:[eax]
mov edi, dword [edi + 0xc]
mov edi, dword [edi + 0x1c]
mov edi, dword [edi]
mov edi, dword [edi + 8]
call 0x473019
pop ebx
sub ebx, 0x401019
mov dword [ebx + 0x4011ed], edi
mov esi, edi
add esi, dword [esi + 0x3c]
mov esi, dword [esi + 0x78]
add esi, edi
push esi
mov ebp, dword [esi + 0x18]
mov esi, dword [esi + 0x20]
add esi, edi
xor edx, edx
push esi
mov edi, dword [esi]
add edi, dword [ebx + 0x4011ed]
lea esi, [ebx + 0x4011c6]
nop
mov ecx, 0xf
repe cmpsb byte [esi], byte es:[edi]
jne 0x47305a
pop esi
mov edx, esi
pop esi
jmp 0x47306b
pop esi
add esi, 4
inc edx
cmp edx, ebp
jb 0x47303b
sub esp, 4
jmp 0x47318e
sub edx, dword [esi + 0x20]
mov eax, dword [ebx + 0x4011ed]
sub edx, eax
shr edx, 1
add edx, dword [esi + 0x24]
add edx, eax
movzx eax, word [edx]
shl eax, 2
add eax, dword [esi + 0x1c]
add eax, dword [ebx + 0x4011ed]
mov eax, dword [eax]
add eax, dword [ebx + 0x4011ed]
mov edi, eax
mov ebp, esp
mov edx, dword [ebx + 0x4011ed]
lea eax, [ebx + 0x4011a1]
push eax
push edx
call edi
sub esp, 0x104
push esp
push 0x104
call eax
lea eax, [ebx + 0x4011bd]
push eax
mov edx, dword [ebx + 0x4011ed]
push edx
call edi
lea ecx, [ebx + 0x401193]
push ecx
mov ecx, esp
add ecx, 4
push ecx
call eax
lea eax, [ebx + 0x4011e1]
push eax
mov edx, dword [ebx + 0x4011ed]
push edx
call edi
mov ecx, esp
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ecx
call eax
mov esi, eax
lea ecx, [ebx + 0x4011f1]
push ecx
push ecx
mov edx, dword [ebx + 0x4011ed]
push edx
call edi
pop ecx
push 0
push ecx
add ecx, 0xa
mov edx, dword [ecx]
push edx
push ecx
mov edx, 0x905a4d
mov dword [ecx], edx
push esi
mov edx, 0x40112c
add edx, ebx
push edx
push eax
ret
jmp fcn.00463b30
Function at 0x473a3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov dword [ebp - 0x14], 1
and dword [ebp - 0x10], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x20], 0
and dword [ebp - 0x44], 0
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
or dword [ebp - 0x18], 0xffffffff
and dword [ebp - 8], 0
mov dword [ebp - 0x40], 0x64616f4c
mov dword [ebp - 0x3c], 0x6f736552
mov dword [ebp - 0x38], 0x65637275
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x40]
push eax
push 0x4082a8
call dword [0x4080dc]
push eax
call dword [0x4080d0]
mov dword [ebp - 8], eax
push 0x4082b8
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call dword [0x4080a4]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push dword [ebp + 0xc]
call dword [0x4080c4]
mov dword [ebp - 4], eax
push dword [ebp - 0x20]
push dword [ebp + 0xc]
call dword [ebp - 8]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x44]
call dword [0x4080d8]
cmp dword [ebp + 0x10], 0x65
jne 0x473ae2
mov dword [ebp - 0x1c], 0xc6f
cmp dword [ebp + 0x10], 0x66
jne 0x473aef
mov dword [ebp - 0x1c], 0x145
push dword [ebp - 4]
call fcn.00479585
pop ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 0x44]
push dword [ebp - 0x10]
call fcn.00479573
add esp, 0xc
push 0
push dword [ebp - 0x1c]
push dword [ebp - 4]
push dword [ebp - 0x10]
call fcn.004735fb
push 0
push dword [ebp + 0x14]
push 2
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [fcn.004080a0]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x473b4c
and dword [ebp - 0x14], 0
jmp 0x473b61
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call dword [fcn.004080bc]
cmp dword [ebp - 0x10], 0
je 0x473b76
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
call fcn.0047957f
pop ecx
cmp dword [ebp - 0x44], 0
je 0x473b85
push dword [ebp - 0x44]
call dword [0x4080a8]
cmp dword [ebp - 0x18], 0xffffffff
je 0x473b94
push dword [ebp - 0x18]
call dword [fcn.004080e8]
mov eax, dword [ebp - 0x14]
leave
ret 0x10
Function at 0x474f06
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
or dword [ebp - 4], 0xffffffff
cmp dword [0x40c930], 0
jne 0x474f93
push 0x400
call fcn.00479585
pop ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x40c930], eax
and dword [ebp - 8], 0
jmp 0x474f3c
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x474f93
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 8
jmp 0x474f5b
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x474f82
mov eax, dword [ebp - 0xc]
and eax, 1
je 0x474f78
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
jmp 0x474f80
mov eax, dword [ebp - 0xc]
shr eax, 1
mov dword [ebp - 0xc], eax
jmp 0x474f54
mov eax, dword [ebp - 8]
mov ecx, dword [0x40c930]
mov edx, dword [ebp - 0xc]
mov dword [ecx + eax*4], edx
jmp 0x474f35
and dword [ebp - 0x14], 0
jmp 0x474fa0
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x474fdc
and dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
movsx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
shr eax, 8
and eax, 0xffffff
mov ecx, dword [ebp - 0x18]
mov edx, dword [0x40c930]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 4], eax
jmp 0x474f99
mov eax, dword [ebp - 4]
not eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x478443
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
or dword [ebp - 0x14], 0xffffffff
and dword [ebp - 0x40], 0
mov dword [ebp - 8], 0x4000
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0
push 0
push 2
call fcn.004795a9
test eax, eax
je 0x47847e
jmp 0x47861f
push dword [ebp - 8]
push 0x40
call dword [0x40804c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x478497
jmp 0x47861f
mov dword [ebp - 0x3c], 0x74654e57
mov dword [ebp - 0x38], 0x6d756e45
mov dword [ebp - 0x34], 0x6f736552
mov dword [ebp - 0x30], 0x65637275
mov dword [ebp - 0x2c], 0x41
lea eax, [ebp - 0x3c]
push eax
push 0x408cf4
call dword [0x4080dc]
push eax
call dword [0x4080d0]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
call fcn.00479579
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x4785f6
and dword [ebp - 0x44], 0
jmp 0x47850e
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x14]
jae 0x4785f4
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 1
je 0x4785ce
or dword [ebp - 0x154], 0xffffffff
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x408cfc
lea eax, [ebp - 0x150]
push eax
call dword [fcn.00408218]
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x150]
push eax
call dword [fcn.004080a0]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffff
je 0x4785ce
push dword [ebp - 0x154]
call dword [fcn.004080e8]
lea eax, [ebp - 0x150]
push eax
call dword [0x4080f0]
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x408950
lea eax, [ebp - 0x150]
push eax
call dword [fcn.00408218]
add esp, 0xc
lea eax, [ebp - 0x150]
push eax
call fcn.00476d5e
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 2
je 0x4785ef
mov eax, dword [ebp - 0x44]
shl eax, 5
add eax, dword [ebp - 0xc]
push eax
call fcn.00478443
jmp 0x478507
jmp 0x478601
cmp dword [ebp - 0x40], 0x103
je 0x478601
jmp 0x47860e
cmp dword [ebp - 0x40], 0x103
jne 0x4784d3
push dword [ebp - 0xc]
call dword [0x408050]
push dword [ebp - 4]
call fcn.004795a3
leave
ret 4
Function at 0x415e70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x41dc80], ecx
add edx, 1
cmp edx, 0x100
jb 0x415e72
cmp edx, 0x800
jae 0x415f5b
mov edi, edi
mov eax, dword [edx*4 + 0x41d880]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x41dc80]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x41dc7c], eax
jb 0x415f30
mov dword [0x41dc54], 0x416610
call fcn.004160a0
test eax, eax
jne 0x415f78
mov dword [0x41dc54], 0x416530
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx