joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30807f83
Capabilities:
Create directory

Disassembly:
push 0x88
mov eax, 0x3081ac6d
call fcn.3081997e
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0x10]
push str.__
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x8c], eax
call fcn.3080c670
push esi
push eax
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.3080c670
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.3080c670
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x30807fe2
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
push 0x5c
pop esi
cmp word [eax + ecx*2 - 2], si
je 0x30807ffa
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.3080c670
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x94], esi
or edi, 0xffffffff
mov ecx, dword [ebp - 0x90]
push 1
push dword [ebp - 0x88]
lea eax, [ebp - 0x94]
push eax
call fcn.3080c670
mov ecx, dword [ebp - 0x90]
mov esi, eax
cmp esi, edi
je 0x30808078
sub eax, dword [ebp - 0x88]
push eax
push dword [ebp - 0x88]
lea eax, [ebp - 0x48]
push eax
call fcn.3080c670
push edi
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.3080c670
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.3080c670
push 0x5c
push 1
lea ecx, [ebp - 0x2c]
call fcn.3080c670
inc esi
mov dword [ebp - 0x88], esi
jmp 0x308080ac
push edi
push dword [ebp - 0x88]
lea eax, [ebp - 0x48]
push eax
call fcn.3080c670
push edi
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.3080c670
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.3080c670
mov dword [ebp - 0x88], edi
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x308080b8
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
setne byte [ebp - 0x81]
cmp byte [ebp - 0x81], bl
je 0x308080f5
push edi
push 4
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.3080c670
mov ecx, dword [ebp - 0x8c]
push eax
mov byte [ebp - 4], 5
call fcn.3080c670
lea ecx, [ebp - 0x48]
jmp 0x30808153
mov eax, dword [ebp - 0x8c]
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], ebx
jb 0x30808106
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp - 0x88], edi
jne 0x30808009
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
sete byte [ebp - 0x81]
cmp byte [ebp - 0x81], bl
je 0x3080816b
push edi
push 4
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2c]
call fcn.3080c670
mov ecx, dword [ebp - 0x8c]
push eax
mov byte [ebp - 4], 6
call fcn.3080c670
lea ecx, [ebp - 0x64]
push ebx
push 1
mov byte [ebp - 4], 2
call fcn.3080c670
cmp dword [ebp - 0x88], edi
jne 0x30808009
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.3080c670
mov al, byte [ebp - 0x81]
call fcn.308199b4
ret
Function at 0x30808ae4
Capabilities:
Enumerate process modules

Disassembly:
push 0x20
mov eax, 0x3081ae31
call fcn.30801ee1
push dword [ebp + 8]
xor edi, edi
push edi
push 0x410
mov dword [ebp - 0x14], edi
call dword [sym.imp.kernel32.dll_OpenProcess]
mov ebx, eax
cmp ebx, edi
je 0x30808b87
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], edi
call sub.psapi.dll_EnumProcessModules
test eax, eax
je 0x30808b87
push 0x20
pop esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
push edi
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.3080c670
push esi
push dword [ebp - 0x2c]
push dword [ebp - 0x10]
push ebx
call sub.psapi.dll_GetModuleBaseNameA
cmp eax, esi
jb 0x30808b62
push edi
add esi, esi
push esi
lea ecx, [ebp - 0x2c]
call fcn.3080c670
cmp esi, 0x208
jbe 0x30808b3d
push dword [ebp - 0x2c]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll__mbsstr]
pop ecx
pop ecx
test eax, eax
je 0x30808b7b
mov dword [ebp - 0x14], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.30806a0c
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
call fcn.30801fc6
ret

Function at 0x30808c2f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x138
mov eax, 0x3081ae8b
call fcn.3081997e
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x138], edi
cmp ebx, edi
je 0x30808d1c
lea eax, [ebp - 0x134]
push eax
call fcn.30808b97
pop ecx
cmp dword [ebp - 0x120], 0x10
mov eax, dword [ebp - 0x134]
mov dword [ebp - 4], edi
jae 0x30808c76
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x13c]
push ecx
push 1
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x30808d0a
mov esi, 0x105
push esi
lea eax, [ebp - 0x118]
push edi
push eax
mov dword [ebp - 0x140], 0x104
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x144]
push eax
push edi
push ebx
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x30808cfe
mov eax, dword [0x30825cd8]
push esi
call dword [eax + 4]
pop ecx
mov dword [ebp - 0x138], eax
cmp eax, edi
je 0x30808cfe
push esi
lea ecx, [ebp - 0x118]
push ecx
push esi
push eax
call dword [sym.imp.MSVCR100.dll_strncpy_s]
add esp, 0x10
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x134]
call fcn.3080c670
mov eax, dword [ebp - 0x138]
call fcn.308199b4
ret
Function at 0x30809222
Capabilities:
Enumerate process modules

Disassembly:
push 0x24
mov eax, 0x3081af3b
call fcn.30801ee1
xor ebx, ebx
push 8
pop esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
push ebx
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
call fcn.3080c670
push 0x20
pop edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 1
mov byte [ebp - 0xd], 1
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 0x30]
call sub.psapi.dll_EnumProcesses
test eax, eax
je 0x3080928c
mov eax, dword [ebp - 0x18]
cmp eax, edi
jb 0x30809285
push ebx
add esi, esi
push esi
lea ecx, [ebp - 0x30]
call fcn.3080c670
mov edi, esi
shl edi, 2
jmp 0x30809294
shr eax, 2
mov esi, eax
jmp 0x30809291
xor esi, esi
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
jne 0x3080925a
cmp dword [ebp - 0x14], ebx
je 0x308092c8
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.3080c670
cmp esi, ebx
jbe 0x308092c8
mov ebx, dword [ebp - 0x30]
push ebx
mov ecx, edi
call fcn.3080c670
add ebx, 4
dec esi
jne 0x308092ba
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.30806a0c
mov eax, dword [ebp - 0x14]
call fcn.30801fc6
ret

Function at 0x3080c670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x3080c67f
pop dword [ebp - 0x20]
mov eax, 0x7f036f93
sub eax, 0x4e82a914
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xc3f3a812
add dword [ebp - 0x30], 0x8a5e9d39
mov dword [ebp - 0x2c], 0x5a4f300e
add dword [ebp - 0x2c], 0xd7e41c37
mov dword [ebp - 0x28], 0x8df9f7f6
sub dword [ebp - 0x28], 0x41adb3c8
mov dword [ebp - 0x24], 0xf92f8772
add dword [ebp - 0x24], 0x6d0788e
lea eax, [ebp - 0x30]
push eax
mov eax, 0x558e10c9
sub eax, 0x250c4075
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xa2ec95f1
sub dword [ebp - 0x30], 0x2e7a2c9b
mov dword [ebp - 0x2c], 0x2bce5592
add dword [ebp - 0x2c], 0x159e0be3
mov dword [ebp - 0x28], 0x84bdde6f
add dword [ebp - 0x28], 0xdeb18dfd
mov dword [ebp - 0x24], 0x5f3c3c5c
add dword [ebp - 0x24], 0xa0c3c3a4
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x235a6f5
sub eax, 0xd1b3d639
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3a04e
push 0
call eax
mov ecx, 0x43524ec0
sub ecx, 0x435212ed
mov edi, eax
mov ebx, 0x69dce721
add ebx, 0xc6a60adf
add ebx, dword [ebp - 0x20]
mov esi, 0x51c9a7a9
sub esi, 0x23426cca
xor dword [ebp - 8], 0xa3f1c012
mov edx, dword [ebx]
mov dword [ebp - 4], 0xb9b9eb36
add edx, esi
mov dword [ebp - 0x1c], 0x1a794e7c
mov dword [edi], edx
sub dword [ebp - 0x14], edx
add edi, 0x19f8a6c8
add edi, 0xe607593c
add ebx, 4
loop 0x3080c7a1
add eax, 0xe21f
xor ebx, ebx
add ebx, eax
add eax, 0xe3d2c450
sub eax, 0xe3d2c44b
mov ecx, 0xdc6f2d7a
sub ecx, 0xabef2d7a
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x1c29660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x1c29710
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
call fcn.01cbc2ea
mov ecx, eax
call dword [section..00cfg]
mov dword [esi + 8], 1
call ecx
push 2
call fcn.01cafef4
add esp, 4
push eax
push 1
push 0x28
push str.terminate_handler_unexpectedly_returned_n
call fcn.01cc16ad
add esp, 0x10
call fcn.01cbd630
push ebp
sub esp, 0x10
add ebp, 0xc
call fcn.01cacce1
push ebp
sub esp, 0x10
add ebp, 0xc
mov dword [ebp - 0x1c], esp
push 2
call fcn.01cafef4
add esp, 4
push eax
push 1
push 0x32
push str.terminate_handler_unexpectedly_threw_an_exception_n
call fcn.01cc16ad
add esp, 0x10
call fcn.01cbd630

Function at 0x1c296e6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x1c29710
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
call fcn.01cbc2ea
mov ecx, eax
call dword [section..00cfg]
mov dword [esi + 8], 1
call ecx
push 2
call fcn.01cafef4
add esp, 4
push eax
push 1
push 0x28
push str.terminate_handler_unexpectedly_returned_n
call fcn.01cc16ad
add esp, 0x10
call fcn.01cbd630
push ebp
sub esp, 0x10
add ebp, 0xc
call fcn.01cacce1
push ebp
sub esp, 0x10
add ebp, 0xc
mov dword [ebp - 0x1c], esp
push 2
call fcn.01cafef4
add esp, 4
push eax
push 1
push 0x32
push str.terminate_handler_unexpectedly_threw_an_exception_n
call fcn.01cc16ad
add esp, 0x10
call fcn.01cbd630

Function at 0x1c2d1a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x20], ecx
mov eax, dword [0x1cf151c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
xor eax, eax
dec eax
mov dword [ecx - 4], eax
mov dword [ecx - 8], eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0xffffffff
mov ebx, dword [edi + 0x24]
mov eax, dword [edi + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [section..00cfg]
mov ecx, ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x24]
call esi
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.01cc16ad
add esp, 0x10
cmp eax, esi
jne 0x1c2d237
cmp ebx, 1
je 0x1c2d1c5
cmp ebx, 2
mov esi, 0xffffffff
je 0x1c2d23a
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.01cc118b
add esp, 4
xor esi, esi
neg eax
sbb esi, esi
jmp 0x1c2d23a
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01caaec1
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c513d6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x1c521b6
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.01c4ff94
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x1c51430
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x1c51479
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x1c51423
call fcn.01c50023
jae 0x1c514b8
fucom st(6)
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
invalid
pop ss
dec dword [ecx - 0x3a]
test esp, ebx
clc
invalid
Function at 0x50871be5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x50871bf4
pop dword [ebp - 0x14]
mov eax, 0xe06d5238
sub eax, 0x8fe63644
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x943709f9
add dword [ebp - 0x24], 0xba1b3b52
mov dword [ebp - 0x20], 0xf5ee6c38
sub dword [ebp - 0x20], 0xc3bb1ff3
mov dword [ebp - 0x1c], 0x3410c69b
add dword [ebp - 0x1c], 0x183b7d93
mov dword [ebp - 0x18], 0x37ee240e
add dword [ebp - 0x18], 0xc811dbf2
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x66988fe3
sub dword [ebp - 0x24], 0xf226268d
mov dword [ebp - 0x20], 0x9ddbdffa
sub dword [ebp - 0x20], 0x5c6f7e85
mov dword [ebp - 0x1c], 0x25467247
add dword [ebp - 0x1c], 0x3e28fa25
mov dword [ebp - 0x18], 0xe507d262
add dword [ebp - 0x18], 0x1af82d9e
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xeeff979
add eax, 0x419716ef
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x35106
push 0
call eax
mov ecx, 0x40eb
mov ebx, eax
mov esi, 0x252e9706
add esi, 0x2b58f8fa
add esi, dword [ebp - 0x14]
mov edx, 0x6fadf7a0
add dword [ebp - 8], 0x5cae9e9b
mov edi, dword [esi]
add dword [ebp - 8], 0xa1298ce1
xor edi, edx
mov dword [ebp - 8], 0x5b276b61
mov dword [ebx], edi
xor dword [ebp - 8], eax
add ebx, 0x792dce05
sub ebx, 0x792dce01
add esi, 4
loop 0x50871d05
add eax, 0xd9d1267a
add eax, 0x262fd005
mov ebx, eax
add eax, 5
mov ecx, 0x34937584
sub ecx, 0xe40c7584
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x50872f7f
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x50872f8a
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x5087472e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
mov esi, ecx
call fcn.50874717
and byte [esi + 0xc], 0
mov eax, 0x50870000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [esi], 0x3c
call sub.MSVCR70.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x50874788
cmp dword [ebp - 0x18], 5
jb 0x508747a0
jmp 0x5087479c
cmp dword [ebp - 0xc], 1
jne 0x508747a0
cmp dword [ebp - 0x18], 4
ja 0x5087479c
jne 0x508747a0
cmp dword [ebp - 0x14], 0
jbe 0x508747a0
mov byte [esi + 0xc], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x50875050
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x4095e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x409630
cmp esi, edi
ja 0x409698
cmp edi, dword [esp + 0x1c]
ja 0x4096a6
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x409632
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x409620
jmp 0x40968f
ja 0x409638
cmp eax, edx
mov esi, edi
jne 0x4095f3
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x409670
mov ebp, esi
sub ecx, edx
jns 0x409687
jmp 0x409691
cmp esi, edi
je 0x4096b6
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x409691
xor al, 1
cmp ebp, edi
jne 0x409650
jmp 0x409691
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x495d28
call fcn.0048d5c0
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x495d28
call fcn.0048d3b0
mov ecx, 0x495d18
call fcn.0048d740

Function at 0x40a160
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov eax, dword [ebp + 0x14]
mov ebx, ecx
mov esi, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x20]
mov edi, edx
mov edx, dword [ebp + 8]
mov byte [esp + 0x24], 0x30
mov dword [esp + 0x20], 0x30303030
mov dword [esp + 0x1c], 0x30303030
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], ecx
call fcn.0040a1b0
Function at 0x40e585
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, ecx
xor edx, edx
mov esi, 0x16
mov edi, 0x16
shl eax, 0xb
nop word cs:[eax + eax]
nop
shr esi, 1
add esi, edx
mov ebx, dword [esi*4 + 0x499068]
shl ebx, 0xb
cmp ebx, eax
je 0x40e4d5
cmp ebx, eax
lea ebp, [esi + 1]
cmova edi, esi
cmovb edx, ebp
mov esi, edi
sub esi, edx
ja 0x40e4b0
jmp 0x40e4d8
inc esi
mov edx, esi
cmp edx, 0x15
ja 0x40e574
mov eax, dword [edx*4 + 0x499068]
shr eax, 0x15
cmp edx, 0x15
jne 0x40e4fc
mov edx, 0x14
mov esi, 0x13b
jmp 0x40e50b
mov esi, dword [edx*4 + 0x49906c]
shr esi, 0x15
test edx, edx
je 0x40e55f
dec edx
mov edi, 0x1fffff
and edi, dword [edx*4 + 0x499068]
mov edx, eax
not edx
add edx, esi
je 0x40e558
sub ecx, edi
cmp eax, 0x13c
mov edx, 0x13b
cmovae edx, eax
dec esi
xor edi, edi
nop word cs:[eax + eax]
nop dword [eax + eax]
cmp edx, eax
je 0x40e563
movzx ebx, byte [eax + 0x4990c0]
add edi, ebx
cmp edi, ecx
ja 0x40e558
inc eax
cmp esi, eax
jne 0x40e540
mov eax, esi
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x40e517
mov ecx, edx
mov edx, 0x13b
push 0x4962ec
call fcn.0048d350
mov ecx, edx
mov edx, 0x16
push 0x4962dc
call fcn.0048d350
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x18]
not ecx
cmp ebx, 0x40
jb 0x40e69e
add edx, 0x10
xor edi, edi
mov ebp, ebx
cmp ebp, 0xf
jbe 0x40e6cb
mov dword [esp], ebp
movzx eax, byte [edx - 1]
movzx ebp, byte [edx - 2]
mov ebp, dword [ebp*4 + 0x49c788]
xor ebp, dword [eax*4 + 0x49c388]
movzx eax, byte [edx - 3]
xor ebp, dword [eax*4 + 0x49cb88]
movzx eax, byte [edx - 4]
xor ebp, dword [eax*4 + 0x49cf88]
movzx eax, byte [edx - 5]
xor ebp, dword [eax*4 + 0x49d388]
movzx eax, byte [edx - 6]
xor ebp, dword [eax*4 + 0x49d788]
movzx eax, byte [edx - 7]
xor ebp, dword [eax*4 + 0x49db88]
movzx eax, byte [edx - 8]
xor ebp, dword [eax*4 + 0x49df88]
movzx eax, byte [edx - 9]
xor ebp, dword [eax*4 + 0x49e388]
movzx eax, byte [edx - 0xa]
xor ebp, dword [eax*4 + 0x49e788]
movzx eax, byte [edx - 0xb]
xor ebp, dword [eax*4 + 0x49eb88]
movzx eax, byte [edx - 0xc]
xor ebp, dword [eax*4 + 0x49ef88]
movzx eax, byte [edx - 0xd]
mov esi, ecx
shr ecx, 0x18
xor ecx, eax
xor ebp, dword [ecx*4 + 0x49f388]
movzx eax, byte [edx - 0xe]
mov ecx, esi
shr ecx, 0x10
mov ebx, 0xff
and ecx, ebx
xor ecx, eax
xor ebp, dword [ecx*4 + 0x49f788]
movzx eax, byte [edx - 0xf]
mov ecx, esi
shr ecx, 8
and ecx, ebx
xor ecx, eax
xor ebp, dword [ecx*4 + 0x49fb88]
movzx eax, byte [edx - 0x10]
and esi, ebx
xor esi, eax
mov ebx, dword [esp]
inc edi
xor ebp, dword [esi*4 + 0x49ff88]
mov ecx, ebp
lea ebp, [ebx - 0x10]
cmp edi, 4
jne 0x40e693
xor edi, edi
cmp ebp, 0x3f
jbe 0x40e69b
add edx, 0x10
jmp 0x40e5a0
add ebx, 0xfffffff0
test ebx, ebx
je 0x40e6bf
xor esi, esi
mov eax, ebx
mov bl, byte [edx + esi]
xor bl, cl
movzx edi, bl
mov ebx, eax
shr ecx, 8
xor ecx, dword [edi*4 + 0x49c388]
inc esi
cmp eax, esi
jne 0x40e6a4
not ecx
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp + 0x18]
and edx, 0xf
mov ecx, 0xf
push 0x49c378
call fcn.0048d350
Function at 0x40e6e1
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov esi, ecx
mov edi, dword [esp + 0xc]
add dword [ecx + 8], edi
adc dword [ecx + 0xc], 0
cmp dword [ecx], 0
je 0x40e8b1
mov ecx, dword [esi + 4]
cmp edi, 0x80
jb 0x40e8b4
movdqu xmm4, xmmword [edx]
movdqu xmm3, xmmword [edx + 0x10]
movdqu xmm2, xmmword [edx + 0x20]
movdqu xmm1, xmmword [edx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add edx, 0x40
add edi, 0xffffffc0
movdqa xmm4, xmmword [0x4934a0]
movdqa xmm5, xmmword [0x4934b0]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [edx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [edx + 0x10]
movdqa xmm7, xmm3
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm7
movdqu xmm6, xmmword [edx + 0x20]
movdqa xmm7, xmm2
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm7
movdqu xmm6, xmmword [edx + 0x30]
movdqa xmm7, xmm1
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm7
add edx, 0x40
add edi, 0xffffffc0
cmp edi, 0x3f
ja 0x40e73b
movdqa xmm4, xmmword [0x4934c0]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x4934d0]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp edi, 0x10
jb 0x40e845
movdqu xmm1, xmmword [edx]
add edi, 0xfffffff0
add edx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp edi, 0xf
ja 0x40e81e
movdqa xmm1, xmmword [0x4934d0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
movss xmm2, xmm0
pclmulqdq xmm2, xmmword [0x4934e0], 0
psrldq xmm0, 4
pxor xmm0, xmm2
pxor xmm2, xmm2
movss xmm2, xmm0
pclmulqdq xmm2, xmmword [0x4934f0], 0x10
pblendw xmm2, xmm1, 0xfc
pclmulqdq xmm2, xmmword [0x493500], 0
pxor xmm2, xmm0
pextrd eax, xmm2, 1
not eax
test edi, edi
je 0x40e8bd
mov ecx, eax
jmp 0x40e8b4
mov ecx, dword [esi + 4]
push edi
call 0x40e585
add esp, 4
mov dword [esi + 4], eax
pop esi
pop edi
ret