joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402f30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
push 0x4000
push 8
push dword [0x425ba8]
call dword [0x425358]
mov edi, eax
mov dword [ebp - 0x38], edi
test edi, edi
jne 0x402f87
jmp 0x402f60
push 0x80
call dword [0x425428]
push 0x4000
push 8
push dword [0x425ba8]
call dword [0x425358]
mov edi, eax
mov dword [ebp - 0x38], eax
test edi, edi
je 0x402f60
push 0x2000
push 8
push dword [0x425ba8]
call dword [0x425358]
mov esi, eax
test esi, esi
jne 0x402fc4
push 0x80
call dword [0x425428]
push 0x2000
push 8
push dword [0x425ba8]
call dword [0x425358]
mov esi, eax
test esi, esi
je 0x402fa0
mov ebx, dword [0x4259b8]
mov dword [ebp - 8], 0
cmp ebx, 0x4259b8
je 0x4030d3
lea ecx, [ecx]
mov edi, dword [ebx + 0x20]
mov edx, dword [ebx + 8]
add edi, 8
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 4], edx
mov edx, dword [ebx + 0xc]
shrd dword [ebp - 4], edx, 0x14
mov dword [ebp - 0x5c], edi
mov edi, dword [ebp - 0xc]
shrd edi, ecx, 0x14
shr edx, 0x14
shr ecx, 0x14
mov dword [ebp - 0x58], ecx
xor ecx, ecx
mov dword [ebp - 0xc], edx
xor edx, edx
mov dword [ebp - 0x44], 0x490046
mov dword [ebp - 0x40], 0x450058
mov dword [ebp - 0x3c], 0x44
mov dword [ebp - 0x20], 0x450052
mov dword [ebp - 0x1c], 0x4f004d
mov dword [ebp - 0x18], 0x410056
mov dword [ebp - 0x14], 0x4c0042
mov dword [ebp - 0x10], 0x45
mov dword [ebp - 0x52], 0x450052
mov dword [ebp - 0x4e], 0x4f004d
mov dword [ebp - 0x4a], 0x450054
mov word [ebp - 0x46], cx
cmp eax, 3
jne 0x403075
lea edx, [ebp - 0x44]
jmp 0x403087
cmp eax, 2
jne 0x40307f
lea edx, [ebp - 0x20]
jmp 0x403087
cmp eax, 4
jne 0x403087
lea edx, [ebp - 0x52]
lea eax, [ebp - 0x102]
push eax
call fcn.00403170
xor ecx, ecx
xor word [eax + ecx*2], 0x63
inc ecx
cmp ecx, 0x53
jb 0x403095
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp - 0x58]
push edi
push edx
push dword [ebp - 0x5c]
push eax
mov eax, dword [ebp - 8]
lea eax, [esi + eax*2]
push eax
call dword [0x425418]
add dword [ebp - 8], eax
add esp, 0x20
mov ebx, dword [ebx]
cmp ebx, 0x4259b8
jne 0x402fe0
mov edi, dword [ebp - 0x38]
push 0x2c
push esi
call dword [0x425040]
add esp, 8
test eax, eax
je 0x4030e8
xor ecx, ecx
mov word [eax], cx
mov eax, 0x63
mov dword [ebp - 0x32], 0x70041
mov word [ebp - 0xe], ax
xor eax, eax
mov dword [ebp - 0x2e], 0x10000a
mov dword [ebp - 0x2a], 0x100008
mov dword [ebp - 0x26], 0xa003c
mov dword [ebp - 0x22], 0x5000d
mov dword [ebp - 0x1e], 0x41000c
mov dword [ebp - 0x1a], 0x430059
mov dword [ebp - 0x16], 0x460038
mov dword [ebp - 0x12], 0x3e0010
xor word [ebp + eax*2 - 0x32], 0x63
inc eax
cmp eax, 0x13
jb 0x403132
push esi
lea eax, [ebp - 0x32]
push eax
push edi
call dword [0x425418]
add esp, 0xc
push esi
push 0
push dword [0x425ba8]
call dword [0x425290]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4032d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x100
xor eax, eax
mov dword [ebp - 0x24], 0x110033
mov dword [ebp - 0x20], 0x7000c
mov dword [ebp - 0x1c], 0x16
mov dword [ebp - 0x18], 0x2d0017
mov dword [ebp - 0x14], 0xe0002
mov dword [ebp - 0x10], 0x630006
jmp 0x403320
xor word [ebp + eax*2 - 0x24], 0x63
inc eax
cmp eax, 0xc
jb 0x403320
mov eax, 0x63
mov dword [ebp - 0x7e], 0x2c0030
mov word [ebp - 0x26], ax
xor eax, eax
mov dword [ebp - 0x7a], 0x370025
mov dword [ebp - 0x76], 0x220034
mov dword [ebp - 0x72], 0x260031
mov dword [ebp - 0x6e], 0x2e003f
mov dword [ebp - 0x6a], 0xa
mov dword [ebp - 0x66], 0xc0011
mov dword [ebp - 0x62], 0xc0010
mov dword [ebp - 0x5e], 0x170005
mov dword [ebp - 0x5a], 0x34003f
mov dword [ebp - 0x56], 0xd000a
mov dword [ebp - 0x52], 0xc0007
mov dword [ebp - 0x4e], 0x100014
mov dword [ebp - 0x4a], 0x2d0043
mov dword [ebp - 0x46], 0x3f0037
mov dword [ebp - 0x42], 0x160020
mov dword [ebp - 0x3e], 0x110011
mov dword [ebp - 0x3a], 0xd0006
mov dword [ebp - 0x36], 0x350017
mov dword [ebp - 0x32], 0x110006
mov dword [ebp - 0x2e], 0xa0010
mov dword [ebp - 0x2a], 0xd000c
xor word [ebp + eax*2 - 0x7e], 0x63
inc eax
cmp eax, 0x2d
jb 0x4033d1
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x101
push esi
lea eax, [ebp - 0x7e]
push eax
push 0x80000002
call dword [0x425054]
test eax, eax
jne 0x403423
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call dword [0x425228]
test eax, eax
jne 0x40341a
lea esi, [eax + 1]
push dword [ebp - 4]
call dword [0x425378]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403430
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x64], 0x100
xor eax, eax
mov dword [ebp - 0x20], 0x2002e
mov dword [ebp - 0x1c], 0xb0000
mov dword [ebp - 0x18], 0xd000a
mov dword [ebp - 0x14], 0x240006
mov dword [ebp - 0x10], 0xa0016
mov dword [ebp - 0xc], 0x630007
jmp 0x403480
xor word [ebp + eax*2 - 0x20], 0x63
inc eax
cmp eax, 0xc
jb 0x403480
mov dword [ebp - 0x60], 0x2c0030
xor eax, eax
mov dword [ebp - 0x5c], 0x370025
mov dword [ebp - 0x58], 0x220034
mov dword [ebp - 0x54], 0x260031
mov dword [ebp - 0x50], 0x2e003f
mov dword [ebp - 0x4c], 0xa
mov dword [ebp - 0x48], 0xc0011
mov dword [ebp - 0x44], 0xc0010
mov dword [ebp - 0x40], 0x170005
mov dword [ebp - 0x3c], 0x20003f
mov dword [ebp - 0x38], 0x1a0011
mov dword [ebp - 0x34], 0x170013
mov dword [ebp - 0x30], 0x4000c
mov dword [ebp - 0x2c], 0x20011
mov dword [ebp - 0x28], 0xb0013
mov dword [ebp - 0x24], 0x63001a
mov edi, edi
xor word [ebp + eax*2 - 0x60], 0x63
inc eax
cmp eax, 0x20
jb 0x403500
lea eax, [ebp - 4]
push eax
push 0x101
push 0
lea eax, [ebp - 0x60]
push eax
push 0x80000002
call dword [0x425054]
test eax, eax
jne 0x403619
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call dword [0x425228]
push dword [ebp - 4]
test eax, eax
jne 0x403613
call dword [0x425378]
or eax, 0xffffffff
lea edi, [ebp - 0x168]
movzx edx, word [edi]
lea edi, [edi + 2]
lea ecx, [edx - 0x41]
cmp cx, 0x19
ja 0x403578
or edx, 0x20
ror eax, 0xd
movzx ecx, dx
add eax, ecx
test dx, dx
jne 0x403566
lea edi, [ebp - 0x168]
jmp 0x403590
movzx edx, word [edi]
lea edi, [edi + 2]
lea ecx, [edx - 0x41]
cmp cx, 0x19
ja 0x4035a2
or edx, 0x20
ror eax, 0xd
movzx ecx, dx
add eax, ecx
test dx, dx
jne 0x403590
lea edi, [ebp - 0x168]
movzx edx, word [edi]
lea edi, [edi + 2]
lea ecx, [edx - 0x41]
cmp cx, 0x19
ja 0x4035c7
or edx, 0x20
ror eax, 0xd
movzx ecx, dx
add eax, ecx
test dx, dx
jne 0x4035b5
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
bswap eax
push 8
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.00402e10
mov byte [esi + 9], 0
add esp, 4
mov al, byte [esi]
test al, al
je 0x403619
cmp al, 0x2b
je 0x403601
cmp al, 0x2f
je 0x403601
cmp al, 0x3d
jne 0x403604
mov byte [esi], 0x7a
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4035f5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [0x425378]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
push esi
push edi
lea eax, [ebp - 0xe0]
mov dword [ebp - 8], edx
push eax
call fcn.004036f0
mov edi, eax
xor esi, esi
nop
xor word [edi + esi*2], 0x63
inc esi
cmp esi, 0x64
jb 0x403640
xor esi, esi
push esi
push esi
push esi
push esi
push ecx
call dword [0x425044]
mov ebx, eax
test ebx, ebx
je 0x4036e5
push esi
push esi
push 3
push esi
push esi
push 0x63af
push dword [ebp - 8]
push ebx
call dword [0x425350]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4036de
xor ecx, ecx
mov dword [ebp - 0x12], 0x4f0050
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
mov word [ebp - 0xa], cx
lea ecx, [ebp - 0x12]
push ecx
push eax
mov dword [ebp - 0xe], 0x540053
call dword [0x42540c]
mov dword [ebp - 8], eax
test eax, eax
je 0x4036d5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [0x4252e0]
push eax
push edi
mov edi, dword [ebp - 8]
push edi
call dword [0x4251bc]
test eax, eax
je 0x4036ce
mov esi, 1
push edi
call dword [0x42539c]
push dword [ebp - 0x18]
call dword [0x42539c]
push ebx
call dword [0x42539c]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404d50
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov dword [edi + 0x200], 0x61707865
mov dword [edi + 0x204], 0x3320646e
mov dword [edi + 0x208], 0x79622d32
mov dword [edi + 0x20c], 0x6b206574
movzx esi, byte [edx + 3]
movzx eax, byte [edx + 2]
shl esi, 8
or esi, eax
movzx eax, byte [edx + 1]
shl esi, 8
or esi, eax
movzx eax, byte [edx]
shl esi, 8
or esi, eax
mov dword [edi + 0x210], esi
movzx ecx, byte [edx + 7]
shl ecx, 8
movzx eax, byte [edx + 6]
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x214], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x218], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x21c], ecx
movzx ecx, byte [edx + 0x13]
movzx eax, byte [edx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x220], ecx
movzx ecx, byte [edx + 0x17]
movzx eax, byte [edx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x224], ecx
movzx ecx, byte [edx + 0x1b]
movzx eax, byte [edx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x19]
shl ecx, 8
or ecx, eax
shl ecx, 8
movzx eax, byte [edx + 0x18]
or ecx, eax
mov dword [edi + 0x228], ecx
movzx ecx, byte [edx + 0x1f]
movzx eax, byte [edx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1c]
mov edx, dword [ebp + 8]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x230], 0
mov dword [edi + 0x22c], ecx
mov dword [edi + 0x234], 0
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x238], ecx
movzx ecx, byte [edx + 7]
movzx eax, byte [edx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x240], 0x200
mov dword [edi + 0x23c], ecx
pop edi
pop esi
pop ebp
ret
Function at 0x40b4b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov edx, dword [ebp + 8]
mov ecx, 8
push edi
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov al, byte [ebp - 5]
lea ecx, [ebp - 0x164]
and byte [ebp - 0x24], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 5], al
call fcn.004095d0
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x204]
call fcn.0040a480
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x1b4]
call fcn.0040a780
lea eax, [ebp - 0x1b4]
push eax
lea edx, [ebp - 0x204]
lea ecx, [ebp - 0x114]
call fcn.00408bb0
add esp, 0xc
lea ecx, [ebp - 0x114]
call fcn.00409080
lea ecx, [ebp - 0x114]
call fcn.00409160
push 0x50
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [0x425270]
add esp, 0xc
lea edx, [ebp - 0x7c]
mov ecx, ebx
call fcn.004098c0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b980
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
cmp dword [0x4256f0], 0
push ebx
push esi
push edi
je 0x40baea
cmp dword [ebp + 8], 0
mov esi, dword [0x425004]
je 0x40b9ab
mov esi, dword [section..data]
cmp esi, 0xffffffff
je 0x40baea
xor eax, eax
mov dword [ebp - 0xa], 0xa000d
push 0x42597c
mov word [ebp - 6], ax
call dword [0x42506c]
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push 0x7fff
push dword [0x425994]
call dword [0x4252b8]
add esp, 0x10
mov edi, eax
lea eax, [ebp - 0x50]
push eax
call dword [0x4251dc]
mov eax, 0x21
mov dword [ebp - 0x40], 0x4007a
mov word [ebp - 0xc], ax
xor eax, eax
mov dword [ebp - 0x3c], 0x540049
mov dword [ebp - 0x38], 0x4000c
mov dword [ebp - 0x34], 0x540049
mov dword [ebp - 0x30], 0x4000c
mov dword [ebp - 0x2c], 0x540049
mov dword [ebp - 0x28], 0x40001
mov dword [ebp - 0x24], 0x540049
mov dword [ebp - 0x20], 0x4001b
mov dword [ebp - 0x1c], 0x540049
mov dword [ebp - 0x18], 0x4001b
mov dword [ebp - 0x14], 0x540049
mov dword [ebp - 0x10], 0x1007c
lea esp, [esp]
xor word [ebp + eax*2 - 0x40], 0x21
inc eax
cmp eax, 0x1b
jb 0x40ba60
movzx eax, word [ebp - 0x44]
push eax
movzx eax, word [ebp - 0x46]
push eax
movzx eax, word [ebp - 0x48]
push eax
movzx eax, word [ebp - 0x4a]
push eax
movzx eax, word [ebp - 0x4e]
push eax
movzx eax, word [ebp - 0x50]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xd0]
push eax
call dword [0x4250b4]
add esp, 0x20
lea ecx, [ebp - 4]
add eax, eax
push 0
push ecx
push eax
lea eax, [ebp - 0xd0]
push eax
push esi
call dword [0x425204]
push 0
lea eax, [ebp - 4]
push eax
lea eax, [edi + edi]
push eax
push dword [0x425994]
push esi
call dword [0x425204]
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0xa]
push eax
push esi
call dword [0x425204]
push 0x42597c
call dword [0x425280]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c400
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x644
cmp dword [0x4256e8], 0
push ebx
push esi
push edi
je 0x40c5dc
cmp dword [0x42543c], 0
jne 0x40c5dc
lea eax, [ebp - 0x240]
push eax
push 0
push 0
push 0x23
push 0
call dword [0x425078]
lea eax, [ebp - 0x240]
push eax
call dword [0x4252ec]
push 0x4255a0
lea eax, [ebp - 0x240]
push eax
call dword [0x425410]
mov eax, dword [0x425940]
cmp eax, 2
jne 0x40c4c0
mov dword [ebp - 0x24], 0x6f0023
xor eax, eax
mov dword [ebp - 0x20], 0x2e002c
mov dword [ebp - 0x1c], 0x7f0029
mov dword [ebp - 0x18], 0x2c002e
mov dword [ebp - 0x14], 0x5f0023
mov dword [ebp - 0x10], 0x590044
mov dword [ebp - 0xc], 0x480058
mov dword [ebp - 8], 0x5b0043
mov dword [ebp - 4], 0xc0042
xor word [ebp + eax*2 - 0x24], 0xc
inc eax
cmp eax, 0x12
jb 0x40c4a5
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x24]
jmp 0x40c53e
cmp eax, 1
jne 0x40c518
mov dword [ebp - 0x20], 0x6f0023
xor eax, eax
mov dword [ebp - 0x1c], 0x2e002c
mov dword [ebp - 0x18], 0x7f0029
mov dword [ebp - 0x14], 0x2c002e
mov dword [ebp - 0x10], 0x5e0023
mov dword [ebp - 0xc], 0x4e0049
mov dword [ebp - 8], 0x430043
mov dword [ebp - 4], 0xc0058
nop
xor word [ebp + eax*2 - 0x20], 0xc
inc eax
cmp eax, 0x10
jb 0x40c500
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x20]
jmp 0x40c53e
lea eax, [ebp - 0x240]
mov dword [ebp - 0x34], 0x63002f
push eax
mov dword [ebp - 0x30], 0x220020
lea eax, [ebp - 0x34]
mov dword [ebp - 0x2c], 0x730025
mov dword [ebp - 0x28], 0x22
push eax
lea eax, [ebp - 0x640]
push eax
call dword [0x4250b4]
add esp, 0xc
lea eax, [ebp - 0x240]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push eax
call dword [0x4250bc]
mov esi, eax
cmp esi, 0xffffffff
je 0x40c593
push 0
lea eax, [ebp - 0x38]
push eax
push 0x1400
push 0x41a1b0
push esi
call dword [0x425204]
push esi
call dword [0x4251e0]
xor eax, eax
mov dword [ebp - 0x10], 0x6d0063
push eax
push eax
mov word [ebp - 0x26], ax
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0x2e0064
push eax
lea eax, [ebp - 0x2e]
mov dword [ebp - 8], 0x780065
push eax
push 0
mov dword [ebp - 4], 0x65
mov dword [ebp - 0x2e], 0x70006f
mov dword [ebp - 0x2a], 0x6e0065
call dword [0x42532c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40cfe0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8a4
cmp dword [0x425834], 0
push ebx
push esi
push edi
je 0x40d185
cmp dword [0x42543c], 0
jne 0x40d185
push 0x104
lea eax, [ebp - 0x2a0]
push eax
push 0
call dword [0x425084]
cmp dword [0x4256e8], 0
jne 0x40d087
mov eax, dword [0x425940]
cmp eax, 2
jne 0x40d057
lea eax, [ebp - 0x96]
push eax
call fcn.0040d190
xor ecx, ecx
jmp 0x40d040
xor word [eax + ecx*2], 0xc
inc ecx
cmp ecx, 0x3e
jb 0x40d040
lea ecx, [ebp - 0x2a0]
push ecx
jmp 0x40d12b
cmp eax, 1
jne 0x40d087
lea eax, [ebp - 0x96]
push eax
call fcn.0040d280
xor ecx, ecx
lea ebx, [ebx]
xor word [eax + ecx*2], 0xc
inc ecx
cmp ecx, 0x3e
jb 0x40d070
lea ecx, [ebp - 0x2a0]
push ecx
jmp 0x40d12b
mov dword [ebp - 0x6a], 0x6f0023
xor eax, eax
mov dword [ebp - 0x66], 0x7c002c
mov dword [ebp - 0x62], 0x620065
mov dword [ebp - 0x5e], 0x2c006b
mov dword [ebp - 0x5a], 0x3e003d
mov dword [ebp - 0x56], 0x22003b
mov dword [ebp - 0x52], 0x22003c
mov dword [ebp - 0x4e], 0x22003c
mov dword [ebp - 0x4a], 0x2c003d
mov dword [ebp - 0x46], 0x620021
mov dword [ebp - 0x42], 0x39002c
mov dword [ebp - 0x3e], 0x32002c
mov dword [ebp - 0x3a], 0x62002c
mov dword [ebp - 0x36], 0x600079
mov dword [ebp - 0x32], 0x2a002c
mov dword [ebp - 0x2e], 0x68002c
mov dword [ebp - 0x2a], 0x600069
mov dword [ebp - 0x26], 0x2e002c
mov dword [ebp - 0x22], 0x7f0029
mov dword [ebp - 0x1e], 0xc002e
xor word [ebp + eax*2 - 0x6a], 0xc
inc eax
cmp eax, 0x28
jb 0x40d115
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x6a]
push eax
lea eax, [ebp - 0x8a0]
push eax
call dword [0x4250b4]
add esp, 0xc
mov dword [ebp - 0x1a], 0x6d0063
xor eax, eax
mov dword [ebp - 0x16], 0x2e0064
mov word [ebp - 2], ax
mov dword [ebp - 0x12], 0x780065
push eax
push eax
lea eax, [ebp - 0x8a0]
mov dword [ebp - 0xe], 0x65
push eax
lea eax, [ebp - 0x1a]
mov dword [ebp - 0xa], 0x70006f
push eax
lea eax, [ebp - 0xa]
mov dword [ebp - 6], 0x6e0065
push eax
push 0
call dword [0x42532c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40da30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
cmp dword [0x42543c], 0
jne 0x40dbd7
cmp dword [0x425450], 0
je 0x40dbd7
push ebx
push esi
push edi
lea eax, [ebp - 0x25c]
push eax
push 0
push 0
push 0x23
push 0
call dword [0x425078]
lea eax, [ebp - 0x25c]
push eax
call dword [0x4252ec]
push 0x425470
lea eax, [ebp - 0x25c]
push eax
call dword [0x425410]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x54], 0
push eax
call dword [0x4250bc]
mov esi, eax
cmp esi, 0xffffffff
je 0x40dad5
push 0
lea eax, [ebp - 0x54]
push eax
push 0x86be
push 0x41b5b0
push esi
call dword [0x425204]
push esi
call dword [0x4251e0]
pop edi
pop esi
mov dword [ebp - 0x50], 0x43005f
xor eax, eax
mov dword [ebp - 0x4c], 0x58004a
mov dword [ebp - 0x48], 0x4d005b
mov dword [ebp - 0x44], 0x49005e
mov dword [ebp - 0x40], 0x4f0050
mov dword [ebp - 0x3c], 0x6d0060
mov dword [ebp - 0x38], 0x7f007f
mov dword [ebp - 0x34], 0x7f0069
mov dword [ebp - 0x30], 0x220050
mov dword [ebp - 0x2c], 0x75005f
mov dword [ebp - 0x28], 0x6d0062
mov dword [ebp - 0x24], 0x7f007c
mov dword [ebp - 0x20], 0x500069
mov dword [ebp - 0x1c], 0x690048
mov dword [ebp - 0x18], 0x6d006a
mov dword [ebp - 0x14], 0x600079
mov dword [ebp - 0x10], 0x450078
mov dword [ebp - 0xc], 0x63006f
mov dword [ebp - 8], 0xc0062
pop ebx
nop
xor word [ebp + eax*2 - 0x50], 0xc
inc eax
cmp eax, 0x26
jb 0x40db60
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x2011f
push 0
push 0
push 0
lea eax, [ebp - 0x50]
push eax
push 0x80000002
call dword [0x42518c]
test eax, eax
jne 0x40dbc6
lea eax, [ebp - 0x25c]
push eax
call dword [0x4252e0]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x25c]
push eax
push 1
push 0
push 0
push dword [ebp - 4]
call dword [0x425098]
push dword [ebp - 4]
call dword [0x425378]
push 0
push 0
push 0
push 0x8000000
call dword [0x42534c]
mov esp, ebp
pop ebp
ret
Function at 0x40dbe0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f4
cmp dword [0x42543c], 0
push ebx
push esi
push edi
jne 0x40ddd1
cmp dword [0x425464], 0
je 0x40ddd1
lea eax, [ebp - 0xbe]
push eax
call fcn.0040dde0
xor ecx, ecx
xor word [eax + ecx*2], 0xc
inc ecx
cmp ecx, 0x36
jb 0x40dc14
lea ecx, [ebp - 0x2c]
push ecx
push 0x20106
push 0
push eax
push 0x80000002
call dword [0x425054]
test eax, eax
jne 0x40ddd1
mov eax, 0xc
mov dword [ebp - 0x26], 0x75005f
mov word [ebp - 2], ax
xor eax, eax
mov dword [ebp - 0x22], 0x6d0062
mov dword [ebp - 0x1e], 0x7f007c
mov dword [ebp - 0x1a], 0x2c0069
mov dword [ebp - 0x16], 0x6d005e
mov dword [ebp - 0x12], 0x7f0062
mov dword [ebp - 0xe], 0x610063
mov dword [ebp - 0xa], 0x6d007b
mov dword [ebp - 6], 0x69007e
jmp 0x40dc90
xor word [ebp + eax*2 - 0x26], 0xc
inc eax
cmp eax, 0x13
jb 0x40dc90
lea eax, [ebp - 0xf0]
push eax
call fcn.0040deb0
xor ecx, ecx
lea ebx, [ebx]
xor word [eax + ecx*2], 0xc
inc ecx
cmp ecx, 0x4f
jb 0x40dcb0
push 0x425840
push eax
lea eax, [ebp - 0x1f0]
push eax
call dword [0x4250b4]
mov ebx, 0xc
mov dword [ebp - 0x52], 0x690040
add esp, 0xc
mov dword [ebp - 0x4e], 0x6d006b
mov dword [ebp - 0x4a], 0x420060
xor eax, eax
mov dword [ebp - 0x46], 0x780063
mov dword [ebp - 0x42], 0x6f0065
mov dword [ebp - 0x3e], 0x4f0069
mov dword [ebp - 0x3a], 0x7c006d
mov dword [ebp - 0x36], 0x650078
mov dword [ebp - 0x32], 0x620063
mov word [ebp - 0x2e], bx
jmp 0x40dd20
xor word [ebp + eax*2 - 0x52], bx
inc eax
cmp eax, 0x13
jb 0x40dd20
lea eax, [ebp - 0x26]
push eax
call dword [0x4252e0]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x26]
push eax
push 1
push 0
lea eax, [ebp - 0x52]
push eax
push dword [ebp - 0x2c]
call dword [0x425098]
mov dword [ebp - 0x20], 0x690040
xor eax, eax
mov dword [ebp - 0x1c], 0x6d006b
mov dword [ebp - 0x18], 0x420060
mov dword [ebp - 0x14], 0x780063
mov dword [ebp - 0x10], 0x6f0065
mov dword [ebp - 0xc], 0x580069
mov dword [ebp - 8], 0x740069
mov dword [ebp - 4], 0xc0078
lea esp, [esp]
xor word [ebp + eax*2 - 0x20], bx
inc eax
cmp eax, 0x10
jb 0x40dd90
lea eax, [ebp - 0x1f0]
push eax
call dword [0x4252e0]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x1f0]
push eax
push 1
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x2c]
call dword [0x425098]
push dword [ebp - 0x2c]
call dword [0x425378]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret