joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404c60
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x28]
mov eax, 0xffffffff
test ebp, ebp
je 0x404dab
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x404dab
cmp dword [esp + 0x30], 0
je 0x404dab
push edi
call fcn.0040c520
add esp, 4
mov dword [esp], eax
mov ebx, 0x1505
test eax, eax
je 0x404cce
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edi + eax]
test ecx, ecx
je 0x404cce
mov edx, ebx
shl edx, 5
add edx, ebx
mov esi, edx
and esi, ecx
xor edx, ecx
lea ebx, [edx + esi*2]
inc eax
cmp dword [esp], eax
jne 0x404cb0
mov esi, dword [ebp + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x404d31
mov ebp, 0xffffffff
mov esi, dword [esp + 0x28]
mov eax, dword [esi + 0x18]
cmp eax, dword [esi + 0x1c]
jae 0x404d95
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x18]
mov edx, dword [esp + 0x2c]
mov dword [eax + ecx*4], edx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [esi + 0x10]
mov edx, dword [esp + 0x30]
mov dword [eax + ecx*4], edx
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x18]
mov dword [eax + ecx*4], ebx
inc dword [esi + 0x18]
mov eax, dword [esi]
mov dword [edx], eax
xor eax, eax
jmp 0x404dab
and edi, ebx
mov eax, dword [ebp + 4]
mov dword [esp + 4], eax
jmp 0x404d44
inc edi
dec esi
je 0x404cdf
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404ce4
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + 8]
cmp dword [ecx + eax*4], ebx
jne 0x404d40
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040c520
add esp, 4
cmp eax, dword [esp]
jne 0x404d40
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040c540
add esp, 0xc
test eax, eax
jne 0x404d40
mov eax, 0xffffffff
jmp 0x404dab
mov ecx, esi
call fcn.00405970
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x2c]
je 0x404db3
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push ecx
call fcn.0040c520
add esp, 4
mov dword [esp + 0xc], eax
mov edx, dword [esi + 0x20]
lea edi, [edx - 1]
mov eax, edx
sub eax, 1
mov dword [esp + 8], eax
jae 0x404ddb
mov ebp, 0xffffffff
jmp 0x404cf4
and edi, ebx
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
jmp 0x404df4
inc edi
dec edx
je 0x404e54
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404e59
mov esi, dword [esp + 0x28]
mov ecx, dword [esi + 8]
cmp dword [ecx + eax*4], ebx
jne 0x404df0
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x10], eax
push eax
mov dword [esp + 4], edx
call fcn.0040c520
mov edx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0xc]
jne 0x404df0
push dword [esp + 0xc]
push dword [esp + 0x14]
push dword [esp + 0x34]
call fcn.0040c540
mov edx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x404df0
jmp 0x404cf4
mov ebp, 0xffffffff
mov esi, dword [esp + 0x28]
jmp 0x404cf4
Function at 0x4056d0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x4058b3
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x4058b3
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x4058b3
cmp dword [ecx], 0
jne 0x4058b3
push edi
call fcn.0040c520
add esp, 4
mov ebp, 0x1505
test eax, eax
je 0x40573d
xor ebx, ebx
nop
nop
nop
nop
movzx ecx, byte [edi + ebx]
test ecx, ecx
je 0x40573d
mov edx, ebp
shl edx, 5
add edx, ebp
mov esi, edx
and esi, ecx
xor edx, ecx
lea ebp, [edx + esi*2]
inc ebx
cmp eax, ebx
jne 0x405720
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x28]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0xc], eax
mov dword [esp], ebp
jae 0x40581f
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
jb 0x4057ad
mov ecx, dword [esp + 0x28]
call fcn.00405970
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x4058b3
push ebx
call fcn.0040c520
add esp, 4
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov edx, ebx
push esi
push dword [esp + 4]
push eax
call fcn.004058c0
add esp, 0xc
mov ebp, eax
push ebx
call fcn.0040c520
add esp, 4
mov esi, ebx
mov ebx, eax
inc eax
push eax
call dword [0x450008]
add esp, 4
test eax, eax
je 0x4058ae
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c440
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov dword [eax + ecx*4], edi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov esi, dword [esp]
mov dword [eax + ecx*4], esi
mov ecx, edx
inc dword [edx + 0x18]
mov eax, dword [ecx]
mov dword [edi], eax
xor eax, eax
jmp 0x4058b3
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405838
inc ebx
dec esi
je 0x40575d
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov edi, dword [eax + ebp*4]
cmp edi, 0xffffffff
je 0x405762
mov eax, dword [ecx + 8]
mov edx, dword [esp]
cmp dword [eax + edi*4], edx
jne 0x405830
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + edi*4]
push ebp
call fcn.0040c520
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x405830
push dword [esp + 4]
push ebp
push dword [esp + 0x34]
call fcn.0040c540
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405830
mov eax, dword [ecx + 0x10]
push dword [eax + edi*4]
call fcn.00404800
mov ecx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [ecx + 0x10]
mov edx, dword [esp + 0x30]
mov dword [eax + edi*4], edx
mov edi, edx
jmp 0x405814
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406940
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x406ae6
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406adf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x4069d0
add ebp, dword [esp + 0x10]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov ebx, 0x15b0
je 0x406adf
mov dword [esp + 4], esi
xor edx, edx
cmp ebx, 8
mov dword [esp], ebx
jb 0x406a44
xor eax, eax
movzx edx, byte [ebp]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + 3]
add esi, edx
mov edx, ecx
and edx, esi
xor ecx, esi
movzx edi, byte [ebp + 4]
add edi, esi
movzx esi, byte [ebp + 5]
add esi, edi
add edi, ecx
movzx ebx, byte [ebp + 6]
add ebx, esi
lea ecx, [edi + edx*2]
movzx edi, byte [ebp + 7]
add edi, ebx
add ecx, esi
add ecx, ebx
mov ebx, dword [esp]
add ecx, edi
mov esi, eax
and esi, 8
xor eax, 8
lea edx, [eax + esi*2]
add ebp, 8
lea esi, [eax + esi*2]
add esi, 7
mov eax, edx
cmp esi, ebx
jb 0x4069e0
mov eax, edx
sub eax, ebx
jae 0x406994
sub ebx, edx
mov dword [esp + 0x10], ebx
and ebx, 3
mov dword [esp + 8], ebx
je 0x406a90
mov dword [esp + 0xc], eax
neg dword [esp + 8]
xor esi, esi
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec esi
cmp dword [esp + 8], esi
jne 0x406a70
sub edx, esi
mov eax, dword [esp + 0xc]
cmp eax, 0xfffffffc
ja 0x406990
jmp 0x406a9b
mov ebx, ebp
cmp eax, 0xfffffffc
ja 0x406990
mov eax, dword [esp]
sub eax, edx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x406ab0
jmp 0x406990
shl ecx, 0x10
or ecx, edi
jmp 0x406aeb
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406b00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x406b5c
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test edx, edx
je 0x406b5e
not eax
xor esi, esi
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44dc50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
mov edi, dword [edi*4 + 0x44dc50]
mov ebx, eax
and ebx, edi
add eax, edi
add ebx, ebx
sub eax, ebx
inc esi
cmp edx, esi
jne 0x406b20
not eax
jmp 0x406b5e
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x40c2f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x40c35c
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x40c33e
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x40c340
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 0xfffffffd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x40c320
jmp 0x40c340
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40c35a
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40c35c
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cb20
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00445850
test al, al
je 0x40cd1e
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043cf30
test al, al
je 0x40cd19
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0xb2fb4c4f
mov dword [esp + 8], 0x665c9a62
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40cba6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040cd30
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40cb80
mov dword [esp + 4], 0x2eb74d0d
mov dword [esp + 8], 0xd8b76a33
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40cc06
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040cdb0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40cbe0
test esi, esi
je 0x40ccb6
mov dword [esp], 0x17161939
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x40cc59
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax]
push dword [esp + 4]
push eax
call fcn.0040ce30
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x40cc30
mov dword [esp + 4], 0x89e77dd3
mov dword [esp + 8], 0x23582c6a
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40ccb6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040ced0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40cc90
mov dword [esp + 4], 0x42434041
mov dword [esp + 8], 0x46474445
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40cd06
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040cf60
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40cce0
call fcn.0040e570
test al, al
je 0x40cd19
call fcn.00412080
call fcn.0040fd70
call fcn.00446ad0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d1d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push edi
push esi
sub esp, 0x54
mov esi, ecx
mov edi, dword [esp + 0x64]
add edi, dword [ecx + 0x60]
mov word [esp + 4], 0x7b7d
mov byte [esp + 6], 0x62
mov dword [esp + 7], 0
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
cmp eax, 6
ja 0x40d23b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x14]
movzx eax, byte [esp + eax + 4]
push dword [esp + 0x14]
push eax
call fcn.0040df10
add esp, 8
mov ecx, dword [esp + 0x14]
mov byte [esp + ecx + 4], al
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, 7
jb 0x40d210
mov dword [esp + 0xc], 0x22202c06
mov dword [esp + 0x10], 0x3522
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
cmp eax, 7
ja 0x40d28b
nop
nop
nop
nop
mov eax, dword [esp + 0x14]
movzx eax, byte [esp + eax + 0xc]
push dword [esp + 0x14]
push eax
call fcn.0040de80
add esp, 8
mov ecx, dword [esp + 0x14]
mov byte [esp + ecx + 0xc], al
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, 8
jb 0x40d260
mov dword [esp + 0x14], 0x56ace0e3
mov dword [esp + 0x18], 0x52562428
mov dword [esp + 0x1c], 0x5d665c23
mov dword [esp + 0x20], 0x5a515e69
mov dword [esp + 0x24], 0x32596d6e
mov dword [esp + 0x28], 0x7427e9ef
mov dword [esp + 0x2c], 0x4741734a
mov dword [esp + 0x30], 0x462e047c
mov dword [esp + 0x34], 0x447f7f79
mov dword [esp + 0x38], 0x4479477b
mov dword [esp + 0x3c], 0x7f360d7a
mov dword [esp + 0x40], 0x32754949
mov dword [esp + 0x44], 0x624a7c78
mov dword [esp + 0x48], 0x666c231d
mov dword [esp + 0x4c], 0x2b19606b
mov byte [esp + 0x50], 0xc8
mov word [esp + 0x51], 0
mov byte [esp + 0x53], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x3f
ja 0x40d356
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x14]
push dword [esp]
push eax
call fcn.0040de10
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x40
jb 0x40d330
mov ecx, dword [esp + 0x68]
movzx edx, byte [esp + 0x14]
mov eax, edi
test dl, dl
je 0x40d37b
lea ebx, [esp + 0x15]
mov eax, edi
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40d370
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40d39b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40d390
mov ecx, dword [esp + 0x6c]
mov byte [eax], 0
movzx edx, byte [esp + 0xc]
test dl, dl
je 0x40d3bb
lea ebx, [esp + 0xd]
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40d3b0
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40d3db
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40d3d0
mov byte [eax], 0
movzx ecx, byte [esp + 4]
test cl, cl
je 0x40d3fb
lea edx, [esp + 5]
nop
nop
nop
nop
nop
mov byte [eax], cl
inc eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x40d3f0
mov byte [eax], 0
sub eax, edi
add dword [esi + 0x60], eax
add esp, 0x54
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x41dc50
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa48
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + ecx], 0
lea ecx, [ecx + 2]
jne 0x41dc70
lea edx, [eax + ecx]
add edx, 0xfffffffe
mov esi, eax
not esi
and esi, edx
add ecx, eax
mov edx, 1
sub edx, ecx
and edx, eax
sub esi, edx
sar esi, 1
lea ecx, [esp + 0x40]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x4571a0]
mov ebx, dword [esp + 0x40]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41dcbc
mov eax, 0xffffffff
jmp 0x41dcbf
lea eax, [ebx + ebx]
push eax
call fcn.0040c410
add esp, 4
lea ecx, [esp + 0x40]
push ecx
push ebx
mov ebx, eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x4571a0]
mov eax, dword [esp + 0x40]
mov ecx, eax
add ecx, 0xd
js 0x41dcf2
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c410
add esp, 4
mov esi, eax
mov dword [esp + 0x158], 0x9fd299c4
mov dword [esp + 0x15c], 0xa3d59dfd
mov dword [esp + 0x160], 0xa786a1d4
mov dword [esp + 0x164], 0xabcfa5fe
mov dword [esp + 0x168], 0xafd9a9de
mov dword [esp + 0x16c], 0xb3c1adc5
mov dword [esp + 0x170], 0xb7b6b1c2
mov dword [esp + 0x6b8], 0
mov eax, dword [esp + 0x6b8]
cmp eax, 0x1b
ja 0x41ddb0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x6b8]
movzx eax, byte [esp + eax + 0x158]
push dword [esp + 0x6b8]
push eax
call fcn.00422c50
add esp, 8
mov ecx, dword [esp + 0x6b8]
mov byte [esp + ecx + 0x158], al
inc dword [esp + 0x6b8]
mov eax, dword [esp + 0x6b8]
cmp eax, 0x1c
jb 0x41dd70
movzx ecx, word [ebx]
mov eax, esi
test cx, cx
je 0x41ddd1
lea edx, [ebx + 2]
mov eax, esi
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ddc0
mov word [eax], 0
movzx ecx, word [esp + 0x158]
test cx, cx
mov dword [esp + 0x18], ebx
je 0x41de01
lea edx, [esp + 0x15a]
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ddf0
mov word [eax], 0
lea eax, [esp + 0x598]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0044a7a0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x451f6c]

Function at 0x420dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov edx, dword [esp + 0x60]
xor eax, eax
test edx, edx
setne al
xor ebp, ebp
mov dword [esp + 0x40], 0
xor ecx, ecx
jmp dword [eax*4 + 0x45211c]
Function at 0x424d70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0x74]
mov edi, dword [esp + 0x70]
mov ecx, dword [ebx + 4]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx], 0
lea edx, [edx + 2]
jne 0x424d90
lea esi, [ecx + edx]
add esi, 0xfffffffe
mov eax, ecx
not eax
and eax, esi
add edx, ecx
mov esi, 1
sub esi, edx
and esi, ecx
sub eax, esi
cmp eax, 0xffffffdd
jge 0x424dbf
mov eax, 0xffffffff
jmp 0x424dc2
add eax, 0x22
push eax
call fcn.0040c410
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0x99e79bf8
mov dword [esp + 0x1c], 0xa5d7a7e4
mov dword [esp + 0x20], 0xa1cda3da
mov dword [esp + 0x24], 0xadc5afc9
mov dword [esp + 0x28], 0xa9c6abc8
mov dword [esp + 0x2c], 0xb5dcb7c3
mov dword [esp + 0x30], 0xb1c9b3db
mov dword [esp + 0x34], 0xbdc2bfc4
mov word [esp + 0x38], 0xbbbc
mov dword [esp + 0x3a], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x25
ja 0x424e5b
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.00425e80
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x26
jb 0x424e30
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x424e81
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x424e70
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x424eb1
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424ea0
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x33a531a5
mov dword [esp + 0x1c], 0x2ffb2da6
mov dword [esp + 0x20], 0x2ba229b5
mov dword [esp + 0x24], 0x27bb25a8
mov dword [esp + 0x28], 0x23b121b6
mov dword [esp + 0x2c], 0x1f891d85
mov dword [esp + 0x30], 0x1bc1198e
mov dword [esp + 0x34], 0x17cd15cf
mov dword [esp + 0x38], 0x13b411ca
mov dword [esp + 0x3c], 0xf9d0d81
mov dword [esp + 0x40], 0xb980995
mov dword [esp + 0x44], 0x79105c7
mov dword [esp + 0x48], 0x38e0196
mov dword [esp + 0x4c], 0xff76fd61
mov dword [esp + 0x50], 0xfb43f974
mov dword [esp + 0x54], 0xf733f568
mov dword [esp + 0x58], 0xf3f2f12a
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x43
ja 0x424f96
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.00425f10
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x44
jb 0x424f70
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x425450
push ecx
push esi
call fcn.00426260
add esp, 0x10
jmp dword [0x4523e8]
Function at 0x428c20
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x70
mov esi, dword [0x4571a0]
mov dword [esp + 0x10], 0x99ce9bb7
mov dword [esp + 0x14], 0xa5cba7e9
mov dword [esp + 0x18], 0xa1d6a3cb
mov dword [esp + 0x1c], 0xaddeafef
mov dword [esp + 0x20], 0xa9e6abdc
mov dword [esp + 0x24], 0xb5cab7c7
mov dword [esp + 0x28], 0xb199b3db
mov dword [esp + 0x2c], 0xbfb0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x1f
ja 0x428ca6
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x10]
push dword [esp]
push eax
call fcn.0042b500
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x20
jb 0x428c80
lea edi, [esp + 0x64]
lea eax, [esp + 0x10]
push edi
push 0
push 0
push 0xe
push eax
push 0
call esi
mov ebx, dword [esp + 0x64]
test ebx, ebx
jns 0x428cc9
mov eax, 0xffffffff
jmp 0x428ccc
lea eax, [ebx + ebx]
push eax
call fcn.0040c410
add esp, 4
mov esi, eax
mov ebp, dword [0x4571a0]
mov dword [esp + 0x10], 0x23de2105
mov dword [esp + 0x14], 0x27c525bb
mov dword [esp + 0x18], 0xdb46d939
mov dword [esp + 0x1c], 0xdf4edd1d
mov dword [esp + 0x20], 0xd316d140
mov dword [esp + 0x24], 0xd742d535
mov dword [esp + 0x28], 0xcbefc929
mov word [esp + 0x2c], 0xcdcc
mov dword [esp + 0x2e], 0
mov byte [esp + 0x32], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x22
ja 0x428d66
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x10]
push dword [esp]
push eax
call fcn.0042b580
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x23
jb 0x428d40
push edi
push ebx
push esi
push 0xe
lea eax, [esp + 0x20]
push eax
push 0
call ebp
mov eax, dword [esp + 0x64]
mov ecx, eax
add ecx, 9
jns 0x428d86
mov eax, 0xffffffff
jmp 0x428d8d
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040c410
add esp, 4
mov edi, eax
mov dword [esp + 0x10], 0x9fce99c4
mov dword [esp + 0x14], 0xa3c59dfd
mov dword [esp + 0x18], 0xa7c7a1cf
mov dword [esp + 0x1c], 0xabcfa5cf
mov dword [esp + 0x20], 0xafaea9df
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x13
ja 0x428df6
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x10]
push dword [esp]
push eax
call fcn.0042b610
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x14
jb 0x428dd0
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x428e21
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428e10
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x428e51
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428e40
mov ebp, dword [esp + 0x84]
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.0044a960
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x452ab0]