joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x407f9b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x407fa3
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x40803b
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x407fe9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x40804a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x407ffe
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x408010
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x407fd0
jmp 0x408019
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x407fd0
cmp edi, ebx
jge 0x408030
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x407fd4
jmp 0x408034
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x407fdd
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x4080d2
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x4080d2
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x408084
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x408070
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x4080d2
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x408090
dec eax
mov ecx, 1
xor esi, esi
jmp 0x4080ec
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x407f9b
test edx, edx
mov dword [esp], ecx
js 0x408120
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x408130
inc ebp
dec edx
cmp edi, ebp
jne 0x408100
mov edx, 0xffffffff
jmp 0x408132
xor edi, edi
jmp 0x408135
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x4080e0
and ebp, 3
je 0x408168
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x408150
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x40816a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x4080e0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x408180
jmp 0x4080e0
Function at 0x4089b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, dword [esp + 8]
mov dword [0x442150], edx
mov eax, 0xfffffd92
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x6c078965
mov esi, ecx
or ecx, 0x6c078965
imul ecx, edx
xor edx, 0x6c078965
and esi, 0x93f8769a
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x26f
mov dword [eax*4 + 0x442b0c], edx
test eax, eax
je 0x408a3f
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
mov edx, ecx
and edx, 0x6c078965
mov esi, ecx
or ecx, 0x6c078965
imul ecx, edx
xor edx, 0x6c078965
and esi, 0x93f8769a
imul esi, edx
add ecx, esi
lea edx, [eax + ecx]
add edx, 0x270
mov dword [eax*4 + 0x442b10], edx
add eax, 2
jmp 0x4089c0
mov dword [0x44214c], 0x270
pop esi
ret

Function at 0x408a90
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
call fcn.00436e00
test al, al
je 0x408bd0
call fcn.00430500
test al, al
je 0x408bcb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edi, 0x728603e0
mov esi, 0x15a11629
shrd esi, edi, cl
shr edi, cl
test cl, 0x20
je 0x408adb
mov esi, edi
xor edi, edi
xor esi, 0x15a11629
xor edi, 0x728603e0
mov ecx, 0xea64c41a
mov eax, esi
mul ecx
imul esi, esi, 0xd9566a
imul ecx, edi, 0xea64c41a
add ecx, edx
add ecx, esi
mov esi, ecx
shld esi, eax, 0xb
mov edi, ecx
shr edi, 0x15
mov edx, edi
and edx, ecx
mov ebx, esi
and ebx, eax
add esi, eax
adc edi, ecx
shld edx, ebx, 1
add ebx, ebx
sub esi, ebx
sbb edi, edx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x408ba7
mov ebp, esi
or ebp, 0x6992d852
mov ecx, edi
or ecx, 0x208ee243
mov eax, esi
xor eax, 0x966d27ad
mov ebx, edi
xor ebx, 0xdf711dbc
and ebx, ecx
and eax, ebp
imul ecx, eax
mul ebp
mov dword [esp], eax
add edx, ecx
imul ebx, ebp
mov eax, esi
not eax
add ebx, edx
mov ebp, edi
and esi, 0x966d27ad
and edi, 0xdf711dbc
and eax, 0x6992d852
imul edi, eax
mul esi
add edx, edi
not ebp
and ebp, 0x208ee243
imul ebp, esi
add ebp, edx
add eax, dword [esp]
adc ebp, ebx
mov esi, eax
mov ecx, dword [esp + 4]
shrd esi, ebp, cl
mov edi, ebp
shr edi, cl
test cl, 0x20
je 0x408ba3
mov esi, edi
xor edi, edi
xor edi, ebp
xor esi, eax
or edi, 0x1010101
or esi, 0x1010101
push edi
push esi
call fcn.00409dd0
add esp, 8
test al, al
je 0x408bcb
call fcn.0040c810
call fcn.0040b6a0
call fcn.00437220
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x408be0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x408c47
mov edx, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and edx, 0x80000000
mov esi, dword [ecx + eax + 0x9c8]
mov edi, esi
not edi
or edi, 0x7fffffff
add edi, esi
inc edi
or edx, edi
shr edx, 1
and edi, 1
neg edi
and edi, 0x9908b0df
xor edx, dword [ecx + eax + 0xff8]
xor edx, edi
mov dword [ecx + eax + 0x1384], edx
mov edx, esi
add eax, 4
jne 0x408c00
mov eax, 0x270
jmp 0x408c59
cmp eax, 0x4e0
jb 0x408c59
mov esi, ecx
call fcn.00408ca0
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov edx, dword [ecx + eax*4 + 4]
mov eax, edx
shr eax, 0xb
and eax, dword [ecx + 0x1384]
mov ecx, eax
and ecx, edx
add eax, edx
add ecx, ecx
sub eax, ecx
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
xor ecx, eax
mov edx, ecx
shl edx, 0xf
and edx, 0xefc60000
xor edx, ecx
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
pop edi
ret

Function at 0x408ca0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
mov esi, dword [ecx + eax*4 - 0x630]
mov edi, esi
not edi
or edi, 0x7fffffff
add edi, esi
inc edi
and edx, 0x80000000
or edx, edi
and edi, 1
neg edi
and edi, 0x9908b0df
shr edx, 1
xor edx, edi
mov edi, dword [ecx + eax*4]
mov ebx, edx
and ebx, edi
add edx, edi
add ebx, ebx
sub edx, ebx
mov dword [ecx + eax*4 - 0xff4], edx
inc eax
mov edx, esi
cmp eax, 0x4e1
jne 0x408cb0
mov ebx, dword [ecx + 0xd50]
mov eax, 0xe4
mov edx, 0x1c6
nop
nop
nop
nop
nop
nop
nop
lea esi, [eax - 1]
and ebx, 0x80000000
mov ebp, dword [ecx + eax*4 + 0x9c4]
mov edi, ebp
and edi, 0x7ffffffe
or edi, ebx
shr edi, 1
mov ebx, ebp
and ebp, 1
neg ebp
and ebp, 0x9908b0df
xor ebp, edi
xor esi, 0x3ffffd8f
mov edi, edx
and edi, 0x31e
add edi, esi
mov esi, dword [ecx + edi*4 + 0x63c]
mov edi, ebp
and edi, esi
add ebp, esi
add edi, edi
sub ebp, edi
mov dword [ecx + eax*4], ebp
inc eax
add edx, 2
cmp eax, 0x270
jne 0x408d10
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
and eax, 1
neg eax
and eax, 0x9908b0df
mov esi, eax
and esi, edx
add eax, edx
add esi, esi
sub eax, esi
xor eax, dword [ecx + 0x634]
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx eax, word [esi]
lea ebp, [esp + 4]
test ax, ax
je 0x409095
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx ebx, ax
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x408fa0
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x409040
cmp ebx, 0x7ff
ja 0x408fd0
cmp edx, 2
jb 0x408fd0
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
lea eax, [ebp + 2]
jmp 0x409040
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x40905a
cmp edx, 4
jb 0x40905a
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
add ebx, ecx
add ebx, 0xfca02400
mov eax, ebx
shr eax, 0x12
mov edi, ebx
shr edi, 0x11
and edi, 0xe0
xor eax, 0xf0
add eax, edi
mov byte [ebp], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 2], bl
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx eax, word [esi]
test ax, ax
je 0x409095
test edx, edx
jne 0x408f80
jmp 0x409095
movzx eax, ax
cmp eax, 0xdc00
jne 0x409068
mov esi, edi
jmp 0x409048
cmp edx, 3
jb 0x409091
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x409040
mov eax, ebp
jmp 0x409040
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ebp], 0
xor eax, eax
jmp 0x4090b8
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x4090b0
test ecx, ecx
je 0x4090cc
mov ebx, ecx
jmp 0x4090b0
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00404b90
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x409110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx ecx, word [esi]
test cx, cx
je 0x409255
mov edx, dword [esp + 0x18]
dec edx
je 0x409255
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, cx
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x409160
lea eax, [ebp + 1]
mov byte [ebp], bl
jmp 0x409200
cmp ebx, 0x7ff
ja 0x409190
cmp edx, 2
jb 0x409190
mov eax, ebx
shr eax, 6
add al, 0xc0
mov byte [ebp], al
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 1], bl
lea eax, [ebp + 2]
jmp 0x409200
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x40921a
cmp edx, 4
jb 0x40921a
movzx ecx, word [esi + 2]
add esi, 4
shl ebx, 0xa
add ebx, ecx
add ebx, 0xfca02400
mov eax, ebx
shr eax, 0x12
mov edi, ebx
shr edi, 0x11
and edi, 0xe0
xor eax, 0xf0
add eax, edi
mov byte [ebp], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 2], bl
and cl, 0x3f
or cl, 0x80
lea eax, [ebp + 4]
mov byte [ebp + 3], cl
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edx, ebp
sub edx, eax
mov esi, edi
mov ebp, eax
movzx ecx, word [esi]
test cx, cx
je 0x409255
test edx, edx
jne 0x409140
jmp 0x409255
movzx eax, ax
cmp eax, 0xdc00
jne 0x409228
mov esi, edi
jmp 0x409208
cmp edx, 3
jb 0x409251
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov byte [ebp], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
and bl, 0x3f
or bl, 0x80
lea eax, [ebp + 3]
mov byte [ebp + 2], bl
jmp 0x409200
mov eax, ebp
jmp 0x409200
mov byte [ebp], 0
sub ebp, dword [esp + 0x14]
mov eax, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409dd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
push eax
sub esp, 0x3c
mov dword [ebp - 0x1c], esp
sub esp, 0x80
mov dword [ebp - 0x24], esp
mov eax, dword [0x44352c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1b4], 0xa232a038
mov dword [ebp - 0x1b0], 0xa60aa4f1
mov dword [ebp - 0x1ac], 0x9acb98f4
mov dword [ebp - 0x1a8], 0x9e399cc5
mov dword [ebp - 0x1a4], 0x920d9003
mov word [ebp - 0x1a0], 0x9493
mov ecx, 0x3b116e17
mov edx, 0xe8
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ebp + ecx - 0x3b116fcb]
mov esi, edi
not esi
mov ebx, edx
or ebx, esi
lea eax, [edi + ebx]
add edi, ebx
inc edi
and esi, ecx
mov ebx, esi
not ebx
and ebx, edi
xor esi, edi
add eax, esi
inc eax
sub eax, ebx
add al, 0x48
mov byte [ebp + ecx - 0x3b116fcb], al
inc ecx
dec edx
cmp ecx, 0x3b116e2d
jne 0x409e40
lea esi, [ebp - 0x1b4]
push 0x800
push 0
push esi
call dword [ebp - 0x14]
mov ecx, 0x443530
push eax
call fcn.00436dc0
movzx eax, al
mov eax, dword [eax*4 + 0x43d6cc]
mov ecx, 0xf645e524
xor ecx, dword [0x43d6d4]
add eax, ecx
inc eax
jmp eax

Function at 0x40afc0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x443508]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40b06e
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x43d9fc]
xor eax, eax
jmp 0x40b694
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b6d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov ebp, dword [esp + 0x44c]
mov dword [esp + 0x38], 0xa907a7eb
mov dword [esp + 0x3c], 0xad05ab30
mov dword [esp + 0x40], 0x913caf02
mov dword [esp + 0x44], 0x95fb9333
mov dword [esp + 0x48], 0x99f697c3
mov dword [esp + 0x4c], 0x9dfc9bca
mov dword [esp + 0x50], 0x81379ff6
mov dword [esp + 0x54], 0x852a832b
mov dword [esp + 0x58], 0x89278722
mov dword [esp + 0x5c], 0x8d1f8b1d
mov dword [esp + 0x60], 0xf1be8fee
mov dword [esp + 0x64], 0xf594f346
mov dword [esp + 0x68], 0xf9a8f7a7
mov dword [esp + 0x6c], 0xfdacfb94
mov dword [esp + 0x70], 0xe180ffa5
mov dword [esp + 0x74], 0xe54de355
mov dword [esp + 0x78], 0xe9bee748
mov dword [esp + 0x7c], 0xedb7ebbe
mov dword [esp + 0x80], 0xd148ef8e
mov dword [esp + 0x84], 0xd580d384
mov dword [esp + 0x88], 0xd9b8d7bf
mov dword [esp + 0x8c], 0xdd4cdb9b
mov dword [esp + 0x90], 0xc16cdf4e
mov dword [esp + 0x94], 0xc573c367
mov dword [esp + 0x98], 0xc96ac763
mov dword [esp + 0x9c], 0xcd65cb81
mov dword [esp + 0xa0], 0x315fcf5a
mov dword [esp + 0xa4], 0x35673367
mov dword [esp + 0xa8], 0x39563761
mov dword [esp + 0xac], 0x3d6a3b69
mov dword [esp + 0xb0], 0x21483f5e
mov dword [esp + 0xb4], 0x256c2369
mov dword [esp + 0xb8], 0x29652792
mov dword [esp + 0xbc], 0x2d402b66
mov dword [esp + 0xc0], 0x11bc2f4e
mov dword [esp + 0xc4], 0x15bf13bb
mov dword [esp + 0xc8], 0x197817b3
mov dword [esp + 0xcc], 0x1db91b5d
mov dword [esp + 0xd0], 0x1ab1fbd
mov dword [esp + 0xd4], 0x56d03ad
mov dword [esp + 0xd8], 0x94b0766
mov dword [esp + 0xdc], 0xd9e0ba2
mov dword [esp + 0xe0], 0x71dd0fa1
mov dword [esp + 0xe4], 0x751b73d7
mov dword [esp + 0xe8], 0x79297727
mov dword [esp + 0xec], 0x7d127b23
mov dword [esp + 0xf0], 0x610e7f2e
mov dword [esp + 0xf4], 0x650a6332
mov dword [esp + 0xf8], 0x69086736
mov dword [esp + 0xfc], 0x6dcd6bd9
mov dword [esp + 0x100], 0x51f16fc8
mov dword [esp + 0x104], 0x55fd53c0
mov dword [esp + 0x108], 0x590d5739
mov dword [esp + 0x10c], 0x5d0b5b09
mov dword [esp + 0x110], 0x41135f30
mov dword [esp + 0x114], 0x45444314
mov eax, dword [0x4434fc]
mov ecx, 0xd3fd
mov edx, 0xffff2c02
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0xd3c5]
mov edi, edx
and edi, 0xbefa0be7
mov ebx, ecx
and ebx, 0xc418
sub ebx, edi
mov edi, ebx
and edi, esi
add ebx, esi
add edi, edi
sub ebx, edi
add bl, 0x50
mov byte [esp + ecx - 0xd3c5], bl
inc ecx
dec edx
cmp ecx, 0xd4dd
jne 0x40b930
lea edi, [esp + 0x38]
push 0
push 0
push 0
push 0
push edi
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x43dab4]
mov ecx, 0x2b76a7a
xor ecx, dword [0x43dabc]
add eax, ecx
inc eax
jmp eax
Function at 0x40bf50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x23c
push eax
mov dword [ebp - 0x48], esp
mov eax, dword [0x4434fc]
mov dword [ebp - 0x248], 0x40f04e10
mov dword [ebp - 0x244], 0x44fa42cb
mov dword [ebp - 0x240], 0x58fb46f9
mov dword [ebp - 0x23c], 0x5c245af8
mov dword [ebp - 0x238], 0x50215e28
mov dword [ebp - 0x234], 0x54335221
mov dword [ebp - 0x230], 0xa800562d
mov dword [ebp - 0x22c], 0xac15aa10
mov dword [ebp - 0x228], 0xa010ae09
mov dword [ebp - 0x224], 0xa410a216
mov dword [ebp - 0x220], 0xb8f9a6c5
mov dword [ebp - 0x21c], 0xbcdbbaed
mov dword [ebp - 0x218], 0xb0cfbecc
mov dword [ebp - 0x214], 0xb4c3b2cf
mov dword [ebp - 0x210], 0x88d7b6fe
mov dword [ebp - 0x20c], 0x8c328ade
mov dword [ebp - 0x208], 0x80f98e33
mov dword [ebp - 0x204], 0x84c882f5
mov dword [ebp - 0x200], 0x980f86e5
mov dword [ebp - 0x1fc], 0x9cef9aef
mov dword [ebp - 0x1f8], 0x90ff9ee4
mov dword [ebp - 0x1f4], 0x942392d0
mov dword [ebp - 0x1f0], 0xe82b9625
mov dword [ebp - 0x1ec], 0xecbcea4c
mov dword [ebp - 0x1e8], 0xe04dee48
mov dword [ebp - 0x1e4], 0xe45ae2ba
mov dword [ebp - 0x1e0], 0xf898e651
mov dword [ebp - 0x1dc], 0xfc88fa8c
mov dword [ebp - 0x1d8], 0xf081fe8a
mov dword [ebp - 0x1d4], 0xf485f282
mov dword [ebp - 0x1d0], 0xc88ff695
mov dword [ebp - 0x1cc], 0xcc93ca92
mov dword [ebp - 0x1c8], 0xc092ce99
mov dword [ebp - 0x1c4], 0xc4bfc29d
mov dword [ebp - 0x1c0], 0xd87bc6a5
mov dword [ebp - 0x1bc], 0xdc60da60
mov dword [ebp - 0x1b8], 0xd0bfde78
mov dword [ebp - 0x1b4], 0xd476d296
mov dword [ebp - 0x1b0], 0x286cd676
mov dword [ebp - 0x1ac], 0x2c522a96
mov dword [ebp - 0x1a8], 0x206c2e4d
mov dword [ebp - 0x1a4], 0x24912299
mov dword [ebp - 0x1a0], 0x389a269a
mov dword [ebp - 0x19c], 0x3c443a9c
mov dword [ebp - 0x198], 0x304e3e4c
mov dword [ebp - 0x194], 0x344d3278
mov dword [ebp - 0x190], 0x8493645
mov dword [ebp - 0x18c], 0xc750a79
mov dword [ebp - 0x188], 0x6f0e7d
mov dword [ebp - 0x184], 0x4a20252
mov dword [ebp - 0x180], 0x18a606a3
mov dword [ebp - 0x17c], 0x1ca21aab
mov dword [ebp - 0x178], 0x106a1e62
mov dword [ebp - 0x174], 0x14641262
mov dword [ebp - 0x170], 0x6864166b
mov dword [ebp - 0x16c], 0x6c6b6a1f
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebp + ecx - 0x248]
lea edi, [ecx + 0x5676e565]
mov edx, 0x9a
sub edx, ecx
xor edx, edi
and edx, esi
xor edx, edi
mov esi, 0xb3b72b28
sub esi, edx
or esi, 1
add esi, edx
add esi, 0x4c48d4d8
mov edi, esi
and edi, 0xfd
mov ebx, esi
and ebx, 2
or esi, 2
imul esi, ebx
xor ebx, 2
imul ebx, edi
add edx, 0xd7
xor edx, 1
add edx, esi
add edx, ebx
mov byte [ebp + ecx - 0x248], dl
add ecx, 0x8d4c156
mov edx, ecx
xor edx, 0x8d4c155
and ecx, 0x2aa
add ecx, ecx
sub ecx, edx
cmp ecx, 0xe0
jb 0x40c1a0
lea esi, [ebp - 0x248]
push 0
push 0
push 0
push 0
push esi
call eax
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
mov eax, dword [eax*4 + 0x43dc3c]
mov ecx, 0xa6aa4a24
xor ecx, dword [0x43dc44]
add eax, ecx
inc eax
jmp eax
Function at 0x413dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x418
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 8]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x413de0
mov eax, ebx
sar eax, 1
mov dword [esp + 0xdc], eax
cmp eax, 0xfffffff2
jge 0x413e02
mov eax, 0xffffffff
jmp 0x413e05
lea eax, [ebx + 0x1c]
push eax
call fcn.00408330
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x290], 0x2fe22df0
mov dword [esp + 0x294], 0x33813191
mov dword [esp + 0x298], 0x37d63580
mov dword [esp + 0x29c], 0x3b9f39ee
mov dword [esp + 0x2a0], 0x3f8d3d8e
mov dword [esp + 0x2a4], 0x3ad01a9
mov dword [esp + 0x2a8], 0x70605aa
mov eax, 0x216b514c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x216b4ebc]
lea edx, [eax - 0x216b5100]
and edx, ecx
or ecx, eax
lea esi, [edx + edx]
not esi
add esi, edx
and esi, ecx
xor ecx, edx
or ecx, esi
add cl, 0xa0
mov byte [esp + eax - 0x216b4ebc], cl
inc eax
cmp eax, 0x216b5168
jne 0x413e70
movzx ecx, word [edi]
mov esi, dword [esp + 4]
mov eax, esi
test cx, cx
je 0x413ed1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x413ec0
mov word [eax], 0
movzx ecx, word [esp + 0x290]
test cx, cx
je 0x413f01
lea edx, [esp + 0x292]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413ef0
mov word [eax], 0
lea eax, [esp + 0x110]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00438d90
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43e7a0]
Function at 0x41e570
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
mov ecx, 0xfffffffe
nop
cmp word [edi + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x41e580
mov eax, ecx
sar eax, 1
and ecx, 0x12
xor eax, 9
add eax, ecx
jns 0x41e5a0
mov eax, 0xffffffff
jmp 0x41e5a2
add eax, eax
push eax
call fcn.00408330
add esp, 4
mov esi, eax
mov dword [esp], 0x5ac258cb
mov dword [esp + 4], 0x5ed45cfe
mov dword [esp + 8], 0x528f508b
mov dword [esp + 0xc], 0x56f754f7
mov word [esp + 0x10], 0x4857
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
mov ebx, ecx
xor ebx, 0x938e059f
add ebx, eax
xor ebx, edx
add ebx, 0x638fd307
mov edx, ebx
and edx, 1
xor ebx, 1
lea edx, [ebx + edx*2]
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0x12
jne 0x41e5e0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41e631
add edi, 2
mov eax, esi
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41e620
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41e661
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e650
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00438ee0
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x43eee8]