joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404250
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x404320
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x404320
mov ebp, dword [esp + 0x28]
mov esi, 0x1505
test ebp, ebp
je 0x40429d
xor edi, edi
nop
movzx ecx, byte [ebx + edi]
test ecx, ecx
je 0x40429d
mov edx, esi
shl edx, 5
add edx, esi
mov esi, edx
and esi, ecx
xor edx, ecx
lea esi, [edx + esi*2]
inc edi
cmp ebp, edi
jne 0x404280
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edi, [ebx - 1]
mov edx, ebx
sub edx, 1
mov dword [esp + 8], edx
jb 0x404320
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4042c4
inc edi
dec ebx
je 0x40431e
mov eax, edi
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x40431e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x4042c0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040c660
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x4042c0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040c680
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x4042c0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x404320
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x404650
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x404779
mov ecx, dword [eax + 4]
cmp ecx, 2
je 0x40476d
cmp ecx, 5
je 0x404729
cmp ecx, 4
jne 0x404779
mov esi, dword [eax + 8]
cmp dword [esi + 0x18], 0
je 0x4046b3
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 0xc]
push dword [eax + edi*4]
call dword [0x450004]
add esp, 4
mov eax, dword [esi + 0x10]
push dword [eax + edi*4]
call fcn.00404650
add esp, 4
inc edi
cmp edi, dword [esi + 0x18]
jb 0x404690
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
push dword [esi + 4]
call dword [0x450004]
add esp, 4
push dword [esi + 0xc]
call dword [0x450004]
add esp, 4
push dword [esi + 0x10]
call dword [0x450004]
add esp, 4
push dword [esi + 0x14]
call dword [0x450004]
add esp, 4
push dword [esi + 8]
call dword [0x450004]
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
jmp 0x40476a
mov esi, dword [eax + 8]
cmp dword [esi + 8], 0
je 0x40475e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi + 4]
push dword [eax + edi*4]
call fcn.00404650
add esp, 4
mov eax, edi
and eax, 1
xor edi, 1
lea edi, [edi + eax*2]
cmp edi, dword [esi + 8]
jb 0x404740
push dword [esi + 4]
call dword [0x450004]
add esp, 4
push esi
jmp 0x404770
push dword [eax + 8]
call dword [0x450004]
add esp, 4
pop esi
pop edi
jmp dword [0x450004]
Function at 0x404ab0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x28]
mov eax, 0xffffffff
test ebp, ebp
je 0x404bfb
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x404bfb
cmp dword [esp + 0x30], 0
je 0x404bfb
push edi
call fcn.0040c660
add esp, 4
mov dword [esp], eax
mov ebx, 0x1505
test eax, eax
je 0x404b1e
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edi + eax]
test ecx, ecx
je 0x404b1e
mov edx, ebx
shl edx, 5
add edx, ebx
mov esi, edx
and esi, ecx
xor edx, ecx
lea ebx, [edx + esi*2]
inc eax
cmp dword [esp], eax
jne 0x404b00
mov esi, dword [ebp + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x404b81
mov ebp, 0xffffffff
mov esi, dword [esp + 0x28]
mov eax, dword [esi + 0x18]
cmp eax, dword [esi + 0x1c]
jae 0x404be5
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x18]
mov edx, dword [esp + 0x2c]
mov dword [eax + ecx*4], edx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [esi + 0x10]
mov edx, dword [esp + 0x30]
mov dword [eax + ecx*4], edx
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x18]
mov dword [eax + ecx*4], ebx
inc dword [esi + 0x18]
mov eax, dword [esi]
mov dword [edx], eax
xor eax, eax
jmp 0x404bfb
and edi, ebx
mov eax, dword [ebp + 4]
mov dword [esp + 4], eax
jmp 0x404b94
inc edi
dec esi
je 0x404b2f
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404b34
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + 8]
cmp dword [ecx + eax*4], ebx
jne 0x404b90
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040c660
add esp, 4
cmp eax, dword [esp]
jne 0x404b90
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040c680
add esp, 0xc
test eax, eax
jne 0x404b90
mov eax, 0xffffffff
jmp 0x404bfb
mov ecx, esi
call fcn.00405840
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x2c]
je 0x404c03
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push ecx
call fcn.0040c660
add esp, 4
mov dword [esp + 0xc], eax
mov edx, dword [esi + 0x20]
lea edi, [edx - 1]
mov eax, edx
sub eax, 1
mov dword [esp + 8], eax
jae 0x404c2b
mov ebp, 0xffffffff
jmp 0x404b44
and edi, ebx
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
jmp 0x404c44
inc edi
dec edx
je 0x404ca4
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404ca9
mov esi, dword [esp + 0x28]
mov ecx, dword [esi + 8]
cmp dword [ecx + eax*4], ebx
jne 0x404c40
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x10], eax
push eax
mov dword [esp + 4], edx
call fcn.0040c660
mov edx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0xc]
jne 0x404c40
push dword [esp + 0xc]
push dword [esp + 0x14]
push dword [esp + 0x34]
call fcn.0040c680
mov edx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x404c40
jmp 0x404b44
mov ebp, 0xffffffff
mov esi, dword [esp + 0x28]
jmp 0x404b44
Function at 0x4055a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405783
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x405783
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405783
cmp dword [ecx], 0
jne 0x405783
push edi
call fcn.0040c660
add esp, 4
mov ebp, 0x1505
test eax, eax
je 0x40560d
xor ebx, ebx
nop
nop
nop
nop
movzx ecx, byte [edi + ebx]
test ecx, ecx
je 0x40560d
mov edx, ebp
shl edx, 5
add edx, ebp
mov esi, edx
and esi, ecx
xor edx, ecx
lea ebp, [edx + esi*2]
inc ebx
cmp eax, ebx
jne 0x4055f0
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x28]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0xc], eax
mov dword [esp], ebp
jae 0x4056ef
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
jb 0x40567d
mov ecx, dword [esp + 0x28]
call fcn.00405840
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x405783
push ebx
call fcn.0040c660
add esp, 4
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov edx, ebx
push esi
push dword [esp + 4]
push eax
call fcn.00405790
add esp, 0xc
mov ebp, eax
push ebx
call fcn.0040c660
add esp, 4
mov esi, ebx
mov ebx, eax
inc eax
push eax
call dword [0x450008]
add esp, 4
test eax, eax
je 0x40577e
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c530
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov dword [eax + ecx*4], edi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov esi, dword [esp]
mov dword [eax + ecx*4], esi
mov ecx, edx
inc dword [edx + 0x18]
mov eax, dword [ecx]
mov dword [edi], eax
xor eax, eax
jmp 0x405783
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405708
inc ebx
dec esi
je 0x40562d
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov edi, dword [eax + ebp*4]
cmp edi, 0xffffffff
je 0x405632
mov eax, dword [ecx + 8]
mov edx, dword [esp]
cmp dword [eax + edi*4], edx
jne 0x405700
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + edi*4]
push ebp
call fcn.0040c660
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x405700
push dword [esp + 4]
push ebp
push dword [esp + 0x34]
call fcn.0040c680
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405700
mov eax, dword [ecx + 0x10]
push dword [eax + edi*4]
call fcn.00404650
mov ecx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [ecx + 0x10]
mov edx, dword [esp + 0x30]
mov dword [eax + edi*4], edx
mov edi, edx
jmp 0x4056e4
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4068e0
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406a96
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406a8f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406975
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406a8f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x4069fc
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
mov edi, eax
and edi, esi
xor eax, esi
lea eax, [eax + edi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 2]
add esi, eax
mov eax, ecx
and eax, esi
xor ecx, esi
movzx edi, byte [ebp + edx + 3]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + edx + 4]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + edx + 5]
add edi, esi
lea ecx, [ecx + eax*2]
movzx eax, byte [ebp + edx + 6]
add eax, edi
add ecx, edi
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406990
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x40693d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406a40
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406a20
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406930
jmp 0x406a4f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406930
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406a60
jmp 0x406930
shl ecx, 0x10
or ecx, edi
jmp 0x406a9b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cc10
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00445a00
test al, al
je 0x40cdee
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043cf50
test al, al
je 0x40cde9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0xc205d0dd
mov dword [esp + 8], 0xb6a8e2b6
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x40cc96
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040ce00
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x40cc70
mov dword [esp + 4], 0xdeb98343
mov dword [esp + 8], 0xf441a2c9
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40cce6
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040ce80
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40ccc0
test esi, esi
je 0x40cd86
mov dword [esp + 4], 0xf9fafbe3
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x40cd36
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040cf00
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x40cd10
mov dword [esp + 4], 0xe91f8523
mov dword [esp + 8], 0x53a8449a
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40cd86
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040cf70
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40cd60
mov dword [esp + 4], 0x92939091
mov dword [esp + 8], 0x9e9f9c9d
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x40cdd6
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040cfe0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x40cdb0
call fcn.0040e750
test al, al
je 0x40cde9
call fcn.00411aa0
call fcn.0040fe10
call fcn.00446b00
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40fe20
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov esi, dword [0x455ff4]
mov dword [esp + 0x38], 0x13851165
mov dword [esp + 0x3c], 0x1f771d86
mov dword [esp + 0x40], 0x1b8e198c
mov dword [esp + 0x44], 0x7510565
mov dword [esp + 0x48], 0x354015d
mov dword [esp + 0x4c], 0xf2e0d5c
mov dword [esp + 0x50], 0xb750920
mov dword [esp + 0x54], 0x37a0355d
mov dword [esp + 0x58], 0x33a5315c
mov dword [esp + 0x5c], 0x3fad3da3
mov dword [esp + 0x60], 0x3b4c3918
mov dword [esp + 0x64], 0x27062558
mov dword [esp + 0x68], 0x23722171
mov dword [esp + 0x6c], 0x2f7e2d7a
mov dword [esp + 0x70], 0x2b0a2973
mov dword [esp + 0x74], 0x573f552b
mov dword [esp + 0x78], 0x530c51c6
mov dword [esp + 0x7c], 0x5f055d00
mov dword [esp + 0x80], 0x5bc25978
mov dword [esp + 0x84], 0x471a451a
mov dword [esp + 0x88], 0x43624169
mov dword [esp + 0x8c], 0x4fde4d0d
mov dword [esp + 0x90], 0x4bde49d8
mov dword [esp + 0x94], 0x77097519
mov dword [esp + 0x98], 0x7310711d
mov dword [esp + 0x9c], 0x7f177d37
mov dword [esp + 0xa0], 0x7b2d79e4
mov dword [esp + 0xa4], 0x67356539
mov dword [esp + 0xa8], 0x6334613f
mov dword [esp + 0xac], 0x6f306d3f
mov dword [esp + 0xb0], 0x6b426948
mov dword [esp + 0xb4], 0x97de95df
mov dword [esp + 0xb8], 0x93e791ec
mov dword [esp + 0xbc], 0x9fca9de8
mov dword [esp + 0xc0], 0x9b0e99b8
mov dword [esp + 0xc4], 0x87ed85ed
mov dword [esp + 0xc8], 0x83a281ed
mov dword [esp + 0xcc], 0x8fe38dc3
mov dword [esp + 0xd0], 0x8be189eb
mov dword [esp + 0xd4], 0xb79fb523
mov dword [esp + 0xd8], 0xb3f1b190
mov dword [esp + 0xdc], 0xbf2cbdd4
mov dword [esp + 0xe0], 0xbb2fb92f
mov dword [esp + 0xe4], 0xa7f1a5c9
mov dword [esp + 0xe8], 0xa3f3a1f1
mov dword [esp + 0xec], 0xaff8adf5
mov dword [esp + 0xf0], 0xabfca9f8
mov dword [esp + 0xf4], 0xd780d584
mov dword [esp + 0xf8], 0xd3f2d180
mov dword [esp + 0xfc], 0xdfbfddaf
mov dword [esp + 0x100], 0xdbbbd9b6
mov dword [esp + 0x104], 0xc7afc556
mov dword [esp + 0x108], 0xc39fc197
mov dword [esp + 0x10c], 0xcf91cd9f
mov dword [esp + 0x110], 0xcb99c99e
mov dword [esp + 0x114], 0xf7f6f5aa
mov dword [esp + 0x118], 0
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0xe3
ja 0x4100ad
mov eax, dword [esp + 0xc]
movzx eax, byte [esp + eax + 0x38]
push dword [esp + 0xc]
push eax
call fcn.00411380
add esp, 8
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x38], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0xe4
jb case.default.0x4100c9
lea ebp, [esp + 0x38]
push 0
push 0
push 0
push 0
push ebp
call esi
mov esi, eax
xor eax, eax
test esi, esi
setne al
xor edi, edi
xor ebx, ebx
jmp dword [eax*4 + 0x450c2c]
Function at 0x4105a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov esi, dword [0x455ff4]
mov dword [esp + 0x38], 0x9fb0bdf
mov dword [esp + 0x3c], 0x5f1078e
mov dword [esp + 0x40], 0x1f603f0
mov dword [esp + 0x44], 0x1d2f1fff
mov dword [esp + 0x48], 0x19281bd7
mov dword [esp + 0x4c], 0x15361728
mov dword [esp + 0x50], 0x11fb132c
mov dword [esp + 0x54], 0x2ddc2fe7
mov dword [esp + 0x58], 0x29db2bd0
mov dword [esp + 0x5c], 0x25ab27a1
mov dword [esp + 0x60], 0x21f02304
mov dword [esp + 0x64], 0x3d1e3fcc
mov dword [esp + 0x68], 0x390a3bf3
mov dword [esp + 0x6c], 0x3506370a
mov dword [esp + 0x70], 0x311233f1
mov dword [esp + 0x74], 0xcd39cfd9
mov dword [esp + 0x78], 0xc900cb3e
mov dword [esp + 0x7c], 0xc503c704
mov dword [esp + 0x80], 0xc14ac3e4
mov dword [esp + 0x84], 0xdd12df0a
mov dword [esp + 0x88], 0xd9fadbeb
mov dword [esp + 0x8c], 0xd526d707
mov dword [esp + 0x90], 0xd126d324
mov dword [esp + 0x94], 0xed07ef2b
mov dword [esp + 0x98], 0xe914eb17
mov dword [esp + 0x9c], 0xe511e73d
mov dword [esp + 0xa0], 0xe1d3e368
mov dword [esp + 0xa4], 0xfd33ff2b
mov dword [esp + 0xa8], 0xf9c8fb35
mov dword [esp + 0xac], 0xf53cf735
mov dword [esp + 0xb0], 0xf1caf3d4
mov dword [esp + 0xb4], 0x8d568f25
mov dword [esp + 0xb8], 0x89598b60
mov dword [esp + 0xbc], 0x85b2875c
mov dword [esp + 0xc0], 0x817683a4
mov dword [esp + 0xc4], 0x9d6b9f77
mov dword [esp + 0xc8], 0x99ba9b67
mov dword [esp + 0xcc], 0x956d9741
mov dword [esp + 0xd0], 0x91679369
mov dword [esp + 0xd4], 0xad99af61
mov dword [esp + 0xd8], 0xa977ab8c
mov dword [esp + 0xdc], 0xa528a750
mov dword [esp + 0xe0], 0xa151a355
mov dword [esp + 0xe4], 0xbd8fbf5b
mov dword [esp + 0xe8], 0xb975bb73
mov dword [esp + 0xec], 0xb584b77f
mov dword [esp + 0xf0], 0xb180b384
mov dword [esp + 0xf4], 0x4d7c4f80
mov dword [esp + 0xf8], 0x496a4b7c
mov dword [esp + 0xfc], 0x45b947a5
mov dword [esp + 0x100], 0x41bd43be
mov dword [esp + 0x104], 0x5da95fce
mov dword [esp + 0x108], 0x59915b6d
mov dword [esp + 0x10c], 0x559f5795
mov dword [esp + 0x110], 0x519f5366
mov dword [esp + 0x114], 0x6d6e6f9a
mov byte [esp + 0x11a], 0
mov word [esp + 0x118], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xe2
ja 0x41083d
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x38]
push dword [esp + 4]
push eax
call fcn.00411610
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x38], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xe3
jb 0x410810
lea ebx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ebx
call esi
mov esi, eax
xor eax, eax
test esi, esi
setne al
jmp dword [eax*4 + 0x450d04]

Function at 0x411aa0
Capabilities:
Contain obfuscated stackstrings
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x451544]
Function at 0x424a00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x424a20
cmp eax, 0xffffffdd
jge 0x424a37
mov eax, 0xffffffff
jmp 0x424a3a
add eax, 0x22
push eax
call fcn.0040c500
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0x41db47e0
mov dword [esp + 0x1c], 0x4dd343dc
mov dword [esp + 0x20], 0x49ed4fde
mov dword [esp + 0x24], 0xb5e54be1
mov dword [esp + 0x28], 0xb11ab710
mov dword [esp + 0x2c], 0xbd1cb31f
mov dword [esp + 0x30], 0xb921bf1f
mov dword [esp + 0x34], 0xa526bb2c
mov dword [esp + 0x38], 0xa7a4
mov byte [esp + 0x3c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x24
ja 0x424adb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.004258c0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x25
jb 0x424ab0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x424b01
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x424af0
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x424b31
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424b20
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x99eb9bef
mov dword [esp + 0x1c], 0xa595a71e
mov dword [esp + 0x20], 0xa1daa3cf
mov dword [esp + 0x24], 0xadc5afdc
mov dword [esp + 0x28], 0xa9d7abde
mov dword [esp + 0x2c], 0xb5c7b7df
mov dword [esp + 0x30], 0xb187b3c6
mov dword [esp + 0x34], 0xbd8bbf85
mov dword [esp + 0x38], 0xb9d8bb8a
mov dword [esp + 0x3c], 0xc5bbc7c3
mov dword [esp + 0x40], 0xc1bcc3af
mov dword [esp + 0x44], 0xcdbfcf8d
mov dword [esp + 0x48], 0xc9b6cbbe
mov dword [esp + 0x4c], 0xd5aed7a3
mov dword [esp + 0x50], 0xd185d3a8
mov dword [esp + 0x54], 0xdd9ddfbc
mov dword [esp + 0x58], 0xd9dadbea
mov byte [esp + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x44
ja 0x424c16
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.00425930
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x45
jb 0x424bf0
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x424f10
push ecx
push esi
call fcn.00425b20
add esp, 0x10
jmp dword [0x4524ac]