joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407070
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x407236
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
movzx edi, si
shr esi, 0x10
test ebp, ebp
je 0x40722f
mov ecx, 0x5e6ea9af
mov eax, ebp
mul ecx
shr edx, 0xb
imul eax, edx, 0x15b0
mov dword [esp + 4], ebp
sub ebp, eax
jmp 0x407114
mov ebp, dword [esp + 8]
mov eax, ebp
sub eax, dword [esp]
add ebx, eax
mov ecx, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov eax, esi
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub esi, eax
mov eax, ebp
xor eax, ecx
not ebp
and ebp, ecx
add ebp, ebp
mov ecx, ebp
mov ebp, 0x15b0
sub ecx, eax
mov dword [esp + 4], ecx
je 0x40722f
xor eax, eax
cmp ebp, 8
mov dword [esp + 8], ebp
jb 0x4071a1
and ebp, 0x1ff8
mov dword [esp], ebp
xor edx, edx
nop
nop
mov eax, edx
movzx ecx, byte [ebx + edx]
add ecx, edi
add esi, ecx
movzx edx, byte [ebx + edx + 1]
add edx, ecx
add esi, edx
movzx ecx, byte [ebx + eax + 2]
add ecx, edx
mov edx, esi
and edx, ecx
xor esi, ecx
lea edx, [esi + edx*2]
movzx esi, byte [ebx + eax + 3]
mov edi, ecx
and edi, esi
xor ecx, esi
lea ecx, [ecx + edi*2]
add edx, ecx
movzx esi, byte [ebx + eax + 4]
add esi, ecx
add edx, esi
movzx ecx, byte [ebx + eax + 5]
add ecx, esi
add edx, ecx
movzx esi, byte [ebx + eax + 6]
add esi, ecx
mov ecx, edx
and ecx, esi
xor edx, esi
movzx edi, byte [ebx + eax + 7]
add edi, esi
add edx, edi
lea esi, [edx + ecx*2]
mov ebp, dword [esp + 8]
lea edx, [eax + 8]
add eax, 0xf
cmp eax, ebp
jb 0x407130
add ebx, edx
mov eax, dword [esp]
mov ecx, eax
sub ecx, ebp
jae 0x4070cb
and ebp, 3
mov dword [esp], eax
je 0x4071e1
mov dword [esp + 0xc], ecx
neg ebp
xor eax, eax
mov edx, ebx
nop
nop
nop
movzx ecx, byte [edx]
inc edx
add edi, ecx
add esi, edi
dec eax
cmp ebp, eax
jne 0x4071c0
mov ebp, dword [esp]
sub ebp, eax
mov ecx, dword [esp + 0xc]
cmp ecx, 0xfffffffc
ja 0x4070c0
jmp 0x4071ee
mov ebp, eax
mov edx, ebx
cmp ecx, 0xfffffffc
ja 0x4070c0
mov eax, dword [esp + 8]
sub eax, ebp
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + ebp]
add ecx, edi
add esi, ecx
movzx edi, byte [edx + ebp + 1]
add edi, ecx
add esi, edi
movzx ecx, byte [edx + ebp + 2]
add ecx, edi
add esi, ecx
movzx edi, byte [edx + ebp + 3]
add edi, ecx
add esi, edi
add ebp, 4
cmp eax, ebp
jne 0x407200
jmp 0x4070c0
shl esi, 0x10
or esi, edi
jmp 0x40723b
mov esi, 1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407250
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4072bd
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x4072bf
not eax
xor esi, esi
nop
nop
nop
nop
movzx edx, byte [ecx + esi]
mov ebx, eax
mov edi, edx
and edi, 0xf
mov ebp, edi
and ebp, eax
and eax, 0xf
add eax, edi
shr ebx, 4
add ebp, ebp
sub eax, ebp
mov ebp, dword [eax*4 + 0x442c50]
mov eax, ebp
and eax, ebx
add eax, eax
sub ebp, eax
add ebp, ebx
mov eax, ebp
and ebp, 0xf
shr edx, 4
xor edx, ebp
shr eax, 4
xor eax, dword [edx*4 + 0x442c50]
mov edx, dword [esp + 0x1c]
inc esi
cmp edx, esi
jne 0x407270
not eax
jmp 0x4072bf
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d2c0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push esi
sub esp, 8
call fcn.0043ba60
test al, al
je 0x40d358
call fcn.00434420
test al, al
je 0x40d353
mov dword [esp], 0x9fb7f2ab
mov dword [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
and ecx, 1
mov edx, eax
and edx, 2
mov esi, edx
xor esi, 2
imul esi, ecx
or ecx, 2
imul ecx, edx
add ecx, esi
mov edx, eax
xor edx, 0xca3705e3
mov esi, ecx
and esi, edx
xor edx, ecx
lea ecx, [edx + esi*2]
xor cl, byte [esp + eax]
add cl, 0x91
mov byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x40d2f0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40d340
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e4c0
test al, al
je 0x40d353
call fcn.004110c0
call fcn.0040fc90
call fcn.0043cd30
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40ee90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40f100
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40eecc
cmp edx, esi
jae 0x40f100
test edi, edi
je 0x40f100
movzx ebp, bl
test bl, bl
js 0x40ef00
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40eec0
jmp 0x40f100
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40ef3f
cmp bl, 0xc2
jb 0x40eef0
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40efb2
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40eee2
mov ecx, ebp
xor ecx, 0xffffff0f
mov esi, ebp
or esi, 0xf0
and esi, ecx
cmp esi, 0xe0
jne 0x40ef7a
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40efbc
cmp ebp, 0xe0
jne 0x40efc5
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40eeec
jmp 0x40efc5
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40f0db
cmp bl, 0xf4
ja 0x40eeec
movzx ecx, byte [edx + 1]
je 0x40f014
cmp ebp, 0xf0
jne 0x40f01d
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40eeec
jmp 0x40f01d
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40eef2
cmp cl, 0x9f
ja 0x40eeec
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f0e2
movzx ebx, byte [edx + 2]
mov esi, ebx
not esi
or esi, 0xc0
add esi, ebx
cmp esi, 0x7f
jne 0x40f00c
shl ebp, 0xc
shl ecx, 6
add ecx, 0xe000
add edx, 3
and ebx, 0x3f
or ebx, ebp
or ebx, ecx
lea ecx, [eax + 2]
mov word [eax], bx
jmp 0x40eee2
add edx, 2
jmp 0x40eeec
cmp cl, 0x8f
ja 0x40eeec
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f0e2
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f0e8
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f0f4
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov esi, dword [esp]
and esi, 0x3f
or esi, ebp
cmp esi, 0x10000
jb 0x40eeec
mov ecx, esi
not ecx
or ecx, 0xfffff800
add ecx, esi
inc ecx
cmp ecx, 0xd800
je 0x40eeec
cmp edi, 2
jb 0x40f0db
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
and esi, 0x3ff
or esi, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], si
jmp 0x40eee2
mov ecx, eax
jmp 0x40eee2
inc edx
jmp 0x40eeec
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40eef2
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40eef2
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44b07c]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40f6be
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x445e54]
xor eax, eax
jmp 0x40fc7f
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40fca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x444
mov dword [esp + 0x44], 0x63fd61dd
mov dword [esp + 0x48], 0x67ff65ee
mov dword [esp + 0x4c], 0x5bc659c4
mov dword [esp + 0x50], 0x5f815dfd
mov dword [esp + 0x54], 0x538c5185
mov dword [esp + 0x58], 0x57b65584
mov dword [esp + 0x5c], 0x4bfd4990
mov dword [esp + 0x60], 0x4fd04dd5
mov dword [esp + 0x64], 0x43dd41e4
mov dword [esp + 0x68], 0x47d545d3
mov dword [esp + 0x6c], 0x3b8439d8
mov dword [esp + 0x70], 0x3fde3d88
mov dword [esp + 0x74], 0x33e231e1
mov dword [esp + 0x78], 0x37e635ea
mov dword [esp + 0x7c], 0x2bca29e3
mov dword [esp + 0x80], 0x2fb72d9b
mov dword [esp + 0x84], 0x23f421be
mov dword [esp + 0x88], 0x27ed25f0
mov dword [esp + 0x8c], 0x1b9219f8
mov dword [esp + 0x90], 0x1fca1dca
mov dword [esp + 0x94], 0x13f211c9
mov dword [esp + 0x98], 0x178615d5
mov dword [esp + 0x9c], 0xb960998
mov dword [esp + 0xa0], 0xfb90da9
mov dword [esp + 0xa4], 0x3a001a5
mov dword [esp + 0xa8], 0x79f05bf
mov dword [esp + 0xac], 0xfb25f96c
mov dword [esp + 0xb0], 0xff2dfd29
mov dword [esp + 0xb4], 0xf32cf127
mov dword [esp + 0xb8], 0xf720f527
mov dword [esp + 0xbc], 0xeb32e908
mov dword [esp + 0xc0], 0xef56ed57
mov dword [esp + 0xc4], 0xe35fe154
mov dword [esp + 0xc8], 0xe73ae558
mov dword [esp + 0xcc], 0xdb46d938
mov dword [esp + 0xd0], 0xdf45dd45
mov dword [esp + 0xd4], 0xd332d175
mov dword [esp + 0xd8], 0xd773d513
mov dword [esp + 0xdc], 0xcb51c96b
mov dword [esp + 0xe0], 0xcf17cd53
mov dword [esp + 0xe4], 0xc301c120
mov dword [esp + 0xe8], 0xc754c55c
mov dword [esp + 0xec], 0xbb27b927
mov dword [esp + 0xf0], 0xbf61bd19
mov dword [esp + 0xf4], 0xb363b161
mov dword [esp + 0xf8], 0xb768b57d
mov dword [esp + 0xfc], 0xab74a978
mov dword [esp + 0x100], 0xaf70ad7c
mov dword [esp + 0x104], 0xa342a170
mov dword [esp + 0x108], 0xa707a517
mov dword [esp + 0x10c], 0x9b3b993e
mov dword [esp + 0x110], 0x9f079d0e
mov dword [esp + 0x114], 0x9347914f
mov dword [esp + 0x118], 0x97419547
mov dword [esp + 0x11c], 0x8b598956
mov dword [esp + 0x120], 0x8f8e8d5a
mov byte [esp + 0x126], 0
mov word [esp + 0x124], 0
mov eax, dword [0x44b070]
xor ecx, ecx
xor edx, edx
movzx ebx, byte [esp + edx + 0x44]
mov ebp, edx
xor ebp, 0xcd4c7a68
mov esi, ecx
and esi, 0x12e
sub esi, ebp
xor esi, ebx
mov ebp, esi
and ebp, 0x2320405
mov edi, esi
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, ebp
or ebp, 2
imul ebp, edi
xor esi, 0x27e6407
add ebx, esi
add ebx, ebp
and esi, 1
or ebx, 1
add ebx, esi
mov byte [esp + edx + 0x44], bl
inc edx
add ecx, 2
cmp edx, 0xe3
jne 0x40ff00
lea ebp, [esp + 0x44]
push 0
push 0
push 0
push 0
push ebp
call eax
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
mov eax, dword [eax*4 + 0x445f04]
mov ecx, 0x8e9907c9
xor ecx, dword [0x445f0c]
add eax, ecx
inc eax
jmp eax
Function at 0x4105b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0x49db4bff
mov dword [esp + 0x40], 0x45d147ce
mov dword [esp + 0x44], 0x41d643d0
mov dword [esp + 0x48], 0xbdefbfdf
mov dword [esp + 0x4c], 0xb9e8bbf7
mov dword [esp + 0x50], 0xb5d6b7e8
mov dword [esp + 0x54], 0xb11bb3ec
mov dword [esp + 0x58], 0xad3caf27
mov dword [esp + 0x5c], 0xa93bab30
mov dword [esp + 0x60], 0xa52ba721
mov dword [esp + 0x64], 0xa110a3c4
mov dword [esp + 0x68], 0x9dfe9f0c
mov dword [esp + 0x6c], 0x99ca9bd3
mov dword [esp + 0x70], 0x95c697ca
mov dword [esp + 0x74], 0x91f293d1
mov dword [esp + 0x78], 0x8d198f39
mov dword [esp + 0x7c], 0x89c08b1e
mov dword [esp + 0x80], 0x85c387c4
mov dword [esp + 0x84], 0x810a83e4
mov dword [esp + 0x88], 0xfdb2ffca
mov dword [esp + 0x8c], 0xf99afbab
mov dword [esp + 0x90], 0xf566f747
mov dword [esp + 0x94], 0xf166f364
mov dword [esp + 0x98], 0xed47ef6b
mov dword [esp + 0x9c], 0xe974eb77
mov dword [esp + 0xa0], 0xe571e75d
mov dword [esp + 0xa4], 0xe1b3e368
mov dword [esp + 0xa8], 0xdd93dfab
mov dword [esp + 0xac], 0xd988db95
mov dword [esp + 0xb0], 0xd59cd795
mov dword [esp + 0xb4], 0xd18ad3b4
mov dword [esp + 0xb8], 0xcd76cf65
mov dword [esp + 0xbc], 0xc979cb60
mov dword [esp + 0xc0], 0xc592c77c
mov dword [esp + 0xc4], 0xc156c3a4
mov dword [esp + 0xc8], 0x3dab3f57
mov dword [esp + 0xcc], 0x395a3ba7
mov dword [esp + 0xd0], 0x35ad3781
mov dword [esp + 0xd4], 0x31a733a9
mov dword [esp + 0xd8], 0x2d792fa1
mov dword [esp + 0xdc], 0x29972b4c
mov dword [esp + 0xe0], 0x25a827b0
mov dword [esp + 0xe4], 0x21b123b5
mov dword [esp + 0xe8], 0x1d4f1fbb
mov dword [esp + 0xec], 0x19551b53
mov dword [esp + 0xf0], 0x1544175f
mov dword [esp + 0xf4], 0x11401344
mov dword [esp + 0xf8], 0xd5c0f40
mov dword [esp + 0xfc], 0x96a0b5c
mov dword [esp + 0x100], 0x59907a5
mov dword [esp + 0x104], 0x19d039e
mov dword [esp + 0x108], 0x7de97f8e
mov dword [esp + 0x10c], 0x79317b2d
mov dword [esp + 0x110], 0x753f7735
mov dword [esp + 0x114], 0x713f7326
mov dword [esp + 0x118], 0x6d6e6f3a
mov dword [esp + 0x11c], 0
mov eax, dword [0x44b070]
lea ecx, [esp + 0x3c]
mov edx, 0xed42f48c
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx]
lea esi, [edi + edi]
not esi
add esi, edi
mov ebx, edi
and ebx, 0x1b
and esi, 0xe4
or esi, ebx
xor esi, edi
xor esi, 0x1b
and esi, edi
or esi, edx
lea ebx, [edx + 0x12bd0c00]
and ebx, edi
not esi
or esi, ebx
lea edi, [esi + esi]
and edi, 2
sub esi, edi
add esi, 0xa24ec6c1
mov ebx, esi
and ebx, edi
xor esi, edi
lea ebx, [esi + ebx*2]
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0xed42f3a8
jne 0x410810
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov edi, eax
xor eax, eax
test edi, edi
setne al
mov eax, dword [eax*4 + 0x4460cc]
mov ecx, 0x3faf4a30
xor ecx, dword [0x4460d4]
add eax, ecx
inc eax
jmp eax
Function at 0x417870
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebp, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + eax], 0
lea eax, [eax + 2]
jne 0x417890
add eax, ebp
add eax, 0xfffffffe
mov ebx, ebp
not ebx
and ebx, eax
add ebx, ebx
xor eax, ebp
sub ebx, eax
mov esi, dword [ecx + 4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x4178c0
sar ebx, 1
lea ecx, [esi + eax]
add ecx, 0xfffffffe
mov eax, esi
not eax
and eax, ecx
add eax, eax
xor ecx, esi
sub eax, ecx
mov ecx, eax
sar ecx, 1
and eax, 2
xor ecx, 1
add eax, ebx
lea edx, [ecx + eax]
inc edx
test edx, edx
jns 0x4178f9
mov eax, 0xffffffff
jmp 0x417902
add eax, ecx
lea eax, [eax*2 + 2]
push eax
call fcn.0040cc40
add esp, 4
mov edi, eax
movzx ecx, word [esi]
test cx, cx
je 0x417931
add esi, 2
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x417920
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0x417961
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417950
mov word [eax], 0
mov eax, esp
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00440500
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4466ac]
Function at 0x417c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1148
call fcn.0040cba0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x417c30
sar esi, 1
lea ecx, [esp + 0x38]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44c3b4]
mov ebx, dword [esp + 0x38]
mov edi, 0xffffffff
test ebx, ebx
jns 0x417c64
mov eax, 0xffffffff
jmp 0x417c67
lea eax, [ebx + ebx]
push eax
call fcn.0040cc40
add esp, 4
lea ecx, [esp + 0x38]
push ecx
push ebx
mov dword [esp + 0x34], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44c3b4]
mov eax, dword [esp + 0x38]
mov ecx, eax
add ecx, 0xd
js 0x417c9c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040cc40
add esp, 4
mov ebx, eax
mov dword [esp + 0x144], 0xf520964
mov dword [esp + 0x148], 0x3750d6d
mov dword [esp + 0x14c], 0x7260174
mov dword [esp + 0x150], 0x1b7f056e
mov dword [esp + 0x154], 0x1f69196e
mov dword [esp + 0x158], 0x13611d65
mov dword [esp + 0x15c], 0x17161162
mov word [esp + 0x160], 0
mov byte [esp + 0x162], 0
mov eax, 0x1c596f82
mov ecx, 0xe3a6907d
mov edx, ecx
xor edx, 0x35
mov edi, ecx
or edi, 0x4a
and edi, edx
mov edx, eax
xor edx, 0x4a
mov esi, eax
or esi, 0xb5
and esi, edx
movzx edx, byte [esp + eax - 0x1c596e3e]
or esi, edi
mov edi, edx
and edx, 0xffffffb5
xor edx, esi
and edi, 0x4a
or edi, 0xa1
xor edx, edi
xor dl, 0xeb
add dl, 0x76
mov byte [esp + eax - 0x1c596e3e], dl
inc eax
dec ecx
cmp eax, 0x1c596fa1
jne 0x417d10
mov eax, dword [esp + 0x2c]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x417d91
mov eax, dword [esp + 0x2c]
lea edx, [eax + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417d80
mov word [eax], 0
movzx ecx, word [esp + 0x144]
test cx, cx
je 0x417dc1
lea edx, [esp + 0x146]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417db0
mov word [eax], 0
lea eax, [esp + 0xb8]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00440500
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446a5c]
Function at 0x4203a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x2c]
xor eax, eax
nop
nop
nop
cmp word [edi + eax], 0
lea eax, [eax + 2]
jne 0x4203b0
lea ecx, [edi + eax]
add ecx, 0xfffffffe
mov eax, edi
not eax
and eax, ecx
xor ecx, edi
add eax, eax
sub eax, ecx
cmp eax, 0xffffffed
jge 0x4203d8
mov eax, 0xffffffff
jmp 0x4203db
add eax, 0x12
push eax
call fcn.0040cc40
add esp, 4
mov esi, eax
mov dword [esp], 0xe947eb58
mov dword [esp + 4], 0xed71ef43
mov dword [esp + 8], 0xd180d3b8
mov dword [esp + 0xc], 0xd570d774
mov word [esp + 0x10], 0xdbd4
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
mov eax, 0x48c48657
nop
nop
movzx ecx, byte [esp + eax - 0x48c48657]
xor ecx, eax
lea edx, [ecx + ecx]
mov ebx, edx
and ebx, 0x98
mov ebp, ecx
xor ebp, 0x4c
add ebp, ebx
and edx, 2
and ecx, edx
or edx, 1
xor edx, ebp
lea ecx, [edx + ecx*2]
mov byte [esp + eax - 0x48c48657], cl
inc eax
cmp eax, 0x48c4866e
jne 0x420420
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x420481
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x420470
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4204b1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4204a0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00440670
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x44704c]
Function at 0x4224a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x94
mov dword [esp + 4], 0x83ce81e5
mov dword [esp + 8], 0x8725852b
mov dword [esp + 0xc], 0x8b268929
mov dword [esp + 0x10], 0x8f3e8dcd
mov dword [esp + 0x14], 0x93d69120
mov dword [esp + 0x18], 0x97229535
mov dword [esp + 0x1c], 0x9bff9939
lea eax, [esp + 0x20]
mov word [esp + 0x20], 0x9d9c
mov dword [esp + 0x22], 0
mov byte [esp + 0x26], 0
xor ecx, ecx
nop
nop
nop
nop
mov edx, ecx
add dl, 0x20
xor dl, byte [esp + ecx + 4]
add dl, 0x60
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 0x23
jne 0x422500
lea ebx, [esp + 0x76]
lea edx, [esp + 4]
mov edi, ebx
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x92]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea ebp, [esp + 0x54]
push ebp
push 0
push 0
push 0xe
push ebx
push 0
call dword [0x44c3b4]
mov esi, dword [esp + 0x54]
mov edi, 0xffffffff
test esi, esi
jns 0x422564
mov eax, 0xffffffff
jmp 0x422567
lea eax, [esi + esi]
push eax
call fcn.0040cc40
add esp, 4
push ebp
push esi
mov dword [esp + 8], eax
push eax
push 0xe
push ebx
push 0
call dword [0x44c3b4]
mov eax, dword [esp + 0x54]
mov ecx, eax
add ecx, 9
js 0x422594
lea edi, [eax*2 + 0x12]
push edi
call fcn.0040cc40
add esp, 4
mov edi, eax
mov dword [esp + 4], 0x519e4f90
mov dword [esp + 8], 0x55b753b3
mov dword [esp + 0xc], 0x59b557b9
mov dword [esp + 0x10], 0x5dbd5bb1
mov dword [esp + 0x14], 0x615e5fa9
mov dword [esp + 0x18], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
and edx, 0x13
xor edx, 0x73
mov ecx, eax
and ecx, 0xc
sub ecx, edx
xor cl, byte [esp + eax + 4]
add cl, 0x3f
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 0x18
jne 0x4225e0
mov eax, dword [esp]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x422631
mov eax, dword [esp]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x422620
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x422661
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x422650
mov word [eax], 0
lea eax, [esp + 0x70]
push eax
push edi
call fcn.00440670
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44759c]
Function at 0x422c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x8c
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x1c
mov ebx, esp
mov dword [ebp - 0x58], 0x9550b37
mov dword [ebp - 0x54], 0x5760778
mov dword [ebp - 0x50], 0x17d0358
mov dword [ebp - 0x4c], 0x1d611f8c
mov dword [ebp - 0x48], 0x197e1b27
mov dword [ebp - 0x44], 0x156e1774
mov dword [ebp - 0x40], 0x1160139f
mov dword [ebp - 0x3c], 0x2d552f6c
mov dword [ebp - 0x38], 0x29542ba2
mov dword [ebp - 0x34], 0x25a8275f
mov dword [ebp - 0x30], 0x21462358
mov dword [ebp - 0x2c], 0x3db03f70
mov dword [ebp - 0x28], 0x39403b4d
mov dword [ebp - 0x24], 0x3542374f
mov dword [ebp - 0x20], 0x31bf334f
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0x4f30
mov byte [ebp - 0x18], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebp + ecx - 0x58]
mov edi, ecx
and edi, 0x7d
xor edi, 0xe283a67d
mov edx, ecx
and edx, 2
sub edx, edi
xor edx, esi
mov esi, edx
and esi, 0xc104070
mov edi, edx
xor edi, 0x6c924070
lea esi, [edi + esi*2]
and edx, 1
mov edi, esi
add edx, esi
and esi, 0xfe
xor edi, 1
add edx, edi
sub edx, esi
mov byte [ebp + ecx - 0x58], dl
inc ecx
cmp ecx, 0x41
jne 0x422cc0
lea eax, [ebp - 0x96]
lea edx, [ebp - 0x58]
mov edi, eax
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [ebp - 0x5a]
mov ecx, 1
mov edx, dword [ebp - 0x14]
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov esi, dword [ebp - 0x10]
push esi
push 0
push 0
push 0x1e
push eax
push 0
call dword [0x44c3b4]
mov edi, dword [esi]
test edi, edi
jns 0x422d52
mov eax, 0xffffffff
jmp 0x422d55
lea eax, [edi + edi]
push eax
call fcn.0040cc40
add esp, 4
mov esi, eax
push dword [ebp - 0x10]
push edi
push eax
push 0x1e
lea eax, [ebp - 0x96]
push eax
push 0
call dword [0x44c3b4]
mov dword [ebx], 0x9ff699cc
mov dword [ebx + 4], 0xa3d09de9
mov dword [ebx + 8], 0xa7c3a1c4
mov dword [ebx + 0xc], 0xabcca5d2
mov dword [ebx + 0x10], 0xafd8a9c1
mov dword [ebx + 0x14], 0xb3b2adc8
mov word [ebx + 0x18], 0
mov eax, 0xf45a121a
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebx + eax + 0xba5ede6]
xor ecx, eax
mov edx, ecx
and edx, 0x3018007d
xor ecx, 0x3a3da57d
lea ecx, [ecx + edx*2]
mov edx, ecx
not edx
and edx, 0x39
and ecx, 0xc6
sub ecx, edx
add cl, 0x3a
mov byte [ebx + eax + 0xba5ede6], cl
inc eax
cmp eax, 0xf45a1234
jne 0x422db0
push 0
push 0
push ebx
push esi
push dword [ebp + 8]
call fcn.0041e140
add esp, 0x14
mov ebx, eax
jmp dword [0x447604]