joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a00e2
Capabilities:
Terminate process

Disassembly:
push 8
push 0x100ab450
call fcn.1009e76c
push 8
call fcn.100a1cc0
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x100b9844], esi
jne 0x100a0116
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [0x100b9840], esi
mov al, byte [ebp + 0x10]
mov byte [0x100b983c], al
cmp dword [ebp + 0xc], edi
jne 0x100a0160
cmp dword [0x100bc288], edi
je 0x100a0150
mov eax, dword [0x100bc284]
sub eax, 4
mov dword [0x100bc284], eax
cmp eax, dword [0x100bc288]
jb 0x100a0150
mov eax, dword [eax]
cmp eax, edi
je 0x100a0131
call eax
jmp 0x100a0131
push 0x100ad028
mov eax, 0x100ad020
call fcn.100a0060
pop ecx
push 0x100ad030
mov eax, 0x100ad02c
call fcn.100a0060
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x100a0191
cmp dword [ebp + 0x10], edi
jne 0x100a019f
mov dword [0x100b9844], esi
push dword [ebp + 8]
call fcn.100a001e
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x100a019e
push 8
call fcn.100a1cc0
pop ecx
ret
call fcn.1009e7a7
ret

Function at 0x100a0bb2
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x100b4368]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x100b49f0]
je 0x100a0be7
inc eax
cmp eax, 0x13
jb 0x100a0bd8
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x100b49f0]
jne 0x100a0d0d
mov eax, dword [0x100b9784]
cmp eax, 1
je 0x100a0ce5
cmp eax, edx
jne 0x100a0c17
cmp dword [0x100b9788], 1
je 0x100a0ce5
cmp ecx, 0xfc
je 0x100a0d0d
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100a0c4d
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.100a0e60
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.100a1090
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x100a0c81
mov eax, edi
push eax
call fcn.100a1090
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x100a73f8
push edi
call fcn.100a0f60
add esp, 0x10
push edi
call fcn.100a1090
push dword [esi + 0x100b49f4]
mov ebx, eax
call fcn.100a1090
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.1009daf0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.100a0e60
push edi
push ebx
call fcn.100a0e70
push 0x100aafc0
push ebx
call fcn.100a0e70
push dword [esi + 0x100b49f4]
push ebx
call fcn.100a0e70
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.100a1cc0
add esp, 0x2c
jmp 0x100a0d0d
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x100b49f4]
push dword [esi]
call fcn.100a1090
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.1009d15f
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x100a1cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x100a1ccf
pop dword [ebp - 0x18]
mov eax, 0x100a1ccf
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3d25b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x5cd21db0
sub ecx, 0x5cd1ca10
mov edi, eax
mov ebx, 0x100e3000
add ebx, dword [ebp - 0x18]
mov edx, 0xcdd63105
add edx, 0x3cd85286
mov dword [ebp - 0xc], 0x657614ad
mov esi, dword [ebx]
xor dword [ebp - 0x14], 0xba93f1d7
sub esi, edx
xor dword [ebp - 4], edi
mov dword [edi], esi
add dword [ebp - 4], ecx
add edi, 4
add ebx, 0xcf386daf
add ebx, 0x30c79255
loop 0x100a1d1e
add eax, 0x1540b7d9
add eax, 0xeac0897a
mov ebx, eax
add eax, 0xc9dd2ad8
add eax, 0x3622d52d
mov ecx, 0xf94fcf1e
sub ecx, 0xe94fcf1e
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x100a3693
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x100b4368]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x100a36c4
xor eax, eax
jmp 0x100a384d
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x100bc180]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x100a3700
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.100a1cc0
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x100a37db
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x100a3819
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x100a3764
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x100a3755
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x100a3735
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x100a37a4
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x100a37ad
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x100a3726
jmp 0x100a37af
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x100a3848
cmp dword [ebp - 0x6c], edi
je 0x100a3819
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x100a380e
call fcn.1009f770
mov dword [eax], 9
call fcn.1009f779
mov dword [eax], esi
jmp 0x100a3843
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x100a3803
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x100a37af
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x100a37af
push dword [ebp - 0x6c]
call fcn.1009f782
pop ecx
jmp 0x100a3843
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x100a3831
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x100a3831
xor eax, eax
jmp 0x100a384b
call fcn.1009f770
mov dword [eax], 0x1c
call fcn.1009f779
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x100a384b
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.1009d15f
add ebp, 0x3a0
leave
ret
Function at 0x402640
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
xor eax, eax
test ecx, ecx
je 0x402744
test edx, edx
je 0x402744
mov ebp, dword [esp + 0x2c]
test ebp, ebp
mov dword [esp], ecx
je 0x40268a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x402691
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x402670
jmp 0x402693
mov esi, 0x1505
jmp 0x402693
mov esi, ecx
mov ebp, dword [esp]
mov ecx, dword [ebp + 0x20]
lea ebx, [ecx - 1]
mov edi, ecx
sub edi, 1
jb 0x402744
mov dword [esp + 0x14], edi
mov dword [esp + 8], edx
and ebx, esi
mov edx, ebp
mov eax, dword [ebp + 4]
mov dword [esp + 0x10], eax
xor edi, edi
mov dword [esp + 4], ecx
mov dword [esp + 0xc], ebx
jmp 0x4026d9
inc edi
cmp ecx, edi
mov ebx, dword [esp + 0xc]
je 0x402742
mov ebp, ecx
mov eax, edi
xor eax, ebx
mov ecx, edi
and ecx, ebx
lea eax, [eax + ecx*2]
and eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov ebx, dword [ecx + eax*4]
cmp ebx, 0xffffffff
je 0x402742
mov eax, dword [edx + 8]
cmp dword [eax + ebx*4], esi
mov ecx, ebp
jne 0x4026d0
mov eax, dword [edx + 0xc]
mov ebp, dword [eax + ebx*4]
push ebp
call fcn.00408ec0
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x4026d0
push dword [esp + 0x2c]
push ebp
push dword [esp + 0x10]
call fcn.00408ee0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4026d0
mov eax, dword [edx + 0x10]
mov eax, dword [eax + ebx*4]
jmp 0x402744
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403500
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4036b6
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0x4036af
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0x403593
add ebp, dword [esp + 0xc]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov ebx, dword [esp + 0x10]
sub ebx, esi
mov esi, 0x15b0
je 0x4036af
xor edx, edx
cmp esi, 8
mov dword [esp + 4], esi
jb 0x403614
and esi, 0x1ff8
mov dword [esp], esi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx edi, byte [ebp + eax + 1]
add edi, edx
mov edx, ecx
and edx, edi
xor ecx, edi
movzx esi, byte [ebp + eax + 2]
add esi, edi
movzx edi, byte [ebp + eax + 3]
add edi, esi
add esi, ecx
lea ecx, [esi + edx*2]
movzx edx, byte [ebp + eax + 4]
add edx, edi
add ecx, edi
movzx esi, byte [ebp + eax + 5]
add esi, edx
add ecx, edx
movzx edx, byte [ebp + eax + 6]
add edx, esi
add ecx, esi
mov esi, dword [esp + 4]
movzx edi, byte [ebp + eax + 7]
add edi, edx
add ecx, edx
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, esi
jb 0x4035b0
add ebp, edx
mov edx, dword [esp]
mov eax, esi
sub eax, edx
mov dword [esp + 0x10], ebx
jbe 0x403558
mov dword [esp], edx
not edx
add edx, esi
mov dword [esp + 8], edx
and esi, 3
mov dword [esp + 0xc], eax
je 0x403663
neg esi
xor edx, edx
mov ebx, ebp
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0x403640
mov eax, dword [esp]
sub eax, edx
mov edx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x403550
jmp 0x403675
mov ebx, ebp
mov eax, dword [esp + 8]
mov edx, dword [esp]
cmp eax, 3
jb 0x403550
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x403680
jmp 0x403550
shl ecx, 0x10
or ecx, edi
jmp 0x4036bb
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4036d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40372a
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x40372c
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43ca18]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
add edi, ebp
add ebx, ebx
sub edi, ebx
xor eax, dword [edi*4 + 0x43ca18]
inc esi
cmp edx, esi
jne 0x4036f0
not eax
jmp 0x40372c
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4095e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x40970a
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x40961d
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x409641
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x409610
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x409610
lea esi, [ebx + 1]
push esi
call fcn.00408da0
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x409718
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x409688
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x40971a
movzx edx, word [edi]
test dx, dx
je 0x40971a
cmp dx, 0x7f
jbe 0x409670
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp ecx, 2
jb 0x4096d0
cmp esi, 0x7ff
ja 0x4096d0
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x409677
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x409677
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x409677
push 1
call fcn.00408da0
add esp, 4
mov ebp, eax
jmp 0x40971a
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x409737
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x409732
test eax, eax
jne 0x409730
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.004058c0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x415190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x4151b0
mov edi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4151d0
sar esi, 1
sar eax, 1
lea ecx, [esi + eax]
add ecx, 2
test ecx, ecx
jns 0x4151f0
mov eax, 0xffffffff
jmp 0x4151f7
add eax, esi
add eax, eax
add eax, 4
push eax
call fcn.00408da0
add esp, 4
movzx ecx, word [edi]
mov ebx, eax
test cx, cx
je 0x415221
add edi, 2
mov ebx, eax
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x415210
mov word [ebx], 0x5c
add ebx, 2
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x415251
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415240
mov word [ebx], 0
lea ecx, [esp + 0xc]
push 0x60
push 3
push 0x120089
push ecx
mov dword [esp + 0x34], eax
push eax
call fcn.0043aa20
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x441808]
Function at 0x415510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x415530
sar esi, 1
lea edi, [esp + 0x80]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x447498]
mov ebx, dword [esp + 0x80]
test ebx, ebx
jns 0x415565
mov eax, 0xffffffff
jmp 0x415568
lea eax, [ebx + ebx]
push eax
call fcn.00408da0
add esp, 4
push edi
push ebx
mov dword [esp + 0x54], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x447498]
mov dword [esp + 0x18], 0xf33ecd30
mov dword [esp + 0x1c], 0xf761f111
mov dword [esp + 0x20], 0xfbdaf560
mov dword [esp + 0x24], 0xff1bf902
mov dword [esp + 0x28], 0xe375fd6a
mov dword [esp + 0x2c], 0xe775e109
mov dword [esp + 0x30], 0xebeae576
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0xb8], 0
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x27
ja 0x415652
nop
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0xb8]
movzx edx, byte [esp + edx + 0x18]
lea esi, [ecx + 0x1082ab1e]
lea edi, [ecx + 0x1e]
mov ebx, esi
and ebx, edi
and ebx, edx
xor esi, edi
and esi, edx
add ecx, edx
add ecx, 0x1082ab1e
lea edx, [esi + ebx*2]
sub ecx, edx
mov dword [esp + 0x90], ecx
mov ecx, dword [esp + 0x90]
add cl, 0x2e
mov edx, dword [esp + 0xb8]
mov byte [esp + edx + 0x18], cl
inc dword [esp + 0xb8]
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x28
jb 0x4155f0
lea edi, [esp + 0xb8]
lea edx, [esp + 0x18]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xd4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x80]
mov ecx, eax
add ecx, 0xd
jns 0x41568b
mov eax, 0xffffffff
jmp 0x415690
add eax, eax
add eax, 0x1a
push eax
call fcn.00408da0
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x4c]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x4156d1
mov eax, dword [esp + 0x4c]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4156c0
mov word [eax], 0
movzx ecx, word [esp + 0xb8]
test cx, cx
mov ebx, dword [ebp + 0xc]
je 0x415701
lea edx, [esp + 0xba]
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4156f0
mov word [eax], 0
lea eax, [esp + 0x10]
push 0x60
push 3
push 0x120089
push eax
mov dword [esp + 0x18], esi
push esi
call fcn.0043aa20
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x441a50]

Function at 0x4168c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe8
xor eax, eax
cmp dword [ebp + 0x10], 0
setne al
xor ebx, ebx
mov dword [esp], 0
xor ecx, ecx
jmp dword [eax*4 + 0x441b60]
Function at 0x41de90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0x73336d49
mov dword [esp + 0x14], 0x77067100
mov dword [esp + 0x18], 0x7b1b7530
mov dword [esp + 0x1c], 0x7f1f790c
mov dword [esp + 0x20], 0x83de7d59
mov dword [esp + 0x24], 0x87ee81d4
mov dword [esp + 0x28], 0x8bf885f1
mov dword [esp + 0x2c], 0x8feb89ec
mov dword [esp + 0x30], 0x93f48dfa
mov dword [esp + 0x34], 0x97e091f9
mov dword [esp + 0x38], 0x9bc695f0
mov dword [esp + 0x3c], 0x9fe899c8
mov dword [esp + 0x40], 0xa3c89def
mov dword [esp + 0x44], 0xa7caa1c9
mov dword [esp + 0x48], 0xabdda5c1
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0xa9a8
mov dword [esp + 0x4e], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x41
ja 0x41df86
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
add ecx, 0x6a7f09ee
mov esi, ecx
and esi, edx
mov edi, ecx
xor edi, edx
or ecx, edx
xor ecx, edi
lea edx, [edi + esi*2]
add ecx, esi
sub edx, ecx
mov dword [esp + 0x5c], edx
mov ecx, dword [esp + 0x5c]
add cl, 0x7e
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x42
jb 0x41df40
lea ebx, [esp + 0x5c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x447498]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x41dfcf
mov eax, 0xffffffff
jmp 0x41dfd2
lea eax, [edi + edi]
push eax
call fcn.00408da0
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x1e
push ebx
push 0
call dword [0x447498]
mov dword [esp + 0x10], 0x33aa3144
mov dword [esp + 0x14], 0x37a835a1
mov dword [esp + 0x18], 0x2b4f294c
mov dword [esp + 0x1c], 0x2f4c2dbe
mov dword [esp + 0x20], 0x23b021b9
mov dword [esp + 0x24], 0x27262540
mov word [esp + 0x28], 0
mov byte [esp + 0x2a], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1a
ja 0x41e07d
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax - 0x76e37558]
add eax, 0xa8
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0x68
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1b
jb 0x41e040
push 0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.00417e80
add esp, 0x14
mov ebx, eax
jmp dword [0x442a7c]
Function at 0x433c30
Capabilities:
Encode data using xor
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x14], 0xc3d2e1f0
mov dword [esp + 0x10], 0x10325476
mov dword [esp + 0xc], 0x98badcfe
mov dword [esp + 8], 0xefcdab89
mov dword [esp + 4], 0x67452301
cmp ebp, 0x40
jb 0x433ced
mov edi, ebp
shr edi, 6
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
add esi, 4
cmp esi, 0x40
jne 0x433c90
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.004347e0
add esp, 8
inc ebx
lea eax, [esi + ebp]
cmp ebx, edi
jne 0x433c80
add ebp, esi
mov eax, ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov ecx, ebp
and ecx, 0x3f
mov dword [esp], ecx
je 0x433de4
mov ecx, ebp
and ecx, 1
xor edi, edi
cmp dword [esp], 1
je 0x433dcd
mov dword [esp + 0x18], ecx
sub dword [esp], ecx
xor ebx, ebx
xor edi, edi
nop
movzx ebp, byte [eax + edi]
mov ecx, ebx
and cl, 0x10
shl ebp, cl
mov edx, edi
and edx, 0xfffffffc
xor ebp, dword [esp + edx + 0x1c]
mov dword [esp + edx + 0x1c], ebp
movzx esi, byte [eax + edi + 1]
or cl, 8
shl esi, cl
xor esi, ebp
mov dword [esp + edx + 0x1c], esi
add edi, 2
add ebx, 0x10
cmp dword [esp], edi
jne 0x433d90
add eax, edi
mov ebp, dword [esp + 0x74]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x433de4
movzx eax, byte [eax]
lea ecx, [edi*8]
shl eax, cl
and edi, 0xfffffffc
xor dword [esp + edi + 0x1c], eax
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x1c], eax
mov esi, dword [esp + 0x78]
mov eax, ebp
not eax
test al, 0x38
jne 0x433e35
lea edi, [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
call fcn.004347e0
add esp, 8
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x5c]
xor eax, eax
xor ecx, ecx
rep stosw word es:[edi], ax
mov dword [esp + 0x54], ebx
shr ebp, 0x1d
mov dword [esp + 0x58], ebp
lea eax, [esp + 0x1c]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.004347e0
add esp, 8
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret