joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406fe0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4071a6
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
movzx edi, si
shr esi, 0x10
test ebx, ebx
je 0x40719f
mov ecx, 0x5e6ea9af
mov eax, ebx
mul ecx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ecx, ebx
sub ecx, eax
jmp 0x407076
mov ecx, dword [esp + 8]
mov eax, ecx
sub eax, dword [esp]
add ebp, eax
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, esi
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub esi, eax
mov ebx, dword [esp + 0xc]
sub ebx, ecx
mov ecx, 0x15b0
je 0x40719f
xor edx, edx
cmp ecx, 8
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
jb 0x407110
and ecx, 0x1ff8
mov dword [esp], ecx
xor eax, eax
mov dword [esp + 4], ebp
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
movzx ebx, byte [ebp + eax]
add ebx, edi
movzx eax, byte [ebp + eax + 1]
add eax, ebx
movzx ecx, byte [ebp + edx + 2]
add ecx, eax
movzx edi, byte [ebp + edx + 3]
mov ebp, ecx
xor ebp, edi
and edi, ecx
lea edi, [edi*2]
add edi, ebp
mov ebp, dword [esp + 4]
add ebx, esi
add ebx, eax
add ebx, ecx
add ebx, edi
movzx eax, byte [ebp + edx + 4]
add eax, edi
add ebx, eax
movzx ecx, byte [ebp + edx + 5]
add ecx, eax
add ebx, ecx
movzx eax, byte [ebp + edx + 6]
add eax, ecx
mov ecx, dword [esp + 8]
add ebx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
mov esi, ebx
add esi, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, ecx
jb 0x4070a0
add ebp, eax
mov edx, dword [esp]
mov ebx, edx
sub ebx, ecx
jae 0x40703b
mov eax, ecx
and eax, 3
mov dword [esp], edx
je 0x407151
mov dword [esp + 4], ebx
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
movzx ecx, byte [edx]
inc edx
add edi, ecx
add esi, edi
dec ebx
cmp eax, ebx
jne 0x407130
mov eax, dword [esp]
sub eax, ebx
mov ebx, dword [esp + 4]
cmp ebx, 0xfffffffc
ja 0x407030
jmp 0x40715e
mov eax, edx
mov edx, ebp
cmp ebx, 0xfffffffc
ja 0x407030
mov ebx, dword [esp + 8]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + eax]
add ecx, edi
add esi, ecx
movzx edi, byte [edx + eax + 1]
add edi, ecx
add esi, edi
movzx ecx, byte [edx + eax + 2]
add ecx, edi
add esi, ecx
movzx edi, byte [edx + eax + 3]
add edi, ecx
add esi, edi
add eax, 4
cmp ebx, eax
jne 0x407170
jmp 0x407030
shl esi, 0x10
or esi, edi
jmp 0x4071ab
mov esi, 1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4071c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4071ee
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x40728c
not eax
test bl, 1
jne 0x4071f5
mov edx, ebx
cmp ebx, 1
jne 0x407226
jmp 0x40728a
xor eax, eax
jmp 0x40728c
lea edx, [ebx - 1]
mov esi, eax
shr esi, 4
movzx edi, byte [ecx]
xor eax, edi
and eax, 0xf
xor esi, dword [eax*4 + 0x446c50]
inc ecx
mov eax, esi
shr eax, 4
and esi, 0xf
shr edi, 4
xor edi, esi
xor eax, dword [edi*4 + 0x446c50]
cmp ebx, 1
je 0x40728a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
shr edi, 4
movzx ebx, byte [ecx + esi]
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x446c50]
mov eax, edi
shr eax, 4
and edi, 0xf
shr ebx, 4
xor ebx, edi
xor eax, dword [ebx*4 + 0x446c50]
mov edi, eax
shr edi, 4
movzx ebx, byte [ecx + esi + 1]
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x446c50]
mov eax, edi
shr eax, 4
and edi, 0xf
shr ebx, 4
xor ebx, edi
xor eax, dword [ebx*4 + 0x446c50]
add esi, 2
cmp edx, esi
jne 0x407230
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x40cd50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x40cdbc
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x40cd9e
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x40cda0
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 2
mov ebp, ebx
or ebx, 2
imul ebx, edx
xor edx, 2
and ebp, 0xfffffffd
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x40cd80
jmp 0x40cda0
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40cdba
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40cdbc
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d560
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
call fcn.00440130
test al, al
je 0x40d7c1
mov dword [esp], 0x1716f20d
mov byte [esp + 4], 0
mov eax, 0x11a1effa
mov ecx, 0xee5e1006
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x11a1effa]
lea esi, [edx + edx]
not esi
add esi, edx
and esi, 0x18139657
and edx, 0xffffffa8
or edx, esi
mov esi, ecx
or esi, 0x18139657
mov edi, ecx
xor edi, 0x8121017
mov ebx, ecx
or ebx, 0xe64c0008
and ebx, edi
add esi, eax
or esi, ebx
xor esi, edx
lea edx, [esi + esi]
and edx, 0xb0535fc2
xor esi, 0x5829afe1
mov edi, edx
and edi, esi
xor esi, edx
lea edx, [esi + edi*2]
inc dl
mov byte [esp + ecx + 0x11a1effa], dl
dec eax
inc ecx
cmp eax, 0x11a1eff5
jne 0x40d590
mov ecx, dword [esp]
mov eax, ecx
and eax, 0xff368126
mov edx, ecx
and edx, 0xc97ed9
or ecx, 0xc97ed9
imul ecx, edx
xor edx, 0xc97ed9
imul edx, eax
add ecx, edx
mov eax, ecx
shr eax, 7
xor eax, ecx
mov edx, eax
and edx, 0xb9fe1a8
mov ecx, eax
or ecx, 0xb9fe1a8
imul ecx, edx
xor edx, 0xb9fe1a8
mov dword [esp], 0x6f94e21d
mov word [esp + 4], 0
mov byte [esp + 6], 0
and eax, 0xf4601e57
imul eax, edx
mov edx, esp
mov esi, 0xbf8d6ea
nop
nop
nop
nop
movzx edi, byte [edx]
mov ebx, esi
or ebx, edi
lea ebp, [esi - 0xbf8d600]
and ebp, edi
not ebx
or ebx, ebp
mov edi, ebx
and edi, 1
or ebx, 1
add ebx, edi
add bl, 0x96
mov byte [edx], bl
inc edx
dec esi
cmp esi, 0xbf8d6e3
jne 0x40d660
add eax, ecx
cmp eax, dword [esp]
jne 0x40d78a
mov dword [esp], 0x49d94bd1
mov dword [esp + 4], 0x459447d4
mov dword [esp + 8], 0x41ca43df
mov dword [esp + 0xc], 0x7d5e7fdb
mov dword [esp + 0x10], 0x79e77bad
mov dword [esp + 0x14], 0x7778
mov byte [esp + 0x18], 0
mov eax, 0xd36748a9
mov ecx, 0xa6ce9152
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, eax
xor esi, 0x96
mov edx, ecx
and edx, 0xd2
sub edx, esi
xor dl, byte [esp + eax + 0x2c98b757]
add dl, 0xa1
mov byte [esp + eax + 0x2c98b757], dl
inc eax
add ecx, 2
cmp eax, 0xd36748c2
jne 0x40d6e0
mov dword [esp + 0x1c], 0x3fae39ab
mov dword [esp + 0x20], 0x23b03d99
mov dword [esp + 0x24], 0x2120
mov dword [esp + 0x28], 0
mov eax, 0xe4858b4a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x1b7a74d2]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0xd
xor ecx, 0x8d
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax + 0x1b7a74d2], cl
inc eax
cmp eax, 0xe4858b5a
jne 0x40d740
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0
push eax
push 0x4483da
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00438740
test al, al
je 0x40d7bc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetInputState]
test eax, eax
je 0x40d7a9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e6e0
test al, al
je 0x40d7bc
call fcn.004110c0
call fcn.00410000
call fcn.00441520
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40e520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov bl, byte [ebp + 8]
call fcn.0040e6d0
sub esp, 8
push eax
test edi, edi
sets al
mov ecx, edi
sub ecx, 1
sete cl
or al, cl
mov ecx, edi
sub ecx, 0x25
setge cl
or al, cl
test al, 1
jne 0x40e557
jmp 0x40e55c
jmp 0x40e6c5
movzx eax, bl
mov ecx, 0x3203aa01
sub ecx, eax
add ecx, 0xcdfc55ff
mov edi, esi
mov ecx, dword [ebp + 0x10]
add edi, ecx
add edi, 0xffffffff
mov byte [esi + ecx - 1], 0
jmp 0x40e57d
cmp eax, 0
sete al
jmp 0x40e585
test al, 1
jne 0x40e58b
jmp 0x40e599
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], 0x30
jmp 0x40e6c5
mov eax, dword [ebp + 0x14]
cmp eax, 0xa
jne 0x40e642
jmp 0x40e5a7
movzx ecx, bl
cmp ecx, 0x64
jb 0x40e604
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
mov eax, edx
xor eax, 0xffffffff
and eax, 2
mov esi, edx
and esi, 0xfffffffd
imul esi, eax
mov eax, edx
and eax, 2
or edx, 2
imul edx, eax
add edx, esi
mov al, byte [edx + 0x447761]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov al, byte [edx + 0x447760]
add esi, 0xffffffff
mov byte [edi - 2], al
mov edi, 0x64
mov eax, ecx
xor edx, edx
div edi
mov ebx, eax
mov edi, esi
jmp 0x40e5a7
cmp ecx, 0xa
jae 0x40e61a
mov al, byte [ecx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x40e63d
shl ecx, 1
lea eax, [0x447760]
add eax, ecx
mov ecx, eax
add ecx, 1
jmp 0x40e62b
mov cl, byte [ecx]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], cl
mov al, byte [eax]
add esi, 0xffffffff
mov byte [edi - 2], al
jmp 0x40e6c5
cmp eax, 0x10
je 0x40e649
jmp 0x40e68c
movzx eax, bl
jmp 0x40e64e
cmp eax, 0x10
setl cl
test cl, 1
jne 0x40e65b
jmp 0x40e66c
mov al, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x40e6c5
shl eax, 1
mov cl, byte [eax + 0x44782a]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], cl
mov al, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
add esi, 0xffffffff
mov byte [edi - 2], al
jmp 0x40e6c5
movzx ecx, bl
cmp ecx, 0
seta al
test al, 1
jne 0x40e69b
jmp 0x40e6c1
mov eax, ecx
xor edx, edx
mov esi, dword [ebp + 0x14]
mov ebx, esi
div ebx
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov eax, ecx
xor edx, edx
div ebx
mov ebx, eax
mov edi, esi
jmp 0x40e68c
mov esi, edi
jmp 0x40e6c5
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f9d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
xor edx, edx
mov ecx, dword [0x44f7dc]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx], 0
lea edx, [edx + 2]
jne case.default.0x40fa8f
lea edi, [eax + edx]
add edi, 0xfffffffe
mov edx, eax
not edx
and edx, edi
add edx, edx
xor edi, eax
sub edx, edi
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449d40]
xor eax, eax
jmp 0x40fff5
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40fa50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
xor edx, edx
mov ecx, dword [0x44f7dc]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx], 0
lea edx, [edx + 2]
jne case.default.0x40fa8f
lea edi, [eax + edx]
add edi, 0xfffffffe
mov edx, eax
not edx
and edx, edi
add edx, edx
xor edi, eax
sub edx, edi
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449d40]
xor eax, eax
jmp 0x40fff5
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x410010
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x434
mov dword [esp + 0x34], 0x79eb7b0f
mov dword [esp + 0x38], 0x65f167fe
mov dword [esp + 0x3c], 0x61f663f0
mov dword [esp + 0x40], 0x6d3f6f0f
mov dword [esp + 0x44], 0x69386b37
mov dword [esp + 0x48], 0x95b69738
mov dword [esp + 0x4c], 0x91eb93bc
mov dword [esp + 0x50], 0x9d0c9f07
mov dword [esp + 0x54], 0x990b9bf0
mov dword [esp + 0x58], 0x851b8701
mov dword [esp + 0x5c], 0x81f083a4
mov dword [esp + 0x60], 0x8dae8ffc
mov dword [esp + 0x64], 0x89da8bd3
mov dword [esp + 0x68], 0xb5e6b7da
mov dword [esp + 0x6c], 0xb192b3f1
mov dword [esp + 0x70], 0xbd29bfc9
mov dword [esp + 0x74], 0xb9e0bb2e
mov dword [esp + 0x78], 0xa5e3a7e4
mov dword [esp + 0x7c], 0xa13aa384
mov dword [esp + 0x80], 0xadf2affa
mov dword [esp + 0x84], 0xa98aabfb
mov dword [esp + 0x88], 0xd546d7e7
mov dword [esp + 0x8c], 0xd146d344
mov dword [esp + 0x90], 0xdda7dfbb
mov dword [esp + 0x94], 0xd9b4dbb7
mov dword [esp + 0x98], 0xc551c7ad
mov dword [esp + 0x9c], 0xc193c358
mov dword [esp + 0xa0], 0xcd93cf9b
mov dword [esp + 0xa4], 0xc998cb95
mov dword [esp + 0xa8], 0xf5acf795
mov dword [esp + 0xac], 0xf1daf3d4
mov dword [esp + 0xb0], 0xfdb6ff85
mov dword [esp + 0xb4], 0xf989fb80
mov dword [esp + 0xb8], 0xe5b2e78c
mov dword [esp + 0xbc], 0xe176e3c4
mov dword [esp + 0xc0], 0xed7bef77
mov dword [esp + 0xc4], 0xe9caeb87
mov dword [esp + 0xc8], 0x157d17a1
mov dword [esp + 0xcc], 0x11871379
mov dword [esp + 0xd0], 0x1d491f81
mov dword [esp + 0xd4], 0x19571b3c
mov dword [esp + 0xd8], 0x5980770
mov dword [esp + 0xdc], 0x1910395
mov dword [esp + 0xe0], 0xd5f0f6b
mov dword [esp + 0xe4], 0x9550b53
mov dword [esp + 0xe8], 0x3564374f
mov dword [esp + 0xec], 0x31603364
mov dword [esp + 0xf0], 0x3d6c3f60
mov dword [esp + 0xf4], 0x391a3b6c
mov dword [esp + 0xf8], 0x25492745
mov dword [esp + 0xfc], 0x214d234e
mov dword [esp + 0x100], 0x2db92fbe
mov dword [esp + 0x104], 0x29712b7d
mov dword [esp + 0x108], 0x550f5775
mov dword [esp + 0x10c], 0x510f5306
mov dword [esp + 0x110], 0x5d5e5f0a
mov dword [esp + 0x114], 0
mov eax, dword [0x44f7d0]
mov dword [esp], eax
xor edi, edi
xor esi, esi
movzx ebx, byte [esp + esi + 0x34]
mov ecx, edi
and ecx, 0xb2
mov edx, esi
xor edx, 0xbf9e4159
lea eax, [ecx + edx]
add eax, 0x12
mov ebp, eax
and ebp, ebx
add ecx, edx
add ecx, 0x4711b312
or ecx, ebx
not ecx
or ecx, ebp
and ecx, eax
add ecx, ecx
sub eax, ecx
add al, bl
add al, 0xe9
mov byte [esp + esi + 0x34], al
inc esi
add edi, 2
cmp esi, 0xe4
jne 0x410260
lea eax, [esp + 0x34]
push 0
push 0
push 0
push 0
push eax
call dword [esp + 0x14]
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x449db0]
mov ecx, 0x5e006ab5
xor ecx, dword [0x449db8]
add eax, ecx
inc eax
jmp eax
Function at 0x4108c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24c
mov dword [esp + 0x4c], 0x39ab3b8f
mov dword [esp + 0x50], 0x25b127be
mov dword [esp + 0x54], 0x21b623b0
mov dword [esp + 0x58], 0x2d7f2f8f
mov dword [esp + 0x5c], 0x29782b77
mov dword [esp + 0x60], 0x15761778
mov dword [esp + 0x64], 0x11ab137c
mov dword [esp + 0x68], 0x1d8c1f87
mov dword [esp + 0x6c], 0x198b1bb0
mov dword [esp + 0x70], 0x59b0781
mov dword [esp + 0x74], 0x1b00364
mov dword [esp + 0x78], 0xd6e0fbc
mov dword [esp + 0x7c], 0x95a0b53
mov dword [esp + 0x80], 0x7526775a
mov dword [esp + 0x84], 0x71127331
mov dword [esp + 0x88], 0x7de97fc9
mov dword [esp + 0x8c], 0x79207bee
mov dword [esp + 0x90], 0x65236724
mov dword [esp + 0x94], 0x61fa6304
mov dword [esp + 0x98], 0x6d326f3a
mov dword [esp + 0x9c], 0x690a6b3b
mov dword [esp + 0xa0], 0x55c65727
mov dword [esp + 0xa4], 0x51c653c4
mov dword [esp + 0xa8], 0x5de75ffb
mov dword [esp + 0xac], 0x59f45bf7
mov dword [esp + 0xb0], 0x45d147ed
mov dword [esp + 0xb4], 0x411343d8
mov dword [esp + 0xb8], 0x4d134f1b
mov dword [esp + 0xbc], 0x49184b15
mov dword [esp + 0xc0], 0xb5ecb715
mov dword [esp + 0xc4], 0xb1dab3d4
mov dword [esp + 0xc8], 0xbdf6bf05
mov dword [esp + 0xcc], 0xb909bb00
mov dword [esp + 0xd0], 0xa5f2a70c
mov dword [esp + 0xd4], 0xa136a3c4
mov dword [esp + 0xd8], 0xad3baf37
mov dword [esp + 0xdc], 0xa9caab07
mov dword [esp + 0xe0], 0x953d97e1
mov dword [esp + 0xe4], 0x91079339
mov dword [esp + 0xe8], 0x9dc99f01
mov dword [esp + 0xec], 0x99d79bfc
mov dword [esp + 0xf0], 0x85188730
mov dword [esp + 0xf4], 0x81118315
mov dword [esp + 0xf8], 0x8ddf8f2b
mov dword [esp + 0xfc], 0x89d58bd3
mov dword [esp + 0x100], 0xf5a4f7cf
mov dword [esp + 0x104], 0xf1a0f3a4
mov dword [esp + 0x108], 0xfdacffa0
mov dword [esp + 0x10c], 0xf99afbac
mov dword [esp + 0x110], 0xe549e745
mov dword [esp + 0x114], 0xe14de34e
mov dword [esp + 0x118], 0xed79ef7e
mov dword [esp + 0x11c], 0xe9b1ebbd
mov dword [esp + 0x120], 0xd58fd7b5
mov dword [esp + 0x124], 0xd18fd386
mov dword [esp + 0x128], 0xdddedf8a
mov word [esp + 0x12c], 0
mov eax, dword [0x44f7d0]
xor ecx, ecx
xor edx, edx
nop
nop
mov esi, edx
xor esi, 0xf5
mov ebx, ecx
and ebx, 0x14
sub ebx, esi
xor bl, byte [esp + edx + 0x4c]
add bl, 0xc9
mov byte [esp + edx + 0x4c], bl
inc edx
add ecx, 2
cmp edx, 0xe2
jne 0x410b20
lea ecx, [esp + 0x4c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov edi, eax
xor eax, eax
test edi, edi
setne al
mov eax, dword [eax*4 + 0x449f7c]
mov ecx, 0x516b2ed5
xor ecx, dword [0x449f84]
add eax, ecx
inc eax
jmp eax

Function at 0x4110c0
Capabilities:
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x44a738]
Function at 0x41d410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1118
call fcn.0040cdd0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
xor ecx, ecx
nop
nop
nop
nop
nop
cmp word [eax + ecx], 0
lea ecx, [ecx + 2]
jne 0x41d430
lea edx, [eax + ecx]
add edx, 0xfffffffe
add ecx, eax
mov edi, 1
sub edi, ecx
and edi, eax
mov esi, eax
not esi
and esi, edx
sub esi, edi
sar esi, 1
lea ecx, [esp + 0x3c]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x450b14]
mov ebx, dword [esp + 0x3c]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41d47c
mov eax, 0xffffffff
jmp 0x41d47f
lea eax, [ebx + ebx]
push eax
call fcn.0040ce70
add esp, 4
lea ecx, [esp + 0x3c]
push ecx
push ebx
mov dword [esp + 0x2c], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x450b14]
mov eax, dword [esp + 0x3c]
mov ecx, eax
add ecx, 0xd
js 0x41d4b4
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040ce70
add esp, 4
mov ebx, eax
mov dword [esp + 0x114], 0xf1c20fb0
mov dword [esp + 0x118], 0xf567f353
mov dword [esp + 0x11c], 0xf916f760
mov dword [esp + 0x120], 0xfd5dfb4e
mov dword [esp + 0x124], 0xe16bff6e
mov dword [esp + 0x128], 0xe573e34b
mov dword [esp + 0x12c], 0xe9e6e74a
mov dword [esp + 0x130], 0
mov eax, 0x7ee947d
mov ecx, 0x38116b82
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x7ee9369]
mov edi, ecx
and edi, 0x3811630c
mov edx, eax
and edx, 0x40490f3
or edx, edi
mov edi, esi
xor edi, 0x3ea040c
xor esi, 0x40490f3
or edi, edx
not edx
or edx, esi
and edx, edi
mov esi, edx
not esi
and edx, 0x8e
and esi, 0x71
sub edx, esi
mov byte [esp + eax - 0x7ee9369], dl
inc eax
dec ecx
cmp eax, 0x7ee949d
jne 0x41d530
mov edx, dword [esp + 0x24]
movzx ecx, word [edx]
mov eax, ebx
test cx, cx
je 0x41d5b1
add edx, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d5a0
mov word [eax], 0
movzx ecx, word [esp + 0x114]
test cx, cx
je 0x41d5e1
lea edx, [esp + 0x116]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d5d0
mov word [eax], 0
lea eax, [esp + 0xa8]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00444880
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b704]
Function at 0x425860
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x425870
cmp eax, 0xffffffed
jge 0x425887
mov eax, 0xffffffff
jmp 0x42588a
add eax, 0x12
push eax
call fcn.0040ce70
add esp, 4
mov dword [esp], eax
mov dword [esp + 4], 0xf710964
mov dword [esp + 8], 0x38b0d69
mov dword [esp + 0xc], 0x7340134
mov dword [esp + 0x10], 0x1b7c0560
mov word [esp + 0x14], 0x1918
mov dword [esp + 0x16], 0
mov eax, 0x7e7ce102
mov ecx, 0x1831efd
nop
movzx ebx, byte [esp + eax - 0x7e7ce0fe]
lea ebp, [ecx - 0x1800000]
and ebp, 0x30cf9
mov edx, eax
and edx, 0x44c2006
or edx, ebp
xor edx, ebx
xor edx, 0x5cc3206
and edx, eax
mov ebp, edx
and ebp, 2
mov esi, edx
or edx, 2
imul edx, ebp
xor ebp, 2
and esi, 0x44c203d
imul esi, ebp
add edx, esi
mov esi, edx
xor esi, eax
and edx, ecx
add edx, edx
sub edx, esi
mov esi, edx
xor esi, ebx
not edx
and edx, ebx
add edx, edx
sub edx, esi
add edx, 0x878f9af5
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + eax - 0x7e7ce0fe], dl
inc eax
dec ecx
cmp eax, 0x7e7ce118
jne 0x4258d0
movzx ecx, word [edi]
mov esi, dword [esp]
mov eax, esi
test cx, cx
je 0x425971
add edi, 2
mov eax, esi
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x425960
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x4259a1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425990
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.00444a20
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x44bca8]

Function at 0x4259e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov ebp, dword [esp + 0x5c]
mov ebx, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
movzx eax, byte [esp + 0x60]
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x30], al
test ebp, ebp
setg cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44bd84]