joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405930
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
cmp dword [esp + 0x2c], 0
je 0x405b31
mov esi, dword [esp + 0x30]
test esi, esi
je 0x405b31
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x405b31
cmp dword [ecx], 0
jne 0x405b31
push esi
call fcn.0040cc20
add esp, 4
test eax, eax
je 0x4059a4
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x4059ab
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ebx, [ebx + ecx*2]
mov ecx, edi
cmp ebx, eax
jb 0x405980
jmp 0x4059ad
mov edi, 0x1505
jmp 0x4059ad
mov edi, ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x20]
test edx, edx
je 0x405a7b
mov dword [esp + 4], eax
mov eax, edx
xor eax, 1
mov esi, edx
and esi, 0xfffffffe
add esi, esi
sub esi, eax
and esi, edi
mov dword [esp + 0x10], esi
lea eax, [edx - 1]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
xor ebx, ebx
mov dword [esp], edx
jmp 0x4059ff
mov eax, ebx
xor eax, 1
and ebx, 1
lea ebx, [eax + ebx*2]
cmp ebx, edx
jae 0x405a7b
mov eax, dword [esp + 0x10]
lea ebp, [ebx + eax]
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x405a80
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x4059f0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
call fcn.0040cc20
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4059f0
push dword [esp + 4]
push ebp
push dword [esp + 0x38]
call fcn.0040cc40
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x4059f0
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.004049a0
mov edx, dword [esp + 0x30]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x34]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405b24
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405ac0
call fcn.00405c20
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x30]
jne 0x405b31
push esi
call fcn.0040cc20
add esp, 4
mov edx, esi
lea esi, [esp + 0x14]
mov ecx, dword [esp + 0x2c]
push esi
push edi
push eax
call fcn.00405b40
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x30]
push esi
call fcn.0040cc20
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x44a008]
add esp, 4
test eax, eax
je 0x405b2c
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040ca30
add esp, 0xc
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x34]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405b31
mov eax, 0xffffffff
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406c70
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406e26
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406e1f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x406d05
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov ebx, 0x15b0
je 0x406e1f
xor edx, edx
cmp ebx, 8
mov dword [esp], ebx
mov dword [esp + 8], esi
jb 0x406d82
and ebx, 0x1ff8
mov dword [esp + 4], ebx
xor edx, edx
nop
mov ebx, edx
add edx, 8
movzx eax, byte [ebp + ebx]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + ebx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + ebx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + ebx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + ebx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + ebx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + ebx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + ebx + 7]
add edi, eax
add ecx, edi
add ebx, 0xf
cmp ebx, dword [esp]
mov ebx, dword [esp]
jb 0x406d20
add ebp, edx
mov esi, dword [esp + 8]
mov edx, dword [esp + 4]
mov eax, edx
sub eax, ebx
jae 0x406ccd
mov dword [esp + 0xc], eax
mov eax, ebx
and eax, 3
mov dword [esp + 4], edx
je 0x406dd0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406db0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406cc0
jmp 0x406ddf
mov eax, edx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406cc0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406df0
jmp 0x406cc0
shl ecx, 0x10
or ecx, edi
jmp 0x406e2b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406e40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x406e6e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x406f0c
not eax
test bl, 1
jne 0x406e75
mov edx, ebx
cmp ebx, 1
jne 0x406ea6
jmp 0x406f0a
xor eax, eax
jmp 0x406f0c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x447c50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x447c50]
cmp ebx, 1
je 0x406f0a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x447c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x447c50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x447c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x447c50]
add esi, 2
cmp edx, esi
jne 0x406eb0
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x40c8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, edx
mov eax, dword [esp + 0x14]
mov edx, dword [edx + 8]
mov esi, 1
cmp edx, eax
jae 0x40c950
cmp dword [esp + 0x18], 0
je 0x40c92e
cmp edx, 1
adc edx, 0
cmp edx, eax
jae 0x40c932
mov ebx, edx
nop
nop
nop
nop
nop
nop
nop
mov ebp, edx
or ebp, 2
and ebx, 2
imul ebp, ebx
and edx, 0xfffffffd
xor ebx, 2
imul ebx, edx
add ebx, ebp
mov edx, ebx
cmp ebx, eax
jb 0x40c910
jmp 0x40c934
mov ebx, eax
jmp 0x40c934
mov ebx, edx
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40c94e
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40c950
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d1e0
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebx
push edi
push esi
sub esp, 0x2c
call fcn.004418e0
test al, al
je 0x40d434
mov dword [esp], 0x393a022f
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, esp
mov ecx, 0x74
nop
nop
nop
movzx esi, byte [eax]
lea edx, [ecx - 0x63502a00]
or edx, esi
and esi, ecx
not edx
or edx, esi
lea esi, [edx + 0x54]
mov edi, 0xb
sub edi, edx
and edi, 0xc
and esi, 0xf2
sub esi, edi
and edx, 1
or edx, esi
inc dl
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x6d
jne 0x40d210
mov ecx, dword [esp]
mov eax, ecx
and eax, 0xff368126
mov edx, ecx
and edx, 0xc97ed9
or ecx, 0xc97ed9
imul ecx, edx
xor edx, 0xc97ed9
imul edx, eax
add ecx, edx
mov eax, ecx
shr eax, 7
xor eax, ecx
mov edx, eax
xor edx, 0xb9fe1a8
mov ecx, eax
or ecx, 0xf4601e57
and ecx, edx
mov edx, eax
and edx, 0xb9fe1a8
or eax, 0xb9fe1a8
imul eax, edx
xor edx, 0xb9fe1a8
mov esi, ecx
not esi
and esi, edx
imul esi, ecx
or edx, ecx
add eax, esi
mov dword [esp], 0x7d48facf
mov byte [esp + 4], 0
and ecx, 0xb9fe1a8
imul ecx, edx
xor edx, edx
mov esi, 0x17
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, esi
and edi, 0x16
mov ebx, edx
and ebx, 1
or ebx, edi
xor bl, byte [esp + edx]
xor bl, 0xfe
add bl, 0x78
mov byte [esp + edx], bl
inc edx
dec esi
cmp edx, 5
jne 0x40d2d0
add eax, ecx
cmp eax, dword [esp]
jne 0x40d3fd
mov dword [esp], 0x77c379c7
mov dword [esp + 4], 0x738075c8
mov dword [esp + 8], 0x4fc671cd
mov dword [esp + 0xc], 0x4baa4df1
mov dword [esp + 0x10], 0x47f949bb
mov dword [esp + 0x14], 0x4544
mov byte [esp + 0x18], 0
mov eax, 0x3441e496
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x3441e496]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x12
mov byte [esp + eax - 0x3441e496], cl
inc eax
cmp eax, 0x3441e4af
jne 0x40d340
mov dword [esp + 0x1c], 0x81368735
mov dword [esp + 0x20], 0x8d34832f
mov dword [esp + 0x24], 0x8f8c
mov byte [esp + 0x28], 0
mov eax, 0x5211f8ca
mov ecx, 0xa423f194
nop
nop
movzx edx, byte [esp + eax - 0x5211f8ae]
mov esi, edx
not esi
mov edi, eax
xor edi, 0x3d73a629
mov ebx, ecx
and ebx, 0x8400b1ac
sub ebx, edi
and esi, 0xf
xor edx, 0xf
or edx, esi
xor edx, ebx
xor edx, 0xf
add edx, 0xb64e3278
mov esi, edx
and esi, 0x5a
xor edx, 0xda
lea edx, [edx + esi*2]
add dl, 0x89
mov byte [esp + eax - 0x5211f8ae], dl
inc eax
add ecx, 2
cmp eax, 0x5211f8d7
jne 0x40d390
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0
push eax
push 0x4493da
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00439450
test al, al
je 0x40d42f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetInputState]
test eax, eax
je 0x40d41c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e390
test al, al
je 0x40d42f
call fcn.00410d90
call fcn.0040fc60
call fcn.00442880
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d710
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov edx, dword [esp + 0x78]
mov esi, dword [esp + 0x74]
mov dword [esp + 0x14], ecx
mov ecx, dword [ecx + 0x60]
mov word [esp], 0xcbcd
mov byte [esp + 2], 0xc2
mov word [esp + 3], 0
mov byte [esp + 5], 0
xor ebx, ebx
nop
mov eax, ebx
add al, 0x50
xor al, byte [esp + ebx]
add al, 0x70
mov byte [esp + ebx], al
inc ebx
cmp ebx, 6
jne 0x40d740
mov dword [esp + 8], 0x1a241802
mov word [esp + 0xc], 0x2f26
mov dword [esp + 0xe], 0
mov byte [esp + 0x12], 0
xor ebx, ebx
movzx eax, byte [esp + ebx + 8]
lea edi, [ebx - 0x530993c9]
mov ebp, 0xc8
sub ebp, ebx
xor ebp, edi
and ebp, eax
xor ebp, edi
mov eax, ebp
not eax
or eax, 0x1f2fe2ec
add eax, ebp
xor ebp, 0x9f2fe2ec
lea eax, [eax*2 + 2]
add eax, ebp
mov edi, eax
not edi
and edi, 0xd7
and eax, 0x28
sub eax, edi
add al, 0xd8
mov byte [esp + ebx + 8], al
mov eax, ebx
xor eax, 1
and ebx, 1
lea ebx, [eax + ebx*2]
cmp ebx, 0xb
jb 0x40d770
mov dword [esp + 0x18], 0xfef0c4c5
mov dword [esp + 0x1c], 0xf2f2c0c4
mov dword [esp + 0x20], 0xf78af0c5
mov dword [esp + 0x24], 0xeaefe693
mov dword [esp + 0x28], 0xd2ef9392
mov dword [esp + 0x2c], 0x98cd0739
mov dword [esp + 0x30], 0x9de7959e
mov dword [esp + 0x34], 0xdefae0a8
mov dword [esp + 0x38], 0xa0a5a1a3
mov dword [esp + 0x3c], 0xa8d7a1d5
mov dword [esp + 0x40], 0xd51ae3ae
mov dword [esp + 0x44], 0xf2b3b7b3
mov dword [esp + 0x48], 0xc2bec0cc
mov dword [esp + 0x4c], 0xceb80df7
mov dword [esp + 0x50], 0x9efc4bd
mov byte [esp + 0x54], 0xd4
mov dword [esp + 0x55], 0
xor ebx, ebx
nop
nop
mov eax, ebx
add al, 0x44
xor al, byte [esp + ebx + 0x18]
add al, 0xac
mov byte [esp + ebx + 0x18], al
inc ebx
cmp ebx, 0x41
jne 0x40d850
mov eax, dword [esp + 0x70]
add eax, ecx
movzx ebx, byte [esp + 0x18]
mov edi, eax
test bl, bl
je 0x40d88c
lea ebp, [esp + 0x19]
mov edi, eax
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [ebp]
inc ebp
test bl, bl
jne 0x40d880
mov byte [edi], 0
movzx ebx, byte [esi]
test bl, bl
je 0x40d8ab
inc esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40d8a0
mov byte [edi], 0
movzx ebx, byte [esp + 8]
test bl, bl
je 0x40d8cb
lea esi, [esp + 9]
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40d8c0
mov byte [edi], 0
movzx ebx, byte [edx]
test bl, bl
je 0x40d8eb
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], bl
inc edi
movzx ebx, byte [edx]
inc edx
test bl, bl
jne 0x40d8e0
mov byte [edi], 0
movzx edx, byte [esp]
test dl, dl
je 0x40d90b
lea esi, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], dl
inc edi
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x40d900
mov byte [edi], 0
sub edi, eax
mov eax, dword [esp + 0x14]
add dword [eax + 0x60], edi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40ee20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40f07b
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40ee5c
cmp edx, esi
jae 0x40f07b
test edi, edi
je 0x40f07b
movzx ebp, bl
test bl, bl
js 0x40ee90
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40ee50
jmp 0x40f07b
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40eec8
cmp bl, 0xc2
jb 0x40ee80
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40ef2a
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40ef7c
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40eef2
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40ef34
cmp ebp, 0xe0
jne 0x40ef3d
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40ee7c
jmp 0x40ef3d
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40f056
cmp bl, 0xf4
ja 0x40ee80
movzx ecx, byte [edx + 1]
je 0x40ef87
cmp ebp, 0xf0
jne 0x40ef90
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40ee7c
jmp 0x40ef90
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40ee82
cmp cl, 0x9f
ja 0x40ee7c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f05d
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f063
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40ee72
cmp cl, 0x8f
ja 0x40ee7c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f05d
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f063
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40f06f
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
shl ebp, 6
add ecx, ebp
add ecx, 0xffffe000
add edx, 4
mov ebp, dword [esp]
and ebp, 0x3f
or ebp, ecx
cmp ebp, 0x10000
jb 0x40ee7c
mov esi, ebp
xor esi, 0x7ff
mov ebx, ebp
or ebx, 0xfffff800
and ebx, esi
cmp ebx, 0xd800
je 0x40ee7c
cmp edi, 2
jb 0x40f056
add ecx, 0xf0000
shr ecx, 0xa
and ecx, 0x3ff
or ecx, 0xd800
mov word [eax], cx
and ebp, 0x3ff
or ebp, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], bp
jmp 0x40ee72
mov ecx, eax
jmp 0x40ee72
inc edx
jmp 0x40ee7c
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40ee82
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40ee82
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40fc70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov ebp, dword [esp + 0x468]
mov dword [esp + 0x3c], 0x299b2b77
mov dword [esp + 0x40], 0x2d812f96
mov dword [esp + 0x44], 0x319e3380
mov dword [esp + 0x48], 0x35473797
mov dword [esp + 0x4c], 0x39483b4f
mov dword [esp + 0x50], 0x3d5e3f48
mov dword [esp + 0x54], 0x15b0354
mov dword [esp + 0x58], 0x5b407af
mov dword [esp + 0x5c], 0x9bb0ba0
mov dword [esp + 0x60], 0xdbb0fb1
mov dword [esp + 0x64], 0x1140136c
mov dword [esp + 0x68], 0x15761744
mov dword [esp + 0x6c], 0x196a1b63
mov dword [esp + 0x70], 0x1d6e1f6a
mov dword [esp + 0x74], 0x61026361
mov dword [esp + 0x78], 0x65c96739
mov dword [esp + 0x7c], 0x69106bd6
mov dword [esp + 0x80], 0x6d136f1c
mov dword [esp + 0x84], 0x71ca730c
mov dword [esp + 0x88], 0x7502770a
mov dword [esp + 0x8c], 0x791a7b1b
mov dword [esp + 0x90], 0x7dce7f3f
mov dword [esp + 0x94], 0x41ee43cc
mov dword [esp + 0x98], 0x451f47eb
mov dword [esp + 0x9c], 0x49ec4bef
mov dword [esp + 0xa0], 0x4de14f05
mov dword [esp + 0xa4], 0x512353f8
mov dword [esp + 0xa8], 0x5523572b
mov dword [esp + 0xac], 0x59285b2d
mov dword [esp + 0xb0], 0x5d245f2d
mov dword [esp + 0xb4], 0xa1caa33c
mov dword [esp + 0xb8], 0xa5eea7ed
mov dword [esp + 0xbc], 0xa9f9abf0
mov dword [esp + 0xc0], 0xadc2afe4
mov dword [esp + 0xc4], 0xb11eb3cc
mov dword [esp + 0xc8], 0xb51bb71f
mov dword [esp + 0xcc], 0xb9dabb1f
mov dword [esp + 0xd0], 0xbd15bff1
mov dword [esp + 0xd4], 0x812f8319
mov dword [esp + 0xd8], 0x85e98731
mov dword [esp + 0xdc], 0x89cf8be4
mov dword [esp + 0xe0], 0x8d388f20
mov dword [esp + 0xe4], 0x9121933d
mov dword [esp + 0xe8], 0x95e7973b
mov dword [esp + 0xec], 0x99ed9be3
mov dword [esp + 0xf0], 0x9dec9fe7
mov dword [esp + 0xf4], 0xe190e3ec
mov dword [esp + 0xf8], 0xe594e790
mov dword [esp + 0xfc], 0xe98aeb94
mov dword [esp + 0x100], 0xed49efbd
mov dword [esp + 0x104], 0xf155f346
mov dword [esp + 0x108], 0xf559f746
mov dword [esp + 0x10c], 0xf981fb85
mov dword [esp + 0x110], 0xfd87ff8d
mov dword [esp + 0x114], 0xc1b7c38e
mov dword [esp + 0x118], 0xc5c6c7ba
mov dword [esp + 0x11c], 0
mov eax, dword [0x450c38]
mov ecx, 0xc6dbb107
mov edx, 0xf8
movzx esi, byte [esp + ecx + 0x39244f35]
mov edi, edx
xor edi, ecx
and edi, esi
xor edi, ecx
mov esi, edi
mov ebx, edi
xor ebx, 0xdc
add ebx, edi
and edi, 0xdc
and esi, 0x23
sub ebx, esi
add ebx, edi
inc bl
mov byte [esp + ecx + 0x39244f35], bl
inc ecx
dec edx
cmp ecx, 0xc6dbb1eb
jne 0x40fed0
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x44ae1c]
mov ecx, 0x68b3cd93
xor ecx, dword [0x44ae24]
add eax, ecx
inc eax
jmp eax
Function at 0x410560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov dword [esp + 0x38], 0x7fed7935
mov dword [esp + 0x3c], 0x630b7de2
mov dword [esp + 0x40], 0x670a610c
mov dword [esp + 0x44], 0x6b396505
mov dword [esp + 0x48], 0x6f3c693d
mov dword [esp + 0x4c], 0x93b26d3c
mov dword [esp + 0x50], 0x97ed91b8
mov dword [esp + 0x54], 0x9b0895fd
mov dword [esp + 0x58], 0x9f0d99fc
mov dword [esp + 0x5c], 0x83159d07
mov dword [esp + 0x60], 0x87f481a0
mov dword [esp + 0x64], 0x8baa85f0
mov dword [esp + 0x68], 0x8fde89d9
mov dword [esp + 0x6c], 0xb3e28dde
mov dword [esp + 0x70], 0xb796b1ef
mov dword [esp + 0x74], 0xbbd3b5cf
mov dword [esp + 0x78], 0xbfe4b92a
mov dword [esp + 0x7c], 0xa3fdbde8
mov dword [esp + 0x80], 0xa73ea180
mov dword [esp + 0x84], 0xabfea5fe
mov dword [esp + 0x88], 0xaf8ea981
mov dword [esp + 0x8c], 0xd342aded
mov dword [esp + 0x90], 0xd7bad140
mov dword [esp + 0x94], 0xdba1d5b1
mov dword [esp + 0x98], 0xdfb8d9bd
mov dword [esp + 0x9c], 0xc3abdd93
mov dword [esp + 0xa0], 0xc795c154
mov dword [esp + 0xa4], 0xcb9dc591
mov dword [esp + 0xa8], 0xcf9cc993
mov dword [esp + 0xac], 0xf3a8cd9b
mov dword [esp + 0xb0], 0xf7def1d0
mov dword [esp + 0xb4], 0xfbb2f5bb
mov dword [esp + 0xb8], 0xffb3f98c
mov dword [esp + 0xbc], 0xe3cefdb0
mov dword [esp + 0xc0], 0xe78ae1c0
mov dword [esp + 0xc4], 0xeb85e58d
mov dword [esp + 0xc8], 0xefcee98d
mov dword [esp + 0xcc], 0x1377eda7
mov dword [esp + 0xd0], 0x17791177
mov dword [esp + 0xd4], 0x1b331587
mov dword [esp + 0xd8], 0x1f591938
mov dword [esp + 0xdc], 0x3941d74
mov dword [esp + 0xe0], 0x76b0193
mov dword [esp + 0xe4], 0xb590561
mov dword [esp + 0xe8], 0xf5f0959
mov dword [esp + 0xec], 0x33600d55
mov dword [esp + 0xf0], 0x37643160
mov dword [esp + 0xf4], 0x3b683564
mov dword [esp + 0xf8], 0x3f1e3968
mov dword [esp + 0xfc], 0x23433d4b
mov dword [esp + 0x100], 0x2747214a
mov dword [esp + 0x104], 0x2b4325b2
mov dword [esp + 0x108], 0x2f7b297b
mov dword [esp + 0x10c], 0x53092d7b
mov dword [esp + 0x110], 0x57015102
mov dword [esp + 0x114], 0x5b5a550e
mov byte [esp + 0x11a], 0
mov word [esp + 0x118], 0
mov eax, dword [0x450c38]
mov ecx, 0xe949ab6a
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x16b654ce]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0xee
mov byte [esp + ecx + 0x16b654ce], dl
inc ecx
cmp ecx, 0xe949ac4d
jne 0x4107c0
lea esi, [esp + 0x38]
push 0
push 0
push 0
push 0
push esi
call eax
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x44afd4]
mov ecx, 0xc781f0
xor ecx, dword [0x44afdc]
add ecx, edx
inc ecx
jmp ecx
Function at 0x41cee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x10b8
call fcn.0040c960
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41cf00
sar esi, 1
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x451f7c]
mov ebx, dword [esp + 0x28]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41cf34
mov eax, 0xffffffff
jmp 0x41cf37
lea eax, [ebx + ebx]
push eax
call fcn.0040ca00
add esp, 4
lea ecx, [esp + 0x28]
push ecx
push ebx
mov dword [esp + 0x28], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x451f7c]
mov eax, dword [esp + 0x28]
mov ecx, eax
add ecx, 0xd
js 0x41cf6c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040ca00
add esp, 4
mov edi, eax
mov dword [esp + 0xb4], 0x51824f90
mov dword [esp + 0xb8], 0x55a753b3
mov dword [esp + 0xbc], 0x597657a0
mov dword [esp + 0xc0], 0x5dbd5b8e
mov dword [esp + 0xc4], 0x61ab5fae
mov dword [esp + 0xc8], 0x6593638b
mov dword [esp + 0xcc], 0x6966678a
mov dword [esp + 0xd0], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xd
xor cl, byte [esp + eax + 0xb4]
add cl, 0xbf
mov byte [esp + eax + 0xb4], cl
inc eax
cmp eax, 0x20
jne 0x41cfe0
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x41d031
mov eax, dword [esp + 0x20]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d020
mov word [eax], 0
movzx ecx, word [esp + 0xb4]
test cx, cx
je 0x41d061
lea edx, [esp + 0xb6]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d050
mov word [eax], 0
lea eax, [esp + 0x48]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.00445c90
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c804]
Function at 0x420360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov ebx, dword [ebp + 0x10]
push eax
sub esp, 0x30
mov dword [ebp - 0x1c], esp
sub esp, 0x18
mov dword [ebp - 0x14], esp
sub esp, 0x24
mov dword [ebp - 0x24], esp
sub esp, 0x24
mov dword [ebp - 0x30], esp
sub esp, 0x34
mov dword [ebp - 0x34], esp
sub esp, 0x1c
mov dword [ebp - 0x3c], esp
push eax
mov dword [ebp - 0x38], esp
xor eax, eax
test ebx, ebx
setne al
xor edi, edi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x10], 0
jmp dword [eax*4 + 0x44c9e4]