joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404dc0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x404ec4
mov esi, dword [esp + 0x28]
test esi, esi
je 0x404ec4
cmp dword [esp + 0x2c], 0
je 0x404ec4
push esi
call fcn.0040cb00
add esp, 4
test eax, eax
je 0x404e2a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x404e31
inc edi
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
mov ecx, ebx
cmp eax, edi
jne 0x404e10
jmp 0x404e33
mov ebx, 0x1505
jmp 0x404e33
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
mov esi, edi
sub esi, 1
jae 0x404ecc
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x404e89
call fcn.00405b60
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x404ec4
push ecx
call fcn.0040cb00
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
mov esi, edi
sub esi, 1
jae 0x404f50
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and esi, ebx
mov eax, edi
xor eax, 1
mov edx, edi
and edx, 0xfffffffe
add edx, edx
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404ef8
inc esi
dec edi
je 0x404e45
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404e4a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x404ef0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040cb00
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404ef0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040cb20
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404ef0
mov eax, 0xffffffff
jmp 0x404ec4
and esi, ebx
mov eax, edi
xor eax, 1
mov edx, edi
and edx, 0xfffffffe
add edx, edx
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404f78
inc esi
dec edi
je 0x404e84
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404e89
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x404f70
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040cb00
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404f70
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040cb20
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404f70
jmp 0x404e89
Function at 0x4058b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405a98
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405a98
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405a98
cmp dword [ecx], 0
jne 0x405a98
push esi
call fcn.0040cb00
add esp, 4
test eax, eax
je 0x40591a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405921
inc ebx
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
mov ecx, edi
cmp eax, ebx
jne 0x405900
jmp 0x405923
mov edi, 0x1505
jmp 0x405923
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
mov esi, edx
sub esi, 1
jae 0x4059ed
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x40597a
call fcn.00405b60
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405a98
push esi
call fcn.0040cb00
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405aa0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040cb00
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x447008]
add esp, 4
test eax, eax
je 0x405a93
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c910
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405a98
mov dword [esp], eax
and esi, edi
mov eax, edx
xor eax, 1
mov ebx, edx
and ebx, 0xfffffffe
add ebx, ebx
sub ebx, eax
mov dword [esp + 0xc], ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405a18
inc esi
dec edx
je 0x405935
mov ebp, esi
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ebx, dword [eax + ebp*4]
cmp ebx, 0xffffffff
je 0x40593a
mov eax, dword [ecx + 8]
cmp dword [eax + ebx*4], edi
jne 0x405a10
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + ebx*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040cb00
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405a10
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040cb20
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405a10
mov eax, dword [ecx + 0x10]
push dword [eax + ebx*4]
call fcn.00404970
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ebx*4], esi
jmp 0x4059e2
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406b30
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406cc6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406cbf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406bc5
mov eax, dword [esp]
sub eax, dword [esp + 0xc]
add ebp, eax
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406cbf
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 4], esi
jb 0x406c45
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
mov edi, esi
and edi, eax
xor esi, eax
lea eax, [esi + edi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406be0
add ebp, eax
mov esi, dword [esp + 4]
mov eax, ebx
sub eax, edx
jae 0x406b8d
mov dword [esp + 8], eax
mov esi, edx
and esi, 3
mov dword [esp + 0xc], ebx
mov eax, ebx
mov edx, ebp
je 0x406c7c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
movzx ebx, byte [edx]
add edi, ebx
add ecx, edi
inc edx
dec esi
jne 0x406c70
cmp dword [esp + 8], 0xfffffffc
ja 0x406b80
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406c90
jmp 0x406b80
shl ecx, 0x10
or ecx, edi
jmp 0x406ccb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406ce0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x406d0e
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
not ecx
test ebx, ebx
je 0x406daa
test bl, 1
jne 0x406d15
mov edx, ebx
cmp ebx, 1
jne 0x406d46
jmp 0x406daa
xor eax, eax
jmp 0x406db1
lea edx, [ebx - 1]
movzx esi, byte [eax]
mov edi, ecx
shr edi, 4
xor ecx, esi
and ecx, 0xf
xor edi, dword [ecx*4 + 0x444c50]
inc eax
mov ecx, edi
shr ecx, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor ecx, dword [esi*4 + 0x444c50]
cmp ebx, 1
je 0x406daa
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [eax + esi]
mov ebx, ecx
shr ebx, 4
xor ecx, edi
and ecx, 0xf
xor ebx, dword [ecx*4 + 0x444c50]
mov ecx, ebx
shr ecx, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor ecx, dword [edi*4 + 0x444c50]
movzx edi, byte [eax + esi + 1]
mov ebx, ecx
shr ebx, 4
xor ecx, edi
and ecx, 0xf
xor ebx, dword [ecx*4 + 0x444c50]
mov ecx, ebx
shr ecx, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor ecx, dword [edi*4 + 0x444c50]
add esi, 2
cmp edx, esi
jne 0x406d50
lea eax, [ecx + ecx]
not eax
add eax, ecx
pop esi
pop edi
pop ebx
ret
Function at 0x40d180
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebx
push edi
push esi
sub esp, 8
call fcn.0043d7d0
test al, al
je 0x40d23e
call fcn.00436a50
test al, al
je 0x40d239
mov dword [esp], 0x2bdb86d7
mov dword [esp + 4], 0
mov edx, 0x3dcca3b5
mov esi, 0xc2335c4a
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx - 0x3dcca3b5]
mov ebx, eax
mov edi, eax
xor ebx, edx
or ebx, esi
mov eax, ebx
or al, 0x42
inc al
mov ecx, ebx
shr cl, 1
and cl, 1
mul cl
mov ecx, eax
add cl, al
mov eax, edi
add cl, al
test bl, 2
sete al
not bl
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0x77
mov byte [esp + edx - 0x3dcca3b5], al
inc edx
dec esi
cmp edx, 0x3dcca3bd
jne 0x40d1c0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40d226
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e2c0
test al, al
je 0x40d239
call fcn.00410b50
call fcn.0040fc10
call fcn.0043ea40
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x404
mov dword [esp], ecx
mov esi, dword [esp + 0x418]
movzx ecx, word [esi]
lea ebp, [esp + 4]
test cx, cx
je 0x40d3d7
mov edx, 0x1ff
nop
nop
nop
nop
nop
nop
nop
movzx eax, cx
lea edi, [esi + 2]
cmp ax, 0x7f
ja 0x40d2f0
lea ecx, [ebp + 1]
mov byte [ebp], al
jmp 0x40d380
cmp eax, 0x7ff
ja 0x40d320
cmp edx, 2
jb 0x40d320
mov ecx, eax
shr ecx, 6
add cl, 0xc0
mov byte [ebp], cl
mov ebx, eax
not ebx
or ebx, 0x3f
add ebx, eax
add bl, 0x81
lea ecx, [ebp + 2]
mov byte [ebp + 1], bl
jmp 0x40d380
mov ecx, eax
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x40d39a
cmp edx, 4
jb 0x40d39a
shl eax, 0xa
movzx ecx, word [esi + 2]
add esi, 4
lea ebx, [eax + ecx]
add ebx, 0xfca02400
mov eax, ebx
shr eax, 0x12
add al, 0xf0
mov byte [ebp], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [ebp + 1], al
shr ebx, 6
and bl, 0x3f
or bl, 0x80
mov byte [ebp + 2], bl
mov al, 0x3f
sub al, cl
and al, 0x3f
xor al, 0xbf
lea ecx, [ebp + 4]
mov byte [ebp + 3], al
mov edi, esi
nop
nop
nop
nop
nop
nop
add edx, ebp
sub edx, ecx
mov esi, edi
mov ebp, ecx
movzx ecx, word [esi]
test cx, cx
je 0x40d3d7
test edx, edx
jne 0x40d2d0
jmp 0x40d3d7
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x40d3a9
mov esi, edi
jmp 0x40d388
cmp edx, 3
jb 0x40d3d3
mov ecx, eax
shr ecx, 0xc
or cl, 0xe0
mov byte [ebp], cl
mov ecx, eax
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 1], cl
and al, 0x3f
or al, 0x80
lea ecx, [ebp + 3]
mov byte [ebp + 2], al
jmp 0x40d380
mov ecx, ebp
jmp 0x40d380
mov esi, dword [esp + 0x420]
mov edx, dword [esp + 0x41c]
mov byte [ebp], 0
xor eax, eax
jmp 0x40d3f8
mov byte [esp + eax + 0x204], bl
inc eax
movzx ecx, byte [esp + eax + 4]
mov bl, 0x2f
cmp ecx, 0x5c
je 0x40d3f0
test ecx, ecx
je 0x40d40c
mov ebx, ecx
jmp 0x40d3f0
mov byte [esp + eax + 0x204], 0
lea eax, [esp + 0x204]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push esi
push edx
push eax
push ecx
call fcn.00408ef0
add esp, 0x28
test eax, eax
setne al
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40e2c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x194
mov esi, dword [0x44d4ec]
mov dword [esp + 0x114], 0x313e273c
mov word [esp + 0x118], 0
mov byte [esp + 0x11a], 0
xor eax, eax
nop
movzx edx, byte [esp + eax + 0x114]
lea edi, [eax + 0xb5]
mov ecx, 0x4a
sub ecx, eax
xor ecx, edi
and ecx, edx
xor ecx, edi
add cl, 0x77
mov byte [esp + eax + 0x114], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 7
jb 0x40e2f0
mov ebx, dword [esp + 0x114]
mov dword [esp + 0x14], 0x8f378903
mov dword [esp + 0x18], 0x833a8d3e
mov dword [esp + 0x1c], 0x87328134
mov dword [esp + 0x20], 0x9be88534
mov dword [esp + 0x24], 0x9f22993c
mov dword [esp + 0x28], 0x93929d20
mov dword [esp + 0x2c], 0
xor ecx, ecx
jmp dword [0x447ae4]
Function at 0x40ed10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40ef6c
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40ed4c
cmp edx, esi
jae 0x40ef6c
test edi, edi
je 0x40ef6c
movzx ebp, bl
test bl, bl
js 0x40ed80
mov word [eax], bp
lea ecx, [eax + 2]
inc edx
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40ed40
jmp 0x40ef6c
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40edb8
cmp bl, 0xc2
jb 0x40ed70
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40ee1a
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40ee6c
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40ede2
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40ee24
cmp ebp, 0xe0
jne 0x40ee2d
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40ed6c
jmp 0x40ee2d
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40ef47
cmp bl, 0xf4
ja 0x40ed70
movzx ecx, byte [edx + 1]
je 0x40ee77
cmp ebp, 0xf0
jne 0x40ee80
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40ed6c
jmp 0x40ee80
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40ed72
cmp cl, 0x9f
ja 0x40ed6c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ef4e
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ef54
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40ed62
cmp cl, 0x8f
ja 0x40ed6c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ef4e
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ef54
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40ef60
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ecx, ebp
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x40ed6c
mov esi, dword [esp]
and esi, 0x3f
or esi, ebp
cmp esi, 0x10000
jb 0x40ed6c
cmp edi, 2
jb 0x40ef47
mov ecx, esi
xor ecx, 0x10000
and esi, 0x1effff
add esi, esi
sub esi, ecx
mov ecx, esi
shr ecx, 0xa
and ecx, 0x3ff
or ecx, 0xd800
mov word [eax], cx
and esi, 0x3ff
or esi, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], si
jmp 0x40ed62
mov ecx, eax
jmp 0x40ed62
inc edx
jmp 0x40ed6c
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40ed72
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40ed72
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f460
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ebx, esp
push eax
mov ecx, esp
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x68], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0x3c
mov dword [esi + 0x44], 0xffffffff
mov dword [esi + 0x60], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44d4c8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40f51e
sar edx, 1
lea edi, [esi + 0x30]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x447c28]
xor eax, eax
jmp 0x40fa68
mov ecx, dword [0x447cf4]
nop
nop
jmp ecx
Function at 0x40fc20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov esi, dword [esp + 0x468]
mov edi, dword [esp + 0x450]
mov dword [esp + 0x3c], 0x41d747b3
mov dword [esp + 0x40], 0x4da943da
mov dword [esp + 0x44], 0x49da4fd8
mov dword [esp + 0x48], 0x759b4bab
mov dword [esp + 0x4c], 0x71a077ab
mov dword [esp + 0x50], 0x7d5273a0
mov dword [esp + 0x54], 0x79877f54
mov dword [esp + 0x58], 0x65ec7b93
mov dword [esp + 0x5c], 0x61f76788
mov dword [esp + 0x60], 0x6dff63f9
mov dword [esp + 0x64], 0x69986f4c
mov dword [esp + 0x68], 0x154a6b94
mov dword [esp + 0x6c], 0x11c617c7
mov dword [esp + 0x70], 0x1dc213c6
mov dword [esp + 0x74], 0x193e1fd9
mov dword [esp + 0x78], 0x5f11be1
mov dword [esp + 0x7c], 0x1d80792
mov dword [esp + 0x80], 0xdc703dc
mov dword [esp + 0x84], 0x9960f2c
mov dword [esp + 0x88], 0x35d60bd6
mov dword [esp + 0x8c], 0x3116371f
mov dword [esp + 0x90], 0x3da233f3
mov dword [esp + 0x94], 0x39aa3fac
mov dword [esp + 0x98], 0x25c33bd7
mov dword [esp + 0x9c], 0x21c427cb
mov dword [esp + 0xa0], 0x2dc923d5
mov dword [esp + 0xa4], 0x29ff2fb0
mov dword [esp + 0xa8], 0xd5f72bf7
mov dword [esp + 0xac], 0xd100d70d
mov dword [esp + 0xb0], 0xdd0cd30d
mov dword [esp + 0xb4], 0xd9f6dffc
mov dword [esp + 0xb8], 0xc512db2d
mov dword [esp + 0xbc], 0xc131c738
mov dword [esp + 0xc0], 0xcd16c334
mov dword [esp + 0xc4], 0xc95acfec
mov dword [esp + 0xc8], 0xf55fcb23
mov dword [esp + 0xcc], 0xf1d6f71b
mov dword [esp + 0xd0], 0xfd1df339
mov dword [esp + 0xd4], 0xf96bff11
mov dword [esp + 0xd8], 0xe5d1fb69
mov dword [esp + 0xdc], 0xe12be7c4
mov dword [esp + 0xe0], 0xed70e308
mov dword [esp + 0xe4], 0xe979ef7d
mov dword [esp + 0xe8], 0x953beb07
mov dword [esp + 0xec], 0x91459747
mov dword [esp + 0xf0], 0x9d44934b
mov dword [esp + 0xf4], 0x99489f4c
mov dword [esp + 0xf8], 0x854c9b48
mov dword [esp + 0xfc], 0x81a68754
mov dword [esp + 0x100], 0x8d61837d
mov dword [esp + 0x104], 0x896d8f62
mov dword [esp + 0x108], 0xb5618b1a
mov dword [esp + 0x10c], 0xb169b765
mov dword [esp + 0x110], 0xbd6bb36d
mov dword [esp + 0x114], 0xb963bf6a
mov dword [esp + 0x118], 0xa5babb66
mov dword [esp + 0x11c], 0
mov eax, dword [0x44d4bc]
mov ecx, 0x59dc1691
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x59dc1655]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0x2b
mov byte [esp + ecx - 0x59dc1655], dl
inc ecx
cmp ecx, 0x59dc1775
jne 0x40fe90
lea ebp, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ebp
call eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [esp], 0
xor ebx, ebx
jmp dword [ecx*4 + 0x447cf8]
Function at 0x4103c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov dword [esp + 0x38], 0x93059125
mov dword [esp + 0x3c], 0x9f379d06
mov dword [esp + 0x40], 0x9b0e990c
mov dword [esp + 0x44], 0x87d18525
mov dword [esp + 0x48], 0x83d481dd
mov dword [esp + 0x4c], 0x8fee8ddc
mov dword [esp + 0x50], 0x8b3589e0
mov dword [esp + 0x54], 0xf760f55d
mov dword [esp + 0x58], 0xf365f15c
mov dword [esp + 0x5c], 0xff6dfd63
mov dword [esp + 0x60], 0xfb4cf998
mov dword [esp + 0x64], 0xe786e558
mov dword [esp + 0x68], 0xe3b2e1b1
mov dword [esp + 0x6c], 0xefbeedba
mov dword [esp + 0x70], 0xeb8ae9b3
mov dword [esp + 0x74], 0xd77fd56b
mov dword [esp + 0x78], 0xd38cd146
mov dword [esp + 0x7c], 0xdf85dd80
mov dword [esp + 0x80], 0xdb42d9b8
mov dword [esp + 0x84], 0xc79ac59a
mov dword [esp + 0x88], 0xc3a2c1a9
mov dword [esp + 0x8c], 0xcf5ecd8d
mov dword [esp + 0x90], 0xcb5ec958
mov dword [esp + 0x94], 0x37893599
mov dword [esp + 0x98], 0x3390319d
mov dword [esp + 0x9c], 0x3f973d77
mov dword [esp + 0xa0], 0x3b6d39a4
mov dword [esp + 0xa4], 0x27752579
mov dword [esp + 0xa8], 0x2374217f
mov dword [esp + 0xac], 0x2f702d7f
mov dword [esp + 0xb0], 0x2b422948
mov dword [esp + 0xb4], 0x175e155f
mov dword [esp + 0xb8], 0x13a711ac
mov dword [esp + 0xbc], 0x1f4a1da8
mov dword [esp + 0xc0], 0x1b8e1978
mov dword [esp + 0xc4], 0x7ad05ad
mov dword [esp + 0xc8], 0x36201ad
mov dword [esp + 0xcc], 0xfa30d43
mov dword [esp + 0xd0], 0xba109ab
mov dword [esp + 0xd4], 0x771f75e3
mov dword [esp + 0xd8], 0x73317110
mov dword [esp + 0xdc], 0x7fec7dd4
mov dword [esp + 0xe0], 0x7bef79ef
mov dword [esp + 0xe4], 0x673165c9
mov dword [esp + 0xe8], 0x63336131
mov dword [esp + 0xec], 0x6f386d35
mov dword [esp + 0xf0], 0x6b3c6938
mov dword [esp + 0xf4], 0x57005504
mov dword [esp + 0xf8], 0x53325100
mov dword [esp + 0xfc], 0x5fff5def
mov dword [esp + 0x100], 0x5bfb59f6
mov dword [esp + 0x104], 0x47ef45d6
mov dword [esp + 0x108], 0x431f4117
mov dword [esp + 0x10c], 0x4f114d1f
mov dword [esp + 0x110], 0x4b19491e
mov dword [esp + 0x114], 0xb7b6b5ea
mov byte [esp + 0x118], 0
mov edi, dword [0x44d4bc]
mov esi, 0x88af90a4
nop
movzx edx, byte [esp + esi + 0x77506f94]
mov ebx, edx
and ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xfd
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0xcc
mov byte [esp + esi + 0x77506f94], al
inc esi
cmp esi, 0x88af9185
jne 0x410610
lea eax, [esp + 0x38]
push 0
push 0
push 0
push 0
push eax
call edi
xor ecx, ecx
mov dword [esp + 4], eax
test eax, eax
setne cl
jmp dword [ecx*4 + 0x447da8]
Function at 0x423110
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x38]
mov ebp, 0xfffffffe
cmp word [ebx + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x423120
sar ebp, 1
lea eax, [esp + 8]
push eax
push 0
push 0
push ebp
push ebx
push 0
call dword [0x44e800]
mov edi, dword [esp + 8]
test edi, edi
jns 0x42314f
mov eax, 0xffffffff
jmp 0x423152
lea eax, [edi + edi]
push eax
call fcn.0040c8e0
add esp, 4
mov esi, eax
lea eax, [esp + 8]
push eax
push edi
push esi
push ebp
push ebx
push 0
call dword [0x44e800]
lea ebx, [esp + 0xc]
push ebx
push esi
call fcn.004421d0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44995c]