joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e527
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x280]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x2ac0]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x6e6e6f43
mov dword [ebp - 8], 0x41746365
mov byte [ebp - 4], 0
call fcn.0041ebf7
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41e599
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41e5a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x280]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x2ac4]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x6e65704f
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0041ebf7
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41e619
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41e627
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x280]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x2ac8]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x646e6553
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0041ebf7
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41e68d
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41e697
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x280]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x2acc]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x64616552
mov dword [ebp - 8], 0x656c6946
mov byte [ebp - 4], 0
call fcn.0041ebf7
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41e6f9
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41e707
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x280]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x2ad0]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x736f6c43
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 4], 0x656c64
call fcn.0041ebf7
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41e760
mov eax, dword [ebp + 0xc]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41eff7
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41f05d
cmp dword [esi + 0x18], 0
je 0x41f078
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.004208d7
add esp, 8
test eax, eax
jne 0x41f055
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41f037
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x41f078
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41f078
cmp eax, ecx
je 0x41f055
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41f06b
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41f087
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41f0df
cmp dword [esi + 0x18], 0
je 0x41f0df
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.004208d7
add esp, 8
test eax, eax
jne 0x41f0e7
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41f0c7
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41f0f7
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41f14f
cmp dword [esi + 0x18], 0
je 0x41f14f
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.004208d7
add esp, 8
test eax, eax
jne 0x41f157
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41f137
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41f207
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
test edx, edx
je 0x41f24b
cmp dword [eax + 0x18], 0
je 0x41f24b
mov eax, dword [eax]
inc ecx
cmp ecx, edx
jb 0x41f23e
mov esp, ebp
pop ebp
ret

Function at 0x41f257
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.0041fac7
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x41f2e2
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0041fff7
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.00418a07
add esp, 0x10
test eax, eax
jne 0x41f2ea
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41f2b7
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41f7a7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x41f7b5
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f7b1
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x41f7b1
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret
Function at 0x41f827
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x41f84b
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x41f84b
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x41f853
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebp + 8]
push esi
inc edx
push edx
push eax
call fcn.0041fb07
mov ecx, dword [ebx + 0x50]
mov esi, eax
push ecx
push esi
call fcn.0041fa77
mov edx, dword [ebx + 0x54]
push edx
push edi
push esi
call fcn.0041fa47
xor edx, edx
xor eax, eax
add esp, 0x1c
mov dword [ebp - 4], edx
cmp ax, word [ebx + 6]
jae 0x41f8e5
mov dword [ebp + 0xc], edx
jmp 0x41f890
xor edx, edx
mov ecx, dword [edi + 0x3c]
add ecx, dword [ebp + 0xc]
lea eax, [ecx + esi + 0xf8]
mov ecx, dword [eax + 0x10]
cmp ecx, edx
jne 0x41f8a7
mov dword [eax + 0x14], edx
mov edx, dword [eax + 8]
cmp ecx, edx
jbe 0x41f8bd
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, edi
push edx
add eax, esi
push eax
jmp 0x41f8ca
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x14]
add ecx, edi
push ecx
add edx, esi
push edx
call fcn.0041fa47
mov eax, dword [ebp - 4]
movzx ecx, word [ebx + 6]
add dword [ebp + 0xc], 0x28
inc eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x41f88e
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41f967
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x41f987
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f987
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x41f98b
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x41f987
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x4205b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x4207f3
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.0041fac7
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x420783
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x420779
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.0040c1f7
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x4207a4
inc eax
cmp byte [esi + eax], 0
jne 0x42079d
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.0041fa47
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x4207c1
inc edi
cmp byte [edi + ebx], 0
jne 0x4207ba
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x4207d1
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x4207c9
test esi, esi
je 0x4207e6
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.0041fa97
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4228b7
Capabilities:
Encode data using xor

Disassembly:
or edi, dword [0x3d25daf7]
sub cl, byte [0x375d0fb7]
test dword [0x42379089], esp
shl dword [0x851fd8b9], 0x65
inc eax
or dword [0xf9b49762], esp
and edi, dword [0x6181440e]
sub esp, 0xcd814b62
push ecx
adc dword [0x2b5e9203], esi
or esp, dword [0x61bc5564]
test dword [0xdab6b8ed], eax
sbb edx, 0x88413083
mov ecx, 0x30a9dacf
test ecx, 0x63f8936c
sbb dword [0x1ffd1203], edx
dec ebx
ror dword [0xe617d803], 0x35
cmp dl, 0x24
xor ecx, 0x1714ee0f
adc ecx, dword [0x6b6dfe3f]
pop dword [0x8a5cce0d]
dec ecx
rol dword [0x7acf8b68], 0x5b
add dh, byte [0xe2a3ea1a]
sub esp, 0x1bb431ef
shl dword [0x7a68d695], 0xd2
test dword [0x1242ca9c], ebp
add ebp, dword [0x9e383f31]
or ecx, dword [0xc7dbdda1]
sbb byte [0xaa94de2a], dh
and esi, dword [0x4b1eef0e]
xchg dword [0xcbb7da05], esi
push esi
xor dword [0x20f3da2f], esp
sar dword [0xd2ab4ff8], 0xa1
or bh, 4
push ebp
and esp, dword [0x2b18dccb]
pop ecx
xor ebx, 0x75fd23cf
dec esi
add bl, byte [0xf275680a]
xchg byte [0x58d164d7], ch
inc esp
sub cl, byte [0x4a691f1c]
sbb bh, byte [0xc63f12e7]
mov esp, 0xaad2cbec
shr dword [0x4f6ce985], 0x3b
cmp edi, dword [0x872f57fc]
xor dword [0xc6c33b15], ecx
test byte [0x75d90fe2], al
test byte [0x69fcbfe0], dh
push ecx
jne fcn.004228b7
sbb edx, dword [0x86195e75]
cmp cl, 0x14
sbb ecx, dword [0xb02309f0]
and dl, byte [0x6604ba32]
call fcn.004228b7
cmp dword [0x2a1379e8], ecx
ret 0x1b85
Function at 0x54cad0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc8000]
push edi
jmp 0x54caea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x54caf1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54cae0
mov eax, 1
add ebx, ebx
jne 0x54cb03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x54cb14
jne 0x54cb33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54cb33
dec eax
add ebx, ebx
jne 0x54cb20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x54caf8
add ebx, ebx
jne 0x54cb2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x54cb85
xor ecx, ecx
sub eax, 3
jb 0x54cb4b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x54cbba
sar eax, 1
mov ebp, eax
jmp 0x54cb56
add ebx, ebx
jne 0x54cb56
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54cb24
inc ecx
add ebx, ebx
jne 0x54cb64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54cb24
add ebx, ebx
jne 0x54cb71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x54cb66
jne 0x54cb82
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x54cb66
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x54cba4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x54cb96
jmp 0x54cae6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x54cba4
add edi, ecx
jmp 0x54cae6
pop esi
mov edi, esi
mov ecx, 0x652
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x54cbc2
cmp byte [edi], 0xa
jne 0x54cbc2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x54cbc7
lea edi, [esi + 0x14a000]
mov eax, dword [edi]
or eax, eax
je 0x54cc36
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14f8f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x14f970]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x54cbf4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x14f974]
or eax, eax
je 0x54cc30
mov dword [ebx], eax
add ebx, 4
jmp 0x54cc11
call dword [esi + 0x14f984]
mov ebp, dword [esi + 0x14f978]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x54cc6a
sub esp, 0xffffff80
jmp 0x40c950
Function at 0x402947
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 0x18
mov eax, edx
push ebx
mov ebx, dword [ebp + 0xc]
shr eax, 4
push esi
mov ecx, ebx
test eax, eax
je 0x4029b9
add ebx, 8
mov dword [ebp - 4], eax
nop
mov eax, dword [ecx]
xor dword [edi], eax
mov edx, dword [ebx - 4]
xor dword [edi + 4], edx
mov edx, dword [ebx]
xor dword [edi + 8], edx
mov edx, dword [ebx + 4]
xor dword [edi + 0xc], edx
add ecx, 0x10
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
add ebx, 0x10
call fcn.004028b7
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 8]
add esp, 4
dec dword [ebp - 4]
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
jne 0x402967
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
lea eax, [ebx + edx]
cmp eax, ecx
jbe 0x402a2c
sub ebx, ecx
add ebx, edx
test ebx, ebx
jle 0x4029d6
push ebx
push ecx
lea ecx, [ebp - 0x18]
push ecx
call fcn.0041faf7
add esp, 0xc
mov eax, 0x10
sub eax, ebx
lea ecx, [ebp + ebx - 0x18]
je 0x4029ef
push eax
push 0
push ecx
call fcn.0041fb27
add esp, 0xc
mov edx, dword [ebp - 0x18]
xor dword [edi], edx
mov ecx, dword [ebp - 0x14]
xor dword [edi + 4], ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor dword [edi + 8], edx
xor dword [edi + 0xc], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
call fcn.004028b7
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [edi], edx
mov edx, dword [ebp - 0xc]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov dword [edi + 0xc], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4063c7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x27e]
push ecx
mov word [ebp - 0x280], ax
call fcn.0041fb27
push 0x40
lea ecx, [ebp - 0x7c]
push 0
push ecx
mov dword [ebp - 0x2c], 0x65005c
mov dword [ebp - 0x28], 0x700078
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x650072
mov dword [ebp - 0x1c], 0x2e0072
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.0041fb27
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x10]
push ecx
xor edx, edx
push esi
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x10], 0x690077
mov dword [ebp - 0xc], 0x64006e
mov dword [ebp - 8], 0x720069
mov word [ebp - 4], dx
call fcn.0040c527
push 0
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x280]
push eax
call fcn.0041fe17
mov ecx, dword [esi + 0xbc4]
push 0xad0121ab
push 0
push 0
push ecx
add esi, 0x20
push esi
call fcn.00418a77
add esp, 0x44
pop esi
test eax, eax
je 0x4064cc
push 0
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x80]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x280]
push edx
push 0
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x407a57
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
push ebx
xor ebx, ebx
push esi
push 0x1fe
lea eax, [ebp - 0x29e]
xor edx, edx
push ebx
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x5c], 0x18
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x2a0], dx
call fcn.0041fb27
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0x401
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.0041d877
add esp, 0x20
test eax, eax
js 0x407bbe
mov eax, dword [esi + 0xbc4]
push edi
push 0xcc145ef7
push ebx
push ebx
push eax
lea edi, [esi + 0x20]
push edi
mov dword [ebp - 0x2c], 0x65005c
mov dword [ebp - 0x28], 0x700078
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x650072
mov dword [ebp - 0x1c], 0x2e0072
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.00418a77
add esp, 0x14
cmp eax, ebx
je 0x407b1d
mov ecx, dword [ebp + 0xc]
push ebx
push ecx
call eax
push 0x40
lea edx, [ebp - 0x9c]
push ebx
push edx
call fcn.0041fb27
lea ecx, [ebp - 0x2a0]
push ecx
xor eax, eax
lea edx, [ebp - 0x10]
push edx
push esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xa0], 0x44
mov dword [ebp - 0x10], 0x690077
mov dword [ebp - 0xc], 0x64006e
mov dword [ebp - 8], 0x720069
mov word [ebp - 4], ax
call fcn.0040c527
push ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x2a0]
push ecx
call fcn.0041fe17
mov edx, dword [esi + 0xbc4]
push 0xad0121ab
push ebx
push ebx
push edx
push edi
call fcn.00418a77
add esp, 0x38
pop edi
cmp eax, ebx
je 0x407bbe
push ebx
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0xa0]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x2a0]
push ecx
push ebx
call eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret