joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408d70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x408dd2
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x408d90
mov eax, 0x270
jmp 0x408de4
cmp eax, 0x4e0
jb 0x408de4
mov esi, ecx
call fcn.00408e30
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
mov ecx, eax
and ecx, edx
add ecx, ecx
sub eax, ecx
add eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
mov edx, ecx
and edx, eax
add edx, edx
sub ecx, edx
add ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
ret

Function at 0x408e30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, dword [ecx + 0x9c4]
mov eax, 0x3fe
jmp 0x408e66
shr esi, 1
xor esi, dword [ecx + eax*4]
xor esi, edi
mov dword [ecx + eax*4 - 0xff4], esi
inc eax
cmp eax, 0x4e1
je 0x408e97
mov esi, edx
and esi, 0x80000000
mov edx, dword [ecx + eax*4 - 0x630]
lea edi, [edx - 0x80000000]
mov ebx, edx
or ebx, 0x7fffffff
and ebx, edi
or esi, ebx
mov edi, esi
xor edi, 0xfffffffe
and edi, ebx
je 0x408e50
mov edi, 0x9908b0df
jmp 0x408e50
mov edi, dword [ecx + 0xd50]
mov eax, 0xe4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [eax - 1]
and edi, 0x80000000
mov ebx, dword [ecx + eax*4 + 0x9c4]
mov esi, ebx
and esi, 0x7ffffffe
or esi, edi
shr esi, 1
mov edi, ebx
and ebx, 1
neg ebx
and ebx, 0x9908b0df
mov ebp, edx
or ebp, 0x3ffffd8f
and edx, 0x18f
add edx, ebp
xor ebx, dword [ecx + edx*4 + 0x63c]
xor ebx, esi
mov dword [ecx + eax*4], ebx
inc eax
cmp eax, 0x270
jne 0x408eb0
mov esi, SysReAllocString
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x22c
mov eax, dword [0x443670]
mov dword [esp + 0x1c], 0x48c476c2
mov dword [esp + 0x20], 0x4ce44abb
mov dword [esp + 0x24], 0x40bd4ebe
mov dword [esp + 0x28], 0x44e742bf
mov dword [esp + 0x2c], 0x58fb46f9
mov word [esp + 0x30], 0x5a59
xor ecx, ecx
mov edx, ecx
add dl, 0x9d
xor dl, byte [esp + ecx + 0x1c]
add dl, 0x18
mov byte [esp + ecx + 0x1c], dl
inc ecx
cmp ecx, 0x16
jne 0x409ec0
lea esi, [esp + 0x1c]
push 0x800
push 0
push esi
call eax
mov ecx, 0x443674
push eax
call fcn.00436bf0
movzx eax, al
mov eax, dword [eax*4 + 0x43d690]
mov ecx, 0x2a6fc6ad
xor ecx, dword [0x43d698]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx

Function at 0x40b220
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44364c]
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40b2ce
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x43d988]
xor eax, eax
jmp 0x40b878
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41dfd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x24]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41dfe0
cmp eax, 0xffffffed
jge 0x41dff7
mov eax, 0xffffffff
jmp 0x41dffa
add eax, 0x12
push eax
call fcn.00408310
add esp, 4
mov esi, eax
mov dword [esp], 0xe8ac16b9
mov dword [esp + 4], 0xec62ea4c
mov dword [esp + 8], 0xe011ee19
mov dword [esp + 0xc], 0xe441e245
mov word [esp + 0x10], 0xe6e5
mov eax, 0xfb7387fd
movzx ecx, byte [esp + eax + 0x48c7803]
xor ecx, eax
add ecx, 0x96e33293
mov edx, ecx
and edx, 0x17
xor ecx, 0x17
lea ecx, [ecx + edx*2]
add cl, 0x6e
mov byte [esp + eax + 0x48c7803], cl
inc eax
cmp eax, 0xfb73880f
jne 0x41e030
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41e081
add edi, 2
mov eax, esi
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41e070
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41e0b1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e0a0
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.00439240
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x43edd0]
Function at 0x420c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x14c0
call fcn.004081f0
push eax
sub esp, 0x10
mov dword [ebp - 0x48], esp
sub esp, 0x200
mov dword [ebp - 0x24], esp
sub esp, 0x14
mov eax, esp
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x18], eax
push eax
mov dword [ebp - 0x4c], esp
sub esp, 0x800
mov dword [ebp - 0x2c], esp
push eax
mov dword [ebp - 0x68], esp
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x400
mov dword [ebp - 0x28], esp
push eax
mov dword [ebp - 0x3c], esp
sub esp, 0x10
mov ebx, esp
sub esp, 0x14
mov dword [ebp - 0x1c], esp
sub esp, 0x24
mov dword [ebp - 0x70], esp
mov dword [ebp - 0x14cc], 0xef3ced30
mov dword [ebp - 0x14c8], 0xf335f135
mov dword [ebp - 0x14c4], 0xf725f53d
mov dword [ebp - 0x14c0], 0xfb28f92c
mov dword [ebp - 0x14bc], 0xff22fd25
mov dword [ebp - 0x14b8], 0xc311c115
mov dword [ebp - 0x14b4], 0xc714c501
mov word [ebp - 0x14b0], 0xc9c8
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ecx - 0x14cc]
mov esi, eax
and esi, 0x18
mov edi, ecx
xor edi, 0xc0de48c
add edi, esi
xor edi, edx
add edi, 0x9f90db9f
mov edx, edi
and edx, 1
xor edi, 1
lea edx, [edi + edx*2]
mov byte [ebp + ecx - 0x14cc], dl
inc ecx
add eax, 2
cmp ecx, 0x1e
jne case.default.0x420d2c
lea eax, [ebp - 0x54]
lea ecx, [ebp - 0x14cc]
push 0
push 0
push 0x20019
push eax
mov dword [ebp - 0x20], ecx
push ecx
call fcn.00439610
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0x43f388]
Function at 0x421bc2
Capabilities:
Encode data using xor

Disassembly:
cmp esi, 1
sete al
test byte [ebp - 0x38], 1
sete cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x43f3f8]
Function at 0x423639
Capabilities:
Encode data using xor

Disassembly:
mov ecx, esi
nop
nop
nop
nop
nop
mov eax, ecx
add ecx, 2
cmp word [eax], 0
jne 0x423640
sub eax, esi
cmp eax, 0xffffffd9
jge 0x423659
mov eax, 0xffffffff
jmp 0x42365c
add eax, 0x26
push eax
call fcn.00408310
add esp, 4
mov ebp, eax
mov dword [esp + 0x7e], 0xb450b25d
mov dword [esp + 0x82], 0x4849b64a
mov dword [esp + 0x86], 0x4cb24aaf
mov dword [esp + 0x8a], 0x40a34eaa
mov dword [esp + 0x8e], 0x44bc42a2
mov dword [esp + 0x92], 0x58a146bb
mov dword [esp + 0x96], 0x5cbc5aa0
mov dword [esp + 0x9a], 0x50a95e63
mov dword [esp + 0x9e], 0x54b552b5
mov word [esp + 0xa2], 0x5655
mov eax, 0xaa96379
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0xaa962fb]
xor ecx, eax
add ecx, 0xaab4e437
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax - 0xaa962fb], cl
inc eax
cmp eax, 0xaa9639f
jne 0x4236e0
movzx ecx, word [esi]
mov eax, ebp
test cx, cx
je 0x423731
mov edx, esi
add edx, 2
mov eax, ebp
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423720
mov word [eax], 0
movzx ecx, word [esp + 0x7e]
test cx, cx
je 0x423761
lea edx, [esp + 0x80]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423750
mov word [eax], 0
jmp dword [0x43fa9c]

Function at 0x42376c
Capabilities:
Copy file

Disassembly:
push esi
call fcn.00408320
add esp, 4
xor eax, eax
cmp word [ebp], 0x2a
sete al
jmp dword [eax*4 + 0x43faa4]

Function at 0x423786
Capabilities:
Copy file
Encode data using xor

Disassembly:
xor eax, eax
cmp word [ebp], 0x2a
sete al
jmp dword [eax*4 + 0x43faa4]

Function at 0x4238a7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
call fcn.00408320
add esp, 4
xor eax, eax
cmp edi, ebx
sete al
jmp dword [eax*4 + 0x43fb14]

Function at 0x423a50
Capabilities:
Contain obfuscated stackstrings
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov dword [esp + 0x7e], 0x544951be
mov dword [esp + 0x82], 0x41514356
mov dword [esp + 0x86], 0x4446b09a
mov dword [esp + 0x8a], 0xaf845f4f
mov dword [esp + 0x8e], 0x4d5e5b49
mov dword [esp + 0x92], 0x5750b38e
mov dword [esp + 0x96], 0x7c49434a
mov word [esp + 0x9a], 0xca7a
mov eax, 0x52a952c5
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x52a95247]
xor ecx, eax
neg ecx
lea edx, [ecx + ecx]
and edx, 0x52
xor ecx, 0xd6
sub ecx, edx
add cl, 2
mov byte [esp + eax - 0x52a95247], cl
inc eax
cmp eax, 0x52a952e3
jne 0x423ab0
mov ecx, edi
push esi
call fcn.00426730
jmp dword [0x43fae4]

Function at 0x423b87
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
cmp edi, ebx
sete al
jmp dword [eax*4 + 0x43fb14]

Function at 0x4247b5
Capabilities:
Encode data using xor

Disassembly:
mov ecx, eax
and al, 1
movzx eax, al
jmp dword [eax*4 + 0x43fc14]
Function at 0x42486c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xdc
push eax
sub esp, 0x14
mov dword [ebp - 0x1c], esp
sub esp, 0x18
mov esi, esp
sub esp, 0xc
mov dword [ebp - 0x58], esp
sub esp, 0x1c
mov dword [ebp - 0x38], esp
push eax
mov dword [ebp - 0x50], esp
push eax
mov dword [ebp - 0x78], esp
sub esp, 0x18
mov dword [ebp - 0xbc], esp
sub esp, 8
mov dword [ebp - 0xb8], esp
sub esp, 8
mov dword [ebp - 0x54], esp
sub esp, 0x10
mov dword [ebp - 0x20], esp
sub esp, 0x30
mov eax, esp
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x88], eax
sub esp, 0x14
mov eax, esp
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xc4], eax
push eax
mov dword [ebp - 0xc0], esp
mov dword [ebp - 0x74], 0xf634f4d6
mov dword [ebp - 0x70], 0xea79e867
mov dword [ebp - 0x6c], 0xee0cec2f
mov dword [ebp - 0x68], 0xe200e07b
mov dword [ebp - 0x64], 0xe6e5e4c6
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xab
xor cl, byte [ebp + eax - 0x74]
add cl, 0xa8
mov byte [ebp + eax - 0x74], cl
inc eax
cmp eax, 0x14
jne case.default.0x424959
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0x74]
mov edi, edx
mov ecx, 5
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [ebp - 0xd4]
lea eax, [ebp - 0x60]
xor ebx, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 9
push edx
push 0
call dword [0x444994]
xor ecx, ecx
cmp eax, 0xc0000023
setne cl
jmp dword [ecx*4 + 0x43fc34]
Function at 0x4249ae
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp - 0x30], esi
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [eax + ecx]
mov eax, 0xfffffffe
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x4249c0
mov dword [ebp - 0x34], ecx
sar eax, 0xd
lea ecx, [eax + eax]
test eax, eax
jns 0x4249dd
mov ecx, 0xffffffff
push ecx
call fcn.00408310
add esp, 4
movzx edx, word [edi]
mov ecx, eax
test dx, dx
je 0x424a11
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x424a00
mov dword [ebp - 0x1c], eax
mov eax, ecx
mov word [ecx], 0x5c
mov ebx, dword [ebp - 0x38]
mov dword [ebx], 0xf5b8f38e
mov dword [ebx + 4], 0xf99bf799
mov dword [ebx + 8], 0xfd90fb9b
mov dword [ebx + 0xc], 0xe193ffde
mov dword [ebx + 0x10], 0xe585e376
mov dword [ebx + 0x14], 0xe98de772
mov word [ebx + 0x18], 0xebea
mov edx, 0x1d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx]
mov edi, edx
and edi, esi
lea ecx, [edx - 0x15c4200]
or ecx, esi
not ecx
or ecx, edi
mov esi, ecx
not esi
and esi, 0x11
and ecx, 0xee
sub ecx, esi
inc cl
mov byte [ebx], cl
inc ebx
dec edx
cmp edx, 3
jne 0x424a60
mov esi, eax
add esi, 2
mov eax, dword [ebp - 0x34]
movzx edx, word [eax]
test dx, dx
je 0x424ab1
add eax, 2
mov word [esi], dx
add esi, 2
movzx edx, word [eax]
add eax, 2
test dx, dx
jne 0x424aa0
mov word [esi], 0
mov ecx, dword [ebp - 0x38]
movzx edx, word [ecx]
test dx, dx
je 0x424ae3
mov edi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [esi], dx
add esi, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x424ad0
jmp 0x424ae6
mov edi, dword [ebp - 0x24]
mov word [esi], 0
push 0x60
push 3
push 0x120089
push dword [ebp - 0x50]
push dword [ebp - 0x1c]
call fcn.004390d0
add esp, 0x14
jmp case.0x423896.120
Function at 0x424b33
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, dword [ebp - 0x24]
mov word [esi], 0
push 0x60
push 3
push 0x120089
push dword [ebp - 0x50]
push eax
call fcn.004390d0
add esp, 0x14
jmp dword [0x43fc94]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x44]
mov edx, dword [eax + ecx]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edx + esi + 2], 0
lea esi, [esi + 2]
jne 0x424b50
mov dword [ebp - 0x8c], esi
sar esi, 1
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], esi
add eax, esi
inc eax
mov ecx, eax
and ecx, 0xc
xor eax, 0xc
lea eax, [eax + ecx*2]
test eax, eax
mov dword [ebp - 0x1c], edx
jns 0x424b90
mov eax, 0xffffffff
jmp 0x424b92
add eax, eax
push eax
call fcn.00408310
add esp, 4
movzx ecx, word [edi]
mov esi, eax
test cx, cx
je 0x424bc1
mov edx, dword [ebp - 0x2c]
mov esi, eax
nop
nop
nop
nop
nop
nop
mov word [esi], cx
add esi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424bb0
mov dword [ebp - 0x34], eax
mov word [esi], 0x5c
mov edx, dword [ebp - 0x38]
mov dword [edx], 0xf5b8f38e
mov dword [edx + 4], 0xf99bf799
mov dword [edx + 8], 0xfd90fb9b
mov dword [edx + 0xc], 0xe193ffde
mov dword [edx + 0x10], 0xe585e376
mov dword [edx + 0x14], 0xe98de772
mov word [edx + 0x18], 0xebea
mov ecx, 0x1d
movzx edi, byte [edx]
mov eax, ecx
and eax, edi
lea ebx, [ecx - 0x15c4200]
or ebx, edi
not ebx
or ebx, eax
mov eax, ebx
not eax
and eax, 0x11
and ebx, 0xee
sub ebx, eax
inc bl
mov byte [edx], bl
inc edx
dec ecx
cmp ecx, 3
jne 0x424c00
add esi, 2
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax]
test cx, cx
je 0x424c51
lea edx, [eax + 2]
nop
nop
mov word [esi], cx
add esi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424c40
mov word [esi], 0
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
test cx, cx
mov eax, dword [ebp - 0x34]
je 0x424b10
mov edx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x24]
nop
nop
mov word [esi], cx
add esi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424c70
jmp 0x424b13

Function at 0x424cb3
Capabilities:
Encode data using xor

Disassembly:
push dword [ebp - 0x34]
call fcn.00408320
add esp, 4
movzx eax, bl
mov ebx, esi
jmp dword [eax*4 + 0x43fd34]
Function at 0x425602
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x74], 0x533b5114
mov dword [ebp - 0x70], 0x57355527
mov dword [ebp - 0x6c], 0x5b285937
mov dword [ebp - 0x68], 0x5f5e5d38
mov eax, 0xa156dcd0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebp + eax + 0x5ea922bc]
xor ecx, eax
mov edi, ecx
xor edi, 0xab6e680
mov edx, ecx
or edx, 0xa140187f
and edx, edi
mov edi, edx
and edi, 0xfd
mov ebx, ecx
and ebx, 2
or edx, 2
imul edx, ebx
xor ebx, 2
imul ebx, edi
xor ecx, 0x7f
add ecx, ebx
add ecx, edx
inc cl
mov byte [ebp + eax + 0x5ea922bc], cl
inc eax
cmp eax, 0xa156dce0
jne 0x425630
lea edi, [ebp - 0xd4]
lea ebx, [ebp - 0x74]
mov ecx, 4
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
lea edi, [ebp - 0xc4]
lea eax, [ebp - 0x64]
xor ebx, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [ebp - 0xa8], 0xcf67cd08
mov dword [ebp - 0xa4], 0xd371d163
mov dword [ebp - 0xa0], 0xd764d57b
mov dword [ebp - 0x9c], 0xdb19d97c
mov dword [ebp - 0x98], 0xdf70dd7d
mov dword [ebp - 0x94], 0xa310a101
mov dword [ebp - 0x90], 0xa7a6a51d
xor edx, edx
nop
nop
nop
nop
nop
movzx eax, byte [ebp + edx - 0xa8]
mov edi, ebx
and edi, 0x18
mov ecx, edx
xor ecx, 0xf012eaac
add ecx, edi
xor ecx, eax
mov eax, ecx
and eax, 0x1f
xor ecx, 0x9f
lea eax, [ecx + eax*2]
inc al
mov byte [ebp + edx - 0xa8], al
inc edx
add ebx, 2
cmp edx, 0x1c
jne 0x4256f0
lea eax, [ebp - 0xa8]
lea edi, [ebp - 0x74]
mov ecx, 7
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [ebp - 0x58]
lea eax, [ebp - 0x8c]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [esi], 0xd971d792
mov dword [esi + 4], 0xdd7fdb49
mov dword [esi + 8], 0xc152df71
mov dword [esi + 0xc], 0xc574c366
mov dword [esi + 0x10], 0xc98ac772
lea ebx, [esi + 0x14]
mov word [esi + 0x14], 0xcbca
mov ecx, 0xe6
mov edi, 0xbf420319
movzx eax, byte [esi + ecx - 0xe6]
mov edx, ecx
xor edx, edi
and edx, eax
xor edx, edi
mov eax, edx
not eax
and eax, 0x4f
xor edx, 0x30
lea eax, [edx + eax*2]
inc al
mov byte [esi + ecx - 0xe6], al
inc ecx
dec edi
cmp ecx, 0xfc
jne 0x425780
mov eax, esi
mov edx, dword [ebp - 0x1c]
mov edi, edx
mov ecx, 5
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [edx + 0x14]
mov ecx, 1
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0xd4]
mov dword [eax], ecx
lea ecx, [ebp - 0x74]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
jmp dword [0x43fc74]
Function at 0x4257e9
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov dword [ebp - 0x74], 0x533b5114
mov dword [ebp - 0x70], 0x57355527
mov dword [ebp - 0x6c], 0x5b285937
mov dword [ebp - 0x68], 0x5f5e5d38
mov eax, 0xa156dcd0
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebp + eax + 0x5ea922bc]
xor ecx, eax
mov edi, ecx
xor edi, 0xab6e680
mov edx, ecx
or edx, 0xa140187f
and edx, edi
mov edi, edx
and edi, 0xfd
mov ebx, ecx
and ebx, 2
or edx, 2
imul edx, ebx
xor ebx, 2
imul ebx, edi
xor ecx, 0x7f
add ecx, ebx
add ecx, edx
inc cl
mov byte [ebp + eax + 0x5ea922bc], cl
inc eax
cmp eax, 0xa156dce0
jne 0x425810
lea edi, [ebp - 0xd4]
lea ebx, [ebp - 0x74]
mov ecx, 4
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
lea edi, [ebp - 0xc4]
lea eax, [ebp - 0x64]
xor ebx, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [ebp - 0xa8], 0xcf67cd08
mov dword [ebp - 0xa4], 0xd371d163
mov dword [ebp - 0xa0], 0xd764d57b
mov dword [ebp - 0x9c], 0xdb19d97c
mov dword [ebp - 0x98], 0xdf70dd7d
mov dword [ebp - 0x94], 0xa310a101
mov dword [ebp - 0x90], 0xa7a6a51d
xor edx, edx
nop
nop
nop
nop
nop
movzx eax, byte [ebp + edx - 0xa8]
mov edi, ebx
and edi, 0x18
mov ecx, edx
xor ecx, 0xf012eaac
add ecx, edi
xor ecx, eax
mov eax, ecx
and eax, 0x1f
xor ecx, 0x9f
lea eax, [ecx + eax*2]
inc al
mov byte [ebp + edx - 0xa8], al
inc edx
add ebx, 2
cmp edx, 0x1c
jne 0x4258d0
lea eax, [ebp - 0xa8]
lea edi, [ebp - 0x74]
mov ecx, 7
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [ebp - 0x58]
lea eax, [ebp - 0x8c]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [esi], 0xd971d792
mov dword [esi + 4], 0xdd7fdb49
mov dword [esi + 8], 0xc152df71
mov dword [esi + 0xc], 0xc574c366
mov dword [esi + 0x10], 0xc98ac772
lea ebx, [esi + 0x14]
mov word [esi + 0x14], 0xcbca
mov ecx, 0xe6
mov edi, 0xbf420319
movzx eax, byte [esi + ecx - 0xe6]
mov edx, ecx
xor edx, edi
and edx, eax
xor edx, edi
mov eax, edx
not eax
and eax, 0x4f
xor edx, 0x30
lea eax, [edx + eax*2]
inc al
mov byte [esi + ecx - 0xe6], al
inc ecx
dec edi
cmp ecx, 0xfc
jne 0x425960
mov eax, esi
mov ecx, 5
mov edx, dword [ebp - 0x1c]
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [edx + 0x14]
mov ecx, 1
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0xd4]
mov dword [eax], ecx
lea ecx, [ebp - 0x74]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
jmp case.0x423896.112
Function at 0x425f42
Capabilities:
Encode data using xor

Disassembly:
lea edx, [ecx + 0xa]
movzx eax, byte [ecx + 0xa]
xor ebx, ebx
test al, al
je 0x425d92
mov ecx, edx
nop
cmp al, 0x22
je 0x425d90
movzx eax, byte [ecx + 1]
inc ecx
test al, al
jne 0x425d80
jmp 0x425d92
mov ebx, ecx
mov ecx, ebx
sub ecx, edx
xor eax, eax
cmp ecx, 5
setb al
jmp dword [eax*4 + 0x43fdc4]
mov eax, 0x1b
xor edx, edx
idiv dword [ebp - 0x44]
push edx
call fcn.00408310
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
xor edx, edx
div ebx
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp - 0x4c]
mov dword [edi], 0xe29ce6c3
mov dword [edi + 4], 0xdfd19b9c
mov dword [edi + 8], 0xdcf213a6
mov dword [edi + 0xc], 0x16abd2da
mov dword [edi + 0x10], 0xd8a8d4f4
mov dword [edi + 0x14], 0xac4deae
mov word [edi + 0x18], 0xc09
mov byte [edi + 0x1a], 0x24
mov eax, 0xa84d18da
movzx edx, byte [edi + eax + 0x57b2e726]
xor edx, eax
lea ecx, [edx + 0x2f]
mov esi, 0xd0
sub esi, edx
or esi, 1
add esi, edx
or ecx, 1
add ecx, esi
add cl, 0x30
mov byte [edi + eax + 0x57b2e726], cl
inc eax
cmp eax, 0xa84d18f5
jne 0x425f9d
movzx eax, byte [edi]
mov esi, dword [ebp - 0x28]
mov ecx, esi
test al, al
je 0x425fe9
mov edx, dword [ebp - 0x2c]
mov ecx, esi
mov byte [ecx], al
inc ecx
movzx eax, byte [edx]
inc edx
test al, al
jne 0x425fde
mov byte [ecx], 0
cmp dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], ebx
jae 0x425ff8
mov edi, ecx
jmp 0x426061
mov eax, dword [ebp - 0x14]
lea edx, [eax + ebx]
mov ebx, dword [ebp - 0x1c]
mov edi, ebx
and edi, 3
je 0x426017
dec ebx
movzx eax, byte [edx]
cmp al, 1
sbb edx, 0xffffffff
mov byte [ecx], al
inc ecx
dec edi
jne 0x426008
mov esi, dword [ebp - 0x1c]
dec esi
mov edi, ecx
cmp esi, 3
mov esi, dword [ebp - 0x28]
jb 0x426061
movzx eax, byte [edx]
cmp al, 1
sbb edx, 0xffffffff
mov byte [ecx], al
movzx eax, byte [edx]
cmp al, 1
sbb edx, 0xffffffff
mov byte [ecx + 1], al
movzx eax, byte [edx]
cmp al, 1
sbb edx, 0xffffffff
mov byte [ecx + 2], al
movzx eax, byte [edx]
mov byte [ebp - 0x1c], al
cmp al, 1
sbb edx, 0xffffffff
lea edi, [ecx + 4]
movzx eax, byte [ebp - 0x1c]
mov byte [ecx + 3], al
mov ecx, edi
add ebx, 0xfffffffc
jne 0x426025
mov byte [edi], 0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x48]
push dword [eax]
push dword [ebp - 0x20]
push esi
call fcn.00409300
mov ebx, dword [ebp - 0x38]
jmp case.0x425d9e.26
mov ecx, dword [ebp - 0x18]
and cl, 1
or cl, al
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x20]
jmp dword [0x43fe3c]
push dword [ebp - 0x1c]
call fcn.00408320
mov ecx, dword [ebp - 0x20]
add esp, 4
mov eax, dword [case.0x425d9e.22]
jmp eax