joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f20
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x401f8d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x401f8d
push esi
call fcn.004097f0
add esp, 4
test eax, eax
je 0x401f6a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x401f71
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x401f50
jmp 0x401f73
mov ebx, 0x1505
jmp 0x401f73
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x401f95
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x401fa4
inc ebp
dec edi
je 0x401f8b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x401f8b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x401fa0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.004097f0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x401fa0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00409810
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x401fa0
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x401f8d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x401f8d
Function at 0x4021b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x4022c2
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4022c2
cmp dword [esp + 0x2c], 0
je 0x4022c2
push esi
call fcn.004097f0
add esp, 4
test eax, eax
je 0x40221a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x402221
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x402200
jmp 0x402223
mov ebx, 0x1505
jmp 0x402223
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 8], edx
jae 0x4022ca
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x402287
call fcn.004023c0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x4022c2
push ecx
call fcn.004097f0
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edi, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 8], eax
jae 0x40233d
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4022e8
inc edi
dec esi
je 0x40223c
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x402241
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x4022e0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.004097f0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4022e0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.00409810
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4022e0
mov eax, 0xffffffff
jmp 0x4022c2
and edi, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x402358
inc edi
dec esi
je 0x402282
mov ebp, edi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x402287
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x402350
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.004097f0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x402350
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.00409810
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402350
jmp 0x402287
Function at 0x402af0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402ca6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x402c9f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x402b85
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x402c9f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x402c05
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
mov edi, eax
xor edi, esi
and eax, esi
lea eax, [edi + eax*2]
add ecx, eax
movzx esi, byte [ebp + edx + 6]
add esi, eax
add ecx, esi
movzx edi, byte [ebp + edx + 7]
add edi, esi
lea eax, [edx + 8]
add ecx, edi
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x402ba0
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x402b4d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x402c50
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x402c30
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402b40
jmp 0x402c5f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402b40
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x402c70
jmp 0x402b40
shl ecx, 0x10
or ecx, edi
jmp 0x402cab
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402cc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402cee
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x402d8c
not eax
test bl, 1
jne 0x402cf5
mov edx, ebx
cmp ebx, 1
jne 0x402d26
jmp 0x402d8a
xor eax, eax
jmp 0x402d8c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x44180c]
inc ecx
mov eax, edi
shr eax, 4
shr esi, 4
and edi, 0xf
xor edi, esi
xor eax, dword [edi*4 + 0x44180c]
cmp ebx, 1
je 0x402d8a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x44180c]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0x44180c]
movzx ebx, byte [ecx + esi + 1]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x44180c]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0x44180c]
add esi, 2
cmp edx, esi
jne 0x402d30
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x409d10
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + 4]
mov dword [0x449904], ecx
mov eax, 0xfffffd92
nop
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x26f
mov dword [eax*4 + 0x44a2c0], ecx
test eax, eax
je 0x409d61
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x270
mov dword [eax*4 + 0x44a2c4], ecx
add eax, 2
jmp 0x409d20
mov dword [0x449900], 0x270
ret

Function at 0x409d80
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x210
call fcn.0043bf40
test al, al
je 0x409ee0
lea eax, [esp + 8]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00434fb0
test al, al
je 0x409edb
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, 0x1586ab4f
mov esi, 0xdab05038
mov ecx, ebx
shrd esi, edi, cl
shr edi, cl
mov edx, 0x2b0d569f
mov ebp, 0xb560a070
shrd ebp, edx, cl
mov dword [esp], eax
shr edx, cl
test bl, 0x20
je 0x409df3
mov esi, edi
xor edi, edi
mov ebp, edx
xor edx, edx
and ebp, 0xb560a070
and edx, 0x2b0d569f
add esi, 0xdab05038
adc edi, 0x1586ab4f
sub esi, ebp
sbb edi, edx
mov ebp, esi
and ebp, 0x2d43e9be
mov ecx, edi
and ecx, 0x66ad91d5
mov ebx, esi
and ebx, 0xd2bc1641
mov eax, ebx
xor eax, 0xd2bc1641
imul ecx, eax
mul ebp
mov dword [esp + 4], eax
add edx, ecx
mov ecx, edi
and ecx, 0x99526e2a
or esi, 0xd2bc1641
mov eax, esi
imul esi, ecx
xor ecx, 0x99526e2a
imul ecx, ebp
add ecx, edx
mul ebx
add esi, edx
or edi, 0x99526e2a
imul edi, ebx
add edi, esi
add eax, dword [esp + 4]
adc edi, ecx
mov ebx, edi
shr ebx, 0x15
xor ebx, edi
mov esi, edi
shld esi, eax, 0xb
xor esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x409eb7
mov ecx, 0xfa7b998b
mov eax, esi
mul ecx
imul ecx, esi, 0x11fab5e
imul edi, ebx, 0xfa7b998b
add edi, edx
add edi, ecx
mov esi, eax
mov ecx, dword [esp]
shrd esi, edi, cl
mov ebx, edi
shr ebx, cl
test cl, 0x20
je 0x409eb3
mov esi, ebx
xor ebx, ebx
xor ebx, edi
xor esi, eax
or ebx, 0x1010101
or esi, 0x1010101
push ebx
push esi
call fcn.0040b0d0
add esp, 8
test al, al
je 0x409edb
call fcn.0040dd70
call fcn.0040cb20
call fcn.0043d2c0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409ef0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x409f53
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
jmp 0x409f31
and esi, 0x80000000
or edi, esi
shr edi, 1
xor edi, dword [ecx + eax + 0xff8]
xor edi, ebx
mov dword [ecx + eax + 0x1384], edi
mov esi, edx
add eax, 4
je 0x409f67
mov edx, dword [ecx + eax + 0x9c8]
mov edi, edx
and edi, 0x7fffffff
mov ebx, edx
xor ebx, 0x7ffffffe
and ebx, edi
je 0x409f10
mov ebx, 0x9908b0df
jmp 0x409f10
cmp eax, 0x4e0
jb 0x409f6c
mov esi, ecx
call fcn.00409fd0
mov ecx, esi
mov eax, dword [esi]
jmp 0x409f6c
mov eax, 0x270
mov edx, eax
and edx, 1
mov esi, eax
xor esi, 1
lea edx, [esi + edx*2]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
mov ecx, eax
not ecx
or ecx, 0x9d2c5680
add eax, ecx
inc eax
xor eax, edx
mov ecx, eax
shl ecx, 0xf
mov edx, ecx
or edx, 0xefc60000
xor ecx, 0x1039ffff
and ecx, edx
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
pop ebx
ret

Function at 0x409fd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov edi, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
nop
and edi, 0x80000000
mov edx, dword [ecx + eax*4 - 0x630]
mov ebx, edx
and ebx, 0x7ffffffe
or ebx, edi
shr ebx, 1
mov esi, edx
and esi, 1
neg esi
and esi, 0x9908b0df
mov edi, esi
and edi, ebx
add esi, ebx
add edi, edi
sub esi, edi
xor esi, dword [ecx + eax*4]
mov edi, edx
mov dword [ecx + eax*4 - 0xff4], esi
inc eax
cmp eax, 0x4e1
jne 0x409fe0
mov esi, dword [ecx + 0xd50]
mov eax, 0x355
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 - 0xd50]
xor edi, edx
mov dword [ecx + eax*4 - 0x9c4], edi
inc eax
cmp eax, 0x4e1
jne 0x40a030
mov edx, dword [ecx + 0x1380]
mov esi, edx
not esi
or esi, 0x80000000
mov eax, SysReAllocString
and eax, dword [ecx + 4]
add edx, esi
inc edx
or eax, edx
mov edx, eax
shr edx, 1
and eax, 1
neg eax
xor edx, dword [ecx + 0x634]
and eax, 0x9908b0df
xor edx, eax
mov dword [ecx + 0x9c0], edx
mov dword [ecx], 0
pop esi
pop edi
pop ebx
ret
Function at 0x40b0d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x234
push eax
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 0x30], esp
sub esp, 0x70
mov dword [ebp - 0x1c], esp
sub esp, 0x28
mov dword [ebp - 0x18], esp
sub esp, 8
mov dword [ebp - 0x28], esp
sub esp, 0x40
mov dword [ebp - 0x24], esp
sub esp, 0x80
mov dword [ebp - 0x2c], esp
mov eax, dword [0x44ace0]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xb0], 0x73727970
mov byte [ebp - 0xac], 0
mov ecx, 0x14
mov edx, 0x7cde0beb
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + ecx - 0xc4]
mov esi, ecx
xor esi, edx
and esi, eax
xor esi, edx
mov eax, 0x70563b9a
sub eax, esi
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
mov byte [ebp + ecx - 0xc4], al
inc ecx
dec edx
cmp ecx, 0x19
jne 0x40b130
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x240], 0xf779f973
mov dword [ebp - 0x23c], 0xf351f5ba
mov dword [ebp - 0x238], 0xcf80f1bf
mov dword [ebp - 0x234], 0xcb76cdbe
mov dword [ebp - 0x230], 0xc772c97c
mov dword [ebp - 0x22c], 0xc5c4
mov edx, 0x68669ed6
mov esi, 0x97996129
nop
movzx ebx, byte [ebp + edx - 0x6866a116]
lea edi, [edx - 0x68669e00]
and edi, ebx
mov eax, edi
and eax, 0xfffffffd
mov ecx, edi
and ecx, 2
or edi, 2
imul edi, ecx
xor ecx, 2
imul ecx, eax
add edi, ecx
mov eax, esi
sub eax, ebx
lea ecx, [edx + ebx]
and eax, edi
not edi
and edi, ecx
sub edi, eax
add edi, 0x483f503b
mov eax, edi
and eax, 0x17
xor edi, 0x97
lea eax, [edi + eax*2]
mov byte [ebp + edx - 0x6866a116], al
inc edx
dec esi
cmp edx, 0x68669eee
jne 0x40b1b0
lea esi, [ebp - 0x240]
push dword [ebp - 0x14]
push 0
push esi
call dword [ebp - 0x10]
mov ecx, 0x44ace4
push eax
call fcn.0043beb0
movzx eax, al
mov eax, dword [eax*4 + 0x444a58]
mov ecx, 0x5ea8ba44
xor ecx, dword [0x444a60]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x40bd70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40bfd9
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40bdac
cmp edx, esi
jae 0x40bfd9
test edi, edi
je 0x40bfd9
movzx ebp, bl
test bl, bl
js 0x40bde0
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40bda0
jmp 0x40bfd9
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40be1f
cmp bl, 0xc2
jb 0x40bdd0
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40be89
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40bdc2
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40be49
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40be93
cmp ebp, 0xe0
jne 0x40be9c
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40bdcc
jmp 0x40be9c
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40bfb4
cmp bl, 0xf4
ja 0x40bdd0
movzx ecx, byte [edx + 1]
je 0x40bef2
cmp ebp, 0xf0
jne 0x40befb
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40bdcc
jmp 0x40befb
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40bdd2
cmp cl, 0x9f
ja 0x40bdcc
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40bfbb
movzx ebx, byte [edx + 2]
mov esi, ebx
not esi
or esi, 0xc0
add esi, ebx
cmp esi, 0x7f
jne 0x40beea
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
add edx, 3
mov esi, ebx
xor esi, 0xffc0
or ebx, 0x3f
and ebx, esi
add ebx, ecx
lea ecx, [eax + 2]
mov word [eax], bx
jmp 0x40bdc2
add edx, 2
jmp 0x40bdcc
cmp cl, 0x8f
ja 0x40bdcc
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40bfbb
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40bfc1
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40bfcd
and bl, 7
movzx ebx, bl
shl ebx, 0x12
and ecx, 0x3f
shl ecx, 0xc
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov esi, dword [esp]
and esi, 0x3f
or esi, ebp
or ebx, esi
cmp ebx, 0x10000
jb 0x40bdcc
mov ecx, ebx
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0x40bdcc
cmp edi, 2
jb 0x40bfb4
add ebx, 0xf0000
shr ebx, 0xa
and ebx, 0x3ff
or ebx, 0xd800
mov word [eax], bx
and esi, 0x3ff
or esi, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], si
jmp 0x40bdc2
mov ecx, eax
jmp 0x40bdc2
inc edx
jmp 0x40bdcc
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40bdd2
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40bdd2
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40c480
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44acbc]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40c52e
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x444d28]
mov eax, dword [0x444d38]
nop
nop
nop
nop
nop
nop
jmp eax
Function at 0x40d4d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov dword [esp + 0x38], 0x1770753
mov dword [esp + 0x3c], 0xd69037a
mov dword [esp + 0x40], 0x97a0f78
mov dword [esp + 0x44], 0x153b0b6b
mov dword [esp + 0x48], 0x1120172b
mov dword [esp + 0x4c], 0x1d321320
mov dword [esp + 0x50], 0x19471f34
mov dword [esp + 0x54], 0x256c1b73
mov dword [esp + 0x58], 0x21572748
mov dword [esp + 0x5c], 0x2d5f2359
mov dword [esp + 0x60], 0x29782f0c
mov dword [esp + 0x64], 0x350a2b74
mov dword [esp + 0x68], 0x31063707
mov dword [esp + 0x6c], 0x3d023306
mov dword [esp + 0x70], 0x391e3f79
mov dword [esp + 0x74], 0x45513b61
mov dword [esp + 0x78], 0x41784732
mov dword [esp + 0x7c], 0x4d07437c
mov dword [esp + 0x80], 0x49364f6c
mov dword [esp + 0x84], 0x55764b76
mov dword [esp + 0x88], 0x5176577f
mov dword [esp + 0x8c], 0x5d225313
mov dword [esp + 0x90], 0x592a5f2c
mov dword [esp + 0x94], 0x65035b37
mov dword [esp + 0x98], 0x6104670b
mov dword [esp + 0x9c], 0x6d096335
mov dword [esp + 0xa0], 0x695f6f10
mov dword [esp + 0xa4], 0x75576b57
mov dword [esp + 0xa8], 0x7140774d
mov dword [esp + 0xac], 0x7d4c734d
mov dword [esp + 0xb0], 0x79567f5c
mov dword [esp + 0xb4], 0x85327b2d
mov dword [esp + 0xb8], 0x81d187d8
mov dword [esp + 0xbc], 0x8db683d4
mov dword [esp + 0xc0], 0x89fa8fac
mov dword [esp + 0xc4], 0x95ff8be3
mov dword [esp + 0xc8], 0x91b697fb
mov dword [esp + 0xcc], 0x9dfd93d9
mov dword [esp + 0xd0], 0x99eb9ff1
mov dword [esp + 0xd4], 0xa5b19be9
mov dword [esp + 0xd8], 0xa1eba784
mov dword [esp + 0xdc], 0xadd0a3c8
mov dword [esp + 0xe0], 0xa9d9afdd
mov dword [esp + 0xe4], 0xb59babc7
mov dword [esp + 0xe8], 0xb185b787
mov dword [esp + 0xec], 0xbd84b38b
mov dword [esp + 0xf0], 0xb988bf8c
mov dword [esp + 0xf4], 0xc58cbb88
mov dword [esp + 0xf8], 0xc1e6c7f4
mov dword [esp + 0xfc], 0xcda1c39d
mov dword [esp + 0x100], 0xc9adcfa2
mov dword [esp + 0x104], 0xd5a1cbba
mov dword [esp + 0x108], 0xd1e9d7e5
mov dword [esp + 0x10c], 0xddebd3ed
mov dword [esp + 0x110], 0xd9e3dfea
mov dword [esp + 0x114], 0xe5dadbe6
mov byte [esp + 0x118], 0
mov eax, dword [0x44acb0]
mov ecx, 0x52e28381
mov edx, 0x7e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x52e28349]
mov esi, edx
and esi, 0x83
mov edi, ecx
and edi, 0x7c
or edi, esi
xor edi, 0x7c
and edi, edx
mov esi, ecx
or esi, ebx
not ebx
or ebx, edi
and ebx, esi
add bl, 0x7b
mov byte [esp + ecx - 0x52e28349], bl
inc ecx
dec edx
cmp ecx, 0x52e28462
jne 0x40d730
lea ebp, [esp + 0x38]
push 0
push 0
push 0
push 0
push ebp
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x444fc8]
mov ecx, 0x31761c34
xor ecx, dword [0x444fd0]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x414f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edi + 2], 0
lea edi, [edi + 2]
jne 0x414f70
mov esi, dword [ecx]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x414f90
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x414fb0
mov eax, 0xffffffff
jmp 0x414fb9
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.004095c0
add esp, 4
movzx ecx, word [esi]
mov dword [esp + 4], eax
test cx, cx
je 0x414ff1
add esi, 2
mov eax, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x414fe0
mov word [eax], 0x5c
add eax, 2
mov edx, dword [esp + 0x38]
movzx ecx, word [edx]
test cx, cx
je 0x415021
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x415010
mov word [eax], 0
lea eax, [esp + 8]
xor ebx, ebx
push 0x60
push 7
push 0x120089
push eax
push dword [esp + 0x14]
call fcn.0043fa20
add esp, 0x14
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp], 0xf3323173
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x8c
xor dl, byte [esp + ecx]
add dl, 0x44
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 4
jne case.default.0x41507c
xor ecx, ecx
cmp eax, dword [esp]
sete cl
jmp dword [ecx*4 + 0x44551c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], 0x337271ac
mov byte [esp + 0x10], 0
mov ebx, 0x121f414
mov edx, 0x1cde0beb
nop
nop
movzx esi, byte [esp + ebx - 0x121f408]
lea ebp, [esi + esi]
not ebp
add ebp, esi
and ebp, 0x9aae1c1c
and esi, 0xffffffe3
or esi, ebp
mov ebp, edx
and ebp, 0x188e080c
mov ecx, ebx
and ecx, 0x101e003
or ecx, ebp
xor ecx, esi
add ecx, 0x70563b9b
mov esi, ecx
and esi, 1
xor ecx, 1
lea ecx, [ecx + esi*2]
mov byte [esp + ebx - 0x121f408], cl
inc ebx
dec edx
cmp ebx, 0x121f419
jne 0x4150a0
mov ecx, dword [esp + 0xc]
xor edx, edx
cmp eax, ecx
sete dl
mov ebx, dword [esp + 0x14]
jmp dword [edx*4 + 0x445524]
mov ecx, eax
not ecx
shr ecx, 0x1f
jmp dword [ecx*4 + 0x44552c]
push 0x1388
mov esi, dword [esp + 8]
push esi
call fcn.004389e0
add esp, 8
push 0x60
push 7
push 0x120089
lea eax, [esp + 0x14]
push eax
push esi
call fcn.0043fa20
add esp, 0x14
mov ecx, eax
not ecx
shr ecx, 0x1f
jmp dword [ecx*4 + 0x44552c]
xor edx, edx
cmp ebx, 0xa
setb dl
jmp dword [edx*4 + 0x445534]