joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ddc3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0x18]
push edi
mov edi, ecx
test eax, eax
je 0x40dec5
push esi
mov esi, dword [edx]
mov dword [ebp - 0x14], esi
mov esi, dword [edx + 4]
mov dword [ebp - 0x10], esi
mov esi, dword [edx + 8]
mov edx, dword [edx + 0xc]
shr eax, 4
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edx
test eax, eax
je 0x40de8c
mov edx, ebx
sub ecx, edx
lea esi, [edx + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp + 0x18], eax
jmp 0x40de13
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
call fcn.004100d3
mov eax, dword [edi]
xor dword [ebx], eax
mov ecx, dword [edi + 4]
xor dword [esi - 8], ecx
mov edx, dword [edi + 8]
xor dword [esi - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + esi]
xor dword [esi], ecx
movzx eax, byte [ebp - 8]
movzx edx, byte [ebp - 7]
movzx ecx, byte [ebp - 6]
shl eax, 8
or eax, edx
movzx edx, byte [ebp - 5]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
inc eax
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 8], cl
mov edx, eax
mov ecx, eax
shr edx, 0x10
shr ecx, 8
add esp, 0x10
add edi, 0x10
add ebx, 0x10
add esi, 0x10
dec dword [ebp + 0x18]
mov byte [ebp - 7], dl
mov byte [ebp - 6], cl
mov byte [ebp - 5], al
jne 0x40de13
mov ecx, dword [ebp + 0x10]
sub ecx, edi
add ecx, dword [ebp + 0x14]
mov esi, ecx
je 0x40dec4
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x24]
push edx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
call fcn.004100d3
add esp, 0x10
xor eax, eax
test esi, esi
je 0x40dec4
sub ebx, edi
mov cl, byte [ebp + eax - 0x24]
xor cl, byte [edi]
inc eax
mov byte [ebx + edi], cl
inc edi
cmp eax, esi
jb 0x40deb5
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412963
Capabilities:
Encode data using xor

Disassembly:
ja 0x412931
xor al, 0xeb
out dx, eax
inc eax
test dword [esi + ebx*8], ebx
xor ch, bh
stc
push ss
cmp eax, 0x8c8405ca
in al, 0x1d
mov cl, 0xc4
add al, dl
int1
sal cl, 1
inc edx
call dword [edi + edi*8 + 0x57]
iretd
push ebp
mov ebp, esp
sub esp, 0x518
push esi
fdiv st(4)
mov eax, 0x8552a56
or cl, 0xce
xchg byte [esi], ch
and al, 0x3d
jle 0x4129a1
salc
xor al, 0x84
jae 0x41291a
test byte [ebx - 0x68], dh
or eax, 0xf82bcedc
mov dl, 0x74
loope 0x4129ee
aam 0x90
or dword [eax + 0x5997970e], 0x463d2308
movsb byte es:[edi], byte [esi]
xchg esi, eax
pop esi
inc ebp
sbb ebx, 0xa3e3af54
push edi
mov word [ebx], ds
mov dh, 0xe6
ficom dword [ebx + 0xe]
mov dword [0xb61b8c57], eax
out 0xda, al
push ebx
push cs
pop esi
cmp byte [edi + 0x28], cl
push ebx
je 0x4129b0
inc dword [esp + eax*4 - 0x234bdcc7]
loop 0x41297f
test byte [ecx + edi - 0x1d234bdd], al
mov byte [edx + 0x239f25cc], 0xbe
clc
loope 0x4129ca
or ah, 0x25
lahf
and edi, dword [esi + 0x6608e1f8]
adc byte [edi + ebx*4], ch
adc byte [edi + ebx*4], ch
mov esp, 0xfc6ab481
cld
inc edi
xor dword [esi + 0x12], ecx
invalid
out dx, al
mov cl, 0xec
or byte [ecx], 0x35
wait
push ebx
jnp 0x4129a9
mov fs, eax
and esi, eax
out 0xb3, eax
aad 0xab
in eax, 0x35
or bh, byte [edi + 0xe]
in al, 0x7f
cld
test dword [ebp + eax*2 - 0x51245d66], 0x5057efb2
push ss
inc ebx
xchg edi, eax
jo 0x412a84
imul ebp, dword [ebx - 7], 0x9302a08b
sal esi, cl
push edi
or dl, ah
adc ebx, dword [ebp - 0x605dcc14]
and dword [edx - 0x80], edx
dec ebp
mov byte [ecx + ebx*8 - 0x42], cl
and ch, byte [edi + 0x52f83429]
xor al, 0xf8
push edx
cmp dword [ecx], eax
invalid
adc dword [ecx - 0x69], ebx
adc eax, 0xd9b5fee6
cmc
dec esp
sbb dword [edx + 0x56], edx
insd dword es:[edi], dx
js 0x412a35
invalid

Function at 0x416083
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
xor ecx, ecx
mov edi, 0x100
nop
mov eax, ecx
shl eax, 0x18
mov esi, 8
lea ebx, [ebx]
test eax, eax
jns 0x4160b0
add eax, eax
xor eax, 0x4c11db7
jmp 0x4160b2
add eax, eax
dec esi
jne 0x4160a3
mov dword [edx], eax
inc ecx
add edx, 4
dec edi
jne 0x416093
pop edi
pop esi
pop ebp
ret

Function at 0x4160c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
push 0x3fc
lea eax, [ebp - 0x3fc]
push 0
push eax
mov dword [ebp - 0x400], 0
call fcn.0042e0f3
lea ecx, [ebp - 0x400]
push ecx
call fcn.00416083
mov esi, dword [ebp + 0xc]
add esp, 0x10
or eax, 0xffffffff
test esi, esi
je 0x416126
mov edx, dword [ebp + 8]
push edi
movzx edi, byte [edx]
mov ecx, eax
shr ecx, 0x18
xor ecx, edi
and ecx, 0xff
shl eax, 8
xor eax, dword [ebp + ecx*4 - 0x400]
inc edx
dec esi
jne 0x416107
pop edi
not eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x416163
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
pop ebp
ret
Function at 0x416e73
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
xor ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov edx, ecx
sub edx, eax
mov al, byte [edx + edi]
mov byte [ebp + ecx - 0x106], cl
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x416e85
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [ebp + eax - 0x208]
movzx edx, byte [ebp + eax - 0x106]
add ecx, esi
lea esi, [ecx + edx]
and esi, 0x800000ff
jns 0x416ee8
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + eax - 0x106]
mov dl, byte [ebp + esi - 0x106]
mov byte [ebp + eax - 0x106], dl
inc eax
mov byte [ebp + esi - 0x106], cl
cmp eax, 0x100
jl 0x416ec3
xor eax, eax
xor cl, cl
mov byte [ebp - 0x107], 0
cmp dword [ebp + 0xc], eax
jbe 0x416f94
mov edi, dword [ebp + 8]
push ebx
jmp 0x416f29
mov cl, byte [ebp - 0x108]
mov dl, byte [eax + edi]
inc cl
mov byte [ebp - 0x108], cl
movzx esi, cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, byte [ebp - 0x107]
add ecx, ebx
mov byte [ebp - 0x107], cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, cl
lea ecx, [ebp + ecx - 0x106]
mov byte [ebp - 1], bl
movzx ebx, byte [ecx]
mov byte [ebp + esi - 0x106], bl
movzx ebx, byte [ebp - 1]
mov byte [ecx], bl
movzx ebx, byte [ebp + esi - 0x106]
add bl, byte [ecx]
inc eax
movzx ecx, bl
mov cl, byte [ebp + ecx - 0x106]
xor cl, dl
mov byte [eax + edi - 1], cl
cmp eax, dword [ebp + 0xc]
jb 0x416f23
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x418513
Capabilities:
Encode data using xor

Disassembly:
add byte [eax + 0x57], dl
call fcn.0042b3e3
add esp, 0xc
lea ebx, [ebx]
push 0xff676980
push edi
call fcn.0041ad23
mov ecx, dword [ebp - 4]
add esp, 8
cmp byte [ecx + 5], 0xac
jne 0x4184b3
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x38]
push edx
push eax
push ecx
call fcn.00417053
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x38]
push edx
lea ecx, [esi + eax + 4]
push ebx
push ecx
call fcn.00417053
mov edx, dword [ebp - 4]
push 0
push edi
mov byte [edx], 0xf9
call fcn.0042c383
add esp, 0x20
nop
nop
nop
nop
nop
nop
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
scasd eax, dword es:[edi]
jl 0x4184a2
push ss
xchg esi, eax
loopne 0x418527
ficom word [esi - 0x72561129]
cmc
jle 0x418519
test eax, 0xed7ef58d
xchg esp, eax
add dword [esi - 0x36b585c5], esp
inc ecx
loope 0x4184c4
insb byte es:[edi], dx
cwde
cmp dword [eax - 0x1b93600a], ebx
mov dword [bp + si], esi
mov ebx, 0xb65dd2b5
cwde
neg byte [edi - 0x76981b94]
xor bh, byte [ebx - 0x49a22d4b]
fisub dword [edi]
and eax, 0xeb338fd1
and byte [eax - 0x6b], bl
cmpsd dword [esi], dword es:[edi]
mov eax, 0x311b49c0
out 0x37, al
dec ebx
xchg esi, eax
mul dword [edx + ecx*4 - 0x62]
pop edi
cmp byte [ebx + 0x69], dh
dec ebp
and dh, dh
push eax
sti
insd dword es:[edi], dx
imul ecx, dword [ebp + 0x20], 0x36fb50f6
insd dword es:[edi], dx
dec dword [edx - 0x36558fa5]
arpl word [ecx - 0x6258d820], si
stosb byte es:[edi], al
mov ecx, 0x8fc992fc
adc al, 0xa1
scasb al, byte es:[edi]
sahf
xor ebp, dword [ecx + 0x5ad06a21]
mov edx, 0xe1c753fd
or byte [bp - 0x43], bl
jle 0x418562
invalid
fisub word [ecx + 0x33]
pushal
add bl, dl
loop 0x4185e3
jmp 0x4185d1
das
js 0x418539
invalid
fisub word fs:[edx - 3]
mov dl, 0x59
ror ecx, cl
mov bl, 0x5c
adc byte [edi - 0x3d4ea2ca], ch
mov bl, 0xf2
xor byte [ebx + 0x2f546f8], bh
mov ebx, 0x2f546f8
lea esp, [0xa254051]
lea esp, [ecx + 7]
jl 0x4185be
mov ebp, 0xeb2e1391
rcr ah, 0x91
sar ch, 1
push eax
add al, 0x1c
add dh, byte [esi + ecx*8]
mov ebx, 0x4681d581
loop 0x41857b
adc ebp, dword [esi]
jmp 0x4185a7
mov edx, 0xc8017451
enter 0xffffffffffffba31, 0xffffffffffffff9d
cmp dl, byte [ecx + esi*2 + 0x39]
sbb eax, 0xe0051bdf
pushfd
mov al, byte [0xa6313ad6]
or al, 0xbd
imul esp, dword [ecx + 0x2f8bb72d], 0xffffffb6
sub dh, ah
loope 0x418668
dec edx
out 0x30, eax
pop ebx
sub dl, byte [eax]
stc
add eax, 0xac7e4069
cli
out 0xab, al
push edx
xlatb
and byte [edi], al
pop eax
imul edi, ebx, 0x4d
pop esp
dec esp
push edi
mov word [ebp - 0x5509cc3b], ss
pop esp
jnp 0x41861d
inc edx
aaa
pop ebp
jb 0x418683
cmc
add eax, 0x937af59c
call ecx
add esi, dword [ecx]
sub dword [ebx + 0x68], ebx
adc ecx, esp
mov esi, 0x455823b6
xor dword [esi], edi
fcmovbe st(0), st(4)
xchg esp, eax
pop ebx
out dx, eax
dec ebx
mov esp, edx
hlt
jmp 0xd44d53ee
ret
Function at 0x41a323
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov ebx, dword [ebp + 0x10]
shl ebx, 4
add ebx, dword [ebp + 0xc]
cmp dword [ebx + 4], 0
jne 0x41a3a6
mov edx, dword [ebp + 8]
push esi
push edi
mov edi, dword [edx + 0xb24]
xor ecx, ecx
push 0x2a
push ecx
lea edx, [ebp - 0x2a]
push edx
mov dword [ebp - 0x40], 0x430020
mov dword [ebp - 0x3c], 0x6f006f
mov dword [ebp - 0x38], 0x69006b
mov dword [ebp - 0x34], 0x730065
mov dword [ebp - 0x30], 0xa000d
mov word [ebp - 0x2c], cx
call fcn.0042e0f3
lea eax, [ebp - 0x40]
push eax
call fcn.0042e293
mov esi, eax
mov eax, dword [ebx + 8]
add esi, esi
lea ecx, [esi + 2]
push ecx
lea edx, [ebp - 0x40]
push edx
lea ecx, [eax + edi + 0x54d14]
push ecx
call fcn.0042e073
add esp, 0x1c
pop edi
mov dword [ebx + 4], esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41cc13
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x1000
push esi
mov dword [ebp - 0x24], 0x37018534
call fcn.0042e0a3
mov edi, dword [ebp + 0x14]
xor eax, eax
push edi
mov word [ebp - 8], 9
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov dword [ebp - 0x10], 0x45555254
mov byte [ebp - 0xc], al
mov word [ebp - 0xb], ax
mov byte [ebp - 9], al
mov dword [ebp - 0x18], 0x534c4146
mov dword [ebp - 0x14], 0x45
call fcn.0042e273
push eax
push edi
push esi
call fcn.0042e073
push 0
lea ecx, [ebp - 8]
push ecx
push esi
call fcn.0042e3a3
push 0
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.0042e3a3
push 0
lea eax, [ebp - 8]
push eax
push esi
call fcn.0042e3a3
mov ecx, dword [ebp + 0x18]
push 0
push ecx
push esi
call fcn.0042e3a3
add esp, 0x48
push 0
lea edx, [ebp - 8]
push edx
push esi
call fcn.0042e3a3
mov eax, dword [ebp + 0x1c]
add esp, 0xc
cmp byte [eax], 0x30
push 0
jne 0x41ccc1
lea ecx, [ebp - 0x18]
push ecx
jmp 0x41ccc5
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.0042e3a3
add esp, 0xc
push 0
lea eax, [ebp - 8]
push eax
push esi
call fcn.0042e3a3
mov ecx, dword [ebp + 0x20]
push 0
push ecx
push esi
call fcn.0042e3a3
push 0
lea edx, [ebp - 8]
push edx
push esi
call fcn.0042e3a3
mov eax, dword [ebp + 0x24]
push 0
push eax
push esi
call fcn.0042e3a3
push 0
lea ecx, [ebp - 8]
push ecx
push esi
call fcn.0042e3a3
mov edx, dword [ebp + 0x30]
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x10]
add esp, 0x3c
push 0xb
push edx
mov edx, dword [ecx + 0x3c4]
push eax
push edx
push esi
call fcn.0042e273
mov edi, dword [ebp + 8]
add esp, 4
add eax, esi
push eax
push edi
call fcn.00420823
lea eax, [ebp - 0x30]
push eax
push 0xb
push 0
push 0
push esi
push edi
call fcn.0042a003
add esp, 0x30
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x424863
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x42487d
mov edx, dword [ebp + 0x10]
test edx, edx
jne 0x424884
cmp dword [ebp + 0x18], edx
jne 0x424884
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x3c]
mov ecx, 0x5a4d
cmp word [edi], cx
jne 0x42487d
cmp dword [eax + edi], 0x4550
jne 0x42487d
mov ecx, dword [eax + edi + 0x7c]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x42487d
push ebx
push esi
mov esi, dword [eax + edi + 0x78]
mov ecx, dword [esi + edi + 0x24]
mov eax, dword [esi + edi + 0x20]
add esi, edi
add ecx, edi
mov dword [ebp - 8], ecx
mov ecx, dword [esi + 0x1c]
add eax, edi
add ecx, edi
cmp dword [ebp + 0x18], 0
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], ecx
je 0x424931
xor ebx, ebx
cmp dword [esi + 0x18], ebx
ja 0x4248e6
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + ebx*4]
mov eax, dword [ebp + 0x18]
add edx, edi
push edx
push eax
call fcn.00424803
add esp, 8
test eax, eax
jne 0x424909
inc ebx
cmp ebx, dword [esi + 0x18]
jb 0x4248e3
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + ebx*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
add eax, edi
cmp eax, esi
jbe 0x4248d6
add esi, dword [ebp - 4]
cmp eax, esi
jae 0x4248d6
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + ebx*4]
add ecx, edi
push ecx
jmp 0x4249c0
mov ebx, edx
shr ebx, 0x10
test ebx, ebx
je 0x424991
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jbe 0x4248d4
jmp 0x424949
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov ecx, dword [eax + ebx*4]
add ecx, edi
push ecx
push edx
call fcn.0042edf3
add esp, 8
test eax, eax
jne 0x424969
inc ebx
cmp ebx, dword [esi + 0x18]
jb 0x424943
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
movzx eax, word [edx + ebx*2]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax*4]
add eax, edi
cmp eax, esi
jbe 0x4248d6
add esi, dword [ebp - 4]
cmp eax, esi
jae 0x4248d6
mov ecx, dword [ebp + 0x10]
push ecx
jmp 0x4249c0
cmp edx, dword [esi + 0x14]
jae 0x4248d4
test edx, edx
je 0x4248d4
mov eax, edx
sub eax, dword [esi + 0x10]
mov eax, dword [ecx + eax*4]
add eax, edi
cmp eax, esi
jbe 0x4248d6
add esi, dword [ebp - 4]
cmp eax, esi
jae 0x4248d6
push edx
mov edx, dword [ebp + 0x14]
push edi
push edx
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00424d03
add esp, 0x14
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x425e73
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x425fd4
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x425fd4
push ebx
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x252]
push ecx
mov word [ebp - 0x254], ax
call fcn.0042e0f3
push pe_nt_image_headers32
push esi
call fcn.0042e0a3
push edi
call fcn.0042e293
mov esi, eax
lea edx, [esi + esi]
push edx
lea eax, [ebp - 0x254]
push edi
push eax
call fcn.0042e073
mov ebx, dword [ebp + 8]
xor eax, eax
add esp, 0x24
mov dword [ebp - 0x40], 0x6f004c
mov dword [ebp - 0x3c], 0x610063
mov dword [ebp - 0x38], 0x20006c
mov dword [ebp - 0x34], 0x740053
mov dword [ebp - 0x30], 0x740061
mov dword [ebp - 0x2c], 0x65
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x4c], 0xafb5aeea
xor edi, edi
lea ebx, [ebx]
cmp esi, 5
jbe 0x425f49
cmp word [ebp + esi*2 - 0x254], 0x5c
je 0x425f49
dec esi
cmp esi, 5
ja 0x425f38
lea ecx, [ebp - 0x40]
push ecx
call fcn.0042e293
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp + esi*2 - 0x252]
push ecx
call fcn.0042e073
lea edx, [ebp - 0x4c]
push edx
push 0
push 0x15
lea eax, [ebp - 0x254]
push eax
push ebx
call fcn.00428153
add esp, 0x24
test eax, eax
jne 0x425f9d
xor ecx, ecx
inc edi
mov word [ebp + esi*2 - 0x254], cx
cmp edi, 3
jb 0x425f33
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x254]
xor edx, edx
push eax
mov word [ebp + esi*2 - 0x252], dx
call fcn.0042e293
lea ecx, [eax + eax + 2]
mov eax, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x254]
push edx
push eax
call fcn.0042e073
add esp, 0x10
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42d653
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x42d6b9
cmp dword [esi + 0x18], 0
je 0x42d6d4
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0042ee23
add esp, 8
test eax, eax
jne 0x42d6b1
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x42d693
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x42d6d4
mov eax, dword [esi + 0x18]
test eax, eax
je 0x42d6d4
cmp eax, ecx
je 0x42d6b1
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x42d6c7
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42d6e3
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x42d73b
cmp dword [esi + 0x18], 0
je 0x42d73b
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0042ee23
add esp, 8
test eax, eax
jne 0x42d743
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x42d723
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42d843
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.0042e0f3
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x42d8ce
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0042e6b3
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.00424803
add esp, 0x10
test eax, eax
jne 0x42d8d6
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x42d8a3
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42dde3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x42ddf1
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42dded
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x42dded
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret
Function at 0x42eb03
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x42ed3f
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.0042e0f3
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x42eccf
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x42ecc5
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.00417053
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x42ecf0
inc eax
cmp byte [esi + eax], 0
jne 0x42ece9
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.0042e073
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x42ed0d
inc edi
cmp byte [edi + ebx], 0
jne 0x42ed06
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x42ed1d
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x42ed15
test esi, esi
je 0x42ed32
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.0042e0c3
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret