joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc2084c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0xc0ab50
call fcn.00c1737a
add esp, 0xc
mov byte [0xc0ab50], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0xc2356d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00c10fe8
add esp, 0xc
jns 0xc23588
clc
jo 0xc23595
jl 0xc2358d
nop
lea esp, [esp]
jno 0xc23595
mov ebp, 0xec45c6ee
inc esp
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
test dword [esp + 8], edi
xchg esi, esi
cmp edx, ebx
jns 0xc235dc
jmp 0xc235d1
ja 0xc235d3
jp 0xc235d5
jg 0xc235d7
js 0xc235dc
add eax, 0x4d8ab8b7
in al, dx
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.00c130b3
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xc2364e
xor eax, eax
jmp 0xc236ba
jge 0xc23650
neg ebx
neg ebx
lea esp, [esp]
jns 0xc23665
jge 0xc2365b
ja 0xc2365d
lea eax, [eax]
jno 0xc23661
js 0xc23665
jmp 0xed07c41e
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00c172c8
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00c10fe8
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0xc2368f
xor eax, eax
jmp 0xc236ba
jae 0xc23691
clc
jl 0xc2369a
jo 0xc23696
jge 0xc2369a
mov ecx, 0xfc458bf9
mov eax, dword [ebp - 4]
push eax
call fcn.00c20cf3
add esp, 4
jo 0xc236a8
lea ebx, [ebx]
jnp 0xc236ac
jl 0xc236b3
jl 0xc236b0
jge 0xc236b3
mov esi, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xc26765
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00c10fe8
add esp, 0xc
xchg edi, ebx
xchg edi, ebx
jns 0xc26789
jnp 0xc26786
js 0xc26789
add eax, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x55
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6e
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0
test edx, 0x1919
cmp edx, edi
test eax, edx
jb 0xc267f1
pushf
ror edx, 5
rol edx, 5
lea esp, [esp]
jle 0xc267e2
test esp, 0x7529
popf
lea ecx, [ecx]
xchg esi, esi
jae 0xc267f1
mov edx, 0x80ec4d8a
jmp 0xed0feffb
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
call fcn.00c130b3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xc26888
xor eax, eax
jmp 0xc2692f
shl esi, 0
jp 0xc26897
xchg esp, esp
mov esp, esp
jp 0xc26893
jnp 0xc26897
mov edx, 0xec4d8d0b
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00c172c8
mov dword [ebp - 0x18], eax
or esi, esi
xchg esi, edx
xchg esi, edx
ror ebx, 0
jbe 0xc268bf
jp 0xc268b4
jp 0xc268b6
je 0xc268b8
xchg edx, edx
ja 0xc268bf
add eax, 0x106a1426
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.00c10fe8
add esp, 0xc
jp 0xc268d1
jnp 0xc268d3
nop
jne 0xc268e1
jo 0xc268d8
je 0xc268da
js 0xc268dc
jnp 0xc268de
je 0xc268e1
mov esi, 0xe87d83
cmp dword [ebp - 0x18], 0
jne 0xc268eb
xor eax, eax
jmp 0xc2692f
xor ebx, ecx
xor ebx, ecx
je 0xc268f9
lea esp, [esp]
jne 0xc268f9
mov esp, 0x4d8be827
call 0xa4b45151
invalid
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00c20cf3
add esp, 4
lea edi, [edi]
jb 0xc26909
jnp 0xc26918
pushf
jb 0xc2690f
popf
ja 0xc26913
lea ecx, [ecx]
jp 0xc26918
jmp 0x52dabea7
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0xc28d7e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0xc0aba4], 1
jne 0xc28ef6
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00c10fe8
add esp, 0xc
xchg edi, edi
je 0xc28dba
jbe 0xc28daa
nop
lea eax, [eax + 0x38f3]
lea eax, [eax - 0x38f3]
jne 0xc28dba
mov ebp, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
shr esp, 0
jne 0xc28def
xor edx, 0
push ecx
pop ecx
jge 0xc28e13
pushf
xchg esp, esp
not edi
not edi
xchg edx, eax
xchg edx, eax
popf
lea ebx, [ebx + 0x369b]
lea ebx, [ebx - 0x369b]
jbe 0xc28e10
jl 0xc28e13
mov eax, 0x80e84d8a
jmp 0xe910161d
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.00c130b3
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0xc28e88
xor eax, eax
jmp 0xc28f4f
lea esi, [esi + 0x3a9e]
lea esi, [esi - 0x3a9e]
and ebx, 0xffffffff
js 0xc28ea2
ja 0xc28e9b
nop
mov esp, esp
jns 0xc28ea2
ljmp 0x8b50:0xe8458d8e
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00c172c8
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00c10fe8
add esp, 0xc
push ecx
add ecx, 0x52c9
ror ecx, 0x12
pop ecx
not esi
not esi
nop
stc
jno 0xc28ee0
lea ecx, [ecx]
js 0xc28ed9
jno 0xc28edb
xchg esp, esp
jo 0xc28ee0
ljmp 0xa74:0xf87d83
cmp dword [ebp - 8], 0
je 0xc28ef0
mov eax, dword [ebp - 8]
mov dword [0xc0aba4], eax
jmp 0xc28ef4
xor eax, eax
jmp 0xc28f4f
jmp 0xc28eff
mov ecx, dword [0xc0aba4]
mov dword [ebp - 8], ecx
lea esp, [esp]
cmp ecx, eax
lea esi, [esi]
add edi, 0
jne 0xc28f24
pushf
push esi
add esi, 0x988
ror esi, 0x1f
pop esi
stc
popf
ja 0xc28f1d
jo 0xc28f1f
xchg esp, esp
je 0xc28f24
mov edi, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov edi, edi
test dword [esp + 4], edi
jae 0xc28f38
jae 0xc28f34
jb 0xc28f38
mov ecx, 0xfc458b97
mov eax, dword [ebp - 4]
push eax
call fcn.00c20cf3
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xc2be33
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0xc2be47
jmp 0xc2bfff
jne 0xc2be49
rol ebx, 0x1f
rol ebx, 1
jb 0xc2be72
pushf
xchg edx, edx
ror ecx, 0x14
ror ecx, 0xc
and esp, 0xffffffff
popf
jp 0xc2be61
lea eax, [eax + 0x2867]
lea eax, [eax - 0x2867]
jbe 0xc2be6f
jae 0xc2be72
add eax, 0x8908458b
inc ebp
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0xc0af8c], edx
clc
jns 0xc2be9d
pushf
neg esi
neg esi
jnp 0xc2be8e
nop
ror esi, 0
popf
jg 0xc2be96
je 0xc2be98
jp 0xc2be9a
js 0xc2be9d
mov edi, 0x8bec458b
dec eax
add al, 0x89
or eax, 0xc0abb4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0xc0abb4], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0xc0abb0], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0xc0afa4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0xc0afa8], ecx
inc ebx
dec ebx
ror eax, 0
jb 0xc2bedc
mov edi, edi
jmp 0xc2bed7
nop
jae 0xc2bedc
xor dword [0x4df045c6], 0x70f145c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
cmc
jne 0xc2bf13
jae 0xc2bf2a
pushf
rol eax, 0xb
rol eax, 0x15
xor edi, eax
xor edi, eax
popf
jno 0xc2bf25
jns 0xc2bf27
jb 0xc2bf2a
add eax, 0x80f0558a
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
shl esp, 0
jl 0xc2bfa0
jge 0xc2bf99
jl 0xc2bf9b
jg 0xc2bf9d
jge 0xc2bfa0
call 0xac72fd27
rol byte [eax], 0
cmp dword [0xc0abb0], 0
je 0xc2bfbd
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0xc0abb0]
push eax
call fcn.00c172c8
mov dword [0xc0af88], eax
xchg ebx, edi
xchg ebx, edi
xchg esp, esp
lea eax, [eax + 0x294c]
lea eax, [eax - 0x294c]
jge 0xc2bfd1
je 0xc2bfef
pushf
xor ebx, 0x35ff
xor ebx, 0x35ff
nop
ror eax, 0
add esp, 0
popf
jl 0xc2bfec
jne 0xc2bfef
mov ebp, 0x6a0d6a
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.00c10fe8
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xc2ca2b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00c10fe8
add esp, 0xc
and edi, 0xffffffff
jno 0xc2ca4e
jle 0xc2ca4b
jo 0xc2ca4e
add esi, 0xc648e045
inc ebp
in eax, 0x65
mov byte [ebp - 0x20], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0xf], 0x58
mov byte [ebp - 0x1d], 0x4e
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x13], 0x4f
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x47
mov byte [ebp - 0x12], 0x62
xor eax, 0
xor edi, 0
jno 0xc2caa9
xchg edi, ebx
xchg edi, ebx
jo 0xc2caa9
sub eax, 0x80e04d8a
jmp 0xe11052b3
mov cl, byte [ebp - 0x20]
sub cl, 1
mov byte [ebp - 0x20], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x1e]
sub al, 1
mov byte [ebp - 0x1e], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x1d]
sub cl, 1
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x18]
sub dl, 1
mov byte [ebp - 0x18], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
shl eax, 0
nop
jne 0xc2cb65
pushf
lea esi, [esi]
call fcn.00c2cb54
Function at 0x413858
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4299d0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x41387a
shr eax, 1
xor eax, 0xedb88320
jmp 0x41387c
shr eax, 1
dec edx
jne 0x413868
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x413861
mov byte [0x429dd0], 1
pop esi
pop ebx
ret

Function at 0x413898
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x429dd0], 0
jne 0x4138af
call fcn.00413858
mov eax, edi
dec eax
test eax, eax
jl 0x4138d8
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4299d0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4138b9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00407949
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00407949
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00407949
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00407949
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00407949
mov dword [0x41203c], eax
call fcn.00407949
test eax, eax
jge 0x402550
push 8
call fcn.00407949
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00407949
pop ecx
push 1
call fcn.00407949
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00407949
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00407949
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00407949
jmp 0x402495

Function at 0x407949
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x407958
pop dword [ebp - 0x48]
mov eax, 0xc77bc05e
add eax, 0x38c4b8fa
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3e55e
push 0
mov eax, 0xab8b665d
add eax, 0x54b57a7b
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0xd99c9448
add ecx, 0x2663c6da
xor edx, edx
add edx, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 0x48]
mov esi, 0xddf9302e
add esi, 0xc22d6c76
xor dword [ebp - 0x38], 0x8d752555
mov edi, dword [ebx]
xor dword [ebp - 0x44], 0xc6c4534
add edi, esi
sub dword [ebp - 0x40], 0x68adb268
mov dword [edx], edi
add dword [ebp - 0x40], ecx
add edx, 4
add ebx, 4
loop 0x4079b3
add eax, 0x8b75c09f
sub eax, 0x8b746144
mov ebx, eax
add eax, 0xaa9422e5
sub eax, 0xaa9422e0
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x403685
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x4036e9
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x4036d2
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x4036c1
xor ecx, eax
xor edx, ebx
dec edi
jne 0x4036b2
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x419dd5
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x419e89
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00419d65
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x419e62
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419e95
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x419eb0
test ebp, ebp
je 0x419eb0
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x419eb8
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x419ef8
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x419f54
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x419f4f
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x419f3a
test dl, dl
je 0x419f36
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x419f3a
add ecx, 2
add eax, 2
test dl, dl
jne 0x419f1a
xor eax, eax
jmp 0x419f3f
sbb eax, eax
or eax, 1
test eax, eax
je 0x419f5e
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x419f07
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x419f75
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.00419dd5
test eax, eax
jne 0x419f8d
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.00419e95
mov esi, eax
test esi, esi
jne 0x419fc3
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x419fdd
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret