joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4070fd
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x40ba68], ebx
push esi
push edi
jne 0x40717d
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4071b8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x40ba68], eax
je 0x4071b8
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x40ba6c], eax
call esi
cmp dword [0x40b900], 2
mov dword [0x40ba70], eax
jne 0x40717d
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x40ba78], eax
je 0x40717d
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x40ba74], eax
mov eax, dword [0x40ba74]
test eax, eax
je 0x4071c2
call eax
test eax, eax
je 0x4071a9
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x40ba78]
test eax, eax
je 0x4071a9
test byte [ebp - 8], 1
jne 0x4071c2
cmp dword [0x40b90c], 4
jb 0x4071bc
or byte [ebp + 0x12], 0x20
jmp 0x4071e1
xor eax, eax
jmp 0x4071f1
or byte [ebp + 0x12], 4
jmp 0x4071e1
mov eax, dword [0x40ba6c]
test eax, eax
je 0x4071e1
call eax
mov ebx, eax
test ebx, ebx
je 0x4071e1
mov eax, dword [0x40ba70]
test eax, eax
je 0x4071e1
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x40ba68]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404350
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x404430
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x404430
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40439a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x4043a1
inc edi
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
mov ecx, esi
cmp ebp, edi
jne 0x404380
jmp 0x4043a3
mov esi, 0x1505
jmp 0x4043a3
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x404430
mov eax, edi
or eax, 1
mov ebx, edi
or ebx, 0xfffffffe
add ebx, eax
and ebx, esi
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x4043d4
inc ebx
dec edi
je 0x40442e
mov eax, ebx
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x40442e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x4043d0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040c820
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x4043d0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040c840
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x4043d0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x404430
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404bb0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x404d03
mov esi, dword [esp + 0x28]
test esi, esi
je 0x404d03
cmp dword [esp + 0x2c], 0
je 0x404d03
push esi
call fcn.0040c820
add esp, 4
test eax, eax
je 0x404c1a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x404c21
inc edi
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
mov ecx, ebx
cmp eax, edi
jne 0x404c00
jmp 0x404c23
mov ebx, 0x1505
jmp 0x404c23
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x404ca5
mov dword [esp], eax
mov eax, edi
or eax, 1
mov esi, edi
or esi, 0xfffffffe
add esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404c54
inc esi
dec edi
je 0x404ca5
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404caa
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x404c50
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040c820
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404c50
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040c840
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404c50
mov eax, 0xffffffff
jmp 0x404d03
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jae 0x404cef
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
jmp 0x404d03
call fcn.00405930
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
je 0x404d0b
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push ecx
call fcn.0040c820
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x404d9e
mov eax, edi
or eax, 1
mov esi, edi
or esi, 0xfffffffe
add esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404d44
inc esi
dec edi
je 0x404d9e
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404cb2
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x404d40
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040c820
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404d40
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040c840
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404d40
jmp 0x404cb2
mov ebp, 0xffffffff
jmp 0x404cb2
Function at 0x405680
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405861
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405861
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405861
cmp dword [ecx], 0
jne 0x405861
push esi
call fcn.0040c820
add esp, 4
test eax, eax
je 0x4056ea
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x4056f1
inc ebx
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
mov ecx, edi
cmp eax, ebx
jne 0x4056d0
jmp 0x4056f3
mov edi, 0x1505
jmp 0x4056f3
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
test edx, edx
je 0x4057ab
mov dword [esp], eax
mov eax, edx
or eax, 1
mov esi, edx
or esi, 0xfffffffe
add esi, eax
and esi, edi
lea eax, [edx - 1]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405734
inc esi
dec edx
je 0x4057ab
mov ebp, esi
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ebx, dword [eax + ebp*4]
cmp ebx, 0xffffffff
je 0x4057b0
mov eax, dword [ecx + 8]
cmp dword [eax + ebx*4], edi
jne 0x405730
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + ebx*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040c820
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405730
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040c840
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405730
mov eax, dword [ecx + 0x10]
push dword [eax + ebx*4]
call fcn.00404760
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ebx*4], esi
jmp 0x405854
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x4057f0
call fcn.00405930
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405861
push esi
call fcn.0040c820
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405870
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040c820
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x44e008]
add esp, 4
test eax, eax
je 0x40585c
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c6f0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405861
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406990
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406b46
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406b3f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406a25
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406b3f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406aa5
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
mov esi, edi
and esi, eax
xor edi, eax
lea eax, [edi + esi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406a40
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x4069ed
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406af0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406ad0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4069e0
jmp 0x406aff
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4069e0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406b10
jmp 0x4069e0
shl ecx, 0x10
or ecx, edi
jmp 0x406b4b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x406bbe
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x406bc0
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
mov ebp, eax
not ebp
or ebp, 0xf
add eax, ebp
inc eax
mov ebp, edi
and ebp, 0xf
xor ebp, eax
xor ebx, dword [ebp*4 + 0x44bc50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44bc50]
inc esi
cmp edx, esi
jne 0x406b80
not eax
jmp 0x406bc0
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cde0
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.00444720
test al, al
je 0x40cfce
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043c240
test al, al
je 0x40cfc9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0x66ad181d
mov dword [esp + 8], 0x2a105632
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x40ce66
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040cfe0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x40ce40
mov dword [esp + 4], 0xc6af6525
mov dword [esp + 8], 0xf8af0a23
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40cec6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d060
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40cea0
mov dword [esp], 0xf7f609e9
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x40cf09
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax]
push dword [esp + 4]
push eax
call fcn.0040d0e0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x40cee0
test esi, esi
je 0x40cf66
mov dword [esp + 4], 0x49a71d73
mov dword [esp + 8], 0xe3f8ec2a
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40cf66
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d130
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40cf40
mov dword [esp + 4], 0xfefdfc03
mov dword [esp + 8], 0xfaf9f8ff
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40cfb6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d1b0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40cf90
call fcn.0040e710
test al, al
je 0x40cfc9
call fcn.00412500
call fcn.00410640
call fcn.004457c0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x58
mov esi, ecx
mov edi, dword [esp + 0x68]
add edi, dword [ecx + 0x60]
mov word [esp + 4], 0x8b85
mov byte [esp + 6], 0x92
mov dword [esp + 7], 0
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
cmp eax, 6
ja 0x40d49b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x14]
movzx eax, byte [esp + eax + 4]
push dword [esp + 0x14]
push eax
call fcn.0040e220
add esp, 8
mov ecx, dword [esp + 0x14]
mov byte [esp + ecx + 4], al
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, 7
jb 0x40d470
mov dword [esp + 0xc], 0xcaccc8d2
mov dword [esp + 0x10], 0xe7ce
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
cmp eax, 7
ja 0x40d4eb
nop
nop
nop
nop
mov eax, dword [esp + 0x14]
movzx eax, byte [esp + eax + 0xc]
push dword [esp + 0x14]
push eax
call fcn.0040e1d0
add esp, 8
mov ecx, dword [esp + 0x14]
mov byte [esp + ecx + 0xc], al
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, 8
jb 0x40d4c0
mov dword [esp + 0x14], 0xbe447073
mov dword [esp + 0x18], 0xc2be6c68
mov dword [esp + 0x1c], 0xc5cec413
mov dword [esp + 0x20], 0xcac1c6c9
mov dword [esp + 0x24], 0x2c9c5c6
mov dword [esp + 0x28], 0xdc2f6967
mov dword [esp + 0x2c], 0xdfd1c3da
mov dword [esp + 0x30], 0xde361cc4
mov dword [esp + 0x34], 0xccd7d7c9
mov dword [esp + 0x38], 0xecd9cfdb
mov dword [esp + 0x3c], 0xe75e35ea
mov dword [esp + 0x40], 0x22ede9e9
mov dword [esp + 0x44], 0x12fa14e8
mov dword [esp + 0x48], 0xee45335
mov dword [esp + 0x4c], 0x4b29f0fb
mov byte [esp + 0x50], 0x68
mov dword [esp + 0x51], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x40
ja 0x40d5a6
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x14]
push dword [esp]
push eax
call fcn.0040e180
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x41
jb 0x40d580
mov ecx, dword [esp + 0x6c]
movzx edx, byte [esp + 0x14]
mov eax, edi
test dl, dl
je 0x40d5cb
lea ebx, [esp + 0x15]
mov eax, edi
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40d5c0
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40d5eb
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40d5e0
mov ecx, dword [esp + 0x70]
mov byte [eax], 0
movzx edx, byte [esp + 0xc]
test dl, dl
je 0x40d60b
lea ebx, [esp + 0xd]
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40d600
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40d62b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40d620
mov byte [eax], 0
movzx ecx, byte [esp + 4]
test cl, cl
je 0x40d64b
lea edx, [esp + 5]
nop
nop
nop
nop
nop
mov byte [eax], cl
inc eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x40d640
mov byte [eax], 0
mov ecx, eax
xor ecx, edi
not edi
and edi, eax
add edi, edi
sub edi, ecx
add dword [esi + 0x60], edi
add esp, 0x58
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x40ffa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x454308]
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x41004e
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + str.UAA]
xor eax, eax
jmp 0x41056f
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41c100
Capabilities:
Contain obfuscated stackstrings
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa50
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x41c120
sar esi, 1
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x455640]
mov ebx, dword [esp + 0x2c]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41c154
mov eax, 0xffffffff
jmp 0x41c157
lea eax, [ebx + ebx]
push eax
call fcn.0040c6c0
add esp, 4
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov dword [esp + 0x20], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x455640]
mov eax, dword [esp + 0x2c]
mov ecx, eax
add ecx, 0xd
js 0x41c18c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c6c0
add esp, 4
mov esi, eax
mov dword [esp + 0x250], 0xb1c28ff0
mov dword [esp + 0x254], 0xb527b3d3
mov dword [esp + 0x258], 0xb996b720
mov dword [esp + 0x25c], 0xbdddbbce
mov dword [esp + 0x260], 0xa12bbf2e
mov dword [esp + 0x264], 0xa533a3cb
mov dword [esp + 0x268], 0xa9a6a7ca
mov dword [esp + 0x26c], 0
mov dword [esp + 0x6c0], 0
mov eax, dword [esp + 0x6c0]
cmp eax, 0x1f
ja 0x41c250
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x6c0]
movzx eax, byte [esp + eax + 0x250]
push dword [esp + 0x6c0]
push eax
call fcn.00421550
add esp, 8
mov ecx, dword [esp + 0x6c0]
mov byte [esp + ecx + 0x250], al
inc dword [esp + 0x6c0]
mov eax, dword [esp + 0x6c0]
cmp eax, 0x20
jb 0x41c210
mov eax, dword [esp + 0x18]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x41c281
mov eax, dword [esp + 0x18]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41c270
mov word [eax], 0
movzx ecx, word [esp + 0x250]
test cx, cx
je 0x41c2b1
lea edx, [esp + 0x252]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41c2a0
mov word [eax], 0
lea eax, [esp + 0x130]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.004493c0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x450188]
Function at 0x423740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x423760
cmp eax, 0xffffffdd
jge 0x423777
mov eax, 0xffffffff
jmp 0x42377a
add eax, 0x22
push eax
call fcn.0040c6c0
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0xf76909ac
mov dword [esp + 0x1c], 0xf361f568
mov dword [esp + 0x20], 0xff5ff16e
mov dword [esp + 0x24], 0xfb57fd57
mov dword [esp + 0x28], 0xe74af95c
mov dword [esp + 0x2c], 0xe348e549
mov dword [esp + 0x30], 0xef73e141
mov dword [esp + 0x34], 0xeb76ed78
mov dword [esp + 0x38], 0xe9e8
mov byte [esp + 0x3c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x24
ja 0x42381b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.00424460
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x25
jb 0x4237f0
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x423841
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x423830
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x423871
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423860
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x51bf4fa3
mov dword [esp + 0x1c], 0x557d53aa
mov dword [esp + 0x20], 0x59ae57b3
mov dword [esp + 0x24], 0x5dbd5bac
mov dword [esp + 0x28], 0x61ab5fb2
mov dword [esp + 0x2c], 0x6593638b
mov dword [esp + 0x30], 0x694b678a
mov dword [esp + 0x34], 0x6d476b45
mov dword [esp + 0x38], 0x71b06f46
mov dword [esp + 0x3c], 0x75877387
mov dword [esp + 0x40], 0x79847793
mov dword [esp + 0x44], 0x7d8b7bbd
mov dword [esp + 0x48], 0x18a7f92
mov dword [esp + 0x4c], 0x5fa03e7
mov dword [esp + 0x50], 0x9cd07f0
mov dword [esp + 0x54], 0xd350bec
mov dword [esp + 0x58], 0x110e0f26
mov word [esp + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x45
ja 0x423956
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.004244c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x46
jb 0x423930
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x423c60
push ecx
push esi
call fcn.00424680
add esp, 0x10
jmp dword [0x4505d0]