joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101294b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
movzx eax, word [esp + 0xc]
mov ecx, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 8], eax
push esi
push edi
movzx eax, word [ebp + eax*2 + 0x11a]
cmp eax, ecx
jbe 0x10129524
mov edi, dword [ebp + 0x10]
mov dl, byte [edi + eax*8 + 4]
lea ebx, [edi + eax*8]
movzx eax, word [ebx]
and dl, 0x1f
cmp eax, ecx
je 0x10129551
test dl, dl
jne 0x1012951c
cmp word [esp + 0x1c], 0x40
movzx edx, word [edi + eax*8 + 2]
movzx esi, word [edi + ecx*8 + 2]
je 0x10129508
mov al, byte [edi + esi*8 + 4]
xor al, byte [edi + edx*8 + 4]
test al, 0x1f
jne 0x1012951c
cmp edx, esi
je 0x10129549
cmp edx, 0x8000
jae 0x10129549
cmp esi, 0x8000
jae 0x10129549
movzx eax, word [ebx + 6]
cmp eax, ecx
ja 0x101294d5
mov eax, dword [esp + 0x10]
movzx eax, word [ebp + eax*2 + 0x10c]
cmp eax, ecx
jbe 0x10129549
mov esi, dword [ebp + 0x10]
lea edx, [esi + eax*8]
movzx eax, word [edx]
cmp eax, ecx
je 0x1012955e
movzx eax, word [edx + 6]
cmp eax, ecx
ja 0x10129537
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
xor eax, eax
test dl, dl
pop esi
pop ebp
setne al
pop ebx
pop ecx
ret
test byte [edx + 4], 0x1f
mov eax, 0
pop edi
pop esi
pop ebp
setne al
pop ebx
pop ecx
ret
Function at 0x1015923b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10158ee2

Function at 0x10159246
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1015906c
Function at 0x4093d1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x34], ebx
je 0x40947e
mov al, 0x66
mov dword [ebp - 0x21], 0x786f5c66
mov dword [ebp - 0x1d], 0x72677b7a
mov ecx, ebx
mov dword [ebp - 0x19], 0x6b6b784c
mov word [ebp - 0x15], 0x7e4b
mov byte [ebp - 0x13], bl
movsx eax, al
and eax, 0x8000000f
jns 0x409417
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, 0xd
jae 0x409426
mov al, byte [ebp - 0x21]
jmp 0x409408
mov byte [ebp - 0x13], bl
mov cl, 0x1a
mov dword [ebp - 0x12], 0x687f511a
mov eax, ebx
mov dword [ebp - 0xe], 0x29767f74
mov dword [ebp - 0xa], 0x767e3428
mov word [ebp - 6], 0x76
xor byte [ebp + eax - 0x11], cl
inc eax
cmp eax, 0xc
jae 0x409457
mov cl, byte [ebp - 0x12]
jmp 0x409448
lea edx, [ebp - 0x20]
mov byte [ebp - 5], bl
lea ecx, [ebp - 0x11]
call fcn.0040c457
mov dword [ebp - 4], 0x8250
mov ecx, dword [ebp - 4]
xor ecx, 0x250
push ecx
push ebx
push dword [esi + 0x34]
push 0xffffffffffffffff
call eax
lea ecx, [esi + 0x140]
call fcn.0040aec1
pop esi
pop ebx
leave
ret
Function at 0x40adc7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x453649
call fcn.004534f4
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov al, 0x10
mov dword [ebp - 0x26], 0x65724310
mov dword [ebp - 0x22], 0x54657461
mov dword [ebp - 0x1e], 0x61657268
mov word [ebp - 0x1a], 0x64
mov edx, ebx
mov dword [ebp - 0x14], edx
cmp edx, 0xc
jae 0x40ae2b
movsx ecx, al
and ecx, 0x8000000f
jns 0x40ae18
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x25]
sub al, cl
mov byte [ebp + edx - 0x25], al
inc edx
mov dword [ebp - 0x14], edx
mov al, byte [ebp - 0x26]
jmp 0x40ae03
mov byte [ebp - 0x19], bl
lea edi, [ebp - 0x25]
mov al, 0x44
mov dword [ebp - 0x34], 0x76694f44
mov dword [ebp - 0x30], 0x37706972
mov dword [ebp - 0x2c], 0x70683236
mov word [ebp - 0x28], 0x70
mov edx, ebx
mov dword [ebp - 0x18], edx
cmp edx, 0xc
jae 0x40ae7b
movsx ecx, al
and ecx, 0x8000000f
jns 0x40ae68
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x33]
sub al, cl
mov byte [ebp + edx - 0x33], al
inc edx
mov dword [ebp - 0x18], edx
mov al, byte [ebp - 0x34]
jmp 0x40ae53
mov byte [ebp - 0x27], bl
mov edx, edi
lea ecx, [ebp - 0x33]
call fcn.0040c457
push ebx
push ebx
push esi
push 0x40ac55
push ebx
push ebx
call eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c18e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
or esi, 0xffffffff
xor edi, edi
test edx, edx
je 0x40c1b1
movzx eax, byte [edi + ecx]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x405ea0]
inc edi
cmp edi, edx
jb 0x40c199
not esi
pop edi
mov eax, esi
pop esi
ret

Function at 0x40c2e1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x4536a9
call fcn.004534f4
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, edx
mov dword [ebp - 0x2c], ebx
mov edx, ecx
and dword [ebp - 4], 0
mov dword [ebp - 0x20], edx
mov eax, dword [edx + 0x3c]
add eax, 0x78
add eax, edx
mov dword [ebp - 0x38], eax
mov ecx, dword [eax]
add ecx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx + 0x1c]
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0x24]
add eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ecx + 0x20]
add eax, edx
mov dword [ebp - 0x28], eax
and dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0x61c
mov ecx, dword [ebp - 0x24]
xor ecx, 0x60c
mov eax, ebx
shr eax, cl
test eax, eax
jne 0x40c3dc
movzx esi, bx
mov edi, dword [ebp - 0x18]
cmp esi, dword [edi + 0x10]
jb 0x40c441
mov eax, dword [edi + 0x14]
add eax, dword [edi + 0x10]
cmp esi, eax
ja 0x40c441
sub esi, dword [edi + 0x10]
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax + esi*4]
add esi, edx
mov dword [ebp - 0x14], esi
cmp esi, edi
jb 0x40c433
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 4]
add eax, edi
cmp esi, eax
jae 0x40c433
push esi
call fcn.00448a7b
pop ecx
mov edi, eax
test edi, edi
je 0x40c441
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x3c], eax
mov cl, byte [eax]
mov dl, cl
cmp cl, 0x2e
je 0x40c3bd
inc eax
mov dword [ebp - 0x3c], eax
mov cl, byte [eax]
mov dl, cl
test cl, cl
jne 0x40c3aa
xor ebx, ebx
cmp dl, 0x2e
cmove ebx, eax
mov byte [ebx], 0
mov ecx, edi
call fcn.0040c292
test eax, eax
jne 0x40c41d
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x40c42c
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
cmp ebx, dword [edi + 0x18]
jae 0x40c377
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + ebx*4]
add eax, dword [ebp - 0x20]
push eax
push dword [ebp - 0x2c]
call fcn.00448ad0
pop ecx
pop ecx
test eax, eax
jne 0x40c417
mov eax, dword [ebp - 0x30]
movzx eax, word [eax + ebx*2]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx + eax*4]
add esi, dword [ebp - 0x20]
mov dword [ebp - 0x14], esi
inc ebx
mov dword [ebp - 0x34], ebx
jmp 0x40c3e7
lea edx, [ebx + 1]
mov ecx, eax
call fcn.0040c2e1
mov esi, eax
mov dword [ebp - 0x14], esi
push edi
call fcn.00448b5c
pop ecx
mov eax, esi
jmp 0x40c443
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ce55
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x4536f1
call fcn.004534f4
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
movaps xmm0, xmmword [0x407690]
movups xmmword [ebp - 0x3a], xmm0
mov dword [ebp - 0x2a], 0x1d2f39
mov ecx, ebx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x12
jae 0x40ce97
mov al, byte [ebp + ecx - 0x39]
xor al, byte [ebp - 0x3a]
mov byte [ebp + ecx - 0x39], al
inc ecx
jmp 0x40ce81
mov byte [ebp - 0x27], bl
lea esi, [ebp - 0x39]
mov al, 0x79
mov dword [ebp - 0x26], 0x7b6e5479
mov dword [ebp - 0x22], 0x3c756e77
mov dword [ebp - 0x1e], 0x756d373b
mov word [ebp - 0x1a], 0x75
mov edx, ebx
mov dword [ebp - 0x18], edx
cmp edx, 0xc
jae 0x40cee7
movsx ecx, al
and ecx, 0x8000000f
jns 0x40ced4
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x25]
sub al, cl
mov byte [ebp + edx - 0x25], al
inc edx
mov dword [ebp - 0x18], edx
mov al, byte [ebp - 0x26]
jmp 0x40cebf
mov byte [ebp - 0x19], bl
mov edx, esi
lea ecx, [ebp - 0x25]
call fcn.0040c457
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x40ceff
mov ecx, dword [ecx]
push 0x80
push ecx
call eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x414050
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebx, ecx
lea ecx, [eax - 1]
push esi
mov ebp, ecx
mov dword [esp + 0x10], ecx
push edi
mov edi, edx
sar ebp, 1
mov dword [esp + 0x10], edi
mov esi, edi
cmp edi, ebp
jge 0x4140aa
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x18
add ecx, ebx
lea eax, [ecx - 0x18]
push eax
push ecx
call fcn.00414005
movzx eax, al
xor eax, 1
imul ecx, edi, 0x18
inc eax
add esi, eax
imul eax, esi, 0x18
add ecx, ebx
add eax, ebx
push eax
call fcn.0040cac9
mov edi, esi
cmp esi, ebp
jl 0x414073
mov eax, dword [esp + 0x1c]
cmp esi, ebp
jne 0x4140c9
test al, 1
jne 0x4140c9
imul eax, eax, 0x18
imul ecx, edi, 0x18
add eax, 0xffffffe8
add eax, ebx
add ecx, ebx
push eax
call fcn.0040cac9
mov edi, dword [esp + 0x14]
cmp dword [esp + 0x10], edi
jge 0x4140fa
push dword [esp + 0x20]
lea esi, [edi - 1]
sar esi, 1
imul ebp, esi, 0x18
add ebp, ebx
push ebp
call fcn.00414005
test al, al
je 0x4140fa
imul ecx, edi, 0x18
push ebp
add ecx, ebx
call fcn.0040cac9
mov edi, esi
cmp dword [esp + 0x10], esi
jl 0x4140cf
push dword [esp + 0x20]
imul ecx, edi, 0x18
add ecx, ebx
call fcn.0040cac9
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc

Function at 0x4142b0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x1a4
push ebx
push ebp
push esi
push edi
push 0x40
mov esi, edx
mov edi, ecx
pop ebp
cmp esi, ebp
jbe 0x4142f0
lea ecx, [esp + 0x150]
call fcn.0041e100
push esi
mov edx, edi
call fcn.0041e12b
lea edx, [esp + 0x150]
lea ecx, [esp + 0x54]
call fcn.0041e1d3
push 0x14
lea edi, [esp + 0x58]
pop esi
lea ecx, [esp + 0x90]
call fcn.0041e100
xor ebx, ebx
mov edx, ebx
test esi, esi
je 0x414321
mov ebp, edi
lea eax, [esp + 0x10]
sub ebp, eax
lea ecx, [esp + 0x10]
add ecx, edx
mov al, byte [ecx + ebp]
xor al, 0x36
inc edx
mov byte [ecx], al
cmp edx, esi
jb 0x41430c
push 0x40
pop ebp
cmp esi, ebp
jae 0x41433b
mov eax, ebp
sub eax, esi
push eax
lea eax, [esp + 0x14]
add eax, esi
push 0x36
push eax
call fcn.00445a50
add esp, 0xc
push ebp
lea edx, [esp + 0x14]
lea ecx, [esp + 0x94]
call fcn.0041e12b
push dword [esp + 0x1bc]
mov edx, dword [esp + 0x1bc]
lea ecx, [esp + 0x94]
call fcn.0041e12b
lea edx, [esp + 0x90]
lea ecx, [esp + 0x68]
call fcn.0041e1d3
lea ecx, [esp + 0xf0]
call fcn.0041e100
test esi, esi
je 0x41439e
lea eax, [esp + 0x10]
sub edi, eax
lea ecx, [esp + 0x10]
add ecx, ebx
mov al, byte [edi + ecx]
xor al, 0x5c
inc ebx
mov byte [ecx], al
cmp ebx, esi
jb 0x41438c
cmp esi, ebp
jae 0x4143b8
mov eax, ebp
sub eax, esi
push eax
lea eax, [esp + 0x14]
add eax, esi
push 0x5c
push eax
call fcn.00445a50
add esp, 0xc
push ebp
lea edx, [esp + 0x14]
lea ecx, [esp + 0xf4]
call fcn.0041e12b
push 0x14
pop ebx
push ebx
lea edx, [esp + 0x6c]
lea ecx, [esp + 0xf4]
call fcn.0041e12b
lea edx, [esp + 0xf0]
lea ecx, [esp + 0x7c]
call fcn.0041e1d3
mov eax, dword [esp + 0x1c4]
mov ecx, dword [eax]
cmp ecx, ebx
cmova ecx, ebx
mov dword [eax], ecx
lea eax, [esp + 0x7c]
push ecx
push eax
push dword [esp + 0x1c8]
call fcn.004454d0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a4
ret 0x10
Function at 0x41852b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x453a21
call fcn.004534f4
sub esp, 0x134
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
movaps xmm0, xmmword [0x407f50]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x4b6f77
mov edx, ebx
mov dword [ebp - 0x24], edx
cmp edx, 0x12
jae 0x418580
movsx ecx, byte [ebp - 0x3c]
and ecx, 0x8000000f
jns 0x418573
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x3b]
sub al, cl
mov byte [ebp + edx - 0x3b], al
inc edx
jmp 0x41855a
mov byte [ebp - 0x29], bl
lea esi, [ebp - 0x3b]
mov al, 0x42
mov dword [ebp - 0x1e], 0x74674d42
mov dword [ebp - 0x1a], 0x356e6770
mov dword [ebp - 0x16], 0x6e663034
mov word [ebp - 0x12], 0x6e
mov edx, ebx
mov dword [ebp - 0x28], edx
cmp edx, 0xc
jae 0x4185d0
movsx ecx, al
and ecx, 0x8000000f
jns 0x4185bd
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x1d]
sub al, cl
mov byte [ebp + edx - 0x1d], al
inc edx
mov dword [ebp - 0x28], edx
mov al, byte [ebp - 0x1e]
jmp 0x4185a8
mov byte [ebp - 0x11], bl
mov edx, esi
lea ecx, [ebp - 0x1d]
call fcn.0040c457
push 0x104
lea ecx, [ebp - 0x140]
push ecx
push ebx
call eax
push eax
lea eax, [ebp - 0x140]
push eax
mov ecx, dword [ebp + 8]
call fcn.00417ad9
jmp 0x418615
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41c1db
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x453a45
call fcn.004534f4
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
movaps xmm0, xmmword [0x408480]
movups xmmword [ebp - 0x3a], xmm0
mov dword [ebp - 0x2a], 0x46786a
mov edx, ebx
mov dword [ebp - 0x14], edx
cmp edx, 0x12
jae 0x41c22d
movsx ecx, byte [ebp - 0x3a]
and ecx, 0x8000000f
jns 0x41c220
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x39]
sub al, cl
mov byte [ebp + edx - 0x39], al
inc edx
jmp 0x41c207
mov byte [ebp - 0x27], bl
lea esi, [ebp - 0x39]
mov al, 0x22
mov dword [ebp - 0x26], 0x74674d22
mov dword [ebp - 0x22], 0x356e6770
mov dword [ebp - 0x1e], 0x6e663034
mov word [ebp - 0x1a], 0x6e
mov edx, ebx
mov dword [ebp - 0x18], edx
cmp edx, 0xc
jae 0x41c27d
movsx ecx, al
and ecx, 0x8000000f
jns 0x41c26a
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x25]
sub al, cl
mov byte [ebp + edx - 0x25], al
inc edx
mov dword [ebp - 0x18], edx
mov al, byte [ebp - 0x26]
jmp 0x41c255
mov byte [ebp - 0x19], bl
mov edx, esi
lea ecx, [ebp - 0x25]
call fcn.0040c457
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x41c295
mov ecx, dword [ecx]
push ecx
call eax
cmp eax, 0xffffffff
setne al
jmp 0x41c2ac
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41c556
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x453a69
call fcn.004534f4
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dl, 0x47
mov dword [ebp - 0x29], 0x282b0447
mov dword [ebp - 0x25], 0x260f2234
mov dword [ebp - 0x21], 0x222b2329
mov byte [ebp - 0x1d], bl
mov ecx, ebx
mov dword [ebp - 0x14], ecx
cmp ecx, 0xb
jae 0x41c5aa
mov al, byte [ebp + ecx - 0x28]
xor al, dl
mov byte [ebp + ecx - 0x28], al
inc ecx
mov dword [ebp - 0x14], ecx
mov dl, byte [ebp - 0x29]
jmp 0x41c592
mov byte [ebp - 0x1d], bl
lea edi, [ebp - 0x28]
mov al, 0x45
mov dword [ebp - 0x37], 0x776a5045
mov dword [ebp - 0x33], 0x38716a73
mov dword [ebp - 0x2f], 0x71693337
mov word [ebp - 0x2b], 0x71
mov edx, ebx
mov dword [ebp - 0x18], edx
cmp edx, 0xc
jae 0x41c5fa
movsx ecx, al
and ecx, 0x8000000f
jns 0x41c5e7
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x36]
sub al, cl
mov byte [ebp + edx - 0x36], al
inc edx
mov dword [ebp - 0x18], edx
mov al, byte [ebp - 0x37]
jmp 0x41c5d2
mov byte [ebp - 0x2a], bl
mov edx, edi
lea ecx, [ebp - 0x36]
call fcn.0040c457
push dword [esi + 0xc]
call eax
or dword [ebp - 4], 0xffffffff
jmp 0x41c61f
mov ecx, esi
call fcn.0040c108
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e100
Capabilities:
Hash data using sha1

Disassembly:
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
ret

Function at 0x41e2b1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
xor edx, edx
mov dword [ebp - 0xa], 0x706b4e27
mov esi, ecx
mov dword [ebp - 6], 0x6c794d77
mov al, 0x27
mov word [ebp - 2], 0x6c
mov ecx, edx
movsx eax, al
and eax, 0x8000000f
jns 0x41e2e3
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 9], al
inc ecx
cmp ecx, 8
jae 0x41e2f2
mov al, byte [ebp - 0xa]
jmp 0x41e2d4
mov byte [ebp - 1], dl
mov cl, 0x37
mov dword [ebp - 0x17], 0x5e535037
mov eax, edx
mov dword [ebp - 0x13], 0x44425b47
mov dword [ebp - 0xf], 0x5b5b5319
mov byte [ebp - 0xb], dl
xor byte [ebp + eax - 0x16], cl
inc eax
cmp eax, 0xb
jae 0x41e320
mov cl, byte [ebp - 0x17]
jmp 0x41e311
mov byte [ebp - 0xb], dl
lea ecx, [ebp - 0x16]
lea edx, [ebp - 9]
call fcn.0040c457
push esi
call eax
pop esi
leave
ret

Function at 0x41e3be
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movaps xmm0, xmmword [0x408410]
push ebx
push esi
mov esi, ecx
mov word [ebp - 0xf], 0x7a
xor ebx, ebx
movups xmmword [ebp - 0x1f], xmm0
mov edx, ebx
mov dword [esi], 0x406fd0
mov al, byte [ebp - 0x1f]
xor byte [ebp + edx - 0x1e], al
inc edx
cmp edx, 0x10
jb 0x41e3e3
mov byte [ebp - 0xe], bl
mov al, 9
mov dword [ebp - 0xd], 0x726d7009
mov ecx, ebx
mov dword [ebp - 9], 0x7c7e7579
mov dword [ebp - 5], 0x75756d37
mov byte [ebp - 1], bl
movsx eax, al
and eax, 0x8000000f
jns 0x41e41e
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0xc], al
inc ecx
cmp ecx, 0xb
jae 0x41e42d
mov al, byte [ebp - 0xd]
jmp 0x41e40f
lea edx, [ebp - 0x1e]
mov byte [ebp - 1], bl
lea ecx, [ebp - 0xc]
call fcn.0040c457
push dword [esi + 4]
call eax
pop esi
pop ebx
leave
ret

Function at 0x41e4f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movaps xmm0, xmmword [0x407e30]
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], 0x6c7b7d5a
push esi
mov esi, ecx
mov word [ebp - 0x10], 0x6468
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0xe], bl
mov ecx, ebx
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x15
jb 0x41e521
mov byte [ebp - 0xe], bl
mov al, 0x16
mov dword [ebp - 0xd], 0x6f6a6d16
mov ecx, ebx
mov dword [ebp - 9], 0x797b7276
mov dword [ebp - 5], 0x72726a34
mov byte [ebp - 1], bl
movsx eax, al
and eax, 0x8000000f
jns 0x41e55c
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0xc], al
inc ecx
cmp ecx, 0xb
jae 0x41e56b
mov al, byte [ebp - 0xd]
jmp 0x41e54d
lea edx, [ebp - 0x23]
mov byte [ebp - 1], bl
lea ecx, [ebp - 0xc]
call fcn.0040c457
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call eax
test eax, eax
je 0x41e58e
mov dword [esi + 8], eax
jmp 0x41e590
mov eax, ebx
pop esi
pop ebx
leave
ret 0xc
Function at 0x41e63b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor edx, edx
mov dword [ebp - 0xb], 0x706b4e57
mov al, 0x57
mov dword [ebp - 7], 0x73734877
mov word [ebp - 3], 0x6a76
mov ecx, edx
mov byte [ebp - 1], dl
movsx eax, al
and eax, 0x8000000f
jns 0x41e66d
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0xa], al
inc ecx
cmp ecx, 9
jae 0x41e67c
mov al, byte [ebp - 0xb]
jmp 0x41e65e
mov byte [ebp - 1], dl
mov cl, 0x67
mov dword [ebp - 0x18], 0xe030067
mov eax, edx
mov dword [ebp - 0x14], 0x14120b17
mov dword [ebp - 0x10], 0xb0b0349
mov byte [ebp - 0xc], dl
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xb
jae 0x41e6aa
mov cl, byte [ebp - 0x18]
jmp 0x41e69b
mov byte [ebp - 0xc], dl
lea ecx, [ebp - 0x17]
lea edx, [ebp - 0xa]
call fcn.0040c457
push 0x10
call eax
leave
ret

Function at 0x41e6be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movaps xmm0, xmmword [0x4073a0]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x1e], 0xc112513
xor ebx, ebx
mov dword [ebp - 0x1a], 0x2a212b0e
mov dword [ebp - 4], ebx
mov ecx, ebx
movups xmmword [ebp - 0x2e], xmm0
mov dword [esi], 0x406fd8
mov dword [ebp - 0x16], 0x33222e37
mov byte [ebp - 0x12], bl
mov al, byte [ebp - 0x2e]
xor byte [ebp + ecx - 0x2d], al
inc ecx
cmp ecx, 0x1b
jb 0x41e6f8
mov byte [ebp - 0x12], bl
mov cl, 0x30
mov dword [ebp - 0x11], 0x59545730
mov eax, ebx
mov dword [ebp - 0xd], 0x43455c40
mov dword [ebp - 9], 0x5c5c541e
mov byte [ebp - 5], bl
xor byte [ebp + eax - 0x10], cl
inc eax
cmp eax, 0xb
jae 0x41e733
mov cl, byte [ebp - 0x11]
jmp 0x41e724
lea edx, [ebp - 0x2d]
mov byte [ebp - 5], bl
lea ecx, [ebp - 0x10]
call fcn.0040c457
lea ecx, [ebp - 4]
push ecx
push ebx
push dword [ebp + 8]
call eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x41e788
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movaps xmm0, xmmword [0x4077e0]
xor edx, edx
movups xmmword [ebp - 0x22], xmm0
mov dword [ebp - 0x12], 0x73523
mov ecx, edx
mov al, byte [ebp - 0x22]
xor byte [ebp + ecx - 0x21], al
inc ecx
cmp ecx, 0x12
jb 0x41e7a4
mov byte [ebp - 0xf], dl
mov al, 0x28
mov dword [ebp - 0xe], 0x7a6d5328
mov ecx, edx
mov dword [ebp - 0xa], 0x3b746d76
mov dword [ebp - 6], 0x746c363a
mov word [ebp - 2], 0x74
movsx eax, al
and eax, 0x8000000f
jns 0x41e7e2
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0xd], al
inc ecx
cmp ecx, 0xc
jae 0x41e7f1
mov al, byte [ebp - 0xe]
jmp 0x41e7d3
mov byte [ebp - 1], dl
lea ecx, [ebp - 0xd]
lea edx, [ebp - 0x21]
call fcn.0040c457
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x41e80a
mov ecx, dword [ecx]
push ecx
call eax
mov ecx, eax
xor edx, edx
and ecx, 0x10
cmp eax, 0xffffffff
cmove ecx, edx
mov eax, ecx
leave
ret 4
Function at 0x41ee63
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x453ab1
call fcn.004534f4
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov al, 0x68
mov dword [ebp - 0x26], 0x6d7b7d68
mov dword [ebp - 0x22], 0x7569767a
mov word [ebp - 0x1e], 0x6d
mov edx, ebx
mov dword [ebp - 0x14], edx
cmp edx, 8
jae 0x41eebe
movsx ecx, al
and ecx, 0x8000000f
jns 0x41eeab
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x25]
sub al, cl
mov byte [ebp + edx - 0x25], al
inc edx
mov dword [ebp - 0x14], edx
mov al, byte [ebp - 0x26]
jmp 0x41ee96
mov byte [ebp - 0x1d], bl
lea eax, [ebp - 0x25]
push eax
call fcn.004494dd
pop ecx
test eax, eax
je 0x41ef1a
mov dl, 0x60
mov dword [ebp - 0x30], 0x5131560
mov dword [ebp - 0x2c], 0xd010e12
mov word [ebp - 0x28], 5
mov ecx, ebx
mov dword [ebp - 0x18], ecx
cmp ecx, 8
jae 0x41ef02
mov al, byte [ebp + ecx - 0x2f]
xor al, dl
mov byte [ebp + ecx - 0x2f], al
inc ecx
mov dword [ebp - 0x18], ecx
mov dl, byte [ebp - 0x30]
jmp 0x41eeea
mov byte [ebp - 0x27], bl
lea eax, [ebp - 0x2f]
push eax
call fcn.004494dd
pop ecx
push eax
mov ecx, dword [ebp + 8]
call fcn.0040bc98
jmp 0x41ef86
mov al, 4
mov dword [ebp - 0x3f], 0x65725904
mov dword [ebp - 0x3b], 0x24697066
mov dword [ebp - 0x37], 0x6b247378
mov word [ebp - 0x33], 0x7869
mov byte [ebp - 0x31], bl
mov edx, ebx
mov dword [ebp - 0x1c], edx
cmp edx, 0xd
jae 0x41ef67
movsx ecx, al
and ecx, 0x8000000f
jns 0x41ef54
dec ecx
or ecx, 0xfffffff0
inc ecx
mov al, byte [ebp + edx - 0x3e]
sub al, cl
mov byte [ebp + edx - 0x3e], al
inc edx
mov dword [ebp - 0x1c], edx
mov al, byte [ebp - 0x3f]
jmp 0x41ef3f
mov byte [ebp - 0x31], bl
lea eax, [ebp - 0x3e]
jmp 0x41ef0f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4