joyce8/EMBER2024-capa huggingface dataset:
Function at 0x572c80
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x55f65f96
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x628e118f
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4016d4
mov edi, esi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
mov edx, edi
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
mov ebx, esi
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
mov esi, eax
mov edx, esi
mov ecx, ebx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x77563c90
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x34750d68
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4042c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x4043a0
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x4043a0
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40430a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x404311
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x4042f0
jmp 0x404313
mov esi, 0x1505
jmp 0x404313
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 0x20]
mov ebx, edi
sub ebx, 1
jb 0x4043a0
and ebx, esi
mov eax, edi
or eax, 1
mov edx, edi
or edx, 0xfffffffe
add edx, eax
mov dword [esp + 8], edx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404344
inc ebx
dec edi
je 0x40439e
mov eax, ebx
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x40439e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x404340
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040c6a0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x404340
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040c6c0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x404340
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x4043a0
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404b50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x404c54
mov esi, dword [esp + 0x28]
test esi, esi
je 0x404c54
cmp dword [esp + 0x2c], 0
je 0x404c54
push esi
call fcn.0040c6a0
add esp, 4
test eax, eax
je 0x404bba
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x404bc1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x404ba0
jmp 0x404bc3
mov ebx, 0x1505
jmp 0x404bc3
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
mov esi, edi
sub esi, 1
jae 0x404c5c
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x404c19
call fcn.00405900
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x404c54
push ecx
call fcn.0040c6a0
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
mov esi, edi
sub esi, 1
jae 0x404ce0
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
and esi, ebx
mov eax, edi
or eax, 1
mov edx, edi
or edx, 0xfffffffe
add edx, eax
mov dword [esp + 8], edx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404c88
inc esi
dec edi
je 0x404bd5
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404bda
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x404c80
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040c6a0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404c80
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040c6c0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404c80
mov eax, 0xffffffff
jmp 0x404c54
and esi, ebx
mov eax, edi
or eax, 1
mov edx, edi
or edx, 0xfffffffe
add edx, eax
mov dword [esp + 8], edx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404d08
inc esi
dec edi
je 0x404c14
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404c19
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x404d00
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040c6a0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404d00
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040c6c0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404d00
jmp 0x404c19
Function at 0x405640
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405838
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x405838
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405838
cmp dword [ecx], 0
jne 0x405838
push edi
call fcn.0040c6a0
add esp, 4
test eax, eax
je 0x4056aa
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [edi + ebx]
test edx, edx
je 0x4056b1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebx
mov ecx, esi
cmp eax, ebx
jne 0x405690
jmp 0x4056b3
mov esi, 0x1505
jmp 0x4056b3
mov esi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
mov edi, edx
sub edi, 1
jae 0x405786
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
mov ebx, dword [esp + 0x2c]
jb 0x40570a
call fcn.00405900
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x405838
push ebx
call fcn.0040c6a0
add esp, 4
lea edi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov edx, ebx
push edi
push esi
push eax
call fcn.00405840
add esp, 0xc
mov ebp, eax
push ebx
call fcn.0040c6a0
add esp, 4
mov ebx, eax
xor eax, 1
mov ecx, ebx
and ecx, 1
lea eax, [eax + ecx*2]
push eax
call dword [0x449008]
add esp, 4
test eax, eax
je 0x405833
mov edi, eax
mov byte [eax + ebx], 0
push ebx
push dword [esp + 0x30]
push eax
call fcn.0040c5c0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov edi, dword [esp + 0x30]
mov dword [eax + ecx*4], edi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [edi], eax
xor eax, eax
jmp 0x405838
mov dword [esp], eax
and edi, esi
mov eax, edx
or eax, 1
mov ebx, edx
or ebx, 0xfffffffe
add ebx, eax
mov dword [esp + 0xc], ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4057b8
inc edi
dec edx
je 0x4056c5
mov ebp, edi
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ebx, dword [eax + ebp*4]
cmp ebx, 0xffffffff
je 0x4056ca
mov eax, dword [ecx + 8]
cmp dword [eax + ebx*4], esi
jne 0x4057b0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + ebx*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040c6a0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x4057b0
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040c6c0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x4057b0
mov eax, dword [ecx + 0x10]
push dword [eax + ebx*4]
call fcn.004046d0
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov edi, dword [esp + 0x30]
mov dword [eax + ebx*4], edi
jmp 0x40577b
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406900
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406ab6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406aaf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406995
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ecx
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, edi
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub ecx, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406aaf
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406a15
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
mov edi, esi
and edi, eax
xor esi, eax
lea eax, [esi + edi*2]
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x4069b0
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x40695d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x406a60
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x406a40
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406950
jmp 0x406a6f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x406950
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x406a80
jmp 0x406950
shl ecx, 0x10
or ecx, edi
jmp 0x406abb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406ad0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x406afe
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x406b9c
not eax
test bl, 1
jne 0x406b05
mov edx, ebx
cmp ebx, 1
jne 0x406b36
jmp 0x406b9a
xor eax, eax
jmp 0x406b9c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x446c50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x446c50]
cmp ebx, 1
je 0x406b9a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x446c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x446c50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x446c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x446c50]
add esi, 2
cmp edx, esi
jne 0x406b40
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x40c470
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x40c4dc
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x40c4be
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x40c4c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 0xfffffffd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x40c4a0
jmp 0x40c4c0
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x40c4da
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x40c4dc
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cc00
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
call fcn.00440a50
test al, al
je 0x40ce04
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
call fcn.00438e70
test al, al
je 0x40cdff
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
mov dword [esp], 0xf2ade0e5
mov dword [esp + 4], 0xcec892ce
mov dword [esp + 8], 0
mov eax, 0x41
mov ecx, 0x732319be
movzx edx, byte [esp + eax - 0x41]
mov edi, ecx
or edi, edx
not edx
or edx, eax
and edx, edi
lea edi, [edx + edx]
and edi, 0x66460174
xor edi, 0x7f5f0174
xor edx, 0xc0507f45
add edx, edi
mov ebx, edx
or ebx, 1
add ebx, edx
not edx
or edx, 1
add ebx, edx
inc bl
mov byte [esp + eax - 0x41], bl
inc eax
dec ecx
cmp eax, 0x4d
jne 0x40cc50
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp], 0x128bb5f5
mov dword [esp + 4], 0x2093ee07
mov word [esp + 8], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, eax
and edi, 0x14
mov edx, ecx
xor edx, 0x8a
add edx, edi
xor dl, byte [esp + ecx]
add dl, 0x4e
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0xa
jne 0x40ccc0
mov dword [esp], 0x7f7e7959
mov dword [esp + 4], 0
mov eax, 0x5d1422ea
mov ecx, 0xa2ebdd15
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x5d1422ea]
lea edx, [edi + edi]
not edx
add edx, edi
mov ebp, ecx
and ebp, 0xa0e91411
mov ebx, eax
and ebx, 0x4810226e
or ebx, ebp
xor ebx, 0xb5ed1491
or ebx, edi
not edi
and edi, edx
or edi, ecx
and ebx, edi
add ebx, 0x2e9b516d
mov edx, ebx
and edx, 1
xor ebx, 1
lea edx, [ebx + edx*2]
mov byte [esp + eax - 0x5d1422ea], dl
inc eax
dec ecx
cmp eax, 0x5d1422f2
jne 0x40cd00
test esi, esi
je 0x40cdae
mov dword [esp], 0x37a10771
mov dword [esp + 4], 0xe9fcd02a
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx]
mov esi, eax
and esi, 0xe
mov edi, ecx
xor edi, 0x7248a587
add edi, esi
xor edi, edx
mov edx, edi
and edx, 0x5c
xor edi, 0x5c
lea edx, [edi + edx*2]
inc dl
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0xb
jne 0x40cd80
mov dword [esp], 0x62656467
mov dword [esp + 4], 0x5e616063
mov eax, 0x19
mov ecx, 0xe6
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x19]
mov edx, eax
xor edx, ecx
and edx, esi
xor edx, ecx
mov bl, 0x82
sub bl, dl
mov byte [esp + eax - 0x19], bl
inc eax
dec ecx
cmp eax, 0x21
jne 0x40cdd0
call fcn.0040dcb0
test al, al
je 0x40cdff
call fcn.00410e40
call fcn.0040f930
call fcn.004419c0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d010
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov esi, dword [esp + 0x78]
mov dword [esp + 0x18], ecx
mov eax, dword [ecx + 0x60]
mov dword [esp + 0x14], eax
mov word [esp], 0x7775
mov byte [esp + 2], 0x7e
mov dword [esp + 3], 0
mov byte [esp + 7], 0
xor eax, eax
mov ebx, eax
add bl, 0xea
xor bl, byte [esp + eax]
add bl, 0x6e
mov byte [esp + eax], bl
inc eax
cmp eax, 8
jne 0x40d040
mov dword [esp + 8], 0x3230345e
mov word [esp + 0xc], 0x3d32
mov dword [esp + 0xe], 0
xor ecx, ecx
xor ebp, ebp
nop
movzx edi, byte [esp + ebp + 8]
mov ebx, ecx
and ebx, 0x14
mov eax, ebp
xor eax, 0x3b766b8a
add eax, ebx
mov ebx, eax
and ebx, edi
add eax, edi
mov edi, eax
not edi
and edi, 1
mov edx, eax
or edx, 0xfe
add ebx, ebx
sub eax, ebx
add eax, edx
add eax, edi
add al, 0x4f
mov byte [esp + ebp + 8], al
inc ebp
add ecx, 2
cmp ebp, 0xa
jne 0x40d070
mov dword [esp + 0x1c], 0x766c2023
mov dword [esp + 0x20], 0x72762428
mov dword [esp + 0x24], 0x7d667c23
mov dword [esp + 0x28], 0x7a717e69
mov dword [esp + 0x2c], 0x52796d6e
mov dword [esp + 0x30], 0x1467a9af
mov dword [esp + 0x34], 0x701130a
mov dword [esp + 0x38], 0x66e441c
mov dword [esp + 0x3c], 0x41f1f19
mov dword [esp + 0x40], 0x419071b
mov dword [esp + 0x44], 0x1f564d1a
mov dword [esp + 0x48], 0x52150909
mov dword [esp + 0x4c], 0x220a1c18
mov dword [esp + 0x50], 0x262c637d
mov dword [esp + 0x54], 0x6b79202b
mov byte [esp + 0x58], 0x88
mov dword [esp + 0x59], 0
mov dword [esp + 0x5c], 0
mov ebx, 0x2c
mov ebp, 0xfab1a4d2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebx - 0x7d58d27f]
mov ecx, ebp
and ecx, 0x4e
and eax, 0xb1
or eax, ecx
xor al, byte [esp + ebx - 0x10]
xor al, 0x4e
add al, 0x9f
mov byte [esp + ebx - 0x10], al
inc ebx
dec ebp
cmp ebx, 0x70
jne 0x40d150
mov ecx, dword [esp + 0x74]
add ecx, dword [esp + 0x14]
movzx eax, byte [esp + 0x1c]
mov edi, ecx
test al, al
je 0x40d19b
lea ebx, [esp + 0x1d]
mov edi, ecx
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ebx]
inc ebx
test al, al
jne 0x40d190
mov byte [edi], 0
movzx eax, byte [esi]
test al, al
je 0x40d1bd
inc esi
mov edx, dword [esp + 0x7c]
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [esi]
inc esi
test al, al
jne 0x40d1b0
jmp 0x40d1c1
mov edx, dword [esp + 0x7c]
mov byte [edi], 0
movzx eax, byte [esp + 8]
test al, al
je 0x40d1eb
lea esi, [esp + 9]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [esi]
inc esi
test al, al
jne 0x40d1e0
mov byte [edi], 0
movzx eax, byte [edx]
test al, al
je 0x40d20b
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [edx]
inc edx
test al, al
jne 0x40d200
mov byte [edi], 0
movzx eax, byte [esp]
test al, al
je 0x40d22b
lea edx, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [edx]
inc edx
test al, al
jne 0x40d220
mov byte [edi], 0
mov eax, edi
xor eax, ecx
not ecx
and ecx, edi
add ecx, ecx
sub ecx, eax
mov eax, dword [esp + 0x18]
add dword [eax + 0x60], ecx
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret 0xc