joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407668
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412018]
jne 0x407672
repz ret
jmp fcn.00407bfa

Function at 0x408890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0040851c
push eax
push esi
push dword [ebp + 8]
call fcn.004084d1
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040851c
push eax
push esi
push dword [ebp + 8]
call fcn.004084d1
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040851c
push eax
push esi
push dword [ebp + 8]
call fcn.004084d1
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040850c
int3
Function at 0x4093e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004084ea
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040851c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004084d1
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040850c
dec esi
mov ch, 0x9b
fisubr word [eax + 4]
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid

Function at 0x40ac90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x40acb0
xor eax, eax
jmp 0x40ad66
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ad64
mov dword [ebp - 0x25c], 0
call fcn.00409bd0
test eax, eax
je 0x40ace0
mov eax, 1
jmp 0x40ad66
mov dword [ebp - 0x258], 0
push 0x24c
push 0
lea ecx, [ebp - 0x254]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40ad64
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0xc], 0xffffffff
je 0x40ad3b
mov edx, dword [ebp - 0x238]
cmp edx, dword [ebp + 0xc]
je 0x40ad3b
xor eax, eax
jmp 0x40ad66
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040a3e0
add esp, 8
test eax, eax
je 0x40ad64
cmp dword [ebp + 0xc], 0xffffffff
jne 0x40ad5d
mov eax, dword [ebp - 0x238]
jmp 0x40ad66
mov eax, 1
jmp 0x40ad66
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret
Function at 0x4012f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x4a5e98]
xor eax, eax
test ecx, ecx
jle 0x401330
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x4a5e58
sub edi, esi
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x3a]
inc eax
xor cl, byte [edi + edx]
mov byte [edx], cl
mov ecx, dword [0x4a5e98]
cmp eax, ecx
jl 0x401310
pop edi
mov byte [ecx + esi], 0
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov byte [ecx + eax], 0
pop ebp
ret 4

Function at 0x401340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x4a5edc]
xor eax, eax
test ecx, ecx
jle 0x401380
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x4a5e9c
sub edi, esi
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x46]
inc eax
xor cl, byte [edi + edx]
mov byte [edx], cl
mov ecx, dword [0x4a5edc]
cmp eax, ecx
jl 0x401360
pop edi
mov byte [ecx + esi], 0
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov byte [ecx + eax], 0
pop ebp
ret 4

Function at 0x401390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x4a5fe4]
xor eax, eax
test ecx, ecx
jle 0x4013d0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x4a5ee0
sub edi, esi
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 2]
inc eax
xor cl, byte [edi + edx]
mov byte [edx], cl
mov ecx, dword [0x4a5fe4]
cmp eax, ecx
jl 0x4013b0
pop edi
mov byte [ecx + esi], 0
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov byte [ecx + eax], 0
pop ebp
ret 4

Function at 0x4013e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x4a60ec]
xor eax, eax
test ecx, ecx
jle 0x401420
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x4a5fe8
sub edi, esi
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x5e]
inc eax
xor cl, byte [edi + edx]
mov byte [edx], cl
mov ecx, dword [0x4a60ec]
cmp eax, ecx
jl 0x401400
pop edi
mov byte [ecx + esi], 0
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov byte [ecx + eax], 0
pop ebp
ret 4
Function at 0x403aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4a4314]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.004093f0
cmp byte [0x49eb8f], 0
mov eax, dword [0x49eb88]
mov edx, dword [0x49eb8c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
je 0x403c09
xor ecx, ecx
cmp dword [0x4a5684], 2
jl 0x403be0
movaps xmm2, xmmword [0x49f2f0]
mov ecx, 4
movaps xmm3, xmmword [0x49f330]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
movd xmm4, ecx
mov ecx, 0x1f
psrad xmm1, xmm4
movaps xmm0, xmm1
movd xmm5, ecx
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x49f310]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x49f300]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x49f320]
packuswb xmm1, xmm1
paddb xmm1, xmmword [0x49f340]
movd xmm0, eax
pxor xmm1, xmm0
movaps xmm0, xmm2
movd dword [ebp - 0xc], xmm1
movaps xmm1, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm4
movaps xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x49f310]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x49f320]
packuswb xmm1, xmm1
paddb xmm1, xmmword [0x49f340]
movd xmm0, edx
pxor xmm1, xmm0
movd dword [ebp - 8], xmm1
jmp 0x403c09
mov eax, 0x446f8657
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
mov dl, cl
shr eax, 6
movsx eax, al
imul eax, eax, 0x65
sub dl, al
add dl, 0x63
xor byte [ebp + ecx - 0xc], dl
inc ecx
cmp ecx, 8
jl 0x403be0
push 0x2040
lea eax, [ebp - 0xc]
push eax
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046a386
mov esp, ebp
pop ebp
ret
Function at 0x403c30
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489610
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xc
mov eax, dword [0x4a4314]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], esi
cmp byte [0x49edaf], 0
mov eax, dword [0x49eda8]
mov edx, dword [0x49edac]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
je 0x403dc9
xor ecx, ecx
cmp dword [0x4a5684], 2
jl 0x403da0
movaps xmm2, xmmword [0x49f2f0]
mov ecx, 4
movaps xmm3, xmmword [0x49f330]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
movd xmm4, ecx
mov ecx, 0x1f
psrad xmm1, xmm4
movaps xmm0, xmm1
movd xmm5, ecx
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x49f310]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x49f300]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x49f320]
packuswb xmm1, xmm1
paddb xmm1, xmmword [0x49f340]
movd xmm0, eax
pxor xmm1, xmm0
movaps xmm0, xmm2
movd dword [ebp - 0x1c], xmm1
movaps xmm1, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm4
movaps xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x49f310]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x49f320]
packuswb xmm1, xmm1
paddb xmm1, xmmword [0x49f340]
movd xmm0, edx
pxor xmm1, xmm0
movd dword [ebp - 0x18], xmm1
jmp 0x403dc9
mov eax, 0x446f8657
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
mov dl, cl
shr eax, 6
movsx eax, al
imul eax, eax, 0x65
sub dl, al
add dl, 0x63
xor byte [ebp + ecx - 0x1c], dl
inc ecx
cmp ecx, 8
jl 0x403da0
lea eax, [ebp - 0x1c]
push eax
call fcn.00470ec2
add esp, 4
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
push eax
mov byte [esi], 0
mov dword [ebp - 4], 0xffffffff
call fcn.004166e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046a386
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x403e20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48967f
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4a4314]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], 0
mov edx, 4
mov ecx, dword fs:[0x2c]
mov edi, dword [ecx]
mov eax, dword [edi + 0x1390]
test al, 1
jne 0x403eda
or eax, 1
mov dword [edi + 0x1390], eax
mov dword [ebp - 4], 1
call fcn.00417bac
mov ecx, eax
mov dword [edi + 0x138c], 0xffffffff
mov dword [edi + 0xc], ecx
lea esi, [edi + 0x10]
mov edx, 1
nop
mov eax, ecx
lea esi, [esi + 4]
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
inc edx
mov dword [esi - 4], ecx
cmp edx, 0x270
jb 0x403ea0
mov eax, dword [edi + 0x1390]
mov edx, 4
mov ecx, dword fs:[0x2c]
mov dword [edi + 8], 0x270
test al, 2
jne 0x403efb
or eax, 2
mov dword [edi + 0x1394], 0
mov dword [edi + 0x1390], eax
mov dword [edi + 0x1398], 0x3d
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
mov dword [ebp - 4], 0
mov eax, dword [ecx]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x30], eax
lea ecx, [eax + 8]
mov dword [ebp - 0x14], ecx
nop
mov esi, dword [eax + 0x1398]
dec edx
mov eax, dword [eax + 0x1394]
sub esi, eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
cmp esi, 0xffffffff
jne 0x403f53
call fcn.00417360
mov edx, eax
jmp 0x403f97
lea eax, [esi + 1]
mov dword [ebp - 0x20], eax
lea ebx, [esi + 1]
nop dword [eax]
xor edi, edi
xor eax, eax
test esi, esi
je 0x403f72
call fcn.00417360
mov edi, eax
or eax, 0xffffffff
xor edx, edx
div ebx
mov ecx, eax
mov dword [ebp - 0x1c], edx
xor edx, edx
mov eax, edi
div ebx
cmp eax, ecx
jb 0x403f8d
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 0x1c], esi
jne 0x403f60
mov ebx, dword [ebp - 0x24]
mov eax, edi
xor edx, edx
div dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebx + 0x10]
mov al, byte [edx + eax + str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov edx, dword [ebx + 0x14]
mov byte [ebp - 0x10], al
cmp ecx, edx
jae 0x403fca
lea eax, [ecx + 1]
mov dword [ebx + 0x10], eax
mov eax, ebx
cmp edx, 0x10
jb 0x403fbd
mov eax, dword [ebx]
mov dl, byte [ebp - 0x10]
mov byte [eax + ecx], dl
mov byte [eax + ecx + 1], 0
jmp 0x403fd8
push dword [ebp - 0x10]
push dword [ebp - 0x30]
push ecx
mov ecx, ebx
call fcn.00416fc0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
test edx, edx
jne 0x403f30
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor edx, edx
mov ecx, dword [esi + 0x104]
lea ebx, [esi + 0x104]
test ecx, ecx
jle 0x41628d
push edi
mov edi, dword [ebp + 8]
sub esi, edi
nop
lea ecx, [edx + edi]
lea eax, [edx - 0x5e]
inc edx
xor al, byte [esi + ecx]
mov byte [ecx], al
mov eax, dword [ebx]
cmp edx, eax
jl 0x416270
mov byte [eax + edi], 0
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov byte [ecx + eax], dl
pop ebp
ret 4

Function at 0x4162a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor edx, edx
mov ecx, dword [esi + 0x40]
lea ebx, [esi + 0x40]
test ecx, ecx
jle 0x4162dd
push edi
mov edi, dword [ebp + 8]
sub esi, edi
nop dword [eax]
lea ecx, [edx + edi]
lea eax, [edx - 0x46]
inc edx
xor al, byte [esi + ecx]
mov byte [ecx], al
mov eax, dword [ebx]
cmp edx, eax
jl 0x4162c0
mov byte [eax + edi], 0
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov byte [ecx + eax], dl
pop ebp
ret 4
Function at 0x417360
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x4173be
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x417380
mov eax, dword [edi]
jmp 0x4174a9
cmp eax, 0x4e0
jb 0x4174a9
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x4173e0
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x417430
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4213e0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x42146c
push esi
call fcn.00432f40
add esp, 4
test al, al
jne 0x42146c
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x421403
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.0043e630
add esp, 0xc
test eax, eax
je 0x421437
sub eax, esi
push eax
push 0x2e
push esi
call fcn.0043e630
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x421439
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x421465
mov al, byte [esi]
push eax
call fcn.0042fdb0
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x421447
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4260f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x24]
mov eax, 0x180
mov edx, 0x140
push ebp
push esi
cmp dword [ebx], 0x4a405c
mov ecx, dword [ebx + 8]
cmovne eax, edx
mov dword [esp + 0x20], ecx
add eax, dword [ebx + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
push edi
test eax, eax
je 0x426127
mov byte [eax], 0
mov ebp, dword [esp + 0x34]
mov esi, dword [ebp + 0x8d8]
test esi, esi
je 0x4262e4
push dword [ecx + 8]
mov edi, dword [esi + 0x14]
call dword [0x4a4018]
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
je 0x426180
mov eax, dword [ebx + 0xc]
cmp byte [eax + 0x1c9], 0
je 0x426192
push dword [eax + 0x64]
call dword [0x4a4018]
mov ecx, eax
add esp, 4
mov dword [esp + 0x10], ecx
test ecx, ecx
jne 0x42618d
mov edi, dword [esp + 0x34]
push edi
call dword [0x4a4010]
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0x1c
ret
mov eax, dword [ebx + 0xc]
jmp 0x42619a
mov dword [esp + 0x10], 0
cmp byte [eax + 0x1ca], 0
je 0x4261af
mov ecx, dword [eax + 0x444]
mov dword [esp + 0x14], ecx
jmp 0x4261b7
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [ebp + 0x78]
test eax, eax
je 0x4261cd
test byte [eax + 4], 0x10
je 0x4261cd
lea edx, [eax + 0x78]
mov dword [esp + 0x30], edx
jmp 0x4261d7
lea eax, [ebp + 0x8dc]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x4a4]
mov ecx, 1
cmp eax, ecx
jbe 0x42622b
mov eax, dword [ebp + 0x8d8]
add eax, 0x74
nop
cmp dword [eax - 8], 0
mov edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], eax
je 0x426225
mov edi, dword [eax]
inc ecx
mov esi, dword [esp + 0x18]
add eax, 0x60
add esi, 0xffffffec
cmp edi, edx
cmovge esi, dword [esp + 0x20]
cmp edi, edx
cmovge edi, edx
cmp ecx, dword [ebp + 0x4a4]
jb 0x4261f0
mov eax, dword [ebp + 0x4a4]
cmp ecx, eax
jne 0x42623a
push esi
call fcn.00426b80
add esp, 4
jmp 0x426246
lea esi, [ecx + ecx*2]
shl esi, 5
add esi, dword [ebp + 0x8d8]
mov eax, dword [esp + 0x38]
push dword [esi]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
call dword [0x4a4010]
push dword [esi + 4]
call dword [0x4a4010]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x18]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov dword [esi], edi
mov dword [esi + 4], ebp
mov eax, dword [eax + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 0xc]
lea ebx, [esi + 0x20]
push ebx
push dword [esp + 0x34]
mov eax, dword [eax + 0x1e0]
mov eax, dword [eax]
mov dword [esi + 8], eax
call fcn.00425920
add esp, 0x10
test al, al
jne 0x4262d9
push ebx
call fcn.00425bb0
push edi
mov dword [esi + 0xc], 0
call dword [0x4a4010]
push ebp
call dword [0x4a4010]
add esp, 0xc
mov eax, 0x1b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov eax, dword [esp + 0x40]
test eax, eax
je 0x4262e4
mov byte [eax], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
Function at 0x4268c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x14]
push ebx
push esi
mov esi, 0x140
mov byte [esp + 0xb], 1
mov eax, dword [ecx]
mov ebx, 0x180
mov edx, dword [ecx + 8]
cmp eax, 0x4a405c
mov dword [esp + 0xc], edx
cmovne ebx, esi
mov esi, 0x3cc
add ebx, dword [ecx + 0xc]
cmp eax, 0x4a405c
mov eax, dword [esp + 0x24]
mov ecx, 0x434
mov dword [esp + 0x14], ebx
cmovne ecx, esi
mov ebx, dword [esp + 0x20]
mov dword [eax], 0
add ecx, ebx
je 0x426a5d
cmp byte [ecx + 0x3c], 0
je 0x426a5d
cmp dword [ebx + 0x8d8], 0
je 0x426a5d
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x426941
test byte [eax + 4], 0x10
je 0x426941
add eax, 0x78
jmp 0x426947
lea eax, [ebx + 0x8dc]
push ebp
push edi
xor edi, edi
mov dword [esp + 0x18], eax
cmp dword [ebx + 0x4a4], edi
jbe 0x426a26
xor ebp, ebp
nop dword [eax]
mov esi, dword [ebx + 0x8d8]
add esi, ebp
cmp dword [esi + 0xc], 0
je 0x426a16
push dword [esi]
push dword [edx + 8]
call fcn.0042fef0
add esp, 8
test eax, eax
je 0x426a12
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 4]
cmp byte [ecx + 0x1c9], 0
jne 0x4269a0
test eax, eax
je 0x4269b4
jmp 0x426a12
test eax, eax
je 0x426a12
push eax
push dword [ecx + 0x64]
call fcn.0042fef0
add esp, 8
test eax, eax
je 0x426a12
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x1c]
cmp byte [ecx + 0x1ca], 0
jne 0x4269ce
cmp eax, 0xffffffff
je 0x4269db
jmp 0x426a12
cmp eax, 0xffffffff
je 0x426a12
cmp dword [ecx + 0x444], eax
jne 0x426a12
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x10]
cmp eax, dword [esi + 0x18]
jne 0x426a16
mov eax, dword [ecx + 0x1e0]
push dword [esi + 8]
push dword [eax]
call fcn.0042fef0
add esp, 8
test eax, eax
je 0x426a12
lea eax, [esi + 0x20]
push eax
push dword [esp + 0x20]
call fcn.004264f0
add esp, 8
test al, al
jne 0x426a32
mov edx, dword [esp + 0x14]
inc edi
add ebp, 0x60
cmp edi, dword [ebx + 0x4a4]
jb 0x426960
mov al, byte [esp + 0x13]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
inc dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [ecx], eax
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x426a53
mov eax, dword [esi + 0x10]
mov dword [ecx], eax
pop edi
pop ebp
pop esi
xor al, al
pop ebx
add esp, 0x10
ret
pop esi
mov al, 1
pop ebx
add esp, 0x10
ret