joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403f60
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push ebp
push esi
mov ecx, edx
mov esi, edx
shr ecx, 8
shr esi, 0x10
push edi
mov edi, dword [esp + 0x18]
movzx ebp, dl
shr edx, 0x18
and ecx, 0xff
and esi, 0xff
mov dword [esp + 0x18], edx
cmp edi, 0x100
jne 0x403fc7
mov ebx, dword [eax + 0xc]
movzx ebp, byte [ebp + 0x51d210]
movzx ecx, byte [ecx + 0x51d110]
movzx esi, byte [esi + 0x51d110]
movzx edx, byte [edx + 0x51d210]
movzx edi, bl
xor ebp, edi
movzx edi, byte [eax + 0xd]
xor ecx, edi
movzx edi, byte [eax + 0xe]
shr ebx, 0x18
xor esi, edi
xor edx, ebx
jmp 0x403fcf
cmp edi, 0xc0
jb 0x404008
mov ebx, dword [eax + 8]
movzx ebp, byte [ebp + 0x51d210]
movzx ecx, byte [ecx + 0x51d210]
movzx esi, byte [esi + 0x51d110]
movzx edx, byte [edx + 0x51d110]
movzx edi, bl
xor ebp, edi
movzx edi, byte [eax + 9]
xor ecx, edi
movzx edi, byte [eax + 0xa]
shr ebx, 0x18
xor esi, edi
xor edx, ebx
mov dword [esp + 0x18], edx
movzx edx, byte [esi + 0x51d110]
movzx esi, byte [eax + 6]
mov edi, dword [eax + 4]
mov ebx, dword [eax]
movzx ecx, byte [ecx + 0x51d210]
xor edx, esi
movzx edx, byte [edx + 0x51d210]
movzx esi, byte [eax + 2]
xor edx, esi
movzx esi, byte [eax + 5]
movzx eax, byte [eax + 1]
xor ecx, esi
movzx esi, byte [ecx + 0x51d110]
mov ecx, dword [esp + 0x14]
xor esi, eax
mov eax, dword [ecx + edx*4 + 0x810]
xor eax, dword [ecx + esi*4 + 0x410]
mov edx, dword [esp + 0x18]
movzx edx, byte [edx + 0x51d210]
mov esi, edi
shr esi, 0x18
xor edx, esi
movzx edx, byte [edx + 0x51d210]
mov esi, ebx
shr esi, 0x18
xor edx, esi
xor eax, dword [ecx + edx*4 + 0xc10]
movzx edx, byte [ebp + 0x51d110]
and edi, 0xff
xor edx, edi
movzx edx, byte [edx + 0x51d110]
pop edi
and ebx, 0xff
pop esi
xor edx, ebx
xor eax, dword [ecx + edx*4 + 0x10]
pop ebp
pop ebx
ret 8

Function at 0x4040b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
movzx ecx, cl
push edi
imul ecx, ecx, 0x1010101
mov edi, dword [esp + 0x10]
lea edx, [esi + 0xc]
lea eax, [edi + 4]
sub esi, edi
mov edi, 0x10
nop
mov ebx, dword [edx - 0xc]
xor ebx, ecx
mov dword [eax - 4], ebx
mov ebx, dword [esi + eax]
xor ebx, ecx
mov dword [eax], ebx
mov ebx, dword [edx - 4]
xor ebx, ecx
mov dword [eax + 4], ebx
mov ebx, dword [edx]
xor ebx, ecx
mov dword [eax + 8], ebx
add eax, 0x10
add edx, 0x10
sub edi, 1
jne 0x4040d0
pop edi
pop esi
pop ebx
ret 4
Function at 0x404100
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov edx, dword [ecx + 0x1014]
xor edx, dword [eax + 4]
push ebx
mov ebx, dword [ecx + 0x1010]
xor ebx, dword [eax]
push ebp
push esi
mov esi, dword [ecx + 0x101c]
push edi
mov edi, dword [ecx + 0x1018]
xor edi, dword [eax + 8]
xor esi, dword [eax + 0xc]
lea eax, [ecx + 0x1034]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], 8
mov eax, ebx
shr eax, 0x17
and eax, 0x1fe
mov eax, dword [ecx + eax*4 + 0x18b4]
mov ebp, ebx
shr ebp, 0xf
and ebp, 0x1fe
xor eax, dword [ecx + ebp*4 + 0x18b0]
mov ebp, ebx
shr ebp, 7
and ebp, 0x1fe
xor eax, dword [ecx + ebp*4 + 0x10b4]
mov ebp, ebx
and ebp, 0xff
xor eax, dword [ecx + ebp*8 + 0x10b0]
mov ebp, edx
shr ebp, 0xf
and ebp, 0x1fe
shr edx, 7
and edx, 0x1fe
mov dword [esp + 0x14], edx
mov edx, dword [ecx + ebp*4 + 0x18b4]
mov ebp, dword [esp + 0x14]
xor edx, dword [ecx + ebp*4 + 0x18b0]
mov ebp, dword [esp + 0x1c]
shr ebp, 0x17
and ebp, 0x1fe
xor edx, dword [ecx + ebp*4 + 0x10b0]
mov ebp, dword [esp + 0x1c]
and ebp, 0xff
xor edx, dword [ecx + ebp*8 + 0x10b4]
mov ebp, dword [esp + 0x2c]
mov ebp, dword [ebp - 4]
add ebp, edx
add ebp, eax
xor edi, ebp
mov ebp, dword [esp + 0x2c]
mov ebp, dword [ebp]
lea edx, [ebp + edx*2]
add edx, eax
rol esi, 1
xor esi, edx
ror edi, 1
mov eax, edi
shr eax, 0x17
and eax, 0x1fe
mov eax, dword [ecx + eax*4 + 0x18b4]
mov edx, edi
shr edx, 0xf
and edx, 0x1fe
xor eax, dword [ecx + edx*4 + 0x18b0]
mov edx, edi
shr edx, 7
and edx, 0x1fe
xor eax, dword [ecx + edx*4 + 0x10b4]
mov edx, edi
and edx, 0xff
xor eax, dword [ecx + edx*8 + 0x10b0]
mov edx, esi
shr edx, 0xf
and edx, 0x1fe
mov edx, dword [ecx + edx*4 + 0x18b4]
mov ebp, esi
shr ebp, 7
and ebp, 0x1fe
xor edx, dword [ecx + ebp*4 + 0x18b0]
mov ebp, esi
shr ebp, 0x17
and ebp, 0x1fe
xor edx, dword [ecx + ebp*4 + 0x10b0]
mov ebp, esi
and ebp, 0xff
xor edx, dword [ecx + ebp*8 + 0x10b4]
mov ebp, dword [esp + 0x1c]
rol ebp, 1
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x2c]
mov ebp, dword [ebp + 4]
add ebp, edx
add ebp, eax
xor ebx, ebp
mov ebp, dword [esp + 0x2c]
mov ebp, dword [ebp + 8]
add dword [esp + 0x2c], 0x10
lea ebp, [ebp + edx*2]
mov edx, dword [esp + 0x1c]
add ebp, eax
xor edx, ebp
ror ebx, 1
sub dword [esp + 0x10], 1
mov dword [esp + 0x1c], edx
jne 0x404144
mov ebp, dword [ecx + 0x1020]
mov eax, dword [esp + 0x30]
xor ebp, edi
mov dword [eax], ebp
mov edi, dword [ecx + 0x1024]
xor edi, esi
mov dword [eax + 4], edi
mov esi, dword [ecx + 0x1028]
xor esi, ebx
pop edi
mov dword [eax + 8], esi
mov ecx, dword [ecx + 0x102c]
pop esi
xor ecx, edx
pop ebp
mov dword [eax + 0xc], ecx
pop ebx
add esp, 0x18
ret 8
Function at 0x404300
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
mov edx, dword [ecx + 0x1024]
xor edx, dword [eax + 4]
push ebx
mov ebx, dword [ecx + 0x1020]
xor ebx, dword [eax]
push ebp
push esi
mov esi, dword [ecx + 0x1028]
xor esi, dword [eax + 8]
push edi
mov edi, dword [ecx + 0x102c]
xor edi, dword [eax + 0xc]
lea eax, [ecx + 0x10ac]
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], 8
mov eax, ebx
shr eax, 0x17
and eax, 0x1fe
mov eax, dword [ecx + eax*4 + 0x18b4]
mov ebp, ebx
shr ebp, 0xf
and ebp, 0x1fe
xor eax, dword [ecx + ebp*4 + 0x18b0]
mov ebp, ebx
shr ebp, 7
and ebp, 0x1fe
xor eax, dword [ecx + ebp*4 + 0x10b4]
mov ebp, ebx
and ebp, 0xff
xor eax, dword [ecx + ebp*8 + 0x10b0]
mov ebp, edx
shr ebp, 0xf
and ebp, 0x1fe
shr edx, 7
and edx, 0x1fe
mov dword [esp + 0x14], edx
mov edx, dword [ecx + ebp*4 + 0x18b4]
mov ebp, dword [esp + 0x14]
xor edx, dword [ecx + ebp*4 + 0x18b0]
mov ebp, dword [esp + 0x24]
shr ebp, 0x17
and ebp, 0x1fe
xor edx, dword [ecx + ebp*4 + 0x10b0]
mov ebp, dword [esp + 0x24]
and ebp, 0xff
xor edx, dword [ecx + ebp*8 + 0x10b4]
mov ebp, dword [esp + 0x2c]
mov ebp, dword [ebp - 4]
add ebp, edx
add ebp, eax
rol esi, 1
xor esi, ebp
mov ebp, dword [esp + 0x2c]
mov ebp, dword [ebp]
lea edx, [ebp + edx*2]
add edx, eax
xor edx, edi
ror edx, 1
mov edi, edx
mov eax, esi
shr eax, 0x17
and eax, 0x1fe
mov eax, dword [ecx + eax*4 + 0x18b4]
mov edx, esi
shr edx, 0xf
and edx, 0x1fe
xor eax, dword [ecx + edx*4 + 0x18b0]
mov edx, esi
shr edx, 7
and edx, 0x1fe
xor eax, dword [ecx + edx*4 + 0x10b4]
mov edx, esi
and edx, 0xff
xor eax, dword [ecx + edx*8 + 0x10b0]
mov edx, edi
shr edx, 0xf
and edx, 0x1fe
mov edx, dword [ecx + edx*4 + 0x18b4]
mov ebp, edi
shr ebp, 7
and ebp, 0x1fe
xor edx, dword [ecx + ebp*4 + 0x18b0]
mov ebp, edi
shr ebp, 0x17
and ebp, 0x1fe
xor edx, dword [ecx + ebp*4 + 0x10b0]
mov ebp, edi
and ebp, 0xff
xor edx, dword [ecx + ebp*8 + 0x10b4]
mov ebp, dword [esp + 0x2c]
mov ebp, dword [ebp - 0xc]
add ebp, edx
add ebp, eax
rol ebx, 1
xor ebx, ebp
mov ebp, dword [esp + 0x2c]
mov ebp, dword [ebp - 8]
sub dword [esp + 0x2c], 0x10
lea edx, [ebp + edx*2]
add edx, eax
xor edx, dword [esp + 0x24]
ror edx, 1
sub dword [esp + 0x10], 1
mov dword [esp + 0x24], edx
jne 0x404344
mov ebp, dword [ecx + 0x1010]
mov eax, dword [esp + 0x30]
xor ebp, esi
mov dword [eax], ebp
mov esi, dword [ecx + 0x1014]
xor esi, edi
mov dword [eax + 4], esi
mov esi, dword [ecx + 0x1018]
xor esi, ebx
pop edi
mov dword [eax + 8], esi
mov ecx, dword [ecx + 0x101c]
pop esi
xor ecx, edx
pop ebp
mov dword [eax + 0xc], ecx
pop ebx
add esp, 0x18
ret 8
Function at 0x4050b1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x54
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x50], eax
xor eax, eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov word [esp + 0x2d], ax
mov byte [esp + 0x2f], al
mov al, 0xd5
mov byte [esp + 7], al
mov byte [esp + 0xc], al
mov al, 0xec
push esi
mov esi, ecx
mov dl, 0xf7
mov cl, 0x28
mov byte [esp + 0x18], al
mov byte [esp + 0x21], al
mov eax, dword [esi]
mov byte [esp + 8], dl
mov byte [esp + 0x13], cl
mov byte [esp + 0x17], dl
mov edx, dword [eax + 0x18]
mov byte [esp + 0x20], cl
mov ecx, esi
mov byte [esp + 0x24], 0
mov byte [esp + 4], 0x37
mov byte [esp + 5], 0x47
mov byte [esp + 6], 8
mov byte [esp + 7], 0xff
mov byte [esp + 9], 0x71
mov byte [esp + 0xa], 0x9d
mov byte [esp + 0xc], 0x97
mov byte [esp + 0xd], 0x9e
mov byte [esp + 0xe], 0xc8
mov byte [esp + 0xf], 0x75
mov byte [esp + 0x11], 0x6c
mov byte [esp + 0x12], 0xd2
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x15], 0x6d
mov byte [esp + 0x16], 0x3c
mov byte [esp + 0x19], 0x31
mov byte [esp + 0x1a], 0x7a
mov byte [esp + 0x1b], 0x3b
mov byte [esp + 0x1c], 0x25
mov byte [esp + 0x1d], 0x63
mov byte [esp + 0x1e], 0x2a
mov byte [esp + 0x1f], 0xab
mov byte [esp + 0x22], 0x37
mov byte [esp + 0x23], 0xbb
call edx
cmp eax, 0x20
je 0x40516d
xor al, al
pop esi
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.004690b5
add esp, 0x54
ret
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
mov ecx, esi
call edx
cmp eax, 0x40
jne 0x40515b
mov eax, dword [esi]
mov eax, dword [eax + 4]
lea ecx, [esp + 0x34]
push ecx
push 0x10
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
lea ecx, [esp + 4]
lea esi, [esp + 0x34]
cmp eax, 4
jb 0x4051ba
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x40515b
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x4051a6
test eax, eax
je 0x4051e2
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x40515b
cmp eax, 1
jbe 0x4051e2
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x40515b
cmp eax, 2
jbe 0x4051e2
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x40515b
mov ecx, dword [esp + 0x54]
pop esi
xor ecx, esp
mov al, 1
call fcn.004690b5
add esp, 0x54
ret
Function at 0x4052b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x38], eax
xor eax, eax
push esi
mov esi, ecx
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov byte [esp + 0x18], 0
mov byte [esp + 4], 0xe1
mov byte [esp + 5], 0x29
mov byte [esp + 6], 0xf2
mov byte [esp + 7], 0x7c
mov byte [esp + 8], 0x51
mov byte [esp + 9], 3
mov byte [esp + 0xa], 0xbc
mov byte [esp + 0xb], 0x5c
mov byte [esp + 0xc], 0xc4
mov byte [esp + 0xd], 0x4b
mov byte [esp + 0xe], 0xcd
mov byte [esp + 0xf], 0xf0
mov byte [esp + 0x10], 0xa1
mov byte [esp + 0x11], 0x5e
mov byte [esp + 0x12], 0x16
mov byte [esp + 0x13], 0xd
mov byte [esp + 0x14], 0x44
mov byte [esp + 0x15], 0x50
mov byte [esp + 0x16], 0x66
mov byte [esp + 0x17], 0xff
call edx
cmp eax, 0x14
je 0x40534f
xor al, al
pop esi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004690b5
add esp, 0x3c
ret
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
mov ecx, esi
call edx
cmp eax, 0x40
jne 0x40533d
mov eax, dword [esi]
mov eax, dword [eax + 4]
lea ecx, [esp + 0x28]
push ecx
push 0x10
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
lea ecx, [esp + 4]
lea esi, [esp + 0x28]
cmp eax, 4
jb 0x40539c
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x40533d
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x405388
test eax, eax
je 0x4053c4
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x40533d
cmp eax, 1
jbe 0x4053c4
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x40533d
cmp eax, 2
jbe 0x4053c4
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x40533d
mov ecx, dword [esp + 0x3c]
pop esi
xor ecx, esp
mov al, 1
call fcn.004690b5
add esp, 0x3c
ret
Function at 0x405680
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable.dwcl::MD5.0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
ret

Function at 0x4056b0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], eax
ret
Function at 0x408810
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable.dwcl::RIPEMD128.0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
ret
Function at 0x409720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x30], eax
xor eax, eax
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov word [esp + 0x1d], ax
mov byte [esp + 0x1f], al
mov al, 0xc3
push esi
mov esi, ecx
mov byte [esp + 5], al
mov byte [esp + 0x13], al
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov byte [esp + 0x14], 0
mov byte [esp + 4], 0x74
mov byte [esp + 6], 0x33
mov byte [esp + 7], 0x69
mov byte [esp + 8], 0x7c
mov byte [esp + 9], 0x41
mov byte [esp + 0xa], 0x3d
mov byte [esp + 0xb], 0x8f
mov byte [esp + 0xc], 0x39
mov byte [esp + 0xd], 0xc
mov byte [esp + 0xe], 0xf1
mov byte [esp + 0xf], 0x21
mov byte [esp + 0x10], 0x24
mov byte [esp + 0x11], 0x47
mov byte [esp + 0x12], 0x8c
call edx
cmp eax, 0x10
je 0x4097bb
xor al, al
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004690b5
add esp, 0x34
ret
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
mov ecx, esi
call edx
cmp eax, 0x40
jne 0x4097a9
mov eax, dword [esi]
mov eax, dword [eax + 4]
lea ecx, [esp + 0x24]
push ecx
push 0x10
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
lea ecx, [esp + 4]
lea esi, [esp + 0x24]
cmp eax, 4
jb 0x409808
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x4097a9
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x4097f4
test eax, eax
je 0x409830
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x4097a9
cmp eax, 1
jbe 0x409830
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x4097a9
cmp eax, 2
jbe 0x409830
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x4097a9
mov ecx, dword [esp + 0x34]
pop esi
xor ecx, esp
mov al, 1
call fcn.004690b5
add esp, 0x34
ret
Function at 0x40c690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x30], eax
xor eax, eax
push esi
mov esi, ecx
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov word [esp + 0x21], ax
mov byte [esp + 0x23], al
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov byte [esp + 0x14], 0
mov byte [esp + 4], 0x48
mov byte [esp + 5], 0x7c
mov byte [esp + 6], 0x3f
mov byte [esp + 7], 0x5e
mov byte [esp + 8], 0x2b
mov byte [esp + 9], 0xd
mov byte [esp + 0xa], 0x6a
mov byte [esp + 0xb], 0x79
mov byte [esp + 0xc], 0x32
mov byte [esp + 0xd], 0x4e
mov byte [esp + 0xe], 0xcd
mov byte [esp + 0xf], 0xbe
mov byte [esp + 0x10], 0x9c
mov byte [esp + 0x11], 0x15
mov byte [esp + 0x12], 0x16
mov byte [esp + 0x13], 0x6f
call edx
cmp eax, 0x10
je 0x40c72b
xor al, al
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004690b5
add esp, 0x34
ret
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
mov ecx, esi
call edx
cmp eax, 0x40
jne 0x40c719
mov eax, dword [esi]
mov eax, dword [eax + 4]
lea ecx, [esp + 0x24]
push ecx
push 0x10
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
lea ecx, [esp + 0x24]
lea esi, [esp + 4]
cmp eax, 4
jb 0x40c778
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x40c719
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x40c764
test eax, eax
je 0x40c7a0
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x40c719
cmp eax, 1
jbe 0x40c7a0
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x40c719
cmp eax, 2
jbe 0x40c7a0
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x40c719
mov ecx, dword [esp + 0x34]
pop esi
xor ecx, esp
mov al, 1
call fcn.004690b5
add esp, 0x34
ret
Function at 0x411700
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x164
push ebx
push ebp
mov ebx, ecx
mov eax, dword [ebx]
mov edx, dword [eax + 4]
push esi
push edi
call edx
push eax
mov eax, dword [ebx + 4]
push eax
lea ecx, [esp + 0xdc]
push ecx
call fcn.00468d50
mov ecx, 7
mov esi, 0x5194a8
lea edi, [esp + 0x24]
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
xor esi, esi
lea ebx, [ebx]
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
cdq
and edx, 3
add eax, edx
mov ecx, eax
mov eax, esi
cdq
sar ecx, 2
idiv ecx
mov eax, dword [esp + esi*4 + 0x2c]
xor eax, dword [esp + esi*4 + 0x18]
rol eax, 3
xor eax, dword [esp + edx*4 + 0xd4]
xor eax, esi
mov dword [esp + esi*4 + 0x34], eax
inc esi
cmp esi, 0x26
jle 0x411740
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [esp + 0xd0], eax
mov edx, 7
jmp 0x4117a0
mov ecx, 1
jmp 0x4117b0
mov eax, dword [esp + ecx*4 + 0x30]
and eax, 0x1ff
mov eax, dword [eax*4 + 0x5194c8]
add eax, dword [esp + ecx*4 + 0x34]
add ecx, 3
rol eax, 9
mov dword [esp + ecx*4 + 0x28], eax
and eax, 0x1ff
mov eax, dword [eax*4 + 0x5194c8]
add eax, dword [esp + ecx*4 + 0x2c]
rol eax, 9
mov dword [esp + ecx*4 + 0x2c], eax
and eax, 0x1ff
mov eax, dword [eax*4 + 0x5194c8]
add eax, dword [esp + ecx*4 + 0x30]
rol eax, 9
cmp ecx, 0x27
mov dword [esp + ecx*4 + 0x30], eax
jle 0x4117b0
mov ecx, dword [esp + 0xd0]
and ecx, 0x1ff
mov eax, dword [ecx*4 + 0x5194c8]
add eax, dword [esp + 0x34]
rol eax, 9
sub edx, 1
mov dword [esp + 0x34], eax
jne 0x4117a0
xor ecx, ecx
lea esi, [esp + 0x34]
nop
mov eax, ecx
cdq
mov edi, 0x28
idiv edi
mov eax, dword [esi]
add ecx, 7
add esi, 4
cmp ecx, 0x111
mov dword [ebx + edx*4 + 0x10], eax
jle 0x411830
lea edi, [ebx + 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x10
lea ecx, [ecx]
mov ebx, dword [edi]
mov edx, ebx
or edx, 3
mov esi, edx
shr esi, 1
mov eax, esi
and eax, edx
mov ecx, eax
shr ecx, 2
and eax, ecx
mov ecx, eax
shr ecx, 4
and eax, ecx
mov edi, eax
mov ecx, eax
shr ecx, 1
shr edi, 2
and edi, ecx
and edi, eax
mov eax, edx
not eax
mov ecx, eax
shr ecx, 1
and ecx, eax
mov eax, ecx
shr eax, 2
and ecx, eax
mov eax, ecx
shr eax, 4
and ecx, eax
mov eax, ecx
mov ebp, ecx
shr eax, 2
shr ebp, 1
and eax, ebp
and eax, ecx
or eax, edi
mov edi, dword [esp + 0x14]
mov cl, byte [edi + 0xc]
and cl, 0x1f
and ebx, 3
mov ebx, dword [ebx*4 + 0x5198ec]
rol ebx, cl
lea ecx, [eax + eax]
or ecx, eax
add ecx, ecx
or ecx, eax
add ecx, ecx
or ecx, eax
add ecx, ecx
or ecx, eax
add ecx, ecx
or ecx, eax
add ecx, ecx
or ecx, eax
add ecx, ecx
or ecx, eax
add ecx, ecx
or ecx, eax
add ecx, ecx
or ecx, eax
and ebx, ecx
lea eax, [edx + edx]
not eax
xor eax, edx
and ebx, eax
not esi
xor esi, edx
and ebx, esi
and ebx, 0xfffffffc
xor ebx, edx
mov dword [edi], ebx
add edi, 8
sub dword [esp + 0x10], 1
mov dword [esp + 0x14], edi
jne 0x411860
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x164
ret 4
Function at 0x4132d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [eax + 4]
push ebx
mov ebx, dword [eax]
push esi
push edi
mov edi, ecx
lea eax, [edi + 0x70]
mov esi, 2
sub edx, dword [eax + 4]
mov cl, bl
ror edx, cl
sub eax, 0x30
xor edx, ebx
sub ebx, dword [eax + 0x30]
mov cl, dl
ror ebx, cl
xor ebx, edx
sub edx, dword [eax + 0x2c]
mov cl, bl
ror edx, cl
xor edx, ebx
sub ebx, dword [eax + 0x28]
mov cl, dl
ror ebx, cl
xor ebx, edx
sub edx, dword [eax + 0x24]
mov cl, bl
ror edx, cl
xor edx, ebx
sub ebx, dword [eax + 0x20]
mov cl, dl
ror ebx, cl
xor ebx, edx
sub edx, dword [eax + 0x1c]
mov cl, bl
ror edx, cl
xor edx, ebx
sub ebx, dword [eax + 0x18]
mov cl, dl
ror ebx, cl
xor ebx, edx
sub edx, dword [eax + 0x14]
mov cl, bl
ror edx, cl
xor edx, ebx
sub ebx, dword [eax + 0x10]
mov cl, dl
ror ebx, cl
xor ebx, edx
sub edx, dword [eax + 0xc]
mov cl, bl
ror edx, cl
xor edx, ebx
sub ebx, dword [eax + 8]
mov cl, dl
ror ebx, cl
xor ebx, edx
sub esi, 1
jne 0x4132e6
sub ebx, dword [edi + 0x10]
mov eax, dword [esp + 0x14]
mov dword [eax], ebx
sub edx, dword [edi + 0x14]
pop edi
pop esi
mov dword [eax + 4], edx
pop ebx
ret 8
Function at 0x41347a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x40], eax
mov dl, 0xd1
mov al, 0x37
mov byte [esp + 5], dl
mov byte [esp + 0xd], dl
mov dl, 0x9c
mov byte [esp + 0xb], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x24], al
mov al, 0xe5
push esi
mov esi, ecx
mov cl, 0x5a
mov byte [esp + 0x14], dl
mov byte [esp + 0x21], dl
mov dl, 0x15
mov byte [esp + 0x29], al
mov byte [esp + 0x35], al
mov eax, dword [esi]
mov byte [esp + 0xb], cl
mov byte [esp + 0x27], dl
mov byte [esp + 0x39], cl
mov byte [esp + 0x3c], dl
mov edx, dword [eax]
mov byte [esp + 0x40], cl
mov ecx, esi
mov byte [esp + 4], 0x73
mov byte [esp + 5], 0x69
mov byte [esp + 6], 0xc
mov byte [esp + 7], 0xa1
mov byte [esp + 8], 0xc0
mov byte [esp + 0xa], 0xce
mov byte [esp + 0xc], 0xb1
mov byte [esp + 0xd], 0xbf
mov byte [esp + 0xe], 0x11
mov byte [esp + 0x10], 0x26
mov byte [esp + 0x12], 0xae
mov byte [esp + 0x13], 0xfb
mov byte [esp + 0x15], 0x21
mov byte [esp + 0x16], 0x54
mov byte [esp + 0x17], 0x32
mov byte [esp + 0x18], 0x16
mov byte [esp + 0x19], 0xbd
mov byte [esp + 0x1a], 0x7e
mov byte [esp + 0x1b], 0xe1
mov byte [esp + 0x1c], 0x17
mov byte [esp + 0x1d], 0x98
mov byte [esp + 0x1f], 0x77
mov byte [esp + 0x20], 1
mov byte [esp + 0x22], 0x61
mov byte [esp + 0x23], 0x60
mov byte [esp + 0x24], 0x5d
mov byte [esp + 0x25], 0xde
mov byte [esp + 0x26], 0x19
mov byte [esp + 0x2a], 0x29
mov byte [esp + 0x2b], 0x83
mov byte [esp + 0x2c], 0xcb
mov byte [esp + 0x2d], 0x42
mov byte [esp + 0x2e], 0xe2
mov byte [esp + 0x2f], 0x72
mov byte [esp + 0x30], 0x9a
mov byte [esp + 0x31], 0x45
mov byte [esp + 0x32], 2
mov byte [esp + 0x33], 0x2c
mov byte [esp + 0x34], 0xed
mov byte [esp + 0x36], 0xab
mov byte [esp + 0x37], 0xd2
mov byte [esp + 0x38], 0xb9
mov byte [esp + 0x3a], 0xc3
mov byte [esp + 0x3b], 0x47
mov byte [esp + 0x3d], 0xae
mov byte [esp + 0x3e], 0x97
mov byte [esp + 0x3f], 0x70
mov byte [esp + 0x41], 0x63
mov byte [esp + 0x42], 0x8d
mov byte [esp + 0x43], 0x8f
call edx
cmp eax, 8
je 0x4135be
xor al, al
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004690b5
add esp, 0x44
ret
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
push 0
push 0x40
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call edx
mov ecx, dword [esp + 0x44]
pop esi
xor ecx, esp
mov al, 1
call fcn.004690b5
add esp, 0x44
ret