joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405640
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x40582a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x40582a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x40582a
cmp dword [ecx], 0
jne 0x40582a
push esi
call fcn.0040c7b0
add esp, 4
test eax, eax
je 0x4056b4
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x4056bb
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ebx, [ebx + ecx*2]
mov ecx, edi
cmp ebx, eax
jb 0x405690
jmp 0x4056bd
mov edi, 0x1505
jmp 0x4056bd
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov esi, edx
sub esi, 1
mov dword [esp + 0xc], esi
jae 0x40578e
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x40571b
call fcn.004058f0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x40582a
push esi
call fcn.0040c7b0
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405840
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040c7b0
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x448008]
add esp, 4
test eax, eax
je 0x405825
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c590
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x40582a
mov dword [esp], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4057a8
inc ebx
dec edx
je 0x4056d6
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x4056db
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x4057a0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040c7b0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x4057a0
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040c7d0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x4057a0
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00404780
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x405783
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406860
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406a16
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406a0f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x4068f5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406a0f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x406975
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
mov edi, esi
and edi, eax
xor esi, eax
lea eax, [esi + edi*2]
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406910
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x4068bd
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x4069c0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x4069a0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4068b0
jmp 0x4069cf
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x4068b0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x4069e0
jmp 0x4068b0
shl ecx, 0x10
or ecx, edi
jmp 0x406a1b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406a30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x406a5e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x406afc
not eax
test bl, 1
jne 0x406a65
mov edx, ebx
cmp ebx, 1
jne 0x406a96
jmp 0x406afa
xor eax, eax
jmp 0x406afc
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x445c50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x445c50]
cmp ebx, 1
je 0x406afa
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x445c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x445c50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x445c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x445c50]
add esi, 2
cmp edx, esi
jne 0x406aa0
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x40ccf0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
call fcn.0043f2d0
test al, al
je 0x40cebf
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
call fcn.00437160
test al, al
je 0x40ceba
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
mov dword [esp], 0xe6ad181d
mov dword [esp + 4], 0x2a10d632
mov byte [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x6b
xor cl, byte [esp + eax]
add cl, 0xe9
mov byte [esp + eax], cl
inc eax
cmp eax, 9
jne 0x40cd40
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp], 0xd679b3f3
mov dword [esp + 4], 0xcc7192f9
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
movzx edx, byte [esp + eax]
lea edi, [eax + 0x31]
mov ecx, 0xce
sub ecx, eax
xor ecx, edi
and ecx, edx
xor ecx, edi
add cl, 0xb
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0xb
jb 0x40cd80
mov dword [esp], 0xf7f609e9
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xfe
xor cl, byte [esp + eax]
add cl, 0xa
mov byte [esp + eax], cl
inc eax
cmp eax, 4
jne 0x40cdc0
test esi, esi
je 0x40ce04
mov dword [esp], 0xf7618731
mov dword [esp + 4], 0xa9bc50ea
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa7
xor cl, byte [esp + eax]
add cl, 0xbd
mov byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x40cdf0
mov dword [esp], 0xb6b78889
mov dword [esp + 4], 0xb2b3b4b5
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
mov edi, eax
and edi, 0x1c
mov edx, ecx
xor edx, 0xc893f2de
add edx, edi
mov edi, edx
and edi, esi
mov ebp, edi
or ebp, 0xfffffffd
inc ebp
mov ebx, edi
and ebx, 0xfffffffd
imul ebx, ebp
mov ebp, edi
and ebp, 2
or edi, 2
imul edi, ebp
sub ebx, edi
add edx, esi
add edx, ebx
mov esi, edx
not esi
or esi, 0x151c41a9
add esi, edx
inc esi
mov ebx, esi
and ebx, 2
mov edi, esi
or esi, 2
imul esi, ebx
xor ebx, 2
and edi, 0xfd
imul edi, ebx
lea ebx, [edx + edx]
and ebx, 0x52
sub edx, ebx
add edx, esi
add edx, edi
add dl, 0xaa
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0xb
jne 0x40ce30
call fcn.0040dd30
test al, al
je 0x40ceba
call fcn.00410ed0
call fcn.0040fa90
call fcn.0043fea0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40db70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov bl, byte [ebp + 8]
call fcn.0040dd20
push eax
push eax
test edi, edi
sets al
mov ecx, edi
sub ecx, 1
sete cl
or al, cl
mov ecx, edi
sub ecx, 0x25
setge cl
or al, cl
test al, 1
jne 0x40dba5
jmp 0x40dbaa
jmp 0x40dd16
movzx eax, bl
mov edi, esi
mov ecx, dword [ebp + 0x10]
add edi, ecx
add edi, 0xffffffff
mov byte [esi + ecx - 1], 0
cmp eax, 0
sete al
jmp 0x40dbc4
test al, 1
jne 0x40dbca
jmp 0x40dbd8
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], 0x30
jmp 0x40dd14
cmp dword [ebp + 0x14], 0xa
sete al
test al, 1
jne 0x40dbe8
jmp 0x40dc89
jmp 0x40dbea
movzx ecx, bl
cmp ecx, 0x64
setae al
test al, 1
jne 0x40dbf9
jmp 0x40dc4e
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
mov esi, edx
and esi, 0xfffffffd
mov eax, edx
or eax, 0xfffffffd
xor eax, 0xffffffff
imul eax, esi
mov esi, edx
and esi, 2
or edx, 2
imul edx, esi
add edx, eax
mov al, byte [edx + 0x446761]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov al, byte [edx + 0x446760]
add esi, 0xffffffff
mov byte [edi - 2], al
mov edi, 0x64
mov eax, ecx
xor edx, edx
div edi
mov ebx, eax
mov edi, esi
jmp 0x40dbea
cmp ecx, 0xa
jae 0x40dc64
mov al, byte [ecx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x40dc84
shl ecx, 1
mov al, byte [ecx + 0x446761]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov al, byte [ecx + 0x446760]
add esi, 0xffffffff
mov byte [edi - 2], al
jmp 0x40dc84
jmp 0x40dd14
cmp dword [ebp + 0x14], 0x10
je 0x40dc91
jmp 0x40dcdb
movzx eax, bl
cmp eax, 0x10
setl cl
jmp 0x40dc9c
test cl, 1
jne 0x40dca3
jmp 0x40dcb4
mov al, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x40dd14
shl eax, 1
mov cl, byte [eax + 0x44682a]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], cl
mov al, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
jmp 0x40dcce
add esi, 0xffffffff
jmp 0x40dcd3
jmp 0x40dcd5
mov byte [esi], al
jmp 0x40dcd9
jmp 0x40dd14
movzx ecx, bl
cmp ecx, 0
seta al
test al, 1
jne 0x40dcea
jmp 0x40dd10
mov eax, ecx
xor edx, edx
mov esi, dword [ebp + 0x14]
mov ebx, esi
div ebx
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov eax, ecx
xor edx, edx
div ebx
mov ebx, eax
mov edi, esi
jmp 0x40dcdb
mov esi, edi
jmp 0x40dd14
jmp 0x40dd16
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40dd30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x19c
mov eax, dword [0x44e578]
mov dword [esp], eax
mov dword [esp + 0x11c], 0x898a938c
mov byte [esp + 0x120], 0
mov ecx, 0x8b7405e3
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x748bfb39]
xor edx, ecx
mov esi, edx
xor esi, 0x70
and edx, 0xf
add edx, edx
sub edx, esi
inc dl
mov byte [esp + ecx + 0x748bfb39], dl
inc ecx
cmp ecx, 0x8b7405e8
jne 0x40dd60
mov ecx, dword [esp + 0x11c]
mov dword [esp + 0x1c], 0xe945eb7d
mov dword [esp + 0x20], 0xed46ef7a
mov dword [esp + 0x24], 0xd146d378
mov dword [esp + 0x28], 0xd584d740
mov dword [esp + 0x2c], 0xd976db70
mov dword [esp + 0x30], 0xdddedf74
mov word [esp + 0x34], 0
mov byte [esp + 0x36], 0
mov edx, 0xd7
movzx esi, byte [esp + edx - 0xbb]
lea edi, [edx - 0x4e475b00]
mov ebx, esi
not ebx
or ebx, edx
lea ebp, [esi + ebx]
inc ebp
or edi, esi
lea ebx, [edi + edi]
not ebx
add ebx, edi
or ebx, ebp
mov al, 0xcc
sub al, bl
mov byte [esp + edx - 0xbb], al
inc edx
cmp edx, 0xf2
jne 0x40ddd0
lea eax, [esp + 0x1c]
push ecx
push 0
push eax
call dword [esp + 0xc]
mov ecx, 0x44e540
push eax
call fcn.0043f070
movzx eax, al
mov eax, dword [eax*4 + 0x448a5c]
mov ecx, 0x9e1b805b
xor ecx, dword [0x448a64]
add eax, ecx
inc eax
jmp eax
Function at 0x40faa0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov edi, dword [esp + 0x44c]
mov dword [esp + 0x38], 0x77e509bd
mov dword [esp + 0x3c], 0x73db75f2
mov dword [esp + 0x40], 0x7fea71e4
mov dword [esp + 0x44], 0x7b297ddd
mov dword [esp + 0x48], 0x67347925
mov dword [esp + 0x4c], 0x63026534
mov dword [esp + 0x50], 0x6fd56108
mov dword [esp + 0x54], 0x6bf86dc5
mov dword [esp + 0x58], 0x57c569c4
mov dword [esp + 0x5c], 0x53cd55cf
mov dword [esp + 0x60], 0x5fec5130
mov dword [esp + 0x64], 0x5b3a5de0
mov dword [esp + 0x68], 0x47165909
mov dword [esp + 0x6c], 0x43124516
mov dword [esp + 0x70], 0x4f2e4107
mov dword [esp + 0x74], 0x4be34df7
mov dword [esp + 0x78], 0xb7ec49da
mov dword [esp + 0x7c], 0xb3f5b5e8
mov dword [esp + 0x80], 0xbf26b1d0
mov dword [esp + 0x84], 0xbbe6bde6
mov dword [esp + 0x88], 0xa7c6b9d1
mov dword [esp + 0x8c], 0xa332a5e5
mov dword [esp + 0x90], 0xaf3aa130
mov dword [esp + 0x94], 0xab11ad01
mov dword [esp + 0x98], 0x9738a905
mov dword [esp + 0x9c], 0x933b9523
mov dword [esp + 0xa0], 0x9fcd910c
mov dword [esp + 0xa4], 0x9bc59dc1
mov dword [esp + 0xa8], 0x87d499c3
mov dword [esp + 0xac], 0x83d885db
mov dword [esp + 0xb0], 0x8fe681e0
mov dword [esp + 0xb4], 0x8bc28d3b
mov dword [esp + 0xb8], 0xf7438934
mov dword [esp + 0xbc], 0xf3a6f540
mov dword [esp + 0xc0], 0xff6af190
mov dword [esp + 0xc4], 0xfb6dfd55
mov dword [esp + 0xc8], 0xe786f955
mov dword [esp + 0xcc], 0xe34fe5af
mov dword [esp + 0xd0], 0xef79e14f
mov dword [esp + 0xd4], 0xeb83ed7f
mov dword [esp + 0xd8], 0xd799e988
mov dword [esp + 0xdc], 0xd34cd57c
mov dword [esp + 0xe0], 0xdf4bd143
mov dword [esp + 0xe4], 0xdb89dd71
mov dword [esp + 0xe8], 0xc797d989
mov dword [esp + 0xec], 0xc390c59d
mov dword [esp + 0xf0], 0xcf9cc190
mov dword [esp + 0xf4], 0xcb98cd9c
mov dword [esp + 0xf8], 0x3756c998
mov dword [esp + 0xfc], 0x3393358b
mov dword [esp + 0x100], 0x3f9f319a
mov dword [esp + 0x104], 0x3b933da2
mov dword [esp + 0x108], 0x277b396b
mov dword [esp + 0x10c], 0x2379257b
mov dword [esp + 0x110], 0x2f712172
mov dword [esp + 0x114], 0x2b2a2d76
mov eax, dword [0x44e548]
mov ecx, 0x5d7fe507
nop
nop
nop
movzx edx, byte [esp + ecx - 0x5d7fe4cf]
lea esi, [ecx - 0x5d7fe449]
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + ecx - 0x5d7fe4cf], dl
inc ecx
cmp ecx, 0x5d7fe5e7
jne 0x40fcf0
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x448fb4]
mov ecx, 0xf7b0b2f3
xor ecx, dword [0x448fbc]
add eax, ecx
inc eax
jmp eax

Function at 0x410ed0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xca8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x449978]
Function at 0x41cebf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x10], esp
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
cmp word [edi + edx + 2], 0
lea edx, [edx + 2]
jne 0x41ced0
mov esi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41cef0
sar edx, 1
sar eax, 1
lea ecx, [edx + eax]
add ecx, 2
test ecx, ecx
mov dword [ebp - 0x20], edx
jns 0x41cf13
mov eax, 0xffffffff
jmp 0x41cf1c
add eax, edx
lea eax, [eax*2 + 4]
push eax
call fcn.0040c560
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x41cf51
add esi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x41cf40
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [edi]
test cx, cx
je 0x41cf83
lea edx, [edi + 2]
mov esi, dword [ebp - 0x10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cf70
jmp 0x41cf86
mov esi, dword [ebp - 0x10]
mov word [eax], 0
lea eax, [ebp - 0x18]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00443380
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a4f8]
Function at 0x41d2f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x10c8
call fcn.0040c4c0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
xor ecx, ecx
nop
nop
nop
nop
nop
cmp word [eax + ecx], 0
lea ecx, [ecx + 2]
jne 0x41d310
lea edx, [eax + ecx]
add edx, 0xfffffffe
add ecx, eax
mov edi, 1
sub edi, ecx
and edi, eax
mov esi, eax
not esi
and esi, edx
sub esi, edi
sar esi, 1
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44f88c]
mov ebx, dword [esp + 0x34]
mov edi, 0xffffffff
test ebx, ebx
jns 0x41d35c
mov eax, 0xffffffff
jmp 0x41d35f
lea eax, [ebx + ebx]
push eax
call fcn.0040c560
add esp, 4
lea ecx, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x20], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44f88c]
mov eax, dword [esp + 0x34]
mov ecx, eax
add ecx, 0xd
js 0x41d394
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c560
add esp, 4
mov esi, eax
mov dword [esp + 0xc4], 0x31e23fd0
mov dword [esp + 0xc8], 0x35c733d3
mov dword [esp + 0xcc], 0xc91637c0
mov dword [esp + 0xd0], 0xcd2dcb1e
mov dword [esp + 0xd4], 0xc13bcf3e
mov dword [esp + 0xd8], 0xc533c33b
mov dword [esp + 0xdc], 0xd9c6c73a
mov word [esp + 0xe0], 0
mov eax, 0xf5
mov ecx, 0xa
mov edi, ecx
and edi, 0x4d
mov edx, eax
and edx, 0xb2
or edx, edi
xor dl, byte [esp + eax - 0x31]
xor dl, 0x4d
add dl, 0x37
mov byte [esp + eax - 0x31], dl
inc eax
dec ecx
cmp eax, 0x113
jne 0x41d400
mov eax, dword [esp + 0x18]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x41d451
mov eax, dword [esp + 0x18]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d440
mov word [eax], 0
movzx ecx, word [esp + 0xc4]
test cx, cx
je 0x41d481
lea edx, [esp + 0xc6]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41d470
mov word [eax], 0
lea eax, [esp + 0x58]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00443380
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44a7a8]
Function at 0x4270a0
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x74
mov eax, dword [0x44f88c]
mov dword [esp], 0xe132e7db
mov dword [esp + 4], 0xfd1fe311
mov dword [esp + 8], 0xf90aff1f
mov dword [esp + 0xc], 0xf50afb3b
mov dword [esp + 0x10], 0xf12af704
mov dword [esp + 0x14], 0x8d7ef313
mov dword [esp + 0x18], 0x89b18f6f
mov word [esp + 0x1c], 0x8b88
mov dword [esp + 0x1e], 0
mov byte [esp + 0x22], 0
mov ecx, esp
mov edx, 0xd6
nop
nop
movzx esi, byte [ecx]
lea edi, [edx - 0x2bc9db00]
or edi, esi
not edi
and esi, edx
or esi, edi
lea ebx, [esi + 0x250ebd32]
mov edi, ebx
xor edi, 0xfe
or ebx, 1
and ebx, edi
mov edi, 0xcd
sub edi, esi
or edi, 1
sub ebx, edi
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0xb3
jne 0x427100
lea ecx, [esp + 0x50]
mov ebx, esp
push ecx
push 0
push 0
push 0xe
push ebx
push 0
call eax
mov ebp, dword [esp + 0x50]
test ebp, ebp
jns 0x42715d
mov eax, 0xffffffff
jmp 0x427164
lea eax, [ebp*2]
push eax
call fcn.0040c560
add esp, 4
mov esi, eax
mov eax, dword [0x44f88c]
mov dword [esp], 0xd182cfeb
mov dword [esp + 4], 0xd5b7d3a1
mov dword [esp + 8], 0xd9bad7b7
mov dword [esp + 0xc], 0xddaadb9b
mov dword [esp + 0x10], 0xe19adfac
mov dword [esp + 0x14], 0xe596e383
mov dword [esp + 0x18], 0xe9c1e787
mov dword [esp + 0x1c], 0xebe8
mov byte [esp + 0x20], 0
mov ecx, 0xd11ab74d
nop
nop
nop
movzx edx, byte [esp + ecx + 0x2ee548b3]
xor edx, ecx
mov edi, edx
and edi, 1
or edx, 1
add edx, edi
add dl, 0x7e
mov byte [esp + ecx + 0x2ee548b3], dl
inc ecx
cmp ecx, 0xd11ab76e
jne 0x4271c0
lea ecx, [esp + 0x50]
push ecx
push ebp
push esi
push 0xe
push ebx
push 0
call eax
mov eax, dword [esp + 0x50]
mov ecx, eax
add ecx, 9
jns 0x427207
mov eax, 0xffffffff
jmp 0x42720e
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040c560
add esp, 4
mov edi, eax
mov dword [esp], 0x81568720
mov dword [esp + 4], 0x8d2f8323
mov dword [esp + 8], 0x892d8f39
mov dword [esp + 0xc], 0x95258b21
mov dword [esp + 0x10], 0x91969729
mov word [esp + 0x14], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
mov ebp, eax
and ebp, 2
mov edx, ecx
xor edx, 0xe1
add edx, ebp
xor dl, byte [esp + ecx]
add dl, 0x9b
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0x16
jne 0x427250
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x427291
lea edx, [esi + 2]
mov eax, edi
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x427280
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4272c1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4272b0
mov word [eax], 0
lea eax, [esp + 0x70]
push eax
push edi
call fcn.00443520
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44b380]