joyce8/EMBER2024-capa huggingface dataset:
Function at 0x504cf5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00504c71
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x504e64
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x504e64
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x504e19
jg 0x504d51
test eax, eax
je 0x504e0f
push 1
push 0x1000
call fcn.004f96c1
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x504d74
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x504e06
push 0x8000
push ebx
call fcn.004f39fd
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x504d9d
jg 0x504d98
cmp ecx, 0x1000
jb 0x504d9d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004fc112
add esp, 0x10
cmp eax, 0xffffffff
je 0x504de2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x504d98
jl 0x504dc9
test ecx, ecx
jne 0x504d8a
push dword [ebp - 0xc]
push ebx
call fcn.004f39fd
push esi
call fcn.004f8fa1
add esp, 0xc
xor ebx, ebx
jmp 0x504e72
cmp byte [edi + 0x24], 0
je 0x504df9
cmp dword [edi + 0x20], 5
jne 0x504df9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x504e04
mov ebx, dword [edi + 0x18]
jmp 0x504e06
xor ebx, ebx
push esi
call fcn.004f8fa1
pop ecx
jmp 0x504e72
test ecx, ecx
jg 0x504ddb
jl 0x504e19
test eax, eax
jae 0x504ddb
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004f76a5
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x504e39
cmp byte [edi + 0x1c], 0
je 0x504ddb
jmp 0x504e6a
push ebx
call fcn.004fed71
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x504ddb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x504e72
cmp byte [edi + 0x1c], 0
je 0x504e6f
mov ebx, dword [edi + 0x18]
jmp 0x504e72
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004f76a5
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5063e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x50640d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x50640d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x45da90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x38000]
push edi
or ebp, 0xffffffff
jmp 0x45dab2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45dab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45daa8
mov eax, 1
add ebx, ebx
jne 0x45dacb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45dac0
jne 0x45dadc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45dac0
xor ecx, ecx
sub eax, 3
jb 0x45daf0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45db62
mov ebp, eax
add ebx, ebx
jne 0x45dafb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45db08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45db2c
inc ecx
add ebx, ebx
jne 0x45db18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45db0d
jne 0x45db29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45db0d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45db4c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45db3d
jmp 0x45daae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45db4c
add edi, ecx
jmp 0x45daae
pop esi
lea edi, [esi + 0x5b000]
mov eax, dword [edi]
or eax, eax
je 0x45dbab
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5d22c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5d2d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45db69
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5d2dc]
or eax, eax
je 0x45dba5
mov dword [ebx], eax
add ebx, 4
jmp 0x45db86
call dword [esi + 0x5d2d8]
mov ebp, dword [esi + 0x5d2e0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45dbdf
sub esp, 0xffffff80
jmp 0x401710
Function at 0x426c41
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x426c50
pop dword [ebp - 0x50]
mov eax, 0xebc6039b
sub eax, 0xeb83974b
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x912f6456
sub dword [ebp - 0x60], 0x42dd1f0b
mov dword [ebp - 0x5c], 0xdeb868ef
add dword [ebp - 0x5c], 0x537ae356
mov dword [ebp - 0x58], 0x96ac84b5
add dword [ebp - 0x58], 0xb59fbf79
mov dword [ebp - 0x54], 0xbf30fde6
add dword [ebp - 0x54], 0x40cf021a
lea eax, [ebp - 0x60]
push eax
mov eax, 0x369cf870
add eax, 0xc9a319f8
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x422b4bed
sub dword [ebp - 0x60], 0xcdb8e297
mov dword [ebp - 0x5c], 0xd4d2f6f3
add dword [ebp - 0x5c], 0x6c996a82
mov dword [ebp - 0x58], 0xafaceb69
sub dword [ebp - 0x58], 0x4c3d7efd
mov dword [ebp - 0x54], 0x78809d43
sub dword [ebp - 0x54], 0x78809d43
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xfd7daafe
sub eax, 0xfd3d9a26
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3f112
push 0
call eax
mov ecx, 0xe6e9560
sub ecx, 0xe6e4e03
mov edx, eax
mov ebx, 0xc60e5cd
add ebx, 0xf3e66033
add ebx, dword [ebp - 0x50]
mov edi, 0xcd2deb13
sub edi, 0x313be4e1
add dword [ebp - 0x34], ebx
mov esi, dword [ebx]
sub dword [ebp - 4], ecx
xor esi, edi
xor dword [ebp - 0x44], ebx
mov dword [edx], esi
add edx, 0x15462f68
sub edx, 0x15462f64
add ebx, 0x1e1f548d
add ebx, 0xe1e0ab77
loop 0x426d72
add eax, 0x11047
mov ebx, eax
add eax, 5
mov ecx, 0xfb544e5
add ecx, 0xf08abb1b
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x6df058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x6df1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x6df07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6df06a
add dl, dl
jne 0x6df089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6df0dc
xor eax, eax
add dl, dl
jne 0x6df096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6df17d
add dl, dl
jne 0x6df0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6df0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6df0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6df0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x6df0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x6df075
mov eax, 1
add dl, dl
jne 0x6df0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6df0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6df0e1
sub eax, ebx
mov ebx, 1
jne 0x6df128
mov ecx, 1
add dl, dl
jne 0x6df10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6df119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6df105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6df075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x6df13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6df14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6df136
cmp eax, 0x7d00
jae 0x6df16d
cmp eax, 0x500
jb 0x6df168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6df075
cmp eax, 0x7f
ja 0x6df170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6df075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x6df19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x6df075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x161c220
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push edx
rcl dh, 0x79
mov edx, dword [ebp + 0xc]
cmc
add eax, ecx
jmp 0x27470cc
push ebp
mov ebp, esp
btc ecx, ecx
sal ecx, cl
mov ecx, dword [ebp + 8]
cmc
clc
sub esp, 0x114
test ebx, ecx
push esi
test ecx, ecx
jmp 0x27bb177
jle 0x170b5a8
lea ebx, [esi + 1]
cmp bl, 0x17
mov ecx, dword [ebp + 8]
clc
stc
cmp ebx, edi
jle 0x163193c
jmp 0x170b5dc
mov eax, dword [ebp - 0xc]
xadd dx, dx
jmp 0x167fb29
js 0x170b5df
jmp 0x167fb29
jne 0x27d92b1
mov edx, dword [eax + ecx + 0x78]
stc
mov dword [ebp - 4], edx
test edx, edx
je 0x27d92b1
mov eax, dword [eax + ecx + 0x7c]
cmp cx, 0x3b27
push ebx
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
jmp 0x167dc4a
jmp 0x162b207
ja 0x16f351e
mov eax, esi
cmp edi, ecx
sub eax, dword [edx + ecx + 0x10]
jmp 0x26d3a87
mov edx, dword [ebp + 0x10]
shrd si, cx, 0xcb
lea esi, [edi + ebx]
cmp ebx, ecx
cmp ch, 0xa2
sar esi, 1
stc
jmp 0x16c648a
mov eax, dword [ecx + 0x3c]
test di, cx
cmp dword [eax + ecx], 0x4550
jmp 0x165d463
mov eax, dword [eax + esi*4]
test di, 0x7492
jmp 0x161c1a8
ret
je 0x170b5df
mov eax, dword [edx + ecx + 0x20]
cmp edi, 0x1f453ee2
lea eax, [eax + ecx]
stc
sub ebx, ebx
jmp 0x279b3aa
mov edi, dword [edx + ecx + 0x18]
test edi, edi
jmp 0x16e431d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
bsf dx, sp
mov edx, dword [ecx + eax + 0x24]
btc cx, 0xe4
add cl, 0xff
lea ecx, [edx + esi*2]
sbb edx, 0x48ef6a92
neg dx
cwd
movzx edx, word [ecx + eax]
btc cx, bx
inc cx
mov dword [ebp - 8], edx
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
cmc
cmp ebp, esp
cmp eax, dword [edx + ecx + 0x14]
jmp 0x26fd1ee
mov dword [ebp - 8], eax
jmp 0x27b405d
jae 0x26cf8f4
mov esi, dword [edx + ecx + 0x1c]
stc
lea eax, [esi + eax*4]
stc
mov eax, dword [eax + ecx]
jmp 0x27421a6
test eax, eax
jmp 0x276f85b
call fcn.0277fd20
add esp, 4
test eax, eax
jmp 0x274fee1
jns 0x162b1fb
lea edi, [esi - 1]
jmp 0x1661594
mov dword [ebp - 0xc], eax
jmp 0x163eeb6
je 0x27d92b1
mov eax, 0x5a4d
cmp word [ecx], ax
jmp 0x27d92ab
mov esp, ebp
xchg bp, bp
movsx ebp, sp
pop ebp
jmp 0x16d25df
dec edi
jmp 0x276bb16
jmp 0x170b5df
je 0x27d92b1
mov esi, dword [ebp + 0xc]
stc
test esi, esi
jmp 0x2778ac1
je 0x16a5b0c
xor eax, eax
not esi
pop esi
jmp 0x277a50f
Function at 0x106f1058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x106f11a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x106f107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106f106a
add dl, dl
jne 0x106f1089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106f10dc
xor eax, eax
add dl, dl
jne 0x106f1096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106f117d
add dl, dl
jne 0x106f10a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106f10b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106f10bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106f10c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106f10d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x106f1075
mov eax, 1
add dl, dl
jne 0x106f10ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106f10f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106f10e1
sub eax, ebx
mov ebx, 1
jne 0x106f1128
mov ecx, 1
add dl, dl
jne 0x106f110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106f1119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106f1105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106f1075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x106f113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106f114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106f1136
cmp eax, 0x7d00
jae 0x106f116d
cmp eax, 0x500
jb 0x106f1168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106f1075
cmp eax, 0x7f
ja 0x106f1170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106f1075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x106f119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x106f1075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403c1b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x403c26
xor eax, eax
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 8]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x403cde
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x680330]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x680330]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x680330]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x680330]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x680330]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x680330]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x680330]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x680330]
dec edi
jne 0x403c41
pop edi
test esi, esi
je 0x403cf7
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x680330]
inc edx
dec esi
jne 0x403ce2
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
Function at 0x40484f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x7c
mov eax, 0x63606b
call fcn.00611c5e
mov esi, ecx
sub esp, 0x18
mov dword [ebp - 0x39], 0x74746553
lea eax, [ebp - 0x24]
mov dword [ebp - 0x88], esp
xor ebx, ebx
mov word [ebp - 0x46], 0x6f69
mov ecx, esp
mov word [ebp - 0x4d], 0x6e65
push eax
mov word [ebp - 0x57], 0x646e
mov dword [ebp - 0x4a], 0x73726556
mov dword [ebp - 0x43], 0x746e495c
mov word [ebp - 0x67], 0x7261
mov dword [ebp - 0x3f], 0x656e7265
mov word [ebp - 0x54], 0x7377
mov dword [ebp - 0x35], 0x73676e69
mov dword [ebp - 0x6c], 0x74666f53
mov dword [ebp - 0x51], 0x72727543
mov byte [ebp - 0x68], 0x77
mov dword [ebp - 0x5b], 0x69575c74
mov dword [ebp - 0x64], 0x63694d5c
mov word [ebp - 0x3b], 0x2074
mov dword [ebp - 0x5f], 0x666f736f
mov byte [ebp - 0x55], 0x6f
mov byte [ebp - 0x4b], 0x74
mov byte [ebp - 0x44], 0x6e
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x60], 0x72
mov byte [ebp - 0x52], 0x5c
mov byte [ebp - 0x65], 0x65
mov dword [ebp - 0x24], 0x786f7250
mov word [ebp - 0x1e], 0x616e
mov word [ebp - 0x1b], 0x656c
mov word [ebp - 0x20], 0x4579
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x1c], 0x62
mov dword [ebp - 0x2a], 0x65767265
mov dword [ebp - 0x2f], 0x79786f72
mov byte [ebp - 0x2b], 0x53
mov word [ebp - 0x26], 0x72
mov byte [ebp - 0x30], 0x50
call fcn.0040d5ca
sub esp, 0x18
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
mov ecx, esp
push eax
call fcn.0040d5ca
or dword [ebp - 4], 0xffffffff
call fcn.00404a43
cmp eax, 1
lea eax, [ebp - 0x30]
sete bl
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.0040d5ca
sub esp, 0x18
mov dword [ebp - 4], 1
lea eax, [ebp - 0x6c]
mov ecx, esp
push eax
call fcn.0040d5ca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.00404ace
lea eax, [ebp - 0x18]
mov word [ebp - 0x14], 0x3d
push eax
mov word [ebp - 0x17], 0x7474
mov byte [ebp - 0x15], 0x70
mov byte [ebp - 0x18], 0x68
call fcn.0040d5ad
add esp, 0x34
push eax
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.0040d604
cmp eax, 0xffffffff
mov dword [ebp - 0x15], 0x3d7370
lea eax, [ebp - 0x18]
mov word [ebp - 0x18], 0x7468
push eax
mov byte [ebp - 0x16], 0x74
setne bh
call fcn.0040d5ad
pop ecx
push eax
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.0040d604
cmp eax, 0xffffffff
setne cl
test bl, bl
je 0x404a1d
test bh, bh
jne 0x404a15
test cl, cl
jne 0x404a15
push 0
push 1
lea ecx, [ebp - 0x84]
call fcn.0040c64e
mov al, 1
jmp 0x404a30
test esi, esi
jne 0x404a36
test bh, bh
jne 0x404a02
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x84]
call fcn.0040c64e
mov al, bl
call fcn.00611c0d
ret
cmp esi, 1
jne 0x404a1d
test cl, cl
je 0x404a1d
mov bl, 1
jmp 0x404a1f
Function at 0x4058a6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x40
mov eax, 0x634631
call fcn.00611c5e
mov edi, ecx
call fcn.004f5dba
push eax
lea ecx, [ebp - 0x48]
call fcn.0040d74c
mov eax, 0x400
lea ecx, [ebp - 0x48]
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x18], 0x6e65704f
mov byte [ebp - 0x14], bl
call fcn.0040da31
push 0x400
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.0040da83
lea eax, [ebp - 0x4c]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0062dcf7
add esp, 0x10
lea ecx, [ebp - 0x48]
push 0xffffffffffffffff
call fcn.0040d716
lea ecx, [ebp - 0x48]
call fcn.0041b07d
push ebx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x37], 0x46455249
push eax
lea ecx, [ebp - 0x48]
mov word [ebp - 0x32], 0x58
mov byte [ebp - 0x38], 0x46
mov byte [ebp - 0x33], 0x4f
call fcn.0041b046
test eax, eax
js 0x405942
push 2
jmp 0x4059e1
push ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1d], 0x454c47
push eax
lea ecx, [ebp - 0x48]
mov word [ebp - 0x1f], 0x4f4f
mov byte [ebp - 0x20], 0x47
call fcn.0041b046
test eax, eax
js 0x405990
push ebx
lea eax, [ebp - 0x28]
mov word [ebp - 0x25], 0x4d4f
push eax
lea ecx, [ebp - 0x48]
mov word [ebp - 0x28], 0x4843
mov byte [ebp - 0x26], 0x52
mov word [ebp - 0x23], 0x45
call fcn.0041b046
test eax, eax
js 0x405990
xor ebx, ebx
inc ebx
jmp 0x4059e2
push ebx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x40], 0x45524f4c
push eax
lea ecx, [ebp - 0x48]
mov word [ebp - 0x43], 0x5845
mov byte [ebp - 0x41], 0x50
mov byte [ebp - 0x3c], bl
mov byte [ebp - 0x44], 0x49
call fcn.0041b046
test eax, eax
js 0x4059bd
push 3
jmp 0x4059e1
push ebx
lea eax, [ebp - 0x30]
mov word [ebp - 0x2b], 0x45
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 0x4445534d
mov byte [ebp - 0x2c], 0x47
call fcn.0041b046
test eax, eax
js 0x4059e2
push 4
pop ebx
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0040d912
mov eax, ebx
call fcn.00611c0d
ret
Function at 0x4059f5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x48
mov eax, 0x634d80
call fcn.00611c5e
mov dword [ebp - 0x54], edx
mov bh, cl
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
push eax
push esi
push ecx
mov dword [ebp - 0x44], eax
mov ecx, esp
lea eax, [ebp - 0x28]
mov word [ebp - 0x23], 0x2065
push eax
mov dword [ebp - 0x28], 0x676f6f47
mov word [ebp - 0x1c], 0x65
mov dword [ebp - 0x21], 0x6f726843
mov byte [ebp - 0x24], 0x6c
mov byte [ebp - 0x1d], 0x6d
call fcn.0040db5c
xor dl, dl
xor cl, cl
call fcn.00408e27
mov bl, al
mov dword [edi], 1
add esp, 0xc
test bl, bl
jne 0x405aaa
push dword [ebp - 0x44]
lea eax, [ebp - 0x28]
push esi
push ecx
mov ecx, esp
push eax
call fcn.0040db5c
mov dl, 1
xor cl, cl
call fcn.00408e27
mov bl, al
mov dword [edi], 2
add esp, 0xc
test bl, bl
jne 0x405aaa
test bh, bh
je 0x405aaa
push dword [ebp - 0x44]
lea eax, [ebp - 0x28]
push esi
push ecx
mov ecx, esp
push eax
call fcn.0040db5c
xor dl, dl
mov cl, 1
call fcn.00408e27
add esp, 0xc
mov dword [edi], 3
mov bl, al
mov dword [ebp - 0x18], 0x6f726843
mov word [ebp - 0x13], 0x65
mov byte [ebp - 0x14], 0x6d
test bl, bl
jne 0x405b53
push dword [ebp - 0x44]
lea eax, [ebp - 0x18]
push esi
push ecx
mov ecx, esp
push eax
call fcn.0040db5c
xor dl, dl
xor cl, cl
call fcn.00408e27
mov bl, al
mov dword [edi], 4
add esp, 0xc
test bl, bl
jne 0x405b53
push dword [ebp - 0x44]
lea eax, [ebp - 0x18]
push esi
push ecx
mov ecx, esp
push eax
call fcn.0040db5c
mov dl, 1
xor cl, cl
call fcn.00408e27
mov bl, al
mov dword [edi], 5
add esp, 0xc
test bl, bl
jne 0x405b53
test bh, bh
je 0x405b3f
push dword [ebp - 0x44]
lea eax, [ebp - 0x18]
push esi
push ecx
mov ecx, esp
push eax
call fcn.0040db5c
xor dl, dl
mov cl, 1
call fcn.00408e27
mov bl, al
mov dword [edi], 6
add esp, 0xc
test bl, bl
jne 0x405b53
mov edx, edi
mov ecx, esi
call fcn.00630228
mov bl, al
test bl, bl
jne 0x405b53
and dword [edi], 0
jmp 0x405bc3
mov edi, dword [ebp - 0x44]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x405b9f
mov edx, dword [esi]
lea ecx, [ebp - 0x40]
call fcn.00409110
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
mov word [ebp - 0x4b], 0x73
cmovae eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x4c]
mov byte [ebp - 0x4c], 0x25
push eax
push edi
call fcn.0041aabc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
add esp, 0xc
push 0
push 1
call fcn.0040c64e
mov ecx, dword [esi]
lea edx, [ebp - 0x50]
and dword [ebp - 0x50], 0
call fcn.0040a3f1
test eax, eax
je 0x405bbc
cmp dword [ebp - 0x50], 6
jne 0x405bbc
xor eax, eax
inc eax
jmp 0x405bbe
xor eax, eax
mov ecx, dword [ebp - 0x54]
mov byte [ecx], al
mov al, bl
call fcn.00611c0d
ret

Function at 0x405bcb
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 4]
mov dword [esi], 0x682618
push eax
call fcn.006125f0
and dword [esi + 0x48], 0
add esp, 0xc
and dword [esi + 0x44], 0
mov eax, esi
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
pop esi
ret