joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401138
Capabilities:
Packed with generic packer

Disassembly:
push ebx
add esp, 0xffffffbc
mov ebx, 0xa
push esp
call sub.kernel32.dll_GetStartupInfoA
test byte [esp + 0x2c], 1
je fcn.00401153
jmp loc.004188d3

Function at 0x40119c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, 0x40f5cc
cmp dword [esi], 0
jne 0x4011e2
push 0x644
push 0
call sub.kernel32.dll_LocalAlloc
mov ecx, eax
test ecx, ecx
jne 0x4011bf
xor eax, eax
pop esi
pop ebx
ret
jmp loc.004176e5
mov eax, dword [esi]
mov edx, dword [eax]
mov dword [esi], edx
pop esi
pop ebx
ret

Function at 0x4012b0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
mov edi, ebx
mov esi, dword [edx]
mov eax, dword [ebx + 8]
cmp esi, eax
jb 0x401330
mov ecx, esi
add ecx, dword [edx + 4]
jmp loc.00417480
mov ebx, dword [ebx]
cmp edi, ebx
jne 0x4012bb
xor eax, eax
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4015e8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov edi, eax
mov ebp, 0x40f5e0
add edi, 0x3fff
jmp loc.00418891

Function at 0x401a60
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ecx, edx
sub ecx, 4
lea ebx, [ecx + eax]
cmp edx, 0x10
jl 0x401a7d
mov dword [ebx], 0x80000007
mov edx, ecx
call fcn.00401c34
pop ebx
ret
cmp edx, 4
jl 0x401a8e
mov ecx, edx
jmp loc.00418666
pop ebx
ret

Function at 0x401ab4
Capabilities:
Packed with generic packer

Disassembly:
cmp edx, 0xc
jl 0x401ac7
or edx, 2
mov dword [eax], edx
add eax, 4
call fcn.00401a90
ret
cmp edx, 4
jl 0x401ad6
mov ecx, edx
or ecx, 0x80000002
mov dword [eax], ecx
jmp loc.00419128

Function at 0x401b4c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
xor edi, edi
mov eax, dword [ebx]
test eax, 0x80000000
je 0x401b67
and eax, 0x7ffffffc
add edi, eax
add ebx, eax
mov eax, dword [ebx]
test al, 2
jne 0x401b7e
mov esi, ebx
mov eax, esi
call fcn.004019cc
mov eax, dword [esi + 8]
add edi, eax
jmp 0x419ee5
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x401df4
Capabilities:
Packed with generic packer

Disassembly:
xor edx, edx
test eax, eax
jns 0x401dfd
add eax, 3
sar eax, 2
cmp eax, 0x400
jg 0x401e1d
jmp 0x4173f2
mov eax, edx
ret

Function at 0x4024fc
Capabilities:
Packed with generic packer

Disassembly:
push ebx
test eax, eax
je 0x402516
jmp loc.0041c146
xor ebx, ebx
mov eax, ebx
pop ebx
ret

Function at 0x4025c4
Capabilities:
Packed with generic packer

Disassembly:
and eax, 0x7f
mov edx, dword [esp]
jmp loc.0041dbbf

Function at 0x402738
Capabilities:
Accept command line arguments
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403d80
test esi, esi
jne 0x40276e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403e70
jmp 0x40278c
jmp loc.0041b86f
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x4027d4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov ax, word [ebx + 4]
cmp ax, 0xd7b0
jb 0x4027ea
cmp ax, 0xd7b3
jbe 0x4027f1
mov ebx, 0x66
jmp 0x40281c
cmp ax, 0xd7b0
je 0x4027fe
mov eax, ebx
call fcn.00402c18
mov word [ebx + 4], si
cmp byte [ebx + 0x48], 0
jne 0x402815
cmp dword [ebx + 0x18], 0
jne 0x402815
jmp 0x418b4f
mov eax, ebx
call dword [ebx + 0x18]
mov ebx, eax
test ebx, ebx
je 0x402827
mov eax, ebx
call fcn.004025f0
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x402cf4
Capabilities:
Packed with generic packer

Disassembly:
push edi
mov edi, eax
mov ch, cl
jmp loc.0041c57f

Function at 0x402d14
Capabilities:
Generate random numbers using the delphi lcg
Packed with generic packer

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x40e008], 0x8088405
inc edx
jmp loc.0041dec0

Function at 0x402e58
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, edx
call fcn.00403d80
sub esp, 0x100
mov eax, ebx
mov edx, esp
mov ecx, 0xff
call fcn.00402e4c
mov eax, esi
mov edx, esp
call fcn.00403ee0
cmp byte [esp], 0xff
jne 0x402eb9
mov eax, ebx
mov edx, esp
mov ecx, 0xff
call fcn.00402e4c
mov edx, esp
push 0
mov eax, esp
jmp loc.0041b510
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x403078
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, edx
xor edx, edx
jmp loc.0041c7a1

Function at 0x403084
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push eax
test eax, eax
je 0x4030fa
xor eax, eax
xor ebx, ebx
jmp loc.00418d0e
inc esi
jmp 0x403103
pop ebx
sub esi, ebx
jmp 0x403149
mov dword [edx], esi
pop edi
pop esi
pop ebx
ret

Function at 0x4032e4
Capabilities:
Packed with generic packer
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40e010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40337c
jmp loc.0041dfbe

Function at 0x4033ec
Capabilities:
Packed with generic packer

Disassembly:
test dl, dl
je 0x4033f8
add esp, 0xfffffff0
call fcn.0040350c
test dl, dl
je 0x40340b
jmp 0x41bd64
ret

Function at 0x40341c
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je fcn.00403427
mov dl, 1
jmp loc.00418088

Function at 0x40350c
Capabilities:
Packed with generic packer

Disassembly:
push edx
push ecx
push ebx
test dl, dl
jl 0x403516
call dword [eax - 0xc]
jmp loc.0041b0f1

Function at 0x403564
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
jmp loc.0041d4fa

Function at 0x4035dc
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [0x40e014], 1
jbe 0x4035ec
push eax
push ebx
jmp loc.0041dbd5
ret

Function at 0x403610
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [0x40e014], 1
jbe 0x403636
push eax
push edx
push ecx
call fcn.004035f0
push ecx
push esp
push 1
push 0
push 0xeedfae1
jmp loc.0041c259
ret

Function at 0x403654
Capabilities:
Packed with generic packer

Disassembly:
push eax
push edx
cmp byte [0x40e014], 1
jbe fcn.0040366f
push esp
push 2
push 0
push 0xeedfae3
jmp loc.0041977e
Function at 0x403b88
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40f034], 0
je 0x403be9
jmp loc.0041a330
cmp byte [0x40e01c], 0
jne 0x403c05
push 0
push 0x40e094
push 0x40e074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403cf8
Capabilities:
Packed with generic packer

Disassembly:
pop dword [0x40e004]
jmp loc.0041db29

Function at 0x403d3c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004024dc
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x40f035], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403d04
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x403da4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov edx, dword [ebx]
test edx, edx
je 0x403dca
jmp loc.0041a59c
add ebx, 4
dec esi
jne 0x403daa
pop esi
pop ebx
ret

Function at 0x4041e4
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je 0x40423e
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov edx, dword [edx]
push edx
test edx, edx
je 0x4041fc
mov edx, dword [edx - 4]
dec edi
jge 0x404201
xor edi, edi
cmp edi, edx
jle 0x404207
mov edi, edx
jmp 0x41e17d
ret

Function at 0x404314
Capabilities:
Packed with generic packer

Disassembly:
mov edx, dword [eax]
test edx, edx
je 0x404328
jmp 0x41cefe
ret

Function at 0x404350
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
push ebx
mov cl, byte [edx + 1]
push esi
push edi
mov ebx, eax
lea esi, [ecx + edx + 0xa]
mov edi, dword [ecx + edx + 6]
jmp loc.0041d3da

Function at 0x40458c
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4045c5
jmp loc.0041d000
ret

Function at 0x404634
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x404698
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004045c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40469f
mov eax, dword [ebp - 4]
cmp eax, dword [0x40e024]
jne 0x404678
jmp loc.004183b2
mov eax, dword [0x40e024]
test eax, eax
je 0x404697
mov edx, dword [eax]
cmp edx, dword [ebp - 4]
jne 0x404691
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov dword [eax], edx
jmp 0x404697
mov eax, dword [eax]
test eax, eax
jne 0x404681
ret

Function at 0x4047b8
Capabilities:
Set thread local storage value

Disassembly:
push ebx
call fcn.004047b0
mov ebx, eax
test ebx, ebx
je fcn.004047fa
jmp loc.0041d244

Function at 0x4047fc
Capabilities:
Get thread local storage value

Disassembly:
mov cl, byte [0x40f6f4]
jmp loc.0041c287

Function at 0x404a54
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
mov dword [esp], edx
mov byte [esp + 4], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
jmp loc.00418e53
Function at 0x404e1c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004040ec
xor eax, eax
push ebp
push 0x404efe
jmp loc.0041d741

Function at 0x404f48
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
xor ebx, ebx
mov dword [ebp - 0x1d8], ebx
jmp loc.00418f7f

Function at 0x40538c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
jmp loc.00419ca0

Function at 0x405494
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x405508
push dword fs:[eax]
mov dword fs:[eax], esp
jmp loc.0041d1d0

Function at 0x40650c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
cmp eax, 0xffffffff
je fcn.00406524
push eax
call sub.kernel32.dll_FindClose
jmp loc.004196b8

Function at 0x406528
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
mov edi, eax
not edx
and edx, 0x1e
mov dword [ebx + 0x10], edx
lea eax, [ebx + 0x18]
push eax
mov eax, edi
call fcn.004040fc
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
mov dword [ebx + 0x14], esi
cmp esi, 0xffffffff
je 0x406568
mov eax, ebx
call fcn.004064a8
mov esi, eax
test esi, esi
je 0x40656f
mov eax, ebx
call fcn.0040650c
jmp 0x40656f
jmp 0x41bdea
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x406578
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
je 0x406595
mov eax, ebx
call fcn.004064a8
pop ebx
ret
jmp loc.0041984a

Function at 0x40659c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004040ec
xor eax, eax
push ebp
push 0x4065f2
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov edx, dword [ebp - 4]
mov eax, 0x406608
call fcn.00404240
mov ecx, eax
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 4]
jmp loc.0041a72c

Function at 0x40670c
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004040ec
xor eax, eax
push ebp
push 0x406853
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403d80
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x40681e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004040fc
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jmp loc.0041b6f0

Function at 0x406a10
Capabilities:
Packed with generic packer

Disassembly:
push ebx
add esp, 0xfffffec0
mov ebx, eax
push esp
mov eax, ebx
jmp loc.00417085
Function at 0x406b00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
jmp loc.0041b36b

Function at 0x406b5c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004040fc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x406b75
test al, 0x10
jne 0x406b79
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x406b80
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406c59
jmp loc.0041a88c

Function at 0x40747c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
jmp loc.0041b05a

Function at 0x407c9c
Capabilities:
Act as tcp client
Connect tcp socket
Connect udp socket
Initialize winsock library
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
jmp loc.00419c62

Function at 0x40d8c9
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 8]
jmp loc.0041c7c1

Function at 0x41981e
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0x1c
push 0x40e040
mov edi, 0x94
push edi
push 0
mov ebx, dword [0x40c050]
push eax
add esp, 0x14
leave
popal
popfd
call fcn.004047fc
jmp loc.00403831

Function at 0x419be6
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
mov dword [eax + 4], 0x403823
jmp loc.004037e3
Function at 0x521790
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x521860
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x521860
mov ebp, dword [esp + 0x28]
mov esi, 0x1505
test ebp, ebp
je 0x5217dd
xor edi, edi
nop
movzx ecx, byte [ebx + edi]
test ecx, ecx
je 0x5217dd
mov edx, esi
shl edx, 5
add edx, esi
mov esi, edx
and esi, ecx
xor edx, ecx
lea esi, [edx + esi*2]
inc edi
cmp ebp, edi
jne 0x5217c0
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edi, [ebx - 1]
mov edx, ebx
sub edx, 1
mov dword [esp + 8], edx
jb 0x521860
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x521804
inc edi
dec ebx
je 0x52185e
mov eax, edi
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x52185e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x521800
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.005291a0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x521800
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.005291c0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x521800
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x521860
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5299b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x529a3e
xor eax, eax
mov edx, 0x80000000
nop
nop
nop
nop
nop
nop
nop
nop
lea esi, [eax + 0x270]
mov edi, esi
not edi
and edi, 0x270
and esi, 0x58f
sub esi, edi
mov edi, dword [ecx + esi*4 + 8]
lea ebp, [edi - 0x80000000]
mov ebx, edi
or ebx, 0x7ffffffe
and ebx, ebp
mov ebp, dword [ecx + esi*4 + 4]
and ebp, edx
or ebx, ebp
mov ebp, esi
and ebp, 0x18d
xor esi, 0x18d
lea esi, [esi + ebp*2]
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + esi*4 + 4]
shr ebx, 1
xor edi, ebx
mov dword [ecx + eax*4 + 0x9c4], edi
inc eax
cmp eax, 0x270
jne 0x5299d0
mov eax, 0x270
jmp 0x529a50
cmp eax, 0x4e0
jb 0x529a50
mov esi, ecx
call fcn.00529aa0
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov edx, dword [ecx + eax*4 + 4]
mov eax, edx
shr eax, 0xb
and eax, dword [ecx + 0x1384]
xor eax, edx
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
mov edx, ecx
and edx, eax
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
shl edx, 0xf
and edx, 0xefc60000
xor edx, ecx
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x529aa0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
xor eax, eax
mov edx, 0x80000000
nop
nop
nop
nop
nop
mov edi, eax
and edi, 0x70
mov esi, eax
or esi, 0x270
add esi, edi
mov ebp, dword [ecx + esi*4 + 4]
and ebp, edx
mov edi, dword [ecx + esi*4 + 8]
mov ebx, edi
and ebx, 0x7ffffffe
or ebx, ebp
shr ebx, 1
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + esi*4 + 0x638]
xor edi, ebx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0x529ab0
mov esi, dword [ecx + 0xd50]
mov eax, 0x355
and esi, 0x80000000
mov edi, dword [ecx + eax*4]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 - 0xd50]
xor edi, edx
mov dword [ecx + eax*4 - 0x9c4], edi
inc eax
cmp eax, 0x4e1
jne 0x529b00
mov edx, 0x80000000
and edx, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov esi, eax
and esi, 0x7fffffff
or edx, esi
shr edx, 1
xor eax, 0x7ffffffe
and eax, esi
je 0x529b62
mov eax, 0x9908b0df
mov esi, eax
and esi, edx
add eax, edx
add esi, esi
sub eax, esi
xor eax, dword [ecx + 0x634]
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x52ac00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
push eax
sub esp, 8
mov dword [ebp - 0x14], esp
sub esp, 0x40
mov dword [ebp - 0x1c], esp
sub esp, 0x80
mov dword [ebp - 0x20], esp
mov eax, dword [0x569d3c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x234], 0xc1c6cfc4
mov word [ebp - 0x230], 0
xor ecx, ecx
nop
mov edx, ecx
not edx
movzx esi, byte [ebp + ecx - 0x234]
lea ebx, [ecx + 0xd1]
mov edi, 0x2e
sub edi, ecx
xor ebx, edi
and ebx, esi
xor ebx, edi
mov al, 0xea
sub al, bl
mov byte [ebp + ecx - 0x234], al
and edx, 6
mov eax, ecx
and eax, 1
xor ecx, 0xfffffffe
or ecx, edx
not ecx
lea ecx, [ecx + eax*2]
cmp ecx, 6
jb 0x52ac40
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 0x1b4], 0x63f161f7
mov dword [ebp - 0x1b0], 0x67c965b6
mov dword [ebp - 0x1ac], 0x5b88598b
mov dword [ebp - 0x1a8], 0x5ffa5d82
mov dword [ebp - 0x1a4], 0x53ce51cc
mov word [ebp - 0x1a0], 0x5554
mov dword [ebp - 0x19e], 0
mov byte [ebp - 0x19a], 0
mov edx, 0x5bcc3c98
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ebp + edx - 0x5bcc3e4c]
xor ebx, edx
mov esi, ebx
and esi, 5
mov eax, ebx
and eax, 2
mov edi, eax
xor edi, 2
imul edi, esi
or esi, 2
imul esi, eax
xor ebx, 7
add ebx, edi
add ebx, esi
inc bl
mov byte [ebp + edx - 0x5bcc3e4c], bl
inc edx
cmp edx, 0x5bcc3cb3
jne 0x52ace0
lea esi, [ebp - 0x1b4]
push ecx
push 0
push esi
call dword [ebp - 0x10]
mov ecx, 0x569d40
push eax
call 0x55a5b0
movzx eax, al
mov eax, dword [eax*4 + 0x563958]
mov ecx, 0x7bbfa073
xor ecx, dword [0x563960]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax
Function at 0x52d230
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x21c
push eax
sub esp, 0x2c
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x28], esp
mov eax, dword [0x569d0c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x228], 0x61176733
mov dword [ebp - 0x224], 0x7d1963ea
mov dword [ebp - 0x220], 0x790a7f08
mov dword [ebp - 0x21c], 0x754b7b1b
mov dword [ebp - 0x218], 0x7140773b
mov dword [ebp - 0x214], 0x8d527340
mov dword [ebp - 0x210], 0x89e78fb4
mov dword [ebp - 0x20c], 0x85fc8bf3
mov dword [ebp - 0x208], 0x81f787f8
mov dword [ebp - 0x204], 0x9d0f8309
mov dword [ebp - 0x200], 0x99c89fbc
mov dword [ebp - 0x1fc], 0x95ba9bf4
mov dword [ebp - 0x1f8], 0x91a697a7
mov dword [ebp - 0x1f4], 0xada293a6
mov dword [ebp - 0x1f0], 0xa98eafe9
mov dword [ebp - 0x1ec], 0xa5d1abc1
mov dword [ebp - 0x1e8], 0xa1e8a7d2
mov dword [ebp - 0x1e4], 0xbde7a3ec
mov dword [ebp - 0x1e0], 0xb936bf9c
mov dword [ebp - 0x1dc], 0xb5f6bbf6
mov dword [ebp - 0x1d8], 0xb196b78f
mov dword [ebp - 0x1d4], 0xcdc2b3f3
mov dword [ebp - 0x1d0], 0xc9bacfbc
mov dword [ebp - 0x1cc], 0xc5a3cbb7
mov dword [ebp - 0x1c8], 0xc1a4c7bb
mov dword [ebp - 0x1c4], 0xddb9c395
mov dword [ebp - 0x1c0], 0xd9efdf50
mov dword [ebp - 0x1bc], 0xd597db97
mov dword [ebp - 0x1b8], 0xd1e0d79d
mov dword [ebp - 0x1b4], 0xed9cd39d
mov dword [ebp - 0x1b0], 0xe9d6efcc
mov dword [ebp - 0x1ac], 0xe5b2ebbd
mov dword [ebp - 0x1a8], 0xe1b1e788
mov dword [ebp - 0x1a4], 0xfdd6e3b4
mov dword [ebp - 0x1a0], 0xf98affdc
mov dword [ebp - 0x19c], 0xf58ffb83
mov dword [ebp - 0x198], 0xf1d6f78b
mov dword [ebp - 0x194], 0xd8df3a9
mov dword [ebp - 0x190], 0x97b0f71
mov dword [ebp - 0x18c], 0x5310b79
mov dword [ebp - 0x188], 0x15b0724
mov dword [ebp - 0x184], 0x1d700378
mov dword [ebp - 0x180], 0x19691f6d
mov dword [ebp - 0x17c], 0x152b1b67
mov dword [ebp - 0x178], 0x11251727
mov dword [ebp - 0x174], 0x2d24135b
mov dword [ebp - 0x170], 0x29182f1c
mov dword [ebp - 0x16c], 0x251c2b18
mov dword [ebp - 0x168], 0x21062714
mov dword [ebp - 0x164], 0x3d41234d
mov dword [ebp - 0x160], 0x395d3f42
mov dword [ebp - 0x15c], 0x35413b4a
mov dword [ebp - 0x158], 0x31793705
mov dword [ebp - 0x154], 0x4d7b337d
mov dword [ebp - 0x150], 0x49034f7a
mov dword [ebp - 0x14c], 0x454a4b06
mov dword [ebp - 0x148], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebp + edx - 0x228]
mov edi, ecx
and edi, 0xd2
mov ebx, edx
xor ebx, 0xaae8d269
add ebx, edi
mov edi, ebx
and edi, esi
add edi, edi
sub ebx, edi
add ebx, esi
mov esi, ebx
and esi, 0xf0
mov eax, ebx
and eax, 2
mov edi, eax
xor edi, 2
imul edi, esi
or esi, 2
imul esi, eax
xor ebx, 0xf2
add ebx, edi
add ebx, esi
inc bl
mov byte [ebp + edx - 0x228], bl
inc edx
add ecx, 2
cmp edx, 0xe4
jne 0x52d4a0
lea eax, [ebp - 0x228]
push 0
push 0
push 0
push 0
push eax
call dword [ebp - 0x14]
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov eax, dword [eax*4 + 0x563eb4]
mov ecx, dword [0x563ebc]
mov edx, ecx
and edx, 0xe81a69fd
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0x97e59603
xor ebx, ebx
jmp eax