joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421a10
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x445420
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4541b0]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4541b0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
mov edi, ecx
xor ebp, ebp
push eax
lea ecx, [esp + 0x5c]
mov dword [esp + 0x1c], 5
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], 0x19
call fcn.0041d6b0
mov dword [esp + 0x80], ebp
push 0x3e
mov ebx, 7
push 0x44b988
lea esi, [esp + 0x44]
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x58], ebp
mov word [esp + 0x48], bp
call fcn.00402690
push ebp
push edi
or eax, 0xffffffff
mov byte [esp + 0x88], 1
call fcn.0040b070
lea ecx, [esp + 0x58]
push ecx
mov edx, 0x44ba08
lea edi, [esp + 0x1c]
call fcn.0040b3e0
add esp, 4
push ebp
push eax
or eax, 0xffffffff
mov byte [esp + 0x88], 2
call fcn.0040b070
mov edi, 8
mov byte [esp + 0x80], 1
cmp dword [esp + 0x30], edi
jb 0x421aef
mov edx, dword [esp + 0x1c]
push edx
call fcn.00430a06
add esp, 4
push ebp
call dword [0x4483f4]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push 0xffffffffffffffff
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x14], ebp
push ebp
lea eax, [esp + 0x60]
mov word [ecx + 4], bp
call fcn.004025a0
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x70], esp
mov byte [esp + 0xb8], 3
push 0x11
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push 0x44ba1c
mov word [esi + 4], bp
call fcn.00402690
mov byte [esp + 0xb8], 1
call fcn.00423920
add esp, 0x38
cmp dword [esp + 0x54], edi
jb 0x421b5f
mov eax, dword [esp + 0x40]
push eax
call fcn.00430a06
add esp, 4
cmp dword [esp + 0x70], edi
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], ebp
mov word [esp + 0x40], bp
jb 0x421b7f
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.00430a06
add esp, 4
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00431099
add esp, 0x70
ret
Function at 0x423920
Capabilities:
Check http status code

Disassembly:
sub esp, 0x814
mov eax, dword [0x4541b0]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
push ebp
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call dword [0x4483d0]
mov ebx, eax
cmp ebx, esi
jne 0x4239a5
mov ebp, 8
cmp dword [esp + 0x840], ebp
jb 0x423969
mov eax, dword [esp + 0x82c]
push eax
call fcn.00430a06
add esp, 4
cmp dword [esp + 0x85c], ebp
mov dword [esp + 0x840], 7
mov dword [esp + 0x83c], esi
mov word [esp + 0x82c], si
jb 0x423b31
mov ecx, dword [esp + 0x848]
push ecx
call fcn.00430a06
add esp, 4
jmp 0x423b31
push 4
lea edx, [esp + 0x18]
push edx
push 2
push ebx
mov dword [esp + 0x24], 0x7d0
call dword [0x4483cc]
mov eax, dword [esp + 0x82c]
mov ebp, 8
cmp dword [esp + 0x840], ebp
jae 0x4239d9
lea eax, [esp + 0x82c]
push esi
push esi
push 3
push esi
push esi
push 0x50
push eax
push ebx
call dword [0x4483ec]
mov edi, eax
cmp edi, esi
jne 0x4239fb
push ebx
call dword [0x4483bc]
jmp 0x423950
cmp dword [esp + 0x85c], ebp
mov eax, dword [esp + 0x848]
jae 0x423a12
lea eax, [esp + 0x848]
push esi
push 0x4280000
push esi
push esi
push 0x44bd3c
push eax
push 0x44bd50
push edi
call dword [0x4483d8]
mov esi, eax
test esi, esi
jne 0x423a95
mov esi, dword [0x4483bc]
push edi
call esi
push ebx
call esi
cmp dword [esp + 0x840], ebp
jb 0x423a57
mov edx, dword [esp + 0x82c]
push edx
call fcn.00430a06
add esp, 4
xor eax, eax
cmp dword [esp + 0x85c], ebp
mov dword [esp + 0x840], 7
mov dword [esp + 0x83c], eax
mov word [esp + 0x82c], ax
jb 0x423b31
mov eax, dword [esp + 0x848]
push eax
call fcn.00430a06
add esp, 4
jmp 0x423b31
push 0
push 0
push 0
push 0
push esi
call dword [0x4483c8]
push 0x7fe
lea ecx, [esp + 0x1e]
push 0
push ecx
mov word [esp + 0x24], 0
call fcn.00432700
add esp, 0xc
push 0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push 0x13
push esi
mov dword [esp + 0x24], 0x400
call dword [0x4483e8]
push edi
mov edi, dword [0x4483bc]
call edi
push ebx
call edi
lea eax, [esp + 0x18]
call fcn.0042cf21
cmp eax, 0xc8
push esi
jne 0x423b17
call edi
lea ecx, [esp + 0x828]
call fcn.00402540
lea ecx, [esp + 0x844]
call fcn.00402540
mov al, 1
jmp 0x423b33
call edi
lea ecx, [esp + 0x828]
call fcn.00402540
lea ecx, [esp + 0x844]
call fcn.00402540
xor al, al
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00431099
add esp, 0x814
ret
Function at 0x426450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x445846
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x4541b0]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4541b0]
xor eax, esp
push eax
lea eax, [esp + 0xa4]
mov dword fs:[0], eax
mov eax, dword [esp + 0xb4]
lea ebp, [eax + 0x78]
push ebp
call fcn.0042e76d
add esp, 4
test al, al
je 0x426649
lea esi, [esp + 0x54]
call fcn.0042e58f
xor edi, edi
lea esi, [esp + 0x18]
mov dword [esp + 0xac], edi
call fcn.0042ea92
mov byte [esp + 0xac], 1
push 5
push 0x44c214
lea esi, [esp + 0x24]
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], edi
mov word [esp + 0x28], di
call fcn.00402690
mov eax, esi
push eax
mov bl, 2
push ebp
lea edi, [esp + 0x40]
mov byte [esp + 0xb4], bl
call fcn.0040b330
add esp, 8
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x58]
mov ecx, eax
mov byte [esp + 0xb0], 3
call fcn.0042eac2
mov byte [esp + 0xac], bl
cmp dword [esp + 0x50], 8
mov byte [esp + 0x17], al
jb 0x42653a
mov edx, dword [esp + 0x3c]
push edx
call fcn.00430a06
add esp, 4
cmp byte [esp + 0x17], 0
je 0x426607
lea esi, [esp + 0x54]
call fcn.0042e67c
test al, al
jne 0x42658d
mov eax, esi
call fcn.0042e669
test al, al
jne 0x42658d
mov eax, esi
call fcn.0042e665
push eax
push ebp
lea edi, [esp + 0x40]
call fcn.0040b330
add esp, 8
mov byte [esp + 0xac], 4
call fcn.0042f035
mov ecx, edi
mov byte [esp + 0xac], bl
call fcn.00402540
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x58]
call fcn.0042eb2f
test al, al
je 0x426607
nop
lea esi, [esp + 0x54]
call fcn.0042e67c
test al, al
jne 0x4265f5
mov eax, esi
call fcn.0042e669
test al, al
jne 0x4265f5
mov eax, esi
call fcn.0042e665
push eax
push ebp
lea edi, [esp + 0x40]
call fcn.0040b330
add esp, 8
mov byte [esp + 0xac], 5
call fcn.0042f035
mov byte [esp + 0xac], bl
cmp dword [esp + 0x50], 8
jb 0x4265f5
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00430a06
add esp, 4
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x58]
call fcn.0042eb2f
test al, al
jne 0x4265a0
lea eax, [esp + 0x18]
call fcn.0042eb82
cmp dword [esp + 0x34], 8
jb 0x426624
mov eax, dword [esp + 0x20]
push eax
call fcn.00430a06
add esp, 4
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], eax
mov word [esp + 0x20], ax
call fcn.0042eaaa
lea ecx, [esp + 0x54]
call fcn.0042e5c2
mov al, 1
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00431099
add esp, 0x9c
ret 4
Function at 0x4275e0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x446a8b
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x4541b0]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4541b0]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
push 0x20
xor ebx, ebx
mov ebp, 7
push 0x44c340
lea esi, [esp + 0x74]
mov edi, ecx
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], bx
call fcn.00402690
mov dword [esp + 0xb0], ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
mov ebp, 8
mov byte [esp + 0xb0], 1
cmp dword [edi + 0x18], ebp
jb 0x427672
mov edi, dword [edi + 4]
jmp 0x427675
add edi, 4
cmp dword [esp + 0x84], ebp
mov eax, dword [esp + 0x70]
jae 0x427686
lea eax, [esp + 0x70]
push edi
push eax
push 0x44c384
lea ecx, [esp + 0x24]
call fcn.0042d3e4
add esp, 0xc
lea eax, [esp + 0x34]
push ebx
push eax
lea esi, [esp + 0x20]
call fcn.0042df4b
add esp, 8
mov byte [esp + 0xb0], 2
mov ecx, dword [esp + 0x38]
mov edi, 0x10
cmp dword [esp + 0x4c], edi
jae 0x4276c6
lea ecx, [esp + 0x38]
mov edx, dword [esp + 0x48]
push edx
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x90]
call fcn.0042eff1
add esp, 8
lea esi, [esp + 0x50]
mov byte [esp + 0xb0], 3
call fcn.0042d2cd
cmp dword [esp + 0x64], 0xa
jb 0x42773f
mov ecx, esi
push 0xa
push ecx
xor ecx, ecx
lea esi, [esp + 0x90]
call fcn.0040cc80
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x20]
mov byte [esp + 0xb8], 4
call fcn.004025a0
mov byte [esp + 0xb0], 3
cmp dword [esp + 0xa0], ebp
jb 0x42773f
mov edx, dword [esp + 0x8c]
push edx
call fcn.00430a06
add esp, 4
cmp dword [esp + 0x30], ebp
mov eax, dword [esp + 0x1c]
jae 0x42774d
lea eax, [esp + 0x1c]
push eax
push 0x44c390
lea ecx, [esp + 0x20]
call fcn.0042d3e4
add esp, 8
lea ebx, [esp + 0x18]
call fcn.00421130
cmp dword [esp + 0x68], ebp
jb 0x42777b
mov eax, dword [esp + 0x54]
push eax
call fcn.00430a06
add esp, 4
xor ebx, ebx
cmp dword [esp + 0x4c], edi
mov esi, 7
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], bx
jb 0x4277a2
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00430a06
add esp, 4
cmp dword [esp + 0x30], ebp
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
jb 0x4277c5
mov edx, dword [esp + 0x1c]
push edx
call fcn.00430a06
add esp, 4
cmp dword [esp + 0x84], ebp
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
jb 0x4277e8
mov eax, dword [esp + 0x70]
push eax
call fcn.00430a06
add esp, 4
mov al, 1
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00431099
add esp, 0xa0
ret
Function at 0x416860
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x402cf6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call fcn.00402cf0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x402090
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [fcn.004010a4]
mov dword [ebp - 4], 3
call fcn.00405b94
mov dword [ebp - 0x6c], eax
call dword [fcn.00401074]
lea eax, [ebp - 0x64]
push eax
push 0x28
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00405b48
mov dword [ebp - 0x70], eax
call dword [fcn.00401074]
xor edx, edx
cmp dword [ebp - 0x70], 0
setne dl
neg edx
movsx eax, dx
test eax, eax
je 0x416a15
mov dword [ebp - 4], 4
xor ecx, ecx
test ecx, ecx
je 0x416936
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0x1c
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea ecx, [ebp - 0x60]
push ecx
push 0
mov edx, dword [ebp - 0x64]
push edx
call fcn.00405c70
call dword [fcn.00401074]
jmp 0x416a15
mov dword [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
push 0x404d24
lea ecx, [ebp - 0x68]
push ecx
call dword [fcn.00401208]
push eax
push 0
call fcn.00405bf4
mov dword [ebp - 0x6c], eax
call dword [fcn.00401074]
xor edx, edx
cmp dword [ebp - 0x6c], 0
setne dl
neg edx
mov word [ebp - 0x74], dx
lea ecx, [ebp - 0x68]
call dword [fcn.00401264]
movsx eax, word [ebp - 0x74]
test eax, eax
je 0x416a15
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x4169b3
mov dword [ebp - 0x8c], 0
jmp 0x4169bf
call dword [fcn.004010e4]
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x74]
imul edx, edx, 0xc
lea eax, [ebp + edx - 0x5c]
push eax
push 8
call dword [0x401064]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x4169f6
mov dword [ebp - 0x90], 0
jmp 0x416a02
call dword [fcn.004010e4]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x74]
imul ecx, ecx, 0xc
mov dword [ebp + ecx - 0x54], 2
jmp 0x416904
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x64]
push edx
call fcn.004057f4
call dword [fcn.00401074]
push 0x416a3d
jmp 0x416a3c
ret
Function at 0x403a51
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x403a65
shr eax, 1
xor eax, 0xedb88320
jmp 0x403a67
shr eax, 1
dec edx
jne 0x403a58
mov dword [ecx*4 + 0x4161c0], eax
mov dword [ecx*4 + 0x4181c0], eax
inc ecx
cmp ecx, 0x100
jb 0x403a53
push ebx
push esi
push edi
mov ecx, 0x4165c0
mov edi, 0x101
mov eax, dword [ecx - 0x400]
push 7
mov edx, ecx
pop esi
movzx ebx, al
shr eax, 8
xor eax, dword [ebx*4 + 0x4161c0]
mov dword [edx], eax
add edx, 0x400
dec esi
jne 0x403a99
add ecx, 4
dec edi
jne 0x403a8e
pop edi
pop esi
pop ebx
ret

Function at 0x403abb
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4181c4], 0
jne 0x403ac9
call fcn.00403a51
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x403af6
test cl, 7
je 0x403af6
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4161c0]
dec esi
inc ecx
jmp 0x403ad7
cmp esi, 8
jb 0x403b89
mov edi, esi
shr edi, 3
push ebx
xor eax, dword [ecx]
sub esi, 8
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x4171c0]
xor edx, dword [ebx*4 + 0x4175c0]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4179c0]
movzx ebx, byte [ecx + 6]
xor edx, dword [ebx*4 + 0x4165c0]
movzx ebx, byte [ecx + 5]
xor edx, dword [ebx*4 + 0x4169c0]
movzx ebx, byte [ecx + 4]
xor edx, dword [ebx*4 + 0x416dc0]
movzx ebx, byte [ecx + 7]
xor edx, dword [ebx*4 + 0x4161c0]
movzx eax, al
xor edx, dword [eax*4 + 0x417dc0]
add ecx, 8
dec edi
mov eax, edx
jne 0x403b05
pop ebx
jmp 0x403b89
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4161c0]
dec esi
inc ecx
test esi, esi
ja 0x403b75
pop edi
pop esi
ret 0xc
Function at 0x40a7b9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x20
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 8], ecx
call fcn.0040b0cd
xor eax, eax
push 4
xor ecx, ecx
mov dword [ebp + 8], eax
xor ebx, ebx
pop edx
cmp eax, 0xa
jg 0x40a8c7
cmp ebx, edx
jge 0x40a80e
lea esi, [ebp + ebx*4 - 0x28]
mov dword [ebp - 4], esi
cmp ecx, edx
jge 0x40a810
mov edi, dword [ebp - 8]
lea esi, [ecx + eax*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, dword [ebp - 4]
add dword [ebp - 4], edx
inc ebx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x40a7f3
cmp ecx, edx
jne 0x40a818
inc eax
mov dword [ebp + 8], eax
xor ecx, ecx
cmp ebx, edx
jl 0x40a7df
cmp eax, 0xa
jg 0x40a8c7
mov dword [ebp - 4], 0x41dec0
movzx esi, byte [ebp - 0x1b]
mov al, byte [ebp - 0x28]
xor al, byte [esi + 0x41dfe0]
movzx esi, byte [ebp - 0x1a]
mov bl, byte [esi + 0x41dfe0]
movzx esi, byte [ebp - 0x19]
xor byte [ebp - 0x27], bl
mov bl, byte [esi + 0x41dfe0]
movzx esi, byte [ebp - 0x1c]
xor byte [ebp - 0x26], bl
mov bl, byte [esi + 0x41dfe0]
mov esi, dword [ebp - 4]
xor al, byte [esi]
xor byte [ebp - 0x25], bl
inc dword [ebp - 4]
push 3
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x24]
pop edi
xor esi, esi
mov bl, byte [eax + esi - 4]
xor byte [eax + esi], bl
inc esi
cmp esi, edx
jl 0x40a873
add eax, edx
dec edi
jne 0x40a871
xor ebx, ebx
cmp dword [ebp + 8], 0xa
jg 0x40a8c7
cmp ebx, edx
jge 0x40a8b0
lea eax, [ebp + ebx*4 - 0x28]
cmp ecx, edx
jge 0x40a8b2
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
lea esi, [ecx + esi*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, eax
inc ebx
add eax, edx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x40a894
cmp ecx, edx
jne 0x40a8b9
inc dword [ebp + 8]
xor ecx, ecx
cmp ebx, edx
jl 0x40a886
cmp dword [ebp + 8], 0xa
jle 0x40a82c
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40a8ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
add ecx, 0x24
push 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 9
pop edi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 8], edi
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x41aec0]
xor dl, byte [eax + ebx*4 + 0x41b6c0]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x41bac0]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x41b2c0]
add ecx, edi
mov byte [esi], dl
add esi, edi
dec dword [ebp - 8]
jne 0x40a8f6
inc eax
cmp eax, edi
jl 0x40a8e9
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0040b0cd
add dword [ebp - 4], 0x10
dec dword [ebp - 0xc]
jne 0x40a8e7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40abf7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
push ebx
push esi
xor eax, eax
xor ecx, ecx
inc eax
mov esi, 0x11b
push edi
mov edx, eax
and dl, 0x80
movsx edx, dl
mov byte [ebp + ecx - 0x304], al
mov byte [ebp + ecx - 0x205], al
mov byte [ebp + eax - 0x104], cl
inc ecx
neg edx
sbb edx, edx
and edx, esi
lea edi, [eax + eax]
xor edx, edi
xor eax, edx
cmp eax, 1
jne 0x40ac0d
xor ecx, ecx
pop edi
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov byte [ecx + 0x41dec0], al
and edx, esi
add eax, eax
xor eax, edx
inc ecx
cmp ecx, 0x1e
jb 0x40ac40
xor ebx, ebx
mov dword [ebp - 4], ebx
jmp 0x40ac68

Function at 0x40b938
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
cmp dword [0x41e0e8], esi
jne 0x40b951
mov ecx, 0x41e0e0
call fcn.0040b8f9
cmp byte [ebp + 0x14], 0
mov ebx, dword [ebp + 0x10]
je 0x40b9a7
cmp dword [0x41e0e8], esi
je 0x40b9d8
test bl, 0xf
jne 0x40b9d8
add ebx, ebx
push ebx
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.0040b0cd
push esi
push ebx
push dword [ebp + 0xc]
call dword [0x41e0e8]
test eax, eax
jne 0x40ba00
push 0x414528
mov esi, 0x418e8c
mov ecx, esi
call fcn.004042fa
mov ecx, esi
call fcn.0040419c
push 2
mov ecx, esi
call fcn.00404497
jmp 0x40ba00
cmp dword [0x41e0ec], esi
je 0x40b9d8
test bl, 0xf
jne 0x40b9d8
add ebx, ebx
push ebx
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.0040b0cd
push esi
push ebx
push dword [ebp + 0xc]
call dword [0x41e0ec]
test eax, eax
jne 0x40ba00
push 0x41450c
jmp 0x40b989
call dword [0x4140d0]
xor edx, edx
cmp ebx, esi
jbe 0x40ba00
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
sub esi, ecx
push edi
lea edi, [eax + edx + 0x4b]
xor di, word [esi + ecx]
inc edx
mov word [ecx], di
inc ecx
inc ecx
cmp edx, ebx
jb 0x40b9ed
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x40eeb8
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4
Function at 0x1001fadf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.100220b2
add esp, 0xc
mov edi, edi
xor esi, 0x4926
xor esi, 0x4926
jle 0x1001fb25
pushf
jbe 0x1001fb0c
xchg esi, eax
xchg esi, eax
xor edi, edx
xor edi, edx
call 0x1001fb17
add esp, 4
popf
jbe 0x1001fb1e
ja 0x1001fb20
jbe 0x1001fb22
jg 0x1001fb25
mov esp, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
and esp, 0xffffffff
jbe 0x1001fb6a
lea edi, [edi + 0x7c43]
lea edi, [edi - 0x7c43]
ja 0x1001fb6a
sub dword [ebp - 0x76], 0xe980f04d
add dword [eax + 0x558af04d], ecx
cmc
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
nop
js 0x1001fbd7
mov esp, esp
lea eax, [eax]
mov eax, eax
jns 0x1001fbd7
mov ebx, 0x4faae896
add byte [eax], al
call fcn.10024b86
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001fbe9
xor eax, eax
jmp 0x1001fc28
cmp esp, 0xf12
lea edi, [edi]
jns 0x1001fc05
lea ecx, [ecx + 0x7e64]
lea ecx, [ecx - 0x7e64]
lea ecx, [ecx]
nop
js 0x1001fc05
or dword [ebp - 0x74af0fbb], 0xe851fc4d
jno 0x1001fc51
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.10043d83
add al, byte [eax]
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.100220b2
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100242bd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.100220b2
add esp, 0xc
jle 0x100242d8
rol esi, 0xd
rol esi, 0x13
xchg esp, esp
shr esp, 0
ja 0x1002430b
pushf
cmp edx, 0x28ba
rol eax, 0
jge 0x100242f2
add edi, dword [esp]
sub edi, dword [esp]
popf
jne 0x100242fc
lea esi, [esi + 0x4679]
lea esi, [esi - 0x4679]
jbe 0x1002430b
mov esp, 0x47e845c6
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
cld
or ecx, 0
clc
jae 0x1002434a
ja 0x10024360
pushf
jns 0x10024350
xchg ebx, esi
xchg ebx, esi
sub esp, 0
popf
jae 0x1002435b
jle 0x1002435d
jbe 0x10024360
or dword [edx - 0x167f17b3], 0xe84d8801
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.10041083
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100243e6
xor eax, eax
jmp 0x1002447d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10043d83
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.100220b2
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x1002447b
or edx, edx
ja 0x10024410
jno 0x10024412
xchg esp, esp
je 0x10024431
pushf
jle 0x1002441a
or esi, esi
jmp 0x1002441e
popf
xchg ecx, ecx
lea eax, [eax + 0x21ee]
lea eax, [eax - 0x21ee]
jne 0x10024431
add eax, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.1003f812
add esp, 4
jns 0x1002443f
ror ecx, 0x15
ror ecx, 0xb
rol esp, 0
or edx, edx
jo 0x10024466
pushf
cmp eax, ecx
jo 0x10024452
xor ebx, 0x58d6
xor ebx, 0x58d6
xchg esp, esp
popf
nop
jno 0x10024466
mov ecx, 0x5014458b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x1002447d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10