joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d7a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423dc8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
test eax, eax
je 0x40d7e6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.0040b3b0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x40d80f
lea ebx, [esi + 8]
jmp 0x40d811
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
call fcn.00403a10
test al, al
jne 0x40d827
mov ecx, dword [ebp - 0x18]
call fcn.00404450
jmp 0x40d829
xor eax, eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x40d84a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40d84a
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x40d873
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40d888
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.0040f9ba
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f979
mov esp, ebp
pop ebp
ret 4

Function at 0x40dd60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423f35
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x43800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x1050
call fcn.0040f98a
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 0x1050
push 0
push esi
call fcn.004121c0
lea ecx, [esi + 0x44]
mov dword [esi], 0
mov eax, ecx
mov dword [esi + 4], 0
neg eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
lea edx, [esi + 0x1044]
mov dword [esi + 0x10], 0
and eax, 3
mov dword [esi + 0x14], 0
add esp, 0x10
mov dword [esi + 0x18], 0
add eax, ecx
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [edx], 0
mov dword [esi + 0x1048], 0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edx
mov byte [ebp - 4], 2
mov dword [esi + 0x104c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov dword [edi], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b65a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041b308
Function at 0x4045e0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x4046d0
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x4046d0
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40462a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x404631
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x404610
jmp 0x404633
mov esi, 0x1505
jmp 0x404633
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x4046d0
mov eax, edi
not eax
and eax, 1
mov ebx, edi
and ebx, 0xfffffffe
sub ebx, eax
and ebx, esi
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404674
inc ebx
dec edi
je 0x4046ce
mov eax, ebx
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x4046ce
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x404670
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.0040c9d0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x404670
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0040ca00
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x404670
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x4046d0
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404e60
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x404fc3
mov esi, dword [esp + 0x28]
test esi, esi
je 0x404fc3
cmp dword [esp + 0x2c], 0
je 0x404fc3
push esi
call fcn.0040c9d0
add esp, 4
test eax, eax
je 0x404eca
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x404ed1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x404eb0
jmp 0x404ed3
mov ebx, 0x1505
jmp 0x404ed3
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x404f65
mov dword [esp], eax
mov eax, edi
not eax
and eax, 1
mov esi, edi
and esi, 0xfffffffe
sub esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x404f14
inc esi
dec edi
je 0x404f65
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404f6a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x404f10
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0040c9d0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x404f10
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0040ca00
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x404f10
mov eax, 0xffffffff
jmp 0x404fc3
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jae 0x404faf
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
jmp 0x404fc3
call fcn.00405b80
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
je 0x404fcb
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push ecx
call fcn.0040c9d0
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
test edi, edi
je 0x40506e
mov eax, edi
not eax
and eax, 1
mov esi, edi
and esi, 0xfffffffe
sub esi, eax
and esi, ebx
lea eax, [edi - 1]
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x405014
inc esi
dec edi
je 0x40506e
mov ebp, esi
and ebp, dword [esp + 8]
mov eax, dword [esp + 4]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x404f72
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x405010
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
push eax
call fcn.0040c9d0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405010
push dword [esp]
push dword [esp + 0x10]
push dword [esp + 0x30]
call fcn.0040ca00
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405010
jmp 0x404f72
mov ebp, 0xffffffff
jmp 0x404f72
Function at 0x4058d0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x405ab1
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405ab1
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x405ab1
cmp dword [ecx], 0
jne 0x405ab1
push esi
call fcn.0040c9d0
add esp, 4
test eax, eax
je 0x40593a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x405941
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x405920
jmp 0x405943
mov edi, 0x1505
jmp 0x405943
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
test edx, edx
je 0x4059fb
mov dword [esp], eax
mov eax, edx
not eax
and eax, 1
mov esi, edx
and esi, 0xfffffffe
sub esi, eax
and esi, edi
lea eax, [edx - 1]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405984
inc esi
dec edx
je 0x4059fb
mov ebp, esi
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ebx, dword [eax + ebp*4]
cmp ebx, 0xffffffff
je 0x405a00
mov eax, dword [ecx + 8]
cmp dword [eax + ebx*4], edi
jne 0x405980
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + ebx*4]
push ebp
mov dword [esp + 8], edx
call fcn.0040c9d0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x405980
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0040ca00
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x405980
mov eax, dword [ecx + 0x10]
push dword [eax + ebx*4]
call fcn.00404a00
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ebx*4], esi
jmp 0x405aa4
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x405a40
call fcn.00405b80
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x405ab1
push esi
call fcn.0040c9d0
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00405ac0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040c9d0
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x446004]
add esp, 4
test eax, eax
je 0x405aac
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0040c8f0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x405ab1
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406bb0
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x406d54
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x406d4d
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x406c40
add ebp, dword [esp + 8]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x406d4d
xor eax, eax
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 4], esi
jb 0x406cbe
mov eax, edx
and eax, 0x1ff8
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
movzx esi, byte [ebp + ebx]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + ebx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + ebx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + ebx + 3]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + ebx + 4]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + ebx + 5]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + ebx + 6]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + ebx + 7]
add edi, esi
add ecx, edi
add ebx, 8
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x406c60
add ebp, ebx
mov esi, dword [esp + 4]
mov ebx, edx
sub ebx, eax
mov dword [esp + 8], ebx
jbe 0x406c08
mov ebx, edx
mov edx, eax
or edx, 1
test bl, 1
jne 0x406cf0
mov ebx, ebp
cmp dword [esp], edx
je 0x406c00
jmp 0x406d0d
lea ebx, [ebp + 1]
movzx eax, byte [ebp]
mov esi, edi
and esi, eax
xor edi, eax
lea edi, [edi + esi*2]
add ecx, edi
mov eax, edx
cmp dword [esp], edx
je 0x406c00
mov edx, dword [esp]
sub edx, eax
mov dword [esp + 0xc], edx
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + eax]
mov edx, edi
and edx, esi
xor edi, esi
lea edx, [edi + edx*2]
add ecx, edx
movzx esi, byte [ebx + eax + 1]
mov edi, edx
and edi, esi
xor edx, esi
lea edi, [edx + edi*2]
add ecx, edi
add eax, 2
cmp dword [esp + 0xc], eax
jne 0x406d20
jmp 0x406c00
shl ecx, 0x10
or ecx, edi
jmp 0x406d59
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x406d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x406dc8
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x406dca
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x443c50]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
or ebp, edi
and edi, ebx
sub ebp, edi
xor eax, dword [ebp*4 + 0x443c50]
inc esi
cmp edx, esi
jne 0x406d90
not eax
jmp 0x406dca
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d020
Capabilities:
Encode data using xor
Terminate process

Disassembly:
sub esp, 8
call fcn.0043c340
test al, al
je 0x40d0ab
call fcn.00434c30
test al, al
je 0x40d0a6
mov dword [esp], 0x961a659
mov byte [esp + 4], 0
mov eax, 0x42f59e40
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x42f59e40]
xor ecx, eax
add ecx, 0xae0847f5
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
add cl, 0xca
mov byte [esp + eax - 0x42f59e40], cl
inc eax
cmp eax, 0x42f59e45
jne 0x40d050
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40d093
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040e0f0
test al, al
je 0x40d0a6
call fcn.00410c00
call fcn.0040f970
call fcn.0043e110
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40f2a0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44c760]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40f34e
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x446fbc]
xor eax, eax
jmp 0x40f761
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f980
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x43c
mov ebx, dword [esp + 0x450]
mov dword [esp + 0x3c], 0xb725897d
mov dword [esp + 0x40], 0xb35bb532
mov dword [esp + 0x44], 0xbf2ab124
mov dword [esp + 0x48], 0xbb69bd5d
mov dword [esp + 0x4c], 0xa774b965
mov dword [esp + 0x50], 0xa382a574
mov dword [esp + 0x54], 0xaf55a188
mov dword [esp + 0x58], 0xab38ad45
mov dword [esp + 0x5c], 0x57c5a944
mov dword [esp + 0x60], 0x53cd55cf
mov dword [esp + 0x64], 0x5fac5170
mov dword [esp + 0x68], 0x5b7a5da0
mov dword [esp + 0x6c], 0x47965989
mov dword [esp + 0x70], 0x43924596
mov dword [esp + 0x74], 0x4f6e4187
mov dword [esp + 0x78], 0x4ba34db7
mov dword [esp + 0x7c], 0x77ac49da
mov dword [esp + 0x80], 0x73b575a8
mov dword [esp + 0x84], 0x7fe67150
mov dword [esp + 0x88], 0x7ba67da6
mov dword [esp + 0x8c], 0x67467951
mov dword [esp + 0x90], 0x63f265a5
mov dword [esp + 0x94], 0x6ffa61f0
mov dword [esp + 0x98], 0x6b916d81
mov dword [esp + 0x9c], 0x17f86985
mov dword [esp + 0xa0], 0x13fb15e3
mov dword [esp + 0xa4], 0x1fcd118c
mov dword [esp + 0xa8], 0x1bc51dc1
mov dword [esp + 0xac], 0x7d419c3
mov dword [esp + 0xb0], 0x3d805db
mov dword [esp + 0xb4], 0xf260120
mov dword [esp + 0xb8], 0xbc20dfb
mov dword [esp + 0xbc], 0x37c309f4
mov dword [esp + 0xc0], 0x33e635c0
mov dword [esp + 0xc4], 0x3faa3110
mov dword [esp + 0xc8], 0x3bad3dd5
mov dword [esp + 0xcc], 0x270639d5
mov dword [esp + 0xd0], 0x23cf25ef
mov dword [esp + 0xd4], 0x2fb921cf
mov dword [esp + 0xd8], 0x2b032dbf
mov dword [esp + 0xdc], 0xd7192908
mov dword [esp + 0xe0], 0xd34cd53c
mov dword [esp + 0xe4], 0xdf4bd143
mov dword [esp + 0xe8], 0xdb09dd31
mov dword [esp + 0xec], 0xc717d909
mov dword [esp + 0xf0], 0xc310c51d
mov dword [esp + 0xf4], 0xcf1cc110
mov dword [esp + 0xf8], 0xcb18cd1c
mov dword [esp + 0xfc], 0xf7d6c918
mov dword [esp + 0x100], 0xf313f50b
mov dword [esp + 0x104], 0xff1ff11a
mov dword [esp + 0x108], 0xfb13fd62
mov dword [esp + 0x10c], 0xe73bf92b
mov dword [esp + 0x110], 0xe339e53b
mov dword [esp + 0x114], 0xef31e132
mov dword [esp + 0x118], 0xebeaed36
mov eax, dword [0x44c754]
mov ecx, 0xde
mov esi, 0x21
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0xa2]
mov edx, esi
xor edx, ecx
and edx, edi
xor edx, ecx
add dl, 0xaa
mov byte [esp + ecx - 0xa2], dl
inc ecx
dec esi
cmp ecx, 0x1be
jne 0x40fbe0
lea ebp, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ebp
call eax
xor edx, edx
test eax, eax
setne dl
mov ecx, 0x31515d3e
xor ecx, dword [0x447064]
mov edx, dword [edx*4 + 0x44705c]
add ecx, edx
inc ecx
xor edi, edi
xor esi, esi
jmp ecx
Function at 0x4102d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0xe177e753
mov dword [esp + 0x40], 0xdd79e36a
mov dword [esp + 0x44], 0xd94adf48
mov dword [esp + 0x48], 0xd58bdb7b
mov dword [esp + 0x4c], 0xd180d79b
mov dword [esp + 0x50], 0xcdb2d380
mov dword [esp + 0x54], 0xc967cf94
mov dword [esp + 0x58], 0xc55ccb53
mov dword [esp + 0x5c], 0xc157c758
mov dword [esp + 0x60], 0x3d4fc349
mov dword [esp + 0x64], 0x39883f5c
mov dword [esp + 0x68], 0x355a3b94
mov dword [esp + 0x6c], 0x31663767
mov dword [esp + 0x70], 0x2d623366
mov dword [esp + 0x74], 0x294e2f69
mov dword [esp + 0x78], 0x25b12b81
mov dword [esp + 0x7c], 0x216827b2
mov dword [esp + 0x80], 0x1d67236c
mov dword [esp + 0x84], 0x19961f7c
mov dword [esp + 0x88], 0x15561b56
mov dword [esp + 0x8c], 0x1176174f
mov dword [esp + 0x90], 0xd821353
mov dword [esp + 0x94], 0x99a0f9c
mov dword [esp + 0x98], 0x5a30b97
mov dword [esp + 0x9c], 0x1a4079b
mov dword [esp + 0xa0], 0x7d9903b5
mov dword [esp + 0xa4], 0x792f7ff0
mov dword [esp + 0xa8], 0x75377b37
mov dword [esp + 0xac], 0x7120773d
mov dword [esp + 0xb0], 0x6d3c733d
mov dword [esp + 0xb4], 0x69366f0c
mov dword [esp + 0xb8], 0x65d26bdd
mov dword [esp + 0xbc], 0x61d167c8
mov dword [esp + 0xc0], 0x5d3663d4
mov dword [esp + 0xc4], 0x59ca5f3c
mov dword [esp + 0xc8], 0x55cf5bc3
mov dword [esp + 0xcc], 0x513657cb
mov dword [esp + 0xd0], 0x4dcd53e9
mov dword [esp + 0xd4], 0x49db4fd1
mov dword [esp + 0xd8], 0x45114bd9
mov dword [esp + 0xdc], 0x41fb4724
mov dword [esp + 0xe0], 0xbdd043d8
mov dword [esp + 0xe4], 0xb929bf2d
mov dword [esp + 0xe8], 0xb5ebbb27
mov dword [esp + 0xec], 0xb1e5b7e7
mov dword [esp + 0xf0], 0xade4b3fb
mov dword [esp + 0xf4], 0xa9f8affc
mov dword [esp + 0xf8], 0xa5fcabf8
mov dword [esp + 0xfc], 0xa1c6a7f4
mov dword [esp + 0x100], 0x9d01a30d
mov dword [esp + 0x104], 0x993d9f02
mov dword [esp + 0x108], 0x95019b0a
mov dword [esp + 0x10c], 0x91d997c5
mov dword [esp + 0x110], 0x8ddb93dd
mov dword [esp + 0x114], 0x89c38fda
mov dword [esp + 0x118], 0x858a8bc6
mov byte [esp + 0x11c], 0
mov eax, dword [0x44c754]
mov ecx, 0x59
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x1d]
lea edx, [ecx - 0x31ae8c00]
or edx, esi
and esi, ecx
sub edx, esi
mov esi, 0xea
sub esi, edx
add edx, 0x15
and esi, 0xd2
and edx, 0x2d
sub edx, esi
mov byte [esp + ecx - 0x1d], dl
inc ecx
cmp ecx, 0x13a
jne case.default.0x410590
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov ebp, eax
xor eax, eax
test ebp, ebp
setne al
mov eax, dword [eax*4 + 0x447284]
mov ecx, 0xcc6e5e39
xor ecx, dword [0x44728c]
add eax, ecx
inc eax
jmp eax
sbb al, 0xff
and al, 0x85
sub byte [eax + 0x25ff0044], dl
add bh, bh
and eax, 0x44916c
jmp dword [0x449034]
add bh, bh
and eax, 0x44916c
Function at 0x4179b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1140
call fcn.0040c820
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov esi, 0xfffffffe
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x4179d0
sar esi, 1
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x44da98]
mov ebx, dword [esp + 0x34]
mov edi, 0xffffffff
test ebx, ebx
jns 0x417a04
mov eax, 0xffffffff
jmp 0x417a07
lea eax, [ebx + ebx]
push eax
call fcn.0040c8c0
add esp, 4
lea ecx, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x2c], eax
push eax
push esi
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0
call dword [0x44da98]
mov eax, dword [esp + 0x34]
mov ecx, eax
add ecx, 0xd
js 0x417a3c
lea edi, [eax*2 + 0x1a]
push edi
call fcn.0040c8c0
add esp, 4
mov esi, eax
mov dword [esp + 0x13c], 0x790e7b18
mov dword [esp + 0x140], 0x65fb6717
mov dword [esp + 0x144], 0x614263f8
mov dword [esp + 0x148], 0x6d056f1a
mov dword [esp + 0x14c], 0x69f76bf2
mov dword [esp + 0x150], 0x950797ff
mov dword [esp + 0x154], 0x91929306
mov word [esp + 0x158], 0
mov byte [esp + 0x15a], 0
mov eax, 0x4e71e26b
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x4e71e12f]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xe9
mov byte [esp + eax - 0x4e71e12f], cl
inc eax
cmp eax, 0x4e71e28a
jne 0x417ab0
mov eax, dword [esp + 0x24]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x417b01
mov eax, dword [esp + 0x24]
lea edx, [eax + 2]
mov eax, esi
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417af0
mov word [eax], 0
movzx ecx, word [esp + 0x13c]
test cx, cx
je 0x417b31
lea edx, [esp + 0x13e]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417b20
mov word [eax], 0
lea eax, [esp + 0xb0]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00441990
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447b38]