joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x234
mov esi, dword [esp + 0x24c]
mov edi, dword [esp + 0x248]
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov dword [esi], 0
xor eax, eax
cmp byte [0x43f968], 0
sete al
jmp dword [eax*4 + 0x43a4d4]

Function at 0x402c80
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test ecx, ecx
je 0x402d68
test edx, edx
je 0x402d68
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp], ecx
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402cca
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x402cd1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x402cb0
jmp 0x402cd3
mov esi, 0x1505
jmp 0x402cd3
mov esi, ecx
mov dword [esp + 4], edx
mov ecx, dword [esp]
mov ebp, dword [ecx + 0x20]
lea ebx, [ebp - 1]
mov edx, ebp
sub edx, 1
mov dword [esp + 0x10], edx
jb 0x402d61
and ebx, esi
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x402d04
inc ebx
dec ebp
je 0x402d5f
mov eax, ebx
and eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x402d5f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402d00
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
push eax
call fcn.004097e0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x402d00
push dword [esp + 0x28]
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00409800
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x402d00
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x402d61
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402d70
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x402e71
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x402e71
push ebx
call fcn.004097e0
add esp, 4
test eax, eax
je 0x402dca
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x402dd1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x402db0
jmp 0x402dd3
mov esi, 0x1505
jmp 0x402dd3
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x402e71
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x402e04
inc ebp
dec ebx
je 0x402e6f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x402e6f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x402e00
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.004097e0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x402e00
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00409800
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x402e00
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x402e6f
cmp dword [eax + 4], 2
mov edi, 0
jne 0x402e71
mov edi, dword [eax + 8]
jmp 0x402e71
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402ea0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x402f0b
mov esi, dword [esp + 0x30]
test esi, esi
je 0x402f0b
push esi
call fcn.004097e0
add esp, 4
test eax, eax
je 0x402eea
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x402ef1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x402ed0
jmp 0x402ef3
mov ebp, 0x1505
jmp 0x402ef3
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x402f17
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x402f34
inc ebx
dec edi
je 0x402f0b
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x402f0b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x402f30
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.004097e0
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x402f30
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.00409800
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x402f30
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x402f0b
cmp dword [eax + 4], 3
jne 0x402f0b
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x402f0b
Function at 0x402fd0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x4030d1
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4030d1
push ebx
call fcn.004097e0
add esp, 4
test eax, eax
je 0x40302a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x403031
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x403010
jmp 0x403033
mov esi, 0x1505
jmp 0x403033
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x4030d1
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x403064
inc ebp
dec ebx
je 0x4030cf
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x4030cf
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x403060
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.004097e0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x403060
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00409800
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x403060
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x4030cf
cmp dword [eax + 4], 5
mov edi, 0
jne 0x4030d1
mov edi, dword [eax + 8]
jmp 0x4030d1
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403100
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x403204
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x403204
push ebx
call fcn.004097e0
add esp, 4
test eax, eax
je 0x40315a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x403161
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x403140
jmp 0x403163
mov esi, 0x1505
jmp 0x403163
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x403204
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x403194
inc ebp
dec ebx
je 0x4031ff
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x4031ff
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x403190
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.004097e0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x403190
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00409800
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x403190
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x4031ff
cmp dword [eax + 4], 6
mov edi, 0xffffffff
jne 0x403204
mov edi, dword [eax + 8]
jmp 0x403204
mov edi, 0xffffffff
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403210
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
push 0x2e
push edi
call fcn.00409850
add esp, 8
test eax, eax
je 0x403276
mov ebx, eax
jmp 0x403254
mov edi, ebx
inc edi
push 0x2e
push edi
call fcn.00409850
add esp, 8
mov ebx, eax
test eax, eax
je 0x403276
mov eax, ebx
sub eax, edi
mov ecx, esi
mov edx, edi
push eax
call fcn.00402c80
add esp, 4
xor esi, esi
test eax, eax
je 0x403240
cmp dword [eax + 4], 4
jne 0x403240
mov esi, dword [eax + 8]
jmp 0x403240
xor eax, eax
test esi, esi
je 0x4032da
test edi, edi
je 0x4032da
push edi
call fcn.004097e0
add esp, 4
test eax, eax
je 0x4032ba
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [edi + ebp]
test edx, edx
je 0x4032c1
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc ebp
mov ecx, ebx
cmp eax, ebp
jne 0x4032a0
jmp 0x4032c3
mov ebx, 0x1505
jmp 0x4032c3
mov ebx, ecx
mov dword [esp + 4], eax
mov ecx, dword [esi + 0x20]
lea ebp, [ecx - 1]
mov eax, ecx
sub eax, 1
mov dword [esp + 0x14], eax
jae 0x4032e2
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov dword [esp], esi
mov eax, dword [esi + 4]
mov dword [esp + 0x10], eax
jmp 0x4032f4
inc ebp
dec ecx
je 0x4032d8
mov eax, ebp
and eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x4032d8
mov eax, dword [esp]
mov eax, dword [eax + 8]
cmp dword [eax + esi*4], ebx
jne 0x4032f0
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], ecx
call fcn.004097e0
mov ecx, dword [esp + 0xc]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4032f0
push dword [esp + 4]
push dword [esp + 0x10]
push edi
call fcn.00409800
mov ecx, dword [esp + 0x14]
add esp, 0xc
test eax, eax
jne 0x4032f0
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + esi*4]
jmp 0x4032da
Function at 0x4033f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x40345d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x40345d
push esi
call fcn.004097e0
add esp, 4
test eax, eax
je 0x40343a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x403441
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x403420
jmp 0x403443
mov ebx, 0x1505
jmp 0x403443
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x403465
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x403474
inc ebp
dec edi
je 0x40345b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x40345b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x403470
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.004097e0
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x403470
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00409800
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x403470
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x40345d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x40345d
Function at 0x403680
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0xffffffff
test ecx, ecx
je 0x40378c
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, edx
test edx, edx
je 0x403785
mov dword [esp], ecx
cmp dword [esp + 0x2c], 0
je 0x403785
push esi
call fcn.004097e0
add esp, 4
test eax, eax
je 0x4036da
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x4036e1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x4036c0
jmp 0x4036e3
mov ebp, 0x1505
jmp 0x4036e3
mov ebp, ecx
mov dword [esp + 8], esi
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x40378d
mov edi, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x40374a
call fcn.00403880
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 8]
jne 0x403785
push ecx
call fcn.004097e0
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [esp]
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov eax, esi
sub eax, 1
mov dword [esp + 0x10], eax
jae 0x4037ff
mov edi, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 8]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + edi*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], edi
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x4037a8
inc ebx
dec esi
je 0x4036ff
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x403704
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x4037a0
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*4]
push edi
call fcn.004097e0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x4037a0
push dword [esp + 4]
push edi
push dword [esp + 0x10]
call fcn.00409800
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4037a0
mov eax, 0xffffffff
jmp 0x403785
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
jmp 0x403818
inc ebx
dec esi
je 0x403745
mov edi, ebx
and edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x40374a
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebp
jne 0x403810
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0x14], eax
push eax
call fcn.004097e0
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x403810
push dword [esp + 4]
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.00409800
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x403810
jmp 0x40374a
Function at 0x403f60
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x4040f2
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x4040eb
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x403feb
add ebp, dword [esp + 4]
mov eax, edi
mov esi, 0x80078071
mul esi
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mul esi
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov esi, dword [esp + 8]
sub esi, dword [esp]
mov edx, 0x15b0
je 0x4040eb
mov dword [esp + 8], esi
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
jb 0x404065
xor eax, eax
nop
nop
nop
nop
nop
movzx edx, byte [ebp]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + 3]
add esi, edx
mov edx, ecx
and edx, esi
xor ecx, esi
movzx edi, byte [ebp + 4]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + 5]
add esi, edi
add ecx, esi
lea ecx, [ecx + edx*2]
movzx edx, byte [ebp + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebp + 7]
add edi, edx
add ecx, edi
mov edx, eax
and edx, 8
xor eax, 8
lea ebx, [eax + edx*2]
add ebp, 8
lea edx, [eax + edx*2]
add edx, 7
mov eax, ebx
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x404000
sub edx, ebx
jbe 0x403fb4
lea esi, [ebx + 1]
test dl, 1
mov dword [esp + 4], edx
jne 0x404090
mov edx, ebp
cmp dword [esp], esi
je 0x403fb0
jmp 0x4040ad
lea edx, [ebp + 1]
movzx ebx, byte [ebp]
add edi, ebx
mov ebx, edi
and ebx, ecx
xor ecx, edi
lea ecx, [ecx + ebx*2]
mov ebx, esi
cmp dword [esp], esi
je 0x403fb0
mov esi, dword [esp]
sub esi, ebx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [edx + ebx]
add eax, edi
mov edi, eax
and edi, ecx
xor ecx, eax
lea ecx, [ecx + edi*2]
movzx edi, byte [edx + ebx + 1]
add edi, eax
mov eax, edi
and eax, ecx
xor ecx, edi
lea ecx, [ecx + eax*2]
add ebx, 2
cmp esi, ebx
jne 0x4040c0
jmp 0x403fb0
shl ecx, 0x10
or ecx, edi
jmp 0x4040f7
mov ecx, 1
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x404110
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x404171
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x404173
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, edi
xor ebx, 0x3ffffff0
mov ebp, edi
or ebp, 0xf
and ebp, ebx
mov ebx, eax
and eax, 0xf
xor ebp, eax
shr ebx, 4
xor ebx, dword [ebp*4 + 0x43780c]
mov eax, ebx
and ebx, 0xf
shr edi, 4
xor edi, ebx
shr eax, 4
xor eax, dword [edi*4 + 0x43780c]
inc esi
cmp edx, esi
jne 0x404130
not eax
jmp 0x404173
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4136e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x14], esp
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x413700
mov edi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x413720
sar esi, 1
sar eax, 1
lea ecx, [esi + eax]
add ecx, 2
test ecx, ecx
jns 0x413740
mov eax, 0xffffffff
jmp 0x413749
add eax, esi
lea eax, [eax*2 + 4]
push eax
call fcn.004095a0
add esp, 4
mov ebx, eax
movzx ecx, word [edi]
test cx, cx
je 0x413781
add edi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x413770
mov word [eax], 0
mov word [eax], 0x5c
add eax, 2
mov edi, dword [ebp - 0x14]
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x4137b1
add edx, 2
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4137a0
mov word [eax], 0
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x18]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00435b60
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43bab8]
Function at 0x413a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x7c
mov eax, dword [esp + 0x94]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x413a60
sar esi, 1
lea ebx, [esp + 0x68]
push ebx
push 0
push 0
push esi
push eax
push 0
call dword [0x440ee4]
mov ebp, dword [esp + 0x68]
mov edi, 0xffffffff
test ebp, ebp
jns 0x413a94
mov eax, 0xffffffff
jmp 0x413a9b
lea eax, [ebp*2]
push eax
call fcn.004095a0
add esp, 4
push ebx
push ebp
mov ebp, eax
push eax
push esi
push dword [esp + 0xa4]
push 0
call dword [0x440ee4]
mov eax, dword [esp + 0x68]
mov ecx, eax
add ecx, 0xd
js 0x413acb
lea edi, [eax*2 + 0x1a]
push edi
call fcn.004095a0
add esp, 4
mov ebx, eax
mov dword [esp + 0x24], 0x11e21ff0
mov dword [esp + 0x28], 0x158713f3
mov dword [esp + 0x2c], 0x9361780
mov dword [esp + 0x30], 0xded0bfe
mov dword [esp + 0x34], 0x19b0f9e
mov dword [esp + 0x38], 0x593039b
mov dword [esp + 0x3c], 0x3906079a
mov dword [esp + 0x40], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x1f
ja 0x413b5e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x24]
add eax, 0x73ce91c5
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x27
mov ecx, dword [esp]
mov byte [esp + ecx + 0x24], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x20
jb 0x413b30
movzx ecx, word [ebp]
mov eax, ebx
test cx, cx
je 0x413b81
lea edx, [ebp + 2]
mov eax, ebx
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413b70
mov word [eax], 0
movzx ecx, word [esp + 0x24]
test cx, cx
je 0x413bb1
lea edx, [esp + 0x26]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413ba0
mov word [eax], 0
lea eax, [esp + 0xc]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.00435b60
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43bd20]
Function at 0x417350
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov ebx, dword [esp + 0x80]
mov ebp, dword [esp + 0x7c]
mov edi, dword [esp + 0x78]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x417370
cmp eax, 0xffffffdd
jge 0x417387
mov eax, 0xffffffff
jmp 0x41738a
add eax, 0x22
push eax
call fcn.004095a0
add esp, 4
mov esi, eax
mov dword [esp + 8], 0x29bf2b58
mov dword [esp + 0xc], 0x2dbf2fbc
mov dword [esp + 0x10], 0x513553ba
mov dword [esp + 0x14], 0x553d5739
mov dword [esp + 0x18], 0x593e5b28
mov dword [esp + 0x1c], 0x5d345f33
mov dword [esp + 0x20], 0x41d9433b
mov dword [esp + 0x24], 0x45d2472c
mov word [esp + 0x28], 0x4b44
mov dword [esp + 0x2a], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x25
ja 0x417437
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0x37]
add eax, ecx
and edx, ecx
add edx, edx
sub eax, edx
add eax, 0xbe5d7937
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x50]
add al, 0xed
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x26
jb 0x417400
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x417461
add ecx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x417450
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x417491
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417480
mov word [eax], 0
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebx
mov eax, dword [esp + 0x84]
mov dword [esp + 0x60], eax
mov dword [esp + 8], 0x41d747d3
mov dword [esp + 0xc], 0x4d1543da
mov dword [esp + 0x10], 0x49d64fe3
mov dword [esp + 0x14], 0xb5e54bd4
mov dword [esp + 0x18], 0xb12bb722
mov dword [esp + 0x1c], 0xbd23b31b
mov dword [esp + 0x20], 0xb9ebbf2a
mov dword [esp + 0x24], 0xa5efbbed
mov dword [esp + 0x28], 0xa100a7ce
mov dword [esp + 0x2c], 0xad3fa33f
mov dword [esp + 0x30], 0xa93caf03
mov dword [esp + 0x34], 0x953babe5
mov dword [esp + 0x38], 0x910a9702
mov dword [esp + 0x3c], 0x9d0a933f
mov dword [esp + 0x40], 0x99d59f00
mov dword [esp + 0x44], 0x85dd9b34
mov dword [esp + 0x48], 0x818687ee
mov byte [esp + 0x4c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x44
ja 0x417581
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x6f3d2571
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xcb
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x45
jb 0x417550
lea eax, [esp + 0x50]
lea ecx, [esp + 8]
push eax
push 0x417840
push ecx
push esi
call fcn.00418040
add esp, 0x10
jmp dword [0x43c0d0]