joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402b40
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x402ce6
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x402cdf
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x402bd5
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x402cdf
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x402c4e
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x402bf0
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x402b9d
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x402c90
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x402c70
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402b90
jmp 0x402c9f
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x402b90
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x402cb0
jmp 0x402b90
shl ecx, 0x10
or ecx, edi
jmp 0x402ceb
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402d00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402d54
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test edx, edx
je 0x402d56
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
not eax
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x44280c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x44280c]
not eax
inc esi
cmp edx, esi
jne 0x402d20
jmp 0x402d56
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x409310
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esp + 4]
mov dword [0x44a8ec], ecx
mov eax, 0xfffffd92
nop
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x26f
mov dword [eax*4 + 0x44b2a8], ecx
test eax, eax
je 0x409361
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
add ecx, 0x270
mov dword [eax*4 + 0x44b2ac], ecx
add eax, 2
jmp 0x409320
mov dword [0x44a8e8], 0x270
ret

Function at 0x409380
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x210
call fcn.0043cd10
test al, al
je 0x40955d
lea eax, [esp + 8]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00436a30
test al, al
je 0x409558
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 0x1b33ee25
mov ebx, 0x7e9f1d8
mov ecx, esi
shrd ebx, edx, cl
mov dword [esp + 4], eax
mov ecx, esi
shr edx, cl
test cl, 0x20
je 0x4093e3
mov ebx, edx
xor edx, edx
mov ebp, ebx
mov esi, ebx
and esi, 0xc96ba95d
mov ecx, edx
and edx, 0xcf996c3
xor esi, 0xc8020805
xor edx, 0x84c810c2
mov edi, ebx
and edi, 0x369456a2
xor edi, 0x6805080
mov eax, edi
imul edi, edx
mul esi
mov dword [esp], eax
mov eax, ebx
xor eax, 0x7e9f1d8
add edi, edx
mov ebp, ecx
and ebp, 0x1306693c
xor ebp, 0x13026824
imul ebp, esi
mov esi, ecx
xor esi, 0x1b33ee25
add ebp, edi
xor ebx, 0x317da77a
xor ecx, 0x68358719
or eax, 0xc96ba95d
mov edi, esi
or edi, 0xcf996c3
and edi, ecx
and ebx, eax
mov ecx, eax
or esi, 0x8cf996c3
imul esi, ebx
mov eax, ebx
mul ecx
imul edi, ecx
add edi, edx
add edi, esi
add eax, dword [esp]
adc edi, ebp
mov ebx, edi
shr ebx, 0x15
xor ebx, edi
mov esi, edi
shld esi, eax, 0xb
xor esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x409534
mov ebp, ebx
and ebp, 0x4ebcdeef
mov eax, esi
and eax, 0x41ed8b41
mov dword [esp], eax
mov edi, esi
or edi, 0x41ed8b41
mov edx, ebx
or edx, 0x4ebcdeef
mov ecx, edx
shld ecx, esi, 1
lea eax, [edi + edi]
not eax
add eax, edi
not ecx
adc ecx, edx
mov edx, dword [esp]
imul ecx, edx
imul ebp, eax
mul edx
mov dword [esp], eax
mov edi, edx
add edi, ebp
add edi, ecx
mov ebp, ebx
and ebp, 0xb1432110
mov ecx, esi
and ecx, 0xbe1274be
or esi, 0xbe1274be
mov eax, esi
mul ecx
imul esi, ebp
add esi, edx
or ebx, 0xb1432110
imul ebx, ecx
add ebx, esi
add eax, dword [esp]
adc ebx, edi
mov edi, eax
mov ecx, dword [esp + 4]
shrd edi, ebx, cl
mov edx, ebx
shr edx, cl
test cl, 0x20
je 0x40951e
mov edi, edx
xor edx, edx
mov esi, edi
xor esi, edi
mov ecx, edx
xor ecx, edx
not esi
and esi, eax
xor esi, edi
not ecx
and ecx, ebx
xor ecx, edx
mov ebx, ecx
or ebx, 0x1010101
or esi, 0x1010101
push ebx
push esi
call fcn.0040a6e0
add esp, 8
test al, al
je 0x409558
call fcn.0040d5a0
call fcn.0040c1d0
call fcn.0043ddf0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409570
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0x4095da
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
lea ebx, [edi - 0x80000000]
mov edx, edi
or edx, 0x7ffffffe
and edx, ebx
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0x409590
mov eax, 0x270
jmp 0x4095ec
cmp eax, 0x4e0
jb 0x4095ec
mov esi, ecx
call fcn.00409640
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov ecx, edx
shl ecx, 7
and ecx, 0x9d2c5680
mov eax, ecx
and eax, edx
add ecx, edx
add eax, eax
sub ecx, eax
mov eax, ecx
shl eax, 0xf
and eax, 0xefc60000
xor eax, ecx
mov edx, eax
shr edx, 0x12
not eax
or eax, edx
not edx
or edx, ecx
and eax, edx
not eax
pop esi
pop edi
pop ebx
ret

Function at 0x409640
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push edi
push esi
mov esi, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 - 0x630]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4]
xor edi, edx
mov dword [ecx + eax*4 - 0xff4], edi
inc eax
cmp eax, 0x4e1
jne 0x409650
mov esi, dword [ecx + 0xd50]
mov eax, 0x355
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4]
lea ebx, [edi - 0x80000000]
mov edx, edi
or edx, 0x7ffffffe
and edx, ebx
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, edx
mov edx, dword [ecx + eax*4 - 0xd50]
mov ebx, edi
and ebx, edx
add edi, edx
add ebx, ebx
sub edi, ebx
mov dword [ecx + eax*4 - 0x9c4], edi
inc eax
cmp eax, 0x4e1
jne 0x4096a0
mov edx, SysReAllocString
and edx, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov esi, eax
and esi, 0x7fffffff
or edx, esi
shr edx, 1
xor eax, 0x7ffffffe
and eax, esi
je 0x409714
mov eax, 0x9908b0df
mov esi, eax
and esi, edx
add eax, edx
add esi, esi
sub eax, esi
xor eax, dword [ecx + 0x634]
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
ret
Function at 0x40a6e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x230
mov eax, dword [0x44bcc8]
mov dword [esp + 0x1b0], 0xb7b68188
mov word [esp + 0x1b4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x1e
xor dl, byte [esp + ecx + 0x1b0]
add dl, 0x6a
mov byte [esp + ecx + 0x1b0], dl
inc ecx
cmp ecx, 6
jne 0x40a710
mov ecx, dword [esp + 0x1b0]
mov dword [esp + 0x20], 0x43d141d7
mov dword [esp + 0x24], 0x47b94596
mov dword [esp + 0x28], 0x4b98499b
mov dword [esp + 0x2c], 0x4faa4d62
mov dword [esp + 0x30], 0x739e719c
mov word [esp + 0x34], 0x7574
mov dword [esp + 0x36], 0
xor edx, edx
nop
nop
nop
nop
movzx esi, byte [esp + edx + 0x20]
lea ebx, [edx - 0x5dbd2a70]
xor ebx, esi
lea esi, [ebx - 0x2b4e2bd1]
not ebx
add ebx, ebx
and ebx, 2
mov edi, ebx
and edi, esi
or ebx, esi
xor ebx, 1
add ebx, edi
mov byte [esp + edx + 0x20], bl
mov esi, edx
and esi, 0xd
xor edx, 0x23baaaad
lea edx, [edx + esi*2]
add edx, 0xdc455554
cmp edx, 0x1a
jb 0x40a770
lea edx, [esp + 0x20]
push ecx
push 0
push edx
call eax
mov ecx, 0x44bccc
push eax
call fcn.0043cc80
movzx eax, al
mov eax, dword [eax*4 + 0x445af8]
mov ecx, 0x541fa28f
xor ecx, dword [0x445b00]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x40b3e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0x40b65c
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0x40b41c
cmp edx, esi
jae 0x40b65c
test edi, edi
je 0x40b65c
movzx ebp, bl
test bl, bl
js 0x40b450
mov word [eax], bp
lea ecx, [eax + 2]
inc edx
mov esi, ecx
sub esi, eax
sar esi, 1
sub edi, esi
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0x40b410
jmp 0x40b65c
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0x40b488
cmp bl, 0xc2
jb 0x40b440
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0x40b4f2
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
jmp 0x40b54b
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0x40b4b2
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0x40b4fc
cmp ebp, 0xe0
jne 0x40b505
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0x40b43c
jmp 0x40b505
mov ecx, ebp
and ecx, 0xfffffff8
cmp ecx, 0xf0
jne 0x40b637
cmp bl, 0xf4
ja 0x40b440
movzx ecx, byte [edx + 1]
je 0x40b55e
cmp ebp, 0xf0
jne 0x40b567
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0x40b43c
jmp 0x40b567
inc edx
mov esi, dword [esp + 0x24]
jmp 0x40b442
cmp cl, 0x9f
ja 0x40b43c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b63e
movzx ebx, byte [edx + 2]
mov esi, ebx
or esi, 0xc0
mov dword [esp], ebx
xor ebx, 0xffffff3f
and ebx, esi
cmp ebx, 0x80
jne 0x40b556
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
add edx, 3
lea ecx, [eax + 2]
mov word [eax], si
jmp 0x40b432
add edx, 2
jmp 0x40b43c
cmp cl, 0x8f
ja 0x40b43c
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b63e
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b644
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0x40b650
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
shl ebp, 6
lea ebx, [ecx + ebp]
add ebx, 0xffffe000
add edx, 4
mov esi, ebx
and esi, 0x1ff800
cmp esi, 0xd800
je 0x40b43c
add ebp, ecx
mov ecx, dword [esp]
and ecx, 0x3f
add ecx, ebp
add ecx, 0xffffe000
cmp ecx, 0x10000
jb 0x40b43c
cmp edi, 2
jb 0x40b637
add ebx, 0xf0000
shr ebx, 0xa
and ebx, 0x3ff
or ebx, 0xd800
mov word [eax], bx
mov esi, 0x3ff
sub esi, ecx
not esi
or esi, ecx
and esi, 0x3ff
or esi, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], si
jmp 0x40b432
mov ecx, eax
jmp 0x40b432
inc edx
jmp 0x40b43c
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0x40b442
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0x40b442
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40bb20
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0x3c
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x50], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x44bca4]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40bbce
sar edx, 1
lea edi, [esi + 0x20]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x445e28]
xor eax, eax
jmp 0x40c054
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40c200
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov ebp, dword [esp + 0x464]
mov dword [esp + 0x38], 0x23bd21dd
mov dword [esp + 0x3c], 0x27bf25ae
mov dword [esp + 0x40], 0xdb46d944
mov dword [esp + 0x44], 0xdf01dd3d
mov dword [esp + 0x48], 0xd30cd105
mov dword [esp + 0x4c], 0xd7f6d504
mov dword [esp + 0x50], 0xcb3dc910
mov dword [esp + 0x54], 0xcf50cd55
mov dword [esp + 0x58], 0xc35dc124
mov dword [esp + 0x5c], 0xc755c553
mov dword [esp + 0x60], 0xfb04f9d8
mov dword [esp + 0x64], 0xffdefd08
mov dword [esp + 0x68], 0xf322f121
mov dword [esp + 0x6c], 0xf726f52a
mov dword [esp + 0x70], 0xebcae923
mov dword [esp + 0x74], 0xef77ed1b
mov dword [esp + 0x78], 0xe334e17e
mov dword [esp + 0x7c], 0xe72de530
mov dword [esp + 0x80], 0x9b1299b8
mov dword [esp + 0x84], 0x9f4a9d4a
mov dword [esp + 0x88], 0x93b29149
mov dword [esp + 0x8c], 0x97069555
mov dword [esp + 0x90], 0x8b168918
mov dword [esp + 0x94], 0x8f798d69
mov dword [esp + 0x98], 0x83608165
mov dword [esp + 0x9c], 0x871f857f
mov dword [esp + 0xa0], 0xbb65b92c
mov dword [esp + 0xa4], 0xbf6dbd69
mov dword [esp + 0xa8], 0xb36cb167
mov dword [esp + 0xac], 0xb760b567
mov dword [esp + 0xb0], 0xab72a988
mov dword [esp + 0xb4], 0xaf56ad57
mov dword [esp + 0xb8], 0xa35fa154
mov dword [esp + 0xbc], 0xa77aa558
mov dword [esp + 0xc0], 0x5bc65978
mov dword [esp + 0xc4], 0x5fc55dc5
mov dword [esp + 0xc8], 0x537251b5
mov dword [esp + 0xcc], 0x57b35593
mov dword [esp + 0xd0], 0x4bd149ab
mov dword [esp + 0xd4], 0x4f974dd3
mov dword [esp + 0xd8], 0x43814160
mov dword [esp + 0xdc], 0x47d445dc
mov dword [esp + 0xe0], 0x7be779e7
mov dword [esp + 0xe4], 0x7fa17d99
mov dword [esp + 0xe8], 0x73a371a1
mov dword [esp + 0xec], 0x77a875bd
mov dword [esp + 0xf0], 0x6bb469b8
mov dword [esp + 0xf4], 0x6fb06dbc
mov dword [esp + 0xf8], 0x634261b0
mov dword [esp + 0xfc], 0x67876597
mov dword [esp + 0x100], 0x1bfb19fe
mov dword [esp + 0x104], 0x1f871d8e
mov dword [esp + 0x108], 0x13c711cf
mov dword [esp + 0x10c], 0x17c115c7
mov dword [esp + 0x110], 0xbd909d6
mov dword [esp + 0x114], 0xf0e0dda
mov byte [esp + 0x11a], 0
mov word [esp + 0x118], 0
mov eax, dword [0x44bc98]
mov ecx, 0x14b78
nop
movzx esi, byte [esp + ecx - 0x14b40]
mov edx, ecx
and edx, esi
add edx, edx
add esi, ecx
mov ebx, edx
xor ebx, esi
not edx
and edx, esi
add edx, edx
sub edx, ebx
add edx, 0xecb46761
mov esi, edx
and esi, 0x27
xor edx, 0xa7
lea edx, [edx + esi*2]
add dl, 0xa0
mov byte [esp + ecx - 0x14b40], dl
inc ecx
cmp ecx, 0x14c5b
jne 0x40c460
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
xor ecx, ecx
test eax, eax
setne cl
mov edx, dword [ecx*4 + 0x445ea8]
mov ecx, 0xca4830e3
xor ecx, dword [0x445eb0]
add ecx, edx
inc ecx
jmp ecx
Function at 0x40cc60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov dword [esp + 0x38], 0xffd09d5
mov dword [esp + 0x3c], 0x3fb0d82
mov dword [esp + 0x40], 0x7fa01fc
mov dword [esp + 0x44], 0x1b2905e5
mov dword [esp + 0x48], 0x1f2c192d
mov dword [esp + 0x4c], 0x13321d2c
mov dword [esp + 0x50], 0x17fd1128
mov dword [esp + 0x54], 0x2bd815ed
mov dword [esp + 0x58], 0x2fdd29cc
mov dword [esp + 0x5c], 0x23d52da7
mov dword [esp + 0x60], 0x27f42100
mov dword [esp + 0x64], 0x3b1a25f0
mov dword [esp + 0x68], 0x3f0e3909
mov dword [esp + 0x6c], 0x33023d0e
mov dword [esp + 0x70], 0x371631ff
mov dword [esp + 0x74], 0xcb3335df
mov dword [esp + 0x78], 0xcf04c93a
mov dword [esp + 0x7c], 0xc30dcdf8
mov dword [esp + 0x80], 0xc74ec1e0
mov dword [esp + 0x84], 0xdbeec50e
mov dword [esp + 0x88], 0xdffed9e1
mov dword [esp + 0x8c], 0xd322dd1d
mov dword [esp + 0x90], 0xd72ad120
mov dword [esp + 0x94], 0xeb01d531
mov dword [esp + 0x98], 0xef08e90d
mov dword [esp + 0x9c], 0xe31bed33
mov dword [esp + 0xa0], 0xe7d5e114
mov dword [esp + 0xa4], 0xfbcde5d1
mov dword [esp + 0xa8], 0xffccf933
mov dword [esp + 0xac], 0xf338fdcb
mov dword [esp + 0xb0], 0xf7cef1d0
mov dword [esp + 0xb4], 0x8b52f52b
mov dword [esp + 0xb8], 0x8f53895c
mov dword [esp + 0xbc], 0x83be8d50
mov dword [esp + 0xc0], 0x877a81a0
mov dword [esp + 0xc4], 0x9b65857d
mov dword [esp + 0xc8], 0x9fbe997d
mov dword [esp + 0xcc], 0x93779d47
mov dword [esp + 0xd0], 0x97699177
mov dword [esp + 0xd4], 0xab939567
mov dword [esp + 0xd8], 0xaf69a988
mov dword [esp + 0xdc], 0xa354ad54
mov dword [esp + 0xe0], 0xa75ba153
mov dword [esp + 0xe4], 0xbb89a541
mov dword [esp + 0xe8], 0xbf8fb989
mov dword [esp + 0xec], 0xb380bd75
mov dword [esp + 0xf0], 0xb784b180
mov dword [esp + 0xf4], 0x4b78b584
mov dword [esp + 0xf8], 0x4f6e4978
mov dword [esp + 0xfc], 0x43a34d9b
mov dword [esp + 0x100], 0x47a741ba
mov dword [esp + 0x104], 0x5ba345b2
mov dword [esp + 0x108], 0x5f6b596b
mov dword [esp + 0x10c], 0x53995d6b
mov dword [esp + 0x110], 0x57615162
mov dword [esp + 0x114], 0x6b6a559e
mov eax, dword [0x44bc98]
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 0x38]
mov edi, ecx
and edi, 0x184
mov ebx, edx
xor ebx, 0x1c36a8c2
add ebx, edi
xor ebx, esi
mov esi, ebx
and esi, 0x35
xor ebx, 0x35
lea ebx, [ebx + esi*2]
inc bl
mov byte [esp + edx + 0x38], bl
inc edx
add ecx, 2
cmp edx, 0xe0
jne 0x40ceb0
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
mov ebp, eax
xor eax, eax
test ebp, ebp
setne al
mov eax, dword [eax*4 + 0x44607c]
mov ecx, dword [0x446084]
mov edx, ecx
and edx, 0xf6269d3c
add edx, edx
sub edx, ecx
add eax, edx
add eax, 0x89d962c4
jmp eax
Function at 0x419b90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ebp, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x419bb0
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x419bd0
sar ebp, 1
sar eax, 1
lea ecx, [eax + ebp]
add ecx, 2
test ecx, ecx
jns 0x419bf0
mov eax, 0xffffffff
jmp 0x419bf9
add eax, ebp
lea eax, [eax*2 + 4]
push eax
call fcn.00408c10
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x419c31
add esi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x419c20
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [edi]
test cx, cx
je 0x419c61
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x419c50
mov word [eax], 0
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.004405b0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4465f8]
Function at 0x419f10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x438
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + ecx], 0
lea ecx, [ecx + 2]
jne 0x419f30
lea edx, [eax + ecx]
add edx, 0xfffffffe
add ecx, eax
mov edi, 1
sub edi, ecx
and edi, eax
mov ecx, eax
not ecx
and ecx, edx
sub ecx, edi
sar ecx, 1
lea edx, [esp + 0x80]
push edx
push 0
push 0
mov dword [esp + 0x28], ecx
push ecx
push eax
push 0
call dword [0x44cfec]
mov dword [esp + 0xf8], 0x894a4b11
mov word [esp + 0xfc], 0
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edi + 0xf8]
mov ecx, edi
and ecx, 5
xor ecx, 0x92bfa70d
mov edx, edi
and edx, 2
sub edx, ecx
xor edx, ebx
lea ecx, [edx - 0x2241bcc0]
mov ebx, 1
sub ebx, edx
not ebx
and ebx, 1
mov esi, ecx
and esi, 0xfe
xor ecx, 1
add ecx, edx
add ecx, 0xddbe4340
sub ecx, esi
add ecx, ebx
mov byte [esp + edi + 0xf8], cl
inc edi
cmp edi, 6
jne case.default.0x419ff0
xor ecx, ecx
cmp eax, dword [esp + 0xf8]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x446ae0]
mov ebx, dword [esp + 0x80]
test ebx, ebx
mov esi, dword [ebp + 0xc]
jns 0x41a00c
mov eax, 0xffffffff
jmp 0x41a00f
lea eax, [ebx + ebx]
push eax
call fcn.00408c10
add esp, 4
mov edi, eax
lea eax, [esp + 0x80]
push eax
push ebx
push edi
push dword [esp + 0x28]
push dword [esi + 4]
push 0
call dword [0x44cfec]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446ae8]
xor eax, eax
jmp dword [0x446af0]
push edi
jmp 0x41a584
mov eax, dword [esp + 0x80]
mov ecx, eax
add ecx, 0xd
jns 0x41a062
mov eax, 0xffffffff
jmp 0x41a069
lea eax, [eax*2 + 0x1a]
push eax
call fcn.00408c10
add esp, 4
mov esi, eax
mov dword [esp + 0xf8], 0x93269134
mov dword [esp + 0xfc], 0x9f0d9d3d
mov dword [esp + 0x100], 0x9b7a9904
mov dword [esp + 0x104], 0x872b853a
mov dword [esp + 0x108], 0x83118112
mov dword [esp + 0x10c], 0x8f198d25
mov dword [esp + 0x110], 0x8b8a891e
mov word [esp + 0x114], 0
mov byte [esp + 0x116], 0
mov eax, 0xff7113e4
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x8eed14]
xor ecx, eax
mov edx, ecx
and edx, 0xb
xor ecx, 0x8b
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax + 0x8eed14], cl
inc eax
cmp eax, 0xff711403
jne 0x41a0e0
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41a131
lea edx, [edi + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a120
mov word [eax], 0
movzx ecx, word [esp + 0xf8]
test cx, cx
je 0x41a161
lea edx, [esp + 0xfa]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41a150
mov dword [esp + 0x74], edi
mov word [eax], 0
lea eax, [esp + 0x278]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.004405b0
add esp, 0x14
mov ecx, dword [0x446b04]
nop
nop
nop
nop
nop
nop
jmp ecx
call fcn.00408c20
add esp, 4
xor eax, eax
jmp case.0x419ff0.0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret