joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100399f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push 0x1008cf5c
push str.AB_DATA_data.abminfo
call fcn.1001d2cc
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 1
push 4
push 0x100a2f8c
call fcn.1001e4cc
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
push 1
push 4
push 0x100a2f90
call fcn.1001e4cc
add esp, 0x10
mov edx, dword [0x100a2f8c]
mov dword [ebp - 0x20], edx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov edx, 0x1c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10012b4b
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10039acb
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x30], 0
jbe 0x10039ac3
mov ecx, dword [ebp - 4]
mov byte [ecx], 0
xor edx, edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov word [eax + 0x10], dx
mov byte [eax + 0x12], dl
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], 0
mov eax, dword [ebp - 4]
add eax, 0x1c
mov dword [ebp - 4], eax
jmp 0x10039a6f
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
jmp 0x10039ad2
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x24]
mov dword [0x100a2eb8], edx
mov eax, dword [0x100a2f90]
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov edx, 0x1c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10012b4b
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10039b70
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x34], 0
jbe 0x10039b68
mov ecx, dword [ebp - 8]
mov byte [ecx], 0
xor edx, edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov word [eax + 0x10], dx
mov byte [eax + 0x12], dl
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], 0
mov eax, dword [ebp - 8]
add eax, 0x1c
mov dword [ebp - 8], eax
jmp 0x10039b14
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], ecx
jmp 0x10039b77
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp - 0x2c]
mov dword [0x100a2ea4], edx
mov eax, dword [ebp - 0xc]
push eax
imul ecx, dword [0x100a2f8c], 0x1c
push ecx
push 1
mov edx, dword [0x100a2eb8]
push edx
call fcn.1001e4cc
add esp, 0x10
mov eax, dword [ebp - 0xc]
push eax
imul ecx, dword [0x100a2f90], 0x1c
push ecx
push 1
mov edx, dword [0x100a2ea4]
push edx
call fcn.1001e4cc
add esp, 0x10
mov eax, dword [ebp - 0xc]
push eax
call fcn.100182e1
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x1003b420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
jmp 0x1003b438
mov byte [ebp - 0x2c], 0xee
mov byte [ebp - 0x2b], 0x7c
mov byte [ebp - 0x2a], 0x7f
mov byte [ebp - 0x29], 0x3f
mov byte [ebp - 0x28], 0xa4
mov byte [ebp - 0x27], 0x70
mov byte [ebp - 0x26], 0x7d
mov byte [ebp - 0x25], 0x3f
mov byte [ebp - 0x24], 0x33
mov byte [ebp - 0x23], 0x33
mov byte [ebp - 0x22], 0x73
mov byte [ebp - 0x21], 0x3f
mov byte [ebp - 0x20], 0x9a
mov byte [ebp - 0x1f], 0x99
mov byte [ebp - 0x1e], 0x59
mov byte [ebp - 0x1d], 0x3f
mov byte [ebp - 0x1c], 0x14
mov byte [ebp - 0x1b], 0xae
mov byte [ebp - 0x1a], 0x47
mov byte [ebp - 0x19], 0x3f
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [0x100a3269], 1
cvtss2sd xmm0, dword [ebp + 8]
movsd xmm1, qword [0x1009d230]
subsd xmm1, xmm0
cvtsd2ss xmm0, xmm1
movss dword [ebp - 8], xmm0
cvtss2sd xmm0, dword [ebp - 8]
sub esp, 8
movsd qword [esp], xmm0
call fcn.1001d336
add esp, 8
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
fstp dword [ebp - 0xc]
movss xmm0, dword [ebp - 0xc]
addss xmm0, dword [ebp - 0xc]
movss dword [ebp - 0x14], xmm0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
movss xmm0, dword [ebp + eax*4 - 0x2c]
comiss xmm0, dword [ebp - 0x14]
jbe 0x1003b512
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 6
jl 0x1003b510
jmp 0x1003b617
jmp 0x1003b4ed
mov edx, dword [ebp - 4]
xor edx, 0x33
mov dword [0x100a2f54], edx
cmp dword [0x100a2f70], 0x58
jne 0x1003b605
cmp dword [ebp - 4], 5
jge 0x1003b5fb
movss xmm0, dword [0x100a2f74]
ucomiss xmm0, dword [0x1009d1c0]
lahf
test ah, 0x44
jnp 0x1003b5dc
cmp dword [0x100a2f7c], 1
jne 0x1003b59b
movss xmm0, dword [0x1009d140]
comiss xmm0, dword [ebp - 8]
jbe 0x1003b59b
cmp dword [0x100a2f80], 5
jae 0x1003b587
mov eax, dword [0x100a2f80]
add eax, 1
mov dword [0x100a2f80], eax
mov dword [0x100a2f7c], 0
jmp 0x1003b59b
mov dword [0x100a2f58], 0x55
mov dword [0x100a2f7c], 0
cmp dword [0x100a2f7c], 2
jne 0x1003b5dc
cmp dword [0x100a2f80], 5
jae 0x1003b5c8
mov ecx, dword [0x100a2f80]
add ecx, 1
mov dword [0x100a2f80], ecx
mov dword [0x100a2f7c], 0
jmp 0x1003b5dc
mov dword [0x100a2f58], 0x55
mov dword [0x100a2f7c], 0
movss xmm0, dword [0x100a2f74]
movss dword [0x100a2f78], xmm0
movss xmm0, dword [ebp - 8]
movss dword [0x100a2f74], xmm0
jmp 0x1003b605
mov dword [0x100a2f7c], 0
jmp 0x1003b617
mov esp, ebp
pop ebp
ret
Function at 0x1003c1b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0xc]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov byte [ecx], 0xe8
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [edx + 1], eax
mov dword [ebp - 4], 5
jmp 0x1003c1f7
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x10]
jae 0x1003c20a
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
mov byte [eax], 0x90
jmp 0x1003c1ee
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x1003d770
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
call fcn.10062230
mov dword [ebp - 4], eax
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [0x100a2edc]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x44]
cvtsi2ss xmm0, edx
movss dword [ebp - 0x1c], xmm0
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x40]
cvtsi2ss xmm0, eax
movss dword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0x1c]
movss dword [ebp - 0x34], xmm0
movss xmm0, dword [ebp - 0x20]
movss dword [ebp - 0x30], xmm0
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [0x100a2ee8]
mov edx, dword [ebp - 0x28]
sbb edx, dword [0x100a2eec]
call fcn.1007cff0
cvtsd2ss xmm0, xmm0
mov edx, dword [0x100a2ee4]
mov ecx, dword [0x100a2ee0]
movss dword [ebp - 0x24], xmm0
call fcn.1007cff0
cvtsd2ss xmm0, xmm0
movss xmm1, dword [ebp - 0x24]
divss xmm1, xmm0
mov edx, dword [ebp - 4]
movss dword [edx + 0x10], xmm1
mov eax, dword [ebp - 0x2c]
mov dword [0x100a2ee8], eax
mov ecx, dword [ebp - 0x28]
mov dword [0x100a2eec], ecx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x1003d84d
mov dword [ebp - 8], 1
jmp 0x1003d854
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 8]
mov byte [eax + 0xe9], cl
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x1003d87c
mov dword [ebp - 0xc], 1
jmp 0x1003d883
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 0xc]
mov byte [eax + 0xea], cl
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x1003d8ab
mov dword [ebp - 0x10], 1
jmp 0x1003d8b2
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 0x10]
mov byte [eax + 0xeb], cl
mov edx, dword [ebp - 4]
mov byte [edx + 0xec], 0
call fcn.1003d000
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0xe8]
test ecx, ecx
je 0x1003d8e4
mov dword [ebp - 0x14], 0xffffffff
jmp 0x1003d8ec
call fcn.10062100
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
mov eax, dword [0x100a1b74]
cmp eax, dword [ebp - 0x18]
je 0x1003d90a
mov ecx, dword [ebp - 0x18]
mov dword [0x100a1b74], ecx
call fcn.1003d100
mov esp, ebp
pop ebp
ret
Function at 0x100573f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100a2ef8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movss xmm0, dword [0x1009d140]
movss dword [ecx + 0x2b64], xmm0
cmp dword [ebp + 8], 0
jne 0x10057419
jmp 0x1005746d
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
call fcn.10057300
add esp, 4
mov dword [ebp - 0x10], eax
push 0x1008fb4c
mov eax, dword [ebp + 8]
push eax
call fcn.1005fe10
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1005744b
jmp 0x1005746d
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
push 1
mov eax, dword [ebp - 0x10]
push eax
call fcn.10018ac4
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.100182e1
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x1005fcc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
je 0x1005fcd2
cmp dword [ebp + 0xc], 0
jne 0x1005fce9
push 0x65f
push 0x1008da10
push str.filename__file_open_mode
call fcn.1001ed1e
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x1005fcf8
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1005fe10
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1005fd18
xor eax, eax
jmp 0x1005fe05
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001c8e7
add esp, 0xc
test eax, eax
jne 0x1005fd55
mov edx, dword [ebp - 4]
push edx
call fcn.1001cee0
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x1005fd55
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1001c8e7
add esp, 0xc
test eax, eax
je 0x1005fd68
mov ecx, dword [ebp - 4]
push ecx
call fcn.100182e1
add esp, 4
xor eax, eax
jmp 0x1005fe05
mov edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp + 0x14]
push eax
call fcn.1005cc50
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1005fd96
mov ecx, dword [ebp - 4]
push ecx
call fcn.100182e1
add esp, 4
xor eax, eax
jmp 0x1005fe05
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1001e4cc
add esp, 0x10
cmp eax, dword [ebp - 8]
je 0x1005fdcd
mov edx, dword [ebp - 4]
push edx
call fcn.100182e1
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.1005cc20
add esp, 4
xor eax, eax
jmp 0x1005fe05
cmp dword [ebp + 0x14], 0
jle 0x1005fde8
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 8]
push edx
call fcn.100143f0
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call fcn.100182e1
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x1005fe02
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x10060a50
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 4
shl eax, 0
cmp dword [eax + 0x100a3428], 0
jne 0x10060ad0
mov dword [ebp - 0x20], 0xedb88320
mov dword [ebp - 0x10], 0
jmp 0x10060a80
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x100
jae 0x10060ad0
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 0
jmp 0x10060aa1
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 8
jae 0x10060ac1
mov ecx, dword [ebp - 0x14]
shr ecx, 1
mov edx, dword [ebp - 0x14]
and edx, 1
neg edx
and edx, 0xedb88320
xor ecx, edx
mov dword [ebp - 0x14], ecx
jmp 0x10060a98
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax*4 + 0x100a3428], ecx
jmp 0x10060a77
mov edx, dword [ebp + 0x10]
not edx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jle 0x10060b2d
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x1c], 0
je 0x10060b2b
mov ecx, dword [ebp - 0xc]
shr ecx, 8
mov edx, dword [ebp - 0xc]
and edx, 0xff
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor edx, eax
xor ecx, dword [edx*4 + 0x100a3428]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x10060aea
jmp 0x10060b9e
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
movzx edx, byte [ebp - 1]
test edx, edx
je 0x10060b9e
movzx eax, byte [ebp - 1]
cmp eax, 0x23
jne 0x10060b7d
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x10060b7d
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x10060b7d
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 8
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
movzx edx, byte [ebp - 1]
xor ecx, edx
xor eax, dword [ecx*4 + 0x100a3428]
mov dword [ebp - 0xc], eax
jmp 0x10060b2d
mov eax, dword [ebp - 0xc]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x402b10
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
xor esi, esi
test ecx, ecx
je 0x402c11
test edx, edx
je 0x402c11
mov eax, 0x1505
cmp dword [esp + 0x2c], 0
je 0x402b63
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [edx + ebx]
test ebp, ebp
je 0x402b63
mov edi, eax
shl edi, 5
mov esi, edx
mov edx, edi
and edx, eax
xor edi, eax
add edi, ebp
lea eax, [edi + edx*2]
mov edx, esi
inc ebx
cmp dword [esp + 0x2c], ebx
jne 0x402b40
mov esi, dword [ecx + 0x20]
lea ebx, [esi - 1]
mov dword [esp + 0x10], esi
sub esi, 1
mov dword [esp + 0x14], esi
mov esi, 0
jb 0x402c11
mov dword [esp + 4], edx
mov dword [esp + 8], eax
and ebx, eax
mov dword [esp], ecx
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], eax
xor edi, edi
mov edx, ebx
jmp 0x402ba7
inc edi
cmp dword [esp + 0x10], edi
je 0x402c0f
mov eax, edi
and eax, edx
mov ecx, edi
xor ecx, edx
lea eax, [ecx + eax*2]
and eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov ebp, dword [ecx + eax*4]
cmp ebp, 0xffffffff
je 0x402c0f
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov ecx, dword [esp + 8]
cmp dword [eax + ebp*4], ecx
jne 0x402ba0
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + ebp*4]
push ebx
mov esi, edx
call fcn.00409070
mov edx, esi
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x402ba0
push dword [esp + 0x2c]
push ebx
push dword [esp + 0xc]
call fcn.00409090
mov edx, esi
add esp, 0xc
test eax, eax
jne 0x402ba0
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov esi, dword [eax + ebp*4]
jmp 0x402c11
xor esi, esi
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4039c0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x403b76
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x403b6f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x403a56
mov eax, dword [esp + 4]
sub eax, dword [esp]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 4]
mov ebx, 0x15b0
je 0x403b6f
xor edx, edx
cmp ebx, 8
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
jb 0x403ad8
and ebx, 0x1ff8
mov dword [esp], ebx
xor eax, eax
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx edi, byte [ebp + edx + 4]
add edi, esi
mov eax, ecx
and eax, edi
xor ecx, edi
movzx esi, byte [ebp + edx + 5]
add esi, edi
movzx ebx, byte [ebp + edx + 6]
add ebx, esi
add esi, ecx
lea ecx, [esi + eax*2]
movzx edi, byte [ebp + edx + 7]
add edi, ebx
add ecx, ebx
mov ebx, dword [esp + 4]
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, ebx
jb 0x403a70
add ebp, eax
mov esi, dword [esp + 8]
mov edx, dword [esp]
mov eax, edx
sub eax, ebx
jae 0x403a1d
mov dword [esp + 0xc], eax
mov eax, ebx
and eax, 3
mov dword [esp], edx
je 0x403b1f
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x403b00
mov eax, dword [esp]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x403a10
jmp 0x403b2e
mov eax, edx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x403a10
mov ebx, dword [esp + 4]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x403b40
jmp 0x403a10
shl ecx, 0x10
or ecx, edi
jmp 0x403b7b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403b90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x403c06
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
lea ecx, [esi + esi]
not ecx
add ecx, esi
test edx, edx
je 0x403bfd
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [eax + esi]
mov ebx, edi
xor ebx, 0x3ffffff0
mov ebp, edi
or ebp, 0xf
and ebp, ebx
mov ebx, ecx
and ecx, 0xf
xor ebp, ecx
shr ebx, 4
xor ebx, dword [ebp*4 + 0x43980c]
mov ecx, ebx
and ebx, 0xf
shr edi, 4
xor edi, ebx
shr ecx, 4
xor ecx, dword [edi*4 + 0x43980c]
inc esi
cmp edx, esi
jne 0x403bc0
lea eax, [ecx + ecx]
not eax
add eax, ecx
jmp 0x403c08
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40e090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x148
mov word [esp + 0x50], 0x9f39
mov dword [esp + 0x52], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x40e0f9
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x50]
add eax, 0x792b025
xor eax, ecx
mov dword [esp + 0xbc], eax
mov eax, dword [esp + 0xbc]
add al, 0x47
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x50], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x40e0c0
lea eax, [esp + 0x50]
push eax
push dword [ebp + 8]
call fcn.00402cf0
add esp, 8
mov esi, eax
xor ecx, ecx
test eax, eax
sete cl
xor ebx, ebx
xor eax, eax
jmp dword [ecx*4 + 0x43d2b8]
Function at 0x412c00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x14], esp
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x412c20
mov edi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x412c40
sar esi, 1
sar eax, 1
lea ecx, [esi + eax]
add ecx, 2
test ecx, ecx
jns 0x412c60
mov eax, 0xffffffff
jmp 0x412c69
add eax, esi
lea eax, [eax*2 + 4]
push eax
call fcn.00408f60
add esp, 4
movzx ecx, word [edi]
mov ebx, eax
test cx, cx
je 0x412ca1
add edi, 2
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x412c90
mov word [ebx], 0x5c
add ebx, 2
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x412cd3
add edx, 2
mov edi, dword [ebp - 0x14]
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x412cc0
jmp 0x412cd6
mov edi, dword [ebp - 0x14]
mov word [ebx], 0
lea ecx, [ebp - 0x18]
push 0x60
push 3
push 0x120089
push ecx
mov dword [ebp - 0x2c], eax
push eax
call fcn.004371a0
add esp, 0x14
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x43d75c]
Function at 0x413020
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x78
mov eax, dword [esp + 0x90]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x413040
sar esi, 1
lea ebx, [esp + 0x60]
push ebx
push 0
push 0
push esi
push eax
push 0
call dword [0x442ddc]
mov ebp, dword [esp + 0x60]
mov edi, 0xffffffff
test ebp, ebp
jns 0x413074
mov eax, 0xffffffff
jmp 0x41307b
lea eax, [ebp*2]
push eax
call fcn.00408f60
add esp, 4
push ebx
push ebp
mov dword [esp + 0x60], eax
push eax
push esi
mov ebx, dword [esp + 0xa0]
push ebx
push 0
call dword [0x442ddc]
mov eax, dword [esp + 0x60]
mov ecx, eax
add ecx, 0xd
js 0x4130ae
lea edi, [eax*2 + 0x1a]
push edi
call fcn.00408f60
add esp, 4
mov ebp, eax
mov dword [esp + 0x10], 0xf1c20fb0
mov dword [esp + 0x14], 0xf567f353
mov dword [esp + 0x18], 0xf916f760
mov dword [esp + 0x1c], 0xfd5dfb4e
mov dword [esp + 0x20], 0xe16bff6e
mov dword [esp + 0x24], 0xe573e34b
mov dword [esp + 0x28], 0xe9e6e74a
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x1b
ja 0x41312e
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
add eax, 0xb431e9fd
xor eax, ecx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x44]
add al, 0xf
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1c
jb 0x413100
mov edx, dword [esp + 0x58]
movzx ecx, word [edx]
mov eax, ebp
test cx, cx
je 0x413161
add edx, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413150
mov word [eax], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x413191
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x413180
mov word [eax], 0
lea eax, [esp + 8]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.004371a0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43d9cc]