joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a3c4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004057d4
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x49a52c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.00499d9c
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00499dbc
mov ebx, eax
jmp 0x49a4fe
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004055c4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040abac
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409884
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409884
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.0040577c
je 0x49a4de
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004055c4
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409884
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409884
mov edx, dword [ebp - 0x148]
pop eax
call fcn.0040577c
jne 0x49a4f3
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.00499ddc
mov ebx, eax
test ebx, ebx
jne 0x49a43f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a533
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00405378
lea eax, [ebp - 4]
call fcn.00405354
ret
Function at 0x49cd64
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49ce35
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x104]
call fcn.0040b008
lea ecx, [ebp - 0x108]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0043c8f4
mov eax, dword [ebp - 0x108]
mov edx, 0x49ce4c
call fcn.0040577c
je 0x49ce05
lea ecx, [ebp - 0x10c]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0043c8f4
mov eax, dword [ebp - 0x10c]
mov edx, 0x49ce58
call fcn.0040577c
je 0x49ce05
lea eax, [ebp - 4]
mov edx, 0x49ce4c
call fcn.00405620
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004053a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ce3c
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.00405378
lea eax, [ebp - 4]
call fcn.00405354
ret
Function at 0x49eaf8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov eax, 0x49d93c
call fcn.00407620
mov eax, dword [0x4a4688]
mov eax, dword [eax]
call fcn.00473574
mov eax, 0x49ec94
call fcn.0040a63c
test al, al
jne 0x49eb2f
mov eax, 0x49ec94
call fcn.0040a660
push 0x49eca0
call sub.kernel32.dll_DeleteFileA
mov ecx, 0x49ecbc
mov edx, 0x49ecd8
mov eax, 0x49ece4
call fcn.0049d82c
mov eax, 0x49ecbc
call fcn.0040a618
test al, al
jne 0x49eb76
mov eax, 0x49ecf4
call fcn.004465cc
mov eax, dword [0x4a4688]
mov eax, dword [eax]
call fcn.00473730
jmp 0x49ec82
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4823cc]
call fcn.00487010
mov ebx, eax
mov edx, 0x49ecbc
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, 0x49ec94
mov eax, ebx
call fcn.00487784
mov byte [ebx + 0x39], 1
mov byte [ebx + 0x50], 1
mov byte [ebx + 0x3a], 1
mov byte [ebx + 0x40], 1
xor eax, eax
push ebp
push 0x49ebcd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00488074
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49ebd7
mov dl, 1
mov eax, 0x49ed50
call fcn.0049d740
mov eax, dword [0x4a4688]
mov eax, dword [eax]
call fcn.00473460
xor eax, eax
push ebp
push 0x49ec1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x4a47f0]
mov eax, dword [0x4a4688]
mov eax, dword [eax]
mov edx, dword [0x49a700]
call fcn.0047358c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49ec46
mov ecx, dword [0x4a4838]
mov eax, dword [0x4a4688]
mov eax, dword [eax]
mov edx, dword [0x497030]
call fcn.0047358c
mov ecx, dword [0x4a463c]
mov eax, dword [0x4a4688]
mov eax, dword [eax]
mov edx, dword [0x49a53c]
call fcn.0047358c
mov eax, dword [0x4a4688]
mov eax, dword [eax]
call fcn.0047360c
pop edi
pop esi
pop ebx
call fcn.00405240
add byte [eax], al
Function at 0x9f9d13
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf09eb038
jmp 0x9f9d52
call fcn.009f9cc9
mov dword [esp + 0x54], edi
lea esp, [esp + 0x54]
jmp 0x9f9d36
pushfd
jmp 0x9f9b7c
bsr di, dx
jp 0x9f9d5b
mov dh, 0x4c
setl dh
jmp 0x9f9d66
lea ebp, [edx*4]
jmp 0x9f9d3c
mov dh, 0x4c
setl dh
call fcn.009f9d9e
mov si, word [esp + 0x2c]
mov esi, dword [esp + 0x2c]
xor ebx, ecx
jmp 0x9f9dfb
jo 0x9f9e11
not bh
xchg ebx, edi
jmp 0x9f9e1e
not bh
xchg ebx, edi
not di
jmp 0x9f9fad
not di
jmp 0x9f9fad
jmp 0x9f9ec5
stc
xor dh, ch
jmp 0x9f9e62
cpuid
mov ebx, esi
mov ax, word [esp]
mov eax, dword [esp]
pushfd
jmp 0x9f9ea4
bsf ebx, edx
jb 0x9f9e59
stc
xor dh, ch
cpuid
jmp 0x9f9e64
mov ax, cx
mov cx, word [esp]
jmp 0x9f9f27
or cx, 0x9c83
jnp 0x9f9e8e
mov ax, cx
mov cx, word [esp]
mov cx, 0x2105
mov cx, word [esp]
jmp 0x9f9f2f
setp cl
sub esp, 0xc0
mov ebp, esp
jmp 0x9f9e82
mov dl, bl
bswap ecx
jmp 0x9f9f00
bswap ecx
rdtsc
jmp 0x9f9f04
shl ch, 7
jns 0x9f9ed2
mov dl, bl
bswap ecx
jmp 0x9f9ed8
bswap ecx
rdtsc
dec esi
setbe al
jmp 0x9f9f0e
cmc
jae 0x9f9f49
bswap eax
xchg dh, al
rol al, cl
xor dx, ax
jmp 0x9f9f65
mov cx, 0x2105
mov cx, word [esp]
not esi
jmp 0x9f9ef1
rol al, cl
xor dx, ax
jmp 0x9f9f65
bswap eax
xchg dh, al
jmp 0x9f9f33
jmp 0x9f9f8e
add esi, 0x52a7df37
mov ax, word [esp]
adc dx, 0xa54
ja 0x9f9f4f
jbe 0x9f9f4f
neg al
jge 0x9fa042
jl 0x9fa042
int3
push edi
ljmp 0xc90f
not esi
bswap ecx
lea ecx, reloc.kernel32.dll_DeleteCriticalSection
call 0x9f9f78
mov ah, 0x34
stosb byte es:[edi], al
int 0x3c
mov fs, word [edx + 0x23d0b121]
loop 0x9f9f8a
and ebx, dword [edx - 0x4b]
lea edi, [esp]
lea ebp, [eax*4]
lea ebx, [ebx*4]
and ebx, edi
jnp 0x9f9e26
setp cl
jmp 0x9f9ec8
mov al, dl
jmp 0x9fa00e
ror esi, 0
rdtsc
ror ah, 6
jbe 0x9f9fce
mov al, dl
dec dx
jmp 0x9fa010
jmp 0x9fa020
dec dx
add esi, dword [edi]
inc dl
jno 0x9f9ff4
mov al, bl
mov dh, ch
jmp fcn.009f9ff6
mov al, bl
mov dh, ch
jmp fcn.009f9ff6
jmp 0x9f9fe4

Function at 0x9f9d7f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], ebx
call 0x9f9cfd
dec ax
sub esp, 0xb
add esp, 8
mov bp, si
lea esp, [esp + 3]
jmp 0x9f9db1
lea edx, [edx + 1]
shl cx, 0xa
mov eax, 0x5d41030f
btr cx, ax
bswap ecx
xchg dword [esp], edx
jmp 0x9f9df2
mov edx, ebx
neg dl
call fcn.009f9dda

Function at 0x9f9d9e
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bh, dh
sub ecx, 0x45ccc859
clc
mov eax, 0xf9a21979
xchg dword [esp], edx
jmp 0x9f9d88
Function at 0x9fcb9f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf09eb038
jmp 0x9fcc43
call fcn.009fcb38
pushal
lea esp, [esp + 0x17]
push dword [esp + 2]
je 0x9fcbc8
lea esp, [esp + 1]
jmp 0x9fcbec
lea esp, [esp + 1]
jmp 0x9fcc02
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
jmp 0x9fcc0a
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
pushfd
jmp 0x9fbc6e
mov ax, word [esp]
jmp 0x9fcc2d

Function at 0x9fcbba
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0x28], esi
jmp 0x9fcba4

Function at 0x9fccf5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp]
lea edx, [esi*4]
neg al
lea eax, [esi + ebp]
xchg ebx, eax
jmp 0x9fcd48
neg bl
inc ax
setne bh
mov ax, 0x920
xchg dword [esp + 4], ecx
jmp 0x9fcd9a
xchg dword [esp], ecx
xchg dh, dl
bt edx, edx
push ebp
lea ecx, [ecx - 0x24]
mov ebx, dword [esp]
jmp 0x9fcd32
mov edx, ebx
call fcn.009fcd84

Function at 0xa0059f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 1], esi
jmp 0xa00688
mov dword [esp], esp
push dword [esp + 3]
jne 0xa00589
mov dword [esp + 1], esi
mov byte [esp], al
mov dword [esp + 0xc], ebx
mov byte [esp], al
mov dword [esp + 0xc], ebx
Function at 0xaeca71
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x26]
bswap ebp
xchg bl, cl
jmp 0xaeca5b
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x421008]
jne 0x40100a
repz ret
jmp fcn.00401910

Function at 0x4050fa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004038b7
and dword [ebp - 4], 0
cmp dword [0x422d70], 0
mov ebx, eax
jne 0x4051ab
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40525c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40525c
push eax
call fcn.00403845
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x422d70], eax
call esi
push eax
call fcn.00403845
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x422d74], eax
call esi
push eax
call fcn.00403845
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x422d78], eax
call esi
push eax
call fcn.00403845
pop ecx
mov dword [0x422d80], eax
test eax, eax
je 0x4051ab
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403845
pop ecx
mov dword [0x422d7c], eax
mov eax, dword [0x422d7c]
cmp eax, ebx
je 0x405203
cmp dword [0x422d80], ebx
je 0x405203
push eax
call fcn.004038c0
push dword [0x422d80]
mov esi, eax
call fcn.004038c0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405203
test edi, edi
je 0x405203
call esi
test eax, eax
je 0x4051fa
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4051fa
test byte [ebp - 0xc], 1
jne 0x405203
or dword [ebp + 0x10], 0x200000
jmp 0x40523c
mov eax, dword [0x422d74]
cmp eax, ebx
je 0x40523c
push eax
call fcn.004038c0
pop ecx
test eax, eax
je 0x40523c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40523c
mov eax, dword [0x422d78]
cmp eax, ebx
je 0x40523c
push eax
call fcn.004038c0
pop ecx
test eax, eax
je 0x40523c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x422d70]
call fcn.004038c0
pop ecx
test eax, eax
je 0x40525c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40525e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41d980
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x404
mov eax, dword [0x421008]
xor eax, esp
mov dword [esp + 0x400], eax
cmp dword [0x2a5d99c], 0x114e
mov eax, dword [esp + 0x408]
mov dword [0x2a5d7e0], eax
jne 0x41d9c1
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00401000
add esp, 0x404
ret
Function at 0x41d9f0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x818
mov eax, dword [0x421008]
xor eax, esp
mov dword [esp + 0x814], eax
mov eax, dword [esp + 0x81c]
push edi
xor edi, edi
cmp dword [esp + 0x824], edi
mov dword [esp + 0xc], eax
jle 0x41dae0
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push esi
lea esp, [esp]
lea esi, [esp + 0x1c]
mov dword [esp + 0x14], 5
mov dword [esp + 0x1c], 0
call fcn.0041d9e0
mov eax, dword [esp + 0x1c]
add eax, 0x46
mov dword [esp + 0x14], eax
nop
sub dword [esp + 0x14], 0x46
mov ecx, dword [esp + 0x18]
movsx edx, byte [ecx + edi]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x14]
xor dword [esp + 0x10], eax
mov esi, dword [esp + 0x830]
mov al, byte [esp + 0x10]
mov byte [ecx + edi], al
cmp esi, 0xf
jne 0x41dad4
push 0
push 0
call ebp
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push str.razigo
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectW]
push 0
lea eax, [esp + 0x428]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push ebx
push str.gecucufemesixihor
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
inc edi
cmp edi, esi
jl 0x41da30
pop esi
pop ebp
pop ebx
cmp dword [esp + 0x824], 0x2d
pop edi
jne 0x41daff
mov dword [0x2a5dad0], 0xa62e7790
mov dword [0x2a5dad4], 0xffffffff
mov ecx, dword [esp + 0x814]
xor ecx, esp
call fcn.00401000
add esp, 0x818
ret

Function at 0x41db20
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x804
mov eax, dword [0x421008]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [0x421fe0]
push esi
mov esi, dword [0x2a5d99c]
push edi
mov edi, dword [0x2a5d7e4]
push eax
call fcn.0041d980
add esp, 4
cmp dword [0x2a5d99c], 0x2f
jne 0x41db5f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
push edi
call fcn.0041d9f0
add esp, 8
cmp dword [0x2a5d99c], 0x568
pop edi
pop esi
jne 0x41db98
push 0
push 0
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push 0
lea edx, [esp + 0x404]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00401000
add esp, 0x804
ret
Function at 0x4546f2
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00454771
jae 0x4546fe
xor ecx, ecx
call fcn.00454771
jae 0x454728
xor eax, eax
call fcn.00454771
jae 0x454739
mov al, 0x10
call fcn.00454771
adc al, al
jae 0x45471a
jne 0x454766
stosb byte es:[edi], al
jmp 0x4546ff
call fcn.0045477d
dec ecx
loop 0x454745
mov eax, ebp
call fcn.0045477b
jmp 0x454767
lodsb al, byte [esi]
shr eax, 1
je 0x45478d
adc ecx, 2
mov ebp, eax
jmp 0x454767
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0045477b
cmp eax, 0x7d00
jae 0x454765
cmp eax, 0x500
jae 0x454766
cmp eax, 0x7f
ja 0x454767
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4546ff
pop ebp
ret 8

Function at 0x7ffe53fb
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
nop
and bh, 0xff
clc
lea esp, [esp]
nop
pushal
inc eax
popal
cld
push edx
cdq
pop edx
stc
push edx
cdq
pop edx
cld
pushal
inc eax
popal
cld
and bh, 0xff
nop
add eax, 0
clc
lea esp, [esp]
clc
add eax, 0
cld
pushal
inc eax
popal
cld
and bh, 0xff
cld
pushal
inc eax
popal
stc
pushal
inc eax
popal
cld
stc
call 0x7ffe5440
pop edx
lea esp, [esp]
xor dx, dx
nop
nop
add edx, 0xd5e0
lea esp, [esp]
cld
clc
xor ecx, ecx
stc
stc
stc
nop
mov cl, 0x1e
cld
pushal
inc eax
popal
nop
clc
nop
xor byte [ecx + edx], 0xbe
loop 0x7ffe5463
and bh, 0xff
cld
stc
nop
push dword fs:[0x24]
cld
pop dword [edx + 0xa]
mov cl, 0xff
pushal
inc eax
popal
push edx
loop 0x7ffe547f
cld
nop
mov dword [edx + 0x11], 0xffffacbb
add eax, 0
clc
nop
mov ecx, dword [eax + 0x2c]
cld
add eax, 0
mov dword [edx + 0x1b], ecx
clc
and bh, 0xff
clc
cld
cld
mov dword [edx + 0x100], ecx
lea esp, [esp]
inc esi
dec esi
nop
mov dword [eax + 0x2c], esp
stc
push 0
push 0
add eax, 0
push 0
clc
clc
push 0
stc
lea esp, [esp]
cld
push 0x30
lea esp, [esp]
stc
push 0x20
lea esp, [esp]
nop
cld
stc
cld
push 0
cld
and bh, 0xff
clc
cld
push 0
nop
add edx, 0xffff7f35
push edx
push es
pop ds
stc
push edx
cld
cld
push 0
pushal
inc eax
popal
nop
cld
call dword [edx + 0x820e]
nop
and al, 0xff
cld
add esp, 0x3f8
push edx
cdq
pop edx
stc
nop
cld
clc
xor eax, eax
nop
and bh, 0xff
clc
cld
inc eax
cld
ret 0xc
Function at 0x403c10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a2d3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x424008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x425810
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x425810
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x42170c
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00402f60
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x409fa6
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x409fe1
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x409fc8
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x409fd9
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x409fe3
inc edi
add eax, 0x28
cmp edi, esi
jb 0x409fbe
xor eax, eax
pop edi
pop esi
ret

Function at 0x40a674
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40a63d
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40a65b
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
add byte [eax], al
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
push dword [ebx]
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40a6b9
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax - 0x77], al
jge 0x40a698
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40a6a0
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40a6a9
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40a6b3
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40a695
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
invalid
invalid
jmp dword [esi - 0x75]
dec ebp
or al, 0x66
cmp ecx, dword [eax + 6]
jbe 0x40a61f
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x40a683
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40a63d
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40a65b
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
add byte [eax], al
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
push dword [ebx]
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40a6b9
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax - 0x77], al
jge 0x40a698
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40a6a0
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40a6a9
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40a6b3
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40a695
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
invalid
invalid
jmp dword [esi - 0x75]
dec ebp
or al, 0x66
cmp ecx, dword [eax + 6]
jbe 0x40a61f
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x40a699
Capabilities:
Inspect section memory permissions

Disassembly:
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4

Function at 0x40ab97
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
invalid
test esi, esi
cli
invalid
Function at 0x1891130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x10]
test ecx, ecx
mov al, byte [edx + 0x101]
push ebx
mov bl, byte [edx + 0x100]
jbe 0x18911c1
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
sub esi, ebp
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], ecx
jmp 0x1891164
mov al, byte [esp + 0x14]
inc bl
movzx ecx, bl
lea esi, [ecx + edx]
mov cl, byte [esi]
add al, cl
mov byte [esp + 0x14], al
movzx eax, al
lea edi, [eax + edx]
xor eax, eax
mov al, byte [edi]
mov byte [esi], al
mov esi, dword [esp + 0x1c]
test esi, esi
mov byte [edi], cl
je 0x189119e
add eax, ecx
and eax, 0xff
mov cl, byte [eax + edx]
mov eax, dword [esp + 0x18]
xor cl, byte [eax + ebp]
mov byte [ebp], cl
mov eax, dword [esp + 0x20]
inc ebp
dec eax
mov dword [esp + 0x20], eax
jne 0x1891160
mov cl, byte [esp + 0x14]
pop edi
pop esi
pop ebp
mov byte [edx + 0x100], bl
mov byte [edx + 0x101], cl
pop ebx
ret 0x10
mov byte [edx + 0x100], bl
mov byte [edx + 0x101], al
pop ebx
ret 0x10
Function at 0x409b6f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x458da0]
jne 0x409b79
repz ret
jmp fcn.0040e731

Function at 0x40b063
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004071ab
and dword [ebp - 4], 0
cmp dword [0x45e800], 0
mov ebx, eax
jne 0x40b114
push 0x401ab8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b1c5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401aac
push edi
call esi
test eax, eax
je 0x40b1c5
push eax
call fcn.00407139
mov dword [esp], 0x401a9c
push edi
mov dword [0x45e800], eax
call esi
push eax
call fcn.00407139
mov dword [esp], 0x401a88
push edi
mov dword [0x45e804], eax
call esi
push eax
call fcn.00407139
mov dword [esp], 0x401a6c
push edi
mov dword [0x45e808], eax
call esi
push eax
call fcn.00407139
pop ecx
mov dword [0x45e810], eax
test eax, eax
je 0x40b114
push 0x401a54
push edi
call esi
push eax
call fcn.00407139
pop ecx
mov dword [0x45e80c], eax
mov eax, dword [0x45e80c]
cmp eax, ebx
je 0x40b16c
cmp dword [0x45e810], ebx
je 0x40b16c
push eax
call fcn.004071b4
push dword [0x45e810]
mov esi, eax
call fcn.004071b4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b16c
test edi, edi
je 0x40b16c
call esi
test eax, eax
je 0x40b163
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b163
test byte [ebp - 0xc], 1
jne 0x40b16c
or dword [ebp + 0x10], 0x200000
jmp 0x40b1a5
mov eax, dword [0x45e804]
cmp eax, ebx
je 0x40b1a5
push eax
call fcn.004071b4
pop ecx
test eax, eax
je 0x40b1a5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b1a5
mov eax, dword [0x45e808]
cmp eax, ebx
je 0x40b1a5
push eax
call fcn.004071b4
pop ecx
test eax, eax
je 0x40b1a5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45e800]
call fcn.004071b4
pop ecx
test eax, eax
je 0x40b1c5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b1c7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret