joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x407b00
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x41653e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0040e400
xor edi, edi
mov eax, 0x41a048
mov dword [esp + 0x1c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x6c]
mov byte [esp + 0x1c], 3
call fcn.00414aa2
lea ecx, [esi + 0x70]
mov byte [esp + 0x1c], 4
call fcn.00414aa2
lea ecx, [esi + 0x74]
mov byte [esp + 0x1c], 5
call fcn.00414aa2
lea ebp, [esi + 0x78]
mov byte [esp + 0x1c], 6
mov ecx, ebp
call fcn.00414aa2
lea ebx, [esi + 0x7c]
mov byte [esp + 0x1c], 7
mov ecx, ebx
call fcn.00414aa2
lea ecx, [esi + 0x80]
mov byte [esp + 0x1c], 8
call fcn.00414aa2
lea edx, [esi + 0x10]
mov eax, 0xa
mov ecx, eax
push str.Arial
mov dword [edx], eax
mov byte [esp + 0x20], 9
mov dword [esi], fcn.0040e540
mov dword [esi + 0x50], edi
mov dword [edx + 4], ecx
xor ecx, ecx
mov dword [esi + 0x5c], 1
mov dword [esi + 0x60], edi
mov dword [edx + 8], eax
mov dword [esi + 0x68], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x90], eax
mov ecx, ebp
mov dword [esi + 0x94], edi
mov dword [esi + 0x64], edi
call fcn.00414a9c
push str.Times_New_Roman
mov ecx, ebx
call fcn.00414a9c
push str.Arial
lea ecx, [esi + 0x80]
call fcn.00414a9c
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x84], 0xc
mov dword [esi + 0x88], 6
mov dword [esi + 0x8c], 0xa
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x407ce0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4165f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], fcn.0040e540
mov eax, dword [esi + 0x60]
mov dword [esp + 0x18], 9
test eax, eax
je 0x407d6c
mov eax, dword [esi + 0x50]
test eax, eax
je 0x407d25
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esi + 0x54]
test eax, eax
je 0x407d35
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esi + 0x58]
test eax, eax
je 0x407d6c
mov eax, dword [esi + 0x60]
xor edi, edi
test eax, eax
jle 0x407d60
mov eax, dword [esi + 0x58]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x407d58
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esi + 0x60]
inc edi
cmp edi, eax
jl 0x407d45
mov eax, dword [esi + 0x58]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esi + 0x80]
mov byte [esp + 0x18], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x7c]
mov byte [esp + 0x18], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x78]
mov byte [esp + 0x18], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x74]
mov byte [esp + 0x18], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x6c]
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CString::CString
lea edi, [esi + 0x30]
mov dword [esp + 0xc], edi
mov dword [edi], 0x419ff4
mov ecx, edi
mov byte [esp + 0x18], 0xa
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [edi], 0x41a008
lea edi, [esi + 0x28]
mov dword [esp + 0xc], edi
mov dword [edi], 0x419ff4
mov ecx, edi
mov byte [esp + 0x18], 0xb
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [edi], 0x41a008
lea edi, [esi + 0x20]
mov dword [esp + 0xc], edi
mov dword [edi], 0x419ff4
mov ecx, edi
mov byte [esp + 0x18], 0xc
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, esi
mov dword [edi], 0x41a008
mov dword [esp + 0x18], 0xffffffff
call fcn.0040e480
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x408c80
Capabilities:
Start service

Disassembly:
push ebx
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x408cc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x408cc9
mov esi, dword [sym.imp.MSVCRT.dll_printf]
push str.IsaAdSys:_You_do_not_have_rights_to_access_the_Service_Control_Manager_and_n
call esi
push str.IsaAdSys:_the_IsaAdSys_driver_is_not_installed_or_started._Please_ask__n
call esi
push str.IsaAdSys:_your_administrator_to_install_the_driver_on_your_behalf._n
call esi
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret
mov ebx, dword [sym.imp.MSVCRT.dll_printf]
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push 0xf01ff
push str.IsaAdSys
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x408d39
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x408d28
cmp eax, 0x7b
je 0x408d17
cmp eax, 0x424
jne 0x408cd5
push str.IsaAdSys:_The_IsaAdSys_driver_does_not_exist._Installing_driver._n
call ebx
push str.IsaAdSys:_This_can_take_up_to_30_seconds_on_some_machines_._._n
call ebx
add esp, 8
call fcn.00408da0
jmp 0x408cd5
push str.IsaAdSys:_The_specified_service_name_is_invalid._n
call ebx
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret
push str.IsaAdSys:_You_do_not_have_rights_to_the_IsaAdSys_service_database_n
call ebx
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x408d60
push str.IsaAdSys:_The_IsaAdSys_driver_has_been_successfully_started._n
call ebx
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x408d85
push str.IsaAdSys:_The_IsaAdSys_driver_is_already_running._n
call ebx
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
push str.IsaAdSys:_Unknown_error_while_starting_IsaAdSys_driver_service._n
call ebx
push str.IsaAdSys:_Does_IsaAdSys.SYS_exist_in_your_System32Drivers_Directory__n
call ebx
add esp, 8
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x408da0
Capabilities:
Copy file
Create service
Get common file path

Disassembly:
sub esp, 0x50
lea eax, [esp]
push esi
push edi
push 0x37
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.MSVCRT.dll_printf]
test eax, eax
jne 0x408dcd
push str.IsaAdSys:_Failed_to_get_System_Directory._Is_System_Directory_Path___55_Characters__n
call esi
push str.IsaAdSys:_Please_manually_copy_driver_to_your_system32_driver_directory._n
call esi
add esp, 8
lea ecx, [esp + 8]
push str.DriversIsaAdSys.sys
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 8]
push edx
push str.IsaAdSys:_Copying_driver_to__s_n
call esi
add esp, 8
lea eax, [esp + 8]
push 0
push eax
push str.IsaAdSys.sys
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x408e18
lea ecx, [esp + 8]
push ecx
push str.IsaAdSys:_Failed_to_copy_driver_to__s_n
call esi
push str.IsaAdSys:_Please_manually_copy_driver_to_your_system32_driver_directory._n
call esi
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0
push 0
push 0
push 0
push 0
push str.System32DriversIsaAdSys.sys
push 1
push 3
push 1
push 0xf01ff
push str.IsaAdSys
push str.IsaAdSys
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
test edi, edi
jne 0x408e93
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x408e7c
push str.IsaAdSys:_Driver_already_exists._No_action_taken._n
call esi
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
add esp, 0x50
ret
push str.IsaAdSys:_Unknown_error_while_creating_Service._n
call esi
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
add esp, 0x50
ret
push str.IsaAdSys:_Driver_successfully_installed._n
call esi
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
add esp, 0x50
ret
Function at 0x409be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
xor esi, esi
xor eax, eax
cmp word [ebp + 8], si
push edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0x12
setne al
add eax, 0x328
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0x40
mov byte [esp + 0x14], 0
mov edi, eax
mov bl, byte [esp + esi*4 + 0x18]
push ebx
push edi
call fcn.00408b50
mov cl, byte [esp + 0x1c]
add esp, 8
xor cl, bl
test esi, esi
mov byte [esp + 0x14], cl
jne 0x409c3f
fild dword [0x423800]
jmp 0x409c45
fild dword [0x423808]
mov ecx, dword [esp + 0x10]
sub esp, 8
fstp qword [esp]
call fcn.00409f00
inc esi
cmp esi, 3
jl 0x409c1b
mov ecx, dword [esp + 0x14]
push ecx
push edi
call fcn.00408b50
fild dword [0x423804]
mov ecx, dword [esp + 0x18]
fstp qword [esp]
call fcn.00409f00
fild dword [0x423808]
xor bl, bl
xor esi, esi
fstp qword [esp + 0x18]
push edi
call fcn.00408ba0
mov edx, dword [esp + 0x20]
and eax, 0xff
add esp, 4
mov dword [esi + 0x422390], eax
mov cl, al
mov eax, dword [esp + 0x18]
xor bl, cl
mov ecx, dword [esp + 0x10]
push edx
push eax
call fcn.00409f00
push edi
call fcn.00408ba0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
add esp, 4
and eax, 0xff
mov dword [esi + 0x4222f0], eax
xor bl, al
push ecx
mov ecx, dword [esp + 0x14]
push edx
call fcn.00409f00
add esi, 4
cmp esi, 0x80
jl 0x409c85
push edi
call fcn.00408ba0
mov ecx, dword [esp + 0x1c]
and eax, 0xff
add esp, 4
mov dword [0x422410], eax
xor bl, al
mov eax, dword [esp + 0x1c]
push eax
push ecx
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x1c], bl
call fcn.00409f00
push edi
call fcn.00408ba0
mov ecx, dword [0x422410]
add esp, 4
and eax, 0xff
cmp ecx, 0xa5
mov dword [0x422370], eax
jne 0x409d8d
mov edx, dword [esp + 0x14]
and edx, 0xff
cmp eax, edx
jne 0x409d8d
mov edx, dword [ebp + 8]
and edx, 0xffff
mov ecx, edx
shl ecx, 7
add ecx, 0x42367c
xor eax, eax
mov esi, dword [eax + 0x422390]
mov edi, dword [eax + 0x4222f0]
shl esi, 8
add esi, edi
add eax, 4
mov dword [ecx], esi
add ecx, 4
cmp eax, 0x80
jl 0x409d55
mov dword [edx*4 + 0x4221d4], 0
mov ax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
and eax, 0xffff
mov edx, dword [eax*4 + 0x4221d4]
lea eax, [eax*4 + 0x4221d4]
inc edx
mov ecx, edx
mov dword [eax], edx
cmp ecx, 0xf
jle 0x409db3
mov dword [eax], 0
pop edi
pop esi
mov ax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], 0x80
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x20
mov byte [esp + 0x10], 0
xor esi, esi
mov bl, byte [esp + esi*4 + 0x14]
push ebx
push 0x308
call fcn.00408b50
mov cl, byte [esp + 0x18]
add esp, 8
xor cl, bl
test esi, esi
mov byte [esp + 0x10], cl
jne 0x409e14
push 0x405b8000
jmp 0x409e19
push 0x40340000
push 0
mov ecx, edi
call fcn.00409f00
inc esi
cmp esi, 3
jl 0x409ded
mov eax, dword [esp + 0x10]
push eax
push 0x308
call fcn.00408b50
add esp, 8
mov ecx, edi
push 0x40440000
push 0
call fcn.00409f00
xor bl, bl
mov esi, 0x4235fc
mov cl, byte [esi]
push ecx
push 0x308
call fcn.00408b50
mov cl, byte [esi]
add esp, 8
xor bl, cl
mov ecx, edi
push 0x40340000
push 0
call fcn.00409f00
add esi, 4
cmp esi, 0x42367c
jl 0x409e4f
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x10]
push edx
push 0x308
call fcn.00408b50
add esp, 8
mov ecx, edi
push 0x40440000
push 0
call fcn.00409f00
push 0x308
call fcn.00408ba0
add esp, 4
cmp al, 0xa5
jne 0x409ec4
mov dword [0x4221dc], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4221dc]
inc eax
cmp eax, 0xa
mov dword [0x4221dc], eax
jle 0x409ef0
push 0xf1
push 0x308
mov dword [0x4221dc], 0
call fcn.00408b50
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x409f00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x18
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x409f1c
fild qword [esp]
fstp qword [esp + 0x10]
jmp 0x409f2a
push 0
push 0
push str.Error
call sub.MFC42.DLL_AfxMessageBox
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push esi
lea ecx, [esp + 8]
push edi
push ecx
call ebx
mov edi, dword [esp + 0xc]
xor esi, esi
lea edx, [esp + 0xc]
push edx
call ebx
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp eax, esi
jl 0x409f5d
jg 0x409f57
cmp ecx, edi
jb 0x409f5d
sub ecx, edi
sbb eax, esi
jmp 0x409f67
sub ecx, edi
sbb eax, esi
add ecx, 0xffffffff
adc eax, 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
fild qword [esp + 0x14]
fdiv qword [esp + 0x1c]
fmul qword [0x41a488]
fcomp qword [esp + 0x28]
fnstsw ax
test ah, 1
jne 0x409f40
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
Function at 0x4101f6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.004102c2
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x78
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 8], 0x41
mov byte [ebp - 0x11], 0x56
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 7], bl
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6e
mov dword [ebp - 0xa8], 0x94
call fcn.004102f1
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0xa8]
push ecx
call eax
test eax, eax
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
jne 0x410282
call fcn.004102c2
add esp, 0xc
xor eax, eax
jmp 0x4102bf
call fcn.004102c2
mov eax, dword [ebp - 0x98]
add esp, 0xc
sub eax, ebx
je 0x4102bc
dec eax
je 0x41029c
dec eax
je 0x4102ae
jmp 0x41027e
cmp dword [ebp - 0xa0], ebx
jne 0x4102a8
push 4
jmp 0x4102be
jbe 0x4102ae
push 5
jmp 0x4102be
cmp dword [ebp - 0xa4], 5
sbb eax, eax
add eax, 7
jmp 0x4102bf
push 3
pop eax
pop ebx
leave
ret

Function at 0x4102f1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004102c2
mov eax, dword [0x420194]
and byte [ebp - 8], 0
add esp, 0xc
cmp eax, 1
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0x14], 0x6b
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
jne 0x410354
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x420194], eax
leave
ret
Function at 0x410f7f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x14
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.004102c2
and byte [ebp - 0x17], 0
add esp, 0xc
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x53
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x6d
mov byte [ebp - 0x1b], 0x54
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x18], 0x65
call fcn.004102f1
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410fe7
lea ecx, [ebp - 0x10]
push ecx
call eax
push esi
push 0x14
movzx esi, word [ebp - 0x10]
movzx eax, word [ebp - 0xe]
imul esi, esi, 0xd
add esi, eax
push 0
movzx eax, word [ebp - 0xa]
imul esi, esi, 0x1e
add esi, eax
movzx eax, word [ebp - 8]
imul esi, esi, 0x1a
imul eax, eax, 0x3d
add esi, eax
movzx eax, word [ebp - 6]
add esi, eax
movzx eax, word [ebp - 4]
imul esi, esi, 0x3c
add esi, eax
movzx eax, word [ebp - 2]
imul esi, esi, 0x4d2
add esi, eax
lea eax, [ebp - 0x24]
push eax
call fcn.004102c2
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x41103a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
xor ebx, ebx
push 0x11
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.004102c2
add esp, 0xc
mov byte [ebp - 0x20], 0x2a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x1f], 0x89
mov byte [ebp - 0xf], 0x21
mov byte [ebp - 0x1e], 0xed
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0x1d], 0x5e
mov byte [ebp - 0xd], 0xa4
mov byte [ebp - 0x1c], 0x49
mov byte [ebp - 0xc], 0x10
mov byte [ebp - 0x1b], 0x26
mov byte [ebp - 0xb], 0x7e
mov byte [ebp - 0x1a], 0x40
mov byte [ebp - 0xa], 0x51
mov byte [ebp - 0x19], 0x19
mov byte [ebp - 9], 0x25
mov byte [ebp - 0x18], 0x80
mov byte [ebp - 8], 0x25
mov byte [ebp - 0x17], 0x40
mov byte [ebp - 7], bl
mov byte [ebp - 0x16], 0xe2
mov byte [ebp - 6], bl
mov byte [ebp - 0x15], 0x51
mov byte [ebp - 5], 0x2d
mov byte [ebp - 0x14], 0xaa
mov byte [ebp - 4], bl
mov byte [ebp - 0x13], 0xfa
mov byte [ebp - 3], bl
mov byte [ebp - 0x12], 0xdb
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x53
mov byte [ebp - 0x30], 0x79
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x6d
mov byte [ebp - 0x2b], 0x54
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x6d
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], bl
call fcn.004102f1
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x58]
push ecx
call eax
mov ax, word [ebp - 0x58]
xor ecx, ecx
mov cl, ah
mov byte [ebp - 7], al
mov ax, word [ebp - 0x56]
mov byte [ebp - 6], cl
xor ecx, ecx
mov byte [ebp - 4], al
mov cl, ah
lea eax, [ebp - 0xc8]
push eax
mov byte [ebp - 5], 0x2d
mov byte [ebp - 3], cl
call fcn.004111b4
lea eax, [ebp - 0x20]
push 0x1e
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.004111dc
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0041127a
add esp, 0x18
xor eax, eax
cmp byte [eax + ebp - 0x48], bl
lea ecx, [eax + ebp - 0x48]
jne 0x411176
mov byte [ecx], 1
inc eax
cmp eax, 0x10
jl 0x411169
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00411ec0
movzx ax, byte [ebp + 8]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00411c66
push dword [ebp + 0xc]
call fcn.00411e8d
push 0x1e
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.004102c2
add esp, 0x20
xor eax, eax
pop ebx
leave
ret

Function at 0x4111b4
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x411cbf
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
push edi
xor ecx, ecx
movzx eax, byte [ecx + str.80_]
mov esi, dword [ebp + 8]
mov edx, eax
sar edx, 3
and eax, 7
mov dl, byte [esi + edx]
test byte [eax*2 + 0x41f8ac], dl
setne al
mov byte [ecx + ebp - 0x74], al
inc ecx
cmp ecx, 0x38
jl 0x411ccd
and dword [ebp + 8], 0
mov dword [ebp - 4], 0x1e
cmp word [ebp + 0xc], 1
jne 0x411d0d
mov eax, dword [ebp - 4]
jmp 0x411d12
mov eax, dword [ebp + 8]
add eax, eax
and dword [ebp + eax*4 - 0xf0], 0
and dword [ebp + eax*4 - 0xf4], 0
lea ecx, [ebp + eax*4 - 0xf0]
lea esi, [ebp + eax*4 - 0xf4]
mov eax, dword [ebp + 8]
xor edx, edx
movzx eax, byte [eax + 0x41f954]
mov edi, eax
cmp edi, 0x1c
jge 0x411d49
mov bl, byte [edi + ebp - 0x74]
jmp 0x411d50
mov bl, byte [edi + ebp - 0x90]
mov byte [edx + ebp - 0x3c], bl
inc edx
inc edi
cmp edx, 0x1c
jl 0x411d3e
push 0x1c
pop edi
add eax, edi
cmp eax, 0x38
jge 0x411d6b
mov dl, byte [eax + ebp - 0x74]
jmp 0x411d72
mov dl, byte [eax + ebp - 0x90]
mov byte [edi + ebp - 0x3c], dl
inc edi
inc eax
cmp edi, 0x38
jl 0x411d60
xor edi, edi
mov edx, 0x41f8bc
movzx ebx, byte [edi + 0x41f964]
lea eax, [edi + 0x41f97c]
cmp byte [ebx + ebp - 0x3c], 0
je 0x411d9c
mov ebx, dword [edx]
or dword [esi], ebx
movzx eax, byte [eax]
cmp byte [eax + ebp - 0x3c], 0
je 0x411daa
mov eax, dword [edx]
or dword [ecx], eax
add edx, 4
inc edi
cmp edx, str.80_
jl 0x411d84
sub dword [ebp - 4], 2
inc dword [ebp + 8]
cmp dword [ebp - 4], 0xfffffffe
jg 0x411d01
lea eax, [ebp - 0xf4]
push eax
call fcn.00411dd9
pop ecx
pop edi
pop esi
pop ebx
leave
ret