joyce8/EMBER2024-capa huggingface dataset:
Function at 0x39e8d06b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x34
mov eax, 0x39ebb365
call fcn.39eaecb8
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov esi, ecx
cmp dword [esi + 0x58], 8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x40], ebx
jb 0x39e8d098
mov eax, dword [esi + 0x44]
jmp 0x39e8d09b
lea eax, [esi + 0x44]
lea ecx, [ebp - 0x38]
push ecx
push ebx
lea ecx, [ebp - 0x40]
push ecx
push ebx
push eax
lea edi, [esi + 0x94]
push dword [edi]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x39e8d19b
mov eax, dword [ebp - 0x38]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.39eb4742
pop ecx
mov dword [ebp - 0x34], eax
cmp eax, ebx
jne 0x39e8d100
push edi
mov ecx, esi
call fcn.39eb4742
mov ecx, dword [ebp - 0x30]
push 0x39e162d8
call fcn.39eb4742
mov dword [ebp - 4], ebx
mov dword [ebp - 0x3c], 1
jmp 0x39e8d1f2
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx + ecx + 2]
push ecx
push ebx
push eax
call fcn.39e6fce0
add esp, 0xc
cmp dword [esi + 0x58], 8
jb 0x39e8d11d
mov eax, dword [esi + 0x44]
jmp 0x39e8d120
lea eax, [esi + 0x44]
lea ecx, [ebp - 0x38]
push ecx
push dword [ebp - 0x34]
lea ecx, [ebp - 0x40]
push ecx
push ebx
push eax
push dword [edi]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x39e8d16a
cmp dword [ebp - 0x40], 1
jne 0x39e8d16a
mov eax, dword [ebp - 0x34]
mov byte [esi + 0x9c], 1
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x39e8d14c
sub eax, edx
sar eax, 1
xor ecx, ecx
cmp ecx, eax
sbb al, al
inc al
mov byte [esi + 0x9d], al
jmp 0x39e8d1a8
push edi
mov ecx, esi
mov byte [esi + 0x9c], bl
mov byte [esi + 0x9d], 1
call fcn.39eb4742
push dword [ebp - 0x34]
call fcn.39eb4742
mov dword [esp], 0x39e162d8
mov ecx, dword [ebp - 0x30]
call fcn.39eb4742
jmp 0x39e8d0f1
mov byte [esi + 0x9c], bl
mov byte [esi + 0x9d], 1
push edi
mov ecx, esi
call fcn.39eb4742
cmp dword [ebp - 0x34], ebx
jne 0x39e8d1bc
push 0x39e162d8
jmp 0x39e8d18e
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2c]
call fcn.39eb4742
xor esi, esi
inc esi
mov dword [ebp - 4], esi
push dword [ebp - 0x34]
call fcn.39eb4742
pop ecx
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
push eax
call fcn.39eb4742
mov dword [ebp - 0x3c], esi
mov byte [ebp - 4], bl
push ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.39eb4742
mov eax, dword [ebp - 0x30]
call fcn.39eaed4a
ret 4
Function at 0x39e8ead7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x234
mov eax, 0x39ebb6ba
call fcn.39eaecb8
mov esi, dword [ebp + 8]
mov ebx, ecx
xor edi, edi
push 0x39e0737c
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x23c], edi
call fcn.39eb4742
mov dword [ebp - 4], edi
push 0xffffffffffffffff
push edi
push esi
lea ecx, [ebp - 0x238]
call fcn.39eb4742
push 0x39e0735c
lea ecx, [ebp - 0x238]
call fcn.39eb4742
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x39e8eb3a
lea eax, [ebp - 0x234]
lea ecx, [ebp - 0x23c]
push ecx
push eax
push SysReAllocStringLen
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
test eax, eax
jne 0x39e8ebc7
push 0x208
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push edi
push eax
call fcn.39e6fce0
add esp, 0xc
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push edi
push edi
push dword [ebp - 0x23c]
mov dword [ebp - 0x240], 0x20a
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x39e8ebc7
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call fcn.39eb4742
pop ecx
pop ecx
cmp eax, edi
je 0x39e8ebc7
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebx + 0x44]
call fcn.39eb4742
cmp dword [ebp - 0x23c], edi
je 0x39e8ebdd
lea eax, [ebp - 0x23c]
push eax
mov ecx, ebx
call fcn.39eb4742
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x238]
call fcn.39eb4742
call fcn.39eaed4a
ret 4
Function at 0x39e92f6b
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0x10
mov eax, 0x39ebc009
call fcn.39eaec45
mov esi, ecx
mov dword [ebp - 0x18], esi
call fcn.39e3c0a7
xor edi, edi
mov dword [ebp - 4], edi
lea ecx, [esi + 0x1c]
call fcn.39e3c0a7
mov byte [ebp - 4], 1
lea ebx, [esi + 0x38]
mov eax, ebx
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov byte [ebp - 4], 3
lea eax, [esi + 0x3c]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov byte [ebp - 4], 5
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 7
lea eax, [ebp - 0x10]
push eax
push 0x39e0fedc
push 1
push edi
push 0x39e0ffac
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jge 0x39e93006
push 0x1c
call fcn.39eb4742
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 8
cmp ecx, edi
je 0x39e92fef
push 0x39e08798
call fcn.39e92583
jmp 0x39e92ff1
xor eax, eax
mov byte [ebp - 4], 7
mov dword [ebp + 8], eax
push 0x39ecda28
lea eax, [ebp + 8]
push eax
call fcn.39eb4742
push 0x39e0878c
mov ecx, esi
call fcn.39eb4742
push dword [ebp + 8]
mov ecx, esi
call fcn.39eb4742
cmp dword [esi + 0x18], 8
jb 0x39e93027
mov eax, dword [esi + 4]
jmp 0x39e9302a
lea eax, [esi + 4]
push eax
lea ecx, [ebp + 8]
call fcn.39eb4742
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ebx
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp + 8]
push eax
call dword [ecx + 0xc]
mov ebx, eax
cmp dword [ebp - 0x10], edi
je 0x39e9305b
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.39eb4742
cmp ebx, edi
jge 0x39e93096
push 0x1c
call fcn.39eb4742
pop ecx
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 0xa
cmp ecx, edi
je 0x39e93080
push 0x39e0874c
call fcn.39e92583
jmp 0x39e93082
xor eax, eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x14], eax
push 0x39ecda28
lea eax, [ebp - 0x14]
jmp 0x39e93000
mov byte [ebp - 4], 7
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10]
call fcn.39e97970
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.39eaed31
ret 4
Function at 0x39ea2163
Capabilities:
Get common file path

Disassembly:
push 0x440
mov eax, 0x39ebe68e
call fcn.39eaecb8
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x448], edi
mov dword [ebp - 0x44c], ebx
cmp dword [esi + 0x14], edi
jne 0x39ea21a9
push 0x39e162d8
mov ecx, ebx
call fcn.39eb4742
mov dword [ebp - 4], edi
mov dword [ebp - 0x448], 1
jmp 0x39ea2281
xor eax, eax
mov edi, 0x208
push edi
push eax
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push eax
call fcn.39e6fce0
add esp, 0xc
lea eax, [ebp - 0x428]
push eax
push 0x104
call fcn.39eb4742
test eax, eax
jne 0x39ea21ef
push 0x39e162d8
mov ecx, ebx
call fcn.39eb4742
and dword [ebp - 4], 0
jmp 0x39ea219a
xor eax, eax
push edi
mov word [ebp - 0x21c], ax
xor edi, edi
lea eax, [ebp - 0x21a]
push edi
push eax
call fcn.39e6fce0
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x39ea2216
mov esi, dword [esi + 4]
jmp 0x39ea2219
add esi, 4
lea eax, [ebp - 0x21c]
push eax
push edi
push esi
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
test eax, eax
jne 0x39ea2244
push 0x39e162d8
mov ecx, ebx
call fcn.39eb4742
jmp 0x39ea2197
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x444]
call fcn.39eb4742
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x444]
push eax
mov ecx, ebx
call fcn.39eb4742
mov dword [ebp - 0x448], esi
mov byte [ebp - 4], 0
push edi
push esi
lea ecx, [ebp - 0x444]
call fcn.39eb4742
mov eax, ebx
call fcn.39eaed4a
ret 8
Function at 0x39ea2290
Capabilities:
Create directory

Disassembly:
push 0x294
mov eax, 0x39ebe71f
call fcn.39eaecb8
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x240], ebx
push 0x208
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x244], ebx
call fcn.39e6fce0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call fcn.39eb4742
test eax, eax
jne 0x39ea2312
push 0x39e162d8
mov ecx, esi
call fcn.39eb4742
mov dword [ebp - 4], ebx
mov dword [ebp - 0x240], 1
mov eax, esi
jmp 0x39ea248c
push ebx
lea eax, [ebp - 0x268]
push eax
call fcn.39ea2974
mov dword [ebp - 0x24c], eax
xor esi, esi
inc esi
mov dword [ebp - 4], esi
push edi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x284]
push eax
call fcn.39e4ad04
mov byte [ebp - 4], 2
push dword [ebp - 0x24c]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.39e56816
add esp, 0x18
mov byte [ebp - 4], 4
push ebx
push esi
lea ecx, [ebp - 0x284]
call fcn.39eb4742
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x268]
push ebx
push esi
call fcn.39eb4742
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x39ea2390
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.39eb4742
pop ecx
pop ecx
test eax, eax
jne 0x39ea2431
inc dword [ebp - 0x244]
push dword [ebp - 0x244]
lea eax, [ebp - 0x2a0]
push eax
call fcn.39ea2974
mov edi, eax
mov byte [ebp - 4], 6
push dword [ebp - 0x248]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x284]
push eax
call fcn.39e4ad04
mov byte [ebp - 4], 7
push edi
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.39e56816
add esp, 0x18
mov byte [ebp - 4], 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x238]
call fcn.39eb4742
mov byte [ebp - 4], 7
push ebx
push esi
lea ecx, [ebp - 0x268]
call fcn.39eb4742
mov byte [ebp - 4], 6
push ebx
push esi
lea ecx, [ebp - 0x284]
call fcn.39eb4742
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2a0]
jmp 0x39ea2374
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x39ea2446
lea eax, [ebp - 0x234]
push ebx
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x23c]
test eax, eax
jne 0x39ea2464
push 0x39e162d8
call fcn.39eb4742
jmp 0x39ea2470
lea eax, [ebp - 0x238]
push eax
call fcn.39eb4742
mov dword [ebp - 0x240], esi
mov byte [ebp - 4], bl
push ebx
push esi
lea ecx, [ebp - 0x238]
call fcn.39eb4742
mov eax, dword [ebp - 0x23c]
call fcn.39eaed4a
ret 8
Function at 0x39ea2aaf
Capabilities:
Get hostname

Disassembly:
push 0x248
mov eax, 0x39ebe817
call fcn.39eaecb8
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor ebx, ebx
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.39e6fce0
add esp, 0xc
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x254], 0x104
xor esi, esi
call fcn.39ea29ed
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24c], 2
jne 0x39ea2b0a
cmp dword [ebp - 0x248], 5
jae 0x39ea2b21
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.39ea27b4
mov al, bl
call fcn.39eaed4a
ret
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x218]
push eax
push 7
call sub.Secur32.dll_GetComputerObjectNameW
test al, al
je 0x39ea2b80
lea eax, [ebp - 0x218]
push 0x2f
push eax
call fcn.39eb4742
pop ecx
pop ecx
cmp eax, ebx
je 0x39ea2b80
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.39eb4742
lea eax, [ebp - 0x218]
push 0x39e0cf58
push eax
call fcn.39eb4742
add esp, 0x10
mov esi, eax
neg esi
sbb esi, esi
neg esi
cmp esi, ebx
setne bl
jmp 0x39ea2b0a
Function at 0x39ea5ee3
Capabilities:
Create process on windows

Disassembly:
push 0xb4
mov eax, 0x39ebf0e7
call fcn.39eaecb8
mov edi, dword [ebp + 8]
mov esi, ecx
call fcn.39eb4742
mov eax, dword [eax + 0x40]
add esi, 8
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x50], eax
call fcn.39eb4742
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x39e0d9c0
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.39e567c2
mov byte [ebp - 4], 1
push edi
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.39e56816
add esp, 0x18
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x7c]
call fcn.39eb4742
mov esi, dword [ebp - 0x34]
inc esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.39eb4742
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x39ea5f8f
mov byte [ebp - 0x49], bl
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.39eb4742
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.39eb4742
mov al, byte [ebp - 0x49]
call fcn.39eaed4a
ret 4
lea eax, [esi + esi]
push eax
push ebx
push edi
call fcn.39e6fce0
mov eax, dword [ebp - 0x44]
add esp, 0xc
cmp dword [ebp - 0x30], 8
jae 0x39ea5fa9
lea eax, [ebp - 0x44]
push eax
push esi
push edi
call fcn.39eb4742
push 0x44
pop esi
push esi
lea eax, [ebp - 0xc0]
push ebx
push eax
call fcn.39e6fce0
add esp, 0x18
mov dword [ebp - 0xc0], esi
cmp dword [ebp - 0x50], ebx
je 0x39ea5fee
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x39ea5fdc
lea eax, [ebp - 0x28]
push edi
push eax
push 0x39e0d938
push dword [ebp - 0x50]
call fcn.39eb4742
add esp, 0x10
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x39ea5ffa
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0xc0]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x39ea6037
push 0xffffffffffffffff
push dword [ebp - 0x60]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebp - 0x60]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [ebp - 0x5c]
call esi
xor esi, esi
inc esi
jmp 0x39ea6039
xor esi, esi
push edi
call fcn.39eb4742
cmp esi, ebx
pop ecx
setne byte [ebp - 0x49]
jmp 0x39ea5f67
Function at 0x39eb4742
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x39eb4751
pop dword [ebp - 0x10]
mov eax, 0x203df7c1
add eax, 0x19ad4f90
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x67005
push 0
mov eax, 0xf46f7cb8
sub eax, 0xba8f6aa4
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x5ca5d846
add ecx, 0xa35a735f
xor ebx, ebx
add ebx, eax
mov edx, 0x49f027fb
sub edx, 0xfffe3fb
add edx, dword [ebp - 0x10]
mov edi, 0x1385005a
sub dword [ebp - 0xc], 0x7c16d0b5
mov esi, dword [edx]
mov dword [ebp - 4], 0x7276188b
xor esi, edi
mov dword [ebp - 4], 0x1b88c54d
mov dword [ebx], esi
add ebx, 0x166ca255
add ebx, 0xe9935daf
add edx, 0x33e750aa
add edx, 0xcc18af5a
loop 0x39eb47ac
add eax, 0x4e0905ef
add eax, 0xb1f81b78
xor ebx, ebx
add ebx, eax
add eax, 0x1ae8f449
add eax, 0xe5170bbc
mov ecx, 0x2bcea5ba
sub ecx, 0xf1eea5ba
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x43b64f
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
add eax, edi
add eax, 0x607ae346
sub eax, eax
call fcn.0043b696
mov edi, 0xc810713f
xor dword [ecx], ebx
sub edi, 0xc71d50eb
mov eax, 0xa4710812
add edi, edi
add ecx, 1
sub edi, 0x2c40b908
cmp ecx, edx
jne fcn.0043b64f
mov eax, edi
ret

Function at 0x401e1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4800b8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, 0x47fd28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push eax
push 0x4a93b8
push 0x47fce4
lea eax, [ebp - 0xcc]
push 0x18
push eax
mov dword [ebp - 0xcc], 0x4800ac
mov dword [ebp - 0xc8], 0x480094
mov dword [ebp - 0xc4], 0x48008c
mov dword [ebp - 0xc0], 0x480078
mov dword [ebp - 0xbc], 0x480070
mov dword [ebp - 0xb8], 0x48005c
mov dword [ebp - 0xb4], 0x480054
mov dword [ebp - 0xb0], 0x48003c
mov dword [ebp - 0xac], 0x480038
mov dword [ebp - 0xa8], 0x480028
mov dword [ebp - 0xa4], 0x48001c
mov dword [ebp - 0xa0], 0x480004
mov dword [ebp - 0x9c], 0x47fff8
mov dword [ebp - 0x98], 0x47ffe0
mov dword [ebp - 0x94], 0x47ffd4
mov dword [ebp - 0x90], 0x47ffb8
mov dword [ebp - 0x8c], 0x47ffac
mov dword [ebp - 0x88], 0x47ff94
mov dword [ebp - 0x84], 0x47ff84
mov dword [ebp - 0x80], 0x47ff68
mov dword [ebp - 0x7c], 0x47ff54
mov dword [ebp - 0x78], 0x47ff3c
mov dword [ebp - 0x74], 0x47ff2c
mov dword [ebp - 0x70], 0x47ff10
mov dword [ebp - 0x6c], 0x47ff00
mov dword [ebp - 0x68], 0x47fee4
mov dword [ebp - 0x64], 0x47fed0
mov dword [ebp - 0x60], 0x47feb0
mov dword [ebp - 0x5c], 0x47fea4
mov dword [ebp - 0x58], 0x47fe8c
mov dword [ebp - 0x54], 0x47fe74
mov dword [ebp - 0x50], 0x47fe50
mov dword [ebp - 0x4c], 0x47fe40
mov dword [ebp - 0x44], 0x47fe2c
mov dword [ebp - 0x3c], 0x47fe20
mov dword [ebp - 0x38], 0x47fe08
mov dword [ebp - 0x34], 0x47fdf8
mov dword [ebp - 0x30], 0x47fddc
mov dword [ebp - 0x2c], 0x47fdcc
mov dword [ebp - 0x28], 0x47fdb0
mov dword [ebp - 0x24], 0x47fda4
mov dword [ebp - 0x20], 0x47fd8c
mov dword [ebp - 0x1c], 0x47fd80
mov dword [ebp - 0x18], 0x47fd68
mov dword [ebp - 0x14], 0x47fd5c
mov dword [ebp - 0x10], 0x47fd44
call fcn.00401da4
mov ecx, dword [ebp - 4]
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0043cac0
leave
ret
Function at 0x4607bc
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x445957
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x445971
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x445960
pop esi
jmp 0x44597c
ret 4
jmp 0x460808
bswap ebp
lea esp, [esp + 2]
mov dword [esp + 1], edx
mov edx, 0xa7a0a207
jmp 0x460839
lea ebp, reloc.MSVCRT.dll_strncpy
push word [esp + 3]
mov word [esp + 3], di
xchg word [esp + 2], bp
mov dword [esp], eax
pushfd
jmp 0x4607f2
lea edx, reloc.MSVCRT.dll_strncpy
mov dh, byte [esp]
setns dh
setl dh
jmp 0x46091e
lea edx, [ebx*4]
mov bp, 0x9456
mov dh, 0x30
not edx
push esi
mov dx, 0x6386
jmp 0x460823
mov dh, 0x10
mov edx, dword [esp + 1]
bswap ebp
mov ebp, 0x79aacbc0
lea ebp, [eax + eax]
call fcn.00460873
jmp 0x44594a
mov si, cx
mov dh, bl
pop esi
mov dx, word [esp]
mov dh, byte [esp]
not dx
jmp 0x46089f

Function at 0x48cb2f
Capabilities:
Encode data using xor

Disassembly:
call fcn.0048cb8a
or dword [ecx - reloc.MSVCRT.dll_strncpy], ebx
pop es
mov eax, dword [ebx]
push esp
ja 0x3d3d2ec
das
xor ecx, eax
inc ebp
jnp 0x48cb36
fstp qword es:[edx - 0x7bf06d54]
sub bh, bh
invalid

Function at 0x510b70
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, dword [esp + 0x13]
xchg bh, ah
mov dx, 0x785f
jmp 0x510bc6
mov di, word [esp + 9]
add esp, 0x14
lea esi, [esi + esi]
btc esi, edx
sbb eax, esp
mov byte [esp], bl
jmp 0x510bd8
setne dh
mov di, bp
neg ebx
cmc
rdtsc
mov edi, 0xa4c57f11
jmp 0x510baa
xchg dword [esp + 6], edx
xchg edx, edi
bsr di, bp
pop ax
mov esi, 0x7bc45557
mov word [esp + 2], bp
jmp 0x510f89
lea esp, [esp + 2]
call fcn.00510cb2
cli
adc dword [ebx], 0x76
test dword [ebx - 0x40], esp
inc esp
fidivr dword [ebp - 0x788e5db4]
ror dword [ebx + reloc.MSVCRT.dll_strncpy], 1
pop dword [esp]
xchg ecx, edx
mov esi, ecx
rdtsc
pop word [esp]
setle dh
mov edx, 0xf887d70c
jmp 0x510c72
neg cl
dec dx
rcl ebp, 0xb
mov ebx, 0x31b2b421
bswap ebx
not dx
jmp 0x510c88
rcr dx, 0xe
inc di
mov eax, dword [esp + 2]
mov si, 0xbe0d
mov byte [esp + 1], dl
mov ebx, 0x7c04d084
jmp 0x510cd4
xchg byte [esp + 3], dh
mov esi, edi
xchg word [esp], bx
bt eax, eax
mov eax, edi
mov word [esp + 2], si
jmp 0x510d1c
pop dword [esp]
pop di
rcr esi, 0x14
lea edi, reloc.MSVCRT.dll_strncpy
mov ebp, dword [esp]
push word [esp + 1]
jmp 0x510df3
mov esi, 0x7d70afd7
xchg byte [esp], dl
lea eax, [edi + 0x3f]
mov bl, 0x99
setno dh
lea esi, [edi*4]
jmp 0x510f37

Function at 0x510e0c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebp
bswap edi
pop ebx
setne al
mov bx, 0xcb09
jmp 0x510e3f
xchg ch, bh
lea ebp, [eax - 0x2a]
bsf dx, si
mov bx, 0xb668
mov al, ah
mov bx, si
jmp 0x510e29
Function at 0x5115ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 9]
shr edx, 8
mov byte [esp + 2], dl
mov edx, ebx
not dh
jmp 0x5115cb
cpuid
pop word [esp + 4]
xchg byte [esp + 3], bl
push edi
xchg byte [esp + 6], ch
inc esi
jmp 0x511581
xchg cx, bp
cpuid
push word [esp + 7]
mov byte [esp + 3], ch
bswap ebp
dec cx
jmp 0x511597
mov word [esp + 9], bx
mov edx, 0x935f09a
xchg word [esp + 0xc], si
mov dword [esp + 2], edx
not eax
mov al, ch
jmp 0x5116a0
mov di, 0x5e14
xchg word [esp], bp
clc
mov word [esp + 3], bp
jmp 0x5115b7
mov edx, 0xe84be85b
pop ecx
rdtsc
xchg word [esp], bp
sete bl
jmp 0x511626
push bp
xchg edx, esi
mov bx, dx
pop word [esp + 3]
xchg cl, bl
lea esp, [esp + 2]
jmp 0x5115fc
mov edi, eax
xchg word [esp + 1], bx
sub ch, bh
mov byte [esp + 2], bl
pop bp
push dword [esp + 3]
jmp 0x511670
mov ah, bl
rol cx, cl
lea ebx, reloc.MSVCRT.dll_strncpy
lea esi, [esp + esi]
rdtsc
mov word [esp + 7], si
jmp 0x511612
xchg ebx, eax
mov si, bp
setle ch
sub esp, 0xa
btr edi, esp
neg bx
jmp 0x511684
sete dl
neg dl
cpuid
rdtsc
pop word [esp + 2]
mov bx, 0x9323
jmp 0x51165a
push word [esp + 0xb]
sub esp, 0x15
cpuid
mov word [esp + 0x1c], si
xchg byte [esp + 0x1c], cl
jmp 0x5116b7
mov byte [esp + 3], cl
mov ah, dh
lea eax, reloc.MSVCRT.dll_strncpy
mov byte [esp + 0xa], al
lea esp, [esp + 2]
cld
jmp 0x511643
ror bp, 7
rdtsc
xchg di, bp
pop word [esp + 0xf]
mov ax, word [esp + 0xf]
bswap ebx
jmp 0x511898
mov bx, 0x91bd
lea esp, [esp + 0x12]
call 0x51172c
mov cx, di
mov bh, byte [esp + 0xb]
xchg byte [esp + 5], ch
mov dx, 0xaa3a
jmp 0x511855
mov eax, dword [esp + 5]
lea esi, [esp + edi]
stc
call fcn.0051186d
xor al, 0xbf
das
dec edx
mov ecx, 0x1c8d1224
mov bp, dx
add esp, 0xe
rol ax, cl
xchg dword [esp], edi
bsr si, bx
lea ebp, reloc.MSVCRT.dll_strncpy
jmp 0x51183f
shl dh, cl
sub bx, 0xf7c3
lea edx, [edx + ebx]
pop ebx
xchg byte [esp + 3], al
shr dl, cl
jmp 0x5117ec

Function at 0x511c1d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 0x14]
mov byte [esp + 0x15], al
xchg dword [esp + 0x1c], edx
lea ebp, [ecx + ebp]
jmp 0x511c58
pushal
jmp 0x511c07
mov word [esp + 1], sp
rdtsc
mov dl, dh
push word [esp + 7]
lea esp, [esp + 0xc]
xchg byte [esp + 3], dl
jmp 0x511c42

Function at 0x51378b
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp]
push dword [esp + 2]
jmp 0x513798
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x5137c1
Function at 0x10013050
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov edx, 0xa7
xor eax, eax
nop dword [eax]
mov cl, byte [eax + 0x1007e64c]
xor cl, dl
inc edx
mov byte [ebp + eax - 0x2c], cl
and edx, 0x800000ff
jns 0x1001307d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x1e
jl 0x10013060
lea eax, [ebp - 0x2c]
mov byte [ebp - 0xe], 0
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x6c64746e
push eax
mov dword [ebp - 8], 0x6c642e6c
mov word [ebp - 4], 0x6c
call dword [0x1007d014]
push eax
call dword [0x1007d030]
xorps xmm0, xmm0
mov word [ebp - 4], 0
push 0x10051e10
push 1
movq qword [ebp - 0xc], xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov word [ebp - 0x10], 0
mov byte [ebp - 0xe], 0
call eax
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x100223e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x1008e170], 0
jne 0x10022443
mov edx, 0x54
xor eax, eax
mov cl, byte [eax + 0x1007e698]
xor cl, dl
inc edx
mov byte [ebp + eax - 0x18], cl
and edx, 0x800000ff
jns 0x10022413
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x15
jl 0x100223f6
lea eax, [ebp - 0x18]
mov byte [ebp - 3], 0
push eax
call dword [0x1007d014]
add eax, 0xcdda
mov dword [0x1008e170], 1
mov dword [0x10093770], eax
add eax, 0x18
mov dword [0x10092ad8], eax
mov esp, ebp
pop ebp
ret