joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429918
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0043280d
add esp, 0xc
nop
xchg edi, eax
xchg edi, eax
xchg esp, esp
add ebx, dword [esp]
sub ebx, dword [esp]
jbe 0x42995a
pushf
shl eax, 0
ror edx, 0
or esp, 0
popf
lea ecx, [ecx + 0x7a29]
lea ecx, [ecx - 0x7a29]
ja 0x42995a
call 0x5426df24
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
not esi
not esi
lea esi, [esi + 0x5996]
sub esi, 0x5996
jae 0x4299bd
xchg ecx, edx
xchg ecx, edx
mov esp, esp
jb 0x4299bd
mov esi, 0x80e44d8a
jmp 0xe49021c7
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.0043e8fe
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x429a6b
xor eax, eax
jmp 0x429ae5
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00438b78
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0043280d
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x429ae3
add esi, 0x7ff
sub esi, 0x7ff
shr esp, 0
or esi, 0
js 0x429aae
je 0x429aa7
xchg esp, esp
jns 0x429aae
mov edx, 0x4d8bab30
cld
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041b3b3
add esp, 4
test esp, 0x113d
test dword [esp], ecx
jns 0x429aca
jns 0x429ac7
js 0x429aca
sub eax, 0x5218558b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x429ae5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x429aee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x412b98], 1
jne 0x429c54
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0043280d
add esp, 0xc
jo 0x429b16
lea edx, [edx + 0x2a74]
sub edx, 0x2a74
jge 0x429b2c
mov ebx, ebx
lea esp, [esp]
jl 0x429b2c
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
add esp, 0
mov edi, edi
jae 0x429b75
pushf
test ecx, 0x1608
test dword [esp], eax
popf
xchg edx, edx
jb 0x429b75
lcall 0x1e9, 0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.0043e8fe
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x429bea
xor eax, eax
jmp 0x429cab
lea ecx, [ecx + 0x1bce]
sub ecx, 0x1bce
cmp ebx, dword [esp]
jnp 0x429c07
xchg esi, ebx
xchg esi, ebx
nop
lea esp, [esp]
jp 0x429c07
sub eax, 0xe8458db9
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00438b78
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0043280d
add esp, 0xc
jb 0x429c29
add esp, 0
jg 0x429c3e
pushf
cmp edx, 0xaff
popf
lea esp, [esp]
jle 0x429c3e
mov ecx, 0xf87d83
cmp dword [ebp - 8], 0
je 0x429c4e
mov eax, dword [ebp - 8]
mov dword [0x412b98], eax
jmp 0x429c52
xor eax, eax
jmp 0x429cab
jmp 0x429c5d
mov ecx, dword [0x412b98]
mov dword [ebp - 8], ecx
clc
ja 0x429c60
jo 0x429c7a
js 0x429c64
xchg esp, esp
lea edi, [edi + 0x10b7]
lea edi, [edi - 0x10b7]
xchg edx, esi
xchg edx, esi
jno 0x429c7a
mov eax, 0xf8558b5d
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
lea esp, [esp]
jno 0x429c85
jg 0x429c94
pushf
and edx, edx
popf
jb 0x429c8f
jae 0x429c91
jle 0x429c94
add eax, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0041b3b3
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x429cb4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0043280d
add esp, 0xc
mov eax, eax
ror esi, 7
rol esi, 7
jl 0x429cd7
jg 0x429cd9
jnp 0x429cea
pushf
jmp 0x429cdf
popf
jl 0x429ce3
jno 0x429ce5
jge 0x429ce7
jp 0x429cea
add eax, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0xc], 0
inc edx
dec edx
or esi, 0
jg 0x429d41
pushf
mov edx, edx
call fcn.00429d2e

Function at 0x42a475
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x41112c
call fcn.00416219
add esp, 0xc
mov byte [0x41112c], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x42c8d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0043280d
add esp, 0xc
jge 0x42c8f2
lea esi, [esi]
add ebx, 0
jne 0x42c8fe
jne 0x42c8fb
je 0x42c8fe
mov eax, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0043e8fe
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42c9c9
xor eax, eax
jmp 0x42ca50
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00438b78
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0043280d
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x42c9f3
xor eax, eax
jmp 0x42ca50
ror eax, 0x11
ror eax, 0xf
jnp 0x42c9fb
lea edi, [edi + 0x962]
sub edi, 0x962
sub ecx, 0
jp 0x42ca2c
pushf
lea ebx, [ebx + 0x4ba3]
lea ebx, [ebx - 0x4ba3]
jbe 0x42ca1c
add esp, 0
jo 0x42ca21
popf
jns 0x42ca25
mov esp, esp
jno 0x42ca29
jnp 0x42ca2c
mov ecx, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.0041b3b3
add esp, 4
cmc
mov esp, esp
jle 0x42ca45
lea esp, [esp]
jo 0x42ca42
jg 0x42ca45
or dword [ebx - 0x74aef3b3], 0xff520855
push ebp
call 0x8b9e28b3
in eax, 0x5d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x430c03
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.0043280d
add esp, 0xc
push 0x21
push 0x412d10
lea ecx, [ebp - 0x138]
push ecx
call fcn.0042ece7
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x430d0b
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.0043280d
add esp, 0xc
push 0xb
push 0x412d34
lea edx, [ebp - 0x138]
push edx
call fcn.0042ece7
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x430cfe
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042ece7
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x430d0d
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x43575d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
or edx, edx
shr esp, 0
lea eax, [eax + 0x3f59]
lea eax, [eax - 0x3f59]
xchg esp, esp
jg 0x43579a
pushf
ror ebx, 0
ja 0x435783
xor edi, 0x7eb3
xor edi, 0x7eb3
div dword [ebx + 0x6600007e]
popfd
jnp 0x435793
jae 0x435795
jge 0x435797
jle 0x43579a
mov esi, 0x33f645c6
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 7], 0x6d
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xe], 0x57
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 0xd], 0x46
mov byte [ebp - 0xb], 0x43
mov byte [ebp - 6], 0x6d
mov byte [ebp - 9], 0x2f
mov byte [ebp - 8], 0x65
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x53
lea ebx, [ebx + 0x6350]
lea ebx, [ebx - 0x6350]
jns 0x4357e0
lea eax, [eax]
nop
jle 0x4357dd
js 0x4357e0
mov ebx, 0x80f7558a
ljmp 0x458a
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
test ebx, 0x6397
mov edi, edi
cmp esp, 0x46d7
jg 0x435861
pushf
sub esp, 0
or esp, 0
stc
and edx, edx
popf
lea ecx, [ecx]
jle 0x435861
mov edi, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43578a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
or edx, edx
shr esp, 0
lea eax, [eax + 0x3f59]
lea eax, [eax - 0x3f59]
xchg esp, esp
jg 0x43579a
pushf
ror ebx, 0
ja 0x435783
xor edi, 0x7eb3
xor edi, 0x7eb3
div dword [ebx + 0x6600007e]
popfd
jnp 0x435793
jae 0x435795
jge 0x435797
jle 0x43579a
mov esi, 0x33f645c6
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 7], 0x6d
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xe], 0x57
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 0xd], 0x46
mov byte [ebp - 0xb], 0x43
mov byte [ebp - 6], 0x6d
mov byte [ebp - 9], 0x2f
mov byte [ebp - 8], 0x65
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x53
lea ebx, [ebx + 0x6350]
lea ebx, [ebx - 0x6350]
jns 0x4357e0
lea eax, [eax]
nop
jle 0x4357dd
js 0x4357e0
mov ebx, 0x80f7558a
ljmp 0x458a
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
test ebx, 0x6397
mov edi, edi
cmp esp, 0x46d7
jg 0x435861
pushf
sub esp, 0
or esp, 0
stc
and edx, edx
popf
lea ecx, [ecx]
jle 0x435861
mov edi, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435adb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0043280d
add esp, 0xc
or edx, 0
jle 0x435b0d
jae 0x435afb
jnp 0x435afd
lea ebx, [ebx + 0x104a]
lea ebx, [ebx - 0x104a]
jg 0x435b0d
add eax, 0xec45c62c
inc edi
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
call 0x435b42
add esp, 4
jg 0x435b4e
jne 0x435b49
jns 0x435b4b
jle 0x435b4e
ljmp 0x1e9:0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
jge 0x435bb0
je 0x435bb8
xchg edx, eax
xchg edx, eax
jne 0x435bb8
adc eax, 0x8d41e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.0043e8fe
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x435bcd
xor eax, eax
jmp 0x435c68
cmp ecx, esi
shl esp, 0
rol esp, 0
and esp, 0xffffffff
je 0x435be1
jb 0x435bdc
ja 0x435bde
jne 0x435be1
jmp 0x512fa172
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00438b78
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0043280d
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x435c55
jge 0x435c09
xor ecx, dword [esp + 8]
xor ecx, dword [esp + 8]
jae 0x435c13
jno 0x435c15
jge 0x435c36
pushf
shl esp, 0
and edi, edi
std
cld
popf
xchg esp, esp
lea esp, [esp]
lea ebx, [ebx + 0x999]
lea ebx, [ebx - 0x999]
jl 0x435c36
mov edi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0041b3b3
add esp, 4
and esp, 0xffffffff
ja 0x435c4c
xchg edx, edx
jbe 0x435c4c
call 0x514ba9db
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x435c68
jo 0x435c57
cmp ecx, 0x5297
jno 0x435c66
jp 0x435c61
jnp 0x435c63
jo 0x435c66
mov esi, 0x5e5fc033
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x438811
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0043280d
add esp, 0xc
sub edx, 0
ja 0x438834
jne 0x438831
jbe 0x438834
mov eax, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
xchg edi, eax
xchg edi, eax
jnp 0x438868
and edx, edx
jb 0x43888b
lea ecx, [ecx + 0x51da]
lea ecx, [ecx - 0x51da]
lea ebx, [ebx]
lea esi, [esi + 0x4d14]
lea esi, [esi - 0x4d14]
ja 0x438888
jae 0x43888b
mov esi, 0x80ec4d8a
jmp 0xec911095
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0043e8fe
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x438900
xor eax, eax
jmp 0x43898f
xor edx, ebx
xor edx, ebx
jne 0x438912
jns 0x438908
jnp 0x43890a
mov edi, edi
xchg esp, esp
je 0x438912
add eax, 0xec458d28
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00438b78
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0043280d
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x43893c
xor eax, eax
jmp 0x43898f
or ecx, ecx
jp 0x438946
jbe 0x438942
jnp 0x438946
add eax, 0xfc458bd3
mov eax, dword [ebp - 4]
push eax
call fcn.0041b3b3
add esp, 4
xor ebx, 0xc4f
xor ebx, 0xc4f
call 0x438963
lea esp, [esp + 4]
or esp, 0
jp 0x438988
pushf
shr esp, 0
jae 0x438973
jne 0x438975
lea edi, [edi + 0x45e8]
sub edi, 0x45e8
popf
jae 0x438985
jnp 0x438988
or dword [ebx - 0xaef7b3], 0x5e5ffc55
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43e0c3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0043280d
add esp, 0xc
xor esi, eax
xor esi, eax
xchg esi, esi
je 0x43e0e4
jge 0x43e0f3
pushf
jg 0x43e0ea
popf
jl 0x43e0ee
jp 0x43e0f0
jl 0x43e0f3
sub eax, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
jns 0x43e131
xor edx, ecx
xor edx, ecx
cmp edi, dword [esp]
xchg esp, esp
jno 0x43e157
pushf
sub esp, 0
shl edi, 0
add ecx, 0x1046
sub ecx, 0x1046
popf
jo 0x43e154
jo 0x43e157
mov esp, 0x80ec4d8a
jmp 0xec916961
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.0043e8fe
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43e1e1
jmp 0x43e25e
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00438b78
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0043280d
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x43e25e
sub edx, 0
xchg edi, ecx
xchg edi, ecx
jg 0x43e224
pushf
call 0x43e217
add esp, 4
stc
popf
xchg esi, ebx
xchg esi, ebx
jle 0x43e224
mov ecx, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.0041b3b3
add esp, 4
jle 0x43e232
jl 0x43e234
jb 0x43e236
js 0x43e24b
pushf
jno 0x43e23c
xor ebx, esi
xor ebx, esi
jp 0x43e242
ja 0x43e244
popf
js 0x43e248
jns 0x43e24b
call 0x51582fda
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b080
Capabilities:
Read file on windows
Read pipe

Disassembly:
add byte [eax], al
add byte [ebx - 0x17afa7bd], cl
xchg esp, eax
daa
dec dword [ebx + 0x5e5f0845]
sbb cl, byte [edx + 0xc6c1de5]
add byte [ebx + 0xc848d73], cl
push ecx
or al, 0
mov esi, dword [ebx - 0x73]
test byte [ecx + edx*2], cl
push edx
popal
push es
call fcn.0040b080
add esp, 0x10
cmp eax, 0x1117e
test byte [eax - 0x38f88af8], ah
loop 0x40b085
add dword [eax], eax
add byte [edx + 0x5f0c458b], dl
mov dword [esi], eax
mov eax, dword [ebp - 3]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xd0c
push ebp
mov ebx, ebp
push esi
mov esi, dword [ebp + 8]
jne 0x40b08f
cmp al, 0x8b
jge 0x40b09b
mov ecx, dword [eax + 0x10]
mov ecx, dword [esi + 0x5f]
dec esi
pop edi
or eax, ecx
rcl ecx, 1
adc byte [eax], al
add byte [eax], al
add dh, byte [ebp + 0x71]
mov al, byte [esi + 8]
test al, al
jge 0x40b10d
jno 0x40b027
inc esi
or byte [eax + eax*8 + 0x568b6a7d], al
add al, 0x5a
mov edx, dword [esi + 4]
pop edx
dec ebp
or byte [edx + 0x43], ch
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x40b03d
mov esp, dword [edi + sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
add byte [ecx], cl
mov ecx, dword [ebp + 0x14]
pop edi
pop esi
mov dword [ecx], eax
pop ebp
ret
mov ecx, dword [ecx + 0xc]
test eax, eax
je 0x40b137
mov dh, cl
or byte [ecx + ecx*8 + 0x4e8b1c75], al
push eax
std
dec esi
or byte [ebx + 0x56bc5046], cl
push esp
test esi, eax
sahf
mov al, 0
call fcn.0040b810
mov edx, dword [esi + 0x7e]
mov dword [edx + 0xc], eax
cmc
inc esi
or al, 0x8b
cmp edx, dword [edx + 0x3a4d0953]
push eax
mov eax, dword [esi + 4]
add edx, dword [edi + 0x52]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xchg ebp, eax
in eax, 0x74
pop es
xor eax, eax
jmp 0x416685