joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010a59e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x20], ebx
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
mov esi, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ecx
add eax, ecx
mov dword [ebp - 0x24], eax
cmp ecx, eax
jae 0x1010a6bc
push edi
mov eax, dword [edx + 0x68]
mov edi, dword [edx + 0x60]
add eax, ecx
add edi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x1c], eax
cmp ecx, eax
jae 0x1010a69e
movzx ebx, byte [ecx]
mov eax, dword [ebp - 8]
movzx edx, byte [edi + 1]
movzx edi, byte [ecx + 1]
mov ecx, ebx
and ecx, 0xe3
mov dword [ebp - 0xc], edx
movzx esi, byte [eax]
and edx, 0xe3
mov eax, esi
and eax, 0xe3
add ecx, eax
mov eax, edi
and eax, 0xe3
add eax, 0x42
add ecx, eax
mov eax, esi
add edx, ecx
and eax, 0x1c
mov ecx, ebx
shr edx, 2
and ecx, 0x1c
add ecx, eax
mov eax, edi
and eax, 0x1c
add ecx, eax
mov eax, dword [ebp - 0xc]
and eax, 0x1c
add eax, 8
add eax, ecx
mov ecx, 0xe3
shr eax, 2
and ebx, ecx
xor dl, al
and esi, ecx
mov eax, dword [ebp - 0xc]
and edi, ecx
and eax, ecx
add ebx, esi
mov ecx, dword [ebp - 4]
add ebx, edi
mov edi, dword [ebp - 8]
add eax, 0x42
add eax, ebx
and dl, 0x1c
shr eax, 2
add ecx, 2
xor dl, al
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x10]
add edi, 2
mov dword [ebp - 8], edi
mov byte [eax], dl
inc eax
mov dword [ebp - 0x10], eax
cmp ecx, dword [ebp - 0x1c]
jb 0x1010a5f1
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
add esi, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x14], esi
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x18], ecx
cmp ecx, dword [ebp - 0x24]
jb 0x1010a5d3
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x1010a766
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x20], ebx
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
mov esi, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ecx
add eax, ecx
mov dword [ebp - 0x24], eax
cmp ecx, eax
jae 0x1010a8a1
push edi
mov eax, dword [edx + 0x68]
mov edi, dword [edx + 0x60]
add edi, ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], ecx
lea eax, [ecx + eax*2]
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], eax
cmp ecx, eax
jae 0x1010a883
movzx ebx, word [ecx]
mov eax, dword [ebp - 4]
movzx edx, word [edi + 2]
movzx edi, word [ecx + 2]
and edx, 0xe3
mov ecx, ebx
movzx esi, word [eax]
and ecx, 0xe3
mov eax, esi
and eax, 0xe3
add ecx, eax
mov eax, edi
and eax, 0xe3
add eax, 0x42
add ecx, eax
mov eax, esi
add edx, ecx
and eax, 0xff1c
mov ecx, ebx
shr edx, 2
and ecx, 0xff1c
add ecx, eax
mov eax, edi
and eax, 0xff1c
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
movzx eax, word [ecx + 2]
mov ecx, dword [ebp - 0x18]
and eax, 0xff1c
add ecx, 0x208
add eax, ecx
mov ecx, 0xff1c
and ebx, ecx
shr eax, 2
and esi, ecx
and edi, ecx
xor edx, eax
add ebx, esi
add ebx, edi
and edx, 0xe3
mov edi, dword [ebp - 4]
movzx eax, word [edi + 2]
add edi, 4
and eax, ecx
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 8]
add eax, 0x208
add eax, ebx
add ecx, 4
shr eax, 2
xor edx, eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 0xc]
mov word [eax], dx
add eax, 2
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp - 0x1c]
jb 0x1010a7ba
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x10]
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
add esi, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x10], esi
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 0x24]
jb 0x1010a79b
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x1010a9bd
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
push ebx
push edi
mov ebx, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov edi, dword [edx + 0x20]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
add eax, edi
mov dword [ebp - 0x20], eax
cmp edi, eax
jae 0x1010aae2
push esi
mov eax, dword [edx + 0x60]
mov esi, edi
add eax, edi
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 0x68]
mov dword [ebp - 4], esi
lea eax, [edi + eax*2]
mov dword [ebp - 0x18], eax
cmp edi, eax
jae 0x1010aac4
mov edi, dword [ebp - 0x14]
movzx eax, word [esi]
movzx ebx, word [edi]
movzx edx, word [edi + 2]
movzx ecx, al
movzx eax, bl
add ecx, eax
movzx ebx, dl
movzx eax, word [esi + 2]
movzx eax, al
add eax, 2
mov dword [ebp - 0x14], edx
movzx edx, word [esi]
add ecx, eax
movzx esi, word [edi + 2]
add ebx, ecx
movzx ecx, word [edi]
mov eax, 0xff00
and ecx, eax
shr ebx, 2
and edx, eax
add ecx, esi
mov esi, dword [ebp - 4]
add ecx, edx
mov edx, dword [ebp - 4]
movzx eax, word [esi + 2]
mov esi, 0xff00
and eax, esi
add eax, 0x200
add eax, ecx
shr eax, 2
xor ebx, eax
movzx eax, word [edx]
movzx edx, word [edi]
and eax, esi
and edx, esi
movzx ecx, bl
mov esi, dword [ebp - 4]
lea edi, [edi + 4]
add edx, dword [ebp - 0x14]
add eax, edx
movzx ebx, word [esi + 2]
add esi, 4
and ebx, 0xff00
mov dword [ebp - 4], esi
add ebx, 0x200
add eax, ebx
shr eax, 2
xor ecx, eax
mov eax, dword [ebp - 8]
mov word [eax], cx
add eax, 2
mov dword [ebp - 8], eax
cmp esi, dword [ebp - 0x18]
jb 0x1010aa14
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
add ebx, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0xc], ebx
lea edi, [edi + eax*2]
mov dword [ebp - 0x10], edi
cmp edi, dword [ebp - 0x20]
jb 0x1010a9f0
pop esi
pop edi
xor eax, eax
pop ebx
leave
ret
Function at 0x1010aaee
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x24], ebx
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
mov esi, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ecx
add eax, ecx
mov dword [ebp - 0x28], eax
cmp ecx, eax
jae 0x1010abff
push edi
mov eax, dword [edx + 0x68]
mov edi, dword [edx + 0x60]
add eax, ecx
add edi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], eax
cmp ecx, eax
jae 0x1010abe1
movzx edx, byte [ecx + 1]
movzx esi, byte [edi + 1]
movzx eax, byte [edi]
movzx edi, byte [ecx]
mov dword [ebp - 8], eax
mov ecx, edi
mov dword [ebp - 0xc], edx
push 0xf
pop ebx
and eax, ebx
and ecx, ebx
add ecx, eax
and edx, ebx
add edx, 2
and ebx, esi
add ecx, edx
mov eax, 0xf0
add ebx, ecx
mov edx, edi
mov ecx, dword [ebp - 8]
and edx, eax
and ecx, eax
shr ebx, 2
mov eax, dword [ebp - 0xc]
add ecx, esi
and eax, 0xf0
add ecx, edx
add eax, 0x20
mov edx, 0xf0
add eax, ecx
and edi, edx
mov ecx, dword [ebp - 0xc]
shr eax, 2
and ecx, edx
xor bl, al
add ecx, 0x20
mov eax, dword [ebp - 8]
and bl, 0xf
and eax, edx
add eax, esi
add eax, edi
mov edi, dword [ebp - 0x14]
add eax, ecx
add edi, 2
mov ecx, dword [ebp - 4]
shr eax, 2
add ecx, 2
xor bl, al
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], edi
mov byte [eax], bl
inc eax
mov dword [ebp - 0x10], eax
cmp ecx, dword [ebp - 0x20]
jb 0x1010ab41
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
add esi, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x18], esi
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [ebp - 0x28]
jb 0x1010ab23
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x1014623d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0x2000000
xor edi, edi
mov esi, edx
push edi
push 0x10023194
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101462a3
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1014629f
cmp dword [ebp - 0xc], 4
jne 0x1014629f
inc edi
mov eax, edi
jmp 0x101462a5
xor eax, eax
pop edi
pop esi
leave
ret 8

Function at 0x10148862
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
lea eax, [ebp - 0x24]
push edi
xor edi, edi
push eax
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea edx, [eax + 0xffff]
neg eax
and edx, eax
mov dword [esi + 4], edx
pop edi
lea eax, [edx + 0xfffff]
neg edx
and eax, edx
mov dword [esi + 0x14], eax
mov eax, esi
pop esi
leave
ret 8
Function at 0x10169083
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov eax, dword [edi + 0x34]
push eax
mov edx, dword [eax]
mov esi, dword [edx + 0xc]
mov ecx, esi
call dword [0x101d83dc]
call esi
mov edx, eax
lea esi, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov ecx, dword [edx + 4]
mov ebx, dword [edx + 0xc]
add ebx, dword [eax]
xor eax, eax
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
test byte [ecx + 0x134], 1
jne 0x10169107
cmp dword [ebp + 0x10], eax
je 0x10169107
push eax
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__controlfp]
mov ecx, dword [ebp - 8]
push 0x30000
push 0
mov dword [ecx + 0x130], eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__controlfp]
mov ecx, dword [ebp - 8]
add esp, 0x10
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
or dword [ecx + 0x134], 1
cmp dword [edi + 0x38], 0
je 0x101691ea
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [edx + 0x10]
add esi, dword [eax]
mov dword [ebp - 0x10], esi
mov esi, dword [edx + 0x14]
add esi, dword [eax]
mov dword [ebp - 0x20], esi
mov esi, dword [edx + 0x18]
add esi, dword [eax]
mov dword [ebp - 0x1c], esi
xor esi, esi
cmp bx, word [edi + 0x4a]
mov ebx, dword [ebp - 0x14]
jae 0x101691e2
mov ebx, dword [ebp - 0x10]
movzx eax, si
imul edx, eax, 0x18
add edx, dword [edi + 0x30]
mov eax, dword [edx + 4]
mov eax, dword [eax + 8]
mov eax, dword [eax]
cmp eax, dword [ecx + 0x34]
jbe 0x101691ce
mov ecx, dword [edx + 8]
movzx eax, word [ecx + 4]
sub eax, 0
je 0x101691a9
sub eax, 1
je 0x1016918f
sub eax, 1
jne 0x101691cb
push ecx
lea eax, [ebp - 0xc]
push eax
movzx eax, word [ecx + 8]
push ecx
push dword [edi + 0x38]
push eax
movzx eax, word [ecx + 6]
shl eax, 5
add eax, ebx
push eax
mov eax, dword [edx + 4]
push eax
call fcn.10170344
jmp 0x101691cb
push ecx
lea eax, [ebp - 0xc]
push eax
movzx eax, word [ecx + 8]
push ecx
push dword [edi + 0x38]
push eax
movzx eax, word [ecx + 6]
shl eax, 5
add eax, dword [ebp - 0x1c]
jmp 0x10169183
push ecx
lea eax, [ebp - 0xc]
push eax
movzx eax, word [ecx + 8]
push ecx
push dword [edi + 0x38]
push eax
movzx eax, word [ecx + 6]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax*8]
push eax
mov eax, dword [edx + 4]
push eax
call fcn.10170718
mov ecx, dword [ebp - 8]
inc esi
cmp si, word [edi + 0x4a]
jb 0x10169140
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov esi, dword [eax]
add esi, dword [edx + 0x10]
mov eax, dword [edx + 8]
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [edi + 0x40]
push ecx
push ecx
push ecx
push eax
push 0
push ebx
push ebx
push ebx
push ecx
mov ecx, dword [edi + 0x3c]
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.10117742
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10173894
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
push edi
mov edi, edx
mov ebx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
cmp dword [ebx + 4], edi
je 0x101738b8
mov eax, dword [ebx]
mov eax, dword [eax + 8]
add eax, dword [ebx + 4]
jmp 0x101738ba
mov eax, edi
mov dword [edx], eax
movzx eax, word [ebx + 8]
mov dword [edx + 4], eax
movzx eax, word [ebx + 0xa]
mov dword [edx + 8], eax
movzx eax, word [ebx + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ebx + 0x18]
push esi
mov edi, dword [ebp + 8]
push 0
movzx eax, word [eax]
mov dword [edx + 0x10], eax
mov eax, dword [ebx + 0x18]
movzx eax, word [eax + 2]
mov dword [edx + 0x14], eax
mov eax, dword [ebx + 0x18]
movzx esi, word [eax + 4]
mov dword [edx + 0x18], esi
mov eax, dword [ebx + 0x18]
movzx ecx, word [eax + 6]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebx + 0x18]
movzx edx, word [eax + 8]
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], edx
mov eax, dword [ebx + 0x18]
imul edx, ecx
mov ecx, edi
movzx eax, word [eax + 0xa]
mov dword [edi + 0x24], eax
imul edx, esi
pop edi
pop esi
shl edx, 2
mov dword [ecx + 0x28], edx
mov edx, dword [ebx + 0x14]
test edx, edx
je 0x10173933
mov eax, dword [ebx]
mov edi, dword [eax + 8]
add edi, edx
mov dword [ecx + 0x2c], edi
xor eax, eax
pop edi
pop ebx
pop ebp
ret 4
Function at 0x101ba008
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x101ba045
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x101ba03e
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x101ba04a
add edx, 0x28
cmp edx, esi
jne 0x101ba02f
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x101ba047
Function at 0x40bd70
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40be24
jmp 0x40be19
cmp dword [esi + 0x10], 0x1000
jne 0x40be05
test byte [esi + 0x15], 1
jne 0x40be05
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x40bdc4
cmp eax, 2
je 0x40bdc4
cmp eax, 0x10
je 0x40bdc4
cmp eax, 0x20
jne 0x40bdd9
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40bdd9
mov bl, 1
xor ebp, ebp
jmp 0x40bdea
mov eax, dword [esi]
add eax, ebp
call fcn.0040bd68
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40bddd
test bl, bl
je 0x40be05
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40be24
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40bd9c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409b38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x409b47
pop dword [ebp - 0x44]
mov eax, 0x409b47
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x5a97f74
sub dword [ebp - 0x54], 0xb7573a29
mov dword [ebp - 0x50], 0x480b8312
add dword [ebp - 0x50], 0xea27c933
mov dword [ebp - 0x4c], 0x161be6bd
sub dword [ebp - 0x4c], 0xc9cfa28f
mov dword [ebp - 0x48], 0xa9e356ce
add dword [ebp - 0x48], 0x561ca932
lea eax, [ebp - 0x54]
push eax
mov eax, 0x9eefb971
sub eax, 0x9eaee91d
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xdfb7866f
add dword [ebp - 0x54], 0x94bae2e7
mov dword [ebp - 0x50], 0xf281c36a
add dword [ebp - 0x50], 0x4eea9e0b
mov dword [ebp - 0x4c], 0x4a862609
add dword [ebp - 0x4c], 0x18e94663
mov dword [ebp - 0x48], 0xc6aecdcf
sub dword [ebp - 0x48], 0xc6aecdcf
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xd9e3cea
add eax, 0xf2a29362
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3c822
push 0
call eax
mov ecx, 0x1da02d6b
sub ecx, 0x1d9fd98e
mov ebx, eax
mov esi, 0x41b000
add esi, dword [ebp - 0x44]
mov edx, 0x1fe6095a
sub edx, 0xe4ce2844
xor dword [ebp - 0x20], 0x9ad173e1
mov edi, dword [esi]
add dword [ebp - 0x30], 0x3e8036e
add edi, edx
xor dword [ebp - 0x30], 0xf05b8e8c
mov dword [ebx], edi
xor dword [ebp - 0x18], 0x26ba1ee8
add ebx, 4
add esi, 0xf5457ce1
sub esi, 0xf5457cdd
loop 0x409c5e
add eax, 0x5c2ca82c
add eax, 0xa3d49a1b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x64ec2a5d
sub ecx, 0x64ac2a5d
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x401ea2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401efd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401efd
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x401eec
cmp esi, ecx
jae 0x401efd
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x401eda
cmp esi, ecx
jae 0x401efd
cmp word [esi], 0
je 0x401efd
lfence
mov eax, esi
jmp 0x401eff
xor eax, eax
pop esi
pop ebp
ret
Function at 0x403e1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c0fe4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push 0xd
mov edi, ecx
mov dword [ebp - 0x14], 0x65796642
pop edx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0x3a3a6f75
mov dword [ebp - 0xc], 0x78776e37
mov byte [ebp - 8], 0
mov dword [ebp - 0x24], 0x747c7444
mov dword [ebp - 0x20], 0x7a6c4a79
mov dword [ebp - 0x1c], 0x57708072
mov word [ebp - 0x18], 0x8772
mov byte [ebp - 0x16], 0
call fcn.0040349a
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0xf
pop edx
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.0040349a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403ea7
push ebx
push 1
push dword [ebp + 8]
push 0x660e
push edi
call eax
jmp 0x403ea9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00541915
leave
ret

Function at 0x403eb8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5c0fe4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push 0xd
mov edi, ecx
mov dword [ebp - 0x28], eax
pop edx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x65796642
mov dword [ebp - 0x10], 0x3a3a6f75
mov dword [ebp - 0xc], 0x78776e37
mov byte [ebp - 8], 0
mov dword [ebp - 0x24], 0x747c7444
mov dword [ebp - 0x20], 0x6b6c4a79
mov dword [ebp - 0x1c], 0x807b837b
mov byte [ebp - 0x18], 0
call fcn.0040349a
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0xd
pop edx
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.0040349a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403f42
push dword [ebp - 0x28]
push ebx
push 0
push 1
push 0
push edi
call eax
jmp 0x403f44
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00541915
leave
ret

Function at 0x403f53
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c0fe4]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x5a4e80]
push esi
push edi
push 0xd
mov edi, ecx
mov dword [ebp - 0x14], 0x65796642
pop edx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0x3a3a6f75
mov dword [ebp - 0xc], 0x78776e37
mov byte [ebp - 8], 0
movups xmmword [ebp - 0x24], xmm0
call fcn.0040349a
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x10
pop edx
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.0040349a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403fbb
push edi
call eax
jmp 0x403fbd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00541915
leave
ret
Function at 0x403fcb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5c0fe4]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [str.DttyJlz]
push esi
push edi
push 0xd
mov edi, ecx
mov dword [ebp - 0x14], 0x65796642
pop edx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0x3a3a6f75
mov dword [ebp - 0xc], 0x78776e37
mov byte [ebp - 8], 0
movups xmmword [ebp - 0x28], xmm0
mov byte [ebp - 0x18], 0
call fcn.0040349a
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x11
pop edx
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0040349a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404037
push edi
call eax
jmp 0x404039
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00541915
leave
ret

Function at 0x404047
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5c0fe4]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x5a4eb0]
push esi
push edi
push 0xd
mov edi, ecx
mov dword [ebp - 0x14], 0x65796642
pop edx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0x3a3a6f75
mov dword [ebp - 0xc], 0x78776e37
mov byte [ebp - 8], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x878a76
call fcn.0040349a
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x14
pop edx
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0040349a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4040b8
push 0
push edi
call eax
jmp 0x4040ba
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00541915
leave
ret